From c9d7ce5bb434933f0dadd018afb24084d25e5194 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Tue, 22 Feb 2022 11:04:49 -0500 Subject: [PATCH] Delete packages from staging --- packages/gcp/1.4.0/changelog.yml | 94 - .../audit/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 261 - .../1.4.0/data_stream/audit/fields/agent.yml | 204 - .../data_stream/audit/fields/base-fields.yml | 20 - .../1.4.0/data_stream/audit/fields/ecs.yml | 144 - .../1.4.0/data_stream/audit/fields/fields.yml | 133 - .../audit/fields/package-fields.yml | 63 - .../gcp/1.4.0/data_stream/audit/manifest.yml | 56 - .../1.4.0/data_stream/audit/sample_event.json | 117 - .../dns/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 240 - .../1.4.0/data_stream/dns/fields/agent.yml | 204 - .../data_stream/dns/fields/base-fields.yml | 20 - .../gcp/1.4.0/data_stream/dns/fields/ecs.yml | 103 - .../1.4.0/data_stream/dns/fields/fields.yml | 48 - .../gcp/1.4.0/data_stream/dns/manifest.yml | 56 - .../1.4.0/data_stream/dns/sample_event.json | 74 - .../firewall/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 407 - .../data_stream/firewall/fields/agent.yml | 204 - .../firewall/fields/base-fields.yml | 20 - .../1.4.0/data_stream/firewall/fields/ecs.yml | 199 - .../data_stream/firewall/fields/fields.yml | 44 - .../firewall/fields/package-fields.yml | 63 - .../1.4.0/data_stream/firewall/manifest.yml | 56 - .../data_stream/firewall/sample_event.json | 118 - .../vpcflow/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 368 - .../data_stream/vpcflow/fields/agent.yml | 204 - .../vpcflow/fields/base-fields.yml | 20 - .../1.4.0/data_stream/vpcflow/fields/ecs.yml | 215 - .../data_stream/vpcflow/fields/fields.yml | 11 - .../vpcflow/fields/package-fields.yml | 63 - .../1.4.0/data_stream/vpcflow/manifest.yml | 56 - .../data_stream/vpcflow/sample_event.json | 105 - packages/gcp/1.4.0/docs/README.md | 884 - packages/gcp/1.4.0/img/filebeat-gcp-audit.png | Bin 507414 -> 0 bytes packages/gcp/1.4.0/img/logo_gcp.svg | 19 - ...-6576c480-73a2-11ea-a345-f985c61fe654.json | 59 - ...-a97de660-73a5-11ea-a345-f985c61fe654.json | 24 - ...-d88364c0-73a1-11ea-a345-f985c61fe654.json | 41 - ...-33ee1320-73a5-11ea-a345-f985c61fe654.json | 28 - ...-4627efa0-73a2-11ea-a345-f985c61fe654.json | 28 - ...-6d90d320-73a4-11ea-a345-f985c61fe654.json | 28 - ...-a8e40240-73a3-11ea-a345-f985c61fe654.json | 28 - ...-eb5bf570-73a2-11ea-a345-f985c61fe654.json | 28 - packages/gcp/1.4.0/manifest.yml | 61 - packages/gcp/1.4.1/changelog.yml | 99 - .../audit/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 261 - .../1.4.1/data_stream/audit/fields/agent.yml | 204 - .../data_stream/audit/fields/base-fields.yml | 20 - .../1.4.1/data_stream/audit/fields/ecs.yml | 144 - .../1.4.1/data_stream/audit/fields/fields.yml | 133 - .../audit/fields/package-fields.yml | 63 - .../gcp/1.4.1/data_stream/audit/manifest.yml | 56 - .../1.4.1/data_stream/audit/sample_event.json | 117 - .../dns/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 240 - .../1.4.1/data_stream/dns/fields/agent.yml | 204 - .../data_stream/dns/fields/base-fields.yml | 20 - .../gcp/1.4.1/data_stream/dns/fields/ecs.yml | 103 - .../1.4.1/data_stream/dns/fields/fields.yml | 48 - .../gcp/1.4.1/data_stream/dns/manifest.yml | 56 - .../1.4.1/data_stream/dns/sample_event.json | 74 - .../firewall/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 407 - .../data_stream/firewall/fields/agent.yml | 204 - .../firewall/fields/base-fields.yml | 20 - .../1.4.1/data_stream/firewall/fields/ecs.yml | 199 - .../data_stream/firewall/fields/fields.yml | 44 - .../firewall/fields/package-fields.yml | 63 - .../1.4.1/data_stream/firewall/manifest.yml | 56 - .../data_stream/firewall/sample_event.json | 118 - .../vpcflow/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 368 - .../data_stream/vpcflow/fields/agent.yml | 204 - .../vpcflow/fields/base-fields.yml | 20 - .../1.4.1/data_stream/vpcflow/fields/ecs.yml | 215 - .../data_stream/vpcflow/fields/fields.yml | 11 - .../vpcflow/fields/package-fields.yml | 63 - .../1.4.1/data_stream/vpcflow/manifest.yml | 56 - .../data_stream/vpcflow/sample_event.json | 105 - packages/gcp/1.4.1/docs/README.md | 884 - packages/gcp/1.4.1/img/filebeat-gcp-audit.png | Bin 507414 -> 0 bytes packages/gcp/1.4.1/img/logo_gcp.svg | 19 - ...-6576c480-73a2-11ea-a345-f985c61fe654.json | 59 - ...-a97de660-73a5-11ea-a345-f985c61fe654.json | 24 - ...-d88364c0-73a1-11ea-a345-f985c61fe654.json | 41 - ...-33ee1320-73a5-11ea-a345-f985c61fe654.json | 28 - ...-4627efa0-73a2-11ea-a345-f985c61fe654.json | 28 - ...-6d90d320-73a4-11ea-a345-f985c61fe654.json | 28 - ...-a8e40240-73a3-11ea-a345-f985c61fe654.json | 28 - ...-eb5bf570-73a2-11ea-a345-f985c61fe654.json | 28 - packages/gcp/1.4.1/manifest.yml | 61 - packages/juniper/1.1.0/changelog.yml | 96 - .../junos/agent/stream/stream.yml.hbs | 12572 -------- .../junos/agent/stream/tcp.yml.hbs | 12569 -------- .../junos/agent/stream/udp.yml.hbs | 12569 -------- .../elasticsearch/ingest_pipeline/default.yml | 71 - .../1.1.0/data_stream/junos/fields/agent.yml | 198 - .../data_stream/junos/fields/base-fields.yml | 46 - .../1.1.0/data_stream/junos/fields/ecs.yml | 506 - .../1.1.0/data_stream/junos/fields/fields.yml | 1754 - .../1.1.0/data_stream/junos/manifest.yml | 204 - .../1.1.0/data_stream/junos/sample_event.json | 73 - .../netscreen/agent/stream/logfile.yml.hbs | 26357 ---------------- .../netscreen/agent/stream/tcp.yml.hbs | 26354 --------------- .../netscreen/agent/stream/udp.yml.hbs | 26354 --------------- .../elasticsearch/ingest_pipeline/default.yml | 72 - .../data_stream/netscreen/fields/agent.yml | 198 - .../netscreen/fields/base-fields.yml | 46 - .../data_stream/netscreen/fields/ecs.yml | 506 - .../data_stream/netscreen/fields/fields.yml | 1754 - .../1.1.0/data_stream/netscreen/manifest.yml | 205 - .../data_stream/netscreen/sample_event.json | 61 - .../srx/agent/stream/logfile.yml.hbs | 20 - .../data_stream/srx/agent/stream/tcp.yml.hbs | 16 - .../data_stream/srx/agent/stream/udp.yml.hbs | 16 - .../srx/elasticsearch/ingest_pipeline/atp.yml | 364 - .../elasticsearch/ingest_pipeline/default.yml | 298 - .../elasticsearch/ingest_pipeline/flow.yml | 363 - .../srx/elasticsearch/ingest_pipeline/idp.yml | 288 - .../srx/elasticsearch/ingest_pipeline/ids.yml | 364 - .../ingest_pipeline/secintel.yml | 350 - .../srx/elasticsearch/ingest_pipeline/utm.yml | 391 - .../1.1.0/data_stream/srx/fields/agent.yml | 207 - .../data_stream/srx/fields/base-fields.yml | 20 - .../1.1.0/data_stream/srx/fields/ecs.yml | 2452 -- .../1.1.0/data_stream/srx/fields/fields.yml | 388 - .../1.1.0/data_stream/srx/manifest.yml | 133 - .../1.1.0/data_stream/srx/sample_event.json | 106 - packages/juniper/1.1.0/docs/README.md | 2455 -- packages/juniper/1.1.0/img/logo.svg | 72 - packages/juniper/1.1.0/manifest.yml | 32 - packages/o365/1.4.1/changelog.yml | 132 - .../audit/agent/stream/o365audit.yml.hbs | 39 - .../elasticsearch/ingest_pipeline/default.yml | 1041 - .../1.4.1/data_stream/audit/fields/agent.yml | 198 - .../data_stream/audit/fields/base-fields.yml | 20 - .../1.4.1/data_stream/audit/fields/beats.yml | 12 - .../1.4.1/data_stream/audit/fields/ecs.yml | 305 - .../1.4.1/data_stream/audit/fields/fields.yml | 199 - .../o365/1.4.1/data_stream/audit/manifest.yml | 103 - .../1.4.1/data_stream/audit/sample_event.json | 111 - packages/o365/1.4.1/docs/README.md | 361 - .../o365/1.4.1/img/filebeat-o365-audit.png | Bin 432036 -> 0 bytes .../img/filebeat-o365-azure-permissions.png | Bin 301548 -> 0 bytes .../img/logo-integrations-microsoft-365.svg | 16 - ...-712e2c00-685d-11ea-8d6a-292ef5d68366.json | 54 - ...-dbae13c0-685c-11ea-8d6a-292ef5d68366.json | 24 - ...-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json | 56 - ...-fdc14020-6859-11ea-8d6a-292ef5d68366.json | 35 - ...-0be1adb0-6860-11ea-8d6a-292ef5d68366.json | 28 - ...-897d0c70-6869-11ea-8d6a-292ef5d68366.json | 33 - ...-8b033510-685a-11ea-8d6a-292ef5d68366.json | 28 - ...-d43c95a0-6864-11ea-8d6a-292ef5d68366.json | 28 - packages/o365/1.4.1/manifest.yml | 35 - packages/zscaler/0.5.1/changelog.yml | 82 - .../zia/agent/stream/stream.yml.hbs | 2655 -- .../data_stream/zia/agent/stream/tcp.yml.hbs | 2652 -- .../data_stream/zia/agent/stream/udp.yml.hbs | 2652 -- .../elasticsearch/ingest_pipeline/default.yml | 72 - .../data_stream/zia/fields/base-fields.yml | 46 - .../0.5.1/data_stream/zia/fields/ecs.yml | 539 - .../0.5.1/data_stream/zia/fields/fields.yml | 1754 - .../0.5.1/data_stream/zia/manifest.yml | 204 - .../0.5.1/data_stream/zia/sample_event.json | 148 - packages/zscaler/0.5.1/docs/README.md | 798 - packages/zscaler/0.5.1/img/logo.svg | 1 - packages/zscaler/0.5.1/manifest.yml | 32 - packages/zscaler_zia/0.1.0/changelog.yml | 6 - .../alerts/agent/stream/tcp.yml.hbs | 23 - .../elasticsearch/ingest_pipeline/default.yml | 52 - .../0.1.0/data_stream/alerts/fields/agent.yml | 204 - .../data_stream/alerts/fields/base-fields.yml | 20 - .../0.1.0/data_stream/alerts/fields/ecs.yml | 33 - .../data_stream/alerts/fields/fields.yml | 14 - .../0.1.0/data_stream/alerts/manifest.yml | 41 - .../data_stream/alerts/sample_event.json | 61 - .../data_stream/dns/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 209 - .../0.1.0/data_stream/dns/fields/agent.yml | 204 - .../data_stream/dns/fields/base-fields.yml | 20 - .../0.1.0/data_stream/dns/fields/ecs.yml | 98 - .../0.1.0/data_stream/dns/fields/fields.yml | 48 - .../0.1.0/data_stream/dns/manifest.yml | 41 - .../0.1.0/data_stream/dns/sample_event.json | 124 - .../firewall/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 270 - .../data_stream/firewall/fields/agent.yml | 204 - .../firewall/fields/base-fields.yml | 20 - .../0.1.0/data_stream/firewall/fields/ecs.yml | 55 - .../data_stream/firewall/fields/fields.yml | 127 - .../0.1.0/data_stream/firewall/manifest.yml | 41 - .../data_stream/firewall/sample_event.json | 127 - .../tunnel/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 292 - .../0.1.0/data_stream/tunnel/fields/agent.yml | 204 - .../data_stream/tunnel/fields/base-fields.yml | 20 - .../0.1.0/data_stream/tunnel/fields/ecs.yml | 54 - .../data_stream/tunnel/fields/fields.yml | 113 - .../0.1.0/data_stream/tunnel/manifest.yml | 41 - .../data_stream/tunnel/sample_event.json | 115 - .../data_stream/web/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 308 - .../0.1.0/data_stream/web/fields/agent.yml | 204 - .../data_stream/web/fields/base-fields.yml | 20 - .../0.1.0/data_stream/web/fields/ecs.yml | 136 - .../0.1.0/data_stream/web/fields/fields.yml | 116 - .../0.1.0/data_stream/web/manifest.yml | 41 - .../0.1.0/data_stream/web/sample_event.json | 140 - packages/zscaler_zia/0.1.0/docs/README.md | 1121 - .../zscaler_zia/0.1.0/img/zscaler-logo.svg | 1 - .../0.1.0/img/zscaler-zia-screenshot.png | Bin 87669 -> 0 bytes ...-66597790-4ded-11ec-ad09-d9f49962d407.json | 72 - ...-85380a00-4de3-11ec-ad09-d9f49962d407.json | 72 - ...-9447f5b0-4eaf-11ec-9527-b704eaaa5c53.json | 57 - ...-d4977590-4de8-11ec-ad09-d9f49962d407.json | 42 - ...-48a188a0-4de8-11ec-ad09-d9f49962d407.json | 22 - ...-0334d8c0-4de4-11ec-ad09-d9f49962d407.json | 30 - ...-05cc16a0-4eae-11ec-9527-b704eaaa5c53.json | 25 - ...-2958ae90-4de5-11ec-ad09-d9f49962d407.json | 25 - ...-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53.json | 25 - ...-35612ae0-4de6-11ec-ad09-d9f49962d407.json | 25 - ...-3faec910-4ded-11ec-ad09-d9f49962d407.json | 25 - ...-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53.json | 25 - ...-4e583660-4deb-11ec-ad09-d9f49962d407.json | 25 - ...-5b68c940-4eaf-11ec-9527-b704eaaa5c53.json | 25 - ...-5ebff250-4de5-11ec-ad09-d9f49962d407.json | 25 - ...-63155460-4e82-11ec-ad09-d9f49962d407.json | 25 - ...-652829d0-4eb9-11ec-9527-b704eaaa5c53.json | 25 - ...-68d16b80-4de4-11ec-ad09-d9f49962d407.json | 30 - ...-6d29cc50-4de8-11ec-ad09-d9f49962d407.json | 25 - ...-72169a60-4deb-11ec-ad09-d9f49962d407.json | 25 - ...-7a0a40d0-4de3-11ec-ad09-d9f49962d407.json | 30 - ...-8058c4e0-4eae-11ec-9527-b704eaaa5c53.json | 25 - ...-91813c00-4de8-11ec-ad09-d9f49962d407.json | 25 - ...-9e6d2890-4deb-11ec-ad09-d9f49962d407.json | 25 - ...-a536b890-4e80-11ec-ad09-d9f49962d407.json | 30 - ...-a9ac0260-4de3-11ec-ad09-d9f49962d407.json | 30 - ...-bcddbd40-4ead-11ec-9527-b704eaaa5c53.json | 25 - ...-bd00f230-4de8-11ec-ad09-d9f49962d407.json | 25 - ...-c8b23580-4de3-11ec-ad09-d9f49962d407.json | 25 - ...-da1734d0-4deb-11ec-ad09-d9f49962d407.json | 25 - ...-db1241f0-4e80-11ec-ad09-d9f49962d407.json | 25 - ...-dff0d0b0-4dea-11ec-ad09-d9f49962d407.json | 30 - ...-e4f2aa20-4ead-11ec-9527-b704eaaa5c53.json | 25 - ...-e54e9f20-4de4-11ec-ad09-d9f49962d407.json | 25 - ...-f5a2e730-4deb-11ec-ad09-d9f49962d407.json | 25 - packages/zscaler_zia/0.1.0/manifest.yml | 70 - packages/zscaler_zpa/0.1.0/changelog.yml | 6 - .../agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 287 - .../app_connector_status/fields/agent.yml | 204 - .../fields/base-fields.yml | 20 - .../app_connector_status/fields/ecs.yml | 69 - .../app_connector_status/fields/fields.yml | 125 - .../app_connector_status/manifest.yml | 41 - .../app_connector_status/sample_event.json | 135 - .../audit/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 276 - .../0.1.0/data_stream/audit/fields/agent.yml | 204 - .../data_stream/audit/fields/base-fields.yml | 20 - .../0.1.0/data_stream/audit/fields/ecs.yml | 79 - .../0.1.0/data_stream/audit/fields/fields.yml | 43 - .../0.1.0/data_stream/audit/manifest.yml | 41 - .../0.1.0/data_stream/audit/sample_event.json | 89 - .../browser_access/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 306 - .../browser_access/fields/agent.yml | 204 - .../browser_access/fields/base-fields.yml | 20 - .../data_stream/browser_access/fields/ecs.yml | 117 - .../browser_access/fields/fields.yml | 127 - .../data_stream/browser_access/manifest.yml | 41 - .../browser_access/sample_event.json | 158 - .../user_activity/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 444 - .../user_activity/fields/agent.yml | 204 - .../user_activity/fields/base-fields.yml | 20 - .../data_stream/user_activity/fields/ecs.yml | 41 - .../user_activity/fields/fields.yml | 244 - .../data_stream/user_activity/manifest.yml | 41 - .../user_activity/sample_event.json | 159 - .../user_status/agent/stream/tcp.yml.hbs | 19 - .../elasticsearch/ingest_pipeline/default.yml | 239 - .../data_stream/user_status/fields/agent.yml | 204 - .../user_status/fields/base-fields.yml | 20 - .../data_stream/user_status/fields/ecs.yml | 40 - .../data_stream/user_status/fields/fields.yml | 93 - .../data_stream/user_status/manifest.yml | 41 - .../data_stream/user_status/sample_event.json | 130 - packages/zscaler_zpa/0.1.0/docs/README.md | 1248 - .../zscaler_zpa/0.1.0/img/zscaler-logo.svg | 1 - .../0.1.0/img/zscaler-zpa-screenshot.png | Bin 268761 -> 0 bytes ...-26cc19c0-4c44-11ec-9023-a76a2cb41dcd.json | 44 - ...-7511d7f0-4c49-11ec-9023-a76a2cb41dcd.json | 79 - ...-fa3c3c00-4c57-11ec-9023-a76a2cb41dcd.json | 74 - ...-fa5b1830-4c63-11ec-9023-a76a2cb41dcd.json | 49 - ...-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd.json | 24 - ...-43836b20-4c55-11ec-9023-a76a2cb41dcd.json | 24 - ...-5a0f9320-4c44-11ec-9023-a76a2cb41dcd.json | 24 - ...-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd.json | 24 - ...-d9d5e800-537b-11ec-9527-b704eaaa5c53.json | 39 - ...-17759700-4c5b-11ec-9023-a76a2cb41dcd.json | 32 - ...-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53.json | 27 - ...-1b5846e0-4c44-11ec-9023-a76a2cb41dcd.json | 27 - ...-23d03780-4eb8-11ec-9527-b704eaaa5c53.json | 27 - ...-2fffbd90-4d29-11ec-ad09-d9f49962d407.json | 27 - ...-4cf30750-4d0a-11ec-ad09-d9f49962d407.json | 32 - ...-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd.json | 27 - ...-552331e0-4c4f-11ec-9023-a76a2cb41dcd.json | 27 - ...-76176ed0-4c4e-11ec-9023-a76a2cb41dcd.json | 27 - ...-82076ba0-4e74-11ec-ad09-d9f49962d407.json | 42 - ...-860071f0-4c55-11ec-9023-a76a2cb41dcd.json | 27 - ...-89a91550-4c5a-11ec-9023-a76a2cb41dcd.json | 27 - ...-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd.json | 27 - ...-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd.json | 27 - ...-b0fa5650-4c55-11ec-9023-a76a2cb41dcd.json | 27 - ...-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd.json | 27 - ...-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd.json | 27 - ...-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd.json | 27 - ...-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd.json | 27 - ...-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd.json | 27 - ...-d8e44aa0-5992-11ec-b2d0-45019404f2e5.json | 27 - ...-e86c2d90-4c49-11ec-9023-a76a2cb41dcd.json | 27 - ...-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd.json | 27 - ...-f2e526e0-4c63-11ec-9023-a76a2cb41dcd.json | 27 - ...-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53.json | 27 - packages/zscaler_zpa/0.1.0/manifest.yml | 70 - 331 files changed, 169236 deletions(-) delete mode 100755 packages/gcp/1.4.0/changelog.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/fields/agent.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/fields/ecs.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/fields/fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/fields/package-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/manifest.yml delete mode 100755 packages/gcp/1.4.0/data_stream/audit/sample_event.json delete mode 100755 packages/gcp/1.4.0/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.0/data_stream/dns/fields/agent.yml delete mode 100755 packages/gcp/1.4.0/data_stream/dns/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/dns/fields/ecs.yml delete mode 100755 packages/gcp/1.4.0/data_stream/dns/fields/fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/dns/manifest.yml delete mode 100755 packages/gcp/1.4.0/data_stream/dns/sample_event.json delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/fields/agent.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/fields/ecs.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/fields/fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/fields/package-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/manifest.yml delete mode 100755 packages/gcp/1.4.0/data_stream/firewall/sample_event.json delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/fields/agent.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/fields/ecs.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/fields/fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/fields/package-fields.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/manifest.yml delete mode 100755 packages/gcp/1.4.0/data_stream/vpcflow/sample_event.json delete mode 100755 packages/gcp/1.4.0/docs/README.md delete mode 100755 packages/gcp/1.4.0/img/filebeat-gcp-audit.png delete mode 100755 packages/gcp/1.4.0/img/logo_gcp.svg delete mode 100755 packages/gcp/1.4.0/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.0/manifest.yml delete mode 100755 packages/gcp/1.4.1/changelog.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/fields/agent.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/fields/ecs.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/fields/fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/fields/package-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/manifest.yml delete mode 100755 packages/gcp/1.4.1/data_stream/audit/sample_event.json delete mode 100755 packages/gcp/1.4.1/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.1/data_stream/dns/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.1/data_stream/dns/fields/agent.yml delete mode 100755 packages/gcp/1.4.1/data_stream/dns/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/dns/fields/ecs.yml delete mode 100755 packages/gcp/1.4.1/data_stream/dns/fields/fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/dns/manifest.yml delete mode 100755 packages/gcp/1.4.1/data_stream/dns/sample_event.json delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/fields/agent.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/fields/ecs.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/fields/fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/fields/package-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/manifest.yml delete mode 100755 packages/gcp/1.4.1/data_stream/firewall/sample_event.json delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/fields/agent.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/fields/base-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/fields/ecs.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/fields/fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/fields/package-fields.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/manifest.yml delete mode 100755 packages/gcp/1.4.1/data_stream/vpcflow/sample_event.json delete mode 100755 packages/gcp/1.4.1/docs/README.md delete mode 100755 packages/gcp/1.4.1/img/filebeat-gcp-audit.png delete mode 100755 packages/gcp/1.4.1/img/logo_gcp.svg delete mode 100755 packages/gcp/1.4.1/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.4.1/manifest.yml delete mode 100755 packages/juniper/1.1.0/changelog.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/agent/stream/stream.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/junos/agent/stream/tcp.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/junos/agent/stream/udp.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/junos/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/fields/agent.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/fields/base-fields.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/fields/ecs.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/fields/fields.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/manifest.yml delete mode 100755 packages/juniper/1.1.0/data_stream/junos/sample_event.json delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/agent/stream/logfile.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/agent/stream/tcp.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/agent/stream/udp.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/fields/agent.yml delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/fields/base-fields.yml delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/fields/ecs.yml delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/fields/fields.yml delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/manifest.yml delete mode 100755 packages/juniper/1.1.0/data_stream/netscreen/sample_event.json delete mode 100755 packages/juniper/1.1.0/data_stream/srx/agent/stream/logfile.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/srx/agent/stream/tcp.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/srx/agent/stream/udp.yml.hbs delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/atp.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/flow.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/idp.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/ids.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/secintel.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/utm.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/fields/agent.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/fields/base-fields.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/fields/ecs.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/fields/fields.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/manifest.yml delete mode 100755 packages/juniper/1.1.0/data_stream/srx/sample_event.json delete mode 100755 packages/juniper/1.1.0/docs/README.md delete mode 100755 packages/juniper/1.1.0/img/logo.svg delete mode 100755 packages/juniper/1.1.0/manifest.yml delete mode 100755 packages/o365/1.4.1/changelog.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/agent/stream/o365audit.yml.hbs delete mode 100755 packages/o365/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/fields/agent.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/fields/beats.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/fields/ecs.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/fields/fields.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/manifest.yml delete mode 100755 packages/o365/1.4.1/data_stream/audit/sample_event.json delete mode 100755 packages/o365/1.4.1/docs/README.md delete mode 100755 packages/o365/1.4.1/img/filebeat-o365-audit.png delete mode 100755 packages/o365/1.4.1/img/filebeat-o365-azure-permissions.png delete mode 100755 packages/o365/1.4.1/img/logo-integrations-microsoft-365.svg delete mode 100755 packages/o365/1.4.1/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/map/o365-dbae13c0-685c-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/visualization/o365-0be1adb0-6860-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/visualization/o365-897d0c70-6869-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/visualization/o365-8b033510-685a-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/kibana/visualization/o365-d43c95a0-6864-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.4.1/manifest.yml delete mode 100755 packages/zscaler/0.5.1/changelog.yml delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/agent/stream/stream.yml.hbs delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/agent/stream/udp.yml.hbs delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/fields/base-fields.yml delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/fields/ecs.yml delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/fields/fields.yml delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/manifest.yml delete mode 100755 packages/zscaler/0.5.1/data_stream/zia/sample_event.json delete mode 100755 packages/zscaler/0.5.1/docs/README.md delete mode 100755 packages/zscaler/0.5.1/img/logo.svg delete mode 100755 packages/zscaler/0.5.1/manifest.yml delete mode 100755 packages/zscaler_zia/0.1.0/changelog.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml delete mode 100755 packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json delete mode 100755 packages/zscaler_zia/0.1.0/docs/README.md delete mode 100755 packages/zscaler_zia/0.1.0/img/zscaler-logo.svg delete mode 100755 packages/zscaler_zia/0.1.0/img/zscaler-zia-screenshot.png delete mode 100755 packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-66597790-4ded-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-85380a00-4de3-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-9447f5b0-4eaf-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-d4977590-4de8-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/map/zscaler_zia-48a188a0-4de8-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-0334d8c0-4de4-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-05cc16a0-4eae-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2958ae90-4de5-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-35612ae0-4de6-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-3faec910-4ded-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4e583660-4deb-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5b68c940-4eaf-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5ebff250-4de5-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-63155460-4e82-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-652829d0-4eb9-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-68d16b80-4de4-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-6d29cc50-4de8-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-72169a60-4deb-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-7a0a40d0-4de3-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-8058c4e0-4eae-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-91813c00-4de8-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-9e6d2890-4deb-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a536b890-4e80-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a9ac0260-4de3-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bcddbd40-4ead-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bd00f230-4de8-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-c8b23580-4de3-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-da1734d0-4deb-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-db1241f0-4e80-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-dff0d0b0-4dea-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e4f2aa20-4ead-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e54e9f20-4de4-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-f5a2e730-4deb-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zia/0.1.0/manifest.yml delete mode 100755 packages/zscaler_zpa/0.1.0/changelog.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/agent.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/base-fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/ecs.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/manifest.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/sample_event.json delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/fields/agent.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/fields/ecs.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/fields/fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/manifest.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/audit/sample_event.json delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/agent.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/base-fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/ecs.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/manifest.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/browser_access/sample_event.json delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/agent.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/base-fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/ecs.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/manifest.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_activity/sample_event.json delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/agent/stream/tcp.yml.hbs delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/agent.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/base-fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/ecs.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/fields.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/manifest.yml delete mode 100755 packages/zscaler_zpa/0.1.0/data_stream/user_status/sample_event.json delete mode 100755 packages/zscaler_zpa/0.1.0/docs/README.md delete mode 100755 packages/zscaler_zpa/0.1.0/img/zscaler-logo.svg delete mode 100755 packages/zscaler_zpa/0.1.0/img/zscaler-zpa-screenshot.png delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-26cc19c0-4c44-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-7511d7f0-4c49-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa3c3c00-4c57-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa5b1830-4c63-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-43836b20-4c55-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-5a0f9320-4c44-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-17759700-4c5b-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b5846e0-4c44-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-23d03780-4eb8-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-2fffbd90-4d29-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4cf30750-4d0a-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-552331e0-4c4f-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-76176ed0-4c4e-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-82076ba0-4e74-11ec-ad09-d9f49962d407.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-860071f0-4c55-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-89a91550-4c5a-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-b0fa5650-4c55-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d8e44aa0-5992-11ec-b2d0-45019404f2e5.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-e86c2d90-4c49-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f2e526e0-4c63-11ec-9023-a76a2cb41dcd.json delete mode 100755 packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53.json delete mode 100755 packages/zscaler_zpa/0.1.0/manifest.yml diff --git a/packages/gcp/1.4.0/changelog.yml b/packages/gcp/1.4.0/changelog.yml deleted file mode 100755 index 5232e6047a..0000000000 --- a/packages/gcp/1.4.0/changelog.yml +++ /dev/null @@ -1,94 +0,0 @@ -# newer versions go on top -- version: "1.4.0" - changes: - - description: Add gcp.dns integration - type: enhancement - link: https://github.com/elastic/integrations/pull/2624 -- version: "1.3.1" - changes: - - description: Add Ingest Pipeline script to map IANA Protocol Numbers - type: bugfix - link: https://github.com/elastic/integrations/pull/2470 -- version: "1.3.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2406 -- version: "1.2.2" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.2.1" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.2.0" - changes: - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2251 -- version: "1.1.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1965 -- version: "1.1.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1818 -- version: "1.1.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1661 -- version: "1.0.0" - changes: - - description: Move from experimental to GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1568 - - description: remove experimental from data_sets - type: enhancement - link: https://github.com/elastic/integrations/pull/1717 -- version: "0.3.3" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1478 -- version: '0.3.2' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1385 -- version: "0.3.1" - changes: - - description: Escape special characters in docs - type: enhancement - link: https://github.com/elastic/integrations/pull/1405 -- version: "0.3.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.2.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1240 -- version: "0.1.0" - changes: - - description: update to ECS 1.10.0 and adding event.original options - type: enhancement - link: https://github.com/elastic/integrations/pull/1045 -- version: "0.0.2" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/846 -- version: "0.0.1" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/459 diff --git a/packages/gcp/1.4.0/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.0/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index 578ef33758..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: {{credentials_json}} -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 306383af01..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,261 +0,0 @@ ---- -description: Pipeline for Google Cloud audit logs - -processors: - - set: - field: event.ingested - value: "{{_ingest.timestamp}}" - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - set: - field: event.kind - value: event - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - convert: - field: json.resource.labels.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - ignore_failure: true - - convert: - field: json.resource.labels.instance_id - target_field: cloud.instance.id - type: string - ignore_missing: true - ignore_failure: true - - rename: - field: "json.protoPayload.@type" - target_field: gcp.audit.type - ignore_missing: true - - rename: - field: json.protoPayload.authenticationInfo.principalEmail - target_field: gcp.audit.authentication_info.principal_email - ignore_missing: true - - set: - field: user.email - value: "{{gcp.audit.authentication_info.principal_email}}" - if: ctx?.gcp?.audit?.authentication_info?.principal_email != null - - rename: - field: json.protoPayload.authenticationInfo.authoritySelector - target_field: gcp.audit.authentication_info.authority_selector - ignore_missing: true - - rename: - field: json.protoPayload.authorizationInfo - target_field: gcp.audit.authorization_info - ignore_missing: true - - rename: - field: json.protoPayload.methodName - target_field: gcp.audit.method_name - ignore_missing: true - - set: - field: event.action - value: "{{gcp.audit.method_name}}" - if: ctx?.gcp?.audit?.method_name != null - - convert: - field: json.protoPayload.numResponseItems - target_field: gcp.audit.num_response_items - type: long - ignore_missing: true - - rename: - field: "json.protoPayload.request.@type" - target_field: gcp.audit.request.proto_name - ignore_missing: true - - rename: - field: json.protoPayload.request.filter - target_field: gcp.audit.request.filter - ignore_missing: true - - rename: - field: json.protoPayload.request.name - target_field: gcp.audit.request.name - ignore_missing: true - - rename: - field: json.protoPayload.request.resourceName - target_field: gcp.audit.request.resource_name - ignore_missing: true - - rename: - field: json.protoPayload.requestMetadata.callerIp - target_field: gcp.audit.request_metadata.caller_ip - ignore_missing: true - - set: - field: source.ip - value: "{{gcp.audit.request_metadata.caller_ip}}" - if: ctx?.gcp?.audit?.request_metadata?.caller_ip != null - - rename: - field: json.protoPayload.requestMetadata.callerSuppliedUserAgent - target_field: gcp.audit.request_metadata.caller_supplied_user_agent - ignore_missing: true - - set: - field: user_agent.original - value: "{{gcp.audit.request_metadata.caller_supplied_user_agent}}" - if: ctx?.gcp?.audit?.request_metadata?.caller_supplied_user_agent != null - - rename: - field: "json.protoPayload.response.@type" - target_field: gcp.audit.response.proto_name - ignore_missing: true - - rename: - field: json.protoPayload.response.status - target_field: gcp.audit.response.status - ignore_missing: true - - rename: - field: gcp.audit.response.status - target_field: gcp.audit.response.status.value - if: ctx?.gcp?.audit?.response?.status instanceof String - ignore_missing: true - - rename: - field: json.protoPayload.response.details.group - target_field: gcp.audit.response.details.group - ignore_missing: true - - rename: - field: json.protoPayload.response.details.kind - target_field: gcp.audit.response.details.kind - ignore_missing: true - - rename: - field: json.protoPayload.response.details.name - target_field: gcp.audit.response.details.name - ignore_missing: true - - rename: - field: json.protoPayload.response.details.uid - target_field: gcp.audit.response.details.uid - ignore_missing: true - - rename: - field: json.protoPayload.resourceName - target_field: gcp.audit.resource_name - ignore_missing: true - - rename: - field: json.protoPayload.resourceLocation.currentLocations - target_field: gcp.audit.resource_location.current_locations - ignore_missing: true - - rename: - field: json.protoPayload.serviceName - target_field: gcp.audit.service_name - ignore_missing: true - - set: - field: service.name - value: "{{gcp.audit.service_name}}" - if: ctx?.gcp?.audit?.service_name != null - - convert: - field: json.protoPayload.status.code - target_field: gcp.audit.status.code - type: long - ignore_missing: true - - foreach: - field: gcp.audit.authorization_info - ignore_missing: true - ignore_failure: true - processor: - rename: - field: _ingest._value.resourceAttributes - target_field: _ingest._value.resource_attributes - if: ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List - - set: - field: event.outcome - value: success - if: ctx?.gcp?.audit?.status?.code != null && ctx?.gcp?.audit?.status?.code == 0 - - set: - field: event.outcome - value: failure - if: ctx?.gcp?.audit?.status?.code != null && ctx?.gcp?.audit?.status?.code != 0 - - set: - field: event.outcome - value: success - if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && ctx?.gcp?.audit?.authorization_info[0].granted - - set: - field: event.outcome - value: failure - if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && !ctx?.gcp?.audit?.authorization_info[0].granted - - set: - field: event.outcome - value: unknown - if: ctx?.event?.outcome == null - - rename: - field: json.protoPayload.status.message - target_field: gcp.audit.status.message - ignore_missing: true - - user_agent: - field: user_agent.original - ignore_missing: true - # Orchestrator fields - - set: - field: orchestrator.type - value: kubernetes - if: ctx.json?.resource?.type == 'k8s_cluster' - - rename: - field: json.resource.labels.cluster_name - target_field: orchestrator.cluster.name - ignore_missing: true - if: ctx.json?.resource?.type == 'k8s_cluster' - - rename: - field: json.protoPayload.resourceName - target_field: orchestrator.resource.type_temp - ignore_missing: true - if: ctx.json?.resource?.type == 'k8s_cluster' - - grok: - field: orchestrator.resource.type_temp - patterns: - - '%{DATA}/%{API_VERSION:orchestrator.api_version}/namespaces/%{DATA:orchestrator.namespace}/%{RESOURCE_TYPE:orchestrator.resource.type}(/%{HOSTNAME:orchestrator.resource.name})?' - - '%{DATA}/%{API_VERSION:orchestrator.api_version}/%{RESOURCE_TYPE:orchestrator.resource.type}' - - 'apis/%{RESOURCE_TYPE:orchestrator.resource.type}/%{API_VERSION:orchestrator.api_version}' - - 'api/%{API_VERSION:orchestrator.api_version}' - - '%{RESOURCE_TYPE:orchestrator.resource.type}' - pattern_definitions: - API_VERSION: (v\d+([a-z]+)?(\d+)?) - RESOURCE_TYPE: ([a-z]+((\.[a-z0-9]+)+)?) - ignore_missing: true - - remove: - field: orchestrator.resource.type_temp - ignore_missing: true - - remove: - field: json - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/gcp/1.4.0/data_stream/audit/fields/agent.yml b/packages/gcp/1.4.0/data_stream/audit/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.0/data_stream/audit/fields/base-fields.yml b/packages/gcp/1.4.0/data_stream/audit/fields/base-fields.yml deleted file mode 100755 index 4a7da76510..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.audit diff --git a/packages/gcp/1.4.0/data_stream/audit/fields/ecs.yml b/packages/gcp/1.4.0/data_stream/audit/fields/ecs.yml deleted file mode 100755 index ceedc4d273..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/fields/ecs.yml +++ /dev/null @@ -1,144 +0,0 @@ -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: API version being used to carry out the action - name: orchestrator.api_version - type: keyword -- description: Name of the cluster. - name: orchestrator.cluster.name - type: keyword -- description: URL of the API used to manage the cluster. - name: orchestrator.cluster.url - type: keyword -- description: The version of the cluster. - name: orchestrator.cluster.version - type: keyword -- description: Namespace in which the action is taking place. - name: orchestrator.namespace - type: keyword -- description: Organization affected by the event (for multi-tenant orchestrator setups). - name: orchestrator.organization - type: keyword -- description: Name of the resource being acted upon. - name: orchestrator.resource.name - type: keyword -- description: Type of resource being acted upon. - name: orchestrator.resource.type - type: keyword -- description: Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry). - name: orchestrator.type - type: keyword -- description: |- - Name of the service data is collected from. - The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. - In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - name: service.name - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: user_agent.os.family - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: user_agent.os.kernel - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: user_agent.os.platform - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/gcp/1.4.0/data_stream/audit/fields/fields.yml b/packages/gcp/1.4.0/data_stream/audit/fields/fields.yml deleted file mode 100755 index a0951af4e6..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/fields/fields.yml +++ /dev/null @@ -1,133 +0,0 @@ -- name: gcp.audit - type: group - fields: - - name: type - type: keyword - description: | - Type property. - - name: authentication_info - type: group - fields: - - name: principal_email - type: keyword - description: "The email address of the authenticated user making the request. \n" - - name: authority_selector - type: keyword - description: "The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. \n" - - name: authorization_info - type: array - description: | - Authorization information for the operation. - fields: - - name: permission - type: keyword - description: "The required IAM permission. \n" - - name: granted - type: boolean - description: "Whether or not authorization for resource and permission was granted. \n" - - name: resource_attributes - type: group - fields: - - name: service - type: keyword - description: | - The name of the service. - - name: name - type: keyword - description: | - The name of the resource. - - name: type - type: keyword - description: | - The type of the resource. - - name: method_name - type: keyword - description: | - The name of the service method or operation. For API calls, this should be the name of the API method. For example, 'google.datastore.v1.Datastore.RunQuery'. - - name: num_response_items - type: long - description: | - The number of items returned from a List or Query API method, if applicable. - - name: request - type: group - fields: - - name: proto_name - type: keyword - description: | - Type property of the request. - - name: filter - type: keyword - description: | - Filter of the request. - - name: name - type: keyword - description: "Name of the request. \n" - - name: resource_name - type: keyword - description: "Name of the request resource. \n" - - name: request_metadata - type: group - fields: - - name: caller_ip - type: ip - description: "The IP address of the caller. \n" - - name: caller_supplied_user_agent - type: keyword - description: | - The user agent of the caller. This information is not authenticated and should be treated accordingly. - - name: response - type: group - fields: - - name: proto_name - type: keyword - description: | - Type property of the response. - - name: details - type: group - fields: - - name: group - type: keyword - description: | - The name of the group. - - name: kind - type: keyword - description: | - The kind of the response details. - - name: name - type: keyword - description: | - The name of the response details. - - name: uid - type: keyword - description: | - The uid of the response details. - - name: status.allowed - type: boolean - - name: status.reason - type: keyword - - name: status.value - type: keyword - - name: resource_name - type: keyword - description: | - The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. - - name: resource_location - type: group - fields: - - name: current_locations - type: keyword - description: | - Current locations of the resource. - - name: service_name - type: keyword - description: | - The name of the API service performing the operation. For example, datastore.googleapis.com. - - name: status - type: group - fields: - - name: code - type: integer - description: "The status code, which should be an enum value of google.rpc.Code. \n" - - name: message - type: keyword - description: "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. \n" diff --git a/packages/gcp/1.4.0/data_stream/audit/fields/package-fields.yml b/packages/gcp/1.4.0/data_stream/audit/fields/package-fields.yml deleted file mode 100755 index 88482fd9c1..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/fields/package-fields.yml +++ /dev/null @@ -1,63 +0,0 @@ -- name: gcp - type: group - fields: - - name: destination.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: destination.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. - - name: source.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: source.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. diff --git a/packages/gcp/1.4.0/data_stream/audit/manifest.yml b/packages/gcp/1.4.0/data_stream/audit/manifest.yml deleted file mode 100755 index bc65390c11..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) audit logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-audit - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-audit - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-audit - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) audit logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) audit logs using gcp-pubsub input diff --git a/packages/gcp/1.4.0/data_stream/audit/sample_event.json b/packages/gcp/1.4.0/data_stream/audit/sample_event.json deleted file mode 100755 index f94bbc8980..0000000000 --- a/packages/gcp/1.4.0/data_stream/audit/sample_event.json +++ /dev/null @@ -1,117 +0,0 @@ -{ - "@timestamp": "2019-12-19T00:44:25.051Z", - "agent": { - "ephemeral_id": "0365945c-c25a-4f02-b62c-a94a0b661f02", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "project": { - "id": "elastic-beats" - } - }, - "data_stream": { - "dataset": "gcp.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "beta.compute.instances.aggregatedList", - "agent_id_status": "verified", - "created": "2021-12-31T03:10:44.655Z", - "dataset": "gcp.audit", - "id": "yonau2dg2zi", - "ingested": "2021-12-31T03:10:45Z", - "kind": "event", - "outcome": "success" - }, - "gcp": { - "audit": { - "authentication_info": { - "principal_email": "xxx@xxx.xxx" - }, - "authorization_info": [ - { - "granted": true, - "permission": "compute.instances.list", - "resource_attributes": { - "name": "projects/elastic-beats", - "service": "resourcemanager", - "type": "resourcemanager.projects" - } - } - ], - "method_name": "beta.compute.instances.aggregatedList", - "num_response_items": 61, - "request": { - "proto_name": "type.googleapis.com/compute.instances.aggregatedList" - }, - "request_metadata": { - "caller_ip": "192.168.1.1", - "caller_supplied_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)" - }, - "resource_location": { - "current_locations": [ - "global" - ] - }, - "resource_name": "projects/elastic-beats/global/instances", - "response": { - "details": { - "group": "batch", - "kind": "jobs", - "name": "gsuite-exporter-1589294700", - "uid": "2beff34a-945f-11ea-bacf-42010a80007f" - }, - "proto_name": "core.k8s.io/v1.Status", - "status": { - "value": "Success" - } - }, - "service_name": "compute.googleapis.com", - "type": "type.googleapis.com/google.cloud.audit.AuditLog" - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access" - }, - "service": { - "name": "compute.googleapis.com" - }, - "source": { - "ip": "192.168.1.1" - }, - "tags": [ - "forwarded", - "gcp-audit" - ], - "user": { - "email": "xxx@xxx.xxx" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Firefox", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)", - "os": { - "full": "Mac OS X 10.15", - "name": "Mac OS X", - "version": "10.15" - }, - "version": "71.0." - } -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.0/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index 578ef33758..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: {{credentials_json}} -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index eca01434a2..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,240 +0,0 @@ ---- -description: Pipeline for Google Cloud DNS logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - set: - field: event.kind - value: event - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - convert: - field: json.resource.labels.project_id - target_field: cloud.project.id - type: string - ignore_failure: true - - convert: - field: json.resource.labels.location - target_field: cloud.region - type: string - ignore_failure: true - - rename: - field: json.jsonPayload.authAnswer - target_field: gcp.dns.auth_answer - ignore_missing: true - - rename: - field: json.jsonPayload.destinationIP - target_field: gcp.dns.destination_ip - ignore_missing: true - - set: - field: destination.address - copy_from: gcp.dns.destination_ip - ignore_failure: true - - convert: - field: gcp.dns.destination_ip - target_field: destination.ip - type: ip - ignore_failure: true - - rename: - field: json.jsonPayload.egressError - target_field: gcp.dns.egress_error - ignore_missing: true - - rename: - field: json.jsonPayload.protocol - target_field: gcp.dns.protocol - ignore_missing: true - - set: - field: network.transport - copy_from: gcp.dns.protocol - ignore_failure: true - - lowercase: - field: network.transport - ignore_missing: true - - rename: - field: json.jsonPayload.queryName - target_field: gcp.dns.query_name - ignore_missing: true - - set: - field: dns.question.name - copy_from: gcp.dns.query_name - ignore_failure: true - - gsub: - field: dns.question.name - pattern: "[.]$" - replacement: "" - ignore_failure: true - - registered_domain: - field: dns.question.name - target_field: dns.question - - remove: - field: dns.question.domain - ignore_missing: true - - rename: - field: json.jsonPayload.queryType - target_field: gcp.dns.query_type - ignore_missing: true - - set: - field: dns.question.type - copy_from: gcp.dns.query_type - ignore_failure: true - - rename: - field: json.jsonPayload.rdata - target_field: gcp.dns.rdata - ignore_missing: true - - script: - if: ctx?.gcp?.dns?.rdata != null - lang: painless - tag: Process DNS RData - description: This script processes the DNS RData into `dns.answers` and `dns.resolved_ip`. - source: | - def rdata = ctx.gcp.dns.rdata; - - def dns_answers = []; - def dns_resolved_ip = []; - - // Check for truncated answers. - def truncated = rdata.endsWith("...") ? 1 : 0; - - // Process answers. - def rdata_answers = /\n/.split(rdata); - - for (def i = 0; i < rdata_answers.length - truncated; i++) { - def answer_parts = /\t/.split(rdata_answers[i]); - - // Assign answer parts. - def name = answer_parts[0]; - def ttl = answer_parts[1]; - def cls = answer_parts[2]; - def type = answer_parts[3]; - def data = answer_parts[4]; - - // Remove trailing fullstop. - if (name.endsWith(".")) { - name = name.substring(0, name.length() - 1); - } - - if (data.endsWith(".")) { - data = data.substring(0, data.length() - 1); - } - - // Uppercase type. - type = type.toUpperCase(); - - dns_answers.add([ - "name": name, - "ttl": ttl, - "class": cls, - "type": type, - "data": data - ]); - - if (type == "A" || type == "AAAA") { - dns_resolved_ip.add(data); - } - } - - ctx.dns.answers = dns_answers; - ctx.dns.resolved_ip = dns_resolved_ip; - - rename: - field: json.jsonPayload.responseCode - target_field: gcp.dns.response_code - ignore_missing: true - - set: - field: dns.response_code - copy_from: gcp.dns.response_code - ignore_failure: true - - set: - field: event.outcome - value: success - if: ctx?.gcp?.dns?.response_code != null && ctx?.gcp?.dns?.response_code == "NOERROR" - - set: - field: event.outcome - value: failure - if: ctx?.gcp?.dns?.response_code != null && ctx?.gcp?.dns?.response_code != "NOERROR" - - rename: - field: json.jsonPayload.serverLatency - target_field: gcp.dns.server_latency - ignore_missing: true - - rename: - field: json.jsonPayload.sourceIP - target_field: gcp.dns.source_ip - ignore_missing: true - - set: - field: source.address - copy_from: gcp.dns.source_ip - ignore_failure: true - - convert: - field: gcp.dns.source_ip - target_field: source.ip - type: ip - ignore_failure: true - - rename: - field: json.jsonPayload.sourceNetwork - target_field: gcp.dns.source_network - ignore_missing: true - - rename: - field: json.jsonPayload.vmInstanceIdString - target_field: gcp.dns.vm_instance_id - ignore_missing: true - - set: - field: cloud.instance.id - copy_from: gcp.dns.vm_instance_id - ignore_failure: true - - rename: - field: json.jsonPayload.vmInstanceName - target_field: gcp.dns.vm_instance_name - ignore_missing: true - - set: - field: cloud.instance.name - copy_from: gcp.dns.vm_instance_name - ignore_failure: true - - gsub: - field: cloud.instance.name - pattern: "^.*[.]" - replacement: "" - ignore_failure: true - - rename: - field: json.jsonPayload.vmProjectId - target_field: gcp.dns.vm_project_id - ignore_missing: true - - rename: - field: json.jsonPayload.vmZoneName - target_field: gcp.dns.vm_zone_name - ignore_missing: true - - set: - field: cloud.availability_zone - copy_from: gcp.dns.vm_zone_name - ignore_failure: true - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/gcp/1.4.0/data_stream/dns/fields/agent.yml b/packages/gcp/1.4.0/data_stream/dns/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.0/data_stream/dns/fields/base-fields.yml b/packages/gcp/1.4.0/data_stream/dns/fields/base-fields.yml deleted file mode 100755 index bc80931b38..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.dns diff --git a/packages/gcp/1.4.0/data_stream/dns/fields/ecs.yml b/packages/gcp/1.4.0/data_stream/dns/fields/ecs.yml deleted file mode 100755 index d714c83a48..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/fields/ecs.yml +++ /dev/null @@ -1,103 +0,0 @@ -- description: |- - An array containing an object for each answer section returned by the server. - The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. - Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. - name: dns.answers - type: object -- description: The class of DNS data contained in this resource record. - name: dns.answers.class - type: keyword -- description: |- - The data describing the resource. - The meaning of this data depends on the type and class of the resource record. - name: dns.answers.data - type: keyword -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. - name: dns.answers.ttl - type: long -- description: The type of data contained in this resource record. - name: dns.answers.type - type: keyword -- description: |- - The name being queried. - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - name: dns.question.name - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - The highest registered domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: dns.question.registered_domain - type: keyword -- description: |- - The subdomain is all of the labels under the registered_domain. - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: dns.question.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: dns.question.top_level_domain - type: keyword -- description: |- - Array containing all IPs seen in `answers.data`. - The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. - name: dns.resolved_ip - type: ip -- description: The DNS response code. - name: dns.response_code - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/gcp/1.4.0/data_stream/dns/fields/fields.yml b/packages/gcp/1.4.0/data_stream/dns/fields/fields.yml deleted file mode 100755 index c0a98003d6..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/fields/fields.yml +++ /dev/null @@ -1,48 +0,0 @@ -- name: gcp.dns - type: group - fields: - - name: auth_answer - type: boolean - description: Authoritative answer. - - name: destination_ip - type: ip - description: Destination IP address, only applicable for forwarding cases. - - name: egress_error - type: keyword - description: Egress proxy error. - - name: protocol - type: keyword - description: Protocol TCP or UDP. - - name: query_name - type: keyword - description: DNS query name. - - name: query_type - type: keyword - description: DNS query type. - - name: rdata - type: keyword - description: DNS answer in presentation format, truncated to 260 bytes. - - name: response_code - type: keyword - description: Response code. - - name: server_latency - type: integer - description: Server latency. - - name: source_ip - type: ip - description: Source IP address of the query. - - name: source_network - type: keyword - description: Source network of the query. - - name: vm_instance_id - type: keyword - description: Compute Engine VM instance ID, only applicable to queries initiated by Compute Engine VMs. - - name: vm_instance_name - type: keyword - description: Compute Engine VM instance name, only applicable to queries initiated by Compute Engine VMs. - - name: vm_project_id - type: keyword - description: Google Cloud project ID, only applicable to queries initiated by Compute Engine VMs. - - name: vm_zone_name - type: keyword - description: Google Cloud VM zone, only applicable to queries initiated by Compute Engine VMs. diff --git a/packages/gcp/1.4.0/data_stream/dns/manifest.yml b/packages/gcp/1.4.0/data_stream/dns/manifest.yml deleted file mode 100755 index 668b7e2350..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) DNS logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-dns - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-dns - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-dns - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) DNS logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) DNS logs using gcp-pubsub input diff --git a/packages/gcp/1.4.0/data_stream/dns/sample_event.json b/packages/gcp/1.4.0/data_stream/dns/sample_event.json deleted file mode 100755 index 9cd568cf68..0000000000 --- a/packages/gcp/1.4.0/data_stream/dns/sample_event.json +++ /dev/null @@ -1,74 +0,0 @@ -{ - "@timestamp": "2022-01-23T09:16:05.341Z", - "cloud": { - "availability_zone": "europe-west2-a", - "instance": { - "id": "8340998530665147", - "name": "instance" - }, - "project": { - "id": "project" - }, - "region": "europe-west2" - }, - "dns": { - "answers": [ - { - "class": "IN", - "data": "127.0.0.1", - "name": "elastic.co", - "ttl": "300", - "type": "A" - } - ], - "question": { - "name": "elastic.co", - "registered_domain": "elastic.co", - "top_level_domain": "co", - "type": "A" - }, - "resolved_ip": [ - "127.0.0.1" - ], - "response_code": "NOERROR" - }, - "ecs": { - "version": "8.0.0" - }, - "event": { - "id": "vwroyze8pg7y", - "kind": "event", - "outcome": "success", - "original": "{\"insertId\":\"vwroyze8pg7y\",\"jsonPayload\":{\"authAnswer\":true,\"protocol\":\"UDP\",\"queryName\":\"elastic.co.\",\"queryType\":\"A\",\"rdata\":\"elastic.co.\\t300\\tIN\\ta\\t127.0.0.1\",\"responseCode\":\"NOERROR\",\"serverLatency\":14,\"sourceIP\":\"10.154.0.3\",\"sourceNetwork\":\"default\",\"vmInstanceId\":8340998530665147,\"vmInstanceIdString\":\"8340998530665147\",\"vmInstanceName\":\"694119234537.instance\",\"vmProjectId\":\"project\",\"vmZoneName\":\"europe-west2-a\"},\"logName\":\"projects/project/logs/dns.googleapis.com%2Fdns_queries\",\"receiveTimestamp\":\"2022-01-23T09:16:05.502805637Z\",\"resource\":{\"labels\":{\"location\":\"europe-west2\",\"project_id\":\"project\",\"source_type\":\"gce-vm\",\"target_name\":\"\",\"target_type\":\"external\"},\"type\":\"dns_query\"},\"severity\":\"INFO\",\"timestamp\":\"2022-01-23T09:16:05.341873447Z\"}" - }, - "gcp": { - "dns": { - "auth_answer": true, - "protocol": "UDP", - "query_name": "elastic.co.", - "query_type": "A", - "rdata": "elastic.co.\t300\tIN\ta\t127.0.0.1", - "response_code": "NOERROR", - "server_latency": 14, - "source_ip": "10.154.0.3", - "source_network": "default", - "vm_instance_id": "8340998530665147", - "vm_instance_name": "694119234537.instance", - "vm_project_id": "project", - "vm_zone_name": "europe-west2-a" - } - }, - "log": { - "logger": "projects/project/logs/dns.googleapis.com%2Fdns_queries" - }, - "network": { - "transport": "udp" - }, - "source": { - "address": "10.154.0.3", - "ip": "10.154.0.3" - }, - "tags": [ - "preserve_original_event" - ] -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.0/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index 578ef33758..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: {{credentials_json}} -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index a23c18f27e..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,407 +0,0 @@ ---- -description: Pipeline for Google Cloud Firewall Logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - community_id: - source_ip: json.jsonPayload.connection.src_ip - source_port: json.jsonPayload.connection.src_port - destination_ip: json.jsonPayload.connection.dest_ip - destination_port: json.jsonPayload.connection.dest_port - iana_number: json.jsonPayload.connection.protocol - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - set: - field: event.kind - value: event - - set: - field: event.category - value: network - - set: - field: event.action - value: firewall-rule - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - rename: - field: json.resource.labels.subnetwork_name - target_field: network.name - ignore_missing: true - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - rename: - field: json.jsonPayload.disposition - target_field: event.type - if: ctx?.json?.jsonPayload?.disposition != null - - set: - field: event.type - value: connection - if: ctx?.event?.type != null - - lowercase: - field: event.type - - set: - field: network.direction - value: inbound - if: ctx?.json?.jsonPayload?.rule_details?.direction == "INGRESS" - - set: - field: network.direction - value: outbound - if: ctx?.json?.jsonPayload?.rule_details?.direction == "EGRESS" - - set: - field: network.direction - value: unknown - if: ctx?.network?.direction == null - - rename: - field: json.jsonPayload.vpc - target_field: json.jsonPayload.src_vpc - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.instance - target_field: json.jsonPayload.src_instance - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.location - target_field: json.jsonPayload.src_location - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_vpc - target_field: json.jsonPayload.dest_vpc - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_instance - target_field: json.jsonPayload.dest_instance - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_location - target_field: json.jsonPayload.dest_location - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.vpc - target_field: json.jsonPayload.dest_vpc - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.instance - target_field: json.jsonPayload.dest_instance - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.location - target_field: json.jsonPayload.dest_location - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_vpc - target_field: json.jsonPayload.src_vpc - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_instance - target_field: json.jsonPayload.src_instance - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_location - target_field: json.jsonPayload.src_location - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.connection.protocol - target_field: network.iana_number - ignore_missing: true - - convert: - field: network.iana_number - type: string - ignore_missing: true - - script: - lang: painless - ignore_failure: true - if: ctx?.network?.iana_number != null - source: | - def iana_number = ctx.network.iana_number; - if (iana_number == '0') { - ctx.network.transport = 'hopopt'; - } else if (iana_number == '1') { - ctx.network.transport = 'icmp'; - } else if (iana_number == '2') { - ctx.network.transport = 'igmp'; - } else if (iana_number == '6') { - ctx.network.transport = 'tcp'; - } else if (iana_number == '8') { - ctx.network.transport = 'egp'; - } else if (iana_number == '17') { - ctx.network.transport = 'udp'; - } else if (iana_number == '47') { - ctx.network.transport = 'gre'; - } else if (iana_number == '50') { - ctx.network.transport = 'esp'; - } else if (iana_number == '58') { - ctx.network.transport = 'ipv6-icmp'; - } else if (iana_number == '112') { - ctx.network.transport = 'vrrp'; - } else if (iana_number == '132') { - ctx.network.transport = 'sctp'; - } - - rename: - field: json.jsonPayload.connection.dest_ip - target_field: destination.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.dest_port - target_field: destination.port - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_ip - target_field: source.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_port - target_field: source.port - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance.vm_name - target_field: source.domain - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance.vm_name - target_field: destination.domain - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.continent - target_field: destination.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.country - target_field: destination.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.region - target_field: destination.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.city - target_field: destination.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.continent - target_field: source.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.country - target_field: source.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.region - target_field: source.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.city - target_field: source.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance - target_field: gcp.destination.instance - ignore_missing: true - - rename: - field: json.jsonPayload.dest_vpc - target_field: gcp.destination.vpc - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance - target_field: gcp.source.instance - ignore_missing: true - - rename: - field: json.jsonPayload.src_vpc - target_field: gcp.source.vpc - ignore_missing: true - - rename: - field: json.jsonPayload.rule_details.reference - target_field: rule.name - ignore_missing: true - - set: - field: source.ip - value: "{{source.address}}" - if: ctx?.source?.address != null - ignore_failure: true - - set: - field: destination.ip - value: "{{destination.address}}" - if: ctx?.destination?.address != null - ignore_failure: true - - convert: - field: gcp.source.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.destination.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.network?.direction == "inbound" - - set: - field: network.direction - value: internal - if: ctx?.gcp?.source?.instance == ctx?.gcp?.destination?.instance - - set: - field: network.type - value: ipv4 - if: ctx?.source?.ip != null && ctx?.source?.ip.contains(".") - - set: - field: network.type - value: ipv6 - if: ctx?.source?.ip != null && !ctx?.source?.ip.contains(".") - - rename: - field: json.jsonPayload.rule_details - target_field: gcp.firewall.rule_details - ignore_missing: true - - append: - field: related.ip - value: "{{source.ip}}" - allow_duplicates: false - if: ctx?.source?.ip != null && ctx?.source?.ip != "" - - append: - field: related.ip - value: "{{destination.ip}}" - allow_duplicates: false - if: ctx?.destination?.ip != null && ctx?.destination?.ip != "" - - remove: - field: - - gcp.firewall.connection - - gcp.firewall.dest_location - - gcp.firewall.disposition - - gcp.firewall.src_location - - json - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/gcp/1.4.0/data_stream/firewall/fields/agent.yml b/packages/gcp/1.4.0/data_stream/firewall/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.0/data_stream/firewall/fields/base-fields.yml b/packages/gcp/1.4.0/data_stream/firewall/fields/base-fields.yml deleted file mode 100755 index 93e2a6ab3b..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.firewall diff --git a/packages/gcp/1.4.0/data_stream/firewall/fields/ecs.yml b/packages/gcp/1.4.0/data_stream/firewall/fields/ecs.yml deleted file mode 100755 index db6f5e0d91..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/fields/ecs.yml +++ /dev/null @@ -1,199 +0,0 @@ -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: destination.geo.name - type: keyword -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Port of the destination. - name: destination.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: Name given by operators to sections of their network. - name: network.name - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/gcp/1.4.0/data_stream/firewall/fields/fields.yml b/packages/gcp/1.4.0/data_stream/firewall/fields/fields.yml deleted file mode 100755 index 98681562b2..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/fields/fields.yml +++ /dev/null @@ -1,44 +0,0 @@ -- name: gcp.firewall - type: group - fields: - - name: rule_details - type: group - fields: - - name: priority - type: long - description: The priority for the firewall rule. - - name: action - type: keyword - description: Action that the rule performs on match. - - name: direction - type: keyword - description: Direction of traffic that matches this rule. - - name: reference - type: keyword - description: Reference to the firewall rule. - - name: source_range - type: keyword - description: List of source ranges that the firewall rule applies to. - - name: destination_range - type: keyword - description: List of destination ranges that the firewall applies to. - - name: source_tag - type: keyword - description: | - List of all the source tags that the firewall rule applies to. - - name: target_tag - type: keyword - description: | - List of all the target tags that the firewall rule applies to. - - name: ip_port_info - type: array - description: | - List of ip protocols and applicable port ranges for rules. - - name: source_service_account - type: keyword - description: | - List of all the source service accounts that the firewall rule applies to. - - name: target_service_account - type: keyword - description: | - List of all the target service accounts that the firewall rule applies to. diff --git a/packages/gcp/1.4.0/data_stream/firewall/fields/package-fields.yml b/packages/gcp/1.4.0/data_stream/firewall/fields/package-fields.yml deleted file mode 100755 index 88482fd9c1..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/fields/package-fields.yml +++ /dev/null @@ -1,63 +0,0 @@ -- name: gcp - type: group - fields: - - name: destination.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: destination.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. - - name: source.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: source.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. diff --git a/packages/gcp/1.4.0/data_stream/firewall/manifest.yml b/packages/gcp/1.4.0/data_stream/firewall/manifest.yml deleted file mode 100755 index 1262782381..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) firewall logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-firewall - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-firewall - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-firewall - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) firewall logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) firewall logs using gcp-pubsub input diff --git a/packages/gcp/1.4.0/data_stream/firewall/sample_event.json b/packages/gcp/1.4.0/data_stream/firewall/sample_event.json deleted file mode 100755 index 34c5396a1d..0000000000 --- a/packages/gcp/1.4.0/data_stream/firewall/sample_event.json +++ /dev/null @@ -1,118 +0,0 @@ -{ - "@timestamp": "2019-10-30T13:52:42.191Z", - "agent": { - "ephemeral_id": "4fed48b9-0848-4ceb-88b1-30fb7da99604", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "availability_zone": "us-east1-b", - "project": { - "id": "test-beats" - }, - "region": "us-east1" - }, - "data_stream": { - "dataset": "gcp.firewall", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "10.42.0.2", - "domain": "test-windows", - "ip": "10.42.0.2", - "port": 3389 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "firewall-rule", - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:11:30.136Z", - "dataset": "gcp.firewall", - "id": "1f21ciqfpfssuo", - "ingested": "2021-12-31T03:11:31Z", - "kind": "event", - "type": "connection" - }, - "gcp": { - "destination": { - "instance": { - "project_id": "test-beats", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "test-beats", - "subnetwork_name": "windows-isolated", - "vpc_name": "windows-isolated" - } - }, - "firewall": { - "rule_details": { - "action": "ALLOW", - "direction": "INGRESS", - "ip_port_info": [ - { - "ip_protocol": "TCP", - "port_range": [ - "3389" - ] - } - ], - "priority": 1000, - "source_range": [ - "0.0.0.0/0" - ], - "target_tag": [ - "allow-rdp" - ] - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/test-beats/logs/compute.googleapis.com%2Ffirewall" - }, - "network": { - "community_id": "1:OdLB9eXsBDLz8m97ao4LepX6q+4=", - "direction": "inbound", - "iana_number": "6", - "name": "windows-isolated", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.2.126", - "10.42.0.2" - ] - }, - "rule": { - "name": "network:windows-isolated/firewall:windows-isolated-allow-rdp" - }, - "source": { - "address": "192.168.2.126", - "geo": { - "continent_name": "Asia", - "country_name": "omn" - }, - "ip": "192.168.2.126", - "port": 64853 - }, - "tags": [ - "forwarded", - "gcp-firewall" - ] -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.0/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index 578ef33758..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: {{credentials_json}} -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.0/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 2370c3e3c9..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,368 +0,0 @@ ---- -description: Pipeline for Google Cloud VPC Flow Logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - community_id: - source_ip: json.jsonPayload.connection.src_ip - source_port: json.jsonPayload.connection.src_port - destination_ip: json.jsonPayload.connection.dest_ip - destination_port: json.jsonPayload.connection.dest_port - iana_number: json.jsonPayload.connection.protocol - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - set: - field: event.kind - value: event - - set: - field: event.category - value: network - - set: - field: event.type - value: connection - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - rename: - field: json.jsonPayload.connection.dest_ip - target_field: destination.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.dest_port - target_field: destination.port - ignore_missing: true - - rename: - field: json.jsonPayload.connection.protocol - target_field: network.iana_number - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_ip - target_field: source.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_port - target_field: source.port - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance.vm_name - target_field: source.domain - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance.vm_name - target_field: destination.domain - ignore_missing: true - - rename: - field: json.jsonPayload.bytes_sent - target_field: source.bytes - ignore_missing: true - - rename: - field: json.jsonPayload.packets_sent - target_field: source.packets - ignore_missing: true - - rename: - field: json.jsonPayload.start_time - target_field: event.start - ignore_missing: true - - rename: - field: json.jsonPayload.end_time - target_field: event.end - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.continent - target_field: destination.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.country - target_field: destination.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.region - target_field: destination.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.city - target_field: destination.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.continent - target_field: source.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.country - target_field: source.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.region - target_field: source.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.city - target_field: source.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance - target_field: gcp.destination.instance - ignore_missing: true - - rename: - field: json.jsonPayload.dest_vpc - target_field: gcp.destination.vpc - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance - target_field: gcp.source.instance - ignore_missing: true - - rename: - field: json.jsonPayload.src_vpc - target_field: gcp.source.vpc - ignore_missing: true - - convert: - field: json.jsonPayload.rtt_msec - target_field: json.jsonPayload.rtt.ms - type: long - ignore_missing: true - - rename: - field: json.jsonPayload - target_field: gcp.vpcflow - ignore_missing: true - - convert: - field: source.bytes - type: long - ignore_missing: true - - convert: - field: source.packets - type: long - ignore_missing: true - - convert: - field: network.iana_number - type: string - ignore_missing: true - - script: - lang: painless - ignore_failure: true - if: ctx?.network?.iana_number != null - source: | - def iana_number = ctx.network.iana_number; - if (iana_number == '0') { - ctx.network.transport = 'hopopt'; - } else if (iana_number == '1') { - ctx.network.transport = 'icmp'; - } else if (iana_number == '2') { - ctx.network.transport = 'igmp'; - } else if (iana_number == '6') { - ctx.network.transport = 'tcp'; - } else if (iana_number == '8') { - ctx.network.transport = 'egp'; - } else if (iana_number == '17') { - ctx.network.transport = 'udp'; - } else if (iana_number == '47') { - ctx.network.transport = 'gre'; - } else if (iana_number == '50') { - ctx.network.transport = 'esp'; - } else if (iana_number == '58') { - ctx.network.transport = 'ipv6-icmp'; - } else if (iana_number == '112') { - ctx.network.transport = 'vrrp'; - } else if (iana_number == '132') { - ctx.network.transport = 'sctp'; - } - - remove: - field: - - gcp.vpcflow.rtt_msec - - gcp.vpcflow.connection - - gcp.vpcflow.dest_location - - gcp.vpcflow.src_location - - json - ignore_missing: true - - set: - field: source.ip - value: "{{source.address}}" - ignore_failure: true - if: ctx?.source?.address != null - - set: - field: destination.ip - value: "{{destination.address}}" - ignore_failure: true - if: ctx?.destination?.address != null - - convert: - field: gcp.source.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.destination.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: source.bytes - type: long - target_field: network.bytes - ignore_missing: true - - convert: - field: source.packets - type: long - target_field: network.packets - ignore_missing: true - - set: - field: network.direction - value: internal - if: ctx?.gcp?.source?.instance != null && ctx?.gcp?.destination?.instance != null - - set: - field: network.direction - value: outbound - if: ctx?.gcp?.source?.instance != null && ctx?.gcp?.destination?.instance == null - - set: - field: network.direction - value: inbound - if: ctx?.gcp?.source?.instance == null && ctx?.gcp?.destination?.instance != null - - set: - field: network.direction - value: unknown - if: ctx?.network?.direction == null - - set: - field: network.type - value: ipv4 - if: ctx?.source?.ip != null && ctx?.source?.ip.contains(".") - - set: - field: network.type - value: ipv6 - if: ctx?.source?.ip != null && !ctx?.source?.ip.contains(".") - - append: - field: related.ip - value: "{{source.ip}}" - allow_duplicates: false - if: ctx?.source?.ip != null && ctx?.source?.ip != "" - - append: - field: related.ip - value: "{{destination.ip}}" - allow_duplicates: false - if: ctx?.destination?.ip != null && ctx?.destination?.ip != "" - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/fields/agent.yml b/packages/gcp/1.4.0/data_stream/vpcflow/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/fields/base-fields.yml b/packages/gcp/1.4.0/data_stream/vpcflow/fields/base-fields.yml deleted file mode 100755 index 09f5a3a04a..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.vpcflow diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/fields/ecs.yml b/packages/gcp/1.4.0/data_stream/vpcflow/fields/ecs.yml deleted file mode 100755 index d5927f4874..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/fields/ecs.yml +++ /dev/null @@ -1,215 +0,0 @@ -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: destination.geo.name - type: keyword -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Port of the destination. - name: destination.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: Name given by operators to sections of their network. - name: network.name - type: keyword -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/fields/fields.yml b/packages/gcp/1.4.0/data_stream/vpcflow/fields/fields.yml deleted file mode 100755 index afd0aca3fa..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/fields/fields.yml +++ /dev/null @@ -1,11 +0,0 @@ -- name: gcp.vpcflow - type: group - fields: - - name: reporter - type: keyword - description: | - The side which reported the flow. Can be either 'SRC' or 'DEST'. - - name: rtt.ms - type: long - description: | - Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay. diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/fields/package-fields.yml b/packages/gcp/1.4.0/data_stream/vpcflow/fields/package-fields.yml deleted file mode 100755 index 88482fd9c1..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/fields/package-fields.yml +++ /dev/null @@ -1,63 +0,0 @@ -- name: gcp - type: group - fields: - - name: destination.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: destination.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. - - name: source.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: source.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/manifest.yml b/packages/gcp/1.4.0/data_stream/vpcflow/manifest.yml deleted file mode 100755 index 5b4ca90446..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) vpcflow logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-vpcflow - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-vpcflow - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-vpcflow - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) vpcflow logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) vpcflow logs using gcp-pubsub input diff --git a/packages/gcp/1.4.0/data_stream/vpcflow/sample_event.json b/packages/gcp/1.4.0/data_stream/vpcflow/sample_event.json deleted file mode 100755 index 1fc30d133a..0000000000 --- a/packages/gcp/1.4.0/data_stream/vpcflow/sample_event.json +++ /dev/null @@ -1,105 +0,0 @@ -{ - "@timestamp": "2019-06-14T03:50:10.845Z", - "agent": { - "ephemeral_id": "e58d02a0-e7a0-45c0-aba6-a8c983782744", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "data_stream": { - "dataset": "gcp.vpcflow", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "67.43.156.13", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.13", - "port": 33478 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:12:25.823Z", - "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:45:37.301953198Z", - "id": "ut8lbrffooxyw", - "ingested": "2021-12-31T03:12:26Z", - "kind": "event", - "start": "2019-06-14T03:45:37.186193305Z", - "type": "connection" - }, - "gcp": { - "source": { - "instance": { - "project_id": "my-sample-project", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "my-sample-project", - "subnetwork_name": "default", - "vpc_name": "default" - } - }, - "vpcflow": { - "reporter": "SRC", - "rtt": { - "ms": 36 - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" - }, - "network": { - "bytes": 1776, - "community_id": "1:Wa+aonxAQZ59AWtNdQD0CH6FnsM=", - "direction": "outbound", - "iana_number": "6", - "packets": 7, - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "10.87.40.76", - "67.43.156.13" - ] - }, - "source": { - "address": "10.87.40.76", - "bytes": 1776, - "domain": "kibana", - "ip": "10.87.40.76", - "packets": 7, - "port": 5601 - }, - "tags": [ - "forwarded", - "gcp-vpcflow" - ] -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/docs/README.md b/packages/gcp/1.4.0/docs/README.md deleted file mode 100755 index 2a4c113d07..0000000000 --- a/packages/gcp/1.4.0/docs/README.md +++ /dev/null @@ -1,884 +0,0 @@ -# Google Cloud Integration - -The Google Cloud integration collects and parses Google Cloud audit, VPC flow, -and firewall logs that have been exported from Stackdriver to a Google Pub/Sub topic sink. - -## Logs - -### Audit - -This is the `audit` dataset. - -An example event for `audit` looks as following: - -```json -{ - "@timestamp": "2019-12-19T00:44:25.051Z", - "agent": { - "ephemeral_id": "0365945c-c25a-4f02-b62c-a94a0b661f02", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "project": { - "id": "elastic-beats" - } - }, - "data_stream": { - "dataset": "gcp.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "beta.compute.instances.aggregatedList", - "agent_id_status": "verified", - "created": "2021-12-31T03:10:44.655Z", - "dataset": "gcp.audit", - "id": "yonau2dg2zi", - "ingested": "2021-12-31T03:10:45Z", - "kind": "event", - "outcome": "success" - }, - "gcp": { - "audit": { - "authentication_info": { - "principal_email": "xxx@xxx.xxx" - }, - "authorization_info": [ - { - "granted": true, - "permission": "compute.instances.list", - "resource_attributes": { - "name": "projects/elastic-beats", - "service": "resourcemanager", - "type": "resourcemanager.projects" - } - } - ], - "method_name": "beta.compute.instances.aggregatedList", - "num_response_items": 61, - "request": { - "proto_name": "type.googleapis.com/compute.instances.aggregatedList" - }, - "request_metadata": { - "caller_ip": "192.168.1.1", - "caller_supplied_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)" - }, - "resource_location": { - "current_locations": [ - "global" - ] - }, - "resource_name": "projects/elastic-beats/global/instances", - "response": { - "details": { - "group": "batch", - "kind": "jobs", - "name": "gsuite-exporter-1589294700", - "uid": "2beff34a-945f-11ea-bacf-42010a80007f" - }, - "proto_name": "core.k8s.io/v1.Status", - "status": { - "value": "Success" - } - }, - "service_name": "compute.googleapis.com", - "type": "type.googleapis.com/google.cloud.audit.AuditLog" - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access" - }, - "service": { - "name": "compute.googleapis.com" - }, - "source": { - "ip": "192.168.1.1" - }, - "tags": [ - "forwarded", - "gcp-audit" - ], - "user": { - "email": "xxx@xxx.xxx" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Firefox", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)", - "os": { - "full": "Mac OS X 10.15", - "name": "Mac OS X", - "version": "10.15" - }, - "version": "71.0." - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.audit.authentication_info.authority_selector | The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. | keyword | -| gcp.audit.authentication_info.principal_email | The email address of the authenticated user making the request. | keyword | -| gcp.audit.authorization_info.granted | Whether or not authorization for resource and permission was granted. | boolean | -| gcp.audit.authorization_info.permission | The required IAM permission. | keyword | -| gcp.audit.authorization_info.resource_attributes.name | The name of the resource. | keyword | -| gcp.audit.authorization_info.resource_attributes.service | The name of the service. | keyword | -| gcp.audit.authorization_info.resource_attributes.type | The type of the resource. | keyword | -| gcp.audit.method_name | The name of the service method or operation. For API calls, this should be the name of the API method. For example, 'google.datastore.v1.Datastore.RunQuery'. | keyword | -| gcp.audit.num_response_items | The number of items returned from a List or Query API method, if applicable. | long | -| gcp.audit.request.filter | Filter of the request. | keyword | -| gcp.audit.request.name | Name of the request. | keyword | -| gcp.audit.request.proto_name | Type property of the request. | keyword | -| gcp.audit.request.resource_name | Name of the request resource. | keyword | -| gcp.audit.request_metadata.caller_ip | The IP address of the caller. | ip | -| gcp.audit.request_metadata.caller_supplied_user_agent | The user agent of the caller. This information is not authenticated and should be treated accordingly. | keyword | -| gcp.audit.resource_location.current_locations | Current locations of the resource. | keyword | -| gcp.audit.resource_name | The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. | keyword | -| gcp.audit.response.details.group | The name of the group. | keyword | -| gcp.audit.response.details.kind | The kind of the response details. | keyword | -| gcp.audit.response.details.name | The name of the response details. | keyword | -| gcp.audit.response.details.uid | The uid of the response details. | keyword | -| gcp.audit.response.proto_name | Type property of the response. | keyword | -| gcp.audit.response.status.allowed | | boolean | -| gcp.audit.response.status.reason | | keyword | -| gcp.audit.response.status.value | | keyword | -| gcp.audit.service_name | The name of the API service performing the operation. For example, datastore.googleapis.com. | keyword | -| gcp.audit.status.code | The status code, which should be an enum value of google.rpc.Code. | integer | -| gcp.audit.status.message | A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. | keyword | -| gcp.audit.type | Type property. | keyword | -| gcp.destination.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.instance.region | Region of the VM. | keyword | -| gcp.destination.instance.zone | Zone of the VM. | keyword | -| gcp.destination.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.destination.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.source.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.source.instance.region | Region of the VM. | keyword | -| gcp.source.instance.zone | Zone of the VM. | keyword | -| gcp.source.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.source.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.source.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| orchestrator.api_version | API version being used to carry out the action | keyword | -| orchestrator.cluster.name | Name of the cluster. | keyword | -| orchestrator.cluster.url | URL of the API used to manage the cluster. | keyword | -| orchestrator.cluster.version | The version of the cluster. | keyword | -| orchestrator.namespace | Namespace in which the action is taking place. | keyword | -| orchestrator.organization | Organization affected by the event (for multi-tenant orchestrator setups). | keyword | -| orchestrator.resource.name | Name of the resource being acted upon. | keyword | -| orchestrator.resource.type | Type of resource being acted upon. | keyword | -| orchestrator.type | Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry). | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| tags | List of keywords used to tag each event. | keyword | -| user.email | User email address. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.kernel | Operating system kernel version as a raw string. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | - - -### Firewall - -This is the `firewall` dataset. - -An example event for `firewall` looks as following: - -```json -{ - "@timestamp": "2019-10-30T13:52:42.191Z", - "agent": { - "ephemeral_id": "4fed48b9-0848-4ceb-88b1-30fb7da99604", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "availability_zone": "us-east1-b", - "project": { - "id": "test-beats" - }, - "region": "us-east1" - }, - "data_stream": { - "dataset": "gcp.firewall", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "10.42.0.2", - "domain": "test-windows", - "ip": "10.42.0.2", - "port": 3389 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "firewall-rule", - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:11:30.136Z", - "dataset": "gcp.firewall", - "id": "1f21ciqfpfssuo", - "ingested": "2021-12-31T03:11:31Z", - "kind": "event", - "type": "connection" - }, - "gcp": { - "destination": { - "instance": { - "project_id": "test-beats", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "test-beats", - "subnetwork_name": "windows-isolated", - "vpc_name": "windows-isolated" - } - }, - "firewall": { - "rule_details": { - "action": "ALLOW", - "direction": "INGRESS", - "ip_port_info": [ - { - "ip_protocol": "TCP", - "port_range": [ - "3389" - ] - } - ], - "priority": 1000, - "source_range": [ - "0.0.0.0/0" - ], - "target_tag": [ - "allow-rdp" - ] - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/test-beats/logs/compute.googleapis.com%2Ffirewall" - }, - "network": { - "community_id": "1:OdLB9eXsBDLz8m97ao4LepX6q+4=", - "direction": "inbound", - "iana_number": "6", - "name": "windows-isolated", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.2.126", - "10.42.0.2" - ] - }, - "rule": { - "name": "network:windows-isolated/firewall:windows-isolated-allow-rdp" - }, - "source": { - "address": "192.168.2.126", - "geo": { - "continent_name": "Asia", - "country_name": "omn" - }, - "ip": "192.168.2.126", - "port": 64853 - }, - "tags": [ - "forwarded", - "gcp-firewall" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.destination.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.instance.region | Region of the VM. | keyword | -| gcp.destination.instance.zone | Zone of the VM. | keyword | -| gcp.destination.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.destination.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.firewall.rule_details.action | Action that the rule performs on match. | keyword | -| gcp.firewall.rule_details.destination_range | List of destination ranges that the firewall applies to. | keyword | -| gcp.firewall.rule_details.direction | Direction of traffic that matches this rule. | keyword | -| gcp.firewall.rule_details.ip_port_info | List of ip protocols and applicable port ranges for rules. | array | -| gcp.firewall.rule_details.priority | The priority for the firewall rule. | long | -| gcp.firewall.rule_details.reference | Reference to the firewall rule. | keyword | -| gcp.firewall.rule_details.source_range | List of source ranges that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.source_service_account | List of all the source service accounts that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.source_tag | List of all the source tags that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.target_service_account | List of all the target service accounts that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.target_tag | List of all the target tags that the firewall rule applies to. | keyword | -| gcp.source.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.source.instance.region | Region of the VM. | keyword | -| gcp.source.instance.zone | Zone of the VM. | keyword | -| gcp.source.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.source.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.source.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | - - -### VPC Flow - -This is the `VPC Flow` dataset. - -An example event for `vpcflow` looks as following: - -```json -{ - "@timestamp": "2019-06-14T03:50:10.845Z", - "agent": { - "ephemeral_id": "e58d02a0-e7a0-45c0-aba6-a8c983782744", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "data_stream": { - "dataset": "gcp.vpcflow", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "67.43.156.13", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.13", - "port": 33478 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:12:25.823Z", - "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:45:37.301953198Z", - "id": "ut8lbrffooxyw", - "ingested": "2021-12-31T03:12:26Z", - "kind": "event", - "start": "2019-06-14T03:45:37.186193305Z", - "type": "connection" - }, - "gcp": { - "source": { - "instance": { - "project_id": "my-sample-project", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "my-sample-project", - "subnetwork_name": "default", - "vpc_name": "default" - } - }, - "vpcflow": { - "reporter": "SRC", - "rtt": { - "ms": 36 - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" - }, - "network": { - "bytes": 1776, - "community_id": "1:Wa+aonxAQZ59AWtNdQD0CH6FnsM=", - "direction": "outbound", - "iana_number": "6", - "packets": 7, - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "10.87.40.76", - "67.43.156.13" - ] - }, - "source": { - "address": "10.87.40.76", - "bytes": 1776, - "domain": "kibana", - "ip": "10.87.40.76", - "packets": 7, - "port": 5601 - }, - "tags": [ - "forwarded", - "gcp-vpcflow" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.destination.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.instance.region | Region of the VM. | keyword | -| gcp.destination.instance.zone | Zone of the VM. | keyword | -| gcp.destination.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.destination.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.source.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.source.instance.region | Region of the VM. | keyword | -| gcp.source.instance.zone | Zone of the VM. | keyword | -| gcp.source.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.source.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.source.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.vpcflow.reporter | The side which reported the flow. Can be either 'SRC' or 'DEST'. | keyword | -| gcp.vpcflow.rtt.ms | Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay. | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | - - -### DNS - -This is the `DNS` dataset. - -An example event for `dns` looks as following: - -```json -{ - "@timestamp": "2022-01-23T09:16:05.341Z", - "cloud": { - "availability_zone": "europe-west2-a", - "instance": { - "id": "8340998530665147", - "name": "instance" - }, - "project": { - "id": "project" - }, - "region": "europe-west2" - }, - "dns": { - "answers": [ - { - "class": "IN", - "data": "127.0.0.1", - "name": "elastic.co", - "ttl": "300", - "type": "A" - } - ], - "question": { - "name": "elastic.co", - "registered_domain": "elastic.co", - "top_level_domain": "co", - "type": "A" - }, - "resolved_ip": [ - "127.0.0.1" - ], - "response_code": "NOERROR" - }, - "ecs": { - "version": "8.0.0" - }, - "event": { - "id": "vwroyze8pg7y", - "kind": "event", - "outcome": "success", - "original": "{\"insertId\":\"vwroyze8pg7y\",\"jsonPayload\":{\"authAnswer\":true,\"protocol\":\"UDP\",\"queryName\":\"elastic.co.\",\"queryType\":\"A\",\"rdata\":\"elastic.co.\\t300\\tIN\\ta\\t127.0.0.1\",\"responseCode\":\"NOERROR\",\"serverLatency\":14,\"sourceIP\":\"10.154.0.3\",\"sourceNetwork\":\"default\",\"vmInstanceId\":8340998530665147,\"vmInstanceIdString\":\"8340998530665147\",\"vmInstanceName\":\"694119234537.instance\",\"vmProjectId\":\"project\",\"vmZoneName\":\"europe-west2-a\"},\"logName\":\"projects/project/logs/dns.googleapis.com%2Fdns_queries\",\"receiveTimestamp\":\"2022-01-23T09:16:05.502805637Z\",\"resource\":{\"labels\":{\"location\":\"europe-west2\",\"project_id\":\"project\",\"source_type\":\"gce-vm\",\"target_name\":\"\",\"target_type\":\"external\"},\"type\":\"dns_query\"},\"severity\":\"INFO\",\"timestamp\":\"2022-01-23T09:16:05.341873447Z\"}" - }, - "gcp": { - "dns": { - "auth_answer": true, - "protocol": "UDP", - "query_name": "elastic.co.", - "query_type": "A", - "rdata": "elastic.co.\t300\tIN\ta\t127.0.0.1", - "response_code": "NOERROR", - "server_latency": 14, - "source_ip": "10.154.0.3", - "source_network": "default", - "vm_instance_id": "8340998530665147", - "vm_instance_name": "694119234537.instance", - "vm_project_id": "project", - "vm_zone_name": "europe-west2-a" - } - }, - "log": { - "logger": "projects/project/logs/dns.googleapis.com%2Fdns_queries" - }, - "network": { - "transport": "udp" - }, - "source": { - "address": "10.154.0.3", - "ip": "10.154.0.3" - }, - "tags": [ - "preserve_original_event" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| dns.answers | An array containing an object for each answer section returned by the server. The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. | object | -| dns.answers.class | The class of DNS data contained in this resource record. | keyword | -| dns.answers.data | The data describing the resource. The meaning of this data depends on the type and class of the resource record. | keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.resolved_ip | Array containing all IPs seen in `answers.data`. The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ip | -| dns.response_code | The DNS response code. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.dns.auth_answer | Authoritative answer. | boolean | -| gcp.dns.destination_ip | Destination IP address, only applicable for forwarding cases. | ip | -| gcp.dns.egress_error | Egress proxy error. | keyword | -| gcp.dns.protocol | Protocol TCP or UDP. | keyword | -| gcp.dns.query_name | DNS query name. | keyword | -| gcp.dns.query_type | DNS query type. | keyword | -| gcp.dns.rdata | DNS answer in presentation format, truncated to 260 bytes. | keyword | -| gcp.dns.response_code | Response code. | keyword | -| gcp.dns.server_latency | Server latency. | integer | -| gcp.dns.source_ip | Source IP address of the query. | ip | -| gcp.dns.source_network | Source network of the query. | keyword | -| gcp.dns.vm_instance_id | Compute Engine VM instance ID, only applicable to queries initiated by Compute Engine VMs. | keyword | -| gcp.dns.vm_instance_name | Compute Engine VM instance name, only applicable to queries initiated by Compute Engine VMs. | keyword | -| gcp.dns.vm_project_id | Google Cloud project ID, only applicable to queries initiated by Compute Engine VMs. | keyword | -| gcp.dns.vm_zone_name | Google Cloud VM zone, only applicable to queries initiated by Compute Engine VMs. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| tags | List of keywords used to tag each event. | keyword | - diff --git a/packages/gcp/1.4.0/img/filebeat-gcp-audit.png b/packages/gcp/1.4.0/img/filebeat-gcp-audit.png deleted file mode 100755 index 4f68932e9f7098f4a3ae6864701896d46d93e6d8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 507414 zcmce-2UJu`7cK~*C`u4ef5&ZY2Y;|^Wwad7(C!dk{h*^ICX=9{-FN_fsp+Vxs32f$W6fe{Vq*kh zakaJut8slUep{|VEWJ3875u(Gi-NGFHUM8?$tgeQ(tn4goSFiL} zLlfiQ?QEUwt^OL^#F!Og1+j*}934Pg_TO!7&21cQ9L#P0FS`DH`@aSNORK2(dyN0- zT&%5s58>b_=?q@u?*;jvwsv^wW(#3eg*eza*&9P7oxwC|uinO1K-?Z;=xAgA(#FQ> zpN)F)&y=Y-z?)D%Rx~t*!meI|@sCF!5{8ZtVVbLbV`k%I=45}#&M&~hF2K&i%*G|a z#`d44iZ&)tQ@8(9Qw}x(E_MN~|85F|#>CLk@PFCZ#8|-8#@^ZxyfW0<&yBA)sy<{!epYHLgDXHdo-E-v$o?16Ix+n6r5~%4D>gRi9-g#9q24 zZ%#WU>;AmB+#92q)*8znGS$JOa9WpK}8 zE#$eR#2=S)W^42xje-vEJj(v#wnV1EWA;Zhe_R*OgBkJvxYmf}6#g7XrtyW5+@C$1 zy(3Wj<9V7PR;$|D=NDSxJKoH=PX~PjF*Z6!rVU((rxGh8R^A_Ux>Rl-*YFq06n1vb z$4t_n9xNT@Ft@T5ocSpF$KJfC#0WGW`EGK^lRGUm~CySRwS)^z-@3*L|zWP zm$AF$+xW2%B9S&E7I}Vkm)Z zfAe7MO@2*b!Xm}k+x4w@IQKKt4e96VlTMo;nO0$EF_0k6x_?A~yx#SLtevsAfpe8bX~ zLe#EuY&PzUjvdk^OSc}*;9D?Yc3a5Ys_$v*1`dR#jFU4c)N#vBs{qEkbpO?&shP7| z(YO3-fh}UHM(31qjd|zZqHZ_Zuql#LUlT5h1)R`@(qH zj1WIWf*)y4`nwF)=sjTkNs-s~d^l%zK3ND`{`uu*6j`cB7~v`k`N`OKpDn2G8D9 zkImlPG_Q-BO@D~Z$H?TSpBlQ~Sif(-g1o{x5kBM!pYhQN?{Tg3-kipXS)WVH^XZP! zI4AK9@j2(bCPX)txaoY zVPT5rM-_tXiinNb?ZpsQ;$p)VQzN6#P%A5=)}VCH(sjln% zMxQgPm%sKT2)R8U=n+0;O7ki4J(;--!f){zWGJc9u%3ix-t*5sI>5w0j4r~3><>jk ztxh(NiIQKT=o`PF{2Rx7S`HK~HMa`r%qt!dkgI=2d2&eEk2HL67`Rx`ay@%U!jJ8J z!0_eEluf#>>o!!#^`uY8bEg2CDzWDRPgGoS>-eEdQswf&MRz&E6Q#5f6Z@*zaCnqu z>D1GEG=I{6c4uc_U(4-P_(r~dEq-{%6H|6| zb@k*{(U*Lh#!tn=mSBU?(tP%~U1s()L@qalVV8|brwctdgg95SU_GlW4Ut0}78Vwj zJ8^HnE3v;+S1*C|@Vw0?_1;<*y-Xc1Gj-OHuC1K$#>@Npo!Ee-Y0G)%mDkpaB(MfH zL@b8e9#o}HI+P-5MPnqtecEEves`n6%0fs#e6M3WCpR|%^s~PoqP&kVJ~;qC#){BGX z?^-T*jq_>Mkkq~PuS=e3KhgDO_e61fR$g-_=^FHTs8x0LJ_NC}gX;eLsD~dFpKyL^ zb22zJ_4cPx^L1GDng$)iBikK6>;xkSui zcm5b{v~ad}|Gs63CX;4?`d?4dx9**4gt%?>os>*&Av{Htgti~|i(FiL zHoyM(>zDa<)sc^88H{$IZdc%$4!@QVa)``oJTbh@sCjMb^h;GX5i2Q%vrP?83mY4D z#<1mp5RxE-h;=E3IBos#32KW4XAZE~X?$T=Y~aYzRoeGYY#627E?8m^#XKHnHbCa`%kfhR4! zQI@0mS~r_~qfPW(x9tcB30)7iPO9KkC+Hs&1$_7SZ^KS|sJ;*Hp@StUyf_WZ*RCh> z-ON{57P`1qQo>$$f|AyCIJ!^n(W`=%Y|GXILtlY=1t#3 zof7NzGy9xk9%*uKoUKPychKwgW1n%9#7w<^x3?<+;D=gak*Klq;}fY zDsg4c79-`0=;`Sbhm{3`PiF2My*Unyk2lx%-jjvZZ&7(xdfuo!U&4E~YKm-}ab~!h zm|3zn2Qav^Id<3OEo&&O7x$2S$k~&-P=_C@PEq8fEj=rjUne>8F&N==% zUD#;5eht0C>gn8B9_vz?3+f%MnL>K$SIk>sBh_a)#Ct!4D?dhYe^eHk6oDkoQq2`z zA}uK!PSgqD#%}B58d#Wqb;rxdWS@RUA=@#7s%7xV-g(g%8}rPsUjx?E7xI_$$0J_h`tieH(o{wP@i%?_N%7JmEmW$&GIIOJBw)2KyfC%Ug{GKpxe?MLW&X>g27gm?~%O zs6^7jMW-C^jOib!#WE!iuogBZUe;bv*6CAij9Smd8-FlrjyrJOnsxY9!yJD9sm8%- z%L&2#`)x;KdOsN%Zxq`vJwTJ9;JJ1ytm16D_Pzp%Xl&>qSA$N&+c<+$ypyRTULt0M zzj1g%Tah=#*^v8L!pitJDCbVY(d{&^eHJvIM!5bIjMwEHF2Yj1>Ph6uA0DN|S24Ne zg>ctq;%EGAMfmKCc|IOHj@qX)GO04L~=J4rwjOf~-w$0v=NmnEU z$fwBFkRlfdYoHeHdJP%C*7>&>t}I4(gt5Pqw>%xImGmlCY{}lYjHIro72%27r4;x7Udi;$H$}`&b_xp zkmpIZ)fmHSva(9o=f2S9?9JRvE3rG^0WhqiU*MWA7F=rHkx#SQLReZMO-4)wt8(^$ zq}(Yz_eS1Vaav0&^`{w90jWLZrWdA|bPNGKBF@M7y>5F)l$AwoTeL&v$bkp)%JPuK z&UrMtlgM-JO30M)+CoSu7bQA27t5;07gnEhi1?{&Gh+tyKK0&*ts zTSZNR0EC8+;R6E;506m&be3oX(721_p&|QN@7m-HGb&kkck}3Zx0RH(1J?5-95NmZ z+pb5V-{*@R#v#Oe=OLHdswa_;dUkJKoATVCKy$4Z0s8X3hXqG?vU_X%G_I#~NBxk* zKv_Lsdl;H>$J-Hiwn(#lxCU*;d&LVN@?!J7N^J7@{;3m@&lMGg!!pHQT4}!{7IJcD zh{cuD|7`pjYGFk~FHl4Ed3`-Hq@MwJ;OZTpR(SZdvVy{8n<3xU+*)F?#bM3qbRF^D zb|*%Rcs_E8N&ie(S@e?1V&j2KQ1}+t&lE^tV9Ke0kVE&*fpH1RFKeD&+<|3uHujQn zYoXoMvU~UA>_&QXu}P!*q6QjjywY)xe&ws5Q>4NdoljB`<`&L`6xALBao6~ce`)D@ z&btZf^;_V0eNhr#@>fD;cyZQKq-HFgoR(-6%sb(xiM$I9bwukIUcu(z7`lSG3q3_d zwm%10;BTo?T8H(R*e-Q9FXp$i?k+X~kGOt@Qjkc}|Ku4cgT&JG&A(x>iD9 z!QS2oiMMP0w!4ofbjYfmsDqfc@gemts6^xwJuN6mH?wu}G>w`zZP}P?uo15Ph=%d2 z*pTpk%q!q6_Zodp8+SLTJP}x;4U5vqI+5S_o!>Q-L?jwuD|+R`rk3grfqDZ~ zZ7HZMKM3}gmV6qO+}$ToSoiqck0VmDA8fM59@4#a)4O@!Q>QMbG+RJ@))sH}p4D7A z_Z<(Wme$sYh^Z@+p|7|UcOSn4gH`BR$n;#mvu+zXa}N~m_=h9RfDu& z3i8Yl#bU`G%d&_I)NW7)g(3;>`}IVDQJbmfUgES=KF6<$?6@l3Pad-nXb2Mu01^|grh1Gbwd{JG0YcQOI-Se?}-n%}X3U;S%iED4r zSnCi^aC7`VFA%hcleJ{U={}Q{h33@I&?M(;)qbd{z=v!B{1q?ccFpJPz`9QGL_C&B zt9{4&k{GzL4hq4Lwc+d^Q&YW9iyFirko)06XZNtM_A)c+IN?E1&%LE) zsi;C4Pr^gLoAdUPwn&PTJ=9Gq2l>gMFBBAZh?gLQkdc!!nfTV#>$M|(`%VZNVmu~p ze`3St06{oVYP4iQi5wfQLkw9i;;sv|>DlZl#1ue)Dxv^O3og}JDYf?c@iMi3?BVAhYKeNc%0qpz3fcY6XzKJTI%u;O3h;%F5f~D59S-~5 zZB`arLSI|1v*?zE{v7^b>g#oq<1lH7uY|DKx%sKFe*a8Y-_45!kQ#^I?!nI6Vk9K^ z_~(Doo;sge6gKXeVz)Gzmc23jm>k{YyGV!foUD(}4(_?%OqxTkyoW1G*z#$(GaFGw zLg}_}1I@_zbM>(qu`vmzhMqV2m1#mDmuP^aB2M;r0K_)gePOT;u`W2Zo1{~$T|g2r z2)(Xat3n&d;WWfY>AA^|hM9RN)Ths8P5@|z*utgF&gpd!ttEW<@`W<4nKOjAp^Q1b;ga;b&@>`LVLIKL7#n5pSlD! zB|OELlLJd1DP1cj4ZTystH6m3{w0cp$FcL+>yEDT+PkUCCgYKjk-bGYp5yziH%L@- zUnMFRcRVZ8obs>-z629WyO+6P*t5JzU-Nv{45MdWNgSdzm zF&w6vXG(Epy*@XGCt8GpYnyLfzeVXXDiUI;937((5ls?4J;QIXdT`@k4veHc@vlH5% z&I)p3t8R*GPz>i>D?kDy*PloPjuBJSTdWKt>W|JsYG1DOJI1|0FVi%YKLu^E9JGX|xV3E@?{klIRmlZRErhe_@#)Die3Ce0D zM(}a@G$s4deqXq4mo@J$>=nOR!M1=&zF=b)d2hYA^p^VT+Qf&wr)S2u&u6Be)C!LC z+&q;|tr}P$7}wFMST2E0V{&kEk_ehQBF43T8-JRcr5NQ@7cYW)td53u5y;w@GPo>K`>xC&VX>8g#?7wgO zhUr&Z*H7efhfF7lbbH-9u?&zG4+9Oa4aD7#*g4odKI1>WeIc>@GL51<(M{{KiQMaL8Tqg&u_gm?P? znA6h9n+zGCqP~0Ubs~K>7QN}J-td&ooAH7duhbf6*LS+!JctY0d}8c#lUfiTMMn3} zPTzc#bmIwLlec5r&lvn|R&F-zVomIP^{38B_ci=8Y}WH_thnp-sZgKNUN>PgLiW{8|kXSyLz+GB3UxWSqD}v|0q$=otC+&w6^c5c5#CkEkxpk-=IxP1* zI-|qswxtd!39(oiuP^Iex{^2uo@p3N^hS9>W;>tk2VCon4yw$Gad~asR__mm9yhoP zt}8@sUME(UUro0NgI%IKCChD0Bd(d|jBzX^|H@BssO?KdD`-IL8pKs6;{8ZTEGBpO zrUd7o9R+`plVS<++QsDoD{=Sm4a))yl41!vxTTj5tNPQHVRLT|qz_Q*_T6Ol=i61y z7x)&9?p|(;2fXToKh`^ziaB^_0}T4RA;yw~;hqT{jVuo;8^t$G#N7y$S(!5PoBgmd z+xV*8O^I4=N*o+_mtw5*P472L)p--@=qzB*T`Ez{JQ_dwIr^YsO1E#zEOfD9pu&Ft z3%V{Bzn@0q)A`QkVC+y)wkW?pW_&UKDY@H5T$1x(^c6cd1Iu|-61i+thq85G#7piz z{X}7OH2sUhXd)ZmN2f=g6(u#3_IXM5_eLw6-Rj2)Ut7N7YiJlgrn!^IW5O3=JHk_%mX8LPlWj%Hl;nS1zB;PuIZDKikOt}kE z)@~dvLHMksavb`hv#BJ^1ukmZJEmT4ggXU=Xs;Eduyfg!z9!a9os6p!Srw!g{;V7; z`NQCl=i_$ctDy}lk&SJ$JzsBo)E3R{{yoEr@|-3-Sj#S%o5v|+9%$Cr+|3w@1o;aNZ3Wuf~>pznEQ3CKK+Y`f{w>iPIs-S=$XJ%U;f` zuZv4Ytl0nh_=m*RL)ufNB-XxpFNG(oqEsmOB*~Cbg=tE? zM_xVzdU(B92SP4ZgB|lhQCFI^Hx6?7X%)P@sJOG;|u_#HSu7XO_qkys2|_(aZrBi-z-Fv>{`k&{2u zw{Tvglwmbvpw{&@vOOjC{;kBR(={R^ntX+>_r^fVvyNaDFS#9%bQa8+1rdoC&gcN)S_5*fsRWR{j98Gz?uq1cbBXB^1zy@zX&4dOg@gq zvW;?ln)D=z(Rz1xVaNzAd!?Pz#p#Ak{^Lpb1^!B@-C?l=<+&$W<-la`InGaAcHxlb zE)_J_3wp6(6L**pQ29Moo$1--vEctE!(o}F|M%sx8$8lQy>jgN@iW9N4FB2=QQezcL5$&| zP5Yk%c6T~(l_%h(*tF4Ax#ou)^wZz@;i|z7eC*g^J$2nn*$wHw;6(hwJ--5xP-LA7IFcAm|8c#@b zSO>Q0YtQTN%3&g!YRv^XxMo1hVLoWe)G`?z9q$*mkX#Jxkp>jPw{rTv^DBGHhwwi8 z!PUgIcT)jqZTGt<&f~{3-Sn(oDj$@JNHKdKOq}u&ja2Nf1<1u-&OesQlv2~2?EWR# zVDd`#asM|yhQ{QSke^1oh_M^MTE2IUE9iii@D8|6sQ!H0_n>=;ULrt5fR%~SR9i`i zx3{|uj<-J>_9~jkRiMCSeHC5eSAH@ZN5Wb)mWOWRzm})7dHa*1f~26eF1y!j#K{N= z17`Zl?eYTzM(xYkHnysZUVP7z>csHTR|H&sp)z6FU-}h+6O;=jTutO66=WmwT{oqo ze{J+ab676ArTZP>FxGX&b?tMBUrhH#{Zro@W(2QgN{pl1{=y!DKM#&hMeDJ6CQS{)Sc-uqU{v0m{~gA@r(K_ z^WO2t!yPFp-Rnv^kMY%1cODKIW>jryDdmL98NRSzr0fu+;Z9T@(=bZ(msU8vCYGxC zqO&ckQrSskcoPE~EGfpvn7QxJ@_;DOggq8=Yj)fqJJr#-wIkQfFt`+*-Fc9SuWiaw zm_EH(hao$*uJcnZtU{LmDjmY&H_zD*Dc0fleDNH?FbXkl^?h8SUio5X)eyMTtfSgk z>Mu4&Q5w_V%Q?$VyS}~gtgem?AJbq5E*R|g(-1N?MORb9hrpWME;57md@*U0e$7qI z-QElt=H$1Rp}}{4DyxFavG5$LEQH?77S-xVt}gHDUVnUq&P3!_ucE#)uk0|UHoXb4 zP!eMJpg?bqnF~91D#&YTOw-ovTsEDu-{^?`YMnD7 zPAe>09_v_i))IZx-c>GbdeEGByPHfnn%gzVUNg8@2LZdi}#hNAV7{ zL`jZpO0Ro7Y2>9*bjpGNZ>48(MCRk0F=6`l1bXD6Gzkl5qlHf8uXwlxKa^*M2~}nW z?cAix6Zr)IQJA5ACotHi{t_ia=auSvqReP)BDl;>g$cj+_l^;5HXGszG zs5y2#%<*WV>nCSf6&&8@Syk~i>^}3kxsiZ)q=(Y`BWI!G_5=C%TJaiWsEadNhbx;j z)=-)_+gSF2UfCD3vT@Sg6i;!n%|^bMgs6~D$f0QAcfk!lKEI~crTqbO<@OG>bKJ10 zA;R}DeMOiyl$Z+2z}+sJ+0y+Z`mvG#)4LW2!p_ie>VC+|uGn6y#j*K>;ShLFGx8a zZgM4tmf(UhWCCNx#iRIO5~?|ainT4UayAy)fM2)BSZZVZWdx=196 zlpz~zXLJn+M?ZN~cWCooC>e=-=y3Z;vg?ph3V6tNoXMnB(ox{#U*|7@E1@2;H`efY zZ1?P%$H`m@#z)cDMrGS5M8>lpt#CYowPI)YX|D9P6^8DT19Vg7nP+iF=t3xJo{%?A ztT~&L_i7wqNYcAvBJbT{=1yfqp*lT4GH@d@~IuGJL z<-EyYyI{z8p?@M47jI#4e3uM9HEa0K%aC)t6(bC3`!#EL_{2O>lj|frsPo~@AnSpv zg&}^@lf=F2(edj~frt$7yu>%G_Y@hJNog@%h1Bd++nqfYd^pYS%r%AFlH zG`7BN13XN>n_6iv@W^Or_WcYG5h*iKpC{BQPoJbI#xQ#kM*5eZT?0UDW&2d;-<6C& z-RJY&mf?M~-445fS0gm=M);bd#NsnT>_pG9g4plcCn(&dz!u*DUiA}XCltq*=$}{< zLs}W@iyzC?&egWGUIkk)VU4c_Zs%gX-YD9DZ${-L*rDO8PSXt))up5uSHR3HTpp)!2Ib*DJ;B(HTHbTDt*viuYddt)1AOMl z*cj*QXSbbe>wAzmIAJ72e(|fTEIU8Pco*#X?fA&OD04c~zYK2We5!~6fTU|MeINn^ z)Y;?m?z)#=H@Q8oeLK50PvR}3>wJgQ4xdhHf-%=cO?L-)Ze5&Df_>NhtAisyMwy4xdZEUQ1#q#|h6YKQmiB-DzCO8TV4@C-)KvszJekIGu)NAaphzq_19A(y*}^iL~Hd;&=;m>Yu@ zBJCq131noIKrKwHV$y*C^YF-sf@NN9PmN+9^T-%40d@d^9U$XlN7aF8aB{+#9|J@< zPMG5SEV^9JligDcE^c1<0TKzr_}k_#e)_qIwL7uTq41nG3+84+d*@)C4|tw+Q&t~0 zA6mcdY zrn)V=Ex_TV!e?x^Z-=-cr%wc#50-Uy_SVh^v}z7(VQ|eVb1YE&z{Sn2Vlew_$t%1= z9Aqi8t1ni0c(~{HU^|Zs^70t&-kNi+g~DLzpxp2M`)jjphb8cwV#zlsLS#%CmTQck^sZ6HqJ}9v%kPvh`#()FU~Q>o_m88|%ZXO1tEv za**EBk?y>Yj$os4yiN}ahBvW_OFjpG#gz?Xe#Lwha{`Xc4q4%I@{-$)@e4GorGtFf z|FiZ9ddfZi)8czdRGhxnub8i}|9piu&r2>fRpJR37G(c0O|S~CR8GfkSAblq-pkg! z9=T3g$Gx1WfXI8*7ukU$BsT$$0I?&fH#6rf~ z%{2}4Ci`LwZd6Uf*suu}j7T~70$;Or288KAEuarcun9=lKs~e=7jJnncjMjKzJSRs z)9+P-(Xkq;8XDna8!b!rkx?nKRtl>oGo{>AMFWA;rnHavBi@iAeSH4$Wp6sR@OCTl zc=wJ*wYT{k=sLn=miu<(Pc0mnZS;hLL0lIfAKDc(FRkp=F<@#EmGYxeZ8?V5Ra0%~ zx^EjBqVP2`TAsqE$l}A#^jAef1?cYH+FiG_DYe$2 zBx-rC>q#DG;Ebh|6BVcL9rOPE6KsqCT+-fgv$TFPn>u-KG5kyKBd30$iJzwcnE@{+OKH>7(zH1d7l&V4LP>AVsbQst;rGwaQ|5GzveL zXT|upUN5X$V3>wQb*6u6BYX`4$Z!L$SZMVgm&XMF!yrz0^J6tLX=eJFWJX}7IfJO^ zUkuet9=B>2l=_ng!hBmq^pG~YqfjeYTID;3_8hyZAUb_yq5mc9>wK_$`$Dlc;$RBr z{4huXcR=yh*v`?->Vqg|z!N?+e{S7#yi*IvI5#MiJ!~6|C$D+U7}K^N!L@y9MfT1K zhT7XBy5huCpzKqeK2LSNYMUQnk|dLNDKg+T8?hsh(n*Yk4#wpqAf{gC?Z90>@v7t0 z80cL%y&_{QJf3eyGLq6s2q4<>b=B|fOgMUiIJj`G_B-aLIzZ-1-Y(~_1Mq^34D~5A z209ly9|mW3@I%dy4#wLpC@-F*B`J}2|3Fu{{+2%H17%ZOl4X_S`ZLT&(njpm{N2s7 zB2)f-7PcsVNAT6c-c2p_7XzZAvr@pVGmhKoa?>UON(bh%np|T%vuvw7Mw#H(cTGLy z-4zAO>+|#{v+$+0;1BXh+H8TZ&|?l8YY3tPQpWZ~IMJa!>&VrmH}bqjzlW*Np{%;p zEv+p+LIe$zS0_4=jn{Ff-OBNsO8(K-n%(F2QvK)0coJok%n(JLgD*ukty{-0)Kw&( z>oPHR1%pC9HGLIH`Mjis$R8;(jEu5eyp_dJP=}^|r>hHVWMow3r7BTjZ9_>!W~(cx z2TZD1+$yvFJE;;O-ZPzM1?m6%{ED#22`5EslD5nv0U^@79|2qFi~W@<{H{fMNe&PXGnL9#9nb4|b@FtofS734zfme89;>e27zVY@9>!{%mSZ-rJ3ls) z^H^L@^FHGT1&^OHGyQ!U&oIRUacLMBlERWI=8oLEDDEZNTdsa=mXLDx4u~6GTO5*S zz0Hu-fP~$Ex4(;&gjELStOyN6aE8C`U2Sm>V{H8NQLK7A(=2mu>VS24YU;V0+YN{1 zI+^FsuYnREaEQYnXd#a8jajDbO!3BH=>w6htgLs6Nfo;&Bo(LaYcM|cwq240?hQK@ zGHE>J#Ww?$dnay5361HAX_TpLbBmAB0HHt3m5@p{0K)sas!S4Jr08Tjanjd>ND67C z=X581v+b2Pj;so;mb0?bA*s4AI!$;(YeEplCY`4}uFiJ&gq+5t2@m=} z>-m#dKsIjTuo>H46N}n)nW(B56o@K=2Za^yZGW{-)zNK@KQyN|ZDR*^W+$J?3;^c(6F1(F>uT+hpdB$Xttku$5P#mo%>I;^!{Xs?95=z0HVZ z%6{F}6kFEBPM-qi^Kq7(H(ov)`}*8E>9{V(BR`yAJ7 z$_t+*7Ys6%rrViT+As_BG+M92T6@Xu(IOhBjQ7Y>DogqV$azhvX{wgyucd3(D-8T! z^6u1%#wK74ld?Oq>8GU)mEIn;p6abQe~xxLM4lZRqfykClxxqmE?Pq!REo&T%AsM@ zQBsKwXMU|ALTh0o;h~Fbt{#6mIsyc!r7@gbbGIYMvOt`F)(z>cTsEh%n!9YyI&d%KXMV@le ztVJn{W@KjvP^I|rsE3q~#nXpUb-1mhwn-AFN_%->00@(>Uk~sZFR_8Eh*^r;gE-xD z+8Liq+H=&5U`|=tP5b#9D|VagW$sh-5#nOe!|i9vR6y+=hxMiCWp{xU71LLcLC%9A;R?; zeU*0UjVE0}4(wcyzN%eZF{tiW3@UC6r+^od%hq_<7$Cq0SG4YA$NSGeI@6C$I%A|w zBBDsT4njiA_b}P8yvC6j^hGSJZP2p0JJ%U4cRvzr&7EUGNu*{)MQvRQSfH(ht3rwk z9UFPB7f25M%ZAVdKSG!4{8>uDcw|3Cn`r-oF4+uK%}9-&*ma`*G?E8vho|ipK(qD$ z_AVvR1+R4#6abKx4x*x)A_Ey;tZz4$y5m)PRRw!2+dO(W)Zg12>{*|cZGG_|KcHDM zN_^m2uTp4}5&L7{<6U0e@JX$G^B#AY!TVdq+gg$7@3Sk`*@J|0iz^)p+&D263YuFCQ@`X#>LoP`c&G%+5K$GamqGb@j3Vy?HRH*1;WSV zO-&!jc42Yx@Th3(Hv^*%DvLp_?&}f~F75y+^DG>h_BF?$A3tQojR~0x3ivj0L4oj_ zifSpG7V58CN(rMxE|Z78>FEc#7y@QWgoF#|L1Dq$Tnxp3BOe**#`qL@Z^fsTpr~p- zR|Q)>*hs>H3owMOTvuyxqM>0se)#6zNQM1^A+jhczk&O(H|AE-yRQ{VA$f`QnH@(W z+P9zcavBKJCNVTJ&Y>=0@ZOSKp;JXMKE@b=vICA|32>-RK9-4A@M+YoxDbB?pAZa> zk&*HIye2Ke;6f*MXoc!r>l4NhZoogHiCSHFV8@4V!zJ#PCSchjI4#~~M_@40%6Q@6`Bo}KK z+vskhRB=7(L)X{dH>AI|(hECND{?QqBK)*K!Ug0n6}sOWE6UPZb|+S?P2*f8mjDRH zO=@mJyfE1MxcFG#n&rmxS)C{jag5u5vrgE+RvDy(LDG&rFP$gOp+^7PO49G9-HmRo>-ci9_+@s z)xK1BPmTf%A7IvvD<9|{&q#TqN3pM^n+f(ki0#Zb3Ks=e;q8f(oC|J=x##f_Ue|1oS4?iBNbXZ2vxoU(Q+0LBgoJb}sN>6fko&JjMt?>nMai0)y60r7 zcHD`osvkFf2RzZd2f$^bfzvYm0sDF$ zT;d+~U%TKdvpsTW;Dm0mX`cW%&(yRzE)8m%u_rv-L2+r2t)%TtwHb%k#61zju5owI z)9+sVVT#iOz6U7e0phTXwQBdfLxPCcle=;caHvE=#j2~LV`J1nl+#G8H{(I3s zJ%BVGz2x;sNF*Bwrj5c%6#F`9x>M?iU~)V^X+qqZ(Rw9DZLT`FYN+Q%2*+&yNVH)B z*yStdzegL%@AmRGkTlImgMqfFS`j=O6N`HwOPBtW?9;ay3d;L8c1L*Mh4u%{=LDK@ zd}(P4IbKvpG8twJXY3)aC5zC<^yHWk?38jEJ-bKtBoR~^gA`t?7JSHcZIYnkW%=eL zMHL=UoJZ_KGg}^If%K&fo?~XX9`<7BS0=MkBNilhXg1SPj+Lywpn70tLT*M+t3PQr zZm;#NCu+I{?nfQ%YB4s!b7LWKNb2fd?b9B&g$+;2Ga)?RrFTa{h*O?aeNCARh9;YE ziq>%YtiZ9NO*Z##IGz!IXUz%T>EvCI8QML~wqQw2?gy#IWZ{OB`H3xo843qvM-tQ) ziQJ^28@exMXve6ZhBxfL-~GhCRJ?^D5U&f;Gy3+2Lxw`sG7)b?1j~Yv_TkYBk#3VP{u~j(x@9`eGKFpZGuAV}!V}MFQ~;DZ>-zJU*&MtWMDAQC@@`n-7ciu=-YZg6);EnCUx zwG<{eX5vOQ(6Mne^y|kh|44DFzNCTCf=P4hBR1DvY9nJ~TRw7ZDjxqpO7G-@0l|>@ zmWrL>$OY9@pS@WwUfwcrKuW7*;J@;`qyumW1Dk z@6!F8)W|4fywr^>?sC!S>VOKla0o-1d+bfhGh&{Q@(!|ekBKYb@OMfG=psl7-B;AN zC)7)3`zs~H(o^Z9fO7qQm-37z9FUrrm1&1nxBAUJQfI3PhpLwR6on2m1~c0Py5wwC z1{Wc!&Q@{zg$W6LNUb8aXX z;|j~4P!NROEE5-DzrRvCk9S>5W0c&xX{yjdS&6y72xIPWkkQNDOhL(+zW>%$dGaSx zlg>}cyU`x};}|8{1+I1aAT9$zS`|%lW;Q(>54&yac+Osu^Q?GYLb3)Nm1nnDEVdm7 zrwXJ#kUR%q03hUaar-VAJg@XHQf~4<+GzfYiTqGfZqGEEq`#d%`P2gK)|5xT;e7wF zmN?;QBc~Kv`dYTPlOu~?Bu%c>@qQ8v(Ts{Ws3I1NU5($UMB6* zwu6g~QrVLDOW$@+Dt458*Q)K#PZwVpY`3X#uwj2OKa7l8T>x9!axqSC3@}fC?*=Z`VM0x1p63wtCBVR)X1{PL}xvm>G{tw#TI;_g=T^j{aLTQwcmJ;di zP?3;QKtSo1?k;JO4(U$m?v|Kz_avlq(mjc9u-5wRz4kumpYOWPng2|M$vemUjxnCN zpZmE-61xjRyFvylV>mu>n;Jte!q>w`yhd*PnPYn29cN~gCw|XW7&~zsMS_*sY%Wez(b8wt&flDUOB~E+HKNWnN?8+n7ZC)wdV;r^pghJ zzXk`E>d+W_3urimy|W}yaz$=oh!b?masnr*=Q+ zw}w_8N|_u(0M>g7nprO>IrVQt9qCVf%yik9(n0GT5j`L_lX9AETtdp=HBfro_ju>h zMVe{MW*M-3B;Hs0B;b<+M`2v|kiBdYg zeMKp1rZB)D16(107VXHy&E@GOsVvAlkWBRySQzYW+eBuN+~=~MEDY(5BgDmhW?IpmpQ+%n0H68Sy(t5;gISZ(o_AXH8 z6uTJH;8iTUXmqV${dtmby>vm@#0&^Xu9luOIag7A7U>f;8<{ZxYD*dAWNvumIlOy# zjqu=b{gt8!=&Lqq&`av@e~L(dzrnx# zZy}ohu1(%w;Qxg;{6DI^`Yl0@Gl3zcuzgmK4=;9aQfU?bt8BQ6GRPWyL+btgJL;J2 zvSgU`?)`^CNs@;5?O**@#rX(nqmo?GF*mW{vi|#blE>&s0JpKdoz}NmP8OSvZr+r} z;r8i?FPn3+W4>|s?DevnD3i{3k?iE|;oU~zmBuV7cE*P%qnOI{*9}LIlZ08ed@?5l zQG(ZmNvE#eB93vH>NwpvDc*Q6K?IVYj&E~G(d2NL0S`NwzYg{@oegg(V*qag+XiCi z;Se-$T&ce`1_c>H!y)4vh6nFXbKl!=cR3A7%bKn6gPl~4(#UXpwm@((-xO7SI| zL7QQPZpD{|CR;W4H$r2@*bzwY;OEY8$E!W+9I)pJQ2!iW9Xh##aX)C&CKrdd8&s)U zO`G$QIwWBdI}}twSEJ_*x1xe4K+&2VEji6_82v`Y(-{Q)tKqpu!eAM6rw_2cNsjmL zM7^m=G#IC&4&c@}?n~EEX&!RL+}H?n_n&e6n>j}u z2(xl#7)yWCqyY;=i4b#VrCPQq37KGjl7-thj|MceDR zIPbG${9BR#ET&7u52@i`AS{BTCL+`_S)O)xoKpY!<^6kvyUhP}jre~rK{G&#b~gYa zvvMpKJ1vtxC4Izr^##BgDzfYSD!OvmIcZEh177}XAs_iTNCwBb0K`T)hBKUOhgx`4 z+;{#>bh|i+%$#CF0Jc%i*<#@tfF@c&Cu-c(Fl7MH#O2w&SWsg7Wpd;IUpRkv+E`i{ z=bfMoIMN`M0}MBX>Zq&#&<^h3ui9Uy#wFBLM`ApaB@tow13(`jMLqyrFM!u^n102L zl_Tw5-Q^|I`XDN6dybZTd(sa8Vi!lG5DU++zVS+@%dxrB`R047^B#PElDULnvfAbt zo_Jwp{^-<#{M^0zC#V!pg92$0xy8d)V$>r*$AcUGi#jSM<}d~Z;R48zfY}rD0~rhO zpB*kQ-4p@SkXbxO{4jOD@65FDRx~`IrGMpgUpl^~xV#U3TI5l!%r!Rr{LjQ%cJczl zzX`;fCn-<@ZBV9do>m_iX^#X&<9{f{z0U=&jhw$W)F@S1P35Y+EHv+gJ@K6?F*#EB zF!saP-{bts2au+$;1592c^2aOUnC9iusnWYUKz=}<1>@#4_?d8?$owx37%lBb^Ag) zb?y2Lz<_&Eyx}Yz13y93W(X@Z^8qeg5n?~=v(o8>qDOqJzKaaNpa$ugt5zf~k&Z^4|Bk0RQTiXpf zwc4|8Gx6+BtD);6vm%r92?A{^1!_-0Yt%%B#Jal{XW-L7j_G`O6bRSG`WN@V8*Bcx zi0<|Y8xlgC5MzWfpEU@M?5^SgG58QkPcqPYbQ9A~P263P!9GOjZubY6Hzy+l=aN3b zy3%lCzQb!12WIJ`o!>(dvmX{Z=8tP4aR}N@=A7^?3NT6l37-8Px%TZ>1+2k}!n9`T zI#A-aiF#o@!vwO*c0(?wze%hDOgzj~$lm~su|s@1t|31O5cJt-sS*Hfs{gZkhX6z0 zKU7{4)lcfE%Cuib)gxP*RH9(=@Sn!*&EYB{_9+Owd@`)xiDlt%H!Z&NW zK3N~b_%tVM$pH{AT`3Qtd*&~cpLIRJsS?R*4Zlf}Q-qu;xW`8RWq)YN9Xdotf-<}9mMGY2My zI%g|uom1sxP`S#hpXSW0Ef%ofm2gN9^garRfZUxS~RnmOs}XG#SFi#%};DX2$l;1VTRRJ zoDy?lid19YU^ilVR@_MYas9tXdo~VMvx(go^dTnZ<@(HOdA?ZOm0iwc4eR8@4FUq& z&ZW=r#@lE@I(jxaIkKN`>?>j;j5Ts+fuX42Z3*S^;ErE`Mk;%y^-yW89q%r`xZSv* zB#C)GaMxUuGL0(G7xcV+N0Wmi(Nyd6!2TjgTj@l7pz^*=aJS{bNGaw9Kgynn>!svV zb$c=Vss8?T__BD4))z5#-;hUYrgdN6^H(u73oTOq%cj2&D!pA>SF@O3e7ze23WiUr zCyxLhpAU^$m&y#C9Q)n-U?kL#XqVFlT=o@>Bq3q@+@auE#k?{(u%~c{b@q=^KyC^M zo}X6~%GBPTs-gP?*P(~5=Tu5>&E#Jwaw z+Mh%|D?~i3)rzD52pwL1NvrR#83s5F33&2`ZV&&aD}wT>eup?fqJ!Uu7%C_W{x8lU zu3REbW9WaPH}HOapvu&x1AZ=?)z zGO@i0H!bfj_bxX>&Is4g zQwzw&^~H@>b>8*a+tR=9#LN;R#tTzrim~`>2$C}PNuKljSlH;u*0V)$gT1$Z4>1(P ztK_JzoaE^?;h)jez zw@4a1&{Hj0*UnbXw=?yk6lqz1t3{H00AJ-Ln$~`tiOyfG=iQbTsqoi8Y(xXCW)Cl~ z1uFHf7G6iju_H!lTX{nMwj!ey9}+uvPcj{X|9X5R-TXE8pW-@s*-{XzW+fvy`;% zpMyermu760{#Fg6R`Y{<{h6TERp1IpzQXd6(q&gpU4U+g`!FdCloP3d-(&1>^v_w%; zd9cL8zFnB9rm@i*+#IX@_S5a{?F)#;`N76rQ{Ym&|6T<@5R7m-DTDAG`mV&Y>X4K) zpYfYc74KB`TSLeOk~TE|974#}_iGk=A|wV^eOJO@)r~4zuF2c^Kuh6vRwy)Y#i2pH z_+SSRJmp1_ha$84zM7jGfDY$D!DDmr7L79cuYRCzTTfM#VtYF(~YhDZ21BRK16kNb^w_i0(+OH=H?Xmo+tJ< zfS)CtR94P2AIIq#1`MUwPEQ{Q-(Eyr0tG@9gzKgA7K7Grh^{2}F+?}k4%JaPa z_X388k=bqsZ4$|v4ZCzAhJawEtLY!Arv~sXD#^1Eyfze*tJ(ji429FPD1xTXlV_Rd)zg+E9^zd4=e#;n1G>;4e*GFnlGPd zcYI&c$Lyb8bC_7PY>DatB3DOJbbHn^0s`c-P)^X$yiqwONBiQ1ZrINDW@oHsdR?8L zY02g1u)gT%X!i3atd}oewm#d^T@NPePqC*4f^Rd%iDpKBt5I3V32!~bcdPh5I;xO_ zgEM#Q={Y|pdrwH=tK1z9-7-b#QSxXoytxXwKK2TjE;j(0F-1W6h-3l&=PgBa>q`a} zKvNQ#Bm7lRpa-oM1nvKtC9&qvqpv0=8HI&FuSlV{w+|F1F<2T5`jnp&6StoNp~T0J zAHQT`psH=ZCIOTbqB|g2$js(HNe^`VINcmy_=^8Bo2mcV+nax23YG!T3q3k|!-nzz zvH9YNVXtW)QMu?#$k0AuvyugMZYqfbC7{~i#zwd8ogI26hRlqNaz)0UKR>N*5CAbl z$L}K&pFTaKOK~Crtdxy0c@dyCr`ZW}0P75FFjaGIT|Hek*{Ix&wBOq7{Sn54M4$nmb99RWdv-#Y{G$0S%n z*Duv-%rnzU!%@gxq8&Gy>2uoN;uAbQA!)ucX(Rh-`~dCnFwU@aOgJxRRH<@j+1yuX+8xc1DLY|m!|pZxAhHsmKGN4Av_DqZ2@HI zrLcs``6Rxf!wWq5GN948GiCXw4TXH^wE9fiaVqN5#Dw6{G+yIvSEAA?$hV7Lwk+o#U4GS&H0B$`!Ju1gVTM?G#6L#>#8P%$j;Crs$eikU7PSZj`?zMR4 z?fv_JZc85{D7PVwb+Ch$+=lc2!knrjCTyP3PxpQVYJw2Vf4Qr^qGExCX z8287IAK-E6bm0UR1zpuJpKmu+3lI9_1^@!1F_dkLX-;o0bZEi|@`=mLPKSXy2c9CQ^ik9TKH`AXC z7f!6PSgTgETnBrr)a~+dMn=Z3;^Hj_&T)bLW(jd|el|9?#?wiG>&D@~gcT zJd${Ub9a0u&EG{e*M3H+uIbVOSq(e4n{i(koX>@NdwZP^J7a6N!dg($($gdEZ{TAl z)(TI{?K6*-)Ru)aM>6-_K&#IJn(}0zz^>)l^v!-}l1;Y*6*z(pD`=N)8Sv^#%q_bR z#xIq%eO$EzhHGb@bFy*{+>ajlQRh-eMg8n4-*2X4WAjS1yw%Eo#n4cRkt3V{uZZe{g!86TfpXP2y3N@Yn@RFqG<#l{GP%xEk}_8LAh1tbMgWJp9(Km;g!wW;@I z-XcFgUsCdWW_3;sU24kPckgIGxc7k7VOJG+ri=XzEx@XH#;o`I!g_UM!*=loYj}3H z7f$Zh?fqzx)$M}yK4KuybR%jJx!0KLI@(tWkB*jf*C3UZm2K);7$5Hdfu1%HvOEA5 zrF&>-qvh@Wr};?(tOb6AFp)z}XXnfN(Ov>+AHukZ zw))c@r$22HAo`o%au6U%-;e~6Lk#mx46p(0u4f;gt`ht?zeIhA6de;|J=Aok534_w zN#Kl--?)pt-x&~Foi?5)&bODb-93X{u)_o3w#t}TL>kRKT3TR&s(=QDOzy!OR%g4I zo0j(N=*MF@p;LWY`IL@}!<7rqmg`5k$u>5*H&f8VnObW+1P0~e<>R52H1JtqdJ{xh zMZpDr{!EsrM^u^u9Vf9`w*4a&d~4BB7Y;LyOATa>x&2pH$hYuI0+>A}^N{|B{#%3xn#Cry{FXVq(KQPI)ePgt7!uTFOw%!%U+ zzhZU_S2<1Dm@5O1bIJX#v(xSR&<&sE%Nsj8yP7E&^ytX>&Iil7VLmw}y1P=`;J<^w-^AB%^Q^Z=9T^v5dz_%fJ->(2Hz=pr%r)9M8n z^$93sZgCeE7n(x>V{&|fJyEnru$sjsE8gE!>1PHF`MKOH+Y_b-@EdijHs@e6t{jxH!^jwJTHkq#BvQ%y)rpl4vnEH8haI|g*I zkT60*NSs&Eza4N_C*FS?@SaSIZ;9^1*1p)1v_|vCVcu|@7!)#oDa(XmlUd1)$P=3=P9?0H4s+V3?R9CC7k6k4j$wdH!#lI4si z9%3LM2K-nZknU-hsREffYC1YaRV6Wd`vJKcfmg2{qYgM4SIr){ycrV#p6cM{$1|W_ z7yvd}nN!c%3b$eZSDi&Hv-VwbIW0mDLHU%%Aj z#>MRHLuBE~IPgH^@&SvE4sNsip=PNWR(&x=Kq=g&?Q+8!#-)NoN;*%I;`fB$+eR(pI#5wWR5Dq2k1?fxN2 zwu7G;HLlFVVBw@C@QQMFU~nIT$>td3Wl|qHGo6Mhn$>6x&6=fS!bwZ$=wuTlm6V>g z2Vm*VR^~084G)zxBxubY*m~G((SSB3M^}u6y=gr|+YvutXyEbe1`1BAA3o|>*O(*K zKrt#cf*ck14k6@0ow`dqB`rD&jbZUzJ1+~BO~E#S0T-$;D0IGiurFXS6?(?Go&v~} z{$XVdwdvqmkYAAZvLr3NnJl)i6C7{QO~P9m za7=0U_KPcVPGw~DinDA9C#JwdKmY*^k%&i6;2oOk$TEH9|Jbx;RX$xQLR!JftCD)9=<^0IIMtjF;SVt>CLE=;_fsDMV%L zl$;Xk{hokz`(-q*Fgp4vXz2n?4y{X8AHFDyfBcB^gn-Gg<6vni6h6I4_=1Yc*yQ=d zT3abNP$H4r9JzJN4)+=9Jsl4;82~wF1Z+~$cQSV9_V)ImH3BF{zUuAkwdN&tJK8c* zzZ~nMH%{c4M@MeYRDJyTN#Itv`lhP5loXLDZwexkf)#%Wr;t#G9#>C&3gj-ZBm*6Z+9nohJ#H zkKmXJN){2j8uhHc`@u|1a8c9HMI=T^tDBL4-_2|}Y^>@7Jw_1WQ5li7fgS7&q$d#$e<0%bBl{)&!`Rs8Tl5=eVmTU##?Itmi#>b`;7Oyo}}*>Sw-St?zz;sv^G z_kp=idq8Aj;#=i)QFau})thq>{mo&@X>*4Zmn$OiV8S+fI!n)&*76Vlj7Nazs{$m3 zla|xivpf;$zIq<75y9{uKDcE*Y`hs%kHp23djI~nZdo|s>Ow7t)*!L!l@Noy+OYen z&GIA#HUk&$&D0P`yNNhLDZnLxQ6&T%pOK2Nj9T7ti>+eP@)dg#-{QlB#6)_KuQPEy z`&QWR1>)bM1r&02{Y`B^*&z2kq6avIxUQ})a3k0WF~#or4Zk*r?N7nc9)QMQYPF;* zPU@gqGxY}s%wk|j2qJ~Ba7tXg|afOVy?_OKp}M0G|4<~cC>!? z?K#aaFbfD2^z|c<)|g7TKDU+c3MM19PysgpuDZw^etrR% zfkO~F@ZMhNU0Ph8FO@flkhAxY@P^;#FB!IY1gm@CB%`zyfo0l{k{4(s0!nOm+E zz$^j%aElbDBje|Z3Ex9Qe?P-{J%WjaO9uQ?9uo3F2_zL=zQu?TIabSq9;^p}TWcOI z_oi>s%yr?bSsikRm6owOgieBF@87@wl~+t7B*Y{b>n;Ht0h&CKPMPZWkPrY)aVM=# zkLZB=^~DR#1wA|<(AKR|CE_rA3VOzV=B7Hw0MT{7cC6GvAc|={V<18cQUUNG1>oy^ z(N-j7WTv+qrY0r=v|6@}L=2`&(*;k*D;iIFTa3+(*Zg-%s5m${+~)QGY&fnoWd$t% zsS`6eE2Io4kw@?iHMQn{GOagLlaWCex$Fr8afVxqE)9q)W#R>a#_3Co>r)nE`-Zyx zW|Z2EW={o8&7SCu&<=CH%eYOWMZ~% zN&Vx;w%>k1aYC;6Dw@uGD(Z)La(tK6%7yAu9v=4)3ZZz|KW+w6G1S~j6?PjWL3Tp` zVpHHF*-R%tGJ@2SBa}A@I42F006ViG5Od-Lb^d;fCG^~b$qoa~0Fc}J;W@32crMx0 z{T`Bm?YZFo`IQ-}Ke5f#cy}9+WVZ}t9e83I_Upm`2>FdkttKKIdlAOvThEAywq)Yj+05r(J(RnjOPgZ1FP9MniSagPfd2)ErYPW<{v< z*oE@y@&nuh9556GK1O9UsJ%PQ1{92cf*o}K7(rYFWM11P(5d+N;sM?u$9u~gDsrm| ztS>c(DFtRg6xgnz{5Hrw$QX|yxLY=ChW#(g%h`K+dx3K1YZ5+NWDqxty_4W@InhaS zJ&V7O)qpNm*GMKKej< zMcN3^w0>f&NW|fyR2xi%nL7ArBUJ)4!-1CRe%@tNWX%57H5)dU{+F~egz{!G=zx{F zwPl>-F`Gx?adBehlU-RDTteXX7D$`Be0fDB5v)B|TLv82t44Rs03V&V0jvf`)W9Rh zTX*09%jetXV-pw}O3Oy+MI=Eo2$Gij(e_67p!W_K9Q=8Gk4^*=vLzMnGJ?JN{ks*r z$+!-Q{i+Ny7Fp#OEQM7^P|oNVPHakwxSSj}SYPP<-G44t!q#>x20Oq&-8xt!BO@gx zCI9*%$a=w)G(&AEu@5Q?cDRA^sMLFz<((1&tFzBWtk%oE!wz!s{lIWg2s4Ln{(6}s zlh6V36YDzl`?20XC@CpJU=5O-*SGo;?DaR9TPrI8#0kJ8V`HGV&JIpth#%+(#EauL ze>}rC16BpQZikiO5dRNj#az}bbFoCo3Jo)J3|NLg*)k=-q{@hkKmYvs^L=J8l8Fgj zV-LV0#}8#=VBlyBV*?tg*S5_7!}D$n0~EV)@7I@v1cyzB z)u6~eiH)soLlbgXa4@=-ZMDe8*Q?4rpw=E08QH%ymdoyOUCV6llT}R&n}zBN#O&Dd zgJTUqtd$IGSRmR8#4met7Bsw#I(Xh9t1iCeL3BKOGj zbO&%ZM7*p%0Pdq;V5n#>+n+6dE@EL82Dt#UOhZo}k*7#&3!2p;qNB%QXX~r__uFfF zS~WC@FY5l0JCBMf0I_K&VGt^?Qy3rsHTtD~4mqQ<-OSP%GkBH;7sx-lLWuja0`cn2 zImE@pSZ!8O+1c48<>YjaR;7~c*SEm(eH<`0lP=3$F3mVHGP0^4Q0)kC1(`(dpZDKk zz3c>p@j-~AJ3CH)pS|BZmLJa;;zjOSz~Kr9eOl@*Q>m`^*ox15C@e0N$LRB46>m9E z@jkh=n?wS~hCP(UOI?&VEeJ!DViV91#zwV^&$#bm-(_V|hfFcWBx8{sU%E}h&g4oi zZ-6G1UhL%J3_m~tq|N4=s_9A`b8~N$G(X~`DCq9SjV$?g7jNgyrD!e^K<5=_go-Lw z>OOq=(j|1h5C++~Z(#*MjN|?>t_E&e)o}8*Xr`jsnPk0YwQvw#C(%1soDFq(KpAuTswevRC<5W{jE; z-9f5bbZDwnNJD8j3~4@(hZ5d3*v91Fc^ zHusDf9XxYpCG6lFV1~HM4+iY@T9)X^&wgrvdO#;s9ccFM@nTRQTROgUI*CAWEs_8M zb)zd_jZu>kMoW!(Jy z0z{AztHy5R{)JYm+{DM>@?n#r!}2kRd6pa+%4Q0|jxgC^xHtVI%Ru?Y>mN3rO`76A zOioO0I2BtJ{P^kpXa4K8i}=6G|0KM4Li_#+h9YqYw6A4YW&1JlaG#5B-Z84Ct%!2q z$;g1JGWyM^v9r%$`}ps^ebs>1&~k0U^f}FfA?jXCw!z^SK!-jdVZNhNe93AWt}k)| zbSw^09!z7UUADR!EuUUk^THiH;XcEgXv=3_W5|IK>9!f*=#i|QVOQ>`sg<4bFeEPo z1X^TSVd>bR5wDZa^UZPralfrCO4?U=N}q@0R-p)NeKS;0nUZmHJCTbuJ0OfRgpTa! zh}iSt58pInkO%F>ENV(Xx0AOw53i?}oX*Mc9-=uA;~_Vt_zchUO`MYKUJ6gbrenoQz)E@#rn&vdSumdUzEe)_A?iwDwBYRvOu98 za{FneBm0-am=76wV@4C;9$an;_e^B8)AKtict+l5WLloB-QuDnAHwGzx(Uet!5=4d zy74+V&oOqGD@m988dSA%POEWd4$;$LVijBzB9Od6 zTAk_c99(@f?k;0k+Qi{P2X~;`r~@Z@u{soH2I!59E%uzX6nGW0`BgWZ$MLgRRu)y5 zLNZKc8eACp?Rtq_i51}+mkk9ogG|n9;%+ST_PgmQ=O1L`Y>X~DmBZt9$%|2kn-+&d?5af6nIPp76jFFP;r=*Jg-jDgvvZSWfnYY82m@h(uzOiX3nJRwQ>5S%k`bfjZ`Zohk!2|JzzD-9}K0DN`b2o<^ebIo%>GU>EHq^b*IwC!c41?gbyL(iuA zwZpY9R4d7;5Im>!yy}ETaLq*Uk+IRk+`#hyw%*l-c6zIE>-IYB_|On8={Nim$upM! z4O>-mKpTbc&H|aDYdQT%{Rq9zLv1#683$ezj3@pE0k*?t0w^IV)voZ%MUPO+J9Rt3 zp@HfnrgUFPS5nf@&QLbLTe<3~G66`&TbUdpVSJ&k@#>PzlNsnz#jJyce>0Xtura)B zlRM|^W_G2l)b9DmF*3ziy^*zR*7i(g7ZH)_{V*6rK=NnaXd`4v6-RkNU-Q_0_e-)UvvQmt$weFRcnVaGW zhsADwB^VirXs{cY9UXn6VJ_4rdiB~i1X{zX2s#nKt9y_nIxtU^VjMJiielN@`R`G4 z`M`Se&+d?+{7f~Az9h{nle%738+H`q&IAZ!sP^c)(>nTPU#b^xpbM1PsMyrsbkH6+ z^d?rz10aS}N-66};(+)^YrdbK?Da8aDB0L7T6SyZ4FH}6wdg;tNF_p^hTV9+SHt)o zQn_TuFVIAWW4(!91(XN5AG2-hUMv$FU)D6B*E5a)U#?S=X zIh0S-oVie{3RZFYNa*V^U(vLHArmO+(Y%{7+nafRsNMr~X{Yh983z;>A81&g0i_Pl zzOM)&Z~~AOaBSnV)FJsdZ)C#yXs3myGte0c$LpajJdU*uEwIp=(BwbJq+xy-v;0Tx zXg;Bk2fsDy@TI?I1?s5&h6p67Q%>i#SL|HsIPfh%hr(b;#lh7p^P1vtR6n^5ZRqV(ec&*z67_TtSqbiQ)bOL;$sN^Dlel5SgJeVg&XtnNfgw=Er8%=*A??0RGfIc{v< zd}$l-QOOIzkO$%|$7av#VEF9=Zsv`u@2!a73&`l9Y9*{7MVGxgOl;eZu^%C4hLSc@ zPX>w?1Pyyf(a7Q`h_9h%Lf$hvRyHmC!YCJ#aRX0-#?_~g!{B*B%rX^RNJj24)u=JVxJI{(@SzWA6DoTS+jyYLgv_Q|2BpB(Y;i}ymJ2pF z!e*tM-RrCjXjU^*aNR-W#RATT>uDZKPzU!3X8k~Mm`y5g= zL&5(l5>$=~m7lzOm)+4JrWg1d zlHe|QhV&i7g^tYUdX;V=HFNI-Vl}@l&)2{2$MYw99;>L??Ux4nsf9kCx-z14Awk9 zWaKCUk9QVmfG@<=WEkojiv>PqlJrKvKzNYmgYq2KRK)Ds)briRQ_OI|wZNiI+}`n7 zoJje{Pv_!>N!_+D*pIK5lg3`*QJ~9aNpYZ2Dv5k(QfN>`e%ODE-`zL2 z*Lk2T&RIk%TOa=V2k$dxl!A;Pie(7l_=~fV{3p^fXcfN9>%G)8Z?@jqjVuUP#!!0k zObK7{9!} z7$QDXbN7MuOMN|mJU@rDY#!^2m+O+%=JVZN?R2OwM*VyXis#zO^m2RFY!I?WjgbQa z+5$iRdij{k2MA@GR(uUllAe)J>0L|pxIj9(e9$BIV9LJk^bA_N7PE6XQbWEmoSvy) z@mbe8cBlEk*yAeM@&i4=rOMs%F*@ei;ig`T7=_b0()pp*-H|COqUTAjXRtLM$=osH z;@!gAIk&!$#!K^aN-q}A9kuAbXCCM0!mrQ&Aln#)9{+5)eN60s^=rbUaW7}b2?|~8 zU%YE~tUH|~uDjkgy_i*LZd+#}cJAAJNrUyCi&%p;TYX*qC+d9VdS!CKWR7kiH7yK# zXX^!y*1`?LdcAOoT;< zuw%tqaEOYGz%Kh?F+*IjXfbUYDhVa4mybP~2C7-U5+!v`Nb^R~+8YY@je_{h{pz!_ z;n_K5T857=)hHAzWc@IY__)7%pI8P>Q^>BU{zfJ!xAkq4tgDp4&Uwn25hC+sy3USq z1Sd<>tP*85#1&D4vrA~B{{0FRaFeao#N&EKAywrb`jk>ulA%` z3xZVmZa~E7(vk$(%3K}&?IxB;drkA{+rdzIR(AIOP*SMV)fT}oXR; z4wQ@8MUO!6KRXf<37fG`p1+4YkMPd+MI>nx-_dst`%~`Kos%I$xIZQrWo{dG)_*l3 ze%^S<@psBXlXN6zzcqbR}Vx7mc zb^mrxVy5AoqIf5xYN?0LQ&vTVfG#vudndH-Vn&`!Z)mUS-Ps`PmXNNS)-nz8bEwZJ@u?FDy46zB8d))+t9{2W@SZxsR zrEQ}{SC4py?)d9#HdqgN=9q`u2F=s0%*g4!x2^6j@LrK*kAE63^CL8rlTJQmrL_%j zw_f*2=!(_$$wNOkH0pktwVBfN)CdfuuSM1*C_L-F#s%klLcOA%JP`S$PHU2A1$3;_ zk@+U8EQ^0H{1;*uu+}Rbsf0hiTWew~E$L$!r@4N{#vZ!LA+p(e&`c5$6jx8bDc1Q zylqJHALkT&_@yyhH@ipZQ^fS?^iNmBrPzuo#v9b_g;5;;;(f74)8T$*b5?>VbqQ%7 zZ6C*szDuj=JehBd34rveWbXfod!(O1TGkjWoMi@%wzg(u99wqp{@LrBHPZRpVPS8h z9ImQB5YjT_I9HGvB+WR6Td#T%|89_P{d)H;YFkI0RLbo@#kdKVE|C}Z!S7?1(J5#M zwzrDI{@Te_#r@3jG%j(A*O(dYFSIA|T1Ps)7;F_KU%Xjpzn*Eia0g^tKd1gRh{z?M z{N4KJ+Zho!BWZH7Q_3<=i-$j!`-QvNLj5E9N5wnkMnl49dwi`McL%opG6M$(VIKV# zTNT%RcaRq9b<|h(6|d@1Jr)}c@GM>W5@)L2pLkyTiL9&!Mjjm*#c?d0w^ zZWLLrONd+%IW9O$Q|Y2Lpy~BZ$_n1>7)`U*d-=ezDvXcC5!kJJ@WO-#CyR*dPGg9j zFP0>nAq@-o+Y}L!X;sE~lvm478fI>e$b@gV7ImP5eev}4O474^b$S+~spjMCU2C)2 zbAB_A3;gxj+j3;vcjq00o8Y08565?Y?CmiUZo+nS+x7Ijg#kY%z>V&zd&)3HU>FNPW#3Icb^twAQb>F|2a>Kw8l75X^mb1-o?_kJWgbpP+v+FuB7fhX>JuLsbaqI53X7rpFiabkL1r2ymsoTm)UyPUKQ^! zzJJ4`)js&pY?m{syWOm6zRLZy{_Aby4J89ikIUf8C7Wr_;E-C*r?F0xUc05!n=fTy z4&WF+DkHh%rTyj;``d$|+efe07sOt)RZZ{6mp*^n04-Tdc*^D5IfeJ2T#W>mjTS|e zgbp$?Tq^7OyTaOG2VRS|lT)}tUdMtv3ZMP5lGC73ihG1ns(XaU#qZqjmsN3tDWti3 z&R?@56lS026maf!&PpQ|B!A<>x1A|BK#~Yc(&g4#F7M-JA6^V$L(aCByc&p-LuG~v z`*Zs*rE98By`vwXKPRD+3-w_`M?Wbnul#Q(c|W&0P1?y8pPm->BUV_!DU#nGw;T(3 z{;v9{$dY2-qQ{jir@+jDt5DUIR+aNbqY-)Fi?^&mjYF}e0jWkq-7lqlr<9BW2E09Q zVe)?aUwjYhaakk%m^2d1=K6)aCla7RHI_m-s$);{ttJq5H`UsZ9pOKp)D?n^{noNM)AzzPW7lXL0w#R!s zI%Ncd6d8Kywgd0rm9Oy8RECqixAK>M+5%95=I8~OJjS0}J3C+O7)>8_5eizmHx*7z zevoA>nw+Y7@}Xd&XG7Y~(NVn=RYc;qRabauo6`uZ2F_Qi;Y!Dvc-BXwM@f!4uCBuw z=1lYkwI-s4(h9wVZ_89E6J?7oR4GBUGQ^OqAn}0P(Kxi9*}9M|MBjyBV)2m)7Oh>H z7HXo2g{P*wIz{{gjigi=9r-?!mTO@UX-sCwV6-WJ&iOebQJUU*EJ*w=lk0t6j#778 z)$+jk!oZNn(aXDw^E*lIit?9Q^o4>`>Wz62(- z6bI?E_bdp(FRm6nlehASgfEuPN2V6#1<5up4iyDYd;$XNm{oS?-oJB(? zl2KIprsQ9-EZC-{ubgDD70(_i1=#oa5I|C7f{UZynjyAqT{GTDpCG+7j|0^I_nK;v zua+L`Vm{sekihjczqDzJ-&(q}xBmS;Z5G9Pif3hicI$gnN)5@Zu^wrr-#^l$b2QH- zv!e*In^leGu%o<-eP0uEgvGHVS8}hKreP3LzMQ0S(YcGzz^X(>^mniidH!;ev*KBM zSLi7z{ijzdFJpSqF^U;cbkaZ2k~waP$d|jl#TVt!z%d`Y;!5%{l+t)O{6(!3p5=ob zgs0W@HMklUf+HPiHo*R9vKlu&h9h*{H4>&{LqPQjmB&=9nQ@fKB- zUae;E_$mB+4}_~yWFDIkvlcVrc4B`%l`)6i0&Vj5rVDVd^YFekE7I7MX3gsTMiRf( zg_)ayxifg?|V=W;#2ZN3+K0>Zo<<7_A9(PzG68y=_>rl(gJ^IMJ zr{p)&DAT3ZcpC0EZr5Yv*{Uy>C2c2dbVX)kx02eHmT55uqJ9M%dAD6D5deV3B{IMMidincWqAO!aWcXyYdL4sTG;O_2Da0t-2G#Y}ty9IY`+}+)sIhm>V z?wx;h70_MPXYaMvXNwJ_0K~z5Ya$q}qb7z5%~V2wfrFWHSQPt?Hp&FD5q9^q-VWPL7RO!9g(*x)r-#7=0bo zJQ4A{u#m=3_?S48n<@-&+*qyyL8zVY%hI%!3oI<4X)3eplgcmp zL{F1<>{)3pRt_$RXxbtg_tJKKVf1IgF&gmtb*KVHPChZTe`0D0f$LmoHJv-s9p45k zr_)e3dKd|vwZ0Jrz4PDPSzTj-xubkM4@y2CT;OFMATaOuagGyL69k|pBG?mTUu9vy`=Dp?- zb}f6^r?)bkDUr28kgAjRju&XhGBd;^{U<|)>!UN~G%FHzC$i(OZ(M3zhT)2)p9dNf z4b2Oq)pfu0+}arJ`G9^#T2kc^aEIV4kZo@sJw9CLC5l)DD%~XErB>cb7O!}roTr)T z8t;M1mOZa-Huj!S2zJ8@GO5s`zwZc*rD+pquWv1SS6Gijan#r(q$@LmKQ>Z43>33WZFvfw&aG=xgK2{;N4 z6{WM=co*jrn3WLvJgc1x)cxGc$@d2vBa2|-C7gIbnC-t|9XI$gbJ3jh2;{M`m}N8c zjYWknIK|Q#K9q6PX(DS7BSx@>C^a>c^*;v(X_|2&QWZGnDuqW#i!<$vpo@^?kq}-% z6u&SXr0kv}F~W$Uz0axZG!ItN-FlXD`3@ygO#L3eIs}xGEmR{2xx$JtF=P$(TBz;T5q-%HhR=tMkvhjSED8%r|f z;M0;$+&dx5OT%0#yinPh|El?T4k-oOFGtmWM;yvcq|_#%n1gCs95k-AjVnSAueT?5 zGI8|h+Ctf8b#fsU&1jfum^Ft?d~*_;HDu#Fg6a>hZ#J)v-o5#2HwXG_t*!32+y~NX zR5PQW38uVQJQA^ry2L`8U&m;k=xl`6sa0S!jm$p8mES{RZ5Zemy7fgN;^{iJ&XlDZ z9hkK-_Ixa&8*N#=k|&V(Q`^_QAwcXY)Ue{1A-93&)O1v?)pRtbgPvfdw`TFJ;$DOIHDTyR9{ zckm(HT*^Jk*%fZLv?*38+wgFaiR495((GCpv)dWo6vBKAs#MF2y8hJe6LxErFxyp zezjxdS4ija2!Rfbo{F`JO7gtk>o7F`oz>oMtGnP8Bb_%?k>%kpQZ*1Yr`LPucTFQ< z#~)5k*`l{F&bR8xJ>FiKrYG`bIkZjKJUuO!B$m5bB`pq;zdCSDq$)%asC=w~( zz5D2~Y40}sL-bO^8;Pb>z3qxDS-UIum4dvS!|5``ijEEvDypufgDylPxhKKL!Hx$h zQOy8>G>=nL`0N8oUg~7B>vvs&5fo!RF}cQ?1>PbUc=hnPA;rE!<_~9k7db&^eyQmBxYYTNAo9}$m&uhid2O01CQnhBuHU^ zSNyB?g$KQkWSJi^%3qShaRJbn)<81*OC~l=jv@ku?fy0LL}?2PBVG~#Hcc+MzZzM! zu+n@O15#4LHNzJYIVWPORw0}>Uw?SlPOqP5+O`3SMd1kuCQ2JW@~~ij&L#y zV!IR}DE*E^P1X7k)j8;pnkGCKO37Qh&D2Rb3T@F3gD-Y|@yx+r;U;vWN?cFYi*@*p zUB0{UvPrF8)VF}?X27Ky0SDH??Dbcg;;yhpm1!J(S1v=UCRPl%fvgC5rA$d?#IKFt zx&;%!R>Wn^U*{Ktr!G!JC6!+AQ@$kUlyYosDa*=_kPu3JqdHd!wXuUTtjk99C&k1b zQGv&EGLwuoj zDzyq_^y^d(y@6!^%0#}-oQeK#YU{OFxvQ>-k7{B-H^t+iF$O4Vx@Cpd(SqU79olvE^ad!N^^DlsqKuD4$Vv?a*+2C}Zi1`~80F_#H8i2vz(o zcZPpV0JiR8H{WSX+EK+qZ>CSE`)P18Q1cnn`WsJ@@CS^Qy!SeZC3;l;7d?b|=X>*v zrT2LI9h6BIoRyJQ?znF5pFX~JAMU!p|3c(-ObbldS+Cm?%$gk?Q5so22}-VRuIpk`zN{AS7jY8Q^=7VpPS$w? zEb9We(7NyWH1XyC>T~fZ9LQ zOuHGkeq^MMJia*0=iKaFmym&#H(C1v^D|rV`*f|r-0xgIN}K@>0?<)n0@Q#hB%PO2 zm@BR8M%fUabpLQjsciP7{HZy=m|uu8Q?yPqN7qh_qIV11)c2#9Ayv6l6I8!{IL3&Y zk7Ku_P#l~du;)e_$}Eerk5d{K2}K0Q`*kgPVzNDFQ5*|LZ%dl?O#`yYk>0}f@fO|I z**>7Kyw?P3?Ue&4=Nen+UsmW~9G>U0~lZp@_8i=1~ zgTV!eGLZ~_5Eo?Q%oBb{Vi!mGtS^N|v0*q3u*oPfaGZuPMOwrJi5Ib04o`$(adZ4J zFD4pEz;b+~AjHMlUkW;xB2?G>qgc#K2wE3g%`U$PXTxtZ&Xs9LV6_P2!&ArO-Go(# zt=r!1o^pnjP{qxvi}eRxKkrrPFOP0pq4h2nBYNx1^E${mxs)?SihD#Xgxd^v2emuraH6s3r4odgJ#`lCw#zA_|9ngquLqV%-(TxYdoZA z(^x9}atb0fO`?G`t=CxswOs-7RwLS`5K(oYjA|{_*FYhaY-t0RhwAenM&?1 z(NRW$CB78|1p5Y-y!}0Z6z^pPvEE8Tgp*vOqpseu>pRtF0QH!nx$)$=rycxX#Ew4o%4h}lkX5E@j4?njCMD(Y}z z&JUfZX2J|h$obuVQaVCo_D60%Bn*T&`t`LvOFwebmw~~wEFAMKw#U^f+y)#Hl5lAx ziKbtF@gx;D;{G!6dyeX34b)n%`!ju*}Uzi3TvN!Lf4gY{i4%?bKEV? z!QG^!FgDLjFp@a>z&0k4(qo-IFn#SVcsL0#8g<8u{OMsIWfMjNLnOgeA|9o(%?Gc& z&kj$MF8RmE#8Tz-uUw;B5vMmdX zZ=F72Et(S?jAfM!iS9qJaW1VdH)$5r*Tw?VQXsCJ8^$9$lo8&flMbh-E&sf;N&iVA zA{KqXsY)Cu$O?iw)O%(Dp)VDJiy2P@N(1(`?-%~%@oDEwCrk(;hH}I=srMVO5kJG~ zZ;+Vz6RIsFqb`)iECr&|Q|X^HJ$CJLxAXDK4crT}&R*83N5*z>@CfwZvdOI%`1=MS zW{tPS^f5~3BUj8uksE(I$&rw2DXC^?bAD9sIWEcUST5{;1;t!S9h;Z#_2aIa0Y`Y+^Fj#L_Z#?cx0CV82q3xr|fq zt-#KRiVe;0MxL zE_dmTauMV##P>!>P1>>6RCTt0THcL)esPxS`z>e0_}5KSX0q^yA&YTP5A?096q}UP z_~M|N`)Xxwd~QdDS0|SUoc3I&3;u1gr1mmFyOMNAeR95*WiHYHi3|!%dCO1zINwo0 z8CidH-=47V`p)F|YF{PckAjkv0%FaL2s`=|_Bh7{q442Py5Y&$OXHO>6E5IQ;y@jl zPqCuevWsU%An3)|Y(f!bvDk~8{8|fKw{^*6-%-M?vmS1_qKnis4<{3-38kkk-LF)B zBgj*te-hiuHPhZk;%Ik)vdc^R4bT z)8Y_^9=5P$V^cF+jz(lauQU4mZ+_ILn8l9zi1|?Ssb2mk^9*byxS*}tx@dn8Prh!p zb_pv-O7AvuwN;8U*Qj+nQlDax+QI%noGb-RQVHB|?zH@Mi#Vo)2uijEBvr=nCKOiq z8er@24IWtR|;iv0rlVfdu31T8x+qW?|IqDgxhlPZepC z3+Fyvh!Nn*DBW-@1c~~(!Xo9e(aMjS^Ji(Km=Obm%||i6_cjLSRXpj z%pui$`c`B*Ff-EXu_5`Mmy3AM`Yjdb<7 zZ>}L7h{P$`IRg%7#FzB{AkoQanVQc{^{0$4%UTt49+yRW!G1zF(-rsK%-$dYAR2)# z5g;zp?l(k*b|?F@)-%o;QS-3gu1C)ROQe^_nb)ZVZLh*Vbid;5wSy8IdFA)4_Xb97 zeS1&z{3@zq#aX`SLdo1#o5t+7Lwvt7?h|+Bd-u`%5VNB@5P;Po5ccOzY{C9JzjGGg z^a}c3rJ3#CJcLL4+^gypzzugdQ{)G%oC=Trd?#-HT((UwxL0NL4~c~!e0c9~&7+u_ zq2lWUSv)dyq$nn%TqT89gtvZ^&WHsZKkD_ZnjMAg^j8hI0Yq-%cnq zazCbLgv4f#0gJ9K7mL-kR*SX>@9*>TbGs}f7bV)%+A|uO0f#Z0c#!;euXjmeF^(YQ z#jsBXLBvv1?vhrx+^?{RLd7zORo38hh3+ukMzda+>NKd|?xWW_U3509a6+RAa&+(9 zuhPzpuku;jFK7J7z_RCq<36e7&gs&&zbgC=N}gBuguYQN^)AFydmQd5I3Dl+6Tzg7 zUQQ}_<7^%Cr{6(tSB(HVCGGd=oT1i)Y4TJr z+i|x8u#kR`jS)>`0vzMqgPb8%IE&mu4I_*u&!R3so>KM~Bq*$aU`ii1SpBsy__&*h zI_USV@J!$-mb06%+ww$4^`py*xKE)ejuFn$)HFYOe%X~0q2%AIgsd(|kg&DWxIX!= z{_l=7>AJBI*-Y>DfuvFV&&!313~D?+j|2tdviCPHOi0ZweETD&JU*rYqiG@dmt%>3 zD2sVlkkpv@)`|0klW}or&djsV6a}e*Eh*d6j1?`Qpsdx$$*i|H{ECiLud}8IpC{Cu zy4}}?w(!$(`SSKlM?jiX=NZ+|aT9fY_k-<{(5@{FK=%n7RtD0#|AXRdEQR&M z)ID~M*ImpHy(|lJ!Ti*+ZI9)%?MMXvVm!+oVby^+*f8AhzTeJaT)=J{@X?xhdWJaj zj{4a7V1l;JJKl)jV!gBfZYl8hX1yE;Z7o{4I_!Mnb6@)?H28Ke^o+k54l~|%j!~zX zG3=(@R|7b0U!g-AF96BT@dfqX9qz^-gA?})^`9}`=Na~2jrzAeTCW5iw&T5zwAMBS z&OA_oguSQg=$axIZLN-8H#!c2k}f~&I{Cy?tPwRNFKQURv}&Ewoqbx;4^=K|Ms%+J zmb>YwK#9D=`_aWNA5R662-+i(I#B5C9p-Ju_k)*HzvvH^EVVm!lHtD{6XHhF7947tFsSdXKx=EQmi=NReD7KO9woBY&4j$-fIy!h1)sxi zXBU^t2EV&#fUkV``*F4R{+=z!pb$OMv)ZrgmIDW4@cT;Y4e(Dzqs^%9oIbN~D6=~;Ux zGPm~VY+2fT!x@R*(~uAgKmXrRpvE|j^N(MRxAnaGd~_f7u_Hx~xQZyq+_{j*BFSPt z=OcbY1EqD&G`}=LSJ!;Q-ZLWxZB1;zQOSf9v0ZbmKn0pLsA$Li!Zj@adVeOtX)+E5 z3EOp5wqeIHIa9%`NOh`wV^anY8#Oad6J>&1Dgz_xYYNI0si$W=es(4pQkbF?icdA) zgZpqK-55NyfByX4fF2Q|-QKg^!|)L`!+0)HYp+ho{+uUKIzxp`n4gGR&peCImvg-t zMXTOg|IL5PybPBRm*TS(rRQRl*=eIS-8Z>FT|FWYvCv>RCiR}r>f}P_jJi(Kx&!P| z*3sf?;Cf9jSwX5$i^le}s`@FM-x?2>h@Ks{lC*fp$M4d?XG(zDtL3cu)A*Gpm)nZ( zQPlL&YO~kue;74;gNx=8FOSQGVDeo(HiKGT9heg z-fv}qSE^S#*{$u$hW}<*&*}MIs(Jyb$e6A4Tb4A{1%I?G@96Y2);kEKCKp0W(7yp% zvfE;QJ3MQAeYE<&VKSHMul`k&=*=xHpO4wQdOMrFm(Xk+o2>k}OS$?gG%LNm-=5a? zsD&QjFWkMq^{C{bKog=x_(L_vg*fe)7D$SMWS3vt*T$khJJR9wYmyg4a!nr|F(&H0 zC`C*LI5sWTuismL_~pW*^K&?L)>@(4xi`OL_zB%rn65B~y+l-Y#?qyB^7^*4bhSsb zQxP_wE{a3rYf7^fQ|g`y8x`7ArJrLPrZSg_2~~XS^q*3kKwKUkOrBV+9K=P^XZ}d> zAL#>jx?VO|W1F{C?!+6hfV!Yk8<~yNUYlvv7ajZ=r(a}CSDv_wXaa+^4g>s|cUN_o zgPP1y)fpXwpyYQ%o^kWf=0aL8)Pt}<`jgXYKm~-`ewk?JI4B6mz3Nuc0J~Z6oacrh=9zO1!(6D;QVzX=~z{_Z{h`L$ZR;r6{1uaXg-8D;M)7ZEmOw9Gu zpz0o`@&-8QHy`ChpJMS+9sP!;VKMn?VN+rh_ba6~4zqOeg9XL{Q)KM6RY(HjlGkr; z__l+G@lcuU1wplDFfGYaK>zM)raapLR)>dablK4k?O|q@14WZ}xOe-=x;}GYV4E@D zlrM)dIj3zmParWFMNlfloco8v{lT&;tY|%X_xwCdd_24C=r+!!@<*m`t3jN{Xy#jU zshWLbwHFsoDkYp;wgkO6-6JE%tz3iCoA|B)zO|E*>6LxchP)Qo@UE;`4`*J(ItJT$ zXn$;6{av%Z<^Bhj3~IWcZ{cSDqHJ`w@!WdmYJ0M7bhg^M{RNq`>al6>5 zc!th;zCWvUIWm2ndpq&l%X%9mW>_=}iU@Rh=tFN!=RQk^+32{$>wxXMWEB)#y>x0~ z5ob>YY(6NO0ELXhj45t0@{P(?Z(|Pgi)xXI|Ba~rw53&O3WkUxL(;)X#yFK+Qdyhn zW=zEoY9sZjSAH;dLR$zSPkVfQC4y*)O0f!^OZ5Vx^2D%}gGI1-L8H~t8XNETjJB|wqw8pt*$tesA2l8t{rFCdzBH%M;^TY7lTk#y zzFMsrJ}<+ZdCs*ZDgK?UanuP-Il8xahm6{Krt|#dclWmQaqa1S!UlJ}oTqyXC0dyFUL2&gr*8v($ zlVFv0=>3#DIXBlm%zP?t74=T3hyoh=g&%0j4^B=D?oQiUw=(W7rVv|z8!w~7XL~rc zT#TM}1|^5^wy1h@L2_lD3>?MxeCDK@l7ZLXNGna%na{MZ&^F3+%=t6fKE5ovf`rs(HWliQwiS^wdhG@FLe-tXHo;8oP)afY*QUVyoX@ z&G67l?+Nc6kf^B5=2?6wOl2$C)9I33-rI@|X=2VeX!P-46*4(O)cG>uIaVho{{=)r zQUbqvuu}F{59O9j3rofWV?mD|uDQtsU-` z`h#(B+YY?xQ0lLb4Iq&{Z}~qT7Tk}<^J1J0oRUfR@CZ~*jobo;pES9ZOFzJo?w_7+ zzdZ}RrGv&8aKd_xyl>fwvo*^u_Vk{$U|}C)M9xp$I-&%;?wqa%;9vKn1p_;wk)|9T zP6MOu&;O#I`t7x~zRu#)suw@^`aK{lfEc7bte1I)B>eV#{tZ3=sD3{Xx)$~IJg>q# zp1b1!rQT*~#P4Oef{aDQiU^heoC~mf)D(hH@t zpu}DI-w91z;{N43>!{ed^K6r6m@O=clcc!Mi1sFVe(EOnKKtWyy3&#bOdT$Bx^1n9 z7#posK)!f#sG8CcFG=L2d6_l(HYLG$KZtNELhsp7Qc_Mq0owld_{Zz6-7DrJQ1wViVk|#>n$}u)(t~0Q5 zT9dkCeh#pcf5E+%x|1J?*3ec6YhseN0A!ojr8NnWMuf07zo{)w9tN!GA@j%X*1Fu- zUD8WSMzt#kC~&kIbY-(8af3v)hg%vKjW4&O7Mo0svbV{Uph-qrLgrFgeR3P7HrY|D zY3Y;hM0@YgD$4fvp+e8^>MS!Vd``5M9fy&vSNTI`>pz2Rr5$#8P|jZdLO*X7>0NXa z^B-s7mv>z7wm;|jZSO@3b(S@(bhX{BbVn1v{*Xb}RIOkYU?1)bl_q5r0Kr^@3hJrw{^LNaC4@fQLt?7WW09d;{ zB=nRs{wFHChFyjYy+EUsMIghdJETvpdEu3@l%sDRj)^btv!A%vrxi>!sNJ<*Wmz=Rlc$%4@@4Xc)}+VprTn18%ZQTbtgWaVB7k`nPV4o&NK%kX zu0^11h1-YotCvkD1DuDi2LtzBS-A!fXf$~1s&YL_S;^(?qPv|0{P>ZZo=jgRTBxY? zdV2Eirn!Gw1ypW(bp7Kj2Fh?san5E}LeXhV4;ltas(TVEw~d#lu05Rg=hzt1OlqhS z9m9Pi5n4+4&D{tHKqUL)YNbGcd z&g$nB)n`+^0tm+afwoavR$-itpMRiV@YdImH5t`+UB~-^xxMG@WzTPTU0(>mU4bac zu!fEoM)N2=A?a$HB{iT%^SGb0=-qFv<*1c0`exLwTtg;;#ljvQ>F1Diq$GQhG?%PY zOYmW*0wz&PB2fIuzxM@CB982!qB>XEyb?GgYX96rD|r9<@v~2RbT77F zIH!2Sbp(m*!5n{kqJA0w)qen?FndymgALeiuSzK9^(T2vwK@+^NB_H+X`hNa&)+P6`6{%3I|;~TwPwg%NM zFU2fRRd#Eyi(l17T`ctmjvsZ4goKDb#WDD25JY}&_F)4K84g9RyDlPar}b4JPm;p0 z0$z#kucVq2$K2s>j&`FVU9FkI8!GKw^bK1t2|P=yVc9W6Us!B7{W;?zyqne`R3YK5jT%EzTdrLz2p7yu{du# z67KN2)?LMBx~j@5!D8y0;+uJqU=n@&FAFEF;y)p-%s)FIm^XRH9#P6EtSkQ`E~Smvi5-LQ+!zUZau-z?uM{yt`%BZ2~Q(IB%SQ7m6aSdgE(z z$wJ+cqpNOvVl&(FL&y?sa*5>J4m7bRv)MQZurryOnwj1YNC-*trjhDt{S~bB0U=Zr zy&+Ks{nlo8@0&;tlFJBbG}`;VawS=W*PTHdFe;)Wh&t(l4iy49zgKTEaNi`Qcx7S9N02u!=)<7r~N$qynC?M^m429ZXWRW zeMBYNAv|jg6?`*c(tyaFxBMJ-)9nM`4B%9OiRBlj@!E=qr*U9Q@DNKsib>kMZggyQ{=Jvqb%MgL-CBl-7 zsAgMw#mF@OXH0+?zqtC`qEir}FwRB2+60ItOs3mhoK@#CtOcH*oJYB`{PUc}j9UyF zY?)-gHfV$)E2Vgb-?EN(&^S`%?os-#9?MhNo&%ezEA{OBCZk9Er{XN`$^9hJzX6mf z8|eF}F^YG}QBj}(I7@T-Zgsy(Xp+H-Fn1uA9d7HQ^KQ*<(AOfz zilD#B^Ww0_h{>&EgUhz{)v`E|?m#wGmMT~+_2O55Ilf)?sfX-#iMHF)iTe$&$bzS9bp` z$-_)dWvgRtxGd+k&0mCoWdEw0_%%T^6jbfBX97ps2)MEL4-d&Q>Rpf$m1N}rT5KHh ze5gJSq&cfQ?v8xnvccPll_1&!8Y`&vRIBnH0HU!*$>Rj}JrM9ZCjk5)Fir=H#Fmet zP*E2&?(E|4A02J2y*<5+L@>8^^-UT8v&3k~hG6vqN2O#fRxQ6B^QWBYCCI4H-HK?D zxs<4x|ESt2hJ_H6)d&PZv!8H3v8BYU~O&vtsg#TUlxw)S4i?$KmtOP3ka{wJ2a@0xk@@44X2+Z*vBgo zClY;ndWsX1X(yuih_|s^w9OV0k~loWDJA>f#)?-*I(KQ>2}5K8za-|=zVMJ2uH|Tz zJr43ggp555W5O3piVNMSRX>GJ%g~h7ybPQ=HVMh-%}D#T$N5eIX96KA_kkDuw}>IY z630J&?Ppai60JJRRVwY3KF}(MWOwQwy4Wq;Rz#5|(?bQEp2`R%Lu}Cwb}Lr8cE#B= z4eI7JxS=n5#Fxzf2Ay=?PqL!GV#dikg_l;MMiMs}W~5FjD9@xr$$y~uMiM_s^J$s` zy-X~C%OFTXl0ZJA{710pqV@gl_Ebu?CExbTstrv~)%$8z%8g zLLuVV^=+&+&IXJ7T?+WzcFWS)-iEoV*oX_E#1^n}&F1qG!;L;Peo>aQ-}H&8NVZaq zm2@+LjvSpAjm#=!xV8*yqe3G3DK0d+#Ix!e4>=dCf9052VF~zSK?x%nA=R*}I_B|u zFn7+{O8M!jyC-~iiTrHLKA7ZW!R$W9hI4$jAj@W5(8l{tx2(@ub)7c6T&;4D&}iF~ z&Np=nr?*vNlzrA0JGG>pDSs#xl-r#oFYG5ik%3g6^K!rgQkYl2P&umE=mpf;{=k)3 z1DYe70OBUK~Qg-D<+6u5n_IZB~qM7}VA$8^9gYR{S>igx)^cc|tOPa}m^WAHn>+Y{r^n zWo+2p<4)K2BBJ0u&i~inC{yBF~<(5n|FH2^WFWg@f$cI5y378Rky9pXSFP^ zD27Kru|Q((j=e2dYgd_fF_IMSPfKgUk9FXM)%k&J#T6+u~1^A?_tG80e&<8WB~yQ9b% z&d4ekWPSyQd>Z^Q1*7M#8(8cQlDBeQHWBuPnpTcYWJSi_qXoMBdOT3D7@YE-bh?g= z@rt|ybPf$HnS}my&JM)>>|PDO(KAD^mKG|jE2HGfFfy-no4nP;A4|{pQ$s!)j=5zO zkP@f#M}_fO!2au|1j&MnvL>}3n$+eSW|w#Yj$bCs<7Z8Xh%7h+x@JM}d@qI7r8WVM zBdQ5|nyuQ()gC1WdB`0{AQXu;--ej9jT%Pb!dNgRwn%~X zL?{~EikK`TUA%~SphaA`{W2^m1N;nKJeXQJ2h~5JD=Q>Quy!)ZJ{wq3qKGZ{oraP@ z1{===$q-(rc8Eg)TV`nc$Po8-a!R5wVrRbJTL)$<&5Bsuij8&D{ku{ruF|N2V<*qj zNR0?`J_2W?`AF68x1v9xpghU`-6>j`0!c)!_qA5ZpH&GM2hmy$kcx~S$j3IUgE7bKWUah6y+z{0$OU!gkL5AHU;>{>DBe> z;0@X7I?6>Ufl&dxSa-`3f+{a#dglvp_U!_Wf8%28g|5wlFU z=3xOO^kKR{P)tDq```aqq!#QciZ2N7)vmW&8=9DSm!}jS9!?9e#|^8V9VHbmBlVdq%bexy!}p2LdlXA;lKV0 z8xyW@6+@d$6vGc#)8`5 zNxC+dPBa~Sj~YqBK)+d#9j`=|3q2KWda2CtLH^7%=$6#xF^^<1^l#@E>MpXd!m1Y@ zIktyM`FzgH4`TBY_Ij3Le&)5`f2R^2bUxR!Ekq&l^5;MJPLjn7+0y2L ze``A4=rgoFc75hZKKWjxf*!zvywWS4r_}9&oph!IC_uMxPW_fvj+gu*Gx!?T%_egz z3gQ8tGPANQA+FP($W_N8rwC>$+8(B|esv~xQ|E3iFd@LLeQT5i38y!0)tw$kOXvhN zxAwKoH%f?@Qha8i+9N0yIgsFs=dX=yLAIixETW3o*((2h^CGH%IXiPd?Y~yDk(F6g zxRI=IMuY0RXv%w6$L(sFcjW)oWT0(`80ugs3&%Q>e#K*%&zMmPOyG4EDTAS>%KIDL zjs}-ANTJWR7i0e+)7ksu?=!S`E)(KEv^%J`y)}H4g|yufX4yi>_(^cLKMb1;cg7AZ{nkqC*-&w%2eOW%)55W!BZ;ptF0K?J_Y}U$FO*_etub726xzy^aKY$Zye(<` ziAm3vb*L0@WfLOz#%fzX|FSYcUDC%$Sq4p+lXsbaetVatZ8bm<^cRi~h4fjH1mYcb z4FL}(IUMCXq|HKiU45KG_=*$w^#@q9&xZW_?oiPAUhpL27K&7n$6USYKP~KYt^9Vd zGdh~Mld)z9Q))E4F@{Jeg;t5ITz}BP1%*hV{c*PJA7Ra3raBB{$|X#x#%y^0nH3R~ zC*6zUPKpB}xBe4=EFDV96)ar!Kqs3l%r&EHRUcg*nX4JJvSr^ra5>gQ&|}EjTnO3H zD~O|Jg)5d;ERNV&3jLYNdW>T)*@x{5%j@BoegNi&_F3s+`i{3W%)Hife~%?HL`kl} z{OMOP8MOjPnJH2Dsfc>177;@G$THI5@W_v$IsSz3ZhXAq;GUK*%5pl;k#gI~190Vn zr@QJh0tO13@ZUobnNz}?Sdttovq(^NNfzggSKVJdYr3!g|MeL$yl$sgk4l@{lpH$f zeG7QOPsb)#tQjZ9ml2wlaEet}Aj7yG_8>Qq+_*7kA)g!J&pQTIleKYVTUoR@`+5qR zStK(=mZ|rF$$~Aje`1v4#^wiTNnr-R!KFlmd-~W^A=A6i0ue!vd4|<=1FGNlSw6L2 zi9)ds{^^<4oa_x2CyUiLY9JFL#h-&0`Dp)cV_p*4A~)(!SFdXQ=Vi}OKzcnwO0SFq zT{Ss_|XnnoWN28=d3v(iJP{n1MP`3c%ek2id~x#q}wz3I2F9+A#5PGPj9!G3Gz zb>B&myBpjb%>68Jv`X(pD}lisrWfmg1N%o7rl&ZYLt7#%(`*#1U-^2DG( z7J8h!xaLYf7$N-Tn1L^BjQppc4!fvNOtiqCA-&#D8l2!59)BN>Xs;i)8w?ewz&#T} z=u;WS-0`6R@pt6ksNTJWk0LQ>0jCszSs2NUp-sxPDMkqc$hvQ@cJR9wDIE~JRE_F0 z@H*Q(nz_K-dZ*oPv~`HI&JT#zBhc*E*QH=Tdd?Cw#SDM?;`)p7_MqNVB@Xy%n1-O|5e^F z<&*lqsPGJm*`&U@qb^nFMCQXX*J+^7;?7dC?%Z262fef5Ae(2!MN`HeoW#pzjGO9= z4LD8cZmRB+6z1RI+wV%C{*$-*wI-)45lUS|2hq`l#xrEF+6Bp_VNk3_&Gow}8!f^E z#)UglAZenkwvtDrzh#}Tlt~I=+r;P14MK;$gyuj*a&aO+6YC zt33ofF$o<-u!v5Ihy2#ep;6tjk?Ip#)F^e?+Jf&=h7qL?Rxxbg_AirsvQc$|e9Qg~ zNi*T6eaWxA?5!LqZM2f5Q+NxuwsS6D1v?#&a})z}>Gw4@Z@KuFC79H6)w1-~E)4&) zlmsdjIZBzBhiZ;)t#@KN-#N2X8~hYA1dr@`7=8(oH8Tq#myi$j!$vTvRqMfY7|Te@ z*C?Iem)GAKASp`V4A|YHuhAcw3;x+TLfXH$aBms&-D<}}=)Y3JO!*yevH1lr7z&2= zQp&LRf0^J)A)kl5;y0P?&&n|B2Dt>e9Hf2{wpMA(VRM(`nEmdK-XOOaM}6xD3OddG zUHtnHH;%RHk3P&Cx-lV*nn5dC`dL@_n`LZRzv2Of(%)li^f?!%ABX9R`H08HKWN9O zzonuDl*3pL;EiGJ5oduAP3b~JA@-taqhoo7!I`J3i>K{<8UV~lfrD76-ZGS0Wd%Jj4&JH6&q1BdUStEN_ut)yAwR6F0R^XI%4`Nc6s!b z1CH*wV9!v4srJ1?#W$VOZ{Q@sJ{%d2ll|apHd{CLPdutxDnQysOSli(265HT|GDviD?tn#BuyEj%|zA1O< z_g#W>@P(>J|1#b(lI^ z;lJFUxW1e>7<#;qBoZ=aUE^b_1z!|-#wIr{cnxuF5856vq;U)c41ikyJ|I~TlCVfF zd*?7|Y@UnFiUZunBVgsP+Az#naZP-@d+iCZ!fL7}ZVb%JXL)|$PhH~LGw({#7Xx~0vh#c8Z7DSYiGk+Q%B3B_En}xR#}BTAd&@e`utAN>A*v$ z=o9}9OU+qt?^6?KW4lyYwD$SyldjE10W+j|vYzk~ycJa#ic_ZV-3qFwyp!n1< z4ja6PQJrkY!{L!|;7LTup($ENbs%H9uvn9kIo%cXcmRo)JeYvgIJdPShNm1&tt6UQ z(v9!$FOud1X7FJ*YeQ42=!Ce9>~_T2IYV?&X$ue`pJ<+@C@&Cx)VJy*Aw{*RQli?- zg`!k8JzxxRHinS=)-Ac(9R3JSPc;E_un&A4Fo}*}mEA6zMw-tNHcvK1;oN&m>mD!O z{pnYnUV7I(_3mMFGViZGnAeW7#0>b*0R>ndqx=eIZ8iIGPDW$%G1837HCl; z+Vt?P=3>gyX@}kq>E(dZQ-_?n1VnytI6?x074eBbk6G#$ixCp=KIP?gm>>SsidaNB z5%IZWG6Atw1jE8rwoW3N5Ef(1fQx{Qc_iz@Os8dxqGeqx`@A;!ey5;qm5BI43()_e z>aD|~3imHwrMsn(Mrnp_q+v)0q@)Ls?oMfu?gnX*?(XjHZjkPVyFK?l=XdV^^E|}t zcfa3Q>$3=9?}@uvpQX;f02lY_s$$%vX$jDvk@n5LoC^l-(Fb4wYN`ON`cgSzz0Pnx zQ)62l*^=Gp0h&UOpIRjt2#`YF2x@vfhHgU)uo>xGmhNT0iORIlSpGO?lzb0hi@5jX zvpj6X0NlmW(m&mGMv8o$*)dgicAbio;l8du;O{qCEjCInW-5^n37PbGaptXCBwifH z^iLOu2I(hiP@iR zW5(;c9s0!X4mwsmU(c*Z3mGPzq9aN=oQu=8WV}-jz{!|84jjf~8?K5>cTX{8c&;y3 z)}wAy>%2(PkSPkCk&|Vn886yZr=Dv^8sag+cyPF3MOa)+m$VWGKl>+l^jvx_CW}FB z)%wz*-U><}Hl|}(UYI7|#N@)8Ujwu3q{cD}Ot+OgCCh$5Q!)RynVVF=JIJt59>ATw zkF>jwQ21zk`Z>{RO~yyh1$vpx8h*$h7LIPeeP-6kUsZ3-)ZE{>h6nIZ%((AZ3-@p< zTCu8U<9gf}H5cPi8A8Rn&!zgV#A-*B!?alzOMSz;4udekO*jSL!#e<{4boWQ!gh#8!gvT&_ zu5cgRJ?Qa6pHB9KWh*o`i+o<409;X;0MEeV+O0Lfv5OaZ-PDU7G3wt#U3TlUvRrL8 z(_Ir6|14Bo^W8~K-mIj{MVJ~*i?LeG8*Zj2GzCYL7+Wg`v3gcmFVCvNl@iN*?VcYF?Q!NnI`ej+Gj z9jU{&@V+}Ps?BRPsuXTLR;A&mSqO0~BnU&f1U*BSe^FnEiZEwIb`$Fs8B9;RqC*C7 zC4fnBVRbk|SPyA+Eln&wLLWBpq(V@%r466R=x-im4MB)=PFP|TWXRrM0j_34V_`|s z95;Sdn}EZlEm;P38smfvN05#{YDi&TT4=48e-aAn1nV29yqr~x$)koEIgI`}G-Zjk z027KPbx3FUr-p7LhJ8U1|5W@Cey;~cdU&n}rF6>v0oVvoCdhZq{0W_XkS7q!fA?>| zQvuO|yU7aEc|@$@rWz!aqicu=7fZQ8E?i(RU{KOn7S6>|73xy%olW8=mro4!v^c%o z-tu#8q@P}T`(YPyCFt#GNzM~tDHV#H51yS}3ir5OXh|zk!j_}$h^&yO=|8^wc!(!cc?ld#qhT1Crr)2mzVFJ3uj zY<>9Wb~~T5oY0>R%hD?R%Fc|Tj}#^SK4e(GVWTM0ErpeDf9q7QDH&&y@sd7?w#*P@d?k4XQ&X_;VwLReQtlE;P z147xhml2NPU32cmUk^6IfV!Je`w!W!OATx%^YJ!Mb~R*y_|-tzpk1 z0A=^glXn4#kaJPxF?@+OMbpWCdo!J7`w6RgwR6v-wG0B0?Y9wC4d$zX2S7M*}1kG2|L zYb)%ue;ORPM-a+;4~y8Q_J{smRucsXYZ`rGF`phjDx%wN+s~p5v>1c*2c%9wt?VZp zr$)GD_qQISx0>8VJb%_sz#f#0ws^;$Owp4)BnAhb4~ArM%-NAPb!6+neI`i`i0jWY znj|g}^eOeT)z--M63_oc5aIO;O_A+3iSLFomv+uFsz=O=^9VMfC^UW{m^&Y2O{6^q z^bgfiZtqtL;l9xFM%Q&^l=#9i07XZJbxSP;eodsjHk%4}vn~F~JZIUX@y4F?4Jgkd z7w6c5guhfyh-k~hBV%inS==>aj$O$=GXp|8l1?$3jB$NnhAx8>VMU-s>-KQ<`DE3Z zworqV5)PQ71JzQcjwX9@oD!+FJ8vo4R9-39HYzPJeFh+WTf+@*zo*h7X>8gp=;w8QV)BO- za&$J?jqZgE){dQZB(UUh28tmQS*~83Vu~S=`s7Ghb4%B#^<4_ejc<;rK-t`_wOV>j zD%LOc)62&&6Ox>D5`ldKdvbepxNz!R`tJSA3C5NAK;i!!kXe{bDyflag6CE;1O$Zo zjUWrx^Sl)r+z_{IHYy zCKDJe_SlaoU!%>TnPDiA#6bv;$B5JeKC2i;z_QUKS6`5w>4$9zJnS^f6t!#GREyD< ziJBlSm0FQ&1qVbRpE9zDeGEtvr@4!+>L~Ro5t4(sC&4KeynIADc?T{$%P`D&Pe5Gf z)21A5=kKqa%}h@agZEYx>gTp04O4v}{&>q$6q?U(l*OVowx&qX$!l5>CqMXMNWQD1 z`8$i2@rBdIV_;s=T1LJwF}rLWmhi?w=C2a3kEx6r-^WAuJ6$GOhlEY(P934kQd)a; zUD-DVAxz;Gf?%!>)rIyUQI?jJ%uZXH{e+q8Rz;`^N?_&RU0G(o>BT1lM*~WnlARO1 zF&2cpW9D(L$yOxN_C`s!j+ct!7$`hHcz+Ux-7bQ!hLvd=lD;ooo&=2#in}>C;xoQ8 z8O)1HYV_=r0?kBxlZPfP+X)>;m%!ZrU|dPt#|jS^xGH7x4jej`h= zJdS%wxLXEr6|nR1iL~9`=*nii&SO&~nPAyHY_80e(Z8nJX@O3Nh9Dw@V z#%J%*a;-J~q?AQ5LlC}wqf7d&Odcd|(0DK&CB!wY#RHR#m-iD8pJi?yBv02hk<&*+ zLPD9Y2q68o=06S?#e_q1rVqKSn>Y9a@C1Pp3sBRFtV7A4$D3PEy@pcNUNyh+g2jda5Nd^1j$N$u7`9P&?y+eYKb7OU zQk3wf`=?a$CoXnHvv|;Hg%qyU5(E7x*)UNbloM47^}@;jLJ-^l!#_1-t5$BIe>@x? z8X`f(UDi6)Bi3L|&2PfsCx&kSrOCsq)^J~;Q$sBlXZC!#xoFum(Apj+D3eEWENPd` zF6VPbwhrC2RJFq8bI0B2J`)PNZm5#OY?lnyaS*=cr-$6H@u@!Wt1?ciq$4kDn~?L?z}X zx72jWa=1F9DL1w;-9#VDxy!$MnJO@toGuiEuG4?@x2Z)5OzFTbZ$RZ{vi~|WyVUkE z0BbtlkPR3&$jPCb8iyDa(-P-kL9+kR(SA2M%2TMuLuR_7F_6R?v~skIfQMFwX7lRW z*R)Abs5|rk!ds>wu?;$&Z|-z(dI-SW00Gzl z0r=|15ht<1wb##K<0iDduW z{my8)2#24JT1J=CrR6dEf79c$rI1J~Z-Lkv&70lG;YaIlefYw)_s3R|MQTM)4?JUR z-27sNs#NbI9fp{B&J%r}X@Q5$p?cRysbB z?J?6oIo3l-bN~8mFPk847Q|hu?m%csqa~~Lu5Bg z4dRYMK5Cg8T#PEzB=D6F-=|20sL1)IIS5()Y`@>K&ehbGA*elVXv7LVpo$AoCeRuL zM&d@~`DV+70uW?uBG9_TWrp*l_6FNB?cA?A z5Cj)hX37@hTU}yIsOMKTKR?rzQB_qRD!5$K*jL&Se&uMqKtrsZame4TEjz<;mDhAP zfF0P~V;Y&{7$O%k>E|klkE1f6ktWZiP*ZBR1;dk}e^@&r^I=!d!b3+4$&7m4GoY41 zYeBpOUs2i);FAsiqYbDOe3+#HIo+MnZ=PQcm9gagDq@tAmQE2a699;@Bl)s)xIq81 ze|)e#ydVo8?awvPcy`%2(xs6s$+~s~%kJw+cBeg7R>(*NoP#1Pi9ekDiZ?MWM`V5% z;m8JJ%$!6p#*@0ohIA0Gk1gDE$I+%qd{X3tk>=%v%ui=cipo5ClK&tmMh*8UHcRs$ zs$2PC`(IqhkMfN2A_sxYrHA(!X`UJ4fw=Oj-v|{j*;9zOZ(0xMXBt|L?Zn0XwLL}v zL`Pq+@SU!8{mVZw`b%9K;KQsxs;rw>h^9?fJYN9x-voM|MBh{OTwp6S!XiEIyaXTS zaZO7Wn$4)6pS_mt`mBJu2)x4%5P2+@YU5QIdP?e+C0do&OPh4ZO6r;;T3a*RyreZq zuxc8$zGggeBiVP&2}RmBjH)1ho9LxLBDF^FZ7=fhw%dfsY*wh z-9?Ah>>#OId{7K*-0rda{bgvDk3~Y}51iS8ybKB)eR9g20^-x6kV6Q`Q=?A@idkeu z;WCV0cYvbBhQR%^u>Xy>`6oG7t^qjaZgE@hre9>0e{!WgoBe4eRKN+U>smS6|P=7*r1N8MFI?y zf)oN>GkSXP+YJL$fIW)xM-b<9aGb*wIEAkdMXqy^_4yPYU=AlI0{|&9YBXG24m5N} zfCyqS<`(A4)9Hn+N?o6eGdzLNb5e0IO{8eS}WsD*(-2>tm#}ZL~`1`OdJc5zg zZijPDo@4tDMxkR`(%~j|iHOr!4&g6go5Ma#mS)PK(xJkpjdso^!OwjrUY{0Eh@ zqtU1hcRo(9O4!Wl7=dSc;Jo>ho71vJv#4tScixMsyc$Xcm~Sn#`81t`)#YY~VVR0t zG;mMoux}Tr;0O;W;>0W_B>cFpH)1s=PsiR!!Aba;Q|cluJ_dY`tE^yblg%%00eK7f zFnMo>Mq`LER*#p^NUL-!QpBD;j%Ud`JhZ!12C?6ts8M56$*9bmu6ZiODCTe{L~A7b z?XT9d!$YIOJ>DN1p*T)(Vo$W!k9Es zzPcm0F4gLIzV0`qb!*rzw$WyN=^F%HFz z4S3$S1afg%Y+7!wJ-?mWB%PU?!f$QidRsLU>eeXM#Vl8C5x*BY`?&VF8VP9lHcpyO z*MVI6%|pFc7Jv!kl^bIxST;J>dSitXLO7@6f)1P&D3F!#4KPbEmd*pQAOLM(H+Ahv zcm^Df_`W_;gF*4rO$)KS!p^_mAGnY3P-y?m@CQex@t-z=31A>7wU(>xW!^2R=v`g_ zG(l~rSx!8usN$G7nYlb3=&D~FGlW_o+9Cz>KUn>jRv4?`O zG-#LYqrzuEkEqq6=wqXFciY{KmqXpP5$ax}wY6Qyadmw?K6Afxef0jnt7ro=G#d9r zNr@3j0Yg(3`gfkQCzlOy(_rCHnZlZ2rvm_#LEztu{p-m^XhT{79-}h!Ej<}&pCmud z0WVUYDA-KpGkieuS-N>IKT^#NqXP1yA2BbrKfy8^Gv;{o_ZY;2%i6nJ2z>t>gCPjm ztL)L404T-!lR!$0a9^5CtDZz zg?b|e%@gRgFH;wT*^v(lf~{C_*QH63a*;^uk9&{nGO1N$T8HE5!yeF2 ze@Kx}a>|rDvx8igz3mccohE3e#BQ+v8fM71dZk6OsOgiV9%i?AF)0!38IWhSuv(FG zyzB2?Uo;TqZ@ma-xjm^*X^glW945k0%*fSdjs@ovDms_%9V8Osq|-o=0kLq8U~z)13>#aj1XPIbw^*GXhghDG)KcS|A95QG0`dta}vqOV8a}*?N3{5 z*4v&ES*zTpK2lS6O&`7oc3V9ND1nCcpj=gk3gaQE4A)Kdrw(#Yz&Qj2CEU>H=%kaT z@m6M6)B=~!2fdFV4i$<-R$x+W;?6H!qXq5ifAeirF}o(KpuoR$lqtf&E<=StoC^Cx z^bZh-ugSc7`rc5}?0J_W`Uf@##(9>mVtN`7el-O+aUKpMde?cK6%o4Q&i1;*y5qP3 z2U?WyJ?U^+egm(M&3I*>M;3SN$nM3{U!F0CyM1Kg*JPlP(WUQkdG8tED%cym>LT*3 z?}IBqqdJfK2epUAY$l^zPhES&&ND>rb80xvXd-;?ejWXKNYrbp*nAOgTt~j>%zAEg z8;JYyzgLG?z}%aE8Vmk}B%IDxGxNMIg64KJClCc0!2xeQWRssorY}YnVknPwG3$Dd z_oC>9)<52`-S%ww+nqaGp8_?nkpj1_hD;H^{asK1?22qtP6IUE4w&*aHdO*vt9I@3 z{df(_<77vMn#Mum;r0W+)2N%|LNQ!&b-*fgGFWP!dHBv3mOeSmSyEeOyNLTQy}HH9 zyVXr+TtDqEpn-Ei|$xaC;GqLZb`18*VyDygFyyT>LaCeV@KQvgCZ8{`!C(v$zF4eP&}7dd68@a0vUxur0+iu{0IFB~wX8 zw0Z8TA#DW$BIT>Tjd=rhfYG20(VJs|ZYzK`1ei<{1f4;E^T2*{n>SgWm{Q-gJTW6f z@uGpsNoitjPT`w$3OKJ9nAQT6T|lz$;)3|>wNm!yR6P{|R&5`DF z-;yPzUw9t$UOk^}a=Qs!dHQ=m;Cd@?(qIbJDB|_l?i;dR;<edAsU`i#yj~aWP-(Rso@ z^;FT9nJ?z|Ffb;8l&_d%;~ldYC%}-B8AtE8z`hIsCqW8-LICWN8V}bGEUd^e%$ert zeiKNMdusq}1XiwL$`s%HEG$V1OP*HVv~SrvB+6{t71XdTH#z>dC5rcSapplOenp5R zYoltEdKOOOJkXA7%V?+4V-TZN+dK$0%!Y-i(w1Cddj-a;*mKz-Jx7kbYEl^An*3!C z=BC2iNNZd;VWqF9CNlYFma4x1_s@h!neX;w5qog=#HxSwadA-pF2<-}O-IApF06|5 zHW-PldF`OxF2AY)siRXKO7crDEa^_lJ~)S0ZnJ`L*5tyHL**H)Ig zumD3wmh8rr$bt|vz`Fyv&c5{!HkCb`lW0Vtl*z{hcKOwl(|@^JG64^EAcdqw9)vpi z$I_1uH*6IuntY}$<4zfIQ7lc<$2hU?mfkl7#wR*|_s&K~nE<8_N1OY@z1y0C!r0kV zpU=PukM2+?>*?F|z{H!gh{u!N2MgzlZ)=np9vjA_eFj6jAnT?b1fXeNb35z92El8~ z`+@%FrMHGqENA#<#iHXr_pK%u(gb9Cnd@DJNp&~%Melh=-!5G%4F=<8zvP_2}C6cKM2g^h%?&6aC%<-^qD0Es;~EJiwn z!&-jqp9J4WvyHIzMvW!zpG0K$v%q1DA(<4(32d4$BB+bmG@dV74?mHY*frQs{4p-Ad+BJ`M*9b&;{XWOi46E+DRT8McR}9Q zMc;s0jpm=^{W@hcvCX}=jB(a=*MU^lMu|tC?9|I^B~921f9!I9-?ZEcB6HGssMh+p z5==yTw1;lvDwO=rnlw3MK&5B~$p4_u`=wRF!8;DTWBOtyCMuHTY-|dEt)$rdJf^BT zK$--64J1JT!Pv0Aw0WK0?a(PQr%y3qmZ|z5`%e+TzpGuR?{35}RCG z>scMp#317fJmhr+gLucoxA^gX8eiPw%xI;bi~^eVmK#rpNfU07zR>TPVw?~sgb9fE z9}!t<0snIqd+tc|?n=mW33qfnu)a58ug>ZBxjW0TT&j#7sKc=CkFWXMal(zEoLf3eI)E82A9J2JZaU zY?kYzmu%X+kU=R^2qV#m?WT`;3RwQAr1{-nUy?6NY4FJpQ|B`tBBL$aW12-+j5oKk8d z)B=>gkrz~;`}o;tvHbwXb#Zn;(kN+C!kk04DN;L(fG)mIN8aO*AFn{IQ;^pqk zhy3gV?l_%fI00wNorJH}Z`PB)>7s>vpIh_hxLxyM9TU8y`e$Mu;+oSQNUqx2Xz;m+ z%>=Bb3srjnF(z%Jm!u3B0mrsIHkCQ_yjya+-|+%)1-1ZF1e-7k%dhFgUC8G?(PwOX z8&B`3B(c?-`xwd}?fJ`yGh0EH}O+1U8Qw zi$$fMz#SZ8ZDF7wSj0#+&TLO?SLm9M z3*eLfbiB|D+%P`OIrF!@DLsTR#jB?$HI6rhjUgU5lHBaWWNT}Zo4K*zTQaoOByQSq zWucR%zXSe(+{bgd&TPH!i>gb=Vt;DF(9>C^2pOX(PPs$QnLzJ;MR!_cT`u)c6vjBs zb4fcR)Z`6vi8HJo6;Ck>zvRtU{fgB81YyyImghZJJ|e@ zxpAsbZ$c#dCVGX@*f=@+S8N&qk2N?CvQf&j+Hq*phJMgHU*Uil2njT_4l);IV;c{R zi)mWBa}S7113cH?A%(*uWlb5Zo*S`(m&2h)Yc5FNA5Ys7BP@few)X0Q43dx@Lm;pY zfE1W`pWX_OGL{{EdwuDmi3Q5?d!=%-Eu>yT>!xcdZfjy=N24E)Kr#TNurq;~1fWsu zFxxbQYFN76B8hwtuBhmsolEHfvRc0v;CbAVLrs4tGN&S7F0O;A>d+dW4=Sb6R3fRvin?4QALAc<&CF>x0#m0tsuR2=Z`>#-r zRdt-T#0RsSBM1{5Nf6>$oD`urcPgFUM}Qp*kUnXme{3{j04+N}eFD}W{oUJ4;^Hmc zdzQOq5(=_d&f&f&dtA6G1v4T~%Mvkk zTq`cyO~m*>RhA>pcS5ntQF30@5S$Z!<5E1tHkkc?Uo72 z{$qMW1s2G#Ky%B^JKqPO$?8^Icz9N9xd2>gLTtOzSeh(R0fup~ zudgt|g9o3J`La^kd>3$!U_r*GW_tGL5lGweXIr0x`}a_e8qGfpNTdOqx!5s+Hy!cn zM@DPD;=B;sp3&nsK+rWzK-c&bMs9@Z*VOhOG*WPWbstMg0C;H-DA~>_01zD z*-m^5qU%zN&337PHG)1605?J+J>TlY(dF;|PycaEY~yoCa&TJZ{2WoYs*t6;9kFD+ zy;$U|TWR}s zwJhsut5fb{DjTs+`er2q@rN=8l|_YNvaJmB^9HuxvzQ!dfwH3sSC>9;b}&X>Be(?( z#e4XG+P0N(tm+^kSHj|84lx?Ys*3A0Jr*GGUpY5iT_k-{0pH)gdmACX{=-JVI+OQv zMhQ7}F4|PAEK%>*k%Jt{*!Vv59kYY3$X&C3qer%gtw=p4Hfue)9WLi3R+nWhE~82W z_HWB{)zSL?KdffQ)1yKUHU)u+?gmR~DE=doBc;(-7>*y z@|X2H?7dc*7Q~IV_|=hYe$8gfSu80>)F&vLr3yQRs=ovRK`+g=iCL(}hhj)<3B~F3 z9^EUP1HxZ3^YhoW6{fxvPh>)_u8jI=nw}fpPyhit%&EJA>lDhm==5kybrG9|28N|w za!r_a+x>P@(uhAAFusk+PescDXaTqarSy#pvefx%J8{!QDYuU$gbVsA(e!1#{pHU( z9!~sKW`Grdu&Vjd(Z=ROUqmKQ>2?*->61>oC9JXwk(R9)n?y+i5pu4g)q<2pj=ot+R)LiQS z{z(TCIbv*l9w}=r-)~h8v1~EwJ=4vA<3;Yb#wy${2_v7M)B#5pFq3}&@?g_C+8;y- z=&pH|ZOMQuZ5-~iLMM*9@PK9c=j&8%3_IX=P6m9ec|X-}c^#Z%%u5vYYzTlcNBBnu z&Z2Vcbhjrgr(iBPTi*4 z`_d&>@8;)O67?2*%l~Tv<}e2DWAXAaKQk&}DP6}NFG&4?UO__N8KfKNv|15DEhmN7 z-u|xnHuY#4K7mpb2Ez!@NRDHy68zK{9EpiUMv%TwAmnkG`m^2Gl)MuQWt#~XiRnG} z?NVp_)4SfQO%v1T+^-HCEW+V-QXG9l zSIwN{Hla7t9faIxb!ZIVIZXSElz!cqg_@@x>$=!-zIJVmVa zRaQL8?=rez5x85zox@H-k{*&P0T(pptqcb%uE87qg+jhY)BUCe;Q*Li-24@D(kat5 zs#q;8x*U?mvtTS7lM;6LxmsBQt(^GaxQNV{lJNAp3HZ=`G3F^@vB#^um~)j&qMUIp zCXn@5WIKi~yd7*zB8yF2b4IP$`;evBrLNyo01R+5Wb)_>>a8FDgOk znjdG;VUZ%EhCq58{PYgxU$kIZ;hnK&9zn`UDSm`o`&9YX3U8egXb7*QI8fYvr z%B>EOq{iH;x#;TgIx@r8x?Y*c0WgwzO>L#W+V>OduT_7lIQ$R!0n04_Es+Hb=tp;W z{;)0eCxa(u@!)u%F|P7D{Ft6z_R?Sh#BU_(F5?0UZ=baiue7H%WhFY+3@wliOWn+q|EyKp^OSOK>BEP!#nyT4yqg;>E? zlsd55h%x+Ig@oYfZg>|QwtGfF643pZ%>Gt8Bo+4jc~Z(W8I6X1y%28uc4Mtly3?8u zD?7d&UA9QBOM0YhN1!%FmQ_K5I~MYm3c~Pza~Od%p(iBVKJtPz5y=*QIi?B8KhS`e za2tKoL!m^iW~4);!;5fni$F2TxD}`3Cp`YpJa8kM{au72vex5gg!wsxro(w;GS#du z^e3_;oN;b=S(OJ-N?I*9*Lf{^F*llA@lHF}9a5vsaG8(vv;Vgv~M{=sdt&f>xV?Pmb|(sjkP07 zz1dSnl>LkpX|IrzH#Flg8ET>(u0UbBAtRc`Kx^E&vJc?qzDV{eQGe{}kI^5geny=5 zEP7=gHCmpB5e!nxkHR{eV&A~!l!B(2>}8+x;8o}Qa&$DrUGTw(=b&!cfXf5gmv3hI zPB^pMJd@?;rMDb%xCWDUhVcF_m08U*sZf;7A~gia8;~nRv-!$P<-~QYQv{er(^K%Y z4<`;_*oNFK)%%60mM1;=tU0vqwsas3dx@t-vYh0vt{ykU z%|CAkv?%N}_(~ZmzksD;S=piAz*1O2rnfKf{9m%Z9-#s%lVrWu2flWo#KZ%PMaPL& zq7-)rN}2joy`NVfW_d1nd@dtBFI31)fQXvSb3!PT;)my(d2P!Hr$l(ON+4#ox2H`y+ znn}LLqPn_M;s`hs+iujG7dtvyGx>|=%8ZcErzdi>M)pgIwA-}X?vNk1uPLRC7NT8o z)XB-j(q@u56DD5J(AvX_#^!;eBRHxPWh}to7p8F}tbUetn%1lefJ6!kZmi=dME&59 zacE?sC_19%>#sQXyzdaF>&7J4YW^0f@+f^?;t!5}Z{YdzWp27p&j*+k3b`i%Sq8^i zJqot5TgI~T_k%p}k)I=*Q3ndg0+*C1RWGL-cr=selV%L)ipheD6qfS<33e>hl6FYj+1p-o= ze_8+7ua1lWT{|>V8F^vq1tJW6{}>YO0s(W7f#KoAf5o!+Q65qMkPlfQ=zI)}R(Bj& zoC!v79GA{L?U(G#jSVlue3SRtV5Lx){own`&qD!WB_yJLiEqO0Mn5Ay3%5q(DTM7R z!+B|7gWgF#xe_x!4#)22ZXL!9+LQTI;_&O|#nwaM?cH~E#ap1;+}`hdM1Qlt5C(#JOy)gU6rWGQBb!_E;}4Up9ixYL+~ALds$l z1=9GP666vS?l&+q04SFp_Td1j$K!F`S^Iq`;DC9BFN_msNyNO-9g)duH!U=x%JF}m zY$hQDgW)xA#MVMYqvaFIKjKwx+Y@O4Hj9Uh$m9768K#FQ$jT+oPa%2Yw#1*s;Hdwe zpmlS*ljKO}Xowwffb3q9MULbEBtKV52|n)D)?MpZ-p;$-Jrm6a&p>T%IX92gu3-FV z$i=mdCn`NHus0{MI3)Q6ke-6niWI6AB*38y3lWG{vuerL;pq4TyRrpSX?zY5(7p&l zw=q3^18cgv@y7!Wf@`KxQpK6hnmBRTD?WE)oj;1e5hH!6v69 zor}A)j7iiA{lI@xqmw&`!;F%dgedo(?ck?;BMI3|J|z0HEL_iFUX-cPb_J>Xlt7Z$ z3KszbGcGb$Z1C2WA0Wk4wg`_}c^N%fRwMo<;E$f(p zOD4`fc}UZ8hEg|H8m`8ig2IpOI=^}{Y0w?PfCO`(%R!**(0k6Eo|Bho1& zgA9?ygYrc4PYrSiibT|d!qBhTUw^SsTG#`RyWCX3Szaok{b5j-Cb?KqUaY+9FHM)ed6uQwo?EB_Rw?4)bGr}(ZoH6l z9I$vr5_O``9b%?4(7^%y-)n@m z*O$nT@jscEnJ)*`SIKJ{ZdU~e$vxskUhfLrw!dJ)_^A$Vkcr%?>AG%k7U&5ELzn)2 z7T_4GLFj|Kf(h=P_A=Ka1Z=u)y=vTYEAv>%@w{zX+e6iJ zkAW1*lxS^<`#jp5Pl!Abww*^~Mi1@W)xAFYY@fa?me~)5Y&|u-o@L%2`<(l1v^|~p zK;7L@I930=^FC~QeB?1kD9uD@W(uLFrv;~K!RLGbEUc$^hg4{z@s|_YUP;yU(bqs) z3tz+6H#DiwalNC^@$N4%;TvXDQB#?}5*o;q%3_q&C}E!O>E*JSMH})o%eq`Kq&Rl# z&q?tnQw*gl)zmF(y&wsaRk|iM$YY$GReU`%Qidz@NA|EAZo=2@p(a(5e~G6`%<>i( z)MfH)N{v^{8!4={`T6qjrc|JoG(hgH_6Z#-!SV-gVr6S&wZnCKey*T5LzSP!lwA}C ziyL4}na@3yQGU`()}WIph?`4B6A8d&U`rL5 zGsA2dm>zKCcDaj}^D^*(T5s=if@-+3e5$~`vWPb)DG1*feQRsE1pl`Waz4dBbFVo$ag|m0bHNyhdH>{ zc%$mt1crL-2QQ6C#(#-!tq*hL@-@uYmDjpTG0FN1B$Bu-S#^@OYLxxwq%D_q4#l+( zAAW@@A1O%JCbHOzDLXL#%`o9F%hA%Di;emlEZ=){+MpdYQess-8CO@NkqK$5_B||wlCt*2X~0$!RTX`53@Ln1l5}W z_jtpp%qs~9le+{0ZcI!HTra=sA`;Vm=;N#A9RpN?NNX>nn0J$jnTF=}e)kQUCvC6R ztGBC}TOl9XItF(b0X;YK)8^w^AXe1a-rZmI%-tcq7X~PlHpAltZ^k@4Ia$_nX)^)0 z4}kqQ`?7kzAd62UcRW3zi9Ad=XxEo_i({?~4Ob_ZmHux3jjy`5ARw;)5u2B-wmyQ^Gvk+?*R!?Qf!w>f*UQ(@N1u(A@05A1FV{A9`)5>J zxX`D&hQ0gQy0$)%`x2l2dsKq^9Fcnm-P=a#`?0p$&$^fUT|glmpyd6R!}DNB2@sat z{rmKGH?PRuMkMgJw?$YjHQQcDS}yGtDS7$dww>zyle_=tg!2L!v@UB-eI1Ibep$8- znrFcQ#sYL=DDwPNR=OhC4D2b(SbR*VOLpa!A;wD-vNt3fT-Xd8O0R&*SWK@oE*;p3zP>7n!U`OE3Uz0J>6G9l2aAqWv zwc(TahgN~cQ&p_jgquvL)tv8lEBd2G=;GLI$A-^(55_eXEws_Ym$fVeDWU9vE!V_| z%vb`(KPPLitEItAM(bbJ&U4p}35QTrN+*pi<8+P%E@TaSr)8|JLw+3aV1y(uo(Ma~ z%4*<4#VY(sAFX>ha+`q z;wv>Zl3+@8M6?)tr9wULPCdU*ePjLQ*|WTi2h@}>d3bFXL#I$Xy9h{Of0@^vzopGw zQgX7Pxj78|Mn#{lv{|(TP$x`Czc)1SMkv9v@j60hVi{HWxP2cU`NTjh!^chjB0#S1 z?Ts&ovI?XObcJk5YiK7?XAYg+zOJruNBf%sMePWO6Du+ee@(t4;TtZBno5L}WA4O+ zx%$)9uL2R)jeG8Y`2?x*3^Q*#<-AJ%HJkt6{cFpG#U7~Uf1E0ILgt3&f;Y5dFZfc+ z1J%TT&GdP;`K?;?2B_r=>Z_YOrC&QvmHSDyHqW8bZd)X}L%Sx)Yp-QK0efyhuGZMu z>x<8eNWak}AU+hnTwp!B=_B7N6S;KDFZkfL=CL-QqUS^0XXm#-QAr-cXvy-bT^XHCDPq3E#2J=Aq@`AzJ1>B{r0ne@Q34=VSsh7b*(dr zd62qJEjRkM`=fndkPHw0EW3PQxy9TDF0&&&J}M?N2MFuWCjNy6e+$^bB74{cL&4qg zdim3|it@K|0<_-9a+hrwZy+h@u0Yp5@CJrvE^$M8T zCYyA(qLS9!h~HUv(Cg~MH5I4C#1emJIkfn?uvSB{6v(JEI4Uoqy=dEJrHj0vV` zAWV^iqAV1J{!l5rSi47w?iW#|zf;QHh8gd(xn4T&o3lJWif;|PuGgbsNcM)Q=s$k5 zJ~yrMUwbxVt?Qa&y~R{zs+3=J_M0NlbqKrN2E~>dG1wog#>FFmF*8Zn1w?d3`jH;t z11(x%q6f12hjS1q3i{?+Lq+2%E9opJ8A-Jo)QFnwS@_uEsHh+l)l)W&JnpU}V@Y-n z4laM!Sa)}+0L7ur?fV?a_0AC$*c!h1)L0vLAdyIOffIy-L|Y7s+tb!dA8hi7uOj%X z-K=5j^y=4~q*(fwAHvMs2-xRHG9ZW3p%=Oh;5&n8DFZj5JQahiRYyKtbsYg;tM~h@ zd-b4=n}_hiYtW_y{lLu}Et@Ku#{_&HT(#GYNOHjfG(CsN{1~O0VhwZSqD?b%q1Qj( zq_Jw}SN1}-k1^B89Dcg?>}{KKRo&?nr~tZN@aV;_nCT&S?ng}Xf7kfMmtS{J^xEBb zb5-3?v2++c(7>__r0~2xLtY%$oDH9UQrv9ad+Y->_2B(psnA%s|E;40YAZgqL<__;TC5gJgJznERZ?bg}tr_^PDRJ+LF~ zR7G^^{z_X7yGY6;XF?YvK7-M}@{H-Z3x}!CRAO9vh03c9;pjy=6YSLRK~Z_rn$n}{ z)cPJpiL%*Gk`4f=xjFIVHM%H}I`t8Mq`rn(f;!v8q(HoU{y-A0H_eHAw5u>T~lBN*m)WlOOccshSbB$0*>>t ztw;YGOdeWw{cguyjt_-xmR&2;O^+!QHs$?NXL%xX9tm>Qk2$5Li-jT<8rg!yvfR(|Z z^lPq8PTWnEgA+AWsJ#Z8I+4%nC#5`pI17qH% z9nkJXPR}5i?nxuFW7}~koEA1p3Nbw^J{Q<*`A%tMLKes%%xb6k!J_<)dt-1} z3R+d}2kO=eot60GJ+2ezLRgPv0V$kiPjha27g;1rFb=J#ZI$gog;Wys5u@$OG9;fc zKXFUX>5H)vAGvgMS_`&!6UtcQO3EKEWZ`t3*LUjgzC1c~Ixvwo>Ldg3o+hqV;K^NwT(6;`aWh z{oSIq+2u3u_5 z1^6Y4)5Mc9>}dvMuKjm`Wre==gmfPy`2VC*H)ML>W1GSO;DnD~A(9KhhuvGTpRlxI{ zYRC4O`)(;GNsO_{qi9`cb#X?j=_^)TN$G71KWYe3isc(ps<9D7`sdjN(wTblXI=^u z`%=E{Yj}LJ)WnZ_do;82v85Dlm?sa%*8`vA`)Y2Ck1<^-eq`CDC{@x=OCle_r!b(8 zmnt;!CAM)(qR_dCOeZeF1+J!yOrn9N zDuGaarWO16G0g>F`(@$a7`@YCiINA)W~~_e^fY}gN)Sutl?648s>=@W+b{0!MdN)W zrDx^f34>%n-o+mLUN--Aj0+5;8X5~9KjReKglWFpgf3Uj@pw4kZ$j}2=?hY*(SyvT zc-_d8zCKg^-uV9~KVV6s^xZx6@5xD7tEE|SjhTH>EpkyUx>ju`fi4Vfgn)mJIXvZf zbW=V&LN+hC-^2^f$iUw%>27>{_S+jK@9B{0e8t;9>AAVV?!M^q*l9CZ^qDUw@t3%P zW_zqn0ACx;lbT&Sf%${qw;s0k<>aTmo@aIPQ%IjmF%bOkc34wGGHRa!B^4V5a>oeW z{GDv@K^{QO@#_pgDoetG#Ld=dF+1dk42>HXL@v3A=cX`A4zGmU!z8VV7#r}JjdbkaA3uiUBEa0C!%IPxVHS_PW{O1k%nrra zIw+}ScnALZ1%6tHkqPZ1rMAsT<2{aa)+f^KyCZ)#Pk zRXyx36lCE2keQOp)Ll?mKfDz?D$pzm9EVm%=jPoSuORW0qUK>wD+Ja<7@c>Pb^>!3 zHKUSCCz2I;Qe@#QN`~4Eg2Kp)Mdg*^UG_(*!_g*D?EurPRr6}f7>7+PbsCf7n}kX8 zjNIH6j7#5}8cERj-X1OeSowF~OPJYYQ|#z_vM9fRvWPUsN^mvTrC%uI-U=l;de&?P zq*KWWVbZg(K0+)n&jLWojI3<3&Pm!o+XW>?Oke2usqN%a_}j5Y8rq4-OnoFaPb|nl zR3-{ZR%N;D!{AqJ*5|xErD5vK|J_QN-yA({h^q2y*!E!tzQO%Kqw(p%)sT1u= zP1xBZ36npqQ@|WXgCQvh$J823QB3h=99ml>u2pha$J4NwN3^%3X|XnFs%`S&ZEA2D z!Tzsl%=s|6_S5Mk(1I@Nx70qUUY%mpmD{KHqSfo@8NXj*u$bVB*qBh3Q)PJo+NEr+ zSFa5$8%L@ujL^GemAJpp0bD$#5M|2Jhpzpw8iS`#keI&1k6Dy|Xmm%vhZH$~k*H8Z z>^A7N<@}-F8j;MDgr6OQ|1Bn;0rC}sq-fvcxiH5FDteEF1|OJ~jCO5-rD0Pt<+FOd z{KEz{o`;Cud+u0)lQ7Je>D!fx&5&&I#FEylbfZodBbY9RQC(;Ev1_?BMA&3je@lS3 z?@!h!I`1e{K3ixkiUi0kxsz3O$XwC%P%=y_I|>rt1;t*C3tE{Wjx@gARqk!+blSu= zT9sZGIt8~ZhWW64ZTRy7%JyFM$!YDEw*Fn<7a8cpwD@C-gc@DiCtWaxF-Cr&=Wl+M z#|D$|iT^crJB{0j+3lR}5mPeh=qHaf8C(0abryZCr9)=71(G)OK*l}v>pl1ZRg`?w zcfoG?YAu3lY4ZIiCZ6lomG8i=%+7Puq0U`L6=;Xe6F#|UG4lPD@iB0p4V{Wnuf^Vf z-~1!_w{jeD;PKjrYmElBrlW4q54tvbbF;*eeR7zn-F06{x=RlX2N|?BJikUqd3E;@ zK|{ToQIVGv4y*lj4Aj(eezO;Gv2I|MB2`p?<>K-1&v4}pwO_5!GvLCQYefc-Lhnu) z#x!GgX_Y^Zf`9Z62Td4ag-k*h!rl+6WWw| zAI6V0PW7(Nx-@YKEv8Ec1XC7M+cKn843pIJvFV9+M+7PM0`6W-n4l#HOpa1C?$wO5 z-*zNs6}s~Yvu zXV$@RA`g)30^prd1N^cey~X~;8UuB`if@;hf;wMaVKth**8JuyNa+Km)VRQ{+2B{J z6oRXPN8#7R!L&|>T8NJ7Xpwf6$T&yiPjKqsZGK9ZAn2uTISrmi#~}mTKj&nJJ~uXV zNLNq#+l~7tKm#q1gy2L>RG1zo zVOP zeG(rwxj+4iNUQM+cU7J?sB|O4`m;2tFqerq+?dXo67c{)<6`K8W};*l?FbPy!4oZf zdpe%ohf)#0Ry{`cvV77S+6qf}<8TlS2h3r%v;OkAipT?OvAkzcqV?A^-_3C0O@wYo zc4el>V$(KdQ8M#9sQ>QY{@Z+yVfMKPql*W!W6F|fExHbUw|tXb5(~eZW0+bOzdY03 zixFPj8O-nWwoRGLsVs|Mj?MqvF%|!z@E%=NXU$+gqOH{b{kAMkECM1M*ToiFWDaN` z`9CkNiWGz?1^b8wpLi9qS=$X2%)9fr{KX6vZL;m`^t6Z+Lz=~o_5%LjcAT9|qEniP zt4%-Vbz|ai@j-i5jVo4p%U`V7brHz54ViZD54`pCS1IqmA+_9hu4oJEbQ(tXY`3lt&V)-wO z`Yy6}42T92c_6KP8cuF8)dkADFfc#Cz!NIT7F|ut?$A$~J)!sQwP5lx56c$SB#4Sj zu3Y%3!htS|Y7)T&@mAIb;ottMjIy3r=#YIHj3~!(p3T${>`Ic3pvW(nlloZwn$B0s zV)0&5#1#q+dC!Fd);cI&f(m?zlV}CCw4ivvxiy5M$CPx^w!u`s8QG`%tq1SXwSiEk zHtLz+lhe)gZeTnnKSpu!Em*dmq#BDs&K)BHEc=rVc=?aJ1cJ$(G%o3V$sk*1J=JXj z_QA`W!%qfnc|@U;5@&hLxnutaT?8q+{rHX#rFR##mA!%Q7&qVq;6amx3+&ye^US3uV#SYJc~g z6%vLxv4o1`+at2RPHEd7aWiR#smzk{w><2ic?4;h$&_gm_Sx?BjL*GRk}mG`?GE$e zgS%e26E7c=o&t?IjBxs<-IASa{Zu6$D{vCgEvigll`GIH)tHt3EM>WgH~pxZ1Jk8M zCWIXR22{l{1%ke$hPE|J0OZv;hXfyS1ith zxZuNVR$#eMWHdxh^+hSDa-Y3zi!eK$4n?Fad}j2^ayu2NdGF(ffni?joYl(aHiHyC}gpGGYx zIcBWjVh5)mE-a^IJaz-44)XNYeUx`)FH$MvzksWM=fglz) zRx-G@7E@Fh=oPufF)frJh^0O`$&vwUM}A0^1romVXVSG;D;nThcBUNlFZ_h0nN zG;{uOXd+BTL;s+6#`u>|;NCqHPioPSV(Ql^UpReCK`Kk>b#OpkO~)}Xy6?ux*<2gK zj-lj|JnfPWj*_fbC|{<|R;>M2*Xrv9L}azvg_*Dbu62rR_qG`XIS`MpXKFMa)49{s z2UXY{?yjEMO>fQ?NsoZD6RN^6@>1TZ>G}X{0dqlA>K`x-I`+W(w>oVj0{64&@0P4( z69SD&At^k5EsiKrDaTBYHTGEl1uiFSmA(b=uTiLgshuif&>W{IVgqbo5ZSHrU1w+y zURX#{pQzPajjhk+90aBfI3nJ;Q^A4}0f;U1k)MefKvOfK5k1_09%-M3o2VN&i_$nr zmP-s$;#LSKGsJa_c|Xrb4o7+UONDV%D$^x^m`g&#s1XVpMdRHodpv5*qL9p6=%q_< zpT8loXDUoMTKj%ZXJUlm99xV8a<|(){|3v-7Q$Fw&sCLO1O;9Yhc68j~IG(H46SeqaCP~9P4Rd#wBUhYX zV;&Z|<1nK~oHD~scp5Bp`Ie&MUE@6SAauN~K)d|<;9cmZu_hkZy-=9f+QDlLO zEjE~1)RZw*^w00qvRHNd{_B%W-9bJOX>p3xKHOsoj(88|pR5(}AEPaAyTqn4Xf@l0 z8P++@zIr0~qZL}WQ%v*;!qB|0j7jW&#@_)^ZA5i|F${+C(fKA?c`PxZ<9rU!(Y8ft#M&%XMi41Yk-F>@$pC8Buqlfp871C z^Z<0C4nvfc#bAvC`nV?^8I4!%WbT%HBshHm0Pyas(P!F=VQ0!scWxw(Si9csXeUx{ ztjCYo(xgj?Ei7oX_}SUgX^$g|*v8#4!Ot_n)c+UF{&#`zZ5bIydft8%@uPh!ZSBia z{094O%Lc71xQ+I%}X@!k@Pl^3O$jliG=`8V#JhWemh{M zE_nE}DXi)!4J19q$hHwN;PQ_Lx3)n)JV6)B?-=_WbB8^LxL8I#yl1s?6l&_WPOD<< zl(BC;*MDige)s-xigM(NxY*hCE2SElym2|C(gvxRKLOXloRCIHRI5}{HZTD<-y@*# zG`Y@I7&D#25fVM@id)?j`$d;sBTe4BTb?nByXHbh`=Wo$>Acq*6q7K9f-uzj0X+#k zrtY-PsepETOO3TbkTz*+A=_NnsXt`jK6gA${OjBxp-ufAJS8pAI4#`~bYifC>m_%}%YcaLcsy*k* z8%|aWXuUllxqL`YiUye!O=sqU;2|mtPOLU!2s?+jysI*I*j>xG-Uo8BwY1{pvHl1O z(?8HR_-jZzF7&~zDAM7~`&o#baaFB2y?#UD-A80QxExv~ca1a!4W4uqWDyuBe7EbZ z-9L!^TvsTAe3DZ1StVdC=X<84k8=NXy*122 zQuzs%W<_7^&cE+JpY{Cq4+vq>rkNM9Q3j+bjNJ?Fr!*g>3Ee0P@kKRFZI7C zm69hjd^RlwuO+^x^wS94a&_E~SBvD;Fhq;K7=6jFs;EdDDN4`HBBJA!Lg>Ajb82<9 zUp)YXs0REliI=q|n~=6?aA3V<8gSCNZ~j_wP*L4JN2e@>x%$EOJI6KZQuRaf#>LJI zUA6xW$(L4nOMmYbw-;=(humr*P-FMye;;RLy-Ji0CbNA;5oA=#hbT-%$PsjrpF_y= zir&bdg7)cQF|DUB^M*d^ew)eT#gHYY)V;_xk4e%na!PIrMUD~Fp*O8TMrno}BpVaO z{CLZNe_<&S=v>Kr-oz4I#Bw;YMZ|i+3{|1~yF(na`jPn^rP0P76m5I8R?{ovt*OA1(&ZKWY>MJfS>wv(9Drt$>(dIvyP!F4 zAvUyR+Uis~!&CVpg4t`ngUc}8Bzg^+_s564caD5op~x~l zj4?Hbb_K~a?CdMqln$jY)^wzXXBFXU78NmNKsW<)k+2aNO^m^%lihA{KDFGy(Z4F{f=m*b zL<132N8GEgQDvqxbdwLp&zX`VPADVp63J4mNsB$#$yL8Iydzg(bEP8uLkph~MU~X?3De9iSw#<31h{=wK zPf&lWv!WGQh)R6J0>dJT-HOu!6NzeTguo}}?s3dlHoQ&#X+>1qnh}G&YVG#&;$CGl|(zi*>3%fZp3pNFyLR((KrI`|`A#D=HgJDTSMuYUb14H%$pJ zD&M$WtpYDERTOi1CNt_G_mJ18+zX*+rB_1wwCWmWE_>ZBNC4x1B zBO@{Y0VaMHk*f~t8R5_-T{M^N9rLORhdO4V#`9~BWF7%yIb`b6KD2i-bUkjdVmkQ= zg=_4f4*JhlUev6ML^z(gx02E*60%2Coc{%L0MDWkjX~ zz0)+%@3FtX3sUnX$T!!lJ!qLmCNGd?+%4YZVN99kuG1wJ)4ijDeXkQZ<@Dtip5IVF zsY*?JFqRc{=?GhQ{Y z-?3((EK=1RTpFkDodcn<_EKD|c@{6rk;%whCPM5_;m%4>u`xA#nr*7gJ2?GYk{EIg zBZ!prK4L=?mop&;L3vtDJzSk>veoB{Mrya7@8(=QUtEj}-^#7NWr@o>;8E@xCU)V$ z#VrYH1{RXf_NI3xCVZp|)v_Iz`GyuHkC zC%(a@ntQ|?37e(kVHPb<25&7^IeV;xt5juk%q-jTCDL7biOMpN%Oi5EpK_DE|6Pew z6hI}|Owl3aDqUUU_fg{009nRP8^WMH9Pcqb7DfivVl%ny`y-#P^2R#L1{r-m=?J$B z?F&FDX)o)CU4G2*`wdo<8HsB7cW%>Es@;M?2z>6kqylXTtYp(w&VI;+(SFtOXOPIi zHuUs{A<_5Kkg%BFyiO)F+tq?EG8b7|y&4xTLXR36nu~V_T;1?};gLWd5NqszLSNQ)us4dOA!p zj2r?n4i}ydY?$J}nrDtroV@byVy8dBY_jb+ChZ%8s^t}q&FFw$6edz!I!KK>P$VWD zLs@pWvXU<>H%~;fJubOLm~6V>HQIaVPU?@RX##k3cW#i)j7F+Wrc7(qRdDFq)|TJv z49>t~uPHb^6Jc5Y^$?p}Tv;f8U}Xh2Ik^yi9M;K`6nGYKM`b7~Vk`6Xw`os6Hc~`3_Kj|SV zrs3$rRRm)2p^1sW2xC6zgV@-eLfgD$BBAUMcp}DPs#>l&a>&}e?#?HQ0I15g+DOV$ z$|5ys_gZ}SwS70GMz@>KM}qn@Y%H06G;)Nxp1<@~!5Wx71y`xrsR(4{&<lhm~N((RamPImh;7#mYZiApoe*mjsW;+yiAX5H)zZC5ggWpwDf zB~L&;+3p;12DPuKvd^C; z;%lm*2bqUac)f%|v<+)))#K4~|N^$M*KPPn*Vy<>;}aB{Vd-J`&Oc>{82a zoG$Rrfv-2Yf}_Ah$U_qFH10R)xQdG=;7Ypre1=9jgC>uie&X$WKc-aM!ad|NnQi88 z90oX{$2uPM<4xrv4^|3F0JfQa>;(8Y#EY&u#tD;_Jl?K=s)rGf-qGS->z~*)sBQge z-4AU15!QR=({@O0kzc(#;f};f5M(1P+B!-u&^RoMvXV2XnOR|9(CBe(iV<;F+(_T+ zDll9cGWB1+6ku+|{C8}T8@i%wX2KhdJ03 zd~G!l1=Bt04O?FF2N-hjF_dGet6777j!#i`5c=SEHiV6rnDDRGuAMF_FI0C@aTIEc z^uOy)yGIYIpqwH|r5FFT?;v;sPd-Z`^{35^RGgHnP(Juf27Y;HocjzA7^R8gO_PAj zoc{b`AqiOI8|DcDV762DtjbFJe;1FfCC=9;!zcQ#+sgCno_A0u0BZvhSlOPgm|kIk z=%avN%k_9I*Au#zegg*wxHO7H+uhH-xz6VT9(j!xF7+|zkN<2DrKFGa2ColNfQG^! zmE6duJ<43$E{&dSOaI)P2t);_b1JGGo%b&OD09GtqWfM(D>>g?z?^$8?&fiPJ4FO8 zHk$XAuYXAYX?O0Kx*v!3T(s%FAp$M!e1IwE0(g5lNlCFd||c@E!A2q5*In3+NRcMKQoc03p3e5+_PyWH57LPo zT?=>jAW=b|aR|YC)#SptpKhs)`uSS?3%9yJCA_hJ6cU~Wpjj{Q(Pdf@yp!F!_g?f- z74rX?)`D0a)5KbK|Fg=d@a<}4+-xv7kG1fws~|nB78wAZzBxJ0{mrAdcVeH5rK$KY zJY70rYd<25m}UNiV_84ogX)a|h&pN!8tU7Y68*q>AI^LA%h1G4S*=s*IIc&4I|6SZ zbunswh5(tIDu*}S`@Qp@Z|(zipNheO08u$Q`rgzOZidMic4j_r{)^$v3t{YAV;Rl2 z#n|H-(HR)YxMTIR*x-bw7>Lt?#&=#r3ttmtG=<(k6U4zf<*4OX25W?3Fu|8Ni(;Ds zLs2Uf1x?E0l8+z1enD*+;I|w={#IOXR%flq*t+J?(qp5*>L#om5rQs4*I{4ckR;t{ z!kfNp6s2PyA9M=XaB5GSo9wr}NwmYNv#8+Y&2UaoWLDp4_L^zbE-V?cTNhUTXfk^G z+Pv6cPo2-ZRYx#RU;<f7UNkyPrwR5tZ(p?B2Bp#LB3KO3DalZPyxSoe)%m`>9T=%1i#- zS<4AF7M8)yS0B=yP&|WQP(KpSEfRz0LowRoR$xc{p<&Z;uTZ_8AAVK}E~9{bI<9`9 z*!_=fPTymFG+glJEw~KZ(PuRaA0I?kJm9l=?V^^c4q@_0TZOiE}!wYU`5g=WJ?|eiCU#4uNsWcbUCB zekk^v-24rGyXe%+(;EtSXPGcVtRZTkbsnWfHRKdiX3)3)6%G84>LsjyEG&KIvJD~I zQRJ;?UIU1|Dn-)TFYoB_p|`d;asmu{3y&?TB}uZJIE&rI{XV5TItNTsXAVYh6wpM^!@9LyL*W zL;IuGRqeD&B31HG+B&9{R|;-evmYFk8d*u$6dNdJUlL7rVINZ$Sy}KD#3rIG=I|Q& zPI-dh3)iTD>c|${T`ND>Y^BaIIVan3zjXHe2Oca-G-P6LAANZ_GsTfvg;yuge!ilU zu`D1Bdb8Se+4+n$>H?Qs#gZ0eLrC-?JUZ$N(ocH~3A&>mgJnJeS=-Ui=_B=!4NR$S z0h=Y$zQ5$o^BOgJDEu>zP2u@g^y@NzT{{PBU!8|+kWhHy2cbukVV?FAumnsUKecozod?5U<00AFuIp!$@%Eq~95EU{eC_3!r@JU%1x? z!6y&Fk4I`Pe+DdPV9#$zom|?zDbdlKu#=(pz%%t1Ikr^kZL;FX+wof z*faC-O)oC*1Mbui?BC;xJ3heP_~_1PxB;Xd0&`b}d{}eWzMGclhJW}9Lbo4j6mu;Ao`BL?TDVF z1Bo2AQX@-`Q_8$uv{=u=-#-)D`DjnAPIVp+TN8clXyNCH57MZ?V_kWr#CTIG=;iTb=qw{r$CNBzgI``W9xSp6khOVD8=n ztT4Zt7@9^`zw`M7W-Nm&N@=Eh*o3@uu!iEDAAa-rPWH?2{GJ#$T1K6GI^+R<2Y~A- z)F|I>TGdM3n>&i;S8l;!2uE5CN=5tJ?Xt;ZxDZpsH#r=PUiEtCy>8R@t<9|6yrBAl z!itdvW2_2oNYW>=xf9a0*@zL)w0U0JZ_+*Fp!ri81lnu2ZF6w=w!E@pVQieLRuk7u zufDLrsg<4^Ta~R*4tRob06jDXfUOWD;^(^y1}=gr0EM}jNnkDLSPDM2Q+!gRNFT4DMh)uc`&jZHeF+fRv? z)=rz|7(RrTATj9cP!$rippb5knrOF|{u(PKGZh=1DPl-IW-=uN|Aan;OHr9Nf8JT3 z)2r$o9i{XB`K!J>!3~+m9lfzMiqfm8*;ehR8|;=h2|&oSFKD!3ST(Kab$EuhpYgU? z>JBwsR0X9YLIg~aBp027%RIL6mi1OLdO736g#hP5^AEM3{I5^=MJeBf zy8CJ=T@bKGU1XLq6RgaKDPqYvzAU32nQL>}+Un}Hxn`_72!z;wUWuDMv)ynW; zq647u%1TLDXfaM`EkE$6LUQ@W*F8wN+`!>vk||&<(W}0)`lo49|L^}0V|B*ssPMDh z%c0Fa&0O!yf9Nq{DF3(xpeLRDXR#@ov3|J@xHp|S!hXFnd{MnxM&7&|gx>u-VjX>V z%kO*OH)QIU51{_9rgx(d(&s{!I1-*;p-5v-q}|u>Kt@^0=EJz5lnKR zcszl2KgiWJZfp2Rw*f^O0(6=8>zj|NdW*Zw{@0Xy*V_D(b24`A_C?qgTt@AX7mAR` zo(;P`@W5{ukUbITP3Ab~{6B5A=*6FD=QwV|urKARn=^Mox4F{A*dQcX{N6H@*@LFe zXOW<5REi=aTFI05JIfHo%gXbogjGj@K}s|sbiaV(0T=$;8;=Aq;KudZY$vgFvk#v1 zJ^R4FNtrfw_2Ti$Alfq|bg6yZ$eU_^eP>#2>26`;6#oC9XihjSWn${yg+&h%K%1&c zS9~>g&UwBs-u`)RdYh9m=xT!4KoI>0ZJ%(tGBuo4%K5gBV9vQj9W?q05yf~^^R6rW z+=q4_>Q{TVx6DkV_31wA1B&BlsycDkq z`Rjh$^Vp5?W8s*|`Zdlp#u)xBIqX7C=uT)PYu%?*s0rJ}Q%heg5~~3Xik;or`Gb%&fKdX0oyJ8q9%rJfwNBMR=}CR!(%)tP^N=2u zmMww?U1qed;0iRI{v(C*t(`#Ej2#ya+C;B7D(-a^i^;i(1PYXP6FT0-X`~e0%ryb$ zZ>gke!L;5UzYZO*5_FX>$%_vh3h{B#ByHa`d_OkV9e~ozEeyRpL^N;e;`!UH*=XwPojy!u`!uiU;!*SZ1hg&j zoOPP5ltr&=C6yh4&N^QOjEdLCm9oN~8K={{vW-H_Lnis@=&3*NQ;9tw!t-^r2*WLKn zz3RJUp=a@;E+E8QGv|)i(C>`_Ya6%LTWbXkjGVL1rsK7q^xRt<;@{N55SWhjFb z>Ld#X&nO^OK8ooFv_4ji?n=|;DLZ`wV}J!b5OBf+0?A!?p(mizz>Balbu2gFNfmfp z3rU|{ic&gW+~O}rH3fU{y6@C;UJjraegn`hDCI;>XV1|rWU2=u^a=}MVsLi0#t+ws3;#VnZla6( z@1bw?bj|>7k~v-nL-Go6F15@9_RU0tP4*f#d=O1r2^Lcd4<>c0w4Xus=AQ2J=<1dW zncsC*w(e)?^_HxZZM{Q~j9ckwx%^T#Tbcd}nx+f>=7sX7#S~k4IXOqH`k%MD3-%*R z$*vEtfbr5axZMtj(o&f``~t29>djcK&st7lH}4jp+M7#zS)2E7fsDrXvzAcHT)u%; zBssm7mf!V4f+PAKYqFgiTStzsTVW$P|2^~OlB_l4)4j8mfkW@>D55W(?qd1zQ7m4j zoRxu5Ppe?w=JGe2(7|6mhyA_*DhD2CU!%YS?vyJP9m>Y{ROn#wLAF4aPvpWrh=IZs z!tUK$VPVXw)uUWttz-{$QQxDyY^6>q#nk^u@L%Mmg6ovO?*?XQy3{@(L%7lso8S;q z&TG?|E(iHYc4~FcNNnO#zr7`4e>rECGXZ`{d} zhZfB{r~)7ZOo2Gru!X{Sq)lbu?vk|eL)m;*MWsE9kdT+c?$XLnlhrRj5Nh-ix|D5+ z+48LQ77IJ{*^W>+_O64GCXtN6Q2R!C@-JV*Y$<*Y)(2X4?es4}kkXBl&b%qpYKGV416yj?c~7rtFh*?JXCZcK+PW}h|BpP{tE1L3Dl zYl(4e6cg`Ec|!*IXREko=vLmn0}D$%2E{5Lv@m9e_!uq4LqwF%KiRETqhU#yoZ(3x z^^(|z9M^M|N3er!N~i1Fo(5RPzG4nB+Ejye%Vsf=EFxCq{{^qzV+oR^qDRc~gCRtdMEWZ?lq?o=*iSn}Zfl6=r1FWi6Y7w{$Xg)`r;wos-uuV|p zBjRPpIuel`sV%(LYw-+KEoEfobURDc}*+{pb-8DP?d=*0u1ooa-0l=zs0g@i1Qv!w!u82ewLnz>EcA{LJKX zBdts+k01zbrD?g2)Ac;ef4rM36`F(>ykKM-^o@fj?MRFFzu6@c^8Z9IJ8gQ<pIPAl-d_&~=G2wLK)mC%SXbAzk1Pc*&CN@7apzR=sK9!1`WGXZkM#!&t#GSS^cj z%skDeGWIGO+kU`eeSgOy_&cQ*(d4WZ=D7J&TSV!1lxn1gWe>Va+?;c#RdFe$_I2pv zE2nRYS_jGEyixZg5N_`ugg5zp_3|0mD$VUGu=$}@KmY>#B>&K)zza1=3zQLP3t-=T z?2QL#{6Z;QuN!r=q)AHvt@Y3GcwRHr{2cJVnOOgkH{bLt$jF~c$cha8z#&j;Ktu^5 zFhol$e2q5r4oWUH*lVozN}(?=C*p1B0V007fE>F^!1lp6JKJ7bsXWS76a+?4vwD4N zk5GQd7Rbd9BV+V23V$NTcub7m1v%e%3Ys8td3?uL2F@N1G79<)?IP`@LE4&H`Va?1 z?+viZ3Ky>wCAe#S%-+hsrz~=hOtNm~+c=rmNtUM$rHXyK(o`}0!{nW8dV{a541+G1 z?!cN8#km%b=bL||>W=>BB6jZvd&1SEUdurHRcTN{YG{IS8{5=M!#9?~NNZd0Q%G)T zf)?0R7Z;&zMQ7%?$Z3X|cST5Hw?PrVJ4xbx?12Vs|FEa zK|D(Tlrrlg=7EWcH2~MRxGYLOpdb~qYie+{o^Nc=*fg!2 zsh2uozo{gsZ{_z|EnG{wo1w_Ab^2!1O82|%g2S3nk`0hQHl4cIbf5tC|OFbVi_iCqIg#)vN7fma`Chv3el4f9`rV1vV%FPWU|gy>@x}iyfmM|!H`A7zE`H}u| z(+ALcm9EKhQoo4ZA=KJ0UN~cQK;DRy?Lhm+Ehj;&WKmW|1}H^isY#-I-omzAmiH9c zh&-!y4ij6qy1q%;-fgqd0AB8{=pXdhZMK)lNMm&$2?_JTWrZonSv#&S<$VVlp#z~u z#NC#x)^S8R=0`JhfH?;!9htF)U#o%+sTZX}twuCDMJVeXO$9#EO!srl&0;Lhvey6%X zo&k^;>!p~@I|htqB44YqN$+~v?;x)`hL`tD{H?)DIHEOOT_YY{*YAMB3wOXWB=oc$ z-|BjV7>zW$^*E4~G-d;d8mHEPbrO_p*n3kVif*{GrjCCg=76sy%L(m9{NtZ8a;e}+%|f95OC zHP>Hr8$~HzBAggta6S8LE{jCI0?(ShmzB3U&bfWx=k=x^Z0~vP`lwl7y+QRlT?Aa}=dd zDQi3a)}vsYsp@fADGqMz8F8ci`S<1xQ$DF>zJt#j8lceKrQg4iwLcoa0e->&P%)NE zaoOLOV1ZipacW{R}W=_1f0rI2Vtse}=bH05#(*~I((#FA9s0KmH!u4wu*<(WM(P>a)2 zrBps&qCBksE!+>G7_c}pB#t0gzXQPnQ5VWxCjS1f9HdwG$VUyIOk4LD1|q7hd;~L6 z*nKbv4CTP7c?mO~Ig@=6<7R?+D4}^(Y(S3MD9WT=J2>k>E#FyC+A%E7ry|_VQCL?5 z7XBdJN$Etq4EE7TTH_Z*zH5Wy&*2_W5f1)Yzn`jAB=*dol0Yf{p^N228T!y_4vIrc zA}Q%Gt9_5Lkk%K8$qk~j{p?PjrZo7Y6<1-#a08@7dD#qvZ`|Y<=%4t^W`1JvP@22O z$NYU|%sAv`u_B(AWi7Mpch)`Zi6}Q!B$dR==HY6)`29>3WfXnXr%4tuQpCrq%^G#} zVTgDkn0*)ZJQ;D5t8LcV4^0PvkQ&~TtH(2{iEp@#C$pZqwFDr~NpNM%Y2sbp)|N7Q zFNR0RuL7ZhCMsmSa|1oM)8)}Gtf49evO})5ra(8~^h`~|b}~U$Ve$Xr>MWz83fpk4 zNJ*!3BQkV%NOuiLcMjcM(%nM~NDLv;4T6NUh;$6y-HpiEerug|zVG~lKdc4p+56qk zbKTd?%e?)Dm1vfUwYd`^4xLWm4db{~fJZoh(#eY!i)3=xSq1S?KSiuH8(^Va_8*WL}d&x(tm0Lj}wADQ+1 z{Cw#Oq=++R0o?oZr+~e^6>#r@yQrbl6s>GmyHaaO#!T_skDH7 zB{kR6PHzO4KX@@_>f$H z4Pjf5z<1Vil!>laH8U>9%v4apI07~ot?k2 zwckK4T0b;-fp)tbhyq6Ix_qK4Y}%QQv&qgr@S1l0)N}gse+E7rEKW@3cJn+$`9!n2 z>J#YYZ&{@_NAgrp2?&Bsswu25a@7d+#g2CsH_ zrRxC6`iGAS`1DAnSV>US(Qj9FuveiV`N6Q5&l(augg7Phb;%h>`q}bdx^c?Pk?G9p z)sR+7@kmPiUk|fZ@pjo@ASX6fG{%3;NRHoX;K_C5S@RXkAS~s^6KIYJ<&u?4urd%x zOu#YMp|!&ScG-tyaA<4?zKXv6q9f60Dj@DTN)0`>mShtaFj`J{|1b1oL>5yPP++ZT zgwHt>x6LdYoy|3{tqZ#wfn7a zLSvNkzLYy;LQ$q7zDUbdF|FQFmMe63PDSy1MWC{#JdR+ZOy|lEPZds=D&BNE3V1UB zB8E8Wy}6dX%o&>YD;^$@%@%eR7rNpEWGPHD$m62HPOCql|29EHBrlbkOA#AI65cLF z%j5MPDS;ImG4~s3R-utq42EA(?W$k-gkPU~Kp@yRt_?E7)Nb?{^;*mU<43j8 zt7NbtVFlHoHa^=NBHZx|`gwL*i^(%z+&9FdZlraJtLeV^@IT%|_|}TQ>e0bhz+0rL zX@T3e^N2Q@3Pi|~1p02gSltj_ZlVHvn9*hL)d65}+3@GurmNdvg;}nz0~LZ{Sl+zJcR1++JDSzLF<91 z(X@%GU1zknOYSIBQv;k^Ho-TnB2QP|VY_^BWd(n+E-xGYeXDD-y0sofwH0{!Bp6Nr z2$J#xZ+xMCDE6Mi`ZK(bT>d7NlD1H0SC+BfXmi?APVq%o1XqWcS4)Bhru56!O=c4= z!v3U^YjpF~b0nj?VTY)s)t{^AYs6TF%c_IJrxR4sMNp}pN5?N#ygL)dgZDvQf5%Q; zZ}VEterT?4^#C<(DN$5w?j`}L$H%1h_PI;`x5x6JyQR$hjq$%5+<e@x ztGhi0yI#i)^+xN!@KN*X9@rvv6LYYPngb^vzs_G1#bJkC0k;uWETaQ>2xdt2sAgRa z6eU*ibKsGo=(3o4d?fm0-}@F8=2@|;oRh1!w0(vUQ|R*XE2$jR9Tj^SDVV&0i#?7m z9jx2+E462~3|nRoR{T-6@(A%Vh490vzHzze_@JYI$1E8_=wC;mX)wP=-pJxRKU)4N z_J_=UKM9ab!@`PAi3)povR37FrK$-JYV~eI+XtHTvGd|fxKCGwXORf@zCh`UzC#|r z2;gVxE9Q%m4Y){Tut(=gEU9ofa(F46C&7%}(wn3tpO!RMR)M3o7m`iHNJLhxDFFJ3R|rKLTi-){J8#Y2*A-cNMO#Z+5JPZz{Lv>@yZ$IIL{V!vikLgtF3M>Dta7y6+b zunOgh-lDOlK28B0(HS;e{q%0-$3NNDpsH`+r$fl6n?*6B3K5a;2UWc<)m2FqBU9IPvT@^&o#$E0T}r2)|*aO$w7 zpw|(=YEqgzdF6O8^er7V(xjF$5R-uZ^T@y0nd1<*InY;80UAYPidk5Gy2Bmc{X@?f z-=P0n5DgEzQU;tE12a=-NzITpn( zk5FL1d^-bsiv;^hznSIdOM=2uIJ`(&D8j^A;J_47gOuM~%Q`GMyz#4|lQyr0^@GVM zP$uA&j3At`K<$$>yc^k}UcK!rknRRVBpA}h&K`sBcE26h%{2fh__;+CaGIda9p(__ z?J0~9WEt)CVmWEw)OPxQEdbz04h&&9E=NPO*vrBE71O5gn#RUd1_lPI^=C6*@#Ltn ziF0~9@~d`+7P&iuTK+5d*P2q!yBNujx?-_$N|!p;YrX6r9m zJ2$p57P%_pb%j~@TimJca6GHsI&M8uz`o=3HC0T6w1bVB$0=eif*=$u>)wVoUej~@ z$U-z@Ag81_kr}--rp}EDFsFPiOh9^yYk&Gfm3NvkcmL(PaqgztXe+qZtMMmep1!LX z(&n6;VV0jLO5Qbr?`;`dK2PG^k^UP@qjNM(H@-(n5#B+;oi0f+@>j8pPe;JT37lvv zipHti+<6zy^Z1!>fBmO-(G=xGOjqm>GOi4M#N4l^zFB5ha+jyw(B_}`OG zy{n_KyvuOU(Ds|1F0SiDVQQVeRUp_f!HQ42vqxPNtrOuI8(p>>XBj&_)BOlQ+6+d< z@_U~9lAgfRzgX(Qqo@Y4sD|xfn4r}W<99^N3FfX1v61v~jUv%Gug@!Bew=UeFv9bm z2s}_-{P&RVfG&CNPiG4oZFc)Zw9rXq90$^YQUVOdtYwc0WOLY^eN7o#5YxSGhmRd7 z1-m}FA#FC0*g5LD_fU>+>gE`f4gfyy-eGj$LG-(j1RzDaF9Qw72k}B3*b*G|0OaeS z$y%L`S%%4qn_qYsIKu<+T*`noFX$=oeb3SnBBVf)ZH&z1mIF|p0(Tys+hup*42n36 zYoijJZ|k1euW}4j$pM3E)bEk)lMbiXL#k=in)eKTUI0_qe{cK3x=i+5G%fP9%irnM z&+DfgIjZ=-HzEZHT#@;>vvzj?s@-oaSvvE`Xk{*QaM3QOg&;x0f+Av{X!obq@UiD>uQE5*m z;!>b6c=ttTWwqrv*Z3JVf7fi#ZoCV4;=34O+sG~M|2MutFF^cl%bBdN^fa!eg{5P2 ztn!62+rwE$r!nfg!9l_64cm)*)sjBZ+m+!X6Vn{1V@E% zD~km$(-&`JV^dR7hGH?)Vw367wq{(z)PKr@-kSN5;YySJsA65$9TUeh3!$gq;rTU_ z`Mu2!kjgjB?$PE&0&AJOzh?tgUhsZTQQ&jfX7~mMRX|}>7NPw$2N?yVV3jyNbXlhfBN~5l*X=@*AyV)Nw9&gHnZW^8MVv+^w)|XOu9lK6uQ>pFr zKpt(5DGR(vpU@*GkxN#y5Bk;~Y|fO(QN$@-JYnwX$gN963G|Me>~;kB<^g< zqS(VQj}Li@vS`KNLjs)xoOvqoCh#G-bMu4(rKs|$%QAMA9eIeyWvOF`;5y_5=!Vk! z(+fQRnxqh}{sGZDF~JhH_KXosT`Ku-&$B~1A+c}TR<}*Ov^3C1q zr8&3Pnnguc%c?{Govmcn(2-)3Y7^MT+6%!}VPG({z08cYj(8FjLlE0w!{)N<7$?v9 z&HSPHYNq-s;pE=n^Kgk{ES=t_NJ>5AQGL#qKtg&xdG3qjYel`d9F%RoX~QvC?3%g; z_rhR7>2X*kQnjX@BED^bRIT zU!wKjTZHO&#*_SsX5hQ)#}xuWK3hnU5JAeTfF=J{aZ3NAgn(0&aSnbs&6|~{Uj>JD zY2&*dsMQ$RLeZgvFsgA^T;U?5gE!*gbzIs%7W z|C0pW-N4(|e@(Mna&qc0$l1Im{caq|q~#oWkvzwf19`nOuW?W00xjVxCwJ$Co^Jdb zX5z>GbMOEB4x;bn9i47Kjv|xWO@2xe7U>yd2P_M&o`FYdL}90CeffuLR-|3n)t3*% zCoNC$2Fv6<;1_^31j4&qN&BY;`TTwe#xl@YdXf{!Xhrs+dRFD?MEcj#D*z__H?EEd zNQ{XAdjwR@$bwXg7ija`)b%%;MVZotfT3U^bYLZdF&VrefYnvQ2>5o1*)bjbMXAH7 zb5$&0lMZ}ll^Coh>T{qH3MG~HB>S1V?mE+s*JPMuhJ|Ud_&_#!;-j6x@3WrE!u{M! zt0`O3syFwIh=qb}W{GW%cR$-6DWAuDssqG2oaO5N=kD5y>oXi(@g%F*pTwCWGoV`Z zdc`*4y*(j4?;_cydqcn#w)g-*DCq#ZoPWOU>1levMW$J%dRd_sm=O#JeNXatakF^% z&!K`6BnfN%TyKu2H%Yoi<%=zfg4z>T$&5KLE6B(>VNInA5DoGLljS^|>_(}E1#6%* z(R4Wv5N1{yB4JKVSy(nuYz8@-of|ukpEOq(!L295hRY695S+g!Uo2t}B|2)ZR3CT9 zPCA_tvN)0<)KoYQOh)dx=VDIM4am>lC?A(a?W!oYT~XRM;%J89;O&=~7f4|Tk7;Xi zW*n=k5CyesweguN+K<7uKLCvd@fm2!s);w(Y_ot^DmLQ2qHFg&P&^jgG0R(m>%faL zY+qE8L#b@N{zD+J^Jh=82Ankwxps0TEPfG5$3h-{%K3O=LFBge`C*>Ort_aW zG#5++!2bN(5A#pN;vS@aF`vvfTDO1D1fBJ1YJIt`eteQB679x)kIGo;eV~R0lvo%| z?X&^<|B-bmVQ2aMwd`UYCwLvui(miJ^pg${lBrBs#JwL~JwyN5_4$A!QQD;MB3w3avv%7@(?jb%^6|)BrvTX{v?LQf+$f zUcXngr*<^*+i^f>ky%##9*s$*)zfgDNy^Z<1xPJ{yF2HyJY9j?2w*$>_t&c!o(MT^ zoNa`!bYIsrS@V>4?p)C{NA_F4YSxdGKiKb?PPNNotdNq)V(ylwnqhK`hrwAT#*Pb+ zYsK5~qK-GSo|;$HsC1a8u8)eJR{{bb1ktXF3+1%X|4G_FjZFPEy7zi0uraYF>ux7qQr zc7nj6MWtl=vpX71`$+?hV3Xm@v=L*e83XpcJ?h8rl;K*EZvUN%TPs6i@AQ0P!s!f0 z!|58(L4!&n+15w)+|4td2JDVsBmiAAbJwl)?IW|=BsBE5%l`aHVizOpmM?J-B4in@ z4g_@bphi98DSBRW0Z#x%J90?TKaJ9Y4fmj}?2W~lLLtK7CICKfujuk3BXB|iwCc+Y zfWk1sT**gE<{DVY2dx9Xww^AEp~UzVU#DJENE%uEr3WG12OzKNG%ivmSm)MFq;z60 zA!YDL%fq827r*MQy1Uj7yx6@TxV$Hfisb+Hbyns`f3idgzjcOdHY-LE@DD9>Sa4Ly zqS>sIhOxysVTqP33qB%_yECzk!S z%2rlR2Fq2SQber|PNY7oP<&rb+G|%k>cHj{u+sm2BXwISbZvM8&?$XKUOzt!d#JR3 z9^Bv9ros0(tr90Wq!T%L*elv*dQS;K9BKM&?0f=%mrH2HiiOa~C9#;8c$h5`{FdVq zs+R4)(NKA|Q=A4U*MN-V_6SRsNmY)1YBNQgK+GW^iQWfmcos zI}S2<>Rxpst9tBJm1v3h#>G#`LND|VA zH0oVn>MWM`@)hQ+3tujvu-0Tcb`)8_Y<9GO$2#yuoK`X-yfxAkUFjdElHq z*|Q%3HZHA^DZ935JIpUL$Pv9wbF?lN6^Vbe)0ABaegk_{Ju)mzy@y`S-&X`o#Ffbm z=3l(FX|q3OeQDxV!8Uehm`{kF?I?*w8qX&urY-5B~Qz|Gx1JC;mg}%f;0u3 zY|S+h|Y+0M6P^*XU}5KH2RyqS|v;2qAg4cJpMfH@@SUQ`iy@p>42#u1Tyq zO!*0rpK>9!qkEbugwH3jMe0(y8XehS8qZz3Ubk~>HPd@rj0hbAR%VcDe!D!NZ>(o! z7*Lw%^7k5*j%LDC!DjowW1*L(?WJq($adO5VmS@BPeR)rP6`jd$LzG}Tyy zo=l)NBCtsD*jBv{nIv7k6k^|yDEYX@SroDPT7dx;PgV`Z3%&B}WUmwo2+<*3J#9UX z{diE%f*w3HR2L>&p@j+_FeKxA8y<~u8#YgLZ_n-)QkIx#e)$ z4gsE_(HU3SBdh+%NN?H5my$4(v9UMrqMTBO5wr0~*|nQ}C~qJSFEv^~=!Jj;z(veV zOy8^{X>jZvAPk)a~@=c`trk0Zz zYQ-1kv-A@#pQuMUNcfE?5$ID_iZTtT$?*7yCVy83*{8Nx^j%^y;^~n_q$hMyG8*fC z<&+o(T`2b0V|Awcq1yT5@hniBt6b@bI$`&hd}VSxP(u|Os4gF)?xvI72xjOkndRI? z@S-f{{i0NAx}>`kZFFl*cs#c53p17D(YbByoPQd_ivG6Z3X%GHJ%M!O_5HUI7g8Z= z;9zG5+fS3H2aa2FakmT{|CK(;>_4WM#sEdPSL7WStc6Qj8(KHLza&DqrT*}<88NoMX$ekmsLkDG&UfaJ=Q zLzAB1cU8W$Qr(~KbqJ$P$1jp#(swnl+oW? zy^3Hw5Fy!j+bG6qpVL>j34@HR;zY8f+6X>R0I<8{tIU|iGf`~EF#5CnIqCfy$>Msj z@m1*Yt7z3Lt=muKdlBMXTCdeZ&Nb~7M*VH$rLDidVhW?;xQUH#&39RTDl-#?91TwS z&0lU`>Or-q?Z)hBORJ}U@)n9(EMxU5cw-cd@aL~R(Mpb}Xr@`TDH8Y= z24Ek1SATf>r+Xe#IDWH7jI2}zN&Vy5E80rzb-YvpeOn700)+KPc?AN@#bq&Bhw$)R z)R?XlRA?fn=#iAni0ydQQ;LJXH_TuzI){G(991*RTZ?yN;&*kY214^9Trx zexFnA8nxy0S(rlh-RolK_h{&Q#c|1ZXozQF*Arw&gzvh%_RL@C1vj;$CTS>6-I(n# zO~H(@!z+&1SZjd#tVD|jtq`U3k3h9EN)8k;0x;KzU}ky;H{M0g%ziU=H~u$ z3-o`q4sCm)kUzI|{^!H?Xt~>LQPv>|-Gx0J-GO?CDL_5oEre4yw{ zTZK+mfi@@b?24ZwNyUE+-2pX24^FGuk7-tLYFP!U1JSTc>dPJGg+w0KF4xQB4$xqsTxkQrlbdkni1vm3!yU}UPycB z#F3KB(h~9bxOQcr)Wd$1^(E|3IQ-DBV|JpIv}9^vt*NdqaAx<6kjIb;hhcKK{yZ#N z7Br=dnF7*$#r#2~W5&Fp8pw*PPb71cjiS+5S`r||xuL(gNw%%Dnq2#kE0%u;rhY@~HnDo2O z!k7nY>U^Qc;zTlrKC$1Neb(#Wm>6zdY_Ns89m3yf0V zeLcCx-8b(B?rV<6DxVQ{96ovb?NgF$p=`}R8NFXdq>+eU2SkjWj?^YT}bXq6*VCkmO8|MTa+M`Gv3Lw; zjaorkjPxBdVXzOsOuog}bQ9v^q)M&lBpipGKg#gCt^`soJn1j{s&U<-dl?gT9BHfz z5iQc5%G;r;IuWi#oKIkHojQQ zSF?-0V$_LiCX&YSVFRO;{D#nj5!ruehy^aFl)o&`qWO@UX-%U{N=0Kin9I+FRl$gq zay~g5d4h)kqAz^s1x=I#1stmf#3*vW!2H&F#~+xt{Ak@VC!|qcR`G5hlY-GiOlXjR z@I!>;n^hg4Pouj;3JM00qfG%mFtJwsZfqp?X0<1 zP(OSz^j^?~cRNmpdPvf6S{6}8Kp`;5>-UPEddn3&qx$cX-wK9*w8l1DgfwOovmZmq zZvAvf*|ZQn=cJwQyKJi6Y0R6fc)DtYZIfS6NL%N0AxY}STO&#KRbV!p@`y;Zkw_cu zsg5OaG!gx73Jyoq$+83e!4?9^O3`+vg;uB0vaGC>aHda)5s@B8fEkV{*H@~&Zg6G! z5W}O@X`7u7eg%;pHBAWKKwpQ~#v2)f@VBRhPlDW;J8rF4FLA*%kHZAVV|jHIYe6%? zPW_2(9~6rlqvA&ie#*(MEGQJ~k$%0Q)EgYk5Ua$Lfw7|0U?VEt zL%I02OLrbK*Z*c?$R+)9y}u9wLdf?KwqVug-Lma%Ucj|#+hVkMoR^5zVPKQhj^(yMZg7zTN=^#H08qZ$$&^ zACXP(n-WgwL5YCP9Lw`Qgl$R$r5^&YB?+^LRL3~kDcJAgq$^KTC&v=`?#==RwoW#{!IGQ2E7H5Q1 zRcIe7D-(pp>6*d^m< zH*+XgEItdNwxoN)#Vyd;ToE;E*w1nb>$3O_oy3QSc;pZ&*z1e1#ymMWlmh$W*UY@- zHO{}6^!t7#d}bXaP|Tbp{?;o`?^uL$)XR9CAzLWO>13yh5f)^NXy1f9H6^TO3fGp7 zH2m7F-6y^05lx2!Hb>dgB7VYM#qJa3m~KdZBct?@&tmrDZ?tiDi)-6nPa51wv`=H3 z6I!By(TSYw^zf8*${G9#+}x<-_tBF~wo*BAfj?+P{0FH+_b4_MYKkCfCpXKFpJgW% z(wiG*O?Qcz=lPL_68{JfvYNXMe-?u#{&KWCg#5`Dlcc3r6~V}d-wA}eDlNlKyEac! zD$-{8_R0#BC26a$&N)6QQv_C0M|?h+kooTFVR<0UiaFT=l@JI&(xdVpCNQAVkp5xJ z6>%taYY?`R^~)2`i38d#RsH&~SpewJoo<}Wi9}DFW=VwX$RSz?x~ure8x{G#eo zaPcn{i;?JX1Wv9P^;oYC!fE&c&dWl!Sdyql3#9P$-e$*G%#d1wK*ejBT3AFQdBC_8 zA5vRX*G~n%nYEAIog?hOBCbgNthc(c(LYKq-pqXil$D+R z8NQrwKMm5nrx4=lb07a_n0>QT7XPPNg<)#dfB0G?U|ggO3!a%ivbIw{KO)yLz-cwu zMB2f(!7-QjaZNwAdM4yH?&aLUM^U@8E)sYFv{w_Yf>#gTj4BR>AySh~4^9}NHdWWrmL#?_Rf@kv5A;d=YIQ99>)t%JoDZbtvDs&Q{d>hOd} z#VeNP=^KJf{x1Q~({IDA%oZZUxny-MAPo-iZ!9QHI^l>~yH*B}<%&z{@bg|Q3=azI z;F#n*0;356X=Iay58cZpSWpJXteWAnAMc%44-?2fJnqB3UTRhH5|hDAg!00|aY6&c zl$s07hRx(+zk@6MIX!|_Z9NoW%br>n&c*1(#u|rf1)fdMRbSkk zrjuyY;gh{8p&&b+b#+6+Nwp(;qsZ|+j>(Qq_YQE~!OOXQuMjgnR(#vT(Ukm*s|8;J z$rM+)81?(8xA0%# zQ_7m=ZfEXwI%3)Sns=90> zYbdFiP+yHJMZv^Akno$zfiFBj`8*L?;E1++pP_uK_NJAfdAsa94iD6WDq(_OhnAfE z2a`x6+m0+Rff}?w`e{TNaF%|jq$y2&a>4rdmB$y$r+;zau0CsjI~4TZpblRQQ*Fj# zxJO}c-jk9g5#@^y|M-D8#eJ!Z$M#83s(51UM)>qS+OVIB=504#G31@h^&fPgGzQoy z6bA*a?p^^sfuP*}2oj)DV0N};XnQgRKRkM-2%V0%Pu}#S`LNmfZ}O@PCHU0NUn1>e>tHu-;_X7Z*k%P|#|2^j}sUGO0Y(gZbLh&ogGspSC(9aP7f zJCi`V>UV=cr-!06@GTk12=}$npZeY0v$sZy61txaQO}w_8#*=^+a@c*>L^g)UKk{F ztY1G5#A9Lp>@C5=txwCBLo5gx`b^p-Fo>CEN~K+$4BwNVxJ#({?i zh{~s5hK!u7f-v6W1k`8p5NsW{kX+{`SXF#M_uwc)w=>rdh_$u>+8IAk%R&MZN~9Cnjb6^K#6zfhtDhTOc*!ysBZj*a6!0$yE*NyDoVPhhL`=b&>~<7# zTV?k9YR&D#Z!pkaxF1&bKz5O<;rI^!EsU2@IkpD}tdDAQ_Ape!qRsYclRNlHP(8Ng z`x7T%V7&b5?4${21JVWe0g35DBrJ>)Vl@;pZC;sMZOI^-7Y5(i0zyH%BAGdO8g=^+%R6S z8{(fRm!b%iFaeR)f1D9e%rPK~{-0bbyD@#9Du72uq&452+~#lhPwm#SD!5vPqfoVH z0&z02r~PsFjUO6LZQG1M7VJ;INl?b%$^){<-1gz>9pCBQ!k|3T_&cy-e(*Yv_`}2{ zAW|O~0IWn~HFUWOfU*5-VLT`s_(3ao19G^MXMj{T7bq5>fmvDx?R`RZM@u}ROly9Zzno~Avn z6q}DPKsL$2jHMM#yp<|1CmGU4)!hug=|?mlBByARrr-e*tpwRPW*t6(00`F6Uuj24 z#s6N*QA?okd;ZW8?`wU*GRkKw)QI(sVKe_?Kwy)(VDykMLxgDcQoVfblLVW8)oaZ) ziM@MUj4s>|0uoc@5eoE>Mn?yD&ug~>C8Zo_V1~3QhPV(<5w8F1nZolAw}G#t@-w%M zLz(!9p5n#U1&y$IQX@8I#_lE7WM#OP84O~F=sz-r;crX`@ zTeD`JqUNB3I3(yott)}X%G6OS4MpI8htmz@g%v>n%}@+G#DDWHeBPTP4kt}d*BKEp z*3nz0Ji5EJQTw}48+5WY-P0-idl*=STeH@y3bw<1#v{;Na)Kb~QukFsm=FIxk3KOb z{^7adc2^^Vd@lRl9rxw-ah;r{>X0RFE;_E}7IAOxT=AdFt9Yj} zvReorQ-gOu4*QHR9p^0D@BBTnxix;7ed$g4q4Ij`N5^cW$`pPe`~wrOq4+3x>SkNu zM{$}=#ku8iBnNfn4hj3^N^}Ar88~25zeK=$3q#@(G<4ii6eiGvum>K09%*J5iXOc zw3()1Cd50=w&I7t@9k`jA%3H^?&D6@<9|5EWYanyZV9B*boEa`@P z&iR(UZ2-}*o368J{`kvLO7A_|*SA5Sxa+hCCo_^|4djJiq}uQHMLSZFhn7XG?SZ z^0#*|a5~I&>Pj@H8ONsj3mQz!U%OzwxxBcg>i0&%8#DQ{z~8z(OLlG)^V;CgeZgN6 zrfI-J=el`(S~xk4IPzPS{P!ix$))ih)vB3L=i@D9%y7<6uA-%A7DtQkQ#Ynu$pNJ< zAn)O}c_R?C!7~N-uG(XUm4Hj+Q)p#k2|)k8C?Y$xGq=N$p2JoPk&wI2I|}~iL6dl_ zev4M3Jb9LNmy=ljDxQI+G?j<(yy9nbpPVAfplfoz{d4+pqb7sb*~H)T1qH>4%j_rb zV_eX#8&m%(N=l7I)3kLa>9yabF@7V?t?t$>yADIN{-i)|`#*9h7C~_n%tDsLHNZN5p>h`TFb+vd(ro zfsG7vZcZ7p-6)~CXBR9>9XxsH@y-9#E>Fm z=h{}?9^$?;`4~x>ToE#14JV`aI**$fG|cS`Ge7wT$49TosHpOGUazCY{;TG^aK+2V z=lk1*b}M|UKWm~dfLDj0n|aM8_i=v#Pq)aZu15~4zh_UD4aYWhr|&;w0Jvb_>G#~z zpxwtm_j6r63vIsDT{}$Go#%dERAhcjmG~x_GM;XzINOxAE8iV(@;T>}0LTj0*W0fM!P%91-V~c5>87l7)g)PS&pMbmDcL(rLVZMz(bQ;vzyzAmD>;?b(D;6w)Kg}C4LDpc&1IvufMHB z>Po>gdmqh+rxZ%S_aN1dRc$d0Dv~F`ztkU&8KVR%dZcOSA9mS#t}Th1Z$herqMh5+ zqxQX{KaK2Yzcy=&E}tRG6#BDx%`=6zL!<_4)Er>!^?Xig=yT6lgJ>%241PoZ_@6zl>2@>L#DC}txjp9 z)peJdn}&>;hw&IhDd08V#Dp&d2si?X_{W;fvbx3Bzhs_ZKK|>1FGAmE->k~w?4j!t z;Br-WyC0F3H}MdyXMk3=&y0E?SSyAcM+F}z;g|D9A$OwIkn--|>LFlGIbxq!Ge{A#0PG$w*$7h4#s_lKvNjBi>uzP#E(M=F65 z#37a7{Mn02s`gbboKM?>`?&gG#WwHsba zgnibo(@-2kt``XLiZ$eZotaSMUNrmC0;6j;Icc{0Go+yv5~zfkAKg@Pbg(=YX`ShO;mVGZ0c%K5%IMY`;xr|MX0QAE9S;lWu<&F#5fw!8(d1*iR&vtZLFvy*tXIf&RZubMN=Vq0^L%QKOGyvvc4<|l#uK;v;+jRw^ z3a;ft#p1s4ifz49Y9eDsRCh0ay;yPm-A*j6UKLzreD_!53<=${uMU>}Lu-lQ?f)Jt zHkN#Ja5Ou0$A^dR1`B3Mi=ir`?;M20=@21d920{RFI5~dWFt^V zgH~E(OkFKiNc6=7jv9e9LW^X~n&fY-(8u1fG?OI|MZqzjPmv(WZ!pehw^w z=U3{FQh$7U8fCkVn9T{Rp(s=zYVaH-0J=*1ky&^UM^zZ-^m*Rw{$_F*rJbOuWnr_1+Q|C>+%0ar zR|37I6JP5nzngMS$YOkBYJGu`!eqQC7^RcE_E z3#Oe%!259B)ynIMVsx61ynE(GTrxMf@V4Zb&EQ()<0fyh8&@%|*ED+=EH&DP3IvB8 zFB9pCy|bK9Y39E>3#%0f^_q0vU@*`sHWSFTxsL~N-6N=2n5aCSY8=)ky=*UUF@?KG z@4QyW^%pV{R5Zr@&;(f7L%6kmBM~ zo7&oD+vNMcM8v?vY_NrU1=L8_>6$t?5X{}$&KQ)JH1B`Zklu$a_i{)Xcon$_Xz)!R zvi|(3SN+Y6C=u!~&oK~#-++M$pLQ(-1B#Y|Cgd4A%wo*Pn`1zipKmc$iup;zHMOqJ zthAJYF|!g}u?@Fp|kZfKCQ z``qx&4w26tN|MVs%1NK6c49E=VbP^CJ`An-fY08rvVD_(z^@?f_$E95_6QoS`2P;{ zz?tZJGZj~pi2XRylgImcuc6|iapJRz2a}GO7V&)vt81ez&p4!K(7U8ciZBz(rHfD= z$nyO;X`~uL_*l$?N_e^breT`_Jm00fRg#cvYw=Z6%@zl_@qMf7K~MTJ{lr@e@sS9R zR7ke*Lh6ldF;r1C2F)-z^%HP5Lq@j>nSQzOHHkBl8kIA0&zbCcvlT0`@mIcV-z+{@ z-=a|hkempWtEY@waSQ;wb#melcgKV(zs{IbKxQy&hs47AL0A7v@~G8>zFe6X5&(_O z@tg(lD+JElA>DP!RT3r-`!HHjq??r=iN=>M==vskb2TZkJ^rFn^EQeKa0;BT)wl0D zADQ}dH*N6APTN(4s3^xCWz?PAIDdDOX>DLkIL#jIo@Ib|WLv1OFJkNR#LpH-crk!o zKTKCHJJ++D7#ad=w?3@3gbVp7!3YM`ez}h3wM^n**<>JYzhU9WNPsmU&RCUXO8AL^ zg=W1EZT=5cZxt118*J-_gam>+jk^=vHAt}F5D4zxxCIaHjk^VxK;!Oi!L5Pd1b27N z_wTdM8Ef5f0XK~C)mv3_)_g2Cb7P}$iEy5fGMrhGA_g3(D>P(8a)8w2S_0V2CIR|j zxEi)+P_DR~EGPsAskz{IQrYNNIgrLmu55`ahOurT1Xx0QCEkk{B5G5JVQ>g&_c#(4 zePvsyT4*>-N*gk&WNwbGu;&c}h26fZaFrZ)O+b9UK_|BY=3_o+MG|inI??m5#G1!= z7cAl1Wmr^oUo%p^fE9_?to4?%wiYE^EJX0^%44_b8%Td+s&coT zoES{=wjDjS;;!MHUHe~92@-jTg=RKg`1=w_vEL*3=l-1}<|k6MwQ`H{;tKpJ1tJTm z+Ky5+O04FQ<7Ij*4%Sn^f8J@RKn_Owrh_j|{d~O;EEY^bTZ29bXQHvts7i9!Wh z7W~hb+W(I1k){q4yu>vY<9mlVCPgA$x27ks=AR^oGgHsvxy$T<013C~%9h=;-&&cF z^?D;eG>6DxIt*e*ca|>!w+IpcpD#`d@=Mn*RrsnkM!l9-{KxEHq%6R=Z)94aB$6h=*Tyzz z(DCxNqD`p?rcjj{H9>Su^Rj(E*zC5&^A|FdATBb>R7q<7`zgS$! z_-7aIqu7}jxZn2r4_`++<`zxzWq!BZFuzoPCswOnRLvIYp!-)h?$0EBkK@P0A{Bep z3yMHvuHR{lcX!kCE}R2W6cK0_;#cLvrX)iR75%pLQ$UtSM8B?qRv01qOGFkQM2-y*V22Y;>HFh)UCO1YKQaemF+H%I`v+M< zjrE#X5K;UCe29b;nM1$?=R+1?lHTyV(X^T(Qc#FI_Lze2Yu3wG|pXFw*0=eS5(=H}xZ z9I8E_z}@Dfzt!RHgnsAKYEM6Q*nBCJ>`D>~SfTI~F=IKu_yk9Ha&5Q&>Mm#>6W^BE zd}E4=a4{0Ny}Nmz9i)b98L}?ZJ3GK2@)$hv2H>#*2JylTix3Sl!k(qUY=j_HaE^C zfgZEe*5yLc2Hge5y}`$p>Hd8>e%IXaly6%IL`JqVsl$1++!}gV*-re^TV!G&TFsCv z<#cUqXb7XW*11j_nA01nf(;LMP@e`W{aE&W0AA&AxTDBxbBxpGwpF4kfE^eZl)68% z5czX;g;QI5*#zk=7P)?t78R2iZ(SdPr2W@z&^9y6pvRSlsNv)@;?NyI!*P42_M1v;;h?X6{N;WIv9r~85;PNPi2H;Z!>TduN|BW$cO|F*%lo>nd&*_jt>mf-EPAyd&pA16VHp~29VN|45Zb=jkGzb&7 zo?w9niAn`YLp3#AGl*w9x5E+SP&EQ+$|C=mj%chtaXwc-NVh<@lx|vn_gLF5IHWmU z%!KNjB%LhT7wM(2N#92?gf#3GO$M{)Y?7(>w#I@^cW&gX`I3o9?9FNj!?Ql%6{$R! zi*MHNIf3ur#K#dg+ec1R%)ea8T99RhVn@x>iyw6?ejReHYy8vfx?P4LTPaVi!svE- z1p30k(#V8m5-hJmcEctX)@K{qjESu#5Dp8AyQR5KHuoIb7_rKcUM)$urq+?tCG^h& zf<_(-32%=lIMUsJ964Z<#6_!u%ts?oABhuH|1fheaviAwtqi33kES;L#J@hLu5tFz zeWQ#`C7ZxRl8GS*y}#mP?38*WT+809yHk5^K2%qFTRa9e9WCQHvlw~qy<-8`H;PPsE+&O{n1HMDapo^6Dfz;3E+-k!3)bLWt%+{%-w`6@Wc615krppcbI9|f zJDZ3IjzK{8uU@I*z%{+rX4sq1^0(xF^l zNKKvkM%O>V#cEqBh)I4z##o+k--g*aotz;`M-4);y5vcwc6okumov@c`Pd&`_*}Gn zoYZ6Yr5_dV3Da}Udr%3+WG^}j68&?dy4=Yjs_G>0rku(s4D_MOAAgm4-IS!7Mojw* z?qwdX&MsvkpkV1q`ZbEb8wyH1P-IR2UqysrKEU9Ou{DjcMS|);y!rqPhkHp3)3DCi zxWrGgx4&m#N=N_^v7n1xL?)w0N$xR_NAWT=?Ad7wT|0kyKS?SD*GN#r$N^JITDVi z6M;s{D+z+1Rp<)IlNhg_LUP=W+2xn@WEga8p-j>ptY!#7LYvOo29$vyG3*K)McNoq zt`I!5dUKiX8Stkdc^r6&?0PzYMAbSiHD8P7+3Bp8q6_g?vF5SW^FyRK0|YYot*u^W zp3g*x;u2DfBcFn)hX|T%?tdf}$Y@@{y(}OG7N7I-0_n^n?YR zG+JJ)5zW~piir@B6vr^jQ_{KB)+JYdFiu!FC29G)X)I0gB};sXR=00nV=`gWmFYu^ z%<=bo1nw@I?IhK+N<|HqghwB}XDIA5dA>@j=(ThBM^T;#DBfmZkSsDu)*}lZq{vv= zNJMW7D>4TkrJd3LnBREV0Y{RUuprOj5rz8fltomx)xRd!OrYoEjD6-zPeHMGUzrWY zVjR1wisV^u4KOcpB@&{H3r-gzS-7tW#fu_O>pgL7bj_uT zuh7J=2J&}*e*kaSgwISaSq3*i66?iQps2IIBew}YkZ@pP&H=Klt@3Ae9oqTe{lwB< z5se{J9JxhTL)$7f+IKDxFYd=ZlE$Md^ksebSxG`uGCdn5_dQBC82V(e>WGx>w)Es@ zksPx@h}DJ1Xc%t>Pqcm84ey^%PG|M`x;}FNrrDhq_jn?PH1D6Rlh2J=)v5eqF4jbj zXZWN0ikWDw(eHBCiUG{bb{p;n^q-kqv5xS?j2P)ZJ*ny#((1#feuzit|MiLIi-rRaK^~wvgaBR1;<*CU9M9dP6LqrC8Tx5BLXtz$^H%Zpf{|Y$@ zjr{>VctGl_tnjS-6{*JATSZOoIrC5!3_Ttldxjvy1jNFVdTYUo25KmmJU)tAe{5Vi zb$PDyB)aWFHcRBxqup8>z3WNQRf}D;jcSgX>a&B&%^;G>%c}_X~Pf*{P7^ln8bG?RZ zuv_`l*mi}|sy7eb*xqQcu zb;d%KACqzuG3D`A==<|4o*hfq`P_~t#y@fJvrk{IY^tVBO{uOOqF}V}Lq18A)T(P6 zVpx8f)K>WjuZFo6~}jb^fE=;w(ONC zL)^t9M;k9Y5{6@mAK&Pe2x(!Hy~@CNyAQKW?wcy+UZQ8C3@?mOn1)c4nc-l*cl4nq z8I}AqlYZhjSTOQAO)^v-ZK`XzbQ&wKK)A8`Qm0Q**+k8@{u*w;CE-uIv(AWzkaNwj ztsuv21_c6-r;uYoe|?6}YPxN;(U3*ny2B6sDHK$}0pU70X{2%H(4(}g5^nKyvDCc@ z%z!kru~`SaiKIW8wuGPIX0_8Z5w6XDs`5Cw2X~mP?7Jn3b2L_ue`)M68MFfjW)+l% zfvaiDwMJHrHc@urn|RRge2H#2FW|P!m!RuWJ7+4cLpYKBmbLTKi&?#kaQh zF-UtW+r-{YXrV*#=rMaJxcf2xaEM* z%1i(M7PAv8XOzD*bhK(q_k!C*PGfIr=$Mr4KPOgUGM8dF_2RLgCU-_Uusy_3;5j`ye5vK9~Dl4 z|BoFed-r^~^O>pbe8A|So={2TnwW@3zQ$xwV_BmST40F>CAxzTn?XOCXMv zGFmKB@uI*>G;ElF;fv&?Oi;r@Dm2l^@v%uG^9UyTnVMU~Mf$R-U1rFENew4=witbi zLahy9>0HNH7I_M)gA<+qn9kS3v^pc{B+&WWhb!cckPSqEnaBH0dzUZIW>Y|0iZY1i zL_S77%gdIT2u4WN?&aJmvgybN=`F%cX=CLVSu-89OfF3Cc4fZr_^$c4fhlzU!vwBw zEq|{rO`j`?u5^u;c#XOZ4F|)gChLS4p4ezg?aHN0S>i@b`w_z^ileZO{iISg{Pr!y zye|a_#5Hfim8((9a4%=w?v^Y?9xcI#dB7Q^!k**<&j%WHgERqG%owWb82Wa5V$$j4 zQZE#7#HdM|L|JM#mY}zvG+~C6YWNh5zK?9GREabtTkaWqH+?DrdM#|{ZAm#K%xzYM<*YmOg;OHwLN zm)zD>&irM%8>6W1q=4M0UrPblW{CCONy=Bp{=fD`M4rYi_9XQ;K;1IPctjzEMc-FM z>cVcE5tC>dj zY!@z92$@bd8Jt-6NX8g371Gt@=&brvv>)Cf0JN%c;Gb`R?Nehiak^YyzPqu}W_`;= z7SC*e963yc5vCj~pR#mlR)HbD?!hv^7c_#Uu2nHC(<`GftsXB&UlOcnOeR%%?18zE z#*FYm39&(GXED)v_?`tqW!3QZ|A-K)0^acp2BIT3?T_=!kA+>Ml^xv)N}XLDqi#;4 z3JbJ3qK`eJLibmZAQM=P$2+o?Q#-|+v@OB4NA_H#;az9%2NS@Pe0PaJmZwp%(ZoX5 zbgRf?_uayO^8dAW{olcb4}s+)yK8k=-1sBGOh@I`_i9_~Y`!GD)}jP{3)R}lcN8QA zTbq24=X1s*bbV>6VN6+k}D=>suz0MYlW}(N%>_ z`ACw{@%M@no%G3H-w$fZdYcl%)MqoHvf{RYb*FU7G5S!sbQbfic15hWNZ>qespj@0 zsZj}{1Q0JPW~BgHa*@6F#xvmpj9Cjwe9%BD0K1+5o~KghK~=yA!MV`ND4GgxZhnuq zlLAI1DJ+>g0DOe7gg-_@Jv~@nH%IFLZcAXnz>izoW@l$dMb2?1df~zkzBBZ&<*&<@ zD|odn4rmeAJob#BEeB2__u&Ysnd#d~9S^7h&u>(bc)+mF^%`48i|?WBH*(OH z2Pb`xf84&e?tVFXtqqs^O0TMkHDFhOk+Y4f11ThN$R&VtkL)=8gJKCw-Yw43ykCwwBBgo5&~(02ki{x>g1dCwB% zFwspe@Ubxcs%Syl!#?yu@K|@L`B+A}xr`;Ksx%;&rdEzX z>=WB;z)Rok237I*@4Ds-(6K0#PG=SLBs_T>9t`HJfl)N*D*;aim|1>Z-~>sJ&jmL4 zzWm!hNP9%t)`|y*#$P{!CB7Z~QHh;u@`HKVy4(9{L2x_XR*!Si$}*X$qg@RAuc59Dt#)atuPd)}lde+>FL`Q5mM z6zPCMm;IxbrZFd?wijyNpE}2a* zC&ZJ!2wP@w)bdN)U#uUhfX|2r@BNlmx8y3_p&2$ma8n*egCr0QPi6X zF5_q*xZZ^BZh*IQ?0Uff$Wq(>b3{zm_Nos!Am>>!!_<`clbJcN2E$daT>02G2j)xh z1^EQ*dPZh)t0nTDKU5+!%S*I>W&zbBVEF+x~vxV z4F<4w!M6RL!(9)8=nwSHTQ9%9Ky=@f*3%AQD-HnxdD^XnVN)Pw(AcG5Xxa()XLU6u zwBz8S&-~!}gXrU;8j$gQCVirGQf)TMwV?0A@8x#7j{dU#+xzrUbcZwNp3T?X*0bfc z=J$_>Z54f1);NakgoG}`L#lelZzrp58Sm6Gw7xS}?q@$&={tE=z-zEBPNB;&{Qa7` zQw=!U)JFha&$P)>Epn+xSRRrD7#5;Te{IwK&QM+sIBH?~Q7Rn5lSaGry4*_Er|9=< zlxlg`_xQO>%i?j|L(iVHxf#PREr-j&VTi&yn3 zW)>AS@-?J{*Xkp{CD&%xB>Zkywtafn-1yzTc=b^7Hoca?PVnDBUFqfg?U$)9ercOF zt5#_bdd|5wagH>Qqwk$PPNa^EG8AD$v|e5&@>o{;0+bv^UiIt)q~2nZ$M6b;j+?b? z;?zMA-BoqEfQy1bN;+g&Qp+@lNeb6zp?xMb$u@dFHMHIc`k|GUWmj4{n+^aK*D$F~ zSQnOjN^Z7USQ)O}H$KS21l9QuzvYqu4TETr0=E8L8sMwON*?p#a3ya1(*lhxNql^c zmGp<}^%$}+YI=HbJ74Xg)H)*r3Os$DeC&ipS|;(A z#aLZHDO$)P z&LMR5Oy+!a$B^xJ{*CmmYem;<4o=_aSRvczg@$<0Xz=FKU(ZWdAi1sMzT&jFPyPRz zy8q9s&myo|->0r?3VZQ;q#_DK{Mpb;DcguuI1sVI{(Iw3nwIyP#mSLSjK~A%_V1-W zAX}YT_`Re&?Nq*wcou+PZHzlra8PNME(U6lj0AlD3~Z~5N+Z4#(OID&^Rvhz3_;z+ zKZ^g%pisM5pbYYExi_Xj48YAKZ|uy(5d z_FXt1#Ux+c)+CIc)C7wz=E$K$-*4qx+smrX{n7%dDZraQo|cJ$Kkd6CRX>RWlVM-mtwpfg%%~LUWg2x3nr@hrmtVWd zrUJ3TJO$>8Ds-kjDqjxx8s$Bdl!s&zdHyWScG;`~^hLYGePh_*k13jRO)DPT5$&~G zhGaRw#z!cPBoAWa6-4gp+otZhMoh|$jr)_G)@x|Pf*UG_<18`Td;Wdd{1J0?Im)Z zHpP|+)fA_yas_vZhD}sV^g3U%r1jR{$6IkVws@kgY(4jj{Cv@Tf)GFVMa zTYUXQkeJgwOH}I(n*@UiUjwsc*^BK~)SIj+$F2Nc%fkPB=deb1qK=d=GTnW5XJr#T z+HY#P#lC8(mKDmP@w``YYfTOrxZoHZMboq;J#M+#tBJlkK(Iym^j()#q276~0{zFnlMDiHLLqkPXDV=LM;pF9Y50{Spp9}s@)E}ByYFTuht&0A1 zou;ieD18R7JqEr7^ugEXwI^vn=~TM-ZSX|wcb#<#cjk}&ceL|i;Wfl$P_fGOaHMDa znZh!KW$$DLG=m#WnU_E5_)z_QwVn)3&&xBx+)}9&${uD;9>q@od_(+Lj$VRKQ^nx) z_i|f?#hg+6zd*rkr{;KX9_IrT$d=2OJrq>j`=?#e?g_sa(eqt{SGS9M&wwzwLdu-S zqd^RDHg^8;qa&>@0WXv@zznLTt-bSbc>2aVDz&o)4R|mao7cgya~3!6b1p zhmw_~6Z0FATI*j^D;5(jkQFjUSXsb+cI6Ag?xo9}dJAntgN{bW&e?`-dl&PIKUc6> zLMODReW*{@ksOFKR_*zAwR^C-mFM>xwjH5aqZ+(-Zb}2|gS^fU8 zre+9^w%@je-nO5j!Jj={R-R>r`VNWS4|a~-!K!GQ=I`VMwHo>my0|l-@asv@78ePM~a01vQNKwFUM~DYrdo_5ZK^71TKc+|mogEV+ohk0&~Y zrA02pF7AmD47>t~pqDaRY7#o2lY>~m0OLktktdY#Rhq|;6I`LV#W^`D4NTOv@R zK+)HLRZpDnyS=6z_Lr_=i02K37o#__htBMVEO^!CU2*ZPt6og#KDW{U!~B^)d-rT8 zhRo#kMVQIA;B>J)3jlY%dph@fyxha?W~%IvYSt}W1fMS*+SjO-;)F=p8?OAnVDIQai@X=k*NP4A5XifZvL2* zI{#6|YTt`OhKke-;yWh@{ufOG#j#8?&#k-n`>S|l27>(cFNnXpn`F{{elXq|U@x1K z!jj#S^EzlDMAStXVG4Zx`C{YxjT-Zpjgmc=w z6fzysEO&QOUD`?E){*Xm2xm{~8A;}SD((G(oMYtSkyiOUoZ~o$>(#tDGJ3zo`ufpA zF=u1E6>xBL16DB;w9b3l*UQ&Szt2tlq#k!FXu8!gz$xFw89M34Y&iDQL8ULGVwvZ1 zgsJiprsOxiEAprkA|3LvH}+KMijC}HQut`GK3drd2n}aQAESLe%6Sn6dZN^|N72_X zU6#RUUj0Cv0MB;PxnUe&4RCR6?-vtIM0bCn**WaB>WtiR>UahF*m0Q^dVjq3fcsUx z0y7COvn1??Iop84^%ZW^KWVL!Ps+%Ih=!MEv;)W{+ik0e$C1Uz4De7Bz8XXX+U4U= z@0rzNmUy4O!^-&pHM8E;bGMcj{kD2gJt_+HXC8V7oBR&9McGPdd=2#1UoK`h47E3* zt3usCc(GK&K zuyjq!&{;2Ix}hjs_X2GFqK^aae0L8Sf1MX>^=^qsPgdWJXA3{Nq0#+M+nt}p8I+P9l`pZPju9F$ED|TcWKgNvevOn^+Ue1jx5jokc_!aeqgrQFv`f-`&e=2Qmi^PU%P^CTYY#2q)};Q7G)*v;Z{EP zZP~rtzLl(8L^{g{L~%6y;CwyRygTxhI-%l6O!%}z*68`~Wup=v*M;VX@74CuFSIi% zHWt^8wcQj z8f9Mf3_=F*N{UT`>Gv`wDJPc79IFk1s_!$p%?!Qb3MwNlLLPPgOt!}f=K;|@We6V_ zz&K;3!&0^%;UG9igtw`Bc3Em`?OU{Rm@PLqyV=W%k8c3=Vd+S>5uHABa7mCXO{4Y_ z-R}qvXe2%MDmy3QdIyJ0y|cZa7<>=ieWM>q?=Zv>Inq#G&)1$w2Z8l`7p@mv(^JKOk_o9wtb1Clv3IC|u`Z+$d z>0+0C>Qxtui;FL^8%=cVb~kK5!uB`|%F`{K0XM*^eUvm&OB8{Z5Zo(uKcSAY#Sark zGSO1t3^GZYLyzC~5i3D0X1oz@{L97nwgFuNy5%YcW7wDDPTkDv9^=)QpdBGR%g=er z1U4h_t!rMuL*fQNGBx$9@hRXn^*d5L+r^kH&vPG7jg9|?Gz&YtuBZc3e$%xlw8MB! zkU#N%?qZ)%`&&a&52B+E@EPXr^>&9fOi;8#EpeAx5O&v-0pT@E$!C-54=eNAD!(-| zKx-aFW^McP`Y-2|O5b}Q_vUETb)25m|FcV0ALP;>F~doLNm9K;TY%(V{JX58m2G%^ z>K`nXjh#7}((xO_3`#k~ZU+rEP3|@~JUdw3gKqhU3e<}EpJy?VQF4Xju)Thz&Yeg6 z2|;7^p&Q$byXh2>{&4K#uCCcx_zYfq$-~&(T*}UColf~uQyW(l)TFy;gGXWjKZ~k{ z&8J%BXpL3Dy@hR3r_JNDkCh}v-C;vnmyVqRrtyt`|IXXYgk zz#B0!F+oW};yOSr;8GDL8e6RWih}x&mHw@5iOa@@+hK*0Yqjcqy*8YLM4(NC9y6@x zVCp4M=D_Jn;%G?SQ2`GQ0?*#%4-ypK5{6rP?6&r?tVn2K6-Nv@L<7vQ999)eFW*3W zvvtw)tO-+uxP?zOkH4H1i!0|DDXe=n(WoUo)VO%Xf~7)6OOneA$Q=gapq^-OuMpmvKMg2(LnH+Bu^7h+LDh913RR)ENj^n zbC?=_+}gv)>p0N4JW_;Bqn4zZwT6ce-#ZDTjvCmS${U#OAN11ZYILyEOKlXxXAi=l$8~F$M%|-W$`G7?@AOR&q1QoUQrY3Gd_$4| znqlYX)%N#f)R}o7o3JD}K;kl_)H@8*u11<)l`TH7KV)N(fIc~9i$9=3hqv7G7d6tl zxSSZnJ9`$8Q#Sb_;s|Q+RABh-T^d&+u4Uo(awfvu?Ri@?B9`YZo_>$bh*8$BFR$~T zGC*WR07(97fFW^O)2Y`K=E8tAwYs}N z=UsvIQ%V;IFyQ8k*CDlJ)&@GP)N5X@y=)%>o*6jci|hx^_t_^p&o~zJyts85z&mLc z2J6*1qQm%|XN%uRp0usb;Ke}&Y$}dU{!<^KlX|n~lgM>5HVX!a(=)Gl8+?uoT^%O1 zDZQvZL`DCd5^#E8{6egNhi%fqL@?exMI$j4>a$Y1v48@{ckx#-E7Je#m!D>}_;IPz z^I|;wB0bx8G8fGn4L?G55n0w6k>3=GC*!9yfp2-l3mr&Odgh}+*to!PtpJKc&_>sb zUK1ox15S#7Wx4&+bTJKhGx3KeF)WaMpn*G`95I~g8a@C#AZ?`pFx?Pw3NNWsBl?N8 z50N8`Bd7=#7G8R)tCY=M>ReP#<~|m3AtRdsVI{H=qcE-fI#+9?DT&!DK*=-V=sSoM znG&w%oZtH)TIH1%b@Og&t4V1|8ci2>F%JU^6LWdRr|*_`FAPU!N2KMpjKeDFsB)Um zvRSq0E*&NY4i60ri&;WF%C{hc$Io@m5ivF%yTOiG9x>f*$2@8q zUPp?05RY5!i!A5te}RE(P{){0`7BB#w(GKDAVyuQ!zM6+BVRK}dE`eMKYo>KU;gwY z$}TafZ+^Fz`>ryhq|MlHFrN0lY5DJH9fmo~{oS|5|NO&YFIZUg^TBm)d|gF#^CW%h ziAeI$NIsJAd&4hW-}T^&4z9L)@i{)> zyfFe%m+q!V(+;FUajNBP^nLzu0~hr7>!BwSR&d5ZC>p#G)~5o6x{#`gD?SoaCPaSV zuSB006TF|c&?ifH`R(*__)@0sT0WlKy+~!8xcWz8Fx{4nw`=7Md!St_J8YI4 zEmtWV^6CV7!hE73c_R@W1*Cjj0eFz#`+xI+uTt5;o4rfeDc}&g)IWf_^&3*TCo#`H z`&ObGA70L(21RSZsMP3t( z(vZ~`HC1ggD#g$bsTR8%k{0O$_9xVXkgWeM1w;L==n+`f27!^3;tiCqDkl)ZV0YB- zYVO-G!&i05eS;`Cqbd=?KprF`%Cul{CjT(C*Dq)>cQ|GK+tQ)~g^oeg7Y%{+} zyQI2yxL`Phn+OEa7k(cPE(_A!VfmR#c(!$|O74#Nu|RQ_RhzLBF)pF`RI{iyO)3~^ zvI+9WI3A06p*a7QOi%*+z_RZqD1B5v-*B7@j;kBHTN&l0%}Y)$!Ec(C^Rm(~ZbGgO=lWJ&CH^~?M#uBTN;!T?%^gi#>GGPLj?Vo3Qc!;K{*GMmVF{lHk@s`XclBw^*Amez&;GeB|H(z&!Tp>C(?-?O& z`w+fk+Ug_!_xZStb&AfTjxI40u2?}+evXM1F2n*P=^907dXhdc53HYoI06KNlHLER z8wqu*r;68+i$aNafXv*_hJ4;U>+P-1>N@keKE~{(3r*661o4g=^8BVVRe?Nb2m5#n z;BjRr(?BF?=){M=ZNic44lQ{@Ey?Q2gmP*0qyv_^417Xl4*zI#I7i{AJVN_hiq<9a z-)kcsd?GrI<2yB*Xv#L?gd~MqV!>tnGjOVnIX;lkrmI zl~#>b7tG?U!?`cFq=oh3l2hg3K35)G4eGNRVWu%P49}Z*!WmrI)i46;pJB+vaCXlW@ z79tJ$lHewe7=9=KFZT1)1B9X~lU{+RDkro+W%)kYlExD)^2U34j}#qq?hUed@K($5 zF6;4-ULg+jkUU6u343(Qi&Q(*$MylApw$iRRs7|D6cb>vh5JJ~ytH0m!q&FbZ8j0& z`xxfUQbJu--H4Sg^ry`%H!O z;ROB8Qu6zCPxc?w$&qf!ak|I+RRL9EE59qsatUTPwvRJzEPZIpP1EhM9FA15gdVgk ztJkC9Em-b?+urgJ%3&Wn#5Tv31ny;Ks2`y6-hCnMM`!|ejLO`|V@82koa8y;w5JNMGR_#u6ly1p)FW~(KC zF3dehZM#y?mLq!qw%MXDC{&(o$NrxE3!2@%7qUqrP?5Fo$h?n@PpNc2GObTgmu`39LQFB{~caCmJ_F(XE;DXW*pDg>+0BQa8tByA%S+CrqXqdl)$$sO36j}MjwtcNH<-~n zbyV!>{zlEY&1RuW6-N0ffXy4lLt`(K3CuP3fy@MDg2di&j5a4&E->JfP0NW-pwg02 zqA-_W;wvPpf>Wi=D{S|B2IJk$KBi!-u=E+Q_ui*i@P$%rAsvjxlDoi!PtHc>%^~zX4in|a-syu z+49(7m!gKKV=6h+V$^{+pCcj4_ojopQtsuE^-G~O?cqZ&`94dIBrMB~2*>}lprNVO zUE5buq<3csKOTlHv~<6Vzp3o>4MPxlg5#05m!IFCbO;oIMJ7cPQ%BBu|JvF zGzr7x@Ip`d(u*BFOa@O$N|c2K8kLthX}gaKbURdSlUynRt#(ON@s$?CjR{SuX;9b;{sG7`;DQgEn-o( zfXSb6qyRUJH%TgTH^(P?hO>Cs)Z4E0`U4(*@{jvD-gx?2!IQQuntbdF*Jg%P#%5jq zC2STeLXPl0w>*d>`yOb-qFG-$J-r`C!5QD z_j;?Imohc9ENgxQjVo?c_HB--2xQ)26W%-d;MF?+)7LXPVxb>lN$_Q1#0SAF%8yZqN1{OwCEAYL#=N(K7cLjQl)FC2V`dsM1GP8j5l zuuxp5wYOwjvM})mr({+U->Qlbcsk&^I()o<$U@ScL%(zKoTs}`kDEn&KF153ocr0q zJJFY8KSCLK0u!b1QMS)WY(3qG7z0J;z!k_mfz)=FvK&omX?*QMPxcNjq;B7F6Y-r1 ziEHlEO`ZL2TiV{XMWXcth~(Kq*~pT_=0n$p%X=Oi&9Kg*d$iuh-9eA~B}4CPd9K}H z@0TZ=PuGF5XyO7u35}NsMKeJG;*QdWhd=6j?k5GAaC|P|YFzauNsF3@%OB)-+UEPu zMe28ICtmpDDcnME8cqwmBs8`OG=P$Duo_p+XUgX zcNapp0f_t*@Dmd`>q-Vb5u5;L$4iD`O8au;f;cpJm;Z-b$b^B%WtW!=7MG0}sO(aX zAiusy)e0koVzFFF#NMXPWj>9Nlo1$@f6XBc;nx7{@O%v$4rEJGYgqw>yQm0l>KjVTm zCvu?w8zcd${APSIMeR&i7#PdLZCTSGcoXABMjI{@2a(7un=mBFG?LaHXppDn=V!rq zzD2i8*d2%$S6#yKmm2g+r&&#$$DA@<+WO@qKvHhPb3%pE3#D&1CC<|eWrWnR4gBh5 zbNVo93dy6;*{yaVZ{b}M!2JeeR~qI6dlB&GZava%oyZK%ok&n`4Y*)v$zkRtXq&w4 z<<1aJE`$4e9b2(QQ0FfvY?@2xaOp6g zDbL#gWyi}K6yOwSAPMNZunXVf)YWa2DTokgV$cUNar1(&t?I?K#k%%sdOH|m{uOm& z@;s+to;w#wtcf=S%E}j`N93DRD!vt>FGvSyV`@o^d9 z0>Xhg2nrFuxPzVc@I%{V24q<`{{lsGden*;sfD}lFiehRq zekJuiZ0z`4`n?LC?=0Bh1^z$(Vc$6cP~&dbZuRZjuLbHfz{@S+Yxh~K=YYt;-dQyS zgVDRMdN5J-(wum#d8MWjTP%#*CZ{F>S_x6-pY2(AB3?znBz+xhs$W>^`CRnR6XOeN z6!L-#j%!%tE3q9{sZQuWg ztFsJ>E84boLI~~>9D=(`aDq#465QS0-CctRcL+4W8h3YhcXxs|@^;RBuj-!n59uz7 z>b=&QYtAvg@jPgRiv;}nn;A*st&8U@W?)jj|8LViZ$EJ*T*zCpyc#5ryIQugvmcv- zwbzczq<$#3d+{Iez2oL{JIkFiw?D)7^4RN3eK;2t+HEHI)90dH7$MaxMYVuwew4r9 zacTT9m~tt3o*w|(F)$`KU9`7ME?@3zNdh{L*PjZ0$2|b5Oet@hVB^{9yzM~#yyL=_ z*ypbUunJ8X{5@i$IeeZMb^|l7j1GYK&RByA=T`V^POr0tmO$aHmvwo#~ zCLG|kE)3e?R;r4MP>wpJKvsJ0QIm?mn(rbnOys_;5S^evvG&T(q0p3+K*^}bT=?W3 zr+`wxschA`W&HRYPD}gIS28B*TLhxCKm)#NIl8MLT5Qh|yV>KK-#si%kv(BpULJDu7?NQx9ztlRLJn5 z2h*c>iYfc&M2(Ku{omNHD~Lh|6@P~IztO`5H&~jWbUb6JDcInpE&tIhPaFaHoP(!; zffTy3B3&hjD@FNNQne-Hnp{8|g4y zQedCupyK%aSwf|OX;TPSC?=wdqq4naUdVwAn=+dg7kBK4wFYYvxbQ07F`ODn1D+a( zL&oY89b@QC{QYUIc_n_ngS|F-3~A&pCvQaOamfXfj&q^f$uDZWBeGvsAWpb7d2qR0 zoE(p|5Rm%L!D=TYg<}Ib^pNl81l$Q{5nN4ECL}(mt&EA$#x+KbXb|;^`o&f=k{Lec z0*vO_4>9N{jEw3P7HlD`l^r{6r{&*S`W0!g;E+aBw32Fw-F!DiAKC{*bP|Ztx5rUm zF>V#nf=OFkZB0&6Vs>kmC}bQV^K#a|vUkA?vGF5jOHD?#S$|mGK?D6x{|~7bd8*}G z|M<)A7aSfACC>+3hzLlHI4~X_2F_tg?RDaG`06J;(8yB9^qt>IEz3Uqgd-!h=e4G* zN1Z8(0xwFIFmX7z&Ia5~l_MHm7K-NP%?E~1afk>veXKlK@~Lvt$+RNjfMGODm-T}j zYT~&15syoo{toRc?va9F^N;y^LF_hv&tlNI&~b-c*>rAs?(+t*&v%pcuXQq8s&)GU zw8H7%F5dPeTc3_e`}-xieLPcMAorVQ-hhk-5iyFUsBt^;1&-FD{+IWQ)y8H$pY4{< zeOnIDEbrZg9@#?xFoMAA$%tTu65s!tYPQF{p#UU?PVDw$5?T$%-uiX>u`71Fp(lU# z52r8z0Iu&IVov9TvHRbtfr6)Wn_z>M@igT~5z>i2&%@M@=WZlhZhrS2_Q$j7rCHmH z)tG>4G!7^#wr_GExWFwAh@IsY=nE5cMuqFTJJWjHrS^+>yYhSXy9y$C4gLo-yoyjd zZ@H-KRsG*O+yt_|q5(b;Sx{>5p)E<4e5~@Ww2_JjDUt+Tq5Zs^tne2em%~XdfOa*M z`gT~pdehDatGgpb?ZCU32*yz3gaY}2#o?6)~E)lIx9R!}#{i+Yp z>P!thUc5m%CN32t9E8_A-4HRmX_L}@ZaQq~w0FP#fC zT#^SVjFTcK&v_hn1JB4^pDS%vxr$PBmn0`Rr{D@otJj-sE_|{e#Swqa?uA7UbX!!@ zc_CH1S(Nk3j^bsz7=iuuIe#n)St0~KS#tdz`V0>?&8y@i8}l!&5leSQS5~&Q6w{Z? zE1*F-YGjz>+pjM|pQebtl2K8y=~LoW{5Gicv$X1=eQ2>rOyaIE=Bx84W|kAdn8g9R zv{Zm<{u{q|uxQC^g-u>ch9}33-E}CuU-$7@h6h6*}Uj9B5Y!PX2)i-nX zS9iel8Q7LA2qnpagGx2ora$MK6Nwg?~JD0+ytw zmi4&T$gvl$XkuIuMdbQ`6#EL(Y_Zx!^qR^!WMS=i*fmBEhu>><7U1obB=C;kd-`W!0HndHHXHh?F)h?kD>i z>r0|W3n#s~98Ap+BvfobvqqXRw#ohT=m_~vz#Ul#6+ebb$n&A3_4!(upjwc1{MzxO zzunv1y$7)V9!cK9{Q7}C#QIEp6R3>5Z_77&Z?#{CgdS}wTkd3ls#T)>4h)-~qqlkS z)~072fdCB2Kki=*PC$R{NPH$q z6W`H>tCWE1{dyC=$L>_psT`yw`W0Zg6K1`;4 z)s}d1jxiczo5~Za7D;J$TA33}AFI6U%ltN83riQxI{Tr=QGk#oHvAF`#W6$yZL*v+?j(to~<4Qyv( z*v~{<6LBChIqN{eI%TJB30OFyv=*RGwzz!(wG%CaM>{S z-VVuXNq;TJzWmG1e7R_(aFx+sLoBQm=!;%U(6Dm~AM?M$1B@ke6J&t-7dX z9QMiY{qyXL?ZpO^@yhW-53>Y}_%WXV0aVse>bu(~k5HGa4>$rC->fQI4TW-^cbTth z2eP;4g2LS2AR8l+g5D&PTMx-lMH~jD?w4H`fDxv9@enS9OYUaD@8yHw-4v?pTD@9P zvP9OO=S$L6WYN|`rWs|%=khN%w_$#RBYy~YUm+L!uMo8c6_4!ZX}}sz9#W9>v(MCL z^B!<#Tf5#ied$*$=Nvq+0Ww>l0CgK2skLW~C0M@A7G4<>J=6-uP+ za6jP1H6t8BB3byyi*UEg84=2j-frkJ3x6S7=TX* zc3*F9MB~#l$!3x&<~-gGJblJk8i*8(j_@c8IE%s)t~E8M9Yk`E;^XT;>P%rIc>2=V zTN=g|>8rKDHxhXP7-<5UFJXw6(QH(73z)_wi}#96DG*s@j(ak>eIpa86);23X8iz2J;Z${rr}`(kcRAQRqp(< zs)W`bhy{7y)sldBMvOagfrTWR7jFi1ild{E@_Ob&YHj~ZEu3ID)=0t7lS^`WBE7ZX z6}SEk^BNW-%w;1q72hE{mF5#&3dpV&PQ+exQ0; zTl&3MXQxCcSY`v&57!-d;5UTC1#+C#|rz8mFXR}&=WBQ6ymZi5UI6v9GiO7b+?}p#~ zenknaX=YyfwcpR{Sj;tlI?%{OTBVK8r8*XcsaaN&0RO!;USQMm@jbFgPzsaY!}I|y z7Gmr5G=06`OjZMFu>RYg*HX0;A26K6zG#C8v_AH08MEP4ww+s|w7Z7m=y@m06b)w! z@BwJ_$ba9Z>hVf(?c4y20G`MY!U=&F2D{c*USYHUeYO z{dz-kFqI=XPA>F>cjbMt3eEyL@Z|plZo_J?(T+*m7eEjBa*x?B=HC+p(0>uCrpzl( zbZhP>{=eFYcbyYmMY{4ed!{eTZ>4*mUS%Zh!Ed81u#Zbp_6sT+Hdpl=aXw~sK4b&; zihE&?MFWL77i0YKW~7L?87yJuTjz1J2qu1)P{wXY_x4vy!4nxO{5 z6#?2GJ1^Vl2y@4$1hF-H?bHDhKY-)#ILGYs=?JdgZl(L;tt;p9<>D=k+2?46zH+L+ zs*d%W!2ry44<+G5&_kgcN@S{Cp3*4W{lk>gvR5X8S=+;G@|Ww)1T~uI7!>Q7idpxG zyOF2AWfoi?B8#3QFY4x@g{7!=*!fzd^3n&vWoOs z(4IJ)r5ex9>Tw{H80aspM{@Jq48r>M5kGJ99M#)@FT|t2zaQW?`(_{IpV=8V4noeG zldUS-39BX)g17Fp{+NyI#}H;{h`Hm*6kwjVu!$P1N-Ro~!iR*N4_d3CA}x2mMxilc zcQkBxp2VCkR?oG=T8)L4!N0C=y!^=axfB0{lL|N!56)X`&EDGAaE%(z>IpQ|)kP58 zHz4ah)jQN>3k23{&FO&j?tOp1#A2%jdB>|&&R#Nb8PT=7%tKxK*0%l`4qGHXTKe6; zP?3K&c9r>gb9SVKXKNlxj_d0T2gxDnhh_fsLuq@3`4F8cv0FfYCUEofW#TN zE~kmM-uAYZ2f*wUix&D>k^i-q9Y}Pr8nQTL%qYRbudz59Pr@m)9sEf`EYe($+j3Yc zux(uHK2xx37k(^XL3aE&4-EmH>Z|Kh+E~@!#*rbF7tySBmdM7nebgwcKoA?t_lNed zi-v|zL~{X%f$@$-p$q2d(40BVp***qQ*El3@wedpS0p(9Mld+PwJ zKh)vHRwJ5~gZ>ACe9Fley*}?TV7A*SR@}E#)p)FV7Is@PcZiUYQb+Ex))ann^RtXv zXZh(#{ToFqgD!@3}#NCi1yoQPDC9v^s{;17GY^3NDfBq@|~d~@lWjsNy- z$twm&Tb_wNi3`b$QidP}pR~XuET==;Xe4|@`$xi!O^zr}>IF%K{Rn_&CU^g<7}UZX zl*wH7@z=~={D&FA0IpG0EKGuDY_`5eETC{qlFK2Bxcg`Hy=NXV8j8{m37e+L0{PjXqaV~QjH9~ zv1p++Lx7If3VaY6NCe>#DF-qtsi>*K@aYk#1I88?StRJ!y$%?G+yq}BA|&VWZ`f4x zOFah{Z{R$_d+%#Z5yL#i;B@Hnq*Zf>7n8RI{pg*J z_#us(F^!s%fg>TmccY;R>YS%EPr=hL%F1!dn}TB+_VIM6p25WfH60aO;o;LwnRC!$ zU7v1rz>=Q2X*Jkxlf3q9=o`BO$r5fGK77EGglM-$P;<#VZ{v|quMitrA8E-t)b9b+ zF9_%l;1+n?oLaQzK~*kPbC7$5w>hO7X3x7L8ex_1o$zgV>XR?=>oxClwO?=Vv{tjk zr4Fex=d%WnQMIE#FT1$aI9WUPfe{f$b`dpz=odT!A`v)s?cXf?-*cA`FxV`;y$@T% zYpv%?v@1bF=llC9G+2%w7A6OnI#58IdLDc5&)O(QP4kaMoWgBGa|HxT?Pu>Q$!Scs zHZ|ZR_@i+WHi@j}98{&Lu|a2dnjdMieq`nJPtJsCyZEfUh!)J@-^T&W>fdLEGf|c6 z1D?iE8TG@wgyiYtTYt~aL=hs?!Ev`E#`$%zRFRhAGT-Du;#3Sx^`3O9iGR0bdX^$h z?+X=jkpNLwQ>3BMkT?O2355{P?503VElttXw7qAwxB=b7(r?52-~rVRpMP71}w{vXlz3KfOEV7PwT2Urb0s5ZBQC@K$2B; zoIHUx5c*r8gJYFEgu7PDG*5~N{M1%w5!^i7>Uvx42-+9uGF+QHKu>xD^z-4kC=TA@0erR+^6hn|Ehc>YmQ!33n45BCf z4ik}I^p#e49^F`5T7ch;L=!J?5Jt^Qx8I0m84b6~`Ujg@K!RXb=k2=`tx34f#D0u@ z&H!iC1}6}*#)8Cg8<*Jz-(57awJ(a;1PM0F_qwS$&5uLx38AA=QgMl5vu`ApXs8)+ znU?N7i%$7=2CI;fG2z%S$%oqb)z~;$Eu~jSFC*cch;)Pmd1t5IT9{3LV?zUTu^NXU zpN(lvr{lj28C>!@H4KRVb=+LJZrP9)k5g+}Cbzt=E@=0e{y}f@ri#zOfByup-4t<^ z_beWhX&DlkUTc!=qw$lXH`^j_!CoXJNEiWk7(t$qz#G27R-l6iKuj9t&RHsz%>p*Q1GfT{ z-J8^0{r8jBI@;ae%Hxk>cC44potDxL{pt|%>v%q%`(BLULYK&A?agQW>C;y<7|Dj= z`bF@kp|A1Bq=?8Y@poK%$14V1u9*fj&lPLJlpv}nLYLem-nW^K1>0qmPN0zSurc5| zUR5Ls%RNK$MCC9oB8Ox1|F3dRBVR!Ow_qxH|L1)01*`% z{OTayvYD;REHJIHCnG}1)*`x9vI?~(c6E2+(!WTOEZr(AK(<{>F=@&J78+<$LLGSg zl!B%H4l?s7noEv|y%>nIQNStxW`BT!|f$ zsxNNGA_Q{lPG#iW?p?dzIe1=B7I0y_*Do4^Eig6d?P_2ukJcn5`qY`!+;736{5Pv3 z{FebO?}0H@EOoYTHnYzwCRP-^3RTJfmiY8BW30QNtF*Zksd}S2^B7^4sPHxAU&!yZ2T6H51*UK9 zz}gZD$Sw`62(>a$?W7x$A4%8gv~yTt6ovZW!*i7 zlb;Z>Lh|HdfGlJnF)*USXewei3cE#>Vb^>%gHV9Cr{0F3rJWrHAkYC(rBhQ*l0P0} zM}UH_b1!j52c_bu3^{u9^3*~Uce(j)=iZ{^^7e4@vE`kN^s$Gn)Th!$omPmf0i%lHm6=ho*O`P*~cvcwKnfn?0qJ7fiSfwH&Ob2u+YZKEZ(P=&80F5n9$CLMC3b1v%r}U^g&msS2LYvCq`@0 zevbXA`^aI*r4=m0DkvCu>NL1zXjJ`vM6NU}(A1o4dd=62H(#jbR1`N@FpSCbzSQ^( zS+`sV^4>uVzhbq(c{)s*toSQEWP3pY=gKQpHL{f%&Yru*c##A8@x2+7wHT;JxkqBx z96O))zVycc(Gb>|&-}O?$-ku1Wn8w{i82{K5AT6^H>{hyuY62$lwZr8PROdYB5 zV05!Xwvc3Xn|Gl*6sutAdd0Pz6!;(c;{>jd0MrUqGzu9b1Cx{G{^$z+$MpYaY5xz` zH5DN>I_)_6vD!sFZ7H(%p2&Fg+-z3V_|ffbKDtQYMEm5@EdOr z_W8#uBh!Ksh@yWuir@!fQAOk)QT(#zEvPRMFQWlxSnv^ncJj~E-wgsvUPVP)kt3*w z&!o^z+9{?t-Q*>7dzvEp+Ok03AoNmGYvZKE&^1P3>i66r3N~!L66n)P=)i=>pQx?I z!DixA1(yYCR-iqgeU>5(*sMPRS7aUPN@nrj>7Nx-oG}9(n`F2$@-#u@L=gy#c&DD_ zC4$F&uS2h#>V!!yvIGPXczpQ*^#d4y0S1HTVF&!XVCJ;Cpv4H(PyI9jR$YMvQ0cCd z$xkip#s4^)xs8yeGp%ekmdV@^*qJ2iO_wz$^nIj!gQb*1;3hALc^y=9M!wEURq9lx=7W$Huh`->L2%PJN zy~ya)+0?I$LzZ%-trh#l%GCP=4GE&*7C4VYtiC&c7P}iXzAco_x8Yq7H^!ttZJk&? zp*VON#!6JznK-xi_em3MK1>?Y2xIC#)D#taqYS@qZ|L#x$wvaH2AuDT3T~-)@lS)e z-~m8wg(1oEIf<2Cc>+`P%nk8eo9c>l(a}_hdE!?Ah(7HJ213}33k@vHL_o|(+$7=V zDdi!rYJ?AkJIex=n~lIZHv~6n2D&@Xkg$@$ODpfv25V)9z|@I!Ig)=y`l!4@V=Kyc z(%Iyk2c|OT9BLsRK^~%a@@t7G0}#uD2kf&aa{J>zVrmfi$3(4qy~{Qt$$UAl_4fd} zsp;scoXIj~;lCPS?j@H%s0$RNfUk^x@`4ZB5EWH27Dep)pU=D&Adu*wR0Ic9VNmbS zuOf|77HETm>4lgzl2QaO#_=ioGU2pACkTW`JKT45mE;tMi|Iuy!^EOr{KrNyi^LOZ zvMj~5sM8ZL7>No$J8BP%<9yS^E5J01QidUScKpTZkSlS6&X>!pGP)?m=*7GEwIx)N z!%tknz6L(*)8_KIf1-=1OxLA-f@gs^Sd%(uA{z$}Jv68woC*5z8&(APQ_{$-i(YLW z_h<}3{gt;zthEItPf<78Z)D%cVy|%z<^`QL-+_?aIcxOL$UR5oiDV9Z#?Y`RECihF zc?UEgwT1CVf^z(r2`&jq@szbvIcLQORVi&XprPl!-nX<&fq*R{5gFX+|A5s#Q>{ua z=?8FeRr0%r!T33XB#o*Ci6=T1py(L3s;Pvlc0=iRCt~0P=ajGEL$D?@rc=UDS)x>o z)-u#VM@vHa6Xa$ZT2wX#5=I()D3rY=&t57&`;K6c&#nR@mL+{CAp64(18?vK_q*fm zF8NW(XAr<>6Al0K3VfhS{q#wset?LtRUB4>D>rUQ#{U9=uroNY)MXDm4VqLr zkeu=cTkczzb(461ZJA-vSC(2D#k}pmhT-I-o%7`uFh3O$#~B*l^^6+Ei(QQ~;B|k^ zGFs)T`GztX5-;zpSRjcbf>h;1z^LD1h512qgd%ctwYiE-1EQycLnX6SEL(^uP#UL8 zfP}u>POh%S?lT`EC1|xGd9mDL4>{Dv5kZ~)IOOeoLZ)9`89Dq?4AVrIzV3pHOJrKVkT5rj8>7rk=#VsKzD9Mym_+Pu%FJ#))H8ReiACqcWB5?-S zfKicPYTlH&<32EfPb5Ei?K<^jGMivhqA^w)2J~ULqJlYnxT2u-UKi`$UprEkw^Ts# z8v$Da-r@ z^ZJVAOVL_zXn7lMxNzus2CCtVZyU3tYgkMgNa-S;uekbK71!5PsZ(WK70gTrvV5N+ zqyeTYW2T*<$T-UH@`ZxYu%bNn4^oFreFz7-ZUnsF3@J~v;J?ZI_zLH}L7oBjNFF4bs{zB^ykOtCDe*UA=k*? zPJiYK_mht_Ht;8j?i*s&Gw|smu_DRfwrNPWo%N*s&ApIZ-wr>I$8;UCL^vL=0l6m< z)3`IS+$=C;KbaEfmkSDaM8rPVk;@{}%(26? zjIw#1NsB}?Yr(Z`tZOKJg}OfmR{LptD%!oWbrP6(AuO6RaJ*z^hGJ88W0MrH^w!JF zI6%yUDu3vm60{bA#G;v=GeEQCNS2>Ix)s&)$+&C$L87zhzzx5Jdy;Pxlz)N`(N3x( zI?igIv~eN898>Yq4GCWm4`Z7BtRprR-=8aog`Bk*c4*O|jMHqyNV#*axq)#s7`%H{ zALnajM|3BwReTOE`T2pt$Az>2j1Fq6WHldrLNot{#vy9Odfuyw!VE9Mhz9WeG7(ii z4r&K~>99nUXF!B9Ap`$1Zsn>elf=ooLq8(R*0SOFTZ>9s;A8IsF{kA_XY2vy26G|8 z`N{iYOOr^;UQUXPnA~{R8aZR4fe97*`G@fixkX4NR<48~MNCV%am*=A8%c!W@T!jl z7Q2S=*`nlF-+>6`kkGs${buta(xc`^^s=1jmI+UR4)Ai*mzBpcZosj+pwMt}7Ui$0 zVz})lJP=dNpEC4!5R2&fSfiY+W~mi5ImIXSS)9C>E}1vkGD}2Iv}{&rw|ou(kdk}@ zPMwTfbdj1y_4n_Ur5t&3G(o~m%6px!S+WWWpM!mH$}4rDoaJ!whz$=T$?OPuyN6Ut z07~3e)q$>ih~C?F$xLb4e~#NL#5hx%*xaVp;(A@va9Q7NjBiQ*DOT5QTj|5gZpmCx z!f7b80hy$5c;oud&f1~Br*D>%5@7g}K@Ud0e5^W)1*Ztl2tt2g7)UrEA-lx1HW)!! z@Rub4^L@k)0OVtECDeqHJ*4^d6;W23HgBeEPN@K@sb@6#iSyO$qn>KGhn|aleipL*tfYV|m+^D^e+g)q5z!*rtwZ><&popa>=K)n*`J53hpD<-C z4l?U`urp6&ZG($6z9+3%G9;S4En02R~FReSOk>qEHP19dgYkpM!z=G+Nlr7^s(c3wi3XKn1a2{6umQnP6peOi6Yz9K?i0gYCo6U9l(4dCQ*& z-w(}w$|>4P&&bw=fc=;vF##@bvRe#Yr&^Z6iiXyiIT&j=ooZbv4d5C`k4Rj+RnXBZAt-_LccOq z9kf8lbxjlL?-tgH@h`GCFoEnBOcD(9-tM;*t5K0YNlMgW}j$cy+!Dh zeckJPEJGvx$H(hu^pJ|?rimr19L`gxg=H&790>$oe)G>dskvXY#8lYWqrdj^S^Qi? zQbpQp-8{u#WrI&9_NjM8beS-10>97&d-2xHCQY}xZX<~x?BB_&(BYI;E;QCuMJxaE zW*QhC=1q1?-bz5IG*YPi@#Xk?IVb-_kBbf<`2ecceh0$i+t9c63^Nz-@bor55Lruu zBomMWYX1;G>(6e+e0fIQKA~9Doh`s>wmOf9X*?KDDjJIPg;14AVBmN!2Z_Vgd0+mH z@U@dkCF$R9@G3dip#x}7;=@zJoYn~MGFbJ41&Zi7a94~q3F3Frl?$|C>o#!lpUsn8 z5WX3VF3xu@@NJRHu(TQY$P5hDnsq;xxDoXmUnIz*!p@yBz(nl&6MQSZz?Bu8Z8Q- zKYDvv##A$6Vqp4|vorb9!fmWMxZQKzf-Be;6DIE4?f9L{j2j7K&srt(6halu?j|nn zua^xO>Xm5xbsLs++A3i?Lqzi4d=Nj5gs+(0J2;y%|6yj%_1=%e9yuiQ9+Q zC4c*vG+nns+~2vZnQU0*e?S`=CR6dpPO&WMGAVz_d};KZ5Y3SXF>=|%lNGb0rO`*~ zgY8{MxZE}Co2O%p5ilKzpeHKGG%8Of!c{8-&#p(5@@rLneL#j&x4yZ!-Dk0n3ofKT z)NJ&>!*u;ht3*KO_=yv71+Npshp*y{U19sNWHnJZpwl$$Y8z(T-XVdBT#oeJldyeYJjNV(I?{#7ND zdSy~zBudyK^0X^ux2N#1@7;C64eD}51Ka{Z7}{o}e)QH{-+Dk9;tzB8AdlA6V^(}d zr95wn4=P!Ao!Rd#X@%DvaOtI!Slx%?-SjJPb%Wmxd)SBMM3_KtPX47}G%=?qcv#}2 zNMk4wDiIKcDYEHb8W~`&@%ug6wZvAGZ}owL2(p{Un#RCa@rANnj)lr~;=3-l!B<`ElRxSU%W-?` zg%$03jyMUP5frTm5Ku;uHHiDGr~UUNI2yX{sI5E{hr1FSxWw0jX37IoYP!@x$WbmW zrfQ4+bIZ#xbIC4L)C1gJcNo*vo)`Ptp`pV_KV+<}In=c_a>0j>kcMhlKkYC>)`{K+ zsqHnUR5w5vVBlbpoSaO@&b~9+7pTmKtU$}Ja8(a`u{XXF7n*}}y}*r-_Mer>b_yl$ zX_aZNgJ*tX&+}z?`1coUMF{{hYynBcisDMFXjURWXvT_q%zj^-x#Q@3 zd_29BlCl8w*iLvGD~$_)>=%Yj+K_n|5QnHJWnH}hCLyhZ6I12M;x%Uoe|8C)vf>}k z^mM#|8!Y;AAR;!Vx_SyOV_c0++|eVWZx0vG)E}NUAyyjNCIqeVwU$k6$*|r!Z_Kj? z_d0~1@-1D1rv`bqsEQI3=hMO>J3ETH&dc&uj(xKRr5;m|pB^c+ZP#%pV!0Zw&<(y_ z2H&<>mU?qEtARp^HWMA*QFFblN##}!(?(!rXva5#iFs$v%A2er1+NKG5yvkX1wwL@ zN2lxKgfH`~gAc(((Qqr>ysno^{h6aJx7Ol+^)Xv!&NV3EgMqQkDP zOJBXBYpdFL0yIKUwTSi_zye91=IWfiM#>H~N-Ud!Qc|>}{j@p_^P98OgX^;C`xmS) z^XUWxTbluG3=Ea|{BeM5W^vK}VV#rXdokPh{5k7_=bGw1!vN*7_~jBO6OXKKsVP7Z zZ>`$|wAa1-xuzll94c;BhkbJ%5HjR9Ds8ge&yf8 z|De%Z30qttYRFO|?JsYpbg-vXmTQh;&=Cj2blzlx)bwwA>?Tr;* zRAz6|iO#aHq1m-j6;_90g(HLyy57@NuL{$6I9lZz|!!A&s7sFbu6IY}Dr=s0)rw~7^?d{s^ikFR`= z&1giMmXmSoV%F7{Wy0jv+$k=8H+bUA+P32P40}_Zs^#E1x0EwdT9Ucq;-9r$rL7;x zJ<<-@&Q`qSo6Z-76`)}yxx94g1X@A7 zbjmCx5P#KFRx8cyIx^LIc}X^h(ovQo%~PBVCsWcTW865+@afibBaf*@IW`SOB-+_u z&mLXg=)LycpFgbvPX$or^w<`BtSI0j!igUHPst`6*|%GRACh>n|)yL;~~ zVuc1(7W3A(z)W2jaOr6@a^S3>e{m$)7fivQOo#4k2OK>JWQM{<)|e0xyN*>mMjAIp z(kcxVM1uO(iMHAd-5N?H)a0^-jEV|Xyx&RrpF`qqflFkUiHk{)h=ZHFZ@uQiK6bwg z(aCB!sqZiFVs*RrIKZ$4z=qAf4Jw0sga~w!loDzi7~w?nDUCCG!^tKHA%sBSw`phT9{c#{=FoVgCF}`l+Z}|DNkA?Z~904so`;Wt4 zZqNT6Co=IPMAPH_8JAg*rtb!VEVb&Drc#KDW>b~A))QaQ9KQkZsy z-TV&b((22vu}Z->i!>ViPnK;TXoN>NJ!XcNIFW~@o90fw7OaK>}gdc@~m}D@UhLz{kHdnTN&tb z_J{c$`Diz{b}kTm5Gr^ijZg|+CFn`OJ)AK6WGzb|54b!Q-FIZPdAZ(cnEuao;{UF= zeM!kbtRk>RW{OnS?SyZu!F!K&^Ysil^ZpW20a#q3-CXN;5OL{@wO|r!Hs6Ay+_0F- zkt%pv8zj2Me*e4Lip~^f(Wg9STJqn9;y2)Va}bNBk+Y{=ZRm@s$9ca>#c&Y)#7j3-aA zmO)+0lRNRsi@Gu`(4^3aQS^L{f2yku=#t6K>KA?l+I=yI&QrCUwDsD(;Q@Y_EED0_ zlm;jBK530mx1ghE&|J>fAM+*yEriQ7s@am)8T`iCf06a&fw2D$DJq6!mH04VzbasM z4Xm_M9i-Kek=44$uZWk^lQ#Az;`~qjAfg|UR*^+KPrZ~1HFNz_W~HeDzH_W_AVf`J zW+L00#so~E zaBDex@bMb|!rzzTP?Cm;h-J%F9y??@aO{?88ke^)ZhCVtBGifysT zfxz^630T65xL>I4q!Hs;KWP@9u^^g0n8-->Z=WW2tbir$a|KN}przGw=0vFL%AM*K ze$vp6U?^5UPnyC9Vfijt62e9&l*ywT!HW>Q;df}~qIHjx|BM+AO04e3^#dNfWqj*EOgC2Wwg}Qe0XD)#K0u=B_p`kdY~M!o&fZNL5XZe0w}lcpBK{u8Dy)FOKo* z2o_f(7Gl<{(}-66-sLQPwby|y;>bP#!Zz#KznlfBjufcceJQ%$lXrv$wFh zS3Z;w!xioYLw*gySYq?MZQtcG%hBc1B0QCJ#ePYl+E882d$CRu zF7KMRS;*WC5zt0kTq1TVyf(!ARVP!i;$WNxUiOK(^T>OLx$G#l@TiYcge5%D)8&p{ zAicb9|6)EZQNW)=MGCXX?EUNcg={xOM+)`VwxIrW+)0Z%6S^0?x@3CnS2#u| zMn4Ddc8Bge&QZ9N+8eMF6mi7V8y1)}dQ2N!guA4~ed={#Tv|Y^JlXb$e113QR5Eh8 z?08+v-O=*bP^AU$NZij${{w@AE|OtE63M9avgsiuiGBk~1f-FUrMnvuSh~AKTDn;}q@}w- zVriEC-JbJ3&vVWn%2Ks&prImRCqi|rP!SpdweF-)BfLA z6lZs4&7h_Z#)QX!&HC#f^$3OHDE05;$||>IP)Mndk(G{%Gd8##<92a;DPsc!ViR%; zqUqN2%K`JzB1b!S{1j5XzZ27;=c>K~oyVy8C$PTMV=FRU+h}!BY4FRg(b9&do$rP) z*OFj)u*12;0(15F(q)haB~nV*YXLDUi|h;_?AZOe38NBbZ!%>@jUR2%WTeq$!DRTL ze(c|4xP0mEhw*BD^I6K^GJrj$n)B&+}tG6X=0D3m^t5=Ep&& z)445m#+~lE$C@r@aoK9;?6!6akAPo|p+!`rZok}^Vwo!B*8lN6O>#mo-z~3PrXURc zThY-^KzH{Iety-GlXWXG|4g!0zQ`+ENx|$yC%VFE`Haw-t8WXW$QiC56EUC;AqNS~ zTwKm`M`>@!(Nwr)W#8#;x%&C8P7BWXEYTM}8Gl20*Kyd2%S|+xD@kSEB+1JknY$BK zEaHYC_VBTcpG`khZB@KwqXprM`N*Z0Ni4IR>@<<@x8*%-M}3bo37YJ+DIRf0 znZgEi9GQt^yg`S1f9#|hWizBfPi+1wY9iOk0s`fDU)R532aqV&J0uKqG+K%txg;#P zLsx;5#EZ>4C}C)E5MpZVd$p;SQ<%$ity?C`B~_;fopeovFYM-{+_3k|q`IRc-iQFn z$4nmLYLHGDgYJ^rFzSUskZWEsO-y5cN28p-o#24bn8H{gJ^n*DT7(P@{>yPUYi`Q| zFA&yMrpS7c$alRtl>UzPmzBs>eUNTP@+j1Ba!@9W`_P^Qf7pvpS%!(17!-~gyjjpU z_Qin5U*IUKUhD`Y*|Az{goMr99vkylhYv&dPNehxz@}8h%9C9k4{iU1yj|@Qv*hg! zEfP-n2jmP8#F1elUp~n7(J1icD@FV00~A~09(pD&4IgL-XXohbMN21hTz3JIGG=mr zv(Ku(qqlx%$Un9Z!FfK|#woskmdF{ydIglSw4WN2YU zVNoMpcbOLHIrWdDaHxv1P-X2Gbq>VPr%sz}QMjOZI8$HQswu0k-?^U{r+|@$m;q{M zUE}~15;N2{O6TVii}?LHdbg3Q2Sg0Taqz`9g4qNpl?la~!TT}?#^JRI8&^L~exe}` zHbQNFyw1x?XrV+2o92=3CbfPADS3+R~^tzPi+a}GaXuJx$C8+Y+H zjk$KmeXW$tc$}NH+bQxu#P+#SYUYp!VndCBq-Uv9Tnm|6%eV6fwp384}nll(UEBcmsXGZNRyYdFbi@I^WPe*2pDTr7_!nE%x=8Ao}Bmk+taeL$G!VV-Wfcg@hZFV8g+dVf<9Za6u#% zV$F$Cd@vmqNL%@6xh$@6rh{0F-0C%@!6p$QwxBR@E-<~*o7-D7lf+6v>?;7x`~DtP zna)+!p$9d2$S%6t$I%d;cf`EmwNJ!{-GwS%O_NZG(>P(j5l>g93 zDT9n@2Aca)fNdd_fGRk4S-egC#Oud3O$MkJ24S#Z6quW{)z`I+qaeQ=J)~W?KJjTR zsQlm~ON zvS+7VFXVvY;9ecHLL zRfP9=&_cj5aJCdVzsMz$+^o&o#05?H{}U>pI&wF_Gm+N%Gr|AaT-@T58V+J12uoq% zSskGQcU;EpaWs0}QamI;T^&{o3VxNuixNF1*u&;V6Ai%{mAk-gL<*M75l2EaDGD$; zv6LqYh2nt~Ds>`cCPx|5s2v@VyU_6cEwnbUqAb7lk)h^aie*U_es;ytd~fF^*(LRz zBO|XbpUfefF~#2Jd&7p@lCGn#lLwrJv5(?gBBPF9M(*}iwwJqJLg}jNNX~8g&>w~l zz|gYm>}{FWQH8dxRWYcHRQuN_TQyevGvTngfoJXv=Q6^afl9PwwVaaHPXLagzebbl z^2Mk;KW4z`!>&5^#O1L_Qo*dvjNO<0{G-;2imF0k=@$KZKYU-Z`gA^C+-^70A;@0< zWWPBz{mI!^{Fj*IKQluU}i#F z`+~ghMkAwZ3}xkV>oWa{9sLTuZ+BtA8!g>Sq^=1ipOEYQ>YTBTu+^%T*VIf#^%g7qOcuO#+crR`QfA;bVqlTo~6{ck3~E5Gb*R@=C-CAfh1t!lhfTn!EoQ+x6!-^ zu=%OmrNliap@<&#*>XT*hi4F_yavDQuK=YCL#whvw+K!vF1&>HgE$CY#@T}mas5+v zR|L^2B+9r8x)U}>Z#rqv4g_PO%EvXnA3UchDe^m|Zr(Fc*eQz6Wq^{LTX^P!4J?E)#t|i);xi#iK~ci2B}L0xg%KM{UjrKqW|?h+0D_tfM7(wDO zcAbHQvTvEZJyo{z&R}kiS4T%@uS&>XTmeG8?wv3ZaBkb~{P>~kY%K!kmY9r8`O(M8 z$!Xd4_y5YRdMDWItsEq(->0bOJW*jZW`#LEb|-CHzCNs3$x-_hp4`D;B2Po)a*rU6 zQwd`Kp7-*tTd*)xN)Q9*WwgU>HeUq9^(tBh2{%Ute;VRs@DR4>;T>#b-%lt7GniBP zP%Oo-vXDr98mF#6*V%^%Mkd*C#v*jx;N}}Z$drl`lhL$Mlha$0{vL`uE;wF^E6zl} zi&DYu5mEXYkkQjfEM#V>Oy?eV1%&ot2hd#e<)XG$**`69EZ%)=Zss62bl${qEn}%U+xanc+6w%w#P}U5rTIc#e_w8*mKBR{X|;Tn z^pa)RM97aFy=dBkP;Kl5K%?iqaS2);wxHvCL?RUIuEK8ZB=q0N_u?)VK4tnP1iE?0Ji0u|9Zy1m_Ts=$_wCV+oLy<6=tf@got2A6@;j>H+#HlLkW zCON*%9m&q6djI4oB_Y~l7zL4!QybrIrE8L#(ek7e^2APzWi=eqG(1l7g?Disj#$j_ zwKCONJzEe&~PdCP7$gg^W zBVOutx%3`Xug~pBb)h(oL=pzq=It}QrH70_@DHB(APCZ(oIqb^<$o46>#ZgpZgG?B z4Y5!xjBf_3oXQ7P5x;HCtr9fJvr+4C49hn_G|1T)dWK`6X`W`UU`Lad{&T79dJbpG zZit&oRZSj{&1E?bST*})0XD6BdpBp3k`9|}FBcAJIXOGC+Nx)Z6aEQwxxN{IhSS5^ zt%{-Nxp|KF--yQxwys=@y8hoe3_#nh#q|(H?0!ns6SnDbKIY(`s`_*zJKXY%iOI9{ z6Dxt&Ngqj;_ck-&$~b$?2u|`nAXsnP^+BeDHDGq-j%vRHE>hdBN7U%pSm%Av;E#Ed z`Xv_syAY_kjWcN=X26-r&sp@fyPJm=0L*mvw*KGO?2w}$oQC!5(lM?wB~L0Y!6}Dq zcrY5399$(?(m8t%8+Ad0(H7gtR}>Z7C4t&;;cVe+vOhlw)TwGQjP%OM^_aw9&MbZr zDc=P0i~F4PLruw0ktStKT-Ata9oG;_lR>=}n?eU6zfm)@^KpWBf{@6_Ziq8Ml+loH z^k?`$p`cs*y`53%hGM%b*7H;EOxrWVx;h50u44-dmv*k*4DPOT{O<1cYUZmdc?zcY zuD> zVHouPY)wlmGqmq=#e=!&#{_W3VuTiNEDC?)Hy%gF?ED-x-{K>fVaYI0cDq7}Y{JFV~h)T8$ zDLdCVT1qZPWHLu4@i=eTA2ITZ#4XAQym`Ktp9F=bvK1D>LZd(@TSq_javMD>k|e?CU&)PNp-U5ekK%( z=Itu*tomTbqU=8>J_y{yzQ%ma(1PfV56YY}iCxe``;4tej8igUwo%kfBBC>@L(f<< z_Jm7API^JJ$x?ZR(C<5iTth^uU4aCxh-_QjfQYCUc4{odi&Da{k4snG3wt_gAnIg9 z_RP+d`*3WRdME5p#XPrMvrFuUN}4STAGI_F_~Z4ah`RkM$MY?!I-hD);}MJZZlPAe zfvwfO&k=;CR@}PB>teQ;Xwn2a%WEbS zf^>f-5^xB86Y0ZFSz8AD``qg^w5bIMHgiH>{0T;wSGmI=9~k0f3L0d-DoRxIJjv3- zgX0>_Y=02Q8}RtK%`WY!Y2$JiAK5^H%1k1N!xPJKqK!My(Kk0DwRA8V^|YTnmSXUA zd4^dA?e~T@LwtA3V=o$;)+Sh*)_$`+_O!tsszpa~pB9bIb3D4TO$Y6_hUs!GK%i^~ z-)*6KU6!@`|EjF`8~s74I=bk9iu6vZh23`UpZFeS#$GPjmNq{%7S@{Lw}mLC62NXe zx+aumG5+mD&(pBni=n2R4Pa1LC=8Tz*>-tj`UxTHMO3pa$rHBf(0ke5x0&nFe&W9b ziq$_27w!E|zx=;p7e0=v<))aiH=jB-o2w{naF7uLU&x5_#T5}v?NrOU58v0A-=5X+ zzj{Ia^+W|S+sUh=D>Vg^$?;cZM>Z` zLnbCqa$zTKcy3{AuIfE=Ob4)*?s}uUmXrmMtye-tj>+}sAgFav~C7IYT$nnt-<$Oa%KbCuAV>ynzRYB>tv8p@;%xZwX7e~cG zP8m1QR7=LaC}0*$zA0o;9BDW4{)U>r!9G}B`#exTxMYZuWZ{pQF=I9@CHzvZ(a`%# zhV-z>7W-%jwv>BaVo4y~vq|{Jq|msuoQXMv+Tdwhb@+$WF3Y~EIEKf8v>~r0Cb_h) znba9_Bbpy^LyzKQU=JpAT|Sc^niMp;QE^ikk4hLkOMGN83eDDU55tWw=XE)Azeu<8$VR~kkURhAs-`CO7&QGSXu@VT0=#0xxA`pgj4fxcoV1=Q73+T2Iz0s0j~3OZ~Ya7;nFDEPCHL)0o96 zFu!{+76Hp%e*)Cz_5_|EyZnPpn@BeS^~%jR6rPwb6ED~6=VDK)FLe5Y7ybX>FhK$~ zLqO08s_-qd6faivhQCrPQTT zPR~8&8Dn#ea2i;oHHXi_EYu>X3g-W--DAS%WYFb=hLfcLt`##FY(O-KR56X96Fcv6 zeT@+5^tDv_gsgXF{9^^P7JC@7;vp@cH z1~iz|hUnm|#MS<)S1v<76yut&UQbbDN&TF!EI+pewh#xR(f2B#r@A9|T)^yI#ITcXfDcmPrj&q^x@z)(b-+Y<2{+kqAu78WpMDg4;pLs*Jcaxs& zQa}*prCZ5+?+st_ijpknZc0^0Uw?0Qn@+$N_DVwo7dU15qqLhZ$Mrb637+rESNxYb zFvtYE_q)z$>Zc#00LRaX<29nr=WA$=Dgctn+I*XJ78J{2y(A)T=R`zEEKL6tI^lge%d}>yllT1LH56&*?t^wctkNZ zEo|Qx!90g;uWwU4LL4+0o7*yYc(}MCff4w@KZ}vbhabae8pIZrr`Wgxeh8NEr~;0!wc4q8t)WPfL5twxI5S9TkH z2%_%eChuemYe&a^`NEglH=$74g-=YXrEhL>f|K~GOh;j_NE#3tbg6~$s~Uirq+$eD zJ(k!X^I_7IT~B!_`waT?i`T9*Kso9$}kuIfl75a^NT%PmjJ zC10DbT|Jr?vd1{mh)~)`=Fl^b;6uZuKkrZlW3i)=k424vu#h=Ju_J?}1)SxN{3UT<7y` zEGG}o@G`kK(*x%5{?M2#zuR9ofM#V#9%W`_KKr8~mZ!#iHZ)H`y-$eJa?0H6YS2-; zW2(L1tYDx#K7W3i&AE0tdVWfQpF}F%F|{$PZMgkA-Nko@nqsSj8j*t#kUsN#Sf)VY z3cZ15?*2>qyMw&^9}+1{oSY(apRYcH$=V{n)((*XMK%_PmIxqC7=*>d2BZOwaI*Zs zo+&Rssu|raD5ax=B^!BD#8@O+23%;MguzkVC1dK(1{MD=W&xn@KAn~Pn0g=jEt|1n zQDvaI$ujh8v;aPr zhwKmkVyX?WyQZ`QwReqYXZ0or#}~NmRdXBHT4b7v@ptumebq6l<`5EEoTqf+p*JjK zgX%Gu%%h51U=!%Qbxk_>Q@`pYBNHLYVg1)vo zBgo-tfUrvciwSgXIH-DR0050VH8?5Zk7k!r22w|*wY27lh)ndr=@OKxtm|8_F!YOL z6JqiTZoc>qzWge~YuL%;RoySJLFpm!Zzt+$SILVlnIdb;JuB~U?`5@dNG)>Ok_B>? zf1G-___Hl~CEo3dABpz68^BFu%?G;iFKWClk9CWQ=`wm;s`iWPdd{rAI0X)Z8V9So zIv;xcsNZ8J=ANEudJb)2+C~E7us;6V6&ImG>RvpQw|o1RfR>8yOIaxqIr-MS|4Hv- zdBEL^F~~Yy-8@TIvCDeLG!fPQW5+^PiOozNPjo%2%V}2cR3_MQ=ghx;?)UhqiLV`e zCH`d{*W)wviB@1<+_oQB*^tfNhpCZm0O@|8I?5%=F#`3!-YG-@IEGHh(;frntv$6X&k$WfY`@xQlNmX0L8ltrY)oIF|D`La&3UB@Vb$7 zjpt+e?#Ti2Tpprsi+-Qe2S6dy2c;TBpMqji^M|*jkw{BijAgJ^gcLw7%j~%wSKPuQ zM)Xi}c!*g5Ywz)QTo9BnNbC+OWm*>D;`Eb?K8GyPT7$>0wVLMt63Sj=im0 z{AIY(+$wkgI~n8nv9{!frZD5ax4^4>Q@}F*`VG(wO#-Nvl3Z+ouK1n8HBN4k-e>Gy zSLqtdvr9O=9<^eiI7G@{?oMYCEm8F036=6pn5|-iNGuKhECms|9R?gC6VIdj)(uMr z^O)KSkA(p+>m2V3Yx1W7K5L%L$8o4XReMwS*_eYUP;w_Q@{9zOzU##NQ#?AM1P4t9 z7OlkN+>@}%ag)H9cK{y6oGmbTRVx{Nn*EI|1>34R>@{Pt@F1AHk1*_pJ8_#jI!2S< z;Q^1a{t@#k zo#R|$-a&(%Pk0pf{kO+U?fuyj8#EHUbyMxV9VV5=Iveu(r2* z0R|c95|8Y{B`d@$6iemDmFf&}aq3g1x&Y2lz`0@89K9_!H-|W(1jn@A+p8z^b=|J9 zk<^ToWce#ME+H}Fr=fkFFJ<$@hJbk4}9ucJrgnk9{l`}4uH9iLa1 zS(QUZ?`F@wdhCP*S=rR1AEA%QK^#YmHWxm$y-R`vn(<|j>?6cp$eV{|U#}nnL(lZw z_A^c4Q0&9b6SGA9Faocy87mussR_nZHiH4%Ca*yua;aBh&r>cH z)s=wRL^%^vmXHrPHQ=7nW7P!_3BuAuzFjNZ85uI*Hhn8L135aPq3Ez$;xSm|Rn}Wi z{L2!<8SZS0O!;9(qc9pR^#s~5U}b(gweh_4(x#=~(mupg-9CQroebFQ0xlt>K^?R= zh=os3bisDEHx;&RumMw5z+cAmNbmIZMx&nnfUzgAgbMyN9Oh>HH`M)~iHx>L5-L+h zFr==uVA@ZHq+Sc22S&;eZ!&1sWtJO>*o3BFy}oGc^C><-3CH7?ZRMmcH9Hc66Bc}_ zSg&w}4%D)eN0%vhrWJ0v>*wY3`8C4)!uoJ$kl=%_5^Pt~I8)*l6OAwlT&efHlZa!L z8#&Yw7tt1k$@rsTW9OIOE05nrtCb|ce{N^zz&NBS(sq}7*~Vh(W!Q zMb8~!bdbPEu)hzsA)ePx0b_WFIH91v=I$M%LzL)zwoexdm=ywK<&A5{~l z6-Qv)^hTxd>LYzFrv;uQtv3HWdsWY=4KFg9yh&s z(fV*XF6h`Wr)SheftNfjuCSmKmePt*2vJzqP2cFM^{ShcH;Fq;gI*)7&`4} z^TBAKxntKYtPf{7FKF`R7M3gorLp#UPNkfXv>?bUL4+2rLz5Do9`<|o&rdzNVgT*_ z_^zkr>X5((Xjhb;y~uaojJvxIKqQ>ZW2FaC^vn?OuP+700rw&%ga^+Y!}!+tM_Vol zysm1YTl^T*)RO-dre0zC_YDmpRd=|52YLc4$A+R8wMK)(fP>M&tK5gEiMra(@FRC< z?eg^O$$@mU5$uA}Ts6~Ff++eZOcEMhf|r3X9aVYwlSA-ar7e9m)Jj#i(%N}U(91H! zPxcn`N@dEXLBQt}C6$d$os~eq)sfZLp>=Iix30duC&)Ntp10kxU%L2sJ%^<( zF8tu){MClo_Wz-n|6Z6hIrY9R$!n@ByhN=$S7jrv{4`Q0o|k8t6gSkzBOW;N0!JZ; z0?+?msYy~}LFUtxr+J7G6%wy}P#otOD1sY7MX6X53ma9jxG%eZQ}7A5T!Eqfm$^8c zZ1NKoMd>I^Md|1d${rSP*r?%hE%+d*s(2Xw$ek>7(g5T5{Xubqo79g$S_Vlv-+j{J zEWfXGDRvG;%cX61OUM)dByJUoxAuUQS_!XJh0vxGbM_MuD)s9aNDjjXF14GMCS5|) zx>)#{Mni!6;s+OUZ7%59}GdbJowWH`1m zZX(;pY(=v1K>Q-Gh`&<;;};yqc3Vw=571gU?X0|AM`<5V|zk?L7Z*t zVo+9zcJ?xfTwE+O$YnwwumYl;=kr|Ol*sc>^;*Zve4`YP&vXJVr*INT802Y|&>U;P z@HY2uRh3yQW%V>xKnY`?uPBg^tO$Exu$oel`fY7OX22D4}DF z#=z2Vbv92Q1@!RrQ-K1I`UnXv{o9oJJKvm!Yeq5uQ<{JI!dCw%Q2n3|>ppR!XZSx@ z%bHTNN!MZ#VrejrzxW+^L0%K|Mi?Ok2QC!O`Z5E~L7ZRIap3+|$~IcugZJQ{ z8{Fj`d>^uNmoPcKYNx3YDhrNdJUZ-;vIN+BT-$W)6IPnEAQO}a&(els?}T!#M(wN+a=%YH81ep=H8Nr$ z6zZLih2ltBB=0nNM>nIKTJ^oN^`~j84YyU8s>b&!grLjrIqMiLa&Zzt#_}sR;S(@sHsXT**6a?@CtAm zb6}7_KpX_e@TCe8^ogIBVF-Oq#!;4CKww0XEw|vrYiGq4CP>sNBtDMc{$Suxd(%@# zG%f2O+Wn~u5lb|ec#M~8W+n-RRks0PHpX+(5hcrn-LKRZ+MFydIydNX34bIhkop~o zU-ZK@G+Gpw2sHi4t3V*hV7#Fixdw$Z=6GmFJF0B7sU0$N7Ez*5bS&qDXyez&+ z04Fyy>)3U+fA#`0En0Qwn*J=U_N*JZ=8b)tXy84?vTp$GhO|Z=TR{D$mqM;fP6oY> zI)O@PO!6$Fk59V>;D0cl(-u9ig_f+SG@oESmy3~^4wqYcK?D%=&$sLedG>yrw;Z_*hg(;ijG&_e{GVIr4H!dIz+YpO@&jM`7Aa$U0Hth z=W}5qcNp(TS{!YgJ(-}6#yn{2h_}{Fis&oE^CXt8XqZ)47y=byJK=eb^qerx3M80n zeG_3FM`r%`C5d9?+a;Aw1UT98T9pMR?r&O$)-&@`Ygzs%i3$;fGlU%}iRyJpWxjZ^ zi#igMY%lbpWlw0`5q*6QH>p2K{pv*rG{`J7$@Ius8TM1wku!WPTb!n?70#%Te!`9# zzx4L)=;M+_A5ex+Ds$XT5}WC>Ra6ySN`y@?R1pa7NGFth6ovZ|b*Vxu8An89UY7UjLf4#tkab z!k!_J43f=96;;_}7ctcAel#*bKL*_J3XC&xr<4AC7LrxgO3P*Z^~*QDzyEU)o|0+| z-N?F4Ws9p9U?Ajn;gx!L=rk}GaU#xSit0T7H-?09db_(17 z@C|emh}$b=9ApJ!!9u&JlYv7FYKU0+De(M6iCR%yI6*=?A9J8qY_0z(> zu2){+uaddF5A!BHZbwB=2WgU5I!!8P1--n~@nEHeMHNH%8{zs8apcOtl8r?a+d3SV zZ>Mg0Kr3MD=;qFnq7v{c343B!G~=+i!|n<)(p=6*7!Fe7hMoZr_$_KYJ6f z#6{Th){q|a%7PnvIT0^sY7>C$FpV4-nV7s(w)z@tUCw$w*Q69LNWKP@bsK zjJUR-=s;RO0mOikVi!m|TxT^V)qn!x#^ew2g0dYvbsOEKr7B$#VGw^821{Lf)qvIC zKcB_Fp60YFoaL-aYMUYwZ9SOrDHBhm#g!DXAcjcEooTVT{2dVhuK|MT#XN>0{uv!U zv<#`Jo;iEREsFHTL_}5WA|fjJaf)ZnnydgwC1YLX*gJFvTR?&az$jS_b&cIX+4=b> zJ{BcEk`yzIvi_6nBGoSF?n2o_1tu2~G=|_b{?$ty(f{Qc(~7WuRkL7@=dzQuL-h~P&OPU*blP@QQ)0vqhW^zh?fqitelnJRX z5-+2oZo&BM0UahT%3$tk5M0tdMVumeHO~Uy%$mGO`7_7N89=4T^amksC%NwfHOhJD z-(6NzRn#>%OSEX3ef=7muk8I6gdf(^z_7b-Q21)WebdY4Qk(+`u+EE+DdbTTkgDX_ zUPe-Sy(zqmq11vgun=7-K{;rHJ6?r6ryGQ;C`;Gab|n!i4zGSy;PUv<8=Hyk-FW=u z=k24P3V(mrin}ww%MsliP`c{MmiBGG<4gk-6XX+5>nWZ+sUl2_1G?Y$I4e6nOqpOx zkR%JQ=C;}sRV*XV%li6S?H4NH*$QQ2kR;1!U>d>~&whmjeNg@tMZ1}M8e4_zITc%C z?~f{kJe^v)=05Ym3a9p50x3>QG*|@CL6%Njh$bk}LkMxx$?&D~qz}n%j}v_noFf}a zQq@qsI}0fh*9ze{P{|P7m6Rcho}&aw4Ej14rqvvONuZrdB=~Su5JJ!?ym-;b@L-0* zMzz-OH8nvlHSw-{$gus}sB9JiubetCWiJr17=PqL58x=FrAcE;?T~+4VxLWa6J~44 z?`q{fgYygMT1F8NU@WUtJx=~Vb(5xm_1PFoH zHTa~pNfahEgZ-!z{0f7I6P^s>VvNq}C={iA*i?nG)*X4LW-&4Z-SBZOZZevyZt8dY zZVF*Ob+fb15XxK^EQu{a2<0o~(HWD##blga#1rfdq#&8eIXFs_C59UPYR8Rk!+}AW zFZzb2=9L37l|dY8^eKd7ELF+} z7p`P#A-AK>+ufRAH>7l!1V-q1(0fw`XZHo;OpJL79|ZL+n99L{nPoliQTK^!^IIC@ zt(bZmT`Ll^sHr4h83t}5>?$FZL@XS>RM~eCWmP0vfxRM~>p-&r<9L1apW;Cb@rXv2 zSXUr~U68YHVc`sX6|tm1J2yLID;(%VU7%YDvi8mM2uY#85_VV??=BzXtrO=?<+7}1 z7Ze$5`MHf)%uH&XS(T~M@$Jw$twS=8043jC;`TUAt_yKCYBIb}#RT!PpDQPLLc>i} z4r>Hq2KVM;Xd{DY1V@S}i@Mcc6g#P0Tl0{WY;J7+L12g^07C>z`MKJA1`h!{IPqLm z`5S8+(L(K{e>nHu(M`xnHg`XO?5W=FNMqIGkzJTv8Mo)<`ntli6bdjyr#<6YDR|2V z?1F%tpy-(3X>PTpX)uH?`$76An!SofwVTI`*(6+U3Etg78Nsh65u`ynbG5W_k9gM% ziH?IUk7~EfGd~(Xs7fMcWW3|(RYTdjWweQjNpfv1rL#aP0IPY48FTRo_4o9kc&s^T zsLwlmjE>fHBptrH@0R{}d;*PfS}> zR7L~1iJ3^MgFp^llM*m!mi(O+1H_vItRe?iK^eJ|vj}3(V=HFyvI*<})b@&sX_RTK ze=6TZ8Tt^yv4o))U>21_9_$85CD=Li^BUW`x3+M=c>lNt2?av|w*;;7{*@Kxhnthl zyZwOgrQH2rS*Ynn;%Y>y{>1s z@f2wocd5h$j^D#XIQ2JoB3|46En0HT%Hpm(a><kX(At>a86EJapGjzX9PP5Ad(_iGxuyddH1-H0n}Ss z8X+Ku_p7y0yl~B|P|MQXZT01ep1Ln#vZ9yoy??NW0~f6`eJKtz^@D-=yn?A*Bg2!)rd^dLIg4ND%}^ltg+}pjbz44 z3qKrM{utARVgZHi@hZi+8yNCM33G!8tH4e@o_7GmieN|hpOxOgsdHWb#9k-k4@fNWa#}e*-c74%bfD@tublBf+!uj6a`^mllxMQ8}OQ8Vxxf*DU$W85|j zl6uS2O*sjK)Yc4=tBPxdsa1jtx5wimWz|(B6>V`YU#hAucG(_z0PcbM<$%lgkZFD6 zqF5TGpDOBMulcS!0@h>X3qDL|_@_kp_IZQCKSiBmBDU*6GROB(e(!edA_ehO3Tb%V z_uRH#k7a;PCOtQE_n!V4xGF;S>lhGajxe z<&dAYvo_DA=tO3*h-6<-(Z5An#b^T84)`Cw<9x~)4)754@Eg=7O#5pnx$n0H-iATF z$B%^YXGlk%_T>a$w~=XP&fv+?SnAkHG`y8$Sl<m?BI2>!$44C7uhyqK}-Y1x)P<%Bauc z8o}^v2{7U}8fa2q4Z z(tz!XeBI*K2E>n4xPBeMIBcWmP7x6Fatp-*-pGCPu=iuuw*BG)IYnD5Jtt#lfrSrv zs6e|4tZgU|Bpx@hKC;%Ku~Tg3&iiZe;r2w{&z+AEXvjujj9vWZVxxo8(6v>`ZRy(` zRa|kM5v8ST3NO^B z!1{@oSZEc_uL}=tZa);8OdK;4j2oHx`=>Y;|JLq$M8fPi0<~X*Fx8mx&xOY>Cpx-I z18$q>lSdyT0&Xepu4A83E-&kZZ-)5NGcq>x*1dz*UykY0(+IZ#HoGR^g%q$dLB!oQ zt=9tqRGQb^d^s>rUR&R6S0{{}^!+Vx?HwL+09J3aH&(p5K;a&Eu(}xqDN=}K-Sg-DM)(d1h`T;432+WD%8DY(>kz{g3@qQ15{#TF12MZm_<<&n^Vh*8(+ zncnsANZ?r9E41#;CwBjg>9s==%fZX50IV*b*nrgam);4rwDj$+=YE3p4AMb2gTL1Z zFFU!99M|620k_a+v_rY?{cy3u_XeU@iqP#2sNXlh`R|hAB_Ke&MYG4vAVqs_p~)fV z<=&|49{^+G?A(J;he5HEZke;sWaJe(Rr^V|@|~*a9e2PPV(!jlkXI6Mh5K{N_pg+y zb&EZhfEnJY8v!e`TIJkgSHQ&Qx5eHjs{M}6G*4%JdEYpH9_xX;5ZAW0BO(AKtum}m ziL`lG3;w`U%$~vO=at8jcz(XHd*P2x!9v-F84%U+K3yM(*eOL<*g@ zhaFmz)Xe(3dz5Jcu-+%eJqA}&Eyf*}XUiLrnl-CmH8nlJ)BV>ro>1lz7KTBx|7W%R zXTTfG_t_XFcxH5XCdJycbtI+ua~b86Xc-tT5$9^DFTaKiac2U>8Jw5E*WL*yOP4>5 z-CNdZm!hb*te`%s{95@3?+L@kIn|2b2|I^qPag~k5RIE{U~JG$^zMNC)opO7j(Bx+ zL{d=&dIdOW0*Vzi4*s-m6&wijZu~x{oVp}8r`ao!vQCm8k;Kb1yDv4@k6BI8NJ!jn zfI{WrGe{NGh8c3Sgf?^{LBikkd|7V$FGIMLK;n1W!h5Cad&?kt?IY{?D70?w2g+tj zCBOo3zrPMYG#T5sSD}EO=efhn*vkO!`aN&c`jxez-!;64-=p?IQvmqoF5sE(@upOC zKtuH@jzai}`Qk@H;f)$_eaCiwe`Em(q-tp&m8I}UtaQ%|xUPOS^1U04y;y%bgqnifyWWWL zi2@=lBqT94Xq#bCiaNB%;tD*TK$ zs>t-X2H-xgMiocfuck-apFo)GJR-vcqPNljAFKLu_9Z$OOpIweIw2!^^Jx#&7J#S-G_$_BXO^6Glw7kH0r?!=a9u2l`hZy zJJk>f%*bxruZXu)OkRV{dyBg`2HNg%?-{`2$9_P%Oh%F9$}zyMil=ZV z>qb-Ib6DczT&aH|9eDtNR5!;s82OVH3j02(-nxq zcLG+{vy=yiQgx+LhPe6fwjs74kj_ukpP)(FCy}VsoDUzcQF@1z7xYYeii~18?zL%eWL-OCv=j%l7JLaPQ&cy&ZkPc=KUNYAOL#0 zT^+s+IHP`7#SHgvs2K6IE7Q3}YSQ#(D@;*S;Vlq(y12~Hi+DOjoS$O@5ip>!_N%cI z0{E(@r;`Jhsqco*e-{|g#L8jg$rN=9`lMFJej2xqqcD~>rBDBL)_HPmD5rAZ%l_$w z2sUvLWAR4GxFVLq5t@G82Ia{M`gy|>ktBV;&+H=}ye%5e>rG69n=3MvRJSd_jO-q9LMiidn=NO19-+!KbI1Gxjc{l(aYm=P*5V6GKxyF~$4St+57C^Mdl!93!6f&W9)YqSo zMZfr0a0qJ6twn5fA_)0Cjc9Ps3y3im?ofLTDYilRgr9ic0{F%6sqFkHwSo{%R$;;z@EZNHR^l{_JE7%Fpa7}>EKbS113u%>Zo*B$8XBS4h z*f~D`&KtbB-$bYr6iYa{{8^u2m&A})`^T7VF?VpEIjCfj&SS!ks9~q&A9~q$BMIww5L3x?KHwx1a9@7 zFQ5B(C?C0_r2oaU@&LreD7=&X(}aJ;abY0?An1xK_j}YD89iKI4_obhcz6dyyKsVA zZa$!0jh&OWpRT_bq5LNWH;a#p!^Fa3(Qc}dY(8XfcH4(F$&3Hj&3&SM_>S?n8QNO` z4#%(W-X;BK*1U#_t7wzVW%59Cxj?*H`HGK&U9Mm8L0H{QRBX|`gZ?%TY?z8=SVVT%KTG>ydnAc|h>#y98S2;z(PG~jsSwHJbM z5Kwv5(b=0n7wFz+pbZY*3=Jspy`uUtxbQQpDWcOnNG00$a#< z2=^+qMf9f5gCngZ0|3c(nq#_C(?=uqAV-tV?fiiuyb>D_^H}Fq1ACTh zF}knw+7c@s$|Zzfh|5|47{7yrg?4FBxz#a622oHf!xAQ&602I+%xxgE`{P}KJ z@bWJ%2`TCJZ@*`VZR@rvv&8G8Cb(Lb`vzLeWv3VD4JLa3dY0F*r2OD)`_ucQmUA^$ zy)PS`fNFJjg4X-cYSqxz77P^QKvZ(nwa`OZHVN7TAn#9_j;iQ4$eZX|rmOI&{VLMD zu8}^HOU9X0So|O6r+bZ{9yoZh;5TFpV9X5T^p8u+gna>^u~5)ufzXqZ5VXQ?0dqg= z{XEP<;&UB_qyQRK42}zq|GI9nd5A?@2ZsgC z{xjXSiqXMU)PeA|`_3|wWoyzaby$_g#qwI%9p_Cf1Q#XI_ScB-UZ@^A6y>W8QQ%MW zJ5q%@NsbD_wQF(IA}gc0bG`f1r(B+?c=HU44!97hKUs!~ZOuV_)!q;r;Q5w5Z;=H! zjiSyZLiKBWOjO<_(BKppxdn}8VnN;XVVrHlxSz4lg$9?aKhSY0UZ%jc_(*y-+v zV?+|7f;sEvo~;?$J)0{Z0RTI~KLX8s3hR4^jV(Ug=0mpIrI+Nxhgf6h-?J#-0@Cs% z$y}H!Op-!`Kp!ie*X&xu9%@=00@pNC6NXh)eKd1-j|5Pr#ETw&6+*u@I(4>(0Xdmw z>!3=3Z1dqdC<*~+$Nx8Q`*@ty@0$zgcnd>NZ7_`vWCAM}ze(%bI&yHoZj!x~ zO-(mn(NwedQXDR-UaE_3P)$wHWJ#m*G7uJ^3xMXChfohQB>MZb(yXau2Xx_Av$-^B zf%-~jYd;wwOrM6_1F2kyz@GC=uUZtpyQjPq)urz9f_FZd#(=l}QQ^Q3G7#I&wmYU?@c^%*)^BdD@KWywqxLS`Y>zC}qERaHu=zfxw?QF&>!01Ey4oW`48soE7^Q%nL_8DA;+? z{qh7eX^5pXr1Zf+J_U8eLPk1m`DSEAq{U4*P#S3JawtehJMP-U|k$recuwuXpvLC}ju^$8|f25RhE` zr{DO`{RcE2_U}&$AFlErbD&EkZ#r*qD4(&4BRxN&L@Va`n7#2GA9hnRlI8W?jE0XU z?B=S1Ts;NX-+dO7d+%pkU|kVDaQnve{r4O9bw85X;NcS_+s?blD{|W>xhwrr{vFAh z?mVwAj7BPbgHLRl_=?mLY3Rc&A={yd$|00&=pSTW!ErK=2S12p%^K#bY;-lP|HWLQ zu$rfXU=@fW!?6Oj+-3LHk%9Qn)MGK(7_^g#o#5c6s4D7IV@^DGJ!<<`dYS`jN z(k>P|+{mqpp2ZMat@6-$6 z#0Vh`Lr#=B!N#K#UusBO6iuV8LPB_8GKMZwzFzSAA#|?wx2QW(k!}o13EA6I5Y;f7 zqrczmmmSg+2@xWu^0_*rsg0>J99mC?W5Q*VC0f6p|4!ncEZu%2*L&i(hHGR#|KVfAg>6hLY&p!WGe?zM}6 zhBM+aU(LhO*B9DoZx9!ynK?KJbTs99v`173{2A9wd@7?P(pVKsCqF$=ZOHbsI{rm} z*~1fa8iMRj5C3WW?>@J~=3F$$ajJgacbV%6ahZoO#Dh2CDrPqWaiOY=EBX&@T8+*Y z0Z?k96;spnF}yNz|?H%YRRU{`(Ng zZloa>y3$xN`~I3p-Uj@mm=FH(FCch-E2BZwQe7VlYcY;N`PfLH0FJ?AzE`rkkj$y{C{E0cx&G!;vp%E>~Ag@s^I#JE;H=H8LP)YqdcN zfPUR_nhaeJ?6zD+6_t*ceGKHA?LrKsX%kkp)Vv_cqZ>`t*MpZ z{+$<7hRS*CBNaFa73U@AOvOo4jB!aHx3ELhsl_^|Kzl_^lcpFO^~yM*XNG*7u#8k- zW#K1h+7B0*mXky4z(S@q!$=ITz`dI$ukpm8Z?T1R;PEz{ydVaVil0%@h!?r!HE?wE zeZi7(3m$@dsj%h0=8?b&LLRFn0wdnaZie6uKGI|sa^7~FvE~vjbM|@|$Q}{>2=o3r z>T>T@Ia8Qkhz#bp_<*59{*}lRPghb*(8#d0R}rrw>TtQuy2pdsgb~7!xZTrqzb9p# z&56od!cDU1M!ztdy?)!$l6XE+}ZucQ0OT*y3L9e{^zHVY( z#DE6!9+-_Bkg8`+sM6#z4H_bfwi>+iR>ds!rqS;W&4&pqCT=pPxgiDbQ@W}@bA ztk^!s9gqV=IROQD!LS0bPj0Hps1M8`vu?*O)|DOR-0zJ6>Ks7F6YAMI*e9I{sCl?s z+h@`U7{?s+p8+L9C=Yr2>&PgagyHQ5`zK7mn2`L)L%BS0e@yo#MeU~=&s@75_tw;c zXHrNA{SNFZ^jI61ZaTrhANcr2cLzp=%m3Ff)t~2M-=~LRi}5hfjrP}^{47yoa#XpR zkG_w5aJ)KSR*`{Cf%^Q&59ooDBHxXv-r0L&?%`#XT)`&7|A>h#DMwEJ*<<(TRu(()WYK?6= zhDop}OH7=2G|+_+DA*?)i_CEx*cUT+hgBcf@bJG&(ikF{310gTM3c*7-U8U&X{DJW z0P0u31P%-)$Yers9^o&2UOy6U0Ga68x+uz0RVLN32zg&h2~03JA6M+eL+1mf)F(d$ z_NE!sVz?bwc7h6Q@EnV&PdNWBpsFXNpd7Yoy*u*6&d1 z=M?u>ys6Is=Jn=o|2m4m*A!y$kK1EgXu{^B@ZZ&zG)5NxaT@5}9z^LNdTSL)#s5`@-hYWwqUp`P! zjU;*@i4g)i!$0zJNaNq4ZDR~E!3)xlJkoWGB+`Ma=r)uySnMx>1N9Xn zyq%8{!hPn55+Uw!-gTK?8e!f&hhni7@(0)idgk@^^q}8nSSi3!zp#j?N~*u_q^XRs9fQ!W9z9w4Iui-;%=nv-N| z=_&Y5-AzcvPC|8S9P+a+XR9meB{7&@VgEK9WL=XJuiUOa8mCC42`H<4xWbJ&Mu<{R37^s=@$xYcF`oD(FEYAZ z6c&w!f?X?|a2QRUN)#>V$Hf_g6a(^vE4WTw!dy9QmgD|l%hze9O?m`iTUQe-a5dYq zP@a}#Q}L3*q)wLZhQeZXW`p4~L%45yZK~0)fBbQ$Hf%xP;%-yM%oWQ=mJCKe&Rh$j zoQoe>TkOwFn=U4E3GntMuX$k3x|r7s&CFWy zmSMlYPN&AJBn5;-Swaaliz_b)5+fw~ww4{NDO=+co2B7BJxoBAQ_XU{g89ZW)@|*A zd5LezYbh%gL)UK;Q4=(@eMBT#KvMW0ToD~+3Tdfds3sV>j0Jpul17QJU~yCpvy8F}5iJqO{3&am6lbMR>p zuv+|wQiel(|7UIG+jmkp_#IQ99Gd2^8l++xDoaWnPN#q}ZyW$`nG zV;ZyKqvyY$_hBg6C=mQHkmY^uvWl!MYAF!i|M{RJnc!0MDqBLHjM|$~&-yV|!%fu4 zdznE=b+(C?@fY@ow}yblkIq85WHDmpcw)?tISL*1mNgUhh~jpv5TTf~HqKL~NHT;3-oxy;P)0E%Y-LkA?r zA_S?W0XbWM;Vv~jbHDABRm?)es#9KK{8NrI#lDJ_L}$o0e@QJi78mh*afSI3#-MfR z>u9ApT@`@g-x;D=uZwP>P=TQ*{7P&qx)KTipi5tx&E_mzA<_9_aL+zJLjRzaA7v|m z_n3n9UH@(yPA%7!pOfhZ0^U(|Z^M@zYcdc2OYOXK3&>mc3KGul8C7aiRp! z@)3jY7EDFH8auxQOY%S}UEGFbyqDuLv|3}O@4TRHt~P-T)Uko~*<`^)ox&EzkwhR) zmokY6T~3!1arFGtAPG&k2}zYEZY5Q7T*+VF`KMhAL84%O7p@H{g-%OVdpOGh%h4p*O5eHae$%078OI4WOKoyD}Th>q3`LcYDUhnLf4#4b2VC%f2To@TIUnXgk z&y;y3yVaTutF^Zvg!Ow;#*>he8`{(k_4LRZ9%I=*ZO~*D0S|kT$^h=nu_f9X?6UVt6L%mvM>O~dU{pAA_H`nX%P6PObV1D*hMXeI}zrEhBXw>@T{5rHn^|Bdg9{I43%ONDS)u^r)W}n)ibH z9LaqpLy=yY9?oHJaK&F|brHrU8ha8Vcj<~t#6trMrsGS1ZxkWDn3 z`%D6`Lb7Kww12Ysf*K;KUsuCu+eMhP4jBioyytTva5ay;)H}=aU`+PtM5H|*dC^lv&u(}zc>X)JYXA(fe@*6&) zsMk*vNs17?8S6y8AH|U5XmO6^iXq_vgnx-maJ5t}JmS2fN^y$21^kUlSy~2`bTYyz zwApTe<0CwTWtfalP`SYIamF#vAWzN6+5IcvC>(1&`Cw)BnVZ`(5@(SDn&g-Y?Ej(Y z%qHoD!XG|}*QzNjnHd3#gSKfVRkv5k-W!=JNh%vRoW8_X#GwA3oo!&@ zkp#F_-n>!!qOEP>>x)`SILrcHayx#nGb;xI-caH!e~M?p01!h^LZTVQbjsP%#@qm1 z%utRd1YY=4mO2_}o@VOex=rO-4UR@>bY^0nPVqBd+3$$f%cmF!^f@C zZH!RwZr`Y+tgO<^G;Nbn4>sQElhJG+*L>XY8iXR^c?9U|{_UWy6d9`@of?;1G{yec z-IQ$q2T4^RiR<+e)?DTNA#zzC$nX7;8*N7tpfI$2?`|_l6`=LF_SbXD+2jWOML~vs zvFqdQy8?Z{wE=d3RZcK05*+2W#A7T1vVaQ(w z;RQNUkiAIxRToUy;i(XO-Y{D+sSIKq?>ia#aabBZV`qJgm+__DmGhsz07x|2BjMHz z4X0TWOx4x>42r_L!jo)-8awA_B<(FC0xl(w^#X#~^hi>~0%)9Ro{NsffB>7OKhUoN z2@N$b&{Q>@v-Hr+%rj8RyE@mojgq(z>tq(szh{s&m-z_Uefnn%_ufojHEDnXw;Kl+ zSLgpvUM&eZM0l~cx7VsM^8b~;z=wy(wI+8~*AKkY9wJ5~{+$^=Gd^kFX8mO`8+!^zZ+!MWnA8l{|NR%Y-|D^wHIN~2m-;d z%USc$3f0mBo6O8(&Bi3Nir1}_Vd*d1Z=T%F_fJ*LO9AFkYYbp9J8C&3zVr-IYwiX6 zowO=K7DhV%H~MYm~!*0amJC-@SnLY zU%7rLIWdzMu^Cif{N(cy0oL7SNr~wxZ{^Fp&iN*1msc@zYojyTT;m}y;zS1OoOmK8 zqno|Jm%`-4TnD8c#nXw7w)E)+^!|&s{%eGD6lmv8K?IvktTH%b=L_N00&l)+T6H-} zR7})Gry(r2RJ1yKu6qvjn>uNvA-1w%6VaL78%zDc>2Ca$X{55ec-I6GR}Vqp`}$}8 z1LTy?HH_%gMS=PbwHrVTWUK~_|E-NKE%Tz%Y9n9F$e?}VaKR~^2-lx?HMS44*q`f0 zg-JygX8I}tAZxq4Iu04{mP{iA-5&FW*SbAhc|;Hvmnh_Dr4H|G4OKwQX60qD*9H&p zcLnJvWw&IdGDg+bW3pF7Nhoy}_(TTc7F{L`ltXz!fF1tlub z>$gi+^zzOh_i&K@rIDVab}l;}zcQG?K*;Oirt zeg4PqUXm3;`7e&Pjg=$AHX&Q@UPEJDJ$dXuFqc}R5+T?shiR-i*E=zJ?a#RxUpY>q z;OLbKKC4s}w9gh_b>x;LNs~6)%J6@ufaACmj3Zysl^)z?OuD~7tS>_1T$7?lV{!R6 zIg~c2GS>K+USX~6?>IU%a!Rjdcr^EE_Wdd$0Bjb^;O{>h;@>n{6xnEA2;OdbDO>6y z`1|WBGe2MSH(H3_EwKvt2X?Rjsv2tMzqG@eaw7foQqn0i9D+TRK9$ke8g^H8q|t06 zpE=9H@b5wh>$0A3ODLFIuRh7?^%NGhr$DoW7hd&8eJ`O4SjfT$a3ZGpt91A;FlBDg zl0$6JzW|*;E9WH&Y${4?gXM5O@wBbN%_u<5p%+_71c{y!z#|zaOu^l|z){OT{gDks zAQYz)B{RVDAw`39S6D^L2qwSpLt3TXPP-hm(<>*9aF!e0u$n_Nx1_YygIb%_OvF`@#_k<$dFU{+GLq$8eZufjdn!)Q3 z0en@-_i)x1KkxORB9M}*U#A;t6_i2y9RzxtHSCU|tGkP?SX=VPqK=DiPi4T65lI3) zPII5*u=*X-e@QC-Tco?(<03@k>GGHmAMIQ~xNv@;T*}@FdSsQ+T*ICsE@0!oNzm=1 z$Cd}dMX@pruaxVjXdUZrHzm>z$TB+{f{|1}ifmz%JweDi*Vp6*023r)2XFxV!6!ZT zc+zy9wKzkDEVLJi==RR6+{Q*m?@p7qRBYal$Ti+@*~^FBkpe=9r$j7P-ry^ zuC%+awoTi36kA9!E9r#Y_sy5Hpj5yXEum%38pp4FcTH-)`fyH<|JpwqFmk8*`{6@Q zt*d`))rT*)t6tw7$gPvbjV!z?1vuUSF*sl>%gG%dB7eQYcz^O^O4{X6E-RDPUCkoQ zaB`KgWsc0EX;wjf>dG*o>d2ftz`Nux7fujL0RoUBlQeXxOoR`u`e=7D$CC|kUo*f@ zhpSVTi>;3UI?KQ)Z-+7?4p2J&eyAUNBnL!v>q5uA0(O4)NPu5r%GOKpdg&X0Sd8&H zYRe1{XMgi1h0pha4p-P6jD@A(y{E9c))C+X#4uLB1LfQGl&{`j_3 z%_|2w;E+Ebi9L%ej?NH~7N17~LVp84S%6;Lhcq3Q&X|L)a4y^aE1UNJO~e`;9F}9c zY#5!G(VgdV;#`nJ0&ocg$PZWbZrUMPp;wuBec<1;oIO?1*mDWvVxcl?HEe+KP`h`T z;*>A21KPkUazbco=RC2MZ5$Ibi%IBwtLB}yQPgo5RpNv#SF$S6-}Kpg`H75XLxKk~ zWALU-%c@2NM8-~RGj4FDSQEX*hvLJ}Z!sxfxiY>*ofSzpVObt z@Kc=fDh}N6y4pv2lpeyGU@>SS1H>#&B%}Cz_6eT&00NOD(z$j)CGyHaoE~wa&z~(W zE4IpZ*#Z|^n#DN+SXb0}Ex!e%Y6RKzb+!crp2!zlAxTcll}G;B6l-@@7asV#S!ztB z-S;vrUlqOMi9p;kAgbinxSYXg;H*%SZ#3rRk{?u1B6Fs4-kuDDUB~|>5MeBmrAt^P zp2Z4tG?_;n6ZQEc6!?&$aMLnz3!`iIU5c}8n@!5rFi=zW)qB+GMLieeTnyCGuSf3Y z$X)M9p+Q>Rb8E$!(o6Hg_biFP4}3M@Rd70D+9vl2xrF`P-}sQs`w(&JE}tqMF#2t- z_sYQgQ$%sn*RYVfCdx~kGZ9sac*vF!0_n7Zy1?~OzIW`Jjsi(d5s8yvM6`jYY}H5q z+(3O_&FJ02|&PpQ@^Zz}tFW;nrE9TyKj>ZM~5u}+wC@_JsNPfZa3*@b|p zy71F~u#))`=4X{Lj~@Uv^V2Gj(To^|dyF)>qCT1HlewF6n7qC~bBw;jOu?w;6iJ9& z{!Rmu#@ubGlPefAQKdl5=zjDgH$E(#v5ezCL7V?NxBn`24fM6II|!|Xcwc9+UXh+EmcS<6Tv-$(td}u#iOG{GYet1b)KDW6a*FpX$P6;C;E)CzZhmqKWTHMS z3Zh?1L=fm(=0-9A#;<__!j=be@^T*-FqHVBw>q9$1)mdUd7X|v+{4UJn`{dVf}mEl z+(SPrtW6lfHI-r!4c?M1$@4{Dcv4%$aL!DfwWe%B zpV}UWuUv~igNO?L>}MN$N7nRO#KC49@m=#}&D_ZFq21nXL2P-9V8ZpK09{!9gtFb+vt_DdBd@oD75I7?z5EvPdu$R94M;QZ-$JyA^e0J!z%H!bezB*+$ad(2U zU=+;58z!LaurWQF^~bq+9?hpij@c!Uyh|AOVc6&H z%yo}bsPopPTLZ&3n?g3&799xt;vt{!pLa?z=h9koHr87`mG7Q+5vzU8_h=LUb@n|a z0u2KtAle8Xvzt;EHuN;$WUxm?3m`+-L(>c&)`tqykSuAdA1*!FLGbdOOUf`Ms9`_2 zPp=zZMRLk z)c!`usmt^Z=4B%8bJ|x1623JEVdM;R2*Y!l{qnkdHj$7yrpNkJFqo1#iijPEAR;^| zhmjc~kfP+!k|g4TzoP7O0u&hm^IIDagKgUQ&K1r}nAGmc-vIK1H9)-e5koha6Xgt_ zV(sgnN)m8jN8%~2uJZ{Eb2`?IQ?MugW=PxzDPh!kFw~iAEhPL@oM1F=iP2<^kr~(^ zUg#kbig!|MESVOD0nfhHLmIO{OERm zt#|(hxFgCD?e8x5q-B_SZL`oQ8p443XZB_XhzQt8$31t`y93;$EG?_00I2xkVTH{L zl;U(dt#>P>3oOpdTO2dG!>*<*Yrkk|nOS&*Pzs+5+W9R$G8K5N1$f=u@wD~YJzvRy zw#Y{Ozo;(ks))D(mSGH!P~#k4_h-z&dgN?_el#zamSc0go9Hd}H*~ioqT^T=cEz2; z!z!cO7R;UU%cw0OiEUBA@+-h>@@CM)ovFQ6LS9@xf75Y&<2B%c2${9z5D^((r@bF+ z=Hm=K_B)ng%JW!zY6k59qVIJ^5f79Cp`%6^&Uk3Z_Uq_&&%i~y_SZe>TZ#Yt(f?hD z10S?yme>M7#Dcu9lh5K_fkJFp!H06DM%dE3Kl_8i{c`K0#zKx2aWfpm#=^#56bO)w zKWTt${Fz7CFqDkl{;UU|2anp4u-p=mf=#yc5Ap|lX7S*Dc*Yz6@BuB2-TeKJgzdJV zcS@>k!UK_*UIv$*N>5HvffW3LdlXqeam~+;S%O5Rh`@@H3G7?>xa0 zl}d*QTgNeq^z3vlw_AdMT!JnK;2A}KOYecd7bm+b#R%U0D)M+GV{3+Mu<^AW?ea;@H#uJ@ z@8`&Uwb#Sk8P}AEU7iLIF~YKXx+T~+9aw&4{zPAy<_Hg`C!8VxRKYu>)I%WPt_6Ka z*YZ$c-lYhefBjBEw`Z1o6n{`=Qu>Q-4^q8Oi@mYA1Z|r0_qdF{Zw=l(UJWSs)}m9M z)q~Ey!3BlJwhaR|2_B(CD4Kk7!r8dTR*}@%-*m?!dIh7cs;O>;R~IZLi30WI#4#^$z%P!oouUTIeR_`E0eSqM_&EKtFXrtfS%+^T7f~eDpAG zmTz%EzloG)*C$CWMuDHTyYg))b+{?>6Jo`9}H(dYCUFE%HsbMa!%yF+Wk+I zZM5ngczgQ=(D5>fxZm|>2)M=73%gT#T`LCG3ALgMZC#rB!+EiZkZJk;q|Fwt?VJcE z%~7JfQtvYVXy0hb+i2)j^AeMq91y+Su0D%Ar&`uZ3&WsgiGXFPn^JW^0eD3X_}#?# zS(xN&Yy{jNiv!KP&o;i`7=VvHMlI$8Fv8DI&-bv0nCDHuv8|CMTcP;>d0>riQafM1 z{vOyFs5Ao5bJ^=WVlRdw56Oe2xK-@k$x_&PG)izDCCq~pY zh=h9+CDy$Tah&{YV(=Ssd+xApAmtqTZ01O)K2=(vBlOX^)@y8c3G8`>_{!1tS}wJU zQR+ppd9=S<<`vc8xBLu1dzr~O@r}p=9z7`Y7VJ5h$Q*><8Z;0V8e8s=COFpZLiUy+ z4B!5~&7hFkHTn-Cjgiry_0LPoDAT;&n;W(e@n`^FQ=Iq>*qk3(&L}Gre@}Z0Q-0dz zAmeMH1fduK8vY592c6K+(3@_N2TmIicQw`&Vv1iU0@+WzlQ!+~MQcJFpQaP_edlr`4KxiKMz`e?3Zf zdzmN2+h~2Sa!Ae=u7cjlQl7O&x_ZOycOlc>--&c?{db>R;~lcH;3*O?hW!_YN#U_2 z(6SxS{K9=Rio-n%b8vO;=jq0`@=0?}v~=G8+noKUOY8(fIiVrixIy9>vwUgxAu7kcZMOkCe@TX74FnlpGkiSp1uuv-j)X-|5oR zt`+JW3n!h|ZRdXiaC8n^7;eA#>C##3m;Qb{C|vpg30nNKc3k|A)C41gZaB}Kv8M6w z%qa@<&sL^-_mtyWEPN72!9F6<60OeQPcgTSsug1o5KBqfU_cyPe`jeA6Ao3oV zb$jrN1K++xImv|%+?J%Z44TKbeC;giZ$1uP(Qz>0PznQtf772(Q%A!<;D3pKeQG$5 z*18#W%i7vjk3N6GZAl+eN&OdSFlp-rjM*HfAZUDUSBN6FfGOtTL_!cqu)3X-5ebIN zityGt;Y9&d%`{{Uzm)gqLy!{zweO znwD~n317e3B-nJfiJ6}M44BL&r~zIrqu#*z!8v%LYLXq;g!Kbz9_?8+-3jbz`j@!* zk!?-RzYGef%$d8fQVe*NExCQ)0&bM(O~=y>lcV-yrIp*!`uH)Jxfex@(3Q?n+r8_* zYz(mX`Y;fi%FfQ-c4+p$Ddi;ZYzI0BC6%&k5R&kI44)>tmOi3|zmiIij?o$C5v|5p zeiV*DTS3hOvAgg?+EneD0S0`l6!6!t6LcHJ-y-{2XOL%tgi-$%Zk9n3(FaLByi+QV zLstsHaWUX1QzNw-UHc1o8OTH&lIxfJ;G&!L-QRKpyH!3y?MN1eV%>6gvJRX(NnHN@o&yij}JUL#KpD5xXp*W0g!mGN{i`O)`YKprV}(z;{qV%!W| z7onh~!{)7S12QgUwD4?)^df4>OqzZFPlMX|Lt|@qs*v|6OelXB#?NwQJ|vzS!Y($< z6xCII@o{CSHd>*cRDW=Al%{szN>8jxs`iiioR{f&j1Z(U33OfPTu&7qnfOJ^q*#<@Kr@t0V^=$Bne%2BG!uQhbPY}WoW_onLazcp3vRiKg1z7PXXD`L1^ccEdEYN8pZ4ulFL`h2@1M85MW?6*?0Yd>hni5PJLJl(G2r%}6;zt_G4jny!Z z+2++z#;50lN3$B8*`(F*rAV_RkO&1S%HMMgT2WZd_*eYD*kr>&RyI}Z*Jm4z?K zj+-tS_)9?;ujpiBsl)<--v;=Q!_$Hzq{kf=EpXh7%#bb}Ch(nyy-3fYBK5R&1b?~F zhu^}GfU|bAa`3cB^bJU1JO!UKac%e4+BCiU2CrBz)_2LSD`<*5zruL->k@&JNwO9} z+}|)+nWWQGYC!br;c=K>wkrE(K2bm4+{t?0r14j=Kt)3t32WMtv+#Q+6Z(*v+w#Pu zEhwUbI5$0C!&X-6-3A^zSCrpE1KTyx!6qHCY&?CJK{l=LB6WGR_k0cQJK);OPjV4Qy>^aM^ z1Z!Kt^vmsZSo)u#4Z0m(g0U;-GPzQx42rZBCeOCi(`nDlf?BSc8RKdc%d)k2);5fe zD!Ru4ag{G~t9r)P&i>-UL?c3+pJ>t{{ocm|_9BZ#eZUyu-Me?^Lv6I5m|+8mH~e`m zx-Uoh1XbA%VVajeKkXZhWns-%nPjwjUFRikELfH0lz-B9b`EAKYar}*XgqFPRVh_# zyidUeXeJHMPhkQp=e35mzHvp_zF90~Es5#2o&xIH4j_4pw#P%t)3tKS^Im@ZAG-1(@R?(t{6+c5>UWS;a`ZtG9f*CsFMa_1c{gqhNZlH z3-;JphczD=cVdwEuk%M61(hN6q3E@>4}va+1jg;r74N=f3NY|GyQigGQy99~2%)?7 z*vD6qzF#2IbY_|*4DuLM=`>`so3K~3YMc1+#}dLZW5xlk0nHlx)K93TpANOSE#iv2 zoF7Tix%$H;`=t=m%3?Wuf)iRZFc)7CQK&r|c{QK^zEdOnkNB6$Ye^&pagbGI!^-B- z5ks33NR0g@cqCLJ-~TCcBCeuW@4Wie)>L54dyP^oHOs)z53{B=8l{<#r_I`tf5&H< z(%x}%3>{*YO(}S2HTgwm$|^MvhBZpHipsM6VcYU`R0vBI_Rf^HFb>g6Ambr1{=pXxjzBdXXXh4-f+KJzEQbGgUDZsNWeF6w~|Eamfr< z+k%!n;R4??mb#*Nbcb87pF-tp>xw0xP1hNZ?(QN+Mn{3c7w+j5ynLsd(i7awI`^*+ zVDD|C0rc5pzB`*_g3iIm-Y{1Rp94AJ%i+x>ZuJHBgkk}qFco3lRU@Fc$mkX zN7*KySyE~nQAqLYON|;nWv$%m!CpTqQ4Tltw`9KEnYJ<)?{aU+1hgU}2!F8)v>380 zQ~hp4swksy_6OyYAn9%+G`*l$PQ-uPG1a>aHwBvrr%UpMG-l@UKWq&UR@0gL3My+^ z+a&W_Qr;;vYliuT=lj?vNonEG&^r*}`N+t-ikgO@$w}tL!oDCie++RlK7I-IY@_?= z@G0HBDzEEXG6DWSs>(uPv9D%7D?%W#e@wq<>hApb#tLx7vWl`ivvgp`YvjibtSwhv z=W<1VZhy(dD4ox+tah1++_P8BW0$v_G5bBvu9|w7gjB|L{>cyK30W07L%tP{CS8WB z2)wqkGGT4D#+}xT0;-etJhk7|M*ZAR2g>a|)9QMowX-cri+{?PD%kC-6MXKAe^KgT@o{n5l6NbYD{Ki~%{|Og*L0E(6${dx zo?Gy(X+YbSKSh3&QM_Gy_z7C>K+?IQLzozI-er`pRfFKc&IZQ z@5ZaEaY~#&Y#W%@Y}QaJ%+6RR&4Cnq`kZ~rs4@NQI9$}Pve@hLPo9=IsxkCuE78BX z6p4jcJt|yb!Xxjb_0G$!1}g=h-XH*|-~=)e9zHzr(JV&!B~04VVwCrnRLq03!ka}xk8~I2Q>oo0NmDN3r4nK9O(dWfvR0CN_O#ZQpGYsJ~xEnWM zcz`|4fUK9&N}AQ~`&4mH=(#*Gv)W{T*`lm6WyI@wq;*tgV(?;T)FEF9g#NZ1|= zC}F0Y!(Yeapd-g!GC`U>JZiIv3nd(2I9{5wKPI_+hik0?e{7!C@}Z)#7v@$TpDQZb z@!{*kUt9*{(O7TKTL{=UPW>;J22Q{4a54wwfHhVDyRC2r>pDM%1X9Dz(-Q~XhF={T8T3Su=+vn`>Q$j*sk$O@w z^BCn^VP1X(u4MDkv_*j8lQMO6#jj>ct*k#l8eC5|w{C_S-+|F`O}kogfcOKU)-x}z zUscKN?GO%`Mf`5?QwxDm?GG3Ot{)`X8jQ@e0;+R8KO((Nm07zt5)8v)qxDPVnNn9) zL%CnZ3?KIzKPteycDi#oLNK{n?Fj!NL>8u|vG4`v>zi50-ptp%4u%O3KU!TF@@rSq z|8EdZi3urS89KBky>_I;{H9he|E6cxq_%0Vfkl@NT@mgo9Mf6!>^LB-bPwgvFBDmq zr{AtaIA;GEq~Jt`&4}F5PBGQ(V#>f)Ft+E1-=i+#=DGmRS$nI3*kiP{`LzYY45fXf zk9%JK7=4gcfiiaB5n!8n<#SuPts3KG2;(m2sCXtTx6QXjTQ4xIa>m3P7mp}*VHLV# z6QvL@V#%>8EfEunQvL;Kk~3qoAO)HwGX*+(#U;8?@j%XsL|?}&A=wj|pl>sXSn!in zo7YBwrVf+dY6jZi0N-3?fq?fDT<(sev#_*LMLlFWlFnQkswUL#>;s~|M2Byk} z{1BHDYd_wkzzD4x9eVLB=_hE&8XF(7`v=C?L1rzE(rGdY4Z|}B(-XE?m z$)+A7i&6QEYQFHoPT(o_yua}t6P|JY7v#KTzC{ZfEosHh@Xb#P;}#@v`jNy zgv*qI99z16>B$W4>lorpR@F3@i{X>M9is*x8ICNV)rK*#nJV=kpH&Oq&BlqOW02@jtpRNlcyPL}_O7YN&OuyTl&ThVB(ed74{5h1P zwB$$sIuza}V9>yv>oYXWc^0oSdijp882dS7S=aFQ|s&Z zy)$`5-~rw^Au(jq-f#KT65>~OspK;C_|h?z4EFWwviy;|6%vO^Ko{hX!Hu8Odv>Y6 zJA%m4djHL4c-+E~q1-K>eYi@sVq%C<>=yYBx6+=Fle3%zao^Eh!{Sv%!`&9c*$rPM z?rO#E1t@n`Ni063>R^-i;eciY$~f9EULPFg!@mB=^!@0$wZLOff=h-;EOH(eB38WTN0eqn}NkfB)uxkMuxX3Lh`2j&cFdGFA2MaUlx&=V`E! zLcjoSQ@k|pvyY9bQ%27;lDa}JZUdhG%3N|$dzNu#eHtTPiqimv^h7hBtcOumbB=$h zDDdE!BvchV;cU}JRl04<`89rkf&U5dWe-Co+4CDS`klz#GC73ab&^^+2rO4v7fU4R zS@AvkC&yh|PEQO5sn>m4>*0X$Ch4%Z)$tmG>$^Y_h9_|3`p zCS-T)fJ6;hIx_TUvop5TVy39;OnHX^HU1p2p=db_BohH!`L?l@ph42^krk2+1bsTF zcvip~kAPEjsJQ<3yFLfA%mHcMpdx8p|Fr-{^eS7f?y&Va*;gQj8CflR;iu~i3JKJd zrJF$iLyZ_;ak0?$C^SXSmBpMtMeiq-XwZV-9L*%*WZA$iD(tOgZmi;a{j-vHYAUS; zqx_w*0UvD9oxw{>>8})9*s=qo8^&ce+>m(ObkAz=bg>yg5G0b~?*WUx2njl{uum@j zEScz5kRvws=Lj==nOm@F)9W6~6eiV%w<*AUp6x?yO_K-X{xQweM|(wR{~AR$14b4@ zwM`!?D2dClD&n7)llwM?8}F^u{Mo^m7U;9>ujbGS!&^<7sUPTRr|UD2OcFKZ&pJc$ zU;ZDF(?2<~_JWv0kzmibx0*CACx2fZ3JnYVIMH8mEqQw9*a)aujn=%z8Cj{RXvGcE znUucdB>GzEV)$EC86~P=YqqR`3z(oN6T7Bl>M)Q|ToPl+Oid%cTItLb75*`s1M)m- z@7QxuPyl(d93w57YHDK>mYb`+xtSpBuq+(-`V-JXZ?E_FN?yU3cXWM5)99D`7j~{z zlv@{Vbvb>Fw5bil(&?LX#%vU)dX5j-uYNm^2Ifp!yY2t(Neks(2c8-dshe@`y88>U zKC;u7=nJ)PF*%Dl2TcKMuAQJbE!-i4cI+u3{;KFh4=8+tF`>6tfd$mqT22b#NpTf< zr%iS9vl#y8d0P533513%pS}{Ofzds2!Eb7KsW!sTc|rUCpep~}GtL8m!?A%C9-ELj zF%W*h6OlgsUQ+1O_WemA;}zxMDF{8>iGG@78AGetbExzkjnc~yK&PZf`tGUc6F%bS z)%2GkOi8iVk^^6D^{Fv%=m1F{G|$ycTog1GK4}*1Iz9uribJy~)MMw1nHyUnd{9K; zR;0J42Pb)3Zy*LzKrh5w0t>OER<@*=JL>Ou(K&Lkj~HW7IU-6rE}rx|$W&?s)&v`q zPO^o{Dnnud&{Pn_wmh0&#+`X&HnQpXSYX^4g|Ax{`slG`y&Ly+XQ*HTNm;8_Gkf1N zo6M?B99;^6*Km>eil6~pgAPVwRt}u$hJvd`J3h5e?O49(hNAKuXeOk%(OFV>?O)1Lh_3^!(81xF~j}Eks6a2h@(&l3Lz)pZEH2!Z# zf*kYxH-K5ct2s;d=lII|O!;(~@$)*ge=pu%`E2e|9% zW1bRr>$PE*4q8pvuF0M#Md_lN=v=$btgV34PW6c+>OOwsgG~fY`kv%A$$OIw?w@J; zhK82rxkFRy@%M1F$900H8bl@ zB0$zw>kzPHgfbQ{yysb5uH#X<4*z3~$0}1#FgjALq>7`oec$o;weXlzy~L z{T`3CL_pRxA;=i|9G$9J@V)+rLW}YMMQPpy3)}wpM*-g^8O)w}OjB}8v*;CcLbRP- zFiOQ0*3^4vhCKDk zjxP`)CtS6>!Cs1J+Jp7VcsmPCemUOyXkV1|Z+WpR z(uBVG6mh&2F>k{X`ZAODo%S{Ss-s@4KWkdSbvzPV4Z94|x5b`O&~J~tYR6VHqOZ;7 zc(a}CJs$b7(kg9Xh;DvtN**+98!eB>g&paGGE3LXZ7xz{YArau9 zc5&961e4<;BcBE^rI4sU4iYDliCc5!>=}N!f9uYo*xsv~l)KdPVeoUzc^}CvFosMM z(q~YQzJ1C6kF1su)C2w_3oK&fL%-Io4LpW9*tP_!WxE=nAMt{|Z4;I7Q&yQ=y1Ck) z{d1e*S9%9~97~v^2qHfNrMjo1iX7DIZCOL&U0vA5c-yjeJuKs z5jPX-L}5cfZH%TuRGk>QAP2M5wFyvFh8&MH$l8wTERH;Mo(b_0eZDL*tDdMEM(#?y zV)d$>M*7^kJukwBUud?J$XnUi7CHKvSV_rMemi}cGix-mwh(@$c7PnA8@_6zWvOlC zCQK_M-S2b%(9+}?@zef~G^m~05%I>vn@zAKD3YMkVNs{$HS}Cr3kIUkqRsoxtWL}e zP5gp4E;2v1ezv?2^nG|dgoy&m?NS$9v$mk3eRj2-B^cNJrYoPT#k#4Rkd$g@ z2Hf}~sRn&pmHFWjRTS4g5vN`PiqcFxWBUF@V~ag5H%-H?G)LKn)e9T9OgRu%rkjlK z-4MuwT=TyFMDKd74KN;6UDS^z_jrL0;A;kQ@J=PYk#;}$GQPTVXE^OsOOfg>z zn=bLUXnX#{@vEl<@zRQib!U=kzMB{$QuboTkMmoA+;O!F{J2rpqQqu?Hu`w$H}i@a zhp4&(UOf4e^AfC6UlWeS`2YAMhxpYLRn_aplune2Z`JqD|ESv%!!DB5lOiPO6(6pi zFrs8K%GO!Y1$<8S3qJy;!Mc3+42&3w;Tl@@E%P+n&FDFh2X4G3PV)YsCBS7Wu0QGvdr{61Ys z)yJhAQ-o0yY)!ju(`}=Tr9|`Lm9K_~4cU*Ej$K?0zX~A)Ns3DxgOy_QLDyPiV*#}h z9jXF+UoW5P!)qke+NlrBR(9N=k+&9Anq(WZOO*VMDEV2KD|2#S5L zB3Pm+`&on6Abfmkoe=f@S@XDAi?e~V;un#bQm zqu;T01E6jo+9#IWrSmQO)Zr)y&=GH!5Ivt&ThLRqes1tV;r>bDmk+OlXmMFZe0_q` zAMX-?Xw~DG^xxg^qgK)dq==Ub!u#kRA0TaMHA{4^A1?hm0JS;o!|^SUb?tB)c?7ub z&(0^gkForY=`gWwphnOQ0JIVSbi44f-d9Thj|2s-VrPOaGt&X76j4wHA8n#uElHj} zgRr#3LJ$0B7++ZZL4qd_&b`WgueyUE`t`8=|+p% zz-ea`?-VN6Iel)+|Z55zBD+`t};YN&JVe-d;T>giy%_O!#tzZ?J%wRrQ@An zP{c8`oCX*0I{E__NGX$0d!QZ$C++z_vFYaLY}}zhH~Y`P5^z74?_{g{6!)_3gTUD* zzMF9w5RN}kD)2Kf_wTtwsb}s`!~t;*WNV#$RcY-m)j-5y znVkO`kj1-v_kTd`Zb97<`c)-N_A)nz8_nQ5B9J{#c3$=iX|)kF@^bm+8?b68iSkG+0tZT_7wkCp39HoCfv&04LJ>8o}^-;N)zCb8)}PP%o4-RuyL zC&u>}kLf_{^zvn^U+`tiR^I1QxK>PA=j8vpEdPB0oe8(rx#5o~VO9kAEt8n=@HoJN@(@Hoo03PV!no=wnvQMr|hrXX`?O^if z{b)RgtS|toLS|&WNo|U>|&Z6U}^(IFHI`;qg9l4BbeaHpPh{5qem5E`5Mn> zZMXy!v<9Ghf1s}g6soEZTMm&nc;tQ7X{pccXssHUDyIKf;hK%#3M8k#x-mQ-%Ab_c z8XcWUkRxqfJr06w{^DmL9|&Ben|0a0 zqDH&#j&M#Rn4$__E-rIZ%(X+Rh4Ty5c6F@cavw=_0sB8Drq?z=PPEU>JuBT?^|D;H zE&=Wy^P4VItr(!?YpZRrBN@BpK5R2{mBnI4t!P612&+5HqO@3~`YBl+BWv!}bTc8q zB5{=h9Oc8plF!%ML%(l}WQa4b>Y2NPr3VT8{Pv537}zbc7B#^5es>l~k9GVzo$!wW z0#xxbf9?-?c>f;1YTZJky&j|RCipKp)}D-`z|P-P=~b6sabG~MOJL-JU{(IleN%=3 z+%q=(?J2`pzHb_@W?56$%mOs?KSd}y9JvfTvYEX%2#~~y!)$8EDG&iTlygh9#>O>U zsw2_M7%f}ZVLaz@J^w|^YmsT&@WauM*_O!_4B84+I$G3*PIVsQ!}^AfF2AZbw3I)n zkRMcuAlFxIv?MA&jmaywcQgQ4)_E=i78&LKujtGfjpAt-2djp%mZA#gso+l}>+dD;BzM|YX{$)H;!UzMp`@v~)B5o_r$n4s=9jd{ zYznid!z-CmOGVU!IPP*{CqVj}BK8{P-Z{>U!v+t8{eDH z^!1?xnMM#ZgM_{80Je)SCMH`ie)?~N5GscXpMb!NY6Dm5uhY}6ATr%wkGq7 z2vyZFDhNpRqFq@{%k|TB^}Njh(bM&z+bM`zrOOoychfPh0W$1t@#s&)Uc+y{NBiql zGD*_)&B-K^R_}A1f0TfI{W-mkj?VS4y`Mt!;c5S`N3VqSVtBgV0X%F|(n7Zgxtb>0eEZyo zOZ7CYkAnBlmh}FzGu@ZjTn_QIA^UgCH8}5vOKp)gN~-^vE*)-j zrUq;%dL1dKw?FvUvBWQHD96APD5QcEe}Te-RoH4yJay{rf@v0*g?X#~)nfohbLaxT zMuJ;Esl4_J)mRV-=NHz?Dl2Qtj+E#fut|D=oVez3$%vW3$+@ivN?rUO2XoPrV&C9} zV!iM{pVfvr?R3`-Yybk6wRSApmE45Oz}bhRHQL7T_IBUH#-rM%(}5!3>i@^|H~#rc zKs~#0I(Xr*Wq5gd+!Q_PahV_Zp*XWi(zY(TV>#yD@E4 zOuW-7DrxF#Z#NN>5)VUT=m+|O0*2DDg;jy}RgK~w@F4Nn^QVTA1PjUtv_TEW)k`ad zm}dd9^Y4rg40x8(r~3pAL*uZbjw^SM2f_yE&2o5);o(!Hovfm-fy}e{hi^ zY5r%yT40!3eQ6@KqT|va!B%+AoMfV@SMJD^2?Fg5|6@JRs8jcQaodyME~#&gG{IYH zI6nozp`>!WuacJTj>1^?EDMG{WH>L%Enwd|zk~gQU7Mr?#8^$ZOeIh>WNsmSGcTxzpNqgIVek4`7(M zX`v88vuIjGQeyOK+r)q}7LqT)8#iq3K%Kt@6umO_d}SqZ8cNYyo<{2>2U4-javrPG zzPbu_AUTotOC1lok&fNwWKBC)Qo0%kO3eaD#&YZ9?N^bNdjV%xSNT$My!dgaY=C$a zOelH9Lrk0vz`nu3nAhvfl6`BDQl0KC-eO2|UNE>Vq4nGvK!+pNPCG)qJ&)VJ{%U~( z1w!8&4_nfcKQ{k$sq&rxNJ84j{e+xJR>}K*LPt}J2r<9wml1nFq0m)lPMM}h=y6W$!#jHTJX!fU-zwjK_3 zj*50zaY)z+3RCLxdlDj$N`#6)ZTJzW^KIt(Ti#K}$&-33)$SM_`4`I894cShdEsnd zsL80yFwzOG+@4F%gQ%fSbruRB72GrlqqWKs3g5=Ej$8x&p;AF|t~o$5Rr)K9E`bPm zBea}J&^$w5hvN6#a8O3{L~FpU&;#l#RV49yeY(8Oa>a8b7v=AFo!8Ivhz{I{&#A^IZBWr8+!5 zMI&b{p8>0tlbUa@UW8cXzCzA7567LlHYxax6;{y;8uC4QBS45Rb2$V9 z_{0jsm2-*qlk!suLC5Rk8v#uB&!h=`($6V3cTB#X*iN&(3e4sxV=Y}|n`g@Pd3sI; zs0KNmXKh?9w&EQqo0-GaF}r0Wg4aIYG_;te!32lTLoh&~c&L%lhue#jjKbC706V7P z5MsQh6bV2+lv$PtNUnb@t~;|Nun%!_@Pp^xR$OiVlor#{D}*-{D6s~O;XeC)lV(6p z`6A2S47I?}?QO)#+lO_$rv&&wT5fy#!%hNA-1l?Rv%8a7snPQgD97L`aO+ymmeN?| zMop~R8sAdK{RLjsh%-ySi;c-Y@n89X<#N0?-J%4xS;)@4vE{xv+Flf4 zs?>kRy}uE7)ELB^=9{*3|6nb7)9&6n63hHQhTi4yU}rJj4UFqJNL^{5juA#M+_SxB zhPJ?01IkLafhZ(kEqN(D>l03^s-v61=2v41Sr+Az z{Tv0_9Q(@!whr18HhRnF-*!mO10Sq4$8rW^QN2cpw>)`X?{0u-GAY;-elHLPcYlf= z3}%JR9w>o0!8jr2uUXkeDhfT_FiX<|rW;Hx3^QuTs0q!U#G7X)n`tU0ySZ@>btt~T zT<8f!m(>UCCr@=*^YV~Ul^oID8{OTdEF}X|Q|?=ul+$iBsHP{HzjsW+^puwm?l-Ff!{kaTNA}O3mO_99 zcU*`^x;{^@paBd!qF@c*YtTc5E3ZcHs>Y0=LaN^HKczff`areIEt#@P+m zmHsJ>(C_Zmx}8i(rX%HFX{j7@*BsWuz|4{X6Cdx!W7OkPDyAwss)B{#_jg~92z?9$ z9x^_ewq0WBvr^CUauUi}(vs%)ha4|LLA))C-y(NSihQ*{ENA;51kW`og*LOjegsj) z1nnylKmR2n!`F4ivWVnk%IFt3J^K{PXny;>m5J6IR>fV5e`i8PI~@@j#UzxWq=@$` zgsDS~@S}7L%Ama4PyMH9C3^_zj~TR}F)uY2pPxX?T&P28SQ%M7Jk#}3pkMnrR1Xx- zD6Z*d#0~4kA?~2D#*Ha!?#t3Ii&4o3R89aubYi-d;lXCkFDOdh*a9ncTHk(38SX?1 zEF&~!Qlu<@Nq@exVRkKnFQ}?TRFszw-F4u48;cChaK3tq|2N%~ZB%k<4euB7VOg>T`Tw z>#$*-aJ)Kr>v_7f^&c5-Ufl!SK3AjfWG#I$h9U2NN^2Yj97mY)vid1DF!0Cc8K`43 z7Du*U3g-_A=-0m=WYK+@%oe*E^6XK81)DPfu_ZKxa zIHBGoo65;z@8Wm+T|a)p>vg=o+j{)W&b5Gs>U%r3_SU9x<9U)-7StI1Bof-QJmKh{nH(t{i!;#{E-}$awV6f4%d2C?Kz^1B2vCOn0m7}4UOp~Lm z;wWPxGy3FKo%7{o~QLsMUGm5^Lvl4{`^MSb8|D^Xj0-o zI#;I@;fl7C9SlIS50t5PA{%vC(~1&P4a_Xue#FB0!S75x>SzZme@;^sm+2O~D-@0h zEdp0ng$@mKRXT6!Knjkhy*xd`cZknEE5U%tV&{mvvZ=DitA3yeD?*FKEQy@fcTzhu z)n+~C^>l^k)lY{5F0t=6i$I|lqd;kSBDd|uFzX+_-~v5ef_Rhz!GKFt6%^2N$I5^u)Sg?>%+X=;sjoHxJ9L}`^Gf>*Q`6!m zN`36G7fnPl?#wP7VJQ{O(I9GD#L>{~_lM%{p~B513Xfhl#7kfm_$MO=pu69mTg@=f zYewPH!N`Y|EoxzhFS0AxDBMSjqk!XxwA_`4hh{i*Bzjgjzezb(?}6li#1GCc0@TKZQE|~9@VKlED)pZiYyXp+ zGh*r150wdQkLsH>bBvxgSQK#d<-nzRnpdN0F!%>ub=V0aCSNjw`3Ei1k~S!Fo0vW% zed!A^PtbqOTdU7(k5{cDTxx1j@;(}Jh1@dPrw`k=DGAt(>HHcQJ!norwf`X(!Ymf0 zfa{EgC--OO9p}-K(S$1N@cubYJQSNmb)jHn-msgPw&$ zs{_h~NgV|mJ6ke&8iRdV*HcaK0-NJP#2m)_JFE9Kmzus#On@e`-7kj|X>%tNX1|do z&a_(jEiCd^T0z?nCWr$0x6qF$R=G+O`l(YPz?fdMt?&j^v6a&}Hf7$7{X)wd;S$EQ zmaUqWmCAwm6pL#{huG3!J05mKkX+e9Vhj_nv*Fj`tvkX-vaLeU^A7j&C}fy@oZO%& zMNMd$)x`6q-^m<9&TbL{00!TFL)7&0O$$V(#%Nyz1KjOe4k-eT_!u^3BT3WH2$v?y zrfEpQr`t$AQPDnRL4_XCnoCw$;uf&N8UZMH5*Uyd@$gr*O-%d)MY@m$yf-)M_NE7_ zfNjPR7!3gU1dy`3*nRWiiZy0RrH@hP6*dXDuF+2gaIa0W_+O2eJb;pbgA>E@y= zE57WjFFloXA5<>5J3P@e6l-m}^Ro|+8Cv}AfvQsA`6iqDv~n$eIu}!18V{sNCy>)p znIAo%?f>TO9$%Y;`R;TpvU=PV08AiYa6$`uvt@e-LDdI!2W)o% zTN=!+y9;Sq4-tkE4Ipz+LoMUP;BQjuip7@exw8}si>knvZ|H8#w6zegEebg|YkSog zY^&2iE7Yn+7_rhhIw^|pDT7lFW}d(g(2tjOWYi=bp#hj+Pw)F|ctz6*3qAyWv~vr{ z$-}e+VSo#S)eg*`BU4VTZGHp^rejqe2gZo1YgKWW0&9VjfUGU1ll9E*JoRad5|pK+ zoMTveWU~vgSx-?{{n|ZOWy$F|fEtjLLWV}UEA5wL+z#deznl+`ymJ2qJZ28ry*{M_ zlm-0*61yL7Xdk0h1&4oRPu`6_J{W6pY}Ow(6a}EqOieK?-TrwCfX|!k#@8GMwQ7z& z70PtEK%O076@MT}zwNN}So-=Ajo}{c)7{(0%f~jYNU45p`_|{Pjsa#V+bN+N>e@(X4a!!CpwI0> zGC&eLckR7;7g*N$?}nFr0H49gfz%BvVC)sY?wb5(8~iufleL^i_RVL>NmW~tb$IK{ ztJslyAABr&pb*jT9sRrWkt~zrZi^jpU_?bL*X16BEJRD)Gb`%I?_X;_W;U>%7zXdW zq+8W(Lr3oRs|#FDF7Ic6XwB`kZ%5K?v?T3f`y zK0&sXF;J>J1;!^*sx zD(L%5itQzKq!BsbMHApFAYoPdNk&tyQ>wAc-6LrL)88npHFA+Beg;rRPW4^`heCpa zZ!)7k02~7rVY-RO&#t+-sDe6ih0NI1t|3&Q8PtrARbBy$f^vW1IHggQNsTEcPh-e& zfBWgJvBY<{K@L9vOez1Pt|TR=E*c8@HG!Ub;LBHKR8Vml2gHT{<>&kT7+ms3%#bBV zW&$NQspQMi>A3s+%%uWZekMy^Rf=AqZUT?Cmc2A!iS5JsgO3`aHu{ni2wGWduq|6p zxO_kWfV#7DD9mj~PLcI$<5TO#*V?6i74OTl(&VKFubA}zLRJ5DhzPwL8SjcEqYivo zv0QsNHm?$O)z5U-_0EGUIEqiWv5Qc3wSmcFs{uPR0EKcH<6Co;3jGs~M}?A^_idcw zWXfJ!9bJKD<841@@(vO&HjfwZN zwiV(xhPsZIi2boAi`iP6 zVeddKO|L4kee&OGy#cjEY%|d^`ZONn3{TMA5n@7I%L=A2>zMdSo zj!00o`GKM4gXb^rg=iM=|}9jd@E(P6dM+=S!t$Pdw9uMD3k22?&ZRa#7ijTR=gjMT)ti#_ol5Uovz` zdS{kqzsu6~0^IJ<5LY>1CEMK<1s>Zd2`qz&k~ns15k54l8x;)TRaDFuV$OgGc1F+` z2un&tnk&i6V=Cp_0Roum(ou=@(dbdjfAL%I9fPK)`S9=t!y=yYfTtqOQycqR_(Njh zfiq!Ss-zbXZB19}Px)|PzjwIr&@pC}(&o`*X-R!>t1oQ@b$b zTxG!Lh<4PN^kYQ^Me?e}K+k~PdF`*R<8>}sb6U>-emwt;#T&K$xB-?AN%V=*(Haxg zx!v!_@pn7`W!2`&b;CFQJZMGiv@stRtUkyvJ29H}#kP`M6oVnHZjP(QKD-UJoDYK(d~GH+YfUv8URPuKG1qfAsMeH5+sMcm%ND~`g5|*tApu` zaGVKbkohk)B;}TvhdLato&9B2`K?g+krmlT@@HqgLWXNnYvJb4(>$4l%BKN+jG_}r7i#(2#h^sQgk>wr2i94B>FN!%LSe1vg|(>7XndYSqAS8&fQSOnIKE2YCshwb%Z+JChcDPAQ`(D-%9A>Eo2HqL zr<_#P)eQi2yz|*0pv>pvDRjtVZjaDgo)d^TVS45@b-(O`_`KX<*(Vh}Elk(tf8hmUZ=yfbV&`_|iJ7lB8XSU}2 zFGKf#Af?G*VB8Egr>G2i8mJ^4^)3pM9mL}&h*5O+(w3YWtwe6Fk_+MBzpU}sK}f)Y zV5Rnz)=AS3GT8a;LUNnx9A8l!lXTY>wiOX7=lnPcPS&;1xTq?GT$XJKF0aWpba*LLdPhK zoM}UR=(-Pn42J4X)up+Ajtai~NOZ|WJcp9%S$(IC~} z8_wyE438^Pcg!tksea3&5Buz~gL_sbtO@LOrJdnN9#oO{4@$ldXU0y~aS0Vokn9!| zEiHqcJ$9#An#*!?C-(T%)zb7Oz!|=Ys5J~PYO6eWDO2-<1H7rq^u?|wl;B1t>i0JW z5%K$N3o;MEnUFl2*P8C{7e1S0jhZ%?ewY=|w{kOd#Mf%%?sheFx)$$EpqW5hgI$(h zYL*no44ao9fED7Yiyum0_lJaZ;Qbd>iun)#cTB$tB>d5@$1*FY+@Jrj9QYEw)MaN7 zdm!Ax0RMUh%;;*0v~laOwPq{L`nGHGTW8o)Kwog7kU8`PJkAP|uLPojPhSQan#oXk z*50UGE%V8>Ll=aOESEMf5`}<;+`NE%QR@rt?yEfzqG7P_Sb~$he!^Ot(7J8&H3*} zTG@bi{JN z%OyTlthSng#BQMju8vH5GKbv2NPqh&w65J>^0c1gpUfx;YGPh9bWw0p)j+cd>}U#+ zqozusz`ytOVtw$x)(Wx{RLh0ziL@;lvq5&*%YhRE{4ah0y&2&IqMcO>-eJ4kxMUdF zmp4_;I0RSCtzZqi}k?24AA(v~PZ9RdCNO`RGdDrP<|+LFxSgRmP!7d1BI!!o_?+i+53t$(;Fx=wDrCLktW z1C~O-JLNLJ|GAbU1oHjy0!R&r4OndCewjXca{A}~F4^yXwEhCYel^$oacxVg^{efY z8)@t9;+h#B1p&2iM+^`vFSg_Ps$$J&{R6G(t>;#S9)F0)^pxOFW@rlE{agyiofMo?MwXS3)SO5TV%0{d zm;0Gy!!?KmSNA$3g?dk0T1?S;^-5s2$5p_~h(EgMgHpSLdRE+8cQ%aAx~!X;U_r&f zgLGz>*|sRn&}DAyA-H_n4Giy4@aGZ1T1@u6dOXx&9GmeoiOvJ$|0&sn7}cIS%p2Ja zeH~A&vI@Liy9zRt+`Kj5rN6*xR0F7{qKtC7_re0;pwXg(t0*4(;y23piaPA1Jzs;N zg~}sT0jX%IMY$Fhpbtu8bJV`kr%zwSsE=FKnN{WQJS35bA>Z;YZ>CSWindXZac>$dxQl{|m1z}e4 zL`?!j`NK~7r=VJx*K@5HgR3g3dt9`@dqq~yQSU$f+Pa3p@@IztPhM)cm9+Dj(}4Mz z>@mPZhQhoL;uPtw0Fu6KZ0u!_Y}(n#!btk#weAxZlGCv8h~vLy_s_Xo@7PoZ+1H(* zBdyD*)QkYLE7>*!j~P-;m#+Wr-gGAKX6(dEs;g0&#Go!lFzR;SHy7}<`~}Waj3AI2 z@9&Hxy|b-9WEN!L6c)Tf0&MW4ZPZ(TPIOz>@SoZ(Ibm-GIG`)@$a3!Xge~}t&8w(@M zLCdavDw-^2jwzG0p0qSHfcn(Y$16hjg4W!}?%R)*hpH^n#r=JH;OOT-fObzt`QY1% z;z@&P^99h~o_-1U!RUX}r?7^Z@B5&d8dn0^B)S+SApA=8frR-Uf*c-`rj3cQ+{|EH z5?9ZcSZ52+jh|omG$mQZ+P;6Yll|&{xNU&6i!MiXCV++!CN9s(hz)u*h-f}@ILPTh zGSJ>1H}W2sU_X?mi0T@9;^+tNP1WyySMk`}@NN>j=A1rOkJ4n(G19gHaUGMhx%j>(Of^|w7iskJJD6qOKrkWK=FCZyssZ1R*BCmr;X9h`u%S)Xu z9jNfUicQl6>HJ6&N!k4?^&OH|>xg93v$wKQ-%{@T-x(tgyT`%TJJU`&V?Da)PwtG| zHSB>v#z_*R$=|EnvBR0J8UTHQknK?CRI{w$xSJa~(LT#}qB&|T*UR6TBae00(cCvG zZC#VRgVjH{KR^jYn~c{zzQ%G&H?s7am)a4*EY|9I9<^y)s6^GjAK{T3PH$Bk^}ntPRF~T7lSk$VId|h=TJ? zm9fC=Y6}e7rbQC+M8Tya&`XOn^na)? zyc`m7o)?(4Eom1#K&f#W_WS_h6O??zmCQ^1&167${u7t}SF1OAABpZ;hVL;km8Wd} zUbStD16*kRA_0J>0MP`%2UAgA*8w27J*7vKK&?DzcvqXQ1(aNk#)Ypr8hyNKTVPHFd`vmJjf5w&ib zjy8N#S$leyf1!S zVUe4^&BIw9$T2b&nwE|uU#g5pyyq$gD+pSfQfyf$8!u+=7#owb3+kF-QK_ zKp+C{^%DUGi7`dctLgrIZq&rJ78u$E5vjhABp$jc-YykPA46AD)R`{?Bzp*OpsNF{ z|KGbP&mB;{NlRVCBU>YN;|3oWRkso z+~pxVN!Yy$lD`Z7~)rUW}~`zQF!9PLtCl6pCb`4LA_CmNwn=$1jK};1jAEB4)I+ z7Fo!tGX{8GnK@Uh^usNYb3>X{Uoidxht4Ta{&~2vd$P^(n6G>$E%A19mkfd5>^5JO z)60ItXzuMeVaz#jq4Cs7hSU7l-Trk`!lI&R`0lY<;v-C*Ons3W2O<4XmwEfqTvg5& zJp<^Uz}vAwXD-s$mv6yHiVg9MOLxc~cbWGkA429#60{NC4Zl#&qJn`}Tbx*j1LU@i zQ?E7TAAg1GNl_5=wrlI1pYdDovfCgMqlLMq+}yoA^p+vyZt@)q$J03kAiVuo=+>fS zQ{s53C9F=EHGViXQ~!#}Y2+pFS|VdKHST!k=RPq*#7!yug|s#B^-j}m{zyuPOrfk` zKFr4HA(j;l3)1mQ#vO;>8_MCSkeiyfEDUsXR3yu4D!|LPtnedgX<`*~>BoNk!^BW{ zPA^gB)Tpep^phbwZinen*D8GcOXH4bGfN09ZTO0sjB@_W=#7_sJ>Y_MmQWC!(J|$u zZnb4(d2Bb4};tBycg{&UUy`5TgmiwkGEFWg-_?lQsyc&IkS$B3WC?|SI>Suo15duE;4q0 zNL%xj02~bU``XWdlNK{%c6|o?0kblyrjADNLb78y1fg1@7OY%FOm@@jx1f@stI@SdblB)8l*P)>r<*(%7FJ^bj^1+RcYv##waqk{vgo+18#uKB${`m_#^1b`3r3 zAUAwzOT8pA_2n;gH+&K0>3(#MZaC%kxoeaVr)Ck$pKi~4q8%QJT=vusk3~~|$nd?p z^JvWbmiw<_HtJaF*TNUl0>=Qx^}}U-W~rAS=iEXSx>n)cr}}y`cjsR5{^r;W>{h47 zAQrEE_o7V(HKHU0)pV>01)58y-1vE6L0k@M?C`Z_st7e8?AHNeL@`oC5u(2Sx4c}V zjPct8=L`CpM4W{?-Q4d?Jaap|l7rq=I|qFOnd~bCK|GYVn8YhtURAvv9JtIjC6<@U zOWPLldgeMdmwsPbbneZ1csS37%$h#QPDpsvMvEu%a2}>C6yYzW+f+7jjpn00W_=)4 zBfj4HXEoc`pUI;&EGu!t=r$zGr%M7hCBx!WygXU=il| z=2N@!hyu#mBKFTh4Hi2+uO1RMb4>kl_)pq8o9@p9k6NE7%*?ig5z}1Gw9;Ju5;8|K zxB#OnkNq`)ww0Ib2ro;1Ku)F#@Beby8GIjK=& zlLAL^-KThL?AhFL)%t|J=ZN6H3b1{D$0W(N$!uF;bDmkQlq1k5HqZ#if4dVqI5-$R zUd7hez0r|Gf?kRf4qg6puTif*MF$=s3AdPEi z`0LnFUgl=D+|w5<%An~Z4-eQG4;QF`o|qXmQc+da4>oyLuGU43l@+;BBD!!E+9{i6 zDJ@^0pR1#6O%2z)SgHRhOTgK|JOg>0ge_Y8+g37;-*Z)Itffbjt1DS%bIi*k-$0cf zgsdTLc23D$BbcwcwEZ0P+c@hY_YXTXFq1o03-(a7iE;E-G%b&t?-1? zOVL9FNk5*S8ZCZ?4cHp4*CY9)@^o)TQRc~A9Uv1pi2=l~tl#!k4p)4ZgAZgzS@QBI zWDrT#<(f=VfPh(=wt7a+#`xHb)|vn!1;GFZO>U;!q83!!BxAl;q`ERRIL+N>t~!}V z@)P@KToQfEqUo=aT5xX5eM}w;q4Nb3{mzraVZ*n)reCRv{3G{*N0EsWwL6V+a)0xl zjPnnc)}FB^I1rB1hnW$-Hs6!`M++Wb_=VX_+uV>c-_h{-f)8ti{UQ@Z+e;>x?h20_ zwu{~thc|I}eB%}?`a0I?)#X#8oIv}YJ~SOWNC~-ZcY5qjthI6pyP;WW4;agAl} zIS)PbNY*HBNorfE`{I^a@%e8BV$8Nok0tWG*@VOQcNWRVWb(SNAn-MN=Zkv?dOem} z%=5*}%36Oc&UP=ZKhcMB?gy+j`gzr%@ye(o7%WReVYKROOx7apV#Fb1INN-gWTew& zb^L$5Sg28EcGP&|GfS0zP0lFFe7ddlO{$PKk>N)zZ~8c5?E;*PoTmpOh3lKDNdH zE(=cpA`A!U;?w;Ve&c=!CymHFU}r{0Q)qmc!BDXWkUwKByhPoK6m+juy{3oT!k5== z2+Kp^T)G1XgCx(E3Uu#{X0QWeB|tH@CJzcyCTc7+&; zTXev6R*5wB|MYv4()rQ`6ljj(yxR3hegQGMqmcJM{zmN}|Ijlr{Ne_;v7JP}1A}^iVc$t3onidOC29 zgNWYD{4UEw6hS9(YXQT`sh6IVJ zDPvd}SrBng?L|q)add-e35k}Ki?2%S#rT-XyuBTY!N00A@{1YN5Xhz&P;gKEl(l{* zTxOveta55eT0!PA+dAp4?4uyR1hWmY)UQt#Nz@>LpW1tqb? zHS@NIuMT&And6IXS!lmse{8FL>m5O@C51TwyN)0%Bg~p2PK%!pft|xaNZ?3}6ivV4 z+~j7$Kdz6Gd~+l4Y(0`cu8U}W8XI}Z4MMVs`tv=g;5FFk#em+;33z}DJdAMEyE8GY z&X2$m0E>WjULM(!?&G7v9Z_cxqpvgOetd^2L%U^$FEz(`we*Csomva~ZNH>78T-8% zsM))th**bE*~)cIgFQu-I@ZY56!!xyU~*!6T#Ft{6wc^7zVinOuRk~2b~(BwnN?=T z^g&6BY%;*0t~r?gHMDhi*HvL~@Y%y=zdvhfgX_XpW)rHmchTyELP0>nFb1HyKzsvw z^~8I;XUm(hhkr}UNlvbANtu2={FA;Oz3Se=WJa>N00Yvz&9A1K?Be69Zga5}vb#!7 zRQMnbNRP%^#p%Xi{(s%Rxu>|_W2*{NAsU^qB7WNcyq&erU2d4(%C3v(P!fm1hA3re zXWocMhbMGyR8rn_Cq@@Tg24E2`XZXA$l|1xPkxIbloLXWFIlL0R+vP6?uxxKj#9@l zv61SCRfuPws%iXvmSl^B5c=zIWS!F zz2{5EH{(!-qBKhwQB~UX%uF2Sp>{{}J}p?lV5Lx&L>y{2{SDD25&!Y+%+%+msM)Iy zG5_O8h}lDMZ-*l(24_mhX+3g8sc@Du`bB;-!#$6#zseWV$-wS9uWO`NTxo_Umv1{H z7d3GEl{56N9j@1CDSq=t#e6sJHmgS)h}IjY{=w92ZupWjV!dKnNllOWG)F{hk_1D9 z{l{1w?rNV%BN~UPk4BgYgeZvPJ&5neYp?{ zZvBnm-CQK>=*)+W^Ykat$MmNoD4U=l(YqoK0Y}}$J2IEx!-e;*TS@rOOkG89H?Cvv z6~jk6j9-(BLMz7Yu+bhj! zKLpF$rtF$`!Um~wOu&)e=TY!^+N-Cxy;Dx8l8=Lp-HCIi1*V1VHO1s1i86CID~2Jo zFS7$g;RmjT$LaT#t&dz^=V%-BQC-3A>hL8D5DT}||pL%7AyFtxPw@Vu7T@=SBY8{>bY=;ibJtw+jUDyIhuie(bHH|zUeZKW@8`wG3G)6}zt5Y3KK z6`XIb3JFt)bS|SrGwKX+xZ9|0HD1y~92aq7gpQXEx=?R;UgJ zD^O|rwAZJX{Qb3rb}_3)l;iyG8P!JrF=&TVWRB!#6?c28SpZ%|m4r0BaAQ4OgT{1|<(Mp)kyrkqeiYdmanX}3~fwXWmKi(BSq-qZSj zc!{&O+I@?8rEDbI(d$Bi*}}l7`#zjeOXI6v_}SsBefvr@BIxFa4$DO*!B07VUvSp< zrl|3zZp{Nr5%l5M8;B1W3(j&z3wYX{u;_w=LtHCujkcZ$!(ol{%c#EW zm+fO&Jv?7`Xr2zzJ;P7Sl}j3K?H}`=cD>g}GqS)OC=M^Nb(7MzZcQ89j*OfRc_V>Q zJ{ioD(%g^4-?;54o0)HeI>E^2))ZaRa8qG@g0HB8az@G1^lSGMLv}Th8-4cUew)=Z{86;Edb# zDdy+@jeP$y+BaE~) zI=eg>qS-ZlLjG2jC!N*IvoP___nT1|HH92j4x>D!MB>`QU88{`Rz}~uO0kpIa^Hr~ z{cH33T3Z33OU|8clu{u!NwmA<^ac+mE~?l8?&Wk8bt$Vdf>vS9|?jS!1-SiIUJ)h`OsQ+)Yb~)A{y>0W8ZN>-u<9_PNfd2-!7-6mTyrEpm4t0 z@*ibqIVSnS6IgK367XGsUr$t(nDoN(Q~A_C-q}>UCRgptPQ^21ir$52&M(3*cwdX? zxEzidLy)sg-&TpB>{6*^{J@kVMq`k@W%CV{qyl00I+mfMLZ^>N!tI! zC*eb@qjFhTsbGkMKS(28Trn4i% zLZ3tNZudXQVlt6lsvos8Yp#@2zhbQS03w)J)Z~dHCg4(u0dJ^?cM@qOOhw-r{W2$)(zn&E^yu^4)$nEi_I>ZL=xvwCDJ(yu%r3$(JzJmJsvpVH=NAl=NIRy0ds@@4)tq zmu$NbgZsaENk0fSYZh!bD?n-)IO#D|PNqt|BEYQy_k(W#OzR_0#2cQ7C|}~0Q_kF) zh_^W#`v!OXpqT06>gx1n#4|=$ut(jlIZT#mPTrtA_yq{0o#c7nnzGHk-ULk;_nRZ1 z&-qpq1k=T7hoFx=Pr)971Nbe5J1>R+@%jt6s~h(WA3jH0uO!ojq@DQJw!Xvae5zZUB$m$BNb<^@vZrA&NvH8Pkx6zfP5 zyxD^?UZm1Z?xW2e?7Bw~Q^Z$*z(KBt6$@AEA264{b%S51*m3t$m*)6b_rt7Zt$E_M zWznvl4xFD&H%xSV9~lNqQZ^>1bSS`m*6qLFnM#!H4MqAVIsY#5A`RCHiaC|>d^gF%gRuV zmZ6n!y{g$y#L0iJ#>>TUY<5B>#D4ktaZdV($|gUC8IBN`*o0G2dDe*1nPyc7Y*rHx z%Ots@a=t4fXqev9FPP3N&(ag3sYiUsY}Wg;L0YK}c1h<4A;egzU7y@pU6p@wu}@b+ zdqD@;WTcKP1!Q_#!Mbmokh5(e;@eRwZV<<<#-vF7YrG+djRu}n)j?|R(3#B^rj$)r zPs&TN$KYO=s<8J+T$xCWA&|ERGT16rdX0_6(g~)nkgn~Wfp!&KIyB9Mf$3AsZret} zP0s5!n_BW5F&;-jmj%Yz8q)jx#aA@##aykZ#cegK(L~ZF1y2^wGD*ZX-fMkaps~!x$DVYYwyy{JPtbZ`@%U?&Zb?)hLD28G zT>Vm2{Zf^4Eaix-s5Ci-g=ZK2o;qym;ctz7b8!w8>R52`p!pxc&&;>rnv3m~J(ktn zxgH>SUf;p__vLreC+A}w5OBv%{--gIyqy^P83?54`*q%tXvv1TN}?7?qn7j-J|ok- z0D|C=a=d-RTcqp#kY>hrCCYI%0K6ze8&+b9tlaM)w=jamVl!# zjzXe2O`;c&j}_K3OdJ+~VSO9~E9+~Yr8myR$(^7!D+R5ZRwE*kY~RGTpJ?LL#YAyR z4XvT`M^Y1C2yx8oyK9_YJx!CQ-OF`B%8}O*ol(!8Fv8%MQDyyTf}Fg)-EnUB*Tb&c z`=Z}@QG;s}>J}${K?FUWIj=k%lMHZMPFbsXNxV{~$B(q*~hfQ|-Hu9VUb7H^_oGQ0~P;d{{1{w)xIIpd6K;z!^?RaLs=o7_MhW-=?g3f z^QJ1xN#FEgq=2coG&&GI9hbamI^ow(UYMqvG`04@0f@fXKWhIqNBN2TGqzQN?-kVo z`Vj`DfcO`zInM z(w84-RrF8lvE`}kL?0r&CbXq2xtl1n-0N2`9@oP=dQ#L!RuCc08d{qAZ02r<2Nvh^ zD8N8OPj6MqMM$d5u$45=8)!N}j^udV``WLOnviG@Y96C>sFXk1Yoh=3J)b5MSIq9~ zMUGMa^vzxPeGo=&z{&ydBuOv$um1Yav}M%lK|Aq*x%#Z}_5p!6_13eE0o$QT5HgqW zYs6O@Hlo;ai~jT6>^^ZE$)NAiOr3V63fGj(K5CPgdXu_3dsSd^mb6w>4J3yFXFRHs zg39Q(WD7};QL~Du8S;kpk3#EBgp@DNE0p}lU8IQkk zcO_>3R)?t(`74p=9#N6ISB&hMl*}De3Z&czc@OPogTL|cUEW_rKx?<7V9=O4)5heZ z&Uh)~D`-odLxx+2X*MdYR|I`9*0hXE5BNklQ|8ENP3Lc41t-;7oEtgZd}th5@W@5d zNwux;FH$LHo%K$rCb<~K_h2_9FXX8p5_oHO{+Px576|ibjGY0Uc|ZUB*L1)|bqzK8 z$M|wR>6W1bi)6^xr}q5ni0X~G3zsKmJ4O&%y`1GS7 zFBx{iRI@OEf&dkw+nY!JF)7zI3;uWG)*DL{` zf5%oaBMu!Dx9L$QUi~!Wf~hjD7V2YITwb1LHS!OSKG|6N^Qlzthk7F{|A=WC_{LX8 zw>cch(VPl0oiamVdIcS6nA~*?W&YjDx!T!VKN7z4A+l2g@bmvpdgWF(&{YbD>pHn zJ-m!fLT;rjo=V%^T*|g(DDZ-)>=hLYRum0QP-SOpTYbJhVGWdcMMz2nM=^WX{}MPs zH+sj`Aw;Ow3ua*YiU?t^JeMO&Z&#QLiwtLDWBW7Uezn$+tL^x!RV=^t&zh*DkWhw_ zp|QuGpFFvXKLjp)LHp?^lg|@PsR|awT=8i( zF)wxK(0Gvj&B~Dj;<_fku}mo~zqKt1X8TgJJg;L}oIgWc6i?5V4 zS;FbylQX=~BGaF4-a5+%Fd1c$uHih>AnHdQl2Rz=C@l-<7AFrdSqcdFZdg3#rWZ$z zYQkVtFu9j&Z=3(AAiDs7yoCF)X7PeEXtyGo2Ic17VWF2IYV4OSf2&TGCQwL($NF3) zg#4Q?mvW$HURLa*?_X8VWMi4N1}1e`r5WEud{sT0DgMIWde+mDfTio&Enk80Ri314 z>!jN$HA_+_T<`AzNmfp@t{`QZN0)6oxS_1U&e~th&e)7uwKjn&~*NAnG4TaAZ z^_wj&Zz;j_wm_5bJ#l`)XT7{&5WlA7;za68kb+-g(f{WBzU9IFem zY>t~cHy%OYcks(nwc@0p875g*F8)VG*Sk~gZA6nb?w9gjXC?LHbP};_LDL8o7=ZsL z_0p42(;1GQ<9CChti0`#$9qaI$mbWZ9={m7_TBOZ1&BAU`8M zT2=D~p({>&)&+%4;bYM+?df@nE~n3BMYO<7{{;izX#Upes5IV^wK@WCPW1=z;Bfzh zPf!Z-bT)GbQhiK0JX~0R;|&u@*qpT z5P+ANGhWc8kzzu@J3PjKGB-hlH-%m%prSqV&H(zi;-tq80`TRFE~ud;OD~+R!{&D- zWhLtzUewsEbED-?@;o5V`htXsA`}pA{*kT*5|?ZS)*5sIG|`ZoYpTsc%~|@>x%Vb4 znG08FsOa|9>ixH4Vz|~O3i}qU$O)|CZA=Kz@Cik-b!a!WB zSz0Qt76JKkh)TQXJ=xje7NYNN|D~*wlD?9x4E<}tWE9^5n9V@GMqFwQnxS_#Tb~75 zI!PO4q~sQh<=cj``W&+$_3db*crAXXbREtFtp~leWROWgc`tJ8ybEcdto zmAd{|u3rHXG%ux?$0kFlanDFcDMES#9T&_CU#uZ#Q=PsWhXiGG;VC(&s*z}xB>#yU z-(v6`=o#^_mq8RB<3ws|Z^x-=u3tJ0LL-xO4ryX!E{*QXCM0EG7336~8jI?WA{^{? z{Aug7=GOjZ{#B2sC$h=f;n6>OvA+(#m6l6N$ub10)VeIhr|~9rrK{=Z^B{GUzO`-$)K^lVR6(79MZMd-HsWwSg_uZ*@hO-KVmhYM-7URT55yj_3 z+XUo34*Qr3$PTfYa^Zg-=fOaK3#3nIK(!x)<)B4%b`cupM6HCELx+Vv#`^&p%Yp9U z^m0_XSC=Byy&VDaE3NPd8r)nEF6)Rs>UYv z18PFQLtQ-Xc$dnya{^~8Gn|r?4lqQG4E}JCh}}^0RnP>DNcO}6;X`=cWfNT!a{oyn zFh?IQG3XVbL^Qd1$z|&6Lfvrq!Q@*_k*0_ky{WHT2}~1%Y?R4g5;C?V2$D+ zZGD%zRDwj~Y7izBAax>~GN`l5w=lpY55Dv2(iDo-5QfQc))KR1LyWP}=lcy>1>VRD zt}Md|#|y`L(cn_cWKO--lp5=={jO#}Gjj=(razTd^}8+^e_L*$DIW`Gcr*!4MP}S` zVu3kc#)hQ0mcg6H-+}_{h(VrcmWu z5przd7?H}%M&8WnX{*_cl_%|L{*wS10C4>Ng3+~-e=1*Wo78> z0s5jLV3=*b@4r8Fsd#}h2Ew*fQR)|g8T=n_F%{_~EJbM5h#yWI^XBr#)S>e`tAV#* zz!7U_n;^c^+H?uyV|gXcl19C<`Cdocvyym`Q=ez!{kFOs9;xLgdX&zHedzw1%g$b3 zPLIN0ROz;3k(^eu68qU)l7M(@z+7cp@GX2t@@MXEw10I@?)&0WF~MWmas1oENwjzl z+zQ*DW*rDi_Rn?|z2m&^?4Aq&(#6xJr>Hpoi(c2NAr$1bUq3_S*4ML|9s;di^qN%y z?>WOj=9)mB=N;O~PL|@?w)dktpz}2J2sz-$SXwu_)AzAQQ0us7fjWg}yZ-(ZUBBZT z2gjePexjAPnJrD{$0+$6ElmB9M7vl6C_R>eK?u9dm(6MK(kHmTtbUlJM-d2LvTsMAK?QlU z|AmYG&!idL|LTF11JnHIjdA1^adb4Jox~~Q!YZ6|x^VsjPkJ0Ku}Lhf(D8&vc%Lqu zjNCS@(@tv}0gWqHI>Yg;LM&IUVr<-a7AsrOOmcr~;+a!(ZEEL2xvlo1>kUz4&oCsZ z;BC5HtO=Wkq>gkx!ODBl*!mCb@>{OKX{HoSR=@}Yk;1HEThPR#@E*DqR$9u1;i--n z7lZmoU2j|6j7TCTs!$KP!O|5b#}ge8u$aG2MfxcxQqZJt>gE;!!eiH(+pGN7QY*}4f3}L+CNZbx z<>1sQ>IbiD%#y>7tW;E#OQ(h^$5HQ{;xGhJy!B(ZvC{PFx|uRZ zXjQt9U_xH|eiHhl@vx0q-Rx9>Xv4RvL)+;b%P{Cj%}Nd$4{L5Qdv(^+3AaC7UH1jh zth6j&LvCumqgl=ud0j(7@RB`R#9h)kD|R43rR=%l8Nt^js2&c3i9n5U&Xx{zE3?#s z^HO@-REZ<11<0jw)c!nKsKtKfI}J?8PyAV`j3~aBBDJG9dX2?+$s#RWjkMdXqd5PsJ6yxe^KI_`%cD@q%mZBqnj5B4m>wm>U9GFlum>K6uD(Kt(NJcn@;TCWyK}8R1J0T zGN{WN7wDE$Jhdq^xed(i;sBd%)XL-0muwspc0$3Mu`71I+P2hI4~!ni-ff5bwI0xp zev*~G+~o#BS2eCrjdsSy9v7F?Pd~+6EumA@yJ_7KwvDF{)!6@k#BQGpcm~KEBzMEv z<=~XRNIr97vnn1dFJDU{RgnRHV#a2@5nil!VQ(xBs{^n)3bkK&&$uy=BU~$|>^x)% zf1W~-7s-s)|2BNkbmiBfT(!A?vYPyq$v4vM+SIwzDdg;*i@4&;^1{Z2%Tcpqd%<15 z7;@v`92H<7{tHPP4f(j9DA`0Z*_VgkE&JkA=e-O{DNN|AL^LjFRJf`Mc8Vy23&ENB1d2{?GGP_piUBW+@yG>6thgYgUxM(nOyhvU515v0rYMgx!Q z7(SJZ74>0l@scxbUM@i%Y6X3Ult}wKko9p_~x5Z+|)q4>oo9;0zXp8iUKu5XL)& zd)Q+?8AJ-qjw*P|9O*wLtPU1-O^8l~?)Wa!7;|E=Gcv<@v=)h*>hD4{TH=-7klE6& z$b0yEG;Ymtj=dA3L4iumDdWAAUvsdD7bi}p^cm!q4~!&OAvM9|&x^PnQ@}&^5!xLZ z=y+0HGe+voV<;#w%z4G}fnCR^3WBTl0PZ{;yFyGUTTQ94!2WE1vihY)AtI(iM^8L! z4RZL1rsOySO{u!IT{oi9m5RXk0zh!#Zqm0C27um2&b#J`e_f92(# z-NsZ@=asFJuc32!6G2@AOqChR(WjZ4MC?Jwb{%_(qfC@;R&0NW?}mg%#Cs+2wR$-r zV+UOBWdam9GGZf98SwV^06w z(-rNFAf^{N+<3)}o%gu_-9GN)X6t?4#<`Zh*D3Df(ZW+3s7G6M@V-F8I7vNz@CSX- zpwV-r%%KN|UN-dJ`{^v@{>H!~Jh~lADm4A^An_S~CCl6#40@llXnNMF)#PuiEV(QU z_otB_uOp#=vk>^|?tdyb?>i{7K6dKX-FZCTkF<)=#Z#Itc-*Rzt<`Vq8`~5QnkF6^ zeX^&20pRM}77)1(OM83YVx9Nbp{>_+pjdi;`JcvKIB$Tl*91TC9xL^xQ-ylKndS4k zJ61E!kM7&SSUutxnwpaO|C(Is0VNZ2*3@;~3OR%f7Tur9w6UX6Ut@SemC|G{xjeZ` zLf4ZCCq$H`bod=$0<9d81BUi{k~)r1oY=T$kE?%j#Q#-<-cgcyJTdCJ&QUd8pLwNu z-0}bm%60^8iT8pIU=-h9n_q$2q5m8w|Fj22W!eSKM$7;lvpjQ*KNn9`a-Ze)a#!;Z zVdBP4$;%l^!}U#?>Z>nonT?^#0j6E^RPgD}zocaxwxSM_sLL4WEAAFse@P}A`$%9C z6OX?WNaj6lmQEgAJ@Lr3t=JJ#B}b8U^XZoF&$NtCEgS`NHgT?~wrFU)TS}9>R1qcsxO*xK1zE}0#J0a^GpY&d)6+2a+oR7}W(xrKS zVh&BSb`))#Z6mv0e;cw0!YC|~Q9B6@RD_h^h410gP|fUUHP>`q7j-%zTO*P8xWlbt z^ysntu0NrHClBem`DZdlFE3?+Ua?~u5pkA)C5u?bd%9%S9HlXOR-pxC`o4d>b*?Qb z7jOGpsX)R-7#KotcnJ*N)1z@uan$_d8nq3Kw+AFHHc&L7sbV~51}hF)Kc5lkuRWWi zrSm{YUmgk4{&4k#*YkzPWrrs5pgyYcs39HLh%tLuQ!uu+@NaHLj*UKl{&sit#At9c zZVon}#V^~<9*6tsK@_UI8VoqkwlbG(`I)ZeNCiC9o~5#RDf&cEO;Ou)&Z~qb(+-6G zKkITQ5yT~E2!*dY{XCn_bFDsJDTNb(@33ia6_8&QI6j-Vva~ruPbq-W(br#JZC?lC z$=ErE`D=4mtZLHicmO6M2@iBdkj}9N$k`-N5J5Da1Q8X51uh-1#f|q9b$0q8LPF`S z7)pv>f(mVnwp+J=uox4RhmCU{qH3b^a}*jO4)lyb2K1tx$ZYXUVZ}7|d zHLY~9;Jb^P*!?M7@1wZ^%y>`9xpP@XL-!%H*{@d50Uq{&3e?Zv-VG9}1bC!v#&cw2 z;G9vnYdnJj4I-D!ZA;`swElAo!?MN#;;W1{wb0m6&sPT}+62gVxYs%*r+!uP(*8pu zV@C)rNKw_KWLVQ?XqX<=Vh zhY~r&G{8rg0#2t!fxIX#Nt(8*ieR7Jhvb7LkxXoigaKrgPD*QQrDU8Nc@Lyrw;Y~& z(R!wexF9kq=G$Vt>y8tVYnk$*NN9}Qy4(pJ3BRfUcz1&hFH1ZH)UsF*&}y4lgEj+p zeVH#NeNj;^P8AfW5{7H@$|jZpL=j2!?J;yzx}vOKu21W(Xbj@W0x#k)MAp|Gtsh zCiz%3n`~)|+p%Ic+l!mY{)V7IZDZ<#UN#kgL3EdHvk7ClIyoV2(ow(fnO}ao{1ykZ z5CgzGH9z0F?B?K~?i)Zm#2cMY8zs{X7dTa={V^7upG0v&U7s7y&z=i?%%SI}(i=y zw_^*}%-)xbGC5c!`xRiH0|>`rkEbB$M>DfD9lPe}L<6^gvs+#u(7r}REwh?Y&`6l! zcG+P`vc_X%5PV3ARMjgzd9ZsV73~xS5%y6@+mH4=3TYmXv`6)Kg3pbkJ5DZgrWv$wR~CeW&Ke z5%Lkxw;oqc?S#3zmlNnZ$ZR!j;y*OJ9oxs$L1zCSqfq_wsmhD&Dq&4<@{A&Tx=8dm zMu4s_-;urI8^Ts>?R`LhM6=9^()bQYR>Wyu|8iDWuI~407awCAzu;OJed$>O_f5s4 ztsZE7iow#Ij=qN_Gjmg2I+=U=!vTJ)h*S!`!Tf-t_anV7L%;3!mblKWtEHjy);rYo z9Gth}DIeX_*Ma$*a!J!P8^FH4xE{0^#7yA6I>)PzGhwltNO!tfDn0spBk4V0K`Tzd zD6Iw4xbX5^{+3m<%ymmM{9IB66zxWgOTA>bLi^~+*^{70#I!LHlNUMNn=Qx2kY3{g zzN^94SR$t8U47MR{kkJyXIBSOC&nD4SQ*Mn>G-}!n<41c$z~AlO^{VX0a!YoR7K#bGMnSDqf9De9k3)0O}h z&L5G03YYE0Vvv{|vd+Yn1}LQNvw{x?=g0L5yo@ zjmIBt9OL=Cyznn&=J#Zx$ zP{jfiApY|Ml>1c#=;ogg9*_kbB?8c`#(L0O>~a$?3W?j8Z5O@2kbG|Tz2QlUdq;)i z{j@}Oa-ceLvVh|UF8jRemp?)x>zDJwhGeybY9X| z1Bb9hd_bbWYT!gOgEN4eD5DpxsKxJ@-3{7E7GBwa%4-uqY!B~bOw`z9CW^Ch1OrbK6Ux#^|rG|pjH8P*xHD$B6ySCl84B-Q+R zN^gD&t2n4Tb8k2J!!wg|Ay~;akfrnjS?DE=i>xo45bQTNM9vhAJzIh53$u5{u31T3 zis#v53`0d)Z=0hf?7|!RYk?`-$z|!};ZSx!f581*zb?)RPulRi;7Jwy_5t5pyD`kf>SOujYra;+`)< z+M|;4Pl0fS%dxSs?olOlfhAJ0EKJI1nUKP`n6xysR|pNX3H>Gx@MvT_mlP^`!rlh> zbJl6M8$03)wNZU0*UML4{fxD`lCzuJ7rRKnUMwOhNxZ(EC!MFtf3tD!C9EKr_&&Bz zl?F$-|0YLe&+~mj1PR|zcX|8OWdu5GmvM+_P`C7-kJbdch56jCFjQiOHgBd4JQKm( zjRUY_!Q&)Q6&OV36$eJvl>WbTna)A#6mx>z0g(bcVuq>+>icLSTB2S>lssMtxuRX5NFcjA#XbpP6sR>F&#Zj_RN)g(vuz@`gc+=&6S4} zmo$I>%G<8zye#7U0U?$2aM5$SI9nCTw(g${(?b12C$)gkw-+yA;1Ds$!5_T8UHeJP zSzeXoX|$Tmgh5lxhud8Wy3-4JKK0a|4Z7y;zNHC852a=nHYM;4$TXyT&t1-}jSD{8x{BEP7jA{RS*B>_yr_BQv)vT#Ymo_(6j0j(U8h}G2_L~*vF-Cz+m zxJZFB?kwWKAL;4lPYZWeFoMN$4!a7e%S$w_0f{e1Mr z?389etxXY=|IwGA#YBf(LrIEDv-vJiriRiOu_0CgUY(9k33*)E5BuDd^U6QuhwpBf zyj}kh&pMuzl-#^oImM0Ye$NT`U{g+`S;ai6+PZv zG!?yLBe`5CF9~dKe-rr1eP`Ep`yz?ZzJ4ou-?+SrIyFE9bHH|r86uHy5-ryqr7nYq z91z@GbqPdCn=Kfptn=CS7r+$c_c`SmwcBDuouI%l4zZY@SyoCxTt@32rSjYOfj z_2Vu6QB5~nUTJQ7t{@*oE%=Zh`DMR&1{*C1JR<9pyX-%?za*cYvj5}}2r=b3)FpF2 z(7L^Iqe&b9|BUYi`1!~IliWfc39h?3SRc{^Dblm=pD!hDGk!y`h5I;f4}Fs?{nb5*&o~4*{=6>y&dn7wSQ0cMce7iIFSp2oIht-?(TKB zevOafX6&-9t*ov$xM+)8T445-i!n1*wYn^cV-(}a9_q>tIV-^-prR*ilB{zAVyo!v zo)ForfM|D#Uil}vjA*qq-otkrufxilfZv_NUAlybkGo2KjrW_ojVp7D0Ti?6eiiG; zjLNm?j0(nth``x`NB>)U|5Jp&h=>D;`wHr(o!(Lv({=>vU9+v#tN%$+p~F)D7Ep~; zAKX7w8FKqM37WPk&r{Q%88&@(kR{GBR{gR)i!0l8s=xR>>%GXeQxFqkK`hhlvabma z?e=oh(+o}=%o4x4Oy~Rbo;8W~hoQmJZs7n#4B)j*Ow9Dqr;#ZJxYm>jHZ_)(a!Yp`j#ANMO!{|w2jN46QGAw6eKiZGQ7A292bXuRCXG_Fe3MQ$rl>muo2!ZY<< z4hr-+XOlRf1f34kR+82c!G!=pDo3XvKM{scxprzfIv3 zf<~;?{1QoGN8o~O785!AvNDWA*wVrvn`ml_==4Oya|hlD`P!t0ad|iYr3rN6#-3Va z73g{Lti1W)VB1HsQ|SjcbKOtgQ6)`3Q;%n5lLggXe&88J zMYG*g3?&^MX3UUJ?jFd~xWC6Ui$hUg%gZt8umbe>x^r)r>Km4PQzVw;#O9n@di-l+BSTNKTzRh@W%pH^j!_@0C}jrJ|}K5;M2&LYkxpfsEnFO z=!FnM(g~?=#sI_FcN#fTM*Ei|q!lCCdM_9lLV#@O`X6}|ZyV1hUnC7tMn?~^6tYl8 zvlIg1E-sD7(5!dw7J;=P#og-DI1Nt91Oa}(bG{b2LQ*Mu(`=vLK4IbE0&Z5pD+%Jp z*Z1}oaLR}F*dTI3zsa27jb1el5JMa0XZLY~X35sB zkQ`|lL~TLdRiGC?n$fMzuP+!R8Gg74nFuZF^|!Cv+_NzCt09(^6smCvo%nos$&4TR zotvP}Sb-AhmiUbMigVrW=Apcwo90m7@gm`rn|BR20UB~-kO1X1w#Q8yZRVuN()ND$ z5jR{CaIsZHi9HbgyTf$_3p|o}RurVg#xVYsV#763mF35(YpivSUnC$w1Drd2YS1(t z_xt4w0rN5JHV?KS_oG?!kHgs+F^m>pfVsF%=Tia{Af&l1Etqs-dW-?rLwzjCgLiwy z9bHK9%fLN3k-yg}n4^(q00Z0fXt3Q2Sl_M}rkGfIdS;vVsn8=ZvR;!}vhq~ii3zyI z$DEs6q0P3$QX?6u3;F0+iESJVOj$>g8At|^MZ8YqFi1Z+MG>8>G!~{U3|1=$B-TG? zDk66{cwC*SBhuCq#*hS7^3&w`>EvR?Ikwr3Mg3N3@-^nrw8J63IqQgPXAuWelP@^f z(q8c~(ous=Zx%T+8pLh6p{c>hkXYENSe)Yd>|PTS;f00{fSO_o-!d`+;8~9avD!$6-6S?^( zaO36Xb~v5osYh92Rx#})x6X@Yn-1#^E4qst1oybm(g37}x6Q)6)dP#A+MWlqUukMN|7 z*9_DnaOCVv7(e>Crvohl&8{Os7A;*3j#e*K6sG*>J~;(#Z+GHsTBkp`Zmlf$Tb>(R zUx!q-o-nz&;nN7aC++Msr8iLGNdq&9<4&@cmE{mUY@m8A?=|!5!cyCi8G>vRj^sfL z9>LXPmTKKhL(Z)ul9*s(<#R)UFQ(}S%ijsoq!>tAkR=f!5Gt*71bK_42v?_bHap2hB*Gq}s=^ zZv|l(f1N;RmJ;#bh|3jbV#WN08omnM2feZ@8rK?|9c8sckjy>46N)UFLtPs~KR^9` zo=B%$XS!j#fAhJrhMk$K4Yd~2JAME(2cClDV`h&~$RZj-?6w4NbPp1u&o)SVM zX_d*4WM7jwPB=ns=<#Jl-Lt@<+~Os0ixr)oXG{`!b)KAR9XoJp?;YqekFcY>x*gtmteh#(BYGEZLQl@qbUJF_^SgA}meLOS$_@8$Sq83+i5RV+TR8Bim|9r)>9BBgP?DhYVqHc&i2c& z7HZE*D~QNzIcV9i-AuglS$!c}Qa{Cafp64d@{4&$3IQuy?Ji<|Vfoi0aNPRmn;`RAx-(r#Id~yZpVtoYo<@r@8c;RH7nlT|PZF^?Opf|3n_|^NkS=pNctR zMg!Laja|94R{y%swqi2Fj$9ELfF54&XXP%Q52k*LTn~<1hn-#t&aE_qo_DfJ%tiDK z)=pI0{BpN@vIyd*TOs+2YGOL_@Fz58wziSkOU9gS-t2zM0da<$hhHdgW{ljPJ9nJp zRNI6qcsgOyc?16JXP4)R^33Sl&9?zs7jO=0V73O(5ZAM9xuPPg35m)1c_n&EaVngS zzxUK&u*KC?pVKQChs)XaV}K4a>vPOsFix&u2_9l9>N>k{CytZ3x0piH(^U9l{X}k@ zd3t_|z)H$E^1$(4OZxi-tIp`cPr|xJkn(A*>>E1tMD_{$RVXp=ys4S#g$NEPv2uof zPzgB-H$ti_wFvYwnumLQ-`}%QOqB&L;JXLO&&Lda8oJqd9=3n!xW6E}{&N}F3+FHg zb6H>gU_N~CVIDaGc(F88)g`Sg{|*0(0Yo8-j9lzzpm&xo-Ogqo2mBqRegK?sFa1^p zpS%nCpq7qF=Y?a&_22uRWiu+AFx#q+4wwzg0Sp6D1flE2qJF8UVrK6n z{2WtnW4`ya5*LySyw!}v&6F7bko$}00^HwxvRA*x!P+J{`t>VPZQehBqfkC!B_ zmg5bs`t2uv^T-E>_@B;c%A%OKSbl+IT1^RIbjXaW6I*o_?Q9DKA=}J}<2*lUWljKx z(v#&fCe_^J{m~En%5bzcquAc5cG_4*KD=n~DhjNt);X?8IhTwLA^5KI=y}_+&UEh0 ztnY^Vrx>uIkFO|yBGl-`v%Umq4D=gsiWNl5LR?bsDzcJIkEL*2K&U?P@CF2T@#v9Q z)zl*g!^RdaZM#;u5BKKdh=Zw}+aH=fGpyO=5%JvGZ*B9U#l0GC%UL}Ef(#~Pa#ni{ zoPMq4{2{k^`fR>2NQU;)pzS<4f0O5!lc)`!z<3`pRr*-}eW-}~wV6?A4#=wj4B!+! z7LZ7Lx7ZE1X(2L2-gN>ywZT#ivIUoJKH;nH)<8u03)(HNj_Vh$O~NxqeiX$jDm;9A zl74>Fbf{nLw+EZ%4a>NsfDXMglB~G#LO&XfDkfo6YNF}Fz5MK1hE=Gx)m&HfjgNO| zBMMwbN`$Y+P2lID*LYIpkO6g=s4T$J9WD(+3e{?2y&2~q3^A{Z>Jnu7Q%D3F87#*~XR)3(x?`Hjyjac?|uC%&O)d(HygW_B* zOi?8nIo2|RYx7XYc}>@!>@bWnHnmN~m22_E1CLtmP+|G@-c>7d5+-)ug|Gw+GwLi!Qv~D*WSO| zX!Jw0)BVv*RKeMy78)r7X+0QetKwf>j(SFZtPX=@>PqnTX!G)lIs4dQHNWPa-oo*E;?*9Gc6901=Kw9sywOdPd;65z=}7i!GJArw2)-6ks3NK6G-zv!fXW;JXz=obPc{b4*s9JMPWv zCKtTBrwUMV|E`huw?r-|CBJb`^fGh#WlZ zB*nNnBq&JayKN=XdMp_L(FwYLwfh~eDmR>1`})Fx2oWI0dlvbL_pr?i7Xewmx{-8P ztf}6to$Bi10n9lZXs8X}m`KQG2i!0k2V83bv_2<*c@eLEGRR(Oo=yjt^r(C$7QX)J zyuGt;>foLVVB%l6gs+~H4q(LzpO9bs2Zg_EPU-2f3^;+Aki_+E({5X?rO>|07&$IC zc_*i%^XRRY)7I~Dt}V2+iG{cK=NI#DrunZ>RP$_Zr!hLW6=JyY60T#54K04rs~7VX zYugjNdrg}>e``NGCO_NWr4QKGTCWwf;OWh__k1||w!xX&{1zDlpiGThPX;%5^!=V=*sqop%zRU7xU5b4q!!j+IM7xEEP$*3;=!d8)Ck_?MwG3eIKQgQHifl1p{iQ|ztD(p3`dj`0{v_gSDamrPtBeZY z^5~dAr-RY_O}YA%`J1l;StjxY)GQSh5PdmVh2zHt2}&o7iL7o|r3#GPNw~w9l2l6T zsF77k`L@|tZ?>#?-}r@+N6q)G`7#)k?AHw9WdGineH?Fr?~=?<$#P|wF1@on(TRiqTOp{G+iIiCWXkhH$1Ea49LvmNd-35AQk^2s_?ID?rdfCPwPGhtD ztKSjo1E1Yh?@Wgnh*Sd2-%{BcI-$n=l@ZF&qq2DVkw2D@Oy!3xlNrI;C2_R0_fe1v zaKX6(l3G<*EWRe2xp%)ZxjxyFWn8=K4!n|baqk8K zNqE&ao*g9UW8na2T05tJXV5=W6m1yP`YDA0ba0WkIS7FV`G{ioB%hUsvFo>k)6r0P zGTba(Uh7x-&5Cv|VDWQ#)|mW={VYHI@b_DIna#<*gbo_20JDAr43DR3u7v5r1|IDE zyOwIZM0So-O$wC~WPk2;DfA+I)7>{N>mfT-ExIGxGfP|r&gJZ9lA0C|8zHu#`mFe> zXZ1bayY7(@to`KV_*6X7TFLH^RKuEWW!XAyMGguvTt!yhVfN!t66MD02pin zjqZ#KJYjD?J`eZ4Y?Czfx}O3Vyavwu0E92{-atrNM&|99@GU72;Rg=h~;H43CU8qlpGwynCuT%|qPdY^w_7F_QyVn(O z|F)Avy- zDWmG@i(eA}B(P;AYinwGbf_eg$?fluvvW_kLu(Q7zhZH2M9H814)3v`5|Ns01KVNZ z1@U!WbrUo5P;!jQNgFGxpfzUZ?cWXtA1n3Pi3Qq086&{%0$sa>H#b>YcDqEQsdL0y z*tjvhJ6rcL>G~Qw;BL*tb@~4CXwKd_==0mdRw#3hZxC>z=@Gvw{NUh_3T&?W4C~D8 z9eK(EcJ}6seW*%Ave#FB0>c-9N0Zj~(dD{n8X@m5svs%0v=0_PN`2GQv-==~bMrLq z5_Dv_j(h6Q5um}a9m_r)urEcEIz931!B(*5j}JnRZi`I~W|~t3#U9Z1(W@=RHdvKs z<@O5}G5zOx6pqjH8pt$gZa$4$mX{aP`mTU>GQ+;pr$V&x`zy24a=n6j>hqhHr+;A5 zoa2|8HVJVmgu9TjpUXj7VvEu>dX1ZcQ@$Tz z%)VUaR2uD=boSAai`NV;4XBcRYr3@w@$oOGfcQ)?P_&oZl&!R!Ea2&VWrLKS4|e63 zDvRnTLKQSH+imIb?_f(ctV-uKE>|u#uB6&dJf~nwHKfBPuQc2ZL$Y^=2EAH2wIdCH z@(H;RqkPsnZHuJMeoe~SHd+Hg3Sof1IGotIxf1ggtoZP$<1!YDL%Ec*%A>Y-FCOT^ z{~-tyc=V>Q2v%T;NjArcf=2;Ax5zT^Rse}4uBXE?)~~<2tqRqbh>!w}k3a{o>47VC z1D!AQb3(2$k93B{!97DZ;-*HGV*WIEfuhC6sr+SYJz|<@oS;soKly`5WkhOld!0Cw ziEg)cmi(Z+8D0mYHJ?&;=I(iS@qmg*lN)4`h~q`kyL*>UvDI)RZ}WHUg)`~Zr2RT` zIE$f7GhW&bQwn>UHj{J5_Vs^07eTc0NtCW0i*W4}m)nqfK=^8>*aAOGQN`Gn!KFR& zq`eW#cc8!WdfsbqVWyD85MD}PLds31x4;bu%!}AZN-Bmj9>%7iXKgWpW2I7SFccm; zVAE+NaT(Tv*xn3o1j@3OBze;mJJ!B z%j)YL%X_uiZ`2yR{04@~?z{YCTjbPCM9W~`4vZO+Qa;-$YP9VmX1N{|t_+q}`~vid z>mxIluJikE%o~&QVK7+h^^JkUlJM`{Y0R9zBx9;YLT|UVa`}$fD zP)R8p7$mw2sqq%IaftKleC?>*CE|Im71J%#`~3Mqxh<@Lie{06>~Wf5og={*uYJof zT#4cHdp$~t@6z-97*(IHe})wo0ln(%(j%L~S>N8N z<=oe*$ol#`f2_)R+3#*3$G_*V0q?UgaiGG7;4y&vZJZh#+M39~-Bg=b`%)d32Td~}o7&SufGZB7$ zzb$~A2l1~wipcr}ryh3Cnb3MTK$RZq5|V=vkGp|=W|-b;z3?63&i=%LPzeLE*9-9( z;5)RafJX?WyYnd>w6wLng}hp5QKdTOc-Ma4A|R#^$E4Nm#dyVeZ|$F6Kvp;1>=~=C zr)eWZt;b?o`L(n(;FVGPRFt3#nK7YdE_500PzWY42_ro3Rua*+akZRK6r~#M6660m zu-2lBWc3xkx}hVU%$mK>H}$EhIx2grsKKDV2!0AVRAOg>fB5!7o$!e%TcLoDSuh$c zZB|VjPL%b*q9Bg{klYjYELmq!m2e&jFfu?J>X8=o!AY;{rrDJ<6uOV*djxlXSM1~6 z#{*-*1d+@bP~51utd=nWpzcInf#E-;7?`%0g>)}GNO6y=#ASHCP-18Z4TL}q(@Ja; zV`agGuL*-DRe^J@MjO*$svfCdOsn4PRn#<<3bbYKNMbdHL%Vhg`EPYvDaTRD*J!Ff z&Lj@QdtEu0i=(73^7kAv<<|v_SF5Jv{1H`4Bsf$>qbD#}Z7pBe$M>;poXJ?60FWnO zV{ED2gDfWt9lf`3;)|U>a4cN@W~_6_$=2N=DR0}CqBA6cD<0^VwETjrx{z5aaPEVz z-s=Stddfr=(V*YpTSMcI7Sm>u)?YS)M-;UulDWm+%4JCCO=OYEKJ-&bi5KvaCaljG zw&Wn_{%R4zicKf^wZ8M1m$A25VqIbM;S*M@q7_iFJW@`DEtn45xn(U1p3g9Z9UbHz zaZhHsl+A)!<@QP{ucX?e$J!ThtbJqEonqQ^u~){{WT&UO8_tZ6nd^|0@olDA|55ox zs{wRgnuvo{t3jPlVu`v zKRY8+@VN4IMUBiHpEv`Vet#|=)gw5AvX`9HOF?wJQq{U3s>g3#b4=EO3%%7Ya>RmH zu(wa;bg3m=&v^9cX4m-`z(iuwFL7DLp8s5~cM~y11A~hOuy~X(g`v^d!1S8vq#)$= zh)>MVFZ~$ByY335JTPpodd>H4EH=7#`ZB(}vV7fB`+ENOm=;i@il|pq@8$>bWG-p_ zk9b>e=8XTG2L7=ZIUbmo10`k(^2$}~=BctI3~fgCvAZI{(a;{ti}vd$`S}b03&GgW zk!v35WcK$DCIHH32W(;koL2J(hW^K%BG&`+*DFMU;<>8A3i|ff0MivR0T5$q?!96O zE_on76?|Dc7w$;a@qqhap&8m)#c zJ=6N&VaD12WA6a)`jubMzY*eD5$dM<-A5xM@dCj9C5TcvuNQw6BfzD)XcbrWGhHZb zd{S!-dSpPU)!V`mzR)2ExV^jBQ=}K%D!x++;6}ok_Wvj;sKNSAZ1dD}*T>Y9G_>f& z29qJzk0vrEHRV1}X}`d&D=Cgl_dw*zwLBI(7ax+))-nq6RB1pmMKj$@NKxW(6Fb>w zGS!qM4&dD%Sxkg7G5hYlLw#}9lZ2fLg~!c3D0iEYkks=Y&@I#kMRgrxnPOq%Gu5UC z6E1$-{?hD=@uRROA%AWCl(BbVXpxzDOF&Sh=WJLQV2lCuu*n@Ml-S0qdKj;@)%M}8 znX4T@`JG3`HhOWa?CSH4g7M#Y8zE@THiWJ_ZMY&;OUowCk#kay>Zc3L=qRJ36iN8q z!}@`Dlt@p*|J){yCkvItp|n(k79<8n`?Ch9z-#M=!4a&i=%|=1HA*~eQJR$#_85MiGY^cpqeNJFnQh zilflOGs&&X$x`9T{*6AY)+vk};0?{?C2r)oG0(WF@g^o2iqLebe~^{w1>9tJlzHb* zrw6ImekTC~G%^TWcCS&th)*{zKmGdynV!v-W@vu&dCif(;5l-ue?S3m=GF?8)Y|g* z9nz#O8IawX+;9ASU%HM}*W%ZV_8E}2p*w1Z_pH5cze#>{o%3hvFHF6ZpS}&Ce*m{Z z5{!yA&o=;vb9=O|$52BC6l zbk1}Z*td4@cd{4oLWza{{BToL8TndApZ0|;uCEE83IKwsJL*5H zTz}yH?P4<4)bmJ392%1|Sk7I#1Pcxn9Tp|i%RExV8hqZvi zJt^>*qS6R#?CCR_ZE^X|PQ9w~Pq8hPQo*-{|34M)e|BYGE&su`D9B=}nIpG-Plr}< z!JJ!~LKXR4-B(h>!_u+VYUAkA*k;~?(eeL4sw$@Ebu zxGX2R@o(l^J;-{C^nD3l0Ds=&Hzl0@Ow*EN9&6>>CBE$x?aa_%yeFsD5f@4}=g7=K+zv1~S+dtofMxm?!jk1^HBD{G!O1 znIqnJeTg9iwg$Fgd4#Cz%W_&mhx&mzJUSM=D2pEt9x`uo^fq@XawYG`N{Pw$ZbcJ# zg?fK#{eD2GCbUM!!LT`)MRLjLSY90B|fdF6=aI5Du z|D!2Wy0Z-QbzNVi%qq)h*#VLwonP;`$T*n$o1JnXq5qbFs%(_3$@2bpWDR7| zJ^*(%crfF=&L0Sy~@ z0c7~VJ<3?xw*VXRK1@oucYOQ-P)0CjWw)_+v}<$kbS9>zMyt)4(EzJ;Zf>$bLk?h# z7Xu-JP_6|96BWPOyq|7iX4O)qnwvjMZ9Pq@vozU)ECrLlB0ivc>7Kk466c{{PX5y1 z`Bxot{RG=;3% zKJYL45{|L~l*IjDYv47R15Yf&!ftjB?3gn~cwWDj22-v9VTKA0&z^tPWIL^|40za` z1oX{{rM77Mi@nW}w%e=UGcQ*GcwYL!{e7FehgYH^)75XCm#=7^B*=T7CRYmgcVfx_ ztTRF$P{%}4luu{~LRr_x2ma1blE!~uMoJIoT;}{L8KN`Nd zrt}Ef3?s_1P9JRpFTGLPGK+O90V3keoEEH_*6+&s)(1%>j24HZh)=Pr93r3~Ow2_9 z7OrWcIo3^DV`l2N!vAyo4^9vsg^zT*dlo#W-nX{1%N`v)OGiL?3TxMLcX&CrWd^3} zUQ9wDwlX%N(wGLy!HJn^x8d>O9RK2^>SO_O=cgG6o(J$AkftZa^shDM`WdpMTBm zL0t9jNfrSS5$O}?_1w(MJWa6qvqV(^DS*mtazBVkBj_9K+BBSPUuglvpWPnZg3QgS zS;*z<3Ss^`aR$wxXGtCGa{(Jw5hdvzrEIHwR+A@2nCTVoc>!6fJ_~OzkdwKNzlQ9 zG^q;tU`@%(GW1W^-<1E?{3r0YQLICRk0{jW+1gki4Xt$gXdlf(rLEQHbgz~spg4Gx zU$_J*wB&8Oa0m+X&n^U*d&mX^EJ-%M6S)6)<*?Pifk$xW#ZdTz8x#`qj$`DliLU*R zM=i?gV%A+!^0NzMMHWv5>uq?aDZ1i=2P`vU7U|SUJ7Meq*|Z zZPsr{B;Br#1ms!YhlR;9uYox@dB$hLr_*g95_BfN7QKi*?u?EQ5MJD9;DKh0Yw;0$ z0E_s;Va8##&nY(mE@O0VDuwU~N+Cw?Uuf|1;wz4UKcwS)YRmePlWsNyPvD!sK!jCS zivu03^?36kaXLqajDCPNYtO*3+|6yv_JQ3cOe9RLse?0xD}Dq>)i7EgU-^i1d~y62 z*_vtY>6D<_Utk~8O`N8feGO%d>LHc4S6w=>2PXC%_h2dEFjHA3Cabgz0}xeAyfR}X zb6%zp-$*2k447BkkqYNQ`T6g9PF!Q%g?y$D$C0%ug`~#LCis?GPbdpuue}V>3Xx=S z+GUAJMmPqdwgRn3Z8A7!wsfuGtPVdmxW^uHl-Bkwl_u{$5#UTKv@#>2F z-8)8{=FBlEjix!NU9@-Ze|;&gZX@s^ucsa~UrgRizbwsUGnw(;%8eseLWpYk<=)-c z1Z%guR^}9mg7q?K)9=#ssg`eOM$RQ0Daa;>Ee4hQOLRRk8t_K^J9AkW=Bv2%45z=0 zZOU0I^Y9CavD5{4Y1Bv)(r)Qfs^hJi4$K!vKU1%Y*Kyc`43In0hgnD#%N2cK7-zwD zd>vE>xp&059VLJKJlLk+mP@_f?=Ehv+Bhdn#?kM6{(omoxv z^!iYGVj)$m39Jau)czguo}B$~wV|f{B*g7Ed6Pt%6j3N4keO)VE-4xYiIC2E&@!%e z0;TVf2(key^1Reb(4Eu_I5?2ccgT=@6z7JvG!RLGy90_6^S-h1#l_ef3hU9~@ri_@ zj!Ky7_THg#l$6BTnfnL!`h&Nrt)Ph`Rc8%!kGa}vHA|$_mxg7L;h$&161bF4d2I?K zrMdw-`zJ4+7nkS9EG@-S?E2kZ0jzqAYVRaj0fIbjX8@xFID@muE(igfSJ1clEdZ7? zP`V`=t++%qED1%}KKrqzHaD+9Yj^$=IBl-|k3TU|WSG|%sO5L?QCI2&PU(F|0!~%Y z4)e{X`<=T#0G1jZ%EHQu1YufIOs&c{PIWN-L+KA(-STwRbzR2 zR943?DI--IFG_tc@K$eDUKPoATqV_fdF1|s5%nBjgAJfoD{{<-5{UPIHk@G6scUK! zRV*q1+M`a)`+*cqrEdsrN(8!Wt2oo7u8elc4Kepy=p1vjOQxO^--Qh{+O}*+tEA6r z^2p$_KIT&`UG5u8b(U_2=^_hp8NW6NwQtQRTMrR75xe_8f&0fte=I%**pS*Y z6^~*o>9ccpOXU&s0qe}qD=Q+GPdJPBUy5;>6zH;$MuyEe6izR}>9gdI=5`N(z%|7< zzqsY=(4=5=lXOL+KefCqFhx9z@Te^JShjOH0J)ZBkVZ})n5Cy?=C{-$3JWZSDNRwm z;zdPU5uuV&U37U9xG!F?0({b8&iH|KJ>B8>2${&fd|B3hi_>8)i|yV0uc)?=l7M#q zc3Gwjh8!+>=&Q6S)UuABvjz`IetCHeFBxxLePNY@Ur*{OHiAzkF1x6*0S1`!b9m6@ zse(!I!l$#a9I?Ypxw*%cSS(!EXKlMoVYx`p*7c<6sEFr36|w(AUhqncz43@l!--f9 zAhroW2#E8p6QmL1XuJ)a@&bz~)PTNyk~+&}T`h6fi{-tcVg*>u{r6lt@o)A|m~m&p z&(^SkO^5ia_^@g#iHdY4RzmH!v*=W&{GCpJBL@6OVH25;h~%{fBxH3Nt6GDZuzKyp zdEcOGMDC9OkItv-Wt~ncl*oN7#Thu1?9Bgfjjn>|?`wcg-29#rafC>6Eqf4Jk}LN> zLf#!Dcd5FS?j^@3Db&?$>$)d#Z5ys-xv~?^j&Iq0rXH#J!$n7mJEfjQKb@Y6mG1dR z3=}j^3Auf=1jmKpK8B=6Jk)qz9$RFmhkN-4Zbf=|mY)}*-mi6NX}g{u$~}XeqIzMt zNF)TT1Ya1wdt9eZ8D{Qpf08>k_oh;sjIYL~$N9$X3L;lvXqlBhzCJRM!81U<(ytha zOg+uU)L`WIfNslC(d2N@7yf_{s*~(I66C;Ez@|0`qI>n64_8igt`s?#%nkxEBz6OfW%#(allzP_$u()iXkRG0uRyS8ao*7C2^I(I|XjC<7RDvjwJ zEZY0;l{RRx>g+9+9vHh`6Sv)uAGp8nMmjQCQ|cLx^7}iM>H>to$52H@6c8l!w7X^|cS;cFl#Jt4n%ds{YPNYE0Q@#aaT zECwu9W0GR8-CbwD3$22J9wjAQO}{pCAdinc+LHgv*#tVx z>1Ih6ysGma5w?;m!o<9_y(jze?g!RNyqvYQ!O&S?JP=4lpB&}3cl8`V;P?&KL_taN zmVgu|afrgk`EA2MgL(@WHSN z!kWSqO5JKADC6;K&eQMO@1YQD*5|+}0%fxi!cjqg`>m`4zg^7QDS!5P&yYooVXdoa zDlHWlc7%Gfvv5fmG3iQ$+L|D_zSda?+r6#&lMW0`$Hc;t-%5`Y+8!^=->1 zKX7Wi$D2?Ur5ftON}pA$k8{1AE=NNvY0KVI8s}A|8EM{@*a2Vdz!ECjLd`WSTgzBG zJy}uPCS;uJy*L@ImfWApBx#2Gl59!7iMXk|PCQ!ZXB;^ylbqj{L6I1VYA~tUUjvss zdo;Kxk~iF;Od!Glzi;0qTgXN~ads6jKkuCmMrXplP&x3vW*oKx`)V+u^Q_qH8A!gk zr+(o|Qj z;#LGkuOhn0_gxV}Ba zpb!UIIv|*f??<|SsYCjb??5QuN2%57+Xg@pGt zHNUI3>bf)haEl~-7S_4L%M0wA5*2&L-V$z+$;4&7mlZbV`m!WUXQ4%jt`Ui%~W%Qd6x|ae>Y^scYeb4YnM^eVQY!r_L*3D zjf=Og7A2>W%|6bT7>dgY2n?#tk9-?$IK|m|91AXRH+IGqXJgalv|CCGb2J)niJi?s z{5q?F376&$kj8?42Y2Z6#bcKbffxX(iz0)E}4iMoD-_ikbj*sbH@0} z3Ag5Akl!MJd$HnNEgSrMKUnC+H#oEgL2;v&TRJVXqJ4DT6ht9ZxKI#c_X^+KGTwwW zWh+Yb$U$rJyUew}&OB5D%~oa9^3}>;GO#K=piwKPIjkru;91z2acvpc!SePInf7+L z)4Hfb60z)8UQ-wEBCPMzOWe#`QMibv60R=u!_7q*h~sOy+4#E)@1USMfKV4k&Vp_9 zI3y1{+-mTwkl=}O%8tA&J&vqKVr*Kg3rNL!;T2Wzo8IWNV#d;VF&ia%yQB3^Vd@qM zP**V7DP?3;!8@mT1D2U>8AO~bXtQzTeLK1$*$60n1T9}p$;n6>%v7q0?t9je zUmxD=JF)^=&RkufWQK<^B=8#2rQ^q*zE%o}jMM{4p;R+-pj2>td>Ssr+OvZ~{V-R1 z^77@@pyukggTwN^RWlq`?5r21fD0c6E>sZ!5;Ni6>MrZstV~SSrt0SDOfZd82efdg zdQ^=iukeDOa-xuNc?S`d1TM}^%RdZ~o4^&obj>2Y9X<`z69vaAQHMVOE&)s_?1rk5 ztV1<|f+CUA;}h9=`3&{HuK?vKFs>VV?!dz+=CJXj_${J{d8RM*3Z54vIi1(OBInuJ zQ{)x?sbpGI50d)aLF>&*OwK%;QMd2e#(Sx`a3`d4DIw&}b@@@(!|3VcO8z`lX{ZOI2r* zRWGFU*~Dj^QtyG&k&*qIuR8aS4qs3)U;mm24Giv>bS2Djj*GKv*V1~>&Z=Z1>Rlhq z)VhuIoEcp)h+<2xlYy0`CCu6B} zOQE7{POx>_N@)*cnG)YvkGwLBmee{fi9z3s`N693w&%@s40srLzOP4w9d9n z?l)WoonmQoJzOINn8prLoigSu|NRm&KV;MwG86Y3%b9R_4h98uLdgoedgJ3Vd~oSD zBX0^F&7CH51&Ns(gSBEg~GtIft`4UsSQ;Lv<26 z2_JTFmHq7#qP9|QE?O>PqQ^Lsi8cGJ=A0T9=3ZY+4#!YAaQ7deQ=g5BCM7R}h!71% zJj)(k>(GeDTr{IqZOpx96^dYouXVr9@_IHTO>yQFV~6#@>yEyOMfv5xy8F|MpP$K_ zU2(+tCWy+;LYRWsiMa;W*Ul+wh*>0g17tuoZHb|4NgdOtb+M?vI?Dr+? z>(nO1N$@6?UNR{Vq&-2A)klP71ZLK7WE2(>9P46r#}g2^W2&+l0F?Oq@5rP?!ZaEn zN*CBI{F|oa8RJP6Q5Lp>3L+*JRUH`>2cA!8|82=ILJn?6aZtRcfP7wqC26+R)_de4 znwA`>PJR0u-?xGvU4yHuA2v77rDkVu0U!s?qn5|vlC<)L6SqCHv#*BIXb$&8d&L6Z zXlR@QHj@4}XLa?Af*!t`n9d_t;*zXAogvJxC7F}R}1KxCQCyPLqf;xMQMH=5{}~bU?H?7D5e|V z^8d#rRuu9Ngq^QhkX#rf+KI(4>C0_6esRH9jQ|-z8N_ zEs?<)w>LrKfR<*ctZuYC|MAKK?>cChqS05f4gCA=1C+_AoOa4hK>pyw2)KUf{aMx? zl+d;af*nl{zPA|xz`i%E1C-z-M^r*AcasB*;O)LOlsh66bePF{+^55=*AMT9ldFpj zsN-VEYz@}+F=Xo1py$Y#UciRIdH~SVR(!HhCm1zNsm3cc;K^2{JUm;+*fqRGK2T!O zxM)k*nA(7zprtpcV%uk$iHABB(N-u6cAT<#80l%wmsNn^g*q=bMpg#9Y=ats{m?)c z^21cy{L!*niwge)5uN>h-Y9Lq>=!A4;5sa46DLjefe^B z+?(-8^yd#vU=I-<_a)HgwBbqTsygL3Q0FjZ=6*|jo3k>N7w>$dEO_2KtH_{UllJ&4 zYap?kPHu_*q{v%7p?z6g%OGtX?)C<)_yn#H{EY%sgpnDz4p&Yz5Sf~sm8}cWoVjpQ zRQnGJi2Yjd-SlB*vlr&z!3#;{R|AjDSPRFEE#u1k3lZ%GT|^Ld!8XLgZ%jwbxh93E z--4~$BKmZig^BXEm5$+0*C_)YG{BiQbT+(;8}9vd3eG|ne`PIcCx315RPl)xYX6iD zkwAMu9s^Cw+F6843?ZCews~}I3@Z|9FTXm%7&Z2Ye@gJJa6pMgdyz;zL7H*4BbbTK zKG7s#sQG;jF;HR?KNTt8ON*utN+6l=E3M5m?!W6Xbkr#2mmV!@iY`Re$|rutxlv1i zmek;ng_Z4ht*tm%uIO-Uqe5LUTjFEG^f>JQkE#X@ zLAk@Ik1lQ4;1ozo_daYl>_{7N%BhnJht^VX-Gdd)8lM1FDlO!ktf=-;TO!lq7p9%- ztSF-fnvW*e#i)07v(_}%j){H#!M)l^Q# zFj#wbuyhkJCut@nEp&(-Nlw7%D*7=UjPy=zP)?bhe9=2irGaZz!=LqWAgw8QepGFG z57w0;T}WEnTw_~*A55`Z2PjZ3@VUgb9Q|S})Dl9<7F(bt$7<@nH!Dn4?|j}&#rd}A zmWBZQDjSwzhsRHbJHsH)CgoZ&N8hOr2`=P;Z+wOH%ic%zv zAhLS&EpSN^F){P?{XbNlbyQYS*X;pG>248ecnIl6T3Wh6O1is68blhT1*E0BrMtU9 zy1VP!eDApTz4sqQ2jkJhIeVYA*P8P;(@RROa1R+~LKM3L?=MU0o10UgTjn`z9%OaP1;`iAMKW`duM_s+y<>1Ps*f(q6ZnG?(4xx^8fnuaY+$;g=T9d%% zDf2=Vr9Z!rf^GNAv0&Dyee<_G88s)zHedsUk(i;!Lyo`Pl~-UD>EUIiA1CwB=UtCT z;7#3S2HF{qh1lBu@X)ODnw;36vLGJ&ZAOW#$u%-x@pnBlh&nGqjzW_=P&wI2rA%ei zSSAW_AwW)wm;UDfPhWv{4}E0nFd_=uWUAvPNJH1mQ;n-s#yUM zpDK`6EcYc_{*=dk)~@}VU)SjJ|-rVieUxaV;~Z&dR0; zG%_#@bBaB9sTl49d$`&qkmug5;A#&g;Hdu)1NwX<(IA%JefxR+W~(u6h!cbZ8KrDY zJS--d$bn_nJGSWdPPt#n;mXT8qdp`4)Tkgd=ZXsQ`w;W}}{e!LH^t#w0)Y1gT;>@KiJpGlo_YC z)p)95B3nNiAD)6%8>^26(SRD5uT@|8pesqY2CgE6O5f|0|GSP=b_9O%cY%~RE-_{D z$ZfAtR1d*Ay6)iW#ltGCuHkiU1$}{ln$cu8!95*u;`BrIOTzv)E@nMx|aR z=-q1}sjpD`Uv-B+4a(QB*Q6c@?YqZS(Bda*y&(&AUOmkFe>!oKFRD|*FTJ-R+StEf zjsw^}qKN*=fo^Cq>?fAA{xHa5QHa{4SPgB-yb3QuL?A+e+CiqDBziNlK4PE1ZjL0u zz|ND`k4hfJo>$-lgfpo%vU({W5;yLC&ug(yAs{~n7G{}Ktwfk>B|@O+P=x+2tKg|x z>O{lsCyFnToO$tit@u7Jb38u$8o`_@yl5|x_osOS%g!W7T%wBS0l|b5g`lnQy9}S zl{lSc=H58+FJ{zi$yc=BDH(y+YG~XcA&sxL!uNfcuG2#tJBoCI*z1sB_Utq)ZSxpK zVODBd4S7CM)Km=|NFvd~-dtbSRsD4-86$Y>%HQB1CABg2rX$Iomn#J69zpLI#ulLxZ42y0`Koclzww3lKnwrrd;oUW0- zYqczKgb@taHKD>0qYYVZB&~l(y9TMFxyI@)_wi^<6rd zpMI<8-KWRd^=<(BmPU>EJ4_&jl!Fjus?Y;nkYv48v^3SCnk)RFbzkyoOYmB>AUL>0 zH_-aDEwZW7;_!I6rJ7M5)FkYS(M1^ap1ZiJQ@qr#u6!@Wlu+wKw7jgJ(F8D?X+Wg; z@hEW6C?Y<|StxwmwQ3nRbh08a;Fi)EQ7|iBG_IN$=fL7f>$fNkTkwp;@cB0Hzz`&w zi{y4F5s|F+Z8@*D`9mKz^9d672!c3c{m=Tl^cru0na(K09^!+jOsB;1OvV8H=3hjqEty- zW~%0A(az5n}AZ}nZKnenh>nKTi} ze-3LnQK4kzz9quq7N`9N6jB)90#k>~@`Ou_D|PISlIJI_SyQS%a7&F}_Gb~Um@`dc3^z(^h=koVHDOYgbMVY@0OhVA|=Wtge5&c9=cn{47z zCk`nMo{n%70izZ;qC>R??!H`O-8PYB7#SX#0XA{*$$*GMJBNDruiT^O(`723z~mrm z?W8p>I7WA2tH{hew-Rry@V&UJY|U?4t>JShWD~i*=I&v0a&yd>Z=3IYuFJk{K8!eZ zw?{=W@Q%b;7DT|*OJ@HKQgBF5HjYffu@I>WR$_Il0nCZI0VPjVU zxI&Hf(x-`vF`0C{@SLD{gYDNZN)@>gqh$Eg7u`U>baH(?RZy^pwhe>3;Cmm7u-iZr z&Ir^yOWfDNW%2(uS6aFOAGJ%4>rhx)_&)?hSy|b0piqUXdpMI}k&8_NDFoNe84kzI z89+ZDJFtBV=mxUoHM^?-x$2#v-ETaQ8>5T z&j%wR5=IX7Gv}%Y1e}g&t#>*?4${loeY40tlx9H%T`Oik_!8bL+!Y ztS?4rfnj-P!34IGv-4{cTg}JaJ?j zSLyHO5$-DymBPw|Fcy6b72KFI4JgdOC(2YEJ+dKaq7Ehbl*nMo7-8q0pA792-XnG?O@H#sS`LVc?fueXNG|J3=H|LtwHPh3n9tDT4x^;P-*(V zS~9M1|B>+%;3c|pARVI3;Ql)9O|qw@nOkX3Egnyz)D)Z9DqtbiCg_-3$~fE&qUiS5 z-&?G-bo`D9O^8uyXDNqt{r$i!LHnIW7S_g6IR`1YBTia;MIlfmSKs>2=!PR4a0*3; z3BR@)Xs==rHKdc_+;$gpxqO2^+lOrH@CGF zHJ2;@v^u($jY#gclR1JF-UWPMdA-IJ8xHR6nHWGgYQ-rzM_*|^K}*bu0yalQo7P7O zK<>Q(W{EZ`zS{F1{e}!X?m>V^9$4|Ymwe%YlzUz?0RTe^XT(_`g3y5ev1X(XUY~V)%{|1X}tiqx__M>;P z>N@O=U70Z=TBS>)>er2XT9F}{zJbtb?0EIpZNW3W|KEe^OAty|N)FJ+Q~JY z{io#`0UCq#y^BgLvFZ>UZkgo2ji%=DG+N{6IUM4|HBNuh<6vk)_<&7?L;d&Zc%mJ1-CYIIv4s&!kB z@Rm(YYDY=3B3by`e7)4QT)Vt}yRBc6Rh$Cgl+aJLt+(VLc;O@6?!m!oVUbI@`8mPL zL(%cw@l!j#-~a%&R8~4Z)IMLi66E%AwLD>jy5U&ILj%~XMom_BvwfLMN086*oNvI7 zTN9ujJ`(siMUkxPr}{X|uza@ATsU8DV~EBMXj>EPgruaDB%G&(Eh1|y#9V0hK=ANd zJY0o!!$&ON%Z4Go9}u)-%-Fxj#W>8pOJpuHUmq=WDXWX4N@R$V?~clUpybfgV`F$7p9qZ+ zDi$RIT#jFShadz0fFS`5)Pi1_UzLVE0^7-B`as&@{KA48*wB;G($;~78lZMl#~ zR@8ICTf4~B-$bsOCd$EC-s}zGV9K4IN1`t3cca@Z)E`gdNez#KgBfdgI~)&?oGA1% zdnU}V?a<&j{xni6s_fWusd*AHOgCF z=zB&rm{-yvRfRh}dlhytIfc@o-#y%Sj2@S3(V|_3{DE$v9z##M)nk1lYvM@Sa;JDt z%n)(tvr?v&25pI)GU$_hndHCy#ld)bh?{SFi;aJPQlTtP1~-b_RA{8SR;nH zqlIpEZefE86+?S-w82H;DX(2#T!r^vU8EHuMEjFkavLmV`?9whTH)ptp5FvvuzGPC zo}IO#AIuNtk_k2YnQ95V;`ze;>;SPpygj_uxL(g|Og|k<$LSCIh~~PqJW4FArq(>2 zlXbM6A6qqy(zuC}<0KeLbqYCzG(=;ghIxzsITB4&y(TU>XnM?2P1f3O)DzN*4_soE z1CwtGY7KgeB;dWcoHF|4j3LW8_J%C(C3d>=A(HZe@jD%uigTYahENAQf$G3pT%jJGiZVH?~T=iZv zR4AyIr&kNdr{Vhi-HELaaMC%fLJw;r^_SDcfX>u(dFAus$ie#>K`dF$n39yF`N8gF zRMF?8Bg1h!trjb?hfZ5wwXKxQn`oe7w%HTERN$7RwDpwpdB*pW`N4GsV1U8vFaV?J z<{tz9)lDTL`K;qmJb*LRXQ1#pxuuq)K0e*aDU2vX;@_jbGXEGBh(*NhW|qp}sxL-K zvIgoS`Ly)6c;OZ16A}({B!KdB!;>q+RR1$uGBS4POZ~-oI8q9H-mq+WRa|B($t=a@ZRHw6ZdU%T5xbmCNm=->wpG(sY|eSZElA>tii^yTd|Y#(7(}4`|$$U$HyTqb#l-RwHkn*DA+0JpDre0PBpD6QjF+9dJVTdDZ{Ec zhhtPuAo77J@!Z$-UnjTF{amS{^l1+Bl0p+x{TBjw=H?4}@G9QiL~gCRiKtzE;k{Uv z)_)Uw*WJ`oJ-gyltW3K;@`%`lKNOx^9CM2NFYEg-z0r{WmfRR*Y4R?w}2R% zVh0aTi@1DDP0!C?p|+9moecZ=a{g4c*I3iAP{MwGN1W#1Qp8cEM7!YfO@TYlv007r za>T98bsNT(Mq?AUQ1-LQ-~J*cMQJ{Ex?t+i35zeANDg^g9momuHJjrbu+(X*R*uPW z)@!wrm{|r%Uk3xz9B;8T z*Qiha&_A+FSE(M(D~jVqc*kX!&3FXrvdf@M-uVN))sUL{4ef;3-jr2Axh}hfO!YWZ zs&v&C!Tw65;_6Cy8`c4quH>u3UH588(}wZ+sY{n6(uibRn1B@Ua6d@D>WGK4JSjf7 zyvq-RpvXE+n8szW0}=wm{>E;P#l3hjB(<41F?VV^eG-{7sm?a4kD+EhX9~3r~ha%>$qsun&*w5UF@0%L>)o@y3EvJ!hW4Z z8EX%Ub})QnV{5FlFf7!7DAH>>Iajj@wRWQW+&Dh%X83k^X9NIYaGYJe6-tv~+Vi8>IH3}-(j5W#=ygCG?SkPKmuOP_ z2xt}_j-JU45@2em$w|F`fCV#1CHe&diI7C!d)^oPlJ%kWY)zNI7y-?XjDNsE*#=;L z?@|4WwQEmKM##2%qm8`QiS>;~rqlu00Q#!s5{+xADi~kiD{#F>9v}jD_x3ivn4cv2 z-ja5AOVHwkU0gb!=K+V7$oMKSTW>~iU6%u{l-DV!*(1bn`xJb-0IWsyUey}dGGd1| z={96!M+Pg+*Wc=@#>-H2c&BpnNKvx({QVlsUnsA{1To$@kj0D$cob`!oFs|O>V5U3+8yEbyO%r(UWBb4z0U?op-1C8}%Mmy%0by%re_xA{InaOrFxT>= zsIdo`A!mRowfj7@a9^$Tzs8|pcgJHsfMrt!0=wnr`*Q29X~vY37~f`rrA3GROQ4#b zt#`Z+GY{`#9T9qF1vjthv|I3~X}?6({Wjmoz#vp?v3$&lS1y-c%C%(7A?nDx^X$u) zFFQv^dNXV=ZT=Kww(efqy*wtDeNV)_bGHfUa~Q535dD?v@Z!Gcgmgj~6qqu$=A?kJ zd4r&%kCHO$M43$*8Z*2E!iHTvi;Ix83nE5*3k=vl0;v&0=?Woug{KVuBYGuDi0>pU z|rWg00o%=NMAoYIp|jYWN=y7(ST08uRj&W42$Nm!ZK*t7gEZdqyxKr}cTRySP-AZxztWuCN4TuW zPwo&XD2R^$E^S2LG_`nfTsa%*^7nG-kT_K7diFU)Pm|GQ1?j1M$Xly5>NcVQ5w49! zmmeO9y^{+;LHU=+o5arQ}{n9O<3s6HO zx73P?vtCmA+gW3c_J(MCT!vHKhwg(mm5?TgPQ{^~zFTjyY?q<-2q~Euxb9-maTQDR z3}L0>=G8YX;!gZrx|gjIABpugZazeKw;u~7?kG>J=Q|S3TpA`pcfk32RlH+1i?n2b^aK{Sh zI4-k;j{AK8gu}vw93v~M5>pw2lYKzEjc;O@uX$s#O_XMLf1ffbgaTEVce9G15|RQ) zEUPEc%2rFPO@;zQ!iaf>IrBBL6B^O8XE91|zz*8c(F|c?Vrz{OrW0o+1UAv^>h20$ zHn#J@5oSe5!p^bn<3OnO0)%msc0&fFj>t~@YHbbAmQ?64TUTxZTqlt^sVzz@dz=d-S&LDS z*Vw$dV)z~ud=D_I5GIqQ0F&=eEhRy&@29ghAg7ZPt!?abE=P;qj9j{n{brI^yDC_0 zDz{B`XPxFR0XhXL|LV8(x2_g!HoA#RU-Ct%vCuFhB;203T8$QJdHG?wq{8^B7k6 zWLPc#ii|QLAz?b>C)PKRDZ_w4Qlk zzYZz|$t{tMnpd@&aucTrWU%BwZ?ADy=VKb=cTo-p`xWsr>s_-gjAvWPM3(F)MY{=6 z*t~01bqbo;zgokja8mPmzNZ`NNmq*kMT}gG`g=P5_Yc0vjNd2S{+|5{CnfUGVu94f4^Y2^YORgd zqkv$tgh)TLkFPqS1oejRaM6hhdSjV%^}JZOWl0*I`NOvA$PK$Y62Y|#^jrvaDQaR* ztt9qj>Y%=qav;Q)w9qVz_cRAbWM%*+F;@#H-6^U?@M<#7^~u9M9!LK$A^Un&LvRF% z!AUNRT0i}gog+T5$p6ozFmqCvn)96j`4W0tac@?;E5)Ok4Zc|iwi}}y>Op&=>#LUL z)w*l01$wqo!W^2dCP|{0WhdB$X-Fb&5P6gf^aO@jmi@mqafx^Eo$L~nVr@#DvVPX_ z?>h_}#8b-1X>lO3Yymm2G=In6TwZ@%UrLqJ?yI28?);ZK|a7;DS8;!v?{<1o&^ z3K(b;WcF`aIibNgp`-KqykNCa>(gRIsL59$u?vi0IciEOTMrltT4JMRq+so-!OTUh z!qp0h$sx*!t7ydi3p@SZd9|r~s>pG-wxEYiwmA~`Tq_-)HFGs`E6G5-0Q22KJI7G6 za6G28TT)6_Kia;WqGW09zIkJ74x%~wPnE4Z zM9Cz+K!vk!GB&Cffy+KO#eQ31_XrIyGI@U3E6;VJc(YHrZ+7No{p!)I&b2hI*5x`p zo>yZmGDuK*y+5mhhORjbQYAqgaoyK_Cw#bE%+VKO%!z!TOHNvol=4$7n~-EjGn$`O z&R>og0U%`G1E$kMjcJiEkig)rt!BpRG#RZYuNQ%NyF73F+YDyV#0j0QCYPhmf-r6a zG_wATr?qypGz~x?<1{yuLIL|iLP7;?4$)mfQW6~2F8g>?+yG}rp_1>mhGYe*v~){FTw6wYk!6TneTAg@L_&(ssIUlIsdzXX}H| z6E@)JuuV8Vv56q2dmm9HB(j0l834?)^6_n}yw&xls@I8*Fp8(twzZ`JdyKGUbJkJ{ zfRH34xbGi6J~aAX3pre>HjbL1aP4Z+;rm zG*Y8&ss-<5FpIgWp;YZ| zAUOvt*fhWCV276DCfTZ4umLF~EHVQFC}>wNQDhgBDB$0JVXOjbkGOoA%RI#qNI$YH zZH`$^XJWToa#k-l>QVcUUA;JUIgg*R7;W}zl){mU!0gZNu(3$FDz~Lux zST%bdgEo%b?jh__tSHSpQg?XS^fuWyOnatU?`#2q*D+t!Y@A6>DJ*$4%^?=J_b!{^k61 ze^!F+*ay7Vi!RYcI|w(tMa>qkO0_=BjH@ssD=|1wU}DxBTx6G*lchE1B6d^wylz2 z8iww@>j=SzMSniQ9~>DvuSYn_p;+#oRKi@Sp-bdIhTHkkk?SJt6mf*4WeMWm0IJgQ zWK;^M&bAP4=Z)YG-?u3N5_TZnXZ4l6<9n7*`tI*Q>ItPc2>(HyaNpgNVSCgt$G6-K zE*Tfii^-85dHj7Ky>b9o+stF(tXBNHV4iGpuFzs9C4Rp$=a{Q`uU(=>t5yGxNs-y+ zkyMG$=&$^fV%;|++Lu-%nSG5tB|fbhGI;XNO7XVS&V8)iNC`2-r!tFUn>u|n1&QT!*nUeSKqy;&^u~4f^mGlRj(bP? zJ}FImwfKNF4Ko~A+>>ke!n@ve8XDwk%gRE7_w?YgzI*UcN{|}mt7#EH8OJjB3e^Sf zC15S}Dk&>*B?>a${t?l1J1zX|nrn{nBLGBU>nSF^Ot5IWX=c4uGme7+$m14(an8t| zCu-|2CH8C8n}fr{e^2+v zTcE>6O=J4d&$Ycoq)i7H#Bd%S4czwsaB7r(D23oPEo`HwUVNcrhUE_nE? zB;0N>W2ldyCuwPRLjT-!6_!;$BiuF8;e?63TTAu^O)1%l&ZrnO$^Zf!ZI4R(J*Xs=X;*?G z(%U6v5fmtB7w^7)D^59cB>z>Joz{5V6fa9XfI6esXTn$OJ4^XrB>*A@$QHx@V%T4D zF?@l==(EpNIxcA$SJPJF<&O8{whMp%+qb=5DbU2fB((&7kup&1<8^1_8H~~tO^bOb z^)tKk6p{@&?8n`juvnE0j8fQ{#Q-f1IiE)Qh!bpL3%HfK38dO7>~@*5di{!O2}|TE zo%my-@rCnbR-|dsDPw!4IOJm7mR}u5!W+1+=WVy!bc}8on z8Khm?wsn9_;TiD5sBhJuYoDWUMH2KM|0zCQka_!;K?^;#jr49K1KjJ+1=~ipT~=%1I8O@cQ%RCU!wLAQI^AD6A0A#a6|GkH8Z9IIBT~tu$_gz6?Nc(2r@!UMd6)SX|59{8j*DY_tLBg` zZ;hfgzKf_fZu@26xOr#@21m^v%@)xZCF=8Vp4M}DGDHXNs?gs{bMpQyEV7W&Fcq)* z2ic!Z?a6_xy%Rst#HFvfU+y>PEApo!aed0<@s8TycT3_+vI~@k)XT&A(~VVP_U5hY z3voRdA2s}`CnkSW*m)?9PfbXg_UyUJfsRv!?FuGjq1&qM7WDMCZSpJY6Wit3|1?pw z-PY&j#n#uG;J{=ThM^Z*=1s)ACMk{2O@X;Ztmcel)MKvgk5HP=V>e7X${{GX2dj5FuUo{~3n9l&Obn|N|IPzrOh=*T>_oW8Z% zM&b43nDGzr%@I;5m&2J`+7};SQo7-Vr+lbMNl8C@dBuRC=T4vN=)%GpO~*t54h4lM z{}ad_Qxf2 z0VngY#a_dFbCANL-*)ol3_@-@Xf99o*dNAGIbqBSF#GFG#fsqjl6aFxvB;M^^WyM- zc7|8+AW`owU9Jt26O95_&LZ}TR<^kF{T~T0&rpPG0qI|h)n_oK^T>m$aF+m8Dl!|t zYA{5iw_2G5u{fueGgm@2&J4_lwO#t)>O2*LQ9RII1f^&r^Cw=|($!1!5y-AVvp+#x z^-QKC%o&(y)-u)bv8T8G?TUBvvn?S$3(rWg4 zmrNXvy)~Lt%u7fsxj~UHGA2doxa z0`(uxke)VL?}J~WNQ?@qVTEqkBcc$3D|uVOt*3VLL4(I2I%(9$z3FPggYMh zf4^IYJpqsFa^_lzKE8fyZvc9za{~ngs_6K1Q30?g*F%ldm>UlChNHXw49MpoB|QX< zArQ=ww|z})dqjb$Q0BZq?Q`8Y<5i!#Fi${CyjI+NUw4qdc_-E%=9+^#6d!-OYi;o+lssPnwmSG02KSJy&V+E6jgGjmgAvGP5i^7SK6p*hf{7jEdTrxY2l-ByQ@#i5b8u(hc7 zi-c3Nb3_H=$eEqZfsgSbHD*jMq&EkuTE)4%^-x$D-r-ZL5Yj(CN`^Th17F;EB)N^T z(1Lr79h{tg6aSdeiVf)jNOZZPjN~@HD6pV;JZ`u_4A}1pI*?{Ak*To(HWjDqi(k>- zGt!N1Z2SgXbzx|`duX_Me3B0rYDedmgQC8v>n(-HeH%*QWaVc6n@K?vDsF@lc`>oD zFf`EWnKofcJ==WGib7Z3PlX~12t6SNA6*XTrEE(lCis)SpKl61kthgW5@Vg#wNAeT zpMw4ykoBb4wj_YGqm>rdq|{V{iCo1i9Y?BYvw-q31Hs2#zW1oH08!Gis^YWcvX2TX zm(K+7*GsPWbFv9@bGON^%n*ou4=L9R>A%c=P)ZEY+*0|P4;sRQIt*gR#(V%G;%AcX zFP$0!qP;GRWPpkz^WAj>QQhGWH+hjSAGYF(4oWhhlmx(N{vaF_RJ8FK5LJYkS5)MW z@a6_($f?%x6qjlr9&^K&S_{!uAO_J{U?%r zogMJ`aQIEze44_$z`tsy zej8{fQ z{^(@Dab<$|)UKxjUWrI?YIYJNb=8e=#grNOc>7C*MuaUh)Z%yQ$S3f%j8LjZF%&cc z8VM+KIj!e=sS*!98yG~_u6P6s%;*mcPNJX-JXD=HsUj-_wz2 zOc+GMZ?(&A*b6m}g?^y8{xP!b$pwXfI6JK1bHRe{a|&7kvi6r#>JB%fn2;PWQX&Jq zgkbP6-1I5SX7GsnK10FdSsMte|2tr+jOfV@kOf%*BP^V}tNSO5i|+tARN*%A*&biS z(&w&HQd3Lo3(&!wx(d1d1R{NkoX;caMYl&F#>s&?JPux6zd8IGjbyF7Cw=oJ5h!Kl z4y{A<)$fIIfOn$!+Sg~!9_D&Qx|&6*O-T6W9|%$#2Fl3Sf3I7fSr%%ozno9Yd7Y=M znCwqSh-F~{Z(vSkQEcno{&D5@e9_``RC1-$kftqZ( z>2erpK8UN<7(acmI*voIP%9FIS*+xiN+1y5yjn@DH7gSNjOeGASll3W1n;s&WuEWZ zU5l(sykXUUT`1U3+&Zq7GB)XkMpKX#ZvhHra!TjJ`PUC(nWC{mY)Ump=qE8Jh8!z8 zGO^n!>Z4W3kZEz{cw3uzYDx!=6$sV%Bm_qjJ4cC7n{L_rngGzK04(z10SjN3T|&~c z@XNu&i)@b#q_u*U%IMS-xBC=|2+@Xvc*|w+ad};xn5T9!;EK(5D+2MtOV~|E>n+za zRt|_QtVmSX_Y7w!sYAiwe+cj4@w(yW((&cUxL;gCB)`3K^^q;t_?Pi`{QUjtNe{?1 zf`Mklz_JWYWNQaaZ zqu{+~^pu_Gq-0fV@R2qiF~otT>I0y-0SaIR7#89xO(4&d9pn5a`z zDbqs$Br`~f6GYMqczX*B4h@0aX#nany*`q849NalP}cnX)ChWhc`Eef`xR-F{}ku> z=2?D=z0!AEow&Gg$&P;k!wWt2=mTVvKafnQx8A)~LVP+<0Ewj5DJ-Z`04wWzmFFuf z=}D}AKaWp~7bbsc+4qiwHN>^LSjKc10i;*}Wykg^6yPYRS4pCrtYsG;W@qyOF(rtW z2eLU39|lbuFAW4CV0!!t_dkB>mzyW7J%3stP1mg;hXH~&_8;#Z*Ie0J@^Vdkx5K}q zpx0%zF;t*Uj|gWwL;XxoqKF-O&pH`tp4>Li@qsPfbQ=%ozWkPpzkT7)NcstgQmi!w zbz6MAu$Jl(cisj*2GN0mRN$zO6l{U+TD?d1-15ug5WrVrmD!$Fg5d923LE&r_lA2k zYXb|P5yrC!>xWNJ?3+a>x9r&PBY)3W^pP)sMJqd$zUA^huV9RgqhfSFzN;U* zge(9uoIo9X49~8LXvq>hHqPtb>S$bk=5!>fj5oAgj@AgJp9+>_@j|V``VbdOgZ-<> zhqL!kKS+4LnCDqVN+M9B7GiY8X9=rk8TrRhU43< zZmA=Sp6F27M%i)FR6gf}$Ont{9V<6%bNtLLH=aOI+R0GbB+Qz$8m%wb@B6IKBFt+% zo!YO*41i1nTLxDx&LO~?0ac}DwOHo|UfVCh;c01y4`+#yFR)X;`dhfGW1(I$?^8kF zVjx`zA;q`eEPdK*JeYTWkBlq>URMNPxmLV_4;MHq_bbAsa$~^TIw3IujJ^fYNch{q z6Afj1v^2tZOmbrWLQAg7Q8q*M1iLk{O;d9D7$)ec0KzPgQ#GnqMAH`EE?@ifgD3JO ziGdC;+^Gk(3Wnj&TqFNb?l9xv7NtxMhj9dcFM`;<$I+utAeqj!TmCg!ylK<)uj9yE ziIG1uYL?q(-U?dia%ckS#U(RjRV_5P>mzIFPSX_{%yOtE_BHH0t;`x2x|_-x^;Vdy zr~v6ve^5~@CPEH0qAzjE_U?yi%s}y;D#+Hc69lbM?qMnVvG083IYIJ`dzkN;LQ7lk z2~@buKZYF-@82ht=?#Co9b9F`*Y>-IDmci%A5cBVc_93QBbnL3frFfRM{ozstWs4%^|B< z1kSf7!R^U(HM~dXYnwSW!cnk|Og*-Uy?aBBS!yk8nkWP4&BgspufBmOE}}Wrff@6n z0&Yi-*Tp#56yAvBiZ0gGDgvMpR1Qf2lg+WYXpuEazmi#JOuc)qfVYIlMs8)b@6gFX z=qx8V^&K~R{%l!hvS~TB2*8m?<^zp#rYraF5-2te2DP#L)r=)`-bm>gcJp>xAIa<1 z8W=D|9F{m5y&hAO)3?dFgnrq8lGrq`?xvWib;WXV=?q9R-a#jDW!u&PSCzb4)o7X zX2H+Y>j4FE*87%9r`&Qocxc*Pn4)FHZJ$)n{m{B<8U_8*ex}D3b-EO-#+pkfc%`)= z(G~rT#9IKgTYOGZfVG@~if|LO+o5G{x}XQ4ux{_Vn=|g7E3cRB9du^Wj<406hhrVn z+uoXDz)E4j{$!(y&Uz;fCzD`YI-|AF2s-V{-j=prjrR}JBMwoynEsP6OP}&?#6`cA}EdxPq_t4P1~+cW4|UD zxo+vul(v=!e;!@baqeN9F|1W4XypINA6U+?iX9qh z;^wjS<0!C7`=e*?%#*;;dX{85>Kkk>{JtOG9_g z4E5W~jXOI#ze{c3R!abEA^dYGGi;NZ~G;UL@fGt*M~x#e*TgW=ao8p z#q4(j_;GP=8{aP11$Ey4TId-{n`i|M3-=K{6wssiwM8(uh^Ahbb6cjV&<>mirFDkBkYkh0x?cTFLIi>1&Se?S-eMjQ$?XPCe_ci13K+)%>BjbFyrDHdR+i8bj z%9CclvN1S@#<$gGw}=+yvwonfT=M()tPzNw@F6#0NZ;0b`hgt~Jl4bNu9t z>i8%9z@GKHvOfA%iZF0x-PF{Yi_0SFu4KVKNKDP#;?i4uP{|?WrY^|;tIXPe3 zU(C`aFxgOGg`QpU1&=zX&A2oV{ky`mC}ePV-%cT8l_W#i`ggynzWlqP@Eg@3V^fVK zdP50*w=Mix#H$ak3PRN!@esYqLCeNv>gbO+-8S%B|J=9tZIzXD#6(3=J1C4g4Nu!= zhyLpDx0V^<7t38j%xyQPbUg_&enP(Mz8TcPmrvXMyXjEjrik2l{l?hX>H9j($jQGS zy7(q!LP%hZ(I{jXS@6nwTjPdn5tq+Rf=}~HGOBf5A(xP((P+vKY`#Yu6XMn(XoL|g zztQ+2i~H#VbgKYJ_#!T_%ok659UbsPm*9_HV_1BV+IWj0Tv!weIvVEdJ2R_4c`fD8 zp`XtahAv#LSM6p)X=1$gj`-$0med|>;y>zSuX}Nwx_$E$dZzo9iBY@aOx#u4+Bc3n zFzE2f1(y!)+UH2wYQ8Gnj9o(1h}0$#TX&+IuGRgs^o%pRz&!*dw6HzRb-8mwq4jIY zepL;-l8)68lsb;Ev$N{3yV{$`lo9VICZDHsebAQS+T<4^c&((XD^82k$$|o;6M$XE zozZyBWW`x&ta*nJ9*3nnsjyOt1+Cu$@zWl_+|9ZsD35$D~uqE8|gPY5eElYdhgYr6g=V+PBBsu zU~O4x5<-{~{Xen?t!$GMg=0rj(K5aMwGS_!=dDH;5-5xjNn^)-KwI$n*>U6$#QMD9 zFkve!VmS3!baJ`E2>rPYu6S_(sO}i}Rz6Iy>&?}NUtOs|P5;pw-ksP69v}V8yb6W9 z4#lejo)6Y?AR#qleX(Aim$xCGmbv50y_xauV4#=?1y;nGTs(p{EsppnW!>&1$7YE3 z_;(9sDM}6rnp`AUFK$x$AZX<^ZmFRUS-)mg9IeB<=onEA9JxPPae^xmV-1b^T)AM! zP4X7CJsPpWX7${ik(ex0Y|NQ7Vi4=mPNYF_5)AArUH&?SNpRjhIYvhejO!~54 z`|M`hptFIZC55=Su+vi6F#4stfQo9IZk)H3RsLfXkLUAy#{-F;?$EAvr|YYA`$o-r zFMET7t-pii3`}(YF6QL#;NdYvR$b~@oU&P5;Jn_QYGeQGXG*I4MS9OR+*@~Ia~FOL z-faE!RPm+k_J_DQw^xOxW^fB<+n5cef#kDJey10}$Gz&J3u|K5XTs5-mHP)^aRsszj?GB4w zfAKBi%)rmOc=9Mq#g8}O(eDu@fpoAt86MXffmG?=yms2d8P9w-;0eVgoGp`#wJ(4P72SZVnFI+;uOZVn*jm7`YmiuQ02N^?KCQ zc}O?SIDrp|1aUCG+j0kHPA4)1`xk7FjTE)n{)ei!0IKqf+P(p45E1F_ZVnyN-Ho(# zNOwsiEe(h6MnXYCQo6fDy1S(1-TvR_nfLo<9L5-S6C&-3^_vYklpsAhOVAjvtem^_TB_M$4=Vq62bA_({4y${+<(7k$71gO`liI?f z7alI)_ixw074QN$uyuHWKU~Z>jCY*aWQVmuTHd4RD{e2rSfwmzz8GCYe zvWp6g`3Bq5N!z7#QRv6N=Tv_8(@m;s+M%MDsQ1W-epj#jAaEK=O0%J*h15xe!om`v z5^5EUZ~3iEu$`RgnV9l*=e-XW)4)T)vLemCR_bLkVB28Zi>0Zx4*U&Wha4dzL85{C zvY~_JHitK#r}sslKbd2+uck*k8qPcOk8+lIWX47gmUrKdcHZ7@RXM|0SAALE+IPKr ziT)lRSasXjJ-FEM#@A&-^Hw8PPq)`v`+;`K8nc2v(t8Nqsvr)1wRUFG?yhpXjg@m6X7&1X*f%Gl>tTN2s@w8%>n#G{qwfg6~PDL{xkk zVu^Q4U4o8~8D7RDm%dBSHmHq{&PVBFH}C60rN>*SzW9A6{Lv%C6rUgRW8Tj=kr};5 z0NFR+-+bDQqFo7EZ%!fl`ZRtX4Y>Hy}u{SQbr02%ms4X<>U0* zrDkRm8c1eztjJmsP(p--CN)r7rEhdXo~iI>r1C&&{nbD*y-eLkpww4w@wB&M5{{i3% z%sP(01M^2&pOI9zL)@GWrjFJeO$y=ZhkONftZpb={)x?^TvS<^yI+nh(X%AbjMqcYUKt35c;AR3v!3LNyZMpm{vz(c!-mSf@?bCXKb4v?Sc@=%1 z!}FODj=X|6HXcG`{~JX`<>~pi!OPp!*cTtIAvkA~VabWdY(M&%;~X41yotIx?S;Mf zQ+VkaP$m~thucGBKC8RjD~eVMR)6-19{CI6O-d59P!=YH2wO5MRAQ2j>N> zILWf=8s?Z)^erN!!0a!lmUmMgHLE^2A8$f(rx#abbUckskLtmaQBhFqFpA2^B=3E{ zn3j>AZoV2s6;?OgZ6MT2j1d(TEQ$E?6Pot<&aebFDhpB?6(pB!zK0W<1J zSYr%fb7lRGUTE0RCFUQN_f){zy9(qMC4Y7aCuo6XklD$yk}mR4CJGPA-j<&vRrP4Lz&tT<05(e$vfL^Uo<+OsDw&2u%c{$|F*IIo#jLk zGRH2)MGP~f2twipx16QC7@Z=8p%m`GZxV{>da~1Go={8{Wt-}xU(1Y*K(XTlDY@#I z65HywFx@LD^b)IQ@8>bZkb7;ZYRf8fuGs!M&{iVhZd`e2!p*t9_MZGf2q#_Rt-9YZ z_Ue?XnkIMYtCt!367p9B^{QI>tV%74o`J)N6_{>HonF)^Q|K5BcfnpQcYd?$42zkh1geoIG@GdG)?ti+1AlrtnbUaK8HMy$2sLHeST-61b!n7eg?E z!E!V-EH8@OetG;w*M*sdg$5h-?0EHw(9vpPQmG$=LGL~*w}iMg5_Krdex`ST zQs?cI7_DpijuG2bJv;BGg`I7R4(8-Li-e7y5_)(;#zGE0PI`vxz~%H3u;SF$zqhRz zb{X<1nbb8N1c3q2n(1GfN=ohoy8`!TK5S1%Bs~)hOiVlNY^$RgT)T3#Ne1oCFWuc| zV`7yrsvQFe(uN};=&Y;X0RT=L6&>Ptm}y*4UXG!qh8#9B9?+5Y<@Yl`xIM{V)~qyU z^d7T({R-g(q61Fam!4w}HFd0wxy&Z#_68)W*VaoB`gH!bj4{KCj$JgnXN5!E>$|pdO#!7ChUrU(!Yarc7M!d%yQl*LFHv zUr`XAZiPspgtp%2DZE}sk-PlP2h7Wj_66VRWu2Wr8G|0_^g1$A8r$EAtG^*X4g9{m zYfq>9_=FXZo2EKouYuoTP^CL3Vn+-!=HWIuEf~0b+`V7BdE<*_#{0tcyv^g9(`eyb zAm9tqmw5^Bo~Q~p|L+1MW9GcI2QQ~o_^lZ>ZCG!j6=AJd=l5E*Fp_R#QOf-9g&t_i z@R^rEsCZCxeSEHDjEdrUpZ-Hx1*3$#oS8q19E%=)D?(mfO?b|4*sn$5C3c#c$+%ZF zfhx>1Z=a(-KBtlKyhalf;4890lu)~j+AoslhrOPmm<3atW{7_GHVoICM!?Y~1Xr@*6(HfXOt&!9nTfKQ=8+oZHG zJr}+idnAUskq8Sb>nV@lDB{{czh>0yehS#*GEayoVMeOK8KGo}ZoX%Cx#d}A;{Rx6 zo{&-5u+!V-cgPPJ%o4F|YGNS&{1a=(^dj8Ud}()m`7>7Qa`gL#NiGx|k+TJF6>u5` z1vGkmOyMEopd_FNrPb(V_3d6n0xPoGW$Qr&YAUlsNqY?;dN%aHrHvGCYT`8<;X!42 z1>=iy4Sjt%3IA{2)%7t46)p#d71eg%zTwD9l+t78)zzi;g%d`J!@3@ExGbfn;FxMi zjeU!%#{v&iydw};-=_!HsJXh8wRLjEP@?zU332YS^ma;^X}VYt^V7gwEZP#i!rKcZ z1I|YN=eB`m8Ad^_RUeMl_?R4hSbn=7>B~90Re1N}_Q|G*L01_(wtw0NPI^$`EEdb$ zF!|Y(7VBjlYjr=x%11=1aRe2Tg7b*V{~@3(R3bdn&NV zFYe>%bN*q{twE3fRYLVoVth{kMgUkl8c9z?t0ls``O*3rTf9zi;ozC^yB0F_bl*0 z!I9&p)z0vjm5V%4Vf9bzl$GX*z+TUm2wxEIV z%xrjMjAhqPz1Nh=2PKMSzd zw4e>WX;{iz55@i4?2M*P0sZ@b3V!fW-KE!xEQ9mHF|*!Gcj6!1!&XpxN&i_$NyViI z)hqb%tvO+qDOJ@-Tm7Gk=oVTSnRSzHpBrBB>G>?+>aK1iozv6H@^o*m&ZtZSwN^Hwh@!c4Y%~s6xBV?cdLy@V;XDb=k)Hka0*I9=xHHGAt0EI(g!m zud)soa~lLy_+edNu;8&p&n(yoG%$wh)lW=b9~t&D=s8hgv5UF=r38{zZ?!xYM%Oy*!qQJ)jNI`L+4K3xK_vwAQJsg*Yi?!aFM-U~VAblx zujMB)ZhuI5`IqZ-7tL^7Fm|`u(a$fc{qJi~byZN7r#rW6ip<L$(?oWNHrQOrQr711F65ooApsu8xDy zH2UcB{ylVQN#364L1_COSHqIIiseVySE^$&f$hJ=+KlkvUhqpaTP{-Y_q!XKIhicf z2MtOFgUMG}tv01U^54Yz^A$fLBFPXCWEU0D2RiJ91_xkkO-u`h&L3J@dl8rRD7(-0 z<~Gkbx4-IGwX(cH4oXf;GYZHCX9LIM-!f|S1Ap+0*5d>n;quz^Q&X5yL5(cWhlP+= zU7hiS6bJOr5&j(Li|}M1=S)ve_g}f;H!Vwf33N|PAOjJWs@4O+YTO-aq3hWpVPS!w zF3;m&FkCS^>~*_N*RXSIf9scn{S0c(*n$ei;^O>hvb7sbp3KL*aGGi3w?2aVo>jkt(J|9)HaKjlUj?O;`fhlrt5y8*HpE|QFvDC8&^ z%&#-PZB7mF-HGi?P`_Le@|7Et(5Q%qD7EBoZwvk~6A@O%Robu9!Df2sDqzTEE(*#Y z*7GaPb+p*gg%n$K*+bREA|C5MqkWcwmc%ei9^4z$%N|B3B6wR4Q+5QTi)Cljvp;<9 zBd(ud)5b+qx0Q7dx;LFnPEZR!MH{5d_NKl(s}3B1hnqIbI$1^+9W5rCg8DXJiobKo z=GUmT6#KXu z^~R{8kDBFE1I*>Gwh<}92KJClK4=cizN(7J)N|!b!3opcEn%>$fh%vWpqv_q+8MFm z7-ZWZx$fEu3{;M!SK9cRAojc1$d77eaO+eD#+f$?vro9&TyT70mUJNdoKg9i3T+@Y zEK36SvT7x@tr=O*{E~%LbUKFHK8~9qTPvk*)U_J#&W3a6tJ;q6b^x8fp&@-#UPTR1 zDKyL^6w%`g2ofvQ$qZMX&^;74JsCmyUtV3_ZP^4e#$LOP3YoEiE{vXDS62_6Dt1`h zn9;$3EokDoxw*k54h^AJR1Bd+P!S7zBo0M!f@`Z`?(5x$97;(eeK!v457nEuk(Ydi z81hjew@;*QE9As+?+DmhOihM08qc1jRmRC*gqY3DC94@3WnCIlW9$PsL9|4PtEVP*C<&+ z-ndd~-#4OOf)KTXeLQOihmEbl2J~0)AP+|F-(g|(x%K1D!^h`0j{#)8y;72tYEjV= zK)bm{hF^CIB@r~*&G9{vRKw0vru)}v`g^qcWL1F2H?M#!=B>xExj7vZqv*F6#K0b+ zp_NiBi$X%;AJ(Y}+wuD1DfPZc!1v;uB{bbr2zAqna+NRLjQ7Uzx_cobUH=r-%#&hk z^G@7K5~uHE%83E&!l8FNcA&Y??X_!ok^}9mt>9mJleMEs2k4ej2XM5y9 zGnl0hd|E#EB-I5MSWcUdNF;sDaYPtahY+YENu&prBuj7{<15B%Exk_r3y#|2V|gf| z^z;?B=igNIkn=yYMklk5r${6zrtMSOW#N)XqwOJ4ZjWTiC9#jw4DHDbt=kV$<_458 z2o!74+KcEFjSCMYgyl=z+h-6%EiXRka?XEizLH3<|6F7(e;5&$t^;ZX7mIv)OFhmQ zxAMVe^Mt8a!~2=eeo_2aJp+@kWCaynuc-_L?82F+u1c>$t`^2N1gWCYSNCCpMPHYM z+-)Hv<#Ud5c>(2(mTB<8L~(1NY_Q?x0Q2Hi{!M_en52+un= zVS;*{8WNs&yAkg_6kT&7MoU*(UcsDCt>RSJQi0uSNP~Z7c(tg$xvAmi{z_d-&2~|V z0zTZq>1L(Lbvjlb%UJi+99$fv=I6h@=XY%&!UUJLv?Q|M z>|cXfk`h*yb-6ZNmswgy2Ct$(-N;BDG!uu7+ap*q*<}7H-#ZI+)0)X?&No&L63Ete zb{oLXhW_*%H~QW&x%xLDJ?NL{5BIH z9)$@WU?8B?@c(REI)W}lzwaV{Ig#vf@#4J*^rr!2^gErB#?WNy3Ei>mXfm-P5`Vo7 zmi8I-rYfZB5AJGeq2?g`;}pi6y`Js|tBdM){y|W!6P8iWAqo_NjO~eJrsyn@srv*S z+?L*kEE!yaCw5K(A=d*LTqST6MCQ_kqy^~Ke-8`*8)*Za zCFeE_VwH)3fERBmvmzUdY}GDfM?yf+EiRWitlovT)i_$hN27EzsFX(3DOVwxvI(kU zI}uR@fA$dwI^Fc(ukyBOTCQFGP!=T*A>8~qcu6K}B0mlBX+g5FDgROSaOBZ2l5UER zy)3Flvr9*^=6|qTzxP8#r<^UaS4Qn%yz2%6M#H+m-;wig?Y8){INI=#sC( zve%~gCPm|XoK?-X=h+b@NA8>?d&3jSjVOz*Dk`JJLOd)?fmwAS%{(6(nbi*yapcC6 zcSbvu$5N%jPrtr|s0S&S?)Ta+XVu%>-D+DM$h^bd!B?=XO7gy<`tXciZe=ZRCp)*~ zzjLK0KP-1_EtCj7Ud&e_p^GHl2Q`ub-#a{oQ!)pG{$?o zG~X^tzbC^=&W?kAzwmL5T284)WZYo@Ex)}cIQ{D+Z_R5@G<%wF=yt4qbO_TZ?6p+F zG*=P3sET6L3>k3}8n0&%*fOwT?vbSN2?$E_+Y<{4M1S)*G$q})3@P{osGMSgyO7zo zvZ;okMcG^L_04ZrB9Ztv67x>Y_P=~@KJXb}oU}dp5G%K8NpoReT{e&Zj+@_Pf1#7x zj?goq*W5M81!d+N6)F&1tZ=VXCf<8eyiwV;FDLXho43FIISy4B`mE<@y^d~;%l zMTlO8s7)y;GJN>RP=WZELJ|#{-TZ^1-iU~*(x;d=?3t$!!)C}RO|?7)d+GpG(eB;@b`_0)IcwE<1?zuSVu<6xgp9R_K@7N!# z!2WiVV8rHP&$X3XNvZGXdM&itHn8UjElJKP{lvLjQBMvvw?%ikQ%2Bd_GQncWw1OG zHXF0J$K;xeestwFa~*NCnuhd9i_yv=mj#2*d5GULd!$iK4-&cPwtZGjKL_Q=4Ztrt zYQ&bM=?EC{YowsiGzjfK1R@Z2Q~$^qz~DC*65im4i}{;T4QjSsA2nZ6C(40l&+V~g z5aOk=FhV;d>R_5n3$Mz(2aaddwwiETK4<|Xgt^BMy3Sm@VMr@ z3PzFK%%C99^j4^D*+rA0Mwv!IrqgmW=11AMia@Z7t!04ATxRaK zZd$B9^w8=$@h~Ulc@>KJ6*3D9ib~YPn=|{Y?=tP)ULBR!CxUTF?f_-;o@~+kfA__I zf9s5hj<+xwvTP_F>f09Zbor~Tg{`SrYUGef&}5mV8pT;CEZVp!ZT^=Hdt|hrV%rN4 zm*~(?r~sxv2DIK6YadIJp!A~%)bdY$1!LYjjHYJmp|fhJRp+>v2CHH}bO;^F8M?iz z|Lr7Q0+-81e)zpZyKC7HRdm=yvUDRC*L2P=-`=phzJs1ekNo<9xmQ(;#tnC4m1Jb$ z%$66~5^3-GBXEV-E~b)uJw@~kKGP<+3bRDtSwmw8%HWpXrhARI)h=pQK2DDicGu}< zU1q=d<+oY#Dkk-h)XOaXX(c;5VUgA1*-5~J`u|}bPUVqc^ukgSpMo(&g}ex^iNOz1 zo<=$KWRztYsM^+4V`>)t#2id)GE+*9cvyVXg?+ z9XWrzN9aq5&h*90!E*(&wt)A!pA}rFICEf${Rx{CF7q#GJ^!NlXoSOv#c{A#x6PYs zsP8frAE(|m4R05HFZvX?D&uL@l!1cm02%sm?D%BlKE2=jI_pnJnS% zJ?wD>-Dl<@CG+6jEqE%YESKUlZ9TUO4{v+st9AyZyiojxu0_RV0C zwBsrJaN0NB@oPRyq%f;LD<9jF!uuG50|Z~E5e!68!%~yHY498vN3D|GnTyZxk9JF) z`gQYI;^Q#+bxq{=Gq)TvEMBiCk5Yrr$ZG$C@-z~8^o{P@?sfWX5|Xm0PBlGg&IC}D z=Gj>GDay%lFln=H#)5>6y@buV^m*R72HR0oKM}GzUGzW}9b+*oD_%O~ob49t7;A_; zWdb>2EC_`c)CGVK)_1>6ft=O9sDSWHPQ%qd>K`2np}s<2aS&X0sAhfG#||kDlcv%Yug?YN8wqlPpS< z?Pj)r1OX{&ucbzLO^x|v0j_jE?LyP(XZKZrHxuCF1LOfoN{yb4&2)dtqhJ!h)w83g zB=*qB_m`XJwabnol77>NoxRD;|H@@@Y}8uwK}x_beCcSrS-X!$;~v_`b&knV+BYz182fINRxin1?XD9Z`1u4B~=h()JgB1ZI; zm(k}e3jDw$gE34~R0<2y3=hWCmPV%B##PaBrgFEszdSpGKM%FchTU;bry&lh84(V7 z9hAHij$qcO{80jRV<~J{bJXO|(}(ATEMGFwf3HMDQZG3*6_6g?e~jP87a(g_8vtXb zm7iZ$!uso>VTBAR^nJgA;JMci1MgXBQB@NjwdGF}R zvNx*X*T?5wFJJ~*s13lWu2v!^$BOrQS=}VW z-lE=ftiCKOx9pEtyJ!h>zceMsRax`+Sc_zeG8;~b{fiWDSMUKj)Nf{X-f83320K$; z%9}wP8L$p&>gqA8yTzM+crf9xy;4&26~Utpg_TyI#}v}D53&lfDuz&rJ&2II?#4(7 zi4H!8hnFafxnHU3X@yS%%{Hv&#K_ICv@Rc`XQKRNIr>YtLIp81Ghr*imZ}C@Y^nT$ z7UoPeQk^JZFhPFWmO}=IJuoU zMvqs9tNl|ytXp4|{hhV>COVgjR0T#=O)Z>G_vh24-$nANHQ!aBy-;LkQQG?07F%|30i< z98@~0>1&Jv2s1(beM5O@&uf8Jp9${l{BmWGrXvO#Q!|Aio)6?x({GX zKo@#5a_q5j-Lk(=)NQH3z=|=(j~i~fl{I-|L{6$Q@s?fwgA%_;E||C^2kIqJaSaU| zp5=&3A0UfuzR_3^k|L9T{%er9tJX$y_Pr!e7>WG@srs8H+VAMqi@<9xM`%IZ6*SIy)~C0`E2{hn#>ohSX+K9|H71(@fOxXRsA zq>nQ^WL`W4>?6(T5eMfFw8cM9fJE506Dw=#@@|Ge@N_19*yaK#2XMgsya6%vMqc|` zK&`zS^3Rn*?ppPKE(Jl2R(dT(*&PpmRX{Cf&!NwMSN{r!2YUWF+1lEy_u*O`uH+bK76OZyt4eky6JFF9>mC^SKj&{UP5;*BDPoCC%ozx4z=VxyqUN$J< zlttwg7oe;JqDZJNeN9%C*vY92?b>q6YN4^4BFRI>mlN$78s_6?Wbm*9q;L4xr7*Lt z-Oo)A_6*GLLqzzW#O&WmAcrl@aNW~FnCQ9fvO+scknK@bH4#POCb$PBiM!>_7Dg|N z62oOJzKjSerhTOyo&9a|Ce*;mM{`3pPXyxGkx-N|i8BiyQb=g(iDNn%?ik?m(G32D zQMgQ>>)19CA))2XiNBW+={qP<^&t`lY1h76tykp!_h`uiVt$`sz^H0zA@~f5ERgX0 zawyFRlUfoX0%>q{j?bn*L(@&{ze`iJ{l3C_j<=VRqc17rs+WhT59JH!T^I#_D?yel#%>llO_@GLASvM`9O#;;A97F9o>y1V1hi;JoKL~1lT2=ChGG7QYC zZ^uk$1lkxlf5p=+G@N1lrJkAs!8D3mX9jRt~#fT8G#Z(t#@NTIz`&UbT<`^M-RDn5$YHkuOl~mHA%%3}W zZ<|CciE(0snu-GiPjW!^Q8e7;L_|jyMKVLDQkq$r(dzFpk)`rDJ=aWml=3Pr%j+1T z4W3jn-&532j3%0ij}XBR(M6-3zq~U)|GU>OZUNd*ENItoe!C-RnB6>0s3mZs;rV7o z=5y9Q)mdg$D$=jr$D*l%7hAy%x&Eh+vxFtY|j2AC(%+5uaC zQqL_yQiWSMSE2{!w`FpxR9bIO;G#hwEG@4<0*`xp>Uaa{UI1l@aNu6x89ONxzttLrUPOe zp0A%FkydX+AI0f;%U#?sH83Nop;3&yd)gygjc4%FCtu%HOKrzEsR+V;1yRBSvY&sE zb^UEl|ISEO8@a^+v&bG`dn+ixIOV?wd*Ka0lJ~T!tv0F7CdGYhpd~ zWu=wRKe>_nO}*Z6&b^JZyfnG2C|4}OzO+2#zh~!!aNM-1;sjL$vYJv>l-kz>$)2-6 zL(TIJ(AYpB9)&^9ciOq)he>5|+`ZbzfPrQno_qiJzG6wDXUL0BNNBp;Sh>*V z{iecpDeLOa%*HCumaD(V)KgVQM*(~jyMnD?Ba)5OQs+*XapKE18C9bB)~;~mk@>Ce z=bLKs1>0GtBOO*GJV0i#kXD7`mbVMa=w&H00AUNf&`94m=MF#hZV26M zREENV`Zl_j0hLEfN`7#kYnK5a(ZVEsmQ89}YSLDoY)0`B_3B(ti|pw4_ehbw8-O6v zBaqyDlZ1|rp`l?IIeutr;>1^)J9NQWQrdHMg`uj6UDQ?;3M^tej$|p@7XKcntsc63 zT++~*Rx#w_XY>kSb}@0W8hUD={Da}1#kuv%xGBEk0)8UU4=ka_&Ptm*$q6WeaD}1gY2YYyE!Zr(R7me(+T9OueM`>%;` zyR~6Pk}fYOFm-)WY&w^zA_!w;=~$FKw}YWUA~8RT=T`ns`7d}!nwBz4gVuW`667S< z1G}Mh_v|s)O41dvERO6H+0~}_C7W`*SIL`l*&XqksuC*G$u2xa*-&pA`O6PQw|%K; zr&k!;UmKL>-MA{rr4*nw-WEY$g9VsFOTIFzzU~GcxNy^p?BBvHp`5Rj%Il`wr!yE} zOowCU727phx0Tv8BGQ;D_7|{62FN)ZqAv#DcljAtF}tm}D56rRhNh>8B^%>1f1;I8 zxdsDdcG9GHlsFY|!A&|Pd;VdFa`Yw)$V1{{_(NIu;Av>k66#>_3K;VD17m55{fZ`4 zje9%S=t1WWt(^`x`tl^9Avq-s6B!_&N>=8$AfJX0GIV-t%;<1`?kUaRZ=p(Y~lh95_l=@@v9oq;$Y)i+YNrJCH3HTI8$_%rS9hM(edlab-mpZ}12juZqn#n~o~Q}tWZD(k z#aFX!X6^15lyhi7lD(qz;TF4!X@Q*sTSI#F>@L<*mXA5AwUuz0fklW*#PzjImW|1a zhVOPPI|gUIkI_V5k!ij5BF>Y;j|?WPGUwY5treYzbavV_P=p01XpK5IGFyJZn}fy^ zJi^K;4nJDTA;oE?cw3m_Bg(!g3YR}17AOzIX76ufullw;(5j3I3!6rs8rW_li*Jc( zD*)RwhYUnAc(AEzGH3KD<+#R{mnGQOX2X`UQy?@=E9kQMy+fsi>W zO^!*9d8VPQ9kb$4SlY^)62t(4B(|>&ePP606@)=1MOT-pfihAw9^1yXN zot{<$J6_22c2RR3qt(lXjn`Co&HOIW6;XDCJrnw7c%+C>%v~V#Ejh9jsZ{O4@y#McfzeW`cVBg`&)<3oO zHbg)CLqe(4T;CKWg9)&P;`uOgN@h;hp_6saM$6xjzAP&-lgjX-=lJ|7)|_*I2OosH z7DBe6@OJ}c9>*n7eLJdgp^gx+#9&2Ir{Gxpa@pi2=5veT+8yH(5s{OVd#z*8m?|L? zzkAj29iU7RaU4RNQLDQa$IxxiRmll(Kq~I-jfsf^R^D?T;eSi5y86%3)9(pQH>7K~ zgAK{pcpMNRaXlLp-qqS()B(5atBWgFL3##M4o-o%RbW=Lu+yFTotQSaYvh;WB@{;q z-(?cWHnRc?xM=g`R3-pRUR}R(zCZE?TIVN8Gh%)Z=unjUKRXB*e&ZcSEGYHdi3uFg zFu1V*#YD%5RW&pe6G}C4v(IXQGM@aM83nc8Mr5dzBj_}PS}s%^w$Z?wK#pZ_di;0| zTFDApvKB(uzlM`jaDn?|VBr=X=@nUFb6wn2;(L$dfQbBcHMjsWrc~DV`-wa`%k4>j z^G)q5fn=A@lebr#c4F%Zw!y*5aR-;on>X8Z`!F5sJ}eQrR0hm#Hrq=V(`JelI)GVND!TXW+ZaYj5iWCRvzH_un< z+PK~9)c>@?Wx3AN-uhDv|0q@X2@_BYalc0*OYj;mL!;2SuK_E&!I7l zDlQ&fi=$@Pj-$6`%tq8$*kkOpiGFH>6m#jJ_Vdxvi!K3C6`1n&_hv6bWTjItqm**)2y@*h`3#NFGegclDT}MTa_Zv=aY$txJ9)uXd*F%MhuCs<@5grx zODQ+Xe4ReUV6%tcJyIfW8L(Sq5j2CshXdz;mryPzMEXiDpOau#Zh+vAs{ExlLpF}~ zpfL%0knEz1AY85j`4NX^Ye?kxV2YP*JduihlUhg`Et2y%vdfkz%34@XVmH_`DiQ}8M%!sM?d>q|)PTr%Ai+W_Yg)1ZpbdoV zBEY>TtgGREOhGT}hLDcl+&#)s8=dKst+qDuOXofBlOwVmv|?1LjC z8K6)?WR-|>Z(*>*fZU*(QE2(BJK*j6(`%UMuvjH9Zr{ydzuY3j$0d>$PAr z=pEF^rjH`em`R65fh9JoqKq%waBkf{ z*{8z40!Q+$6Jeygt88A7*S+sHHKW@9+dpFOWFJtB|0Pejxm>3ZE&RPW%o1E3#UYxn ze=43AMb*q48WvnFD&ms_+sBt5brGO%V6<}0^CG0D>RnwZ@EHQN12}(2_e(!IrLQNb z0o48Ix9{ikL57-kmlxoOPDdQ4Zh-xMyuAmM28Pwc8;2rHMLCTe9^4Na%AS+-$4ogH7RTnIp4q}O>&Db#mJA_{k zI&?}oN6{oUIYeWg8h}=zSxQOUZKKIB4i$6^OVq)ooNXG}AeyQlkeQD0 zHpMUcb8J<=xHA=RuP3Wof16}Os($HI!kj#VzqPABo-aojuBU68UtjCS4iLbgZA?=gy2fP<#h8v43YvBmBr;rLX z`0LH(^cg4Yi#TUB`}+F8cNv>HQ(jXJQdo$C;Pb(R7CnezVR198RfWBpP{P*8;$<1I z@z6x$?~#Fi2s}*0in5yXr>Uv;8|RW0Uy}xxK~|5bJmn;Qsfy>C3%|{W55SAd#RriF zn5QdJGbcFefV`WLe?GpF^&4+h&0ZJ6T%lPxDJc}5OnC`^oO8*k0^wrpt3Q7LYcPt9 zhj(fGe7Jf>_wmseh*z%d4H1)*=gDSx@(K!7tu>4FkquUYpn8>-=W-o}sxXkWZbV(% zFVsRowy4@+yYb_Ovv!Svyzwf`;attuw|UPbMd%GSUKnV6t%EURmcU}1`UXN`ZEst# zJH*6`ISUVGvsiZ}l*sRs^MSX)jVJ!Y*uvH%`cO!2RoZJ% zKLDJM{M=l}K{=@Ay91P39&GU+<}`xpGa$vABa4S&qUt-Y7q31(jMJCz;;UbPsJ5_v z(p!$ERcFEcC`31#oMUVy{GUmP9#U(yi`9x$T4zO(mf3_9y(!$0s6c5=NeUO6(L# z^#X;+VF$#eu!7Gs)7^T}j1(zW(X1VWb=(UcTDLq|&CWp}=)q$=Z{^I9j-$Snh?D3G+pv z%R%E4&FDD?SL%p6VayK(fOuUkqWiy2D1?C{#-7|Rii7oAv{?uq4fDE!g{e5vZ~=htinHiYM1#F@5c zn|uAt**%&haEfLG1ecwkwpcPCJ0W>s- zw$=Y6IWj_#ISR^zO+Z-^1$AzJbzSV^PEJb$<4l5kY)U~7V0{wBeOg^$$d zHtlOu)A_!jBP_#W-KG}Mf&;;9k%Vmp+=NIsqJ?8im@)N&s&gj+5(q?-gOf*&FHw|p zbVd`ubtSIKYqR6Y?UR#Kg=yhq>n&ql4__xIE91O$9CQ0b5n{fUL0 z!$GE;(`Br3z~8k(ztdOkvD2npp0ng)W%N;EHa4F`=?AtnL+3%@Up+`jU@?-UeBHnA z1Y&X6H|-OhAVCg+iy+b>Egc`--5?;{T_WAx4bt7+4blPv5`su~cS(15pXu7`?CYFgq8CVg?~G@R zaSvNs5Kq&nv0?`4av^0A0?se4?1J8>_H42xWwn`A*#a|FT0QTAes8$c_#7czAM++& zM1t+?YO%`TVX%7R>SvSBf$Be`4Zz57`>Z2{eL~aWlz_y43;#18Ee8_nI3Ebe@S{;9 zC~-1U|85^NZeCtogycZ5V$j3VsmsA$tCjLpO z?hJ;A7l2#E<+7fLnJQIKS`&TH@TH%&`j@D<>1gH;|E7-po`Wh1oW4wx(gU9KVr6Ze zu;PQucPNg<1rfn2rR|rR@q0IE3RFy%kJa<7ai2*0cXzqeb=^NS7qhbPjC5^IRWuw~ z4=;T`qH#I&N{AjI1Un>D8mskW#)Mk+=Ya@b7e!@NA!%iPO1Ug(V!{Y8O9uBmFslg{ z5n_|2#El~L(`fx44FQ4b@2`KJ_o9RJEhOot6s37|(v48*oY}YyjX@*-Lg~$|M7RmI z@=sa|XVyGT%3D@SBcVSE$d3-u_pr|}WG60bcP6@o%~%FsHk0WmP{q_%B?i+>lcY%_ zC^|n5Y_@ul1+u#&8!{%1C#BftX;@DliDIqp5$ogb$rK*eiefV&5|rYU9$**uFKA{F zJW3siN7HQ<9fVYo7?pvTSZXQJ#T7|k5j8!ctVr=_f#jQ4lU^lv;2+2%xUURtG>v*@ z^pbs2b&WDlmHJ^qA`$yYM_W_nvG#J8yns^>QIsnAVl|Zn5d=v~S3C4(-F@zMt3$;K z0HF;?IWO0vZQ?9gTjOtu@>=TfS~`XJ2n(8vgMskN$RHm2>jdAZH(KX$^<{%mS%^AJ z!5UyL6DdIr_}*UVUMMsmMRb=4Ier0(|;0E?z>wKB(e~Sw2|6R8sx5k^gB$8=+`7x5@5!C{ZS|_r5Koq zwHU#HNqNYsWG8!h1bNohxPRRR37#P&>S)w>W;5rFGkzR(D??*L{D=rP1cZJgKbgcKDj{eKbCo3`=Q^(VfFm8!=Q&7Hf&z z`D5K;Sa2sOpK1?}>wwC3TbBgtdHY3FHR^Xfd_jlQ({`uJ^9lM?^Fe`Vqe@~?4ZmS^Xf>*aahINN$?rL9-<4fCnGM?_5 zr;xZ{qxpd(Gp%?LTcX0++NC9XUXGFVqCsj}#+_+(m+vmqN`Ka<<7?oGgx>yoD+em4 z#LYE7SWBnqo8k7N5b1e%q$kgaVqmLJ2&R2XfklWP$W6(4xqv=gy2IsMb_12MS$ww_ zx?>YlAKiF*c6Z^FaJvk_fk-E0-JXSm<#$a0<*COnfUJv-jz$qHreH?OGEy>JzITq4 zi9TJb8+APWEo9Sr#$zSN8zXRz15W>jPYX$GY@DDC+vm^ZmVSQMRZ(+ucp%Q2c<}t`S1tigKK{q&6YqqPDnc;V@*6$a zI3JwJ$KwILJtjs@iQC1nSoIvm{-mYmB@0|GkDw~Lo9uI)G3x}=?K~qP@Uup$(k6pD z&WVDyvZ(C~>R<{zC;>zb6XTk-&(2%Z2b4h|D4ZSae95nAi(Yy5nW@y2rOW>7m%~4_ zUCsfFC_~wBZMQw7Sw=$})?)~K)v#}2=WDlUz)ml(t1DPvKMly05GDc? zRz4PkFNn8y)5@b~r=2l|b&J3)w!UZD05FdtOCA@ipHtI%i&%!>o%lJnw*BK*tC{NSjP9#(2j=yPcw9uaP4RkpEvwt*Ct$jr|lRD}nw zZy)e+x6^cOO%K>JfMBI}HBbbo2WN*Dyg#j;EWEyO^18H1KCE*9-$Fv5uu$7w)B`mm zt^Umlw2W+sxvgbhX=!xh%1X@OmVtqRKYa$L{b83mPm3p*LKz>G0U-&XxbO>W+R9K9 z|7p|$im_-172-Oxiq;6hHnB1mNHNj+gFL(}SP@{#%Y5*`rV$aWHmI)wcw_dUVdbKg z@PbYd*y!k~^Q(Ph^A)~+5@u!fkP3IR9EHk6;pNnACojn%>y>*S(F=f6Y~`bR#2<+< zAqcnLFt1J2D(`$O@>@!B%xJ!CIgO0OW@l!uAI@LwHv27`WF)9D^?oblN_2c#c{*{} zK6JORq$#Ci>|{a$9?pSe+F{r3NmCv!w_6-a`7BXY)pXnglW_&5&qi0;7zpcE>6*>W z`kU5xNVo6*rRno>B^T2ivs%w)c-45drLqeQH$LSvTXA5@PQt-FCSru7qKLo$3WnaL zwVBGMys6pIOhDuMeUdS4`(I=IXF7poztSPOlPRG~^N`UE&@7vQhxI= z@oy<`B3(`$A4PW3JrI&R=eqZ#rL7!UC#BR-y(Yn6?Mq}ZrywUS=ljecJ0z(rN7S4x zqP$>kb~Klw$!El^R|nX!@bi50)YRblP1 zWbc49p~?2)&U^r$AqOQ8ygl4XnM227{QZ1C1hq6^)e*eI-tP_kT7a{uy-$q*b=F2t zKQT0&sKe783b##$ho|0ET)!6m22!Gg1c^*lyd|O-9Vhf+i!=Z~91!Ha@h~ z?Ua4WA&Ia`e$o~=? zGuocuIthBKvkfn{qk!MRu-z-Ys_F}A9M#AD`M0-|z7KDKOz^z(@+g2(l5paEq74(^ z^AEWv57HreCf0nHf6=*gRcDl5N# z4Q0FHS;RK?T_5?$8=5NoPlIK3*FSTKJ)Z8%0yYi-LFd|c$KE4O;Mk1)-G2LIt5-L# z(eCm__t(n>STul7jCEGW6H_$r6<9?QlQBq;14ON5y>57QMLCfG0j_2Bt}G3?2muKm zSPsoCK{HTZ>-xEGfR^@T8tI4(52@tcQZ_bK2#uGv1`a7 z%W9=EK#1cw2Ki+1OQFs`khRC+izYB*SJZ2dF2#yt4JEraEURElO$92c;t|H+WenS7 zK^0Q@d)uCvoUC|Dbn2ZPFF$7ZK2+ZdzI()|o{b_AVvoPPzWk?sxSC=QM_olmN9!v? zVjd5nf?-3x&s*bjJAJkFy3sXgOxv(*T%2ohB}yphY`t6`oUzf&C_6pQ=0Ei8J-oWmqiQwTxz=hXGh61+`W-Rj7BhN zvAhTJG!^aEQkWs&cjqYU==9Sv{_0b2J0~B>Ia!b5Tq$fQPXA^5tNY~n+10*`gH$ps zA8rZ7?RtJ^zTwK^81y#*s_W^n?UTU6%@G-H)Y-mei^kGQPmLjE8b01y^Fj4i-di7G zDh!~oe(l@jQdU+z^w^+Zz^-@L+_hIJRaC)%(K9ki?0k!Y3J0^he=JuH^|0cT@ym0i z#>gakwR7h7*V%pf<2cb139VWMXq9jUXInr`lZW!p5jaKNGENhD8xkUZ*W&xgoTnH2 z><0zHeP?dqDja62QRDTYWp$;u{l3$7!_oNl1MoPf=?cnI;cQ0e{(Otn{|p`CexJ4j z0Bq+8ZwZZt%aTBwO5IJ?)8n&id%xh*-x3%RAy`;gV81ACDvcw0xfJ@B2Q=)Jb2z-E z7Py%oW#Z=U-`vC)9*(kFZ2kaXbgsvII?MdPZUD?}1YHKqG_Dkcma~p zvifA3@p(DtbmJ{yZO`=UUBe{327SJ=Moj`!vwB80FT zjBr_4dVc?YMXN@)QPZ1K>vnW_yxpK}TUcHfa&{)!BSz_Vy4DL$Y{jLeP&uRGzAs-f zi9Oc33BVRt=XvwxdAR+VP|*D^3HTPkd#(4r)nN{o%`Q9pH)z_bIYkR`OzV0%FPfss1&6?EsH>5mW zj9y^AT9Bl)K&oom!=bIY+WvN$y6$1vwJKY2=4EuMq$@Lfa+9#+n zy&rN?Kf!gJ7abkWyQY5P>z{JMA%WT2Dyq8&Zr)G%V9XWKz48?D9uC}oGOFj84jxvX zg|gkBF`aZw2USysB@eVcQMTQAe(K1f5DN6vpqHHeTn4uhjtU(~d&N-X1GV#!XV<%{ zYjqqPT>as)A~z-SiB(#_HBkT<+U+HG3JO+3mCshNKf$2@TvKpntycOF8QVv0yCCBl znav9{uc3%)+%os;3LkMK@LVnu5+c3omkh$ zTE&u0i)?mkKqFoDfvSzA)(pK7#!CBJg}PU(uL-aQ>ixL0(rM)kEm5bJI4!G7oxgHk zkY-oBpy7v|7I4wBAE#LXYe&F&R7avEMfHq|(bhL^C&$~*_Gtv04!17U063mqSGc=U z+CWuh>yudE*Zp)UpB>j{%<4n0fKjh)j#pr8`RDqmI(Ev5bPetw4RLuP=}^!PvJ=;# z@Jdy+X3-k#ZhSVJ|7^WrlDWNK&I!fD!_(8RYJvJV<mH z5oCtHFrE*q)V{Uml9>6~iZkZg+M9Kw~lzhO&H*l~B2h-u(&b~%&yHixaB>>jE zz}O0nnncR%M|O1`=QjXBTUBM#BPMoxRkwI|uipO2+nWH$Bb_$rYW*LpXQiod{`OPm ztbwZWwOZr@H}BaDIAYxFfjw3}c3D@~cb4kan_z5wUj1^U>##m&kAmMfrmy^lurW*G zv+36UwATin?%GgV9oQMiCziT;q7K}z=Z~hQXL1)*czAd;TRh%?1HRW8;>~xDBP{@B z>Wg4J`hDcW!oeY@qeHKwvkacX^FP-qU|rb416N4zwgHM<2Y9$Ads-VzA9MACAklx(ZsBMH&@Ok#u6_Med~O|~m!haCb=$J^Q~dJ0%!O@*#pLN`M1etZDgo*JT+;Wqzofl$Mj`wBleb;XGp3 zRcBWA>7>KCJJ?rX7y7C%!AHmmHnGulZ$(S=s4I5xY69>+Y-J_<0qFw*PTRqZjvr3; zv^i}XV#S^MPRmHg6`$L10B20320PA|TW@fWOa9TQ zq^u)kEXoaRIzgvSiJ)cx*!Y1MYs3#MbR;Hcl*sGb}pQXzR9nl z1?McAlzS_FWz}Ici&Dpr4#)kIUqV&HqSC<(SaF+BR0#8Rzf5{6CRU#%jjqV) zHL2>1fR30#fe2q#%k(5M=>MViXROa>1uXLry5z|yzS_PU&dn52F~K2u#A5RvZzZWu zTK_ocKvfzmr13uslPpZE&~C>f2ntILp53F!+jGi3DK2intzI3SUxOfvegTIJZl~K+ z@*JywO|Yr2^o|yiQYGpp;d49qk9zeu#os>(0J9X>b-qgtCnYCs@{KY<78~0K zE~hY1LOMPC`aVFDxamL0foyGKW3A1R6nN^`+s>0l6?IgD^L9)G>0xA}*fRx|hZorE zbep&RhmOV5c^Lfso=K7!&6z;fy%&Bfph`&B7U1um=ZjwNG%*r1jMaBloB-(8O14ij zU0KG{uSC6}&x}KqCI<=mM%xzm4NmQMM|v}#vt|i3$`G(Oc^3((F6O@7nM)m{O6;mV9cBrpJqm7zZZ+FO=Rapz~wA;%8z z;FMNYZf};dnry3;d4*5zZGvTZb1j4j7+2RaR$F_JWZ>O)vX%rk&baho>kkfwMd}M` zs8Vzr2-U-*$;6{;jt45c;(5el@B#2MJj3Q^bg%CfAambY3S8{*f`*LiYc(Lh16#1> z^$nm-Qv_#d1C2-UdBeB2I%j#LXK-fi#&m=SC`n>)LSU{07~W#i79dKatg6~kEQ^Qw z`m@bDp=xNIT}V7J23}DS`Js;|k>yNPQF-|w-(gEpm}?AvXKZ{=5A2c+XPjB0-P{m^ zPNNGZJG&~FDM6jywSIP)_W&LMAm-Q6U6~4azxBPWegUAc4&TRjz607V!>k2ZEIuH_ z*%bu+xMpXBC9A5MWYuPY4zS~_rlTO9B;_nRph@P8w4BS{z0o2L;sdZ*SvtUlGJtzg zRwfmn9-OG*WpWcYvoV~(31T*G*G<@a`^Uig8v}SN-DevmxBbxX93HGW6&1grydF?O zDVRw%`FA7HecCq%UpF43cF5#j?vKJ$<&u%1W;JEiHvn}G@9hnJ5q-206lu){3+JR` zvi(t(ol-u#rl+nZ&ksmPn^P)ZzCc3>e#yaZ91L2ug$?AW(3RGT-;w7Zg<4cU%orMdw?+kG+oQU;Qh7 zut~90S`n@mu(;21&-)<@cxyVZzZXQ@*Hnt%H z(T*(zyEzOi8W?{lgBqN&ucVE?Ejht_v~w@hJGOjpQ_Zeq-y;KsSJ@;kbni1QBO}?7 zRO7rAIM)UC61}jaqbFD`du-9&V~BotKEQ;aOGXn2c1r`qc4gz2oMr0fs*Azi9N@Z- z@wp`C|Mdi15cbEPDWx3w1c^u4q#M}`6a9T)s*V*JB4c|DV0s)5>W&M)4r<>l9+<;)JoJl{c8$-XIl z-GQ3H&>jiYEUfm`kio6jd9hQhycX3hHh6-MW}fEQ-JsI~^!L@RmnT8r(Q!k{TWsG`>*JqCCSO*suz(nG z3+2JgvhFnBb&o|)*1bD>n8(T-O6*BVjtZaO*e=nZk8vq@}TD$7^Si;g1 z=wCYA-v*P&UI~b3x9E~{Z>3C$KXJ^w82~%W8`(*>+qmBM!g`Hq9n;{f`X|pd#-VD1uiq%1-BL|KSC{ud zOVquov|Z5SYlclL%2#qt!xo#P?x>^Mq9X|rN(_X}5vY=c4BO`9o*s|q>z4=dkxbrR zdd^k7vy|cT#CXiXlv>MK?Zf%Hcf?z6LzihY0VUZ!(H(gtYE>FiqN3dYPV9HsUy4g> zd}iug+JB|+p8O0-`Lfdg^5FaIcV4T+VWTmsEYBaZY$7u2{8^4t>CfpYoQOy#=*n<> z7r^El@E=%#SNz|rpYsjI=t)~efy(pWUJ*80&e&dFYO18XCix`ymm=ygSEbG8eA$uY zv;7^9mNqUpg1JloC}xcXZ=VbJGHC4xU*B_}ue{6UTN%n#!DV&tLy;PuF8*%@c?I#C z?=$wxGozptDc0+-J-RWrfVFR_lQrz<<~x6c7j*~t+ch6R4*AV;toe)I>91T~0XX~q1WJDIG+ZpPj7e*W#0r@8t%%|1KW>_Smxs5LnUA=eV8z z5|8p-kb)Q3hs6e+?v-C}K|>c+inT^3=w&c8Oi)o%I~`(W99!i5=q-XgsjQ#vWx?AU zowcs}7*VYZgd@S1ivZv)3cfl}KN}N~XJKOMBYGNl<#InqDv`_DYI_hE{P&-_ol=3e z6CJKBl>I-*7@VcqN2|;jsnIH+u`miCrrBsY<-%JZZ@bDe5$rFzL+0T9OBE%47uG>;# zSp+1b@O&nA0&+rWVCqlHjs`~EKV3$t6BER1c9C^E9^j?f=BJ;D^49x_3_!wa4Kxoj z8QtXYoaCw7r#+rmCNJNwJwSg+fce`XB1t9T=t$Px-3=ow%GUVfJq@*ff2}cF{SP3U z{8RR5)vNQp_gFBdqkA_@w)Ry&*W6i1(Uem&Ago;hO1HtAqOGJK^qNw#*7P8*cpi>0 zquU1WnVXnu^4GD&%*@K5KRoI7(T79F88a`QMM`SW%u-jzSe2ce+$5)bwgMQ?T>w_C zz-qZRt$3S)L&u#wBDwP8YmkRZDp#-BD=UwSCSD6Htj$jxI7j=;fNdRtWxthd374p% zprafyc$ELGFtun<4g5u1QYq*$H_&l*%?}Lg@zC~ z^nuWq@nA}wTQ?1Ex)#U=y8SZAxE8H^+-ZMiv}$u8i~dNh%p8zh>;ahia6zwu=IMAf zV?8xBQ@eB2xOZ^0(|ph{-ev@!Q9UpA{RhA`I)FKxDmy!!PFsBZgu^~w#y1jTi4(O5$(0&H-pZ^tF)>@T$&(W^CjE4)w>mysNmFc$`gTU~;qk8q zQ+_DvDhK5qfP+Uey^gS|D*07?J)Ld?_}!x6bG&7rRt4c3P@IY?s#sc4_IJOWqsC#2 zh0yCZ1%f82MyDI@FC;4ZAxSkU&>w35z@o`yP!-&*fal~7B4Zn9`fEx69a1(weQ3cc zKuiLDC?;9*ODJ`;k)ePS=4>|?=x zk*=Mt(PTi~@%3HHvXHbi`e1ScI3i1ex29E-KKm|%V|F?CrgMM(3?+|P{I|jbuzeBm zJLfBe2H$JVRBFo-|Lr}wsdGMOC-~A4lbVSD z*0Qd-IWC5j1l#A46pdD+_kxdWqwc$Tlo|lJQdYKZ$8}pL_#gtT53_uCn=Swo1*Vy> zZ-X_P9R4X*PZBV$EAB+P_Y=!YZk_C2dxNXwsHYbZx?VZ$FAq7V6VlaZgS|doKu$2_ zyBw^%bhKkXG21_bv-tw#v9=BHn6jcTw7yC^>0Y#@e;W4hn6u1F$kc-_B7W= zFwUt-_0P>gKpmPRfwzhp20Fr>`&v<>xn*VNfxW)#9Ne2H8F_K8Rqo$in{1+@K2EZ| zJI)1ou<6CXP8BB+2~@!P`mKv=PbUqg_w7H=sQ)IwS3|eTVS3Vxm41NTE2OByr-3sE z?5pNPGh8Yfs)>(qL4_#kY<6V`O1N;M9kIE4XsU3BG!hU=5hemo*AJdY+iCj2B#IcU zWReDItZbmE4-N*FW13ICs*n6`d$zqFY#>Amv(1rvkS=!Ukg{C8iTAVmJY@yY3>p0i z{-F4$i!GqgM6a=wOXZb$He%{MInJaLDZE|TU*}S)k1CVn$aW=Cg&&mGzr)A!2!H#; z4*kY&Fq?-+<{L&63^<3qu&+L)`2JQ{l9YjtA!tRxBtgQ+iyuSww+Y%I^bPC`S=|zR zp4Me%N`ho3LXe>wmkYJ25Yn^Zq0EB)XfOif;S2VI1E;9<<1c@vG0Q5O-1XYhz#C5D zcJePzVN<(VgWo00al-w3TUHZoc+uk2qfkKpc3M~H9# zeZA#3DtaMJF^gn$-{vh;pb02(j#i_Wr90Cv%XN&AONAH9 z=$dc}chDr6?oQB=(GZtPwmGdf-X;h>LjxyaIO>E4g`Qlp%7;}Wmj2Byi~urpHukB% zXI#S_Kb@<4>Xs?hosX(%pVb1}`?w4F}N4HD!3 zlG|l>2K69Iv43Fc4tk9hFq1~Tj~Rd>0va;@1;Cda2AvOAeN)eB;QtXI^c%|$-L_;$ zvW_;D0rf9uw)bMReW+%G5-dC)W_8=&h)5e{si(MSrH4}gTy{C+$WVo)dEhT@E&ThJ z?%yKvzX(kMEgbx`0r!~xYxV`}froXChsyq59f`EurUk~sY{V4h^c0GV;+sSY(XWFH zL$3PzJP2sbpK`ocwncC9;NY56F`&>DvjQ33e;qAacc$5G-n&hU#)AVxRN^X03d5cU zhKPuixvyeW|At>J7m&8VigS1c&5`7 zwX^za?`$x2PfO44*#R|HD!uul!$3R+g>BTd!$xTHRva+#88!=IqVC*J&;e%YVqgmf zCZ1Y+llGV8>hXn{PfWWzKv+8f@jVPEb=$Vgp6Gk3a4FkWCiZFLyI#_FNS%L& z=50V*#r{4GaK{2B_y=8}_dh-drNn)!to%E7b^)w>*4gm{>BWwqKt(Pj%CAGw!y_b2 zY{QMO;AbXE;Mdw(((+%UJ9#yE@gSKM78u-VQ&3ixxVHz#kud<=uwW7C?)Kw;kSQ2p zOp}6(q+|DZnT>e&d)p|fxdj5iZ@*mGo`PNMNN!qlI4Co}N(jGYF)cIxLolD}-jD&q zQuH^_`Ab~3b~IDDb9!-M@hBYACaEL4AL?HPYp)|b-GYj;=sfDI@5#l?1g|7+%m+y0 z1I?7A&nk_bC`w276;1Y3WCAp}Zt%0rST4A;ph?H+d>@Tu3fm^%qaFWz_!1wU@zdm) zDhxsrKc-}1D#i-~d%)0=*>K$*8I*t|djJr=#&Nt2AF`(Dc^udbICB_B&vyuU!0XVflr%Zz&YAYXrjpBb)cJPG;!KB61+fl^XYqW})}pLaf|tPs0{%GtB~gO-16QP5J1 zX^w-_Jkr$#c_(lS19Ir=@ubI14{AVhdnfn^v7D&@S)g0cpkX>+>$0$rem4&tqok!4 zKDea^T6%Q(Zn?mz9f$-q&Id`~goRi}V~+oy2lPLW>UNi{sGgKmnEvjJcCGtYkLL-w zwCmul->AaG+m!)y%t&eTnAD%PW3PiQNo02F9Q>}8aJQq!Rfx*+hYq-qeqvaK>p=`) zLmp9rV#S&GD&wY18*{pE`1oKx19kvvwDcoG$5>(TWR=o-y}b#Se`scsw(i!>yrqZhI-@8vb)!geB?uPg1cg4El(;yGdjHNmRQaEw3 z<52!hq_Ze3sVpMoKX@b+k@iOgs)3%OrT56BGrgazALu;E=!B39vp2@zr3Wj(aISpk z-jZhhxfeWK`Vdd2xil1iO#xym*9~F|+IV!?6OU0LWEGmfNLeX_6#%b5T%0q`F7T65 z38<0V8q}&;#6S`O2=tW*1Q}VmV0d|P%_%K;;=lDhnzPQu#iWQna=3Z1F$LnIH4dVd zBUjJQ@4?9eI-uYy02qNjfIpx>PSn~4BM)@1A|ofkK-Uevm!h_B$xKWPq+8s(NE51y z;6@)j3GB)BBgr!qPAdusR{(74p()MD@5ALgfOC{qe&NjQ`DKX6j(O2^Gy-v$zwQYM z&pFQVN*IbG;RNW;$k1dF#fZsko})(0@(&T889y5AVke6>wDYTD?KwMCmFx@{m`P3i zFd$Qe9}kQ>Y8)*xhpJ7LP569jo1AI?I*=4K)muW35B7P0qKEVY?nS==4Z|tstdiR2 zLAy_*@Wgl%pjC0iHaU%L7)ff6)pybOtWp{W9*?cMHS-%u7zL73Covi)T=46u+3g*6 ztcVS#ApuJ$VzjWeGcHFfyRnnENd8dod~)6{GXX2xzfwsJf3V!W79tWAA_5wJDmsP~ zS=!Wh-=Pr)g+l%Fgrp*NP=Hdh3x;E*HMqU_hApW7_ATOc?#gIX!N0Lh+UT}2Y0o>5nj|?lIg-yi| znJiha8Crf@tD~lF*%m^L{}hAd73g)EtDo|ysC3f>q036Gr+4kBq{&GbNJ3XHFXiJo z&8J4=IYmM=Kkxm{4u8jWgaB4kmkfge;YmO(&6y0IEG2ypVGEED9$6=&N932rI?p$X zb4lK|=Kz@LG4_Lx7eRx+>YiN@AvLEXkzb0yjI!1+S0k zWa4;CQxCj3tXb_&kVPE{pyAY+v-A!)?Ut&2H5w7XqKf!2$w7vgKp|Q`ycapL8^YZH zl4W=1{)u!>PLOnpP;%>JWi?z_kt_n7Jf13ZwYW65Yr37k!cQ_vgUfpYj-5B%e73p1 zOwKmJzsJbo!Vqx6{mFJkr5xMlRiT1|%i!2#MP{$up z{qTKJwuxF8K$XV933bqKlKbKB24dbH%jk}#vmri~(Wci{E{SyFE*vb5jFwe2CYn@f zran7!RKr6!OtYkT?$#KZ9@*@S6C4%->6e$E>#bCL(kBj#8lsf8>lHP>_mE+OWd{FP6)dPsiluQ5^EXiA6;aVx(4ey996Hg9PI?`PHV`}_ z8w1`ktD8hM_Qjhy2j4oJ$Pj%R6Aio%+bKcj8Cax<)KNnod2lL8+%plNR>QZBiUU&> zGnsCKr%Rc`x%hB`hbl1ZCoH_T32J9zkbYlgy>La;s)H>QaLiwtRY*V+$2bMYT8*4k2hD$Q-KIslyzlh3#wE6yZO87|LX zcg5d}tq?EDfK#@8RY3|U(;JWyNm zg}oB+JkgoyIO6==9@PE-svT;2v)7JWY@vtTOw1)iJ&&8R+V3)afh{*C3U9W?IgAB zD))|_RX`N_++5o=@=4pN=Si^ZNy|u2562vAU?@cx@kg`|ki1OCrHWy57s`<1=O<>? zU#u;x!zFjrf3W{o1#rB(Yp-Xo>Nz)Sbq@8iEe{1Y}>k!6s%S5;NW*YSlWNul1d zv#=W6!s#zFqdA|NSvWzeVdBy33%lRGLCcCS6QGrzfOr>+ugjFD*3s{eMWje7B}8jQ zb1SK+iYj9M_*OuQ7ONyS#1-BT$unSu^OgE?}@`t?C*)UI0o z$oDnpxLqTn<2fb6=!$QKsvM}!>HD0JsUWm+#C()8^r@gSlzxb0E)|)nFS6@M_kwsU ztF7C2VuxSFy45Lo)LN^OM&XW;@9JaBnu@wOa85EK`q@>EB_8Cc6S6~a8$ZRc8JH|9 z5DqBt#*`yU%F#9Yc*i$~4#!LAU?YT=_4F6!iJAU{q)=b`h^M>>Z#5+4nfc{j=v-rcx1{lXVq`OvgtL(;h` zp~1lz3=zGS;MT0Iov6_mVq~ zSjdkGUa8{Vf!7Q*11ezxHP)>py)xVPyzU#txEr%T8LfPoS2PP_zhfXmf$yJ+!ONsy zJbA0D=mc$_6o1w>Iunz%mLb?=k7``6kWT!7e~r*7tw#&HS*G(+^pG1lB@E)6XO0#Q zA&Jq#R!no^r`}_&6q^!t!b-<|${sr)#qGlz7nquJRaxSUz(P(gx{VH>Wn|7Oq>lSw zbsoCIbI41hWy8MZs*;~AQ^XjbtW7}E_*|8p>;1EpgiSTSD=(L-KftblWDw2oW9Z1p zmq;-(v4l9#by%Us>fWSDR>g^fM47p^aDoq^C3}LY3m6pyaLm$D=#)ii7Z+ILqBoMz zIfg*C*}%t-99n<|_<^9HyB|M(tX zhx6lC7EWd}f=6+NY4WH=F3~0zoE5GXFDMfHBcKM52(PGPN5M0S_(aMmSs$2DqpJ{GX9= z(fGuIs7E?MNT-;-klerzh~ysw<~0Y;tMMnpZj(B2VwcfvkI-ZKCFdYF4yeHRDiB_BG?Et%4kNxI@fsG(y4qw6K&~+Zjg+Eo^(J-#?ob zly?zTt0UH|nI=Zq>D!j};V*;2BZCk33!8+xP2$%VKEYJaird&wl*U5R;5P=pYYi0^ z%`<1nrpk)pW-RpgkKj0$E~q%U-YBaidJYI>IL7HQ$#{yt19Cv?5?y$>12c}?^L&>X z_e$8jL5D#Ul3psmCl5M>%6W(&-PW?}tlf?dCp21G+J`0k-YALqz+sbu`by|f7&zNs zTVQIv+=WNGGM-Z(EM_9cqpFJeqtTVce8TP3^)dHHS64e*~NWc zKZg{T$ETv&ZNRa9ULL5ri?4DT#FqZhDZ{|BaUR_FUEn-G;w`($IUzawf;yv{Pi(sRo$De8Z z7eCqoDF+^dsLm(xcuGs6cs3PmEjqUk{66{D?{%@6(}H*6s1k~KMad;+jKiZQqEjRp zbFk=Lo$hKiw4;B#S0y?V$oKw6wiv>Y0LhDTV^lGC=r-%h%!zX#l@@W%>)sa@NisH) zj2`4|W7y=<#8eTT9Hf`rEm$>_UPkg&XBYL`^@MbvD}+pow#tm(P`T@TGKx3)z(&ei zh!ONUB)k)YRB%~Bzxj$+b^3<{;e89PJ7T@JkqVxI-Sm5zJQLO!gYOI%kK$5W%ZMPDkOomhAYaw!$3X3JDWxTUQ> z42K>^C-HiCx#{411(iJmX3{@R4L`g zqTZuxV&OrYMw2S>!psl-BeG*&nlBXPnkK)k$f#&H7m98rFJ8?ZB`XFTiWLAs{ZF7F zH}{9bW!(@L|Bpdd5)F;*YDZ_HfP{w96Y_05VN^rO|2z<$l-X!PDLSX36`8{_%OOR~#my z5{nf!fVufHr%Rm3TT0CY7L?Oa!UjaH68+VEzDn_WJo7LaN%ap*MEw?pK^JyP>PG&* zXX+7S0n?1FM|hcT{?xe%2ByuW6k}+KGnBW^ePfXxDx@5Z7|1-I#GnpP5`LyhGnc3f z6DsbwwboHNRKH$`WoGQ|hlp~rrL5!Mg|Xyi)Ye=UecPbk4vcurPJR2e)1q*;Jl-VE z?hUC>5&Ru6O^%Hd<&v&~djRp)JgmbJ8byGN!Z_6k+xojwBObaRm$Zf2#t4&;bdM(- zzYs+C)S6+1=jg)4sLa=1?BD0>4tX zG=q~M!mghDVx}N9+DSaQGy&jCvn{ki6e6;@EE4Xi zKK=fr%tt=6ZS3Klsx*yqt6Vt!6V^e7LER^3aVHhZJ@-$mDYt)nPF+=9HN>~V-iYAL zaQ3#Bd+0LB6z6Tt#m@#|sAG$;bk7E{)iUJYKrV;VdGc2y`vWj0B_Y?t1p^r6h-iaZ zGR3!TX?Z>h5wxz4oDmF@p|;5yIuLUr$#%_PqwsehyUrzUqbJr=sAaw!lPuFCKbVA# zTqnox76vwt=p2?^Vz8w4H9~O1GOux_ z9QF|bKgRaXF4XTr3AEbru7RYJ4HwTiqp*r084F9w*qoe*VH4AfHD>gs6@v*T##j=b2 z0|T4)2Mprz#w*@8==Tp<@ZEz014edZqE^1&BN&=v*W-ov4>E2~0Wo8lu(pm>^M{#0 z)BK*{LIwgc4#MQrl#sh72}%nlBy7>P-47nUTtdFiag^Wnbfkr7!=XvD)eVZgJE-|7 z*CK9S!F9!+?8ApWv-BS06#C-QJ1!sHum1jzX1>MDmNRSRg)M#{#ms}y3qW^nwf8B8>)JotO%9EV=R+4w6H}2DnP9u;BYD)vj8H5dEK*3Y z6-|bC@Wsuma=VZXdqdSu%3OLr87(4H;m*mt--+SPjW=Oenk6iTOiCz>$0Ea8VUcAq zB(<_Z>tlKeMLCs2xe~A6{z!v7>i0R}oCUH~n7{`J{jp-xi)FiC9*9j4bLHvpKk)x# zTKWZh+!Qh>!fHTDHe@(bl296v>L`uZOz5OZ3YC6)O(K4MfWt6pc0|^YIboLu5&3}> ztY|C+SJ<<~+PYLoUR$E>g@^B;)jKQd^rH!%QhC5Z+yv(1kEMY=@VnmU zb&)^RA&8fhcDo54U~2U?`xeg(?a!^!{`JuX+ zZeU=;z$h#E56kQLc+)%N{hJQ!5{%@T&+c-p|BYq4?~hAyN5g{D&qRlkzS}|GIfbr> zj+JYLWdE@6iy{|J6HYQc?s(&~J*{UZxlt!t!f8u)HYGlHHw3I(mQa{84O{4Mr)0Fd zTos_NcV_yy%3l0Lwfqj{ezkBaq|EmGW%aIe|e+WsxF=S<`HqD=kDKTz&PTXloAlW5osTEw%GYT*t(zAgq3mqAlJ2i& ztKac$pwr+AotQ9NTT3*t++Kh#5%~8}sburBN-_dcrUW?5{&rkA7pvH;>V=S)&wR@4 z#m4Y&@9j05hTOX0;V|Bgppvi~vVw8JOe_9@Dqd`7uUO5zA{_UpD{Xf=PGUS*y7Gd}&1`p#e4q z4W>k}hBv}r9Q_*65S1%nWvP-<3Nt9b9A1BV9@kQ%j9_BJl*CDycvt?vG{a8jLiHVK ziH9yFJvspa^zE-Og4)=z9Q_T#(ytTK*Arj~-ie&3&~MUovtZp8+xw{+ba2jAwBZ*JDIL)tRv1s=R^OJQTx9m!D1><1*1zTLBk{JT zlui7#m!7iv-vd?7!{pN3O-%aVoZS)NXEda4?p_Kql~LaUh_U&(!ll zja+m_6boh7vrjd7K~&fhXDF}s1SB2DT94nnp%x@R@19)@X)mBWKwJCiVQWB2DP(XX zGD9e$mfMij*GDuLK~~6cARrmpzX0Ar%=MwvR~fYmtAPtFruYIA`$Ly%=08_p~&8?$L+&yW28R2*h=eI4nOL zUSHYTS_~IUS;&l4W^(O0Sc&+dWl=sW8AL@6l-##mQE<|mMQ*uOde9ad$)p$bwjXV} zzQ(y#HtvmDjW~O^7Q(*Udv!r3B65qEf9$uV$N3{F8MVgaT31HeDJOr;s-u0ms{=CJ zdC8U4)%1*vu%)c|gM$NRPXt{{bnLFS;5k33XLSl~fr?k}@_eKm2aEX{#c=*)(~rsX z@{7H|in+aJry38BqhfzxEhaq14>K~kzvWpjbaPG{wsg@L7#i-4)CqKlliObm3L-v4 zM7*r5bOo#McvoXW=yge3+1iU24Y=2euk#66aX9Ec|Mv8Y=!}-#R8H>}7 zb0qQEqF=B*8(I%U&B{=jVM}mLdQARbPvzz^MdL;sYqv9Y+>JDhXH56^S){Dx=#I`! z$d$-r@7IZm5*p&>8aRum|4}Sj{}ggxkS0E2LWe_CO+u(LoGww?R$E+~hhizn0Zq{; zO3j4mHtWn_TOmqxkeT7Loi-`Ol7->mL7Ci7GVu@Ka{%H@t>{s`smldsagDd8*W0!(P znseGSatTp9p2@_1>yV9iyFoyJ!NT(NJ$Fv7BoltayI)^&!>^6iUfLTNWrQatN*EiH zW>Pw5WT*Q5N==KC7Ikq&ORG;Q_NHh*xva-#(8Nz{$5yXoq&GKla`L>IA;6SgTrxt+ z{mRNN-6^2&?R%;|Eb*r1$#s*Hh6iu;Sy|-^3ZqJrL-&5HjWk`7>^6oDd#-S=9w$Bf z$u+0RBM~3=RH&GhMuCFkfwQrko%_OeZytlJXjXq`ay6;+q!=Yo?|&uSYf=XL_^H*W zgEak{y?Cj|1!RwS-+glr5~AuuF{D0re~@#}U$sRyypWI*HTkj}RYN5o?|ISQv)-6+ z^oQn~$tJm?rltn*uVcp>KiEE?_^C>7U~DXcvIE;;b!A0VN%8aNy~5FaaeS+c(bbi$ z^z!lt-gL7z&buz|ICx8ILLsv-KdiPbIBYWd;7Yrl^z)#iK0QT65h^ts{nT$VlklFQ z^<5y}jOidX+?0u@Q;u~#M~_{9j+=!WntW<2eLo_Q^+$GLE|5|9WqR&A;$DHWq+p`5 z-AzmPWSK+|M^fs+jb#*#`C_EUUR3|WcF_9T1Ouk~rEJ42le2S$ctjHdMa<;=`a&vV z7pC5}+!I?HBu%DR-bKAlYx?K7{?Cnv#zA88ffs@zgO9CMq-@w$ znbFHSS)+btQEFhn_Vbc2tjeUIXE$p7ZvgE^eT82xWtn~t#j=FXyS5w>Te{?xv&i7B z;3a9n$0Mmdd^qS69=@M$QB?~?>!{QTSqiw5_|jEfzk^~#{J<~|jjeAcd9)1iHO;ByoVV^k= zjaj?*eCB{gahbsSl>NR<)2Ge7Jbi|%_<}%I0A=fQ(u=#kVKgF|TwR|+H1*k>a25Zw z$;${63sSu@FcRgmXqHm-`gxZ?H#)~R?5DD;0eW${p!kkpvn-JTL1O=HLj3!nH0;w# z^rg--Y@*ssgMsmJvTSuNneQ$AAh+ZX2W-6P=;p+hn`!waGbI_$MQugW&v5XuK#UvL zlMH`!5XGwM5(jsYO6n=g`x)EcCTs)ScF9&pYFW2h4C}4L^vUi^mh`isi)T1EhAwDq z*!E<}5-$4fXZ1p5gd4NLnclBZw!DvKc}=a`p1wFQ#N4)+VKZD}6|N4p_XXs`yeV*n$p)CA&qdu<`Dx=e7Y0?(WdP6nFLp zgYC-7u?5l2`#52J3g;$6Oj?$mRC^>LbWR)X*K)BD!`an zZD(R(0fZ{Et{bHZp{_`<*|P#u2%_D+w|^Kfn2^=qKPqEc5E&H226^>N_y#y4^*T|^ z_y#X^eLFhj!Ei&zKq_9^$NR=wXm{!GSRtlY;&>ph7?;<1;QUnL!EL_)%)^^Eu+Va* zNt^VTb;AtZ5ZB`4+l>R;2bSl}I@_%J{{9g%@|*Wzb!Lf_nfc5+%!0p)eO(b((Ve?z zkhE_hznd*Z9qPB=8!HY)Bzs1YfHaC+m zHZ2Qw8LyT}!Tjm8_SB@K{?Y5iuhbyHcq}0L=8b@=YIvrGIR~xdq%$^EWcbAeAKz4) zmXDz!WmI%@k;|bNG_ni0+V@1H__g4%J*}h=6bx-?!Mi|Q!wZbBt@WsMb&2P5ep)1y zMJ5geH#W0B%lJ(&Y%OFy?G3MvDxo zIj8N0zV!+`jr>$yt&xxrDrUfv*jFO1O)J4-a#xc?9yRkCo03R`K@jSv>sJ-~GNZG8 zB$jCtRNgq6MK}lUGjkhpLS>kdqXF$Zr|ZuDrY0bLlmO}n_pvc(tI z!>_$PDCmP!<-;32*nZQ!kGrE!`J(O~pHQ$B{+Z@=ex^lq(E;@IIXkq&@XiEOk~+y3 z;X9~`Nn6*7i0?@IvY{LWN%LLD&8GJ0f7d$Krqh?LL+nm=5m#tv5RTV}zvIV@FL31{ zGst%1bI>66aH#Lg=MgubbpQUKEEJ=NGn!;2!>3DgSTPuEP|7@`6qYgD$(>A0;P-VF z1Iw63Sb5{&?VH*+y}||Na^L@0*rSaJ3y=Pk_71L!8Wb(I(WYeW3Y7HrfcCX7BdeJu z)n2Z(r|b+WPESNK4RNBPX6??~+uG+#c`XfR=R^Q^dFA>{lfp-5JMs#I-{4kjk;=xV z?sYu>Q8_F={eiLQ(Hr8T-bVVeX=w)sJa-hW>Zxn@7^*)2O%9RLz!(kb%@R|C#YO!v z!yA$Y)0viT>m&okHsyyQiM!`0@COAAwVp*~&5(W*z2A>#epGG$p5GnV-qXMH?Y@iG zgi|Lvn8-fPnZ>1X%dCPj(rn%rWW=k-Y%+~0;mz*TwXuN=s!d-yo3|#>tejsxJ3)5- zDjfYDCu78>(~>lrVQ4hCe&BU;WXg&j?7LPr+BJ1Gs$=(at)l%s>&lCX(`eoumvokR zC4RY2Z7DKe9~cDheg8(lW@gyjR{DV3D8OjH;)^MvbF)aJoqE&jeMs`eiN7>vAq0yO z)bDQSPcHG0DiX_+Oq_|Bs#Iw#j9~v1-}Apd^h{?*SoaeNGSe>-gjC*Gs*)D1NfH@4 zD;IGcX(F7hZxw^BxS;%$3Sa)Ueqvzju+O7c6Sw~7U)RUK3?#JcS7I=bXfR`edxDuT zxL>s_!s728Ug%NtADoe7FFO$ON%!++p-lpJ!BQc(SM_91bel}VmNR0AQ1*K$N^tl8eJ$Fcp%CuDB+idCFFcvT zJ;@WTP1QE8e}3ZkzhAH~{24W6E+pfx{<{@z-TwtnUd8Qy!TD%+29e;PG1G7F7PQ^( z+}9nv1EV1G<6z_GUb+d=j_ZxM78@#N5|s3%%l>`L$nV9MO$zDvGsk342>CQg_wTSW zg#Z5YH!g*wjK{WA;a*P`t5tYkD*x=S^Zv;6M1(*slHcLwGY#Yv+#kFXL7~fn&!ir- z>yOQm6P{y&#iT`S(W(^7s&DLZ(Eye0??x|8Se2klQfcahG(~m0@ zhMKJb?2P}6Joi8I#Omwz@?R&nK1Vl-!V^v*?5C0q&#Dsu8mItl6r zN!r2(pOO~h$OzI`!(TsZitJ3e{v|ipE3cr^rinfK)pW8&Pbmp>AVwZ>D+JwYbS{Z^ zJ()l%=C#Cbhn_!$FRV%*@E8Te#LVZbT{2t?#M5j$FjWxKnBR5cni}iKNJ!{aug*xi zcWKLn-(`}fs|Q@cX9?(IHV)bE|M5l%SL6*-ytJ{5pRJH( z3SGkwtlJTh(qO>uUx855(RQl3Me22#K)dqUpPw5oBwV_e=+&JscBxMnB7dFrmhaiv z*c1ucBK$*%Xa5%RfYgUr(s-4nV5q>EGBBY{b0YV`7ysbmr^*@|Q(qxSuR;k}jlvQW zZ6$4L5G{8RXMeF3K{!A|qYE17sJuKi=OBWZjo)|mGLW2XwQ0w%*LvH zX&LG^q81{YSrn$~jqv{+D^(%0&-*RF=gsOB_4I$MY+B@;~b z@^ZU|SU0X~TC`DMwQew`CCk<(6*#__mR}2hLG~My;mpxVKM`g^Tj4Di5QRsB3y}d2LM9k`R8QGbXNr59MuE$&Cyu69k)e{OG#$4aO zo2Rd-UMuKrrR~(7k6tV&H0tJYadjoo)(q}9A&w;B#oDg9deRF5kg=MT6tgEF3n+Ni zT!36-=@dTGCR+ljgxy1vvhhP>x9UYMP)w7{SFH+}NJ`3>mb_6P>#H!tTv%&4HNg$o zyt1+qT6dE^6_k}r!tl7-AyvKXaRt@i4oSJ`sf6LEt6X=bNN$xeepj4_+~qQS?f}f++r@#)s2>&_{PVi2!; zZ5*pmmsSMDr;d)h*F4V0rw2zzCCoP$SRnoeFLQIBZ`WO2 zXRIwrf>N1)7C%ua28PBz*-6TLsm(t?Y>sEPMt@fNFS{pVeV&-#CJHt}4GHL^B7#C6 z=V3bp&q#GzJ;p8|zh89V*(;o~+%E5-KmYrqH(#M0f%~QV$)(4Ihal7k`}v8Uou7Xc zM;q?z6KBGwz_~j(F#(BDXz%Q{Y{kT=K}LcrSvDb2{k0NqXlr9$L2VBy;^a1ctGd`i zm0q(t^7}&hYojVFT`rv{F7edV)!*P43iA+#B}e$w z;%L`5G{pbZvS6fjW`<1rd`-EJEtoonVZLvc+~u_KE7RLN+{A8KM@LRMI?a|{69T{G zk&)?MY^m5c(|s>MYo^BC-9;cbcc8ytLP4QeV2(bbE*AOxv6Lw-lGA;CI?qFP7Z;a< zbqxm2Iz;!j(`<9>%G#RI_|fBwqp#D&uDw%V4|sV^-@TI*7d*N@K0f{iM?`Q6k>r4}f02SDb7jv<7U+d~pkEhN*;9Ay3%j0Da zLKi0T&uI_tqnetSG;KOi^Pyzhet===Pa{z7*n^Oh^FeRuZqtC_#jafF-2SOtoKe18 zaBwhk2Ko7GT=+3OTMP{|**MsX-A><=kNE=#a0dZtcoo=R^RN*QJl+nnCCO6T+aE$7 zX0o|&pK1mV57F;j^4vcxLk|u@Umnhc1V8L_~@B z#CDV`sRn1Tl$x!Fhll+W6G3Uu4vr4{#}dAc!_crhA|*qcfWX!rE6LGt>(>)FnIT6U zHAuPC*6T0{O$V=7`X3H4kDmMUD~SJ~j%;^5Sb5`d-q#2zsIuG2Q0KR1&)+w_Z7{Uv zc-qY9DWk3EpDF3-bSXOaD!{LW3LXL7L$cG;_kCRObViG^Pr>?S)_(oC6oZG@X%%zc z{~mqqjtgBp0?c*B_wVQ*>gxj#_xu~bbs!OHZm2L}yoZaaz| z2)`n~2J2mU1_UKz*q<1f&){GguH+sczOk{f(@t&Df1WYx8+$mvyY0F$h2MT4`$`{M zAXU382S-G=d(0j-l>aCw?ao?p$+kS;=jYdOKg5;J&6zE1jV&_T(jn(CoMpDxL^&PV@cKwQD1GBK%qCwBx~H9 zXgS#5-wv4=y;o5KicMxc#@(Qe2v7O!8piKy0_@t9%f4SGV zCn^5Us@vgK)yn2(Mf!%4@x7eUpy7Q}GN<_`Y zfS{anTCM$kK>^^g;Pbk3b1J!%CMiZnt#u@tCLUeL-FQ<@7m5*`xz2$R_4%R3y}Y6v7b!Av<}#db0WFExYMxb)oe-e^S5Jn;1+@R7|+`j&M0_;DhUFv=pB0~yk`>!) zMwq}cF*4HodxmU%#8TX;1u|ub#6pM-K}B2NQ{v_gp)@T5?~sbwv-R?eqRySuOEz}) z{drRU+rNjuk2_xm8~otrU_zwk)~Sp0cf~Sac%J!i%Ai-Sdl#?Cjln(yK6UG>o4YL!2PV4C*0>eL)2M zlkdXrDlPMJbdWC`tV8ypcUiwb?cQjiEoc3U54>CD!2tV$hPJCaUANr>a-SO*80S^$>^6D6YFe+0)po{>?QFh6Tp`e0k2YpkjZ>Fn>rNP<8EnHit@2k>wE-czYqV2t zi4hTckf`K*d5AkL<|Q?{jUpXpshF%_qzd7tV*&QOz z%S+EMiAueg#5^6p$5?27j)Ay{ZFO2HtE1xOrTuz;(a;cLun#f(bK<$)j9@`H3Aou0 zQ?*k!{Y~5i@wIEMxVixDoff2CK9m_ONBFImL*;WsN5az2eSblINzb}S9kR9|Wo-$2 zdqepu3#&fd)ztS?d!bh+$N0ghTABzR3&$qwSm{SVWl{bjQdAn+^xoUE2`MYJ8F^f` zYABU?g(13`x$Sl?uvNX!QCa1pa&*AT##u(e*J)7HRLkpe<|wEK7xx7M(^Ic!LlwkU z*r`jDW)(lWV7x?nw>O^L?r-;#R5U^v8M~GFI9^PlV;w3pqze$<(18%XYNdV{?zA zKy3vL4dL}&4#fNwf|jxR#Ky~W1MqxfR=2w7!Q^72(YKAig^_g^i+2!<+K5;WI%16d zzw>f72P@1kXCDkjM?>!c!GTNX9J6GpSdEC1tH%P7`*vgOaA#aBU!8L^ltF5Wk9h*8wwElA1m!Rb#KmfB^%P~N z8jcS3>Tx7mA3>&Xj`1B-Z@zsEgPUV9-^T%VL_+KnfYs?dxhM4Y@i!kYMZz{9%ljuM z8&gS6@8JbT11Rq@Vjaw)VrVP{!E->-Cu7QW4f(39s))69pO;U-!EM8qO3kRQPU`BC zp1PVrp~&#D13~!HlSpU3V;RO(9L_Rh+pA~~CEtPKC@af$lw9aWJ>BUOs~ zmL)aa73}QQMNHq98)Lr`!SSWkfMzS5s=wAAOG-&{IjxX^yM@I@UsO2y`!^YDmfZa1 zvETyS*IAj1T%Ilqy#OX5x5?RUmBnFeOvX_T)5G%v2p+x7cM2Stc8c69V(Fs7K6Q3h z45A&`AFpC$shscOwMYl|liWX4=a(9^^BWk%^l$w0M|uI|o0rl!e&2MI)Uwzx@E;D&olqj zu*gW(xvAMAHa3pJcSF4W@s?U|zq|M!gp{bR3_u17SEEC{i46Ow+HRm$jQkc!>#M= zOaMyNdfk;T-*eiY7WH*bp))$eZ!6B8oVbOED4 zqRKhe;W&U1ZBq5mxjC>wk-GmY`_CaZ?rOi;a6=XnxJ%S1>p!ae;M!SX zz4i8o8f2-6UH@BS%!p)Sthkccx=&n!JX^p@8{2ETew;~~$Fb`&sXjWpJEgLV$IU$o zk*i_UzFUkSh73ucx&*fend$jwFGP0~qRAGh7s1uCnmMoXLn5w)bjwcGDU zJUU>t@Ax;SuO$ONp3qniR9F^x6KlDW*WiW@8Rc{Fv|8E0(iDT@M^O+{gA5!h-J9;Y zd)Mvk9hsf?4AzJUola&2p&T!wW6cf&IzGvnn$ox)Z_dvOUVO^W&(Cnsv@P+hovnNy z$7{?1^YPn^W1aPD#HyE~!>cZVZ}^-To@BpsmA3mHaNeVjMvRwP3PMI*f!iWRmTY_j zWvoV%AmUOkj@doI!!kol^dDTlI*N4aFV8W9+TThT_NJI66uL;uNy$02pnA`i(EC4o zaGT5U@w`oyYOzDIKqCb?Ilrm)IABsRE3B|%s5m+OuV+ISYX02+;BqdPk`UEmqayd# z5G+LD)KqPT`>_?UN%C6GhwM|XS16Zpz1!JfrZzUD&(6=B-AoO3CO?@aV~>)ypX58p z$XPOi1l_fZ!$R;sIf6%j06bBaza+ftJ6dT^1gFBNJt7dAfKU}?-oFWjTaeF-|SlarquWIXFwX9?85cWs=_FLh8Hle>&ZI{?UDbWyR|=RM;qL``EeT?bTt=#IHJF+ zwrfJ^Iw7hBmcoSFBk2X%wcnJF7?(bx)wVW$!d5AEcnkm&>O3K3#IM_koR&5c=!da! z-j&UD$_D{vJ+2EY%u8MI!Hu(DvW%WW?bpaYEB;fPo8CfR^$*O=H>(ei-a*5uyzHwX z=r+3TdF25Hc3nWT7j8?asOCHIK0j@#(a!$Xqxj3V!Ozoy_vitMpCP| zU7U+}KurG~G6CsnzK_@huSN`hVKAjWT(f}yMZ5*eQ>*H1mT#*9crU1_y`iKuT4Yaz z>irQc8KbUg&aCMV&GQ_sS}Dc~1L1_6l)@KeCl}T{Xn(5>X=52Ge9r5RA7{xVcBoro z5-7%MRrKw;cx3;qK@&daP z%k((ZnegvNMMYVy^gZFPIj?nQESvUNzkTYr{wiQ40FC5?B$8U@DbC&fOSIa~sIhip z0k@kngCKeOH9PxJByxbzIOH@VH4uD`{qBw~X&0H?TAmi=tx9h+Pb=gx19yySNL{Od zF{e6K6HnFOZ8y#LEaBi9)qEHUWc>aa8rnbV7=pu}pomGDmnWxI2XqNoZrhP$#~pa8 zm|BE=cVv5>54pShMbQ)Z#@{~;h2>WTUySH7*US>y6YBs`{z&4M7r60 ziwvao0px(@V)uYbgba@K)X+=T_J7n7W^6j}rjz(HESm+; zvhoZS_>YzK^$~N3$#!)S3?jFm%wMr@a1HZ1Zh^nxurYD#_h(#7RxW(!X~tS7>xT0! zJB*-Q$6A+T%?aDy5x4_@u(s_N3A|Q*S*k8u?jP2uJ7VwCZ6V{*ZL&xt=)s3MarKx% zv&aYTqk%tvk`#x*0j=bz!Y9TD0X>k{f72l;6*;Ca8p(WiL4IisJn8#k_YU6e>R9=a z>>?tEtqB<};w3bi4R6J>UXvgmV((W{{I_7|T6dZxuT+r_r?$of@`QiCk+V6fAXA)A zcgl))`=;@uy6IjJxOH01R4&)4cVnp55gMp1O;7i}wZ9D92qa;AonD3F2=;$XR?z!` ziqB|UR~RsGl37yQD*p7fc>EC!TU;bkC%roPR_o>6y7?8pU~5Z@4)30~x3|j|6E^i_ z;Uh5?fjmw9veA?JHkfN+fbG!rb@!JaR1r5(&{TYE?luz22dY9(P4 zNyH?G##E-nZjH(XJvDXm_kWBsGWE;Gt*f$ieu>^szqoMQaHy&!aCwH)V8S-H>$I}6 zk@4;4g8(|^ohesRCR2Iz`WIoqH$y@>!<6%}JF#haPkwD}xX=h05vRpc!#xIZaq5(V z5<7S8ywXyPYnmwl8ezN@+}y;siTQL-3o6&{{-{}c{vj&)or@YzO^y4)(xSZT8wsP9 zFfVg+^UT^G*MWRYX#B{Z;5TZP_N_c1M0!eZ3 zsWG+jzjaq%YPUT2auzhpcV14pxZ-xExWwFJjO#r^PgE&3dMtQ#>KRn-SWXAoB+Eb? z;DJFnSRYIqA?1H7w)~Ul7MI%zG*={+;es{6vq4`o%A8?8CV?FAJud@ zB(idHQfhUDGQI$!B#n$vKS!AOyt3g}*U}PIHKn0d{$bSMvl|ygm7;P+5lJN@`In75 z8qwL)qc^fOxiMAa|9#x?n$Bk)g>hb!MK*;iIJ}?EEr&jAeu{LS>4R9 zef1oQ3?1p* z7-enmXIYz11c}=Q0F){E`q`BOuJHnsUd`(ePOy&Dq4vPuC zxrF|X5ip>@mxE(^_N(1svfLVbymWh}gO+i`+xmrk70lLvU>)GYme7K%k`kZNQVuF< z{Lp4SiQIegqv)%vSlJ^}HRmg9B-~@X(Fh`Ct&mZ(rB&mUd0Op?$fF|%#8Fx7NegG~ zkLmXu)K^<=0b?k<4qHtYWvi~glG@%9bf?s84kyadbSw6%K)^<`sJOV|oYv81r|*e| z1?Ss5c2n*5Y=k-a`2fDKV_m}>r`%H^?TS7@ckkWnsnoQc{H07i!8`20ibu3y zut``oiTXmpmK6lEB|14T2=3kV>J4RF2+GNZ<0wXQc`uaj>=7YRVq0hDVuTcf(RoNR zof@R>h=?G`>8?0|*f2UT~M)HOU-9~yPV^%QvSKft`)(p_640{sbz!ElOC=fH;PFtzo1?!t9a znNr|+X|ZR6jcf3H^v1_)=SQS{k6$@d1qTJ)XMt2j{QKlvkrbaSJ@!c;_&ZwTiV21c zs6v!t?xNKG{&f3`J>|NuWo4nzP00dEX>5m-lx;4Yh^id7>&b}XILsvtD$9ByTBG0a z%{!2>HUP#`Y_s_8@-M)%a^QWTbf*TwES^i=p#n<-QjD`L>jnCfn+88B&Yo+zt>Su| z=1sqT!yE!y;2+IRQw{bFqd6DGt`K}l0cNa!OXNWPuL^@t9(>yljP1ymd!tvPFYoI)#rw|nFM z9=-mg?tCv}faSaQTh4P&f2-#B{l#P`DQw97;SPYP7h{v!U+bpZ89h#kFdmZ-e#h4i zZT}aOwYP~c1C!DTLC@1uMh_8fOVVji9h1}yxZ!sKwJ%Y@%bRpW4}RX$)3b#9;1A8J ze+Gk$Gg!^~!p-$inhF~(P&Q6ZD4xVu){+$xx;}l)mxR-cn5&j#$=hcphq(<7XQu}5iK%Q1IdOB%G-#$gIO|Cx&E{* z!C(%7UYx63|1pasB{rk;9v-0tMYG0NkB+KdG)@BzRF~>c;u1H_ci_syTZQc<|3dQ8 zaWylROo9dJjoR5eT%Qq_n*YJOtZHeUYhHc&3>8{L zqE{Vn0Bny}x2%bGKR*HjO3L0_VDqM_WJJ^+@)#-Tw*;+fxNZ(X0wpbSjSJr$RzWca zJu-7cMqzbz^=ol@V9%x;3iKff_ z!7%_^^yrT7Q*V40mH|1*Z3qs1{rTlX-Nm7GQqM;ybtK6fL?cn5Gtv}m+6bKudMhyU zCD7mF7>&bhqU&+lG$?jj%d3L&A`@XSKx7JC=X!&qxW?HTQUqcf5@V3u1su-tsFN%UGp7?Ggi?u!V6|pOPW(jx8#8r)DvF(TjGJsTQx2gcac8C?Mm}X>C z$7X)}7Sew9~_8BskHCRt-Lj+j!Y!ar|{~n-DovT>Zh6-FpowYw>kwx$2S4Xzp zkH?Wb0CkGf=VfgtERb>y^*HekNOlhS%btG9BiD?|jay~3x6n?fW%tC>b(WIE(=Deq zL7_T``pge9h>S5B>n_&oF3(5t^yo~4gL17@nsv)4YFf-Vm_6LsqoZ-5GXp4Bwj7ua zwzai=DbIjrFP|pt2GOIUV#Z;YXjEa3ff3}9m=+oTXT<9#)6~~<19!ags5&tbe zUuUYCJ1Qnx{_VpG%cZW>YoMwJZd>_k3(>dyZ)A*&p>Ugabas@lbaYMkSX! zi)7M@io77*659*V$-dAOK@T0fUY;VR{FEPk9MMYw;`K6F(}9mk6uF@T0C=pkK6&V>bPzyh&&0y3prO*bfvIIj$2g3n+|5_l_8rpKc%G& zjF@|BQL!ot!Ltuu7j7_otBg!$`*)BD>cR>c8#;Z91IJ~zeZ4lu%Th@NPTX69X^s0E zeBrza*`O0(b>( zPdZsXFI1(gtxcz)=?+*UD9&$%?5&FVBXyeR&kZ!}dVf0cCq+gkmw0sJ-LpSDG%zxH zt*O+Uz0S!5w6H}vV(iVKnS})gHdRn|30uS!@-jbNBC3G(0LW0;lgg~`B7dp;`t=K7 zZINik0pLhaQvHRqZ9EM5^wc>j3deRRS{dnBfb~O%L_Z3+jsO#!s7R&6>Iti{ zw47=!EohQXOb{>iCU#D0S9niMOk@7dNP6iF>;_C)*+@AL+9ZMy`4NLxOsz`Q+qTeo50KuHde4J6mq_OU zL=>w*-v2{NO3H=BMHa^`VvCAX(Ja|yuTi~EeCf`%uyFzSfUSGpBGSS8e(64J++LVq zP*+;|hP+)i;0I9mC$>#6G&FSK$HT*2gS-vJDfex6hmF6@Wp#($*gdk4=$XT<^ccMU zgYEr+B6*l1d~MC{q|sv0gJ1CW)a3k+1BYJ1)x!xg*^iJryj7X;VxZYB_vnI6 z?@AR6ZSeAXW1b95p4`|~%f`1s^O20qOlH_-(9Ry&o<3yU(r_Syu%k6Pbo56&TMku@ z2R#Er8cY}^Wiy-wE2NoSr{~l!R_(3S)aOW)U0IhNwvZnsgLE#{pE@KEUk5*~5zaVW z#eyD8t(Z)=ux88N9?K=c^78U-y+7%lD$$)xgYuA1m`6kgt5+$X_%e0G`+I~Nvaw|b zU$Y0l<_hY4lt#vRS(5n}gSM?GqhQ_RCHGv+ZJwb6F)3KrlyBp%tjeJxLqr4 zcUbvzR5~t5biriWp2tr5g15@JSIeSelOaXzh%4|BJ@KJt2>m18YEpFn=#{fsKiyWj znmPhn>PRslqc&GIy65KFS})tJirf!XLPbJo@q^p#kJ?x2W?L^mUPC5U{uyDvMhH2i zi=K$ks}^=;ZT6)D(ZR^wJ?e8mNUmveFQk0by2sC&r08NoXX@8@S1k1LVsmWF;Ge%u z?#GjzhOrFXrUW;=81H7kYQ5=QpTYX+<=4Id^a{C_7zt=+#b~@aW=|#olp@j)?1WzJ z43_iB%2GFJkB<&zG7fRNk0}EB7oZuHk7iW5V&n5vQtD?j_hES4O~R|nYg9hjH#Joc z(HPzv^`H?Ii$HjITz00i>NcEUu_WbwXGx%2{`~!+Ysd!1r5%s|`CfKOH6=gT=6U79#$R@QOHSj4 z9}JHC)&UPY1^U?gNGFpd>$r2e%(`E1+ufL5^B=jSVicVN@n1C3UTk)l{KtF9`?- z2ei(A)tlhLqu2VjUA1educPx~`d%Iz&ww`BNztD3O57kaD+|a?kjUZ$pg^aAbVl{G zzbH@=V?Z!Vl#q}JiWVU5U8sYoW)=9hppp6OS1=Hl*Wh~oV;l;=GjiGO53`posqV=A zCmV$Iu>@Fgk{@qNBXj*{?4I1``6qXr=0B<8@h|_)gHNLA5d{P};`TpP5dSHL_@DpC z-oT23IvB|3{%@Vce|~af2>2cKe}0SnN^x6LmqCPfa>qDTNYe?VP`bcQ> zSW!iq&Rqhk@jKg?sNQkiORO|$$f@X2IJ+@vws{&QtDWbO-}km-&Wl!@)iCMkf{%m| zFOVR8_rRZdjVJ-G4zA7B8=%=EE+_XYB7-#o@#s3UK62h7X6$^OjWsbz&DQk0OFb@^ zy=C0+({T#C2|!HKz8z zt0FGr_`6vlc-`r%Gj;*VbkAhMkG(2%bM0PmNXMI204&~ovb9cW?*GO(_^gP*@SY%Jy z?=PeJXG4Vfpz|i1O$z@0K$~Rc_8Zq|o`jmnfhTfmWN;F?@Z}>D23xX>8fL#`-{|IXesrnd#+y+x#B_v(+G4prXmo5Gy6< zQ2h(NY`nX$(gpI$7-AF8{HQcjQc?t=nGFeEKdOl0T2TS%A^fPgWudUK15mVJcL z>Vs?$A%jX+;WrOa?27303*!z;U@h$r(QkSQT@nI|QK%0}NfsZlR{a}+S|Wsu#{olR z>BqkZhk9wVG`V`ZFm>w#?W_~5M(z=R^-wA6syk2wtt6faI%LSEq2R&rT^`&!I5;Xa z-RA%SCdf`0-h_rtCg$&vt$kGVcx>@lNacjY+qO+RvC{Q<5&JVDAbFQiq2fpuL{GcJJ;m2W%aG zOww0xa3(E>ahJ1M61(v4hd&VQq8^^!{?ps)rpQd1)VsVqc`UHd7&@}{@$0O|vk#Dl z$IA5JP6qn%$o1+%JxYkCiErf*r5LHZqCsoY`!Jo~az8hliE;?PRkz_m<9e%HaE^%B z-P_}|s?g|P_dC#K86|t@#%r^H@8P*HHe374z))c1fz&COMWKfr+tz6msW`rAzq5Ih zHGVzgTs<8wbx3jE5*Zj62s4a_h&oAwuCJk-U?>o|Re6cvcglyQw)P~u(f~env!{e1 z%_koVP%v`(Z>4B$T}`z1Lprd4Bce1bculR*;QE`qa2W<9WVy0wR!JB^;z3_z`RAJnheQEvQrDitQ*~UOqY9*P>ImPE}-qIFGoO>wJ$C z)TlyWZux%%w*huKk#M`?0FlM0vYY=hSE>f^?9RiBv)?!EVy?}q7#gqJo)C|fwvZ|u zF*oKMf9ra^&v(jy*f#$LCOOu$?r1p^}o?{dUd5XGDNethb*W zE*xLyR+l;3q4)p&D`v-bdiMyh(2k5h-)j=7#fII>35;IPbv{(c74mHPs*7$T`QGX2 zX$h&(_aOa2Z!4dAW}X#{c;x{Ux{R7BJpePfnvU2(!~cWr2#iYu;6oGwB%nF5Sj$t> zTCOXBa?Q_PrQ8)WVYs`tsBU|AcLHpOLrN!LF(q;2#gBx-r@t%@LjbKy5>sFrz!9o9 zM`v>j*b`am;(@#|O^2>0OF*Qs#9U{oR-J;f?^URL^}wGsAkw$dEduzd{AxYig9B3_ zSDgk@R3N7Xqp(rp(6^iqkDY+wdcqLipWkAkQAlPOe^@e&BMH2#AD61!Qlq0FL?Ehq z3KjGrbXePdmxgM9QDU^=XEr@B1&D!)bo=@L?tebC#KK zWh^Zb0J5N3ckcn_$*XqgGP0z^VT0@CwEhNYF$9mdKY_OReC2}nBlLSP?hzVDMM^cU zXnbif(RX%0)`FJTmL*`pL72jPB3DyDkpjtJl>6c;@q#qU0%^Iy#$vXCQyKYO`z>(0m`=&5MS>Qv1)b`6Kx? z%r76Od?z{tQ%;ROTtFne8a$(KJ$a8mr}?3O$XEvsBMehh#C*vlL08vLo*5C~f-Eg@ zRH~PPq+g=kmVeV>KyRs}QG3hZZaZ%YYT0V5Ct=_{G6Pij7vQRgJ7l$(tLQkI3Q@Bi z)cdv-Je*Lu9o>8T?v2l+;T2Ge0IV9r?m}wb=1A3}%hnBnYz}Qfp(S~c3 zy5H2?x}TlS+fD}}uv^+m<}XqV@cgBQU}%eu_P_w$PE&Z~s&-H~m{GNn|qB6L0CUsFc#C@3^J_`R3sCKDeoPuqOlo4NGg`vu0q5cHnOO) z(6#`i59BM!X=t!@AsNzP0q=?s3?&-cHtE&;hpk8bL3fA2sZ=&yE+BjX`ceF0RAjXP z>;AFTm8ZC6fS0_{Zh1gtn3@JwneEdJeSoirw(nQ_B||o>x)O$9(EOPq4gnG<5%EP} zX{V+x1IHV%PW<_!<6}*otDKesOmA?^HaEA}EC4%% z(Adoll1{_2Jv)#CKtTHPy{wurAs!RVPWyt;b9mv{SSm4qpiL~zNwbws%-G^W1QB2Z z_oHV=1^`5dhQ*VZ%{hR!?$(`0qdY2yk&$64r+OI%QUF{;f6S4B=Hh7ZlvP_kjQL%r zB&#pfx&Ugp7vP@<=HnfwT_s?O+ApBJc)r}%FDxE%JMkJxt~(SdBmKYiGAtOxd>A_> zlg1F_@qjdmTlWS~rxD!GXit+*OkhLt{w0NKx1dIa;URXS=oqw!yXZA%!UP1hQA98` zi+HjxuKSdbS7- zfx9Yk%jW4wPuDtf{4T%9gaE{J2;$ zhk)A;hOjp`LxR)|$;{o|t=7{i^H(ng9?`an>J!TeKw;!Si!?XEV8k7RV=T7NbL)cNZ}M1MwUCbDf-QB(UP~ zR#18Q;*@s;2mvDJPiJ>7JML@J+=si;?+sC&1u>v}pfc40Zg>drFlUz5f@t-SMGI+B zujf{FuwN~4a@w?T-FtwPa|451fMq3e6+wzcgOKDNgD>3PK)v|iBg;LhvCN((V#Xu! zGF6S?$M=Jk+&yrs0FDpm0^ZW#&`8hL)t`$8P|t~)eka;a>7v0#$eH||=Cm?WrH|m; z$^!^L;M*{lcK)xY8&M@;t*^!*f{5EVdPGCh_4|+;6qF{{`Tka-Bnq#r(oW<1r)uYo z504u%UOTiA)ZK??;1IC@vi8f1hIPk}CCVLOO!gJ#5ZqJm!;fP>HIxj05$=Zc<-v110!P~>uB-b7AaA=kH)~STj@QtO zBd@;rsPJ$a4vyxlZ>p`Kx}QL-X56Q_W}gCh)~l7Qo4PYMSu(1ICD;9Fl6W@780H0 z0`*fOuQlTAY#do|@T5s*ZsRXNE?`rGELXslm z&$C%2_+|~D5TT$P8Uz%=`F8SqY_Rd6qZ@*60)$ocNs>T^?Jop}85tK>RKRQ3$8^Mk z15&=^!077f1(S z0pXFoez!F+G}NOLIXFCQ=1PK26BUqZ32RAg@>{18PsZ6~yo=u)CLwNR0G*gsk6u+|MMY)) zb!dP>!CZ9w?yD-sP{T#dXC2h}9|OC?vkO7lZ+l#)0yw+wWy*CxIt@~3G(t$tf?I)x zvCRlfJ|J!wY*W1_H=xN%;&j5;>Whm>ihGkR3^ceqTSKUivfxbW2Sn@6^FxRKteMzB zMaZDCx;$5xii$k=y}__b6_6C9Xv&G8KnA>{nYno)Th=F#XEm#rm2dPGF!-H1SO+qa zVSRvK-_&8h z;@7SvVqs|TkV--61NdiMI{6!CDhQq4cl-K-XNJ6&CTTjK3}gM&q3z2 z>i%B`-I^pi?685!OaK2SP#k=Fg%y9${DF5}IJU^*WZPyMVJ%=}EJ>xR+48#yH7v41wi>0@oY#A2FE{r1Y#}2!{~#M1yt9wgW}@geAD}CcY5B~S6%%5 z_Z5eJYQpo+|0+UwSyxmrGj>nSW8$n!U1^k(yA1(onkdK~<&*KTm)5%oZcZ z^EAf(Us$m{7U<(*x_m&XAOY~X49>1hP_(}VaWel4p8f|--J=9$kG-PuQ(D05?L~+*SKMfLX;yB7hFmhn9f!fgU_y|J$|vr@v06+S$n~V4`z< zyrlpjImhw&ugsaI|ABA6{lJ)%o^LfI-@yCd(&B$mw?C-{+u1U1;WVy`=|IiHFddc{O8BwiJHmoxl&YmxJ+_+92os@j&ad@XAm~3o z*XLu7DQq;8tqYbA%pW9s6j(QCq2oj>Ep79z^+^2O)dP148aa(HmFADU$%P4 z##Wia|NY!>E_gHCIOT#4hiY5!1sz=1@mH95>B_lDhPUY7zaO#m{$WA z*VcdVyTC_FHcyHtPl^W&26yWa3|o*+8-N#Kw+Z3!5&p12H<`#07D_3=<9#mPF&855 zpZ($F@kW(}zIKLgdg}-E4o#CcsP-=|hqATa={JGPd%CQjJ$wj!1#r}8Np0qm4KX!3 zuuxFfmG`$L+p6a=yEtB4-LXMpEHS!6J!B~Z^n1F&aEj=QLzUP^28lIeBLZNRYLkJ7 z;q)%M7#|6nrx>+|^G9lCOJJ%E9NP@r04EOTk7jb-RwI)H{FI1P-!Gwulcp_6wM;cU#aTrgmtGf83Rz#eu zqDIX@BlhoH)QqYbd*CVmcd`Eo`Bh9lU{jL?E^6yDOKZC_H}nqDWo9v$m-2?6k2DzL zD;?D-69)fA)*q#kii~%@mZWI`qdH%yKNX5Is{X*D&P^)K#i8C-n=ghO%^FxWO68X5Ono~_G?@j@(mb;WZgl*OaUVlC{x^jLzh;PO zfD8DeZxZdpAoAxZOn6k=ma6TY$@y0Q^n8T(E1G`p?+oHcdXC|0^o}DZ(cw#Saisie z2ioPsv@kKZcem(_Cvoa#(Wncx@$f>#S<~BhKf@UzGS zADQ08BJ&UnI{jwe)CiaqFDFjZu>0f^&vZU=5WArFvzY3f`aq8)?)4#+CL@UJ+~R=@ zcdIf=B1=vex=Ds?<|!uJzx-%>FV|Xh#h*#KiO;xa=&AMf9UWFM{8{*iitygF;i~Nz z{Xx?1Sh4avZ%I38B3Z-1oEe^QNjt~Op&q5!*CP!IursMBOz1?|6Wt!SAB00t=$jaT za|?j+=08l*K4C#tgn6&znnvIeuSBI97iX1=-!JJIp44i=Nc_R*yt)S(<^R^22C-+K ztbwqi`P8?Wq7fgC1T6RmZ1@M$Q^6tKs4%dE2AMer7z<*oM>D6QMCu45VBL5yd{Gb( zlxFD$zUsX8IvMEJ+TP_)zVNm8r}mIPobJx-KhPCmH*Gl8Ky!G&f5A#AxA|uV^;G%i7q>b}njuIcOrmiamL#;x zf;Q>?kEx=WLng?=t4)&HI^Jd6PzR?sfBS<=o2Y0K`H}}cF^Dt2>tz@{rXdhydAUk}0YnG_2&07Z4sD_aS!DUIYsx@SFh6+*fGIiV$ z;v!!Tsu7f?A*4o%IYeOWktQw<-nf?uIEI!nCHPPp=?$@+IeCJ>B?}B+iVr^1{40K$ z?XIjI2w(0Gxt*KeU9vj=aDsw{CmIWo@1{snfbCE9e^A}lWZm;@XUvy|%-GDET^6L2 zqJt0~6wE5~Rye{TbzXyEn z9bGblWFs4rSo~Ecns-OrI}tH-VF`|n{VCM3Ywm3&n(TT8O(aR?dKWD1WZ|G$;hgzy z8*Kwu+hi9Lqd3k55m(pklZkH--^D()S@M)367osySd=hEsB~^AnH9o(bVA%T%m4iAp<28=U26Mphzcgpo`26dmmdO`tisuSx7KL>0jF55j{->TG2HOK z822kI7y$$sBk$9oFHHaS(JI&vKZ0<8VX-_1iXAv$@X)-*Me=;%6dT9mu=mT~-O{kT z+98cA|IfDawlnA#lJJMOZSakV8|O@a&S$o+nKm!#(&qB+##qs$b{Z=(w%R>&pCQkw zv16C2$*PPLHh#S??Bj$TsAB7BSKPz;`R~oAjC=3)G7)Hdq(%DpM|dtNO+}Br;@Hk2 zK*T7QyCO9#hw;TX9aT#JgWzA&sKYcT-b^3{1U|R$gL?#=`pm2<=gANERqNc3WI%C% zcMiaO8$|fcn+JLowr z`R3&wJlN}QFN7pg$pcxwBJ|1dREfMdxrR`ut{z-Bj}lxzUK)5Xo5o3dPDwhA_2?#s zug8!ME}00$e&{$rwXB=u>FU#ZNNLq~tiXR8^XW-w@Y=HqHG(>D5va*`#hHIcm&GN; zJGX)YBPb<`qdrEPNoJr5ciABzPV|d7#n9);6N2kW;6XY~f-G3r*g8@GL5pW~WBVzr ztyFz^blJRl(XJ{)86^;v0aEjADOWbVwL z`nl$7e}-}Q?<2Wp&j)MmSxjGFV{ojkCxNR79*wDXGfGQqOKH~(z>rq;XOLh)14uA< z)@%p-Wy&%Jczg8~7&Rw5^oeR1!4(CT6VQ@?yqGP=S35Ay=qNReX1IT!8$euzTEf z)hg5q*5+sl8N5J5yxHT7fB+H@!I1GCTxH~{14KOb{1@t5+bpx<=N8r@J>we=tr9O> zCld%?xy?T*mQ2=1y^GtQnaMs(RCz(z#Uq#xF1*VzlkHRn(+1BoEIFPmkB-;-9xN$U zCoj2ZnW=Ub^&`%09w?gKiymM*_lB3DmYiQiMfhc5GnYT=%yv4iaZJQt@g#G;Tl<-B+I&=H3sCosAS>RS!^T1y(7=@fh7KY) zTXuaSR(39th6}wZCXF`(nKA!;f#Ag-f^c@H$=&j;#s{((JB%NPet6LerUfo;9iEyX zXy$D?9Xr67bq^Tt&%%{Xq((qOq!Z<7$tHa|VxuOP!KjoV}8;;Mzs`IHXi*%@ENAHRm` z^rldP6smp$7JZha+rBm@yKR%t)@@IS?2C)Q^XH9#)9|CTJe?`<9SFsfdH(kRM86kZ zAr;ZUB({Fi4@3g%&pTd~|1X7`L|1LSH@512IamNt`9C&px4W$E;(#?OF0Q^DG_K;r z1yY!HkM(&uW(2R9LU%yIf^0yT_r3;320zwWJA_qKkjA-gz-R$%ctm*Hhhx^snVIZ_ z3IH8-@YILanj~XVw?~4>P6ySs_4Q{UvyhmO5Fx=_)P{sofNRhos`nYvXSyemDInfi zsn|^zcV6!$v{nBWg?i(@r=(UFlVq4z4N*NfCMV8i41)TUqTHVw?T zsQ^vJqniOC!t)s6$LwBGbf+|?$8V@&^10l~^60Kq4e94;AofuJO#aS>v}rm#aQfGE zY}t2c-o0f>gtgkLNyl>U`vttNk?Nz3DrNP?^QY4LdusWOj8$aQ;v@2ZK4Ra0=`5OV zH^WgUYxt#K>PDIa(^jr*%jx;1L|(zcIdZYnO>b8_4#1;8n+}} z9IB#?9`yn;9X2*YFl;wITtHy)wo@FOA@OK*ziO+uu2TU2OyzYf1=zfSQTDT=Xppyk zKIVoOosc5nBtv`Sb;6_NV)?;o)do%}4&7p<@x$J42u#h|NRTI$epG4!lIB3#i+Q3; zvQY}mn5AA#PM2AvvJ9a}YKzGY%k&YCcuPT0@TJ(uXoues1yq__f4;Rk%MJZTFh4^9 z#-^ox_`#Q6oGy9i=aIxuVbWeHUkWK|<0}iSDGkFZ%xa9}W9WrOvN=LZIcB6qrK~;# zD2AawEH@gD4G`~wlVa;Q?gVJUby!jWEV*f}-R5g3!z}}zaL1G|Fn~PW<+>N8nFJX= zvzX%ZXU*3mcZzZ9br=eetmYeSIcTKnRHyh=~>5Jn= zVd-xSR)k59Qbb~8{1SWRuDXri_#ZdlD)fi9$T1h%!m}?z2@o()378){HXXj9Ge-DO zVZfbf=ZPf{oISaOtuy`a4bRF7W|B}{ecK)+JaY4ZfLf5t2o-Bb&q_7mL|GRaE!1wP^V0RB0-q8jB8OR~_ z5B^D!X#-sWAo+Gmqqwu_xsV4Ly_X~w1|4rJ$t?6-0aj0 zZz*TF2g6B60;XOhTBScbrhRg1`{b1H$%}?1hGOG!A|l=(U~Gar>LGf3n|(H8yQX=p zZ(R0sFL#RWIKy+2={nVX`v=EcWew|Dj|`=in(#4kX99vR7=pe`v+} ztZZ|FE=Gw0;_i}r|pIopH$;4HkIfA%yk00dYIXNw9eB?h@tZVr| z?FRC1!v398EJ}>^tOj2mOAAd(<@G> zM2@=npEu@`=FU3NM$`a3fyiKU(QP!7W8>gLy9XC#9Z zpr36Ih@lhyz}AqvE$#5^&JVENT)|l;1F`I~?*6PC-=l@)h*`ZqBI}=JlF8v@Qc+m3 zj`9{A63>)s2Fh$Fmg#cw!`)YU8`&4Pflub}(E4wG%rWE6XEtf&GkEa}%X=P$&PaZT zC0U(fUMzr@`SY>l6!N7$M@hme(YaNVp#h*>iX=! zpv?lz2f*RU0ZORfW>x!dNI(eLks9LySTVqj4#-n@vFO+56bk8cpH&TgdvowGO&gZC z%)E6z&>vo2GJ)|oAY3RcrT!er>jl5YXbd0NOyWw`fcCA%VObhP*NBU#U;;5+Z5@)7 z9SBwe-tP$QmrdSEb!uQL1J(#a5O^regz)-1FwojGt(I!mq=V@Y@4wj%+W^zO4Wi(h z-G4+PNQXSD12=fLEO4}`;~;b5^v)fqBMx@}JD}k)yTioX01gJ`kEBFg8KB=h9e=s} zm@idA48m5N*6#2PvGoYK(h%p>e^qzN* zI;Xkf65{v%4e=P)lsv8sR|zq0MEWGEFS1GZ+mANqJyUbhYbC_FykDugy_sXnX)@w9 z^0UnAbQ!`WDcf_4wnfQW@`)eQm_7$s1$%W3{tIe}H4urOyCXwjUmVHb5ZQz}km!D) zMbN}aDMM?~;-wMmehzP8S*&UVg8?DsgD(RNu*el`U2=(RMQA?pz>9ohaictIM?1g| zBYROj7iD9i%82U6@+3K6r*Gl^(fn&P64rn9^3u|9!Xfdw^Qlooq!-o0II=x6FwDc@ z=#z<2K~0d@fso`dmA~rrn}nV*;0Od^K{mbU5)i7-e^X%Yj#ladz1L;jL`ZdoI`?i+;6bZq{d+5j zYDZg1?aeoJ^-q9;w{gmFg)_6XH0~b*_S`q^wtHnL#yU)vrf5%FH+LY#mIPP%zoMfb z-BI{CP&C*1*AZb_Z(*9^8^6!k z-1+m{Dje}k=7e(Bn?32iyf9WJLeI77ohzWVLdW2+WlPN|#Y#Wv11-Q9nyOpMFGciL{}WX$VEYTt0|h-lfc z%s$Kx^?_1V4b2V`8W|$$XYmaZGCqTt8iQC>`+cmcgRRmVHl;nM^gV+yr9ozJ{3aSuc=J=BB_Io@@ z3$N@7aw#PY%i!l{#%wM_Xr)*R6ZVH{&TK)EVyQAI5@U+U@qr9=U=tN~`Jukn|pX>g@(tKY-Zeul12WY4aVcDkN$~2S3R@RE4#-Tn0HEuIi zIn%RqQAZ>)%G6iKbl3DS8s5d`jFcXWp%xffxQQ=~*j{KcMhli2$kB{Hi8dw3@1~92 zCk^m5Pq)F_kUz5q4#ZL+!vvkG-kZKL1@V<%#tC~gkf7D3ML@y@fII4cZB&ePW?n^m(_&-bpq_Y~3IY`ph)^;{CL1J`d5qDu8Q$ zUFFmo68@F)Fa)P?Drv991(Tb@9Oh@%$_YJ(`SndA`sZO6aQb9dSbGP$({cN6OKmhj`pj|-slqcGI7Rm1h=lfg&M&0i8{L)E>= z4l;E1<-uw*4Zf4=E>3AAgcnVnTC{oVqbGbsve@*HV2c^2OD zTI=1{mLMML5@74_knd>Q&LQK_G5#K!%a$np$`+Kc`$!QN3^e`0;7pUy%?fH*cLBK& z^vV_LKf5=24notM?p+2?=t2^1w=KOp2Wi&!-6%*z?_7;XTC9&e%F9|phT?=SJ<>g> zckM~;Jrv7Wa>yBxs~?OcPY!M5o0~Ag7X2bZWDm8yJBBn$!AmVC0^iPeW13W zUJsfjgHy!(WS$jH;B;L#x^>o+n3_t21)r@*Vbi1mg25m{`xdO*J52_r=1oxV5Foju ziHPU;O3R9bE9SQ@9?qcNnlOKoPWzi%T#V|EkDOd>G{hnu_#Q;O4>b$=kp<&&JTiAY z_R65@A_m5Y5`hdad^Fgs$--Ah>JO7dAD_3b4nHE^M}*!Py%T5Xd0Fo+L(4+R4}$q~af9_^Gy6$Sg_>@dS8qH@=8l%V+uI$)-;_UG8HMD|3-|< z$?0y~o++$cbhrGFq<*XMU17AoEQQ@>6YYaAVU%brtOWb3w2Zdnp2XKz03IRi#}{Co3#;GoYCmGmgMFe)P76X}XCpy+j9d_@f|%DO+0;tviaMvrR`5_{mc zO^u{NgPHD{4mFKoeIq7{THt37Vr<+|cc3E`wYj)W?~*8DYAfvs&e&zD|A`@vlXw%s zkymA!(i6w;t-Mcke=Bp&YD+>-<{?$6xN(HrlNZahchG7y!s#(|_9)gsam7QuxlWnn z&!-W2eivBDd9!hys@vs(dqM>XXGnu9C$?Sc6k4-Jk0^avy*?=*k`JPOAIqne z1dvS2@9YmL^VNMYpNMB047Fu)>g$s~bJm~kZ^ra=%O^=t9wkmoCsu>Wq!niyh;W$>;wBv@! z_sjJsILDBf?`>^us5CY2ax!U}Ce_g~H?E7#nlTDdQZ4WtCDFGv%)@xMH-`oZ7#k_| z>-D45Za^=w{pI?0Vn9k6JYUsrPr1`PVkm4dhSX42y33l8Hu|YR4tAx!n!{KNybE9} zb(=9mz>r`MLvSEJfd-#p-9!(jJKf3=>1l#u> z;jG3$M~LhGgh)AzU5n?&eEGmEsN?e?=(b?1-S^s zS(H#tg(uJpWuf^uSELC%fHh;n1fox8%$Q4*9V;ylNov)p!A;x{jjc0Rmiul_{0AwM zb-&5}K{>vzE>pRvsIXF2L0>3KR)?IH5I0Gm>^ZzC}Q(RPEZPV>)&!IVWS4M;y zlqpMASXQ=COj(gxInlF_7wOBShc>?AAFjrwRWmQ_I(Fe3JNN)aT{Ao zfZ*D?x>;zS-@)OIpaw9qL$NFyby>A>ej=DLBNq4n8fE4AfVJ^x!Ef==Z|2Q)?=L!q zL;o53gLlh=*XWDa=!NKS&HTUClPlaX2R*5B zgfX=9qG#CSuFsR9o8*Txi|@=}z)ef{n#aM`iW~Oji!IF?2FZj^lgF7TiQ7{sZK@V1 zW-Iivw222v7l|V%6r(9Mtc@8Rh=A8A4gujx1+d8C$i`_cN;<*0x1 zeEVCZUcuhY@?tsBdcc54G-6zOZ<|cu8OD7Q8NHdGN&G6dvhlX#1@6OBtdQaWyI2q7 z)0do@c%3$zk8?PzSu=+1{e_AY$;qE!{Q1Ejz>KCw*BfatHJ3gm1gM_{bH0MRH?P$a zG8G+NdV)<)Su7SDG8!8f`(twkyWVoO=iJbeX=YwdTRU)25%dYY8Wu*Q#c?2S$FNo; zXIA#Rf`CwO?O_%uG$~aaB{NF2WIzc>qQEDA3df_%%u}( z=ecjygnzhCg61q_n8}tKh-n&Uo$E@h{C636`kqj1gTuo6QZKwp^?I35DmHs{Oc0O7{Lk1n-$hJC7?@ z)zuY}yoUV995v2QRlKR01#kJR%*KV0tNG*CtUVC=^EK+grsX=^kcnwV&V&IaC>SJI zfL0I^^j`pAHJBYjOiuX(7($CRdl-;!f$gzjv0OH7S`*G2A0H2%ba*~w6O+PjJ#vvU z+%5pP+8w;I(6x)rHcgKWgcv6k;B0&o1Is_Y3Y8q?B2?eZi^cxbilj_(j^VEaheiF5eTF^6 zc*YJptXJC2ob2T3G>dT>!IaIWDvm_QdyZuZ2aqz7#ZJPk-gZ=+6(OCWmkN74DYnyp z@wqjpcuem^%@w{{%dZyQ7~KEMTbbvYljrY~-qme}NV=tzgo~eU*0+Ky+P1A$gNRzl z@XeFAZ4<)~WK<(JH2-c@QlMyF+IlR`lVM?45F58P)-yY%wLbGf{D^cXLc8SvwHjt{ z`lSRdQXK!yUbxGBOhFB`v$Jokb?we zDdMo-irc!%p}kfo1zp`BOByVVW3S(4WkY0?yTK;9ZQa4yzlg-h-#JH#z8Cv?$SgLF z<7DSd5c!a39oXm}JBs-y=Gg`@Li)$bzrNiNDbV$rJO2qlxXl)Lyz%WwuA80tEaf#; z=iqequOeddsq^T*B%{@Ze2vi&@wu0>M%=6Sf!BDyZk+AuMrJgzeuH#=`gH5ix%7gy zmHzaobV!>j)?`>sp*0G<_fSox`GYUT%Wc@mO5$lC8yC~hQ5+8m)VXtxvg6qgC3*vA`utMZg|_gFZ~^$b%!;;V-2RIjnc5XKXGwCl0Xwm zciTX3x9g|&>qY?pvu|uQEG#T=Xc($}Hy3wi!{sZIJZ|VA*N?dLw5j*dsJE{%bz)fT z!yEU%KubD@BNFanYhN0^eI8F@bHs{U`!?7twc?_H@PNn;vy;?$ zcFXAT7@=KZlyYTsFAWYp?teMX-82B-s=5i%@=*xkkcPiKYvGTzSo+0(fv-n)y|u&c z@=0HS8`6&Z-((KNt;V}pm9qR&QQuYcO;smJG!urtFV&EbJVZnz_e2-6V*JL`_}jlm zp)cGRsoQ9THPWG>WL&YTKVV}aRA%RS$8)^PevjF?FxIM2NMD`D)zK2DVQ`2R%{idj z&)C2~6>keLjE{(cBFbg($Ql#EUkkBpRwsx9)QtVad>v?y7@C z2KQJMzE=myHw~o~Q8R>K{-nzG`yCs>Dz6taE#2Z6RHi~mZ1{20bIaS$t*wXbcE(1d zF)}wXgu^fK^lOjNTL1O5=A2XmnTG4icyZ)nsyuJw*o94yM@u{zMDr zZgU+R;`UDE!jcy0$;WRoRR#8VI{qY2agLFR{aWNvdo- z=7nl4bl&i{)ZjGK`h`&kS~?xaf?b-9d zVX7nE7JznAs1vHXS`p*E-Z=Y?9MK;#Yphu$DWvZVtAi;zL!9iK(&yIYd=-0RfETAI z!W(3D%)p6BVRIRAtHd-EQpPjfG&G~&jQNlUdvLlLm)nX})+LOMT zF5|rc4VF!V$H#s|{q+a(kJ@+!)h&!D*6TOqlq}kveRaJqW%-D>HVjNh#zF_m!AypY z{MQGKlTMAT*NCN*A^XzjX`DZLgbodruy77fQ-f#OuP6HzwOUfLhtOekhZtSo+Rd7& zo55AK;D)yF3ub?fZsy zbr`Z**NPh3g1)Qo{BU;DyvcH ztP{_`-kepI+Bpeh3}<_90F@*)dOlik=5*&m{|R0D3*1UUIH8cd_V#^-S8#RMa??e= zdN{7rMpEcD8M2m#d7}1nV-oXD!o}ntyP#8dW)MT+KIF+!u&-<|o;C`QEhQ91y1;vS)A#q^t>}1%Em&Avq`pdqaE_ z(W{Y;&z5L0QQWlX$cQ>aZWHiSZb(vXD}}g1ZNS-yEYTcGxm#J{$-OoMj$#sA=B!I#$ET4w@>IWixyri@xp%s>~foaHP

IT8bq)SA30sZHahJJq4L{_M#q^j8*HXbvl zJ>G9jXl?6ss4d%)7pqW#IG)(Pr_V`gRgz^Q)LZITRLSXGpKYLQsU~jU95KDc-W}=X zjbOOEC|3nn*ZLeAI?_rAry%j39@S`bpFo($9cQo8!*8{`^nj#=Qy;9Ja-BU#INFoJ zV~nk1B$1|vdi8pB>+OpT73h$v#V;%`5ap3+%?Q0FQpJ9p9Y4EieAb{1IqN4MoJZCz zXZA>$c)|y(asB0eu@LCl*MhLZCgeGfAC_29a?6Ljg|qO9f){-G%r1+Ja$L>dw0~ih z_*_9dw4o3ax*$OQ?+K))8(@4I>_(Rt*O@|gz{oONg4X9qi)A{XZYmYLZZwqDAc^ub z{YmsCohDThJyq&4nTC|6-5_9x%2!d2M7!xMvQ$^iFa6+Y=6tFwS$-*vYAP=wMl?m; zQC^}3j8}vO?&<)DxSh2zYyyR`0oPRIEWa5hu}x)LvBi})`GE3sQ{NYFs1%2l_@$tr zYwAz{YdC$Ee_@0&BQIEez>-%_aF7}^G&q;8v6rf$HN?K#Traj4f4C&wKRB>0g4WHZ z5r~cb0MTOiBGeEbJHqsA@~bVJrn!~HwQcLD+P-p1!DAwle7Vk98-OhYjQAWmP7KWFn)Zl0*!2&4TD| z`y>{4o*-@xk}yY)y`IT~RVw!Caf)4DrmIqw6}HBZGfwdKmMC#dDAY&E_nrk;_PQ%< zJ+{V8mXwErxN{)KeFC2y0R{4 z+f6g<*d29jn;qMB$F|)a+qQO+9oy*Gww-ir>#RKQd%o|Can{Jsj9~3KYu2o~ueu9Wk17Xy?Ts8a#cOqh+gdlAesM zC60@UQODVFM~j{cD7JJf5CWSW5IgK>4vi!Xq=F-M9DgOH(pjvvcB*fI!v9*j)dY!i zToGp_#kbWnZ<61nPgh8~L#xv+vLz%N3-|343_}VIU~m{nX{2(*)8(HSVvP91O_K6d zM5l6^c=%h=43cx5w8Vic1&N>+0&8@P%6plf2)|>nXOM{ct>(?|WY(zF5@>yPag{t1 ztwChLhdZciQ&EMo*_%F3V_ix4_Zgf%C$cE0mG$%d8&Bii3PZLPrLRlcm&PD7jZ#NB zDh1uUix?-EfElnc^~X10;hvrrb!`m#_Hw}YjUySdm_Uet1jDeX4Gjkx_fsWuCzj0 z?mYHkAuGHL`%lA1H`MhdZ2^>;THlyug2!kohR&*bR#c>szKtXd=7F_$CNZ7OP0?_% zx*wK2dFgUTdJ*{sw(8k8T0@qbw<*#!wYFZiL0YU<_@~&8tW5<0l%n-c!E|4#7vplw zN$ZtWid#T9jl55$w3ubnaHcd@!Ri^v+K__pby0jQ?(solDDE~TotEgp-8h2mA#^`j zRyxkE+>LL3`i}A8x!Nnr-incN{}W)x^dZfFuCT>h_H5&-n!N6FhyJDqFM z6OoL&e&Uy0;xUKe_khC^>yHU-u>8iL?bDj|hi80~(=EB&aFX1FPw8={ ziZ?gcSG&$-Y>8!s>(h8HL$PUNt>s?N-}^;zW@Dbm!!E4p$463#iDc;-N)Iq{P3B{I zl6%%pN;%{~)^X+;>EHn1tPutdix)GE%~_kr#DDOen|*^B2B~h|o6|-5d6*>l{2NWG z(($+oS5eGZjZ0@g$*D8KRqhiBY^%a|a4}8SvtdIU#%4$~JC~t3blnsDp7a`KJXCLE zbU(}X=lDpnrv1mSluqstUp=d^sJ}`x(AV{$W;6EUeTE4& z(ybb7x9yR2<_l##J*X8p)k z?qJkc#w%&|Ej`y`ocP>u9(6n z6RGv9n24nalH_@nP5hA#PvKwe=oJ;T23r#;>KWY%q{ciqgx#4QolWXWh^fIwyk$z!^2;Ywpo^2s6VhHXR{oiX>nP2KrgE*KiYxYnB`^_ z-)@>k<@H=kcdT~2o$>Gbvod5FWyLnArbF8Q4A(7gS@X?zZg`mEdW8UD?E+E919AG& z=)JAU9arU4a11_@ipX>eTB>uIR8ahjA&Tn=FGcvls$c;w##?tpf2cI9>Fg>1SVqd& zA%ViooQwLD89!+(4^9f&zy72Ju zk?GNxo~CyzQ(Z3-LkXU@^j{44&&J9JqTNE#=8hM#WiAHc8-vuA*n5a@pF^ z3*>YC_N1DHeDlN@d((E!zPDS_RFaoi(XRz3v*%KSu@5%zvaFymQXS2}aX3x0D+B+W z5slhMwTiHyux8#m9y{Z#e7mwk?3~dVJGUsjEO7F|)szs_)Zs3vAI>l5Vc9v^eOx+I zD5c3bGY0kn^p2Sb29iGWi0#>tBfd{`&YCK8kQPLEl;_y5yRc-9Bt?hqlNwqZU^`qO zAlM((%_^xLIutB>O#E>m?9muT!&I8y>k6{MM-FynT6xHLm5u(}|bmA$00r}#auMm+m?+j~#D~c*BA4_P>v(rdVt+c_3Du*T}&sBqpY}G&;zzni1RaYHC82d*+4VED}#J zo_Mh?D?D6Ehge=H+#l=p+^IRsBY9GGeT-7#gVe3_)ZJy=3u3xu8#w|Gf%g4)GkLwqG(q{`2Ghz_D>XwQ_4a`BP-G+qMCh zE{-!$(Y1F;3kaU?>=|sRI`JZ`l1}$bGqtr>c@WHbW&+WQ0B%Qs88DGnEb)r9wTf_g@UP`JwTuywDJ=cH09(eJCw0}g_6g|)FTK9M zz&{u>5Ww*B-{EN+!EV>e(>N&jxc`Xo?+N#y?RZJ}w{}_PSg$=%a(ZtW+Lu0Fx2z@2 zGvm8mwAR-#dOwcOS*q*UTOJMb)n$*Q@QZ7*$+SMK*DzL8bJMMP;TIHFJ0TzVyj7E9 zrN7IY;t9b8#LlH?#HpDKondFUnzI-QV;`3z%E&@lxFH!~)7;8M%PHl{X=YBrXVgJ_ z4i4Oz#yi`X7xEetYMhdjGSv^Ba&pO@ zK{p)bVrPDzvVYI=Fgh=~|S5?2)BrZ_U4&pB|E)DR!#6WXT%YFnt{!74mwAkH#a=Bb@i3jC&lXf;&>**y*v3y@8iec zp7GxpEuP!%_(r169`M}TtmkgLUwe7$twYph#z1eM?}L1vao-+Q-}L94wBZKO6~hvf z&$lpFCGRdEu?~Ew3dzy-wX`0EUw9vNJyWNUzp)*Uy%^!S1hTst`lkA_noAEOZ<679 zq`)=3U;d5I2mT^qxLct0^);*U@bcwc*hwWiqYf<~B%54+{@InWe$bv=7a)xB#2+k% z-21qIt>}dk1Y|}AcD>3?+6Y7WjJ!yDeqJ&~7=`Ntm_B9E@08ppj82_-%VdC6#* z@b)+zwv|2rhFo`Vukr$&h;=Np{~S3_-(H9oEE#^VBZo{(FZWMO*b=^EHmvQg-tl#9 z+Uhq%TmfU$<$+EffHwh7D9IJ@cw?y;KT(ArA0dIzAcWd0v~Ye7<@NGOC{G@uRfldH zUi26zSN;)FzXlWXYY;$7rgP4UGh_Dxf)Ka*u#k`g$ZgA;_M5S%;9N1`fB;kGA%iHs zZ-C@b1f+1;oAh*WbX3?-kwtfRDw-n)GzXEL+}n7^oSjglswrUu1RR}iHf-6kaIi^{ zLoRP7w>`a-bndnOi+X$d{HfK}?y7L?@2i-Ax3LgGeDlOnr+G z+?nElYZoAwyZ!CB)kC3Go=jp_Z&&e75B#Es`n`I(0d%`442%wp;J-zk{}qgyoSpR} z4-I)m`K8|_yuV2M{JMhI{;oyg#v4~^J~&D%vqD5!m&rOMMuf`8s56bGDL^Md)@Sy$ z`bYG&CA0q|{U!V4@1hAsm1Qi5B!9vo;lTd8z2-3(F?FHWt*x^+{yH$f@LR`78P<@Q*$*Hh9 zy7A-i(i^ZsO~=SgH!2U0O`Lom8G_`0bA0l9$b9tU8n>%S*8L_xfdw{IsSX*QBrfOQNF;^Zk`brL58E==Z39%#Wffo!+ zh3Z^lDPg?SX}V(6@v=eywv6cvHqd_e+#l0)1$;I!v9U$UCbQ*Bn)ZWS>>fwd#~ht6 zR=I2<>b7IZ9@5?}&)n`~$lg2o|87u|!?_=VOvtIJdrs^f00vQBQ9Gkf=QkDYdgq}s zmFry_!ozAC{-+Iu&xke2lqE`(D~hC z+sVlrZ_gz@UcA;IAnAS2dq47{<^dh}^97IVYrY7s11uepJ*{(L!Bz(Q&$2z^WwS|@ zeOhem(y1B^__f z&6&4jJKNiP8aG@+ilnDw-c=SGUIAs{vF0d7ENA(SyzmzUXOwTd&XSyK9OA^7y)(R5 zcO?H)|6#-mcHMF6?SMY54CC>mV??sI2i=Hpj#%uqh+mDJA9;y!v?__~h2$i;7rpUI zimV(knYi85@t|Txm@=CKlML5eo+9HJz^SQ}cplGYO6Dv&Sy5;w!wYQ|WSw$|@~9{; zq2Nl0G^_M?x8M3XV_@7F3lQe==8qdq zaRX$nP5TWVFc1I$Q@meI___>-uKyB;5+d+kvwzJ)iZY4KdcA+bgbOUS@;KO?Kj2;# z{xcc8j=!Pmb0LWu+H2xdd#^za)F3CV zK}Ol=%dQa!f;}Cj^=0gd`>l%#2#Avl3(+hU+g@RlF45HDl&KeNUhEMi%shVD_&Gm0@V^Qp|jKa z`?xyYUs$^Kq4xyBVZ5U&@Y@jtyW1tRfk6svVo>*HJZA#T7b+F%{f!)=^n>HAjZLC- z&eg%t$laOQ`AcB_dZC))|K6FXt%WE;$pim=cMqv)iyF?2A8{ih4DtNM)!V&_fAzW$ z@?bsIiUPNrwU}iso&Zes!R%-``{C`fE(px+*8F+A$b$p#aJgfKvn``icDQl8cpC2F z|1s}F7zn4NE;cmOUdO`=p;Imx4fg~U4gGQlKeJPxVt)qA#Qn4)>3Q4BTU^%ERy{B< zk|3wHBRl@>dH189m=*8FhLozpMFH0N;r_dWx4T*Fvf`x{Jv@9wZB(&rzO zKD_tmC`xKW>P^+S0SbSHPYOy}k^l~_(gkp@CQ$-19Ye+{dtt6yJ4k%5XZ5jqiUbJ_ z%~Wu4@eW9JO{|JQQ)-}VhL8yPa>C;f`s>&$bk_a~x~ZhoflGhs;)LjaSrG{?T z<=hJH-Zb59jv|)2wzC;wX}=e$&4Tb%Bx7wsa*WObhEZ#OSQYrg=*+LyqjPy;`5r?v z*`0{M7f0qk&+W+n={q(jv&haHTJ}lg(6Sm3V@G7yU#?UNNl+B(>qoe#aO4mXzycl!Y^8IQhvpW5+kMI| zq~DLezGKhxO|pMZoO2braV$1~ne`N|CUig-umMpcM5F;~4m%=nwZ++f5wr{_jkbFR z6)CKwPJewUZ!rc2|CR5@$#!f!9y!+-JfXKgWh?_S>H&4SpW=250A>LE%$3p*Stu$>TPn$>H+|x*LTB=;)Hh*WC}3J>_YV;vQW0nFM)>Gw+y7TS}^MecymUnA2W#x-ZI&LGZ)+MfiS{m*5-wimYrk4?voCSvBxl%R8Le zXd57(8i``wwq?Eo`j|J8B^28mWDE-p=lD}W7GmuAUP zs{&35W1w_#xkt3u+ajzq*)G~zPO~Qr^$iW<6$?2zoQhHUp#5P2N+^r^uT?yWaY{w2RJ^IQ#cI5YWlih#5^Q9ayu?r zM0hVIzT^K>p0S{KFVDESXSrjxsl?2iAHK+1Hm>|&RnhU|XQBCpi|K_?qa5Y5d;Kw- zY#mS7h+eLh))?md%>#7HDyp(0@ziHBQ3|>_1r<~e*Z-QU5fE@+^lN^?Ff-^;Q3e>N za}Y9deHHa{EU@0BsHYRwrCPypuq<}aWJz(WV82i-?EQ_J&N=il%O0ifs!-xW3Z;bFDq zj39GR{PiO1O!od+yH#x8Brbm;3vk*1ZZ*L30R6T9;MhBO?T^WohQ+{ur($y(>+8hb z7a!~eQMGXDLG_a*@ZGl7Kc}Yok&u?l7QhI3p`OJdJv;l?BOoc^62Qsp{B2+!p;bnY8xy@%sD?D7c=dr}thA@+WGq((8Ual=k0QIN+3`E^ZoD(4YzD3fWPw+9xs;_Ivm=XyjLlaV>y zc$#%J)2&QJ&E6YLbPAVWyN=F3uk?mM9b&@3qV?%?XzyDsBE%TO28Er{ADUXLKWs1f3PBP zJ25uCLw1|V5ZMh4_!aY#fNBZ|hX&hyP9frl5Vv3kjutO~-^!}9iv8^4ekxo#2V-tt z8sg6Pumij1dSyi{zSVHY3)ECG3uUr4FUVe#?=nZpfE^-szGUh7a=#5#1h#5}jdR;e z!FXWDNb(*df;^W}mo8J6k7tPh%9a^XB4B3L2^CLq!sqE63?$(gBOo&y^E4GiCK+6@KXsWIqB$MbqN^M3oA*ZMq^R!e7NFq)cRx!xRb zd8r_i&Mplo;emJ$$m;=k(eq-Lm-kH{9{@KZmzK=Sn=kEQ!bR2=uAIkOO~#!a3Tj}1 zb)-@Ps_&C9FyH}_9liHtCpfkzb+*LR%B*ky>H^`-5&x|HZt}VbND2E(d7eSpy|dwKuG?0pJ{$6Q zZpR2KHyO(uj{htoarp-6d@fM>`f&lT8WRWeFhDiqC+LmmRvOf>hV>)eVD)sj-&HDelijJazrk@igAi1btn!()Bf_+|k!?X$ zT9Ug%$J>^6BJeHILLoqr+-kE0vbZqshNCdU z6x&z~V4XR8+>hG$jGvu)L4|?R`vRM5+l`p=@(kYjo)wq3Zp)R*Nc|cPBp(1S+`N#o zFQ^Fv4(wFyqxW4@2TB2`u)BAt^L_dO48Itb3E=Q{y!?jd{KU?ig%Baq-Jj(>7Ky7_ za5%bF*t={@|F0^Fi`}FCdj*{_aZH)i@4i5H@2h1;+or~3Edq&j&GWQP{;{{UikXDyGf9ZkB24I_0oCrc?w|tu4(X?Kcb3? zPN>t6@M*OXjcFaW)R!;JEW7PwR}q&LZ+kXxN1kl@tYSSg9b!T~rUMmYI+m_htnh0- z_!$+g0?e4%-cL^dU`rcu`$POqbbd2nybgX)I{Y}KNee07<#zu!+|9RMzEt%zw^eC8 zC~G-bgvsZ3kjTds&j_@(zQ2DaT_DbdS1iHJe-tDcM0N2=v5}#l@=9BCVDjqXH|N)Z zlC+#@UA)zDH~@-@KVkKl1`ip{+g8ty4(cErC8d~Eqo1$+L-gXM<14Z;wyciB+yB5i z>xog;DfVk5Xiej{&>_9mTV+;f6~X4f)FE>_^k!vGG>sTJwY+)(5R#%rZ5oT@FqA(c zZ;Ep%7%rjxZvHEvw~U5br~OAD;XyNB0SqK%!~pfE00w-mHxF02z+iA6KzJEa5+H}@ z)3VkW&q@pp50e8e0%Cb(^^jQ&admYHno;SZS@Tlmgnu^x_@WULGp|n}2v$Ib31q-P ztM<5)0U%OfAS3brmz?=U|Br&2IS29cl17?(Q*H*3+ymEXAoT}+cTu$pA>t97MR6Ih zz%qx1LQAb!F|U)uLg`baP|;Er>W*N{EsBA>=AB=V*UQOikF2g%03eo`SruT`{lH}{ zXPpMk%?*o^ikfZHYJ6hiud4Vf;0AZO?a>|tkTq7)-+<^-+dwCX_!%4fuu^RZ;HFEp z7GoH=97tPV0SP!VNFc^_qOl0j5}SvU?1d#&+ic-9nBLlo$43j<9iGjgXY`_r^PuM; zD=4MAg;D>eF?p)aq8jY4Y39wx3)`<0caX$y*h{lZ+q|L_`%P@P_fS9`<1M|ntT%YW zz=Rm_m1EV3PmsvwheS%vf|0$!geJszedM|6Vs&&zf< z)EAYEEs z22LtMM5x?pbHL&(1-pL;wMjaF6u4T+LBXh$o0 zeXa@sX#ijhP$d#UeWc=CdbgJx6$Z$>{S0nAvbHGku{FGL>gFmm_f9)W} zPM7ir!}b27O3IrWJ+9!uiOg0p(Www4_7%txtGY%K2E4V6QPrz=BU=8-feWtsMuI@` zm9FwX>4gY2EzH(~8xH>472oUW+mPwo!!OGfKb;DZGKHMv zL(~15s1!T&GbuiPg~(47qPLa@(CWAi*#w3p(|!>UfMyzSTUzFoQn+I7TLkL^~1VL$IWnELncf zZZXjv%b;EK6XQ;J)5DiMt8jY zBX{M7Y!PohjgE4pC~#MIRaRfWsfHy_0#^45?4L*}6u?#UC!=a525 zg-Uu}H;6d!fcN2?BTO;pFFOwzzHx7#?zHWERLb!Q;m&}r%DRKBLbD!~%bHR*U@0Jw zGm?}cnsvJA^X$&@ovK0{N)b@Fjj`PD<-Qya`O`b?fPSc~$_Wn^M6e^^5Hg<<96KA- zm-FY$WY4AXhfl1j4Mf?P{&EV#`fWi~av^Mx;RFIl=zD!T1gq;dOBl>KtE&DhDj!J4 z`nqx1qs1*H#RJjvCi9rrNJiAiT{U_NrhYdKfvKhFMnNb2Jqu!E9N z-OpgeK|-v1_B=iyu*LPma4q{f`He|82**WL76jSGf{#*Bn$;>X!{Gu{eXgTTzWnVu%xvzW*SxB z&W!~y&|tFTevEIMVS(o&z9ClB|BNTj44F5K|DOHD(AM~v!?m>^(D@0t{@fk18Vqb* zZ0HN+F&LDMoVq`IGN!qFR*#S6SP#~R0txWzZLaWXdaPl0DwOXQ@-6+`#^u``$$R^a znfc%{>9t4hXVdZb^5|@d-{mX8L;1p*)|2}E0ARyKGWV`jw_QafrjiS5PEh3vL1t6F~;%~DG*`7tcmmdT@Z5CjtEGhPx zRGmn=A9k=G5d1U7-3DAgG9C`e%Oq4-zNMVo+s@{l)%uAbD)F!RW@aJquc@={%!i{@|aWx?$|A{TGH9p%K;5iGy@0EX;=Eq zdmPinWu_XWkAaWSkqFcv|1bMwj8+i(Jpxtbh@#Sz-*@O}DY}dBP=Mx8pNG;Qk%0m9 z5fJIB>?ekObo%k-=fTY9(7F6ZIc8EdH$v+^KUVG>=)RBL?7plb&wg;OElK`zyYMXw zO!tI;in6%AdxxrPGOkN&ME^&sa9yQZ8~~)s)XIwM+A<&@{b5K8cR6tRvB&usQ+M@= zE3kb86|~j(^vHfW(2Ys6t5n{UXu2Tjv)|M*fO+VaqCZTcq~k<$s@PxY^B}%<{X)kr zyjXDJ`F896AI37m%;Ie{PS5w`O=K}dx1ZO!53#^?N!rlx`lT!>$>CoUe=RARj!AHJ zA7$#>F5N_860q|>X1n*&gjCObG@ZF(QY)LLoHUP*C%d81(fu4n7rKgN>`4gRNqZ`3 zf>*J+FdAJ~jfC|b5_MWR}geV{w$YsK$6fG{q%zSG4!Y=M-8lNAg zh6rR=EHC%XH8anJS}~)ta^UPUG-IRD#*@+$Ync`MQ}pK@F^LN$Bgb;-cTqB8VY13t z6CzOUj5+Debd%vFP&^9qYJzzbKgLEA6O-I-6Uw=##-A_dr*LQmHwfFE8ufHBO{aT2 zDNGX&kuhltoDVtU#+{0@%G11(T|9`jhX^bcl6p&mt`UCj<%ExTqSUq=cs+Xo3mIaA zdjk4zbw_i?-lGQuEw)|p--Y18_pfjn6aGRP!4ewL5?T=u<4AG14W$Ih(4X{EzY%jD zqoo6JuhYsbU;&R+CdK?t)2YY+j9A8`BDdhjTdjxmjTo_aK%IUIv?WO7kp56>5|H86!vG?>{2St@cDzTjmVZ~y z+YzpNpp5me08SA^B1K0%-r+p@%wN(>h)%u2zE=396XU9UT#_YtHar z*IRRy(zAyHOnyaI*TWBK))PR%Xl;v*fpx^;w(sB-7j3`wEs>H&dI}pdx)dU%+GbNV zOw_uu5E*=s$rzR5Vn5ywTvd+8lw9O%hLjIwM8Yw!nEi&Dh&hR=Ox;oZQL+TOPDgz6 zk`=Cwg}g51&ZT`FYwBpe2n`ieNlk)t7FUrqCXoOIWmPcmlN*PanTbb?rzF+h z#w4;LF@NW$q>$Bc6={x7i@rlA3BeZ7pPb;Z3I$`GT`;09ZlO^eD0FQdpoPYJO?Agj z#iEKRXdUv_h@q^Tm}k|tPH*;1lZ`ng`YKGZ@TzW7X3-}g^RWe-XsObVhV+tg_USl^2KI3=R^v zx#Os*JbpG;a!}99C9}2WAQyG6@%`TsKQF9}1v`25i?$L7wk)ORyyp^LbPzq&uUeYn-7MTod>IzvF(08 z6xLOioW6v|`GZ*4cNIqCXU(U|rYxtbHvC$32W_a{PZ6nOWT@OrIwOL{@?Fw&L0)9F zUcsC#Nxz)w7x`@NRA1&I%EkUvDA+sbFXU*h2- zx(<0Z&Y9)n7(ckFCy}~DZnG#r|Ev3mw*jLq+Xqe@8Em>5AW+ilwgaKSoXXT@Q-lxj z2?~lPdu>tujB}}%kh#n=Sn9J1!VO2{*q}u8E9@o7dbwY724+n1ZA;-A9rwCWaGWH& zz1ZfIj!K%fN(mNV@J!A$B~%b7Y%EkF_SXQq5Mnl1C2Fgy^bZ-41HYOnouj@``r)-W zGNYJU46){KV$D?IuIZlNDZ+jf9|TgkB2hO57+zE<2*~5!WX`B!w@}6HU_c-F6Ea2q z2#^pI>HDBj_9}4-Tk0m%R>*K=!VF_q$jIbLeN&`Tyef{nG+9=qK%7a@qd3@WHrsj{ z>M58ZmnXJax^Fjk*X2r(DG|z12IVW7E0a4Z_BX4wDwL$dgeBz6NP{FLQRwKbZ^8`5gEi@sl7hPcu%p1# zKIJP`gb(Q#<>wln8;%IzFX!D4byX{vNTMdq4fe7@>B{~ol`M%&9~V%;ez5^2GL$#B zs|0SuHerqAESGbtVw)p(khW&TsUJMpx3euo*a#95}HB;Kk$`K{ugfS_h&@DKRj+mP>0YHx7=w?O! zgr~0R_k|bl>kRe~~ zVMXmciC)xb7x@*1IdtJU&;1#Bpn9RhklhnvtyoytKN>iC$Qb5>Sy`)_9jQ)wljMww zy0vV2rgX&g>hP@on7dD*!oJ;6wt2aOkiyzSzbaDQd>NfVXP&au5CM+~h{0{a%Z|tj z(jgKO`nBT`6KlXM%fp2Ev?>}O5Wp(BH5PGciW6eP+nwKa6kgS-#_X9IZ)4#Y+Pfw{ z4wvUwT4Kdi?xzD&Kw4lGFYF~WShw);dX|$~(u4aW6l}8fmiqw84c;X9$VFK(w8|UP9)c&7di^>P+P6)vsfnoD$)6ipZea z7qC6brudVBB_EGWs03m{v=9;nHecov21))uM^}A53t*8VYG4 z37D*5^kGS68XxAm$a~!_E3tIZOE<~seM-`R5aKTJby=;J`T>Im^}uG9CLp#X+1MY3D;-q$BCSRs9m18OA|oI$LDDTjrH+HF(3?m6A;hv@z@D?( zzjulRwl}0%fx05Lr|6!7>}+Qu?NUR07b;dAle(67Pk<-{`9~001v#3@qZu2E}F}13KN;R~Do<|^N-2^1Gi9igs0)>*AqcAgunkj4I^e^hXF||MixeX}y z5HXDYFe$arsogsHqPa=)Vy){tIpc%MokvV@V&s&3AQK3O>j)qYV4Ct&v@0&04^t`J zi5*VNVNJHhTa6;#I~|7TI)&~rO@92gJW(8vgK3963S=sw{IVnFLmG0u?NxVBVLxVI zzMb?QEm|)2&V`n!tJeFWUrGF4=qV)rVb1U-1d{TX`-e=ZoKY2nZ9tUpi2bt**BLqC zQunS`Kn`x|>?BuBQ^bpZ*pp3E#CUF?O9_v5ZcHVXxW_ixz{k}$Zu~jK^n3+9>jn-U z*_IQ$=*SUZGz{e$bm8GZSDIYIqe%NgdFY~7IXC`qYMgCBws))q3}(7INOJakRTI^x zl&dmuz*=TatZwZU3Ta0U%R%>BV&++?4d$BnB+gR(!!K-TP@k-OiK=YPjH+gawZF_AwRq=Byjmtq^Mkbd6FKVildl4U)kU1~1u6NK zicMGTtY+wqRw{`$Zxz{Kgl@GhGYze@7j4|BQ}H=!)YuIV!4GeeLh;wVo^~?zb_0rS zNP(%UXmmO$x+h{1uZsM5jj5$1t@!8#jOqXrs;}zl8l~^c&X@2HX5_@xKnq+)72o^f zV+dBX<1a2a{7N}YTiDb3HKQIbKtR|Nw=hh3Kn`lULyr@bYAy&}_9cNCQ__q%(Llk> zF2L(PFU7ArEaEq2LBB;mkORyS&?(W?u&YUUg%gJa>nFdi0bYr&6eWNHJ}p>rvr@>V z0mC98^0tgBIu}W+&{&7Cn{6ftY{pSWGwR4ecHpwFlQ)hZqAy3WD8KxhYA0Jtb+A6v zVnM4ZjRmw^#KK~rght$UH&T2M7P-@|Si!8%GB>F<5jv|T8Rt;6BV&yKdcmb_m2*9Ww#VAe#3uyAOV64B2;4$h6kwq(*N6FTiI8e* z`+sD58jvRYhcBq_O#71i!Kcf72tU}q-Xs<`ZMgA4gQ|tLhys77^pl_@M1lmr zcuZ=l1a2boH#87N)K4^cNuc*lPNkx#Q<`$N2PowR1Uzz3y7ir@;)o>+($S^qtw!UA zx6BUVYBZUQY6?=VHJyixm4?a1aMzQ>sHpCCI**CJh4!uw`Ny->Iu6G(m&BunB^mNl zsWbnWb|?K|E)C6$rT3BCVP~)sP*8c>YgVf-N~v$=KiCa>@{eBjQ4)tyiTlL$rU|Lp zH}8!9PHv(D^~$clEqFKYDt9%@NY!+O#_Dw@ST2%~X!c60x5rr1uo?-A#MUi4Hs?1w zN;X>>g)APD^nRq#Tg7NVM^PN-v0lV@vxX8sN(X7Z#d}1PQjQZS?4lJV?itMb8s`93 zW~o4t)nsE)7Rj#$gA%=%UD;4WM0)l{jmlYG-TODNaAHYEl$)!(z`@HsF@C$Hl! zO6aO|81;QAdHck_e&8!nK~t=8=Xjmu_w4q1SjL1#!Tes}ek4=6CvXcNu^qOPnY{@U z*i;VWum;~~gsBe57sXP_krMvt+$+pjC->@^tV6XR>?0)_H7uDz*w&G_OI zS<^|Z4^w-_H6=LT;$H@?oif__2Fu|U-;6^g4!Wjm7vk@!K_QxhS@TLcmXzFCMQNMm z^fxVOh<6I54UET4$Yu&RAgt0N`%uN|-5CLs_w^Dxc?UoFw9w+O&4hqiP!rul;n$wp ze5eU7Z%qun1p3D`f*|I689cQv;udP=k{jkUN>lno`4T$*GC6u|TRL+LpY0rRfON$T zm`$E(ez1-N0Kr57e3UFtHr7YHwpCd~m@#keBVeV#n?R-U3=~)?qp~s6FM0$Q^Rwh2D!i>AcS!d(<+*M7-`YyhDd&KB6a9F53s(0Y1djEZG8iIoa*d z{AC3rrMt~kCA1nf+gBkH6cch~g#`+tZOWqK(J>W~EeGFu*;FH8|E%Re0NnUCB%6}F znyuY)ExXkRcrWI@g^laqVW6eI1=1#T=spxk ztv3u!AtnK;b^8efZe%1rQ(5tqJ0xX{QrWRXvWC*-OjT)ZG88B5ZEh)613De?NQoNJ z@kBUNS3T1OWCK!3Seab1<(4T%d*Ue#(bR_5b&E9CQxSFwoMt~b$fXfeU{Dn5(2%X~ zrXt1Hq>;6et?&I86OdeXlb6tc+;D&X;h{}$<&}7X<9}VhCzDEgRnV3?A*V0H9vqQS0bgP ztR)=cMg!WrDVinC2X|J0jB#1M$ND&wTpLq5881mClu{ON!-|sWa(IN$D*Q38*rtxU z{&%lR(?Sn+#OVE5wTiw|BYO;oAk%_T0(it-QNk7o+=K&kB|Y}&$bq3D?Pp&CddBOo zAKoU?uOi{jK4gP$#+&vbZy;LlUKdI)0Vs@JmUp(F&Sy>Nh33xoG3JdWkDcZI7B;?g zv8!&h&Xa+8Y*QWs0vqHjtxRHBMgz*Ljs9B0K(elIL(2T!Jp7x|zf$JpCH8I3KD~Y3 zNcP)NmzuE@nLE4Jg&P7s>j&7_MLbLmRpu3ftSu;NA*#0SA9M+t$%-_c-H5$8~&V z_Y5waKu!MF_|(E&{}z9Wf-tV0ZqF4tcdfsAn)G)O6Ga4|6qmzn|^o zdzg0K=^lvveKH^;pTm5p2^^jv$GGzd2bR-?sQbNn)+diC4=MGg|A)1=jH)^cx4kVw zO1eY3LApVt1f;u_ZloJjq`N`7ySp~h-Q6YKY&!4aoOACu_q_Mx>jwui+ynO7E1vcI z=WouqM_p#2TMYwQTXPqe-)g!GJ|p`gS!3UCj21L1^m!s~o1eB)oq;mi;HI(`(fbpt zG=kc!MCANOqp2EEGF|?ohO4(LqRDO#q2KxkI2M8AV9)wiP)BYl7a?aiEZZtODjWlsz?Crao zT3CHsnpdeBo>&nI_>_^}*hpvcr%#euPT+yz=| zI63aE-?ZR;U(N4@vQg{)ZGLdzB59rtUx}tehxJf^9d;YtRjw}WW9oI|j|QY|`dI#$ zDLWEi+k~EGgsRNN-~cM}IjXa_mj)yc00j&UCIY}2fiM;j2){d6f^&d8SzMwA*r*03 zl14{I19Bv5!VHh7MnPE_{%_~+V928|u*Wrb+!{Cs|7y$l7UH*C`FQqp&FpbCthGym zD_S;_rCJ1Fv4rIFN=prk%oNU~l=e>;2x69(L%2@GJqdXc*PHuodkZ4lhj&O#L|?(%(I{xSuD;& z(t?|Ek)3kdOVRLcQh#(a?ZnwX%_4KoeTBY-;+Zwx8OD8ogKox|ZJV&9!6<{a3zls> z7R-!&2v@o1^@S__gu7EhfY5Kp9!?}bsb+}RuZ)H!vNU9vZt=ZBo1EM|-hS!2Ox3Pb zwN2rU1~w}Sy02qcN zcuBkg72DnWBbujHX;;HTo+gC4O7gTTSdGu2YJn9+aeBFMTw!Mfm)h4Cv;9DwcB^#I zV$feGl^2XWZ{+S>zCZ-x4gh>=EWk}2of6y-jz$?-j=LGTe8sc2Yhr(ag?k?RSrPM? zr`}CKtx!;#YI%d!g$C}Hri;%DORT~lC!SuR_ENn``t z;kuk~;_xRCVMHu9dfuE=QoWT-hhwgT{hoBX^qPDFNYYuTOYRelF1`nm9L2@mzu?>5 zKL_GvlNIyLWaMcx`$l%-!5u6h1XNZX9T^FQ6n=DK;yGL_lV*HI=pzmPVc+&(B9oMK zFffUx=#G9P{25;S6k@WtmY$yeAQ_ZZ(+N4`5rox zI}04*z2N2D`c#8>RWsv^r%XyWh3&5$%|RyUY3(_)d3kqmhKesB`WRh1m66vY*i?WP#{@^=@UY zGf>In;erLS=>FsOmKP)ja`^fADOj+ZPMROxtmz~R+Q+HsdPYaB>(^Q>beg0c=RhrS zfUCck_Yb{?E@r?2Zx!UFW##8be0=}B5L+MipQ3&I!=7_SGN;UeVEf)i=t)7!#1W*o zE#IwT04@EgtlQ0)fU}aeC6LrV%eaul$%#iOo;NEr%D|5wE)(6KkxV>1N?e3zaxvWd zTmaB6{Fj|dnAq6sP7MtYmq|N^hjPh!R#wPYOHUtQl#GsMA-*68Bgu52w^v=j5LUH;$qe-X7_GIpZ5VpHh1$f*|v2(Is{VAFzQN6;Ie8DePy7WAB_ z#Be;<{UWIDWiP?q7$#o9(^zaZXM5t2|8UV}3^=Iz?Xa+n_-L3kLp60i915y#5o9E| zMUK&PSkjoKx2a2oLVnkYhuaOd)En2{Ws;`uu1Hu2Qx**c&n%6n&iDuZa|sXpO{wc{ z7SQA!v0IxD!mfs^mhNwuy@6#hOxeu9?nH_QfZYehd})u_UXXa5(~5L-aCfIHdM(IQ zSF;;=db@15yxZB`&B`y2sGZ(IbUR`V1{UZ^ zef5S%u3AuSpy2crHC$j!qQ;S@X2#3^@9c-m*J=NT*yd&=V-?#jhEz zJd;!pIvF3`zfXT`!n1w$AefrDl>f?}IhN0oG~{u7#OLyV2-?X><>xh%z^(_4>X zQ@!pZ9lp1Izkt^h(9}O4X}RsMfZ6j={ev-3qq>60z`ZaPs#_*eHem|_oyz|==&RvN zBZar&064P$0y9B0eQ!s&V4!$b8>g|sM6UERnG;w`!h6mE2uvoU9Lm{)jr;X&A=p5? zo<}NeCU$cUxOc=`Lv_np)!A>r@Q*wlNF;no+{gjT6$w^ky0+!~Y#-0SFW7d`^0dY! zlFjafK1}fR&9{{U?63E^|Me_4gha@<=G53+3ljW^rLM+yF)Sc{ub8n!Vm-Bx_b$K zC-eV0yD-xuLE*ocpb05cF@$I8Oe_PkkXX(1jCEL@*gF#~9H2)N1v z^0HFD%Z@JZtfrP-Nkyekx~%!<1W%hq*`aV01&~I53<>hM@7sRCf8QJZ%q-2y_XJ|( zU7roSrnPe0858kb&i3cVBcKh~NMO zXAw|)kIU=z(3e5_Mn~bF`M>a<0br2-tnjT1%}dq;P#Vb0$*rIL;^}GCT^wq86Fs7n zHD*|Hl}Q!fCC({LpXW5^0qM8MQPXxL$Qufm4|lbQk%i#**-50-r$(X7<4)! z+qb>rDlx-YPZsme1uuyyeS!G#9#1THb34bfBsT=~PE8A+UdB~gxL~rTYcv2n|na!h2P~RClD;Z0Qym< zgW2{B5xqSAtB2LQfddJ{W9&V| zGy(^%_1|)-z`1zrBvbYM&SsP}}pads< zA+~R<_!pow29g$RjGPAeOvV3`;!LwWkVAbV_;4T%l+N!2@84j> z*{POVN@OUn+BNO&9T^=%ULPzu|H#Og-6mbY)hVqtB4E=F=`C!p^QBk=Sz>29D-mv(*MVB_XQ7_b5um343dqZnH-emJ6Og2VCZeRdd zdR+WeuiijWGD5%tE?Bn&mS}NSLW87l?t{VHih5JG>7sOu?i3~Ew{8-%cNMf6Q5JEIdt5OWG(9pQXz8~XEp}amK|$2 z!0u;AlvlOT6DXbuQq~Ch9e#g(|M#SqCejqs`>z}gyFefL>J=L}iA+u3q^S0sob-km zc%MR8(F0GW+Bz05mKJ7f9Whp#_E8XIr~onx5Y1?Sw%L9Olmf?(T@B+x!kRuISM-#x zO{9UGP}j-h161*9bh*XD@%Z@Ua-qQL1|{wfy~$vfylH-MQ&{(9nxbZdz*t*9v;7Ln z>43II?&kP~vGu%$tbK`>7XgO^3gOjBpBe^qDa1ZApS{)lh}GiKJwqNIkhPJy-LRL3 zLcNc#;eO7Bd{V$1BRB_wd$44qDApWgzb0$?7o@-E^x*>DFL~R#o#rL!x!r$y^^}!+ z3zSmch>#9DU3{6M0lXc{jw8s=scJ5X&CM0h9HVh+GN9A-?b&$w)nhR+AMUR;iQGL0 zZtjR=*$f8!n|zSh0_^)SX}iCU8YJ}_RE4t{SLGz@aTDr4G;%QLE&B}_Z^zCo zztFETppfiO6k5*JzVJHh!+ADf0vAV{V^3hN#3Gv_*s&pZ&vNXkN%%iVN*p$Q?oT5I z$7}m3OYNsCzs+p-k~Cy#G4Y?TRXJhz_ba{9HQid*ey&c|v6^y^gnnqJEeJPXoV zIH4I8Z<=`>0!9u@wwh?SMJ3I=5P#8GT#7BKIWTPOR79U&^iYjAE)g%gZolUI(y$pO zblekI=4kO@2ZVv}q;33+xq63}$PHKkbn^R*V*`{Xx5`|eRsI2t7Lqg3r=A$qgY1eM z6Lq@MTkbNg=`E%g{B`Em9-NoNHpmcAopDo3aoo%xRPWK*cgx7iq9ehAJ*i&1 zwDZqDaf9OU54gx7a&HxWevAOHt191v4j1nE=O{qqa3CW)g1kWd7TxfX;~ost|f&jr+Ki>mxA3&0p%hfF3RA5g2Z}4&)O#6w> z?gPTGw=X~-`KenAJLhDT?FKKWwYG$ciWr&WEv`;&tt7fe4-(Es{oFchn|kND*Y(Rh zJ+HSc{N6#=V9pa>AKJ{Ga(Rn*E(p8`L2i!cC=pi^w;FJ!Et>aRRu|ap{#wy2rR`zL zA;qMj5HOd$J}UW6kJuJ1jNyK58<-BZw4j*N*RW49mA?F0bX2^3b0=#Os$_wA&@3>) z%=huXr>LO^({XZ6LX%bm|ArqmBz1SY0nD+Z0!1cDy~+*CAB99Rh7>+su>jmr3=BKt zb|#-g0h({;iT(VZEsI{{D@z?UZx{oUpVM0aXU^BJ-CFGI6RZ{p366N*zI%$(vS|SN z$`cwRqnu>^rM|19#@8=$6x)=%J;Fex*At$$o=URp+kxf|pI=g7yf8fkN|c~iS&<+H z4+NVm*fa&k>v=}EwUPSyiPxX{6)6oL`wLw&-Mu3O>(bC}9E>XE+V=$S$HU_r=cg_2 zkwhWcQa2(L>RZ}1%ehKy(6!9{_3L+6>>%dZNcDd>&bS(1hrXT_;<+rD!okUVvFBYK zJ>8u)WH$8tsDO8$QCYL}V;&^F)!cITk4P4tZu+7G!y>RC3s4>pZ2pSVZPLHTzSqpLTxx*9Cn4#180 z=B-IN??r%$rfvQ!xWDm)(0F?|{pgn>(sI_8acTbvls}a>Qs-FH1sIV+8&F@(3}gG7 z&4fuY5B@Xkw9po5(=dz3A-L0vT=P)mV!Ao-1S}E5d2(^^K_}cWbOPSox(LGZ|HuyW z?7S>Vy6N$TgoB+1j^Et>~ZghD4dfbiQW-UsUwkg~kPck3fi^aQP$4AyJ z1G*FtZbW4H-}$V=KPn(g>+SXH9b`AAB}lB16=S}N`7=g1sjfhSsop;T?@tbht7pnp zg`N-8NpF0FrGkQKKVXf{&2=p~F9`#b+pCo%MOGR#2I$oosPRMBFWh!_)MX7sh;;QB zAXx@@3$>P?3Y5Rnu`8%)`FxTu2X-L~byn;9Sv|H*0te0da5Xim_mCIjSwF$g2mU7d zHL9ej`yc)jek4wjjd$>(2fHX}QJPy=)bI7v(=f2Ja2jWM-mvZw?6ICDAt0b{m#P+3 zO>3#BNLpEO{CZ!WnMLH&_G3<4RLcUI?49<1h{j&NR?opN!MH5rIcIIL^|#2=?|rBn8XU zVa3G8j!#cVUGV4vgO2fj4>qP+L1UWLe`&mWChXiS2J_{Zo7pB2f#va12FS=p`=h2( zCwI4jqQ=a!GP0?Zgn!bl=3t9e*&ZGQ4>oRmky?eMo_?fREznmm*kqO0ye?^Qn0D;f z=3Za%vD2Zf>4s&OA~JX+y&to=YS`31k?;(;^;cJ_L~AiWRgazCD|#6i`4{&wUkJ^5 zO2sbg0^hn?H&`~&EYbb{!69b+HO+2m0r6M9bK1YhOyA>U0aLH~%XuA;-gNT+M~2jn zgXZ8C*_Yf`WRWym`fL`eCE3l*3}dzC7FZeIakIvH!K^RVt$9^cLw7v80%F||5M`bX zcIL-L-=m7=O@WbZ?~f&-iA@~A0!5&dloac{s)9nQ<6wD3#v?&!(sM|ZYYf8L%=Tqq zUpOiP^F7R0U?>?w(H;r!<&7&{Uj-u#l5bp6`d*^PB~ z@(H&H;fjgLILAY}In%^gZS5N+Td$dyZC`1+{^9CFj8qB}GRy~?)j$p9LHmVCq(l|8 z#n1#@_mG$&*K}YUUO)JNy&pQD_sAY8NQjbGyh|Zjzy@3%;LRO#Gc21+Q1YUmwp*WG zH%$Ps@KUUBEh+s9B_N@tqjP2)rTapk!$(}3E4D8X<1Btu;UT$^~1=k9%i9&zH zf{3Bk+Xw9Lq1}J0fF^dkiKl8Ecxzsp?U!ve;o0kx{nJm|cwZVokEU8mYZU5=Wh`?k z3I9K0jXXsu(1i<>$>3k%!c!wK-<`q6?rY2Ut7+ma0#qqjZg*<`QTp5=n&^@wNxsI=Y>Zf_{=1Y;iipHJGU6QUEw zpVTx;vm1`!Fq1Z~5`4onGqUGQGqg>>UdoE?Fyb72h8`>G=IO*lYyG#Fli|-uoNQip zMZ=HFu=Y;Xm9K;5w6USu$H-N#f~^rFr_w3G1>rZdUdhyVg1po-sU0t=1(sQ;vV=J` zm^)0%$%4M!KMH4S#NpH>o7=1;%-Bg~DSW>;LO6P~W}KRyJ$n

HL*8Q)MTgll|+M z3hN$8JC9G!#iy^mGZN8ecvx=0D8XoYCx-VABK{7IcIqsCh@%E$&N^u0)6wU(yxA0q zJSX7VO?<8nr~1Q0A(k7GbGNDI<=31e2-HpASe$Bmo=zy1Y+5;1hI#{WQ8qxkYV($W zmcd3WivvtA!>y0^R~gOfB4P!wdhZ)oyMQMDO|*ho3&#}$LSkYhiC-%o&H$ngY~=^a zXA6{LZ6wbS+%UlV>wY^sZ^!G6Y*+B`!U|`mXu9yw|ofwLEZ?LAb1C0-}}X>M9JY7bz>bgh;CeQ#bSGPH2ivLa(YIgfI0WG z)z{Hu?mWls;hsjNhECd0@iv{6f=ys3P!ZG9&HQiXq)Yg|NdZW?%<@Tbkr`a-yu#9n zQu_Z^W~xA!FcT?5{^Pwn*1ovh=$U&Oc@mv?~- zw7PeC$LgPw$M+eOV~<6PVsX;-24l=*Ch?_Ce!o7y#x5Pm3BWXB*x5P*Huk@v`@BFI zTl+k8_Ifx1;htY+k1}c?fkrB!F&2oYVj>~1)WZdXRng?&3wfHF;?l)1SrbxBJ5;2Q zVLIm>g2}Mvq2CClUNNbPR{j~=dHMLYpT&z&De^}FzxLS{BLqaNN$#eXGNw@s`C(F`q_3fZU{q+G|*zB z_f;-5W0>+LG+hL5#}8|UobB!O-?`DuU{?+*(;_OdLfiF^KtJUZk^~R5b@{Jjc6c8f z`5Qm#Q8BDyO~@~NC7v#Ga`K-b0(CWc;3;=swyUckER1n-Dq*g=LKHg(o9FcSbH;o# zO((7Qq{L^W%2LCs15QZ!dTDGUZUnC1W)Vo zEfe##2~%HOAUjOfex1T0CuKoTcuzNE_2n?Bly4Jyp`_u+p)zgfz&po!rvKjST`+r> zG66P(n`4h8vu*NIY=#pgiLB~P;=6BBj-&`Wg`YD&_in5KJBRmv9nhuZVv1lz%{j%r z%5c|e7oMa_SxSHFQUBv{`CGUJi66ZT^vMzwD_eZBY88|e3|I(kM;4v;%V2Z zm`^kJH6;lCNdo;>MQ1pCE85qd-tEUEgNbq(qw-qbIOdL|@5}Z*SkPMIIl5u3i(27+ zjC3z2jZkfNl3bj69Ai{tm!^N+tD*svCrE4B#uLuT)IY?hlJI-mumna9GivFoFLSbM zNFOz?5%%80aj_#;<;+Aud~1Dck>Zc~uf+mmdKe?QSn3k?mgurg4I?sIwc;4p7zeLi z*X-S2mD@vFX)%iE5mZh&J;t?MC8sNY5-0~%KcnS3pY?tIa;Z? zPVi=j5K3lb79H`xP#GJcsM>FRE0A<^Ypl(dNGbM2B1C4YrGCt8tDiZEQg}S;m)pw? zw6P68z$S7d{J^P=CUi%LXs>#wl_k;8?7>4HRQR7G`}(Dyp3v_yt}9-))A$ zli&u1QLJ@Z62%Q*(&pt(DjwdX26)S=9O3Z<2<#X;ci}r}l!;`qu#GVWgQ=>ybhBpH00qWp(Ee)o7;VjyQ;K-qq{hG+d8j~T2$Gq_Nvur3S9f& zv(<(2wSS^+R5cEmKG;?M*1kyzrs0TYjER|0rqvo|FA$G9%O0i@l}x--yr&_KZzQSO zk_rtb3a&7a{PgKdcBJBX=Q!o3?CNIPr_PXwLH4_DD`HtJX&rNY44ep4#>IY`Zd4w{(ylk2 zk&v~&V6XQXJ4J<)bD6E|=6~L`zw-Y$lqPtL+?~_7l@f@JSIy)s*sd_b2?O~9G?*a3 z`T28(h*cuxBGUxJSjrk!zGo4p8UhNEfI{F;YsWOng$- zq@C-J7`KS3^pm7Llp9W3Jo=aQuXa#d_Oh}{dxU>Rs3M-UbMqE6xhO|DH$PI1sc$cd z+5aN)yzA5;Eb@2(OAw%G3Sb$&n~HGFU#@ zJl8MHvwOOdlK*dy$&E-J2%9wICcKy6e72o(b_~Nn|1#h_wJi z^0so(aB~Eoc_WQ?C1Yhf0Zi-imARqquqtiMY0ecHz$BfV3q0@$FB}Lo)Q6+29^!Wh zt)?3qV9Xq8OSe=chglILy8Vy}4Mj{j@I7VsdcgFYT1s_FF5B9%* z)K1Ah69z_IQ*NrdM#6e7k3Ib$2Sc+2Hg@lR09R+}$@}t=|6|x01lprFb;TlZZtgWAZpPTKZvc1@1i`~nOv zf&IpJ%zzBx9$|Q;iQi=-5>HJJZ{U1Fh)4_$&T#?Ym*_lj7{jR9`FBmk0RlzYzVzhW zuZ?Ba=r26>2w#tz);QKm7bv+ad-W!zv zUL(vXHj=GBKewPd#afOEOMzm0Angl5^Z~V;07sMkh`&@5o$GE_!vjeTy3R)#s$dz*|& z(YXT$Tx9}%m?`EOmACR$0!_r`3$$Z&RiTrvBlNwSx*7i*MTW7#8U|822XRhVX5i*WytgUNIU$zusbwKF&*$ZRou9!m%?dH!>Z&(@VHD3SS=y@a% zvHxJVm-0AMpRrXGqeWN4N%^{tt+z=oEyME))!JlUZ7cu7#@@NzL!DNxPV#)M0W~7d zpvgtyW_0NU2ojLZ%PK9UvcUsV4JdPS@5=o}TG5u!WhXYV+p1Tw>Ol6L%58V*^&A`j z{pbuWJ$;I@4hP9n&hX;d8@9WRP6N+P1W)4T-%~>)OuL17^4%!PKJkbVDYY(IxBYzU%=*k^hwv- zj|K*n5Mdmu`cA;+UmEw+;pO)|WjJCvkDbV6h?m#pzfviPMjryV^~T0=PH@w=TQ}tMYIQSQ z1PaqbqP(|sWL(}C>#B>^TzT_+iWf+30#r&KpKLYao&zwlHoo-BzGxNtTX2a2E*UD} z%(w_+%U<~L7V=YZeZ(E9Eq6Cl!CK%^@_>6O%(e(|PZ_(Hs+$BQ0(opHDvmOl%=j4L z-0-RBl`G+XwEa1C%KENIWHwSTYx2=tCX7bdy#rp?Dg8Y0@uX4kn~k@xY4chYwdF1M zG24I3j#IvgIIop;)JtnfTcm0r8kwQ2jox$!WaT|St<2t+t?u04!;-F)Y0>XnmWvsZ znviyLhY$5#{YknHNguxlq9RJ{dY$_4@cd4zDGiCU@y64d zShVYfH}?N`wZO57=vr>}+Nnj-BHE67?`WfHjZHI&6m`(7(fgqfM(p2hlmE_AqyL1^ zoj}`RPeX>w+ZA(2BwSKy-Y_qZiA_`;EXvtrVx5co4!cTC-RR;i;{nXjwpG&VI^|7> zhHj-_lNNEe^>soC@xQnkMxjCK*#(;9GyoJblj>ERaWi(!F9H8jNI$~1#2Cj=$LirqwN z^tkZP39URG z`EV2NlBnKY60IIOJAwZjFtf4Q26vPN`W)&E-O+LnuacI+77o|e{2{Vm;@(maH*4uF z%X&ZY{K`NDp#c2ns}D#>_18C5BhU7bvpcv+oJ+DMCTe@v!2QwnK9CWUV!qj}Beqzh ziq1${&3Pm{Y|VYeH9}5sX~5(T<@>*0+dXq=>n2$*McTfL-A`up_j&WZi&2Ud9DQ|z z{|+9b`XdO-Xr)gzE0gon5>_Ol`Vz?l{-wr*ydS5n-AuO9h?5+`p%~b`L|-V#Co@WX zOP1ChtSw~&!pI*3az(8nwXC-kWsDT_y(B~&fuwJg%o3e{n>WWKC*^w8eWv3|Ry>HX z>(8-g%d%iKupS@d+r7OZbBf8#{#4%AFE>3B0^5%*5oF^?V+ z3cbub&%p74Z8_TSO5e?Zry#7uqIONlT10%Bv)6~bBmaEDjjp35ZQb!-x?IkWVc-Bl z08w8&_#!5(sE9hVJB&UgDV?5~Br6&?95c0J&1VRER+}EIF2BH9l;w3ZKmN`~PRh)s z%+#SU=_JhgmdSd(d~m)VjVac$n)h!9_IUJX+)Vqw*%c>Y&YE9V+47{)_ME zud+Hfxf3Jgj`$DPGCR2yA`=tETO_wYq1K6as4)LUXJa<>c78j9Sk~+345X~ zFwkuUC8eQ(GDtUwep;wI7L7BCW7hh_fWPseL-MkGb9bADjxIZ=Au>xM9NI_i&SvSh zm*|~Wn;VoPjlJQ};Ih4>^8##-geY(WakXpsgzMm!G5q?sufl*Dq~L6EwJwRv$Z$M| zn>8Lf0=32*#DLnmF5XCb0a(y>Z4wT0L*!{XrCVKnqoVZx{K2>Devx|4;?d~8l`Bpd z_6mGwcpu+OAri`vNO`6rJAm1s6?AAREKVCi)0M)2M$cKF|4kCQY z;?A`%sOBMfHnbEQB%=uLG^g;Z@5!Mc<7phtu0Ox{x;7hMAU>owC{HrTla{E$Hzr_G zDwpyunw9(-^C_cOiBQ1UH&XM%o&ja-byV=AQ3btFZ1`jD7X6#F3<^49RS_ckdn9nD?tWvALdZY((5$6*97IuuWiNKa)~NI`AF*t)Qv-Yhh!p1vsnETa>+8wN&G3@$?J{ z>F$U*bRv+A5598t>?B|DPPkAjHQEd^x_n+0bh$#D*U1pn++I*Z#g?Od-hi@8@_$Nx7#aGV((6vwWT~HUkq(1#BIjJoS%;u;o2CsyFsej3R3W(+I@FcIDSQEZQBPf`jyZ_+d24hbylW^}*|Z-pD;su& z8=LcZwnv1le6X9B>Ou+3t-H+20g3^mq^35YX1xsmH<-DlJ#n~R=pinNOA&l?L(cMB zSCEl*%bFBWU&;wyFqF1sC_jKHA!=_=F5u~@&VUUItDStfC!QBwe>k1=($w0zbL~4w zi}cA#{{d37+9N-Qr44W5Q{V?GYG|}gt2v<}z1i6plAyrvB00f8$bqT zTgZvk;VZmeT3RNIShaO?Y^4}t0px(yP4G70(KAga;-gU!Sff`@sP3DKZ!a(hktyDq z(+w_qIP$c*wWNJd&Dg76UHlrbk=IhJ&d$|+$q}0XkG$=T(Wz;qA~Ul~QQEA}2vl?N zdUI{fu8d$!`%Nw?swQET%}8()f<_!GKmV^KW05!`1cY@AcL_2DuZM9}h}Vj7P*Bhh zm(Ml|3Zy`~msw)Pa!6!?E+7S90!vlIsVSA;zeqK;v;xGlkluv@=S(0x`FrSOP>}#q zMPx5tui7Cig7rMW5ik@dNL4f?^&U07un;{OXhl>8o-?hCtJc2^5^XvluR~o6ii~jV(R}l^IgyKwjJhaj=gCRAMhOwku z=tfGv)TKfs;VCQi|ME&o)nqKnsg%cI36cYj&?_N5UriJE#Fm{;rJ*Wr5m z+e<6wqmJz|Ru(UVnVG+xsxb|q=7YWrn(a1DWH%(mQU}K% zbN(jLHmTFQl>P!G6UNPqErR?HI66C|2uvIlrsZ|d3)IVL{fQEjK#0zibNAHoZ0zrG zL&as0X40#V!ijH3zCJ>gv@QCQwohH)VST`9~4xiF3uFYQ`j?@-yNs0&FYVE5)0h-cu{L>@G>T6Rh=K`LuoXetPlnFsuxJDv;FLU3*Y0t-V>P`^CwmU#`P=-tr?JtUiX!cgVrM?kn@g!$nk*9ZS;V>urdfa9AKN(9z+l=zAvKJdX zQ*ti7B5Oh7)(|U>p-Y4~OwN-gd$^s`o+k*$F4E%6cVsKyJ?|bw$m|XU5lg1FhO0nI zs*>gLW6d;`QF+$gjJAp+Id;n};&@eGM}*eW$Ar~d01$}O<$H!mnpk~ zhK8`Ty+Jo35y7-xTkHM)20&D?J#wBqhVFsG=37Ow@H1{5VeAZ!*Q8EJ-rl2neQDR;le+sXD-T z9P;^t!&g(OF-7w?{yyiAr8v$_N$oJc%B5unr%OXIHH>SEKOd5pZ+H!sqSGSkPv`d& zo~9O%Nk#% zA)}%K6O6<7rDZpLX8)#*d?hz8?_F@$VA}oI70|18=(AMWZL$JB=jYcCST_zUB$m$= zIk+K%bP~|W{s!7vzKEJH>#tIqT)by`I`tJG9uvsLns{})JwmtSma6n1N3v}3o>H|$ zyBk1_esh-H##LvB{;h3oJ`&HGCC%y=Rda)W$ZG3Xa3^jp&o>g&wO=6{RSQ7fU0=_39_OWK{W1=%P|<7{-ykhaji3pVn=!V^9^c z5Bq$7=L7xqCvwT}t2)%=8qh(9w6jsq{%BHp#(HB~U+Fy>jS0K9SFz9*gAlJ}pQqyB z#w0bnk@h0f3boTzD14K)M15m(C;?r(Tn{*B6&#|7Q?j??{M>iGr>*YnyeyHC8r#@6 zTv?SUE^Ah>P*Qi5=75ZS@b`9RBDX87pKc!~px3CaptD)JPX5fXy8Bj<3xP3 zTvx8Sp`gmhC}Y{U?{s?yN5f3NSqZ#VK(v@kGiYyu=slkmlE2$mN-7${78cU&&KEK$ zM7M-LYU0a40a)pFfdC8V4?0>rUX54-@n_6W+qRDfJ>JQCU``!pH#Olz&xtN%`o5rD zIGVfXxb$#(0m`_Rt3@%ewlQuWDJ0_yy;oY2odD6^ z6CrYciQJmQ%q}r*O+sZotI$6?b;F@tMj~0HuvhQUo$~yn+2a4uYH0o{=w+9cfrk~r zBke&Y(VG4m(E1Mb-Ek}n?z#Dtk`->KpECSO#RfG9aUtlU>~e6v7zIc$c{qPET^b?r zhrnbv3xPzEHq${*5>m7M(UT8P=PQqip?Zy}Nu0WA|BJb|jLNF*8ns1{mTnNFyStTc zgp2O(?nXhnyFt1^x8^Ce{$c{-86S=#&(l`t7J&2ygLpcqY9a6`nHtoGp>EaC`X!oYV%}d=`u4 z^TZ()cgi_q{ zPz#~i`uqMyoHUc&R|(xjJdT~{eX7XTd;j47a&H^!+m=kCBv~Ff!BqQI@8FACa}x$Q8l#$|fAQ~`sqKEv0AH`5TeV}xIWa-fJa z_E;e_?U&^rD>hIGk-Zie_Yk4@n8kwc%yzmVE-IUe5^7#DX_Pm;a=ufoC>|ZTzJH=v z*A%m7H4o`EU)8E~k=8Y6? z@1X!8+&;@OriBsgLQ)Kl`OMYm`Ga7%m=palp^t@g;wC1qWs>MA36UX+x?@3Qb0&Yx zgnrjNQLADUBs}1r!&Ek#3hdA67Jh>W7qPOGFZC#Uc;8s3?y(p*(ls@Gbory;MO8aB z{BsM@?*Mkskk-bKVwGwEmXo_BeU4w@2}!kG|YpVYtEXD+^%qeCqQ;dq%aH3yvwHTT*ptcp=72g?I$pAJS#>m`ZK zg>X6gP76z>1SZ|OPjPX%4titqx#v)e<*G+3&afP_yOQ)Aov~?O6WX)SeRiFBIe(?{ zEiJfr6nT4qg*`!5JRwaw-ExzW^W5()`|0Sop3{)^M{nYoBze#;)43UJsW|S-UY3^+ zpYis4{KleNdm{b5M-y@?xm_SgYIEmsk-rdr?yPQCo4<609GZ6S z$b}iw_u=UJje}J0I>-cZLD4S}g;rQKyBBsJ70z5n6X+}ZSCm3adgXf$sn)ZWwzZKZ zPU^CIw70&lhg~E7T!$x1LE@DP)}4Y_SsAZRP`Q&iZE!(Eks+3hW{Q)2Jme_-K)>eY{#gW^meI^>6CR8c!Z_tol)5%xp1M+$c z-WJoL%LJQ4iDH`REN0D^8JwC#J$-*+e|eC6q51s&-9$$7V+0=GlGr@cYQVxz+==Pm z-)jDja~Uu)wUPU-!kOX(clpc5EePZb!na~K_4wLW>M|agbww~IXS38GRq6^YXYtFC z^Iw?BHoWKf9iimqA%I0^Rn3)@o%|jIo6S9c>H zWs=cP?n-oPO_#QiQN62U$kl6mySgxlmRc#1o3r1v+`e+YfHf~}Ft-VN{|=0Zmt7PA zXAk4CJ(Hn`W9apbdY_FxFr3!OHBn#Zz9S)dMNpP>8g+&nEZ$nr3IECHNYL}XXGTNj z3pd4ex5Hl_DyY>!0V8o(5$~E>;#xTcyWr#{Y`)~x8Cel6hCaG6ltcvdLLaCkC7Lwu2iE5<_3QYfYCriOuqZFGaK8#*O(zkbphO9=fIG;q*(M-UA{f@?kwYJ{SqM*>42Byv# zTIA3H-yU{%!oU7PcC-^1`@>spD>fzd{h{L4GwI(`Auu>2Ag9}1$#r(oPj}Ng?k7WC z*uH}wA-1r|+tvO??fC{Vmx*?>2>Q1BEiED5<{tQs4^9e*oM)*bD7#$qW=0SlneN0x zJYLg6JfPlO>4uIKKm45a2hNu%gE_6Hyfwk7r~@iYL<<}A7oEq;U_60)9rBP)nkA2t zRZApiW1sChU0eG+fZ@*jzNx9mX-mDsMS;g=Us9hjoL`E=gpF#258CQ)Qv<1n=ZA&E zmlw0?pecj}npFaQ1!HvB+rUmg@Hd#ogE1bpd!a;!# zeJv)Vp;)781yLd-Tp3k27qw#h*HbZW2tFY|aSJ907%i^H^Ot#%Nlvo+yJc908Goyv zpe%sQfVYK8$fESW?)~R?Lfb1pi|XNN0IE}RKSj%e+5FpoQi}JS_w5y@_U9gEE^#gH zLl=iBCwU}Anrq=4F6p1Q_K0o|Yy7rtjh}Dm!U|RLl@OGx9uL^7talAZbhEIFiKG#g z=UUJ$ZFM+od=NXDz+sX1{HIbUUc9Ysgfa&Wwq*oz z8E&@%GlQgL-2&ah$Bs|)cPJJ%$cjAu%daFrVrOm%^RvEcNUyNB_oV}E8BUG$i3$D5 ztkY3>c9*WuVX(yR;om8@B^h^oaZ&i&T*60l)K8DKf~5pD+8xz#x2^lsnwrsf#zNx3 zDx!Z73g1YPVsX@){e4w23Z*~a%+*}EMfd#2Xfq3^q`h=9!0jaOe@XVHk@NZCqYD?s zzewF@WLmqnIL=71+FQV5iZw?H(1mtGfc|ILWH1E~6I1c;%`PFm6Kqu8#R^}y6N87I z{v;n4(wqBJqcyD&HfkiaxzLqI;qPIRRrO9E9F@OJHq?~^^5uPyp_PDHu&WU#rlLxF zOrlJs{z@3BwhxqcyYCp0+qB1s-0JSG2hrPAzLAsmp46AKh2kOoy=>ylVCE92L28__ z+xq?Yh=*lfx%CeBXaWuyQax7)M)DWbLP{xCP0LE84YitFQBfKALSh;sj@geksTe&w z9zKdKcLD748uhz=`k%(!e4|@i`4UxG?F2zXujuAtNsM&UwEv$O^KEI)Bna(o^e&*yCFm7MJ$-1zm@m<}4)#*AxC~Pr+SZGl)Z{*V06NMM zQw*4%^I_b#MSK=E7HOBRQ2qTsL41AP?K^i!CrsgYZM=R3vnj==L_n&cYWwey!)GE_ zc9g3>zk`PpTZg*G-(TEixkreM^Y_H!WGOJfX0LRcML!U9O-|C(Uri3Qn*EqM+s=O4 zTy>m6Cc4d-*Y$H6vXQ&I)?K~fdv2VY(<8BPvP6LMGwYvm?tc;*ND4N{Q(#~aF{rpq zTe37J=r2vm@RE~r&g(?kMtzZPW3yMb!hrV2qe4fVTw6+v7hFHyQh$<1zHIBID$3pp zh#KI2`^bSM1H168Bq5#HeEssc!G7RMQ{BOZM{E;E&`)6=o(sFx{YjVk0gMRr79NiI z8Qo;gml_j?e@228oG#5Iy zfm0yx8ijkD5qlXT`ugchKhXMUDBK_50V^7nj@qb%TM5~h5-D^-gt1hEdug>Kr8>zr zDAE)>a`>c?S_s4dyreG#?dHW(cu$sBCmxrqt}|ZY?H*;>%D0`e4)~rat+d!S1_Q~* zU-$J@ymp_5`-76~=}Ctmb$W3?Lx4<5tPuPX$2{CVZG^j{;41QO~fwf8A_*@&|h3eWsp#gN1~}g`==Uy_sOV! zf81npJAmv|?niak>eokQmbJbyHn6iUMw^6eKUyf=ajK7@=VeUP$Uo!#fppe{OIc}} zUK|^J1Zl9iM0J3)LJsQp_rJEJ)j!Iwmc8@|9wb)CcLtGG;36)k+{|IyVRcn1wl6&K z@bN+HC%Uqd$gui4!|9hmd($u5=lD1~J_UNHec>7XEBH>_PlM*d*(vK}yV3YWL{ghn zK5BpnLk|@_xqEfsy}__@``|@mK)rkn{V(cEShHqzWu-2q{$lfxhB$4QqZgcOA->G@ zoV7kirt$EZx+uLqjt;9@kCP?f#C~J_$_1pHL4IF9uIaL6tC!iAH$Ez88Gj;_#|@h8 z3%OKE1TUl3y8c~jS18>Gv(MPO%2-sBzCsP3tCL29kJ zAd(d^e!P9R>Vq0gCa}2Q;REY_m#G7!VCxs|9)CaI0UrxEoS*!GbbdE&+;H`Bzs{+` zh&Oo|3VS@4+&I1J7o|@vs%SuhBH%9c>J_8!||^&ep$}GZ^iR7InLWzk>Kl(Js&K z993+NSK2zVPPaL&K*myTUkuEnJ=Y!j8 z%nH(YBM(Ac3Yg`#Q638}SP1mS*HniUlMGPDC&(~6@W8S~ zF<~N{Oxfw?JeOq_2DKTzpt?)l@%CYfae9h(N?vf6k)_0rWJ0T!wG54F>^)_wE}_TJ z;qo}ODX{)gqjH$S8pVOG*Nv8HPoAXP%_4l0^f5xeg94WfH3AJzoT~mhK=J2i7b%RS*6&aGoGEw*q_=-lZL2WR zD7`)M2^=329G58a>pxlDTi64N_Qfh%b)m25E3e z68Z>2+3=hZ7dIs%H{t=oz4_c7l85%jmYIYS1-PN7Kua<)*AUatAa>w>D3>9R^Gu|v zmIZ>qr{m6FG(jQ9h=xAI)cK{6+VO`ledZs}2pO(@jn9C5|4-XAe0-4aym#H_1W(0d zExFU+WId2xrzQogI}xBNH4$q@Sxr$fOeaqs~(my2( z^&khz6hY;Cw`Xb_Bd1IEH+B;pEkHiD_Cxm*4C|?$66#}=pWCL`+^}Z=20E$R4dTgUL{~H|Vjt;mVtj5XqKna#^q3NpGsx)SO|)uvw3TQbdx*5-D7su{U{16f~EKHz#)@O4d}D zH4O#jtUSwjF66Vmv(}JiBc~-*qwf2Ru_+!)j~jV2Z?=6>>ak$`TR7yXHH+io zWt%5d4c`p=SS!I2H))6*wP$$i}EH8I0A z`Wy=~`N9e4BiwQ1XyJp_>N?=y|03fM@i*egk=cZ%uAps4UZpOF4uFVG!|LlA*lWGU z1uqYN!N#O%4O!N%U);h4_W5O{p= zmA#RRX6|Ls#q-e8XN5(4-iG5aeyy($G-nSR=1BO#_1m=-3ilsWCV%U*V>3+kV)^by zqbAtW{7XRkZ=B2wSPStaMUyC^nFx^`7WWeAb=y#jru)j4^QQj+fc9@5 z`towvIQFB%g4vb~ZLWm$K}^3Exih+C%XJ51YNd?bzVnG#T)w-frI0RVebtX)?fhO= z`DWu)k0r^avIC~Yqm->!Hh<@nFs72nrXeb@WhHh1gV&#Turx1e&D+ z(f3or`i@%iA-2`VGap$6s(Uf-Si}+(WmRYJ%!D#2%aVrGajBS=ZB1IFb;UIu)hGl4 znEaJ0p^UP#DfXs)%}pU5Bov^6>?4~$6C;QQyuk{e9Q`bmffDJ87HV-Ug9>Nr|5!~X zYH~r+J_bU&F|ONQga@7voo#FThG#PQwZ|@ZOn2)%84y|7mgg7t zMU5Kh@7}Vm(P8}al;iWXArB_cd+_q2w|>U1dX!v?!~LU;n6q1>XYTv}{RCANd3kvY z=pD?h0!Mi@i#AAI0{AFv`EeezT8&tf)Sz2l;J9kGzCb8fr4#HV_Ivl99(x0n zW%T~R1@uZnN|wmzah=`j2asotk}v8ptwo1}er7*AI+Fg4Ujg`3TG}29{+nLIQ%r9S zhwNWKGW#MkQwJ3GXr`sBx4Lpz%~uu{7SgKlE=v@drqk!`vHh&yH`4WbkTcfUnjFZ= z2YC4gmHcVAnIF#)$22;q&wz>}XQ}fuU-z$lKe5^)nzIQ1T#6iOZe13d{y1mOR310gDjYTXP!8JWDFB#)|U!ibrn>DZi8~CNpVD3&hcOM)EL3 z;LsGr3FWk7a51L9Yz;B{ny4}M>o-0JrV#z1>oAokjF~p--0n$&P1AB>l50CYXdYnk zbOyZk566>=+re8D%JYf1ZpAwp*bd((7Le5F;+MUBskv2EJzplF#9+M7%4mO>K4zrw&aMMxkpvR6ZAS}}ghk-qDG3_r^+WtV$Y(|S7hmcZ#O zUcxVI(mc1O#y@GRKf-Jy=tAu;)6*??v_SQ1;D%coR)Z*MXAG@6&mTT-qvW&pKv~U~ z{mRAnV4_3Z8s7j66J~f{H<%^4R_x!LZPouR!)crX1ptYOn>@ZnjVr#%>6|MuJ6F<| z2a5xfc~tNH_e!NB#EphH0V`%@A98s)?e62C_fxc^T%zNNfn2Ivf1>uLlF$9VNUON2 zDzCOSocQsC>=^`sQ~G+8N5?=jSUqaYT6&8#OgHq6QkPq=&Ro#67GB~*S4LK=&Qs&l z&GDnI6&YoKtoB2=sNsUmmd4@TOl?t!J7t!&L!m``W1@f1%ag`d5Rdfxyl0Ob%)N{= zu|!BKEjMEIZB)}wEHd)b$dBD=Q7n?Ss1{G`UoJS|M{O7ZvuTiVW7f5cTW0)7dcB4( zWphBUAB#ANH8=EG&$cDzn4JX{&YJw1@i*13aZnafAsgp^fk2kTb#DDHf%&H-eB5jYueYS%}BtSU3-)>hDdRbfsJb|=%PU$#b* z-8UmvHaQIqFrnA4YC*|HeX?FqpP?e*Dl3=?!8L&cZin;61tvBx*!hBoh87rzoR*GH z!^D(VS{gSux8*QCe`+FA_^{;pKoTJ?;F-yIAtEwtCVOg<76JE?r=2N2%K2k>?vD`v z5Sl!)(-E_Tg(!K$qr8)?yg`jz)>wz(UZrJ7CJJqafZ3GtcEV7KnFWFjyPIG(O(V+~ zdf1PfZ4ZRuU5bPiWYYqgZE}Pl)_s`T{lKY**H~v#eOFjER6|?&ftxehl8cuxwYS5? zd4_Hsj-?*7F5N>;m{Lr5+uRxTvg`QKT*;6YWRI!Y>4dvj>Ju;CdZwbwv(;tek+(@~ zjq0*C*)wrzTC`qAG<`pnhU(Oja>FPnw~q!4PsCJ5iYTe342O;j%8yIkl@k-fN{6Cq zrgj-0iJP4c@tjWebV=4P$1Srh>95xg)oH^VRn$N0!^DuozeVpMVS*KJt>X;#w4#wg zunJ_RXwu(WV%w^%eTw39w^hA84GgmPSmN0h94hX_DcXkqV1!d2*+;Lt!b`^q2MtOb zb|?foLZZhd1gDn>55xz`5g>DMFfmN!HJ}1o5VVSLZH+W%7Y85oZid8%q-7Qxe5gQ{+VtVpCNM|pwF5;eW^ z^V#e5nHD(wtB;ssGiHp}n8-}*JHb{%&L$I+lC~C9RaA2J*sLvVb8~W#rQ+0E^53M7 zK3_UW(x%VY#T=ML)I{l0J@k02ux^k7goH=PUVN$cS-1fCkS`cvGJ_0nHKVq}t?7ko#9l{x&t>@-0(Qs5fB8pV(bTDK{EWsBzin z43i1lJ=)93>4=gb^59khE;u80e8^o5y&1nGc)P`oY`2aJnnWrun}}R3xHZN zL4zV$dThDH%&Mw`4aDFcT%@3LVp)xbKeZ%!Uekl$zY>(qhD_?ePyQwqZYGQF_b!cS zoo=%@k!>3Du4Ju~HE2pHf$H#us*J>>FKw6@+Grf1qau$p4&H@HB5&%A<;C>Av$(5I zy`baL4_hierZNGs*pYz2G03k}7|OGeEaB`@F{%*UApznr_dNJp!E7fs96xpWy&_0Q z2yuPxO>Xea5-!yq4VGR(h`Lg?9qq4%gvwm%ycKb8_wIX-L05>JaiT)9T(S(Z6?G0S zzM@is)SuncO{v8ma%mc`gSq?h-ta)4vxr!e`*soU)6pjuzK6(w_JTBy=qEJZ09`nU zzXloYz|MKgHE8h|I<$n0;$yPQ|LD*skhb)$i9LmFJOz4S{2@xw59R1PkNAUty9lHB zLwoI9r=p#a?hS{v^ zM?0$g@qU3*5RUXEoA_=I8@}n*8)24&Rd>nXLfiA&3H~6U8c52n!Q3kO-Y7CK_vNcR ze2F)%mt&919Z7LY*efUXp@^k152#SAM6xHaLo-XD*hqgct`A_fv_r#-_OmS!_Xn`r z4XF8)(lmE0J8!g|Mm^^$+GP!jzQ`wQDI6M<@^^$<51NT|Tr!$;#~O)puP(`Hbt;5z5p1|@HdJ@UDeLeKN$$U6_Qv;B_|W3W=KG82HsV_5LNqQ?H1WxnP@2#+GV}KxWh~DTP>; zs$i&Kn|qkvsRRz<1g{{`IY;^8V~Z_R3xDSa5Qi5Q&Ye{4=l6O|#b1jt85^Bv)cz$G zP1f^-2UVLl<04A&qdSEQ1!`#2`WxPpV2Kmx%!nH=yc4&LH!Zj)SE!MJl(v8Q;Us)^ zTrl`NUiPAx{K|i)MDWnw#!t?>KsHDVxG`uL4(D5#P zcIa37(bqy=frHF6A!)gfLn{imnSfAFKWel2=}VQ)g{3!VELu`hSE71kD00t=4=WXi zDIfDG>|FKQke`n+K)XLE9!%N;C|fQ82tn&UebJQZgM`hs8^ zRxi}GqXALdM3+tD3jg6DLO<26=o|?N8HQhx+Dl{SPvw#dNl-B^O2X`MO2SbIOY&h# zyAMs*d08ln!m&yzL-E-o>DD}w=Tv2NBn6^%$^??M{)q|dMPg;5kWfy^*$!V!t)ftnd2b_2+D&T` zoL~VF7mb%@PYhE}9D~5AFLs08@(|ZA5YsHi`fSX6OhaYqFZdD(N@yd{(_hHf_6aAJ z5MD^nGfXW(cj2IdRCmtCP|ZymA|ww@=+~oxCL%3+y~w*1`4zVd$8I*+>d6SjBBKu< z;1Llt%^7RHhDWX=HvbJ4{|lYj^y;B0;MGZS>F;+d6X&B34PQ@#;3c+E;R*?);+Ul= zRTC?X%*O3F>idWuGgbdA4!6oD= zpQ}(OB#lgVm)Ue9rD%sLrA3RRGt60+G0ei;j1)>n6#S>lsYEg1u2fohm%94QGK z1KX)(&3aW==g3_NPjFy>mHrITJ6^1>1d5=Dq)$<`Mj9jX2iLQEA z?mCx^En&f!=P;E3E#hUDv%?TuT=nYV)x@E~-MF>qE3cq2MU!d+E?ky9=W_beg8FZf z_yJk!?ji5V1<&;yuZ7$u22(oCrh1-Kc(Dyx7mDsCp#7ytq?lJHgQUzz*+qI(p&7U&-Pxe<^EYF?vw#nipIx} zqn{^h)0Q0j`Fuo@;h{B2hgsX9nDW+sH*I=P!UYe&@bGh{Nb@nT=gwIU7%&@5?v_+z zPi(2nJH@`uCHq2VM3XZ_Ok}z+AIP<1II~*Dd#`7-%WKRNL>`JJ23;F1KLs(TEu5_m zG0F=Dllrui^z`Fv|1&W-$W6?5zcGaw;@Ktiuw-m28~^v;*Rfl-x@W%YhXC%d>z%JV z0^?glk6y}}-V$|7b)i7}M1^8$1hJc52FX9sLUqI*d)o=4Xq}iBwM!#tzcC+-;Vc&$ zN*4li$C0|EQ?q_5JjBZsQnJ3yl@!D>QW}gm^fr(X5UCGY@)&~HvYJss&LLGSSZ^$I z1*v?H3nElhJyq+X!rT){C{609Hs=(>4VCI*`H=K@hiGbLlk7z`cc6HT)Z6RK$;%J~ zQw={VX~#|9I4Zr5!&px`Md}p`6m5K0u*o83c$q5KSW!o!A)!Q*yzKv*Kh}t~gRyAN z^aVV4X(v!MlA6o&6}=3Gr~pG%&@)+`b5`mG1~{69ifPS+HB%LO9kJe!*Pii_X z{-o`))cher{Qgus-57-5F`Oxb9>Y#b#PTVD$J?zUeO&q)g3KP#4W}A>4}ONUEc{MMgq1 z;4Bkp-pdu&dO}ZwC6yR)`CfV?m?8%?C7@a(7*^1U+?!*VOChBuQbgK|Yw^K|=(feaa}B^NN=Jvq5k6MUSm!L5%OgFheaLJNd|g2KX9xFjLZ7y@bU~Br=vd&heqrb! zOA=<)%o0+6cODX~PD09XJ*U{a6m;Pf{NU>NB@{n{vc?>?upQLTmoqA3kwUrhSJx%9 z=>!dM(9<7o?PzG$t`$VFDFQR{L-KwmQ-~!fZ3zzgu;!)5SzW*t95_nJ)C^Mwl4umP z)nsHaR#7KoD`WOtm|Q?LA8uRI4Ha^kh&}MjCJ3peNPdJE57AQm$%q`xSNOSWOj=2q z%E1yZ02?nhq#miqu8<=uCq5)KjQw+_kDdmyFvLh#pe3I;jMj{47{{t77Bf^CuOkSH zXH0XWA?;hac|J*bO0h0%=D8rq!(cwhT9c6BCXLpWNKaMty2f}vE@FbQ5Ga~)`EqTX z;of)MYdVXcY!|-QA}8NkEMw0$qXp*z;P7txCeB6x?Z3MoVQ1=XGPw4XK#1$0XwaZ! zS))I-TU^U)?nH0qD+T45=^%c93P&0KMKqw@MSg^BcGm)@JK=Y($bA7ba>vT92jU-L zYIDYkCFsvDKD})Hd}>Hm8T+l!HKK*A+k>L%kL1eq;15z7nwtE!ff~cGsOyegS4*Le z#E=k4?%?=~KfNDy9H*-32l}c&z0DL!W`wKMYnlT8L`;8(czgbXV{Ti*xxx0I0iVe@ z(l=s@`J$vIGs6q2Gg78Qp`4&sJrWC9bKdDM7L`e({tn;5cNxX18Lwnjnv}3pjH^qy zgd~1=CDzQ)Z`z&;D(s5pcVfp)2F77Nl^Y`%*9dz{H_}KA^5*aL5C8D^!oWj!E6w7q z&ssyvLa5&WR}hcB%0{C|+fgBdpj=a);zzsx0(#oNs9nzrgF1zY@bAmRNh$Q#Fl?g@ zj!{is9Q6e~eD9ut$`6g>Y*s#-1dqo@w>R1vs(eh zQ+j|PX9G4{VW@@uUCW2FOVD9BSkH54jG=GdoB1Ebg`C{MX2%Q(UsprR>~MVT6lh0v z7ov0#%O zr%@`{%9Bo-AKX#ORn~T%+MTl5L*G}o?Wp$5h>&58nGw=<0FZnS|y${={l{(q$$Gb8G zi&_LUot|&|g$L@cwn2C>T@Dv%n#ssHXZ72era&#n{ke2`ggEFzcpIX|(T(`$C6 zl+BFs^LrHI^xfqJc7(CAN07kY;a~0>)q9-!V$#|I+SWSH%*q`ve`T9J(td}Zs3J-g zQWEm9`rt4nLjxQArEr5H6B1OYjIISt^5aQ$ihj=Z^%b0_ zC2$wSljrwpQVmMBSf5DC*E6LM<>tUC>V33gqt=`%u7`gKg_`{;f3fo6uee#;SSTVq zv=gBlcdxnno!LlSu2O{@Dx4BK)`;2s_ha^Y18Q!*@szJlA#4gyaXG*4;CX|Uc9WK9 ze^T+9-(31kGs@d6SH}k;Zq<6uo=VN9MxYFCoSXuC)ai3!O6d)VfCmN>H4&H1vhMmO zc63ttULv6gox2PTQC|66j6a>)-S49KG4FOTzV7`aM*D*$^>@rAie{!%aI^ME0a*%x z5_uuDb^tO>b6*|)zD}iEarUaQk>lzjI|A^8#lYw_bbbjqyIe4{vuE(?#amn{k&&I!kdWpqs7A+ywXPZsc~&<` zV#&a%vEUi9@USsZl2Kh5?RxW24qU~%D9Na%Wk`m9U@y~Vr!>nK!!iLDJl~q}1INL- zk=MD3tW!#xxnYO6y}5ffy@hQtwW1i|nkzF&e{P1gDNTx`+Xw0Kwomz^$yB&X)eVcY z_Gf&Rt9y+}X?J6bWy#A9B}sJ_<;kr=X-{j<)^7$I-l2njsuxZNKeQc>`^qWCT?nr_ z;+=4KZak#n$E6K;t79HVw&2D>+h(rd^7|}UUw6!SyM(efTmJl0z*!KKkJ&qwO6z1{ zqB0V)Gh_*|hx)<#xg#fZc$B&DRCol7v_+elD+DU?lC@&=tB9y9Jfovw&B#aU_Z749 z6|7^F{ zmlP4{IX^$2oSlt76?3^dUw3Tkv1sM&8#Vq$nijmgJ;$0V|a*8=3jtey9> zc0hwcN{GC1;@J%F3VN*u<8D_O8JWTpX{+eLd>K)_9~z3H2(e-GMQj$IX)}{66-qM< zE3gw2ZY9uI5_R+x1v?nFOUe$k#wyCJ6=Gwj%YJs(kGt*B|Cv zcNHhaug#c`^xq=g!uRGz1d23~k@!ziSAOKLniqN)&xct)N5P^*&0s=DmwSCy&-qGC zUtjfhclm_VkvlhyDwyoNqbspPX~25ZQBHUD(%Tf0A@%i;FPOYGMBv5J{dI|7q>#N9=3>R|)j%L6Ekv#pAo7g$cAWj?3Ka!~r%w;mWoi}g z@WbU6jtYVXi$icyemG=Pop`@JgH-bAI(ZPJH3eIvNyiL(WG3;rGY)XkXys%aJ~~ax z(&H5wS!A@I>_vIeTTaS(4E@>HbCK-kj~rV-jei+KelM^jVX}}0EV3WoN#?|pOUt?v z!XO@nxY}V2#Nb6RY4+tv3=C(;oomJi*-DTL9lV^73-z8F@|*!xMH zl+GW2fYJUS)TN$KZIA0lE=i3q6RI9xAO#|9Jb;D9ObaWinR6IhWpfC`BP9)n7Yj%^ zXFH&CiX=|Wek+yu?4WBs_W7=NzesGvn(BU9Vzzi)u>b5LYXYi{f0L0t=Xrx9#N98O z^&Ad4)Eof#DJ>JW*y<)^WXlDlc9Xw;4L=WxXJaIe?+pQw`)^$Y&{6g70Ce>t=?Tu? z0u5{dad@@bsxjN?^5CLYWIexo0V-*qWk&>^cLKpE#9eFDxbs(3Qc6SHmw%GX0L&r{ z6n#Gcqzfp+plObfVXUW7T|KquPGkSjs2{YJNp*j9#9ysE#iXTKsw|&-`b3S}*NDK3 zQGf_Q@F&O}b5r+g!)wH@pLzKc#m&qd?1Xj%-ahpWABlx|^RsOcRimgkd=<}c=TMrR2sp9O6{omLwiPvZ?{j*o9c z06D-6+|HnT^Ds!DKO^FRo2dcB<>SfI&G^jh?BBi1dH8>W(pXX>X6EL8Q&WE}EDQsT zXa<4(>7p5IaXGz0pzbSYw<|+dyql@y%2&Vpl69fUGVl02IPnngN|>>7F+^hE8I{CQ2y?Cy zxtP@wa@g=EwHS6rC?|F&c3o0Fg(b?Ayh6|oNc(QDF(Vl!;Yhk&^=xV3zB9U-ZgrA9_XwE1^;g=kpOqw*wlrmyZua(Y>7xkm!Hz|s-3JpBb7FCJ6iZDzYSgrE zH;lLuymjL^#GW~I`GBAK_5Jd#-M4%jmj7Wt604feizgReyS}JiJ}mEaWC#G0DIhkr zy+&0^V2wU}&IBqJ05f|AWW`QibGOG^sQpu+`oVWgxHqBTa^1@aV!u0W%#@DNtt=ar z6MvqzL;_aoyx^#H9v7JL5;l+F2tw|cpXwX%Uj+0-<S}S%OMfRrDY@I{TEm_ydNxmdRkVcsG}kUfe3(>hU&6e6IaPZs!T_<1o-#>paEqX zVt}q;7?n#%!hZEpF}A}Ej8kA>v;POPENvKMEfwt1X%#eeH~!*v)DbU1>=k$HvrPgM z9OQm?cy&EZ{J2J5_4k1EO9@ZJ3cYVR!WL0q;F6z>yU!%vah~srDQ^^iP8!v&>`eVi z!GEH2B|M3M*SQ8ZosDOEa6v(+pO?4H{b$PIa_#Dj2Uz67<>c=`p|UFU-mjAlYt(ss ztE$@OP9F5XJ^@`;LF3t@6>r!g`ON3c%;#c3iuFRSS z_<_{e;cANys%fpI?B<3ktEjmoG`6=l_J5Z&4IJ88fW7zAtHoHvBe2$s67*)jD&yNPU}9|l zL`U~eF?7MGc1Q|qVwgb^v{N*`O!XY)Z)8}s$v^(#sop)#G*V%zH@$T2qhTCtZK`2v zI~O|9MkEvakOBh|LUZn+onlzSFMDvW?!45s>kQZZao#^{ zY3;hN^UU%O8s{HXYW;tJYDk|wdT!~ill^=$2C^3X$M=m6H_K>f809zZfEmTL?UIs8 z!R2{(x`8>)-Te!JT@z(bu(F0m)<%)n{-IklSf)aKXCFRF{fC~& z$KhXkB0%~Cd>G$qJ^Fo;ZJX245j8f(=zBd7{Sg95WFw8yt=hQJ>ktJhP>CqQZLpV< z`Jb*L(%b*dRrDW9gxSt#B?9M}i2DUl7AX{&_21z|7xJYuV}+d*y><#tLCQN~hE*`X zTTEFsH}cK15x@I}&Hm!IiyP^{6iFMl7DN4LqvEnRfoA|kQ5KL1?_U6JMWe$SUadke zc+t8L;C=SwL#2ts7Usnizftt-HJVL(Jh2%vq9^t9!RGn)RuiPT6R|eG^q>Lf@w4O< zXnFmA*^=QRDQPMRf6n^^ivF68S4QjDxz?`ks?|pT>sAX&je(*OROnF1tWV0FZ8xHa z4}yPpI!m_eO$+%JCOYL)$Dkn!wie{;D808Wnsd6ocv1c@OG{}r+RUL`TsVGw-?UPN zsPFs-SyWWqgle3cwr2^}g_FB`^$KiG>n8ur;iTUup5N5z!6mG_dV%t;!nV4Eya5Hr z*;^MNBqa>a)BovOR>pJyn>|n5Z9bDXzpEs~ZhD8uMmDkt1{zqa!+W&d`<(^vyhv?r z@|Lwa&Ps0E)L`%+@>em%Dsczf;@WtI7C?w*sL>?HJ>suHq=fJwAUhd%RHAc)T;dcaSMp z=#dGE`142v-$4flUs+m;gd35_NUM&T6VC-*?|fJpv;FhYQ<*@<2CKf&CjYV_a)+UL zRqXJv$blDDqopp=|0N#*7dSJB2msBwjSV6TE)pgVjzQych`15>aFSSMonKy;01jC- z#)F1)ReHgM@!&hpZYKcsOG}3VhLQ{wPQP(cz19>fGV%>i2TeitQJ70I=uqGJ+iUd> z8#_F8eVtTANO`KEWeHz+joGy|6Wr}@hBr!}No@bc1B1?#xIs<;u(tE+thB-E8Rhg6PdrG$P201-{KDbXXheo&0C0;g?;ngRT4|8b%FWdmhhUAA&} zrjY-@043nB1~lif$ZYL9^m#yFVcd zs4ahMP`=bFiu7pOe}@no!*acDU(opuOhqZnoDLVKMg500#)Br&A_>xIvoL zbo@jqIFOZ2E)D3wA&MS8aGs90;=}C}d(Z-Fl))AIsj|-8s()@Qq_9 zx29+A=uTAHUy8yFdNTJBQLEY%f+9sBi;aO24$^xqdejeD&l-pv7mQV#sZ$z7V~6*UL*Moh>$*U&wfS-@Od&0j(r6HODoZZ4h-hJdiF*&w` zZ-@oj6MG>T&9P*V!6SH{dC3I8H_t*#jH}1K;_c<7_{;T$&iuSBrkRCSB?=1h&Ccu` zvHjQe+SNZh_ED@cA4xd^QvSucsr$>h@mgwmP~dbRUCm1xx?P}LD$!|;esv@;>H_)1 z$L~ZExP}x)E)Bs{IF43het@K6x(pnBHkB{(bRv~Tx0%=P-;Q)7VZjXk>o8AykveP) zZCyJjd=Lp%w_(FYf~RC8M}2u_TwVi}v54WNrMqlf$AZgiZ30c;bC%}Fv5;Z(P$PVE)gl)IWm4Yg<+iOm1asrZ*8 zUN-PsE3sT;1eE*&-4DDIliTjo5x5|#t^=V~N{%|W^LU}=)Tmn~y>Gz`$-iF}_|6f{ zXbz8A#`{~nJ5&CP0^?zrfBysYncq7nP0~{uVT`^Xj*9*Br9?7BfT%$ENQ~uQZzZTzW{?AV z$T%GS+uDhqYfDf@57RlDQ2%c*lW2Q-=EJX3*vkz1vi zoJ1;!=P?2!`p!4as8$i~SI=G2r07emo?hetd>0N+6aMQ;hiP{~&;Rc;%@2)!eliQOvEg1{Mz)kB>oz zTqnDdPI1kL?TNhKqw;BF-UO%OnPqYsZ54y$#kwjJX_#3z=ak9ua4OAW94n{qKmLY% zZboecD{rWPme_<v)W zAIMEo2;`SR5^GI(Q6qygRYo2<#FVE&0EpDG%)^X@d%CIHdQLQj0z3iw8=h(ta;eL( z-Ew66ja~Ei0*uh_-WhsgQ*1Nyo-4FC=uzhes)9R-8OIV_Yv#1m5DN<_3ybd)jDWM? zuSi=xtKU1j?S_djKfRJSe+Vo9M$B?uOrJJgsj3;k<b{NPiPv_%4Q*0|n4X3X%E# z(a9o49o3dWjAdJqbo@S)fs<=)xoRI2Jg(MO+=lHjfS_~ybXgUxT6=Q;c5F@~BF3c~(Qj~q2tgtd*a9o1EJXLvUVj+#Su!5Xs*~2(zQr{f}Qs*7B#gCOA zH%vj?sIqDr$qf8+UD0wVa9@k&Uor*5wt!4)dB7(&0Y%xp1XVHWML z!3s`W2wGfy=gAfhpzWA5-VN~yarjK18K0T%K0m>@4L?5KcMLZOlKq$xJ z;wXIe{2>J{GSnP``v+?5TV9q0r}e2R^bcx&pzUEM&I1GTZh%iE%_aeO7eVJ0s^BQ_^8r~`|)L>fWZD4A;fIIqVj^ni$m)GsON_|j?prgH^a|>Ih zKR~b`I{Y)0bqd2O2@;^2giZ?5M=G+5q{vK!*q9osM_J3##_YpShZDFIJ0^Z@j#Ws` z)x9$}C@Z2mB%jN;i>fR{tur-Sm?=(DndjR@pn$mU?TclbII*Ey}0UhP|G<)qM2lsA0x8a2AFtg;e(AIz>3 zb|xHzQ@05WQUEQZHvTT*{t-r?qXV?{Ra8`vdktWZPJ|?xF+pAl2qetj>~j7hkj=;S z&drSi^n3 z1~&w72D1E3P}+S2w?$32@PW0>C!Okw-Ahd-`|YLI0m&}^D1e^ zd()>5MO(NakjRZGlNucbup_}OY`uBDuTpg4!RIViPVP)DcXG&7iKr@=mj~4!%%d}a zNEId_aXr#?tqMNVMAvW9P;qFYSL;!wfe~=_`~sx<&#MdKpxvY&p9V0}uNxMs7A2D2 z5f7$XwVp^*g~ILX~SQb=4N-6fwkhq9P6k=TaHX|_Q;ZIqmbOnF=CtkPaPwCLxV z_QgiAsW=af8xze^ln@b?hpt3^ZwIm2RhDlV<#hcV9@lTN*K4DPbk`fkpE99BM0x{U z!QwU65L7_gxjaJgwP5MNXP0+Agl`>-%FFqs4Zur`cK#0@(Dtii0x`!vLQ9dWwpb^!an=i^@RAL6!fA1 z0$Hogltm#e+GAxo<#R0gzhx<4yUhpvi_&I(S-H~}dmz(+Ofs&{(TKnPAo#VA(PY7M zPd`B@Yyq0tvMU)k35<#7I$2&od;#V=9`|2x4-dOqQ_U|yoZy#}fOp&kJ0Mi7&%6O> zDZ=t@SXkR;Uh%u&Pjv&JBsdR)&g(#24lx1B`Q_5dl#;>3RI%Ot*?bo?jLq*(!BpG) zrkq)?qem@JMIa-QQFS(h1^M^!KYDgmK5Ova4kOGe4 z^!|nw?|WnEl6@5`-VPM$QbmVDkgDYE>h0&t*UCx$`PCl!KCh^6BJvB@7yt138MDMR z;3hBikM>!LS+IZP!be})=l3%&jSI|+N4Q7sa*<7SA7KhRh;ucR zm_z#lSrqm81y*t=bANos>AjS{G>#`X_Qn6ubwGln4gnDg)R+NjX4 z6gC8tkoSEQRDR|qG5RwNoVfVy_%Zbf5tUCwo;4)zvXw#(`|s`nudN#=C7r;8`xjuf z{XM-92PW$OJwHYC7qq}WfH@1g7Lm>P-^BzgibLRz_#Xj5tiDoU3pI3DiU0qI`w$I# zsyP3pz2fsk23*tS6%}H65yp%EqJ9YE$IF+_gDfCf6O(`LE{V2&uai~SadP%c!t1nq z0=xGAe*_R#?+;Jj3af_ zB)NYJ7+tHwMUJ(8Dp}XtS?iwA?yQP^rTJbM+|2<`=Y=rsPu-HxX^3>dKKb74`7G<$ zD*;UWfbgH2lc$R=!@6|f1P4qhI~|=&wIwO2ZWa^>E{5kkQ<%Eh!y7ntl@82`m^Uo6+>CHRx#&bs=LSwb{Jvny z&HuiT2xLScMnxkobZ*ARZ0dD*KYuy|8TE<|L=NpYK92`X0m!`p-$4Qd24d)Mcvwsv zERYFS&{Fm?SlHJ>fsb}l!MT&)EF{iZ=)}?ARP1rEJc1PMR)N-{ut&0nH5ml>m=rTB?#aby0wu0}`U6@eiN6Qot|59+(sNDYx^8@~Slj4VQ&Jc# zT)y)CAylEg3M(u~>WmvOQ`&?F$sBItG}1dbu)Y}{d-Kfmv{;jSdf|DIpH#e19Yt*| z;u^?OoBa7xO3{D_RjlNzZW|Hxt|t#6aekQ zn{yq|nI(9|7xr(S7z#~X$|hP zSwLxWxksef(R|@YoNqv=1^mJ9-_$^CN?^u+)v|n=aMImvgoyadYe~wuK^r(yp<20t z!3fsj96+Z7R!|ASoOI%_A#+i4^0@#AHF<&Y`s&|Qh&V+BZLK}2i+o?yfA+{DmALuG zPkVth$FmD&P>NP$K*S$t2m(SGbXcofDFWz(<@KUHJs~0_K(w!EKXdkfjK%>fw>Z)+ zXl>ohO9l*sAT1C+xm65=<+Y(w|L*;13+LMo?u1ec<(H(YDdcBaoN?3~SZCaWF4<=b zqF=Xjb|q!RbrPePCuvA)F{1@rO~tkLFQgXG)E5#}B}94ACF=I%`$sLys>Cf+#1_a4 zi|ff8Ml&W=%LfU}^hw7OY^hFo7c5wls744)oQDKbuZ?BI9*c0yAX@yia(D#hzAn3 zwS3uM}0RBb-=VfxVsW@-1Zmk8Esi?W&f#-(_9O{oc` zsbW(-PeXhW-W)Ihmt*qpW?ZoFQMh*feyN9uXP{wo9XBn<(W;?S#5$0NP&z=rUvQY7 z?dgV|EmkN^xte002-3TGii-RqQj8SbM#c>b9~xg<@f% zGC&kD@!swJn#S0fz9*n~T3XMmPe(^La{-iZK#(w5?F@#B2RRC9^8=|{+nNSFmhAtT zJEOi7a_#7wQTQMQXdWPY1_mTk0C8n%>Sym_Q>8XQcz}qC@+ro7LuCk zUO??y06nb_`b=X8Mio^*xHtV~0^Hc%c6o|$D6(djeYs$qZGQzOAD$jXK~Bds@d)m# z)7k~_4T}Z&0Lfqnxqo!Dx#9y_5qquYHU`_JLOx+0pzC;o_nnol>DsR2% z3>L8Lx#~!;q_8oR78KNvw?i7qXkaO(rr!kfFO%Zb!CY3Y3QMVqEkIU1x(RtO7Z+odk)Y49>5AhB<_g`5a&`O`)%tJ2F zad=Zw<8aB?48#=t)<3DGtvT7;1?hh0h-z(@QhfslOTkO7CwxR!GAwt>l~sC{rA?eJ zyNAq1SCff2JoyG}xpHN^QLL=_cs;$oBo@1SELJv}FX`7`Z(7=I(J< zWm+V;{#54@a##k3F+go8#f_x|Y3;%DZ4tcPrsjtso_7N=XtijHk z02!nk)t^_lOJcdmZ^tg`@M8NRcA$pNuc3mHetNsnS!u|eK27=VKVUIu4-U{U*WlbS zkLB)7p=A+2zqf#HbN@S@C?7y=L=#{^Q~|SVJ_9&{^>yT(?Zp0 ztZDBUh46l~I03?i7yC+FBHUrGYx7EHo_(%2y2D2*0?9+ncnF6k) zn}wcnvtl!3(b5R)#D)=av8_!{csXs%3DYlv1Qmi?Q~5qa+R zWjW%U(;Z&6RvGO%hkcTbsiO6i1(7qe0r|G84dq>erBMcktch9A55&ZQl^-jHr(+R>3auWG^=09kv>ewVd z5E<>O`rKk%kGekGHkG@p*hqiVQ;Him{AS4@QOaf9h?PH`#jFz@A#s5_`aA^o1t|&M zs#Z+U)IK+Upy4epV#S20VAg0Dvzx3NQsFx4l8@qMWXVHt6E+{02Ir@`3YPyCnR1Ct zq#|elT8VwOoDHB80@^5oU3s911Jdlkweh`McW?$1$}mtMi$ozyPk_3*`cTxiEGSs_ z-2xtU;Jo*^{lq_>_i!Dr`e1(dgZOB*&EkCi$N9oD5J-Ks;(}urjkD9(>OJcW&4-wQ2O;~-+b?GUAD_cAT<=E<`1;E%eSSsMQW(Y|i)hiF_kHhW@E0NS14YU6 z^kG_R{Wf$}AqFmtb?VrzuKWtF>hV3qx#UN9p3>qJSax_e+a600nx68-@)u|uO;(G**|Pc z6Sx$c`*5npZK371{TLNzTNV+j3ugUT4O_0o{30WvN2SkeO?Bcvqyzxx*RrEC4qoRAdxw#d&& zB>jS4R_n_?^?$iVb{FW;2|O_WJvrr>st`&yeZKR1O4pB-DOrdZW$vm|x+U_@viTmy znz*7%wv+i(^PUhEb5b1Mo-R|SQ_wdpc1aMr#zp$*Gw-G&p{b_qWCXM-5T{Ec@4ynw zMl%u$$T-?wm)+&hz!m>`DEd)2z5l~?*KYHYZ=v1xnN@o|SZ4WV z`6g$aHzMgO!m0TM3U{qC3PgCoXctHv4jykQ*kf_bZi4A!lwepIZQ94F%o zFd^K!d8x~Ivx%t(GfhLO7lbk;dlCVfA+Clt)bopQ|JJcsBZgQX{Oz7Pn-ArGyjoPm zBSy{Us+W_V#}82{8remLOg6Oi88u;m0r0UD)dmv?_O}47f#%=pp2|FoZA=)e^KxdMzgx{{2iG z&8CxjfadQ|nXO^@q@eNebWMkg1Q_s$6vsok!$q(;9Iau-DG4(Gom7pO%NK3&i#+q| z6l-y)(Q#l1q}=E-XyxVOB=gET>T&n?m>+8gnBO3V$EcCwxQINbl1*JqBcsM;THSqp zKd+9hKah{bMwCl&OFU`6X0QXGU{X|=?+b6fFNSEp=~w(KW(Ter_wvGrl)rmoo>YSC zkiKuFNq>|5=MToTC+bgH*~F3uBsiQHa**cmkmtcVb4axnZEYOpz#g-N)vIidE&B2$ zyCl{A-kGbV-3#~NU=cv_2cTP3k@k|@@Fc{M>~xERU#Be4b`{L`ee&@?xdvqqt}1%e ze{)p8LInAyS2lY1OZtKS#rW9cJ&;8Zy`={x>jZ(%Xqa>-4PEaZcg&lgjARVR2D^*1 zyLmuueiJ;-Oci!o`AH4x)?_wo)YRW$#%fxWl+O{!e}Joo6$b1;XtoVhjr+`^HI_cy zcq*Z$I+!GKC*LYf8@94~Oj4ve4MzkecKDLcy+>a;5IL}eTq;1-#2JV^AOd~c zB{9Gpn(rSdYJ;)IO99^YWv?;ox>QUc9zK~jtr`UJ?`R8DFXpFD0ZWXEQ_}0p8^rUD z9DBQHH+#RP*?(T9(@&qRg(lv8=aB$g z{PHR#?#<_!&Yo40pvBL&P>$*X3}I+d6&6np&cV`>(m5$fymV$48c`gdfMG;}YM-0= zx*Rz7zw3Q^2Tcy30a$*gGW$9GbXe|YkBEc*R-@>(=twY;V|Qh3_hP#bB=J5}UF;Gd z*B@fw2>9)D(d%aY((@DN35|;k$3zYlNtY|hU}p*bcih9gzd!%KmS)k&VNTE(aiixZ z#h^hB1e6#U{z-~ce6iHT8SM33eUF00Fm`R~qjzda2X%QYl5+8d25qJ-H|;3+_k#`@ zjzM3+XJX3OAsb5<4wmCjQebco2)X&^OSf>H*JW7r1ze76i#yAKV%N2@xkGW&y)}LR zegHxb7(nFAV#X~o=-=aBmbQ_dZv2b{@O1s_)Tm6Bv461`(n=a;eU?*bbDr1r4}j_4 zV}AMx%Tkn{l5Ho}xtZx>6Ak;Ujzu-ou3C`q0xFQ;B4Z#q z!@u?$-=EI;*>Pi|$~zY?xH1Ny!wThbe{ZLtR@v@$YY@a$r=+FImwn==(ANZ=a`@dx zK{@cUpOgR>d~awPd90x~ZaOC--6$p`>vv0u2g*T^Ge&Wf2JJ4El8Q|+Gl>|_aO_|o z$@p#CjpY_G*|_pgqt_BSiCud4rPJ2I@0hiX>!{IqzLnRJ>12t7nq87^3xJIKY_H4) z(J!a8Va)W6GpuWZ-6;&Kx&K8Yf67wXw-^ckzlr2z>?w~;|C?Wx3jYx#!@dc)?IDtD ztCf9rIy}y;W&6Tf*L+t#;gs9OHUv!*Mtg1%y&DG|Vf@eSZvVZC`i}OY&C;8W_8WzO zFzV;umxv4pvi#cH8Z?`7SBcgl^8`hyaSQT0QNVORhL9hA>Gbn=AOsT_61{!yRKVlm z6x-q9Q2@}hfu-o?f$u~aWD)|&3CiRG0k;wJhh~nJ5o|dYs&+tanp$znG-S3f6s}bi zw;ZaMGcXW(`_=*o-*}ff)+Yct$?nhppJ@~3w+jCX=YW-G!Ct7F8DGh2xWQdJxenHM-2eWmaW4p9^SCBk3L;WItGV=C>D)|_owppX zW7o9T=8Ai8CuqJpm0tgH@B0Ubf37Z+!6J84^L>|@&4l|3zGvE1Hqizm3OdF(Yv7CC zg#Al5R&2uAMa%;`HjLB4{@sox?v*EVuu{y}d)rd0C@5E*6*?2ZyUWflr>IEu{=Go2 zu@jLAm=^%q7Qj@17Av7D*bo@9iuBc#J%4_HBBn^u#?zBLCGSr_&OW~^Ir`XX!!sbT zDdZe{-8?NicniW5fK`TgUK9QkG~pp2>)#0vo$O7V;CgG(hb@?jl*V_N3bL{emtUgX zKi+pm2V87u{IvHd(BtKPH^vzO+A9j#q^REo6V`m8Q1MTWZU{L8O%F*3*98Q(gMG7~ zXKk#*LFrLQ;`aQ>=G3kIvDp8Tw8Z_sCf-r(0p6aQ^!)6w!*}!eXE-=5SnTa__XJ$` zoG7WQ2Le0u?u1~x5Gp9i_5W8dW&i3UH64Q)$d<*36ypX>Q{d7QshvMRXr2e%f%S^Y zIbeY5SvvVuP*#RoJ1`Rb`lqB^DgrrSrmn#XIBD|)<)ey+hVuVe0}bky>zjrNRV}T- zAA7i2oXZLp7C7N3e&bYm$Hh%eUj5^x|N1^J6kA%6b+YZUH<9oknEi32GCRci*T+PO ze62^-$oUTlb9$cgm%~lhWQP*hd6?bu5w^1Dol|wn6fa%M`7cZj9cp^6%`#>q>ge^T z7VaIM(a1^nc2PmSZsBpy307Qu6}t(Xi#msE;y0Bwd0}L?PYqYA>vq{zxs1Lz&csrv zRjQpjD-*xyI6=*r1qYhY{ead&s0(6_K?UYfT1+^{^( zL$#pMSVd5kP0jL83^DpMHNSulFo{yi=rjpaJ_f1E7bV_G&kK|$PW*B;iMhGdlA@NE zb=mA*z_{_?F!4UTyOSK0xsCAEMyRhndXKHapRVGuwdVxnP}TZTb5~vl;NZIp@Z_4{ zzeCrsK>>3tQ&XhCb&18U!$4S@rv1uIuj>{cR`i*vc1dAjbee(JKeF!F3Km=*wH-N& znRxBz$Kjx(iC#Df=!I*kS@Y!A3#QuZ3%mN?jt5JZW_!T312Zteu~}Va+fl_D0r7HmEF z3H>jp!|Sx_RVMQ2&u6BY3|X_BzQB9^NrVS}T`N1EtB!bX_j@>Pb2czOVeq(bQl>V| z^k{jj?Te<2S!Uh-Tbmf8`;v(dm4@ay&Kqrwmtm$TdBgX&Dmt-Zbq^cja;@I|3bF|V z(pcMT`D9>UtDz`EBv_1$3 zy^aXMI9Uq#AfMG$TwDzu`Dts*21(g@+6@OZ^p3y(xCDG`Df^%ud%^vlvGdWK?EQNM zl()PhAYI#`moIk?neV?1_4kz-9S~@bita@>FX4{gz3=+HxRLaY0agfaZ zW>q;3eWcdfRkr}hHScCKeOy#M|G}uBDr!|@zjD})P`w;HgwuCSEn-R^T?x=sC8EO$ zc##@v+&-Np%GBHy;^{q1(`ww8fyt*cW~Ni8GDrA;-<^XPV-vsck|)lM&u!Xg0U*-d zcPMUUxiCsanX|1E>+thSM&5eT!X!0Y54+Ju8ko`HoPf!=Z9M1L_e4@mS{`mZH|7tN z`1sbqUa(mhFEp_4T4!~x0df*tGR^B8o}P6IIYxxt>X@r(0;_f{+DkZY*S(iu6$J11 zRA2nGryU*!ThsQ3ad_Z>KO3%e0O{@{RsG&Tc$&24K=5zgnJ(4tGD0e*=)=V1R(dVT zVz<;84HT8qi&=59HW)Q)4)80mQgt?0`e3{v!F|;8DU)22>k)*W%dBkY&MT+wf&tW!C#IR|Oj7`@fvgf8SZ1?2%)lY@XkJ-*1G@%nS{K8uy`wkt#Si_}5}n zcz!-{G|u~O;1yZu^uuARsBGCeNC83;04Gm8-Jd)~bbkct?`QiKhb_m8gE4W_7CM$T z4yCn1=towZS&nUbwm(`z2mDW|Wz*=5kFyu9eF2}8&$=n|=6uKWS2hBp8-&GUV8Q18 z?Eu?GnP{w=ni<633NdBInPO~i;WlPmO+nL{L`bEG#Uq(crLtK0wulBo`Xn0=!LlNX zKQO=(&q5dyEYAGQlnY|E2nW;lnb5pn>1B!nzc(TyVLhqK@Mgi-YMPa5Sp#N%QpuxB z%sWR$?ut=MS6UG#nkNoktX2vMXW5vo6#OANHlw=3q2@!DEm`EUJ8l-w^!U50O`)Sw zi?TGf6%8HV{pqdvaDj(Ar|=hbmMVp>;ev*?uD_Cudn%YOBHOn4{tDZ#i!+jzX5p&Q ze)aW@L+3#G4jatRMsp4dioW~fNQ-nf3t%>4A_21+pk!JSM z(blGyEjS${L*aBdW&;C^p998qpn!qL%Q=`*05>hNw}5pMKDdUC)G<9qyE#{aGN-ez zUd763T;2J)y73@{egiSDi%WcEHTs#X=3}FHG>=V6)V<@Na_t7(`iz>hv011YG2{Mt zdJv8yiud&g5jcSVOpW-{ZMXV|ZEFiWy!O)=)I)y@IDE zlozr*?giB*NP3%StCY!;A^GcVEVojHO|qz#8*t@Y&NR~IQM0nrN5w6SDk4vbr^PKL zktQWF#^^FZL#Lc2UP3evn;x6vBE!4h>`r#Y0x>qF0~^ZTMVnRtSlI&Vx{IG9G9XJb77RD}`U`pI#Px*7E32ucuUV*;lc(ynMu4gZ z+~~bAc6DYpm z)MjNbC~9TJqMm~F!&U?4*X8|>I=vcu+h#rRKlG0*VLsOnIDbocy}rD)C03wmrft62 z@34P#2-L^ptLmPY!ekpb?S4eQw3=&57S{ zgz9R$#wIt%Lk2DwB@jd4K=>pOa7)$I^0k4oQZwmLTmCNF@GvrBa&li*VYvTEW=bGxlP9&X}xifQ}%6T zZD)#A$@}4s8Ax42ukVWAp@+w)8D;}Xbe4|dizMri7`InzS9vF0&o`$|da4)yCs74I zJ|>R5xK(6W>Td688ad~OKKDB&4>g@v+HBGLL!X$Re}7!(1f5Gp{CZN11X15vH|FUQ z7&OqCX~ERKaohqhpLvtZfNpU}+kvA*bN&wM!f!pRj=ek!H1?g0>X`2b;z3tbx2sOhFmV7TgK6Hc2i&4~g2zdXoo!`yl*wpdoOB>QuXi(c?;p_Q zFq6YQtrfV8CIVzW{MgJdCv7>a0yoIOUCz#xx1JVohAS@q98@pzT%o3@Gy}inAXs>K z6oMVe*URAyTwHyeISSDdh52BE8;4>+e`MGx@VbzOwY;mwp3=JmMOI@DqOS-D))u0H z!(jxR{@*jLWV!uJKg?m+M^)03_Cy<=C9ZvSnt(`cmd;A4rDZZ6usF2UBs>NZ6Zuc} zf3(;lz{J6CaSsiitwfxUz)s=p>%&!1jIM#^n=FK9j;kFWbw-I@>p;=x=_ zx}1dn*qBn*IgXJ zdT_kwtXgk~$&^qO{ivLzTihs%7Ku(8lLSXf@!l(QujHBq(+u)>N~-3&I^!=hj2k(i z$YwBTWCuPjM7q&*9&nrQr}WSQs)$YIV(}V9l;-y``$BOQYbK zByoTdhh;}5?KF@YCK<=4aLpljXfl~$I z8(LH}=Bnw~uB@{mxvxfPp}`}tN;uqz=jy;C_Lbv<;6#vT0-Bs4I-gIL)#-)#B5FOm zcSXZ5K&Nz+W;Ky!3|}6&uJWMrtBF9J-9Om~*~MJ>bW*TT*WmHGy3;)>HgrFr>m?k< zX#S(0>uqV+YqJ`=Q*i-((RKOjpa%lWyM%Y1rlda2`RO_XO*2?kgiQ{>!bPe^8>wEI znwVm?Q8#*ARg)h+xQEI(kpK$rj47c9S;rsk`= zE<)qg&XZ?ajgEpk)tucE8cJ)13e)r=`KUrISByLCV;crf6DQZvLQly*oThIM3YwRF zuHM?Nw!(uWk>AydxTv4qaQgW!$1}1=4r!IX+o#{1O}-8O81?i(-j;a$eS0=^e^dL2 zn>;zV_A&g;yxu^2YlCtn2Mu&r`?zc(l;70!7Py)79#1ERCMHaFMh~fxMZ0>(Z2$^95Yp`aZcd3E!EQSZ?;9ZaUNRy9z<?q3>QL8nwz%=+5*_0Z4E{Q_yYKdU$>k)R7E8L{UbR=OJPaaLWDSHX`WF(coILv3{ zl#k?*Vv}|h+U!w?+)i#oc9M2n?paz(t`8D#m~;elId=_ZeY0j*ZwQV^6=r1Yxt#T< zk*p%;X|}E7uh=p^3dAzTkRu8xcatfl;=pf0&9%)G6VO9vj-FZhb3ltn1CfSWS%mMXdar2JfkiOu1rJhhB#D74Fp}r~CcJ zlirL;T>q$0N9@#>RM0eM-XDzm7O;55tLsC_C1b)*Ka|xi#Ic-Z#Rix5QuT-sL&Nm( zFz_ku#Jkx*jfD1Xyt>e^-?j%}v^pwZUj#l4m((zUqyO`M^vA0dCjCE~w_&&33mqBx zzop#k=yP(=5A|YrZ59Rd0!}$V4CI>7{cJ6ancR~qHKs_l2B@82c6AN<^af0P0~HwSDd780Ou`Rt6kew+W4_+ z45xX$UEo(#ooe%MsoPSW1HFnBlh$gc15t))6OwUjcNL)FnbSFzOaZymAIqkIe3fGZ)L`&T8vl zCM9@$>#Hr<7efzIGjvuJD#MUJcGDMFayFwWD5L73o(k@!i%Ykzr}Hw4bsRfDx?hq4Ha+A~Rr9)mef%7|-~H5d1veC?oG8wolg-$3`b>tL$ORN&#_tn{lE8co2 z`%$P;uH~~^Z9?eL?luHFrDZojCX+LgzP~8X)vMago$+~!g(9SUE;%@x|A(Y{FvoPs zOTe6y-uUA8Pe`fMJ2TOXzV`;!yh%BB>vLK2ri;kkjT8zOku;Q(?`bG?dhvTJ1;jM& zm6NcDi_nBAdG+gmU{prM6^i+8%dq2Mfs&^^Aycn35I85A1n41fyY>`hUPdpl%Lgn3Qfl=x8dY%lU zf~zzca%{>ili!#1&3N7yg^0q12oe_Z%W14}+5WcT!omtPvOIHT1?rhD>BJi16YtOZ zRHy7=EwBnCLiz@uQi>psr<00_mUS&JsVPX=WRk>+oQr(Pf6=$S)x^d!f?V?^U1Ate zNQ)>-^pa4}u84i6P#19|oLnz>Ubjh^(_AKj$w!1i;+?2P$V6L=QHWc|z(Oh?)xcD@ z9D<-yND2}YBJ7;rTIi4Y>Nr#2mOS*>frJ)0usPjCcy+2i-z}E~`!2Q^CR|V#=#7k4 z8e2^3t8qeplkvL7^abN8BSAk~)iOuQ<}}s>r{aq_cMFzCTlf>O@Eitv!r~@a!8d_7 zCGIx6HG@->xP=%TH56nj7_`nW{AXaQJWwoq@%F*FG zfolcmZi9KEeqt~Y=R2==>!Zb0N&2E9-O|De^N2aDX$w$#Niz&v?6rIoAx5W$+{0Ea zzG7xln9jyg>8z~%gLGDlaqTizy?Kewp^0TxEoUr?F=E!Qy1GnHZS@jW%k3oL%CBz| z8*Xg|2W7+<_;ttrT63b zA=Po=Jov=sUbVcKoRCW*gc z*}A^XCrh}Q;Qe}bpD71ys&ceRe<~2u&UvE>+oT5xX|IxvR zYs@DOeebvOjU~gvMJrApcK3E@Nbl$I+WkMD%|L{B1%sQ`MYCKM3923{AY4;<7lxG- zyK}a$CRwTe_UR$DmSLtDtPc_*Zt(YUD3On3u?dsfq(YSw9LD`Jq~JwSou?m(ArOWX zcC|s~1_3PS7N?EglpoytVi|i{`(l}ODtk_ImnLs_eHSSrBsc3_V%+QOB@Y0ow7qZa5peYX}gH>^*5=5t>;CQcMswCGQg%LAODn{c(s!AVZGs+$i zBio4Y@Wm;u6m715n(I9u#iQPbns?F{cYRn5^}Tg7{NNJt^WS z((x@vz0Xo-rXRaKz_J>4g*Yi%)enOe!6RqDi`v4k zmDpvf5?XHA*6GC~Kci)?l&l`RQl9VQheH)dXu9Sow4!Pc!>+A^|D*v%Z6d{$P5DV) z=QXxxSg9J*j~k>|0j(Gb$l|+Se`3YakjMo_WTMNVB*A?_Y2E(?_Qo_YTc%djbgZB* z2dx7XdqPEi(jWV>fKl>Gkk(In1g)bge* z2%8*9i){Xb*gCC|(7q_MbE0JP=JOJ`jp2>H#PtWuEKgw?Z8d4EBJ_Dv{H|-4K)Zgq zu~HdTY@smPCVI{|S~EH6Bqd;6*odp{y~1NKBZ+)6M$?*n$yl(DnX*n@!(C15-MYz` zQy>=F(h?~6615y0P4n!nrI@{SsDi@!-yZx&);J%w@Zo1BT!-@MAm*maq|7d z1`e=F_QQpvrWjWDaB0t@?KFRjoL6Fi6i>!@p1FlOS3fpn_3L=AeI1W5lG41#6Cb<- zg;DF72Rocjjn`qM7)dhs4+xZqkvU*bb)k?8jZuZK9vV?cfzEzNbo;wSi76~vO zQw~8DW}mW{Y05OdJ3W%gGXKX7E97VBo>8!R`1vhU3St} zrs7D)dpRrePwbHVI$VTSzl`Rv4=(TiF0ghY-pgCh2D7EItD5Ms6tCH`UXQ{x*8D|1 z>BzbW4THOo7)^`ve3CDz+6xz>qZK9GTJN56^)o#PyFL0vPf+H|{CZYUkBD+g4lFJ( zjHBNXL%RlpX?7@5dpT_Z14xl-VBy`SRvUIW~l;t98U4nJcTzzWmz_Ie^mEqNqTQor_AMiH(O<+9LC#JevtpyLCmAFdSRo*3Ng&PMFSRKY+3Zqplx(L5nk+d`_n}&YlKq`r0rYI z6l!JTQ8ROmKv1k(s#@miqCV>g8A=I$j;xt<^>cB?FRxQmtzjbb^^K@;tLB!Jp7-E{ zRS;ru$TQs`n&2(G3IjdM7pHdr1$I#hACyiUhqum`R{FNO{>vNfB@K z97b>k=W|qLPy~gO*1+adl~(5ak1znO50RjXG5Q4jFa7%Fa;O_1cJP_R7CAdRyhu{u@ zgA?54;I6ay|9juNZ)R#{Ue#2kDpGKgtiAVIy}Q5ux{$g3fK!CnHO{8y4IMqz@WzCy z+069gef`|Ds+q}9SuP``ruO^@nz7V08(w3pNw$t7+|$YVDSX*ZL{D@6bt*P@ys3cR z(4e{xY3D-$ukrVmkDBc2BJzTm$|*@zMELf#P8|_j$KS^G98Er1cWRs>6J|j|#UUmht0o`}B`E(R%I;3d(E5t-lDq%lBsPc@lNXM6J~O0M(l% zE3~+Q{bmt#K(?6zo~a;=6K8sOWBoASpW(d?(x1E4>7kpZ+o)=@<3Dul#^^$s!%MvZ z&?aU}@weIHgS*dBatZ72WF^e3s5E%;7+9jq%EMJ>5fu{$emQ&`rPf@UeRF|4cDKrC zbieRk6gy6Ihn$@r)QC>L_KGC25_`XYSSla~ zqEtQmdAmr4ygGBt^=Wd?!q!ldk|Nc6Qqt`5ZWi|Kl?~;^WuTy-hfF1}8h0mk9tM(y`+}dKP2IF`n1-8aU=JaGPA9Va_JFwd!){px*W5pI^oFVl8C_esLd_xGAYM%L2jwr7D3^`1ItN&?o+us^nqOb#%!c0c z7cW-|@avf_644}=#5THX;!SgwtuBpTQSy~FXSf9){H)E6epqt0Sq=J;>UoWYn^7y7 zNbx>*i;KKWDou|pc{w$xjO}hEX?k1i1kNy;$^QLhd}HX`ubm&Pt+&m@Ut*uz)LhTr z$#JRkN%1`!SUdg$<_(*ha~Y3R_uNU-mRf?_9todUm>nnldbn}*PLZ<|sfKekAmXMA z@J@Q?a*y&8ueVOGug|LJuTP54&&~wNR+<)m;BYzlw6{mSH34Ocyf(g*mYDtW7vHuP zkl|p74w=)+>0E|tFOWPR&rVa>ZQ)hp^&c3%gZbzHp+`Br&s_u6jCQCKa@}d~0A%(R z$}zMrO8@HqVLdYskw|YB2bhiBf`XD8SdlE6uJj_6^7W?Tt~G2O32W?26A|yvpk8sm zmcl&7?oC2D2;f@e7kl)b4^gyEB*v=eItw>uxz*LAn8vmNG7 zY<05g>OaOza{gsZZZkak3l;MF`$zsM5LJz~iGNr_rf+K>^}1jniwRodesBXRb%CK& zx#70^1Jj2K>xc57w!VL`Qw?EJDmZ;xJPLfzEuKZK;#2s8PR)#QB(bV0f zf0ga&mDp`_9o>*$gfIi znqHK)9Dcj#aw!m=!5%bb0-7^`FxY$s*eEz#(m`z@($LR1!ws&9IKxUA8JX9H{^d&~ z&?yxkM;#AJ#`1UnFVZ9L?nsdn>T{PAu(rqBvlOhdS*T9psk->{`Iw(b+m(i^N zBc!C_D6%8OXEpp+z1z7?^nYx9`k1eN`{xg;<_w_;=d@M%x`A0Qu5 zt#rhySwY9Iq+~I0acWYgVvHLbhWm3Z3HP^X#_znY#_|E6XEbU?KtJja_GiHEi0haH zs)ix18yKIC<7>UpfozrEOH8E5qdG^a7YS zxljK}RCu=Q2u5rCiC+o*#z#xbVlkAB+i|L|lyyES&HnfvbQvgq z`La^GnxbORAMSp;ZgidXxgS2X6`2pT2kk)dfHzD zX%O&}bnYmEec0Ih-14=1FfWYeQn8G}{0zg*L8|(`tm3d~0lJgz3~;HZ8U`X_4PdX1 z$9gl?92#e;U8sTbmqV&*rtT4D37=h1z=M{#h}z{icN)M#Pm2f08GO$($`@8_?+p!s zS!U65>xHYUtINh@9gtoc0^9-YF`AQ&OPmoulQCcGZW=O1fj)#N3=c)vKeL5I{r zn?NnbQ_V~BQx<~gUa!uJW3LA}Dea=-H<74<86f^8z zXZd=`avmkb7e1g}I&TnDL~5i;l@yrmUje48`Szg~4#fZhx3a^9Pg0;A zDPkyql#i4rQ^yiDBOyuC+8TI6ZK23wfU^BJ!2A}e8F~u`P7>&=@UmVFCQN}ZMxC55 z74U_Ea*pO3oxf)fD{KiPFyxQ;@OBn5(W4i$1k77CfXP}{yL*T@oOZFbwMfrB`JlLI zz8$*mp7;$7N|lvEpIE1KD-2eEG;7xm72c0=8?m~M-2b!n{{RYk-mWv>b(cT*a!7@N z`ueYn#Q=S1d4ns^Bq1$(*(}s3%gHV;<39}YF@Hk8CbaE-Z{J`xY3I{U(DpDK1M83K zr30jHBw`bj!z9l7NHr|XPmX#^DD>=Hr1chT)j-`cKHf)D9UYxD<5syzQr2E$(9aL1 zMlw6V@I~&JKo#Fm3 z*>W=5EFh?SG8zgJZm-vo4WpPz*Q(oFCEe+whY0wWnIbx2m$bD#eulQfOk zecd~Ly<1eAkQb^7ZoYqsudW+^enO{%xlX=E$dW#5N)ksl{EznE4~NKhVDJOX{~Z>I zp{1qm1AjEhTQZhGtK`2nIx#|nCn*vtwv@(rHx#}aVCEw-3bUb6@ zxm^^&JMjUTt5iRy>37;5(*o?=j=a=lKZ3iZW{s`Cq4Z5{gsEm2W8EL}y$k$H0$%Hy znqJ5B`}P}j9U?zHyZ}#8rqe=C$|V%5IFDKMc+{^}qy0~$1pr@bc0yKN02IhC{s;r2 z5xRV|s(wKknVis(Vxc-GcrJ=Oh5p`bntDmm5KpB#lbOKU0VZm zBBs2M=Yl7GB9@=9!>;Z<;o)(BRE)t|3yoEsjyD6j&W%LbniD)?`r)?ScMU+D8jH(y zX|n}oTl;W!GP|``f3X{fa=d>`zH^ALGhGHi`b{?&aP<*Vxn0bL)}%dRgRb)_q7p)^ z{`E;BM2quVPRM# z!IOZ?$;0CT0|1Wpwc{uH1~8GT)h4`v$dVjj9`8homug+9}CWLhUMsQVDZ6s=qB}g-J%1}pQ=(Kb5m4NFnq1`Qg{0g zkwv!gS8wUjXwi}Gc9li$+^TWolOWrHr zsVUaEInMg?_>c8_BkI>zYoi<>^s}^tf;l2;-{p+WdJ^zC>{7M)9^C#~v6)-dW0Wcl zvM84>1ASs%WtLCtimXmRr!-)VfyoQ0?r*dIe-AvdTFmfUYvTg|p{%+$gwIOVRBVp% z?W-50-9q5L2b(Y0yt?y-m*f=`!brrx;gB_E@=ML0f<7citT0Ix_m&a(rT=O85@j#5 z%7QLfAJ;e;&n05J{0HGAr;OQk^KHg9t+Kpu;`@IDk{-;IWQAu@4@{*2997P9QL6IyhdboE305j5b%cy3jo{%7k4D_UA*;ZCp))l z%YX7p7?YE6TQ+|5bh~Z$O^8HSoWgXI%f9IXsZT&;*=k%R2_X#uh%3wVz~8*t8R#|pz7sg+n2U-El2nIf83KW|-qeX0 z@Z(SM%kei8i;^cTyy+DdAiZhSzP$whOW#f=0DP@x@lXA=p?&qko2Dws-#;)CoOR%< z1+vEk2ln=6>P->ezc*ap+FG%hY1qj7*f&xutD^Fm0=>g*_(`Mq>C+S-C%?D9R6FDfFKf1A)44*ZeSjW#Qf+c#^(L z=dShEc=<2LCYmb1*u;L2`yOtDoS7NrX6squZCHm-$FGSAZCAfzHm7mH{)jvF( zSzQg=wiGdIpx5r>0zm#K{oz+anFYThD^KKsLk#Sid9z^}4c`c#-WvHHuOk?-&a$5# zt2lJb+^bzMvjDY6qt=1ZwFM7sb`0o7O8PHmXE8ua0@$I#mhgZ7oK{fhikYqYC|9fy zGoxBb8=DZ96;1R|zA=cQUo|UlK~3>%?bjCC+wiM{WFt0t(5$Aa3KvbnSX}W8gdUUF zAT`5n>K}8+ctguCsv+s~5{q^3?6>K2JvxIUv9TU&?JBY&D+68;J=`qzqVP;V zN+?p<*VgHY=Dt^8{}Jt$pc1x6q}2x+tG|vc{v4`*)YSQn}FA28)}i`+|>wlGU!6O>Z5QEOT-z= zZ|lKJ`14{Q5t#3pA1mle&iCmzZ2YSazNBx%_%g#fsk(qNOh}@A7u61Pu7YmJSi&4R zMcS!qB?rwql^{+sn>fWwg&845ED?`x^V((jU8yRR(`ckduOd(8{PG%88|>0Z51rcg@UlH;FZ}ok!8=AY z$rJC7_Xt(E8`gd#%_WVhcHFts9z%CMUK^+k1;BN+JHVO%4yqdOatgg{xIEyJ4^P=I z4=I}krG(7>5m|arhC55`SaLjTwmfyj%QJp_y-weZEH+Lc z^(R1)!2@m(-byAhf~`I;l_GaiRHKE$Sv*J{MwOFVBG`(zyfu4aXnY}c)qXm!SO&vw ze4%edDE7IEeP<0iJ5Gho+Be~*!tVJzd9eb;pxX33{?VPDf6ndCHnxA}?I{{v2+7m$ zK0)$G7;Ki`=06@GPPWyfz_C!(*jym|1ZjEu;gqMpSlP6`+=9_ejN2LkR*poBKf(BS zMWgTL*2q#h3wEuL(@8vLWLpVL0@4Gt32h&`y_IOb&l2$r$pP^QM4vAE17_9HRAfhR zbk>~rmd%rQcd=->FjiDeug}p>Q&dVg;}^qM*a zMfT_my0k~?G-Ns#KB^0_(M~NUHNuXl=*^n^2hOxt_wn!_oGEXL+%4G-y71mYd)j40 zPJzYV9?(r+)>hqd{NNAJmX>!pL-Sp3eP=d!Tc26R z_-A2BNUoRDbhK8!v#jw$4tM%h*OGBgK4Qu9QwG^t)_~DwG*up*G#W+I#)XKQX)!XO zPMW8;uw6fimE7+`ysKH2vEf`OTxLm$Z)N4!bOv_V2j-$g#%!|=s9Z>pjKXt5Nhuhi zIMpq57DIZ*imMx<-SS^@laWF{?eWW?Tt~HseC5?1*@Um}&v37>(rU02Y$3j3)QMWY zhA-n_Q=Bg=9G50i?oqXxXxE5_!|AIQ`F@i-5M?#DOd!CH+*bA*^o%?6{-cQpx2}*f6`KGJX@MFuhIZ?SW zaqPkv)cNk+90&afCab^f$F#Ar+%f%!pT)D)!<@=Ugqx=12W)%z|JuVoPi&M^(6#=~ zTwWq#T@~5%iwv^)hRL@?P$}AVZHTpXmowJXUY?=I@$RPsBbB^@4gzcf7s%Jru&&kT z1=e0lYyVN9N`s%*<9b;v(Vt|#rt*6C1+-dEP>cZuC(_&a{nS z9u|VB3WpXg;Qsf7Q@ycuq?*IDp=Q68GOk00AkhR+N?$_B%?1p{n7rbC%qnj}eo-Lz z&r2SbAs=x?pl+L{qc`y{YBf5yg-ywSr)yf?$AwKmuf(x^eZalExo6q(tvP#3Z3G?Q z&IE}ta%O*h6q8R7-skkt3R8-0*gBdHL`S$?oW_nEoEmpbJ%|r}OI6+x!Vrs!UNp>l z_g)~V?~^#cOLHnZE_nqV)d7WEl-P&Dgq&@b(8J;`xUb?REzuU2HjaYL^3i6i<)xoA zN<)ccDQ)kg&0{Ctl*`GDhXcAN99@GiBfhSVVI8}#niB3?N)!9}UrdwAFoWp?!#SLG zAz>wh&wAOX44~bPq(HJ|EAi_Ery0%a2Xz9hkm#nO?VFVZCkxCPpebw2j*ZafPLj``EG$Se)?Z;;=Y82{gqhk7eB(yn+*FR_vgRZ6=!qRG^rQc15qjQ5HOA`q4xskp>~K1rO^Oav zn2oI$iLU7nIeatSm7nW{6QGO|8b9(9d#+%&9zzlqidHApA!%i*A}YR!KN}u~^-%zu zH#T;Tx1AMkHJtfG3xLHI`ggW5x7{t%6BVeVBC8G3nC)>|eKEq6GTSk-OpDtzwq9tG z9%mOg`^qe1H=B8qDbXFjy_r9?U9r@(HR5`BO6LuuXpk6?GPx}OYD&XQW`kg!8O`OO z51H{?#?uLsPQ|0X>FLri&9srCq_xhu8R+5HACv#p==;~tsRZG4c6_cgo)+qE|2K$@ zoss{Xahibsz+zLG+Pt4_kK91AeL_TzC}y^{iS-23*z(pJ6D6kpWdbW0 zgYdbmu{af~?YL@zd%dEen$Zc)zTM6Ff)Zv%n=^Bb-U#NIN(9pFHj~;08A~B~^S+cO zj2cFfb<;M*i2(hyg+_eWGhMn*_oB*n=ovQIBL{+2r{L+l`-sy$Y*)F=}EJud>~NiKI{fP`0mgQQ?0RP@^fwKtEro-~~KoWV>imy8YQ%R3`SGKUrx@OQD z?VuAJtlVi2g>_DZzkTjNL-*Fd1S?9%1gzdL+pm*a`NbP3O3AhBW;vD42ou+2Rb|xc z@YT86u=e;gw8rp>`Y3_7I7_~234WFbY2TH&Cp1^jko})hAibkkOqSwmlCR!R2ZBxg zdjYXl5NB6hL5zFXvvR>Yxo%P>1(>fitD@10QOYmTDVaJ%&8h;ge2FqenWD4anHIc_ zC?`Oy3$ln1bcO`JBP318trn}| zRZt@gW`Ab%jXv!S+DH3TqKTJ*lG!yu@M`+-`uej1t4=iX)CcHVM`=X7_SzP1I6HT! z$)WW3OAT-7-$}lgeD4%&tvOU^+y*u(N{V&{+ze=!Y@);t&!F5+wP=U!H!;ZO;aXwL z-t3|q6(lc*R9#=kvY)@AEcP>lbZ9r3_(9R?OnL7JmH`c8R9oe{+X15LNsLx2r;3J# z6sWN)8I3qql8(ws6)~>L88)7(Y>>2kCaTwb!lxF2g=W_iN@+yA!D>p=ik*{&mi+)d zOUiabZ?In_c28rDL3XlTo#<-p?HNDbY|lSZd8aFYOq9_SJ4e^=it_>o;gT@(&*MZv z6E6}-JPzJvSU6N1Zg-7RBvW9pZ9H8Bm`KIlJ|FI2crolC_h|p@d=k>=N*TFz6;(a- z$s;EkJF#$y>jWIc_e*pfEIQ*(@`4iuP}G~xdIn$ZaunTT72Vh06W_wE3Etmi=U@I9 z8=&)bK+f*x?>Fgy^f~D@HecC71f|kQ(-!Lmi)`NrtYJnd?%al<6gsp=sb|*`pSOgs zrKX*8_s)fTmZFx~2geYd+ec&3lD?Cq54O@0y{rqc!8ZeZ`_t0XS_{e}#xFKKuaS<~ zw3fG_{PP}bc?YcgI1dZ1KTI)#k(}ws;6Kkmhpi@Kns)Un??i%p{&?Xp+FFHQjj^c> ztZM57hn~(pX{9aIXEG0h^I+xI1aK1_u@90If~9G@3MJywzlX2^zNK{$n#5|TSVr3# z7hLk;A4Hhqjjq}As2tIWi7;fPm^3t_@6m27&AysTFbFbm$u% z@jK6If-l=aGQ*hfbA_ieu*Ht^a|$I;OQHpf1&_t?I2KLzbi)Le#l?;jVi)OkX{ilK zDydd*NaM)hmEk^aiP{B9H~U6Wag+98z?l;uPKyQUiRdZHR=34cgojeGqtxMI>IRq@ zaA9kbi*=6KM!n%Cc^}Lq&ujN~vacdiR+g}PBpv62jGRz1b*Ec zYxUv&bdK>1`NB4ITrd(VKsD_%G>-;*U+0>Jp=!=5x9|)}X!z735 zouw(&2&Fac1ceF_aWf3(V&y2Am2Dlzh9v{GUTK>nw@zufm-1jqSR@wXY(wKEQ%Dny zz_mo}bHuXAxC>vr$2TIgTv81TR)`iCkiIvQH5F8AlknXEER9ADMZ%qiX5KJ6bwKO( z`phfLA7wBQyPc7P215j)GR^Kk2J-!#jCY97=+S@Fg0ak_ui7K051d{tFzG zn4J2W?3~1H^tgZ?>d#^Ob|Nu8;hwjSfMW zx%>kYDeh<+wUzjKkPVsZe&jUm{ob0Dch3@1zT3mJ@O%`Iqq`{Httc= z#UAbGkwRnYv(xU%*fs9r!ZJn!y&h~&SfHGxLlm!HW9G7+W}=sC3>8PTq=lnHyE z#A1RTd-Tpb-3aEb%U2YUn84KJ_&&R?F;-2%!ViXIR$6fZ(p)us*7>b_x)23&)A{+) zpUl4_*@k{Hf4&4YD`R(dv&wN{=^6mR?Br`R72CSAt$EzGf*fI}G@GLzXWjg8g+940 z`^o5BEl33~@!dZkjHgSFJtlu1Vg065DNHRl`2KU>Iu98-PN+l!WszRT`1_5 z`g^*y6Q@3G$%PR-xM0dS-{6tzAo+G#vnUElDz0!HX^OiDG zGKGaod2@KV_bc^S;lwI4dEXnzH6Ca|i&pE9wIKSll6@5pA8bXV|Euda7pQzK>u{;d zT)vBC-Wz=5Yas3522)_KB1?F{2ua%^5+AOiHL~pPG*O(RyieM@K41s)bCMrg^5NJQ zd|L!yQ?0nkn~u_U$cppcweYy{M_gYt;lD!~1mi_Qn?{qEOWz{7_N0E|0kq$x4Bsf2 zkvjel?3Xw>^IeI{^NYn`-8`snJzIXf+Y|#?35KMey3qc%yS=uG^#P$Z-YLNt_lTfJ zoT9Jee3CtkLR}LixHM)okTw373%SO$Z8lAHdFi1mduO`BYk5WXn9D&)ZyOeg3 z6EBXc*G)pKvfcGMx40ExZW&&zb{x_FvG3mEm-1M~m^-quzgb+)W;0o|0b2dVCB*-j z5P7MCf?WI*tAiRXkV$~yz)#@ca;>_x-a|7P7*Gv{l$9M=frfaMQVzj`MJK) z!H~&YcV6&IN}HJq6(Y6;@ChXxvkneUa-g6JMq%#k<~5g~hY5!bPX1{BnO!{S2ka9I z>G*rf8j6A9xgC=WKgNC<--a)^-w%^{M%}&vIwavCrK8iW^!weW6^j`P{em}QxW<3tNRsbUr^v=_ds0z%~fOU ziNh^1wC6#IJK=EX4Easan2hNhS-CknK5haI-21vTEJPu*vvCd~;X?VjRN7#8#fp=P z`S7?(85VJa_}vmHx~V~0aTK~=Q9ZgJDsdrP3JH#DE)lPkM63U@1sh)zbmpxYVCWWU?GkHGSwbY921DcKp%HY3kxZ9p+WX znmYni_;22>oL)y6CV@H&;8y{zxNe|sV!mep;5fk4=GGvB9Jc<9OfF+)ICdVE!P)dJDud+F6jjhV#vjzh>FJ2#rj+PaqR^f*{z-G|=1v(rkH8T+ za?ZH{vF`8k(| zZsop#0sdV1;~0ECQ3~|Uq%AG}e8|eaUFEmq=QtPcPS81EDlisyBn?2uUyB)SCE*+O zhfEFw-0#h`OYKZOF0Ll`zTa~-by0>Rs{jHf;OgZEO1ip5J7Q24a@m|s z02R8f!&5?Pc+ll7OW`|fu-Y5J{Tp+yb@OZoV~7mx;d@4|GM&+EWjFWfzQhw*gH<)# z)#$jF#8DLt;5ePFG9Daun?$f!fWGUTk>VrgN)f?p-+KSa%7qkwi*AG5 z2v9igp5MO-MtLt$okVyS%JA^&9~XU(q1V@75R<)VwBT?2pG8GJT!;0B&&#$ago>*| ziOzD=_r#=$afFB?0)zO8p)uV=s1YdhBTKyfeH+i zaqi6=U-aObYwUdqW0lrutG_|vQW#C~jg^nLS(INqWH0~9AM{CWvcLmqF2i7j*ywX^ z=LPDKYYgU+<${70+Mm%I@~L?9@;UNH=$N6t&y{v-a@jevUzHT^`IMcNP)yymxxGH_5I-5_k4>lR6E`URyY?dBs(wSN zma{EsJPZAIQ3uO}(I`*{tm!S^R(O4MvgV1ey#qX)`_W215Pxhtr~!rX<>Qf6y2}M= z$rKLgoz2Y^;(qL)HmO$Q)}pV%-mUjMXMy#9-d8CJ3a|8SC$Hl7X;Me54z%330POU{ zoN{=sk_cy`WVipOWh>X6zew9YbKM-a_`lMijYQE5K9MAeLq>lOzTkPRKa(U=P@4zJabf@te~F(B9o^bW z@Vc3)PMx6jE$ruy{)0s`v-wy0mMwx98Pwj#3VdH!-5_~*(*@InxI-1N zRKs&V&UyS9-dym&;bUg;8tRUT$z7T2ZYY?9bbcWZ=($itb`kOV=G4$wSeh2ZLLOk8 z?iN(6Oq*X6v2o>xy_B;oZf%y?p_$-p8lWdhno9?>|1S2LozkDRu6ze}nIAFor@Wrl(J= z+uVY)d!+#=|D+)Ex)|*JQ@~O%S>${Cl?pDVU(i$xB|mxeC?G+*ZQYNurU$2v4bP86 zF7iXubORM#%nYw(ETkcvTWs}KapEjj&Ur*`lYRP7V+W@xr>vgE>D1no=b^UHXYm?| zi|0V@dAk890N>nMP-!=g?Wm2L2WK) z^h*TeQ7-U~0RDeWgyY-Ts4O(V*nC zKQsJ&ei-Q0s;jGyFSziJPBVCisLNZsBRn1O0lm!SeDI}sa@l5v5j*T(M3b{0`F)Vy z9H4|Qmz>!Elq+*Q-F>?X2sfJel32#UK?%7+MQ~*Z#N>zCE+&}i?ErrTeqRaj3t)G% zX>7D@Ac`^uoB&X#pdbNpAk7n2`Vf#&>Dg%nM)g4E@|21TlQ>>{e>~KF2*c-bz<04l zo6ko8SxSS@mx${Vni7Ytm*6;>=_7m=Htj*eiz;(cv_v&MfY|zGh)I5rq(dN^kEGZ!n=etVl;f|{V3=rh7wFzt{u7lA zq(blhiwmxAxF$NzFt4HlDTEZEZB#@#AqHR(U#x$&v=Hn5Mf_NIG((SPxDzcjl*arq zV-z?i-2L0GCNmiF3#0sRu%{MpZA$K0l*@B|{(g3cT-J0!1xU5KPOocYe}AHkB9fTS_D5 zMf^rsIINk2SZJE z?QCx(5vbz2O4-Vv{RELwNH@Q&ElPX|4Y=>#`18YgQq-t{5L=2Jy=Udu>4+PC?$w_E z>Ye_MyW`}fghEdVxGihchVNYL^*jVJ-*GuZS27-V4jEI1K@);syN=G|+GhrE$LV?$cCY}b2E_88W z<S1{&izs&h7p8#t!|8|3=UX6?7LYEc|$yyu$Ra zPA;#yI*}TaK6q$6k_1cuCTasnG|+TWQHcYsV;^{kaC$a^{{~8t5lbtR`2B=TN+m#o zW(~6P$>o>k=QDm4WNG1}JfAdkv{26;BS3!CY|@|uG^p3_Ftt)}%B-&&K<1{TDbVw- zB}oL;^}2+Ci4=_P{rUR~kV~CzvglTAte#%mG`&_B5pu{Bi|OzBBl|8+T(3Vaq@b+G zVE#fAjGLs^z1!Smc5iaz$|V&7AW{WOu$JewRO{ozJD@sk^SpyIP~8NrA*(6pDLu{7 zkQat}58dNia8E9E8*foms#5<-{F2}D+R3KoBf+R|Ax-xb+%>civx{Rrr_>me9t0jC)gckol=Iwmf6DJLzec5b~NnuwRpB~b=SG3gyPRi=vu>s_nIYBY^7%~!l6re#h##@>oWns znzGv3@M9>M`e!V{4Wby6q#TeDmm5YwvLxJ zfRP4)A56YX-O)+0^>N0-T1M4H+5ERd(0*ZQnO$1?L*2T;8_eH|i{N`mB^HT*Oihh= zTnb|(;aCbAyI)5U_g=ssy6-2$INOp>?h%YT-T6_nreFw`U2QvArQzQ7{uE7 z6fVw=Q*(SfVgLtXrflN#fHcI9wSVTPd!OWdZY31npTAqqJIkxdhfePa|7^N`6*I!!5oH^H zyu8vP-FEZC50>nsbuwOixzWF58|q#D6+Gejfs95ZRUqxbbJ2XhTUj%}wO`;3CVYRQ6oedC1s$*_9NV3T zsdz;m?8`<4mv42w_^^Mx597c@zs8yNe%8h_U2W7?>$FoSUt;|IhNjf&Wt zMr`nY1C9f55KL)M+ou@m*KMu+ng^qIhYE_ajEquCHA{KIpm9 zgh~QiFypclI8_TuD2TbZQf_YMU_YL@@&M2ue8w{9g*L1CG;C!sJKhaaT@}Y$BS~TX zCW5(2KnVW(?%FcRo;zVu( zp;vHD=V_a95cTWkJ(!mE!lny5Zl%&7FTPXG-KvmoV-W_!dh|m^@Wh~^j2UzO0lgPP zETReIpToaMWOje2pgjEGN6ef)!#9vgP?#;V*#;IuGg$b}R5QYBX#{Ks`9LJE^RorIftP zR;gyskRk=(K!9ShE!HPd_D1gBQEndeT7srOkc6acr3E8I zJ9Wvi;K6!(?^_^%R<4PmlAc3koj-fvMX`T>Hmm@WlUi$_PC-vCL|T{#uFd~3dC98J zy(HIvnRvx(7I%icb)Wg+g((GA`U#%Ze+4g%`>Vyag!&)?TbubuwNOxNT@%S|SCo}e znv7E^iq9I~9$6G&Af)J&lLrad6z6kLLM6CAkj)$BBrj_j@1ZR|kt@!h4r9fu14RHz zWP!zZoH72*;>;MgvtCDom6Gf<*^^|i@<3M&NU;^wCp7_c^yCqy7Z9k)iEigp1o1ii z0EngKYDx0{8DfbO@>z$1kc7*{y^Zg?R(VP+{*~r}Rj4qnTG*?}qpPImUP%>El8LU(Jr^#s9rAgR>Zxkx!PUa95j{d5jMk{1Vk; zI}siIG`KpwzZ7HCC5HI=`1lIeE%jqU4=b8(=S^c8kw52;+sbTY|CPV^5x8WSylD7* zos;#{t`+Y;a0AG)W3$MeVIk#gJfSXga&rcBv4AoL{>+Xtrfrw$3P z(`hd;Q!x@tP0mN;j9wGy_G53zgj!(Kd#+dm$ zH?Otx`LO@TGe=h1vL$fBL$-*YKPfrV;Yt*@BqXR`tDEAC`Q_<{ao+F;e7iT+x1K&f zG~b@rM1OU9+0${evP~I^V=<{vTomBMmDa)#`ouE`L){2Gdv zoly#F@3NvlK#k%LHqkShST#K=*<%ibo#;STDfwer?(daAzmL7lb5gX6ta0M}x#HF5 z8iG0NDHbPJuR70CpyW@4WqWQgU9aQ@@igPNtRIBapTWP0?ZxYncQzMm9MBw_VfV^C zalk{1(Wvp6`UYg@AR$(t8csi(;zEYJPvp(`@ckn~N`0;gotYSm)Pmph_Omb1BzB>k zc&aM>LFw(LQRDOj=@$>8W^H)L(<2VD#-qYYv56)WiQfS36XYZ_>TI!nl?t>s`BJfp zu`jQw>x+(rN%G1;9N$-1;agzvpRA=^MvY~&b)Uf}yV1FMN-7*Nw}g?$xRKWh&G_d6 zg-@)d%U)tHuJyvKyZUkHv^CozBcvw9Dp1iA^Ft{IW(_Zb%wBq6J+o9~0QXgs42pv@ zLBMm9Dg@#&1wHXTUsS|re4cZId72&;vk)2k6t7hxDmqjSRqO)|=+7=jk4GhXM*wp7 z^?!Jb2$TqtV0`(CfGF>&u>{_xe^DRC!xM=rExuKgT($$U#X+`@$ndQh*GrvVR|Y1H zhb!Jwn7daJXRId2HGtdwZ)?KkymQr}W1x2=A0#ggO^PFzTgd~_NuXAAm^9H&W8f0Y zEk2#5#UG#>a5BWN1G(O<77R+wf5(?$kTeZPX%P-{N17FcH72JLb-Yo#&b!y=wRVf( z;ZcX91imsSX>=@!Zw8wgvN}`^`@Hy|YYZeC((L(CXcKme2H-;AgPF$GG~o@1;xYmg z2Vhj+ha6vif?VGBCb4e(jTE@zL`HLPW}H|GZ*aidT+I_r`}Qm4orZ_NKHu)jt^SWx zvs0NS3d+C|YDXyQN9MsWpc{FLzm?p<=sk1zZLFiy zj*-o$9R;=%eqPdwb!Eh9VYD&09)UA5U~zdJ;dX7M&DT3}b@Z(hd~CC713`jNRh3)_I^{pj_Q1S^ zglZD%I&h%wS6-9yz(dY#ImUqo3?k>tyt*MJpCbvY&E7k+fe|0e`U@3hk}38hAd=Gv*=$+yRX*!ln$b|LNUxm1Rqj(#8E^RhMATlHf{JOKNDL@C(+YJ5l?xPgn* zuPf~~pBVMkhlYBegFDd_LKpZl45LgdHl*L?BDLZ_{^veB0S$kpC$p#R@9OYZct0U# z=znk5xBQmOb)33S0D52NSLaZ?#Tm$SRq>>uL}R;qx*~^^P8aEV;3xN$oj7^Qbgq!{ zWq+Sp$`B6(Sf3DyaJj*VvVxzbOTC2oT#(IF%-4;t*eCaNwMF=({5Ze@B9oAWBje~v zOmiY3yN_0QzX0!EK2Q6G66TV>Qf}JRo;VyVT9}GH)ejR%rHNMvix-D-c{>r`gpg2h z_KE&@L@$4St-AzcCctXup_C_;5-oVTisbKZvB&$nF&t{)=pj?lFP%HwbMV8;-Fqjd ziZA_y=!LV^7QrazJ?0Xc#+*iF!)!OU0$77cTe?{{NmTz14F^^P4>uXqi&ua(xhAB( zns>FqH|?Gt4{OWDjMEC?<$Dc7O7{B=fmWnEJ9KCBwCwOYM;~9C3)!}BLD~enG$VCL zPo0IYxHT9jO-#eSJ$BQsp;sl06Q1UkQ_cA*qV%W*(-+lD%ip6Y`6=<9__!}TX5{wmxFVYY_C%WKzK>&MvBH@QWO zZydH`BK^uLfNPP~d#o@`j94hz2;aj|j1P3og;mIq_;0M8WlWvj*XFCVXp6fQcXw-X zcPQ@e?$Q=_cPs8t+@ZL;ySux?Y@R21=l_l*^I;M~n$mL4xwovf*Shxay80>k@qa!N z3>Y8g%2{HU8eBd|srBu6Emo1=djXL0k%a13Zxn>#fMEwIY4Qc@ZILZcn!~|%VTl(O z&cRN zcsG(qcs3YeihPNzUc&#L3~U6gPh4)3SFe*ArphL7nTnST^m2}mp??5TIZooKP;@*w z_5MC(JdPf?mz4iNADlH7F6T&9j+JHkEHut+LoNzVI)9uon?w1W=C3mQsoIsKy~=*S zu38${B$vK~Sir(!?R{EW$FfgLpWGMETVAyFe(O$>uq@qL{b&IQCI&rYwj?BC?GhB{ z`K9!Rb4dTXoxN!l;LVnivwGxwNNGxT)_;38!sr=#3bC{35&iRR?(XumxTM_stpeU6 z+rklpq*v0^h#xZO58lNRLRvcc6S!kzS=Cq@{SG<4pGW(6OK-N?A#G538dVU(sE7K` zi-h~WY?l}p=L=W6btTfAOIq<%gNs-@SXx42G*u4JmvGRwK}C9)m4M>4N3WJUkBFgX zIm~=@ee}C?et_&+hPUtHi3`3nr+@o{0#EvwEMh|`XlwC%)5aJRLV^ft+73&aj_1DY z8EqUy>}~Zoq{f|RX$Zs%xZgF0tt;^&l7j^x{EVJ>KQMl(wq00k%Ws8~be@xamrvSk z^}})4tzC1-#eY)Fd|WVo%!IH+RYzB&iD*1W9HV)P*{#_8o!a8g`T3uT>GZ*7yXDe< z43gfo)`ox0o|LY4K!3gc3LDpQxKaR-xACh!@}o7@CBmG?D&$9KuJPkqlE$LCT%XQpRB1K0>7QanOMwk&W_zyL@Zm} zjp%z)p$~8)dnr$Ax}1O=;aY%`-CO;6B{F$pY;Qkja@vc6_G>eDl8YGRtcqODAc8mp zkk$)~>`=Xgpp8TQlMRpnGgyONm}{_|?1{Z6zb+6?^HcYNAt?*0v<3A$L7ZPX9N*aZ zD{^&}f=zPUrzHw&f_|>d`s5tnOP1GMlb-kO8zmcW{Y8@61&H?|4HI1%IcAf~ix!97 zorg6FHB4rBD|?2CX}=+pPI(#0r7?=KQngs)b80d``Pi`o-4y(PLiY;R=vF*ggC$Y= zH<}XIaaZdzr?#b6UfpwOfWdKmWhRdNUdcp^_B(1gLoSpTmjzXU7(ej+I&B3;hzR00< z5Nul*dQz^q%bTis)d^(1bh5?_3mh3_0Er@ z1FBuI{&iW#${lC~8M}?v`N5XFt$p+M0@nG@-hh1k0p(z!VRn=Ce-O!Nbdy*dJ$R}y1sstlluq?8S}{;uc)c4P0*UC&itB7bTK*VKgnqQkujkDJ)jnj zCoAy*1Z<)Z&L23oHCA2Yy&{g7hfn@!lZa@nxpaJ@@nI^=u>EH_m9*gMQ;~*_ z?&L4EU>EzG!2~3i=6T8UAewb^Zb0U%u?N?eK6?p;WeyJ$G^ATBtlI+!(VnTL&GV;Y z;6)uRshC>;x${X==r7xk zducK7QdZ!o1HSIAlK(0t3n>n211X3$WpBHh!jF8ryCNwh9(*fdxY4!4^v-Fqpc+2| zOP1V5YDwp0nBG+wRd%)wqYzG&x=2%O*u2OoDKIJIqR!M9c>xjgoTnlK4<&9PO}?EY!N+!m^FVhIeOvY+qs=&|pt zNtZFE4uHJrb(^;JMonr-XQL*NPil#K`<4m|+l)lh5)d5CfcWYENIMhAtVYMWI60%R zJYn&Cj5FT%1h=6%&ob{p;bfiLqA~3-V40^oGmP`AMyk1*`}3yea|m$uXu-TLqka!o zTjz*sP}yKz%AXok&21p>Vn|mi_`U*tJ3CV6x0L=`rAhMY3MccgQBZ)qPZuW?40B-c z?Z#fNV14C=QAxU$ze8FOwdW`7W(yZz2%}T>-LuP)-Q&97y4dKfgDBe`B~&Us4-n7| zaP>4350E5@&6b;OYQer@a?x*$p4v?zK{?T@J9PZ)PL=U#Q8RY}40uF}d8;0M1}Rjo zWJ;GA^XVR@u|lC{Z$DmjqEq(}-`%kck>(N7o}q6T-5fuIQ(-vDwNa7F{P zl7~i47{RwxRK-9krbCYoJQUu&;k$A301b$&tdBtH1cXw+1k8*X+)h5deSmrIck?(t zEVuGUPFXorG&=+Mhf(JSm5)V6V;=7^Pmo=Kvtm(q_Z}Rn1IrOSVbUacNrapR+*g zhE9UA_@tD@%Eow_dgL0?4+NNX^P{%;1%c!0%$-9vAe7xXw*?!D4rLjbrhI8>i2DS7 zZF!7x+bp)ZEoo6Ws8mZDD(+l%?;&>18g`*zR^V!!6uDF*CsQ|-E`LZcs$w7q)Q}2%s+-9oP`un;>all(<~jk8Z^{W zKc=2~RJ=dY6m?*pojA`opjTU*1@MbLhBIZGmKjwrm=9&0`fb6!3|}_{hf|Y2gXgr9 zrs$&4QvndC*_2a(PAR>u0dio*$k?1OXe()li9d`Q+viP2th`DamNHevbY{i`oEyAy zW&@x@`J6^d!u~+lm`E zA)^lUS3YjM$LD!yRRL~g{~?`=Sa$wL-8`pwB00e|}py&m>2#kl9|GT`2 zu0@S~9`8%@ts8e=zZe}_7fq@J5m*}UM^(jol4?-4L%)BlmDHO{hWwVM8Nyu?eY`k$ z0T;rL;1f+-tYIjg)i=JaHEtM{JKUPV)agy0#GUj-ms@3W!%eR{(S8l`ZU+q|o!y=5 z0=8}!?qZyQ@vGEtPc`GaE-_)qbL)MB*p1<>JAG!jw2PI?enjRcAE2aBr0VIkgA9^= z^>!H-tD@P}^v)isdA|B>lSVhFU1Vlgg?!iaOwxQffZsDQjEqZ*8(TX5bOP{dptyVU z;DJIN-whhe8!3)FS;fWJ#gcxKg`2=Nr5mW6a+-?YidFl7g#%9PAANqk__l3(ULC)% zDgHMs8O@Ztgu6QI`4+SF#SA2HzWcS9+THBFTyfceEiWHk0ZiMPZw(N^-R;uhZW@m( zT9kf&)<*k%IEW7)c5%^uS5<{P--SK1yzs0Rr!jkbd%GBRR#$N!!{r8ZZ+F&*tym8( zE-x!C`Z|l0$_Ni{3{_Ov93BWgFJ>}gXECsGcbOLsU!y?99(}sxTbZYq(7gRHsiA#{$@GcDj&;3DXpK` zU-g^jPsS8U4rQztzVz3zJYpi`-&ip4R&Xn(*6?;hso$YWl7xb4;XP9wd-tdj&ThfBa!gY9+M1>fUJXZ1h3l|C{CGA0WE0bKwGG zi{B6RANn-66%C+6Fk5(_0>p=qo6S^L$P`JxivHfUPUzaJLuldOX$Xgp64p*awry>k1z!rNmD}@WP3Q;zp^8ZH<$Q*4GX{C1>=)-LkVAzy@5rmz*rSwJ z5>sLz&Z-~^4&LUsd*S0A;nSr432Xfw*Bbsws;66Pq+6>ehz9AmtCIH~B+N?EhJdGP zlVr2eb0|ljVwqWU3{AC~64Deud{DGXcu=pCF<6VDq>KjcGf5iZ1A|pBXqs{$wz%0V zyae>D!Px!~7PW35j)@ub7+!ijn5pyofLj{}c#r@Av$MOqdFaT!^5R?6s`Y|*(cT^F z1j46x0y0YFdhnX=RX8!Coj~ky?&3FAUEDdJ z=9lHZfA|M5N~ivp$3~^ z^H8b|9Cn`56$rd*{z{vYUzysI2Fech%#DN9O8gM}~c$sFi_gs#P)(qq# zYrBRT8+(O{9cJJ2Cqb`o-D>9cAgFYv<@ptgm||c2=4LinoDxYjXStpa&@X7bl6aoD zyE~O?^JS6ezpo^}vrvEM*P@{!%c-sP2MCHzo%Hnd&}*KD=u1pyIbcvX#ayK#0h|(F zJ$OE!Sw8Hf-*=_ZTan{?=aU83u|{&()(6Rvr=Z);zFGK2bMF$CCbyjW_iLYu1hYG{ ziinrKQZRiXY&;{x#a@T9zcL1*^4!I0gv==9UsRkn)U$Qi4<|kkH*G(ATBNl=r(^V{ z$elv$K!P&OQvbZ9Iao--mAw)NEV{K#5te&}`u zE(CW!FQRn=!uoA_WC{F2MU^bK0SO1zi%~Jw_Dt z;=&a_sWe=k9pnrQX^l+79(pLq$hNwe3ST>|4_>pzM2AYtd`Zg&jcVz_$$>N$KVTLK z0E9*+i2_33QD@m=XPjiV22Iz%it5y^IbZj~{Tit?ocj1M{QMLK+!lc$TAD|7=zfX1 z06>)&t?L5iWWb4ZX^UD%ga7MTfuBGD<%EH| z_#atgMBLsGqI~!(nO_z(>8~}-G~s-JDDkVzN9Q;1?m6Gxe?Z?m|NTx5Tc~-;LKJ&^ z*w`9h&op>Jv)NlUa4XV26%qYC0GVfWS*(%-6*_G-L}4|GcjP<$(k7~=Ms8Pzl~7?a zNb$wWL`f0#;Svi|q>9i*gI_-%WWUhOinRwX!VB;DlLx7b1Bv(b8~g+h%?_3|NZ+0F z_q*3&M-%~u>tv|Y(n2ER{*{AD^JgG00w=dMV~-QP0cH_ zQo>;wl7)kXrT55^L`p#;VVX3(-@a=H$VlJ@-s9t2fDr@jd=xPh$=skuPE4R60RlX; z>V@;#xu~$uIXSHG)}k5DC+wWLZh$!S zO$G@hkU8ellbanD!`)`|qhoUbl-#v{Ip%i9C?Fu<#Q86LCU$9wdmu*`io*;4EMdxs zvCKS0QVeJ_v}svch4DUrEmj;~UJe79eqt1#sVU*$KyMTQ4uW!Qgg$yWfGx!bLqI`8 zqd~#QsH+RGVuc2LeetaF`oyyd@WlS*<&p6}HXIrN8OYA@8fYpZ@JL7^rDpZ$5ny}; zv0MI(v;sMC3NXzDEogmUU5KjbHWqe#iF+$bEB=@5>t8ln z1CA#53wtu&)K}Waw><3^hiu#4|etrh* zNj00cXuxTzo=KFA^CNx#XM{OwaM7>32sgy;iQHdr_%&^UL}ewv+xLGYVE!6BHqW6Y zn;MELzgo4>G+Gw?r?=a;uQR82S>0}cPohsAVL-YT|5t_oyNf6R_)Wl^5uBG_5R5?u zZ=9|l!+^`Rw2VxkV&S*gm`YuZmb=9GG;_jYjSk$Y@o_(Z@&a75?Cef?1x2k2<=1~c zm1e(Rv9Z?$@;vaJ9vujBNl)&Qj!*u6IwmF|Ih&2rPYA(m$p&g-*W=*}a%TavrAaBr=Np48aYBOK`=a=exanzuPOodaiN&D%lZa?`F?A~BPdU_E zXq!{278}dYr=rzE#QnvZn-aq7LX#q%#1x9TUwdRB(X-FjG%%-GHu`uV7oc)x8kY&TXy2raS@BS+z3AK!~#dlhD?75^-o|IY1IZp?DnjJ%y-W0&0#Jqg; znZ?;*QJQ>d!m?#_-a!Vl^ciP_IZy27%a3*=O? zMqcFe!g8p|nV3`-b^5bbAakE{{=M_QB9^8p60E=Dn?uCml}jgOpd6}GG%fNtRIho# z1>1sS<=x#~t;wcMpQu<~0-F~gcM}349N2G4nhb~-4CGJeFpo#1HG|qChN}-bfR8)a zoj@qRu~}pRCijV}>(tu!SL#@tPVWdwDXo4_n&?(1{1=>Y_@o@?AE!~_iwcoQZ{R0; z)L^j<#snDULJkfZ-hlf#f-*9%K~R9)7AjUe1&TpgfXn^+v;8H-`Lnr|Gm|rJ4AfBo zh(0>Hij`^wcYDPdoFlyTr@lU6=aQXLSs93`Qr8ulo${Wqj-Sq#4d?t%e}9&F=EX;^ z*gZ>vFQro%RTc~Pdw{u21t^(yLGwN$&(*h;Hx17B11zB2s{)TarHI6oJ}q*<<6wnKIm>2Jb4pPQ8hSnXk>dU~5@*?`~P zp+zgLEE77J=mki51?69~=QsDdb`K1uiXZ?VwMfIAX;VKNmL=jyrP#L0BkD)fqac~ zNjME4G-IihgEdNDw7!4_`)YPp8K92A;)9Z+pM zZobC{Zs8%4g}STA=SqLHG$@x#2u0)-V?m+|#AE}hi}AFX`jni__?0S5CNbn!eCswX z-7hOaOXu@-ynJw{Gn&|0xF7G0O1(^5f`p7a8={RXS%V`H0z#UjM;bWChlt8?gSz|% zhR|D;81~j(Aec1l;37r_^<106fN(5jKe8fmvyQNpwla(=HD!z3@#(JK*31Ov?O&t$ zb_*I$fAz^kU(Z~!A)(pOn!=F&(8$i7G1AR$ir@%Dr5jd>sa`%^CmFvh{4c>B(7pl9 zU7I#KAVOnWs!5~{c74G05Y^S?5{si2j6i0@fPD|g0rDJT78bv;F$C}+0A2q*^p=c< zhF~ZYCX!D^8!zx6KXqyZ!d}3>v)NqpdAVKm@UYF(r8S~kwWU?22M^^_wxyCV&xqN; z#bclf?E3ywCn#WTEz=g?A1nBvedrDjr6oRcEQAB~Er+%N{mv3bI-F(vVt+x>>HJ$c%Bh`G|*V#eSO1F440upi8e^LMdd~ za#9tHBp`AV`N@YjPrkrAFHQL4pI-*SoFk|IP44uCW#0**JwPZFbD27k+lrB693IA3 zXP-AEWaCr_GZPesai2Gq&##hb5MUs5E2M~j{fC=rQ-EvmOEHT0jdd70wv;WZ`u>&G zRt#*9ZqYhfyjpDY6Yi!vyS zuXHQ(wmlNvd_Zsh%}=nx2EFw^y$tEI@7Rk+sMp>Zv{(Grj!j@siaP~)N&=uch&x;N z(d)i%4o|a8i8~5z?Cn5>J2^_Qyy;i|WW6XmF94ro5RG29C5j2FU@#F^_m8A004TOZ zJcK13#{(Dax_Asg>9MX3z^|2eEfjmZC7MM-x3xVQGvw>RV6+=Co>Zi90dP4YIZ!mb zw0(MDK-VYRk%rHFWb|yxz*j9Qu3VCq{p|-yT~)duvyh)JilQxX((iKxb-8x%&^8o5 zPai`;yo`eom=&C2j`<>TvfApPmI@jnglIWHOc0Rzt&a*Ao%X$_YnL6q?5wG1TybF} zUzM!cx9vj8h-7=J{&gH(1G*nK4`{Xi2qsqeaogx7K>@cH4YR=;|6KD`$~q zo#QMUR`q+d4YbV@xERFzWyizI%Mn1KH_e!V_+696Fu1nT3&1P?bkm7Hn^z}9a>Pkr zM(xvmM+WTv{>bJ<5}87I%5nv8T?CSkAiuWkPk<2l_dg>jBKU;-fbe!k(EWR}WHy_# zJ}=Pi{K9cYL)46Yx2>o*1K-dhM}m!JYX;@it03*8%-$PTP0vXH&{cChR9M%j*KQQQ zaQb!5_fc*fscI>>>WTdfb-}OfH}&{dR;R2pQJ#FGtATrtM8cGJG%aqGnSuW+7Rvsl zXk8;Fgzr?9Htpq{2C+%Rn`r;OdoY%BdATchxAKn%5R|aMuW7qH)AAbfRqXb(-b`db zYXQ^C%E6)36yDRz0KeYn zba;%E@%s-yh`+uP|MD@yjeC2?f5+8w(w0ME*~LOZ{lN&1uG(SRF+-YEDW2Xfx^Fr` zF<)O}?F&w?M{IyK10fkv2QqP5o@qR9epey~Y872*YGBC4)Y09X_+jouBCWo7JGzx^ zZG}l=d)-#bUcRpDJiLWi!ca5<^nDmdsnRT+0TYWmK5o? z46pzU=l>}qpWCIZAVhOWjjLZK*Ub?fl%rr$$Fgp{MYtrGNM;KD-&#Fk z)5!E|T^l+RJ{SzKFN?^U2sVzPj>2dN&?72{%FDIpjeK>~?+EY}nJjc2+TNiIhpg*` zK-XLsKK~&fqN8*F6%*iNP>F&5l?=S|kN732wY%?k4(QOv5R6pH#K8N8`ttL06LQE5 ziD9NZ=|`b2>)2yNa^y%0$nKA_lXtswE*+z=HH-dNKseOsvMK_%CP<5g3 zyus9yCM&Iw#`IOo(|=>f4@r?lw}_~~YYv&pE{Lc0JmLh&;f7~Lf7TTj6jv9LXP0}P z@F=rOoB7eOJ5mcK2z{51Fm>jVy{~~(w?gT&OLdMjNyXvjK$4E`{8LFk22+gAG@WH& z$k`hPI+RKS1l(-Q5BU&=RbC}x8_(RH{&rJvYdMi7OrCt z(OS>Fvko#>9`t%iR=X!hG_#H&(JGb%4 zChZnu5!wvpYfcOyTsChzCMOPIt+MKp5|oYOCk)hDmrmixOmr4twn!F-Hfqu1ndr+U z{R;&U9T;)ADC{+inptrD4fdAZl9be* zf3je&r+KI+o?#qFFw^C24#;}9sNjEgx4LW5F}~1~c`82)DK)5{zmLIg}gtBt7e3t~|dn8r40ITXK z<&XH(3M#=rKM-fV%=_ju7><1`dY3)&IrU>LNe9k~1L&ENMxDm?)~sq;9%DM&C=^*O zs`n*L_Nd)K-HZONmBH9Hr^YeCZSyO1;s2z45aT8t)*tL+GzB~Gc1f?q!B%o^kZS;O)(6y;Ey7O8@ z6cWFg-Al0Z7bk}?oeOc!jFNLk0)`*hr0VexijM!{_UV2*i?o&!kLeKCvsmNJAsQf3 zj2n5*tE5L=7e8m8n+L{3)$5<^(kEwV6D$0s;=Q;|`>tc^)GUBzz~nMUN>_e*A~Gq; zzO(=R&aSmiS-k$->Up@v9_EjsSl?nJd`LN5q8vTCzNg#T?q5W%D5MH*YAwbCd!McT zS_kT?Gl`RxMaF4kS*JC^yuGIUV|%~gM2xCRNM;{^W#5pucuj0RnY3ffCg8SPeLTapWpBrd)%ei2ALq8P+Ad^Wx3TsW ztnOO;OU=JY-p3H2^%Hnfgwj;znDYf54r+=CtLA|dbj16`qZAVg;y>Ym5OYKYT zZ_AP$coZQ6|26Uqk&;t7w$IUU>tw{6k&?a6(X)u@(uwWRDnh#tvj$Dv1X^qiXDuRm zyOwCPJ*d3}?do*JESbHMhoVimWwg|@$h_2$KYH8+oaalx8jQ1Wsa zI&E1>!Cs=0JFefSeN;qOm*Mg<#JhcU$C^5>!4sF|@DMIBQPt^oayq|+8+);|urNsu zS%HAL5jI4kR?UK(qR{&4YVbWal#h{_NltNb%6OGKw4o~}4tZgLHG9e{(iqW7cJs>Q zh&|Tp2kexT#>XRiI2`uC?sZ^;BKLinb|d*E^jPakn@n^Jk`kT=yx(|SkwmZ{7s#Is zc2t^fOx3-7C0?c~AMEp4SD;vyo`vHlNsiuG zQ$pQ9kAK6-w>64c<>{Xq*@h+$2Zbu7|7I-BG1q)YgKocM=k+E;MFcep=H_aw8-#W# zY!%0(Iczj%jUE-iCu2>KluRumM1m5y_X9|x%x)7V6?wp=^X*>GE-!EqUREJQNUy8& z8LzT`=YhlLTr%|BNJ9veB7-zzsG@$Zy3gyO) zJ2GABu%`E3U43!%a68u7f+tC`P#}L#6}199+`a-6&eYNAYFE!$n`BADXAgpl1SVLC z%E@UKn>~3VjpJ;h;bzGVL? zoO8@6w5Jb25gVY$BwA*yRdTSKYkK&;t`Ol~(iD*DznvD|&zomkTW@eU2I4ZC?n7u} zBeS)pPuy$w%kI7zZEkCbYkr5vmv>5cxh#-AZBC6EIZ{aj#We$lx7`#*CMJTJlNpmn zPJ60hWftvmj4V}JWh$(;IWZFxNWWTN!3mLgK33pb7i0tuE4qcw>hTs%YE{fSt)2QQ z*Q|_B`#)5Ie+mGEy2B%p8vHBJ1xUDlw?a%9sJ4X!Hj5%%2PpTA3ibTfsB zY=bDCOq}*yUjZ|OE7K7#sJ~{@jzdbKe=ByQVRpJ~y6<#(#ban%_!Iy6{_v2i)4#}G#uQ^wi_i$2jnrN$jaV4AgR6(1X` zxa91Jj#8Ka47G4PcDSLS&y>K-Dkv}oT{E-`m!sx=H~>xXQ_R&p%d%-({pjg(NOceZ zX;;bNbe0qr86DjdYt9kxIiB3?Q8&E=MrCYju4^D+y!LP^DYFb0Kz}Apr=mXN0_?(v z<@+Os&)P}}pihT2Has=C7^0Y|{ru!rq*3wnrj}KW8g=<`Xk3YMOM6&`6>BTz`|@8S z`c=EDvjv9b4kN};wE6C|qO9@)jEY|G?)A-F&)c`reWsQVqgAM7H+@K=$Xy#cI{in4 zU}KySwGh%3x$E0hfwmyVf~?3f-k`y^)_)JuZbq~AurQ9TF5Bzh#`ofaBBJgJ5mqOS z^L($b{lmJu=59`g)83qPq9y_Vs*cXi@{KDW0%pz+pRl!$o4ulAkfYM#_~hiE!HmSE zdJb-Da}y1Oo~<`0iBVtzu9ks7HPt5?#O84Dj*7|fnmZN)QcmL|l@DhXovkqDScP@ypdixZV^ z?gZ1bqjQ&CDMX~0KmeD4`jSG17N0o9uwwgM{7QmSBtiIB$?4mJKwrf8 z2p&;j7Ppw}SEqo6FL7*~^-T|5C=SOr5o>(sy4l9tsrwtZW}~#Jz?ii0b-T!zh@ZpT z>zSKrt5$YrN3Ncr?;c)0rURDfsL=!=@tlZ=WLxTIDRXt~BxXwzE~=QUEPnaN%y=+? zhl6+JSexypnwV>7yp#iO9l^K#l~ZU8WQ-t;p-@=LKW}As9(O2#LoN z79Fj}{bV=kU%{XboppT&ku$MFr!W2uHO&jZ?4#p8I8ZSqWBzF2u8l1Oz^n44kU^<2RBe>&@&wqGE&_JjYiN;tBK-&v%#5jLb|G z28XB*$IqA3+r@^@Kl#K-DORUcw-7(RGd45JXl{lF#z<=dHQ<;Hyah44rIO!i%}w+U zByf3wsUxBcGT-fijddx-v5AH0@a*jD@{Le|SCscBh#<^=%BMltHC2N?I|l|E;t8A) zTC_b!T=!%&G(bj&Y#L0YvZPf*(;U+q)fW&Jw7LC!2A%4*CIdK9j?~J*viTdD&yOuP zNiBDfi2Y(@WYjC^LTOv2o>v4vWcIDTPs4CLZ)^|(SQ4O4DN!11Ei?LshDw4!&I`tU zgk>=e?CzjBI=cGTLJC+9q5AL!^fI2+o4y=%YPn&=j}7}ox)f6-rdu(v8YEYZqxZwb zM(uwmMmHGH(xm^;hjlGcX%a;OVzLDEI5B5&_Rd%&n7s&3RcQQirEtSs%GtgS zJnv2V#^U9}wFp4H(GCMBe@SmLpEKeG;L&W6ut1V4!R6 z{RoZS%v zAIJSzUY#UCY%rWU1aJ^yAot0m_3U_5QJwea{}LZ8IEM|#oBr9NCTXso9Y~U?q64)JH&MZVc9*XprD4YnzPQ;VH29~wdgM|zhO!Uvfm-f zXq1M1#rt6~lDG*PQXst-bin}AQapto-mCS;{Cey9B|z`7IhRLT5eCbq|Hb|I>bE?3 zJeMg%9oy`|5-1qEURQWN;}c7f3+2n}Fk+mzxM$^NN2aFs6(ulaWEQ*vyB#t{h;LDm z9U}(Qs+C>`y|xw4JaBfV^~;3*F*oM|B0Jlx@<2SD4?06mc%+R3O2ySx=+1M9V7q^r zz?YL&zkU%3i7#ASOe)8*R2)iGE>sc1-l!hWP(YEM%&E|dY1s^f;AWh?{$%jk%w0M| zsXv*yp}n|pzn{}Bg!p~DSKsE6Odr$gZGe;-=?|?wA7&z_PE*X!Atd$-D7!^cVd$kN z%2Y7+$2%_#^C`-gT61(t}OX}3%pPC>M;<`$0h&#!|eWsG)d1S>HJb^w0`~R`V z4T0zRcOHYK1!c44x}G2)00o!ZR>T~W`y5yW_dY8 z+ydZ5nYIbW!dl2uUf5-rZCsK5krRNizT5rHn8{H0i! zUYqyXhxePP4FZNTjQY#AYJKtiZj9)HD36i|eTH~*%>Fk<_YoBOH~ZJk)i`d4iyJBk z-IX}+rOhO?1Cll>Bk4>pM)%PYs--@j+B2RE>apw!4^+q{>SZ&|_Fc`vIZSg{ z-3{?%C!j5sF>tZEzs~6z-aOokYqoI)`M_CmcJv%^ggG@{Z#cQTzAhofw#dU1TrwBI zMT~M#Pak?ysae)jL2JwFt-*v&OV8^M9?xU43)CzOIa2sj20<2{JFTwDbtY8EF_U)o z_GMa6ob+Skq&>syx2RA4pjQegtn(HrQW_d?$26*vAhHAmK!VvEc2Ox0tOJ3^77*!` zJB=1UUJil1=n>cwLLr4GNBawA26P!PVi+A;NrR`?zsRDHKD>>oNDOmmxR1&Idu{c@ z@%krEHBlEAjH;^3hYJ!Oz~(a+=7sv2EqewKS1&0spd~wlgA6<>CI=;Rv7(nsaZYx2 zOl)km(HF{AoUrs~h|`P=H&8`EsYqB@I1qD-DaD!Od06LpJa_tFP50$O|M^!dEpcWM z9X<0Mw-tE`q`DjPT)ezpwfscRJ3QW=MW!_w7gug;eMjr^8jYzqjJL#9KSj#kFC=n? z+=@gcpnUgU{2U~k&Yv#*`z!TE*RLTnAxjb7Vy4&d(I(gsrsP-2w^^}^VN~{KdEIkn z%)x?O(3a{yCQSmkEf_IKNqdA!$3ey_2s)nu0S-kd(5=$(AVW78P7Ga4{i>ouuMvjo zHToBTyGY3ggi5EQQepxIQM@!tNk}+Mds^n_IRKCKcTv$hfC0@As0mMqkW@>Cjgg(? zu{?f99E}o{nkonmPhV;I0lVtfnazn42Vk(#(RV=_LyQEqYEuXN0k;NgmbaT-kN7i3 z!{d?$+vY6Qm(~;6Dv1uD6iMwFy!v7@0BICW4yxO0^um}7+z`|>K>k;E zYEW(_SiUAsn0Rr+t6k6e^Az?3V*}ckOe!>;6hC4Zljn<7YW}KVrh*AsWvsRB88)S` zMjOn%1d>uet?AvJR#pf)CVLZh6E|d4eM_l$e!G@~0@p8QRT$!^2=K@TQQ9Mkg8ajR)+>36`ER{tL3$sNm`I;BP-klZ4&%NT70SgZqM}e_ zJ;R;*m+8~Hq?7}OZQio-1*^cat_X#mVN8ZR8q5dnrG*4=4ucJ%BI}jR-~!z`fAASV zK2Mq^Eh_1Nf{t!XiUb9uFn0#h<(<+>;f^vauT$o`V7LXdhy-NOO@I!yjJHI^@rvo!N%ekr+JFg%49qQ_W6@JLoNyNQQoKJ2p((D zXu=|BYL1_PAnrz?#b*vPlY`pL;b#o-wa*((RTi%9J*&yek-8R$?-D_T`9l#` zD_Bq-F1S2A^~p5zl4=q3gXGxRbotSpS#mle=@W^*BE?brX!y-vjCGqehAv$4O^!G9 zlA_j&CE=LuS3mjCxcz>$(pt{w!QS$NC-p&!nX$BXXB|{RiK<1SJH)@tM@m(b;bwM; zd;1e+mV8O8fsNZ|Z2gT{HRs+w={=tvJ;hv9 zmSH#uF3DiU(^+a4K%tQkAwaT!`}}rvw-RJs+z&f)IPN!3+Lx*GG)zvagl{kgM`}Ox zaXKzX3|VH?3el@1YM3x_CbX4;8YWIWx%W+FNiLHYfbB_V9F_+Nw38NlRvLf&Tv183@gi zYeFN|Uil8}x)LGC{&R%+cJb_i9=}H8Ac$Yx>+F<>Wrv&J>70S{eK5fq?rdLMD<%K- zs;x9SUN!@7I$1cM$%j`AiY@1zjkp6$K}8GpCcEHAYc3JSU19qDgm?@-^<2L|2NJ); z2DaI~tTG{sU$x;Wm)JLa&S1x|kqO9$k%L3eQR~yqjRetlF*-ygA0J`&m?A1`LLqy6 zemDtytd{}7T;S1TM046mzZVwa<~Upwb{8ceiXM7&#hcBPCwDgT-Xt4}qr^0yuY=4w zKXj!N$rmHD&3Y_hii}4fE5ZJQ-{Ewly_bTyIGWN znZyv0fezeJy<&1MhLu9qi2a`}UmSr=3nP-13u!Zvx}tS+3w*tNe{jye}R1IJZ*tFj`DMZXM3N=9;r67s3p)pNhJw!mkL z(H9PCkH-l!mxW6u{&0#caiPdOW?S@nyVv&=?zkZ69q)xAqfT0K$Qx>te5Wd2k)K2X z^rjfMTZCW^luJN@)72L|GBW%QSbZxULXIJRhvWc}d^&N7u zS&Z`m`w0hQ(OjMlGtV|9f^ZTKBo}UC?9Q=_vLOy&{17h7;u(GM?|ZRvdDSr0)I%;R z6(eP9wHo>0{~0-H7z_b@GT~0y@W4_g-0$WTO)-Pu6RsB+w~p`N9kkG)R35WSOB_tN z5zo=H&M5G#aVu8+G?ROi(8XFV;ZPoYx)FcSu|L3f6;+6a@BIVKD;6Ey`W54qlhNMQ z$i(_;WxGUGW*mkebS@3+kW6R`RqnjAi3&5c+)*c@U6dgeet)u5JsordH+qzT)*@q_ zv#S3-XykQ#XCVC5Gw^B~^tXTyeD+?AEoLJ-Z7=6Rhr}^*!yurC?8pY2HKZPa) z$AXnRjC5ar6oLq&j+)2uuEhaEsYd6u4PRq2Fk^-y+M7PVESA|2!l3bi>ow}&BP4}i ziys3{H>;rAX2Jx-TIG~cB((@`kbv$N4OG4i?pQSQWo#cWOr`ALP=vL_4I@r*!*y*a zL!S24%NCv1aWNTFSX6H5m!7#M&0|Y)m&ME}u5G9o`MR^f(HOwgT8{Q(WWqeuy9X7o+B zqg#G>I;pbF?fHsevhwWUPN^6Yz*>x)G$md%gt7P?LkYixrkj~t>ZsE4bCOEvP;FqB zu4zxA+q07&(MxNVfIvc+BDC}H@;$Lz!#m+Qs{e_eBe!sms47ovK`fj@x7k@7Xn@Ar5} zuCbe;KW$c*K$KMdJBm4Pw8}Dr31Vz^R~Yh4xR6PI*-Sz7pCZ-b2^msA`0}fjiytB+ z@u0Rsz4E7Y{FDan;?gVgChj>k?!*+Fdd}BCX#tct&00665r0IhF#haJfLVbs$Szw1 z5v+pD+ys&IO^o+>{cV;HJTFXmM|ADpki~k!$>^QH_F3Hj*e`vZe(^jGP9N5)Gzc)Ldd%MeW3^tlmu8KUAVF~ zK7EfKcz%tM;u9MfBHpsSt%L}jH+N1gV4H?{{2A2aKhkx{yHIU4A`Li`jds70{G?rq z3wD-oadF}E)6bT;KXFh~@2+;5Q@cX(H{U0x1|{NHX;qHD%9iw^Ze>5Pln92bQubuN z)nmx4-WlywmND_uXyU@4_+XZk(?->&Yd7+CrLflAudcq^Rpu!e_Xc| z9#ZC1>im`Q^L z@9Jx`<#oaI`rFQ~AJq6h8!JFN@j(DU5SvZ*-R}dAOSeA$*xRE{P`fA+%|_09 zhE>MTvR-cgN;4r^Hv2~gVTH@E{?D(nbWFyIk;TR=V%OP{@xrgn`ah6vVPEG-@vYd* zQT6!Pr8;J0ao9V!(4yZT5^kj1z3#X;WxH_Nu13$!6^B=H(w@$gWn$dc)mAyXa0Pns z1+P14<^>t)ApYg2_Wsg(nsF-h$jWMCO7HeZLBYj~yX^7m!lcy|Szku+9QF#*>={~& zoij4F9#RMiiw4>aTLnmhvz{G=q1b z8IJ%9tF|iLTIbf-O({8PS3V6gdkXL zd8!D_Jtklt09~N3Pflney=vGdVc>Llt;>%8_yfoOb3Xk)J0BXlGFc- zKKcW56N@$I!m;;5dv9fw>wSHZ1J(6^aU}-O-X<4?mQATQ*9!`7JD#MO8(BD5{?)C2 z@MUY;F*7HNtZ)KsrIi%}`d9qdkjg`Xq`NgNVKT#bT~QvcW(G4JMI zWQZqMZOlDLzwZRSn%>vaH^ z{6tjz+j;)mlkAAle6$R{#ds~ZoTtn@M zYg6*_kVAVxzoyrn6V(~V9h&Ol>{oZ3O%8gpk#BEsj*mIl$4esIPBE?5heiA3?gUm18H^(#X=7X~TQVQ%F`u3kn;~ewl}7{pF2_O@qiDfuxg4%4`3w zws7LXVR&3t#w>tQI&4ueOMcjtE#C3$4PrS=O9}i@uCA=mR$nw%Wv~*dnX~IXeEC?z z_7PuQ5P$>X;*YkftI+%gC7=z1$!|;Ub=~RlrQ>zQK~@l!qB-+AOxdAU9j*&z_cJ-k zan4wN;IBErJ7~PdHA>2J+$Ah3CZ^j_O4?axgrSjd@!Dg;tZb4b;2awE4JWHUj5(d4 zOSL}wEo;9yDz2nNr9LrX$VvpfkJeRIVgS$@7Ob}?ws-=Xw8;)gyc!Uabaa0z93buV z@a{_b3(ffyxSh3$LA+#&kpNYw`$+`9&q0T}cwUW<7uGD@jgR-2CN>W+$Z1(%{)H!k zNg)1dxK;-ro@3Bj|Fc(3wY_Zx%2#WfLKq!Fqe$1+FW1)DsRf;1u=_9-sX+Aq`&YCD zlyAZ>7MIz5(_UBtTN8lAd|(5tZ5$#G14ltWGW(o}tf7j64mcW1F4-M|ZqNm4u zMT0D?B`_2cz7&x+x&J`8c*gg?+Ps#`1TYK{gF7eM)go zWa&XIw>AitG+hgPfjzThWAne+4i9UiUj?cpr>_j)$Bv&or7o+L*snd@=ID8G$yc$j zS6xF&Gg!Es{y&=ulGOU?>nH8wu$f9qOAD;}l@Q1xEv@!KR!MP5Ns--{6dDRIPDcla z>pTI%Nj;_fGraet>zW&osHml4lfZW6?j!#6mKDlJ53a)G5#bIfdY0!W4lg9EtSIzS zo1n>%+?ydPQ5+f)`+=7t9@>*^W|LCRDs-Zvz8NRNOdHTDBkWK2AJ$}dJV*#WSrwvV zW@aW$l@qnHLcZm7f3)tPy^mc~teE+Yz)i965HLrA06$XV!T_;2An?O2FM-#O@c@ke zIXR=%zi5`+oFkZuynH$O)C3xz?PU)hq`iqnS)>G=}e z&YH?9DsCWG;tA-0UhUY(9o7e@^fgOVw_l z_wCgIe{GO_&*NX7^uSE1on2t1?UQgi$7W>_A;IXw%uL!B_kT}cJ;cJt_bV!kkR&b( z36A2^HZ?EvhR*$CJZ9*jZf=r+=Cxi6ZaxG_Zio%QF?4ou@%8ho@qgvA4uHW83L(ZC z%0M%3;e96#nV`LP6|Ar(Zs_ibxAWlPoy?W4+e*jqT}e=U$_dSRQ3KfS!tZ zUGcayeI}OrexyhrO!AJ7Lc`}57M@-EtKS|tsX1hkQd=3^t_G|<;2F$VI{qwnM$j5C zgz>3DeWAS${61(i->2_Jc{>r0m75KRNqPC}(J^jDBJ>B%c)s6J$?2D3g7_sQB+!03 z=o~|feR+L#wpW;J+H0!r$6@U*8Yu=UF`MbE0sr~T%i15WA}FD>*S;oA-6$jUOdtT@FBC5e6O1by4%c{n=Q*m?&Be!v;s4ddb(vJ_1?6=h$_%QFY@ zo?s!}YHD@JL~}nI$fR>W{Luj%+RgHFHu%tG^yR)oQ;y#2Igcw(ysuDGjaqSV9cztP zBbbVd-BC@zmxJRLb~&`OOed@3y7TDuyCXjiEhQg!5<17xBMlheJsh_~t@Bus9@fr5 z+y!fEY(Sxb)39^OUoFOn+sJ8nrybe2p_@Gl)bXLs$GBPq??j1`#GUym*MPAjfOPj zc4ZS>3DwmklbWTmA+rM5I5@*K2IRnzE1xhgR(S#ipYC>&>gie>ueQg;Gt&qAgU7D5 zZ}hIr>l$pI-DcSJ+~W5W=yeD^XuzCoA-^aO+uLI?Hd#Afk#>J3CWZ}UC&75~aIrS- zEjJN(v|9q><})pLh15*fzYQ0wpc|J&11VKSWi*LBfqHn3X>Te=Lm@0kD!oaYEi@*^ z%{PB%F!{vW<1F2SZ0jDq(1%*72rWkcHV!t2AHeTIa>)ry;ozn6jK1-;pGLHVIFf&) z`rSu48mkm6!o34I)31Rb+?0Sy8v<_QXfMi>c;XQCr_d~N;U8uo@gL~JKc zPTcvWSYSQdM0oZzw=*K+y z2$_S7oXQJWA?F$l7zqM|1wz71$8ik_ss}HJ1c1e)Ho)AB97yf8)Y7WIQso;l1QUea$}k zp^6FlI>4L0&&?egyZ-oM1OKuqz6Q12rY%V}=%$yz+0^A>!ukk;FmzDlF!daRl&`&D zj=HV8o9Jou&RSmOA`8RC#a)O6uPt|Z+|S4Gm5c1J-nOXHQ%k!yTxy2DReNbrJ6`S; z2c{46tyZgR#PF~QXOo`p&nx9>bX;8Z78RF#o<9`i!KzZp-JGI^xo4j)+{|O)Gsa1Ar}zU@!AL+f!+A4N#Cw9QA$9C{a#Jbdm3D^fz{eWcrx!}-%M7@_O4!ng13j~Yh zOobO)u3SUkZR3{Q*-ke<$<6H^!$6+io|6g>OrUTBgP6i<6Lw`lOj)7f%#-;=U7NAl zQ>5V(Kbx67EF|}eW#Qv=i9Q@#3=AyZ<-bQ`}`iqMVF$+Vo%9E_Sifw zmgQH8iJWG)g`s4uNhu5yTljX^kva@kXMi%1b2zVaY+G5Sq^Da02OLbSq}_LAYtPq1 z1rN5wlQ7*h(W>)Nv^P!2PihYp=>|U^227DZ%j6-3B7Szn;*vnvfco;-&m%E|MpMYx ztxFU^0MO1s@Boe~4NZ2fDt~#6kv1ACgvROpFee96)!#V?ScH8Mws~-u#Zm>}c0h)z zadiIZ?0o9{$%>JiNlefHI}4-N8Cvt4k^1;!+g2D?L6#k2|eUBi#6DY7QAM^@j&}+gHn1=i3REpSW9n$2Gter zuc{@p>OWwW^5kw79(6Z=Z+BOogus7y)*cvCike zmn0Hp&`cUn+iS|ZXCDQJVGq@U;Jy?Z7uV!=I0;TQGYhXY(pyFZf$bz5L`F?Z8@$vl z%CkP@@i}+QzIV=6`{!CDo82w;DIWa%p%&nxxq!JxQ`2=47$X-T)HUJ2F!OsRSwV5| zEBmst?bs8*N$0kmkJpO^2Zq?E_m7!kBp+9}QFwVB7dvnmS~&b18M)3W*yGU>I02~5 zAJ@aq&b>Pc$p-Px??ototcOj~Jyou-MlZ43hhsu}&J+>0L>KhjmfWYY#>%$Rva5(8%EQD~;A*3%$~jG159MBl zfD0m{)sJfkN!7st@SuLgiQ~N~qXwi1kwp=$63b>P4x>m8A^jW}5CB|-tjyc)6jMV^ z83H2-uQN$@Q#+=|@9~FqQwX~#VC#1e(1yZ*X6^#&(UBS#a&b);zeD~bpB6GVtk5=& z`3k0GyD&6obCk(fh|Eq|nGk$uK9sE0-Q&*Qs$u_K3pOY--|NAfz!(HUKe~38c2*N6 zQ{b?0uS?*sxnKiMdE=AY=9Tli|H{LC9yOT{#j)S9%bQKQqOGGtpLJF*s#;d3ndJPJd9?y;4%zJ&m|% zgj2D#t1S)iS19nBwV8qw5?W9@_=GYQ*(Onm-$ux5eFJ>EjP|>1F5;Q?sBZ> zcs?||dVA3YiWzNfZ4Rp)+;r)o9rC&({DV#I@0I(SA<-e7z*F{a{APY0;aWLs0~TUJ zk`j_MYcXtE2RSPoT$PUJT@EAVMvoB7nxNqk19AW_q2y-WrwG2Ecn9IdrpGxt)B?Hy zbIu(exAyet?MK^@@YsIvxExBbS(JF>;b=tb9YjLSNgMoy*9av;Ns+*7w zAdts{O)9Z z1juG)#tUFdL~JB@Vy=&t;J-cHs`9JaR6~0PG)|>#uNz+#XrW55JE#zqN-8J__V>31 z@Cl+dk(=g(b4M4XS2D7SU9gn;zdBdOD|BV|+(OGN_yYs!xvDBTETm%VZ8S9!!m}H1&K!%b-R4Qts_wZ@*z0K zBbpbM!|DnN`4iu3&r#btx)u+b%AUH7;!4HxG^Ib{3);lN@UGY>J$Aix>B08>{>zNJ zVz;~LZ2GhZ``~&_6!@zTQx4a(o0n z3~6t#9OC*W-B7_ZYPN;{gg%IG2MGyocAZwmRmh4xwmmI&0dn{`IMGF&kauOe=I~Mi z?&#rU&4+}uqf^R4X%>u+q3~hd~pAyq@wyb z{F)f0=A9=hCXVl3SC8xRZ&|3OktDmG07?KpNEJGF4kwFrUyoc(HgHxqhX+c;I~nJ# z+bIUd$QE%B4-kVFU)8yjz4a!qglw&a!DF8rutW18RLIs{syqSJsjPHC@_F$!JA0{m zscd@DNh12SkgMzXOJ4GB4SXcfdqnq_>>X6f(0nb-LV=I<0?zRHOff{*!`C!T1H~qs zH()IbGn{F{KP^{Gx$g3qSMBS!Q-?hT{MyRO3jeXg_mrKdo0T?9(40fabs$N;iQ+jh z$bP^pjX5O@!X8j?KoWjgy<}HkNLCqCSlHXKb9&}l?Ar9XWwATH9wMyJ<*$SMP<-DP z%bTlIoU}}pxuto?_wRr}WVohkt3ugwSIxXek1r~U@bT#`wSt1e%;6~GyxGlN6f!%$a!3$Dd!fO%Fn^nOc{v zl=6(XH7=NFge9y*B`RJT`Q)Vs;}vk@2U*jVOPooOLaD=rb!6zmdv|+UML-u98fgep zxt-+)hjTzTGBY!nOM8NlkkW?skgXk_zOB6@4C0*SVwFz3U8fFGEc~Ge3BLjr{l7JkZ`?knyz>TU7fAAYYyZd9W{6+}yjIn!0qQk)a7QJe?{sGc!YCVPOj(kT=cA z&7Zum0gpbxQtuO-%zt%MC>l$ou;mfol2X^?b^4!*pR5&R9 zS*|RY(|)h_6kc9kO{-1xt=dun!1nvrE?^VLmK-FFP0gV4_&7K?u`%z3uh~qbvmnfW z##W>+x%6`;8MHtlSme@zIsoobgF+<276TGO7zv9k^Ez^h-+JwbDD7Lt?4d%7spn*1 zj16)Gq4A}C_DKpXG&#+w*7%xJQK+1^XH}tqZZKt=v#$aW50DXrwik*6ZS5wNg@Bd;8vr4c*PyDDV&r+h1eXW{cspo+miPB$<78y17_j!DBmV-2-NH z!3hx^5Fs2l0vsT-z6R0EQnY7jx)81c5&rY*j>%5JSbZ)n_rYd%zfr|yZB@5wyg=eK zaS>$K~e3UuMHTEo%>d>CY{1;~6xD^&dShyKhzYpd-ztm#|c>y#XLPJBFHvBA7LF;J2bAt3pDQBju zY!dZED3RxEn)gBAvmIw%*S&262))O>m~~yGeim~BnPT8CEhyc?4KIL$kKb{AIN5X^ zg%KT~2za=8U{Yy20B*>P1peixL(D|$UDZzgKP1KcMFegqVjn&VvcK5$tC9yMr8uq#%X>gMdyb1`*0g zcs{A6l)yHfUc=>_lq68<*6rO$sFLygj;j|m{&Y7lPrCdN&p-6qLSjP(JT@bKryQIf z6iv;Br&?IfFIz>cc7KllBBpq`_da57vug7z7y~fWj{ku32V{cDgT@s`lcw?Rt5(2r zFJq_-52cnauv49~>F@1*E-Fef<-VC&`*gF`bB_8E6kUuZCFt|>`m&l+KRp5))<`(E z-d#>PEop-slq#EFQ(DZp5P^OE^-QVl{z(vllkib2b#|=B-7iy~YG(hqwWACADClKl zlCG{Kz^vy#y0D4mQx|{bfCqYU?jRILvYK!Oi$o&2yy(7m(_8P1uE0=M z--4a-qA5Ure9I>^LU1;q#|L1cy~`EE8=Fhv!Ca4J+e(UsNvl(VzWzQMT3Qmh2)RrW zB@fe_0FYh6St6u^kP!L!1wn%5X-OlZrbYr$5W24j%@_Z%tk0J(%zKsN<4!FC(2x`n z6@}XH_k;z16Wmnr`2g}h=;+dNa*p0FVDOP6fxGk6*IrMD>k3mT-Cm_9cp97~|%+Sn) z8W+6rRA8pF4;2dY)4rqbvIKo-IxID7u^@Vr{)F<#kvv9M_>X%Xz+j-+knwX&Oq1_% zI>2E>2Pan$SqvPz%_*V_NaH2Cca;31Hp!@8dR>pOBl~xp9P<4^enWkHoN12c|B8w% z?#j(s_igTmeC-d_DbyNLcf9uY=)`!#Qk&86XT~7SDR)t7K*a$x9_|OXelAJuUO)i) zb~ND)-l+hKgo!<*3tz3?2Mk()ZsA)m_aErPMLF3S1^xsa3Ay4nLjqwmogs_n#v~|o zUx2-D-iV#Knnpgp=bNLwk3Y*$!oX)>+lg1R0w4RvHIU&hxk)nULN~K|zZ(^zJ2p8v z43$9Tv?_eR<#tF|dpTi1U!}Gj^PUO!R@~t@Bqk~wty_LFG`97JW5+P+mW8P6m2;18 z0rekAOTm5kGQ0L;$*^Hi#xuW&RNeGS+8&9m)xm9Yn%dGoMZ1IXzyq~2P2{0pKAHJ$ zw^)%4PYMGg|ZpShu5f)X&h!!6M?)GD&!Tg)_s+r-HqCZx^L!(xpe!y%h3EJeAz zAMr(k$X6h-d_D#DcX+7WPxc+tVoLY{0W0nGSoX!;a2JY*&`z#b&>sz@mik&)7!7tH zjV(<(xzu&_>f(4F3x(lg3)e&S@tw_UZ{;eTh6m!m3NB`X8`=B`zWC%Ld#QMi8d8zm zN@9za&8Rymi9I4JZ{KJu35^W-sC0t~!&K!7+X`AW-%F&XuO7E4@|@tr;@RE9VPRo` z!X6t(=i#GAq2;f~9KET`S^AnGOcOjpd})sQWh`h?65v3f{TR($r+FA&5&O>un!N(D zTuQ2TmcPD*pEV8*vNBVL3)Cxi{DQ=@yqor9Ec_jRY5?$rty2F;GX6qj0GNsGZ}u-S zp<=rJ_1SX*pH>+?NRJ|DNmfjxyHlS%e?5xGog!#qS1!7m`LjHQSErXQzZB3LU=yO( zMPyQGGSFRRvLGFN?ePt)E4BBxDdzF7(pV5zC5f9>IvXTH<6NPe~KTA-~GV|NetaG?Z z=vU;YJ-v;vTOjhUw~UO}*is}_p@P(U6wmh=uxoM^zRJ*@jD5b~#zY+@2!F4|Ncm@b ziDR4TC?uCL5v7Jado~IbZmb9@p!NH{kjV~%AJbiT_wdnb^^{BWH^+yM*iC%}%lE57 z{8+R9`SlLa6RajL*S(jg`#!ggeM{H}i=vNTS20Yf)qXb@8yzcwMQH~n|5HUq#tB|SAp340@LS{N) zw;tXRaO83SVNHra%W#)UnT*4+YowTs5zFe^7zR>FY~Qa)3dVPXwXWp~y}U;N9uhdR zH21CqXNPrx=hn6z{z?pSna7M!s(`OhE<$D}m)*_Qcpi}VXM565wwj^gk2Pl~Ui%Bs96@anDwAoac^jY)$_Il3O^wA5OPe)>X9~wW^9s zU|~?qZ?Bt3JfM+DlB0z*kVdin4#P4EM(CfHbov|C2Rlnmo0$1ovQnVvBkL~8w6B*^ zSYGcf%k$q|zajkNoH!Vs28u>y&rz>h+LMz@w|Ct9N%#)ERk#0w(PjSJ_rJD2JOPMb zW4(DwrT}^Ict=Gu9h04;#DW7~`@5U^QA)0-fdiOl^4iJ!}eWU&f#G!uRhOSt6K#@H+qVpYFSy+*e*D zE|XKF%3y737Fia{%InO)-#))ozkla9svyiN4|6;IQ%(Hs@2u|N-nt?DEWiJ&9Gx#s z-e!4%$$chP$8u|cjY%+)`!n)X4y69}`|ysl&UbuY{6>AhT)es*E&s}7V1P9^k_hXj z_x6eBYYCO&XcIcyzg-wyqE9}0KEvA~{1^H1$ue~LDmAb2)ACtK#7r62cJ&>K+x9RiCk|?~wB8-ALcY#y&RJtTt>s z&&tXY74e~_qSEiwuEBM$BhOXhHs6QkeqVo&C_rDL{qXc0l$J?GpTz zj(VEBZVC5{iy89Em4tjLMNLV{E0EhG+G`oyTeS&pr6J%f5&`J}bi}Hbxug^ocE&E< z$*pk+?)^kBo#j_a}h z?q@Sp46@mY!%2gMtRA4K-Y6(2prmZnRN`GSHZ`4%s5@a@F*0gwX$dHo<{;7E7`3ZD zy+F-TEqe!ylESCV(2zUp=fAvNujNxc9@`Q4rfYN`$YrX)Y}<~Rx(E!2VZ$NE7j||Y z)riLQtLvuG6QIF-8;0$jN8-m@ zQ#Ef}=B@({;1?a;4gp3Y=58m zF%+yf@b`m@cS_#DfjyN3jn0MSE{FX(2SZ&Uu5kKQ=syjuJtPU#VvG4{%mU!^2Us<+ zdssfr@`{Q9V;d+wWK$!T|O9P%*r9WRCY)*x8|{nbhLMLzb154Gs3>AmFz} zM@Ji)nl{c@TAtWGfpQeQ*5rtYh=h4JfdIRct$E4rV!xG|oD3vgXIRX`T~O?4xa-ln z9ITVFet})X!pe&LvwtonZIPv3%TnZVmBSW5?_ac^Mu~`vFH9Wrea)&|oSkI(pP=w( z?HdEu=>opIH!-B+pH7O8Y;UIn%(*$Y>@k9NYkkyu2fF*+dFoZiFq`LSBi}<5*cg{v zQx|btZcAfOS8JTiJ>qb2={4?_I$Z=7>O_CTuiUZWLcK>VLFDNf89u;wHWYEQuZo+W zpI@HB=fgR+tD3RJ^M9vO1tkQFPGwL99=c&j-`Nl zC*gdZdbyYjY(P4Ip_-&*0)9wpWNv$J_%w^Yu$ue=VDFns?%9I$#e2ODKJA`Kx34mY zsY7A3p~$bx+^+(ga&f5cL>l2C^3KzH7yyf!8hREYvtrk9m99Ob{-a-^(m%(?8*ekz zzHkvn#Vhi1*{T6~dyQ8Qzh;NQBPDF#7d`=g$+;x~sa z;V4cU6pxdBVz6ZYop5ydh;3ByJLcs-0&97%dQ%Fnn)rh>`o8FrHGovk z_82_;2esccwJRbG#OCQOv=73=0IiHiukzAhYaUK&Hm?qvM84*Gw;8`_$O#kAV0;TN z5E7CH4Zl%Seh!basy~_X@F0Yqf+zG8u;QdTPS7=B_yXYs85+uQkLCq_OCae3UfyuU zY`&#_=~rkY@o{kon7IjYk4w$C8R~ZEAVvUp;o|fd-^j!yIduWeIN+9NZ!6-r@+MqB z?2Zb?2rff{E85tSV6Ng{6 zR}3CS@fh7NDJeNyt#kM6AL+>V*qs8bOioVjN1CK+QqR^~hbh(O_V8@zS}z>=&Ydlm z^~@cj0-XX=K3(cf{rlrET>S0zBI)f0a##FtvAewX#jg+6M>>9)jUgKv8tTG=0R_bU zJmzvy!Q-*P368v2s&(hD{C^%ejjwFfAErT!fmWjqAX~sDe4Z*-;JhDA(Ld_dFhkKl zXf|5xH9oFZds(w(+0n(0`N(Ee{6v}wMs1C+k|4>_a2n(9uOgPmQG%@S}u z5L~r^0RvM0DFd(rjtD6MONOX zD*w&zhAdx|4g)R;DOMmvx+~cE&U(Yes&SArDEwYH8K35Vlnz{?9O~L>udpq9UB{)>{!AJPhUuJbo6#od=Y!F$e>5NdCv&xv6|x}%*~3Rpf4U0u4*JehJ*G3I+aA^Gyf+a z_t)yCr!MDSfhNPeLJwJO7Mi=xPS`I4@;wH^+e{aMt)~x>0kLGB@$rdkj))$|e@@ETHQ{~C z%OmMap2_EG{x{r`-~VwCF>iFM)*uh1lAMpP+Pcrg6b#&LppyW;qSd^&l9HD88SF|R zX_M37d#B87z-Xn-2^`7cjhm0lo%jI6dIP@&-$}&2ma?+CvqHEsJU7?Y)#e*$4)8Pd zA07zIFal8yY<+?wB07qV>K@~m`ARAB33jBt(shlHZEr6K#?7%yx z`yN%Z80-k}a(O^c|D|fHHnhTK2`=S@vk;L=ZeUK11oYJ+W@qn%A_4>qv~+a3&HgLk zUgqcTj|Q-oPf!rT>aM)J{DL579)BMEnLbU#f3L2vaXd;y1uW=31s`}m*-Gd$>*+n@ z+57H>i#s0*E+jy>)Gvwxw)1v?Fc}rR_u?X+K>a;0uj>PYhm!q=q2!mJ=jV0xyJDY@ ze2{|_z_}(6#z?@`1i_w$t7&U*M?^{>wL#A90|y1Frv|xOAeGc(a;7hhjW3=)?Gu%f zTKuJo$7s~|0%&*59}4AwRR)0G>uN)a{&eXF&^HawRw{CDz#p%5ytA-?(|lI*U&*E) zBH0Z1E7>G?YA6gw7Osz16^^bZwt6`bYXY&?l2YIvLF3%b&jc0~>xB?m#TI@W9YAz8 z-e11j3LzO7=gy{#1oK6AvyntZSH#=ZvU*oZR)@3(1GOeEVv`o~8Em`Ig_ghJqh zh^}e-E1GBTuB6H_nX1y@QsMf3Cm0O4qHyav-QZEstB}7i|Ns24xgm&AWH@;AMKh6a zy}TxaAu8o1@a9TA)(le~cg}LQO?9aJTmsQw?%w~tHUi<9?9X9Wd|uphm3sN^=P-5Z z*Zj$6G%N>q)!+X2vRDaL5&0$>sxK+vVQ6+$=4+@U1j2s{7>HLbr~3=v{`-pL-P(6V zz4xC>MXZo0RDpBpS*<;7FVg$t9HtHerBu3$(VZUmk_jjAQk*#0h!Y2NJ$ceq$X*Vh5AtzVtj&fwN@(|NV%f-V~~O6ZP{@)vh-xlR{bhCuDJ+|e>1D0XLmUy z)juirjr9N6@o8TUv@%&HYd5b8&g&aMvGdWC-##fMr?dEu4nV$%rM1CMMd|7Vj+Iq$ zt`$zGNLE&Ci#>5xP3>g9Epy-#=Ql8*`-~~gZezmZZBC~I_N;f^=FlzCKTY9(uVuM8 zhl{%DNNG$%i_~_P@YVy~C&$&N7E>h&I@EOVVDz?7eYsn7R2qXcT(rgLazLI|)dENl z75Ae!moMWm{HrFV{K~s~3Av*n^79*C?|d^hLB_CFH!h@XL_yc(Rkb-}J}e+6cmHtQ zY3!R>*OT0wk#Ao9{tDJb%=EO~^>o=Lnb{VzrPpnQCJdJ1uPP|SK~5ZCN%I0+xd>O< zU389RTrgAQWy~ z2rW{7V_3@^Flq!rGzVyOVd2NR(pT*;-PCbu;;^l&YX(lFYW-08|JwCd>c5ZA&W=NS zIPI&i806oM7;~%F35?75nmyJQ@^Uvh2;KjSwM%u5%IQOpVQ@01_f1SRR5FwW$Lbnv z=42*+S%D5M%$N*!%U%JP8=Q_aGq}2H943X{xNm;b0c*i}8J}Yt1FbSlNse+gGKsXr z<9cGO~BY1*)WeikIH2;8t#1Es6Qo^g5Ew=?ZjG+E@E?l;ZehPQAc1s8*_gZd>Bx^(vCqL)U>3+BLDtqt+jxr=yPsR?key&ByDETy* zYHypdgJ`jLZk^QrEd1%`u&j)X``{fIJ zyT-$JV%znSw0~kkP)_@bJXLsNzj3lJ;WBYo|9D?>kNe)^m)9%Gc{L75dD_#Sa0^RF z#2J|xj0L)t^OzSCq2JuL8ZXttU@bwFju(-aos%4(_~2KSzIc{~|rL ztQZH!C+v-F*k`7o9pXz!u+ub6OdonlNm8%PX0`U7lZ4m(Q-iQ{-^AQ}L(nT`J2}Fa z*9CEmiEGC{PLWT?KP&_1+3U}qyR+rj>{FPqnfg+tA<<F~DG%Yrw3cZWR(8-4* zDNbEIL!q5wY5lX33--yfCf}$VtsyGps1*gLEi%J(@trxc zVoue4*c;GALphIpnAR;R_K=!7ILhfbxu3pyyrPK1efAon4%uHV`CbwgOB8R603iPp zwep@51w?z5b&?ip1a~YXrj@!kUc%!_Uxx3U>=(qR+~7@~ufGt@a1%ukiG*MFom6@% zBR?uq@^fhoDXOle9MS7;4+8m=D*|~>F`+ZIY*(RN^oE(+egllrUWQ8g9vm&#^`vK3 zgx^i@c)q{ltZl|L@Qc0Bx+?;@!7mSuOl)Kn<;DF6e+28?buBf%I>9RiE}JoBV25)6 zB9CLoCT9#1E+PLx0q^8cR$?}r>7PtUe42H>3~XE97p#-zGLN)(rD}(ZuVy!qkdA~! zV)5&S^}o%E=DM|0lnfnqSei5`IzV{t)=iPSoh@(Q8s+9?-1*xCKY}RH>pj@op^o^3%F!!!v!wrPWtMx6*R2Ye zU_LTXaeZ%Y)7;gm>h2d2&7=*b4i1atNZbDs9{w9_1)0o7aiPPM{VIQ9e`qSHrhzGK zU&H9>KTp<1yXSz4_ZwTG^7gi585@t3>kavw@^82D>guH>LV-UvXJ~GuvxPqfrPAX{ zJ^BgWnq^xqTu*G$o7)Aww0kJo7KZwl^*TJq0jE(s1z}|ApMk$OBaP(S zkF9s5fYD+P9!C?W7`@|t?U=RalGcTN;3>9JQt%7VkAr1YI{ zG1MLKQA;TXkJQyLdYW~o7UoHeEGb>Z4|JQ^>tW0Nf7dMD%rn|>1>J1sS z*a$)66o$KCGyU6Yl~|?RtUi{a2YD|yYGL=dty_W^&jt3)j3v-<+1o_zL7oM=7OUIa z+XYZ+{W2f^;dwa0v=@6w22!{17V_Gdy<%K2z$JGr4iOZV`WzbGec{riHzbHI~FeVRzlj(Rh&b{czvNX8(;T%A|lk^`H6O|=Hf`0<4f@M}A zRVC1}#Eh(vflKoxY0#KMQI?sK$u0?o%YSTUW?@S}?#^>sSYH1zx6kC#tlKAdg8iuM zNu=Pt;Rr{0OSVNDTHLP+G?rC04W$+1ZobcJr10Hx?lHuy=h!0QjkEX-ny~l&1ZN^n z{}(?M%R#b1Po zEh;HWNlW`~QLqIW6i)N=nZ{65IlF0wq?XoNH5zRU(A@=kI7bWt48^4Z1qKZmdB3fTj&HrERENdU#7!9vPy`JOdMoXheX^2nXRmtkR)Q%glI?>clTqK zH|?$Ghef4^SYHU!qAQK_7aC1OsIJ&mK=_{>ZUYGhy#Be}=N+k*xch&Jxk)3NVf4g{kKae7UEk+1awg#>Na#oiChb9`<_D>+9n~L3bQIqO(phte&tL_ z!0|9zDFmlBdW)3Om9M>qmInuYgM)6$J%>$wE4E=@zR18lS+Ud<(9xcwVt|CrcE&Rw zXo8r(SFA#WM2u zmXQlJSuqoxO|lm%h&Ay3zWm%V#nJ z22igqeql3@=0$%CyFmH02@i2Ig7_Tq^@~eY`D-v8-PqwiWc`40ItnB zlW;QvBf~xg1rZlkYa!BnJD0G5&EUDpG!yk9p&Seh{Gi-t6qu)4^(+yjmIvm-p ze`TW9l8;u@UX2WM#fX;j;ls~SOs=DBB`RGTw=JOP4~G6#W}CgfR6--17D%&mraU{} z;|TT|(veAWY8u|Xzj5$^V^i6h*bco5iVIk#sNw<2kkECc@uGP)kR8%Tc!N^!wndaU z92TIT{8bugC;@rO7=AZ3>%(BkNCQ+Pjb!=s9=avhg6(afQg&+D&`S>N#C!ZPaNfPE zHQFPq^|%RaQvFb?*Ev9L;l}Hx=4J*ak{~7a8*ODKPENvMoNg*{GN)-N?Hn-n;D$MW z<1Rx2X?y%Fd=1S{PVH>av?r`0TjLQNZ&VZF9Ce=p??L^Lq?ZoT=20#iexqc zf#;pFbPKoaU!@qXe3#cXFFRP}tg{jmjU;g7tL!&w7DMHbpn;7`2r@jdY5cpo2%k^n z@5$JQauL1+@Kg+0 z2g)8qi;CV-1Ie?`SEV36GAgVaFnBWA#5OJ~XXczgpOWO(c96$mKgDS!uLhd)gpZwb z4d1|Oa8JY1?u@m|(Jr+KK#EPKPj?P4cUzL1S-z8(SC?dg_y}4J>A;u*1BJdmdh=Y` z+(pxMbBk#nm-rHcExt+THQrC3Zq>=jwPy^yxSSZBY19IjpKMt=T)}vYfRm^AB2`F) z2))6764lv{>HX-^t!NW@+*=3rdnbNV4sY8GeW;SrmM9a2#KoRZW#rZO|FW~=HriU& zZJWI=7$RqRVFU7}Wb>+@Hdp;4DTy?Mr*7mSqX#^BovW`eoxo!{wHvp49IqKC1rlUR z2I|o2Sc%6v9I527q@08Ob0G2KOS6-V;kphk>MF+VtekSjZxOyHf4^aQI1sjph*Vp< zx(U8apMVRdVKe#f(C}dU$zY{d4GV#hm1+^p+N)y0{}tIjl;79R!PCweYMu`C-z!iJ z5_NS`Kf4z3k5~VIHAJy6jD}H}QK|5%z&w0)b&wTWpz>creoG<3^p%5?LTAzf;pHzJP!JuG=I-lW*u<)2Z6qZ^1r(cXms&i8?MsK<&<} ztc`FsH8ph4Q{4{)m^<7r{Mkh%0$?CA82fa5WMJFgbRq8>8xsd{{fr2K-^d4n%&#yU z2~rp?5)7D40oMpFO3?2ic!IDG7#|0<6j#M<&@zsX3xIM4iI-O@D_a@|4F%bfD-NuW z=ImXPPEoHQ{~2F34r)Y{uW4ytFuXmZqg5&^KTZY%6+I&-t9fSm+V{16Id!*a2=jxi zC7=q}K0SvCXBe3+3)b?=%91YLSKo?IV!JVT)aqYNaIG|6kH@v@+I4nQP#gkD*IhT$ zl&!M7Jac1XBIsjai>f8GJ1*jR$@+&?<}1K$d}! zVpWVc%z_|0tuhTSC>`9}k52c;4^Nuhg}Tp8Z(1dTrU>-%vhb8+=ReMMQ1~|kewV>{)Ujk}|#-!U; zgKT%1Q>zntaTOBG`2y_#nu|F~yF3kU@7A|a>PL>p;p|5{9bLfm7Fsj3*qR2H4zH9dTuJ3!_Z=G}gIcuH2&RYAA zy>-Jp^E~%+-`DlKenBF-xS+0|1BoSZvVncC-Y%>K9*~SJNa(u22_4n&y{IdDs#Ls;lI^^c`5o0-yF^+p|xAS$nX4S^Q5p|*6 zqLH6d+PFFQW=$2E_dC1R;-Ma@!H27-hZU#@;7apCR|N#1x981gT7mD7n{W5oVFF+4qoXe zYwUjQpn!r<5=b1=z5QO2t`=uopeDD2c-(vlAxB$N$9{O66r|`4Z#^c2{5C?S?F3yn z%qEW_np?*3!4X;apqXo~KRH43+i!BvKi2NmKbaW^g8#t$TFc7X0+7Cc5B_=oJR7gv z!0RDx1YJvfCnY^SQ=#3&D=3&58Cj_Yo(VsE*a1&5CMC8V>3byh=+QSR?_&LB?*8E^ zk+ssNUc);M-ot^Fo_OW>BCB8sX@kj={(<>_?Nn;_Pt*B5*Y1g=M*$_eZhNBQMgCA9 zvOu=*Yc5ARbN%51ut5VCtSEZ{uM+0wfvMRUDL+i=Yg#bhXhwsCnQPAN*PDjv>j5b0 z!otZqWAz=KRTNcFDx_x3;a77}k-x#6XIh?AqNm~LEx762Uc=6G9tXa7>m`@n-IFdP z&bQr(`vpi3LVSa5CVz&<=+=cE#5MpErR04nA*fVLy{pzd^b_L6?mJme#x-?x^i`nO2$~#?-dP zMFixVnWsM$6&3MTM~Sytl>AT*;HN!sT@($Xf+E9_4Il7qfvKQ77FH+&@X-KlTYb$fWT!8ri-Ga0BnWXKD{fO;F6M10^A5W$a4%uT<8%x22hixR{lwWo_-&igy0H;ostBqB!BAbIey zGWhdNf1t%$>mrCo;FNbR19zrQPFve+ zC-|kIp$NdweLtqXaL59!^7z=l_lW8FJG+W&6+u!6lD^Ek5(1z@wWSwj!M+bm3ZI8I z&#VZ^W{Oafz@%BNSPzV})PGM--t=L=<{$!F!D3UCh(w{ zV-3VhNdRxfb&>*3q^-kGM0f=#IAiG6?7dW0Cc_eDea(gmvPR9`H3*$N!7PmMyB}Nu zEop%sA`(=r{P({4dwPqA!o-$DM5nhyB`&jWgnb7>B}$*#tCy3Gl!C_;c$+Q$?YIiq z2tF1Ij90RM7WsoYA4$}Rn6Dl&em@E#O3p|hE!%k#D|^wd4l9zQsJhi~xl6NVBOE8{ zg`;JXieo;Qns$zh`&zp%S(H*ML41$l{1wvYm0u_2_g$ygS5`{g%-lA5dwUURpERFz zAGDL3=g%6K?JMl=h3)`H7oBsbZo^FnF#Ry-oV+ z5!co`Vdh?bhhBn5k2)*eSGdw?_{8<~>wl(cSOn=&kxr`c4Ik}nl%Kcd)lT;by+*;t zX?#?6ot1)7h%QPiS5_Xz9^oUW2TX9*t>OOOpEGCUkfc~v_Pr`QZhzl5>uaEl4F0Eq1!L6u-a@C+KGggtLfXa# z@s~dEfNE!B1vX*){{UV7%r;V~1Q!!<4yOT; z<;T(5tG;$}SxB!e5BoPiijfe+ zj6R&g%`pD>!PVY{93onpX<)3ag4`I7s>;j4-i|Y*E-t$xPwDTvJekY?a9Kq^X3}=4 zk6!4RuO6GP-y12v%`>1<9~>HSnw`536%#|2YhU@e4P0{M0T#E9r8?c%-DdoXt19Mc z9cy-zcrd}rSDozVF-izNZdIP;sdaU})iqvxj(;l!y7jMgn_YvtWO4I_s44eX%rXhx z=kNA>Dp<^^(%JHsiYD8fl9JFb4CP*HVGDAV$3;Z%o^$w3S#MMw6Q6+yTMG-D%;I7a zC!}ssNdP=q=Xm1{^)PlwIlYw-UeL=>*{^B=M1@d zh1C06^z4z#EvzdF59&ycj*fs)02aAPLPzc7VU7DK;j?_c`?{#Z*-R2cE=qiJ`-RFu{NX0=aW5-x!c-@04L@MU9kITm{! zOdPn}dfR`7ISafs&eYdEP& z>@fqgM$KCHvsQNM1C3(Akq$e5La$pG0*@w2(lD1 z)XoDHKv4mu8HBz~ARGe7CGG6!myr4<4JZ63GtsQK$jCN3{Ab-9BB#h1>biD1e?huh zOE|=2bPRYOtr*^tn2jW|YGY+rN_|Pi#=ZnAYJqcq>NPzY7YjZ=zMJjmCmg%(e#^JA zs2L-EkHAF{GrM}+cTI_NY^%^Ns7~rwXvZ8T^%CxxcOo24vVeypF9fh^9O2v;cG4@1+_FIFRBBCCW$?37N(h?pZgRV+B zSi5(bn6_o*Ma{NADly!A5O9KCk`CDTYxc11iA+?$lp%Q1miYo0i@nsqvwcAvXL(?e zmj`O}*W;vz1rM%5Z;=9Ht^qrvH}&}AQBW%EEPD$%IfM-T?_q<{IJWxx~cN63d(E~VPxS}p;e-NN)%F|l~+`>u#@Bj zL6#QdR4lbuVq|(sflCX%DdoFo65lgXRu0RX&A41N`6D|?RL zZFbWv;M$y|=KVcB(v~df`cfyWwGGqR1(tCdg=(-u%G?B`roFtpjwNF=h3QDZdZaAS zi?6k<4K;<63g*`HxUcr_tCDOx+5PnIzpqNPRTc=ZS=6cca0?efD{P#GT0Sv)a{tzx zqf6nQ@6(#ey&NIJX%+y0KpG0Rb`nxj6rexOE-qH$rDMK-|J>$b2RE23A15 z*RPA@Kvb0U5yX@~uAA;QeH=j5%~#+H4m~hHY4A|D;PRkc6ZhnGd=@4tIG=Qe^Uq(CweWUytAF9lD3kQew3{gKR2rj)H zD+wjj6NmfK(h}(Hxp~FB*ZWK1W#}Ic0Tn8B8li(bK|MU#yU_KNk4BN4^|s=*ni{Wz zCS#@T77G0zw(F0;rGeYRpcxQhfrb*zzbsyFka7QQIQ&LkUOeHAsCm58QRNHCA(zMN) zQ9^H!=%xKA;T{lD$m;9+b#p1*Lz3pN#U&L;3h?|PGC`gY`VUVw^|0l)%l#JfByMLq~fujG`JQLC|j(2T|6wnj^p6Wnl>bI>lF|^v4ku&MI!;O|aTZ2_i{^T2y)_dbhfGBSOMPmFescF^Uj^65NrYblSx zM^>ZcgnSX1+|&K->O?>Q>`a_iYGiP)?lFC{=sNKzP2%=qT38qW+TE9|%8&)Q1P-^2 z$B$S#!5Vasi2aAp{gyxzv#flJ{=t`X^M&y9%CBBMv$Z829o2+I0d7Q!lX0F9jokTd zT+M!o*6OVLR-Sp1aDG@zIK_8^1|goQa{rUs34-mY=OKR}yxj%8A|oRMvrGG~kAVdm zCAUgP3u>&Lrvx58ybhlGZx5Z4cw9O|4mOuU61YE#6WBYHAcc(YK^>BiQ z=}U5*saaM`T&j$g7S;ArkJ>hO>9<541tL+XNy)nG44Z<+9saCWkH6G;b)Z0R#!&YI z0(K|4?7>O^#_RBy!iVzJAPMuf)9CWn4`ChLOHE~-xvAuYgv_|i9Hr#vW|EgWWMm%e z@I}?2$DUbQUOl{6WxRnS%WTx-@KfyG>U4Kd>!h9511C7+RkN`0YsCymO&Kjq*}z;?3nM#|7-qusjyxeB;#@OnoV>LuABjy#O z-$&<4#@AyLkOu3YwDWQw73(V$}?u%V*a;VAv~eD!tR`~)36c{o8# zU+!*gI0q#W?kGnir(uc27d1^oel_p~hzI@8&_$(pm%X#|j41*k<=xwaksh6Nh0`~G zy}pp6N+&x>2yAcIn=&1&bHwYXMdz@TpCgkjpHMj`Ty}XpzkKy!z368m%_o}v_$bCF zcMY%4X@Tc^_hR(OZR4??@((>|uyOW$I ze2;BTdi1eZ&qxq_d0;$$u*~PR^T*tJau4t43g;99FK;sL7h?>`icBE8d}sTJ#DZ1_@?T7LG!NNlnKhLHGevkoMl?*NGGb7{oKhK2vU`l z=!@(39yff>m^5$RCA)Hg^Y(2g93sBV@Cjmibzz=yHbQ+b48dw#To}44nbBlnVKMJ_ zB3j=9hBZ|7kWYG;;CFf%oSOvlu%XaNL71<4sBa>N@zE=_$MyFY?Xn^lYasq7u*VGO zl*Tl1lA7JEqB5pGg#KgHdO!#4wz-{^Qc$K@^H7IVu!05+^{EkRUNG4)hS7^ri3V7x z|05wWn*KVx-iuB5+hQqF$wIjJZs3GE?tp3FYb=-D)S8|9wST45&AbauKF5?)TNa4b zmL8O6ETTyD4(ZH5fYfWNny`k~_e9x)Tf)h`7cSZB6}vSD0O9sANtErmErUmwJUIT_ zR2rNDe0*+_d}Z2*`Tz17{$tqM>~e?X|8+CKXUz)x2CEYk`Y;f}DA-BLHyC_)cIP0@H~+y^|7Ql>-s#Ak znv?S0db(Q@4NKe8AEtd$u`g}~ei5B@fJ^0k3=HIH^wC#du@FvB{Mqi$5b2{oAmRK% z!N0goMhNKJ?%(mnl`omMR3OuTOk}pL(+#o~!)*P)6#@o$C-2z`Jw#u{3?TZY6z1!=$w60QMT0ynXcjKxOeX^*Jl)rxp~9-HpCF_CbA zEbv<=*Kk1{nS?UT3FT_*-RL1DyFTo2TqURX2kzHD&lw)DC$}ECSiwXC{0aqu6Klws z44T`U;J*P1bUo}mF<>?&i9Oa;I67!omr+ibt^9F^-5O~Hxmj>rY@7War4g0!K&R3@ zskPP2)6)}R8sohJ$h{b7wN?Q%ytr;pAWEn<5L_60)39&Bk@Ujz7vO7!*q;dP<2zX^ zt)Fg*Q4)m?{5(jV@(T3I9UG?)y?sTF4$k;su|k!mD&5%da@|av&(>cHVj3aY2U#z4 zUbO>p)4#!>a&eoI^U0HUeXqq4xcsCy?Mt(o3_;tMo6^PJwPH`T2+?m1-}<4D)FPLH zHoXJ(e0DIDJ_SriZsI%qWYazY0d#uq7*$^kz3)+6Q*Ke-!d#0bxVBC1j&nHZ3hymQ0cnF>8YKcPwG#39i@nf9#98DzGe5wby>`@TYaIrQvZUnb8yyUU$e+<*_o9sgVB>U^k zf-K<-(;r;x@b{^|AKw@!E-)S*q+<_BWE5qq7j32xOJZR4lf-Ms173ei@%OKtbzfOn zpQv_x2v~={S9){$FnE}Q;Qsa$1G{2yKn<@g>{o(|TYVz~U&Pw@JWnnF$P<>q;de^2 zPL$cC~GxiD^SN;_nY*BUtSZ3&gz)+GSmz405^7AkreF7vTz#7vnKL~sNf>KXS zmyJf!{d8G?IFs`w(x};l>)Wn)r+uZYG(oXkAuqI4w~2zTZ%0VFoGyEkW%ltI`7p&i z6r$v$RA}l-l225SlxG@Pmc8@-Qq#ycW-OcF=87TVrSniCpPiZZJ-)0~q|ph*9I#wZ zj?r{Wy!EHqo)b*py^wlPTRcqW)J@)3?W$o*2oDM}gF~puCiq>Y%!KpP7D#S*0ru$B zg08-WX)39-y0u%YC}_N2CG&F3ERHVe&BdG#F7tqArc?bYVg#k?H!`ZAuP>UwHZtQ{ zQ@${<@eep#ib06-=xCC)*WP^yAJ0)tH{MS})EskA?gQXM^pZJqn9e{1!%}40YhzPqU$|Zd3=t3?G=9PNy zjdpONJe=Cth-vuVkDwY>oPUpuw>cr}pSvimhnPYpx4X-6GGNRUu;R`LmG62$?|pb! zwdQU`(bH21S}e@i9_<+zYCCTJzW#5e+k7cRgDqSFD%_u<+&U9lNi_B-|# zfvffaEE!mX3jqjvhn1JR2NX>gCIaYyDg{PHp!k{j9Nf_G58Q!?^R|~RU9zu&e{}H8 z+Q?EyadA309e8>jEw8L(*VH5cs9IfJ0~ClafUp9I0{l9c*9McSGjcY6q)v{Rv!-m& z!53fNSRp9ROh`+EAN3mA-QVjQ=dD%1V%c=qDA-2MoIih_kg#$HYftj+cmcz~x7;v~ zncMZm5EISr62tr4`~ew^Txz2@1uH+y<#Qm9IoD7;Ece3O3;q>G5WoA!F6EM#OnV;d zt{=noSz4lQQ&FA!weC7FG)a`3bO2#lHlx7V0MTcaW43>jR3tD>ENm^n_8^93m*~vD z(k09Cor{BXm!3X#fw^|XXc5SzZ1hx|!qqe&cA<6M)oR=+yUssy^9KUq1AzS;#=UGh zQqRt09KJNzHb^Po0xrLWwdL?tcK>H@;Kg4*Zs)0-3|Qq1wJcnBt*LU)`!u}iaN+5? zjkV?1l9D7y`GET?Nw*z8t4F5L!wRZ#HoXF-+hoN+(=RVqU*6dGQkAWWN0BlKDd2G5#Sz=J|Cm7Z=u|%{th93WoV?u<+M_FId%wl4~m2*-ck2 zRh5<|pZZcfEqB@3-OV47vY`zKNaHjN`y)ih?lpz`0Glu*j-*{*>YvBJ6fkmpU9C8L zahP*S0bL!!!@==+A(V@T@}+0jhYWb4(z9y*Cwix8Kokl_}DYiL?u5*jY>d`2AMPSdFE-E zKliSNWo({KMJ@lX5;4jy_q3=v7_fT%dajB>58gf4G^7BAj}k3W4d>3BZ(2sJtW|9f z4h=z$lFakBF@?xFY2a}sI;QD)zb|bz3j!%Dhvu7T6yJLxojRSyl7 zYmM>gjT+Vpc{%$!{8$JM-PoU7%pB4rB$}n%nS*~^N#>|-L$*lk)0wZu)7c8b2p@1G zexDm)VTZ-z+-$)amDPa>+aZ&kjsYaT<9IdS=1P>bbo367?3q%jNZm!Q-9& z>5*au{3|&9>%rM+a<&9H7EwTgxB6L%OOLTWXJ92^@Z+SX`kpXfxNgz4ytCTgcXM!f z7+!{dwArd_sq@*Mu_OKFN>yrq`dsdrt$kkLUD5UQnXWEkr}GAHYI0HAD`+sS?CK*( z_I$g$it8Hmu?y_=jv9ceTl-;IhYNLqLG+5{Mdl;pDR_lp#W)Di;FGtu6Y5RSby4_N zHmg~jXVNQSIBdX#3y+Mc6>G^rkXSu-zwJukuN7zf5%#klGt8%LWYF<3(0bIHgj|jW zY3*~i!s~-Evxxav*+Xz%G=s6%A*%kE*>{)TPZBhHB*K+R_robRdlkd??yTc?MC7EK z<9K0LXhrLG->DKf;(-)1-s|R4dftU0A=2t$hoe?PND!VDUtzNXClhJ zDc`zyKldH3@Mo^_tw00!sm=P}`f%qOwOD%!>*u5|y_6&#{VK25Qp*2xcc~M+fDQ|I zDI=nhlIu=cs*#WnbZb{LSw3@#vX$*7G5UCnYsqY8m$<}b{Mv7V+8p3Q#dm*Lt^cT3bNL{s1& z-hOZnM39+u#@?7K#DM9H>x~=u8G{3E(JN6P`(0c5pRj@1Ukg+Qhd=JWQj3R=4o_qy z2RP6ZW!5q^PYWq+M>tvNhI z`o13*<}*WpQQXM}i4tda**kc7;08m&#m?Stsr#&V{A0~_C@sSq3=G-@#bso!CvPCa z3&-_d6(5pTUeY-MGZ*}^Z3C~ktmDlgO(s-8g2e-eK8V%FICls zVRQX^Y;2K{V5Q0W3Aw7uG76Uq(82d{Yxz{IbGZnqG~Y#!0*u0~G zfA2%g4Ty#`p4X*LB014@|Ln!u|C){cnA8RR;Ibf4#3UY{uS>fRj>qG7!!B}oYwjB*wrON$uYTI z>o(n1_OmSdL*g%3f`1nmNv|A$v*oPa>8koz(nKqgLCnu zOB9!B`^m7h1(gOTh3__MwssO~&_DIKJ3u1%Cn{L~}XWk7auYS%9z&fbWwA6VP>T^d2Y$J5_n2LP@pbu3%GF=d?tY$&$s64dlW-| z#*#4^cj{;Np3=|C3e`%J3G|i8gYhv})qOsx<(BE??JNrP-C8}n?gMomV=5;z7$hqIM|opf61oe%{q9wlb7BFT zk^A6<^)R~yk`8Sk=J5mAaBnS>{QN$@?l$`U)b-4ySJQjIS1U&6cQf8S2e&KQmCz(rv(obT3TJ> zxd6M@ubX!-fNf4IHW}SIkNJU(sK5gn;oB6FvD?6*u#@+u*&_P#AnenAUsV(u3PL#I z;qt687#Qasfn6IIJM(&NzN%h=xPo}8*oA_a#$sb|`$LQtb_<`A! zSBHih6Poi==$4+2S;GAy;=s+o;8oRIfp0{gU3npia1>d3XfF9Z zRtZbZ)EwuUm%xT7GW8%O@Y3MUid+#g)WKU!MaD;ukZ z+dgg(6_Fk1w!3=nod0LrG#s#34o?1B^rqKK10vb&?ItHjO+cWCugm{_Iez%K8^=VF zLpsun-@TLPMu@Pedfm#Y%nq^fEoBMpQ^a;*ik#r#s#>+@^w!-Ytn71**|31vEK;vnz@v6HOGU4%W5@;0WP#ktJYdwPCFDTO3V*q=t+i8SjDeEHZ_A2wWC;J_Ikcv0z0__{Kcl zC+Y25A$V3M_VyoMNH?JOxBH~hIkL+V^Rn-+dAgBc*(f9~UL+(U!YoFnx+BEEZf+cQ zTCm`LGitpEBXDnr({l@^14%Enx?wEU`ujI2Fh7T;h#WCu{xIUA$}4z0|2K~tPTm%iCjkA+LPE%-FrpTBDgyn7hxw9iXV+I1WzGN~ zQ~h==PaQDtbvWv#_`9_5Aug_iTU-B`@-3K1gu#%fASrIlXa4UBw@&RV1(>%5N?ZiW z)^(Wm)l5w`0WM`K!4C+2?Log4uthiF2FRz2#BKdpfd)Eu^;31Cq4+XwGG=db2|r*s z7tru)99b z(jJG-on7X5s`c-_zC15o@$qsik}of$eLj=E;sXTXnP^XlOPX=ub$m?$LzR~=b=nj3 z^?{+6uHSM%k2^^S5&yeyx1xb~3wfhrrUo z^i4Hxp?0s07jrlmoTFEqu(no^=%Dm(>vEGelK>f`SQ~zu{ZvAd3D3Fjx|YD_a`c#j zUH9vcA1N6b&o51EaN4{!T1b@&250u3alvVofmYew+v0Wg_Omx&IR z&&tQK%$?I?bavtTqn=ssv?&C`Fpt#FyzdBY#B)RinncLR-bJz_Sby)5)TKa?>@xP>>-zA=< zrD{a)-z0qWF7^YJrz8J7I-p(h?7%| zO+T#97khD}ti0KG1(Y8@Tx zGHMMF5_^KX;@66bC@_T9KUg{Vc>kJ4opnb@Fwb?EslAFt{(_8_!6%28?}CF701w+6 zUg+%@dg1p_{2G;rBXrae*C``b`APwNO!HplcXa$w`E-J%)8xr@!isZ%d>L~Ynj_Q9 zJLUpwOSgrGi*#Fph^!z30CLE{d0pOI-K~4w3D{1%mY1(BBEQsH3jkV+-|RB`J{RT` zSPPJdRwltpF^05|+Rc8en4`(pC3|*Uz^}p6?t0S%k>=^C=g#Zbs3Q6delrF1?1ic6cT5oxjJ7q7*+{S0AMNmOj63sIKmm^*sPb7Z-+M+a z@R0P%X3OEV2{*JZ9E-6~7FcvaSqOZ!crdndm>Fn-g5i_4b||<`ArLoXI-0A?^MN9i z^>gDYqu(uous;Yb*tQ1aI~v!lv`|p^De?}Kr)_HxBKMKiO*&AJ$bwy)lCH5)BsXIk8w8Nx7!mA`wx!^!>it`-yK=A0e55s1}wPO81$KMgY=VEtK z_Ih{=7mptq3tC73^0&;^c&M$0Cpw`Xdhqzc?GhbVS8~OifUq!1nCOJ4nc&_1pwOQlWB*z&0yLhD;5B-JK;2OrW3wd;Z+Xi;@zw{52tXI{#9)|@ zxXcGk?G8>%bS^O?e?wMkfHqHbYU)M8gl(9Iz#jZ=%BL1!D9KEJ;PEW|)J`b%*q#Im z#e3<1zyp!?_I87fi6odE&;e~_F_o>)G+4u9uW!GwBc8ssW;#4Mp)Xe?7QpzUsrv!{ z&_=X=9$re6|4M)|csyH;ug`#g6%rnAF@;}<}D>CZIRbWxo;W9 zIAuvR^5qXe9Kk5d!K0X2`*}(E%%%|Q(rUj}dyXuurD~+9DN6*S56nFxzMfF<=gSYg!}wz_(P5 z<#&_BdQ==TQI~r4LGu{5r0-7lLYt1*^U}iy?Z!ttc_8kPUvl&5S$7lZr+PoDpdZn|}e%%g44EeQzV zr8UX$?SLG=OVo!@9-O^=7d?bOJXW0X1(lN%On+XZBhH;SD-8uGAS~ne=+lWu)0X9y zlvYrP0j_yRG-__{IZ&hnr_uN$BsNYV2T*f2S48lnVGc`*^0wztyqTI+O7+HOV$bgE zRf`bCWFnwqLtk|k9|gYdiYlTAqSs6AF@u%KahtHYMf1v|tGl}qkc$2Gq?QJ}_oQl{ z@P6bOU3Uc`2!52cI^=qFYa3_`;>yqYQi)+`u(G`Ts_g9_ zbwMg9BqGZL>eWGA3qbr;rhn%WvCn=VUm=bfng-@EdEy!m3^M?+16pQUnjVd-S2xGq z9bkVS(|JUxo2!q6Oc91DS2ymzUzqs<+n;Zx?y62-@3|B?gmiUd|`lU!^g)*E8qfx?rdCT!(_p%$r`X z>Ll4CASG&cpLQjO($nE_BbDt3L$0JUq**B?%y4&p8>+q2uPvb8--%N0J`mjC?2oE% zIu5d}9q^@|uLW~#3*qS1)z!04dqRDK_3!D^XsQ?B;d7qk2zb`u9mSBYS9vE;{?p)b#;C$VQ63|{O{ky<5ZN^EhJEdOWe`B;Y|VX|f)pzAxL z>`@=*?iLM>#H6Iqa8HKSrJaEZD7Z*6RTNjnvF=X?+}Du|`+MK0rR@shxU$JmU3<_A z0ev(KLLV@gic>vq-v1}-Z6%0KK!W5rR~p0FMO?DAX1o<1^H_Ab=O%AG>8e=X@(5Wj zN%ng!O7{NWy#1RaCOn43N=z{XnH?b=CXGg%#+=EV!Cvo6Ov4mYf{<^8D1FkQ;?N?T4H!q!=Jo-^V-*8;s<^MuP|ukVUYo3q4E zHx}(rF;AH>GBT#du_SD@M!HEOr5XA8Lo22{NPvP46h?>?mLOR9s(uC@>l@Gdk^Ep9 zT?*3tS{nmC9H(BD8=nw%mjI*dGO(-7qy1Pu`DJGqS%pr*z8uiG!Ll=TzD;yVz5ax< zht;xS)Zhin?Xj^jP?r6^T2P{OC$XCe1Y43`H3ILYfMIpp(KpAP%2g7C7fjaQ_POuHwy z$dPXjkE1_+nE4wl>i$8Hr(mI6w5}stE}_ak?-Q80wlV%Jsr9}DNmB;fi(c->>-!<4 zT6y0JW)3Oz?z4*q@01NDwmocEF#%Q~d?J}uN}O*(I1sC7hy_(u7v3D{Wv!1-FLtl6 zSB_0JEGoDut-6hIUd2U}`?1%b2;j?*3F)&c!3}40Cnv!Lod)?K0l+$7;oWpP?6{3N z!*m;K&lGawRd5M4r#?Z(h0Mi=S7kXuZd}dN?H04#w?YK#M7zlm;Z&p65=$H#=P9iU zjR;qXl)BpAwNcRZ{(0|RJeasI2UBHvN%_`U!X!?iUd$g4rb4NNhbMH8V)`y{33Rv( z|HuyK_uk>FKgOyMdI|wskITx8>x*!fv_B)^Av2V+wEfeKyYk^ofEf*jaf)(n$XJZw3F>g|(8YaR!j&;I5?jCKbSnORpC zJ$-VNP>o6r8M15>OOMF|}pG#jp@X#HCj%I5Lu6o6hh?TVv zTvpAlZaG0f^&Cl*ohtYE7t&Jmo@T)(S=5pyKAvq%!*%D^u$#u;tX6aL@~Hc~Mh!S# zsHg;YSZCzqD0%Jo;*PK}_+@!98C{cH;kNO$O4DZ+-C8r;B7`j2sF+@gf1^JHDhm8` z2mlk{b3TWOPY)mxGZnb)daJIT{hEVGbb7N42yY| zxZavy?NfC8rwp&O-Nq33zIY1Cw|ta6iD#u}c>ttM7T5jtc%^fG*C$=c&L^#`>=h8l zHJIonI z=4XS!RJXmZJ)lO|d1Bb^s-0+;y%s@Qd!3Ck54lFc9{urSBdnuCztiby3{alGR8){S zRXX1PQRH_r?U$MCHheAr^PMO_;OV?hD9<&VDcbD%nyLD#duC{4Y6gj03tk)B6@gdc zUE4f3(I*AdPrUDY4Q>jUsSN}W5(>TSLdtvkmc9e|bQ*j5(DyJr{T$E`?W}|Y)F10- zc+ob?j<-aVIIkE%liM{9OLEFGyCx_2n8)Vc)2H_r5h6#PT(|N5=$fV9B;Qf{=r)H% zMH_nWY|OW`NXRD(1j4VCfuy#Tl@-(7Z)C>M{oA^ViHXsOV)#JPmVwJoUx%;1` z8AGK5knI9@Gj+wMI8C`IIgCY-urIAqb&sek8yQ?K1)o8Gz5V`9v39UtAN`-V6TuR4{|_dP!xl(7gT&8 zJ_q2n3&_JT5dli@J$`{-5V;KKV#Vwcu#`Q5ZuHnSP>B=QCTYV>LKmd#*L3(IB zR+fkV%b1vm=_SS~GvnTrBye_p1M?cQ?!-&a9A6q8v|8R{=M5%8*)hY{Xq+ZWC)urR z8>@$YX3Nn@T0x=jXO~$xeMu^DO)8M|h4k=5qNn-lFSTBtlotV)tg&f0uW4k|#&wOD znmCwIh%hbYLQc#(apuraf_wLwfKDv!`0_@_Lm3DQjQR8l!X~fg<>i5g^+$+@1ETWE zN}fqpc63^rBxLS_ItO6CV9^}B>oc&8lad&73c8(lo#3zf{J4Yts0mnvg;RHSUiA+Q z?Pg`;Nzk%@=DR1q#LtoV?bRrP_bEErC6GWb7x!2tYd7y^Iz^a*kd@0ywpK!9Ph@G^tQl&nMxVLY2A*en63 z=4@ueuN@1O+;5L_0A-PA3B;ht=|H_B&ujmdZM5k4{{EN1F`SwCk_j2FQ4oAD&XEh_2|(A)u+>BN?(ubWb+w`} zMy2B#C2QnhoGqKul0hx0WqB3&^Uwg%J6VHP)_ETrn4mYG7U5=4qLB!Y`KKWkxI$3W zz0~8OjTwDs*RJIF@~+iL(OqWdaL6a@>@s`tN+$$LS0u8_boQ+W<1w5l>pTSwD;q7^$N7E zvdl$e>pbh;W7Zge_M<<2e9PS+1MC?RQRjMFI9}r6cu`=QPvijgWPI*U&Xp)BBG}2( zfjGHq+LSq`1z3R{qC6b`w)Ea;1KNF}s2{OIJRf|=his2%Vp^Nqv>j?DU%iT5`AT{5 zu*!H&!`u5L#C_HNPhM`K|EP8Aiv5Sg#P%;@QU?u;+GmVf5g^KFrD4n;`bO=y8`;-H zGFfaBtatJhPV~Bkzh+UPZUlb)N$dXoQ`%r}FP4V;cddX{K-*5T*cX0;eE@LmC@za@rjEuXzyZv|n7Dz^b zqOKw<3q+~A?7Ww)ylLXd7GT^9y4%q3(hq5$WYt{BK~)@4#e0i_Y}MB3`CAn^eIR{8 z2onf-VrHBHSI%1Wp#c@;kd^I@%gpz2mw~;xxkkGuMSl9wwLxeA=I{i%z4orI*`k`^ zdFMYa1FSg%oO7PCa!T2EMAHij-d~@UoOXLm9&YPBQDsF!MrPVQTotvnXcm*69z23- zF|6PQVh7|(v}QFtpICzi(!S<00FN-2H2|0ZQVxe%1)Dodqw4J9V#$@hoqULo7ckTN z@t4xhli~R)%cVKST^=49SC=2b`br-@%nW{QZhp5JEBz97qz>4TNN@^r3Jk2QaXV#T zGtv*+9TO|-Q=PVq;dzrFln$)^%vJ3mlx|Rha)KNQJ4N2Kj8as0_+VeI3pa@9VIpMZ zA_IF{(|G>6*f|2lU>=>%O}1_1z7YXEX2}O{CbNK&1#uFZAUJ_v2HGJRX=#Int!((o znAEsXBv5AUK~(TolbfZZr-w2|@BV$Fkz>i#M>(XUt zAm~Dv#UypVcZPeyG-b$86g@uQWJEwhAYgf*6w|j^>=))j<$XF+QO9on;N-5T-yH}w zV&-O@O`f{f^ZNrdFa^Q}pQN*PB?>OX6wEaY=0un!zr7|IyMSr>5KDf{Pyz|ie@mS} z-22nGbi8a|nN`2;odtwlJhJ{*M=-7bwC{*{yC(GA^Di2a?IwZ1-&VXlb&m?B=^CE+B;f}5|$>04f_ zx_z9vw?$~tC4Z~cz0GW=ZrW*@#N8G}4}CtT7u)4?O{|8Q`=%hQOEq`EitDYOtTZ&O z`TEg^Q}mh-Al%MwHcUnF`_6Hn&Z2QtS0bv^qeS$hw>@U(OkpY@<0#9e5YYqS379VZ zQ_Vqi>sQK51v&$&co!~3!6!skP`s-O8e=P6pE#$Q!gctFhM&VA}{x0Pa8A2Ht z9ZjB5oF`4?E!@fU+*_RxX0(Ri?(S?{&!d*-%YjPce6k0iTzX!M7rQ>J9EOUkpO%owi znrQXfHjg64>ZN+Q-~Z7=7-EZDZtzxwKC&`uu|asm$W-h+GT-5P?K%E*)QW3ZplHbC z+RsY?hSm#a?(K@nJ*`mFgT`o}kqVtiA{xsxw|!WmArG+scR=ZXlm=<*pw^MgPwX=| zTCZ8{)G^-^NaFPQw)gBAa@lKk*=JB2S*}JNW_7cQ$+OxE&eR{E2GyEn=`~^y)Lzfd za6{Ah)Rmz|Od25|k=_nWfs@Ov?3z}bC9$^F8vibo_Z38a4n6ph-N#!ShPMPGqZEyq zoNV;uJ{eYw!vRwnbRg)Ewt@mvnhmLfgB)HZ_SDEzH$Zi!YD2esjJ3BTn1_GdBs*n} zF{g1lX_bL4;U-JH17d@_599FbDb$*KA* z9dBAK4LviPNR6IU@h~&BEiXC?_q+Zp`*3jja8iB1bIjx^@3ZSLfVWX}(A9~O?LtL2 z#L53SQ2AixWaRkXR&ndue;12yy@5`jY z|5~JillgzRdkdhf+qT^oyFgMp!~hX#r9+WWDFNw{?(SA;DFNw{MpC33rMp4$CZyx0 zJNEg1-goc)eKTwJUbAM+H{Yz8XWn_A$KbyIab4GWp2zV!-0XA5*7lF333U6WPw0aE zaRglwy#%RYu8G>wyUyZ`LW2vXYI=oY>(Ic=ta^IoG_O*6p?!_A0bRRyl5?io8}iUwRiV}Nv>un8;MOs%4CP|!yFK~C9ud1=5Hg45Eu^8fKBm8G=|XrO|E)VLjn z!Uvn!RQI5T2&EJq<{-#x6ScSzbZfkA4iK*>f5;^ zXFtxp)U(4j%&Tktm(Pb1^?S}VuXl48pvaO5p9WwW{B{==N|fE4;NV=GhLra?qVwqt z4X%LY7-f)-&*$+BtJPxR4-Z0@YK~UG>2fT?nXy-Ye}6mMnEGGz`QGrbVSB?aD2Acm z@PLVFA$IcX>vGB^sfH2j1*pnqKQhGD*eMRr{Pq%qes!k@_Q}%FvF!{RL>rmr23m0B z*Kj;V`YS$^W!M@0T${h~L2~W(v+yVJ7M9_{%IXLcl&($F76D59p~2@PiIB^anrb{b z4=kNjX!1I4>siBC&`jwk&IiP-m`fiS8X0+9y#M;dFrL>oqTVNXnqq6lhO^9h_9~3R zwHc{g`6#$;0#cf#-Uk)}2xNPqyEpHn->Qo}HcVG_*W;qYCWp|iSvk9@npQ~8(E&X~VBTf;T`(KAlxSYpLq^QtVUA!@xmZ_w zx`&NSq06oHA;s}v$MHRVHWJ%J(+(;QeTt^rdiyGnrI#iv&?a?JQ6e+)TZiy1dL>qo85I9MA_Q) z0|_Us{TcWWO}Rkf9ACKypXvqFKw}AzxiQxHy?+4`>zKf9CDLIE3SnS31pQ4Fva&98 zoEzjonj&rCSN|ay6|ya@t>`xgsbP@woN;AHB|ZfC1XvR$M~bg~kiw>%?@Ke<+Op=d zU48=RMXL^{$?*dJOV@702eII$*xB9N9N*3dBqNX32o!GW6K6E$>wko$q?jdSytRgV~j}S4<9dZfN5l>@+xp%n3OPPuIHwNbZL~s{i1oUxAVddeY8b0{Hfc$}3_oep+2EG8AQ8=!F^I*&< zH)sPeEGpr1*uQCBA10YesxwlrDGE6p7(v@ch z^B{N{z}i9@8&munFq(i>l|1JEiDkC`%}G328K!<_jOtnG&s@k~NH~+l#sDoe9jr|s zKYk2puF@@25SF#R1%@ksqU;+Yjr57#qNZzi;JQI5#Guo>6C{s%Fxl>7s;z0!M1az<&8Rx@s>8?xzUs1V?>P5-)sh-fFIZ`c zc%`*xEx4JvJ26hTbBMgvkF24|O&P2Z%fX!|JY!`q)$QwG$QteIFPkq>{gfugErx|X z=-IPUc!ZwYN-%)`37)OdiX&XUc>ykq>xD|DRD|?r%M>YyTZL1Kz&#}}$R0>B~4^+0dSiR3GVD zV$%rVq{5|IKlY60vA6!)vWdH(yMqY5RGtvRjDaE7ly|qo8r<10qzNWb$G8;S!=gDw z@=T^g?oL=(61@Ar>7lrW@hFJMp~xvQvedJ2A$H}92e%>EJD?MR96fhOh?bVuDP_C* z{ez)DAx=~5n`=*n?Ij3?F+?!-{4OUA7U9hC?>W+M6&3PgWX<$E0g?LPw3ht0)XSxa z+dqk#*Fzotf%$3iWYd3*O$9^}gGVWOl-!jA72n{cbaKAG%U`{-ziS-U{;aN!gZWKe zsTT;{+OR1o;=%f}g4Aai5M}97buRn7Gg7_G!BJ?GmAjhTYUeWW72#dziSTDcH)Y-G zY2QvfSS83eMZK`*%*UZetyy8cRZw86{@Eb0kiNnao|xFY4B8{~>?N3_?HljLy%Cep z1v6~{I8FjYQj|ZE%8_it7)?e^)*tj+vzuEmV0h@f@7fVgj|I)npG%XKMe=dLY@@b;qO zIM_Y4o24w8kBU{l=Qr!H&h8(#cC<~EFKA3_oX-gu=duHh2M~D=8M0{QBs%X6^zRJfk7xGRYKGj5LwUo0GV`}rSNQh|vEtEbcHw*{$D~qt}5ST(8y$jks>yK+n zI?72ve+$rpi@&~oYF^O=JQ`4Y#_49#%*I**IFXr*EJ& z{??vFx=*zf;FEJ&5LYrJj8-^-$Q~9@)af)G$a14u(>xuFc_F1a9-7r4xgW1Rq)eBj zn}&A^4j^EA1RdXv@NixD(f9QHuk26V4WDCEbUuDuV&)uDd%98!o!mlm6fJ0VZ(el( z0j`X!jADfiE_C~mM-tpkusge*6;jRGVFxLhn@O_Q9@oo?(=jB0eqyKS9q=EjT~D8= zb0$6%BSdb47BeyN)@_(GG^9JDwE&tkXv}{(?*dWn;Vu)hM~@XUg@(on>g&_mPZlRA z$=v}fYAocM!ks3us4Uk$U3(`d_XFO1KY#y}lxh!Q|M^0A29b{oU2%{-!R^K{LWg7| zI#L=}g@aF|!rA$-x%QkMv`)x%Xh^*bvxh$p!&jk^+ZI%6*W1_k`5|Kvr@t5A{it2| zYt4vp;jU{3Nmxp2cDPCbN2YKDfgeo!u!qHj3c70uU_cmeQc{5*rx-aj$iUh#iM!&s z?iC3g`PAC{#LieWjR2FvJ}-J=pCy;U^uYrfP%iS6mvddd=mz`9L2T_&_}-5f0r_AA z-^5SE*Dq$(-xIg1t&P04UKOCJwUdB_;~RQl#o}onXib6F{1){+dY06)Ddgj z#G+vppWi~)I)8e8w*`z%QO^oP@oD*K32s`hHY|WLCK%Fb!I*~qT1qSpA_mVlwiBQG zvMk-HJCnNI*EjmcUI7~!l&`Kn$*sy(AOb11?e>Xiuxk^jO|8#Pg!^P?qg3#X=^skPN&X7*qSb0c=nPgAmQtj@3o4V$_2z5vUg|*I0D4x7!gr|ixSvg6$5*R zw34)ls6H)%H-kzE-t)_uxo)5~yjoY-T_gVD1tpulJS!*Xt4FDj9dWprB85!K2Kw;q zsw;g!Ym@xxA`}Y_*3FWD+eK<4$h8HVP@M@oBIvE*bpHqz4cK1hp)a5fRR;J*jL=uh z9X44N>T}0H;~)w|yb;KPuim`^bysHAV`wn<4Wsfa)oW4RXQzoU(ghz9f4-@E81N}4Sx5q*fVJEjAYoJ(26GBTr6Xn*fCEmtyHmj| z9+@A2*aK!>zkUJBrg9X{y$hVK^S8iS04T4&(YZ|D9^Hf*w^7euf2iZlT8-t_4hd3t zfG^~C^2NRNQ(x-DV6cy9wk&{GBo6$)>Ml#qV240101(LDIF8tWpXH6Mgxdct=Ud-C zge4I$AX97hll34W8Lo>pUwc4|$!e-hx4AilJKP71x+$x2;J4Aj%%>|TFKXcsS{+~z zg?rO}v3J&el zMDo-s7w)+^Hi!Lc?8U{!fojI&wb5c9kVNpmz5bZ|V2AlzqFw`ccfoI8#L^1K6__sn zZD(S#+F8`Eu$U)#mP0;)1IXi~tOro|eq6+xjj;Vz0QrBQKz9c^{yI^q_r*2{U`!3lu9jmIw4guh}zT&{NB%4Zl<>f$k$PsbA{dIH? z4tTKMzoky~9AN&9od(<ixskU`m)x!+1VfJuiFGH$cQTZsgYsY$^U-axN~VankiuZPu9U-YOpv#6k2AWS7&~ z6r3D6q=c!xR=xK#8{6IYK*+IOKM*>a@!lCd(|kZ~RIaLMHk1Pd6pN*-%V~#S%Pxxmow# z)fDRSBcU}49pN_o@A zin*5HbIg&a2kQk0o?rqCXQV%-?7R6B-u0Tzn)dK^0d4?F>Nv@ay^(1fK(1PHuTJaM zhd~gfS+ki!ec{->>E`T}!mO}^b!bIlg3bbg){>z|>tJG3jE3e8w9RH~B{Oh zPl~tX#iFDz_!W(~+B#Q|7Pj3HQ!0C(P!dpYwgBAbXcleKYy5oTps+44MpXOo!U8TQ zN2M|b#OokkgF68>h$n@5as@6UcuxNL!4_C4FUPUor7ONxugPlBfc z;r-;Pe%FWnB4Lt0@99&ROr?RfDm@)Iu1|85tm#*VbCbT^)!>QOT??J#KMo5{ zdu|6TP_964^@l|bsnqtC72?!J&=DZlhkl%PQ?xHwvI^beofrTsNh(;-AE1a-2fokm z)@|a`!gnnyE)9$N3MQCrGu2DQca}gr`O{=cYrZ?N9vX>7KVY3+++9p3;kJCDHE2rz z`!FBJSRT~|eQm>V9C#|U=R4kr(}bCg``aQ*^kxw5Vl%226&z%b8}?fN<@C+3@I6`d zyPlY8Jc%f%Ce;4NDG2@f2|ex37?qJ9W>{WV?r-k^SrQ)6$B*>_TFuc;=u5~+;B>ci z)1hkh)Z#p9&3BxPW^^8=^zT`tp>mHH!Z7;pWm4HwXN?x09jXON&HqlH$^_njg-^u- zFiBW^c7i8#6JN2@?a(7)vexwWsN!j3pJKB$qoBltI3jhYKxq0*TV&=gLI|n5i|e)W za-e}`Gd&N|`IhYbMi`I|i0$%+L9Yu^tin+S%xD8@8BAH>P7QE8`g3-ql2h#(zPB|2 zlvJy~ii z-dU1`#&`4pT5C-o>^#o=f12-OLxS$po{4^s?uGjVH#fVwCgQkVgG4E75<%l*Ss%Sv zCjKB5tDWfijqeOvn3&k@&6(4OS`zmkhZY_7o_n_lPD`Kt&UFzv*Zcc){I~up&Zm0! z`Y^l)IOGYRUhJN}{Z+TYT95L|sM|32(YT%!V4zDtGWphpgKO1}yRs5|51_7-LE%i0 z2~)V;?ej0l&c2q>{{miIpk6)toLtRu6Emul2Bwv8vezHB$aVnKArG_ z5iXj;p3to}*wI=a*>eB~GC8tKY3CE4XCczLBBv6glxw+MQLoKD>_eYQ&27pKOD+sX zu6%<~tJ1ODO7-VtcwHv!_(ViLzuw=Jw{4Sp8H3Wb=eLqhmx(#k`MhRsT6w-32o z{&Ip|Mi%fvpdkE=_Zu)?Fn|yh&ETeS&`7kygd;oRs_pL9-AwjUrr~52GI`J`_C`E) z{mmud`oo%U>TttnLekzL=L|4e#dSKR(?AE>KSuZ^J3BK!# zvZDtTU)8uODCi+OYOXQzEVHIGyV?U%(pf>bl|D`X(+9iEeWhchkz(!D?`00_kajsi`XquC`gOgI4BlD)sOY%Fr zm%l_t){k?smAiK4BEs?~)2uQNm~iR&Mc{Bsal3Lfd2$7aZ!lsNxk2|YtMt7)4Ir)~ z7qAS)PmB*xvhxksrwY@E(>Z)$o=|q^^_J?5aBbdm*GIYoZ4M#cH6h-$G=(>;9bge8 zMyPlA;34rJ3E&#P--^d^QulZZqg6|~9)7hRj0%}6!M6meSYtb*81y=53iqZ6e%ty_ zUo$AsXnarZrhDo6K-Jqa{m4;SF_PU1Uvxgg_8oRcmG{q^4}v~ zp1rP#rySW#Cle0C6;TUZL#KPk<9Hj{F)%3@E{DuuWdp6yL>cqHUHUekdOIurt z^%vL>p<*!{zcLuf8~oY$TMc@9DYrW;BI1qd#2w(Dos%i#Wnv4$Dbw4VM%`@}>ugEj zG|((2iKzLW<`RTyz>*3_heLmj(~HkJ&YHMI3TE;d_|^A`1Bu*I_9dXd-0;~QamGfQ zGEHq_T0-m)M5BQenB~0t{FnzkWo$q#*1WBdCp5Ghe12?hv)$#Sd57R{NMdBWcCf(9 zyTo;O+(vAQz#ol}FHa5=Prs;DPU?gDcEf=eflqCC#Ile|9JugLj#Wnj+0quF?r|NF zM-UKgR-yzNncO#JG1T3+O>^}(Acx2%|6lEb2u8IIXrMZt_IA z8nGZ=0E-F;g`?PQKbwtE%O|+*xElYQyH@QuGtU9twK}Tn9O-g*c~{l$;=DsK-NA&0 zJygo0yF?`OQl~k4Q~jhX-V5~9#nL~y8xoIm_a@4X=E@z`4f&Tmsggi?R$>rjOBGTuW+u|@|(Nf;&IdAw*xxuC)$ zyT2tRg+Q26gTYgPtBId2)t)56pdk3-^2K&uxt@O$Lg0@wt@el+{ z^BPZH`8a(;XWdTs`L4#<7)Ld381B6jtKT0!)l)hv{(!Fx82Q@0mvsM&{uLpI5(hHB z8NMo8$cu*fcl%3 zY`%F4LQCT3x?QoT0*qVI(u5%tamt4C)f-8z<*zbe@`a}r_A{_M&j6`bwCXJj9i1QY zTK%jFfE@`Ya!~^2w|{;6y=H87pNT`i!}8~tsdy}VIQ$~ibDPI54Pz!9(QILeQ{(H` z7JzMGKqCngr5FgARX;RO*T7RDalm8ys=VNM1mrQF?})v=Rr{a}%xV#4P0MTA#ui8ZL+8;X{w_0Uce)*S|V2 z_XK|l^|NQu0|W0s$o)!8>>(dRcoCu+mu-C|cAt+gFd)DNzGcfRDQtI1TDJS~AhBm< z6O~koURqv&UrIjLyM4}%C-3CM4VIVGjO-Nv7$Rv=MFRvf_hsL(w$d%{(LAILjf#3D zqjm8HxMv=4TGC{`JmVqdLiP(4K4*``qR+RdvMr=%Z)T?<>an_QCoW`7Nqwjo$sH1`TF#P zi;FJga9dBibc8uZ9DE%t_Uk5DkK3UM^EFbc*@PW3pXeU9=>tBo?!%x_T2WCHxExv2 ziY|jT1017$va*L;GrCCO4`mVvaa7+!?LhIJmY3i@^LJ z=s7N~AKzlCZsH?D1Fi)DM1l873;J9z&V>B{&UC0Ri6E>3E{iarF@Q4#0a@QN%Wy6& z^Krsj1XL1$KcqP)%+AghADhCW1%u1`{G!SQetr)h(h5F;=rDF*3?mq`xkfQ$1_`iw zY0#2DbWnKsvg_{Nn7OP^e4k&oU8Mw1A~@B+rk9$YIwfua{@-@QFA}QmNUA$;kRC?mDuOSr!o=->71~rd5A5=2zHI@P3jU&iyar9tMHm z2*LxKQ(2%t29RTLU{n~2yl`8O;v}S^61bPZO>PHW2eACW{QNuyeOXXE9*@mLa(d#7Gli8)vKi1v)yr~cP)E5IFGvGDNOGm@}g0=EUV zJ92k)!OWsvItKL%NWdZ>=LDL*pYa;j%NBKK?|g%z4I3-6~e26s|xNyXj!FZq=$yb3qvxB_Bs~u6D!8z z;Mwbo1mO6|$GhNhdB8~l*7)y^R6ZUjF1s;gt`q=`nJD7x^Vc{rKb z!U#*-s?p)#=l-SlF#E%gaPFjGizZnjAatu%7`~p=ytb)X;OTRj;@L??tHHsrKqEI6 zzx##?Dw2)BEhJF@2h=rT(GeRG=An8pG;GuwqGXnM(08P@!`X)WKWAKF{LjXf+1iZP z=BFCF_Pv5hJ*mog4L28*gSCZH$xL-JtEVS>lU{fFuS@d%G%n_jlX{w)T{5cR9OtMl zfK5eO&$*qfV!zl)mRR(+to+KwkJCxmHjB-sx*c0aD}_^@n=r)*CfT2WnNx0aa%np# zMWZqvwWT)o1{DVxQbGl1;y63eo0-keOX)o@5D5 zb%fCe@7Z5=Q2i|0mxHEm&i!QnT+Ec3NZWlN>AT=4E4~-YWC2MvdVhTXQo`8LwN<-V zcFY-rk98Jee->Ry%=w%alvD*mBDvk2Hkd0>sOA~3?GYQa8ivb{eQoGd1-Ks^*IpIW zULQ>9R`}}zVyS50lp`Q1S#36mraak-bSK=cEHG?Z+~$=gE-2Bo0oTLYY=-+8{iMq& zOhVi{jIC`**`kfNmHPs+6?l*=Gzd!(9Lw9B&3CIHrEsrZW{K&jK@OfyhE?j^6xDf( zj{4O zZf8N2jO1-?yPqu7-WQNEy`ExE6^w~Z;wmBBH>EgSfy0rKM4iYkF6TK}jX~p%I2bgO zZ8UrpYnCk>dL7$WUgu4(h^=uoM^$;KJJ~YOv~7znJWCs=uc2F0V>DsEMOdgrrc3`@ zD`@lgME(*;z-&{ZJBK3_0~EezyP1Epc>~*UnEQbqtJ+xhZ!HG%r=-#BrZ?>>v4D0R z_bdqZ3OE22*~f@KV7)wEoOhmmW@bYihD#r3%oo&qZ$XX%Pl|$&iFF{pmv~8wf@Gc1 zC{8oXQk-aYy1-X7=rylXfYz>k{q}%`&oE1sTgo0fWE=B-iGsOet#N!qr)hFqjH0Cq zq@m2js?PjRMq5`pucN`NQ1#Fg3 zbLT;dVW@2AZ@vJn=FR`d-2}Y)M&T>NIPSDvY_9RzPe)FD@0{<=#*CG8D$mKShx;E3~7mu#x-;Z8A;G8183x39iOyYvAM=AN=TfcgF zmW>3MVO*K5BGnAtM*$ltwNJrCP9rTr$7XWNNpj}s^FVZ9dZfCVzu(r${jEKj^*bn> zC6+t&rRB|E!G*GEE3Dk*8jop^LzvFNjY%yM_HQG~@O@JvLBxH+ajiAq-@MQ~xp|;C zSOq)|g1#%uPVbb}gE8}TLK_o5sm9`mY1>$bUX%If_umuTS`iF*!1B+({D=P;$Ju)S zFK^5L>uLF~`ET>)PM2yv4*|c=3I9L2X|7Y(^ouuVR?&3TkjytjRx6OegDXjXt<4@t!;v<96{mPo9P8==F zT2$~DpF{mH&)@Cd@o}g6;bS%Xl&;7zK3|mk>2~2v)3I!X^A0F9D|B(-&!Qxg-Y%xc zHU!ensZrOEZgW&$7*+uXG3cyK6y1-9Z)QLUGm9yNm?Lct{6Ns3I2q{o)!D`R07Yq7n$KB##06H^3IKPw zrfK~|2xv$Ef;kMCF<`k!gNYlUYI7Lazn4dacU8DLZyrr7j=tX_Y z2bvQ|Zz;Z8bA0t0U)9D;_Q{OE$qv1bw3=)?K!yN>T(MHBIaA@Z>X(aH*xwg6y60Me zB+5~5%>U#Rb#}yU8eNtEgJu>|C?w}x`eRw?hVP&Hae{3UvLJYW==KlaUQtHyz94#c z-1sOk;Z!SmQVohKAU4C;@Q6PD9GW)UJ(u>UZMbRG9WGL>k4f3d6TYmWUUP}(JH7&n zEl%S_;X1~yNA>uF+@AA@LxVIV$?z5zl7b zH+G~Z=HZ1iQ<)CJ3y?VwVKM| z)30+q`Xbn(nPUThJJ%cjoEQtquFYHeGw}q1%87x21LInZgHqJlM;P|9LU{*U|M^*E z^I>Pc`*+IH8wjQdpki%$;=}WfZi*&DZdJ%8-@it?4N)w zhff7rEIOc@owlpwvOOY4WRZYi@hxY75D1784T<~u3fi3rJ#J!xPqnIr%Gl4E48@q7o8Qu1tN;?S{e!83Q$|RD!E64Q>zgKrp_grGq~g_3wgb(etv#{(<^od#xxR$@b#_lLW27hm|VbEoJidvFja`wE;eu>!I{M4*SAv| z=sj@QuQs3+RA|5$QDWwbTUifQAVPF?X(Y5Ksn7x~AZ>coqCk(A;JU6GAfnx2k>>^O zdbY)1e4M_{b)7&tf?jdi#B%Mm|L?#TpS*Rmii&&ggWn;jzDqLxJH69Qrm>M+SIXPj zK42O`awXQ+0Y&pak@dpLxv1GQ3utW*P~NTV&HyHMg+dG3c+`p5iQU0WC&TFdS?tT# zFJHWzmsA=HNm!RJBF2`qVk`u(hFqDo|CO|t52PRx|8ElZLfPv-u&^zy;_L+%4}3nw z3FVZ*K49@tWgPb1EiNhP?fLUmlNkI{Y4Nhv)~u5?Fq)aUiS~yC2cy9LAym&FA#Lr# zy;y^gUFhQmIw$b(R4$?IrDat_!C&a)Ixxh-xk!Sa?%N3f`Gr$#Bx(`v5Q!xtA0-oL zBS50QTVY^EVLiE%=WhU0K;?wY0!vN`;&{CeXO2U+UNW5`FI8}Jb|)Fd@IA}&$_#y> zs;AN74UON2(*e;bA<#)o)*KU~LJTA4igd#KVShl3n5v!nQf|Xb>N%2Ag6)3?&=$bx z%(joC{ao8C(p(Ai&LB!2-0dpFI>Q$U{t_V67rTN5F$Gbjp&ZQ{xcqwBc~-pc#IsX^ zFU?kAxp;dJbf#kYCLpn75{V1;#ol-Q-4$QSW%c*K_utYq2Etp=U5B1K63%2~oDU*H zH2T!{cKphHdFAZL5`TeeXrw1NPv41?yaweCT(ivse3fEOHg5iangoF1N~x*wK_d&c z?vbNaf3Rf*(=9ADHiMja9)JX>gIKsb!}H&W2Mo zwHJym5YhfyoW`#l-`Inb@PY~cfrPibj~A|vgN_82Dz(vp{xR?ib^CHhffy9jKZtfP zJ$sF!2tdTeYmbq5mroyO$XO6nEGTqhVqy#pstIB&VAo6wkTvW6^iBFT3%mDD&>$t_lvn})UubWUcz*_lyccc1;U1MPk^7@ zDwbc>wZ6Z9q36$^hUQ~|D+4Y|UjC7ysSGLo+4n`I-m0i{haX)vEnnO+%c;Pq<~;|% z84@}5)MxuwC+JDhnR7rAuEXzKtHn;a-p>qjygNm z_7t45;fB8R?J<;taU28751m%Q5|f&1{ttunOKLuh@qyDLk`pF2 zICXpYk&`$L8%P8@axjs_{0y4zg+oU5ChTmG71@{UBr`amI-PWl9U<&U@t>0Oqj28O z0k-nFX?4t(FG!;lR%J*K)_h9ZiY@SD6qKJsIqI*C-u#Stp^17QB-f@E=>x{)<~vnP*EG4dyImA^oAMk@Yes){XOlfp)x;?2o}IN@)265v%5&7 z>U;;K*$o%S+}m?Kp?m$>uk70R$$=;~5{cD5Sd8TI9qco0X`HtUSp5BS0|_$&v?XMG zv&UjVrWpEcg8-z*;?XjKU|NdQ7?BiA4hsrmTt~TJ1Kw%_-a+UuLQ2#VjS^45=EIN1 zEo}VcZ1JUSiv&b5cfe%Pf`YpM>b#LsG(PB&uUtYz#^34ao~Tv$rl;$HMI;!WHRxdq zoR0)sR$gn);ozW+Mch7+2@OyBYluY#ZOCMe8zEC%H*mTgx0du_D1qtd^N5a43-BHY zFMjzM)y3ft{)j&W$&FbXA%dA_Qej~j4_di9C+nuV>zYJGMaAavDM)F@3(oAavL63| zm7<}svA1{fSF-T7Qnk@T#1mp=g$KLzcUduv;{BHXZrd!Nbb)&Hh9T8nQ zVVS$VnO<&*DQ_Q!L`w;YG;BBE2Qxe%4eS{iX@py8zSDNq5@~p?jvPNELCi_wTE}BN zWzMJZpaLy49$v87-+QYh-4&5*K5bXt(((g%9A)PZjz;+$ zVegq=fy4LwK;UeWxf4Xp-U}m-0#Ijz`Maj8WA2b~HVz>=+RQjp0N%8|_^T(gj6Lt? zr)zHK*G`o9S=sn5dr-S=ZYO@rdYoiIEGH+L#sX2q6r)`=mkj#@LM%;YXS?454VxL~ zd0;c#0HG9VRY_Wb1IjE!5hZgA3)G@=H!bqLU* zpMJd`Jy2k?ya-=&W+g0x%Wn0u{kWU|o{9;{&dy$+{>D@sBbt{r#~EGjPoyy_1Tw5? zi>Uk>?zU8K?o*d%&)C6hMh%q#iGtk6`stohT>r*DXG6EoRz=DF6dg*OD%CAcGF#4E zu6MnC*&}n4Q#6=zp(iQ-&*>r2*T_hcrlh}{64kfivayMe<(DYb9O&^+9+E^;V%wXS z;rrD8D&Hn@H0>u7x+gt4$}Q69WAW(es?){H>}<``iZS5OSDh^D#l$EdEVmSBc00ln zKACwyeA5SFE!vNX$D28-YrFe+V}?g{IBA zgGN?MKwL3bxjYt_TUrG;fkG_N_?i!*I+U@W_}6p^c@JiVk41GpI2L|bU#BC;lHo=v zu7^MWG-d1r2S!1G?#@%1$-TtKdsI4GsZL-=2zB7?T5zt_8R}R9G_>cMd99daNn**~ z?X!9&_nVd?X$lxrZbf0~^LpGo6^i!5YXk&;SGp@jbT9N8bTD_<9&a-pSfMTik#k9w z2+*6>RDS<{CAe8aU!Q0nRhjVfXDE8h;-+QixCLK21}rIxcK!F@gnMd!M^ajv+QZ`l z>9*iXd2pICFeuqD{X>>dlbnM=$zepZ3!KLL6NR@cC%SleCNpw!zCNi922($>yFDSi zH8-b=c^eb@3!<*B42Aj<8F1Q%H>h<+c>4mU)ebSd8Zb#?F`j>Sn}VCwga=)-e}PS3 zJY`OXKIttnsLEra_O(V7gwCudLO^HupxqUvE{x3Ox?v^n)MShH{hCdUs! zu=}hu?_yoDVhf;8i*r3VN~`O~{Dy9PD^~n-wpV$wSW^l9yc`YtYfxL&Yfz-6r;|pu z3+tu(eBNRWqBAvcxPxrVZqbAQA$oTvR8~AX{qK-3iFg(piZ$?;RT!bu^@dO>UUo6l(s>w(Qu}wk>IO_0Nr3({;bb;c?s z^AkGQsFyg{^z)FYix5L~Z$n9z3Bx&)R6sGt70ajrAIb1R$D2zTjBHddP zXc?xJN{Q;!IX;D^SO3UhC&2hbokeNQO-3Y5C7#*Z;*XSXvnewcTTM-A-X=f!3=G(< z?QI8>+5XI|wk|3AS&Ki>yx-Mp%~yFWz5pj$MnmDHk|Q0DU6s@$ay|IsxHo;i=Vv#@ zMz^v-dKK4`XK2XGK`nK(VwYiNvrIk-NA~a_OzneZOvpNK#;yB?u+vQK>VX@msW+v0r26<) zeHo#j(4T@?SIA|9k1#jT%I2~;cY!aL^^LYnni!i%6HCv`hp{=GzEmf5R25e6nD9$i z2Bw-F(&-=ajsTtk4x<#=en60P#R1O{3+Xm5Nke67dt)tpwC5|r?mK^OK;}uqCcXyT zd@)BylG96e7#Q^zop=c zbcNe#JaSbE3SJ8^-A7|B?QxY$>FPcN8-|e)O)5p!pGEFhP<^dvqiQaV7di0X_VFlO z=(3(^7zXV|-|(6*;0Rn^=t^8j3AUG(Q5AA?qx_tl>T37O{+z-QRnfQLQvjix zO#}+F4RYZIPeoMa{IVZEAjJ?(k^T)=rzS)(w0<{@anpfZE)d_pac2uRmsiL+{z-6e zo1LK0JzOo8@G{cj->=@i`JVNLS-K0)U--sD{#bHH8m@u&PkR4wMMMek;gKjOhX|3# zJ`j9LDlGBNsS$6CC06_qp{}BbCVsj(uW3Udj4!U0wl{j+A{r^T<|sv##27pgfta33 zJJ&84(Xr6qgbDW7@bI7J=P$tFtQDpH(T>vCmA}{ z{8%aEt14eJg|xk6i%M0++@Y_nw#8&2BRPR=JebV|j$*;r!R*NX-d?Xxz52+xl3k>$!g21B+(x$+ECk#afLXgjr_zm5E4XL5# zTw8OI*AUUNJCy;)waE6?ajrtep9cII6kKhfj8iPvBH>SrjOP)6AB!JmXiyvQyPTA! zP^oe=wo?&L`$DY5ypTVE^~|XbnmSjs_icWv5DoQaymWP7-;+@n`8Qf8Qw@+HTc8Mr z)T2<%Vy!~m_k|-rz(cgg4wEg&v+;p^o9Ui2Zi+HhNmWTAvq=2XcCWFu-w=F|uVx11 z82I<-0~0MvE=%rs&Uj@9Nl{jp$`ZcV5|Hk?9%J{t)oAaFB`laP8GI5YAnMLU8fXR0 z#C2t7p6&TAttAQnKjEx4c;B$&2?9k9ms?oYE4JAQnPMQvtADqt2gb`MkiG~D7K@|RrCUTDb3=plkVr!oE}3?li#;zZ zG>wDd9urd}(>}%2r1QGgS=Gq6JKBkrkFtL4B9!S7lSRIBVnp}~vyjOX1?e8N-qU`p zJpy&nYzxvIdaju-KR~Cq0O;m$zFb%xv4-TGiV9~==d+7;m4Ua27_Bz7@JUGIBbYRP zXN9-ZF);K7J3b;#EuX{dRSbB}{7q`gtvxF?`k8Ts`YWf6DFtz(Oa$}*-Fs7~(Y?(s zwQ;BRHxRzkIzhIsvyf3)Zjlrc5P&H^UiG!ne_j?c5_`3q`@KVSY)lx>$07mAYqG9b z7$YU?-Ec**$bxd(!V~tkunHvrC%UrEnir#1RF)!s$&9@Bc1}A8a!g4rk7As zqLb+C^rfHOECYXSYEF?Sq_hoGyFG`jP9n0{sAn(zGa4I(bJT6wK$P3G()o9_ z{FdRYcwb)k-VdWRJBA$Pa?F{f{s0@K4oNk5+Llm#?AxRTF!Ru*-JXGQ6XN0L#==g+ zqtD=``#@mPPxtc|d{0uI(%ABN8+yMW7gKiXPZp}V*9FaVpu2ulzmBw+;d}@8wZ1HJ zojA?EHj+o=J-NGRjR5Q9L$%l3WKsm*$T=ONzRS|C)HWJXOc=AMO*-l*!pjas3&k3j z8`%ns896o%2{qsDQk9Mgt4%aWAFkz&O;Uryqm4cmj`^z&`}NYtAypg!#ohQ#!7ru1 z3Ng9Qex^%VxvMtHn1`J`_=dChpTrwzTOr3w7^Ps%dh{Ytv5v^&+sK{XH&GOO@q(Xu zCvJFf(3F@eEMR>Wyig!)DwrRV8!ytKUKyGQYMv#DfcDu-h;wN#G7RIiIk*mq87cEN zuVML))TjE_^4&gxZVYTU8G5WcP?ptMsl#fR(i>GYDfT%zKze_w_D*pF+ckNVzpR9O-suVNMH|W|! z`)!q-r?Zp6us?gGFdf1d$&rBB0-@Q%clX;bVkVYK(9lSdOGR{x?Rr{9cG}aHmcsiX z8OQ0U795Y`F3zFTIIvf0X93Q*F>{sE+(`yg_&>$gc z=^B0lHP%bvqq2{`LqiP2nBgOZ`WEM|kWaljKYn=2dkiz9NJfg=VuP8fc8i`?U(W(%J)6c}L21@@v)QuYeLXJdgo``8v!Q`GFx9Gf5;n%UK}I%r{mshQ*Q5)nr3 z-1PhRU%)h;mEGJwk`|aUIXc<|&V%ODeN*tKH0 zepfbcfyy-MQrLW{wkcE6y5+;mteaPLGLyumI|Ty}QiT>kO;MX@H9ZqRo$ zTV(%hXMI|@SRk(LikDgoOvV!U5~q-ol5(qb%xgIIH2~SNvX-|+KHl&bMj`;@ygA z_mspF7apo6KPQ#x*TaXkx~t0!1A5zab#))6?Jl^!;)LW85fN{B!vxKT=~;0+_8+_L z&}pe?vI6SI~3d7V6JpRt6g30n^A;Dc-L2#KxtAq)ZuMYkYtdESUzcuF!%y-xo4wV1@LhbT`K&A{rn;W zXA?GA-jKO7IR^yHqI=BinJ1S}64vT2>iLuSOC8bHA0p;cyQU*Mh-gd08PO&L5%tsG z0N!T7Dfoz-ol**=bB}x|Z%oID`1<98#o74rVmmDUMD}-!Py|zh&1aIVZ_PSON1cY^ z-)m^F5?e-r>+$WQqhmk;0P!FW&ceWS=}TAnK8*j|(vrGAU2QM zIQ(T0U$)uU`#4P|gTCi+TE`Ka`p+cupVRqT(mx&$3QIH7>w)pzsQ7)c;*SST50u!v zALoSLc_p7s7?J$wrN7dJqBZ>okMp4+K$v~SU#pj1l3KbXD)YIRz#R`qgSM+5zS?dI zbu;E>L~!T0Ec%#00u8{D*zJ5g#>dGCnG(9QV9@0`Lq9-@0;DWOyXb54M9f1HOPVRO&(pr&H_h#?U&F8u>LpHv$5{vb?5 zy@R?G%BaKOuPFRf8E9AuL^-=b6IKirkBCI$QB#LXUsi@8vRv!vf=>~7K`H; z707+4+Mo2P+FI6|?}%?*iA6QcT5iu$P1G}FD{Rb&#ih4rJ)6Dyi zBSR-T!mP!xP6vZlGYhQnW=U3ZwZuoUq`F%kG!ap@{lQFBFd8_K`TQw4O1k4E39GeM z+-&a(LA7XPXq3+z7W%s>VJ_wjaMDq$+~24}pVhs;`~3gv?yaM$T-&`-V<`rRigc-@ zf^?^ffV4<=gLHS9Olc*gL0Ve6L70S;h?L}%E@4Xd=Xo@B8nJvxZ~2 z)^JXF=6vqwzOU)R0uRT??^ibA8E(0I2;Hp&=1{VWi@Q7 z6FgdJ6mNM&Xm9FZ_zs@B_j8-YE*%e%oXxwPT}z7OFL^+Ar|CaTEwc4hN>(;V(0%Pp z<8ht=rJXw~UqYxM^P|m7xvgD-#g)*tbC7^BIVr}bZ!>^B$G{*dpCl9)sw4ut*`nwp z((Z(=$@)V9udTmg%e>zYT2Yg%Irr8#Lq>zvXG6BbUE1j;6fMd_7psQUd^Te{SC|^a zBvn+ncPHz^eni{`znJ}F3Ci+rH<52q9g!CT9tIfES6aB({5W=d4u$6zm`;Hq0KR*H z9{2C6L?PGnt!dw3bMCF*1UI7BjfV-1rW1OVrJh}G6qMx`{fEaZxK=$C-5ZZ@RsMC9 z)fSpJ+Zw~KtfSIXS6zy9Md7wS@&3mrIIR!UudA^d8)GY`5RP^%KMD z`!nfOG$59bX9GJv^kNefEl=|rsm!S$ABqz z|4o)t=)Hu$D_cM&|B&gi;j(ai=^imrY`C6e(O2y>{_*#3wiM4WfrpGS^an@cC)l$` zxYTwSX*WeM>&n=zU{8iI6!S@;&3EtJ%YytIJX)`iXRNXY#wAOtfHZkdwQ4|`Π6 z4#phXoWIVTE-CRDckdPIHh%+kQpKvUfa7$=RQ;_9vFv0tWE0cuP0;Rb7x|t4!ct^A z{ad4)-d-qBC-5{;9Gfx(yA4gz$uLOt7$ z*7jKrF{#~ksA7Pn-+s2y`!6s@)zILF{(&O;{AI`V%WobcPbmNau<{}CrRnwh4E{gc z`DA6`)<4@h0c4JZJ|YUWRC|o?O&V%7#|s_QGagwHn&G0xSq}eE>jJ!#NlpG@{m^#K z2gYy3ZLMAjILgOvUAj}iUv*KEld1FNz$11W+hlu5`jouW_z3Wc6DWf0td`~T?TvWAC6y$I$0M#S@%CFbf1=O zk&#y^KQr#H9-1^s|42F=&Uy8I}puG5(>L6{a;4n@W!NYGzz zUD)KZp67wRbZXNxhnXErSFc>|HFAHqE7w#d*l<;ukYHOxk#S#Mtd(f;UQ@LjJEqtsYEFfIypHr?t{I2*8M%n&6ySW|baW zof!K}yW0DNgmeNUi*gP#r?b$MQ}Csx4X=RanqS#K=M|KK5B%5=Yef>3YR`QI*rdaR z6af;vNYpk1NFI!h=&9P)95`H;>7j=W98TzH2_!o8$CI0gU!5B?3P=|TFNbhKl6&z= zZpI}Br6clsdIaR; z$>{rM%tuOERn^pgZSH?R;7Wi|QBzO?IP#cFAd&UMuq*GNts&WwlH2 zWJRp*a=U+%hbaQov_KI-JfdLN0c4@3Ca^n2n6gqQf%KaVmokhu2)4@yhE!GbmD_;R z1mjnzy}2x(QqP$&cxj%3p!1eN0m%LZWSddR?#oIKJ=M^B1IxX8M*AfRpP1QO=bWww z=j{3Ds~0uI*)*oSeCdpsc_O)c1haW@{$BYfh^_ed2yy)<1`~U zQmUyD!$}h8s1^-F-N@)Ux_0cs;(Ae>xIG^{V$Cy-M4@ee%=Tlsavso<3X|KxV6atk zbeveUz8=;D#P65^9s)5~YuRANrYYZQtjv6u)o`#AK?%VG;llZs0*O~h?!~sZEU%kt z76cf+GUGwc)3tXIHjfuwS*wTB;*K_F~)RU=6e++5%dasigGykhlaknHT) zQQezTo(pMdFO`kd)YPA7sy@DXwPnVw*bt`+*ANktke5B@SzY}oO}R}?{raUhkQUWq z-un?|4R8+KXqA@=h^A^xIeO`1#i&T;Y7d`_d)y+ty&#+2(-Yps2|s7ON^h@D{~mV6 zN%?7-o-1Y zFDI*DZcfn`?K49$-SSGt9RrFqZcB@vnPuqI zh27-N+&zgoHi?uzv6#p`-4Y)rCZ=jOEvfYA9#e+ScRpJ1cZ?eN`fp=?HO;s!q0iMM zDpCbnQc+!L|B3heyjiIk5T-jI+3oAM9hfbxdx#(|tof|8zzBOycTJa#G?HRDRwO4m zEv;F3DSB8~buBNN+Jd_<_o2TS=iST9k2kvuMH@%q*yv8=wC!Hd4>rC9A!;Qh_WZ7) zSEbIMG0GomdH0bn;6$}M%m2W{rvFA*3vTw%iP8HV+}$%TE_jY4W4&TrU|O0tn5MxI z$}nTHMf698@VCBaTk%Q`xvsSe)bUD~bQbNH(IhXAVJlmK z6jd(`+k&DUv!PHw(WvBDwot8_kiH}*r#1Pi&e@C09>Tiw1P$Lk(Gx0O3;YD9V)wg-*0I5g3L z8zIe6kpDsZiL7$ktuJ$7o?JaE;5(lxO~cf+kXcz2-j-#K!}{aI%SoIp{lfWp)O1g} zHH~!Feuf;ax{q(uC6DiUCn}=E@TVX5Ek2R^Ie>AhUL}KM9#Hza;!GFVDjJVzoXvX- zSCcAF|M?b1__K8PGOo)XM|o3hSxjidhoN_&c*daAvY*693+nb~NCJVu$-%-M3}upe zh)A!=oA-9KQf=kHz4Y55ZJa9CNM^hqm{HFsoyDo)WUH?b?+7Cb2#huX5Ps{p#^;Dv zQA1@0%P%UWu`w3$qg6beXOcNdaYDVOu2fmG?-_pN9p45)lHeswbwt^%iTb8zDJX3F z&;9m+8GgtMFHCXirIs4@-tel4Ka{uf5dp}v(ff}wuJU9jh5619MKjq%dn8&SOJAjf zM_{6yttAwO$}4D92J(r^zdEsv8V5%l>NV_-gfK1wbpv&C<@CdU$}_hUO;jhFnCojO zOy>4gHsd!y-^5Zt?JGc~o=*}i)~Oyb7-8N#VZRgr`lfm7 z8v6TL%o_Y^nl-(U(ab1MhU#B}P)sfxayTiN*;xh`c*wgnqopyX{*i}nyc1^q)C(*H z_v^GfRxKr_Ez#2qs2c8sNWJ_>^h9O|cYdt2YZDDcu*Y6(3tc<&Py>IN;$`<|loDh7 zD{$bucbwNGvVOBdD87F+DwQ{uG@|MaPGZI$`){z|5?3oW&0 z!`6xh;v)#>1Y~Pz7Ed#d+qrk{hG6^AYYQf?9jkpGhgt*G#NY#eADY>hiZ-rIx1-#X z*Ahl-8EJJ}cc+USYvR3V8hSWueqi3S;m8ZPWwTXIk^nL)v-|C{xj5t#6S-DuB6?&X zgL52Mua*CMMeK)KyQav5h9CPL-ykN&rzED+qcNN1b!F&%@^Ji_6yNigUGkw0Z+0;( zzJBi>8mue$Mmj~j_w2H+erwI5WzH9&?B&Ya*11X8HP+=^v={a`JckDt^-nwxM!jTi zyt3nYmbH;rJ;d|SSM#+)JWrd;z5f-@V}ius^2U*Z=1)&k?OA zPmNnXp#fU*o@$UHrELM6|*2 zMmE%yzQ!7!uYrij0GU<)_Xv#96Vu~gNtA= zLJ6sZbHIP|*gX!vd1Y=cbKJANAht)sH3cY#A{&d5V5fJAQ9axOye<$Yndz>gYvIt! z@Btm}aG z#OHmgxAQgtjm>gJeIp|>us4mCTYv4?F`y~0M-JTb7 z|GNVmzX{h;QQKbSx=4@u2_D^R^@Rr^_I0IysMbR^+(*^3k&R(Qir= zxb9kp(TaE2RuGq}9LI0vb75Pt36p@|5&iD?ar@X>Wnd$?iT)bj4~7Zm zZ%X@TU65#!H@r}g6zL3iz3sBV@s&&)FQo7qurrG^MdROX~ zeJ624wa|rf_#WJF^Q}OE0o!SW^#z8ZK0(334cqqD{dIv^XFOckdokc8G}(3rrSZ+p zFUuf^K3VK|%NcY(!S~Psxw+l3oNA5d+e+qoDnBK2BwMO5>8&^TVIZy;AYw~9yIUkG zfvv`$9Muep7>9tZpiC?TkBkaREYFwinw0VJSFS6if?D5BFI|BpSgaJM}w?@JtA+le75I)ZHgKI(cl)aiWYzWo(?Ur zKmDiUn_i-TW5jgC?H#Om3#q|x%JL-OlFiM8yI;dU5B2Vr%kH09m0stKfhD69TU*X!e4!%(Q;v&Y zRC+~vp=AK9iwd_)22iLB{dHsllwH&)e!QFP_x_#^W_q!Y2)(oVrK#xW_6QAfnY3iT zz|?;ja~XvOnY=S%NCZvu*^WzSI&gIB>+f%e8zt+_7P7Uy3kgX|Ctps1mDLv19U1+k@Q6w&qKRJ$n83W+){F3;q=rSVo*&&x?KN9@^n zXXCUl(=m+0OF&xldpRplZp_WyJ-lLT3+7YO5Of3^3S5QdA&jm38+Q`mE|F8=bC6x& z5Fi6D^6U8LF9tjWdNJfZq&mdH)JOnWfq_>8r2?hWADLkCV?OTnUkjBI1ihg`&%IMX zozTY|W#RmQ&YZ270+adENIVUUOFx=Tv+LRnh$Esh*meZHcSLH%#w1ut(qVV5sBi=I z3L%J6W@mHyy$;T36TVW({`P%xlGCbDdu$Yz6lKB|3W@$fmeDct<7@+a-Q0H_U_&|c z;yG^O{g}d<4)F3Uz9jk-EM-v&OlsA zd_zNn(U`TJ-PF;WV3UC2rR{p)-$pH4u-@g@*RrXHr_l2kiZ z!464xN2IdS{m0l?drrRv$m#|Q!}~4BsPIEBsbr8|_{$RlqQheb`{#&-6_O;FCj z`10AXq{-%|O>-B$jAbl#c=Hh{8-C_lx_*2Pv0f=7vP^LVkH2|!U^q0yx}$1*WRRCt z|8CGjsQ@=yicHR&kbW@Z{%veR1jhn$@xV7XFc8n~O{5$$!KH_bw;K12qJWYi)y}MU z#4Gg8q!pt|H#1SaNeT??$+Csa`g#>?H4g{JV{cedIf>^Gg6Y&D>lacyDp@TKV!@yZ!icZ00ZOA zv^3rkz&uaOy=#y4Na1_6LZ_!~9R*UShRp?bBv)j{t(N)T9VEpGMKk%SJ?{Ow(d;&I z2z*Nvlm@~aO?U##G2n6*J}ro(@5LJRe5d?GKG8n2E`UsoAXn%a4}?2G zUI8g79jFtqRDG)lMy2Gs7~*x4|w}*YF7Va4<^vF)$!+(g`=54i=H6U3E)q zu!3&g&&MjI6=GU`Sq1iKIXRLBkgNlL9c6_$aG$mJm8D5nskOD9z}Gf0(czS0=jH9S z&7dW;mjj7IQ(FaN-o4;?3lk-|n$@f`@FJjTC6a7+kwS=}bML06e~v z-SR_|o(YpdD$3nRdK@sT`UeKO8*yX6@BQUg8w(f~d*gvu&BQ7B?j&KzonHH5)$^-3 zREZlx&k#C#^J_UyawF`Wu> zB*v8^o+oG}%{q@44beb8Ti;KvA1|>wXVIG^q09=kBSgJ<0-Jh2+yBVkD~}+!wHd(; zv$ryYz>ON2RjtqDA!Lq=D2eBxaxvPc3$}CHXPV}mA|fMu%5ox!2u-l-DY%^?aQA_U z+mur^j3Kp~srYd;_dT@$5f7(yEdxR^R1mE7mXN;wym!|pwQ+aNoA&xe)cRrRmMa`i zMnm~afW|#lnYk@4j=fa$u4Sjj8}hEL>y6J$KOaKLTE9ro{ggYD%SfW4JeX>>h|yk& z?bG`_bKv!OKVdP|Rj|X^j4Mv6o=>}be%87aCp2;wtfkU3>V`H0rs}AQ9EU$(}YJjLZEhM6ci*S+K8`v zBtjm;e0O})cy%dq$KXD^et8S#j9T6cwl+RT8}TV7w7nLFV8M3H8l*`DWs&%+ZNb%!$b}iZ0Y*C#h?8;K)c(* zi~cH`qzf0@xxrT(I+?5wKEC^hCr877oq2#b&2rV#fa$TO^B5FJ;THWXI+j*eZSn6P z1Ppd6`T4L!((zw0qBKy?L9>1ynx>t1Qe;_A{lLx3X%{HJaM zvWv{^>ZiULje(A9;cItyMrC%4>xx}=M%C9pB3KXX+4uzQKc-#?9VRX9VOrk>NXt7~ zH8_zfvbh>F45vqOy+MRgDJPJmDjMrw)ed81z(@)Rxr*-ggkTh9Gjc!z6QU4&7O|A@ zL#&RHwe{hrl{ByB@4oxZtx||Aux?Tw&`_WvAI+TXd82vIQ=ci5Ez&ulAe8W|g~w}S z3MC9`A^h`aj+SHm6>pMJ5Dx>k3ls2@=i*(`AYw4&Xkqum5vi&%+_;jSyZnjA95^r% zVh929{>w3 z!1Ay=uD_63KgfPzCMo6p(z?TLfUu(gRid!}`(eKN2lUr73kpnBeJ-FLq6?Xx*VIr9 z71bs|(oR>AT~J_>8s^-pix&5dM$0;4>M_BT zkzGlPdeq@Wiui+hxp(^>^C;VK`*afU7N)hS-ah!A?|6IaZG~7lUR3V&z-KAIdo{KK zXXDp{#-}4M5?u|oTzT8BOf)BG9(kvjmN8$wV7v#+?20wtN~Ohi2Xb7OH!r~ZAZcK6 z8*Me%Y1?fcahw)mWXP2ot0GQ_cmv1x+4^08;H|bs(LWr}S-|q)@_Y)k9zPionuX1J z1DJWbfZnEgrxL@!G^PY2m6NF$@izkLKUkg*d$3xLvxmvAv*|Uh@1I zk9q6@1|(oU)!0+gVN^gviRQyh3=F(%pUHx*;1H{)q@~s2j-(5j+f~u1d{k3Zh#UU` z%7X?q0VFTv%6S35=^H>0++Znk-Yj7_I1EbTFgg-|Md@)IY72BQXAnn#<|&pZ=Srpb zvuD>pQ`AY^<#Cv_>-lRp{3+1MQD{ZD`@s90GD8V+Cnz8%7I3Grzdce)N}iS+iGf_S zJ7h_vSd$f`YMcTb_n~vz-Yy3(*CZ&-#f}`9f=PSuetqpTfrjuL7|!O$sR+6(e*L^! zcQ}a$7<}jlxq{aZji6w(xARAh*=Zr8=zwyOjl)vSdZ+!*MpqWPlbcF=>wyd+8UWKR ze*PHXC;_SW(ka01!MAp(;>zUs&J}xrl#`OQdrqLVd}dkQ5@SH~#q`JB23Ut@v-^$q zM4#)}>&bX(Eq$8d1^pnDGBiFObjSnIO|E_GJ~TWCaR(SSqUZn)5x;5cZwAjYpypw3 z7%!^)RsXc<$vZ>l$G~o*xwnQ!kT=z$@ z|38S1tkeHQ9#YG$?nh}h-?BA`JfyvXx+s17HC@N#lfcIJ7y2H*env0LlWVqUoD)nz zsh-Nx;D3cmq?^=$21afH>oa#@<0aq0nJ9_KDI1AxyYfQH!6tw>-+{GRY@%)726W}@ zS~0v|flSHi;J+vnxs3Ql(r5%ex?OjIlZHda&_|6y2jdew*&x;_CkH0wbrqJEn+)G- z=ugP2e+b{$cnYjBBnKjouKiO%j=8SdIVJJU+aOI!N?99PI4|f2_zi=0B{k5MK_vu` zf``jYKjO3T{YkJEXMg{gb=AaU`eqcZ-$OMsLC})a?QK{?zTFd5O(0^}wb}52*-9Ko z!==jh9=NZ6eSsbtL`I;f`V10^1~E^HRvX4KEEpgrg0r=l zEkLy|MSs1o=*6%;<{>MIN%QNwzum?@TU#R9tzrKApxPN3ffPHTAIS?Q?TTQ&F9Avy zcx=-%=dN$NmjA~1zl93aVC9(u+DV8SfdDk$DM7FxqdYtZs8dKk3?&N)WY?#pg>zuY zTj6%w-p(5Z%M`tGdvK`0{#tl@`K33pxx0_~z>zpT z-wC9C9(a;_+CQ%B?eM+J!h&Rzsc_#~ebOp5{Gg^xPnY&^hx%7m>n3u>Kp#WI)WFEj zAJfnP3SC1NQC|K^hsEz2b-OreAdmUzV?Qs{J*GDX!uoJnpKl$+G$KUn_;@QAtRf5} zt8#pB)!Dlx;Eofa^{oqrG(s3JKe@rM3d7Dr?AODgXfg2+*G5wQtSSno!rVvcoYT3o zx@x!jP6>d>-b|qHZ38`OMNV&eT_Bf&3Fbs|blRS8cZ9TPi0}h|^7a2JIO2>lWaS+8 zq30@lL>E|+1rIt;Q2eK@AchJPzPKl>ouAL68Raov2XC>Zu)RUU0r?T83*RQj{l=`) zipc<8{yn-a7)<)DJ)arYyt2A_XTvd`pwHf0Bd>F#p7{lFk9jD}+G}a?y(f9^UgqfD zL_JiEikSi>1Uq}ZO+zhw>8|BOOIX@p=x}$x7}V3Z*2@9;u~xRWCS3{k#eNgin7dTj z{Y}e*T_a_dmkm-x6zuIWpNDur!iwOv(1d!3C@Q77`K*n{K|-9nW~M>}R6?L)0;{U& z)-0AuQs_BAMe%38q7tDspjVxY%C%J(hX?H*nV0f?`~A!Cxisz%{hK%YtTJ0cPrEM_ zKVo@@bf`pbU``4In^sDlielr|r|L!eir}IO4g>}t!gs>Hl^qTbV|p{?Y~jF&25tjj z&WH@#yi^9GsGz_Ldf2c85_ZFbvO6Njzk@&J26g;}X!6&m_dhvC1HBUeR9@@L4pXk9 z$vH%2F*+Kkszlaa=UFNUb37=wnNqxH8pSV%k12p>7krc!GPEN|01&HzoMetLAo9Dk zE}Xk=a>y9wUGhoa(;JkABT0$p}6 z20xED;ojMV9yqwrc9lkzV~zs9p)yXqg4!8gf{3kYry6(~0Y@FTBekp4@n3bSb*P5_ z|JGtb6xb0?6hQJn-&&76k%e=i$*Y zBsW9OUc03*DmC(y?;;{z(U1;v98Rh%_UQ95?@285Z<}**>RKk2PZW3&E4 zYLnebXHp0koX2?&M=q_C*^z!(a`?QJCCO?~6I(@rfb^g|65zyFih6-N4Y)-gjqB~!!fBWH&S9p!aPbKaFb!@6o*uKAiJluV4dPqkd2psZjlMYP6 z;uAe@E{6stx5{bNJre`67^Fap*pkUewa;%f`rbjVK8!bSpU3R6?sEu5ymm!e0Mr=d z~G1n@A$sauO8SC=BZl^Bhspy$znZ^ z-IGI`9|uXL{~oCg2brOqHA|d6AxN4690|(QGk~Lre!1_AU<*J?9Y7;0(n^z9bF!A= z4A6ne&NfaXE*xO9z4+!T-W4iykd@w$>Zoo4|PlU{<{4PMSJRtbjQCDbFi;Cjv@=5}G|D|=-W6e3_a;Z+^nW8PoLAN;b_3fMLAC8mazBiGHC z6@T-2r{znrh?8I9H~GoM6*91qZA$*WHSJ?;Pi!~iTgvd*O$jr;1W0WnNm-rjLcUCH z3&#FzMWfvX1BdCBJB&(&Ok@|JIFnLQx$KsZG(Z2LY-#YfR=*Yu#UV+0_UC$$w5`3V z*7K>&ijJ0+z?qH>PuOwRO7_=gcR<+L1?s?}m13gl@TGt}WUrnXRL}uPaEQgUArukr zSzu$3Ef1b1RjeiO%{-Q(6>bpEsXR?nc%ImOKXWHa*2>ay4n_%PJHN@t{V`rp@d&!( zUQY3$?-UF~BGqLV_y_^na5)mIn8XFZGWHhL6=)5H_ey<07+JsK%}O$ZJLG>Cw{#k8 z@WYhceZz8deGZoF7?pBpE1n}Z342e7;USeU^;02nk= z@1;{RDl0L6yrm#F=K>1t)36|CmCFPK=A?1Q!+Sm@&ZN1yNGwtbWEh(X)^;Ru?Tm;k)h+T`W#)?)ijGJHgr4P1X` z^WGoaO&zz4BQ2Bpxg)tPdJzN*0P?LV2Jliz3M@XTt???uW6XZ_;>81~K;cL&EVR>A zv>4@x2np+%^YeD1DcT7OGpZ+7Rm-gU^cKjSpvCo=ABidRtkoWaF93$RzPJzI$^p}h zAITQ?v5scNnp?xL2^%?M-xd=PFr5M3rI9kL$o_!y-^0bQ!^1;pU%<}=fTpeU7o{8- zJ;mxLyZ)+-8ua0f7#|9T~| z_eTn%Q57UT$q7X_1b`l4w3EMN<8O_3vQb0`r#=#R(PYZC4q)#F7F;;WjNFjM9N@2jw2PHV_b$KUX)}+~`UW^!UZXR$ftTx4J5jq&PHQ z5rjuO`nGpvu6tzj2xV|2$QT*8)X!*Aem4L^DP$*c_-EX?hy!%h^WTy>@MwLSv3@7a zdJ_{+!*Rk(Q;zn;j!Um(zgnNkh4Z_Xf4qZIXL9=cRC=PQcQP1$@E)Htg1rFf)!Km? zow|xwhgqIQ5c73(el(Q~%WW*8P`}$6Nvz$mpMCxRMrUOIN%{j{!=EQ@=6iKd)8}KJ z-nh{kVocNdE{oj@NthY53w7*B|QFwm4c<0Za23-%3IZvMo zmNWvU;QCkEWFU(qm@p|ioj@{eE~^D>xc>W8#C~Hc1rX0xz zOv;s&_3bqKY(T)&xN?QY%ajiE9f*7rv8E!Z6ea;OILD1Nh}u0kJioOqwR;9a;6RT9 z1~$vPFCj}KOEIatjVT#u-CIUkB>z)oWXIK`^DhD;+VG>oa_gTJtJGiu5d@R>wR&&r zOa@6%Pi!8d_^jeqJreIkGF`)egO7e}*Sq*L<8bv9RAA4+Y!;%H$k()M&3`%yg48HT zGBqzxI>mbdK^+{*5ec_YW=1I<9 zkGz*H$6a!)^|x~uJ=_WOfv|w*2L4&-9QCYbDs(g~BSpgBT7T@>-Cu0W2JSB8UTgUs z(w>lhOCG%YFyu!pGVmO~T(m)WvTaY$kDo5^0ly1uZ6B(sL50$6fScDi6|l}ff#4F< zZnaaKHM&O%$F@@IY)TwOf0reNKnoQ01 ztFXzgu|1c-(aUzs9cnt6fA(on6wDb!{?v;9Sur@qf3BfFmcNUyU*=Fa<@%1zmUOrs zZ2x{%o?ImqJrV#h17M+Wcg{D8v#i#OZF_OWef<3SIrLTmz}D7-O}oR$2bA{2#B+!> z6fFJ=Zna5pf3NnE6=;&Sng_vASIHRjHyv|;4Y4cT|kmC#` z{1HVUBSpWJ8GmuhcR#C=b=&^~dC`hYLof@TVadLYs91R~+&rofu&RY#10eHSLs}V(;R5~luqSw6v6gaL zJ5vdG3E;PDWcZ{@g)&paMAV+5K4mRV6ih3CccAa(*{>$Pd&!aR39kL*sQu))b~2FV z8WX3Wk!tIlyf|wt+9*3W*I3p4PhKXoIY?RH9E22mm`L6Mdn<5MfP|r(d{!nPaX+RH z>Rm7!>b3+A3J?}ORn`yaU7&6-aKnqE;pbFqU2+1xJ{4$>mPG#o!8)L)Fr5CXq9ooM zuq_eUlozOf3GA`pozrgBz@E+g^yw7H#VNv(!mKl)oCfwxQOG}0(N_-|n`>U#yFBO?}IqtP*8P#$D7G@PF{EY?Pzv#|me_zl$T z`RrO^w2(LSWy$4e&KQBd`sKnA-%=77R0|b`Sr6D9FO%ebOouQ@fIz8z0ENoJvbOIyxA^6%1&7 zPR>r(i=4sm9LV)Cb#+s6e)?fMLhwfejh+%1g@EYDND0NTlte09VZcpGj^UTqUZmUy zLW2(#ji5e>i;MH%7WLo~1_~!vf7#LJA#f^_tO|XGWV5|ZoIGliP_XFTZpn`$t2*$je zaBskvBfT#F5#i;JpFcgXqG*Tu84}b${Rg)LDzj5&!x6umsi zAGx{ZAQ2t-Z-my{-;=>AX`!Ff|0HE;vV8s&Zw) zBpV#T-p}khZ|w~uQjHuHMnLxhrA+opeB|Q>K86P;;q%AM&n+zU^^eK9RiuEg6#(K1 zDY#kCwMNOKxPN~C9OYg_z*EyL5@^0^J|G~K9ln5`I@p|Bm@v8a6~ie z((s8!MXNx-2_ypehU`6(SKVs;8q3F4;n5}ZPO@obY@6RUdnlr4^x*WlbDrQZ-~f*3 ze%oCsM#aoPSPH19xU#%r?O3Zf?z5>d`dQ_?;~;nuEc8!(Cc5+nx6$UXFa~^=YHp{;}h z0KT*=Fp&%nx&$kokqm#@NeIzznVDs#16pI}0!m1rIY90f6t(Ses=^xn&x1=%T}`)d zQ^Kvne?TZ@mfYUMaeDN|SvPNEtFw4)*%bmr{X__588#vM5Auk{F(rl-^BrU3pEk}Y zoRIk22DFYNBe+N8!Rld=G0e^~AF#9ZLrh(I0b=RCY)tFbru&MDicWeZAyO=eo!b2vHT49U$%)E@-rvgdj+COXi-4AM2kX$*^SY9 z^FCAp&{xn=1^#lX1{b<^7%@Q^875m)H<{{WQ1DwI0nGdkHUpKl?mvjPa9iCU3>aHA zo`);$l@0$0EA9Ge%UXnKU-|!Wj2@E{C z-N*dm{_8rMUiW&rnkUR5gI0Ykv277HzV8dCe+RSgz|6}C2U%kc)4p#XrQNy5)Udx` zQcMPpeBUzV3P3REE0zo4?p#JkRV{FYf2HjW!HXFu09iIESzy?K9}x3iQ{j zb2-zCb~a@??8?$n^V}4L_FFXrYXj(7b!+r~#*bPnYu|GAQoF5{R0)%s?wWxiYN-`A zC2gnipJ{!I-@oIX51IZnblYZcp@_c0dMY$5^8MpS_M#tZ44@^{$?h@W-w_x^y_SY8Q!{cZIyf?{wjjbDKZF z4$(w~`(#)ABt`pjHBX~7W&GVjfAf3}Hg_8-+>Y?t!8IkjBT>a{I@{j4XD*)@Y?ke- z$K67{l~%b$L<;!>Ff@ko3l}Uk|Ge{U>=eTE0)h59NNhSGxJv69PV3nav9Jl~8#3wu z-7G0P&r|KE-9-=_5`_&_UJPLOfuEijjv_lRXMHz;COxl%KQq{0%Cb&bD5<8v#nU4FGkEhbsvP(@ zvy${TIx|>G)Of$@6C=cgFPZ`H#}UzPpAR!H@ug%i)7u4#AMbA5z@7&X{rq-+r61X! ztcoi?&F6g$UV2O@lze?wgyo+~TirV?yE4o-hEO@OTs5R$qA~tOTl+@&kfP+$u;k#8 z14g>5p4fd_v$~yCfW16bJZF?8rs4K4g&dL$>tkXK%d9Z^ST!EgJ9TX*{f8u zkgd2%H??r5Au!i5+SIGCZbL!2&@T703miH<^06FOKp~mNZ2FVy>yCx8zItx2CD(`9 zs}35q$EM+*>`O2?M))U3gQ7ou6Y!c+J+mUvn7FOfweERS(v?{U_d7HAEc4)QjcU71 zBgVM?l{2UuOHk0?Og-B6eW&N35mm%ZFlLZ$bX@3mjlZJ!lJ$>P+jLir2s`ptnRNX4 zK0m!B-Z(o-jTKp18wJMx#pa%t?@8cFcy4pyiH1fx%C*`=O!bZ}BUPAT`CU^l5g@}S zzC21L8J23aFx3`SCyTjkJ!`*fS`()!iYpOSlAgR=M1R~c+WgSbHDdUYh6O($`Ey+# z76}c=)mhG+(`F}5_dfc%nQ71%^bk~^c9qIt4iH4l54?Jn27aOZ_Y0n|E-MLh9D7W; zrn)v5y~r}dXZ~}QI0z-d98O>IZv|Q}x>8U|<3Jb@pt(vdxhyvV<{ml}nq*Hi5s!8H z;p>)UKE%QR^Koj?URHyQV8>SwnCZ5ZN3(KMcKnCB3^lik+;{1Wc2x@hPEkZ>^VXha z#A$8J^nQOiNByMH1W1Q^on%Pw(i?A)A-H-u|9FBH`IfuOfN# zVfgkdmN?V(_M5}=KWE7%Vly88qXVLs@zZ-dMKAR)G9e^>>3>(*v*)KK-`coB{a+%Z ze=g*O?m|rrR;e{gRThyt{Wmd@uJ>^9mH9)J|Dif+7;fMvR$(MEJSg1#Z?8u#ZTh^i z>_C$)(}$JH9Q)poi^R|DR`v_sCI9uZr@ed9VmS>K^dDd%gYK*X>d$CHPEzBIw=S@X zSr_}a>+m@N{pJClgy~^oY){9nl|rR+(RZi<_1foo7pi_6~Y-h~_Xvg37!X>(fa#dCDPC393gUfoOa zAx`-3-@=7kE!(_x>EY_+X1$-E+3POo-^T<8L8j~@FmeK;4rcR#*q|QsTUog+Gv?66 z9x?sPmw4gU)7a}L+^Mdoo_3o9-@&{!e>Z|lFZ)t1RKF~9>(7;SJ7pu^!YE_g&FUiR;pTc$PIP>3r+>gHHr%zY3 zLYDP$KatzSQ8NFH$M~nj(%pX(kG)U6qfCCTBxV3&sBfjd8`-Szg<=f;j90D$kNtN@Fas8cnq)I SOg{zx$Ve(aDtu`8^8W%?gDVIC diff --git a/packages/gcp/1.4.0/img/logo_gcp.svg b/packages/gcp/1.4.0/img/logo_gcp.svg deleted file mode 100755 index 75e139f9b2..0000000000 --- a/packages/gcp/1.4.0/img/logo_gcp.svg +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - - - - - - - - - - - - - - diff --git a/packages/gcp/1.4.0/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json deleted file mode 100755 index be9430439a..0000000000 --- a/packages/gcp/1.4.0/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,59 +0,0 @@ -{ - "attributes": { - "description": "Overview of audit events from Google Cloud.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":false,\"mapCenter\":{\"lat\":32.1625,\"lon\":-48.67493,\"zoom\":1.97},\"openTOCDetails\":[]},\"gridData\":{\"h\":15,\"i\":\"a808a985-5cf3-463a-9aad-5159cb64cef1\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"a808a985-5cf3-463a-9aad-5159cb64cef1\",\"panelRefName\":\"panel_0\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"9e7025b6-c3bf-424f-b541-d22d00e1fa64\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"9e7025b6-c3bf-424f-b541-d22d00e1fa64\",\"panelRefName\":\"panel_1\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"5b6a8479-2c18-495e-88fa-9e3239277e3d\",\"w\":12,\"x\":0,\"y\":15},\"panelIndex\":\"5b6a8479-2c18-495e-88fa-9e3239277e3d\",\"panelRefName\":\"panel_2\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"46da4e61-e0bb-4595-a2c7-05210bfbea64\",\"w\":12,\"x\":12,\"y\":15},\"panelIndex\":\"46da4e61-e0bb-4595-a2c7-05210bfbea64\",\"panelRefName\":\"panel_3\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"4d698f07-2caf-45c0-bd48-51ea72ea79b0\",\"w\":12,\"x\":24,\"y\":15},\"panelIndex\":\"4d698f07-2caf-45c0-bd48-51ea72ea79b0\",\"panelRefName\":\"panel_4\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"c5e31da0-d4c8-4554-ab32-61da2495ab6c\",\"w\":12,\"x\":36,\"y\":15},\"panelIndex\":\"c5e31da0-d4c8-4554-ab32-61da2495ab6c\",\"panelRefName\":\"panel_5\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":9,\"i\":\"95ebbda8-9b00-4b23-b116-72569ea031e3\",\"w\":48,\"x\":0,\"y\":29},\"panelIndex\":\"95ebbda8-9b00-4b23-b116-72569ea031e3\",\"panelRefName\":\"panel_6\",\"version\":\"8.0.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Logs GCP] Audit", - "version": 1 - }, - "id": "gcp-6576c480-73a2-11ea-a345-f985c61fe654", - "migrationVersion": { - "dashboard": "7.11.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-a97de660-73a5-11ea-a345-f985c61fe654", - "name": "panel_0", - "type": "map" - }, - { - "id": "gcp-4627efa0-73a2-11ea-a345-f985c61fe654", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "gcp-eb5bf570-73a2-11ea-a345-f985c61fe654", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "gcp-33ee1320-73a5-11ea-a345-f985c61fe654", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "gcp-a8e40240-73a3-11ea-a345-f985c61fe654", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "gcp-6d90d320-73a4-11ea-a345-f985c61fe654", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "panel_6", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json deleted file mode 100755 index c3709277c6..0000000000 --- a/packages/gcp/1.4.0/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"866b5ce1-6ca0-47db-a6f2-54c5e0dcd2f0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"279da950-e9a7-4287-ab37-25906e448455\",\"joins\":[],\"label\":\"Source Locations\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"79ec6461-7561-45e4-a6a2-9d6fbd4cf986\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":19.94277,\"lon\":0},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"settings\":{\"autoFitToDataBounds\":false},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"zoom\":1.97}", - "title": "Audit Source Locations [Logs GCP]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "id": "gcp-a97de660-73a5-11ea-a345-f985c61fe654", - "migrationVersion": { - "map": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json deleted file mode 100755 index e1a7679578..0000000000 --- a/packages/gcp/1.4.0/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "attributes": { - "columns": [ - "user.email", - "service.name", - "gcp.audit.type", - "event.action", - "event.outcome", - "source.ip", - "source.geo.region_name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"gcp.audit\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"gcp.audit\"}}}],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"version\":true}" - }, - "sort": [], - "title": "Audit [Logs GCP]", - "version": 1 - }, - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json deleted file mode 100755 index 2bb80adfad..0000000000 --- a/packages/gcp/1.4.0/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Top User Email [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user.email\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":15},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"scale\":\"linear\",\"showLabel\":true},\"title\":\"Audit Top User Email [Logs GCP]\",\"type\":\"tagcloud\"}" - }, - "id": "gcp-33ee1320-73a5-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json deleted file mode 100755 index 181dcb280b..0000000000 --- a/packages/gcp/1.4.0/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Events Outcome over time [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"drop_partials\":false,\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"scaleMetricValues\":false,\"timeRange\":{\"from\":\"now-7d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"event.outcome\",\"missingBucket\":true,\"missingBucketLabel\":\"[unknown]\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false},\"labels\":{\"show\":false},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Audit Event Outcome over time [Logs GCP]\",\"type\":\"histogram\"}" - }, - "id": "gcp-4627efa0-73a2-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json deleted file mode 100755 index 55d894cb52..0000000000 --- a/packages/gcp/1.4.0/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Resource Name [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"gcp.audit.resource_name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit Resource Name [Logs GCP]\",\"type\":\"pie\"}" - }, - "id": "gcp-6d90d320-73a4-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json deleted file mode 100755 index 1fb78e641e..0000000000 --- a/packages/gcp/1.4.0/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit User Agent [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user_agent.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit User Agent [Logs GCP]\",\"type\":\"pie\"}" - }, - "id": "gcp-a8e40240-73a3-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.0/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json deleted file mode 100755 index 00dddace37..0000000000 --- a/packages/gcp/1.4.0/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Event Action [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"event.action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit Event Action [Logs GCP]\",\"type\":\"pie\"}" - }, - "id": "gcp-eb5bf570-73a2-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.0/manifest.yml b/packages/gcp/1.4.0/manifest.yml deleted file mode 100755 index 3bfaeb8299..0000000000 --- a/packages/gcp/1.4.0/manifest.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: gcp -title: Google Cloud Platform -version: 1.4.0 -release: ga -description: Collect logs from Google Cloud Platform with Elastic Agent. -type: integration -icons: - - src: /img/logo_gcp.svg - title: logo gcp - size: 32x32 - type: image/svg+xml -format_version: 1.0.0 -license: basic -categories: - - google_cloud - - cloud - - network - - security -conditions: - kibana.version: ^7.15.0 || ^8.0.0 -screenshots: - - src: /img/filebeat-gcp-audit.png - title: filebeat gcp audit - size: 1702x996 - type: image/png -policy_templates: - - name: gcp - title: Google Cloud Platform (GCP) logs - description: Collect logs from Google Cloud Platform (GCP) instances - inputs: - - type: gcp-pubsub - vars: - - name: alternative_host - type: text - title: Alternative host - multi: false - required: false - show_user: false - - name: project_id - type: text - title: Project Id - multi: false - required: true - show_user: true - default: SET_PROJECT_NAME - - name: credentials_file - type: text - title: Credentials File - multi: false - required: false - show_user: true - - name: credentials_json - type: text - title: Credentials Json - multi: false - required: false - show_user: true - title: "Collect Google Cloud Platform (GCP) audit, firewall and vpcflow logs (input: gcp-pubsub)" - description: "Collecting audit, firewall and vpcflow logs from Google Cloud Platform (GCP) instances (input: gcp-pubsub)" -owner: - github: elastic/security-external-integrations diff --git a/packages/gcp/1.4.1/changelog.yml b/packages/gcp/1.4.1/changelog.yml deleted file mode 100755 index 7b51c177e4..0000000000 --- a/packages/gcp/1.4.1/changelog.yml +++ /dev/null @@ -1,99 +0,0 @@ -# newer versions go on top -- version: "1.4.1" - changes: - - description: Fix quoting of the credentials_json value in policy templates. - type: bugfix - link: https://github.com/elastic/integrations/pull/2712 -- version: "1.4.0" - changes: - - description: Add gcp.dns integration - type: enhancement - link: https://github.com/elastic/integrations/pull/2624 -- version: "1.3.1" - changes: - - description: Add Ingest Pipeline script to map IANA Protocol Numbers - type: bugfix - link: https://github.com/elastic/integrations/pull/2470 -- version: "1.3.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2406 -- version: "1.2.2" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.2.1" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.2.0" - changes: - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2251 -- version: "1.1.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1965 -- version: "1.1.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1818 -- version: "1.1.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1661 -- version: "1.0.0" - changes: - - description: Move from experimental to GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1568 - - description: remove experimental from data_sets - type: enhancement - link: https://github.com/elastic/integrations/pull/1717 -- version: "0.3.3" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1478 -- version: '0.3.2' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1385 -- version: "0.3.1" - changes: - - description: Escape special characters in docs - type: enhancement - link: https://github.com/elastic/integrations/pull/1405 -- version: "0.3.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.2.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1240 -- version: "0.1.0" - changes: - - description: update to ECS 1.10.0 and adding event.original options - type: enhancement - link: https://github.com/elastic/integrations/pull/1045 -- version: "0.0.2" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/846 -- version: "0.0.1" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/459 diff --git a/packages/gcp/1.4.1/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.1/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index d582de0a80..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: '{{credentials_json}}' -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 306383af01..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,261 +0,0 @@ ---- -description: Pipeline for Google Cloud audit logs - -processors: - - set: - field: event.ingested - value: "{{_ingest.timestamp}}" - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - set: - field: event.kind - value: event - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - convert: - field: json.resource.labels.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - ignore_failure: true - - convert: - field: json.resource.labels.instance_id - target_field: cloud.instance.id - type: string - ignore_missing: true - ignore_failure: true - - rename: - field: "json.protoPayload.@type" - target_field: gcp.audit.type - ignore_missing: true - - rename: - field: json.protoPayload.authenticationInfo.principalEmail - target_field: gcp.audit.authentication_info.principal_email - ignore_missing: true - - set: - field: user.email - value: "{{gcp.audit.authentication_info.principal_email}}" - if: ctx?.gcp?.audit?.authentication_info?.principal_email != null - - rename: - field: json.protoPayload.authenticationInfo.authoritySelector - target_field: gcp.audit.authentication_info.authority_selector - ignore_missing: true - - rename: - field: json.protoPayload.authorizationInfo - target_field: gcp.audit.authorization_info - ignore_missing: true - - rename: - field: json.protoPayload.methodName - target_field: gcp.audit.method_name - ignore_missing: true - - set: - field: event.action - value: "{{gcp.audit.method_name}}" - if: ctx?.gcp?.audit?.method_name != null - - convert: - field: json.protoPayload.numResponseItems - target_field: gcp.audit.num_response_items - type: long - ignore_missing: true - - rename: - field: "json.protoPayload.request.@type" - target_field: gcp.audit.request.proto_name - ignore_missing: true - - rename: - field: json.protoPayload.request.filter - target_field: gcp.audit.request.filter - ignore_missing: true - - rename: - field: json.protoPayload.request.name - target_field: gcp.audit.request.name - ignore_missing: true - - rename: - field: json.protoPayload.request.resourceName - target_field: gcp.audit.request.resource_name - ignore_missing: true - - rename: - field: json.protoPayload.requestMetadata.callerIp - target_field: gcp.audit.request_metadata.caller_ip - ignore_missing: true - - set: - field: source.ip - value: "{{gcp.audit.request_metadata.caller_ip}}" - if: ctx?.gcp?.audit?.request_metadata?.caller_ip != null - - rename: - field: json.protoPayload.requestMetadata.callerSuppliedUserAgent - target_field: gcp.audit.request_metadata.caller_supplied_user_agent - ignore_missing: true - - set: - field: user_agent.original - value: "{{gcp.audit.request_metadata.caller_supplied_user_agent}}" - if: ctx?.gcp?.audit?.request_metadata?.caller_supplied_user_agent != null - - rename: - field: "json.protoPayload.response.@type" - target_field: gcp.audit.response.proto_name - ignore_missing: true - - rename: - field: json.protoPayload.response.status - target_field: gcp.audit.response.status - ignore_missing: true - - rename: - field: gcp.audit.response.status - target_field: gcp.audit.response.status.value - if: ctx?.gcp?.audit?.response?.status instanceof String - ignore_missing: true - - rename: - field: json.protoPayload.response.details.group - target_field: gcp.audit.response.details.group - ignore_missing: true - - rename: - field: json.protoPayload.response.details.kind - target_field: gcp.audit.response.details.kind - ignore_missing: true - - rename: - field: json.protoPayload.response.details.name - target_field: gcp.audit.response.details.name - ignore_missing: true - - rename: - field: json.protoPayload.response.details.uid - target_field: gcp.audit.response.details.uid - ignore_missing: true - - rename: - field: json.protoPayload.resourceName - target_field: gcp.audit.resource_name - ignore_missing: true - - rename: - field: json.protoPayload.resourceLocation.currentLocations - target_field: gcp.audit.resource_location.current_locations - ignore_missing: true - - rename: - field: json.protoPayload.serviceName - target_field: gcp.audit.service_name - ignore_missing: true - - set: - field: service.name - value: "{{gcp.audit.service_name}}" - if: ctx?.gcp?.audit?.service_name != null - - convert: - field: json.protoPayload.status.code - target_field: gcp.audit.status.code - type: long - ignore_missing: true - - foreach: - field: gcp.audit.authorization_info - ignore_missing: true - ignore_failure: true - processor: - rename: - field: _ingest._value.resourceAttributes - target_field: _ingest._value.resource_attributes - if: ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List - - set: - field: event.outcome - value: success - if: ctx?.gcp?.audit?.status?.code != null && ctx?.gcp?.audit?.status?.code == 0 - - set: - field: event.outcome - value: failure - if: ctx?.gcp?.audit?.status?.code != null && ctx?.gcp?.audit?.status?.code != 0 - - set: - field: event.outcome - value: success - if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && ctx?.gcp?.audit?.authorization_info[0].granted - - set: - field: event.outcome - value: failure - if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && !ctx?.gcp?.audit?.authorization_info[0].granted - - set: - field: event.outcome - value: unknown - if: ctx?.event?.outcome == null - - rename: - field: json.protoPayload.status.message - target_field: gcp.audit.status.message - ignore_missing: true - - user_agent: - field: user_agent.original - ignore_missing: true - # Orchestrator fields - - set: - field: orchestrator.type - value: kubernetes - if: ctx.json?.resource?.type == 'k8s_cluster' - - rename: - field: json.resource.labels.cluster_name - target_field: orchestrator.cluster.name - ignore_missing: true - if: ctx.json?.resource?.type == 'k8s_cluster' - - rename: - field: json.protoPayload.resourceName - target_field: orchestrator.resource.type_temp - ignore_missing: true - if: ctx.json?.resource?.type == 'k8s_cluster' - - grok: - field: orchestrator.resource.type_temp - patterns: - - '%{DATA}/%{API_VERSION:orchestrator.api_version}/namespaces/%{DATA:orchestrator.namespace}/%{RESOURCE_TYPE:orchestrator.resource.type}(/%{HOSTNAME:orchestrator.resource.name})?' - - '%{DATA}/%{API_VERSION:orchestrator.api_version}/%{RESOURCE_TYPE:orchestrator.resource.type}' - - 'apis/%{RESOURCE_TYPE:orchestrator.resource.type}/%{API_VERSION:orchestrator.api_version}' - - 'api/%{API_VERSION:orchestrator.api_version}' - - '%{RESOURCE_TYPE:orchestrator.resource.type}' - pattern_definitions: - API_VERSION: (v\d+([a-z]+)?(\d+)?) - RESOURCE_TYPE: ([a-z]+((\.[a-z0-9]+)+)?) - ignore_missing: true - - remove: - field: orchestrator.resource.type_temp - ignore_missing: true - - remove: - field: json - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/gcp/1.4.1/data_stream/audit/fields/agent.yml b/packages/gcp/1.4.1/data_stream/audit/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.1/data_stream/audit/fields/base-fields.yml b/packages/gcp/1.4.1/data_stream/audit/fields/base-fields.yml deleted file mode 100755 index 4a7da76510..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.audit diff --git a/packages/gcp/1.4.1/data_stream/audit/fields/ecs.yml b/packages/gcp/1.4.1/data_stream/audit/fields/ecs.yml deleted file mode 100755 index ceedc4d273..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/fields/ecs.yml +++ /dev/null @@ -1,144 +0,0 @@ -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: API version being used to carry out the action - name: orchestrator.api_version - type: keyword -- description: Name of the cluster. - name: orchestrator.cluster.name - type: keyword -- description: URL of the API used to manage the cluster. - name: orchestrator.cluster.url - type: keyword -- description: The version of the cluster. - name: orchestrator.cluster.version - type: keyword -- description: Namespace in which the action is taking place. - name: orchestrator.namespace - type: keyword -- description: Organization affected by the event (for multi-tenant orchestrator setups). - name: orchestrator.organization - type: keyword -- description: Name of the resource being acted upon. - name: orchestrator.resource.name - type: keyword -- description: Type of resource being acted upon. - name: orchestrator.resource.type - type: keyword -- description: Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry). - name: orchestrator.type - type: keyword -- description: |- - Name of the service data is collected from. - The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. - In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - name: service.name - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: user_agent.os.family - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: user_agent.os.kernel - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: user_agent.os.platform - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/gcp/1.4.1/data_stream/audit/fields/fields.yml b/packages/gcp/1.4.1/data_stream/audit/fields/fields.yml deleted file mode 100755 index a0951af4e6..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/fields/fields.yml +++ /dev/null @@ -1,133 +0,0 @@ -- name: gcp.audit - type: group - fields: - - name: type - type: keyword - description: | - Type property. - - name: authentication_info - type: group - fields: - - name: principal_email - type: keyword - description: "The email address of the authenticated user making the request. \n" - - name: authority_selector - type: keyword - description: "The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. \n" - - name: authorization_info - type: array - description: | - Authorization information for the operation. - fields: - - name: permission - type: keyword - description: "The required IAM permission. \n" - - name: granted - type: boolean - description: "Whether or not authorization for resource and permission was granted. \n" - - name: resource_attributes - type: group - fields: - - name: service - type: keyword - description: | - The name of the service. - - name: name - type: keyword - description: | - The name of the resource. - - name: type - type: keyword - description: | - The type of the resource. - - name: method_name - type: keyword - description: | - The name of the service method or operation. For API calls, this should be the name of the API method. For example, 'google.datastore.v1.Datastore.RunQuery'. - - name: num_response_items - type: long - description: | - The number of items returned from a List or Query API method, if applicable. - - name: request - type: group - fields: - - name: proto_name - type: keyword - description: | - Type property of the request. - - name: filter - type: keyword - description: | - Filter of the request. - - name: name - type: keyword - description: "Name of the request. \n" - - name: resource_name - type: keyword - description: "Name of the request resource. \n" - - name: request_metadata - type: group - fields: - - name: caller_ip - type: ip - description: "The IP address of the caller. \n" - - name: caller_supplied_user_agent - type: keyword - description: | - The user agent of the caller. This information is not authenticated and should be treated accordingly. - - name: response - type: group - fields: - - name: proto_name - type: keyword - description: | - Type property of the response. - - name: details - type: group - fields: - - name: group - type: keyword - description: | - The name of the group. - - name: kind - type: keyword - description: | - The kind of the response details. - - name: name - type: keyword - description: | - The name of the response details. - - name: uid - type: keyword - description: | - The uid of the response details. - - name: status.allowed - type: boolean - - name: status.reason - type: keyword - - name: status.value - type: keyword - - name: resource_name - type: keyword - description: | - The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. - - name: resource_location - type: group - fields: - - name: current_locations - type: keyword - description: | - Current locations of the resource. - - name: service_name - type: keyword - description: | - The name of the API service performing the operation. For example, datastore.googleapis.com. - - name: status - type: group - fields: - - name: code - type: integer - description: "The status code, which should be an enum value of google.rpc.Code. \n" - - name: message - type: keyword - description: "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. \n" diff --git a/packages/gcp/1.4.1/data_stream/audit/fields/package-fields.yml b/packages/gcp/1.4.1/data_stream/audit/fields/package-fields.yml deleted file mode 100755 index 88482fd9c1..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/fields/package-fields.yml +++ /dev/null @@ -1,63 +0,0 @@ -- name: gcp - type: group - fields: - - name: destination.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: destination.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. - - name: source.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: source.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. diff --git a/packages/gcp/1.4.1/data_stream/audit/manifest.yml b/packages/gcp/1.4.1/data_stream/audit/manifest.yml deleted file mode 100755 index bc65390c11..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) audit logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-audit - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-audit - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-audit - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) audit logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) audit logs using gcp-pubsub input diff --git a/packages/gcp/1.4.1/data_stream/audit/sample_event.json b/packages/gcp/1.4.1/data_stream/audit/sample_event.json deleted file mode 100755 index f94bbc8980..0000000000 --- a/packages/gcp/1.4.1/data_stream/audit/sample_event.json +++ /dev/null @@ -1,117 +0,0 @@ -{ - "@timestamp": "2019-12-19T00:44:25.051Z", - "agent": { - "ephemeral_id": "0365945c-c25a-4f02-b62c-a94a0b661f02", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "project": { - "id": "elastic-beats" - } - }, - "data_stream": { - "dataset": "gcp.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "beta.compute.instances.aggregatedList", - "agent_id_status": "verified", - "created": "2021-12-31T03:10:44.655Z", - "dataset": "gcp.audit", - "id": "yonau2dg2zi", - "ingested": "2021-12-31T03:10:45Z", - "kind": "event", - "outcome": "success" - }, - "gcp": { - "audit": { - "authentication_info": { - "principal_email": "xxx@xxx.xxx" - }, - "authorization_info": [ - { - "granted": true, - "permission": "compute.instances.list", - "resource_attributes": { - "name": "projects/elastic-beats", - "service": "resourcemanager", - "type": "resourcemanager.projects" - } - } - ], - "method_name": "beta.compute.instances.aggregatedList", - "num_response_items": 61, - "request": { - "proto_name": "type.googleapis.com/compute.instances.aggregatedList" - }, - "request_metadata": { - "caller_ip": "192.168.1.1", - "caller_supplied_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)" - }, - "resource_location": { - "current_locations": [ - "global" - ] - }, - "resource_name": "projects/elastic-beats/global/instances", - "response": { - "details": { - "group": "batch", - "kind": "jobs", - "name": "gsuite-exporter-1589294700", - "uid": "2beff34a-945f-11ea-bacf-42010a80007f" - }, - "proto_name": "core.k8s.io/v1.Status", - "status": { - "value": "Success" - } - }, - "service_name": "compute.googleapis.com", - "type": "type.googleapis.com/google.cloud.audit.AuditLog" - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access" - }, - "service": { - "name": "compute.googleapis.com" - }, - "source": { - "ip": "192.168.1.1" - }, - "tags": [ - "forwarded", - "gcp-audit" - ], - "user": { - "email": "xxx@xxx.xxx" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Firefox", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)", - "os": { - "full": "Mac OS X 10.15", - "name": "Mac OS X", - "version": "10.15" - }, - "version": "71.0." - } -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.1/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index d582de0a80..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: '{{credentials_json}}' -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.1/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.1/data_stream/dns/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index eca01434a2..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,240 +0,0 @@ ---- -description: Pipeline for Google Cloud DNS logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - set: - field: event.kind - value: event - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - convert: - field: json.resource.labels.project_id - target_field: cloud.project.id - type: string - ignore_failure: true - - convert: - field: json.resource.labels.location - target_field: cloud.region - type: string - ignore_failure: true - - rename: - field: json.jsonPayload.authAnswer - target_field: gcp.dns.auth_answer - ignore_missing: true - - rename: - field: json.jsonPayload.destinationIP - target_field: gcp.dns.destination_ip - ignore_missing: true - - set: - field: destination.address - copy_from: gcp.dns.destination_ip - ignore_failure: true - - convert: - field: gcp.dns.destination_ip - target_field: destination.ip - type: ip - ignore_failure: true - - rename: - field: json.jsonPayload.egressError - target_field: gcp.dns.egress_error - ignore_missing: true - - rename: - field: json.jsonPayload.protocol - target_field: gcp.dns.protocol - ignore_missing: true - - set: - field: network.transport - copy_from: gcp.dns.protocol - ignore_failure: true - - lowercase: - field: network.transport - ignore_missing: true - - rename: - field: json.jsonPayload.queryName - target_field: gcp.dns.query_name - ignore_missing: true - - set: - field: dns.question.name - copy_from: gcp.dns.query_name - ignore_failure: true - - gsub: - field: dns.question.name - pattern: "[.]$" - replacement: "" - ignore_failure: true - - registered_domain: - field: dns.question.name - target_field: dns.question - - remove: - field: dns.question.domain - ignore_missing: true - - rename: - field: json.jsonPayload.queryType - target_field: gcp.dns.query_type - ignore_missing: true - - set: - field: dns.question.type - copy_from: gcp.dns.query_type - ignore_failure: true - - rename: - field: json.jsonPayload.rdata - target_field: gcp.dns.rdata - ignore_missing: true - - script: - if: ctx?.gcp?.dns?.rdata != null - lang: painless - tag: Process DNS RData - description: This script processes the DNS RData into `dns.answers` and `dns.resolved_ip`. - source: | - def rdata = ctx.gcp.dns.rdata; - - def dns_answers = []; - def dns_resolved_ip = []; - - // Check for truncated answers. - def truncated = rdata.endsWith("...") ? 1 : 0; - - // Process answers. - def rdata_answers = /\n/.split(rdata); - - for (def i = 0; i < rdata_answers.length - truncated; i++) { - def answer_parts = /\t/.split(rdata_answers[i]); - - // Assign answer parts. - def name = answer_parts[0]; - def ttl = answer_parts[1]; - def cls = answer_parts[2]; - def type = answer_parts[3]; - def data = answer_parts[4]; - - // Remove trailing fullstop. - if (name.endsWith(".")) { - name = name.substring(0, name.length() - 1); - } - - if (data.endsWith(".")) { - data = data.substring(0, data.length() - 1); - } - - // Uppercase type. - type = type.toUpperCase(); - - dns_answers.add([ - "name": name, - "ttl": ttl, - "class": cls, - "type": type, - "data": data - ]); - - if (type == "A" || type == "AAAA") { - dns_resolved_ip.add(data); - } - } - - ctx.dns.answers = dns_answers; - ctx.dns.resolved_ip = dns_resolved_ip; - - rename: - field: json.jsonPayload.responseCode - target_field: gcp.dns.response_code - ignore_missing: true - - set: - field: dns.response_code - copy_from: gcp.dns.response_code - ignore_failure: true - - set: - field: event.outcome - value: success - if: ctx?.gcp?.dns?.response_code != null && ctx?.gcp?.dns?.response_code == "NOERROR" - - set: - field: event.outcome - value: failure - if: ctx?.gcp?.dns?.response_code != null && ctx?.gcp?.dns?.response_code != "NOERROR" - - rename: - field: json.jsonPayload.serverLatency - target_field: gcp.dns.server_latency - ignore_missing: true - - rename: - field: json.jsonPayload.sourceIP - target_field: gcp.dns.source_ip - ignore_missing: true - - set: - field: source.address - copy_from: gcp.dns.source_ip - ignore_failure: true - - convert: - field: gcp.dns.source_ip - target_field: source.ip - type: ip - ignore_failure: true - - rename: - field: json.jsonPayload.sourceNetwork - target_field: gcp.dns.source_network - ignore_missing: true - - rename: - field: json.jsonPayload.vmInstanceIdString - target_field: gcp.dns.vm_instance_id - ignore_missing: true - - set: - field: cloud.instance.id - copy_from: gcp.dns.vm_instance_id - ignore_failure: true - - rename: - field: json.jsonPayload.vmInstanceName - target_field: gcp.dns.vm_instance_name - ignore_missing: true - - set: - field: cloud.instance.name - copy_from: gcp.dns.vm_instance_name - ignore_failure: true - - gsub: - field: cloud.instance.name - pattern: "^.*[.]" - replacement: "" - ignore_failure: true - - rename: - field: json.jsonPayload.vmProjectId - target_field: gcp.dns.vm_project_id - ignore_missing: true - - rename: - field: json.jsonPayload.vmZoneName - target_field: gcp.dns.vm_zone_name - ignore_missing: true - - set: - field: cloud.availability_zone - copy_from: gcp.dns.vm_zone_name - ignore_failure: true - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/gcp/1.4.1/data_stream/dns/fields/agent.yml b/packages/gcp/1.4.1/data_stream/dns/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.1/data_stream/dns/fields/base-fields.yml b/packages/gcp/1.4.1/data_stream/dns/fields/base-fields.yml deleted file mode 100755 index bc80931b38..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.dns diff --git a/packages/gcp/1.4.1/data_stream/dns/fields/ecs.yml b/packages/gcp/1.4.1/data_stream/dns/fields/ecs.yml deleted file mode 100755 index d714c83a48..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/fields/ecs.yml +++ /dev/null @@ -1,103 +0,0 @@ -- description: |- - An array containing an object for each answer section returned by the server. - The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. - Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. - name: dns.answers - type: object -- description: The class of DNS data contained in this resource record. - name: dns.answers.class - type: keyword -- description: |- - The data describing the resource. - The meaning of this data depends on the type and class of the resource record. - name: dns.answers.data - type: keyword -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. - name: dns.answers.ttl - type: long -- description: The type of data contained in this resource record. - name: dns.answers.type - type: keyword -- description: |- - The name being queried. - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - name: dns.question.name - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - The highest registered domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: dns.question.registered_domain - type: keyword -- description: |- - The subdomain is all of the labels under the registered_domain. - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: dns.question.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: dns.question.top_level_domain - type: keyword -- description: |- - Array containing all IPs seen in `answers.data`. - The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. - name: dns.resolved_ip - type: ip -- description: The DNS response code. - name: dns.response_code - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/gcp/1.4.1/data_stream/dns/fields/fields.yml b/packages/gcp/1.4.1/data_stream/dns/fields/fields.yml deleted file mode 100755 index c0a98003d6..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/fields/fields.yml +++ /dev/null @@ -1,48 +0,0 @@ -- name: gcp.dns - type: group - fields: - - name: auth_answer - type: boolean - description: Authoritative answer. - - name: destination_ip - type: ip - description: Destination IP address, only applicable for forwarding cases. - - name: egress_error - type: keyword - description: Egress proxy error. - - name: protocol - type: keyword - description: Protocol TCP or UDP. - - name: query_name - type: keyword - description: DNS query name. - - name: query_type - type: keyword - description: DNS query type. - - name: rdata - type: keyword - description: DNS answer in presentation format, truncated to 260 bytes. - - name: response_code - type: keyword - description: Response code. - - name: server_latency - type: integer - description: Server latency. - - name: source_ip - type: ip - description: Source IP address of the query. - - name: source_network - type: keyword - description: Source network of the query. - - name: vm_instance_id - type: keyword - description: Compute Engine VM instance ID, only applicable to queries initiated by Compute Engine VMs. - - name: vm_instance_name - type: keyword - description: Compute Engine VM instance name, only applicable to queries initiated by Compute Engine VMs. - - name: vm_project_id - type: keyword - description: Google Cloud project ID, only applicable to queries initiated by Compute Engine VMs. - - name: vm_zone_name - type: keyword - description: Google Cloud VM zone, only applicable to queries initiated by Compute Engine VMs. diff --git a/packages/gcp/1.4.1/data_stream/dns/manifest.yml b/packages/gcp/1.4.1/data_stream/dns/manifest.yml deleted file mode 100755 index 668b7e2350..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) DNS logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-dns - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-dns - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-dns - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) DNS logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) DNS logs using gcp-pubsub input diff --git a/packages/gcp/1.4.1/data_stream/dns/sample_event.json b/packages/gcp/1.4.1/data_stream/dns/sample_event.json deleted file mode 100755 index 9cd568cf68..0000000000 --- a/packages/gcp/1.4.1/data_stream/dns/sample_event.json +++ /dev/null @@ -1,74 +0,0 @@ -{ - "@timestamp": "2022-01-23T09:16:05.341Z", - "cloud": { - "availability_zone": "europe-west2-a", - "instance": { - "id": "8340998530665147", - "name": "instance" - }, - "project": { - "id": "project" - }, - "region": "europe-west2" - }, - "dns": { - "answers": [ - { - "class": "IN", - "data": "127.0.0.1", - "name": "elastic.co", - "ttl": "300", - "type": "A" - } - ], - "question": { - "name": "elastic.co", - "registered_domain": "elastic.co", - "top_level_domain": "co", - "type": "A" - }, - "resolved_ip": [ - "127.0.0.1" - ], - "response_code": "NOERROR" - }, - "ecs": { - "version": "8.0.0" - }, - "event": { - "id": "vwroyze8pg7y", - "kind": "event", - "outcome": "success", - "original": "{\"insertId\":\"vwroyze8pg7y\",\"jsonPayload\":{\"authAnswer\":true,\"protocol\":\"UDP\",\"queryName\":\"elastic.co.\",\"queryType\":\"A\",\"rdata\":\"elastic.co.\\t300\\tIN\\ta\\t127.0.0.1\",\"responseCode\":\"NOERROR\",\"serverLatency\":14,\"sourceIP\":\"10.154.0.3\",\"sourceNetwork\":\"default\",\"vmInstanceId\":8340998530665147,\"vmInstanceIdString\":\"8340998530665147\",\"vmInstanceName\":\"694119234537.instance\",\"vmProjectId\":\"project\",\"vmZoneName\":\"europe-west2-a\"},\"logName\":\"projects/project/logs/dns.googleapis.com%2Fdns_queries\",\"receiveTimestamp\":\"2022-01-23T09:16:05.502805637Z\",\"resource\":{\"labels\":{\"location\":\"europe-west2\",\"project_id\":\"project\",\"source_type\":\"gce-vm\",\"target_name\":\"\",\"target_type\":\"external\"},\"type\":\"dns_query\"},\"severity\":\"INFO\",\"timestamp\":\"2022-01-23T09:16:05.341873447Z\"}" - }, - "gcp": { - "dns": { - "auth_answer": true, - "protocol": "UDP", - "query_name": "elastic.co.", - "query_type": "A", - "rdata": "elastic.co.\t300\tIN\ta\t127.0.0.1", - "response_code": "NOERROR", - "server_latency": 14, - "source_ip": "10.154.0.3", - "source_network": "default", - "vm_instance_id": "8340998530665147", - "vm_instance_name": "694119234537.instance", - "vm_project_id": "project", - "vm_zone_name": "europe-west2-a" - } - }, - "log": { - "logger": "projects/project/logs/dns.googleapis.com%2Fdns_queries" - }, - "network": { - "transport": "udp" - }, - "source": { - "address": "10.154.0.3", - "ip": "10.154.0.3" - }, - "tags": [ - "preserve_original_event" - ] -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.1/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index d582de0a80..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: '{{credentials_json}}' -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index a23c18f27e..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,407 +0,0 @@ ---- -description: Pipeline for Google Cloud Firewall Logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - community_id: - source_ip: json.jsonPayload.connection.src_ip - source_port: json.jsonPayload.connection.src_port - destination_ip: json.jsonPayload.connection.dest_ip - destination_port: json.jsonPayload.connection.dest_port - iana_number: json.jsonPayload.connection.protocol - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - set: - field: event.kind - value: event - - set: - field: event.category - value: network - - set: - field: event.action - value: firewall-rule - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - rename: - field: json.resource.labels.subnetwork_name - target_field: network.name - ignore_missing: true - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - rename: - field: json.jsonPayload.disposition - target_field: event.type - if: ctx?.json?.jsonPayload?.disposition != null - - set: - field: event.type - value: connection - if: ctx?.event?.type != null - - lowercase: - field: event.type - - set: - field: network.direction - value: inbound - if: ctx?.json?.jsonPayload?.rule_details?.direction == "INGRESS" - - set: - field: network.direction - value: outbound - if: ctx?.json?.jsonPayload?.rule_details?.direction == "EGRESS" - - set: - field: network.direction - value: unknown - if: ctx?.network?.direction == null - - rename: - field: json.jsonPayload.vpc - target_field: json.jsonPayload.src_vpc - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.instance - target_field: json.jsonPayload.src_instance - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.location - target_field: json.jsonPayload.src_location - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_vpc - target_field: json.jsonPayload.dest_vpc - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_instance - target_field: json.jsonPayload.dest_instance - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_location - target_field: json.jsonPayload.dest_location - if: ctx?.network?.direction == "outbound" - ignore_missing: true - - rename: - field: json.jsonPayload.vpc - target_field: json.jsonPayload.dest_vpc - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.instance - target_field: json.jsonPayload.dest_instance - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.location - target_field: json.jsonPayload.dest_location - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_vpc - target_field: json.jsonPayload.src_vpc - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_instance - target_field: json.jsonPayload.src_instance - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.remote_location - target_field: json.jsonPayload.src_location - if: ctx?.network?.direction == "inbound" - ignore_missing: true - - rename: - field: json.jsonPayload.connection.protocol - target_field: network.iana_number - ignore_missing: true - - convert: - field: network.iana_number - type: string - ignore_missing: true - - script: - lang: painless - ignore_failure: true - if: ctx?.network?.iana_number != null - source: | - def iana_number = ctx.network.iana_number; - if (iana_number == '0') { - ctx.network.transport = 'hopopt'; - } else if (iana_number == '1') { - ctx.network.transport = 'icmp'; - } else if (iana_number == '2') { - ctx.network.transport = 'igmp'; - } else if (iana_number == '6') { - ctx.network.transport = 'tcp'; - } else if (iana_number == '8') { - ctx.network.transport = 'egp'; - } else if (iana_number == '17') { - ctx.network.transport = 'udp'; - } else if (iana_number == '47') { - ctx.network.transport = 'gre'; - } else if (iana_number == '50') { - ctx.network.transport = 'esp'; - } else if (iana_number == '58') { - ctx.network.transport = 'ipv6-icmp'; - } else if (iana_number == '112') { - ctx.network.transport = 'vrrp'; - } else if (iana_number == '132') { - ctx.network.transport = 'sctp'; - } - - rename: - field: json.jsonPayload.connection.dest_ip - target_field: destination.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.dest_port - target_field: destination.port - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_ip - target_field: source.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_port - target_field: source.port - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance.vm_name - target_field: source.domain - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance.vm_name - target_field: destination.domain - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.continent - target_field: destination.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.country - target_field: destination.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.region - target_field: destination.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.city - target_field: destination.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.continent - target_field: source.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.country - target_field: source.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.region - target_field: source.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.city - target_field: source.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance - target_field: gcp.destination.instance - ignore_missing: true - - rename: - field: json.jsonPayload.dest_vpc - target_field: gcp.destination.vpc - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance - target_field: gcp.source.instance - ignore_missing: true - - rename: - field: json.jsonPayload.src_vpc - target_field: gcp.source.vpc - ignore_missing: true - - rename: - field: json.jsonPayload.rule_details.reference - target_field: rule.name - ignore_missing: true - - set: - field: source.ip - value: "{{source.address}}" - if: ctx?.source?.address != null - ignore_failure: true - - set: - field: destination.ip - value: "{{destination.address}}" - if: ctx?.destination?.address != null - ignore_failure: true - - convert: - field: gcp.source.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.source.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.network?.direction == "outbound" - - convert: - field: gcp.destination.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.network?.direction == "inbound" - - convert: - field: gcp.destination.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.network?.direction == "inbound" - - set: - field: network.direction - value: internal - if: ctx?.gcp?.source?.instance == ctx?.gcp?.destination?.instance - - set: - field: network.type - value: ipv4 - if: ctx?.source?.ip != null && ctx?.source?.ip.contains(".") - - set: - field: network.type - value: ipv6 - if: ctx?.source?.ip != null && !ctx?.source?.ip.contains(".") - - rename: - field: json.jsonPayload.rule_details - target_field: gcp.firewall.rule_details - ignore_missing: true - - append: - field: related.ip - value: "{{source.ip}}" - allow_duplicates: false - if: ctx?.source?.ip != null && ctx?.source?.ip != "" - - append: - field: related.ip - value: "{{destination.ip}}" - allow_duplicates: false - if: ctx?.destination?.ip != null && ctx?.destination?.ip != "" - - remove: - field: - - gcp.firewall.connection - - gcp.firewall.dest_location - - gcp.firewall.disposition - - gcp.firewall.src_location - - json - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/gcp/1.4.1/data_stream/firewall/fields/agent.yml b/packages/gcp/1.4.1/data_stream/firewall/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.1/data_stream/firewall/fields/base-fields.yml b/packages/gcp/1.4.1/data_stream/firewall/fields/base-fields.yml deleted file mode 100755 index 93e2a6ab3b..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.firewall diff --git a/packages/gcp/1.4.1/data_stream/firewall/fields/ecs.yml b/packages/gcp/1.4.1/data_stream/firewall/fields/ecs.yml deleted file mode 100755 index db6f5e0d91..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/fields/ecs.yml +++ /dev/null @@ -1,199 +0,0 @@ -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: destination.geo.name - type: keyword -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Port of the destination. - name: destination.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: Name given by operators to sections of their network. - name: network.name - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/gcp/1.4.1/data_stream/firewall/fields/fields.yml b/packages/gcp/1.4.1/data_stream/firewall/fields/fields.yml deleted file mode 100755 index 98681562b2..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/fields/fields.yml +++ /dev/null @@ -1,44 +0,0 @@ -- name: gcp.firewall - type: group - fields: - - name: rule_details - type: group - fields: - - name: priority - type: long - description: The priority for the firewall rule. - - name: action - type: keyword - description: Action that the rule performs on match. - - name: direction - type: keyword - description: Direction of traffic that matches this rule. - - name: reference - type: keyword - description: Reference to the firewall rule. - - name: source_range - type: keyword - description: List of source ranges that the firewall rule applies to. - - name: destination_range - type: keyword - description: List of destination ranges that the firewall applies to. - - name: source_tag - type: keyword - description: | - List of all the source tags that the firewall rule applies to. - - name: target_tag - type: keyword - description: | - List of all the target tags that the firewall rule applies to. - - name: ip_port_info - type: array - description: | - List of ip protocols and applicable port ranges for rules. - - name: source_service_account - type: keyword - description: | - List of all the source service accounts that the firewall rule applies to. - - name: target_service_account - type: keyword - description: | - List of all the target service accounts that the firewall rule applies to. diff --git a/packages/gcp/1.4.1/data_stream/firewall/fields/package-fields.yml b/packages/gcp/1.4.1/data_stream/firewall/fields/package-fields.yml deleted file mode 100755 index 88482fd9c1..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/fields/package-fields.yml +++ /dev/null @@ -1,63 +0,0 @@ -- name: gcp - type: group - fields: - - name: destination.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: destination.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. - - name: source.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: source.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. diff --git a/packages/gcp/1.4.1/data_stream/firewall/manifest.yml b/packages/gcp/1.4.1/data_stream/firewall/manifest.yml deleted file mode 100755 index 1262782381..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) firewall logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-firewall - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-firewall - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-firewall - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) firewall logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) firewall logs using gcp-pubsub input diff --git a/packages/gcp/1.4.1/data_stream/firewall/sample_event.json b/packages/gcp/1.4.1/data_stream/firewall/sample_event.json deleted file mode 100755 index 34c5396a1d..0000000000 --- a/packages/gcp/1.4.1/data_stream/firewall/sample_event.json +++ /dev/null @@ -1,118 +0,0 @@ -{ - "@timestamp": "2019-10-30T13:52:42.191Z", - "agent": { - "ephemeral_id": "4fed48b9-0848-4ceb-88b1-30fb7da99604", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "availability_zone": "us-east1-b", - "project": { - "id": "test-beats" - }, - "region": "us-east1" - }, - "data_stream": { - "dataset": "gcp.firewall", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "10.42.0.2", - "domain": "test-windows", - "ip": "10.42.0.2", - "port": 3389 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "firewall-rule", - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:11:30.136Z", - "dataset": "gcp.firewall", - "id": "1f21ciqfpfssuo", - "ingested": "2021-12-31T03:11:31Z", - "kind": "event", - "type": "connection" - }, - "gcp": { - "destination": { - "instance": { - "project_id": "test-beats", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "test-beats", - "subnetwork_name": "windows-isolated", - "vpc_name": "windows-isolated" - } - }, - "firewall": { - "rule_details": { - "action": "ALLOW", - "direction": "INGRESS", - "ip_port_info": [ - { - "ip_protocol": "TCP", - "port_range": [ - "3389" - ] - } - ], - "priority": 1000, - "source_range": [ - "0.0.0.0/0" - ], - "target_tag": [ - "allow-rdp" - ] - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/test-beats/logs/compute.googleapis.com%2Ffirewall" - }, - "network": { - "community_id": "1:OdLB9eXsBDLz8m97ao4LepX6q+4=", - "direction": "inbound", - "iana_number": "6", - "name": "windows-isolated", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.2.126", - "10.42.0.2" - ] - }, - "rule": { - "name": "network:windows-isolated/firewall:windows-isolated-allow-rdp" - }, - "source": { - "address": "192.168.2.126", - "geo": { - "continent_name": "Asia", - "country_name": "omn" - }, - "ip": "192.168.2.126", - "port": 64853 - }, - "tags": [ - "forwarded", - "gcp-firewall" - ] -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs b/packages/gcp/1.4.1/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs deleted file mode 100755 index d582de0a80..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -project_id: {{project_id}} -topic: {{topic}} -subscription.name: {{subscription_name}} -{{#if credentials_file}} -credentials_file: {{credentials_file}} -{{/if}} -{{#if credentials_json}} -credentials_json: '{{credentials_json}}' -{{/if}} -{{#if alternative_host}} -alternative_host: {{alternative_host}} -{{/if}} -subscription.create: {{subscription_create}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/1.4.1/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 2370c3e3c9..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,368 +0,0 @@ ---- -description: Pipeline for Google Cloud VPC Flow Logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - community_id: - source_ip: json.jsonPayload.connection.src_ip - source_port: json.jsonPayload.connection.src_port - destination_ip: json.jsonPayload.connection.dest_ip - destination_port: json.jsonPayload.connection.dest_port - iana_number: json.jsonPayload.connection.protocol - - date: - field: json.timestamp - timezone: UTC - formats: - - ISO8601 - - set: - field: event.kind - value: event - - set: - field: event.category - value: network - - set: - field: event.type - value: connection - - set: - field: event.id - copy_from: json.insertId - ignore_empty_value: true - ignore_failure: true - - rename: - field: json.logName - target_field: log.logger - ignore_missing: true - - rename: - field: json.jsonPayload.connection.dest_ip - target_field: destination.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.dest_port - target_field: destination.port - ignore_missing: true - - rename: - field: json.jsonPayload.connection.protocol - target_field: network.iana_number - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_ip - target_field: source.address - ignore_missing: true - - rename: - field: json.jsonPayload.connection.src_port - target_field: source.port - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance.vm_name - target_field: source.domain - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance.vm_name - target_field: destination.domain - ignore_missing: true - - rename: - field: json.jsonPayload.bytes_sent - target_field: source.bytes - ignore_missing: true - - rename: - field: json.jsonPayload.packets_sent - target_field: source.packets - ignore_missing: true - - rename: - field: json.jsonPayload.start_time - target_field: event.start - ignore_missing: true - - rename: - field: json.jsonPayload.end_time - target_field: event.end - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.continent - target_field: destination.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.country - target_field: destination.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.region - target_field: destination.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_location.city - target_field: destination.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.continent - target_field: source.geo.continent_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.country - target_field: source.geo.country_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.region - target_field: source.geo.region_name - ignore_missing: true - - rename: - field: json.jsonPayload.src_location.city - target_field: source.geo.city_name - ignore_missing: true - - rename: - field: json.jsonPayload.dest_instance - target_field: gcp.destination.instance - ignore_missing: true - - rename: - field: json.jsonPayload.dest_vpc - target_field: gcp.destination.vpc - ignore_missing: true - - rename: - field: json.jsonPayload.src_instance - target_field: gcp.source.instance - ignore_missing: true - - rename: - field: json.jsonPayload.src_vpc - target_field: gcp.source.vpc - ignore_missing: true - - convert: - field: json.jsonPayload.rtt_msec - target_field: json.jsonPayload.rtt.ms - type: long - ignore_missing: true - - rename: - field: json.jsonPayload - target_field: gcp.vpcflow - ignore_missing: true - - convert: - field: source.bytes - type: long - ignore_missing: true - - convert: - field: source.packets - type: long - ignore_missing: true - - convert: - field: network.iana_number - type: string - ignore_missing: true - - script: - lang: painless - ignore_failure: true - if: ctx?.network?.iana_number != null - source: | - def iana_number = ctx.network.iana_number; - if (iana_number == '0') { - ctx.network.transport = 'hopopt'; - } else if (iana_number == '1') { - ctx.network.transport = 'icmp'; - } else if (iana_number == '2') { - ctx.network.transport = 'igmp'; - } else if (iana_number == '6') { - ctx.network.transport = 'tcp'; - } else if (iana_number == '8') { - ctx.network.transport = 'egp'; - } else if (iana_number == '17') { - ctx.network.transport = 'udp'; - } else if (iana_number == '47') { - ctx.network.transport = 'gre'; - } else if (iana_number == '50') { - ctx.network.transport = 'esp'; - } else if (iana_number == '58') { - ctx.network.transport = 'ipv6-icmp'; - } else if (iana_number == '112') { - ctx.network.transport = 'vrrp'; - } else if (iana_number == '132') { - ctx.network.transport = 'sctp'; - } - - remove: - field: - - gcp.vpcflow.rtt_msec - - gcp.vpcflow.connection - - gcp.vpcflow.dest_location - - gcp.vpcflow.src_location - - json - ignore_missing: true - - set: - field: source.ip - value: "{{source.address}}" - ignore_failure: true - if: ctx?.source?.address != null - - set: - field: destination.ip - value: "{{destination.address}}" - ignore_failure: true - if: ctx?.destination?.address != null - - convert: - field: gcp.source.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.source.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.gcp?.vpcflow?.reporter == "DEST" - - convert: - field: gcp.destination.instance.project_id - target_field: cloud.project.id - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.instance.vm_name - target_field: cloud.instance.name - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.instance.region - target_field: cloud.region - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.instance.zone - target_field: cloud.availability_zone - type: string - ignore_missing: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: gcp.destination.vpc.subnetwork_name - target_field: network.name - type: string - ignore_missing: true - ignore_failure: true - if: ctx?.gcp?.vpcflow?.reporter == "SRC" - - convert: - field: source.bytes - type: long - target_field: network.bytes - ignore_missing: true - - convert: - field: source.packets - type: long - target_field: network.packets - ignore_missing: true - - set: - field: network.direction - value: internal - if: ctx?.gcp?.source?.instance != null && ctx?.gcp?.destination?.instance != null - - set: - field: network.direction - value: outbound - if: ctx?.gcp?.source?.instance != null && ctx?.gcp?.destination?.instance == null - - set: - field: network.direction - value: inbound - if: ctx?.gcp?.source?.instance == null && ctx?.gcp?.destination?.instance != null - - set: - field: network.direction - value: unknown - if: ctx?.network?.direction == null - - set: - field: network.type - value: ipv4 - if: ctx?.source?.ip != null && ctx?.source?.ip.contains(".") - - set: - field: network.type - value: ipv6 - if: ctx?.source?.ip != null && !ctx?.source?.ip.contains(".") - - append: - field: related.ip - value: "{{source.ip}}" - allow_duplicates: false - if: ctx?.source?.ip != null && ctx?.source?.ip != "" - - append: - field: related.ip - value: "{{destination.ip}}" - allow_duplicates: false - if: ctx?.destination?.ip != null && ctx?.destination?.ip != "" - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/fields/agent.yml b/packages/gcp/1.4.1/data_stream/vpcflow/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/fields/base-fields.yml b/packages/gcp/1.4.1/data_stream/vpcflow/fields/base-fields.yml deleted file mode 100755 index 09f5a3a04a..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: gcp -- name: event.dataset - type: constant_keyword - description: Event dataset - value: gcp.vpcflow diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/fields/ecs.yml b/packages/gcp/1.4.1/data_stream/vpcflow/fields/ecs.yml deleted file mode 100755 index d5927f4874..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/fields/ecs.yml +++ /dev/null @@ -1,215 +0,0 @@ -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: destination.geo.name - type: keyword -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Port of the destination. - name: destination.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: Name given by operators to sections of their network. - name: network.name - type: keyword -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/fields/fields.yml b/packages/gcp/1.4.1/data_stream/vpcflow/fields/fields.yml deleted file mode 100755 index afd0aca3fa..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/fields/fields.yml +++ /dev/null @@ -1,11 +0,0 @@ -- name: gcp.vpcflow - type: group - fields: - - name: reporter - type: keyword - description: | - The side which reported the flow. Can be either 'SRC' or 'DEST'. - - name: rtt.ms - type: long - description: | - Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay. diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/fields/package-fields.yml b/packages/gcp/1.4.1/data_stream/vpcflow/fields/package-fields.yml deleted file mode 100755 index 88482fd9c1..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/fields/package-fields.yml +++ /dev/null @@ -1,63 +0,0 @@ -- name: gcp - type: group - fields: - - name: destination.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: destination.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. - - name: source.instance - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: region - type: keyword - description: | - Region of the VM. - - name: zone - type: keyword - description: | - Zone of the VM. - - name: source.vpc - type: group - fields: - - name: project_id - type: keyword - description: | - ID of the project containing the VM. - - name: vpc_name - type: keyword - description: | - VPC on which the VM is operating. - - name: subnetwork_name - type: keyword - description: | - Subnetwork on which the VM is operating. diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/manifest.yml b/packages/gcp/1.4.1/data_stream/vpcflow/manifest.yml deleted file mode 100755 index 5b4ca90446..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/manifest.yml +++ /dev/null @@ -1,56 +0,0 @@ -type: logs -title: Google Cloud Platform (GCP) vpcflow logs -streams: - - input: gcp-pubsub - vars: - - name: topic - type: text - title: Topic - multi: false - required: true - show_user: true - default: stackdriver-vpcflow - - name: subscription_name - type: text - title: Subscription Name - multi: false - required: true - show_user: true - default: filebeat-gcp-vpcflow - - name: subscription_create - type: bool - title: Subscription Create - description: If true, the integration will create the subscription on start. - multi: false - required: true - show_user: false - default: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - gcp-vpcflow - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: gcp-pubsub.yml.hbs - title: Google Cloud Platform (GCP) vpcflow logs (gcp-pubsub) - description: Collect Google Cloud Platform (GCP) vpcflow logs using gcp-pubsub input diff --git a/packages/gcp/1.4.1/data_stream/vpcflow/sample_event.json b/packages/gcp/1.4.1/data_stream/vpcflow/sample_event.json deleted file mode 100755 index 1fc30d133a..0000000000 --- a/packages/gcp/1.4.1/data_stream/vpcflow/sample_event.json +++ /dev/null @@ -1,105 +0,0 @@ -{ - "@timestamp": "2019-06-14T03:50:10.845Z", - "agent": { - "ephemeral_id": "e58d02a0-e7a0-45c0-aba6-a8c983782744", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "data_stream": { - "dataset": "gcp.vpcflow", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "67.43.156.13", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.13", - "port": 33478 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:12:25.823Z", - "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:45:37.301953198Z", - "id": "ut8lbrffooxyw", - "ingested": "2021-12-31T03:12:26Z", - "kind": "event", - "start": "2019-06-14T03:45:37.186193305Z", - "type": "connection" - }, - "gcp": { - "source": { - "instance": { - "project_id": "my-sample-project", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "my-sample-project", - "subnetwork_name": "default", - "vpc_name": "default" - } - }, - "vpcflow": { - "reporter": "SRC", - "rtt": { - "ms": 36 - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" - }, - "network": { - "bytes": 1776, - "community_id": "1:Wa+aonxAQZ59AWtNdQD0CH6FnsM=", - "direction": "outbound", - "iana_number": "6", - "packets": 7, - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "10.87.40.76", - "67.43.156.13" - ] - }, - "source": { - "address": "10.87.40.76", - "bytes": 1776, - "domain": "kibana", - "ip": "10.87.40.76", - "packets": 7, - "port": 5601 - }, - "tags": [ - "forwarded", - "gcp-vpcflow" - ] -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/docs/README.md b/packages/gcp/1.4.1/docs/README.md deleted file mode 100755 index 2a4c113d07..0000000000 --- a/packages/gcp/1.4.1/docs/README.md +++ /dev/null @@ -1,884 +0,0 @@ -# Google Cloud Integration - -The Google Cloud integration collects and parses Google Cloud audit, VPC flow, -and firewall logs that have been exported from Stackdriver to a Google Pub/Sub topic sink. - -## Logs - -### Audit - -This is the `audit` dataset. - -An example event for `audit` looks as following: - -```json -{ - "@timestamp": "2019-12-19T00:44:25.051Z", - "agent": { - "ephemeral_id": "0365945c-c25a-4f02-b62c-a94a0b661f02", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "project": { - "id": "elastic-beats" - } - }, - "data_stream": { - "dataset": "gcp.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "beta.compute.instances.aggregatedList", - "agent_id_status": "verified", - "created": "2021-12-31T03:10:44.655Z", - "dataset": "gcp.audit", - "id": "yonau2dg2zi", - "ingested": "2021-12-31T03:10:45Z", - "kind": "event", - "outcome": "success" - }, - "gcp": { - "audit": { - "authentication_info": { - "principal_email": "xxx@xxx.xxx" - }, - "authorization_info": [ - { - "granted": true, - "permission": "compute.instances.list", - "resource_attributes": { - "name": "projects/elastic-beats", - "service": "resourcemanager", - "type": "resourcemanager.projects" - } - } - ], - "method_name": "beta.compute.instances.aggregatedList", - "num_response_items": 61, - "request": { - "proto_name": "type.googleapis.com/compute.instances.aggregatedList" - }, - "request_metadata": { - "caller_ip": "192.168.1.1", - "caller_supplied_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)" - }, - "resource_location": { - "current_locations": [ - "global" - ] - }, - "resource_name": "projects/elastic-beats/global/instances", - "response": { - "details": { - "group": "batch", - "kind": "jobs", - "name": "gsuite-exporter-1589294700", - "uid": "2beff34a-945f-11ea-bacf-42010a80007f" - }, - "proto_name": "core.k8s.io/v1.Status", - "status": { - "value": "Success" - } - }, - "service_name": "compute.googleapis.com", - "type": "type.googleapis.com/google.cloud.audit.AuditLog" - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access" - }, - "service": { - "name": "compute.googleapis.com" - }, - "source": { - "ip": "192.168.1.1" - }, - "tags": [ - "forwarded", - "gcp-audit" - ], - "user": { - "email": "xxx@xxx.xxx" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Firefox", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)", - "os": { - "full": "Mac OS X 10.15", - "name": "Mac OS X", - "version": "10.15" - }, - "version": "71.0." - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.audit.authentication_info.authority_selector | The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. | keyword | -| gcp.audit.authentication_info.principal_email | The email address of the authenticated user making the request. | keyword | -| gcp.audit.authorization_info.granted | Whether or not authorization for resource and permission was granted. | boolean | -| gcp.audit.authorization_info.permission | The required IAM permission. | keyword | -| gcp.audit.authorization_info.resource_attributes.name | The name of the resource. | keyword | -| gcp.audit.authorization_info.resource_attributes.service | The name of the service. | keyword | -| gcp.audit.authorization_info.resource_attributes.type | The type of the resource. | keyword | -| gcp.audit.method_name | The name of the service method or operation. For API calls, this should be the name of the API method. For example, 'google.datastore.v1.Datastore.RunQuery'. | keyword | -| gcp.audit.num_response_items | The number of items returned from a List or Query API method, if applicable. | long | -| gcp.audit.request.filter | Filter of the request. | keyword | -| gcp.audit.request.name | Name of the request. | keyword | -| gcp.audit.request.proto_name | Type property of the request. | keyword | -| gcp.audit.request.resource_name | Name of the request resource. | keyword | -| gcp.audit.request_metadata.caller_ip | The IP address of the caller. | ip | -| gcp.audit.request_metadata.caller_supplied_user_agent | The user agent of the caller. This information is not authenticated and should be treated accordingly. | keyword | -| gcp.audit.resource_location.current_locations | Current locations of the resource. | keyword | -| gcp.audit.resource_name | The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. | keyword | -| gcp.audit.response.details.group | The name of the group. | keyword | -| gcp.audit.response.details.kind | The kind of the response details. | keyword | -| gcp.audit.response.details.name | The name of the response details. | keyword | -| gcp.audit.response.details.uid | The uid of the response details. | keyword | -| gcp.audit.response.proto_name | Type property of the response. | keyword | -| gcp.audit.response.status.allowed | | boolean | -| gcp.audit.response.status.reason | | keyword | -| gcp.audit.response.status.value | | keyword | -| gcp.audit.service_name | The name of the API service performing the operation. For example, datastore.googleapis.com. | keyword | -| gcp.audit.status.code | The status code, which should be an enum value of google.rpc.Code. | integer | -| gcp.audit.status.message | A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. | keyword | -| gcp.audit.type | Type property. | keyword | -| gcp.destination.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.instance.region | Region of the VM. | keyword | -| gcp.destination.instance.zone | Zone of the VM. | keyword | -| gcp.destination.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.destination.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.source.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.source.instance.region | Region of the VM. | keyword | -| gcp.source.instance.zone | Zone of the VM. | keyword | -| gcp.source.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.source.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.source.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| orchestrator.api_version | API version being used to carry out the action | keyword | -| orchestrator.cluster.name | Name of the cluster. | keyword | -| orchestrator.cluster.url | URL of the API used to manage the cluster. | keyword | -| orchestrator.cluster.version | The version of the cluster. | keyword | -| orchestrator.namespace | Namespace in which the action is taking place. | keyword | -| orchestrator.organization | Organization affected by the event (for multi-tenant orchestrator setups). | keyword | -| orchestrator.resource.name | Name of the resource being acted upon. | keyword | -| orchestrator.resource.type | Type of resource being acted upon. | keyword | -| orchestrator.type | Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry). | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| tags | List of keywords used to tag each event. | keyword | -| user.email | User email address. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.kernel | Operating system kernel version as a raw string. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | - - -### Firewall - -This is the `firewall` dataset. - -An example event for `firewall` looks as following: - -```json -{ - "@timestamp": "2019-10-30T13:52:42.191Z", - "agent": { - "ephemeral_id": "4fed48b9-0848-4ceb-88b1-30fb7da99604", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "cloud": { - "availability_zone": "us-east1-b", - "project": { - "id": "test-beats" - }, - "region": "us-east1" - }, - "data_stream": { - "dataset": "gcp.firewall", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "10.42.0.2", - "domain": "test-windows", - "ip": "10.42.0.2", - "port": 3389 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "firewall-rule", - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:11:30.136Z", - "dataset": "gcp.firewall", - "id": "1f21ciqfpfssuo", - "ingested": "2021-12-31T03:11:31Z", - "kind": "event", - "type": "connection" - }, - "gcp": { - "destination": { - "instance": { - "project_id": "test-beats", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "test-beats", - "subnetwork_name": "windows-isolated", - "vpc_name": "windows-isolated" - } - }, - "firewall": { - "rule_details": { - "action": "ALLOW", - "direction": "INGRESS", - "ip_port_info": [ - { - "ip_protocol": "TCP", - "port_range": [ - "3389" - ] - } - ], - "priority": 1000, - "source_range": [ - "0.0.0.0/0" - ], - "target_tag": [ - "allow-rdp" - ] - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/test-beats/logs/compute.googleapis.com%2Ffirewall" - }, - "network": { - "community_id": "1:OdLB9eXsBDLz8m97ao4LepX6q+4=", - "direction": "inbound", - "iana_number": "6", - "name": "windows-isolated", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.2.126", - "10.42.0.2" - ] - }, - "rule": { - "name": "network:windows-isolated/firewall:windows-isolated-allow-rdp" - }, - "source": { - "address": "192.168.2.126", - "geo": { - "continent_name": "Asia", - "country_name": "omn" - }, - "ip": "192.168.2.126", - "port": 64853 - }, - "tags": [ - "forwarded", - "gcp-firewall" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.destination.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.instance.region | Region of the VM. | keyword | -| gcp.destination.instance.zone | Zone of the VM. | keyword | -| gcp.destination.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.destination.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.firewall.rule_details.action | Action that the rule performs on match. | keyword | -| gcp.firewall.rule_details.destination_range | List of destination ranges that the firewall applies to. | keyword | -| gcp.firewall.rule_details.direction | Direction of traffic that matches this rule. | keyword | -| gcp.firewall.rule_details.ip_port_info | List of ip protocols and applicable port ranges for rules. | array | -| gcp.firewall.rule_details.priority | The priority for the firewall rule. | long | -| gcp.firewall.rule_details.reference | Reference to the firewall rule. | keyword | -| gcp.firewall.rule_details.source_range | List of source ranges that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.source_service_account | List of all the source service accounts that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.source_tag | List of all the source tags that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.target_service_account | List of all the target service accounts that the firewall rule applies to. | keyword | -| gcp.firewall.rule_details.target_tag | List of all the target tags that the firewall rule applies to. | keyword | -| gcp.source.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.source.instance.region | Region of the VM. | keyword | -| gcp.source.instance.zone | Zone of the VM. | keyword | -| gcp.source.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.source.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.source.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | - - -### VPC Flow - -This is the `VPC Flow` dataset. - -An example event for `vpcflow` looks as following: - -```json -{ - "@timestamp": "2019-06-14T03:50:10.845Z", - "agent": { - "ephemeral_id": "e58d02a0-e7a0-45c0-aba6-a8c983782744", - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "data_stream": { - "dataset": "gcp.vpcflow", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "67.43.156.13", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.13", - "port": 33478 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c53ddea2-61ac-4643-8676-0c70ebf51c91", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "created": "2021-12-31T03:12:25.823Z", - "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:45:37.301953198Z", - "id": "ut8lbrffooxyw", - "ingested": "2021-12-31T03:12:26Z", - "kind": "event", - "start": "2019-06-14T03:45:37.186193305Z", - "type": "connection" - }, - "gcp": { - "source": { - "instance": { - "project_id": "my-sample-project", - "region": "us-east1", - "zone": "us-east1-b" - }, - "vpc": { - "project_id": "my-sample-project", - "subnetwork_name": "default", - "vpc_name": "default" - } - }, - "vpcflow": { - "reporter": "SRC", - "rtt": { - "ms": 36 - } - } - }, - "input": { - "type": "gcp-pubsub" - }, - "log": { - "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" - }, - "network": { - "bytes": 1776, - "community_id": "1:Wa+aonxAQZ59AWtNdQD0CH6FnsM=", - "direction": "outbound", - "iana_number": "6", - "packets": 7, - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "10.87.40.76", - "67.43.156.13" - ] - }, - "source": { - "address": "10.87.40.76", - "bytes": 1776, - "domain": "kibana", - "ip": "10.87.40.76", - "packets": 7, - "port": 5601 - }, - "tags": [ - "forwarded", - "gcp-vpcflow" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.destination.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.instance.region | Region of the VM. | keyword | -| gcp.destination.instance.zone | Zone of the VM. | keyword | -| gcp.destination.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.destination.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.destination.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.source.instance.project_id | ID of the project containing the VM. | keyword | -| gcp.source.instance.region | Region of the VM. | keyword | -| gcp.source.instance.zone | Zone of the VM. | keyword | -| gcp.source.vpc.project_id | ID of the project containing the VM. | keyword | -| gcp.source.vpc.subnetwork_name | Subnetwork on which the VM is operating. | keyword | -| gcp.source.vpc.vpc_name | VPC on which the VM is operating. | keyword | -| gcp.vpcflow.reporter | The side which reported the flow. Can be either 'SRC' or 'DEST'. | keyword | -| gcp.vpcflow.rtt.ms | Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay. | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | - - -### DNS - -This is the `DNS` dataset. - -An example event for `dns` looks as following: - -```json -{ - "@timestamp": "2022-01-23T09:16:05.341Z", - "cloud": { - "availability_zone": "europe-west2-a", - "instance": { - "id": "8340998530665147", - "name": "instance" - }, - "project": { - "id": "project" - }, - "region": "europe-west2" - }, - "dns": { - "answers": [ - { - "class": "IN", - "data": "127.0.0.1", - "name": "elastic.co", - "ttl": "300", - "type": "A" - } - ], - "question": { - "name": "elastic.co", - "registered_domain": "elastic.co", - "top_level_domain": "co", - "type": "A" - }, - "resolved_ip": [ - "127.0.0.1" - ], - "response_code": "NOERROR" - }, - "ecs": { - "version": "8.0.0" - }, - "event": { - "id": "vwroyze8pg7y", - "kind": "event", - "outcome": "success", - "original": "{\"insertId\":\"vwroyze8pg7y\",\"jsonPayload\":{\"authAnswer\":true,\"protocol\":\"UDP\",\"queryName\":\"elastic.co.\",\"queryType\":\"A\",\"rdata\":\"elastic.co.\\t300\\tIN\\ta\\t127.0.0.1\",\"responseCode\":\"NOERROR\",\"serverLatency\":14,\"sourceIP\":\"10.154.0.3\",\"sourceNetwork\":\"default\",\"vmInstanceId\":8340998530665147,\"vmInstanceIdString\":\"8340998530665147\",\"vmInstanceName\":\"694119234537.instance\",\"vmProjectId\":\"project\",\"vmZoneName\":\"europe-west2-a\"},\"logName\":\"projects/project/logs/dns.googleapis.com%2Fdns_queries\",\"receiveTimestamp\":\"2022-01-23T09:16:05.502805637Z\",\"resource\":{\"labels\":{\"location\":\"europe-west2\",\"project_id\":\"project\",\"source_type\":\"gce-vm\",\"target_name\":\"\",\"target_type\":\"external\"},\"type\":\"dns_query\"},\"severity\":\"INFO\",\"timestamp\":\"2022-01-23T09:16:05.341873447Z\"}" - }, - "gcp": { - "dns": { - "auth_answer": true, - "protocol": "UDP", - "query_name": "elastic.co.", - "query_type": "A", - "rdata": "elastic.co.\t300\tIN\ta\t127.0.0.1", - "response_code": "NOERROR", - "server_latency": 14, - "source_ip": "10.154.0.3", - "source_network": "default", - "vm_instance_id": "8340998530665147", - "vm_instance_name": "694119234537.instance", - "vm_project_id": "project", - "vm_zone_name": "europe-west2-a" - } - }, - "log": { - "logger": "projects/project/logs/dns.googleapis.com%2Fdns_queries" - }, - "network": { - "transport": "udp" - }, - "source": { - "address": "10.154.0.3", - "ip": "10.154.0.3" - }, - "tags": [ - "preserve_original_event" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| dns.answers | An array containing an object for each answer section returned by the server. The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. | object | -| dns.answers.class | The class of DNS data contained in this resource record. | keyword | -| dns.answers.data | The data describing the resource. The meaning of this data depends on the type and class of the resource record. | keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.resolved_ip | Array containing all IPs seen in `answers.data`. The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ip | -| dns.response_code | The DNS response code. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| gcp.dns.auth_answer | Authoritative answer. | boolean | -| gcp.dns.destination_ip | Destination IP address, only applicable for forwarding cases. | ip | -| gcp.dns.egress_error | Egress proxy error. | keyword | -| gcp.dns.protocol | Protocol TCP or UDP. | keyword | -| gcp.dns.query_name | DNS query name. | keyword | -| gcp.dns.query_type | DNS query type. | keyword | -| gcp.dns.rdata | DNS answer in presentation format, truncated to 260 bytes. | keyword | -| gcp.dns.response_code | Response code. | keyword | -| gcp.dns.server_latency | Server latency. | integer | -| gcp.dns.source_ip | Source IP address of the query. | ip | -| gcp.dns.source_network | Source network of the query. | keyword | -| gcp.dns.vm_instance_id | Compute Engine VM instance ID, only applicable to queries initiated by Compute Engine VMs. | keyword | -| gcp.dns.vm_instance_name | Compute Engine VM instance name, only applicable to queries initiated by Compute Engine VMs. | keyword | -| gcp.dns.vm_project_id | Google Cloud project ID, only applicable to queries initiated by Compute Engine VMs. | keyword | -| gcp.dns.vm_zone_name | Google Cloud VM zone, only applicable to queries initiated by Compute Engine VMs. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Log offset | long | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| tags | List of keywords used to tag each event. | keyword | - diff --git a/packages/gcp/1.4.1/img/filebeat-gcp-audit.png b/packages/gcp/1.4.1/img/filebeat-gcp-audit.png deleted file mode 100755 index 4f68932e9f7098f4a3ae6864701896d46d93e6d8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 507414 zcmce-2UJu`7cK~*C`u4ef5&ZY2Y;|^Wwad7(C!dk{h*^ICX=9{-FN_fsp+Vxs32f$W6fe{Vq*kh zakaJut8slUep{|VEWJ3875u(Gi-NGFHUM8?$tgeQ(tn4goSFiL} zLlfiQ?QEUwt^OL^#F!Og1+j*}934Pg_TO!7&21cQ9L#P0FS`DH`@aSNORK2(dyN0- zT&%5s58>b_=?q@u?*;jvwsv^wW(#3eg*eza*&9P7oxwC|uinO1K-?Z;=xAgA(#FQ> zpN)F)&y=Y-z?)D%Rx~t*!meI|@sCF!5{8ZtVVbLbV`k%I=45}#&M&~hF2K&i%*G|a z#`d44iZ&)tQ@8(9Qw}x(E_MN~|85F|#>CLk@PFCZ#8|-8#@^ZxyfW0<&yBA)sy<{!epYHLgDXHdo-E-v$o?16Ix+n6r5~%4D>gRi9-g#9q24 zZ%#WU>;AmB+#92q)*8znGS$JOa9WpK}8 zE#$eR#2=S)W^42xje-vEJj(v#wnV1EWA;Zhe_R*OgBkJvxYmf}6#g7XrtyW5+@C$1 zy(3Wj<9V7PR;$|D=NDSxJKoH=PX~PjF*Z6!rVU((rxGh8R^A_Ux>Rl-*YFq06n1vb z$4t_n9xNT@Ft@T5ocSpF$KJfC#0WGW`EGK^lRGUm~CySRwS)^z-@3*L|zWP zm$AF$+xW2%B9S&E7I}Vkm)Z zfAe7MO@2*b!Xm}k+x4w@IQKKt4e96VlTMo;nO0$EF_0k6x_?A~yx#SLtevsAfpe8bX~ zLe#EuY&PzUjvdk^OSc}*;9D?Yc3a5Ys_$v*1`dR#jFU4c)N#vBs{qEkbpO?&shP7| z(YO3-fh}UHM(31qjd|zZqHZ_Zuql#LUlT5h1)R`@(qH zj1WIWf*)y4`nwF)=sjTkNs-s~d^l%zK3ND`{`uu*6j`cB7~v`k`N`OKpDn2G8D9 zkImlPG_Q-BO@D~Z$H?TSpBlQ~Sif(-g1o{x5kBM!pYhQN?{Tg3-kipXS)WVH^XZP! zI4AK9@j2(bCPX)txaoY zVPT5rM-_tXiinNb?ZpsQ;$p)VQzN6#P%A5=)}VCH(sjln% zMxQgPm%sKT2)R8U=n+0;O7ki4J(;--!f){zWGJc9u%3ix-t*5sI>5w0j4r~3><>jk ztxh(NiIQKT=o`PF{2Rx7S`HK~HMa`r%qt!dkgI=2d2&eEk2HL67`Rx`ay@%U!jJ8J z!0_eEluf#>>o!!#^`uY8bEg2CDzWDRPgGoS>-eEdQswf&MRz&E6Q#5f6Z@*zaCnqu z>D1GEG=I{6c4uc_U(4-P_(r~dEq-{%6H|6| zb@k*{(U*Lh#!tn=mSBU?(tP%~U1s()L@qalVV8|brwctdgg95SU_GlW4Ut0}78Vwj zJ8^HnE3v;+S1*C|@Vw0?_1;<*y-Xc1Gj-OHuC1K$#>@Npo!Ee-Y0G)%mDkpaB(MfH zL@b8e9#o}HI+P-5MPnqtecEEves`n6%0fs#e6M3WCpR|%^s~PoqP&kVJ~;qC#){BGX z?^-T*jq_>Mkkq~PuS=e3KhgDO_e61fR$g-_=^FHTs8x0LJ_NC}gX;eLsD~dFpKyL^ zb22zJ_4cPx^L1GDng$)iBikK6>;xkSui zcm5b{v~ad}|Gs63CX;4?`d?4dx9**4gt%?>os>*&Av{Htgti~|i(FiL zHoyM(>zDa<)sc^88H{$IZdc%$4!@QVa)``oJTbh@sCjMb^h;GX5i2Q%vrP?83mY4D z#<1mp5RxE-h;=E3IBos#32KW4XAZE~X?$T=Y~aYzRoeGYY#627E?8m^#XKHnHbCa`%kfhR4! zQI@0mS~r_~qfPW(x9tcB30)7iPO9KkC+Hs&1$_7SZ^KS|sJ;*Hp@StUyf_WZ*RCh> z-ON{57P`1qQo>$$f|AyCIJ!^n(W`=%Y|GXILtlY=1t#3 zof7NzGy9xk9%*uKoUKPychKwgW1n%9#7w<^x3?<+;D=gak*Klq;}fY zDsg4c79-`0=;`Sbhm{3`PiF2My*Unyk2lx%-jjvZZ&7(xdfuo!U&4E~YKm-}ab~!h zm|3zn2Qav^Id<3OEo&&O7x$2S$k~&-P=_C@PEq8fEj=rjUne>8F&N==% zUD#;5eht0C>gn8B9_vz?3+f%MnL>K$SIk>sBh_a)#Ct!4D?dhYe^eHk6oDkoQq2`z zA}uK!PSgqD#%}B58d#Wqb;rxdWS@RUA=@#7s%7xV-g(g%8}rPsUjx?E7xI_$$0J_h`tieH(o{wP@i%?_N%7JmEmW$&GIIOJBw)2KyfC%Ug{GKpxe?MLW&X>g27gm?~%O zs6^7jMW-C^jOib!#WE!iuogBZUe;bv*6CAij9Smd8-FlrjyrJOnsxY9!yJD9sm8%- z%L&2#`)x;KdOsN%Zxq`vJwTJ9;JJ1ytm16D_Pzp%Xl&>qSA$N&+c<+$ypyRTULt0M zzj1g%Tah=#*^v8L!pitJDCbVY(d{&^eHJvIM!5bIjMwEHF2Yj1>Ph6uA0DN|S24Ne zg>ctq;%EGAMfmKCc|IOHj@qX)GO04L~=J4rwjOf~-w$0v=NmnEU z$fwBFkRlfdYoHeHdJP%C*7>&>t}I4(gt5Pqw>%xImGmlCY{}lYjHIro72%27r4;x7Udi;$H$}`&b_xp zkmpIZ)fmHSva(9o=f2S9?9JRvE3rG^0WhqiU*MWA7F=rHkx#SQLReZMO-4)wt8(^$ zq}(Yz_eS1Vaav0&^`{w90jWLZrWdA|bPNGKBF@M7y>5F)l$AwoTeL&v$bkp)%JPuK z&UrMtlgM-JO30M)+CoSu7bQA27t5;07gnEhi1?{&Gh+tyKK0&*ts zTSZNR0EC8+;R6E;506m&be3oX(721_p&|QN@7m-HGb&kkck}3Zx0RH(1J?5-95NmZ z+pb5V-{*@R#v#Oe=OLHdswa_;dUkJKoATVCKy$4Z0s8X3hXqG?vU_X%G_I#~NBxk* zKv_Lsdl;H>$J-Hiwn(#lxCU*;d&LVN@?!J7N^J7@{;3m@&lMGg!!pHQT4}!{7IJcD zh{cuD|7`pjYGFk~FHl4Ed3`-Hq@MwJ;OZTpR(SZdvVy{8n<3xU+*)F?#bM3qbRF^D zb|*%Rcs_E8N&ie(S@e?1V&j2KQ1}+t&lE^tV9Ke0kVE&*fpH1RFKeD&+<|3uHujQn zYoXoMvU~UA>_&QXu}P!*q6QjjywY)xe&ws5Q>4NdoljB`<`&L`6xALBao6~ce`)D@ z&btZf^;_V0eNhr#@>fD;cyZQKq-HFgoR(-6%sb(xiM$I9bwukIUcu(z7`lSG3q3_d zwm%10;BTo?T8H(R*e-Q9FXp$i?k+X~kGOt@Qjkc}|Ku4cgT&JG&A(x>iD9 z!QS2oiMMP0w!4ofbjYfmsDqfc@gemts6^xwJuN6mH?wu}G>w`zZP}P?uo15Ph=%d2 z*pTpk%q!q6_Zodp8+SLTJP}x;4U5vqI+5S_o!>Q-L?jwuD|+R`rk3grfqDZ~ zZ7HZMKM3}gmV6qO+}$ToSoiqck0VmDA8fM59@4#a)4O@!Q>QMbG+RJ@))sH}p4D7A z_Z<(Wme$sYh^Z@+p|7|UcOSn4gH`BR$n;#mvu+zXa}N~m_=h9RfDu& z3i8Yl#bU`G%d&_I)NW7)g(3;>`}IVDQJbmfUgES=KF6<$?6@l3Pad-nXb2Mu01^|grh1Gbwd{JG0YcQOI-Se?}-n%}X3U;S%iED4r zSnCi^aC7`VFA%hcleJ{U={}Q{h33@I&?M(;)qbd{z=v!B{1q?ccFpJPz`9QGL_C&B zt9{4&k{GzL4hq4Lwc+d^Q&YW9iyFirko)06XZNtM_A)c+IN?E1&%LE) zsi;C4Pr^gLoAdUPwn&PTJ=9Gq2l>gMFBBAZh?gLQkdc!!nfTV#>$M|(`%VZNVmu~p ze`3St06{oVYP4iQi5wfQLkw9i;;sv|>DlZl#1ue)Dxv^O3og}JDYf?c@iMi3?BVAhYKeNc%0qpz3fcY6XzKJTI%u;O3h;%F5f~D59S-~5 zZB`arLSI|1v*?zE{v7^b>g#oq<1lH7uY|DKx%sKFe*a8Y-_45!kQ#^I?!nI6Vk9K^ z_~(Doo;sge6gKXeVz)Gzmc23jm>k{YyGV!foUD(}4(_?%OqxTkyoW1G*z#$(GaFGw zLg}_}1I@_zbM>(qu`vmzhMqV2m1#mDmuP^aB2M;r0K_)gePOT;u`W2Zo1{~$T|g2r z2)(Xat3n&d;WWfY>AA^|hM9RN)Ths8P5@|z*utgF&gpd!ttEW<@`W<4nKOjAp^Q1b;ga;b&@>`LVLIKL7#n5pSlD! zB|OELlLJd1DP1cj4ZTystH6m3{w0cp$FcL+>yEDT+PkUCCgYKjk-bGYp5yziH%L@- zUnMFRcRVZ8obs>-z629WyO+6P*t5JzU-Nv{45MdWNgSdzm zF&w6vXG(Epy*@XGCt8GpYnyLfzeVXXDiUI;937((5ls?4J;QIXdT`@k4veHc@vlH5% z&I)p3t8R*GPz>i>D?kDy*PloPjuBJSTdWKt>W|JsYG1DOJI1|0FVi%YKLu^E9JGX|xV3E@?{klIRmlZRErhe_@#)Die3Ce0D zM(}a@G$s4deqXq4mo@J$>=nOR!M1=&zF=b)d2hYA^p^VT+Qf&wr)S2u&u6Be)C!LC z+&q;|tr}P$7}wFMST2E0V{&kEk_ehQBF43T8-JRcr5NQ@7cYW)td53u5y;w@GPo>K`>xC&VX>8g#?7wgO zhUr&Z*H7efhfF7lbbH-9u?&zG4+9Oa4aD7#*g4odKI1>WeIc>@GL51<(M{{KiQMaL8Tqg&u_gm?P? znA6h9n+zGCqP~0Ubs~K>7QN}J-td&ooAH7duhbf6*LS+!JctY0d}8c#lUfiTMMn3} zPTzc#bmIwLlec5r&lvn|R&F-zVomIP^{38B_ci=8Y}WH_thnp-sZgKNUN>PgLiW{8|kXSyLz+GB3UxWSqD}v|0q$=otC+&w6^c5c5#CkEkxpk-=IxP1* zI-|qswxtd!39(oiuP^Iex{^2uo@p3N^hS9>W;>tk2VCon4yw$Gad~asR__mm9yhoP zt}8@sUME(UUro0NgI%IKCChD0Bd(d|jBzX^|H@BssO?KdD`-IL8pKs6;{8ZTEGBpO zrUd7o9R+`plVS<++QsDoD{=Sm4a))yl41!vxTTj5tNPQHVRLT|qz_Q*_T6Ol=i61y z7x)&9?p|(;2fXToKh`^ziaB^_0}T4RA;yw~;hqT{jVuo;8^t$G#N7y$S(!5PoBgmd z+xV*8O^I4=N*o+_mtw5*P472L)p--@=qzB*T`Ez{JQ_dwIr^YsO1E#zEOfD9pu&Ft z3%V{Bzn@0q)A`QkVC+y)wkW?pW_&UKDY@H5T$1x(^c6cd1Iu|-61i+thq85G#7piz z{X}7OH2sUhXd)ZmN2f=g6(u#3_IXM5_eLw6-Rj2)Ut7N7YiJlgrn!^IW5O3=JHk_%mX8LPlWj%Hl;nS1zB;PuIZDKikOt}kE z)@~dvLHMksavb`hv#BJ^1ukmZJEmT4ggXU=Xs;Eduyfg!z9!a9os6p!Srw!g{;V7; z`NQCl=i_$ctDy}lk&SJ$JzsBo)E3R{{yoEr@|-3-Sj#S%o5v|+9%$Cr+|3w@1o;aNZ3Wuf~>pznEQ3CKK+Y`f{w>iPIs-S=$XJ%U;f` zuZv4Ytl0nh_=m*RL)ufNB-XxpFNG(oqEsmOB*~Cbg=tE? zM_xVzdU(B92SP4ZgB|lhQCFI^Hx6?7X%)P@sJOG;|u_#HSu7XO_qkys2|_(aZrBi-z-Fv>{`k&{2u zw{Tvglwmbvpw{&@vOOjC{;kBR(={R^ntX+>_r^fVvyNaDFS#9%bQa8+1rdoC&gcN)S_5*fsRWR{j98Gz?uq1cbBXB^1zy@zX&4dOg@gq zvW;?ln)D=z(Rz1xVaNzAd!?Pz#p#Ak{^Lpb1^!B@-C?l=<+&$W<-la`InGaAcHxlb zE)_J_3wp6(6L**pQ29Moo$1--vEctE!(o}F|M%sx8$8lQy>jgN@iW9N4FB2=QQezcL5$&| zP5Yk%c6T~(l_%h(*tF4Ax#ou)^wZz@;i|z7eC*g^J$2nn*$wHw;6(hwJ--5xP-LA7IFcAm|8c#@b zSO>Q0YtQTN%3&g!YRv^XxMo1hVLoWe)G`?z9q$*mkX#Jxkp>jPw{rTv^DBGHhwwi8 z!PUgIcT)jqZTGt<&f~{3-Sn(oDj$@JNHKdKOq}u&ja2Nf1<1u-&OesQlv2~2?EWR# zVDd`#asM|yhQ{QSke^1oh_M^MTE2IUE9iii@D8|6sQ!H0_n>=;ULrt5fR%~SR9i`i zx3{|uj<-J>_9~jkRiMCSeHC5eSAH@ZN5Wb)mWOWRzm})7dHa*1f~26eF1y!j#K{N= z17`Zl?eYTzM(xYkHnysZUVP7z>csHTR|H&sp)z6FU-}h+6O;=jTutO66=WmwT{oqo ze{J+ab676ArTZP>FxGX&b?tMBUrhH#{Zro@W(2QgN{pl1{=y!DKM#&hMeDJ6CQS{)Sc-uqU{v0m{~gA@r(K_ z^WO2t!yPFp-Rnv^kMY%1cODKIW>jryDdmL98NRSzr0fu+;Z9T@(=bZ(msU8vCYGxC zqO&ckQrSskcoPE~EGfpvn7QxJ@_;DOggq8=Yj)fqJJr#-wIkQfFt`+*-Fc9SuWiaw zm_EH(hao$*uJcnZtU{LmDjmY&H_zD*Dc0fleDNH?FbXkl^?h8SUio5X)eyMTtfSgk z>Mu4&Q5w_V%Q?$VyS}~gtgem?AJbq5E*R|g(-1N?MORb9hrpWME;57md@*U0e$7qI z-QElt=H$1Rp}}{4DyxFavG5$LEQH?77S-xVt}gHDUVnUq&P3!_ucE#)uk0|UHoXb4 zP!eMJpg?bqnF~91D#&YTOw-ovTsEDu-{^?`YMnD7 zPAe>09_v_i))IZx-c>GbdeEGByPHfnn%gzVUNg8@2LZdi}#hNAV7{ zL`jZpO0Ro7Y2>9*bjpGNZ>48(MCRk0F=6`l1bXD6Gzkl5qlHf8uXwlxKa^*M2~}nW z?cAix6Zr)IQJA5ACotHi{t_ia=auSvqReP)BDl;>g$cj+_l^;5HXGszG zs5y2#%<*WV>nCSf6&&8@Syk~i>^}3kxsiZ)q=(Y`BWI!G_5=C%TJaiWsEadNhbx;j z)=-)_+gSF2UfCD3vT@Sg6i;!n%|^bMgs6~D$f0QAcfk!lKEI~crTqbO<@OG>bKJ10 zA;R}DeMOiyl$Z+2z}+sJ+0y+Z`mvG#)4LW2!p_ie>VC+|uGn6y#j*K>;ShLFGx8a zZgM4tmf(UhWCCNx#iRIO5~?|ainT4UayAy)fM2)BSZZVZWdx=196 zlpz~zXLJn+M?ZN~cWCooC>e=-=y3Z;vg?ph3V6tNoXMnB(ox{#U*|7@E1@2;H`efY zZ1?P%$H`m@#z)cDMrGS5M8>lpt#CYowPI)YX|D9P6^8DT19Vg7nP+iF=t3xJo{%?A ztT~&L_i7wqNYcAvBJbT{=1yfqp*lT4GH@d@~IuGJL z<-EyYyI{z8p?@M47jI#4e3uM9HEa0K%aC)t6(bC3`!#EL_{2O>lj|frsPo~@AnSpv zg&}^@lf=F2(edj~frt$7yu>%G_Y@hJNog@%h1Bd++nqfYd^pYS%r%AFlH zG`7BN13XN>n_6iv@W^Or_WcYG5h*iKpC{BQPoJbI#xQ#kM*5eZT?0UDW&2d;-<6C& z-RJY&mf?M~-445fS0gm=M);bd#NsnT>_pG9g4plcCn(&dz!u*DUiA}XCltq*=$}{< zLs}W@iyzC?&egWGUIkk)VU4c_Zs%gX-YD9DZ${-L*rDO8PSXt))up5uSHR3HTpp)!2Ib*DJ;B(HTHbTDt*viuYddt)1AOMl z*cj*QXSbbe>wAzmIAJ72e(|fTEIU8Pco*#X?fA&OD04c~zYK2We5!~6fTU|MeINn^ z)Y;?m?z)#=H@Q8oeLK50PvR}3>wJgQ4xdhHf-%=cO?L-)Ze5&Df_>NhtAisyMwy4xdZEUQ1#q#|h6YKQmiB-DzCO8TV4@C-)KvszJekIGu)NAaphzq_19A(y*}^iL~Hd;&=;m>Yu@ zBJCq131noIKrKwHV$y*C^YF-sf@NN9PmN+9^T-%40d@d^9U$XlN7aF8aB{+#9|J@< zPMG5SEV^9JligDcE^c1<0TKzr_}k_#e)_qIwL7uTq41nG3+84+d*@)C4|tw+Q&t~0 zA6mcdY zrn)V=Ex_TV!e?x^Z-=-cr%wc#50-Uy_SVh^v}z7(VQ|eVb1YE&z{Sn2Vlew_$t%1= z9Aqi8t1ni0c(~{HU^|Zs^70t&-kNi+g~DLzpxp2M`)jjphb8cwV#zlsLS#%CmTQck^sZ6HqJ}9v%kPvh`#()FU~Q>o_m88|%ZXO1tEv za**EBk?y>Yj$os4yiN}ahBvW_OFjpG#gz?Xe#Lwha{`Xc4q4%I@{-$)@e4GorGtFf z|FiZ9ddfZi)8czdRGhxnub8i}|9piu&r2>fRpJR37G(c0O|S~CR8GfkSAblq-pkg! z9=T3g$Gx1WfXI8*7ukU$BsT$$0I?&fH#6rf~ z%{2}4Ci`LwZd6Uf*suu}j7T~70$;Or288KAEuarcun9=lKs~e=7jJnncjMjKzJSRs z)9+P-(Xkq;8XDna8!b!rkx?nKRtl>oGo{>AMFWA;rnHavBi@iAeSH4$Wp6sR@OCTl zc=wJ*wYT{k=sLn=miu<(Pc0mnZS;hLL0lIfAKDc(FRkp=F<@#EmGYxeZ8?V5Ra0%~ zx^EjBqVP2`TAsqE$l}A#^jAef1?cYH+FiG_DYe$2 zBx-rC>q#DG;Ebh|6BVcL9rOPE6KsqCT+-fgv$TFPn>u-KG5kyKBd30$iJzwcnE@{+OKH>7(zH1d7l&V4LP>AVsbQst;rGwaQ|5GzveL zXT|upUN5X$V3>wQb*6u6BYX`4$Z!L$SZMVgm&XMF!yrz0^J6tLX=eJFWJX}7IfJO^ zUkuet9=B>2l=_ng!hBmq^pG~YqfjeYTID;3_8hyZAUb_yq5mc9>wK_$`$Dlc;$RBr z{4huXcR=yh*v`?->Vqg|z!N?+e{S7#yi*IvI5#MiJ!~6|C$D+U7}K^N!L@y9MfT1K zhT7XBy5huCpzKqeK2LSNYMUQnk|dLNDKg+T8?hsh(n*Yk4#wpqAf{gC?Z90>@v7t0 z80cL%y&_{QJf3eyGLq6s2q4<>b=B|fOgMUiIJj`G_B-aLIzZ-1-Y(~_1Mq^34D~5A z209ly9|mW3@I%dy4#wLpC@-F*B`J}2|3Fu{{+2%H17%ZOl4X_S`ZLT&(njpm{N2s7 zB2)f-7PcsVNAT6c-c2p_7XzZAvr@pVGmhKoa?>UON(bh%np|T%vuvw7Mw#H(cTGLy z-4zAO>+|#{v+$+0;1BXh+H8TZ&|?l8YY3tPQpWZ~IMJa!>&VrmH}bqjzlW*Np{%;p zEv+p+LIe$zS0_4=jn{Ff-OBNsO8(K-n%(F2QvK)0coJok%n(JLgD*ukty{-0)Kw&( z>oPHR1%pC9HGLIH`Mjis$R8;(jEu5eyp_dJP=}^|r>hHVWMow3r7BTjZ9_>!W~(cx z2TZD1+$yvFJE;;O-ZPzM1?m6%{ED#22`5EslD5nv0U^@79|2qFi~W@<{H{fMNe&PXGnL9#9nb4|b@FtofS734zfme89;>e27zVY@9>!{%mSZ-rJ3ls) z^H^L@^FHGT1&^OHGyQ!U&oIRUacLMBlERWI=8oLEDDEZNTdsa=mXLDx4u~6GTO5*S zz0Hu-fP~$Ex4(;&gjELStOyN6aE8C`U2Sm>V{H8NQLK7A(=2mu>VS24YU;V0+YN{1 zI+^FsuYnREaEQYnXd#a8jajDbO!3BH=>w6htgLs6Nfo;&Bo(LaYcM|cwq240?hQK@ zGHE>J#Ww?$dnay5361HAX_TpLbBmAB0HHt3m5@p{0K)sas!S4Jr08Tjanjd>ND67C z=X581v+b2Pj;so;mb0?bA*s4AI!$;(YeEplCY`4}uFiJ&gq+5t2@m=} z>-m#dKsIjTuo>H46N}n)nW(B56o@K=2Za^yZGW{-)zNK@KQyN|ZDR*^W+$J?3;^c(6F1(F>uT+hpdB$Xttku$5P#mo%>I;^!{Xs?95=z0HVZ z%6{F}6kFEBPM-qi^Kq7(H(ov)`}*8E>9{V(BR`yAJ7 z$_t+*7Ys6%rrViT+As_BG+M92T6@Xu(IOhBjQ7Y>DogqV$azhvX{wgyucd3(D-8T! z^6u1%#wK74ld?Oq>8GU)mEIn;p6abQe~xxLM4lZRqfykClxxqmE?Pq!REo&T%AsM@ zQBsKwXMU|ALTh0o;h~Fbt{#6mIsyc!r7@gbbGIYMvOt`F)(z>cTsEh%n!9YyI&d%KXMV@le ztVJn{W@KjvP^I|rsE3q~#nXpUb-1mhwn-AFN_%->00@(>Uk~sZFR_8Eh*^r;gE-xD z+8Liq+H=&5U`|=tP5b#9D|VagW$sh-5#nOe!|i9vR6y+=hxMiCWp{xU71LLcLC%9A;R?; zeU*0UjVE0}4(wcyzN%eZF{tiW3@UC6r+^od%hq_<7$Cq0SG4YA$NSGeI@6C$I%A|w zBBDsT4njiA_b}P8yvC6j^hGSJZP2p0JJ%U4cRvzr&7EUGNu*{)MQvRQSfH(ht3rwk z9UFPB7f25M%ZAVdKSG!4{8>uDcw|3Cn`r-oF4+uK%}9-&*ma`*G?E8vho|ipK(qD$ z_AVvR1+R4#6abKx4x*x)A_Ey;tZz4$y5m)PRRw!2+dO(W)Zg12>{*|cZGG_|KcHDM zN_^m2uTp4}5&L7{<6U0e@JX$G^B#AY!TVdq+gg$7@3Sk`*@J|0iz^)p+&D263YuFCQ@`X#>LoP`c&G%+5K$GamqGb@j3Vy?HRH*1;WSV zO-&!jc42Yx@Th3(Hv^*%DvLp_?&}f~F75y+^DG>h_BF?$A3tQojR~0x3ivj0L4oj_ zifSpG7V58CN(rMxE|Z78>FEc#7y@QWgoF#|L1Dq$Tnxp3BOe**#`qL@Z^fsTpr~p- zR|Q)>*hs>H3owMOTvuyxqM>0se)#6zNQM1^A+jhczk&O(H|AE-yRQ{VA$f`QnH@(W z+P9zcavBKJCNVTJ&Y>=0@ZOSKp;JXMKE@b=vICA|32>-RK9-4A@M+YoxDbB?pAZa> zk&*HIye2Ke;6f*MXoc!r>l4NhZoogHiCSHFV8@4V!zJ#PCSchjI4#~~M_@40%6Q@6`Bo}KK z+vskhRB=7(L)X{dH>AI|(hECND{?QqBK)*K!Ug0n6}sOWE6UPZb|+S?P2*f8mjDRH zO=@mJyfE1MxcFG#n&rmxS)C{jag5u5vrgE+RvDy(LDG&rFP$gOp+^7PO49G9-HmRo>-ci9_+@s z)xK1BPmTf%A7IvvD<9|{&q#TqN3pM^n+f(ki0#Zb3Ks=e;q8f(oC|J=x##f_Ue|1oS4?iBNbXZ2vxoU(Q+0LBgoJb}sN>6fko&JjMt?>nMai0)y60r7 zcHD`osvkFf2RzZd2f$^bfzvYm0sDF$ zT;d+~U%TKdvpsTW;Dm0mX`cW%&(yRzE)8m%u_rv-L2+r2t)%TtwHb%k#61zju5owI z)9+sVVT#iOz6U7e0phTXwQBdfLxPCcle=;caHvE=#j2~LV`J1nl+#G8H{(I3s zJ%BVGz2x;sNF*Bwrj5c%6#F`9x>M?iU~)V^X+qqZ(Rw9DZLT`FYN+Q%2*+&yNVH)B z*yStdzegL%@AmRGkTlImgMqfFS`j=O6N`HwOPBtW?9;ay3d;L8c1L*Mh4u%{=LDK@ zd}(P4IbKvpG8twJXY3)aC5zC<^yHWk?38jEJ-bKtBoR~^gA`t?7JSHcZIYnkW%=eL zMHL=UoJZ_KGg}^If%K&fo?~XX9`<7BS0=MkBNilhXg1SPj+Lywpn70tLT*M+t3PQr zZm;#NCu+I{?nfQ%YB4s!b7LWKNb2fd?b9B&g$+;2Ga)?RrFTa{h*O?aeNCARh9;YE ziq>%YtiZ9NO*Z##IGz!IXUz%T>EvCI8QML~wqQw2?gy#IWZ{OB`H3xo843qvM-tQ) ziQJ^28@exMXve6ZhBxfL-~GhCRJ?^D5U&f;Gy3+2Lxw`sG7)b?1j~Yv_TkYBk#3VP{u~j(x@9`eGKFpZGuAV}!V}MFQ~;DZ>-zJU*&MtWMDAQC@@`n-7ciu=-YZg6);EnCUx zwG<{eX5vOQ(6Mne^y|kh|44DFzNCTCf=P4hBR1DvY9nJ~TRw7ZDjxqpO7G-@0l|>@ zmWrL>$OY9@pS@WwUfwcrKuW7*;J@;`qyumW1Dk z@6!F8)W|4fywr^>?sC!S>VOKla0o-1d+bfhGh&{Q@(!|ekBKYb@OMfG=psl7-B;AN zC)7)3`zs~H(o^Z9fO7qQm-37z9FUrrm1&1nxBAUJQfI3PhpLwR6on2m1~c0Py5wwC z1{Wc!&Q@{zg$W6LNUb8aXX z;|j~4P!NROEE5-DzrRvCk9S>5W0c&xX{yjdS&6y72xIPWkkQNDOhL(+zW>%$dGaSx zlg>}cyU`x};}|8{1+I1aAT9$zS`|%lW;Q(>54&yac+Osu^Q?GYLb3)Nm1nnDEVdm7 zrwXJ#kUR%q03hUaar-VAJg@XHQf~4<+GzfYiTqGfZqGEEq`#d%`P2gK)|5xT;e7wF zmN?;QBc~Kv`dYTPlOu~?Bu%c>@qQ8v(Ts{Ws3I1NU5($UMB6* zwu6g~QrVLDOW$@+Dt458*Q)K#PZwVpY`3X#uwj2OKa7l8T>x9!axqSC3@}fC?*=Z`VM0x1p63wtCBVR)X1{PL}xvm>G{tw#TI;_g=T^j{aLTQwcmJ;di zP?3;QKtSo1?k;JO4(U$m?v|Kz_avlq(mjc9u-5wRz4kumpYOWPng2|M$vemUjxnCN zpZmE-61xjRyFvylV>mu>n;Jte!q>w`yhd*PnPYn29cN~gCw|XW7&~zsMS_*sY%Wez(b8wt&flDUOB~E+HKNWnN?8+n7ZC)wdV;r^pghJ zzXk`E>d+W_3urimy|W}yaz$=oh!b?masnr*=Q+ zw}w_8N|_u(0M>g7nprO>IrVQt9qCVf%yik9(n0GT5j`L_lX9AETtdp=HBfro_ju>h zMVe{MW*M-3B;Hs0B;b<+M`2v|kiBdYg zeMKp1rZB)D16(107VXHy&E@GOsVvAlkWBRySQzYW+eBuN+~=~MEDY(5BgDmhW?IpmpQ+%n0H68Sy(t5;gISZ(o_AXH8 z6uTJH;8iTUXmqV${dtmby>vm@#0&^Xu9luOIag7A7U>f;8<{ZxYD*dAWNvumIlOy# zjqu=b{gt8!=&Lqq&`av@e~L(dzrnx# zZy}ohu1(%w;Qxg;{6DI^`Yl0@Gl3zcuzgmK4=;9aQfU?bt8BQ6GRPWyL+btgJL;J2 zvSgU`?)`^CNs@;5?O**@#rX(nqmo?GF*mW{vi|#blE>&s0JpKdoz}NmP8OSvZr+r} z;r8i?FPn3+W4>|s?DevnD3i{3k?iE|;oU~zmBuV7cE*P%qnOI{*9}LIlZ08ed@?5l zQG(ZmNvE#eB93vH>NwpvDc*Q6K?IVYj&E~G(d2NL0S`NwzYg{@oegg(V*qag+XiCi z;Se-$T&ce`1_c>H!y)4vh6nFXbKl!=cR3A7%bKn6gPl~4(#UXpwm@((-xO7SI| zL7QQPZpD{|CR;W4H$r2@*bzwY;OEY8$E!W+9I)pJQ2!iW9Xh##aX)C&CKrdd8&s)U zO`G$QIwWBdI}}twSEJ_*x1xe4K+&2VEji6_82v`Y(-{Q)tKqpu!eAM6rw_2cNsjmL zM7^m=G#IC&4&c@}?n~EEX&!RL+}H?n_n&e6n>j}u z2(xl#7)yWCqyY;=i4b#VrCPQq37KGjl7-thj|MceDR zIPbG${9BR#ET&7u52@i`AS{BTCL+`_S)O)xoKpY!<^6kvyUhP}jre~rK{G&#b~gYa zvvMpKJ1vtxC4Izr^##BgDzfYSD!OvmIcZEh177}XAs_iTNCwBb0K`T)hBKUOhgx`4 z+;{#>bh|i+%$#CF0Jc%i*<#@tfF@c&Cu-c(Fl7MH#O2w&SWsg7Wpd;IUpRkv+E`i{ z=bfMoIMN`M0}MBX>Zq&#&<^h3ui9Uy#wFBLM`ApaB@tow13(`jMLqyrFM!u^n102L zl_Tw5-Q^|I`XDN6dybZTd(sa8Vi!lG5DU++zVS+@%dxrB`R047^B#PElDULnvfAbt zo_Jwp{^-<#{M^0zC#V!pg92$0xy8d)V$>r*$AcUGi#jSM<}d~Z;R48zfY}rD0~rhO zpB*kQ-4p@SkXbxO{4jOD@65FDRx~`IrGMpgUpl^~xV#U3TI5l!%r!Rr{LjQ%cJczl zzX`;fCn-<@ZBV9do>m_iX^#X&<9{f{z0U=&jhw$W)F@S1P35Y+EHv+gJ@K6?F*#EB zF!saP-{bts2au+$;1592c^2aOUnC9iusnWYUKz=}<1>@#4_?d8?$owx37%lBb^Ag) zb?y2Lz<_&Eyx}Yz13y93W(X@Z^8qeg5n?~=v(o8>qDOqJzKaaNpa$ugt5zf~k&Z^4|Bk0RQTiXpf zwc4|8Gx6+BtD);6vm%r92?A{^1!_-0Yt%%B#Jal{XW-L7j_G`O6bRSG`WN@V8*Bcx zi0<|Y8xlgC5MzWfpEU@M?5^SgG58QkPcqPYbQ9A~P263P!9GOjZubY6Hzy+l=aN3b zy3%lCzQb!12WIJ`o!>(dvmX{Z=8tP4aR}N@=A7^?3NT6l37-8Px%TZ>1+2k}!n9`T zI#A-aiF#o@!vwO*c0(?wze%hDOgzj~$lm~su|s@1t|31O5cJt-sS*Hfs{gZkhX6z0 zKU7{4)lcfE%Cuib)gxP*RH9(=@Sn!*&EYB{_9+Owd@`)xiDlt%H!Z&NW zK3N~b_%tVM$pH{AT`3Qtd*&~cpLIRJsS?R*4Zlf}Q-qu;xW`8RWq)YN9Xdotf-<}9mMGY2My zI%g|uom1sxP`S#hpXSW0Ef%ofm2gN9^garRfZUxS~RnmOs}XG#SFi#%};DX2$l;1VTRRJ zoDy?lid19YU^ilVR@_MYas9tXdo~VMvx(go^dTnZ<@(HOdA?ZOm0iwc4eR8@4FUq& z&ZW=r#@lE@I(jxaIkKN`>?>j;j5Ts+fuX42Z3*S^;ErE`Mk;%y^-yW89q%r`xZSv* zB#C)GaMxUuGL0(G7xcV+N0Wmi(Nyd6!2TjgTj@l7pz^*=aJS{bNGaw9Kgynn>!svV zb$c=Vss8?T__BD4))z5#-;hUYrgdN6^H(u73oTOq%cj2&D!pA>SF@O3e7ze23WiUr zCyxLhpAU^$m&y#C9Q)n-U?kL#XqVFlT=o@>Bq3q@+@auE#k?{(u%~c{b@q=^KyC^M zo}X6~%GBPTs-gP?*P(~5=Tu5>&E#Jwaw z+Mh%|D?~i3)rzD52pwL1NvrR#83s5F33&2`ZV&&aD}wT>eup?fqJ!Uu7%C_W{x8lU zu3REbW9WaPH}HOapvu&x1AZ=?)z zGO@i0H!bfj_bxX>&Is4g zQwzw&^~H@>b>8*a+tR=9#LN;R#tTzrim~`>2$C}PNuKljSlH;u*0V)$gT1$Z4>1(P ztK_JzoaE^?;h)jez zw@4a1&{Hj0*UnbXw=?yk6lqz1t3{H00AJ-Ln$~`tiOyfG=iQbTsqoi8Y(xXCW)Cl~ z1uFHf7G6iju_H!lTX{nMwj!ey9}+uvPcj{X|9X5R-TXE8pW-@s*-{XzW+fvy`;% zpMyermu760{#Fg6R`Y{<{h6TERp1IpzQXd6(q&gpU4U+g`!FdCloP3d-(&1>^v_w%; zd9cL8zFnB9rm@i*+#IX@_S5a{?F)#;`N76rQ{Ym&|6T<@5R7m-DTDAG`mV&Y>X4K) zpYfYc74KB`TSLeOk~TE|974#}_iGk=A|wV^eOJO@)r~4zuF2c^Kuh6vRwy)Y#i2pH z_+SSRJmp1_ha$84zM7jGfDY$D!DDmr7L79cuYRCzTTfM#VtYF(~YhDZ21BRK16kNb^w_i0(+OH=H?Xmo+tJ< zfS)CtR94P2AIIq#1`MUwPEQ{Q-(Eyr0tG@9gzKgA7K7Grh^{2}F+?}k4%JaPa z_X388k=bqsZ4$|v4ZCzAhJawEtLY!Arv~sXD#^1Eyfze*tJ(ji429FPD1xTXlV_Rd)zg+E9^zd4=e#;n1G>;4e*GFnlGPd zcYI&c$Lyb8bC_7PY>DatB3DOJbbHn^0s`c-P)^X$yiqwONBiQ1ZrINDW@oHsdR?8L zY02g1u)gT%X!i3atd}oewm#d^T@NPePqC*4f^Rd%iDpKBt5I3V32!~bcdPh5I;xO_ zgEM#Q={Y|pdrwH=tK1z9-7-b#QSxXoytxXwKK2TjE;j(0F-1W6h-3l&=PgBa>q`a} zKvNQ#Bm7lRpa-oM1nvKtC9&qvqpv0=8HI&FuSlV{w+|F1F<2T5`jnp&6StoNp~T0J zAHQT`psH=ZCIOTbqB|g2$js(HNe^`VINcmy_=^8Bo2mcV+nax23YG!T3q3k|!-nzz zvH9YNVXtW)QMu?#$k0AuvyugMZYqfbC7{~i#zwd8ogI26hRlqNaz)0UKR>N*5CAbl z$L}K&pFTaKOK~Crtdxy0c@dyCr`ZW}0P75FFjaGIT|Hek*{Ix&wBOq7{Sn54M4$nmb99RWdv-#Y{G$0S%n z*Duv-%rnzU!%@gxq8&Gy>2uoN;uAbQA!)ucX(Rh-`~dCnFwU@aOgJxRRH<@j+1yuX+8xc1DLY|m!|pZxAhHsmKGN4Av_DqZ2@HI zrLcs``6Rxf!wWq5GN948GiCXw4TXH^wE9fiaVqN5#Dw6{G+yIvSEAA?$hV7Lwk+o#U4GS&H0B$`!Ju1gVTM?G#6L#>#8P%$j;Crs$eikU7PSZj`?zMR4 z?fv_JZc85{D7PVwb+Ch$+=lc2!knrjCTyP3PxpQVYJw2Vf4Qr^qGExCX z8287IAK-E6bm0UR1zpuJpKmu+3lI9_1^@!1F_dkLX-;o0bZEi|@`=mLPKSXy2c9CQ^ik9TKH`AXC z7f!6PSgTgETnBrr)a~+dMn=Z3;^Hj_&T)bLW(jd|el|9?#?wiG>&D@~gcT zJd${Ub9a0u&EG{e*M3H+uIbVOSq(e4n{i(koX>@NdwZP^J7a6N!dg($($gdEZ{TAl z)(TI{?K6*-)Ru)aM>6-_K&#IJn(}0zz^>)l^v!-}l1;Y*6*z(pD`=N)8Sv^#%q_bR z#xIq%eO$EzhHGb@bFy*{+>ajlQRh-eMg8n4-*2X4WAjS1yw%Eo#n4cRkt3V{uZZe{g!86TfpXP2y3N@Yn@RFqG<#l{GP%xEk}_8LAh1tbMgWJp9(Km;g!wW;@I z-XcFgUsCdWW_3;sU24kPckgIGxc7k7VOJG+ri=XzEx@XH#;o`I!g_UM!*=loYj}3H z7f$Zh?fqzx)$M}yK4KuybR%jJx!0KLI@(tWkB*jf*C3UZm2K);7$5Hdfu1%HvOEA5 zrF&>-qvh@Wr};?(tOb6AFp)z}XXnfN(Ov>+AHukZ zw))c@r$22HAo`o%au6U%-;e~6Lk#mx46p(0u4f;gt`ht?zeIhA6de;|J=Aok534_w zN#Kl--?)pt-x&~Foi?5)&bODb-93X{u)_o3w#t}TL>kRKT3TR&s(=QDOzy!OR%g4I zo0j(N=*MF@p;LWY`IL@}!<7rqmg`5k$u>5*H&f8VnObW+1P0~e<>R52H1JtqdJ{xh zMZpDr{!EsrM^u^u9Vf9`w*4a&d~4BB7Y;LyOATa>x&2pH$hYuI0+>A}^N{|B{#%3xn#Cry{FXVq(KQPI)ePgt7!uTFOw%!%U+ zzhZU_S2<1Dm@5O1bIJX#v(xSR&<&sE%Nsj8yP7E&^ytX>&Iil7VLmw}y1P=`;J<^w-^AB%^Q^Z=9T^v5dz_%fJ->(2Hz=pr%r)9M8n z^$93sZgCeE7n(x>V{&|fJyEnru$sjsE8gE!>1PHF`MKOH+Y_b-@EdijHs@e6t{jxH!^jwJTHkq#BvQ%y)rpl4vnEH8haI|g*I zkT60*NSs&Eza4N_C*FS?@SaSIZ;9^1*1p)1v_|vCVcu|@7!)#oDa(XmlUd1)$P=3=P9?0H4s+V3?R9CC7k6k4j$wdH!#lI4si z9%3LM2K-nZknU-hsREffYC1YaRV6Wd`vJKcfmg2{qYgM4SIr){ycrV#p6cM{$1|W_ z7yvd}nN!c%3b$eZSDi&Hv-VwbIW0mDLHU%%Aj z#>MRHLuBE~IPgH^@&SvE4sNsip=PNWR(&x=Kq=g&?Q+8!#-)NoN;*%I;`fB$+eR(pI#5wWR5Dq2k1?fxN2 zwu7G;HLlFVVBw@C@QQMFU~nIT$>td3Wl|qHGo6Mhn$>6x&6=fS!bwZ$=wuTlm6V>g z2Vm*VR^~084G)zxBxubY*m~G((SSB3M^}u6y=gr|+YvutXyEbe1`1BAA3o|>*O(*K zKrt#cf*ck14k6@0ow`dqB`rD&jbZUzJ1+~BO~E#S0T-$;D0IGiurFXS6?(?Go&v~} z{$XVdwdvqmkYAAZvLr3NnJl)i6C7{QO~P9m za7=0U_KPcVPGw~DinDA9C#JwdKmY*^k%&i6;2oOk$TEH9|Jbx;RX$xQLR!JftCD)9=<^0IIMtjF;SVt>CLE=;_fsDMV%L zl$;Xk{hokz`(-q*Fgp4vXz2n?4y{X8AHFDyfBcB^gn-Gg<6vni6h6I4_=1Yc*yQ=d zT3abNP$H4r9JzJN4)+=9Jsl4;82~wF1Z+~$cQSV9_V)ImH3BF{zUuAkwdN&tJK8c* zzZ~nMH%{c4M@MeYRDJyTN#Itv`lhP5loXLDZwexkf)#%Wr;t#G9#>C&3gj-ZBm*6Z+9nohJ#H zkKmXJN){2j8uhHc`@u|1a8c9HMI=T^tDBL4-_2|}Y^>@7Jw_1WQ5li7fgS7&q$d#$e<0%bBl{)&!`Rs8Tl5=eVmTU##?Itmi#>b`;7Oyo}}*>Sw-St?zz;sv^G z_kp=idq8Aj;#=i)QFau})thq>{mo&@X>*4Zmn$OiV8S+fI!n)&*76Vlj7Nazs{$m3 zla|xivpf;$zIq<75y9{uKDcE*Y`hs%kHp23djI~nZdo|s>Ow7t)*!L!l@Noy+OYen z&GIA#HUk&$&D0P`yNNhLDZnLxQ6&T%pOK2Nj9T7ti>+eP@)dg#-{QlB#6)_KuQPEy z`&QWR1>)bM1r&02{Y`B^*&z2kq6avIxUQ})a3k0WF~#or4Zk*r?N7nc9)QMQYPF;* zPU@gqGxY}s%wk|j2qJ~Ba7tXg|afOVy?_OKp}M0G|4<~cC>!? z?K#aaFbfD2^z|c<)|g7TKDU+c3MM19PysgpuDZw^etrR% zfkO~F@ZMhNU0Ph8FO@flkhAxY@P^;#FB!IY1gm@CB%`zyfo0l{k{4(s0!nOm+E zz$^j%aElbDBje|Z3Ex9Qe?P-{J%WjaO9uQ?9uo3F2_zL=zQu?TIabSq9;^p}TWcOI z_oi>s%yr?bSsikRm6owOgieBF@87@wl~+t7B*Y{b>n;Ht0h&CKPMPZWkPrY)aVM=# zkLZB=^~DR#1wA|<(AKR|CE_rA3VOzV=B7Hw0MT{7cC6GvAc|={V<18cQUUNG1>oy^ z(N-j7WTv+qrY0r=v|6@}L=2`&(*;k*D;iIFTa3+(*Zg-%s5m${+~)QGY&fnoWd$t% zsS`6eE2Io4kw@?iHMQn{GOagLlaWCex$Fr8afVxqE)9q)W#R>a#_3Co>r)nE`-Zyx zW|Z2EW={o8&7SCu&<=CH%eYOWMZ~% zN&Vx;w%>k1aYC;6Dw@uGD(Z)La(tK6%7yAu9v=4)3ZZz|KW+w6G1S~j6?PjWL3Tp` zVpHHF*-R%tGJ@2SBa}A@I42F006ViG5Od-Lb^d;fCG^~b$qoa~0Fc}J;W@32crMx0 z{T`Bm?YZFo`IQ-}Ke5f#cy}9+WVZ}t9e83I_Upm`2>FdkttKKIdlAOvThEAywq)Yj+05r(J(RnjOPgZ1FP9MniSagPfd2)ErYPW<{v< z*oE@y@&nuh9556GK1O9UsJ%PQ1{92cf*o}K7(rYFWM11P(5d+N;sM?u$9u~gDsrm| ztS>c(DFtRg6xgnz{5Hrw$QX|yxLY=ChW#(g%h`K+dx3K1YZ5+NWDqxty_4W@InhaS zJ&V7O)qpNm*GMKKej< zMcN3^w0>f&NW|fyR2xi%nL7ArBUJ)4!-1CRe%@tNWX%57H5)dU{+F~egz{!G=zx{F zwPl>-F`Gx?adBehlU-RDTteXX7D$`Be0fDB5v)B|TLv82t44Rs03V&V0jvf`)W9Rh zTX*09%jetXV-pw}O3Oy+MI=Eo2$Gij(e_67p!W_K9Q=8Gk4^*=vLzMnGJ?JN{ks*r z$+!-Q{i+Ny7Fp#OEQM7^P|oNVPHakwxSSj}SYPP<-G44t!q#>x20Oq&-8xt!BO@gx zCI9*%$a=w)G(&AEu@5Q?cDRA^sMLFz<((1&tFzBWtk%oE!wz!s{lIWg2s4Ln{(6}s zlh6V36YDzl`?20XC@CpJU=5O-*SGo;?DaR9TPrI8#0kJ8V`HGV&JIpth#%+(#EauL ze>}rC16BpQZikiO5dRNj#az}bbFoCo3Jo)J3|NLg*)k=-q{@hkKmYvs^L=J8l8Fgj zV-LV0#}8#=VBlyBV*?tg*S5_7!}D$n0~EV)@7I@v1cyzB z)u6~eiH)soLlbgXa4@=-ZMDe8*Q?4rpw=E08QH%ymdoyOUCV6llT}R&n}zBN#O&Dd zgJTUqtd$IGSRmR8#4met7Bsw#I(Xh9t1iCeL3BKOGj zbO&%ZM7*p%0Pdq;V5n#>+n+6dE@EL82Dt#UOhZo}k*7#&3!2p;qNB%QXX~r__uFfF zS~WC@FY5l0JCBMf0I_K&VGt^?Qy3rsHTtD~4mqQ<-OSP%GkBH;7sx-lLWuja0`cn2 zImE@pSZ!8O+1c48<>YjaR;7~c*SEm(eH<`0lP=3$F3mVHGP0^4Q0)kC1(`(dpZDKk zz3c>p@j-~AJ3CH)pS|BZmLJa;;zjOSz~Kr9eOl@*Q>m`^*ox15C@e0N$LRB46>m9E z@jkh=n?wS~hCP(UOI?&VEeJ!DViV91#zwV^&$#bm-(_V|hfFcWBx8{sU%E}h&g4oi zZ-6G1UhL%J3_m~tq|N4=s_9A`b8~N$G(X~`DCq9SjV$?g7jNgyrD!e^K<5=_go-Lw z>OOq=(j|1h5C++~Z(#*MjN|?>t_E&e)o}8*Xr`jsnPk0YwQvw#C(%1soDFq(KpAuTswevRC<5W{jE; z-9f5bbZDwnNJD8j3~4@(hZ5d3*v91Fc^ zHusDf9XxYpCG6lFV1~HM4+iY@T9)X^&wgrvdO#;s9ccFM@nTRQTROgUI*CAWEs_8M zb)zd_jZu>kMoW!(Jy z0z{AztHy5R{)JYm+{DM>@?n#r!}2kRd6pa+%4Q0|jxgC^xHtVI%Ru?Y>mN3rO`76A zOioO0I2BtJ{P^kpXa4K8i}=6G|0KM4Li_#+h9YqYw6A4YW&1JlaG#5B-Z84Ct%!2q z$;g1JGWyM^v9r%$`}ps^ebs>1&~k0U^f}FfA?jXCw!z^SK!-jdVZNhNe93AWt}k)| zbSw^09!z7UUADR!EuUUk^THiH;XcEgXv=3_W5|IK>9!f*=#i|QVOQ>`sg<4bFeEPo z1X^TSVd>bR5wDZa^UZPralfrCO4?U=N}q@0R-p)NeKS;0nUZmHJCTbuJ0OfRgpTa! zh}iSt58pInkO%F>ENV(Xx0AOw53i?}oX*Mc9-=uA;~_Vt_zchUO`MYKUJ6gbrenoQz)E@#rn&vdSumdUzEe)_A?iwDwBYRvOu98 za{FneBm0-am=76wV@4C;9$an;_e^B8)AKtict+l5WLloB-QuDnAHwGzx(Uet!5=4d zy74+V&oOqGD@m988dSA%POEWd4$;$LVijBzB9Od6 zTAk_c99(@f?k;0k+Qi{P2X~;`r~@Z@u{soH2I!59E%uzX6nGW0`BgWZ$MLgRRu)y5 zLNZKc8eACp?Rtq_i51}+mkk9ogG|n9;%+ST_PgmQ=O1L`Y>X~DmBZt9$%|2kn-+&d?5af6nIPp76jFFP;r=*Jg-jDgvvZSWfnYY82m@h(uzOiX3nJRwQ>5S%k`bfjZ`Zohk!2|JzzD-9}K0DN`b2o<^ebIo%>GU>EHq^b*IwC!c41?gbyL(iuA zwZpY9R4d7;5Im>!yy}ETaLq*Uk+IRk+`#hyw%*l-c6zIE>-IYB_|On8={Nim$upM! z4O>-mKpTbc&H|aDYdQT%{Rq9zLv1#683$ezj3@pE0k*?t0w^IV)voZ%MUPO+J9Rt3 zp@HfnrgUFPS5nf@&QLbLTe<3~G66`&TbUdpVSJ&k@#>PzlNsnz#jJyce>0Xtura)B zlRM|^W_G2l)b9DmF*3ziy^*zR*7i(g7ZH)_{V*6rK=NnaXd`4v6-RkNU-Q_0_e-)UvvQmt$weFRcnVaGW zhsADwB^VirXs{cY9UXn6VJ_4rdiB~i1X{zX2s#nKt9y_nIxtU^VjMJiielN@`R`G4 z`M`Se&+d?+{7f~Az9h{nle%738+H`q&IAZ!sP^c)(>nTPU#b^xpbM1PsMyrsbkH6+ z^d?rz10aS}N-66};(+)^YrdbK?Da8aDB0L7T6SyZ4FH}6wdg;tNF_p^hTV9+SHt)o zQn_TuFVIAWW4(!91(XN5AG2-hUMv$FU)D6B*E5a)U#?S=X zIh0S-oVie{3RZFYNa*V^U(vLHArmO+(Y%{7+nafRsNMr~X{Yh983z;>A81&g0i_Pl zzOM)&Z~~AOaBSnV)FJsdZ)C#yXs3myGte0c$LpajJdU*uEwIp=(BwbJq+xy-v;0Tx zXg;Bk2fsDy@TI?I1?s5&h6p67Q%>i#SL|HsIPfh%hr(b;#lh7p^P1vtR6n^5ZRqV(ec&*z67_TtSqbiQ)bOL;$sN^Dlel5SgJeVg&XtnNfgw=Er8%=*A??0RGfIc{v< zd}$l-QOOIzkO$%|$7av#VEF9=Zsv`u@2!a73&`l9Y9*{7MVGxgOl;eZu^%C4hLSc@ zPX>w?1Pyyf(a7Q`h_9h%Lf$hvRyHmC!YCJ#aRX0-#?_~g!{B*B%rX^RNJj24)u=JVxJI{(@SzWA6DoTS+jyYLgv_Q|2BpB(Y;i}ymJ2pF z!e*tM-RrCjXjU^*aNR-W#RATT>uDZKPzU!3X8k~Mm`y5g= zL&5(l5>$=~m7lzOm)+4JrWg1d zlHe|QhV&i7g^tYUdX;V=HFNI-Vl}@l&)2{2$MYw99;>L??Ux4nsf9kCx-z14Awk9 zWaKCUk9QVmfG@<=WEkojiv>PqlJrKvKzNYmgYq2KRK)Ds)briRQ_OI|wZNiI+}`n7 zoJje{Pv_!>N!_+D*pIK5lg3`*QJ~9aNpYZ2Dv5k(QfN>`e%ODE-`zL2 z*Lk2T&RIk%TOa=V2k$dxl!A;Pie(7l_=~fV{3p^fXcfN9>%G)8Z?@jqjVuUP#!!0k zObK7{9!} z7$QDXbN7MuOMN|mJU@rDY#!^2m+O+%=JVZN?R2OwM*VyXis#zO^m2RFY!I?WjgbQa z+5$iRdij{k2MA@GR(uUllAe)J>0L|pxIj9(e9$BIV9LJk^bA_N7PE6XQbWEmoSvy) z@mbe8cBlEk*yAeM@&i4=rOMs%F*@ei;ig`T7=_b0()pp*-H|COqUTAjXRtLM$=osH z;@!gAIk&!$#!K^aN-q}A9kuAbXCCM0!mrQ&Aln#)9{+5)eN60s^=rbUaW7}b2?|~8 zU%YE~tUH|~uDjkgy_i*LZd+#}cJAAJNrUyCi&%p;TYX*qC+d9VdS!CKWR7kiH7yK# zXX^!y*1`?LdcAOoT;< zuw%tqaEOYGz%Kh?F+*IjXfbUYDhVa4mybP~2C7-U5+!v`Nb^R~+8YY@je_{h{pz!_ z;n_K5T857=)hHAzWc@IY__)7%pI8P>Q^>BU{zfJ!xAkq4tgDp4&Uwn25hC+sy3USq z1Sd<>tP*85#1&D4vrA~B{{0FRaFeao#N&EKAywrb`jk>ulA%` z3xZVmZa~E7(vk$(%3K}&?IxB;drkA{+rdzIR(AIOP*SMV)fT}oXR; z4wQ@8MUO!6KRXf<37fG`p1+4YkMPd+MI>nx-_dst`%~`Kos%I$xIZQrWo{dG)_*l3 ze%^S<@psBXlXN6zzcqbR}Vx7mc zb^mrxVy5AoqIf5xYN?0LQ&vTVfG#vudndH-Vn&`!Z)mUS-Ps`PmXNNS)-nz8bEwZJ@u?FDy46zB8d))+t9{2W@SZxsR zrEQ}{SC4py?)d9#HdqgN=9q`u2F=s0%*g4!x2^6j@LrK*kAE63^CL8rlTJQmrL_%j zw_f*2=!(_$$wNOkH0pktwVBfN)CdfuuSM1*C_L-F#s%klLcOA%JP`S$PHU2A1$3;_ zk@+U8EQ^0H{1;*uu+}Rbsf0hiTWew~E$L$!r@4N{#vZ!LA+p(e&`c5$6jx8bDc1Q zylqJHALkT&_@yyhH@ipZQ^fS?^iNmBrPzuo#v9b_g;5;;;(f74)8T$*b5?>VbqQ%7 zZ6C*szDuj=JehBd34rveWbXfod!(O1TGkjWoMi@%wzg(u99wqp{@LrBHPZRpVPS8h z9ImQB5YjT_I9HGvB+WR6Td#T%|89_P{d)H;YFkI0RLbo@#kdKVE|C}Z!S7?1(J5#M zwzrDI{@Te_#r@3jG%j(A*O(dYFSIA|T1Ps)7;F_KU%Xjpzn*Eia0g^tKd1gRh{z?M z{N4KJ+Zho!BWZH7Q_3<=i-$j!`-QvNLj5E9N5wnkMnl49dwi`McL%opG6M$(VIKV# zTNT%RcaRq9b<|h(6|d@1Jr)}c@GM>W5@)L2pLkyTiL9&!Mjjm*#c?d0w^ zZWLLrONd+%IW9O$Q|Y2Lpy~BZ$_n1>7)`U*d-=ezDvXcC5!kJJ@WO-#CyR*dPGg9j zFP0>nAq@-o+Y}L!X;sE~lvm478fI>e$b@gV7ImP5eev}4O474^b$S+~spjMCU2C)2 zbAB_A3;gxj+j3;vcjq00o8Y08565?Y?CmiUZo+nS+x7Ijg#kY%z>V&zd&)3HU>FNPW#3Icb^twAQb>F|2a>Kw8l75X^mb1-o?_kJWgbpP+v+FuB7fhX>JuLsbaqI53X7rpFiabkL1r2ymsoTm)UyPUKQ^! zzJJ4`)js&pY?m{syWOm6zRLZy{_Aby4J89ikIUf8C7Wr_;E-C*r?F0xUc05!n=fTy z4&WF+DkHh%rTyj;``d$|+efe07sOt)RZZ{6mp*^n04-Tdc*^D5IfeJ2T#W>mjTS|e zgbp$?Tq^7OyTaOG2VRS|lT)}tUdMtv3ZMP5lGC73ihG1ns(XaU#qZqjmsN3tDWti3 z&R?@56lS026maf!&PpQ|B!A<>x1A|BK#~Yc(&g4#F7M-JA6^V$L(aCByc&p-LuG~v z`*Zs*rE98By`vwXKPRD+3-w_`M?Wbnul#Q(c|W&0P1?y8pPm->BUV_!DU#nGw;T(3 z{;v9{$dY2-qQ{jir@+jDt5DUIR+aNbqY-)Fi?^&mjYF}e0jWkq-7lqlr<9BW2E09Q zVe)?aUwjYhaakk%m^2d1=K6)aCla7RHI_m-s$);{ttJq5H`UsZ9pOKp)D?n^{noNM)AzzPW7lXL0w#R!s zI%Ncd6d8Kywgd0rm9Oy8RECqixAK>M+5%95=I8~OJjS0}J3C+O7)>8_5eizmHx*7z zevoA>nw+Y7@}Xd&XG7Y~(NVn=RYc;qRabauo6`uZ2F_Qi;Y!Dvc-BXwM@f!4uCBuw z=1lYkwI-s4(h9wVZ_89E6J?7oR4GBUGQ^OqAn}0P(Kxi9*}9M|MBjyBV)2m)7Oh>H z7HXo2g{P*wIz{{gjigi=9r-?!mTO@UX-sCwV6-WJ&iOebQJUU*EJ*w=lk0t6j#778 z)$+jk!oZNn(aXDw^E*lIit?9Q^o4>`>Wz62(- z6bI?E_bdp(FRm6nlehASgfEuPN2V6#1<5up4iyDYd;$XNm{oS?-oJB(? zl2KIprsQ9-EZC-{ubgDD70(_i1=#oa5I|C7f{UZynjyAqT{GTDpCG+7j|0^I_nK;v zua+L`Vm{sekihjczqDzJ-&(q}xBmS;Z5G9Pif3hicI$gnN)5@Zu^wrr-#^l$b2QH- zv!e*In^leGu%o<-eP0uEgvGHVS8}hKreP3LzMQ0S(YcGzz^X(>^mniidH!;ev*KBM zSLi7z{ijzdFJpSqF^U;cbkaZ2k~waP$d|jl#TVt!z%d`Y;!5%{l+t)O{6(!3p5=ob zgs0W@HMklUf+HPiHo*R9vKlu&h9h*{H4>&{LqPQjmB&=9nQ@fKB- zUae;E_$mB+4}_~yWFDIkvlcVrc4B`%l`)6i0&Vj5rVDVd^YFekE7I7MX3gsTMiRf( zg_)ayxifg?|V=W;#2ZN3+K0>Zo<<7_A9(PzG68y=_>rl(gJ^IMJ zr{p)&DAT3ZcpC0EZr5Yv*{Uy>C2c2dbVX)kx02eHmT55uqJ9M%dAD6D5deV3B{IMMidincWqAO!aWcXyYdL4sTG;O_2Da0t-2G#Y}ty9IY`+}+)sIhm>V z?wx;h70_MPXYaMvXNwJ_0K~z5Ya$q}qb7z5%~V2wfrFWHSQPt?Hp&FD5q9^q-VWPL7RO!9g(*x)r-#7=0bo zJQ4A{u#m=3_?S48n<@-&+*qyyL8zVY%hI%!3oI<4X)3eplgcmp zL{F1<>{)3pRt_$RXxbtg_tJKKVf1IgF&gmtb*KVHPChZTe`0D0f$LmoHJv-s9p45k zr_)e3dKd|vwZ0Jrz4PDPSzTj-xubkM4@y2CT;OFMATaOuagGyL69k|pBG?mTUu9vy`=Dp?- zb}f6^r?)bkDUr28kgAjRju&XhGBd;^{U<|)>!UN~G%FHzC$i(OZ(M3zhT)2)p9dNf z4b2Oq)pfu0+}arJ`G9^#T2kc^aEIV4kZo@sJw9CLC5l)DD%~XErB>cb7O!}roTr)T z8t;M1mOZa-Huj!S2zJ8@GO5s`zwZc*rD+pquWv1SS6Gijan#r(q$@LmKQ>Z43>33WZFvfw&aG=xgK2{;N4 z6{WM=co*jrn3WLvJgc1x)cxGc$@d2vBa2|-C7gIbnC-t|9XI$gbJ3jh2;{M`m}N8c zjYWknIK|Q#K9q6PX(DS7BSx@>C^a>c^*;v(X_|2&QWZGnDuqW#i!<$vpo@^?kq}-% z6u&SXr0kv}F~W$Uz0axZG!ItN-FlXD`3@ygO#L3eIs}xGEmR{2xx$JtF=P$(TBz;T5q-%HhR=tMkvhjSED8%r|f z;M0;$+&dx5OT%0#yinPh|El?T4k-oOFGtmWM;yvcq|_#%n1gCs95k-AjVnSAueT?5 zGI8|h+Ctf8b#fsU&1jfum^Ft?d~*_;HDu#Fg6a>hZ#J)v-o5#2HwXG_t*!32+y~NX zR5PQW38uVQJQA^ry2L`8U&m;k=xl`6sa0S!jm$p8mES{RZ5Zemy7fgN;^{iJ&XlDZ z9hkK-_Ixa&8*N#=k|&V(Q`^_QAwcXY)Ue{1A-93&)O1v?)pRtbgPvfdw`TFJ;$DOIHDTyR9{ zckm(HT*^Jk*%fZLv?*38+wgFaiR495((GCpv)dWo6vBKAs#MF2y8hJe6LxErFxyp zezjxdS4ija2!Rfbo{F`JO7gtk>o7F`oz>oMtGnP8Bb_%?k>%kpQZ*1Yr`LPucTFQ< z#~)5k*`l{F&bR8xJ>FiKrYG`bIkZjKJUuO!B$m5bB`pq;zdCSDq$)%asC=w~( zz5D2~Y40}sL-bO^8;Pb>z3qxDS-UIum4dvS!|5``ijEEvDypufgDylPxhKKL!Hx$h zQOy8>G>=nL`0N8oUg~7B>vvs&5fo!RF}cQ?1>PbUc=hnPA;rE!<_~9k7db&^eyQmBxYYTNAo9}$m&uhid2O01CQnhBuHU^ zSNyB?g$KQkWSJi^%3qShaRJbn)<81*OC~l=jv@ku?fy0LL}?2PBVG~#Hcc+MzZzM! zu+n@O15#4LHNzJYIVWPORw0}>Uw?SlPOqP5+O`3SMd1kuCQ2JW@~~ij&L#y zV!IR}DE*E^P1X7k)j8;pnkGCKO37Qh&D2Rb3T@F3gD-Y|@yx+r;U;vWN?cFYi*@*p zUB0{UvPrF8)VF}?X27Ky0SDH??Dbcg;;yhpm1!J(S1v=UCRPl%fvgC5rA$d?#IKFt zx&;%!R>Wn^U*{Ktr!G!JC6!+AQ@$kUlyYosDa*=_kPu3JqdHd!wXuUTtjk99C&k1b zQGv&EGLwuoj zDzyq_^y^d(y@6!^%0#}-oQeK#YU{OFxvQ>-k7{B-H^t+iF$O4Vx@Cpd(SqU79olvE^ad!N^^DlsqKuD4$Vv?a*+2C}Zi1`~80F_#H8i2vz(o zcZPpV0JiR8H{WSX+EK+qZ>CSE`)P18Q1cnn`WsJ@@CS^Qy!SeZC3;l;7d?b|=X>*v zrT2LI9h6BIoRyJQ?znF5pFX~JAMU!p|3c(-ObbldS+Cm?%$gk?Q5so22}-VRuIpk`zN{AS7jY8Q^=7VpPS$w? zEb9We(7NyWH1XyC>T~fZ9LQ zOuHGkeq^MMJia*0=iKaFmym&#H(C1v^D|rV`*f|r-0xgIN}K@>0?<)n0@Q#hB%PO2 zm@BR8M%fUabpLQjsciP7{HZy=m|uu8Q?yPqN7qh_qIV11)c2#9Ayv6l6I8!{IL3&Y zk7Ku_P#l~du;)e_$}Eerk5d{K2}K0Q`*kgPVzNDFQ5*|LZ%dl?O#`yYk>0}f@fO|I z**>7Kyw?P3?Ue&4=Nen+UsmW~9G>U0~lZp@_8i=1~ zgTV!eGLZ~_5Eo?Q%oBb{Vi!mGtS^N|v0*q3u*oPfaGZuPMOwrJi5Ib04o`$(adZ4J zFD4pEz;b+~AjHMlUkW;xB2?G>qgc#K2wE3g%`U$PXTxtZ&Xs9LV6_P2!&ArO-Go(# zt=r!1o^pnjP{qxvi}eRxKkrrPFOP0pq4h2nBYNx1^E${mxs)?SihD#Xgxd^v2emuraH6s3r4odgJ#`lCw#zA_|9ngquLqV%-(TxYdoZA z(^x9}atb0fO`?G`t=CxswOs-7RwLS`5K(oYjA|{_*FYhaY-t0RhwAenM&?1 z(NRW$CB78|1p5Y-y!}0Z6z^pPvEE8Tgp*vOqpseu>pRtF0QH!nx$)$=rycxX#Ew4o%4h}lkX5E@j4?njCMD(Y}z z&JUfZX2J|h$obuVQaVCo_D60%Bn*T&`t`LvOFwebmw~~wEFAMKw#U^f+y)#Hl5lAx ziKbtF@gx;D;{G!6dyeX34b)n%`!ju*}Uzi3TvN!Lf4gY{i4%?bKEV? z!QG^!FgDLjFp@a>z&0k4(qo-IFn#SVcsL0#8g<8u{OMsIWfMjNLnOgeA|9o(%?Gc& z&kj$MF8RmE#8Tz-uUw;B5vMmdX zZ=F72Et(S?jAfM!iS9qJaW1VdH)$5r*Tw?VQXsCJ8^$9$lo8&flMbh-E&sf;N&iVA zA{KqXsY)Cu$O?iw)O%(Dp)VDJiy2P@N(1(`?-%~%@oDEwCrk(;hH}I=srMVO5kJG~ zZ;+Vz6RIsFqb`)iECr&|Q|X^HJ$CJLxAXDK4crT}&R*83N5*z>@CfwZvdOI%`1=MS zW{tPS^f5~3BUj8uksE(I$&rw2DXC^?bAD9sIWEcUST5{;1;t!S9h;Z#_2aIa0Y`Y+^Fj#L_Z#?cx0CV82q3xr|fq zt-#KRiVe;0MxL zE_dmTauMV##P>!>P1>>6RCTt0THcL)esPxS`z>e0_}5KSX0q^yA&YTP5A?096q}UP z_~M|N`)Xxwd~QdDS0|SUoc3I&3;u1gr1mmFyOMNAeR95*WiHYHi3|!%dCO1zINwo0 z8CidH-=47V`p)F|YF{PckAjkv0%FaL2s`=|_Bh7{q442Py5Y&$OXHO>6E5IQ;y@jl zPqCuevWsU%An3)|Y(f!bvDk~8{8|fKw{^*6-%-M?vmS1_qKnis4<{3-38kkk-LF)B zBgj*te-hiuHPhZk;%Ik)vdc^R4bT z)8Y_^9=5P$V^cF+jz(lauQU4mZ+_ILn8l9zi1|?Ssb2mk^9*byxS*}tx@dn8Prh!p zb_pv-O7AvuwN;8U*Qj+nQlDax+QI%noGb-RQVHB|?zH@Mi#Vo)2uijEBvr=nCKOiq z8er@24IWtR|;iv0rlVfdu31T8x+qW?|IqDgxhlPZepC z3+Fyvh!Nn*DBW-@1c~~(!Xo9e(aMjS^Ji(Km=Obm%||i6_cjLSRXpj z%pui$`c`B*Ff-EXu_5`Mmy3AM`Yjdb<7 zZ>}L7h{P$`IRg%7#FzB{AkoQanVQc{^{0$4%UTt49+yRW!G1zF(-rsK%-$dYAR2)# z5g;zp?l(k*b|?F@)-%o;QS-3gu1C)ROQe^_nb)ZVZLh*Vbid;5wSy8IdFA)4_Xb97 zeS1&z{3@zq#aX`SLdo1#o5t+7Lwvt7?h|+Bd-u`%5VNB@5P;Po5ccOzY{C9JzjGGg z^a}c3rJ3#CJcLL4+^gypzzugdQ{)G%oC=Trd?#-HT((UwxL0NL4~c~!e0c9~&7+u_ zq2lWUSv)dyq$nn%TqT89gtvZ^&WHsZKkD_ZnjMAg^j8hI0Yq-%cnq zazCbLgv4f#0gJ9K7mL-kR*SX>@9*>TbGs}f7bV)%+A|uO0f#Z0c#!;euXjmeF^(YQ z#jsBXLBvv1?vhrx+^?{RLd7zORo38hh3+ukMzda+>NKd|?xWW_U3509a6+RAa&+(9 zuhPzpuku;jFK7J7z_RCq<36e7&gs&&zbgC=N}gBuguYQN^)AFydmQd5I3Dl+6Tzg7 zUQQ}_<7^%Cr{6(tSB(HVCGGd=oT1i)Y4TJr z+i|x8u#kR`jS)>`0vzMqgPb8%IE&mu4I_*u&!R3so>KM~Bq*$aU`ii1SpBsy__&*h zI_USV@J!$-mb06%+ww$4^`py*xKE)ejuFn$)HFYOe%X~0q2%AIgsd(|kg&DWxIX!= z{_l=7>AJBI*-Y>DfuvFV&&!313~D?+j|2tdviCPHOi0ZweETD&JU*rYqiG@dmt%>3 zD2sVlkkpv@)`|0klW}or&djsV6a}e*Eh*d6j1?`Qpsdx$$*i|H{ECiLud}8IpC{Cu zy4}}?w(!$(`SSKlM?jiX=NZ+|aT9fY_k-<{(5@{FK=%n7RtD0#|AXRdEQR&M z)ID~M*ImpHy(|lJ!Ti*+ZI9)%?MMXvVm!+oVby^+*f8AhzTeJaT)=J{@X?xhdWJaj zj{4a7V1l;JJKl)jV!gBfZYl8hX1yE;Z7o{4I_!Mnb6@)?H28Ke^o+k54l~|%j!~zX zG3=(@R|7b0U!g-AF96BT@dfqX9qz^-gA?})^`9}`=Na~2jrzAeTCW5iw&T5zwAMBS z&OA_oguSQg=$axIZLN-8H#!c2k}f~&I{Cy?tPwRNFKQURv}&Ewoqbx;4^=K|Ms%+J zmb>YwK#9D=`_aWNA5R662-+i(I#B5C9p-Ju_k)*HzvvH^EVVm!lHtD{6XHhF7947tFsSdXKx=EQmi=NReD7KO9woBY&4j$-fIy!h1)sxi zXBU^t2EV&#fUkV``*F4R{+=z!pb$OMv)ZrgmIDW4@cT;Y4e(Dzqs^%9oIbN~D6=~;Ux zGPm~VY+2fT!x@R*(~uAgKmXrRpvE|j^N(MRxAnaGd~_f7u_Hx~xQZyq+_{j*BFSPt z=OcbY1EqD&G`}=LSJ!;Q-ZLWxZB1;zQOSf9v0ZbmKn0pLsA$Li!Zj@adVeOtX)+E5 z3EOp5wqeIHIa9%`NOh`wV^anY8#Oad6J>&1Dgz_xYYNI0si$W=es(4pQkbF?icdA) zgZpqK-55NyfByX4fF2Q|-QKg^!|)L`!+0)HYp+ho{+uUKIzxp`n4gGR&peCImvg-t zMXTOg|IL5PybPBRm*TS(rRQRl*=eIS-8Z>FT|FWYvCv>RCiR}r>f}P_jJi(Kx&!P| z*3sf?;Cf9jSwX5$i^le}s`@FM-x?2>h@Ks{lC*fp$M4d?XG(zDtL3cu)A*Gpm)nZ( zQPlL&YO~kue;74;gNx=8FOSQGVDeo(HiKGT9heg z-fv}qSE^S#*{$u$hW}<*&*}MIs(Jyb$e6A4Tb4A{1%I?G@96Y2);kEKCKp0W(7yp% zvfE;QJ3MQAeYE<&VKSHMul`k&=*=xHpO4wQdOMrFm(Xk+o2>k}OS$?gG%LNm-=5a? zsD&QjFWkMq^{C{bKog=x_(L_vg*fe)7D$SMWS3vt*T$khJJR9wYmyg4a!nr|F(&H0 zC`C*LI5sWTuismL_~pW*^K&?L)>@(4xi`OL_zB%rn65B~y+l-Y#?qyB^7^*4bhSsb zQxP_wE{a3rYf7^fQ|g`y8x`7ArJrLPrZSg_2~~XS^q*3kKwKUkOrBV+9K=P^XZ}d> zAL#>jx?VO|W1F{C?!+6hfV!Yk8<~yNUYlvv7ajZ=r(a}CSDv_wXaa+^4g>s|cUN_o zgPP1y)fpXwpyYQ%o^kWf=0aL8)Pt}<`jgXYKm~-`ewk?JI4B6mz3Nuc0J~Z6oacrh=9zO1!(6D;QVzX=~z{_Z{h`L$ZR;r6{1uaXg-8D;M)7ZEmOw9Gu zpz0o`@&-8QHy`ChpJMS+9sP!;VKMn?VN+rh_ba6~4zqOeg9XL{Q)KM6RY(HjlGkr; z__l+G@lcuU1wplDFfGYaK>zM)raapLR)>dablK4k?O|q@14WZ}xOe-=x;}GYV4E@D zlrM)dIj3zmParWFMNlfloco8v{lT&;tY|%X_xwCdd_24C=r+!!@<*m`t3jN{Xy#jU zshWLbwHFsoDkYp;wgkO6-6JE%tz3iCoA|B)zO|E*>6LxchP)Qo@UE;`4`*J(ItJT$ zXn$;6{av%Z<^Bhj3~IWcZ{cSDqHJ`w@!WdmYJ0M7bhg^M{RNq`>al6>5 zc!th;zCWvUIWm2ndpq&l%X%9mW>_=}iU@Rh=tFN!=RQk^+32{$>wxXMWEB)#y>x0~ z5ob>YY(6NO0ELXhj45t0@{P(?Z(|Pgi)xXI|Ba~rw53&O3WkUxL(;)X#yFK+Qdyhn zW=zEoY9sZjSAH;dLR$zSPkVfQC4y*)O0f!^OZ5Vx^2D%}gGI1-L8H~t8XNETjJB|wqw8pt*$tesA2l8t{rFCdzBH%M;^TY7lTk#y zzFMsrJ}<+ZdCs*ZDgK?UanuP-Il8xahm6{Krt|#dclWmQaqa1S!UlJ}oTqyXC0dyFUL2&gr*8v($ zlVFv0=>3#DIXBlm%zP?t74=T3hyoh=g&%0j4^B=D?oQiUw=(W7rVv|z8!w~7XL~rc zT#TM}1|^5^wy1h@L2_lD3>?MxeCDK@l7ZLXNGna%na{MZ&^F3+%=t6fKE5ovf`rs(HWliQwiS^wdhG@FLe-tXHo;8oP)afY*QUVyoX@ z&G67l?+Nc6kf^B5=2?6wOl2$C)9I33-rI@|X=2VeX!P-46*4(O)cG>uIaVho{{=)r zQUbqvuu}F{59O9j3rofWV?mD|uDQtsU-` z`h#(B+YY?xQ0lLb4Iq&{Z}~qT7Tk}<^J1J0oRUfR@CZ~*jobo;pES9ZOFzJo?w_7+ zzdZ}RrGv&8aKd_xyl>fwvo*^u_Vk{$U|}C)M9xp$I-&%;?wqa%;9vKn1p_;wk)|9T zP6MOu&;O#I`t7x~zRu#)suw@^`aK{lfEc7bte1I)B>eV#{tZ3=sD3{Xx)$~IJg>q# zp1b1!rQT*~#P4Oef{aDQiU^heoC~mf)D(hH@t zpu}DI-w91z;{N43>!{ed^K6r6m@O=clcc!Mi1sFVe(EOnKKtWyy3&#bOdT$Bx^1n9 z7#posK)!f#sG8CcFG=L2d6_l(HYLG$KZtNELhsp7Qc_Mq0owld_{Zz6-7DrJQ1wViVk|#>n$}u)(t~0Q5 zT9dkCeh#pcf5E+%x|1J?*3ec6YhseN0A!ojr8NnWMuf07zo{)w9tN!GA@j%X*1Fu- zUD8WSMzt#kC~&kIbY-(8af3v)hg%vKjW4&O7Mo0svbV{Uph-qrLgrFgeR3P7HrY|D zY3Y;hM0@YgD$4fvp+e8^>MS!Vd``5M9fy&vSNTI`>pz2Rr5$#8P|jZdLO*X7>0NXa z^B-s7mv>z7wm;|jZSO@3b(S@(bhX{BbVn1v{*Xb}RIOkYU?1)bl_q5r0Kr^@3hJrw{^LNaC4@fQLt?7WW09d;{ zB=nRs{wFHChFyjYy+EUsMIghdJETvpdEu3@l%sDRj)^btv!A%vrxi>!sNJ<*Wmz=Rlc$%4@@4Xc)}+VprTn18%ZQTbtgWaVB7k`nPV4o&NK%kX zu0^11h1-YotCvkD1DuDi2LtzBS-A!fXf$~1s&YL_S;^(?qPv|0{P>ZZo=jgRTBxY? zdV2Eirn!Gw1ypW(bp7Kj2Fh?san5E}LeXhV4;ltas(TVEw~d#lu05Rg=hzt1OlqhS z9m9Pi5n4+4&D{tHKqUL)YNbGcd z&g$nB)n`+^0tm+afwoavR$-itpMRiV@YdImH5t`+UB~-^xxMG@WzTPTU0(>mU4bac zu!fEoM)N2=A?a$HB{iT%^SGb0=-qFv<*1c0`exLwTtg;;#ljvQ>F1Diq$GQhG?%PY zOYmW*0wz&PB2fIuzxM@CB982!qB>XEyb?GgYX96rD|r9<@v~2RbT77F zIH!2Sbp(m*!5n{kqJA0w)qen?FndymgALeiuSzK9^(T2vwK@+^NB_H+X`hNa&)+P6`6{%3I|;~TwPwg%NM zFU2fRRd#Eyi(l17T`ctmjvsZ4goKDb#WDD25JY}&_F)4K84g9RyDlPar}b4JPm;p0 z0$z#kucVq2$K2s>j&`FVU9FkI8!GKw^bK1t2|P=yVc9W6Us!B7{W;?zyqne`R3YK5jT%EzTdrLz2p7yu{du# z67KN2)?LMBx~j@5!D8y0;+uJqU=n@&FAFEF;y)p-%s)FIm^XRH9#P6EtSkQ`E~Smvi5-LQ+!zUZau-z?uM{yt`%BZ2~Q(IB%SQ7m6aSdgE(z z$wJ+cqpNOvVl&(FL&y?sa*5>J4m7bRv)MQZurryOnwj1YNC-*trjhDt{S~bB0U=Zr zy&+Ks{nlo8@0&;tlFJBbG}`;VawS=W*PTHdFe;)Wh&t(l4iy49zgKTEaNi`Qcx7S9N02u!=)<7r~N$qynC?M^m429ZXWRW zeMBYNAv|jg6?`*c(tyaFxBMJ-)9nM`4B%9OiRBlj@!E=qr*U9Q@DNKsib>kMZggyQ{=Jvqb%MgL-CBl-7 zsAgMw#mF@OXH0+?zqtC`qEir}FwRB2+60ItOs3mhoK@#CtOcH*oJYB`{PUc}j9UyF zY?)-gHfV$)E2Vgb-?EN(&^S`%?os-#9?MhNo&%ezEA{OBCZk9Er{XN`$^9hJzX6mf z8|eF}F^YG}QBj}(I7@T-Zgsy(Xp+H-Fn1uA9d7HQ^KQ*<(AOfz zilD#B^Ww0_h{>&EgUhz{)v`E|?m#wGmMT~+_2O55Ilf)?sfX-#iMHF)iTe$&$bzS9bp` z$-_)dWvgRtxGd+k&0mCoWdEw0_%%T^6jbfBX97ps2)MEL4-d&Q>Rpf$m1N}rT5KHh ze5gJSq&cfQ?v8xnvccPll_1&!8Y`&vRIBnH0HU!*$>Rj}JrM9ZCjk5)Fir=H#Fmet zP*E2&?(E|4A02J2y*<5+L@>8^^-UT8v&3k~hG6vqN2O#fRxQ6B^QWBYCCI4H-HK?D zxs<4x|ESt2hJ_H6)d&PZv!8H3v8BYU~O&vtsg#TUlxw)S4i?$KmtOP3ka{wJ2a@0xk@@44X2+Z*vBgo zClY;ndWsX1X(yuih_|s^w9OV0k~loWDJA>f#)?-*I(KQ>2}5K8za-|=zVMJ2uH|Tz zJr43ggp555W5O3piVNMSRX>GJ%g~h7ybPQ=HVMh-%}D#T$N5eIX96KA_kkDuw}>IY z630J&?Ppai60JJRRVwY3KF}(MWOwQwy4Wq;Rz#5|(?bQEp2`R%Lu}Cwb}Lr8cE#B= z4eI7JxS=n5#Fxzf2Ay=?PqL!GV#dikg_l;MMiMs}W~5FjD9@xr$$y~uMiM_s^J$s` zy-X~C%OFTXl0ZJA{710pqV@gl_Ebu?CExbTstrv~)%$8z%8g zLLuVV^=+&+&IXJ7T?+WzcFWS)-iEoV*oX_E#1^n}&F1qG!;L;Peo>aQ-}H&8NVZaq zm2@+LjvSpAjm#=!xV8*yqe3G3DK0d+#Ix!e4>=dCf9052VF~zSK?x%nA=R*}I_B|u zFn7+{O8M!jyC-~iiTrHLKA7ZW!R$W9hI4$jAj@W5(8l{tx2(@ub)7c6T&;4D&}iF~ z&Np=nr?*vNlzrA0JGG>pDSs#xl-r#oFYG5ik%3g6^K!rgQkYl2P&umE=mpf;{=k)3 z1DYe70OBUK~Qg-D<+6u5n_IZB~qM7}VA$8^9gYR{S>igx)^cc|tOPa}m^WAHn>+Y{r^n zWo+2p<4)K2BBJ0u&i~inC{yBF~<(5n|FH2^WFWg@f$cI5y378Rky9pXSFP^ zD27Kru|Q((j=e2dYgd_fF_IMSPfKgUk9FXM)%k&J#T6+u~1^A?_tG80e&<8WB~yQ9b% z&d4ekWPSyQd>Z^Q1*7M#8(8cQlDBeQHWBuPnpTcYWJSi_qXoMBdOT3D7@YE-bh?g= z@rt|ybPf$HnS}my&JM)>>|PDO(KAD^mKG|jE2HGfFfy-no4nP;A4|{pQ$s!)j=5zO zkP@f#M}_fO!2au|1j&MnvL>}3n$+eSW|w#Yj$bCs<7Z8Xh%7h+x@JM}d@qI7r8WVM zBdQ5|nyuQ()gC1WdB`0{AQXu;--ej9jT%Pb!dNgRwn%~X zL?{~EikK`TUA%~SphaA`{W2^m1N;nKJeXQJ2h~5JD=Q>Quy!)ZJ{wq3qKGZ{oraP@ z1{===$q-(rc8Eg)TV`nc$Po8-a!R5wVrRbJTL)$<&5Bsuij8&D{ku{ruF|N2V<*qj zNR0?`J_2W?`AF68x1v9xpghU`-6>j`0!c)!_qA5ZpH&GM2hmy$kcx~S$j3IUgE7bKWUah6y+z{0$OU!gkL5AHU;>{>DBe> z;0@X7I?6>Ufl&dxSa-`3f+{a#dglvp_U!_Wf8%28g|5wlFU z=3xOO^kKR{P)tDq```aqq!#QciZ2N7)vmW&8=9DSm!}jS9!?9e#|^8V9VHbmBlVdq%bexy!}p2LdlXA;lKV0 z8xyW@6+@d$6vGc#)8`5 zNxC+dPBa~Sj~YqBK)+d#9j`=|3q2KWda2CtLH^7%=$6#xF^^<1^l#@E>MpXd!m1Y@ zIktyM`FzgH4`TBY_Ij3Le&)5`f2R^2bUxR!Ekq&l^5;MJPLjn7+0y2L ze``A4=rgoFc75hZKKWjxf*!zvywWS4r_}9&oph!IC_uMxPW_fvj+gu*Gx!?T%_egz z3gQ8tGPANQA+FP($W_N8rwC>$+8(B|esv~xQ|E3iFd@LLeQT5i38y!0)tw$kOXvhN zxAwKoH%f?@Qha8i+9N0yIgsFs=dX=yLAIixETW3o*((2h^CGH%IXiPd?Y~yDk(F6g zxRI=IMuY0RXv%w6$L(sFcjW)oWT0(`80ugs3&%Q>e#K*%&zMmPOyG4EDTAS>%KIDL zjs}-ANTJWR7i0e+)7ksu?=!S`E)(KEv^%J`y)}H4g|yufX4yi>_(^cLKMb1;cg7AZ{nkqC*-&w%2eOW%)55W!BZ;ptF0K?J_Y}U$FO*_etub726xzy^aKY$Zye(<` ziAm3vb*L0@WfLOz#%fzX|FSYcUDC%$Sq4p+lXsbaetVatZ8bm<^cRi~h4fjH1mYcb z4FL}(IUMCXq|HKiU45KG_=*$w^#@q9&xZW_?oiPAUhpL27K&7n$6USYKP~KYt^9Vd zGdh~Mld)z9Q))E4F@{Jeg;t5ITz}BP1%*hV{c*PJA7Ra3raBB{$|X#x#%y^0nH3R~ zC*6zUPKpB}xBe4=EFDV96)ar!Kqs3l%r&EHRUcg*nX4JJvSr^ra5>gQ&|}EjTnO3H zD~O|Jg)5d;ERNV&3jLYNdW>T)*@x{5%j@BoegNi&_F3s+`i{3W%)Hife~%?HL`kl} z{OMOP8MOjPnJH2Dsfc>177;@G$THI5@W_v$IsSz3ZhXAq;GUK*%5pl;k#gI~190Vn zr@QJh0tO13@ZUobnNz}?Sdttovq(^NNfzggSKVJdYr3!g|MeL$yl$sgk4l@{lpH$f zeG7QOPsb)#tQjZ9ml2wlaEet}Aj7yG_8>Qq+_*7kA)g!J&pQTIleKYVTUoR@`+5qR zStK(=mZ|rF$$~Aje`1v4#^wiTNnr-R!KFlmd-~W^A=A6i0ue!vd4|<=1FGNlSw6L2 zi9)ds{^^<4oa_x2CyUiLY9JFL#h-&0`Dp)cV_p*4A~)(!SFdXQ=Vi}OKzcnwO0SFq zT{Ss_|XnnoWN28=d3v(iJP{n1MP`3c%ek2id~x#q}wz3I2F9+A#5PGPj9!G3Gz zb>B&myBpjb%>68Jv`X(pD}lisrWfmg1N%o7rl&ZYLt7#%(`*#1U-^2DG( z7J8h!xaLYf7$N-Tn1L^BjQppc4!fvNOtiqCA-&#D8l2!59)BN>Xs;i)8w?ewz&#T} z=u;WS-0`6R@pt6ksNTJWk0LQ>0jCszSs2NUp-sxPDMkqc$hvQ@cJR9wDIE~JRE_F0 z@H*Q(nz_K-dZ*oPv~`HI&JT#zBhc*E*QH=Tdd?Cw#SDM?;`)p7_MqNVB@Xy%n1-O|5e^F z<&*lqsPGJm*`&U@qb^nFMCQXX*J+^7;?7dC?%Z262fef5Ae(2!MN`HeoW#pzjGO9= z4LD8cZmRB+6z1RI+wV%C{*$-*wI-)45lUS|2hq`l#xrEF+6Bp_VNk3_&Gow}8!f^E z#)UglAZenkwvtDrzh#}Tlt~I=+r;P14MK;$gyuj*a&aO+6YC zt33ofF$o<-u!v5Ihy2#ep;6tjk?Ip#)F^e?+Jf&=h7qL?Rxxbg_AirsvQc$|e9Qg~ zNi*T6eaWxA?5!LqZM2f5Q+NxuwsS6D1v?#&a})z}>Gw4@Z@KuFC79H6)w1-~E)4&) zlmsdjIZBzBhiZ;)t#@KN-#N2X8~hYA1dr@`7=8(oH8Tq#myi$j!$vTvRqMfY7|Te@ z*C?Iem)GAKASp`V4A|YHuhAcw3;x+TLfXH$aBms&-D<}}=)Y3JO!*yevH1lr7z&2= zQp&LRf0^J)A)kl5;y0P?&&n|B2Dt>e9Hf2{wpMA(VRM(`nEmdK-XOOaM}6xD3OddG zUHtnHH;%RHk3P&Cx-lV*nn5dC`dL@_n`LZRzv2Of(%)li^f?!%ABX9R`H08HKWN9O zzonuDl*3pL;EiGJ5oduAP3b~JA@-taqhoo7!I`J3i>K{<8UV~lfrD76-ZGS0Wd%Jj4&JH6&q1BdUStEN_ut)yAwR6F0R^XI%4`Nc6s!b z1CH*wV9!v4srJ1?#W$VOZ{Q@sJ{%d2ll|apHd{CLPdutxDnQysOSli(265HT|GDviD?tn#BuyEj%|zA1O< z_g#W>@P(>J|1#b(lI^ z;lJFUxW1e>7<#;qBoZ=aUE^b_1z!|-#wIr{cnxuF5856vq;U)c41ikyJ|I~TlCVfF zd*?7|Y@UnFiUZunBVgsP+Az#naZP-@d+iCZ!fL7}ZVb%JXL)|$PhH~LGw({#7Xx~0vh#c8Z7DSYiGk+Q%B3B_En}xR#}BTAd&@e`utAN>A*v$ z=o9}9OU+qt?^6?KW4lyYwD$SyldjE10W+j|vYzk~ycJa#ic_ZV-3qFwyp!n1< z4ja6PQJrkY!{L!|;7LTup($ENbs%H9uvn9kIo%cXcmRo)JeYvgIJdPShNm1&tt6UQ z(v9!$FOud1X7FJ*YeQ42=!Ce9>~_T2IYV?&X$ue`pJ<+@C@&Cx)VJy*Aw{*RQli?- zg`!k8JzxxRHinS=)-Ac(9R3JSPc;E_un&A4Fo}*}mEA6zMw-tNHcvK1;oN&m>mD!O z{pnYnUV7I(_3mMFGViZGnAeW7#0>b*0R>ndqx=eIZ8iIGPDW$%G1837HCl; z+Vt?P=3>gyX@}kq>E(dZQ-_?n1VnytI6?x074eBbk6G#$ixCp=KIP?gm>>SsidaNB z5%IZWG6Atw1jE8rwoW3N5Ef(1fQx{Qc_iz@Os8dxqGeqx`@A;!ey5;qm5BI43()_e z>aD|~3imHwrMsn(Mrnp_q+v)0q@)Ls?oMfu?gnX*?(XjHZjkPVyFK?l=XdV^^E|}t zcfa3Q>$3=9?}@uvpQX;f02lY_s$$%vX$jDvk@n5LoC^l-(Fb4wYN`ON`cgSzz0Pnx zQ)62l*^=Gp0h&UOpIRjt2#`YF2x@vfhHgU)uo>xGmhNT0iORIlSpGO?lzb0hi@5jX zvpj6X0NlmW(m&mGMv8o$*)dgicAbio;l8du;O{qCEjCInW-5^n37PbGaptXCBwifH z^iLOu2I(hiP@iR zW5(;c9s0!X4mwsmU(c*Z3mGPzq9aN=oQu=8WV}-jz{!|84jjf~8?K5>cTX{8c&;y3 z)}wAy>%2(PkSPkCk&|Vn886yZr=Dv^8sag+cyPF3MOa)+m$VWGKl>+l^jvx_CW}FB z)%wz*-U><}Hl|}(UYI7|#N@)8Ujwu3q{cD}Ot+OgCCh$5Q!)RynVVF=JIJt59>ATw zkF>jwQ21zk`Z>{RO~yyh1$vpx8h*$h7LIPeeP-6kUsZ3-)ZE{>h6nIZ%((AZ3-@p< zTCu8U<9gf}H5cPi8A8Rn&!zgV#A-*B!?alzOMSz;4udekO*jSL!#e<{4boWQ!gh#8!gvT&_ zu5cgRJ?Qa6pHB9KWh*o`i+o<409;X;0MEeV+O0Lfv5OaZ-PDU7G3wt#U3TlUvRrL8 z(_Ir6|14Bo^W8~K-mIj{MVJ~*i?LeG8*Zj2GzCYL7+Wg`v3gcmFVCvNl@iN*?VcYF?Q!NnI`ej+Gj z9jU{&@V+}Ps?BRPsuXTLR;A&mSqO0~BnU&f1U*BSe^FnEiZEwIb`$Fs8B9;RqC*C7 zC4fnBVRbk|SPyA+Eln&wLLWBpq(V@%r466R=x-im4MB)=PFP|TWXRrM0j_34V_`|s z95;Sdn}EZlEm;P38smfvN05#{YDi&TT4=48e-aAn1nV29yqr~x$)koEIgI`}G-Zjk z027KPbx3FUr-p7LhJ8U1|5W@Cey;~cdU&n}rF6>v0oVvoCdhZq{0W_XkS7q!fA?>| zQvuO|yU7aEc|@$@rWz!aqicu=7fZQ8E?i(RU{KOn7S6>|73xy%olW8=mro4!v^c%o z-tu#8q@P}T`(YPyCFt#GNzM~tDHV#H51yS}3ir5OXh|zk!j_}$h^&yO=|8^wc!(!cc?ld#qhT1Crr)2mzVFJ3uj zY<>9Wb~~T5oY0>R%hD?R%Fc|Tj}#^SK4e(GVWTM0ErpeDf9q7QDH&&y@sd7?w#*P@d?k4XQ&X_;VwLReQtlE;P z147xhml2NPU32cmUk^6IfV!Je`w!W!OATx%^YJ!Mb~R*y_|-tzpk1 z0A=^glXn4#kaJPxF?@+OMbpWCdo!J7`w6RgwR6v-wG0B0?Y9wC4d$zX2S7M*}1kG2|L zYb)%ue;ORPM-a+;4~y8Q_J{smRucsXYZ`rGF`phjDx%wN+s~p5v>1c*2c%9wt?VZp zr$)GD_qQISx0>8VJb%_sz#f#0ws^;$Owp4)BnAhb4~ArM%-NAPb!6+neI`i`i0jWY znj|g}^eOeT)z--M63_oc5aIO;O_A+3iSLFomv+uFsz=O=^9VMfC^UW{m^&Y2O{6^q z^bgfiZtqtL;l9xFM%Q&^l=#9i07XZJbxSP;eodsjHk%4}vn~F~JZIUX@y4F?4Jgkd z7w6c5guhfyh-k~hBV%inS==>aj$O$=GXp|8l1?$3jB$NnhAx8>VMU-s>-KQ<`DE3Z zworqV5)PQ71JzQcjwX9@oD!+FJ8vo4R9-39HYzPJeFh+WTf+@*zo*h7X>8gp=;w8QV)BO- za&$J?jqZgE){dQZB(UUh28tmQS*~83Vu~S=`s7Ghb4%B#^<4_ejc<;rK-t`_wOV>j zD%LOc)62&&6Ox>D5`ldKdvbepxNz!R`tJSA3C5NAK;i!!kXe{bDyflag6CE;1O$Zo zjUWrx^Sl)r+z_{IHYy zCKDJe_SlaoU!%>TnPDiA#6bv;$B5JeKC2i;z_QUKS6`5w>4$9zJnS^f6t!#GREyD< ziJBlSm0FQ&1qVbRpE9zDeGEtvr@4!+>L~Ro5t4(sC&4KeynIADc?T{$%P`D&Pe5Gf z)21A5=kKqa%}h@agZEYx>gTp04O4v}{&>q$6q?U(l*OVowx&qX$!l5>CqMXMNWQD1 z`8$i2@rBdIV_;s=T1LJwF}rLWmhi?w=C2a3kEx6r-^WAuJ6$GOhlEY(P934kQd)a; zUD-DVAxz;Gf?%!>)rIyUQI?jJ%uZXH{e+q8Rz;`^N?_&RU0G(o>BT1lM*~WnlARO1 zF&2cpW9D(L$yOxN_C`s!j+ct!7$`hHcz+Ux-7bQ!hLvd=lD;ooo&=2#in}>C;xoQ8 z8O)1HYV_=r0?kBxlZPfP+X)>;m%!ZrU|dPt#|jS^xGH7x4jej`h= zJdS%wxLXEr6|nR1iL~9`=*nii&SO&~nPAyHY_80e(Z8nJX@O3Nh9Dw@V z#%J%*a;-J~q?AQ5LlC}wqf7d&Odcd|(0DK&CB!wY#RHR#m-iD8pJi?yBv02hk<&*+ zLPD9Y2q68o=06S?#e_q1rVqKSn>Y9a@C1Pp3sBRFtV7A4$D3PEy@pcNUNyh+g2jda5Nd^1j$N$u7`9P&?y+eYKb7OU zQk3wf`=?a$CoXnHvv|;Hg%qyU5(E7x*)UNbloM47^}@;jLJ-^l!#_1-t5$BIe>@x? z8X`f(UDi6)Bi3L|&2PfsCx&kSrOCsq)^J~;Q$sBlXZC!#xoFum(Apj+D3eEWENPd` zF6VPbwhrC2RJFq8bI0B2J`)PNZm5#OY?lnyaS*=cr-$6H@u@!Wt1?ciq$4kDn~?L?z}X zx72jWa=1F9DL1w;-9#VDxy!$MnJO@toGuiEuG4?@x2Z)5OzFTbZ$RZ{vi~|WyVUkE z0BbtlkPR3&$jPCb8iyDa(-P-kL9+kR(SA2M%2TMuLuR_7F_6R?v~skIfQMFwX7lRW z*R)Abs5|rk!ds>wu?;$&Z|-z(dI-SW00Gzl z0r=|15ht<1wb##K<0iDduW z{my8)2#24JT1J=CrR6dEf79c$rI1J~Z-Lkv&70lG;YaIlefYw)_s3R|MQTM)4?JUR z-27sNs#NbI9fp{B&J%r}X@Q5$p?cRysbB z?J?6oIo3l-bN~8mFPk847Q|hu?m%csqa~~Lu5Bg z4dRYMK5Cg8T#PEzB=D6F-=|20sL1)IIS5()Y`@>K&ehbGA*elVXv7LVpo$AoCeRuL zM&d@~`DV+70uW?uBG9_TWrp*l_6FNB?cA?A z5Cj)hX37@hTU}yIsOMKTKR?rzQB_qRD!5$K*jL&Se&uMqKtrsZame4TEjz<;mDhAP zfF0P~V;Y&{7$O%k>E|klkE1f6ktWZiP*ZBR1;dk}e^@&r^I=!d!b3+4$&7m4GoY41 zYeBpOUs2i);FAsiqYbDOe3+#HIo+MnZ=PQcm9gagDq@tAmQE2a699;@Bl)s)xIq81 ze|)e#ydVo8?awvPcy`%2(xs6s$+~s~%kJw+cBeg7R>(*NoP#1Pi9ekDiZ?MWM`V5% z;m8JJ%$!6p#*@0ohIA0Gk1gDE$I+%qd{X3tk>=%v%ui=cipo5ClK&tmMh*8UHcRs$ zs$2PC`(IqhkMfN2A_sxYrHA(!X`UJ4fw=Oj-v|{j*;9zOZ(0xMXBt|L?Zn0XwLL}v zL`Pq+@SU!8{mVZw`b%9K;KQsxs;rw>h^9?fJYN9x-voM|MBh{OTwp6S!XiEIyaXTS zaZO7Wn$4)6pS_mt`mBJu2)x4%5P2+@YU5QIdP?e+C0do&OPh4ZO6r;;T3a*RyreZq zuxc8$zGggeBiVP&2}RmBjH)1ho9LxLBDF^FZ7=fhw%dfsY*wh z-9?Ah>>#OId{7K*-0rda{bgvDk3~Y}51iS8ybKB)eR9g20^-x6kV6Q`Q=?A@idkeu z;WCV0cYvbBhQR%^u>Xy>`6oG7t^qjaZgE@hre9>0e{!WgoBe4eRKN+U>smS6|P=7*r1N8MFI?y zf)oN>GkSXP+YJL$fIW)xM-b<9aGb*wIEAkdMXqy^_4yPYU=AlI0{|&9YBXG24m5N} zfCyqS<`(A4)9Hn+N?o6eGdzLNb5e0IO{8eS}WsD*(-2>tm#}ZL~`1`OdJc5zg zZijPDo@4tDMxkR`(%~j|iHOr!4&g6go5Ma#mS)PK(xJkpjdso^!OwjrUY{0Eh@ zqtU1hcRo(9O4!Wl7=dSc;Jo>ho71vJv#4tScixMsyc$Xcm~Sn#`81t`)#YY~VVR0t zG;mMoux}Tr;0O;W;>0W_B>cFpH)1s=PsiR!!Aba;Q|cluJ_dY`tE^yblg%%00eK7f zFnMo>Mq`LER*#p^NUL-!QpBD;j%Ud`JhZ!12C?6ts8M56$*9bmu6ZiODCTe{L~A7b z?XT9d!$YIOJ>DN1p*T)(Vo$W!k9Es zzPcm0F4gLIzV0`qb!*rzw$WyN=^F%HFz z4S3$S1afg%Y+7!wJ-?mWB%PU?!f$QidRsLU>eeXM#Vl8C5x*BY`?&VF8VP9lHcpyO z*MVI6%|pFc7Jv!kl^bIxST;J>dSitXLO7@6f)1P&D3F!#4KPbEmd*pQAOLM(H+Ahv zcm^Df_`W_;gF*4rO$)KS!p^_mAGnY3P-y?m@CQex@t-z=31A>7wU(>xW!^2R=v`g_ zG(l~rSx!8usN$G7nYlb3=&D~FGlW_o+9Cz>KUn>jRv4?`O zG-#LYqrzuEkEqq6=wqXFciY{KmqXpP5$ax}wY6Qyadmw?K6Afxef0jnt7ro=G#d9r zNr@3j0Yg(3`gfkQCzlOy(_rCHnZlZ2rvm_#LEztu{p-m^XhT{79-}h!Ej<}&pCmud z0WVUYDA-KpGkieuS-N>IKT^#NqXP1yA2BbrKfy8^Gv;{o_ZY;2%i6nJ2z>t>gCPjm ztL)L404T-!lR!$0a9^5CtDZz zg?b|e%@gRgFH;wT*^v(lf~{C_*QH63a*;^uk9&{nGO1N$T8HE5!yeF2 ze@Kx}a>|rDvx8igz3mccohE3e#BQ+v8fM71dZk6OsOgiV9%i?AF)0!38IWhSuv(FG zyzB2?Uo;TqZ@ma-xjm^*X^glW945k0%*fSdjs@ovDms_%9V8Osq|-o=0kLq8U~z)13>#aj1XPIbw^*GXhghDG)KcS|A95QG0`dta}vqOV8a}*?N3{5 z*4v&ES*zTpK2lS6O&`7oc3V9ND1nCcpj=gk3gaQE4A)Kdrw(#Yz&Qj2CEU>H=%kaT z@m6M6)B=~!2fdFV4i$<-R$x+W;?6H!qXq5ifAeirF}o(KpuoR$lqtf&E<=StoC^Cx z^bZh-ugSc7`rc5}?0J_W`Uf@##(9>mVtN`7el-O+aUKpMde?cK6%o4Q&i1;*y5qP3 z2U?WyJ?U^+egm(M&3I*>M;3SN$nM3{U!F0CyM1Kg*JPlP(WUQkdG8tED%cym>LT*3 z?}IBqqdJfK2epUAY$l^zPhES&&ND>rb80xvXd-;?ejWXKNYrbp*nAOgTt~j>%zAEg z8;JYyzgLG?z}%aE8Vmk}B%IDxGxNMIg64KJClCc0!2xeQWRssorY}YnVknPwG3$Dd z_oC>9)<52`-S%ww+nqaGp8_?nkpj1_hD;H^{asK1?22qtP6IUE4w&*aHdO*vt9I@3 z{df(_<77vMn#Mum;r0W+)2N%|LNQ!&b-*fgGFWP!dHBv3mOeSmSyEeOyNLTQy}HH9 zyVXr+TtDqEpn-Ei|$xaC;GqLZb`18*VyDygFyyT>LaCeV@KQvgCZ8{`!C(v$zF4eP&}7dd68@a0vUxur0+iu{0IFB~wX8 zw0Z8TA#DW$BIT>Tjd=rhfYG20(VJs|ZYzK`1ei<{1f4;E^T2*{n>SgWm{Q-gJTW6f z@uGpsNoitjPT`w$3OKJ9nAQT6T|lz$;)3|>wNm!yR6P{|R&5`DF z-;yPzUw9t$UOk^}a=Qs!dHQ=m;Cd@?(qIbJDB|_l?i;dR;<edAsU`i#yj~aWP-(Rso@ z^;FT9nJ?z|Ffb;8l&_d%;~ldYC%}-B8AtE8z`hIsCqW8-LICWN8V}bGEUd^e%$ert zeiKNMdusq}1XiwL$`s%HEG$V1OP*HVv~SrvB+6{t71XdTH#z>dC5rcSapplOenp5R zYoltEdKOOOJkXA7%V?+4V-TZN+dK$0%!Y-i(w1Cddj-a;*mKz-Jx7kbYEl^An*3!C z=BC2iNNZd;VWqF9CNlYFma4x1_s@h!neX;w5qog=#HxSwadA-pF2<-}O-IApF06|5 zHW-PldF`OxF2AY)siRXKO7crDEa^_lJ~)S0ZnJ`L*5tyHL**H)Ig zumD3wmh8rr$bt|vz`Fyv&c5{!HkCb`lW0Vtl*z{hcKOwl(|@^JG64^EAcdqw9)vpi z$I_1uH*6IuntY}$<4zfIQ7lc<$2hU?mfkl7#wR*|_s&K~nE<8_N1OY@z1y0C!r0kV zpU=PukM2+?>*?F|z{H!gh{u!N2MgzlZ)=np9vjA_eFj6jAnT?b1fXeNb35z92El8~ z`+@%FrMHGqENA#<#iHXr_pK%u(gb9Cnd@DJNp&~%Melh=-!5G%4F=<8zvP_2}C6cKM2g^h%?&6aC%<-^qD0Es;~EJiwn z!&-jqp9J4WvyHIzMvW!zpG0K$v%q1DA(<4(32d4$BB+bmG@dV74?mHY*frQs{4p-Ad+BJ`M*9b&;{XWOi46E+DRT8McR}9Q zMc;s0jpm=^{W@hcvCX}=jB(a=*MU^lMu|tC?9|I^B~921f9!I9-?ZEcB6HGssMh+p z5==yTw1;lvDwO=rnlw3MK&5B~$p4_u`=wRF!8;DTWBOtyCMuHTY-|dEt)$rdJf^BT zK$--64J1JT!Pv0Aw0WK0?a(PQr%y3qmZ|z5`%e+TzpGuR?{35}RCG z>scMp#317fJmhr+gLucoxA^gX8eiPw%xI;bi~^eVmK#rpNfU07zR>TPVw?~sgb9fE z9}!t<0snIqd+tc|?n=mW33qfnu)a58ug>ZBxjW0TT&j#7sKc=CkFWXMal(zEoLf3eI)E82A9J2JZaU zY?kYzmu%X+kU=R^2qV#m?WT`;3RwQAr1{-nUy?6NY4FJpQ|B`tBBL$aW12-+j5oKk8d z)B=>gkrz~;`}o;tvHbwXb#Zn;(kN+C!kk04DN;L(fG)mIN8aO*AFn{IQ;^pqk zhy3gV?l_%fI00wNorJH}Z`PB)>7s>vpIh_hxLxyM9TU8y`e$Mu;+oSQNUqx2Xz;m+ z%>=Bb3srjnF(z%Jm!u3B0mrsIHkCQ_yjya+-|+%)1-1ZF1e-7k%dhFgUC8G?(PwOX z8&B`3B(c?-`xwd}?fJ`yGh0EH}O+1U8Qw zi$$fMz#SZ8ZDF7wSj0#+&TLO?SLm9M z3*eLfbiB|D+%P`OIrF!@DLsTR#jB?$HI6rhjUgU5lHBaWWNT}Zo4K*zTQaoOByQSq zWucR%zXSe(+{bgd&TPH!i>gb=Vt;DF(9>C^2pOX(PPs$QnLzJ;MR!_cT`u)c6vjBs zb4fcR)Z`6vi8HJo6;Ck>zvRtU{fgB81YyyImghZJJ|e@ zxpAsbZ$c#dCVGX@*f=@+S8N&qk2N?CvQf&j+Hq*phJMgHU*Uil2njT_4l);IV;c{R zi)mWBa}S7113cH?A%(*uWlb5Zo*S`(m&2h)Yc5FNA5Ys7BP@few)X0Q43dx@Lm;pY zfE1W`pWX_OGL{{EdwuDmi3Q5?d!=%-Eu>yT>!xcdZfjy=N24E)Kr#TNurq;~1fWsu zFxxbQYFN76B8hwtuBhmsolEHfvRc0v;CbAVLrs4tGN&S7F0O;A>d+dW4=Sb6R3fRvin?4QALAc<&CF>x0#m0tsuR2=Z`>#-r zRdt-T#0RsSBM1{5Nf6>$oD`urcPgFUM}Qp*kUnXme{3{j04+N}eFD}W{oUJ4;^Hmc zdzQOq5(=_d&f&f&dtA6G1v4T~%Mvkk zTq`cyO~m*>RhA>pcS5ntQF30@5S$Z!<5E1tHkkc?Uo72 z{$qMW1s2G#Ky%B^JKqPO$?8^Icz9N9xd2>gLTtOzSeh(R0fup~ zudgt|g9o3J`La^kd>3$!U_r*GW_tGL5lGweXIr0x`}a_e8qGfpNTdOqx!5s+Hy!cn zM@DPD;=B;sp3&nsK+rWzK-c&bMs9@Z*VOhOG*WPWbstMg0C;H-DA~>_01zD z*-m^5qU%zN&337PHG)1605?J+J>TlY(dF;|PycaEY~yoCa&TJZ{2WoYs*t6;9kFD+ zy;$U|TWR}s zwJhsut5fb{DjTs+`er2q@rN=8l|_YNvaJmB^9HuxvzQ!dfwH3sSC>9;b}&X>Be(?( z#e4XG+P0N(tm+^kSHj|84lx?Ys*3A0Jr*GGUpY5iT_k-{0pH)gdmACX{=-JVI+OQv zMhQ7}F4|PAEK%>*k%Jt{*!Vv59kYY3$X&C3qer%gtw=p4Hfue)9WLi3R+nWhE~82W z_HWB{)zSL?KdffQ)1yKUHU)u+?gmR~DE=doBc;(-7>*y z@|X2H?7dc*7Q~IV_|=hYe$8gfSu80>)F&vLr3yQRs=ovRK`+g=iCL(}hhj)<3B~F3 z9^EUP1HxZ3^YhoW6{fxvPh>)_u8jI=nw}fpPyhit%&EJA>lDhm==5kybrG9|28N|w za!r_a+x>P@(uhAAFusk+PescDXaTqarSy#pvefx%J8{!QDYuU$gbVsA(e!1#{pHU( z9!~sKW`Grdu&Vjd(Z=ROUqmKQ>2?*->61>oC9JXwk(R9)n?y+i5pu4g)q<2pj=ot+R)LiQS z{z(TCIbv*l9w}=r-)~h8v1~EwJ=4vA<3;Yb#wy${2_v7M)B#5pFq3}&@?g_C+8;y- z=&pH|ZOMQuZ5-~iLMM*9@PK9c=j&8%3_IX=P6m9ec|X-}c^#Z%%u5vYYzTlcNBBnu z&Z2Vcbhjrgr(iBPTi*4 z`_d&>@8;)O67?2*%l~Tv<}e2DWAXAaKQk&}DP6}NFG&4?UO__N8KfKNv|15DEhmN7 z-u|xnHuY#4K7mpb2Ez!@NRDHy68zK{9EpiUMv%TwAmnkG`m^2Gl)MuQWt#~XiRnG} z?NVp_)4SfQO%v1T+^-HCEW+V-QXG9l zSIwN{Hla7t9faIxb!ZIVIZXSElz!cqg_@@x>$=!-zIJVmVa zRaQL8?=rez5x85zox@H-k{*&P0T(pptqcb%uE87qg+jhY)BUCe;Q*Li-24@D(kat5 zs#q;8x*U?mvtTS7lM;6LxmsBQt(^GaxQNV{lJNAp3HZ=`G3F^@vB#^um~)j&qMUIp zCXn@5WIKi~yd7*zB8yF2b4IP$`;evBrLNyo01R+5Wb)_>>a8FDgOk znjdG;VUZ%EhCq58{PYgxU$kIZ;hnK&9zn`UDSm`o`&9YX3U8egXb7*QI8fYvr z%B>EOq{iH;x#;TgIx@r8x?Y*c0WgwzO>L#W+V>OduT_7lIQ$R!0n04_Es+Hb=tp;W z{;)0eCxa(u@!)u%F|P7D{Ft6z_R?Sh#BU_(F5?0UZ=baiue7H%WhFY+3@wliOWn+q|EyKp^OSOK>BEP!#nyT4yqg;>E? zlsd55h%x+Ig@oYfZg>|QwtGfF643pZ%>Gt8Bo+4jc~Z(W8I6X1y%28uc4Mtly3?8u zD?7d&UA9QBOM0YhN1!%FmQ_K5I~MYm3c~Pza~Od%p(iBVKJtPz5y=*QIi?B8KhS`e za2tKoL!m^iW~4);!;5fni$F2TxD}`3Cp`YpJa8kM{au72vex5gg!wsxro(w;GS#du z^e3_;oN;b=S(OJ-N?I*9*Lf{^F*llA@lHF}9a5vsaG8(vv;Vgv~M{=sdt&f>xV?Pmb|(sjkP07 zz1dSnl>LkpX|IrzH#Flg8ET>(u0UbBAtRc`Kx^E&vJc?qzDV{eQGe{}kI^5geny=5 zEP7=gHCmpB5e!nxkHR{eV&A~!l!B(2>}8+x;8o}Qa&$DrUGTw(=b&!cfXf5gmv3hI zPB^pMJd@?;rMDb%xCWDUhVcF_m08U*sZf;7A~gia8;~nRv-!$P<-~QYQv{er(^K%Y z4<`;_*oNFK)%%60mM1;=tU0vqwsas3dx@t-vYh0vt{ykU z%|CAkv?%N}_(~ZmzksD;S=piAz*1O2rnfKf{9m%Z9-#s%lVrWu2flWo#KZ%PMaPL& zq7-)rN}2joy`NVfW_d1nd@dtBFI31)fQXvSb3!PT;)my(d2P!Hr$l(ON+4#ox2H`y+ znn}LLqPn_M;s`hs+iujG7dtvyGx>|=%8ZcErzdi>M)pgIwA-}X?vNk1uPLRC7NT8o z)XB-j(q@u56DD5J(AvX_#^!;eBRHxPWh}to7p8F}tbUetn%1lefJ6!kZmi=dME&59 zacE?sC_19%>#sQXyzdaF>&7J4YW^0f@+f^?;t!5}Z{YdzWp27p&j*+k3b`i%Sq8^i zJqot5TgI~T_k%p}k)I=*Q3ndg0+*C1RWGL-cr=selV%L)ipheD6qfS<33e>hl6FYj+1p-o= ze_8+7ua1lWT{|>V8F^vq1tJW6{}>YO0s(W7f#KoAf5o!+Q65qMkPlfQ=zI)}R(Bj& zoC!v79GA{L?U(G#jSVlue3SRtV5Lx){own`&qD!WB_yJLiEqO0Mn5Ay3%5q(DTM7R z!+B|7gWgF#xe_x!4#)22ZXL!9+LQTI;_&O|#nwaM?cH~E#ap1;+}`hdM1Qlt5C(#JOy)gU6rWGQBb!_E;}4Up9ixYL+~ALds$l z1=9GP666vS?l&+q04SFp_Td1j$K!F`S^Iq`;DC9BFN_msNyNO-9g)duH!U=x%JF}m zY$hQDgW)xA#MVMYqvaFIKjKwx+Y@O4Hj9Uh$m9768K#FQ$jT+oPa%2Yw#1*s;Hdwe zpmlS*ljKO}Xowwffb3q9MULbEBtKV52|n)D)?MpZ-p;$-Jrm6a&p>T%IX92gu3-FV z$i=mdCn`NHus0{MI3)Q6ke-6niWI6AB*38y3lWG{vuerL;pq4TyRrpSX?zY5(7p&l zw=q3^18cgv@y7!Wf@`KxQpK6hnmBRTD?WE)oj;1e5hH!6v69 zor}A)j7iiA{lI@xqmw&`!;F%dgedo(?ck?;BMI3|J|z0HEL_iFUX-cPb_J>Xlt7Z$ z3KszbGcGb$Z1C2WA0Wk4wg`_}c^N%fRwMo<;E$f(p zOD4`fc}UZ8hEg|H8m`8ig2IpOI=^}{Y0w?PfCO`(%R!**(0k6Eo|Bho1& zgA9?ygYrc4PYrSiibT|d!qBhTUw^SsTG#`RyWCX3Szaok{b5j-Cb?KqUaY+9FHM)ed6uQwo?EB_Rw?4)bGr}(ZoH6l z9I$vr5_O``9b%?4(7^%y-)n@m z*O$nT@jscEnJ)*`SIKJ{ZdU~e$vxskUhfLrw!dJ)_^A$Vkcr%?>AG%k7U&5ELzn)2 z7T_4GLFj|Kf(h=P_A=Ka1Z=u)y=vTYEAv>%@w{zX+e6iJ zkAW1*lxS^<`#jp5Pl!Abww*^~Mi1@W)xAFYY@fa?me~)5Y&|u-o@L%2`<(l1v^|~p zK;7L@I930=^FC~QeB?1kD9uD@W(uLFrv;~K!RLGbEUc$^hg4{z@s|_YUP;yU(bqs) z3tz+6H#DiwalNC^@$N4%;TvXDQB#?}5*o;q%3_q&C}E!O>E*JSMH})o%eq`Kq&Rl# z&q?tnQw*gl)zmF(y&wsaRk|iM$YY$GReU`%Qidz@NA|EAZo=2@p(a(5e~G6`%<>i( z)MfH)N{v^{8!4={`T6qjrc|JoG(hgH_6Z#-!SV-gVr6S&wZnCKey*T5LzSP!lwA}C ziyL4}na@3yQGU`()}WIph?`4B6A8d&U`rL5 zGsA2dm>zKCcDaj}^D^*(T5s=if@-+3e5$~`vWPb)DG1*feQRsE1pl`Waz4dBbFVo$ag|m0bHNyhdH>{ zc%$mt1crL-2QQ6C#(#-!tq*hL@-@uYmDjpTG0FN1B$Bu-S#^@OYLxxwq%D_q4#l+( zAAW@@A1O%JCbHOzDLXL#%`o9F%hA%Di;emlEZ=){+MpdYQess-8CO@NkqK$5_B||wlCt*2X~0$!RTX`53@Ln1l5}W z_jtpp%qs~9le+{0ZcI!HTra=sA`;Vm=;N#A9RpN?NNX>nn0J$jnTF=}e)kQUCvC6R ztGBC}TOl9XItF(b0X;YK)8^w^AXe1a-rZmI%-tcq7X~PlHpAltZ^k@4Ia$_nX)^)0 z4}kqQ`?7kzAd62UcRW3zi9Ad=XxEo_i({?~4Ob_ZmHux3jjy`5ARw;)5u2B-wmyQ^Gvk+?*R!?Qf!w>f*UQ(@N1u(A@05A1FV{A9`)5>J zxX`D&hQ0gQy0$)%`x2l2dsKq^9Fcnm-P=a#`?0p$&$^fUT|glmpyd6R!}DNB2@sat z{rmKGH?PRuMkMgJw?$YjHQQcDS}yGtDS7$dww>zyle_=tg!2L!v@UB-eI1Ibep$8- znrFcQ#sYL=DDwPNR=OhC4D2b(SbR*VOLpa!A;wD-vNt3fT-Xd8O0R&*SWK@oE*;p3zP>7n!U`OE3Uz0J>6G9l2aAqWv zwc(TahgN~cQ&p_jgquvL)tv8lEBd2G=;GLI$A-^(55_eXEws_Ym$fVeDWU9vE!V_| z%vb`(KPPLitEItAM(bbJ&U4p}35QTrN+*pi<8+P%E@TaSr)8|JLw+3aV1y(uo(Ma~ z%4*<4#VY(sAFX>ha+`q z;wv>Zl3+@8M6?)tr9wULPCdU*ePjLQ*|WTi2h@}>d3bFXL#I$Xy9h{Of0@^vzopGw zQgX7Pxj78|Mn#{lv{|(TP$x`Czc)1SMkv9v@j60hVi{HWxP2cU`NTjh!^chjB0#S1 z?Ts&ovI?XObcJk5YiK7?XAYg+zOJruNBf%sMePWO6Du+ee@(t4;TtZBno5L}WA4O+ zx%$)9uL2R)jeG8Y`2?x*3^Q*#<-AJ%HJkt6{cFpG#U7~Uf1E0ILgt3&f;Y5dFZfc+ z1J%TT&GdP;`K?;?2B_r=>Z_YOrC&QvmHSDyHqW8bZd)X}L%Sx)Yp-QK0efyhuGZMu z>x<8eNWak}AU+hnTwp!B=_B7N6S;KDFZkfL=CL-QqUS^0XXm#-QAr-cXvy-bT^XHCDPq3E#2J=Aq@`AzJ1>B{r0ne@Q34=VSsh7b*(dr zd62qJEjRkM`=fndkPHw0EW3PQxy9TDF0&&&J}M?N2MFuWCjNy6e+$^bB74{cL&4qg zdim3|it@K|0<_-9a+hrwZy+h@u0Yp5@CJrvE^$M8T zCYyA(qLS9!h~HUv(Cg~MH5I4C#1emJIkfn?uvSB{6v(JEI4Uoqy=dEJrHj0vV` zAWV^iqAV1J{!l5rSi47w?iW#|zf;QHh8gd(xn4T&o3lJWif;|PuGgbsNcM)Q=s$k5 zJ~yrMUwbxVt?Qa&y~R{zs+3=J_M0NlbqKrN2E~>dG1wog#>FFmF*8Zn1w?d3`jH;t z11(x%q6f12hjS1q3i{?+Lq+2%E9opJ8A-Jo)QFnwS@_uEsHh+l)l)W&JnpU}V@Y-n z4laM!Sa)}+0L7ur?fV?a_0AC$*c!h1)L0vLAdyIOffIy-L|Y7s+tb!dA8hi7uOj%X z-K=5j^y=4~q*(fwAHvMs2-xRHG9ZW3p%=Oh;5&n8DFZj5JQahiRYyKtbsYg;tM~h@ zd-b4=n}_hiYtW_y{lLu}Et@Ku#{_&HT(#GYNOHjfG(CsN{1~O0VhwZSqD?b%q1Qj( zq_Jw}SN1}-k1^B89Dcg?>}{KKRo&?nr~tZN@aV;_nCT&S?ng}Xf7kfMmtS{J^xEBb zb5-3?v2++c(7>__r0~2xLtY%$oDH9UQrv9ad+Y->_2B(psnA%s|E;40YAZgqL<__;TC5gJgJznERZ?bg}tr_^PDRJ+LF~ zR7G^^{z_X7yGY6;XF?YvK7-M}@{H-Z3x}!CRAO9vh03c9;pjy=6YSLRK~Z_rn$n}{ z)cPJpiL%*Gk`4f=xjFIVHM%H}I`t8Mq`rn(f;!v8q(HoU{y-A0H_eHAw5u>T~lBN*m)WlOOccshSbB$0*>>t ztw;YGOdeWw{cguyjt_-xmR&2;O^+!QHs$?NXL%xX9tm>Qk2$5Li-jT<8rg!yvfR(|Z z^lPq8PTWnEgA+AWsJ#Z8I+4%nC#5`pI17qH% z9nkJXPR}5i?nxuFW7}~koEA1p3Nbw^J{Q<*`A%tMLKes%%xb6k!J_<)dt-1} z3R+d}2kO=eot60GJ+2ezLRgPv0V$kiPjha27g;1rFb=J#ZI$gog;Wys5u@$OG9;fc zKXFUX>5H)vAGvgMS_`&!6UtcQO3EKEWZ`t3*LUjgzC1c~Ixvwo>Ldg3o+hqV;K^NwT(6;`aWh z{oSIq+2u3u_5 z1^6Y4)5Mc9>}dvMuKjm`Wre==gmfPy`2VC*H)ML>W1GSO;DnD~A(9KhhuvGTpRlxI{ zYRC4O`)(;GNsO_{qi9`cb#X?j=_^)TN$G71KWYe3isc(ps<9D7`sdjN(wTblXI=^u z`%=E{Yj}LJ)WnZ_do;82v85Dlm?sa%*8`vA`)Y2Ck1<^-eq`CDC{@x=OCle_r!b(8 zmnt;!CAM)(qR_dCOeZeF1+J!yOrn9N zDuGaarWO16G0g>F`(@$a7`@YCiINA)W~~_e^fY}gN)Sutl?648s>=@W+b{0!MdN)W zrDx^f34>%n-o+mLUN--Aj0+5;8X5~9KjReKglWFpgf3Uj@pw4kZ$j}2=?hY*(SyvT zc-_d8zCKg^-uV9~KVV6s^xZx6@5xD7tEE|SjhTH>EpkyUx>ju`fi4Vfgn)mJIXvZf zbW=V&LN+hC-^2^f$iUw%>27>{_S+jK@9B{0e8t;9>AAVV?!M^q*l9CZ^qDUw@t3%P zW_zqn0ACx;lbT&Sf%${qw;s0k<>aTmo@aIPQ%IjmF%bOkc34wGGHRa!B^4V5a>oeW z{GDv@K^{QO@#_pgDoetG#Ld=dF+1dk42>HXL@v3A=cX`A4zGmU!z8VV7#r}JjdbkaA3uiUBEa0C!%IPxVHS_PW{O1k%nrra zIw+}ScnALZ1%6tHkqPZ1rMAsT<2{aa)+f^KyCZ)#Pk zRXyx36lCE2keQOp)Ll?mKfDz?D$pzm9EVm%=jPoSuORW0qUK>wD+Ja<7@c>Pb^>!3 zHKUSCCz2I;Qe@#QN`~4Eg2Kp)Mdg*^UG_(*!_g*D?EurPRr6}f7>7+PbsCf7n}kX8 zjNIH6j7#5}8cERj-X1OeSowF~OPJYYQ|#z_vM9fRvWPUsN^mvTrC%uI-U=l;de&?P zq*KWWVbZg(K0+)n&jLWojI3<3&Pm!o+XW>?Oke2usqN%a_}j5Y8rq4-OnoFaPb|nl zR3-{ZR%N;D!{AqJ*5|xErD5vK|J_QN-yA({h^q2y*!E!tzQO%Kqw(p%)sT1u= zP1xBZ36npqQ@|WXgCQvh$J823QB3h=99ml>u2pha$J4NwN3^%3X|XnFs%`S&ZEA2D z!Tzsl%=s|6_S5Mk(1I@Nx70qUUY%mpmD{KHqSfo@8NXj*u$bVB*qBh3Q)PJo+NEr+ zSFa5$8%L@ujL^GemAJpp0bD$#5M|2Jhpzpw8iS`#keI&1k6Dy|Xmm%vhZH$~k*H8Z z>^A7N<@}-F8j;MDgr6OQ|1Bn;0rC}sq-fvcxiH5FDteEF1|OJ~jCO5-rD0Pt<+FOd z{KEz{o`;Cud+u0)lQ7Je>D!fx&5&&I#FEylbfZodBbY9RQC(;Ev1_?BMA&3je@lS3 z?@!h!I`1e{K3ixkiUi0kxsz3O$XwC%P%=y_I|>rt1;t*C3tE{Wjx@gARqk!+blSu= zT9sZGIt8~ZhWW64ZTRy7%JyFM$!YDEw*Fn<7a8cpwD@C-gc@DiCtWaxF-Cr&=Wl+M z#|D$|iT^crJB{0j+3lR}5mPeh=qHaf8C(0abryZCr9)=71(G)OK*l}v>pl1ZRg`?w zcfoG?YAu3lY4ZIiCZ6lomG8i=%+7Puq0U`L6=;Xe6F#|UG4lPD@iB0p4V{Wnuf^Vf z-~1!_w{jeD;PKjrYmElBrlW4q54tvbbF;*eeR7zn-F06{x=RlX2N|?BJikUqd3E;@ zK|{ToQIVGv4y*lj4Aj(eezO;Gv2I|MB2`p?<>K-1&v4}pwO_5!GvLCQYefc-Lhnu) z#x!GgX_Y^Zf`9Z62Td4ag-k*h!rl+6WWw| zAI6V0PW7(Nx-@YKEv8Ec1XC7M+cKn843pIJvFV9+M+7PM0`6W-n4l#HOpa1C?$wO5 z-*zNs6}s~Yvu zXV$@RA`g)30^prd1N^cey~X~;8UuB`if@;hf;wMaVKth**8JuyNa+Km)VRQ{+2B{J z6oRXPN8#7R!L&|>T8NJ7Xpwf6$T&yiPjKqsZGK9ZAn2uTISrmi#~}mTKj&nJJ~uXV zNLNq#+l~7tKm#q1gy2L>RG1zo zVOP zeG(rwxj+4iNUQM+cU7J?sB|O4`m;2tFqerq+?dXo67c{)<6`K8W};*l?FbPy!4oZf zdpe%ohf)#0Ry{`cvV77S+6qf}<8TlS2h3r%v;OkAipT?OvAkzcqV?A^-_3C0O@wYo zc4el>V$(KdQ8M#9sQ>QY{@Z+yVfMKPql*W!W6F|fExHbUw|tXb5(~eZW0+bOzdY03 zixFPj8O-nWwoRGLsVs|Mj?MqvF%|!z@E%=NXU$+gqOH{b{kAMkECM1M*ToiFWDaN` z`9CkNiWGz?1^b8wpLi9qS=$X2%)9fr{KX6vZL;m`^t6Z+Lz=~o_5%LjcAT9|qEniP zt4%-Vbz|ai@j-i5jVo4p%U`V7brHz54ViZD54`pCS1IqmA+_9hu4oJEbQ(tXY`3lt&V)-wO z`Yy6}42T92c_6KP8cuF8)dkADFfc#Cz!NIT7F|ut?$A$~J)!sQwP5lx56c$SB#4Sj zu3Y%3!htS|Y7)T&@mAIb;ottMjIy3r=#YIHj3~!(p3T${>`Ic3pvW(nlloZwn$B0s zV)0&5#1#q+dC!Fd);cI&f(m?zlV}CCw4ivvxiy5M$CPx^w!u`s8QG`%tq1SXwSiEk zHtLz+lhe)gZeTnnKSpu!Em*dmq#BDs&K)BHEc=rVc=?aJ1cJ$(G%o3V$sk*1J=JXj z_QA`W!%qfnc|@U;5@&hLxnutaT?8q+{rHX#rFR##mA!%Q7&qVq;6amx3+&ye^US3uV#SYJc~g z6%vLxv4o1`+at2RPHEd7aWiR#smzk{w><2ic?4;h$&_gm_Sx?BjL*GRk}mG`?GE$e zgS%e26E7c=o&t?IjBxs<-IASa{Zu6$D{vCgEvigll`GIH)tHt3EM>WgH~pxZ1Jk8M zCWIXR22{l{1%ke$hPE|J0OZv;hXfyS1ith zxZuNVR$#eMWHdxh^+hSDa-Y3zi!eK$4n?Fad}j2^ayu2NdGF(ffni?joYl(aHiHyC}gpGGYx zIcBWjVh5)mE-a^IJaz-44)XNYeUx`)FH$MvzksWM=fglz) zRx-G@7E@Fh=oPufF)frJh^0O`$&vwUM}A0^1romVXVSG;D;nThcBUNlFZ_h0nN zG;{uOXd+BTL;s+6#`u>|;NCqHPioPSV(Ql^UpReCK`Kk>b#OpkO~)}Xy6?ux*<2gK zj-lj|JnfPWj*_fbC|{<|R;>M2*Xrv9L}azvg_*Dbu62rR_qG`XIS`MpXKFMa)49{s z2UXY{?yjEMO>fQ?NsoZD6RN^6@>1TZ>G}X{0dqlA>K`x-I`+W(w>oVj0{64&@0P4( z69SD&At^k5EsiKrDaTBYHTGEl1uiFSmA(b=uTiLgshuif&>W{IVgqbo5ZSHrU1w+y zURX#{pQzPajjhk+90aBfI3nJ;Q^A4}0f;U1k)MefKvOfK5k1_09%-M3o2VN&i_$nr zmP-s$;#LSKGsJa_c|Xrb4o7+UONDV%D$^x^m`g&#s1XVpMdRHodpv5*qL9p6=%q_< zpT8loXDUoMTKj%ZXJUlm99xV8a<|(){|3v-7Q$Fw&sCLO1O;9Yhc68j~IG(H46SeqaCP~9P4Rd#wBUhYX zV;&Z|<1nK~oHD~scp5Bp`Ie&MUE@6SAauN~K)d|<;9cmZu_hkZy-=9f+QDlLO zEjE~1)RZw*^w00qvRHNd{_B%W-9bJOX>p3xKHOsoj(88|pR5(}AEPaAyTqn4Xf@l0 z8P++@zIr0~qZL}WQ%v*;!qB|0j7jW&#@_)^ZA5i|F${+C(fKA?c`PxZ<9rU!(Y8ft#M&%XMi41Yk-F>@$pC8Buqlfp871C z^Z<0C4nvfc#bAvC`nV?^8I4!%WbT%HBshHm0Pyas(P!F=VQ0!scWxw(Si9csXeUx{ ztjCYo(xgj?Ei7oX_}SUgX^$g|*v8#4!Ot_n)c+UF{&#`zZ5bIydft8%@uPh!ZSBia z{094O%Lc71xQ+I%}X@!k@Pl^3O$jliG=`8V#JhWemh{M zE_nE}DXi)!4J19q$hHwN;PQ_Lx3)n)JV6)B?-=_WbB8^LxL8I#yl1s?6l&_WPOD<< zl(BC;*MDige)s-xigM(NxY*hCE2SElym2|C(gvxRKLOXloRCIHRI5}{HZTD<-y@*# zG`Y@I7&D#25fVM@id)?j`$d;sBTe4BTb?nByXHbh`=Wo$>Acq*6q7K9f-uzj0X+#k zrtY-PsepETOO3TbkTz*+A=_NnsXt`jK6gA${OjBxp-ufAJS8pAI4#`~bYifC>m_%}%YcaLcsy*k* z8%|aWXuUllxqL`YiUye!O=sqU;2|mtPOLU!2s?+jysI*I*j>xG-Uo8BwY1{pvHl1O z(?8HR_-jZzF7&~zDAM7~`&o#baaFB2y?#UD-A80QxExv~ca1a!4W4uqWDyuBe7EbZ z-9L!^TvsTAe3DZ1StVdC=X<84k8=NXy*122 zQuzs%W<_7^&cE+JpY{Cq4+vq>rkNM9Q3j+bjNJ?Fr!*g>3Ee0P@kKRFZI7C zm69hjd^RlwuO+^x^wS94a&_E~SBvD;Fhq;K7=6jFs;EdDDN4`HBBJA!Lg>Ajb82<9 zUp)YXs0REliI=q|n~=6?aA3V<8gSCNZ~j_wP*L4JN2e@>x%$EOJI6KZQuRaf#>LJI zUA6xW$(L4nOMmYbw-;=(humr*P-FMye;;RLy-Ji0CbNA;5oA=#hbT-%$PsjrpF_y= zir&bdg7)cQF|DUB^M*d^ew)eT#gHYY)V;_xk4e%na!PIrMUD~Fp*O8TMrno}BpVaO z{CLZNe_<&S=v>Kr-oz4I#Bw;YMZ|i+3{|1~yF(na`jPn^rP0P76m5I8R?{ovt*OA1(&ZKWY>MJfS>wv(9Drt$>(dIvyP!F4 zAvUyR+Uis~!&CVpg4t`ngUc}8Bzg^+_s564caD5op~x~l zj4?Hbb_K~a?CdMqln$jY)^wzXXBFXU78NmNKsW<)k+2aNO^m^%lihA{KDFGy(Z4F{f=m*b zL<132N8GEgQDvqxbdwLp&zX`VPADVp63J4mNsB$#$yL8Iydzg(bEP8uLkph~MU~X?3De9iSw#<31h{=wK zPf&lWv!WGQh)R6J0>dJT-HOu!6NzeTguo}}?s3dlHoQ&#X+>1qnh}G&YVG#&;$CGl|(zi*>3%fZp3pNFyLR((KrI`|`A#D=HgJDTSMuYUb14H%$pJ zD&M$WtpYDERTOi1CNt_G_mJ18+zX*+rB_1wwCWmWE_>ZBNC4x1B zBO@{Y0VaMHk*f~t8R5_-T{M^N9rLORhdO4V#`9~BWF7%yIb`b6KD2i-bUkjdVmkQ= zg=_4f4*JhlUev6ML^z(gx02E*60%2Coc{%L0MDWkjX~ zz0)+%@3FtX3sUnX$T!!lJ!qLmCNGd?+%4YZVN99kuG1wJ)4ijDeXkQZ<@Dtip5IVF zsY*?JFqRc{=?GhQ{Y z-?3((EK=1RTpFkDodcn<_EKD|c@{6rk;%whCPM5_;m%4>u`xA#nr*7gJ2?GYk{EIg zBZ!prK4L=?mop&;L3vtDJzSk>veoB{Mrya7@8(=QUtEj}-^#7NWr@o>;8E@xCU)V$ z#VrYH1{RXf_NI3xCVZp|)v_Iz`GyuHkC zC%(a@ntQ|?37e(kVHPb<25&7^IeV;xt5juk%q-jTCDL7biOMpN%Oi5EpK_DE|6Pew z6hI}|Owl3aDqUUU_fg{009nRP8^WMH9Pcqb7DfivVl%ny`y-#P^2R#L1{r-m=?J$B z?F&FDX)o)CU4G2*`wdo<8HsB7cW%>Es@;M?2z>6kqylXTtYp(w&VI;+(SFtOXOPIi zHuUs{A<_5Kkg%BFyiO)F+tq?EG8b7|y&4xTLXR36nu~V_T;1?};gLWd5NqszLSNQ)us4dOA!p zj2r?n4i}ydY?$J}nrDtroV@byVy8dBY_jb+ChZ%8s^t}q&FFw$6edz!I!KK>P$VWD zLs@pWvXU<>H%~;fJubOLm~6V>HQIaVPU?@RX##k3cW#i)j7F+Wrc7(qRdDFq)|TJv z49>t~uPHb^6Jc5Y^$?p}Tv;f8U}Xh2Ik^yi9M;K`6nGYKM`b7~Vk`6Xw`os6Hc~`3_Kj|SV zrs3$rRRm)2p^1sW2xC6zgV@-eLfgD$BBAUMcp}DPs#>l&a>&}e?#?HQ0I15g+DOV$ z$|5ys_gZ}SwS70GMz@>KM}qn@Y%H06G;)Nxp1<@~!5Wx71y`xrsR(4{&<lhm~N((RamPImh;7#mYZiApoe*mjsW;+yiAX5H)zZC5ggWpwDf zB~L&;+3p;12DPuKvd^C; z;%lm*2bqUac)f%|v<+)))#K4~|N^$M*KPPn*Vy<>;}aB{Vd-J`&Oc>{82a zoG$Rrfv-2Yf}_Ah$U_qFH10R)xQdG=;7Ypre1=9jgC>uie&X$WKc-aM!ad|NnQi88 z90oX{$2uPM<4xrv4^|3F0JfQa>;(8Y#EY&u#tD;_Jl?K=s)rGf-qGS->z~*)sBQge z-4AU15!QR=({@O0kzc(#;f};f5M(1P+B!-u&^RoMvXV2XnOR|9(CBe(iV<;F+(_T+ zDll9cGWB1+6ku+|{C8}T8@i%wX2KhdJ03 zd~G!l1=Bt04O?FF2N-hjF_dGet6777j!#i`5c=SEHiV6rnDDRGuAMF_FI0C@aTIEc z^uOy)yGIYIpqwH|r5FFT?;v;sPd-Z`^{35^RGgHnP(Juf27Y;HocjzA7^R8gO_PAj zoc{b`AqiOI8|DcDV762DtjbFJe;1FfCC=9;!zcQ#+sgCno_A0u0BZvhSlOPgm|kIk z=%avN%k_9I*Au#zegg*wxHO7H+uhH-xz6VT9(j!xF7+|zkN<2DrKFGa2ColNfQG^! zmE6duJ<43$E{&dSOaI)P2t);_b1JGGo%b&OD09GtqWfM(D>>g?z?^$8?&fiPJ4FO8 zHk$XAuYXAYX?O0Kx*v!3T(s%FAp$M!e1IwE0(g5lNlCFd||c@E!A2q5*In3+NRcMKQoc03p3e5+_PyWH57LPo zT?=>jAW=b|aR|YC)#SptpKhs)`uSS?3%9yJCA_hJ6cU~Wpjj{Q(Pdf@yp!F!_g?f- z74rX?)`D0a)5KbK|Fg=d@a<}4+-xv7kG1fws~|nB78wAZzBxJ0{mrAdcVeH5rK$KY zJY70rYd<25m}UNiV_84ogX)a|h&pN!8tU7Y68*q>AI^LA%h1G4S*=s*IIc&4I|6SZ zbunswh5(tIDu*}S`@Qp@Z|(zipNheO08u$Q`rgzOZidMic4j_r{)^$v3t{YAV;Rl2 z#n|H-(HR)YxMTIR*x-bw7>Lt?#&=#r3ttmtG=<(k6U4zf<*4OX25W?3Fu|8Ni(;Ds zLs2Uf1x?E0l8+z1enD*+;I|w={#IOXR%flq*t+J?(qp5*>L#om5rQs4*I{4ckR;t{ z!kfNp6s2PyA9M=XaB5GSo9wr}NwmYNv#8+Y&2UaoWLDp4_L^zbE-V?cTNhUTXfk^G z+Pv6cPo2-ZRYx#RU;<f7UNkyPrwR5tZ(p?B2Bp#LB3KO3DalZPyxSoe)%m`>9T=%1i#- zS<4AF7M8)yS0B=yP&|WQP(KpSEfRz0LowRoR$xc{p<&Z;uTZ_8AAVK}E~9{bI<9`9 z*!_=fPTymFG+glJEw~KZ(PuRaA0I?kJm9l=?V^^c4q@_0TZOiE}!wYU`5g=WJ?|eiCU#4uNsWcbUCB zekk^v-24rGyXe%+(;EtSXPGcVtRZTkbsnWfHRKdiX3)3)6%G84>LsjyEG&KIvJD~I zQRJ;?UIU1|Dn-)TFYoB_p|`d;asmu{3y&?TB}uZJIE&rI{XV5TItNTsXAVYh6wpM^!@9LyL*W zL;IuGRqeD&B31HG+B&9{R|;-evmYFk8d*u$6dNdJUlL7rVINZ$Sy}KD#3rIG=I|Q& zPI-dh3)iTD>c|${T`ND>Y^BaIIVan3zjXHe2Oca-G-P6LAANZ_GsTfvg;yuge!ilU zu`D1Bdb8Se+4+n$>H?Qs#gZ0eLrC-?JUZ$N(ocH~3A&>mgJnJeS=-Ui=_B=!4NR$S z0h=Y$zQ5$o^BOgJDEu>zP2u@g^y@NzT{{PBU!8|+kWhHy2cbukVV?FAumnsUKecozod?5U<00AFuIp!$@%Eq~95EU{eC_3!r@JU%1x? z!6y&Fk4I`Pe+DdPV9#$zom|?zDbdlKu#=(pz%%t1Ikr^kZL;FX+wof z*faC-O)oC*1Mbui?BC;xJ3heP_~_1PxB;Xd0&`b}d{}eWzMGclhJW}9Lbo4j6mu;Ao`BL?TDVF z1Bo2AQX@-`Q_8$uv{=u=-#-)D`DjnAPIVp+TN8clXyNCH57MZ?V_kWr#CTIG=;iTb=qw{r$CNBzgI``W9xSp6khOVD8=n ztT4Zt7@9^`zw`M7W-Nm&N@=Eh*o3@uu!iEDAAa-rPWH?2{GJ#$T1K6GI^+R<2Y~A- z)F|I>TGdM3n>&i;S8l;!2uE5CN=5tJ?Xt;ZxDZpsH#r=PUiEtCy>8R@t<9|6yrBAl z!itdvW2_2oNYW>=xf9a0*@zL)w0U0JZ_+*Fp!ri81lnu2ZF6w=w!E@pVQieLRuk7u zufDLrsg<4^Ta~R*4tRob06jDXfUOWD;^(^y1}=gr0EM}jNnkDLSPDM2Q+!gRNFT4DMh)uc`&jZHeF+fRv? z)=rz|7(RrTATj9cP!$rippb5knrOF|{u(PKGZh=1DPl-IW-=uN|Aan;OHr9Nf8JT3 z)2r$o9i{XB`K!J>!3~+m9lfzMiqfm8*;ehR8|;=h2|&oSFKD!3ST(Kab$EuhpYgU? z>JBwsR0X9YLIg~aBp027%RIL6mi1OLdO736g#hP5^AEM3{I5^=MJeBf zy8CJ=T@bKGU1XLq6RgaKDPqYvzAU32nQL>}+Un}Hxn`_72!z;wUWuDMv)ynW; zq647u%1TLDXfaM`EkE$6LUQ@W*F8wN+`!>vk||&<(W}0)`lo49|L^}0V|B*ssPMDh z%c0Fa&0O!yf9Nq{DF3(xpeLRDXR#@ov3|J@xHp|S!hXFnd{MnxM&7&|gx>u-VjX>V z%kO*OH)QIU51{_9rgx(d(&s{!I1-*;p-5v-q}|u>Kt@^0=EJz5lnKR zcszl2KgiWJZfp2Rw*f^O0(6=8>zj|NdW*Zw{@0Xy*V_D(b24`A_C?qgTt@AX7mAR` zo(;P`@W5{ukUbITP3Ab~{6B5A=*6FD=QwV|urKARn=^Mox4F{A*dQcX{N6H@*@LFe zXOW<5REi=aTFI05JIfHo%gXbogjGj@K}s|sbiaV(0T=$;8;=Aq;KudZY$vgFvk#v1 zJ^R4FNtrfw_2Ti$Alfq|bg6yZ$eU_^eP>#2>26`;6#oC9XihjSWn${yg+&h%K%1&c zS9~>g&UwBs-u`)RdYh9m=xT!4KoI>0ZJ%(tGBuo4%K5gBV9vQj9W?q05yf~^^R6rW z+=q4_>Q{TVx6DkV_31wA1B&BlsycDkq z`Rjh$^Vp5?W8s*|`Zdlp#u)xBIqX7C=uT)PYu%?*s0rJ}Q%heg5~~3Xik;or`Gb%&fKdX0oyJ8q9%rJfwNBMR=}CR!(%)tP^N=2u zmMww?U1qed;0iRI{v(C*t(`#Ej2#ya+C;B7D(-a^i^;i(1PYXP6FT0-X`~e0%ryb$ zZ>gke!L;5UzYZO*5_FX>$%_vh3h{B#ByHa`d_OkV9e~ozEeyRpL^N;e;`!UH*=XwPojy!u`!uiU;!*SZ1hg&j zoOPP5ltr&=C6yh4&N^QOjEdLCm9oN~8K={{vW-H_Lnis@=&3*NQ;9tw!t-^r2*WLKn zz3RJUp=a@;E+E8QGv|)i(C>`_Ya6%LTWbXkjGVL1rsK7q^xRt<;@{N55SWhjFb z>Ld#X&nO^OK8ooFv_4ji?n=|;DLZ`wV}J!b5OBf+0?A!?p(mizz>Balbu2gFNfmfp z3rU|{ic&gW+~O}rH3fU{y6@C;UJjraegn`hDCI;>XV1|rWU2=u^a=}MVsLi0#t+ws3;#VnZla6( z@1bw?bj|>7k~v-nL-Go6F15@9_RU0tP4*f#d=O1r2^Lcd4<>c0w4Xus=AQ2J=<1dW zncsC*w(e)?^_HxZZM{Q~j9ckwx%^T#Tbcd}nx+f>=7sX7#S~k4IXOqH`k%MD3-%*R z$*vEtfbr5axZMtj(o&f``~t29>djcK&st7lH}4jp+M7#zS)2E7fsDrXvzAcHT)u%; zBssm7mf!V4f+PAKYqFgiTStzsTVW$P|2^~OlB_l4)4j8mfkW@>D55W(?qd1zQ7m4j zoRxu5Ppe?w=JGe2(7|6mhyA_*DhD2CU!%YS?vyJP9m>Y{ROn#wLAF4aPvpWrh=IZs z!tUK$VPVXw)uUWttz-{$QQxDyY^6>q#nk^u@L%Mmg6ovO?*?XQy3{@(L%7lso8S;q z&TG?|E(iHYc4~FcNNnO#zr7`4e>rECGXZ`{d} zhZfB{r~)7ZOo2Gru!X{Sq)lbu?vk|eL)m;*MWsE9kdT+c?$XLnlhrRj5Nh-ix|D5+ z+48LQ77IJ{*^W>+_O64GCXtN6Q2R!C@-JV*Y$<*Y)(2X4?es4}kkXBl&b%qpYKGV416yj?c~7rtFh*?JXCZcK+PW}h|BpP{tE1L3Dl zYl(4e6cg`Ec|!*IXREko=vLmn0}D$%2E{5Lv@m9e_!uq4LqwF%KiRETqhU#yoZ(3x z^^(|z9M^M|N3er!N~i1Fo(5RPzG4nB+Ejye%Vsf=EFxCq{{^qzV+oR^qDRc~gCRtdMEWZ?lq?o=*iSn}Zfl6=r1FWi6Y7w{$Xg)`r;wos-uuV|p zBjRPpIuel`sV%(LYw-+KEoEfobURDc}*+{pb-8DP?d=*0u1ooa-0l=zs0g@i1Qv!w!u82ewLnz>EcA{LJKX zBdts+k01zbrD?g2)Ac;ef4rM36`F(>ykKM-^o@fj?MRFFzu6@c^8Z9IJ8gQ<pIPAl-d_&~=G2wLK)mC%SXbAzk1Pc*&CN@7apzR=sK9!1`WGXZkM#!&t#GSS^cj z%skDeGWIGO+kU`eeSgOy_&cQ*(d4WZ=D7J&TSV!1lxn1gWe>Va+?;c#RdFe$_I2pv zE2nRYS_jGEyixZg5N_`ugg5zp_3|0mD$VUGu=$}@KmY>#B>&K)zza1=3zQLP3t-=T z?2QL#{6Z;QuN!r=q)AHvt@Y3GcwRHr{2cJVnOOgkH{bLt$jF~c$cha8z#&j;Ktu^5 zFhol$e2q5r4oWUH*lVozN}(?=C*p1B0V007fE>F^!1lp6JKJ7bsXWS76a+?4vwD4N zk5GQd7Rbd9BV+V23V$NTcub7m1v%e%3Ys8td3?uL2F@N1G79<)?IP`@LE4&H`Va?1 z?+viZ3Ky>wCAe#S%-+hsrz~=hOtNm~+c=rmNtUM$rHXyK(o`}0!{nW8dV{a541+G1 z?!cN8#km%b=bL||>W=>BB6jZvd&1SEUdurHRcTN{YG{IS8{5=M!#9?~NNZd0Q%G)T zf)?0R7Z;&zMQ7%?$Z3X|cST5Hw?PrVJ4xbx?12Vs|FEa zK|D(Tlrrlg=7EWcH2~MRxGYLOpdb~qYie+{o^Nc=*fg!2 zsh2uozo{gsZ{_z|EnG{wo1w_Ab^2!1O82|%g2S3nk`0hQHl4cIbf5tC|OFbVi_iCqIg#)vN7fma`Chv3el4f9`rV1vV%FPWU|gy>@x}iyfmM|!H`A7zE`H}u| z(+ALcm9EKhQoo4ZA=KJ0UN~cQK;DRy?Lhm+Ehj;&WKmW|1}H^isY#-I-omzAmiH9c zh&-!y4ij6qy1q%;-fgqd0AB8{=pXdhZMK)lNMm&$2?_JTWrZonSv#&S<$VVlp#z~u z#NC#x)^S8R=0`JhfH?;!9htF)U#o%+sTZX}twuCDMJVeXO$9#EO!srl&0;Lhvey6%X zo&k^;>!p~@I|htqB44YqN$+~v?;x)`hL`tD{H?)DIHEOOT_YY{*YAMB3wOXWB=oc$ z-|BjV7>zW$^*E4~G-d;d8mHEPbrO_p*n3kVif*{GrjCCg=76sy%L(m9{NtZ8a;e}+%|f95OC zHP>Hr8$~HzBAggta6S8LE{jCI0?(ShmzB3U&bfWx=k=x^Z0~vP`lwl7y+QRlT?Aa}=dd zDQi3a)}vsYsp@fADGqMz8F8ci`S<1xQ$DF>zJt#j8lceKrQg4iwLcoa0e->&P%)NE zaoOLOV1ZipacW{R}W=_1f0rI2Vtse}=bH05#(*~I((#FA9s0KmH!u4wu*<(WM(P>a)2 zrBps&qCBksE!+>G7_c}pB#t0gzXQPnQ5VWxCjS1f9HdwG$VUyIOk4LD1|q7hd;~L6 z*nKbv4CTP7c?mO~Ig@=6<7R?+D4}^(Y(S3MD9WT=J2>k>E#FyC+A%E7ry|_VQCL?5 z7XBdJN$Etq4EE7TTH_Z*zH5Wy&*2_W5f1)Yzn`jAB=*dol0Yf{p^N228T!y_4vIrc zA}Q%Gt9_5Lkk%K8$qk~j{p?PjrZo7Y6<1-#a08@7dD#qvZ`|Y<=%4t^W`1JvP@22O z$NYU|%sAv`u_B(AWi7Mpch)`Zi6}Q!B$dR==HY6)`29>3WfXnXr%4tuQpCrq%^G#} zVTgDkn0*)ZJQ;D5t8LcV4^0PvkQ&~TtH(2{iEp@#C$pZqwFDr~NpNM%Y2sbp)|N7Q zFNR0RuL7ZhCMsmSa|1oM)8)}Gtf49evO})5ra(8~^h`~|b}~U$Ve$Xr>MWz83fpk4 zNJ*!3BQkV%NOuiLcMjcM(%nM~NDLv;4T6NUh;$6y-HpiEerug|zVG~lKdc4p+56qk zbKTd?%e?)Dm1vfUwYd`^4xLWm4db{~fJZoh(#eY!i)3=xSq1S?KSiuH8(^Va_8*WL}d&x(tm0Lj}wADQ+1 z{Cw#Oq=++R0o?oZr+~e^6>#r@yQrbl6s>GmyHaaO#!T_skDH7 zB{kR6PHzO4KX@@_>f$H z4Pjf5z<1Vil!>laH8U>9%v4apI07~ot?k2 zwckK4T0b;-fp)tbhyq6Ix_qK4Y}%QQv&qgr@S1l0)N}gse+E7rEKW@3cJn+$`9!n2 z>J#YYZ&{@_NAgrp2?&Bsswu25a@7d+#g2CsH_ zrRxC6`iGAS`1DAnSV>US(Qj9FuveiV`N6Q5&l(augg7Phb;%h>`q}bdx^c?Pk?G9p z)sR+7@kmPiUk|fZ@pjo@ASX6fG{%3;NRHoX;K_C5S@RXkAS~s^6KIYJ<&u?4urd%x zOu#YMp|!&ScG-tyaA<4?zKXv6q9f60Dj@DTN)0`>mShtaFj`J{|1b1oL>5yPP++ZT zgwHt>x6LdYoy|3{tqZ#wfn7a zLSvNkzLYy;LQ$q7zDUbdF|FQFmMe63PDSy1MWC{#JdR+ZOy|lEPZds=D&BNE3V1UB zB8E8Wy}6dX%o&>YD;^$@%@%eR7rNpEWGPHD$m62HPOCql|29EHBrlbkOA#AI65cLF z%j5MPDS;ImG4~s3R-utq42EA(?W$k-gkPU~Kp@yRt_?E7)Nb?{^;*mU<43j8 zt7NbtVFlHoHa^=NBHZx|`gwL*i^(%z+&9FdZlraJtLeV^@IT%|_|}TQ>e0bhz+0rL zX@T3e^N2Q@3Pi|~1p02gSltj_ZlVHvn9*hL)d65}+3@GurmNdvg;}nz0~LZ{Sl+zJcR1++JDSzLF<91 z(X@%GU1zknOYSIBQv;k^Ho-TnB2QP|VY_^BWd(n+E-xGYeXDD-y0sofwH0{!Bp6Nr z2$J#xZ+xMCDE6Mi`ZK(bT>d7NlD1H0SC+BfXmi?APVq%o1XqWcS4)Bhru56!O=c4= z!v3U^YjpF~b0nj?VTY)s)t{^AYs6TF%c_IJrxR4sMNp}pN5?N#ygL)dgZDvQf5%Q; zZ}VEterT?4^#C<(DN$5w?j`}L$H%1h_PI;`x5x6JyQR$hjq$%5+<e@x ztGhi0yI#i)^+xN!@KN*X9@rvv6LYYPngb^vzs_G1#bJkC0k;uWETaQ>2xdt2sAgRa z6eU*ibKsGo=(3o4d?fm0-}@F8=2@|;oRh1!w0(vUQ|R*XE2$jR9Tj^SDVV&0i#?7m z9jx2+E462~3|nRoR{T-6@(A%Vh490vzHzze_@JYI$1E8_=wC;mX)wP=-pJxRKU)4N z_J_=UKM9ab!@`PAi3)povR37FrK$-JYV~eI+XtHTvGd|fxKCGwXORf@zCh`UzC#|r z2;gVxE9Q%m4Y){Tut(=gEU9ofa(F46C&7%}(wn3tpO!RMR)M3o7m`iHNJLhxDFFJ3R|rKLTi-){J8#Y2*A-cNMO#Z+5JPZz{Lv>@yZ$IIL{V!vikLgtF3M>Dta7y6+b zunOgh-lDOlK28B0(HS;e{q%0-$3NNDpsH`+r$fl6n?*6B3K5a;2UWc<)m2FqBU9IPvT@^&o#$E0T}r2)|*aO$w7 zpw|(=YEqgzdF6O8^er7V(xjF$5R-uZ^T@y0nd1<*InY;80UAYPidk5Gy2Bmc{X@?f z-=P0n5DgEzQU;tE12a=-NzITpn( zk5FL1d^-bsiv;^hznSIdOM=2uIJ`(&D8j^A;J_47gOuM~%Q`GMyz#4|lQyr0^@GVM zP$uA&j3At`K<$$>yc^k}UcK!rknRRVBpA}h&K`sBcE26h%{2fh__;+CaGIda9p(__ z?J0~9WEt)CVmWEw)OPxQEdbz04h&&9E=NPO*vrBE71O5gn#RUd1_lPI^=C6*@#Ltn ziF0~9@~d`+7P&iuTK+5d*P2q!yBNujx?-_$N|!p;YrX6r9m zJ2$p57P%_pb%j~@TimJca6GHsI&M8uz`o=3HC0T6w1bVB$0=eif*=$u>)wVoUej~@ z$U-z@Ag81_kr}--rp}EDFsFPiOh9^yYk&Gfm3NvkcmL(PaqgztXe+qZtMMmep1!LX z(&n6;VV0jLO5Qbr?`;`dK2PG^k^UP@qjNM(H@-(n5#B+;oi0f+@>j8pPe;JT37lvv zipHti+<6zy^Z1!>fBmO-(G=xGOjqm>GOi4M#N4l^zFB5ha+jyw(B_}`OG zy{n_KyvuOU(Ds|1F0SiDVQQVeRUp_f!HQ42vqxPNtrOuI8(p>>XBj&_)BOlQ+6+d< z@_U~9lAgfRzgX(Qqo@Y4sD|xfn4r}W<99^N3FfX1v61v~jUv%Gug@!Bew=UeFv9bm z2s}_-{P&RVfG&CNPiG4oZFc)Zw9rXq90$^YQUVOdtYwc0WOLY^eN7o#5YxSGhmRd7 z1-m}FA#FC0*g5LD_fU>+>gE`f4gfyy-eGj$LG-(j1RzDaF9Qw72k}B3*b*G|0OaeS z$y%L`S%%4qn_qYsIKu<+T*`noFX$=oeb3SnBBVf)ZH&z1mIF|p0(Tys+hup*42n36 zYoijJZ|k1euW}4j$pM3E)bEk)lMbiXL#k=in)eKTUI0_qe{cK3x=i+5G%fP9%irnM z&+DfgIjZ=-HzEZHT#@;>vvzj?s@-oaSvvE`Xk{*QaM3QOg&;x0f+Av{X!obq@UiD>uQE5*m z;!>b6c=ttTWwqrv*Z3JVf7fi#ZoCV4;=34O+sG~M|2MutFF^cl%bBdN^fa!eg{5P2 ztn!62+rwE$r!nfg!9l_64cm)*)sjBZ+m+!X6Vn{1V@E% zD~km$(-&`JV^dR7hGH?)Vw367wq{(z)PKr@-kSN5;YySJsA65$9TUeh3!$gq;rTU_ z`Mu2!kjgjB?$PE&0&AJOzh?tgUhsZTQQ&jfX7~mMRX|}>7NPw$2N?yVV3jyNbXlhfBN~5l*X=@*AyV)Nw9&gHnZW^8MVv+^w)|XOu9lK6uQ>pFr zKpt(5DGR(vpU@*GkxN#y5Bk;~Y|fO(QN$@-JYnwX$gN963G|Me>~;kB<^g< zqS(VQj}Li@vS`KNLjs)xoOvqoCh#G-bMu4(rKs|$%QAMA9eIeyWvOF`;5y_5=!Vk! z(+fQRnxqh}{sGZDF~JhH_KXosT`Ku-&$B~1A+c}TR<}*Ov^3C1q zr8&3Pnnguc%c?{Govmcn(2-)3Y7^MT+6%!}VPG({z08cYj(8FjLlE0w!{)N<7$?v9 z&HSPHYNq-s;pE=n^Kgk{ES=t_NJ>5AQGL#qKtg&xdG3qjYel`d9F%RoX~QvC?3%g; z_rhR7>2X*kQnjX@BED^bRIT zU!wKjTZHO&#*_SsX5hQ)#}xuWK3hnU5JAeTfF=J{aZ3NAgn(0&aSnbs&6|~{Uj>JD zY2&*dsMQ$RLeZgvFsgA^T;U?5gE!*gbzIs%7W z|C0pW-N4(|e@(Mna&qc0$l1Im{caq|q~#oWkvzwf19`nOuW?W00xjVxCwJ$Co^Jdb zX5z>GbMOEB4x;bn9i47Kjv|xWO@2xe7U>yd2P_M&o`FYdL}90CeffuLR-|3n)t3*% zCoNC$2Fv6<;1_^31j4&qN&BY;`TTwe#xl@YdXf{!Xhrs+dRFD?MEcj#D*z__H?EEd zNQ{XAdjwR@$bwXg7ija`)b%%;MVZotfT3U^bYLZdF&VrefYnvQ2>5o1*)bjbMXAH7 zb5$&0lMZ}ll^Coh>T{qH3MG~HB>S1V?mE+s*JPMuhJ|Ud_&_#!;-j6x@3WrE!u{M! zt0`O3syFwIh=qb}W{GW%cR$-6DWAuDssqG2oaO5N=kD5y>oXi(@g%F*pTwCWGoV`Z zdc`*4y*(j4?;_cydqcn#w)g-*DCq#ZoPWOU>1levMW$J%dRd_sm=O#JeNXatakF^% z&!K`6BnfN%TyKu2H%Yoi<%=zfg4z>T$&5KLE6B(>VNInA5DoGLljS^|>_(}E1#6%* z(R4Wv5N1{yB4JKVSy(nuYz8@-of|ukpEOq(!L295hRY695S+g!Uo2t}B|2)ZR3CT9 zPCA_tvN)0<)KoYQOh)dx=VDIM4am>lC?A(a?W!oYT~XRM;%J89;O&=~7f4|Tk7;Xi zW*n=k5CyesweguN+K<7uKLCvd@fm2!s);w(Y_ot^DmLQ2qHFg&P&^jgG0R(m>%faL zY+qE8L#b@N{zD+J^Jh=82Ankwxps0TEPfG5$3h-{%K3O=LFBge`C*>Ort_aW zG#5++!2bN(5A#pN;vS@aF`vvfTDO1D1fBJ1YJIt`eteQB679x)kIGo;eV~R0lvo%| z?X&^<|B-bmVQ2aMwd`UYCwLvui(miJ^pg${lBrBs#JwL~JwyN5_4$A!QQD;MB3w3avv%7@(?jb%^6|)BrvTX{v?LQf+$f zUcXngr*<^*+i^f>ky%##9*s$*)zfgDNy^Z<1xPJ{yF2HyJY9j?2w*$>_t&c!o(MT^ zoNa`!bYIsrS@V>4?p)C{NA_F4YSxdGKiKb?PPNNotdNq)V(ylwnqhK`hrwAT#*Pb+ zYsK5~qK-GSo|;$HsC1a8u8)eJR{{bb1ktXF3+1%X|4G_FjZFPEy7zi0uraYF>ux7qQr zc7nj6MWtl=vpX71`$+?hV3Xm@v=L*e83XpcJ?h8rl;K*EZvUN%TPs6i@AQ0P!s!f0 z!|58(L4!&n+15w)+|4td2JDVsBmiAAbJwl)?IW|=BsBE5%l`aHVizOpmM?J-B4in@ z4g_@bphi98DSBRW0Z#x%J90?TKaJ9Y4fmj}?2W~lLLtK7CICKfujuk3BXB|iwCc+Y zfWk1sT**gE<{DVY2dx9Xww^AEp~UzVU#DJENE%uEr3WG12OzKNG%ivmSm)MFq;z60 zA!YDL%fq827r*MQy1Uj7yx6@TxV$Hfisb+Hbyns`f3idgzjcOdHY-LE@DD9>Sa4Ly zqS>sIhOxysVTqP33qB%_yECzk!S z%2rlR2Fq2SQber|PNY7oP<&rb+G|%k>cHj{u+sm2BXwISbZvM8&?$XKUOzt!d#JR3 z9^Bv9ros0(tr90Wq!T%L*elv*dQS;K9BKM&?0f=%mrH2HiiOa~C9#;8c$h5`{FdVq zs+R4)(NKA|Q=A4U*MN-V_6SRsNmY)1YBNQgK+GW^iQWfmcos zI}S2<>Rxpst9tBJm1v3h#>G#`LND|VA zH0oVn>MWM`@)hQ+3tujvu-0Tcb`)8_Y<9GO$2#yuoK`X-yfxAkUFjdElHq z*|Q%3HZHA^DZ935JIpUL$Pv9wbF?lN6^Vbe)0ABaegk_{Ju)mzy@y`S-&X`o#Ffbm z=3l(FX|q3OeQDxV!8Uehm`{kF?I?*w8qX&urY-5B~Qz|Gx1JC;mg}%f;0u3 zY|S+h|Y+0M6P^*XU}5KH2RyqS|v;2qAg4cJpMfH@@SUQ`iy@p>42#u1Tyq zO!*0rpK>9!qkEbugwH3jMe0(y8XehS8qZz3Ubk~>HPd@rj0hbAR%VcDe!D!NZ>(o! z7*Lw%^7k5*j%LDC!DjowW1*L(?WJq($adO5VmS@BPeR)rP6`jd$LzG}Tyy zo=l)NBCtsD*jBv{nIv7k6k^|yDEYX@SroDPT7dx;PgV`Z3%&B}WUmwo2+<*3J#9UX z{diE%f*w3HR2L>&p@j+_FeKxA8y<~u8#YgLZ_n-)QkIx#e)$ z4gsE_(HU3SBdh+%NN?H5my$4(v9UMrqMTBO5wr0~*|nQ}C~qJSFEv^~=!Jj;z(veV zOy8^{X>jZvAPk)a~@=c`trk0Zz zYQ-1kv-A@#pQuMUNcfE?5$ID_iZTtT$?*7yCVy83*{8Nx^j%^y;^~n_q$hMyG8*fC z<&+o(T`2b0V|Awcq1yT5@hniBt6b@bI$`&hd}VSxP(u|Os4gF)?xvI72xjOkndRI? z@S-f{{i0NAx}>`kZFFl*cs#c53p17D(YbByoPQd_ivG6Z3X%GHJ%M!O_5HUI7g8Z= z;9zG5+fS3H2aa2FakmT{|CK(;>_4WM#sEdPSL7WStc6Qj8(KHLza&DqrT*}<88NoMX$ekmsLkDG&UfaJ=Q zLzAB1cU8W$Qr(~KbqJ$P$1jp#(swnl+oW? zy^3Hw5Fy!j+bG6qpVL>j34@HR;zY8f+6X>R0I<8{tIU|iGf`~EF#5CnIqCfy$>Msj z@m1*Yt7z3Lt=muKdlBMXTCdeZ&Nb~7M*VH$rLDidVhW?;xQUH#&39RTDl-#?91TwS z&0lU`>Or-q?Z)hBORJ}U@)n9(EMxU5cw-cd@aL~R(Mpb}Xr@`TDH8Y= z24Ek1SATf>r+Xe#IDWH7jI2}zN&Vy5E80rzb-YvpeOn700)+KPc?AN@#bq&Bhw$)R z)R?XlRA?fn=#iAni0ydQQ;LJXH_TuzI){G(991*RTZ?yN;&*kY214^9Trx zexFnA8nxy0S(rlh-RolK_h{&Q#c|1ZXozQF*Arw&gzvh%_RL@C1vj;$CTS>6-I(n# zO~H(@!z+&1SZjd#tVD|jtq`U3k3h9EN)8k;0x;KzU}ky;H{M0g%ziU=H~u$ z3-o`q4sCm)kUzI|{^!H?Xt~>LQPv>|-Gx0J-GO?CDL_5oEre4yw{ zTZK+mfi@@b?24ZwNyUE+-2pX24^FGuk7-tLYFP!U1JSTc>dPJGg+w0KF4xQB4$xqsTxkQrlbdkni1vm3!yU}UPycB z#F3KB(h~9bxOQcr)Wd$1^(E|3IQ-DBV|JpIv}9^vt*NdqaAx<6kjIb;hhcKK{yZ#N z7Br=dnF7*$#r#2~W5&Fp8pw*PPb71cjiS+5S`r||xuL(gNw%%Dnq2#kE0%u;rhY@~HnDo2O z!k7nY>U^Qc;zTlrKC$1Neb(#Wm>6zdY_Ns89m3yf0V zeLcCx-8b(B?rV<6DxVQ{96ovb?NgF$p=`}R8NFXdq>+eU2SkjWj?^YT}bXq6*VCkmO8|MTa+M`Gv3Lw; zjaorkjPxBdVXzOsOuog}bQ9v^q)M&lBpipGKg#gCt^`soJn1j{s&U<-dl?gT9BHfz z5iQc5%G;r;IuWi#oKIkHojQQ zSF?-0V$_LiCX&YSVFRO;{D#nj5!ruehy^aFl)o&`qWO@UX-%U{N=0Kin9I+FRl$gq zay~g5d4h)kqAz^s1x=I#1stmf#3*vW!2H&F#~+xt{Ak@VC!|qcR`G5hlY-GiOlXjR z@I!>;n^hg4Pouj;3JM00qfG%mFtJwsZfqp?X0<1 zP(OSz^j^?~cRNmpdPvf6S{6}8Kp`;5>-UPEddn3&qx$cX-wK9*w8l1DgfwOovmZmq zZvAvf*|ZQn=cJwQyKJi6Y0R6fc)DtYZIfS6NL%N0AxY}STO&#KRbV!p@`y;Zkw_cu zsg5OaG!gx73Jyoq$+83e!4?9^O3`+vg;uB0vaGC>aHda)5s@B8fEkV{*H@~&Zg6G! z5W}O@X`7u7eg%;pHBAWKKwpQ~#v2)f@VBRhPlDW;J8rF4FLA*%kHZAVV|jHIYe6%? zPW_2(9~6rlqvA&ie#*(MEGQJ~k$%0Q)EgYk5Ua$Lfw7|0U?VEt zL%I02OLrbK*Z*c?$R+)9y}u9wLdf?KwqVug-Lma%Ucj|#+hVkMoR^5zVPKQhj^(yMZg7zTN=^#H08qZ$$&^ zACXP(n-WgwL5YCP9Lw`Qgl$R$r5^&YB?+^LRL3~kDcJAgq$^KTC&v=`?#==RwoW#{!IGQ2E7H5Q1 zRcIe7D-(pp>6*d^m< zH*+XgEItdNwxoN)#Vyd;ToE;E*w1nb>$3O_oy3QSc;pZ&*z1e1#ymMWlmh$W*UY@- zHO{}6^!t7#d}bXaP|Tbp{?;o`?^uL$)XR9CAzLWO>13yh5f)^NXy1f9H6^TO3fGp7 zH2m7F-6y^05lx2!Hb>dgB7VYM#qJa3m~KdZBct?@&tmrDZ?tiDi)-6nPa51wv`=H3 z6I!By(TSYw^zf8*${G9#+}x<-_tBF~wo*BAfj?+P{0FH+_b4_MYKkCfCpXKFpJgW% z(wiG*O?Qcz=lPL_68{JfvYNXMe-?u#{&KWCg#5`Dlcc3r6~V}d-wA}eDlNlKyEac! zD$-{8_R0#BC26a$&N)6QQv_C0M|?h+kooTFVR<0UiaFT=l@JI&(xdVpCNQAVkp5xJ z6>%taYY?`R^~)2`i38d#RsH&~SpewJoo<}Wi9}DFW=VwX$RSz?x~ure8x{G#eo zaPcn{i;?JX1Wv9P^;oYC!fE&c&dWl!Sdyql3#9P$-e$*G%#d1wK*ejBT3AFQdBC_8 zA5vRX*G~n%nYEAIog?hOBCbgNthc(c(LYKq-pqXil$D+R z8NQrwKMm5nrx4=lb07a_n0>QT7XPPNg<)#dfB0G?U|ggO3!a%ivbIw{KO)yLz-cwu zMB2f(!7-QjaZNwAdM4yH?&aLUM^U@8E)sYFv{w_Yf>#gTj4BR>AySh~4^9}NHdWWrmL#?_Rf@kv5A;d=YIQ99>)t%JoDZbtvDs&Q{d>hOd} z#VeNP=^KJf{x1Q~({IDA%oZZUxny-MAPo-iZ!9QHI^l>~yH*B}<%&z{@bg|Q3=azI z;F#n*0;356X=Iay58cZpSWpJXteWAnAMc%44-?2fJnqB3UTRhH5|hDAg!00|aY6&c zl$s07hRx(+zk@6MIX!|_Z9NoW%br>n&c*1(#u|rf1)fdMRbSkk zrjuyY;gh{8p&&b+b#+6+Nwp(;qsZ|+j>(Qq_YQE~!OOXQuMjgnR(#vT(Ukm*s|8;J z$rM+)81?(8xA0%# zQ_7m=ZfEXwI%3)Sns=90> zYbdFiP+yHJMZv^Akno$zfiFBj`8*L?;E1++pP_uK_NJAfdAsa94iD6WDq(_OhnAfE z2a`x6+m0+Rff}?w`e{TNaF%|jq$y2&a>4rdmB$y$r+;zau0CsjI~4TZpblRQQ*Fj# zxJO}c-jk9g5#@^y|M-D8#eJ!Z$M#83s(51UM)>qS+OVIB=504#G31@h^&fPgGzQoy z6bA*a?p^^sfuP*}2oj)DV0N};XnQgRKRkM-2%V0%Pu}#S`LNmfZ}O@PCHU0NUn1>e>tHu-;_X7Z*k%P|#|2^j}sUGO0Y(gZbLh&ogGspSC(9aP7f zJCi`V>UV=cr-!06@GTk12=}$npZeY0v$sZy61txaQO}w_8#*=^+a@c*>L^g)UKk{F ztY1G5#A9Lp>@C5=txwCBLo5gx`b^p-Fo>CEN~K+$4BwNVxJ#({?i zh{~s5hK!u7f-v6W1k`8p5NsW{kX+{`SXF#M_uwc)w=>rdh_$u>+8IAk%R&MZN~9Cnjb6^K#6zfhtDhTOc*!ysBZj*a6!0$yE*NyDoVPhhL`=b&>~<7# zTV?k9YR&D#Z!pkaxF1&bKz5O<;rI^!EsU2@IkpD}tdDAQ_Ape!qRsYclRNlHP(8Ng z`x7T%V7&b5?4${21JVWe0g35DBrJ>)Vl@;pZC;sMZOI^-7Y5(i0zyH%BAGdO8g=^+%R6S z8{(fRm!b%iFaeR)f1D9e%rPK~{-0bbyD@#9Du72uq&452+~#lhPwm#SD!5vPqfoVH z0&z02r~PsFjUO6LZQG1M7VJ;INl?b%$^){<-1gz>9pCBQ!k|3T_&cy-e(*Yv_`}2{ zAW|O~0IWn~HFUWOfU*5-VLT`s_(3ao19G^MXMj{T7bq5>fmvDx?R`RZM@u}ROly9Zzno~Avn z6q}DPKsL$2jHMM#yp<|1CmGU4)!hug=|?mlBByARrr-e*tpwRPW*t6(00`F6Uuj24 z#s6N*QA?okd;ZW8?`wU*GRkKw)QI(sVKe_?Kwy)(VDykMLxgDcQoVfblLVW8)oaZ) ziM@MUj4s>|0uoc@5eoE>Mn?yD&ug~>C8Zo_V1~3QhPV(<5w8F1nZolAw}G#t@-w%M zLz(!9p5n#U1&y$IQX@8I#_lE7WM#OP84O~F=sz-r;crX`@ zTeD`JqUNB3I3(yott)}X%G6OS4MpI8htmz@g%v>n%}@+G#DDWHeBPTP4kt}d*BKEp z*3nz0Ji5EJQTw}48+5WY-P0-idl*=STeH@y3bw<1#v{;Na)Kb~QukFsm=FIxk3KOb z{^7adc2^^Vd@lRl9rxw-ah;r{>X0RFE;_E}7IAOxT=AdFt9Yj} zvReorQ-gOu4*QHR9p^0D@BBTnxix;7ed$g4q4Ij`N5^cW$`pPe`~wrOq4+3x>SkNu zM{$}=#ku8iBnNfn4hj3^N^}Ar88~25zeK=$3q#@(G<4ii6eiGvum>K09%*J5iXOc zw3()1Cd50=w&I7t@9k`jA%3H^?&D6@<9|5EWYanyZV9B*boEa`@P z&iR(UZ2-}*o368J{`kvLO7A_|*SA5Sxa+hCCo_^|4djJiq}uQHMLSZFhn7XG?SZ z^0#*|a5~I&>Pj@H8ONsj3mQz!U%OzwxxBcg>i0&%8#DQ{z~8z(OLlG)^V;CgeZgN6 zrfI-J=el`(S~xk4IPzPS{P!ix$))ih)vB3L=i@D9%y7<6uA-%A7DtQkQ#Ynu$pNJ< zAn)O}c_R?C!7~N-uG(XUm4Hj+Q)p#k2|)k8C?Y$xGq=N$p2JoPk&wI2I|}~iL6dl_ zev4M3Jb9LNmy=ljDxQI+G?j<(yy9nbpPVAfplfoz{d4+pqb7sb*~H)T1qH>4%j_rb zV_eX#8&m%(N=l7I)3kLa>9yabF@7V?t?t$>yADIN{-i)|`#*9h7C~_n%tDsLHNZN5p>h`TFb+vd(ro zfsG7vZcZ7p-6)~CXBR9>9XxsH@y-9#E>Fm z=h{}?9^$?;`4~x>ToE#14JV`aI**$fG|cS`Ge7wT$49TosHpOGUazCY{;TG^aK+2V z=lk1*b}M|UKWm~dfLDj0n|aM8_i=v#Pq)aZu15~4zh_UD4aYWhr|&;w0Jvb_>G#~z zpxwtm_j6r63vIsDT{}$Go#%dERAhcjmG~x_GM;XzINOxAE8iV(@;T>}0LTj0*W0fM!P%91-V~c5>87l7)g)PS&pMbmDcL(rLVZMz(bQ;vzyzAmD>;?b(D;6w)Kg}C4LDpc&1IvufMHB z>Po>gdmqh+rxZ%S_aN1dRc$d0Dv~F`ztkU&8KVR%dZcOSA9mS#t}Th1Z$herqMh5+ zqxQX{KaK2Yzcy=&E}tRG6#BDx%`=6zL!<_4)Er>!^?Xig=yT6lgJ>%241PoZ_@6zl>2@>L#DC}txjp9 z)peJdn}&>;hw&IhDd08V#Dp&d2si?X_{W;fvbx3Bzhs_ZKK|>1FGAmE->k~w?4j!t z;Br-WyC0F3H}MdyXMk3=&y0E?SSyAcM+F}z;g|D9A$OwIkn--|>LFlGIbxq!Ge{A#0PG$w*$7h4#s_lKvNjBi>uzP#E(M=F65 z#37a7{Mn02s`gbboKM?>`?&gG#WwHsba zgnibo(@-2kt``XLiZ$eZotaSMUNrmC0;6j;Icc{0Go+yv5~zfkAKg@Pbg(=YX`ShO;mVGZ0c%K5%IMY`;xr|MX0QAE9S;lWu<&F#5fw!8(d1*iR&vtZLFvy*tXIf&RZubMN=Vq0^L%QKOGyvvc4<|l#uK;v;+jRw^ z3a;ft#p1s4ifz49Y9eDsRCh0ay;yPm-A*j6UKLzreD_!53<=${uMU>}Lu-lQ?f)Jt zHkN#Ja5Ou0$A^dR1`B3Mi=ir`?;M20=@21d920{RFI5~dWFt^V zgH~E(OkFKiNc6=7jv9e9LW^X~n&fY-(8u1fG?OI|MZqzjPmv(WZ!pehw^w z=U3{FQh$7U8fCkVn9T{Rp(s=zYVaH-0J=*1ky&^UM^zZ-^m*Rw{$_F*rJbOuWnr_1+Q|C>+%0ar zR|37I6JP5nzngMS$YOkBYJGu`!eqQC7^RcE_E z3#Oe%!259B)ynIMVsx61ynE(GTrxMf@V4Zb&EQ()<0fyh8&@%|*ED+=EH&DP3IvB8 zFB9pCy|bK9Y39E>3#%0f^_q0vU@*`sHWSFTxsL~N-6N=2n5aCSY8=)ky=*UUF@?KG z@4QyW^%pV{R5Zr@&;(f7L%6kmBM~ zo7&oD+vNMcM8v?vY_NrU1=L8_>6$t?5X{}$&KQ)JH1B`Zklu$a_i{)Xcon$_Xz)!R zvi|(3SN+Y6C=u!~&oK~#-++M$pLQ(-1B#Y|Cgd4A%wo*Pn`1zipKmc$iup;zHMOqJ zthAJYF|!g}u?@Fp|kZfKCQ z``qx&4w26tN|MVs%1NK6c49E=VbP^CJ`An-fY08rvVD_(z^@?f_$E95_6QoS`2P;{ zz?tZJGZj~pi2XRylgImcuc6|iapJRz2a}GO7V&)vt81ez&p4!K(7U8ciZBz(rHfD= z$nyO;X`~uL_*l$?N_e^breT`_Jm00fRg#cvYw=Z6%@zl_@qMf7K~MTJ{lr@e@sS9R zR7ke*Lh6ldF;r1C2F)-z^%HP5Lq@j>nSQzOHHkBl8kIA0&zbCcvlT0`@mIcV-z+{@ z-=a|hkempWtEY@waSQ;wb#melcgKV(zs{IbKxQy&hs47AL0A7v@~G8>zFe6X5&(_O z@tg(lD+JElA>DP!RT3r-`!HHjq??r=iN=>M==vskb2TZkJ^rFn^EQeKa0;BT)wl0D zADQ}dH*N6APTN(4s3^xCWz?PAIDdDOX>DLkIL#jIo@Ib|WLv1OFJkNR#LpH-crk!o zKTKCHJJ++D7#ad=w?3@3gbVp7!3YM`ez}h3wM^n**<>JYzhU9WNPsmU&RCUXO8AL^ zg=W1EZT=5cZxt118*J-_gam>+jk^=vHAt}F5D4zxxCIaHjk^VxK;!Oi!L5Pd1b27N z_wTdM8Ef5f0XK~C)mv3_)_g2Cb7P}$iEy5fGMrhGA_g3(D>P(8a)8w2S_0V2CIR|j zxEi)+P_DR~EGPsAskz{IQrYNNIgrLmu55`ahOurT1Xx0QCEkk{B5G5JVQ>g&_c#(4 zePvsyT4*>-N*gk&WNwbGu;&c}h26fZaFrZ)O+b9UK_|BY=3_o+MG|inI??m5#G1!= z7cAl1Wmr^oUo%p^fE9_?to4?%wiYE^EJX0^%44_b8%Td+s&coT zoES{=wjDjS;;!MHUHe~92@-jTg=RKg`1=w_vEL*3=l-1}<|k6MwQ`H{;tKpJ1tJTm z+Ky5+O04FQ<7Ij*4%Sn^f8J@RKn_Owrh_j|{d~O;EEY^bTZ29bXQHvts7i9!Wh z7W~hb+W(I1k){q4yu>vY<9mlVCPgA$x27ks=AR^oGgHsvxy$T<013C~%9h=;-&&cF z^?D;eG>6DxIt*e*ca|>!w+IpcpD#`d@=Mn*RrsnkM!l9-{KxEHq%6R=Z)94aB$6h=*Tyzz z(DCxNqD`p?rcjj{H9>Su^Rj(E*zC5&^A|FdATBb>R7q<7`zgS$! z_-7aIqu7}jxZn2r4_`++<`zxzWq!BZFuzoPCswOnRLvIYp!-)h?$0EBkK@P0A{Bep z3yMHvuHR{lcX!kCE}R2W6cK0_;#cLvrX)iR75%pLQ$UtSM8B?qRv01qOGFkQM2-y*V22Y;>HFh)UCO1YKQaemF+H%I`v+M< zjrE#X5K;UCe29b;nM1$?=R+1?lHTyV(X^T(Qc#FI_Lze2Yu3wG|pXFw*0=eS5(=H}xZ z9I8E_z}@Dfzt!RHgnsAKYEM6Q*nBCJ>`D>~SfTI~F=IKu_yk9Ha&5Q&>Mm#>6W^BE zd}E4=a4{0Ny}Nmz9i)b98L}?ZJ3GK2@)$hv2H>#*2JylTix3Sl!k(qUY=j_HaE^C zfgZEe*5yLc2Hge5y}`$p>Hd8>e%IXaly6%IL`JqVsl$1++!}gV*-re^TV!G&TFsCv z<#cUqXb7XW*11j_nA01nf(;LMP@e`W{aE&W0AA&AxTDBxbBxpGwpF4kfE^eZl)68% z5czX;g;QI5*#zk=7P)?t78R2iZ(SdPr2W@z&^9y6pvRSlsNv)@;?NyI!*P42_M1v;;h?X6{N;WIv9r~85;PNPi2H;Z!>TduN|BW$cO|F*%lo>nd&*_jt>mf-EPAyd&pA16VHp~29VN|45Zb=jkGzb&7 zo?w9niAn`YLp3#AGl*w9x5E+SP&EQ+$|C=mj%chtaXwc-NVh<@lx|vn_gLF5IHWmU z%!KNjB%LhT7wM(2N#92?gf#3GO$M{)Y?7(>w#I@^cW&gX`I3o9?9FNj!?Ql%6{$R! zi*MHNIf3ur#K#dg+ec1R%)ea8T99RhVn@x>iyw6?ejReHYy8vfx?P4LTPaVi!svE- z1p30k(#V8m5-hJmcEctX)@K{qjESu#5Dp8AyQR5KHuoIb7_rKcUM)$urq+?tCG^h& zf<_(-32%=lIMUsJ964Z<#6_!u%ts?oABhuH|1fheaviAwtqi33kES;L#J@hLu5tFz zeWQ#`C7ZxRl8GS*y}#mP?38*WT+809yHk5^K2%qFTRa9e9WCQHvlw~qy<-8`H;PPsE+&O{n1HMDapo^6Dfz;3E+-k!3)bLWt%+{%-w`6@Wc615krppcbI9|f zJDZ3IjzK{8uU@I*z%{+rX4sq1^0(xF^l zNKKvkM%O>V#cEqBh)I4z##o+k--g*aotz;`M-4);y5vcwc6okumov@c`Pd&`_*}Gn zoYZ6Yr5_dV3Da}Udr%3+WG^}j68&?dy4=Yjs_G>0rku(s4D_MOAAgm4-IS!7Mojw* z?qwdX&MsvkpkV1q`ZbEb8wyH1P-IR2UqysrKEU9Ou{DjcMS|);y!rqPhkHp3)3DCi zxWrGgx4&m#N=N_^v7n1xL?)w0N$xR_NAWT=?Ad7wT|0kyKS?SD*GN#r$N^JITDVi z6M;s{D+z+1Rp<)IlNhg_LUP=W+2xn@WEga8p-j>ptY!#7LYvOo29$vyG3*K)McNoq zt`I!5dUKiX8Stkdc^r6&?0PzYMAbSiHD8P7+3Bp8q6_g?vF5SW^FyRK0|YYot*u^W zp3g*x;u2DfBcFn)hX|T%?tdf}$Y@@{y(}OG7N7I-0_n^n?YR zG+JJ)5zW~piir@B6vr^jQ_{KB)+JYdFiu!FC29G)X)I0gB};sXR=00nV=`gWmFYu^ z%<=bo1nw@I?IhK+N<|HqghwB}XDIA5dA>@j=(ThBM^T;#DBfmZkSsDu)*}lZq{vv= zNJMW7D>4TkrJd3LnBREV0Y{RUuprOj5rz8fltomx)xRd!OrYoEjD6-zPeHMGUzrWY zVjR1wisV^u4KOcpB@&{H3r-gzS-7tW#fu_O>pgL7bj_uT zuh7J=2J&}*e*kaSgwISaSq3*i66?iQps2IIBew}YkZ@pP&H=Klt@3Ae9oqTe{lwB< z5se{J9JxhTL)$7f+IKDxFYd=ZlE$Md^ksebSxG`uGCdn5_dQBC82V(e>WGx>w)Es@ zksPx@h}DJ1Xc%t>Pqcm84ey^%PG|M`x;}FNrrDhq_jn?PH1D6Rlh2J=)v5eqF4jbj zXZWN0ikWDw(eHBCiUG{bb{p;n^q-kqv5xS?j2P)ZJ*ny#((1#feuzit|MiLIi-rRaK^~wvgaBR1;<*CU9M9dP6LqrC8Tx5BLXtz$^H%Zpf{|Y$@ zjr{>VctGl_tnjS-6{*JATSZOoIrC5!3_Ttldxjvy1jNFVdTYUo25KmmJU)tAe{5Vi zb$PDyB)aWFHcRBxqup8>z3WNQRf}D;jcSgX>a&B&%^;G>%c}_X~Pf*{P7^ln8bG?RZ zuv_`l*mi}|sy7eb*xqQcu zb;d%KACqzuG3D`A==<|4o*hfq`P_~t#y@fJvrk{IY^tVBO{uOOqF}V}Lq18A)T(P6 zVpx8f)K>WjuZFo6~}jb^fE=;w(ONC zL)^t9M;k9Y5{6@mAK&Pe2x(!Hy~@CNyAQKW?wcy+UZQ8C3@?mOn1)c4nc-l*cl4nq z8I}AqlYZhjSTOQAO)^v-ZK`XzbQ&wKK)A8`Qm0Q**+k8@{u*w;CE-uIv(AWzkaNwj ztsuv21_c6-r;uYoe|?6}YPxN;(U3*ny2B6sDHK$}0pU70X{2%H(4(}g5^nKyvDCc@ z%z!kru~`SaiKIW8wuGPIX0_8Z5w6XDs`5Cw2X~mP?7Jn3b2L_ue`)M68MFfjW)+l% zfvaiDwMJHrHc@urn|RRge2H#2FW|P!m!RuWJ7+4cLpYKBmbLTKi&?#kaQh zF-UtW+r-{YXrV*#=rMaJxcf2xaEM* z%1i(M7PAv8XOzD*bhK(q_k!C*PGfIr=$Mr4KPOgUGM8dF_2RLgCU-_Uusy_3;5j`ye5vK9~Dl4 z|BoFed-r^~^O>pbe8A|So={2TnwW@3zQ$xwV_BmST40F>CAxzTn?XOCXMv zGFmKB@uI*>G;ElF;fv&?Oi;r@Dm2l^@v%uG^9UyTnVMU~Mf$R-U1rFENew4=witbi zLahy9>0HNH7I_M)gA<+qn9kS3v^pc{B+&WWhb!cckPSqEnaBH0dzUZIW>Y|0iZY1i zL_S77%gdIT2u4WN?&aJmvgybN=`F%cX=CLVSu-89OfF3Cc4fZr_^$c4fhlzU!vwBw zEq|{rO`j`?u5^u;c#XOZ4F|)gChLS4p4ezg?aHN0S>i@b`w_z^ileZO{iISg{Pr!y zye|a_#5Hfim8((9a4%=w?v^Y?9xcI#dB7Q^!k**<&j%WHgERqG%owWb82Wa5V$$j4 zQZE#7#HdM|L|JM#mY}zvG+~C6YWNh5zK?9GREabtTkaWqH+?DrdM#|{ZAm#K%xzYM<*YmOg;OHwLN zm)zD>&irM%8>6W1q=4M0UrPblW{CCONy=Bp{=fD`M4rYi_9XQ;K;1IPctjzEMc-FM z>cVcE5tC>dj zY!@z92$@bd8Jt-6NX8g371Gt@=&brvv>)Cf0JN%c;Gb`R?Nehiak^YyzPqu}W_`;= z7SC*e963yc5vCj~pR#mlR)HbD?!hv^7c_#Uu2nHC(<`GftsXB&UlOcnOeR%%?18zE z#*FYm39&(GXED)v_?`tqW!3QZ|A-K)0^acp2BIT3?T_=!kA+>Ml^xv)N}XLDqi#;4 z3JbJ3qK`eJLibmZAQM=P$2+o?Q#-|+v@OB4NA_H#;az9%2NS@Pe0PaJmZwp%(ZoX5 zbgRf?_uayO^8dAW{olcb4}s+)yK8k=-1sBGOh@I`_i9_~Y`!GD)}jP{3)R}lcN8QA zTbq24=X1s*bbV>6VN6+k}D=>suz0MYlW}(N%>_ z`ACw{@%M@no%G3H-w$fZdYcl%)MqoHvf{RYb*FU7G5S!sbQbfic15hWNZ>qespj@0 zsZj}{1Q0JPW~BgHa*@6F#xvmpj9Cjwe9%BD0K1+5o~KghK~=yA!MV`ND4GgxZhnuq zlLAI1DJ+>g0DOe7gg-_@Jv~@nH%IFLZcAXnz>izoW@l$dMb2?1df~zkzBBZ&<*&<@ zD|odn4rmeAJob#BEeB2__u&Ysnd#d~9S^7h&u>(bc)+mF^%`48i|?WBH*(OH z2Pb`xf84&e?tVFXtqqs^O0TMkHDFhOk+Y4f11ThN$R&VtkL)=8gJKCw-Yw43ykCwwBBgo5&~(02ki{x>g1dCwB% zFwspe@Ubxcs%Syl!#?yu@K|@L`B+A}xr`;Ksx%;&rdEzX z>=WB;z)Rok237I*@4Ds-(6K0#PG=SLBs_T>9t`HJfl)N*D*;aim|1>Z-~>sJ&jmL4 zzWm!hNP9%t)`|y*#$P{!CB7Z~QHh;u@`HKVy4(9{L2x_XR*!Si$}*X$qg@RAuc59Dt#)atuPd)}lde+>FL`Q5mM z6zPCMm;IxbrZFd?wijyNpE}2a* zC&ZJ!2wP@w)bdN)U#uUhfX|2r@BNlmx8y3_p&2$ma8n*egCr0QPi6X zF5_q*xZZ^BZh*IQ?0Uff$Wq(>b3{zm_Nos!Am>>!!_<`clbJcN2E$daT>02G2j)xh z1^EQ*dPZh)t0nTDKU5+!%S*I>W&zbBVEF+x~vxV z4F<4w!M6RL!(9)8=nwSHTQ9%9Ky=@f*3%AQD-HnxdD^XnVN)Pw(AcG5Xxa()XLU6u zwBz8S&-~!}gXrU;8j$gQCVirGQf)TMwV?0A@8x#7j{dU#+xzrUbcZwNp3T?X*0bfc z=J$_>Z54f1);NakgoG}`L#lelZzrp58Sm6Gw7xS}?q@$&={tE=z-zEBPNB;&{Qa7` zQw=!U)JFha&$P)>Epn+xSRRrD7#5;Te{IwK&QM+sIBH?~Q7Rn5lSaGry4*_Er|9=< zlxlg`_xQO>%i?j|L(iVHxf#PREr-j&VTi&yn3 zW)>AS@-?J{*Xkp{CD&%xB>Zkywtafn-1yzTc=b^7Hoca?PVnDBUFqfg?U$)9ercOF zt5#_bdd|5wagH>Qqwk$PPNa^EG8AD$v|e5&@>o{;0+bv^UiIt)q~2nZ$M6b;j+?b? z;?zMA-BoqEfQy1bN;+g&Qp+@lNeb6zp?xMb$u@dFHMHIc`k|GUWmj4{n+^aK*D$F~ zSQnOjN^Z7USQ)O}H$KS21l9QuzvYqu4TETr0=E8L8sMwON*?p#a3ya1(*lhxNql^c zmGp<}^%$}+YI=HbJ74Xg)H)*r3Os$DeC&ipS|;(A z#aLZHDO$)P z&LMR5Oy+!a$B^xJ{*CmmYem;<4o=_aSRvczg@$<0Xz=FKU(ZWdAi1sMzT&jFPyPRz zy8q9s&myo|->0r?3VZQ;q#_DK{Mpb;DcguuI1sVI{(Iw3nwIyP#mSLSjK~A%_V1-W zAX}YT_`Re&?Nq*wcou+PZHzlra8PNME(U6lj0AlD3~Z~5N+Z4#(OID&^Rvhz3_;z+ zKZ^g%pisM5pbYYExi_Xj48YAKZ|uy(5d z_FXt1#Ux+c)+CIc)C7wz=E$K$-*4qx+smrX{n7%dDZraQo|cJ$Kkd6CRX>RWlVM-mtwpfg%%~LUWg2x3nr@hrmtVWd zrUJ3TJO$>8Ds-kjDqjxx8s$Bdl!s&zdHyWScG;`~^hLYGePh_*k13jRO)DPT5$&~G zhGaRw#z!cPBoAWa6-4gp+otZhMoh|$jr)_G)@x|Pf*UG_<18`Td;Wdd{1J0?Im)Z zHpP|+)fA_yas_vZhD}sV^g3U%r1jR{$6IkVws@kgY(4jj{Cv@Tf)GFVMa zTYUXQkeJgwOH}I(n*@UiUjwsc*^BK~)SIj+$F2Nc%fkPB=deb1qK=d=GTnW5XJr#T z+HY#P#lC8(mKDmP@w``YYfTOrxZoHZMboq;J#M+#tBJlkK(Iym^j()#q276~0{zFnlMDiHLLqkPXDV=LM;pF9Y50{Spp9}s@)E}ByYFTuht&0A1 zou;ieD18R7JqEr7^ugEXwI^vn=~TM-ZSX|wcb#<#cjk}&ceL|i;Wfl$P_fGOaHMDa znZh!KW$$DLG=m#WnU_E5_)z_QwVn)3&&xBx+)}9&${uD;9>q@od_(+Lj$VRKQ^nx) z_i|f?#hg+6zd*rkr{;KX9_IrT$d=2OJrq>j`=?#e?g_sa(eqt{SGS9M&wwzwLdu-S zqd^RDHg^8;qa&>@0WXv@zznLTt-bSbc>2aVDz&o)4R|mao7cgya~3!6b1p zhmw_~6Z0FATI*j^D;5(jkQFjUSXsb+cI6Ag?xo9}dJAntgN{bW&e?`-dl&PIKUc6> zLMODReW*{@ksOFKR_*zAwR^C-mFM>xwjH5aqZ+(-Zb}2|gS^fU8 zre+9^w%@je-nO5j!Jj={R-R>r`VNWS4|a~-!K!GQ=I`VMwHo>my0|l-@asv@78ePM~a01vQNKwFUM~DYrdo_5ZK^71TKc+|mogEV+ohk0&~Y zrA02pF7AmD47>t~pqDaRY7#o2lY>~m0OLktktdY#Rhq|;6I`LV#W^`D4NTOv@R zK+)HLRZpDnyS=6z_Lr_=i02K37o#__htBMVEO^!CU2*ZPt6og#KDW{U!~B^)d-rT8 zhRo#kMVQIA;B>J)3jlY%dph@fyxha?W~%IvYSt}W1fMS*+SjO-;)F=p8?OAnVDIQai@X=k*NP4A5XifZvL2* zI{#6|YTt`OhKke-;yWh@{ufOG#j#8?&#k-n`>S|l27>(cFNnXpn`F{{elXq|U@x1K z!jj#S^EzlDMAStXVG4Zx`C{YxjT-Zpjgmc=w z6fzysEO&QOUD`?E){*Xm2xm{~8A;}SD((G(oMYtSkyiOUoZ~o$>(#tDGJ3zo`ufpA zF=u1E6>xBL16DB;w9b3l*UQ&Szt2tlq#k!FXu8!gz$xFw89M34Y&iDQL8ULGVwvZ1 zgsJiprsOxiEAprkA|3LvH}+KMijC}HQut`GK3drd2n}aQAESLe%6Sn6dZN^|N72_X zU6#RUUj0Cv0MB;PxnUe&4RCR6?-vtIM0bCn**WaB>WtiR>UahF*m0Q^dVjq3fcsUx z0y7COvn1??Iop84^%ZW^KWVL!Ps+%Ih=!MEv;)W{+ik0e$C1Uz4De7Bz8XXX+U4U= z@0rzNmUy4O!^-&pHM8E;bGMcj{kD2gJt_+HXC8V7oBR&9McGPdd=2#1UoK`h47E3* zt3usCc(GK&K zuyjq!&{;2Ix}hjs_X2GFqK^aae0L8Sf1MX>^=^qsPgdWJXA3{Nq0#+M+nt}p8I+P9l`pZPju9F$ED|TcWKgNvevOn^+Ue1jx5jokc_!aeqgrQFv`f-`&e=2Qmi^PU%P^CTYY#2q)};Q7G)*v;Z{EP zZP~rtzLl(8L^{g{L~%6y;CwyRygTxhI-%l6O!%}z*68`~Wup=v*M;VX@74CuFSIi% zHWt^8wcQj z8f9Mf3_=F*N{UT`>Gv`wDJPc79IFk1s_!$p%?!Qb3MwNlLLPPgOt!}f=K;|@We6V_ zz&K;3!&0^%;UG9igtw`Bc3Em`?OU{Rm@PLqyV=W%k8c3=Vd+S>5uHABa7mCXO{4Y_ z-R}qvXe2%MDmy3QdIyJ0y|cZa7<>=ieWM>q?=Zv>Inq#G&)1$w2Z8l`7p@mv(^JKOk_o9wtb1Clv3IC|u`Z+$d z>0+0C>Qxtui;FL^8%=cVb~kK5!uB`|%F`{K0XM*^eUvm&OB8{Z5Zo(uKcSAY#Sark zGSO1t3^GZYLyzC~5i3D0X1oz@{L97nwgFuNy5%YcW7wDDPTkDv9^=)QpdBGR%g=er z1U4h_t!rMuL*fQNGBx$9@hRXn^*d5L+r^kH&vPG7jg9|?Gz&YtuBZc3e$%xlw8MB! zkU#N%?qZ)%`&&a&52B+E@EPXr^>&9fOi;8#EpeAx5O&v-0pT@E$!C-54=eNAD!(-| zKx-aFW^McP`Y-2|O5b}Q_vUETb)25m|FcV0ALP;>F~doLNm9K;TY%(V{JX58m2G%^ z>K`nXjh#7}((xO_3`#k~ZU+rEP3|@~JUdw3gKqhU3e<}EpJy?VQF4Xju)Thz&Yeg6 z2|;7^p&Q$byXh2>{&4K#uCCcx_zYfq$-~&(T*}UColf~uQyW(l)TFy;gGXWjKZ~k{ z&8J%BXpL3Dy@hR3r_JNDkCh}v-C;vnmyVqRrtyt`|IXXYgk zz#B0!F+oW};yOSr;8GDL8e6RWih}x&mHw@5iOa@@+hK*0Yqjcqy*8YLM4(NC9y6@x zVCp4M=D_Jn;%G?SQ2`GQ0?*#%4-ypK5{6rP?6&r?tVn2K6-Nv@L<7vQ999)eFW*3W zvvtw)tO-+uxP?zOkH4H1i!0|DDXe=n(WoUo)VO%Xf~7)6OOneA$Q=gapq^-OuMpmvKMg2(LnH+Bu^7h+LDh913RR)ENj^n zbC?=_+}gv)>p0N4JW_;Bqn4zZwT6ce-#ZDTjvCmS${U#OAN11ZYILyEOKlXxXAi=l$8~F$M%|-W$`G7?@AOR&q1QoUQrY3Gd_$4| znqlYX)%N#f)R}o7o3JD}K;kl_)H@8*u11<)l`TH7KV)N(fIc~9i$9=3hqv7G7d6tl zxSSZnJ9`$8Q#Sb_;s|Q+RABh-T^d&+u4Uo(awfvu?Ri@?B9`YZo_>$bh*8$BFR$~T zGC*WR07(97fFW^O)2Y`K=E8tAwYs}N z=UsvIQ%V;IFyQ8k*CDlJ)&@GP)N5X@y=)%>o*6jci|hx^_t_^p&o~zJyts85z&mLc z2J6*1qQm%|XN%uRp0usb;Ke}&Y$}dU{!<^KlX|n~lgM>5HVX!a(=)Gl8+?uoT^%O1 zDZQvZL`DCd5^#E8{6egNhi%fqL@?exMI$j4>a$Y1v48@{ckx#-E7Je#m!D>}_;IPz z^I|;wB0bx8G8fGn4L?G55n0w6k>3=GC*!9yfp2-l3mr&Odgh}+*to!PtpJKc&_>sb zUK1ox15S#7Wx4&+bTJKhGx3KeF)WaMpn*G`95I~g8a@C#AZ?`pFx?Pw3NNWsBl?N8 z50N8`Bd7=#7G8R)tCY=M>ReP#<~|m3AtRdsVI{H=qcE-fI#+9?DT&!DK*=-V=sSoM znG&w%oZtH)TIH1%b@Og&t4V1|8ci2>F%JU^6LWdRr|*_`FAPU!N2KMpjKeDFsB)Um zvRSq0E*&NY4i60ri&;WF%C{hc$Io@m5ivF%yTOiG9x>f*$2@8q zUPp?05RY5!i!A5te}RE(P{){0`7BB#w(GKDAVyuQ!zM6+BVRK}dE`eMKYo>KU;gwY z$}TafZ+^Fz`>ryhq|MlHFrN0lY5DJH9fmo~{oS|5|NO&YFIZUg^TBm)d|gF#^CW%h ziAeI$NIsJAd&4hW-}T^&4z9L)@i{)> zyfFe%m+q!V(+;FUajNBP^nLzu0~hr7>!BwSR&d5ZC>p#G)~5o6x{#`gD?SoaCPaSV zuSB006TF|c&?ifH`R(*__)@0sT0WlKy+~!8xcWz8Fx{4nw`=7Md!St_J8YI4 zEmtWV^6CV7!hE73c_R@W1*Cjj0eFz#`+xI+uTt5;o4rfeDc}&g)IWf_^&3*TCo#`H z`&ObGA70L(21RSZsMP3t( z(vZ~`HC1ggD#g$bsTR8%k{0O$_9xVXkgWeM1w;L==n+`f27!^3;tiCqDkl)ZV0YB- zYVO-G!&i05eS;`Cqbd=?KprF`%Cul{CjT(C*Dq)>cQ|GK+tQ)~g^oeg7Y%{+} zyQI2yxL`Phn+OEa7k(cPE(_A!VfmR#c(!$|O74#Nu|RQ_RhzLBF)pF`RI{iyO)3~^ zvI+9WI3A06p*a7QOi%*+z_RZqD1B5v-*B7@j;kBHTN&l0%}Y)$!Ec(C^Rm(~ZbGgO=lWJ&CH^~?M#uBTN;!T?%^gi#>GGPLj?Vo3Qc!;K{*GMmVF{lHk@s`XclBw^*Amez&;GeB|H(z&!Tp>C(?-?O& z`w+fk+Ug_!_xZStb&AfTjxI40u2?}+evXM1F2n*P=^907dXhdc53HYoI06KNlHLER z8wqu*r;68+i$aNafXv*_hJ4;U>+P-1>N@keKE~{(3r*661o4g=^8BVVRe?Nb2m5#n z;BjRr(?BF?=){M=ZNic44lQ{@Ey?Q2gmP*0qyv_^417Xl4*zI#I7i{AJVN_hiq<9a z-)kcsd?GrI<2yB*Xv#L?gd~MqV!>tnGjOVnIX;lkrmI zl~#>b7tG?U!?`cFq=oh3l2hg3K35)G4eGNRVWu%P49}Z*!WmrI)i46;pJB+vaCXlW@ z79tJ$lHewe7=9=KFZT1)1B9X~lU{+RDkro+W%)kYlExD)^2U34j}#qq?hUed@K($5 zF6;4-ULg+jkUU6u343(Qi&Q(*$MylApw$iRRs7|D6cb>vh5JJ~ytH0m!q&FbZ8j0& z`xxfUQbJu--H4Sg^ry`%H!O z;ROB8Qu6zCPxc?w$&qf!ak|I+RRL9EE59qsatUTPwvRJzEPZIpP1EhM9FA15gdVgk ztJkC9Em-b?+urgJ%3&Wn#5Tv31ny;Ks2`y6-hCnMM`!|ejLO`|V@82koa8y;w5JNMGR_#u6ly1p)FW~(KC zF3dehZM#y?mLq!qw%MXDC{&(o$NrxE3!2@%7qUqrP?5Fo$h?n@PpNc2GObTgmu`39LQFB{~caCmJ_F(XE;DXW*pDg>+0BQa8tByA%S+CrqXqdl)$$sO36j}MjwtcNH<-~n zbyV!>{zlEY&1RuW6-N0ffXy4lLt`(K3CuP3fy@MDg2di&j5a4&E->JfP0NW-pwg02 zqA-_W;wvPpf>Wi=D{S|B2IJk$KBi!-u=E+Q_ui*i@P$%rAsvjxlDoi!PtHc>%^~zX4in|a-syu z+49(7m!gKKV=6h+V$^{+pCcj4_ojopQtsuE^-G~O?cqZ&`94dIBrMB~2*>}lprNVO zUE5buq<3csKOTlHv~<6Vzp3o>4MPxlg5#05m!IFCbO;oIMJ7cPQ%BBu|JvF zGzr7x@Ip`d(u*BFOa@O$N|c2K8kLthX}gaKbURdSlUynRt#(ON@s$?CjR{SuX;9b;{sG7`;DQgEn-o( zfXSb6qyRUJH%TgTH^(P?hO>Cs)Z4E0`U4(*@{jvD-gx?2!IQQuntbdF*Jg%P#%5jq zC2STeLXPl0w>*d>`yOb-qFG-$J-r`C!5QD z_j;?Imohc9ENgxQjVo?c_HB--2xQ)26W%-d;MF?+)7LXPVxb>lN$_Q1#0SAF%8yZqN1{OwCEAYL#=N(K7cLjQl)FC2V`dsM1GP8j5l zuuxp5wYOwjvM})mr({+U->Qlbcsk&^I()o<$U@ScL%(zKoTs}`kDEn&KF153ocr0q zJJFY8KSCLK0u!b1QMS)WY(3qG7z0J;z!k_mfz)=FvK&omX?*QMPxcNjq;B7F6Y-r1 ziEHlEO`ZL2TiV{XMWXcth~(Kq*~pT_=0n$p%X=Oi&9Kg*d$iuh-9eA~B}4CPd9K}H z@0TZ=PuGF5XyO7u35}NsMKeJG;*QdWhd=6j?k5GAaC|P|YFzauNsF3@%OB)-+UEPu zMe28ICtmpDDcnME8cqwmBs8`OG=P$Duo_p+XUgX zcNapp0f_t*@Dmd`>q-Vb5u5;L$4iD`O8au;f;cpJm;Z-b$b^B%WtW!=7MG0}sO(aX zAiusy)e0koVzFFF#NMXPWj>9Nlo1$@f6XBc;nx7{@O%v$4rEJGYgqw>yQm0l>KjVTm zCvu?w8zcd${APSIMeR&i7#PdLZCTSGcoXABMjI{@2a(7un=mBFG?LaHXppDn=V!rq zzD2i8*d2%$S6#yKmm2g+r&&#$$DA@<+WO@qKvHhPb3%pE3#D&1CC<|eWrWnR4gBh5 zbNVo93dy6;*{yaVZ{b}M!2JeeR~qI6dlB&GZava%oyZK%ok&n`4Y*)v$zkRtXq&w4 z<<1aJE`$4e9b2(QQ0FfvY?@2xaOp6g zDbL#gWyi}K6yOwSAPMNZunXVf)YWa2DTokgV$cUNar1(&t?I?K#k%%sdOH|m{uOm& z@;s+to;w#wtcf=S%E}j`N93DRD!vt>FGvSyV`@o^d9 z0>Xhg2nrFuxPzVc@I%{V24q<`{{lsGden*;sfD}lFiehRq zekJuiZ0z`4`n?LC?=0Bh1^z$(Vc$6cP~&dbZuRZjuLbHfz{@S+Yxh~K=YYt;-dQyS zgVDRMdN5J-(wum#d8MWjTP%#*CZ{F>S_x6-pY2(AB3?znBz+xhs$W>^`CRnR6XOeN z6!L-#j%!%tE3q9{sZQuWg ztFsJ>E84boLI~~>9D=(`aDq#465QS0-CctRcL+4W8h3YhcXxs|@^;RBuj-!n59uz7 z>b=&QYtAvg@jPgRiv;}nn;A*st&8U@W?)jj|8LViZ$EJ*T*zCpyc#5ryIQugvmcv- zwbzczq<$#3d+{Iez2oL{JIkFiw?D)7^4RN3eK;2t+HEHI)90dH7$MaxMYVuwew4r9 zacTT9m~tt3o*w|(F)$`KU9`7ME?@3zNdh{L*PjZ0$2|b5Oet@hVB^{9yzM~#yyL=_ z*ypbUunJ8X{5@i$IeeZMb^|l7j1GYK&RByA=T`V^POr0tmO$aHmvwo#~ zCLG|kE)3e?R;r4MP>wpJKvsJ0QIm?mn(rbnOys_;5S^evvG&T(q0p3+K*^}bT=?W3 zr+`wxschA`W&HRYPD}gIS28B*TLhxCKm)#NIl8MLT5Qh|yV>KK-#si%kv(BpULJDu7?NQx9ztlRLJn5 z2h*c>iYfc&M2(Ku{omNHD~Lh|6@P~IztO`5H&~jWbUb6JDcInpE&tIhPaFaHoP(!; zffTy3B3&hjD@FNNQne-Hnp{8|g4y zQedCupyK%aSwf|OX;TPSC?=wdqq4naUdVwAn=+dg7kBK4wFYYvxbQ07F`ODn1D+a( zL&oY89b@QC{QYUIc_n_ngS|F-3~A&pCvQaOamfXfj&q^f$uDZWBeGvsAWpb7d2qR0 zoE(p|5Rm%L!D=TYg<}Ib^pNl81l$Q{5nN4ECL}(mt&EA$#x+KbXb|;^`o&f=k{Lec z0*vO_4>9N{jEw3P7HlD`l^r{6r{&*S`W0!g;E+aBw32Fw-F!DiAKC{*bP|Ztx5rUm zF>V#nf=OFkZB0&6Vs>kmC}bQV^K#a|vUkA?vGF5jOHD?#S$|mGK?D6x{|~7bd8*}G z|M<)A7aSfACC>+3hzLlHI4~X_2F_tg?RDaG`06J;(8yB9^qt>IEz3Uqgd-!h=e4G* zN1Z8(0xwFIFmX7z&Ia5~l_MHm7K-NP%?E~1afk>veXKlK@~Lvt$+RNjfMGODm-T}j zYT~&15syoo{toRc?va9F^N;y^LF_hv&tlNI&~b-c*>rAs?(+t*&v%pcuXQq8s&)GU zw8H7%F5dPeTc3_e`}-xieLPcMAorVQ-hhk-5iyFUsBt^;1&-FD{+IWQ)y8H$pY4{< zeOnIDEbrZg9@#?xFoMAA$%tTu65s!tYPQF{p#UU?PVDw$5?T$%-uiX>u`71Fp(lU# z52r8z0Iu&IVov9TvHRbtfr6)Wn_z>M@igT~5z>i2&%@M@=WZlhZhrS2_Q$j7rCHmH z)tG>4G!7^#wr_GExWFwAh@IsY=nE5cMuqFTJJWjHrS^+>yYhSXy9y$C4gLo-yoyjd zZ@H-KRsG*O+yt_|q5(b;Sx{>5p)E<4e5~@Ww2_JjDUt+Tq5Zs^tne2em%~XdfOa*M z`gT~pdehDatGgpb?ZCU32*yz3gaY}2#o?6)~E)lIx9R!}#{i+Yp z>P!thUc5m%CN32t9E8_A-4HRmX_L}@ZaQq~w0FP#fC zT#^SVjFTcK&v_hn1JB4^pDS%vxr$PBmn0`Rr{D@otJj-sE_|{e#Swqa?uA7UbX!!@ zc_CH1S(Nk3j^bsz7=iuuIe#n)St0~KS#tdz`V0>?&8y@i8}l!&5leSQS5~&Q6w{Z? zE1*F-YGjz>+pjM|pQebtl2K8y=~LoW{5Gicv$X1=eQ2>rOyaIE=Bx84W|kAdn8g9R zv{Zm<{u{q|uxQC^g-u>ch9}33-E}CuU-$7@h6h6*}Uj9B5Y!PX2)i-nX zS9iel8Q7LA2qnpagGx2ora$MK6Nwg?~JD0+ytw zmi4&T$gvl$XkuIuMdbQ`6#EL(Y_Zx!^qR^!WMS=i*fmBEhu>><7U1obB=C;kd-`W!0HndHHXHh?F)h?kD>i z>r0|W3n#s~98Ap+BvfobvqqXRw#ohT=m_~vz#Ul#6+ebb$n&A3_4!(upjwc1{MzxO zzunv1y$7)V9!cK9{Q7}C#QIEp6R3>5Z_77&Z?#{CgdS}wTkd3ls#T)>4h)-~qqlkS z)~072fdCB2Kki=*PC$R{NPH$q z6W`H>tCWE1{dyC=$L>_psT`yw`W0Zg6K1`;4 z)s}d1jxiczo5~Za7D;J$TA33}AFI6U%ltN83riQxI{Tr=QGk#oHvAF`#W6$yZL*v+?j(to~<4Qyv( z*v~{<6LBChIqN{eI%TJB30OFyv=*RGwzz!(wG%CaM>{S z-VVuXNq;TJzWmG1e7R_(aFx+sLoBQm=!;%U(6Dm~AM?M$1B@ke6J&t-7dX z9QMiY{qyXL?ZpO^@yhW-53>Y}_%WXV0aVse>bu(~k5HGa4>$rC->fQI4TW-^cbTth z2eP;4g2LS2AR8l+g5D&PTMx-lMH~jD?w4H`fDxv9@enS9OYUaD@8yHw-4v?pTD@9P zvP9OO=S$L6WYN|`rWs|%=khN%w_$#RBYy~YUm+L!uMo8c6_4!ZX}}sz9#W9>v(MCL z^B!<#Tf5#ied$*$=Nvq+0Ww>l0CgK2skLW~C0M@A7G4<>J=6-uP+ za6jP1H6t8BB3byyi*UEg84=2j-frkJ3x6S7=TX* zc3*F9MB~#l$!3x&<~-gGJblJk8i*8(j_@c8IE%s)t~E8M9Yk`E;^XT;>P%rIc>2=V zTN=g|>8rKDHxhXP7-<5UFJXw6(QH(73z)_wi}#96DG*s@j(ak>eIpa86);23X8iz2J;Z${rr}`(kcRAQRqp(< zs)W`bhy{7y)sldBMvOagfrTWR7jFi1ild{E@_Ob&YHj~ZEu3ID)=0t7lS^`WBE7ZX z6}SEk^BNW-%w;1q72hE{mF5#&3dpV&PQ+exQ0; zTl&3MXQxCcSY`v&57!-d;5UTC1#+C#|rz8mFXR}&=WBQ6ymZi5UI6v9GiO7b+?}p#~ zenknaX=YyfwcpR{Sj;tlI?%{OTBVK8r8*XcsaaN&0RO!;USQMm@jbFgPzsaY!}I|y z7Gmr5G=06`OjZMFu>RYg*HX0;A26K6zG#C8v_AH08MEP4ww+s|w7Z7m=y@m06b)w! z@BwJ_$ba9Z>hVf(?c4y20G`MY!U=&F2D{c*USYHUeYO z{dz-kFqI=XPA>F>cjbMt3eEyL@Z|plZo_J?(T+*m7eEjBa*x?B=HC+p(0>uCrpzl( zbZhP>{=eFYcbyYmMY{4ed!{eTZ>4*mUS%Zh!Ed81u#Zbp_6sT+Hdpl=aXw~sK4b&; zihE&?MFWL77i0YKW~7L?87yJuTjz1J2qu1)P{wXY_x4vy!4nxO{5 z6#?2GJ1^Vl2y@4$1hF-H?bHDhKY-)#ILGYs=?JdgZl(L;tt;p9<>D=k+2?46zH+L+ zs*d%W!2ry44<+G5&_kgcN@S{Cp3*4W{lk>gvR5X8S=+;G@|Ww)1T~uI7!>Q7idpxG zyOF2AWfoi?B8#3QFY4x@g{7!=*!fzd^3n&vWoOs z(4IJ)r5ex9>Tw{H80aspM{@Jq48r>M5kGJ99M#)@FT|t2zaQW?`(_{IpV=8V4noeG zldUS-39BX)g17Fp{+NyI#}H;{h`Hm*6kwjVu!$P1N-Ro~!iR*N4_d3CA}x2mMxilc zcQkBxp2VCkR?oG=T8)L4!N0C=y!^=axfB0{lL|N!56)X`&EDGAaE%(z>IpQ|)kP58 zHz4ah)jQN>3k23{&FO&j?tOp1#A2%jdB>|&&R#Nb8PT=7%tKxK*0%l`4qGHXTKe6; zP?3K&c9r>gb9SVKXKNlxj_d0T2gxDnhh_fsLuq@3`4F8cv0FfYCUEofW#TN zE~kmM-uAYZ2f*wUix&D>k^i-q9Y}Pr8nQTL%qYRbudz59Pr@m)9sEf`EYe($+j3Yc zux(uHK2xx37k(^XL3aE&4-EmH>Z|Kh+E~@!#*rbF7tySBmdM7nebgwcKoA?t_lNed zi-v|zL~{X%f$@$-p$q2d(40BVp***qQ*El3@wedpS0p(9Mld+PwJ zKh)vHRwJ5~gZ>ACe9Fley*}?TV7A*SR@}E#)p)FV7Is@PcZiUYQb+Ex))ann^RtXv zXZh(#{ToFqgD!@3}#NCi1yoQPDC9v^s{;17GY^3NDfBq@|~d~@lWjsNy- z$twm&Tb_wNi3`b$QidP}pR~XuET==;Xe4|@`$xi!O^zr}>IF%K{Rn_&CU^g<7}UZX zl*wH7@z=~={D&FA0IpG0EKGuDY_`5eETC{qlFK2Bxcg`Hy=NXV8j8{m37e+L0{PjXqaV~QjH9~ zv1p++Lx7If3VaY6NCe>#DF-qtsi>*K@aYk#1I88?StRJ!y$%?G+yq}BA|&VWZ`f4x zOFah{Z{R$_d+%#Z5yL#i;B@Hnq*Zf>7n8RI{pg*J z_#us(F^!s%fg>TmccY;R>YS%EPr=hL%F1!dn}TB+_VIM6p25WfH60aO;o;LwnRC!$ zU7v1rz>=Q2X*Jkxlf3q9=o`BO$r5fGK77EGglM-$P;<#VZ{v|quMitrA8E-t)b9b+ zF9_%l;1+n?oLaQzK~*kPbC7$5w>hO7X3x7L8ex_1o$zgV>XR?=>oxClwO?=Vv{tjk zr4Fex=d%WnQMIE#FT1$aI9WUPfe{f$b`dpz=odT!A`v)s?cXf?-*cA`FxV`;y$@T% zYpv%?v@1bF=llC9G+2%w7A6OnI#58IdLDc5&)O(QP4kaMoWgBGa|HxT?Pu>Q$!Scs zHZ|ZR_@i+WHi@j}98{&Lu|a2dnjdMieq`nJPtJsCyZEfUh!)J@-^T&W>fdLEGf|c6 z1D?iE8TG@wgyiYtTYt~aL=hs?!Ev`E#`$%zRFRhAGT-Du;#3Sx^`3O9iGR0bdX^$h z?+X=jkpNLwQ>3BMkT?O2355{P?503VElttXw7qAwxB=b7(r?52-~rVRpMP71}w{vXlz3KfOEV7PwT2Urb0s5ZBQC@K$2B; zoIHUx5c*r8gJYFEgu7PDG*5~N{M1%w5!^i7>Uvx42-+9uGF+QHKu>xD^z-4kC=TA@0erR+^6hn|Ehc>YmQ!33n45BCf z4ik}I^p#e49^F`5T7ch;L=!J?5Jt^Qx8I0m84b6~`Ujg@K!RXb=k2=`tx34f#D0u@ z&H!iC1}6}*#)8Cg8<*Jz-(57awJ(a;1PM0F_qwS$&5uLx38AA=QgMl5vu`ApXs8)+ znU?N7i%$7=2CI;fG2z%S$%oqb)z~;$Eu~jSFC*cch;)Pmd1t5IT9{3LV?zUTu^NXU zpN(lvr{lj28C>!@H4KRVb=+LJZrP9)k5g+}Cbzt=E@=0e{y}f@ri#zOfByup-4t<^ z_beWhX&DlkUTc!=qw$lXH`^j_!CoXJNEiWk7(t$qz#G27R-l6iKuj9t&RHsz%>p*Q1GfT{ z-J8^0{r8jBI@;ae%Hxk>cC44potDxL{pt|%>v%q%`(BLULYK&A?agQW>C;y<7|Dj= z`bF@kp|A1Bq=?8Y@poK%$14V1u9*fj&lPLJlpv}nLYLem-nW^K1>0qmPN0zSurc5| zUR5Ls%RNK$MCC9oB8Ox1|F3dRBVR!Ow_qxH|L1)01*`% z{OTayvYD;REHJIHCnG}1)*`x9vI?~(c6E2+(!WTOEZr(AK(<{>F=@&J78+<$LLGSg zl!B%H4l?s7noEv|y%>nIQNStxW`BT!|f$ zsxNNGA_Q{lPG#iW?p?dzIe1=B7I0y_*Do4^Eig6d?P_2ukJcn5`qY`!+;736{5Pv3 z{FebO?}0H@EOoYTHnYzwCRP-^3RTJfmiY8BW30QNtF*Zksd}S2^B7^4sPHxAU&!yZ2T6H51*UK9 zz}gZD$Sw`62(>a$?W7x$A4%8gv~yTt6ovZW!*i7 zlb;Z>Lh|HdfGlJnF)*USXewei3cE#>Vb^>%gHV9Cr{0F3rJWrHAkYC(rBhQ*l0P0} zM}UH_b1!j52c_bu3^{u9^3*~Uce(j)=iZ{^^7e4@vE`kN^s$Gn)Th!$omPmf0i%lHm6=ho*O`P*~cvcwKnfn?0qJ7fiSfwH&Ob2u+YZKEZ(P=&80F5n9$CLMC3b1v%r}U^g&msS2LYvCq`@0 zevbXA`^aI*r4=m0DkvCu>NL1zXjJ`vM6NU}(A1o4dd=62H(#jbR1`N@FpSCbzSQ^( zS+`sV^4>uVzhbq(c{)s*toSQEWP3pY=gKQpHL{f%&Yru*c##A8@x2+7wHT;JxkqBx z96O))zVycc(Gb>|&-}O?$-ku1Wn8w{i82{K5AT6^H>{hyuY62$lwZr8PROdYB5 zV05!Xwvc3Xn|Gl*6sutAdd0Pz6!;(c;{>jd0MrUqGzu9b1Cx{G{^$z+$MpYaY5xz` zH5DN>I_)_6vD!sFZ7H(%p2&Fg+-z3V_|ffbKDtQYMEm5@EdOr z_W8#uBh!Ksh@yWuir@!fQAOk)QT(#zEvPRMFQWlxSnv^ncJj~E-wgsvUPVP)kt3*w z&!o^z+9{?t-Q*>7dzvEp+Ok03AoNmGYvZKE&^1P3>i66r3N~!L66n)P=)i=>pQx?I z!DixA1(yYCR-iqgeU>5(*sMPRS7aUPN@nrj>7Nx-oG}9(n`F2$@-#u@L=gy#c&DD_ zC4$F&uS2h#>V!!yvIGPXczpQ*^#d4y0S1HTVF&!XVCJ;Cpv4H(PyI9jR$YMvQ0cCd z$xkip#s4^)xs8yeGp%ekmdV@^*qJ2iO_wz$^nIj!gQb*1;3hALc^y=9M!wEURq9lx=7W$Huh`->L2%PJN zy~ya)+0?I$LzZ%-trh#l%GCP=4GE&*7C4VYtiC&c7P}iXzAco_x8Yq7H^!ttZJk&? zp*VON#!6JznK-xi_em3MK1>?Y2xIC#)D#taqYS@qZ|L#x$wvaH2AuDT3T~-)@lS)e z-~m8wg(1oEIf<2Cc>+`P%nk8eo9c>l(a}_hdE!?Ah(7HJ213}33k@vHL_o|(+$7=V zDdi!rYJ?AkJIex=n~lIZHv~6n2D&@Xkg$@$ODpfv25V)9z|@I!Ig)=y`l!4@V=Kyc z(%Iyk2c|OT9BLsRK^~%a@@t7G0}#uD2kf&aa{J>zVrmfi$3(4qy~{Qt$$UAl_4fd} zsp;scoXIj~;lCPS?j@H%s0$RNfUk^x@`4ZB5EWH27Dep)pU=D&Adu*wR0Ic9VNmbS zuOf|77HETm>4lgzl2QaO#_=ioGU2pACkTW`JKT45mE;tMi|Iuy!^EOr{KrNyi^LOZ zvMj~5sM8ZL7>No$J8BP%<9yS^E5J01QidUScKpTZkSlS6&X>!pGP)?m=*7GEwIx)N z!%tknz6L(*)8_KIf1-=1OxLA-f@gs^Sd%(uA{z$}Jv68woC*5z8&(APQ_{$-i(YLW z_h<}3{gt;zthEItPf<78Z)D%cVy|%z<^`QL-+_?aIcxOL$UR5oiDV9Z#?Y`RECihF zc?UEgwT1CVf^z(r2`&jq@szbvIcLQORVi&XprPl!-nX<&fq*R{5gFX+|A5s#Q>{ua z=?8FeRr0%r!T33XB#o*Ci6=T1py(L3s;Pvlc0=iRCt~0P=ajGEL$D?@rc=UDS)x>o z)-u#VM@vHa6Xa$ZT2wX#5=I()D3rY=&t57&`;K6c&#nR@mL+{CAp64(18?vK_q*fm zF8NW(XAr<>6Al0K3VfhS{q#wset?LtRUB4>D>rUQ#{U9=uroNY)MXDm4VqLr zkeu=cTkczzb(461ZJA-vSC(2D#k}pmhT-I-o%7`uFh3O$#~B*l^^6+Ei(QQ~;B|k^ zGFs)T`GztX5-;zpSRjcbf>h;1z^LD1h512qgd%ctwYiE-1EQycLnX6SEL(^uP#UL8 zfP}u>POh%S?lT`EC1|xGd9mDL4>{Dv5kZ~)IOOeoLZ)9`89Dq?4AVrIzV3pHOJrKVkT5rj8>7rk=#VsKzD9Mym_+Pu%FJ#))H8ReiACqcWB5?-S zfKicPYTlH&<32EfPb5Ei?K<^jGMivhqA^w)2J~ULqJlYnxT2u-UKi`$UprEkw^Ts# z8v$Da-r@ z^ZJVAOVL_zXn7lMxNzus2CCtVZyU3tYgkMgNa-S;uekbK71!5PsZ(WK70gTrvV5N+ zqyeTYW2T*<$T-UH@`ZxYu%bNn4^oFreFz7-ZUnsF3@J~v;J?ZI_zLH}L7oBjNFF4bs{zB^ykOtCDe*UA=k*? zPJiYK_mht_Ht;8j?i*s&Gw|smu_DRfwrNPWo%N*s&ApIZ-wr>I$8;UCL^vL=0l6m< z)3`IS+$=C;KbaEfmkSDaM8rPVk;@{}%(26? zjIw#1NsB}?Yr(Z`tZOKJg}OfmR{LptD%!oWbrP6(AuO6RaJ*z^hGJ88W0MrH^w!JF zI6%yUDu3vm60{bA#G;v=GeEQCNS2>Ix)s&)$+&C$L87zhzzx5Jdy;Pxlz)N`(N3x( zI?igIv~eN898>Yq4GCWm4`Z7BtRprR-=8aog`Bk*c4*O|jMHqyNV#*axq)#s7`%H{ zALnajM|3BwReTOE`T2pt$Az>2j1Fq6WHldrLNot{#vy9Odfuyw!VE9Mhz9WeG7(ii z4r&K~>99nUXF!B9Ap`$1Zsn>elf=ooLq8(R*0SOFTZ>9s;A8IsF{kA_XY2vy26G|8 z`N{iYOOr^;UQUXPnA~{R8aZR4fe97*`G@fixkX4NR<48~MNCV%am*=A8%c!W@T!jl z7Q2S=*`nlF-+>6`kkGs${buta(xc`^^s=1jmI+UR4)Ai*mzBpcZosj+pwMt}7Ui$0 zVz})lJP=dNpEC4!5R2&fSfiY+W~mi5ImIXSS)9C>E}1vkGD}2Iv}{&rw|ou(kdk}@ zPMwTfbdj1y_4n_Ur5t&3G(o~m%6px!S+WWWpM!mH$}4rDoaJ!whz$=T$?OPuyN6Ut z07~3e)q$>ih~C?F$xLb4e~#NL#5hx%*xaVp;(A@va9Q7NjBiQ*DOT5QTj|5gZpmCx z!f7b80hy$5c;oud&f1~Br*D>%5@7g}K@Ud0e5^W)1*Ztl2tt2g7)UrEA-lx1HW)!! z@Rub4^L@k)0OVtECDeqHJ*4^d6;W23HgBeEPN@K@sb@6#iSyO$qn>KGhn|aleipL*tfYV|m+^D^e+g)q5z!*rtwZ><&popa>=K)n*`J53hpD<-C z4l?U`urp6&ZG($6z9+3%G9;S4En02R~FReSOk>qEHP19dgYkpM!z=G+Nlr7^s(c3wi3XKn1a2{6umQnP6peOi6Yz9K?i0gYCo6U9l(4dCQ*& z-w(}w$|>4P&&bw=fc=;vF##@bvRe#Yr&^Z6iiXyiIT&j=ooZbv4d5C`k4Rj+RnXBZAt-_LccOq z9kf8lbxjlL?-tgH@h`GCFoEnBOcD(9-tM;*t5K0YNlMgW}j$cy+!Dh zeckJPEJGvx$H(hu^pJ|?rimr19L`gxg=H&790>$oe)G>dskvXY#8lYWqrdj^S^Qi? zQbpQp-8{u#WrI&9_NjM8beS-10>97&d-2xHCQY}xZX<~x?BB_&(BYI;E;QCuMJxaE zW*QhC=1q1?-bz5IG*YPi@#Xk?IVb-_kBbf<`2ecceh0$i+t9c63^Nz-@bor55Lruu zBomMWYX1;G>(6e+e0fIQKA~9Doh`s>wmOf9X*?KDDjJIPg;14AVBmN!2Z_Vgd0+mH z@U@dkCF$R9@G3dip#x}7;=@zJoYn~MGFbJ41&Zi7a94~q3F3Frl?$|C>o#!lpUsn8 z5WX3VF3xu@@NJRHu(TQY$P5hDnsq;xxDoXmUnIz*!p@yBz(nl&6MQSZz?Bu8Z8Q- zKYDvv##A$6Vqp4|vorb9!fmWMxZQKzf-Be;6DIE4?f9L{j2j7K&srt(6halu?j|nn zua^xO>Xm5xbsLs++A3i?Lqzi4d=Nj5gs+(0J2;y%|6yj%_1=%e9yuiQ9+Q zC4c*vG+nns+~2vZnQU0*e?S`=CR6dpPO&WMGAVz_d};KZ5Y3SXF>=|%lNGb0rO`*~ zgY8{MxZE}Co2O%p5ilKzpeHKGG%8Of!c{8-&#p(5@@rLneL#j&x4yZ!-Dk0n3ofKT z)NJ&>!*u;ht3*KO_=yv71+Npshp*y{U19sNWHnJZpwl$$Y8z(T-XVdBT#oeJldyeYJjNV(I?{#7ND zdSy~zBudyK^0X^ux2N#1@7;C64eD}51Ka{Z7}{o}e)QH{-+Dk9;tzB8AdlA6V^(}d zr95wn4=P!Ao!Rd#X@%DvaOtI!Slx%?-SjJPb%Wmxd)SBMM3_KtPX47}G%=?qcv#}2 zNMk4wDiIKcDYEHb8W~`&@%ug6wZvAGZ}owL2(p{Un#RCa@rANnj)lr~;=3-l!B<`ElRxSU%W-?` zg%$03jyMUP5frTm5Ku;uHHiDGr~UUNI2yX{sI5E{hr1FSxWw0jX37IoYP!@x$WbmW zrfQ4+bIZ#xbIC4L)C1gJcNo*vo)`Ptp`pV_KV+<}In=c_a>0j>kcMhlKkYC>)`{K+ zsqHnUR5w5vVBlbpoSaO@&b~9+7pTmKtU$}Ja8(a`u{XXF7n*}}y}*r-_Mer>b_yl$ zX_aZNgJ*tX&+}z?`1coUMF{{hYynBcisDMFXjURWXvT_q%zj^-x#Q@3 zd_29BlCl8w*iLvGD~$_)>=%Yj+K_n|5QnHJWnH}hCLyhZ6I12M;x%Uoe|8C)vf>}k z^mM#|8!Y;AAR;!Vx_SyOV_c0++|eVWZx0vG)E}NUAyyjNCIqeVwU$k6$*|r!Z_Kj? z_d0~1@-1D1rv`bqsEQI3=hMO>J3ETH&dc&uj(xKRr5;m|pB^c+ZP#%pV!0Zw&<(y_ z2H&<>mU?qEtARp^HWMA*QFFblN##}!(?(!rXva5#iFs$v%A2er1+NKG5yvkX1wwL@ zN2lxKgfH`~gAc(((Qqr>ysno^{h6aJx7Ol+^)Xv!&NV3EgMqQkDP zOJBXBYpdFL0yIKUwTSi_zye91=IWfiM#>H~N-Ud!Qc|>}{j@p_^P98OgX^;C`xmS) z^XUWxTbluG3=Ea|{BeM5W^vK}VV#rXdokPh{5k7_=bGw1!vN*7_~jBO6OXKKsVP7Z zZ>`$|wAa1-xuzll94c;BhkbJ%5HjR9Ds8ge&yf8 z|De%Z30qttYRFO|?JsYpbg-vXmTQh;&=Cj2blzlx)bwwA>?Tr;* zRAz6|iO#aHq1m-j6;_90g(HLyy57@NuL{$6I9lZz|!!A&s7sFbu6IY}Dr=s0)rw~7^?d{s^ikFR`= z&1giMmXmSoV%F7{Wy0jv+$k=8H+bUA+P32P40}_Zs^#E1x0EwdT9Ucq;-9r$rL7;x zJ<<-@&Q`qSo6Z-76`)}yxx94g1X@A7 zbjmCx5P#KFRx8cyIx^LIc}X^h(ovQo%~PBVCsWcTW865+@afibBaf*@IW`SOB-+_u z&mLXg=)LycpFgbvPX$or^w<`BtSI0j!igUHPst`6*|%GRACh>n|)yL;~~ zVuc1(7W3A(z)W2jaOr6@a^S3>e{m$)7fivQOo#4k2OK>JWQM{<)|e0xyN*>mMjAIp z(kcxVM1uO(iMHAd-5N?H)a0^-jEV|Xyx&RrpF`qqflFkUiHk{)h=ZHFZ@uQiK6bwg z(aCB!sqZiFVs*RrIKZ$4z=qAf4Jw0sga~w!loDzi7~w?nDUCCG!^tKHA%sBSw`phT9{c#{=FoVgCF}`l+Z}|DNkA?Z~904so`;Wt4 zZqNT6Co=IPMAPH_8JAg*rtb!VEVb&Drc#KDW>b~A))QaQ9KQkZsy z-TV&b((22vu}Z->i!>ViPnK;TXoN>NJ!XcNIFW~@o90fw7OaK>}gdc@~m}D@UhLz{kHdnTN&tb z_J{c$`Diz{b}kTm5Gr^ijZg|+CFn`OJ)AK6WGzb|54b!Q-FIZPdAZ(cnEuao;{UF= zeM!kbtRk>RW{OnS?SyZu!F!K&^Ysil^ZpW20a#q3-CXN;5OL{@wO|r!Hs6Ay+_0F- zkt%pv8zj2Me*e4Lip~^f(Wg9STJqn9;y2)Va}bNBk+Y{=ZRm@s$9ca>#c&Y)#7j3-aA zmO)+0lRNRsi@Gu`(4^3aQS^L{f2yku=#t6K>KA?l+I=yI&QrCUwDsD(;Q@Y_EED0_ zlm;jBK530mx1ghE&|J>fAM+*yEriQ7s@am)8T`iCf06a&fw2D$DJq6!mH04VzbasM z4Xm_M9i-Kek=44$uZWk^lQ#Az;`~qjAfg|UR*^+KPrZ~1HFNz_W~HeDzH_W_AVf`J zW+L00#so~E zaBDex@bMb|!rzzTP?Cm;h-J%F9y??@aO{?88ke^)ZhCVtBGifysT zfxz^630T65xL>I4q!Hs;KWP@9u^^g0n8-->Z=WW2tbir$a|KN}przGw=0vFL%AM*K ze$vp6U?^5UPnyC9Vfijt62e9&l*ywT!HW>Q;df}~qIHjx|BM+AO04e3^#dNfWqj*EOgC2Wwg}Qe0XD)#K0u=B_p`kdY~M!o&fZNL5XZe0w}lcpBK{u8Dy)FOKo* z2o_f(7Gl<{(}-66-sLQPwby|y;>bP#!Zz#KznlfBjufcceJQ%$lXrv$wFh zS3Z;w!xioYLw*gySYq?MZQtcG%hBc1B0QCJ#ePYl+E882d$CRu zF7KMRS;*WC5zt0kTq1TVyf(!ARVP!i;$WNxUiOK(^T>OLx$G#l@TiYcge5%D)8&p{ zAicb9|6)EZQNW)=MGCXX?EUNcg={xOM+)`VwxIrW+)0Z%6S^0?x@3CnS2#u| zMn4Ddc8Bge&QZ9N+8eMF6mi7V8y1)}dQ2N!guA4~ed={#Tv|Y^JlXb$e113QR5Eh8 z?08+v-O=*bP^AU$NZij${{w@AE|OtE63M9avgsiuiGBk~1f-FUrMnvuSh~AKTDn;}q@}w- zVriEC-JbJ3&vVWn%2Ks&prImRCqi|rP!SpdweF-)BfLA z6lZs4&7h_Z#)QX!&HC#f^$3OHDE05;$||>IP)Mndk(G{%Gd8##<92a;DPsc!ViR%; zqUqN2%K`JzB1b!S{1j5XzZ27;=c>K~oyVy8C$PTMV=FRU+h}!BY4FRg(b9&do$rP) z*OFj)u*12;0(15F(q)haB~nV*YXLDUi|h;_?AZOe38NBbZ!%>@jUR2%WTeq$!DRTL ze(c|4xP0mEhw*BD^I6K^GJrj$n)B&+}tG6X=0D3m^t5=Ep&& z)445m#+~lE$C@r@aoK9;?6!6akAPo|p+!`rZok}^Vwo!B*8lN6O>#mo-z~3PrXURc zThY-^KzH{Iety-GlXWXG|4g!0zQ`+ENx|$yC%VFE`Haw-t8WXW$QiC56EUC;AqNS~ zTwKm`M`>@!(Nwr)W#8#;x%&C8P7BWXEYTM}8Gl20*Kyd2%S|+xD@kSEB+1JknY$BK zEaHYC_VBTcpG`khZB@KwqXprM`N*Z0Ni4IR>@<<@x8*%-M}3bo37YJ+DIRf0 znZgEi9GQt^yg`S1f9#|hWizBfPi+1wY9iOk0s`fDU)R532aqV&J0uKqG+K%txg;#P zLsx;5#EZ>4C}C)E5MpZVd$p;SQ<%$ity?C`B~_;fopeovFYM-{+_3k|q`IRc-iQFn z$4nmLYLHGDgYJ^rFzSUskZWEsO-y5cN28p-o#24bn8H{gJ^n*DT7(P@{>yPUYi`Q| zFA&yMrpS7c$alRtl>UzPmzBs>eUNTP@+j1Ba!@9W`_P^Qf7pvpS%!(17!-~gyjjpU z_Qin5U*IUKUhD`Y*|Az{goMr99vkylhYv&dPNehxz@}8h%9C9k4{iU1yj|@Qv*hg! zEfP-n2jmP8#F1elUp~n7(J1icD@FV00~A~09(pD&4IgL-XXohbMN21hTz3JIGG=mr zv(Ku(qqlx%$Un9Z!FfK|#woskmdF{ydIglSw4WN2YU zVNoMpcbOLHIrWdDaHxv1P-X2Gbq>VPr%sz}QMjOZI8$HQswu0k-?^U{r+|@$m;q{M zUE}~15;N2{O6TVii}?LHdbg3Q2Sg0Taqz`9g4qNpl?la~!TT}?#^JRI8&^L~exe}` zHbQNFyw1x?XrV+2o92=3CbfPADS3+R~^tzPi+a}GaXuJx$C8+Y+H zjk$KmeXW$tc$}NH+bQxu#P+#SYUYp!VndCBq-Uv9Tnm|6%eV6fwp384}nll(UEBcmsXGZNRyYdFbi@I^WPe*2pDTr7_!nE%x=8Ao}Bmk+taeL$G!VV-Wfcg@hZFV8g+dVf<9Za6u#% zV$F$Cd@vmqNL%@6xh$@6rh{0F-0C%@!6p$QwxBR@E-<~*o7-D7lf+6v>?;7x`~DtP zna)+!p$9d2$S%6t$I%d;cf`EmwNJ!{-GwS%O_NZG(>P(j5l>g93 zDT9n@2Aca)fNdd_fGRk4S-egC#Oud3O$MkJ24S#Z6quW{)z`I+qaeQ=J)~W?KJjTR zsQlm~ON zvS+7VFXVvY;9ecHLL zRfP9=&_cj5aJCdVzsMz$+^o&o#05?H{}U>pI&wF_Gm+N%Gr|AaT-@T58V+J12uoq% zSskGQcU;EpaWs0}QamI;T^&{o3VxNuixNF1*u&;V6Ai%{mAk-gL<*M75l2EaDGD$; zv6LqYh2nt~Ds>`cCPx|5s2v@VyU_6cEwnbUqAb7lk)h^aie*U_es;ytd~fF^*(LRz zBO|XbpUfefF~#2Jd&7p@lCGn#lLwrJv5(?gBBPF9M(*}iwwJqJLg}jNNX~8g&>w~l zz|gYm>}{FWQH8dxRWYcHRQuN_TQyevGvTngfoJXv=Q6^afl9PwwVaaHPXLagzebbl z^2Mk;KW4z`!>&5^#O1L_Qo*dvjNO<0{G-;2imF0k=@$KZKYU-Z`gA^C+-^70A;@0< zWWPBz{mI!^{Fj*IKQluU}i#F z`+~ghMkAwZ3}xkV>oWa{9sLTuZ+BtA8!g>Sq^=1ipOEYQ>YTBTu+^%T*VIf#^%g7qOcuO#+crR`QfA;bVqlTo~6{ck3~E5Gb*R@=C-CAfh1t!lhfTn!EoQ+x6!-^ zu=%OmrNliap@<&#*>XT*hi4F_yavDQuK=YCL#whvw+K!vF1&>HgE$CY#@T}mas5+v zR|L^2B+9r8x)U}>Z#rqv4g_PO%EvXnA3UchDe^m|Zr(Fc*eQz6Wq^{LTX^P!4J?E)#t|i);xi#iK~ci2B}L0xg%KM{UjrKqW|?h+0D_tfM7(wDO zcAbHQvTvEZJyo{z&R}kiS4T%@uS&>XTmeG8?wv3ZaBkb~{P>~kY%K!kmY9r8`O(M8 z$!Xd4_y5YRdMDWItsEq(->0bOJW*jZW`#LEb|-CHzCNs3$x-_hp4`D;B2Po)a*rU6 zQwd`Kp7-*tTd*)xN)Q9*WwgU>HeUq9^(tBh2{%Ute;VRs@DR4>;T>#b-%lt7GniBP zP%Oo-vXDr98mF#6*V%^%Mkd*C#v*jx;N}}Z$drl`lhL$Mlha$0{vL`uE;wF^E6zl} zi&DYu5mEXYkkQjfEM#V>Oy?eV1%&ot2hd#e<)XG$**`69EZ%)=Zss62bl${qEn}%U+xanc+6w%w#P}U5rTIc#e_w8*mKBR{X|;Tn z^pa)RM97aFy=dBkP;Kl5K%?iqaS2);wxHvCL?RUIuEK8ZB=q0N_u?)VK4tnP1iE?0Ji0u|9Zy1m_Ts=$_wCV+oLy<6=tf@got2A6@;j>H+#HlLkW zCON*%9m&q6djI4oB_Y~l7zL4!QybrIrE8L#(ek7e^2APzWi=eqG(1l7g?Disj#$j_ zwKCONJzEe&~PdCP7$gg^W zBVOutx%3`Xug~pBb)h(oL=pzq=It}QrH70_@DHB(APCZ(oIqb^<$o46>#ZgpZgG?B z4Y5!xjBf_3oXQ7P5x;HCtr9fJvr+4C49hn_G|1T)dWK`6X`W`UU`Lad{&T79dJbpG zZit&oRZSj{&1E?bST*})0XD6BdpBp3k`9|}FBcAJIXOGC+Nx)Z6aEQwxxN{IhSS5^ zt%{-Nxp|KF--yQxwys=@y8hoe3_#nh#q|(H?0!ns6SnDbKIY(`s`_*zJKXY%iOI9{ z6Dxt&Ngqj;_ck-&$~b$?2u|`nAXsnP^+BeDHDGq-j%vRHE>hdBN7U%pSm%Av;E#Ed z`Xv_syAY_kjWcN=X26-r&sp@fyPJm=0L*mvw*KGO?2w}$oQC!5(lM?wB~L0Y!6}Dq zcrY5399$(?(m8t%8+Ad0(H7gtR}>Z7C4t&;;cVe+vOhlw)TwGQjP%OM^_aw9&MbZr zDc=P0i~F4PLruw0ktStKT-Ata9oG;_lR>=}n?eU6zfm)@^KpWBf{@6_Ziq8Ml+loH z^k?`$p`cs*y`53%hGM%b*7H;EOxrWVx;h50u44-dmv*k*4DPOT{O<1cYUZmdc?zcY zuD> zVHouPY)wlmGqmq=#e=!&#{_W3VuTiNEDC?)Hy%gF?ED-x-{K>fVaYI0cDq7}Y{JFV~h)T8$ zDLdCVT1qZPWHLu4@i=eTA2ITZ#4XAQym`Ktp9F=bvK1D>LZd(@TSq_javMD>k|e?CU&)PNp-U5ekK%( z=Itu*tomTbqU=8>J_y{yzQ%ma(1PfV56YY}iCxe``;4tej8igUwo%kfBBC>@L(f<< z_Jm7API^JJ$x?ZR(C<5iTth^uU4aCxh-_QjfQYCUc4{odi&Da{k4snG3wt_gAnIg9 z_RP+d`*3WRdME5p#XPrMvrFuUN}4STAGI_F_~Z4ah`RkM$MY?!I-hD);}MJZZlPAe zfvwfO&k=;CR@}PB>teQ;Xwn2a%WEbS zf^>f-5^xB86Y0ZFSz8AD``qg^w5bIMHgiH>{0T;wSGmI=9~k0f3L0d-DoRxIJjv3- zgX0>_Y=02Q8}RtK%`WY!Y2$JiAK5^H%1k1N!xPJKqK!My(Kk0DwRA8V^|YTnmSXUA zd4^dA?e~T@LwtA3V=o$;)+Sh*)_$`+_O!tsszpa~pB9bIb3D4TO$Y6_hUs!GK%i^~ z-)*6KU6!@`|EjF`8~s74I=bk9iu6vZh23`UpZFeS#$GPjmNq{%7S@{Lw}mLC62NXe zx+aumG5+mD&(pBni=n2R4Pa1LC=8Tz*>-tj`UxTHMO3pa$rHBf(0ke5x0&nFe&W9b ziq$_27w!E|zx=;p7e0=v<))aiH=jB-o2w{naF7uLU&x5_#T5}v?NrOU58v0A-=5X+ zzj{Ia^+W|S+sUh=D>Vg^$?;cZM>Z` zLnbCqa$zTKcy3{AuIfE=Ob4)*?s}uUmXrmMtye-tj>+}sAgFav~C7IYT$nnt-<$Oa%KbCuAV>ynzRYB>tv8p@;%xZwX7e~cG zP8m1QR7=LaC}0*$zA0o;9BDW4{)U>r!9G}B`#exTxMYZuWZ{pQF=I9@CHzvZ(a`%# zhV-z>7W-%jwv>BaVo4y~vq|{Jq|msuoQXMv+Tdwhb@+$WF3Y~EIEKf8v>~r0Cb_h) znba9_Bbpy^LyzKQU=JpAT|Sc^niMp;QE^ikk4hLkOMGN83eDDU55tWw=XE)Azeu<8$VR~kkURhAs-`CO7&QGSXu@VT0=#0xxA`pgj4fxcoV1=Q73+T2Iz0s0j~3OZ~Ya7;nFDEPCHL)0o96 zFu!{+76Hp%e*)Cz_5_|EyZnPpn@BeS^~%jR6rPwb6ED~6=VDK)FLe5Y7ybX>FhK$~ zLqO08s_-qd6faivhQCrPQTT zPR~8&8Dn#ea2i;oHHXi_EYu>X3g-W--DAS%WYFb=hLfcLt`##FY(O-KR56X96Fcv6 zeT@+5^tDv_gsgXF{9^^P7JC@7;vp@cH z1~iz|hUnm|#MS<)S1v<76yut&UQbbDN&TF!EI+pewh#xR(f2B#r@A9|T)^yI#ITcXfDcmPrj&q^x@z)(b-+Y<2{+kqAu78WpMDg4;pLs*Jcaxs& zQa}*prCZ5+?+st_ijpknZc0^0Uw?0Qn@+$N_DVwo7dU15qqLhZ$Mrb637+rESNxYb zFvtYE_q)z$>Zc#00LRaX<29nr=WA$=Dgctn+I*XJ78J{2y(A)T=R`zEEKL6tI^lge%d}>yllT1LH56&*?t^wctkNZ zEo|Qx!90g;uWwU4LL4+0o7*yYc(}MCff4w@KZ}vbhabae8pIZrr`Wgxeh8NEr~;0!wc4q8t)WPfL5twxI5S9TkH z2%_%eChuemYe&a^`NEglH=$74g-=YXrEhL>f|K~GOh;j_NE#3tbg6~$s~Uirq+$eD zJ(k!X^I_7IT~B!_`waT?i`T9*Kso9$}kuIfl75a^NT%PmjJ zC10DbT|Jr?vd1{mh)~)`=Fl^b;6uZuKkrZlW3i)=k424vu#h=Ju_J?}1)SxN{3UT<7y` zEGG}o@G`kK(*x%5{?M2#zuR9ofM#V#9%W`_KKr8~mZ!#iHZ)H`y-$eJa?0H6YS2-; zW2(L1tYDx#K7W3i&AE0tdVWfQpF}F%F|{$PZMgkA-Nko@nqsSj8j*t#kUsN#Sf)VY z3cZ15?*2>qyMw&^9}+1{oSY(apRYcH$=V{n)((*XMK%_PmIxqC7=*>d2BZOwaI*Zs zo+&Rssu|raD5ax=B^!BD#8@O+23%;MguzkVC1dK(1{MD=W&xn@KAn~Pn0g=jEt|1n zQDvaI$ujh8v;aPr zhwKmkVyX?WyQZ`QwReqYXZ0or#}~NmRdXBHT4b7v@ptumebq6l<`5EEoTqf+p*JjK zgX%Gu%%h51U=!%Qbxk_>Q@`pYBNHLYVg1)vo zBgo-tfUrvciwSgXIH-DR0050VH8?5Zk7k!r22w|*wY27lh)ndr=@OKxtm|8_F!YOL z6JqiTZoc>qzWge~YuL%;RoySJLFpm!Zzt+$SILVlnIdb;JuB~U?`5@dNG)>Ok_B>? zf1G-___Hl~CEo3dABpz68^BFu%?G;iFKWClk9CWQ=`wm;s`iWPdd{rAI0X)Z8V9So zIv;xcsNZ8J=ANEudJb)2+C~E7us;6V6&ImG>RvpQw|o1RfR>8yOIaxqIr-MS|4Hv- zdBEL^F~~Yy-8@TIvCDeLG!fPQW5+^PiOozNPjo%2%V}2cR3_MQ=ghx;?)UhqiLV`e zCH`d{*W)wviB@1<+_oQB*^tfNhpCZm0O@|8I?5%=F#`3!-YG-@IEGHh(;frntv$6X&k$WfY`@xQlNmX0L8ltrY)oIF|D`La&3UB@Vb$7 zjpt+e?#Ti2Tpprsi+-Qe2S6dy2c;TBpMqji^M|*jkw{BijAgJ^gcLw7%j~%wSKPuQ zM)Xi}c!*g5Ywz)QTo9BnNbC+OWm*>D;`Eb?K8GyPT7$>0wVLMt63Sj=im0 z{AIY(+$wkgI~n8nv9{!frZD5ax4^4>Q@}F*`VG(wO#-Nvl3Z+ouK1n8HBN4k-e>Gy zSLqtdvr9O=9<^eiI7G@{?oMYCEm8F036=6pn5|-iNGuKhECms|9R?gC6VIdj)(uMr z^O)KSkA(p+>m2V3Yx1W7K5L%L$8o4XReMwS*_eYUP;w_Q@{9zOzU##NQ#?AM1P4t9 z7OlkN+>@}%ag)H9cK{y6oGmbTRVx{Nn*EI|1>34R>@{Pt@F1AHk1*_pJ8_#jI!2S< z;Q^1a{t@#k zo#R|$-a&(%Pk0pf{kO+U?fuyj8#EHUbyMxV9VV5=Iveu(r2* z0R|c95|8Y{B`d@$6iemDmFf&}aq3g1x&Y2lz`0@89K9_!H-|W(1jn@A+p8z^b=|J9 zk<^ToWce#ME+H}Fr=fkFFJ<$@hJbk4}9ucJrgnk9{l`}4uH9iLa1 zS(QUZ?`F@wdhCP*S=rR1AEA%QK^#YmHWxm$y-R`vn(<|j>?6cp$eV{|U#}nnL(lZw z_A^c4Q0&9b6SGA9Faocy87mussR_nZHiH4%Ca*yua;aBh&r>cH z)s=wRL^%^vmXHrPHQ=7nW7P!_3BuAuzFjNZ85uI*Hhn8L135aPq3Ez$;xSm|Rn}Wi z{L2!<8SZS0O!;9(qc9pR^#s~5U}b(gweh_4(x#=~(mupg-9CQroebFQ0xlt>K^?R= zh=os3bisDEHx;&RumMw5z+cAmNbmIZMx&nnfUzgAgbMyN9Oh>HH`M)~iHx>L5-L+h zFr==uVA@ZHq+Sc22S&;eZ!&1sWtJO>*o3BFy}oGc^C><-3CH7?ZRMmcH9Hc66Bc}_ zSg&w}4%D)eN0%vhrWJ0v>*wY3`8C4)!uoJ$kl=%_5^Pt~I8)*l6OAwlT&efHlZa!L z8#&Yw7tt1k$@rsTW9OIOE05nrtCb|ce{N^zz&NBS(sq}7*~Vh(W!Q zMb8~!bdbPEu)hzsA)ePx0b_WFIH91v=I$M%LzL)zwoexdm=ywK<&A5{~l z6-Qv)^hTxd>LYzFrv;uQtv3HWdsWY=4KFg9yh&s z(fV*XF6h`Wr)SheftNfjuCSmKmePt*2vJzqP2cFM^{ShcH;Fq;gI*)7&`4} z^TBAKxntKYtPf{7FKF`R7M3gorLp#UPNkfXv>?bUL4+2rLz5Do9`<|o&rdzNVgT*_ z_^zkr>X5((Xjhb;y~uaojJvxIKqQ>ZW2FaC^vn?OuP+700rw&%ga^+Y!}!+tM_Vol zysm1YTl^T*)RO-dre0zC_YDmpRd=|52YLc4$A+R8wMK)(fP>M&tK5gEiMra(@FRC< z?eg^O$$@mU5$uA}Ts6~Ff++eZOcEMhf|r3X9aVYwlSA-ar7e9m)Jj#i(%N}U(91H! zPxcn`N@dEXLBQt}C6$d$os~eq)sfZLp>=Iix30duC&)Ntp10kxU%L2sJ%^<( zF8tu){MClo_Wz-n|6Z6hIrY9R$!n@ByhN=$S7jrv{4`Q0o|k8t6gSkzBOW;N0!JZ; z0?+?msYy~}LFUtxr+J7G6%wy}P#otOD1sY7MX6X53ma9jxG%eZQ}7A5T!Eqfm$^8c zZ1NKoMd>I^Md|1d${rSP*r?%hE%+d*s(2Xw$ek>7(g5T5{Xubqo79g$S_Vlv-+j{J zEWfXGDRvG;%cX61OUM)dByJUoxAuUQS_!XJh0vxGbM_MuD)s9aNDjjXF14GMCS5|) zx>)#{Mni!6;s+OUZ7%59}GdbJowWH`1m zZX(;pY(=v1K>Q-Gh`&<;;};yqc3Vw=571gU?X0|AM`<5V|zk?L7Z*t zVo+9zcJ?xfTwE+O$YnwwumYl;=kr|Ol*sc>^;*Zve4`YP&vXJVr*INT802Y|&>U;P z@HY2uRh3yQW%V>xKnY`?uPBg^tO$Exu$oel`fY7OX22D4}DF z#=z2Vbv92Q1@!RrQ-K1I`UnXv{o9oJJKvm!Yeq5uQ<{JI!dCw%Q2n3|>ppR!XZSx@ z%bHTNN!MZ#VrejrzxW+^L0%K|Mi?Ok2QC!O`Z5E~L7ZRIap3+|$~IcugZJQ{ z8{Fj`d>^uNmoPcKYNx3YDhrNdJUZ-;vIN+BT-$W)6IPnEAQO}a&(els?}T!#M(wN+a=%YH81ep=H8Nr$ z6zZLih2ltBB=0nNM>nIKTJ^oN^`~j84YyU8s>b&!grLjrIqMiLa&Zzt#_}sR;S(@sHsXT**6a?@CtAm zb6}7_KpX_e@TCe8^ogIBVF-Oq#!;4CKww0XEw|vrYiGq4CP>sNBtDMc{$Suxd(%@# zG%f2O+Wn~u5lb|ec#M~8W+n-RRks0PHpX+(5hcrn-LKRZ+MFydIydNX34bIhkop~o zU-ZK@G+Gpw2sHi4t3V*hV7#Fixdw$Z=6GmFJF0B7sU0$N7Ez*5bS&qDXyez&+ z04Fyy>)3U+fA#`0En0Qwn*J=U_N*JZ=8b)tXy84?vTp$GhO|Z=TR{D$mqM;fP6oY> zI)O@PO!6$Fk59V>;D0cl(-u9ig_f+SG@oESmy3~^4wqYcK?D%=&$sLedG>yrw;Z_*hg(;ijG&_e{GVIr4H!dIz+YpO@&jM`7Aa$U0Hth z=W}5qcNp(TS{!YgJ(-}6#yn{2h_}{Fis&oE^CXt8XqZ)47y=byJK=eb^qerx3M80n zeG_3FM`r%`C5d9?+a;Aw1UT98T9pMR?r&O$)-&@`Ygzs%i3$;fGlU%}iRyJpWxjZ^ zi#igMY%lbpWlw0`5q*6QH>p2K{pv*rG{`J7$@Ius8TM1wku!WPTb!n?70#%Te!`9# zzx4L)=;M+_A5ex+Ds$XT5}WC>Ra6ySN`y@?R1pa7NGFth6ovZ|b*Vxu8An89UY7UjLf4#tkab z!k!_J43f=96;;_}7ctcAel#*bKL*_J3XC&xr<4AC7LrxgO3P*Z^~*QDzyEU)o|0+| z-N?F4Ws9p9U?Ajn;gx!L=rk}GaU#xSit0T7H-?09db_(17 z@C|emh}$b=9ApJ!!9u&JlYv7FYKU0+De(M6iCR%yI6*=?A9J8qY_0z(> zu2){+uaddF5A!BHZbwB=2WgU5I!!8P1--n~@nEHeMHNH%8{zs8apcOtl8r?a+d3SV zZ>Mg0Kr3MD=;qFnq7v{c343B!G~=+i!|n<)(p=6*7!Fe7hMoZr_$_KYJ6f z#6{Th){q|a%7PnvIT0^sY7>C$FpV4-nV7s(w)z@tUCw$w*Q69LNWKP@bsK zjJUR-=s;RO0mOikVi!m|TxT^V)qn!x#^ew2g0dYvbsOEKr7B$#VGw^821{Lf)qvIC zKcB_Fp60YFoaL-aYMUYwZ9SOrDHBhm#g!DXAcjcEooTVT{2dVhuK|MT#XN>0{uv!U zv<#`Jo;iEREsFHTL_}5WA|fjJaf)ZnnydgwC1YLX*gJFvTR?&az$jS_b&cIX+4=b> zJ{BcEk`yzIvi_6nBGoSF?n2o_1tu2~G=|_b{?$ty(f{Qc(~7WuRkL7@=dzQuL-h~P&OPU*blP@QQ)0vqhW^zh?fqitelnJRX z5-+2oZo&BM0UahT%3$tk5M0tdMVumeHO~Uy%$mGO`7_7N89=4T^amksC%NwfHOhJD z-(6NzRn#>%OSEX3ef=7muk8I6gdf(^z_7b-Q21)WebdY4Qk(+`u+EE+DdbTTkgDX_ zUPe-Sy(zqmq11vgun=7-K{;rHJ6?r6ryGQ;C`;Gab|n!i4zGSy;PUv<8=Hyk-FW=u z=k24P3V(mrin}ww%MsliP`c{MmiBGG<4gk-6XX+5>nWZ+sUl2_1G?Y$I4e6nOqpOx zkR%JQ=C;}sRV*XV%li6S?H4NH*$QQ2kR;1!U>d>~&whmjeNg@tMZ1}M8e4_zITc%C z?~f{kJe^v)=05Ym3a9p50x3>QG*|@CL6%Njh$bk}LkMxx$?&D~qz}n%j}v_noFf}a zQq@qsI}0fh*9ze{P{|P7m6Rcho}&aw4Ej14rqvvONuZrdB=~Su5JJ!?ym-;b@L-0* zMzz-OH8nvlHSw-{$gus}sB9JiubetCWiJr17=PqL58x=FrAcE;?T~+4VxLWa6J~44 z?`q{fgYygMT1F8NU@WUtJx=~Vb(5xm_1PFoH zHTa~pNfahEgZ-!z{0f7I6P^s>VvNq}C={iA*i?nG)*X4LW-&4Z-SBZOZZevyZt8dY zZVF*Ob+fb15XxK^EQu{a2<0o~(HWD##blga#1rfdq#&8eIXFs_C59UPYR8Rk!+}AW zFZzb2=9L37l|dY8^eKd7ELF+} z7p`P#A-AK>+ufRAH>7l!1V-q1(0fw`XZHo;OpJL79|ZL+n99L{nPoliQTK^!^IIC@ zt(bZmT`Ll^sHr4h83t}5>?$FZL@XS>RM~eCWmP0vfxRM~>p-&r<9L1apW;Cb@rXv2 zSXUr~U68YHVc`sX6|tm1J2yLID;(%VU7%YDvi8mM2uY#85_VV??=BzXtrO=?<+7}1 z7Ze$5`MHf)%uH&XS(T~M@$Jw$twS=8043jC;`TUAt_yKCYBIb}#RT!PpDQPLLc>i} z4r>Hq2KVM;Xd{DY1V@S}i@Mcc6g#P0Tl0{WY;J7+L12g^07C>z`MKJA1`h!{IPqLm z`5S8+(L(K{e>nHu(M`xnHg`XO?5W=FNMqIGkzJTv8Mo)<`ntli6bdjyr#<6YDR|2V z?1F%tpy-(3X>PTpX)uH?`$76An!SofwVTI`*(6+U3Etg78Nsh65u`ynbG5W_k9gM% ziH?IUk7~EfGd~(Xs7fMcWW3|(RYTdjWweQjNpfv1rL#aP0IPY48FTRo_4o9kc&s^T zsLwlmjE>fHBptrH@0R{}d;*PfS}> zR7L~1iJ3^MgFp^llM*m!mi(O+1H_vItRe?iK^eJ|vj}3(V=HFyvI*<})b@&sX_RTK ze=6TZ8Tt^yv4o))U>21_9_$85CD=Li^BUW`x3+M=c>lNt2?av|w*;;7{*@Kxhnthl zyZwOgrQH2rS*Ynn;%Y>y{>1s z@f2wocd5h$j^D#XIQ2JoB3|46En0HT%Hpm(a><kX(At>a86EJapGjzX9PP5Ad(_iGxuyddH1-H0n}Ss z8X+Ku_p7y0yl~B|P|MQXZT01ep1Ln#vZ9yoy??NW0~f6`eJKtz^@D-=yn?A*Bg2!)rd^dLIg4ND%}^ltg+}pjbz44 z3qKrM{utARVgZHi@hZi+8yNCM33G!8tH4e@o_7GmieN|hpOxOgsdHWb#9k-k4@fNWa#}e*-c74%bfD@tublBf+!uj6a`^mllxMQ8}OQ8Vxxf*DU$W85|j zl6uS2O*sjK)Yc4=tBPxdsa1jtx5wimWz|(B6>V`YU#hAucG(_z0PcbM<$%lgkZFD6 zqF5TGpDOBMulcS!0@h>X3qDL|_@_kp_IZQCKSiBmBDU*6GROB(e(!edA_ehO3Tb%V z_uRH#k7a;PCOtQE_n!V4xGF;S>lhGajxe z<&dAYvo_DA=tO3*h-6<-(Z5An#b^T84)`Cw<9x~)4)754@Eg=7O#5pnx$n0H-iATF z$B%^YXGlk%_T>a$w~=XP&fv+?SnAkHG`y8$Sl<m?BI2>!$44C7uhyqK}-Y1x)P<%Bauc z8o}^v2{7U}8fa2q4Z z(tz!XeBI*K2E>n4xPBeMIBcWmP7x6Fatp-*-pGCPu=iuuw*BG)IYnD5Jtt#lfrSrv zs6e|4tZgU|Bpx@hKC;%Ku~Tg3&iiZe;r2w{&z+AEXvjujj9vWZVxxo8(6v>`ZRy(` zRa|kM5v8ST3NO^B z!1{@oSZEc_uL}=tZa);8OdK;4j2oHx`=>Y;|JLq$M8fPi0<~X*Fx8mx&xOY>Cpx-I z18$q>lSdyT0&Xepu4A83E-&kZZ-)5NGcq>x*1dz*UykY0(+IZ#HoGR^g%q$dLB!oQ zt=9tqRGQb^d^s>rUR&R6S0{{}^!+Vx?HwL+09J3aH&(p5K;a&Eu(}xqDN=}K-Sg-DM)(d1h`T;432+WD%8DY(>kz{g3@qQ15{#TF12MZm_<<&n^Vh*8(+ zncnsANZ?r9E41#;CwBjg>9s==%fZX50IV*b*nrgam);4rwDj$+=YE3p4AMb2gTL1Z zFFU!99M|620k_a+v_rY?{cy3u_XeU@iqP#2sNXlh`R|hAB_Ke&MYG4vAVqs_p~)fV z<=&|49{^+G?A(J;he5HEZke;sWaJe(Rr^V|@|~*a9e2PPV(!jlkXI6Mh5K{N_pg+y zb&EZhfEnJY8v!e`TIJkgSHQ&Qx5eHjs{M}6G*4%JdEYpH9_xX;5ZAW0BO(AKtum}m ziL`lG3;w`U%$~vO=at8jcz(XHd*P2x!9v-F84%U+K3yM(*eOL<*g@ zhaFmz)Xe(3dz5Jcu-+%eJqA}&Eyf*}XUiLrnl-CmH8nlJ)BV>ro>1lz7KTBx|7W%R zXTTfG_t_XFcxH5XCdJycbtI+ua~b86Xc-tT5$9^DFTaKiac2U>8Jw5E*WL*yOP4>5 z-CNdZm!hb*te`%s{95@3?+L@kIn|2b2|I^qPag~k5RIE{U~JG$^zMNC)opO7j(Bx+ zL{d=&dIdOW0*Vzi4*s-m6&wijZu~x{oVp}8r`ao!vQCm8k;Kb1yDv4@k6BI8NJ!jn zfI{WrGe{NGh8c3Sgf?^{LBikkd|7V$FGIMLK;n1W!h5Cad&?kt?IY{?D70?w2g+tj zCBOo3zrPMYG#T5sSD}EO=efhn*vkO!`aN&c`jxez-!;64-=p?IQvmqoF5sE(@upOC zKtuH@jzai}`Qk@H;f)$_eaCiwe`Em(q-tp&m8I}UtaQ%|xUPOS^1U04y;y%bgqnifyWWWL zi2@=lBqT94Xq#bCiaNB%;tD*TK$ zs>t-X2H-xgMiocfuck-apFo)GJR-vcqPNljAFKLu_9Z$OOpIweIw2!^^Jx#&7J#S-G_$_BXO^6Glw7kH0r?!=a9u2l`hZy zJJk>f%*bxruZXu)OkRV{dyBg`2HNg%?-{`2$9_P%Oh%F9$}zyMil=ZV z>qb-Ib6DczT&aH|9eDtNR5!;s82OVH3j02(-nxq zcLG+{vy=yiQgx+LhPe6fwjs74kj_ukpP)(FCy}VsoDUzcQF@1z7xYYeii~18?zL%eWL-OCv=j%l7JLaPQ&cy&ZkPc=KUNYAOL#0 zT^+s+IHP`7#SHgvs2K6IE7Q3}YSQ#(D@;*S;Vlq(y12~Hi+DOjoS$O@5ip>!_N%cI z0{E(@r;`Jhsqco*e-{|g#L8jg$rN=9`lMFJej2xqqcD~>rBDBL)_HPmD5rAZ%l_$w z2sUvLWAR4GxFVLq5t@G82Ia{M`gy|>ktBV;&+H=}ye%5e>rG69n=3MvRJSd_jO-q9LMiidn=NO19-+!KbI1Gxjc{l(aYm=P*5V6GKxyF~$4St+57C^Mdl!93!6f&W9)YqSo zMZfr0a0qJ6twn5fA_)0Cjc9Ps3y3im?ofLTDYilRgr9ic0{F%6sqFkHwSo{%R$;;z@EZNHR^l{_JE7%Fpa7}>EKbS113u%>Zo*B$8XBS4h z*f~D`&KtbB-$bYr6iYa{{8^u2m&A})`^T7VF?VpEIjCfj&SS!ks9~q&A9~q$BMIww5L3x?KHwx1a9@7 zFQ5B(C?C0_r2oaU@&LreD7=&X(}aJ;abY0?An1xK_j}YD89iKI4_obhcz6dyyKsVA zZa$!0jh&OWpRT_bq5LNWH;a#p!^Fa3(Qc}dY(8XfcH4(F$&3Hj&3&SM_>S?n8QNO` z4#%(W-X;BK*1U#_t7wzVW%59Cxj?*H`HGK&U9Mm8L0H{QRBX|`gZ?%TY?z8=SVVT%KTG>ydnAc|h>#y98S2;z(PG~jsSwHJbM z5Kwv5(b=0n7wFz+pbZY*3=Jspy`uUtxbQQpDWcOnNG00$a#< z2=^+qMf9f5gCngZ0|3c(nq#_C(?=uqAV-tV?fiiuyb>D_^H}Fq1ACTh zF}knw+7c@s$|Zzfh|5|47{7yrg?4FBxz#a622oHf!xAQ&602I+%xxgE`{P}KJ z@bWJ%2`TCJZ@*`VZR@rvv&8G8Cb(Lb`vzLeWv3VD4JLa3dY0F*r2OD)`_ucQmUA^$ zy)PS`fNFJjg4X-cYSqxz77P^QKvZ(nwa`OZHVN7TAn#9_j;iQ4$eZX|rmOI&{VLMD zu8}^HOU9X0So|O6r+bZ{9yoZh;5TFpV9X5T^p8u+gna>^u~5)ufzXqZ5VXQ?0dqg= z{XEP<;&UB_qyQRK42}zq|GI9nd5A?@2ZsgC z{xjXSiqXMU)PeA|`_3|wWoyzaby$_g#qwI%9p_Cf1Q#XI_ScB-UZ@^A6y>W8QQ%MW zJ5q%@NsbD_wQF(IA}gc0bG`f1r(B+?c=HU44!97hKUs!~ZOuV_)!q;r;Q5w5Z;=H! zjiSyZLiKBWOjO<_(BKppxdn}8VnN;XVVrHlxSz4lg$9?aKhSY0UZ%jc_(*y-+v zV?+|7f;sEvo~;?$J)0{Z0RTI~KLX8s3hR4^jV(Ug=0mpIrI+Nxhgf6h-?J#-0@Cs% z$y}H!Op-!`Kp!ie*X&xu9%@=00@pNC6NXh)eKd1-j|5Pr#ETw&6+*u@I(4>(0Xdmw z>!3=3Z1dqdC<*~+$Nx8Q`*@ty@0$zgcnd>NZ7_`vWCAM}ze(%bI&yHoZj!x~ zO-(mn(NwedQXDR-UaE_3P)$wHWJ#m*G7uJ^3xMXChfohQB>MZb(yXau2Xx_Av$-^B zf%-~jYd;wwOrM6_1F2kyz@GC=uUZtpyQjPq)urz9f_FZd#(=l}QQ^Q3G7#I&wmYU?@c^%*)^BdD@KWywqxLS`Y>zC}qERaHu=zfxw?QF&>!01Ey4oW`48soE7^Q%nL_8DA;+? z{qh7eX^5pXr1Zf+J_U8eLPk1m`DSEAq{U4*P#S3JawtehJMP-U|k$recuwuXpvLC}ju^$8|f25RhE` zr{DO`{RcE2_U}&$AFlErbD&EkZ#r*qD4(&4BRxN&L@Va`n7#2GA9hnRlI8W?jE0XU z?B=S1Ts;NX-+dO7d+%pkU|kVDaQnve{r4O9bw85X;NcS_+s?blD{|W>xhwrr{vFAh z?mVwAj7BPbgHLRl_=?mLY3Rc&A={yd$|00&=pSTW!ErK=2S12p%^K#bY;-lP|HWLQ zu$rfXU=@fW!?6Oj+-3LHk%9Qn)MGK(7_^g#o#5c6s4D7IV@^DGJ!<<`dYS`jN z(k>P|+{mqpp2ZMat@6-$6 z#0Vh`Lr#=B!N#K#UusBO6iuV8LPB_8GKMZwzFzSAA#|?wx2QW(k!}o13EA6I5Y;f7 zqrczmmmSg+2@xWu^0_*rsg0>J99mC?W5Q*VC0f6p|4!ncEZu%2*L&i(hHGR#|KVfAg>6hLY&p!WGe?zM}6 zhBM+aU(LhO*B9DoZx9!ynK?KJbTs99v`173{2A9wd@7?P(pVKsCqF$=ZOHbsI{rm} z*~1fa8iMRj5C3WW?>@J~=3F$$ajJgacbV%6ahZoO#Dh2CDrPqWaiOY=EBX&@T8+*Y z0Z?k96;spnF}yNz|?H%YRRU{`(Ng zZloa>y3$xN`~I3p-Uj@mm=FH(FCch-E2BZwQe7VlYcY;N`PfLH0FJ?AzE`rkkj$y{C{E0cx&G!;vp%E>~Ag@s^I#JE;H=H8LP)YqdcN zfPUR_nhaeJ?6zD+6_t*ceGKHA?LrKsX%kkp)Vv_cqZ>`t*MpZ z{+$<7hRS*CBNaFa73U@AOvOo4jB!aHx3ELhsl_^|Kzl_^lcpFO^~yM*XNG*7u#8k- zW#K1h+7B0*mXky4z(S@q!$=ITz`dI$ukpm8Z?T1R;PEz{ydVaVil0%@h!?r!HE?wE zeZi7(3m$@dsj%h0=8?b&LLRFn0wdnaZie6uKGI|sa^7~FvE~vjbM|@|$Q}{>2=o3r z>T>T@Ia8Qkhz#bp_<*59{*}lRPghb*(8#d0R}rrw>TtQuy2pdsgb~7!xZTrqzb9p# z&56od!cDU1M!ztdy?)!$l6XE+}ZucQ0OT*y3L9e{^zHVY( z#DE6!9+-_Bkg8`+sM6#z4H_bfwi>+iR>ds!rqS;W&4&pqCT=pPxgiDbQ@W}@bA ztk^!s9gqV=IROQD!LS0bPj0Hps1M8`vu?*O)|DOR-0zJ6>Ks7F6YAMI*e9I{sCl?s z+h@`U7{?s+p8+L9C=Yr2>&PgagyHQ5`zK7mn2`L)L%BS0e@yo#MeU~=&s@75_tw;c zXHrNA{SNFZ^jI61ZaTrhANcr2cLzp=%m3Ff)t~2M-=~LRi}5hfjrP}^{47yoa#XpR zkG_w5aJ)KSR*`{Cf%^Q&59ooDBHxXv-r0L&?%`#XT)`&7|A>h#DMwEJ*<<(TRu(()WYK?6= zhDop}OH7=2G|+_+DA*?)i_CEx*cUT+hgBcf@bJG&(ikF{310gTM3c*7-U8U&X{DJW z0P0u31P%-)$Yers9^o&2UOy6U0Ga68x+uz0RVLN32zg&h2~03JA6M+eL+1mf)F(d$ z_NE!sVz?bwc7h6Q@EnV&PdNWBpsFXNpd7Yoy*u*6&d1 z=M?u>ys6Is=Jn=o|2m4m*A!y$kK1EgXu{^B@ZZ&zG)5NxaT@5}9z^LNdTSL)#s5`@-hYWwqUp`P! zjU;*@i4g)i!$0zJNaNq4ZDR~E!3)xlJkoWGB+`Ma=r)uySnMx>1N9Xn zyq%8{!hPn55+Uw!-gTK?8e!f&hhni7@(0)idgk@^^q}8nSSi3!zp#j?N~*u_q^XRs9fQ!W9z9w4Iui-;%=nv-N| z=_&Y5-AzcvPC|8S9P+a+XR9meB{7&@VgEK9WL=XJuiUOa8mCC42`H<4xWbJ&Mu<{R37^s=@$xYcF`oD(FEYAZ z6c&w!f?X?|a2QRUN)#>V$Hf_g6a(^vE4WTw!dy9QmgD|l%hze9O?m`iTUQe-a5dYq zP@a}#Q}L3*q)wLZhQeZXW`p4~L%45yZK~0)fBbQ$Hf%xP;%-yM%oWQ=mJCKe&Rh$j zoQoe>TkOwFn=U4E3GntMuX$k3x|r7s&CFWy zmSMlYPN&AJBn5;-Swaaliz_b)5+fw~ww4{NDO=+co2B7BJxoBAQ_XU{g89ZW)@|*A zd5LezYbh%gL)UK;Q4=(@eMBT#KvMW0ToD~+3Tdfds3sV>j0Jpul17QJU~yCpvy8F}5iJqO{3&am6lbMR>p zuv+|wQiel(|7UIG+jmkp_#IQ99Gd2^8l++xDoaWnPN#q}ZyW$`nG zV;ZyKqvyY$_hBg6C=mQHkmY^uvWl!MYAF!i|M{RJnc!0MDqBLHjM|$~&-yV|!%fu4 zdznE=b+(C?@fY@ow}yblkIq85WHDmpcw)?tISL*1mNgUhh~jpv5TTf~HqKL~NHT;3-oxy;P)0E%Y-LkA?r zA_S?W0XbWM;Vv~jbHDABRm?)es#9KK{8NrI#lDJ_L}$o0e@QJi78mh*afSI3#-MfR z>u9ApT@`@g-x;D=uZwP>P=TQ*{7P&qx)KTipi5tx&E_mzA<_9_aL+zJLjRzaA7v|m z_n3n9UH@(yPA%7!pOfhZ0^U(|Z^M@zYcdc2OYOXK3&>mc3KGul8C7aiRp! z@)3jY7EDFH8auxQOY%S}UEGFbyqDuLv|3}O@4TRHt~P-T)Uko~*<`^)ox&EzkwhR) zmokY6T~3!1arFGtAPG&k2}zYEZY5Q7T*+VF`KMhAL84%O7p@H{g-%OVdpOGh%h4p*O5eHae$%078OI4WOKoyD}Th>q3`LcYDUhnLf4#4b2VC%f2To@TIUnXgk z&y;y3yVaTutF^Zvg!Ow;#*>he8`{(k_4LRZ9%I=*ZO~*D0S|kT$^h=nu_f9X?6UVt6L%mvM>O~dU{pAA_H`nX%P6PObV1D*hMXeI}zrEhBXw>@T{5rHn^|Bdg9{I43%ONDS)u^r)W}n)ibH z9LaqpLy=yY9?oHJaK&F|brHrU8ha8Vcj<~t#6trMrsGS1ZxkWDn3 z`%D6`Lb7Kww12Ysf*K;KUsuCu+eMhP4jBioyytTva5ay;)H}=aU`+PtM5H|*dC^lv&u(}zc>X)JYXA(fe@*6&) zsMk*vNs17?8S6y8AH|U5XmO6^iXq_vgnx-maJ5t}JmS2fN^y$21^kUlSy~2`bTYyz zwApTe<0CwTWtfalP`SYIamF#vAWzN6+5IcvC>(1&`Cw)BnVZ`(5@(SDn&g-Y?Ej(Y z%qHoD!XG|}*QzNjnHd3#gSKfVRkv5k-W!=JNh%vRoW8_X#GwA3oo!&@ zkp#F_-n>!!qOEP>>x)`SILrcHayx#nGb;xI-caH!e~M?p01!h^LZTVQbjsP%#@qm1 z%utRd1YY=4mO2_}o@VOex=rO-4UR@>bY^0nPVqBd+3$$f%cmF!^f@C zZH!RwZr`Y+tgO<^G;Nbn4>sQElhJG+*L>XY8iXR^c?9U|{_UWy6d9`@of?;1G{yec z-IQ$q2T4^RiR<+e)?DTNA#zzC$nX7;8*N7tpfI$2?`|_l6`=LF_SbXD+2jWOML~vs zvFqdQy8?Z{wE=d3RZcK05*+2W#A7T1vVaQ(w z;RQNUkiAIxRToUy;i(XO-Y{D+sSIKq?>ia#aabBZV`qJgm+__DmGhsz07x|2BjMHz z4X0TWOx4x>42r_L!jo)-8awA_B<(FC0xl(w^#X#~^hi>~0%)9Ro{NsffB>7OKhUoN z2@N$b&{Q>@v-Hr+%rj8RyE@mojgq(z>tq(szh{s&m-z_Uefnn%_ufojHEDnXw;Kl+ zSLgpvUM&eZM0l~cx7VsM^8b~;z=wy(wI+8~*AKkY9wJ5~{+$^=Gd^kFX8mO`8+!^zZ+!MWnA8l{|NR%Y-|D^wHIN~2m-;d z%USc$3f0mBo6O8(&Bi3Nir1}_Vd*d1Z=T%F_fJ*LO9AFkYYbp9J8C&3zVr-IYwiX6 zowO=K7DhV%H~MYm~!*0amJC-@SnLY zU%7rLIWdzMu^Cif{N(cy0oL7SNr~wxZ{^Fp&iN*1msc@zYojyTT;m}y;zS1OoOmK8 zqno|Jm%`-4TnD8c#nXw7w)E)+^!|&s{%eGD6lmv8K?IvktTH%b=L_N00&l)+T6H-} zR7})Gry(r2RJ1yKu6qvjn>uNvA-1w%6VaL78%zDc>2Ca$X{55ec-I6GR}Vqp`}$}8 z1LTy?HH_%gMS=PbwHrVTWUK~_|E-NKE%Tz%Y9n9F$e?}VaKR~^2-lx?HMS44*q`f0 zg-JygX8I}tAZxq4Iu04{mP{iA-5&FW*SbAhc|;Hvmnh_Dr4H|G4OKwQX60qD*9H&p zcLnJvWw&IdGDg+bW3pF7Nhoy}_(TTc7F{L`ltXz!fF1tlub z>$gi+^zzOh_i&K@rIDVab}l;}zcQG?K*;Oirt zeg4PqUXm3;`7e&Pjg=$AHX&Q@UPEJDJ$dXuFqc}R5+T?shiR-i*E=zJ?a#RxUpY>q z;OLbKKC4s}w9gh_b>x;LNs~6)%J6@ufaACmj3Zysl^)z?OuD~7tS>_1T$7?lV{!R6 zIg~c2GS>K+USX~6?>IU%a!Rjdcr^EE_Wdd$0Bjb^;O{>h;@>n{6xnEA2;OdbDO>6y z`1|WBGe2MSH(H3_EwKvt2X?Rjsv2tMzqG@eaw7foQqn0i9D+TRK9$ke8g^H8q|t06 zpE=9H@b5wh>$0A3ODLFIuRh7?^%NGhr$DoW7hd&8eJ`O4SjfT$a3ZGpt91A;FlBDg zl0$6JzW|*;E9WH&Y${4?gXM5O@wBbN%_u<5p%+_71c{y!z#|zaOu^l|z){OT{gDks zAQYz)B{RVDAw`39S6D^L2qwSpLt3TXPP-hm(<>*9aF!e0u$n_Nx1_YygIb%_OvF`@#_k<$dFU{+GLq$8eZufjdn!)Q3 z0en@-_i)x1KkxORB9M}*U#A;t6_i2y9RzxtHSCU|tGkP?SX=VPqK=DiPi4T65lI3) zPII5*u=*X-e@QC-Tco?(<03@k>GGHmAMIQ~xNv@;T*}@FdSsQ+T*ICsE@0!oNzm=1 z$Cd}dMX@pruaxVjXdUZrHzm>z$TB+{f{|1}ifmz%JweDi*Vp6*023r)2XFxV!6!ZT zc+zy9wKzkDEVLJi==RR6+{Q*m?@p7qRBYal$Ti+@*~^FBkpe=9r$j7P-ry^ zuC%+awoTi36kA9!E9r#Y_sy5Hpj5yXEum%38pp4FcTH-)`fyH<|JpwqFmk8*`{6@Q zt*d`))rT*)t6tw7$gPvbjV!z?1vuUSF*sl>%gG%dB7eQYcz^O^O4{X6E-RDPUCkoQ zaB`KgWsc0EX;wjf>dG*o>d2ftz`Nux7fujL0RoUBlQeXxOoR`u`e=7D$CC|kUo*f@ zhpSVTi>;3UI?KQ)Z-+7?4p2J&eyAUNBnL!v>q5uA0(O4)NPu5r%GOKpdg&X0Sd8&H zYRe1{XMgi1h0pha4p-P6jD@A(y{E9c))C+X#4uLB1LfQGl&{`j_3 z%_|2w;E+Ebi9L%ej?NH~7N17~LVp84S%6;Lhcq3Q&X|L)a4y^aE1UNJO~e`;9F}9c zY#5!G(VgdV;#`nJ0&ocg$PZWbZrUMPp;wuBec<1;oIO?1*mDWvVxcl?HEe+KP`h`T z;*>A21KPkUazbco=RC2MZ5$Ibi%IBwtLB}yQPgo5RpNv#SF$S6-}Kpg`H75XLxKk~ zWALU-%c@2NM8-~RGj4FDSQEX*hvLJ}Z!sxfxiY>*ofSzpVObt z@Kc=fDh}N6y4pv2lpeyGU@>SS1H>#&B%}Cz_6eT&00NOD(z$j)CGyHaoE~wa&z~(W zE4IpZ*#Z|^n#DN+SXb0}Ex!e%Y6RKzb+!crp2!zlAxTcll}G;B6l-@@7asV#S!ztB z-S;vrUlqOMi9p;kAgbinxSYXg;H*%SZ#3rRk{?u1B6Fs4-kuDDUB~|>5MeBmrAt^P zp2Z4tG?_;n6ZQEc6!?&$aMLnz3!`iIU5c}8n@!5rFi=zW)qB+GMLieeTnyCGuSf3Y z$X)M9p+Q>Rb8E$!(o6Hg_biFP4}3M@Rd70D+9vl2xrF`P-}sQs`w(&JE}tqMF#2t- z_sYQgQ$%sn*RYVfCdx~kGZ9sac*vF!0_n7Zy1?~OzIW`Jjsi(d5s8yvM6`jYY}H5q z+(3O_&FJ02|&PpQ@^Zz}tFW;nrE9TyKj>ZM~5u}+wC@_JsNPfZa3*@b|p zy71F~u#))`=4X{Lj~@Uv^V2Gj(To^|dyF)>qCT1HlewF6n7qC~bBw;jOu?w;6iJ9& z{!Rmu#@ubGlPefAQKdl5=zjDgH$E(#v5ezCL7V?NxBn`24fM6II|!|Xcwc9+UXh+EmcS<6Tv-$(td}u#iOG{GYet1b)KDW6a*FpX$P6;C;E)CzZhmqKWTHMS z3Zh?1L=fm(=0-9A#;<__!j=be@^T*-FqHVBw>q9$1)mdUd7X|v+{4UJn`{dVf}mEl z+(SPrtW6lfHI-r!4c?M1$@4{Dcv4%$aL!DfwWe%B zpV}UWuUv~igNO?L>}MN$N7nRO#KC49@m=#}&D_ZFq21nXL2P-9V8ZpK09{!9gtFb+vt_DdBd@oD75I7?z5EvPdu$R94M;QZ-$JyA^e0J!z%H!bezB*+$ad(2U zU=+;58z!LaurWQF^~bq+9?hpij@c!Uyh|AOVc6&H z%yo}bsPopPTLZ&3n?g3&799xt;vt{!pLa?z=h9koHr87`mG7Q+5vzU8_h=LUb@n|a z0u2KtAle8Xvzt;EHuN;$WUxm?3m`+-L(>c&)`tqykSuAdA1*!FLGbdOOUf`Ms9`_2 zPp=zZMRLk z)c!`usmt^Z=4B%8bJ|x1623JEVdM;R2*Y!l{qnkdHj$7yrpNkJFqo1#iijPEAR;^| zhmjc~kfP+!k|g4TzoP7O0u&hm^IIDagKgUQ&K1r}nAGmc-vIK1H9)-e5koha6Xgt_ zV(sgnN)m8jN8%~2uJZ{Eb2`?IQ?MugW=PxzDPh!kFw~iAEhPL@oM1F=iP2<^kr~(^ zUg#kbig!|MESVOD0nfhHLmIO{OERm zt#|(hxFgCD?e8x5q-B_SZL`oQ8p443XZB_XhzQt8$31t`y93;$EG?_00I2xkVTH{L zl;U(dt#>P>3oOpdTO2dG!>*<*Yrkk|nOS&*Pzs+5+W9R$G8K5N1$f=u@wD~YJzvRy zw#Y{Ozo;(ks))D(mSGH!P~#k4_h-z&dgN?_el#zamSc0go9Hd}H*~ioqT^T=cEz2; z!z!cO7R;UU%cw0OiEUBA@+-h>@@CM)ovFQ6LS9@xf75Y&<2B%c2${9z5D^((r@bF+ z=Hm=K_B)ng%JW!zY6k59qVIJ^5f79Cp`%6^&Uk3Z_Uq_&&%i~y_SZe>TZ#Yt(f?hD z10S?yme>M7#Dcu9lh5K_fkJFp!H06DM%dE3Kl_8i{c`K0#zKx2aWfpm#=^#56bO)w zKWTt${Fz7CFqDkl{;UU|2anp4u-p=mf=#yc5Ap|lX7S*Dc*Yz6@BuB2-TeKJgzdJV zcS@>k!UK_*UIv$*N>5HvffW3LdlXqeam~+;S%O5Rh`@@H3G7?>xa0 zl}d*QTgNeq^z3vlw_AdMT!JnK;2A}KOYecd7bm+b#R%U0D)M+GV{3+Mu<^AW?ea;@H#uJ@ z@8`&Uwb#Sk8P}AEU7iLIF~YKXx+T~+9aw&4{zPAy<_Hg`C!8VxRKYu>)I%WPt_6Ka z*YZ$c-lYhefBjBEw`Z1o6n{`=Qu>Q-4^q8Oi@mYA1Z|r0_qdF{Zw=l(UJWSs)}m9M z)q~Ey!3BlJwhaR|2_B(CD4Kk7!r8dTR*}@%-*m?!dIh7cs;O>;R~IZLi30WI#4#^$z%P!oouUTIeR_`E0eSqM_&EKtFXrtfS%+^T7f~eDpAG zmTz%EzloG)*C$CWMuDHTyYg))b+{?>6Jo`9}H(dYCUFE%HsbMa!%yF+Wk+I zZM5ngczgQ=(D5>fxZm|>2)M=73%gT#T`LCG3ALgMZC#rB!+EiZkZJk;q|Fwt?VJcE z%~7JfQtvYVXy0hb+i2)j^AeMq91y+Su0D%Ar&`uZ3&WsgiGXFPn^JW^0eD3X_}#?# zS(xN&Yy{jNiv!KP&o;i`7=VvHMlI$8Fv8DI&-bv0nCDHuv8|CMTcP;>d0>riQafM1 z{vOyFs5Ao5bJ^=WVlRdw56Oe2xK-@k$x_&PG)izDCCq~pY zh=h9+CDy$Tah&{YV(=Ssd+xApAmtqTZ01O)K2=(vBlOX^)@y8c3G8`>_{!1tS}wJU zQR+ppd9=S<<`vc8xBLu1dzr~O@r}p=9z7`Y7VJ5h$Q*><8Z;0V8e8s=COFpZLiUy+ z4B!5~&7hFkHTn-Cjgiry_0LPoDAT;&n;W(e@n`^FQ=Iq>*qk3(&L}Gre@}Z0Q-0dz zAmeMH1fduK8vY592c6K+(3@_N2TmIicQw`&Vv1iU0@+WzlQ!+~MQcJFpQaP_edlr`4KxiKMz`e?3Zf zdzmN2+h~2Sa!Ae=u7cjlQl7O&x_ZOycOlc>--&c?{db>R;~lcH;3*O?hW!_YN#U_2 z(6SxS{K9=Rio-n%b8vO;=jq0`@=0?}v~=G8+noKUOY8(fIiVrixIy9>vwUgxAu7kcZMOkCe@TX74FnlpGkiSp1uuv-j)X-|5oR zt`+JW3n!h|ZRdXiaC8n^7;eA#>C##3m;Qb{C|vpg30nNKc3k|A)C41gZaB}Kv8M6w z%qa@<&sL^-_mtyWEPN72!9F6<60OeQPcgTSsug1o5KBqfU_cyPe`jeA6Ao3oV zb$jrN1K++xImv|%+?J%Z44TKbeC;giZ$1uP(Qz>0PznQtf772(Q%A!<;D3pKeQG$5 z*18#W%i7vjk3N6GZAl+eN&OdSFlp-rjM*HfAZUDUSBN6FfGOtTL_!cqu)3X-5ebIN zityGt;Y9&d%`{{Uzm)gqLy!{zweO znwD~n317e3B-nJfiJ6}M44BL&r~zIrqu#*z!8v%LYLXq;g!Kbz9_?8+-3jbz`j@!* zk!?-RzYGef%$d8fQVe*NExCQ)0&bM(O~=y>lcV-yrIp*!`uH)Jxfex@(3Q?n+r8_* zYz(mX`Y;fi%FfQ-c4+p$Ddi;ZYzI0BC6%&k5R&kI44)>tmOi3|zmiIij?o$C5v|5p zeiV*DTS3hOvAgg?+EneD0S0`l6!6!t6LcHJ-y-{2XOL%tgi-$%Zk9n3(FaLByi+QV zLstsHaWUX1QzNw-UHc1o8OTH&lIxfJ;G&!L-QRKpyH!3y?MN1eV%>6gvJRX(NnHN@o&yij}JUL#KpD5xXp*W0g!mGN{i`O)`YKprV}(z;{qV%!W| z7onh~!{)7S12QgUwD4?)^df4>OqzZFPlMX|Lt|@qs*v|6OelXB#?NwQJ|vzS!Y($< z6xCII@o{CSHd>*cRDW=Al%{szN>8jxs`iiioR{f&j1Z(U33OfPTu&7qnfOJ^q*#<@Kr@t0V^=$Bne%2BG!uQhbPY}WoW_onLazcp3vRiKg1z7PXXD`L1^ccEdEYN8pZ4ulFL`h2@1M85MW?6*?0Yd>hni5PJLJl(G2r%}6;zt_G4jny!Z z+2++z#;50lN3$B8*`(F*rAV_RkO&1S%HMMgT2WZd_*eYD*kr>&RyI}Z*Jm4z?K zj+-tS_)9?;ujpiBsl)<--v;=Q!_$Hzq{kf=EpXh7%#bb}Ch(nyy-3fYBK5R&1b?~F zhu^}GfU|bAa`3cB^bJU1JO!UKac%e4+BCiU2CrBz)_2LSD`<*5zruL->k@&JNwO9} z+}|)+nWWQGYC!br;c=K>wkrE(K2bm4+{t?0r14j=Kt)3t32WMtv+#Q+6Z(*v+w#Pu zEhwUbI5$0C!&X-6-3A^zSCrpE1KTyx!6qHCY&?CJK{l=LB6WGR_k0cQJK);OPjV4Qy>^aM^ z1Z!Kt^vmsZSo)u#4Z0m(g0U;-GPzQx42rZBCeOCi(`nDlf?BSc8RKdc%d)k2);5fe zD!Ru4ag{G~t9r)P&i>-UL?c3+pJ>t{{ocm|_9BZ#eZUyu-Me?^Lv6I5m|+8mH~e`m zx-Uoh1XbA%VVajeKkXZhWns-%nPjwjUFRikELfH0lz-B9b`EAKYar}*XgqFPRVh_# zyidUeXeJHMPhkQp=e35mzHvp_zF90~Es5#2o&xIH4j_4pw#P%t)3tKS^Im@ZAG-1(@R?(t{6+c5>UWS;a`ZtG9f*CsFMa_1c{gqhNZlH z3-;JphczD=cVdwEuk%M61(hN6q3E@>4}va+1jg;r74N=f3NY|GyQigGQy99~2%)?7 z*vD6qzF#2IbY_|*4DuLM=`>`so3K~3YMc1+#}dLZW5xlk0nHlx)K93TpANOSE#iv2 zoF7Tix%$H;`=t=m%3?Wuf)iRZFc)7CQK&r|c{QK^zEdOnkNB6$Ye^&pagbGI!^-B- z5ks33NR0g@cqCLJ-~TCcBCeuW@4Wie)>L54dyP^oHOs)z53{B=8l{<#r_I`tf5&H< z(%x}%3>{*YO(}S2HTgwm$|^MvhBZpHipsM6VcYU`R0vBI_Rf^HFb>g6Ambr1{=pXxjzBdXXXh4-f+KJzEQbGgUDZsNWeF6w~|Eamfr< z+k%!n;R4??mb#*Nbcb87pF-tp>xw0xP1hNZ?(QN+Mn{3c7w+j5ynLsd(i7awI`^*+ zVDD|C0rc5pzB`*_g3iIm-Y{1Rp94AJ%i+x>ZuJHBgkk}qFco3lRU@Fc$mkX zN7*KySyE~nQAqLYON|;nWv$%m!CpTqQ4Tltw`9KEnYJ<)?{aU+1hgU}2!F8)v>380 zQ~hp4swksy_6OyYAn9%+G`*l$PQ-uPG1a>aHwBvrr%UpMG-l@UKWq&UR@0gL3My+^ z+a&W_Qr;;vYliuT=lj?vNonEG&^r*}`N+t-ikgO@$w}tL!oDCie++RlK7I-IY@_?= z@G0HBDzEEXG6DWSs>(uPv9D%7D?%W#e@wq<>hApb#tLx7vWl`ivvgp`YvjibtSwhv z=W<1VZhy(dD4ox+tah1++_P8BW0$v_G5bBvu9|w7gjB|L{>cyK30W07L%tP{CS8WB z2)wqkGGT4D#+}xT0;-etJhk7|M*ZAR2g>a|)9QMowX-cri+{?PD%kC-6MXKAe^KgT@o{n5l6NbYD{Ki~%{|Og*L0E(6${dx zo?Gy(X+YbSKSh3&QM_Gy_z7C>K+?IQLzozI-er`pRfFKc&IZQ z@5ZaEaY~#&Y#W%@Y}QaJ%+6RR&4Cnq`kZ~rs4@NQI9$}Pve@hLPo9=IsxkCuE78BX z6p4jcJt|yb!Xxjb_0G$!1}g=h-XH*|-~=)e9zHzr(JV&!B~04VVwCrnRLq03!ka}xk8~I2Q>oo0NmDN3r4nK9O(dWfvR0CN_O#ZQpGYsJ~xEnWM zcz`|4fUK9&N}AQ~`&4mH=(#*Gv)W{T*`lm6WyI@wq;*tgV(?;T)FEF9g#NZ1|= zC}F0Y!(Yeapd-g!GC`U>JZiIv3nd(2I9{5wKPI_+hik0?e{7!C@}Z)#7v@$TpDQZb z@!{*kUt9*{(O7TKTL{=UPW>;J22Q{4a54wwfHhVDyRC2r>pDM%1X9Dz(-Q~XhF={T8T3Su=+vn`>Q$j*sk$O@w z^BCn^VP1X(u4MDkv_*j8lQMO6#jj>ct*k#l8eC5|w{C_S-+|F`O}kogfcOKU)-x}z zUscKN?GO%`Mf`5?QwxDm?GG3Ot{)`X8jQ@e0;+R8KO((Nm07zt5)8v)qxDPVnNn9) zL%CnZ3?KIzKPteycDi#oLNK{n?Fj!NL>8u|vG4`v>zi50-ptp%4u%O3KU!TF@@rSq z|8EdZi3urS89KBky>_I;{H9he|E6cxq_%0Vfkl@NT@mgo9Mf6!>^LB-bPwgvFBDmq zr{AtaIA;GEq~Jt`&4}F5PBGQ(V#>f)Ft+E1-=i+#=DGmRS$nI3*kiP{`LzYY45fXf zk9%JK7=4gcfiiaB5n!8n<#SuPts3KG2;(m2sCXtTx6QXjTQ4xIa>m3P7mp}*VHLV# z6QvL@V#%>8EfEunQvL;Kk~3qoAO)HwGX*+(#U;8?@j%XsL|?}&A=wj|pl>sXSn!in zo7YBwrVf+dY6jZi0N-3?fq?fDT<(sev#_*LMLlFWlFnQkswUL#>;s~|M2Byk} z{1BHDYd_wkzzD4x9eVLB=_hE&8XF(7`v=C?L1rzE(rGdY4Z|}B(-XE?m z$)+A7i&6QEYQFHoPT(o_yua}t6P|JY7v#KTzC{ZfEosHh@Xb#P;}#@v`jNy zgv*qI99z16>B$W4>lorpR@F3@i{X>M9is*x8ICNV)rK*#nJV=kpH&Oq&BlqOW02@jtpRNlcyPL}_O7YN&OuyTl&ThVB(ed74{5h1P zwB$$sIuza}V9>yv>oYXWc^0oSdijp882dS7S=aFQ|s&Z zy)$`5-~rw^Au(jq-f#KT65>~OspK;C_|h?z4EFWwviy;|6%vO^Ko{hX!Hu8Odv>Y6 zJA%m4djHL4c-+E~q1-K>eYi@sVq%C<>=yYBx6+=Fle3%zao^Eh!{Sv%!`&9c*$rPM z?rO#E1t@n`Ni063>R^-i;eciY$~f9EULPFg!@mB=^!@0$wZLOff=h-;EOH(eB38WTN0eqn}NkfB)uxkMuxX3Lh`2j&cFdGFA2MaUlx&=V`E! zLcjoSQ@k|pvyY9bQ%27;lDa}JZUdhG%3N|$dzNu#eHtTPiqimv^h7hBtcOumbB=$h zDDdE!BvchV;cU}JRl04<`89rkf&U5dWe-Co+4CDS`klz#GC73ab&^^+2rO4v7fU4R zS@AvkC&yh|PEQO5sn>m4>*0X$Ch4%Z)$tmG>$^Y_h9_|3`p zCS-T)fJ6;hIx_TUvop5TVy39;OnHX^HU1p2p=db_BohH!`L?l@ph42^krk2+1bsTF zcvip~kAPEjsJQ<3yFLfA%mHcMpdx8p|Fr-{^eS7f?y&Va*;gQj8CflR;iu~i3JKJd zrJF$iLyZ_;ak0?$C^SXSmBpMtMeiq-XwZV-9L*%*WZA$iD(tOgZmi;a{j-vHYAUS; zqx_w*0UvD9oxw{>>8})9*s=qo8^&ce+>m(ObkAz=bg>yg5G0b~?*WUx2njl{uum@j zEScz5kRvws=Lj==nOm@F)9W6~6eiV%w<*AUp6x?yO_K-X{xQweM|(wR{~AR$14b4@ zwM`!?D2dClD&n7)llwM?8}F^u{Mo^m7U;9>ujbGS!&^<7sUPTRr|UD2OcFKZ&pJc$ zU;ZDF(?2<~_JWv0kzmibx0*CACx2fZ3JnYVIMH8mEqQw9*a)aujn=%z8Cj{RXvGcE znUucdB>GzEV)$EC86~P=YqqR`3z(oN6T7Bl>M)Q|ToPl+Oid%cTItLb75*`s1M)m- z@7QxuPyl(d93w57YHDK>mYb`+xtSpBuq+(-`V-JXZ?E_FN?yU3cXWM5)99D`7j~{z zlv@{Vbvb>Fw5bil(&?LX#%vU)dX5j-uYNm^2Ifp!yY2t(Neks(2c8-dshe@`y88>U zKC;u7=nJ)PF*%Dl2TcKMuAQJbE!-i4cI+u3{;KFh4=8+tF`>6tfd$mqT22b#NpTf< zr%iS9vl#y8d0P533513%pS}{Ofzds2!Eb7KsW!sTc|rUCpep~}GtL8m!?A%C9-ELj zF%W*h6OlgsUQ+1O_WemA;}zxMDF{8>iGG@78AGetbExzkjnc~yK&PZf`tGUc6F%bS z)%2GkOi8iVk^^6D^{Fv%=m1F{G|$ycTog1GK4}*1Iz9uribJy~)MMw1nHyUnd{9K; zR;0J42Pb)3Zy*LzKrh5w0t>OER<@*=JL>Ou(K&Lkj~HW7IU-6rE}rx|$W&?s)&v`q zPO^o{Dnnud&{Pn_wmh0&#+`X&HnQpXSYX^4g|Ax{`slG`y&Ly+XQ*HTNm;8_Gkf1N zo6M?B99;^6*Km>eil6~pgAPVwRt}u$hJvd`J3h5e?O49(hNAKuXeOk%(OFV>?O)1Lh_3^!(81xF~j}Eks6a2h@(&l3Lz)pZEH2!Z# zf*kYxH-K5ct2s;d=lII|O!;(~@$)*ge=pu%`E2e|9% zW1bRr>$PE*4q8pvuF0M#Md_lN=v=$btgV34PW6c+>OOwsgG~fY`kv%A$$OIw?w@J; zhK82rxkFRy@%M1F$900H8bl@ zB0$zw>kzPHgfbQ{yysb5uH#X<4*z3~$0}1#FgjALq>7`oec$o;weXlzy~L z{T`3CL_pRxA;=i|9G$9J@V)+rLW}YMMQPpy3)}wpM*-g^8O)w}OjB}8v*;CcLbRP- zFiOQ0*3^4vhCKDk zjxP`)CtS6>!Cs1J+Jp7VcsmPCemUOyXkV1|Z+WpR z(uBVG6mh&2F>k{X`ZAODo%S{Ss-s@4KWkdSbvzPV4Z94|x5b`O&~J~tYR6VHqOZ;7 zc(a}CJs$b7(kg9Xh;DvtN**+98!eB>g&paGGE3LXZ7xz{YArau9 zc5&961e4<;BcBE^rI4sU4iYDliCc5!>=}N!f9uYo*xsv~l)KdPVeoUzc^}CvFosMM z(q~YQzJ1C6kF1su)C2w_3oK&fL%-Io4LpW9*tP_!WxE=nAMt{|Z4;I7Q&yQ=y1Ck) z{d1e*S9%9~97~v^2qHfNrMjo1iX7DIZCOL&U0vA5c-yjeJuKs z5jPX-L}5cfZH%TuRGk>QAP2M5wFyvFh8&MH$l8wTERH;Mo(b_0eZDL*tDdMEM(#?y zV)d$>M*7^kJukwBUud?J$XnUi7CHKvSV_rMemi}cGix-mwh(@$c7PnA8@_6zWvOlC zCQK_M-S2b%(9+}?@zef~G^m~05%I>vn@zAKD3YMkVNs{$HS}Cr3kIUkqRsoxtWL}e zP5gp4E;2v1ezv?2^nG|dgoy&m?NS$9v$mk3eRj2-B^cNJrYoPT#k#4Rkd$g@ z2Hf}~sRn&pmHFWjRTS4g5vN`PiqcFxWBUF@V~ag5H%-H?G)LKn)e9T9OgRu%rkjlK z-4MuwT=TyFMDKd74KN;6UDS^z_jrL0;A;kQ@J=PYk#;}$GQPTVXE^OsOOfg>z zn=bLUXnX#{@vEl<@zRQib!U=kzMB{$QuboTkMmoA+;O!F{J2rpqQqu?Hu`w$H}i@a zhp4&(UOf4e^AfC6UlWeS`2YAMhxpYLRn_aplune2Z`JqD|ESv%!!DB5lOiPO6(6pi zFrs8K%GO!Y1$<8S3qJy;!Mc3+42&3w;Tl@@E%P+n&FDFh2X4G3PV)YsCBS7Wu0QGvdr{61Ys z)yJhAQ-o0yY)!ju(`}=Tr9|`Lm9K_~4cU*Ej$K?0zX~A)Ns3DxgOy_QLDyPiV*#}h z9jXF+UoW5P!)qke+NlrBR(9N=k+&9Anq(WZOO*VMDEV2KD|2#S5L zB3Pm+`&on6Abfmkoe=f@S@XDAi?e~V;un#bQm zqu;T01E6jo+9#IWrSmQO)Zr)y&=GH!5Ivt&ThLRqes1tV;r>bDmk+OlXmMFZe0_q` zAMX-?Xw~DG^xxg^qgK)dq==Ub!u#kRA0TaMHA{4^A1?hm0JS;o!|^SUb?tB)c?7ub z&(0^gkForY=`gWwphnOQ0JIVSbi44f-d9Thj|2s-VrPOaGt&X76j4wHA8n#uElHj} zgRr#3LJ$0B7++ZZL4qd_&b`WgueyUE`t`8=|+p% zz-ea`?-VN6Iel)+|Z55zBD+`t};YN&JVe-d;T>giy%_O!#tzZ?J%wRrQ@An zP{c8`oCX*0I{E__NGX$0d!QZ$C++z_vFYaLY}}zhH~Y`P5^z74?_{g{6!)_3gTUD* zzMF9w5RN}kD)2Kf_wTtwsb}s`!~t;*WNV#$RcY-m)j-5y znVkO`kj1-v_kTd`Zb97<`c)-N_A)nz8_nQ5B9J{#c3$=iX|)kF@^bm+8?b68iSkG+0tZT_7wkCp39HoCfv&04LJ>8o}^-;N)zCb8)}PP%o4-RuyL zC&u>}kLf_{^zvn^U+`tiR^I1QxK>PA=j8vpEdPB0oe8(rx#5o~VO9kAEt8n=@HoJN@(@Hoo03PV!no=wnvQMr|hrXX`?O^if z{b)RgtS|toLS|&WNo|U>|&Z6U}^(IFHI`;qg9l4BbeaHpPh{5qem5E`5Mn> zZMXy!v<9Ghf1s}g6soEZTMm&nc;tQ7X{pccXssHUDyIKf;hK%#3M8k#x-mQ-%Ab_c z8XcWUkRxqfJr06w{^DmL9|&Ben|0a0 zqDH&#j&M#Rn4$__E-rIZ%(X+Rh4Ty5c6F@cavw=_0sB8Drq?z=PPEU>JuBT?^|D;H zE&=Wy^P4VItr(!?YpZRrBN@BpK5R2{mBnI4t!P612&+5HqO@3~`YBl+BWv!}bTc8q zB5{=h9Oc8plF!%ML%(l}WQa4b>Y2NPr3VT8{Pv537}zbc7B#^5es>l~k9GVzo$!wW z0#xxbf9?-?c>f;1YTZJky&j|RCipKp)}D-`z|P-P=~b6sabG~MOJL-JU{(IleN%=3 z+%q=(?J2`pzHb_@W?56$%mOs?KSd}y9JvfTvYEX%2#~~y!)$8EDG&iTlygh9#>O>U zsw2_M7%f}ZVLaz@J^w|^YmsT&@WauM*_O!_4B84+I$G3*PIVsQ!}^AfF2AZbw3I)n zkRMcuAlFxIv?MA&jmaywcQgQ4)_E=i78&LKujtGfjpAt-2djp%mZA#gso+l}>+dD;BzM|YX{$)H;!UzMp`@v~)B5o_r$n4s=9jd{ zYznid!z-CmOGVU!IPP*{CqVj}BK8{P-Z{>U!v+t8{eDH z^!1?xnMM#ZgM_{80Je)SCMH`ie)?~N5GscXpMb!NY6Dm5uhY}6ATr%wkGq7 z2vyZFDhNpRqFq@{%k|TB^}Njh(bM&z+bM`zrOOoychfPh0W$1t@#s&)Uc+y{NBiql zGD*_)&B-K^R_}A1f0TfI{W-mkj?VS4y`Mt!;c5S`N3VqSVtBgV0X%F|(n7Zgxtb>0eEZyo zOZ7CYkAnBlmh}FzGu@ZjTn_QIA^UgCH8}5vOKp)gN~-^vE*)-j zrUq;%dL1dKw?FvUvBWQHD96APD5QcEe}Te-RoH4yJay{rf@v0*g?X#~)nfohbLaxT zMuJ;Esl4_J)mRV-=NHz?Dl2Qtj+E#fut|D=oVez3$%vW3$+@ivN?rUO2XoPrV&C9} zV!iM{pVfvr?R3`-Yybk6wRSApmE45Oz}bhRHQL7T_IBUH#-rM%(}5!3>i@^|H~#rc zKs~#0I(Xr*Wq5gd+!Q_PahV_Zp*XWi(zY(TV>#yD@E4 zOuW-7DrxF#Z#NN>5)VUT=m+|O0*2DDg;jy}RgK~w@F4Nn^QVTA1PjUtv_TEW)k`ad zm}dd9^Y4rg40x8(r~3pAL*uZbjw^SM2f_yE&2o5);o(!Hovfm-fy}e{hi^ zY5r%yT40!3eQ6@KqT|va!B%+AoMfV@SMJD^2?Fg5|6@JRs8jcQaodyME~#&gG{IYH zI6nozp`>!WuacJTj>1^?EDMG{WH>L%Enwd|zk~gQU7Mr?#8^$ZOeIh>WNsmSGcTxzpNqgIVek4`7(M zX`v88vuIjGQeyOK+r)q}7LqT)8#iq3K%Kt@6umO_d}SqZ8cNYyo<{2>2U4-javrPG zzPbu_AUTotOC1lok&fNwWKBC)Qo0%kO3eaD#&YZ9?N^bNdjV%xSNT$My!dgaY=C$a zOelH9Lrk0vz`nu3nAhvfl6`BDQl0KC-eO2|UNE>Vq4nGvK!+pNPCG)qJ&)VJ{%U~( z1w!8&4_nfcKQ{k$sq&rxNJ84j{e+xJR>}K*LPt}J2r<9wml1nFq0m)lPMM}h=y6W$!#jHTJX!fU-zwjK_3 zj*50zaY)z+3RCLxdlDj$N`#6)ZTJzW^KIt(Ti#K}$&-33)$SM_`4`I894cShdEsnd zsL80yFwzOG+@4F%gQ%fSbruRB72GrlqqWKs3g5=Ej$8x&p;AF|t~o$5Rr)K9E`bPm zBea}J&^$w5hvN6#a8O3{L~FpU&;#l#RV49yeY(8Oa>a8b7v=AFo!8Ivhz{I{&#A^IZBWr8+!5 zMI&b{p8>0tlbUa@UW8cXzCzA7567LlHYxax6;{y;8uC4QBS45Rb2$V9 z_{0jsm2-*qlk!suLC5Rk8v#uB&!h=`($6V3cTB#X*iN&(3e4sxV=Y}|n`g@Pd3sI; zs0KNmXKh?9w&EQqo0-GaF}r0Wg4aIYG_;te!32lTLoh&~c&L%lhue#jjKbC706V7P z5MsQh6bV2+lv$PtNUnb@t~;|Nun%!_@Pp^xR$OiVlor#{D}*-{D6s~O;XeC)lV(6p z`6A2S47I?}?QO)#+lO_$rv&&wT5fy#!%hNA-1l?Rv%8a7snPQgD97L`aO+ymmeN?| zMop~R8sAdK{RLjsh%-ySi;c-Y@n89X<#N0?-J%4xS;)@4vE{xv+Flf4 zs?>kRy}uE7)ELB^=9{*3|6nb7)9&6n63hHQhTi4yU}rJj4UFqJNL^{5juA#M+_SxB zhPJ?01IkLafhZ(kEqN(D>l03^s-v61=2v41Sr+Az z{Tv0_9Q(@!whr18HhRnF-*!mO10Sq4$8rW^QN2cpw>)`X?{0u-GAY;-elHLPcYlf= z3}%JR9w>o0!8jr2uUXkeDhfT_FiX<|rW;Hx3^QuTs0q!U#G7X)n`tU0ySZ@>btt~T zT<8f!m(>UCCr@=*^YV~Ul^oID8{OTdEF}X|Q|?=ul+$iBsHP{HzjsW+^puwm?l-Ff!{kaTNA}O3mO_99 zcU*`^x;{^@paBd!qF@c*YtTc5E3ZcHs>Y0=LaN^HKczff`areIEt#@P+m zmHsJ>(C_Zmx}8i(rX%HFX{j7@*BsWuz|4{X6Cdx!W7OkPDyAwss)B{#_jg~92z?9$ z9x^_ewq0WBvr^CUauUi}(vs%)ha4|LLA))C-y(NSihQ*{ENA;51kW`og*LOjegsj) z1nnylKmR2n!`F4ivWVnk%IFt3J^K{PXny;>m5J6IR>fV5e`i8PI~@@j#UzxWq=@$` zgsDS~@S}7L%Ama4PyMH9C3^_zj~TR}F)uY2pPxX?T&P28SQ%M7Jk#}3pkMnrR1Xx- zD6Z*d#0~4kA?~2D#*Ha!?#t3Ii&4o3R89aubYi-d;lXCkFDOdh*a9ncTHk(38SX?1 zEF&~!Qlu<@Nq@exVRkKnFQ}?TRFszw-F4u48;cChaK3tq|2N%~ZB%k<4euB7VOg>T`Tw z>#$*-aJ)Kr>v_7f^&c5-Ufl!SK3AjfWG#I$h9U2NN^2Yj97mY)vid1DF!0Cc8K`43 z7Du*U3g-_A=-0m=WYK+@%oe*E^6XK81)DPfu_ZKxa zIHBGoo65;z@8Wm+T|a)p>vg=o+j{)W&b5Gs>U%r3_SU9x<9U)-7StI1Bof-QJmKh{nH(t{i!;#{E-}$awV6f4%d2C?Kz^1B2vCOn0m7}4UOp~Lm z;wWPxGy3FKo%7{o~QLsMUGm5^Lvl4{`^MSb8|D^Xj0-o zI#;I@;fl7C9SlIS50t5PA{%vC(~1&P4a_Xue#FB0!S75x>SzZme@;^sm+2O~D-@0h zEdp0ng$@mKRXT6!Knjkhy*xd`cZknEE5U%tV&{mvvZ=DitA3yeD?*FKEQy@fcTzhu z)n+~C^>l^k)lY{5F0t=6i$I|lqd;kSBDd|uFzX+_-~v5ef_Rhz!GKFt6%^2N$I5^u)Sg?>%+X=;sjoHxJ9L}`^Gf>*Q`6!m zN`36G7fnPl?#wP7VJQ{O(I9GD#L>{~_lM%{p~B513Xfhl#7kfm_$MO=pu69mTg@=f zYewPH!N`Y|EoxzhFS0AxDBMSjqk!XxwA_`4hh{i*Bzjgjzezb(?}6li#1GCc0@TKZQE|~9@VKlED)pZiYyXp+ zGh*r150wdQkLsH>bBvxgSQK#d<-nzRnpdN0F!%>ub=V0aCSNjw`3Ei1k~S!Fo0vW% zed!A^PtbqOTdU7(k5{cDTxx1j@;(}Jh1@dPrw`k=DGAt(>HHcQJ!norwf`X(!Ymf0 zfa{EgC--OO9p}-K(S$1N@cubYJQSNmb)jHn-msgPw&$ zs{_h~NgV|mJ6ke&8iRdV*HcaK0-NJP#2m)_JFE9Kmzus#On@e`-7kj|X>%tNX1|do z&a_(jEiCd^T0z?nCWr$0x6qF$R=G+O`l(YPz?fdMt?&j^v6a&}Hf7$7{X)wd;S$EQ zmaUqWmCAwm6pL#{huG3!J05mKkX+e9Vhj_nv*Fj`tvkX-vaLeU^A7j&C}fy@oZO%& zMNMd$)x`6q-^m<9&TbL{00!TFL)7&0O$$V(#%Nyz1KjOe4k-eT_!u^3BT3WH2$v?y zrfEpQr`t$AQPDnRL4_XCnoCw$;uf&N8UZMH5*Uyd@$gr*O-%d)MY@m$yf-)M_NE7_ zfNjPR7!3gU1dy`3*nRWiiZy0RrH@hP6*dXDuF+2gaIa0W_+O2eJb;pbgA>E@y= zE57WjFFloXA5<>5J3P@e6l-m}^Ro|+8Cv}AfvQsA`6iqDv~n$eIu}!18V{sNCy>)p znIAo%?f>TO9$%Y;`R;TpvU=PV08AiYa6$`uvt@e-LDdI!2W)o% zTN=!+y9;Sq4-tkE4Ipz+LoMUP;BQjuip7@exw8}si>knvZ|H8#w6zegEebg|YkSog zY^&2iE7Yn+7_rhhIw^|pDT7lFW}d(g(2tjOWYi=bp#hj+Pw)F|ctz6*3qAyWv~vr{ z$-}e+VSo#S)eg*`BU4VTZGHp^rejqe2gZo1YgKWW0&9VjfUGU1ll9E*JoRad5|pK+ zoMTveWU~vgSx-?{{n|ZOWy$F|fEtjLLWV}UEA5wL+z#deznl+`ymJ2qJZ28ry*{M_ zlm-0*61yL7Xdk0h1&4oRPu`6_J{W6pY}Ow(6a}EqOieK?-TrwCfX|!k#@8GMwQ7z& z70PtEK%O076@MT}zwNN}So-=Ajo}{c)7{(0%f~jYNU45p`_|{Pjsa#V+bN+N>e@(X4a!!CpwI0> zGC&eLckR7;7g*N$?}nFr0H49gfz%BvVC)sY?wb5(8~iufleL^i_RVL>NmW~tb$IK{ ztJslyAABr&pb*jT9sRrWkt~zrZi^jpU_?bL*X16BEJRD)Gb`%I?_X;_W;U>%7zXdW zq+8W(Lr3oRs|#FDF7Ic6XwB`kZ%5K?v?T3f`y zK0&sXF;J>J1;!^*sx zD(L%5itQzKq!BsbMHApFAYoPdNk&tyQ>wAc-6LrL)88npHFA+Beg;rRPW4^`heCpa zZ!)7k02~7rVY-RO&#t+-sDe6ih0NI1t|3&Q8PtrARbBy$f^vW1IHggQNsTEcPh-e& zfBWgJvBY<{K@L9vOez1Pt|TR=E*c8@HG!Ub;LBHKR8Vml2gHT{<>&kT7+ms3%#bBV zW&$NQspQMi>A3s+%%uWZekMy^Rf=AqZUT?Cmc2A!iS5JsgO3`aHu{ni2wGWduq|6p zxO_kWfV#7DD9mj~PLcI$<5TO#*V?6i74OTl(&VKFubA}zLRJ5DhzPwL8SjcEqYivo zv0QsNHm?$O)z5U-_0EGUIEqiWv5Qc3wSmcFs{uPR0EKcH<6Co;3jGs~M}?A^_idcw zWXfJ!9bJKD<841@@(vO&HjfwZN zwiV(xhPsZIi2boAi`iP6 zVeddKO|L4kee&OGy#cjEY%|d^`ZONn3{TMA5n@7I%L=A2>zMdSo zj!00o`GKM4gXb^rg=iM=|}9jd@E(P6dM+=S!t$Pdw9uMD3k22?&ZRa#7ijTR=gjMT)ti#_ol5Uovz` zdS{kqzsu6~0^IJ<5LY>1CEMK<1s>Zd2`qz&k~ns15k54l8x;)TRaDFuV$OgGc1F+` z2un&tnk&i6V=Cp_0Roum(ou=@(dbdjfAL%I9fPK)`S9=t!y=yYfTtqOQycqR_(Njh zfiq!Ss-zbXZB19}Px)|PzjwIr&@pC}(&o`*X-R!>t1oQ@b$b zTxG!Lh<4PN^kYQ^Me?e}K+k~PdF`*R<8>}sb6U>-emwt;#T&K$xB-?AN%V=*(Haxg zx!v!_@pn7`W!2`&b;CFQJZMGiv@stRtUkyvJ29H}#kP`M6oVnHZjP(QKD-UJoDYK(d~GH+YfUv8URPuKG1qfAsMeH5+sMcm%ND~`g5|*tApu` zaGVKbkohk)B;}TvhdLato&9B2`K?g+krmlT@@HqgLWXNnYvJb4(>$4l%BKN+jG_}r7i#(2#h^sQgk>wr2i94B>FN!%LSe1vg|(>7XndYSqAS8&fQSOnIKE2YCshwb%Z+JChcDPAQ`(D-%9A>Eo2HqL zr<_#P)eQi2yz|*0pv>pvDRjtVZjaDgo)d^TVS45@b-(O`_`KX<*(Vh}Elk(tf8hmUZ=yfbV&`_|iJ7lB8XSU}2 zFGKf#Af?G*VB8Egr>G2i8mJ^4^)3pM9mL}&h*5O+(w3YWtwe6Fk_+MBzpU}sK}f)Y zV5Rnz)=AS3GT8a;LUNnx9A8l!lXTY>wiOX7=lnPcPS&;1xTq?GT$XJKF0aWpba*LLdPhK zoM}UR=(-Pn42J4X)up+Ajtai~NOZ|WJcp9%S$(IC~} z8_wyE438^Pcg!tksea3&5Buz~gL_sbtO@LOrJdnN9#oO{4@$ldXU0y~aS0Vokn9!| zEiHqcJ$9#An#*!?C-(T%)zb7Oz!|=Ys5J~PYO6eWDO2-<1H7rq^u?|wl;B1t>i0JW z5%K$N3o;MEnUFl2*P8C{7e1S0jhZ%?ewY=|w{kOd#Mf%%?sheFx)$$EpqW5hgI$(h zYL*no44ao9fED7Yiyum0_lJaZ;Qbd>iun)#cTB$tB>d5@$1*FY+@Jrj9QYEw)MaN7 zdm!Ax0RMUh%;;*0v~laOwPq{L`nGHGTW8o)Kwog7kU8`PJkAP|uLPojPhSQan#oXk z*50UGE%V8>Ll=aOESEMf5`}<;+`NE%QR@rt?yEfzqG7P_Sb~$he!^Ot(7J8&H3*} zTG@bi{JN z%OyTlthSng#BQMju8vH5GKbv2NPqh&w65J>^0c1gpUfx;YGPh9bWw0p)j+cd>}U#+ zqozusz`ytOVtw$x)(Wx{RLh0ziL@;lvq5&*%YhRE{4ah0y&2&IqMcO>-eJ4kxMUdF zmp4_;I0RSCtzZqi}k?24AA(v~PZ9RdCNO`RGdDrP<|+LFxSgRmP!7d1BI!!o_?+i+53t$(;Fx=wDrCLktW z1C~O-JLNLJ|GAbU1oHjy0!R&r4OndCewjXca{A}~F4^yXwEhCYel^$oacxVg^{efY z8)@t9;+h#B1p&2iM+^`vFSg_Ps$$J&{R6G(t>;#S9)F0)^pxOFW@rlE{agyiofMo?MwXS3)SO5TV%0{d zm;0Gy!!?KmSNA$3g?dk0T1?S;^-5s2$5p_~h(EgMgHpSLdRE+8cQ%aAx~!X;U_r&f zgLGz>*|sRn&}DAyA-H_n4Giy4@aGZ1T1@u6dOXx&9GmeoiOvJ$|0&sn7}cIS%p2Ja zeH~A&vI@Liy9zRt+`Kj5rN6*xR0F7{qKtC7_re0;pwXg(t0*4(;y23piaPA1Jzs;N zg~}sT0jX%IMY$Fhpbtu8bJV`kr%zwSsE=FKnN{WQJS35bA>Z;YZ>CSWindXZac>$dxQl{|m1z}e4 zL`?!j`NK~7r=VJx*K@5HgR3g3dt9`@dqq~yQSU$f+Pa3p@@IztPhM)cm9+Dj(}4Mz z>@mPZhQhoL;uPtw0Fu6KZ0u!_Y}(n#!btk#weAxZlGCv8h~vLy_s_Xo@7PoZ+1H(* zBdyD*)QkYLE7>*!j~P-;m#+Wr-gGAKX6(dEs;g0&#Go!lFzR;SHy7}<`~}Waj3AI2 z@9&Hxy|b-9WEN!L6c)Tf0&MW4ZPZ(TPIOz>@SoZ(Ibm-GIG`)@$a3!Xge~}t&8w(@M zLCdavDw-^2jwzG0p0qSHfcn(Y$16hjg4W!}?%R)*hpH^n#r=JH;OOT-fObzt`QY1% z;z@&P^99h~o_-1U!RUX}r?7^Z@B5&d8dn0^B)S+SApA=8frR-Uf*c-`rj3cQ+{|EH z5?9ZcSZ52+jh|omG$mQZ+P;6Yll|&{xNU&6i!MiXCV++!CN9s(hz)u*h-f}@ILPTh zGSJ>1H}W2sU_X?mi0T@9;^+tNP1WyySMk`}@NN>j=A1rOkJ4n(G19gHaUGMhx%j>(Of^|w7iskJJD6qOKrkWK=FCZyssZ1R*BCmr;X9h`u%S)Xu z9jNfUicQl6>HJ6&N!k4?^&OH|>xg93v$wKQ-%{@T-x(tgyT`%TJJU`&V?Da)PwtG| zHSB>v#z_*R$=|EnvBR0J8UTHQknK?CRI{w$xSJa~(LT#}qB&|T*UR6TBae00(cCvG zZC#VRgVjH{KR^jYn~c{zzQ%G&H?s7am)a4*EY|9I9<^y)s6^GjAK{T3PH$Bk^}ntPRF~T7lSk$VId|h=TJ? zm9fC=Y6}e7rbQC+M8Tya&`XOn^na)? zyc`m7o)?(4Eom1#K&f#W_WS_h6O??zmCQ^1&167${u7t}SF1OAABpZ;hVL;km8Wd} zUbStD16*kRA_0J>0MP`%2UAgA*8w27J*7vKK&?DzcvqXQ1(aNk#)Ypr8hyNKTVPHFd`vmJjf5w&ib zjy8N#S$leyf1!S zVUe4^&BIw9$T2b&nwE|uU#g5pyyq$gD+pSfQfyf$8!u+=7#owb3+kF-QK_ zKp+C{^%DUGi7`dctLgrIZq&rJ78u$E5vjhABp$jc-YykPA46AD)R`{?Bzp*OpsNF{ z|KGbP&mB;{NlRVCBU>YN;|3oWRkso z+~pxVN!Yy$lD`Z7~)rUW}~`zQF!9PLtCl6pCb`4LA_CmNwn=$1jK};1jAEB4)I+ z7Fo!tGX{8GnK@Uh^usNYb3>X{Uoidxht4Ta{&~2vd$P^(n6G>$E%A19mkfd5>^5JO z)60ItXzuMeVaz#jq4Cs7hSU7l-Trk`!lI&R`0lY<;v-C*Ons3W2O<4XmwEfqTvg5& zJp<^Uz}vAwXD-s$mv6yHiVg9MOLxc~cbWGkA429#60{NC4Zl#&qJn`}Tbx*j1LU@i zQ?E7TAAg1GNl_5=wrlI1pYdDovfCgMqlLMq+}yoA^p+vyZt@)q$J03kAiVuo=+>fS zQ{s53C9F=EHGViXQ~!#}Y2+pFS|VdKHST!k=RPq*#7!yug|s#B^-j}m{zyuPOrfk` zKFr4HA(j;l3)1mQ#vO;>8_MCSkeiyfEDUsXR3yu4D!|LPtnedgX<`*~>BoNk!^BW{ zPA^gB)Tpep^phbwZinen*D8GcOXH4bGfN09ZTO0sjB@_W=#7_sJ>Y_MmQWC!(J|$u zZnb4(d2Bb4};tBycg{&UUy`5TgmiwkGEFWg-_?lQsyc&IkS$B3WC?|SI>Suo15duE;4q0 zNL%xj02~bU``XWdlNK{%c6|o?0kblyrjADNLb78y1fg1@7OY%FOm@@jx1f@stI@SdblB)8l*P)>r<*(%7FJ^bj^1+RcYv##waqk{vgo+18#uKB${`m_#^1b`3r3 zAUAwzOT8pA_2n;gH+&K0>3(#MZaC%kxoeaVr)Ck$pKi~4q8%QJT=vusk3~~|$nd?p z^JvWbmiw<_HtJaF*TNUl0>=Qx^}}U-W~rAS=iEXSx>n)cr}}y`cjsR5{^r;W>{h47 zAQrEE_o7V(HKHU0)pV>01)58y-1vE6L0k@M?C`Z_st7e8?AHNeL@`oC5u(2Sx4c}V zjPct8=L`CpM4W{?-Q4d?Jaap|l7rq=I|qFOnd~bCK|GYVn8YhtURAvv9JtIjC6<@U zOWPLldgeMdmwsPbbneZ1csS37%$h#QPDpsvMvEu%a2}>C6yYzW+f+7jjpn00W_=)4 zBfj4HXEoc`pUI;&EGu!t=r$zGr%M7hCBx!WygXU=il| z=2N@!hyu#mBKFTh4Hi2+uO1RMb4>kl_)pq8o9@p9k6NE7%*?ig5z}1Gw9;Ju5;8|K zxB#OnkNq`)ww0Ib2ro;1Ku)F#@Beby8GIjK=& zlLAL^-KThL?AhFL)%t|J=ZN6H3b1{D$0W(N$!uF;bDmkQlq1k5HqZ#if4dVqI5-$R zUd7hez0r|Gf?kRf4qg6puTif*MF$=s3AdPEi z`0LnFUgl=D+|w5<%An~Z4-eQG4;QF`o|qXmQc+da4>oyLuGU43l@+;BBD!!E+9{i6 zDJ@^0pR1#6O%2z)SgHRhOTgK|JOg>0ge_Y8+g37;-*Z)Itffbjt1DS%bIi*k-$0cf zgsdTLc23D$BbcwcwEZ0P+c@hY_YXTXFq1o03-(a7iE;E-G%b&t?-1? zOVL9FNk5*S8ZCZ?4cHp4*CY9)@^o)TQRc~A9Uv1pi2=l~tl#!k4p)4ZgAZgzS@QBI zWDrT#<(f=VfPh(=wt7a+#`xHb)|vn!1;GFZO>U;!q83!!BxAl;q`ERRIL+N>t~!}V z@)P@KToQfEqUo=aT5xX5eM}w;q4Nb3{mzraVZ*n)reCRv{3G{*N0EsWwL6V+a)0xl zjPnnc)}FB^I1rB1hnW$-Hs6!`M++Wb_=VX_+uV>c-_h{-f)8ti{UQ@Z+e;>x?h20_ zwu{~thc|I}eB%}?`a0I?)#X#8oIv}YJ~SOWNC~-ZcY5qjthI6pyP;WW4;agAl} zIS)PbNY*HBNorfE`{I^a@%e8BV$8Nok0tWG*@VOQcNWRVWb(SNAn-MN=Zkv?dOem} z%=5*}%36Oc&UP=ZKhcMB?gy+j`gzr%@ye(o7%WReVYKROOx7apV#Fb1INN-gWTew& zb^L$5Sg28EcGP&|GfS0zP0lFFe7ddlO{$PKk>N)zZ~8c5?E;*PoTmpOh3lKDNdH zE(=cpA`A!U;?w;Ve&c=!CymHFU}r{0Q)qmc!BDXWkUwKByhPoK6m+juy{3oT!k5== z2+Kp^T)G1XgCx(E3Uu#{X0QWeB|tH@CJzcyCTc7+&; zTXev6R*5wB|MYv4()rQ`6ljj(yxR3hegQGMqmcJM{zmN}|Ijlr{Ne_;v7JP}1A}^iVc$t3onidOC29 zgNWYD{4UEw6hS9(YXQT`sh6IVJ zDPvd}SrBng?L|q)add-e35k}Ki?2%S#rT-XyuBTY!N00A@{1YN5Xhz&P;gKEl(l{* zTxOveta55eT0!PA+dAp4?4uyR1hWmY)UQt#Nz@>LpW1tqb? zHS@NIuMT&And6IXS!lmse{8FL>m5O@C51TwyN)0%Bg~p2PK%!pft|xaNZ?3}6ivV4 z+~j7$Kdz6Gd~+l4Y(0`cu8U}W8XI}Z4MMVs`tv=g;5FFk#em+;33z}DJdAMEyE8GY z&X2$m0E>WjULM(!?&G7v9Z_cxqpvgOetd^2L%U^$FEz(`we*Csomva~ZNH>78T-8% zsM))th**bE*~)cIgFQu-I@ZY56!!xyU~*!6T#Ft{6wc^7zVinOuRk~2b~(BwnN?=T z^g&6BY%;*0t~r?gHMDhi*HvL~@Y%y=zdvhfgX_XpW)rHmchTyELP0>nFb1HyKzsvw z^~8I;XUm(hhkr}UNlvbANtu2={FA;Oz3Se=WJa>N00Yvz&9A1K?Be69Zga5}vb#!7 zRQMnbNRP%^#p%Xi{(s%Rxu>|_W2*{NAsU^qB7WNcyq&erU2d4(%C3v(P!fm1hA3re zXWocMhbMGyR8rn_Cq@@Tg24E2`XZXA$l|1xPkxIbloLXWFIlL0R+vP6?uxxKj#9@l zv61SCRfuPws%iXvmSl^B5c=zIWS!F zz2{5EH{(!-qBKhwQB~UX%uF2Sp>{{}J}p?lV5Lx&L>y{2{SDD25&!Y+%+%+msM)Iy zG5_O8h}lDMZ-*l(24_mhX+3g8sc@Du`bB;-!#$6#zseWV$-wS9uWO`NTxo_Umv1{H z7d3GEl{56N9j@1CDSq=t#e6sJHmgS)h}IjY{=w92ZupWjV!dKnNllOWG)F{hk_1D9 z{l{1w?rNV%BN~UPk4BgYgeZvPJ&5neYp?{ zZvBnm-CQK>=*)+W^Ykat$MmNoD4U=l(YqoK0Y}}$J2IEx!-e;*TS@rOOkG89H?Cvv z6~jk6j9-(BLMz7Yu+bhj! zKLpF$rtF$`!Um~wOu&)e=TY!^+N-Cxy;Dx8l8=Lp-HCIi1*V1VHO1s1i86CID~2Jo zFS7$g;RmjT$LaT#t&dz^=V%-BQC-3A>hL8D5DT}||pL%7AyFtxPw@Vu7T@=SBY8{>bY=;ibJtw+jUDyIhuie(bHH|zUeZKW@8`wG3G)6}zt5Y3KK z6`XIb3JFt)bS|SrGwKX+xZ9|0HD1y~92aq7gpQXEx=?R;UgJ zD^O|rwAZJX{Qb3rb}_3)l;iyG8P!JrF=&TVWRB!#6?c28SpZ%|m4r0BaAQ4OgT{1|<(Mp)kyrkqeiYdmanX}3~fwXWmKi(BSq-qZSj zc!{&O+I@?8rEDbI(d$Bi*}}l7`#zjeOXI6v_}SsBefvr@BIxFa4$DO*!B07VUvSp< zrl|3zZp{Nr5%l5M8;B1W3(j&z3wYX{u;_w=LtHCujkcZ$!(ol{%c#EW zm+fO&Jv?7`Xr2zzJ;P7Sl}j3K?H}`=cD>g}GqS)OC=M^Nb(7MzZcQ89j*OfRc_V>Q zJ{ioD(%g^4-?;54o0)HeI>E^2))ZaRa8qG@g0HB8az@G1^lSGMLv}Th8-4cUew)=Z{86;Edb# zDdy+@jeP$y+BaE~) zI=eg>qS-ZlLjG2jC!N*IvoP___nT1|HH92j4x>D!MB>`QU88{`Rz}~uO0kpIa^Hr~ z{cH33T3Z33OU|8clu{u!NwmA<^ac+mE~?l8?&Wk8bt$Vdf>vS9|?jS!1-SiIUJ)h`OsQ+)Yb~)A{y>0W8ZN>-u<9_PNfd2-!7-6mTyrEpm4t0 z@*ibqIVSnS6IgK367XGsUr$t(nDoN(Q~A_C-q}>UCRgptPQ^21ir$52&M(3*cwdX? zxEzidLy)sg-&TpB>{6*^{J@kVMq`k@W%CV{qyl00I+mfMLZ^>N!tI! zC*eb@qjFhTsbGkMKS(28Trn4i% zLZ3tNZudXQVlt6lsvos8Yp#@2zhbQS03w)J)Z~dHCg4(u0dJ^?cM@qOOhw-r{W2$)(zn&E^yu^4)$nEi_I>ZL=xvwCDJ(yu%r3$(JzJmJsvpVH=NAl=NIRy0ds@@4)tq zmu$NbgZsaENk0fSYZh!bD?n-)IO#D|PNqt|BEYQy_k(W#OzR_0#2cQ7C|}~0Q_kF) zh_^W#`v!OXpqT06>gx1n#4|=$ut(jlIZT#mPTrtA_yq{0o#c7nnzGHk-ULk;_nRZ1 z&-qpq1k=T7hoFx=Pr)971Nbe5J1>R+@%jt6s~h(WA3jH0uO!ojq@DQJw!Xvae5zZUB$m$BNb<^@vZrA&NvH8Pkx6zfP5 zyxD^?UZm1Z?xW2e?7Bw~Q^Z$*z(KBt6$@AEA264{b%S51*m3t$m*)6b_rt7Zt$E_M zWznvl4xFD&H%xSV9~lNqQZ^>1bSS`m*6qLFnM#!H4MqAVIsY#5A`RCHiaC|>d^gF%gRuV zmZ6n!y{g$y#L0iJ#>>TUY<5B>#D4ktaZdV($|gUC8IBN`*o0G2dDe*1nPyc7Y*rHx z%Ots@a=t4fXqev9FPP3N&(ag3sYiUsY}Wg;L0YK}c1h<4A;egzU7y@pU6p@wu}@b+ zdqD@;WTcKP1!Q_#!Mbmokh5(e;@eRwZV<<<#-vF7YrG+djRu}n)j?|R(3#B^rj$)r zPs&TN$KYO=s<8J+T$xCWA&|ERGT16rdX0_6(g~)nkgn~Wfp!&KIyB9Mf$3AsZret} zP0s5!n_BW5F&;-jmj%Yz8q)jx#aA@##aykZ#cegK(L~ZF1y2^wGD*ZX-fMkaps~!x$DVYYwyy{JPtbZ`@%U?&Zb?)hLD28G zT>Vm2{Zf^4Eaix-s5Ci-g=ZK2o;qym;ctz7b8!w8>R52`p!pxc&&;>rnv3m~J(ktn zxgH>SUf;p__vLreC+A}w5OBv%{--gIyqy^P83?54`*q%tXvv1TN}?7?qn7j-J|ok- z0D|C=a=d-RTcqp#kY>hrCCYI%0K6ze8&+b9tlaM)w=jamVl!# zjzXe2O`;c&j}_K3OdJ+~VSO9~E9+~Yr8myR$(^7!D+R5ZRwE*kY~RGTpJ?LL#YAyR z4XvT`M^Y1C2yx8oyK9_YJx!CQ-OF`B%8}O*ol(!8Fv8%MQDyyTf}Fg)-EnUB*Tb&c z`=Z}@QG;s}>J}${K?FUWIj=k%lMHZMPFbsXNxV{~$B(q*~hfQ|-Hu9VUb7H^_oGQ0~P;d{{1{w)xIIpd6K;z!^?RaLs=o7_MhW-=?g3f z^QJ1xN#FEgq=2coG&&GI9hbamI^ow(UYMqvG`04@0f@fXKWhIqNBN2TGqzQN?-kVo z`Vj`DfcO`zInM z(w84-RrF8lvE`}kL?0r&CbXq2xtl1n-0N2`9@oP=dQ#L!RuCc08d{qAZ02r<2Nvh^ zD8N8OPj6MqMM$d5u$45=8)!N}j^udV``WLOnviG@Y96C>sFXk1Yoh=3J)b5MSIq9~ zMUGMa^vzxPeGo=&z{&ydBuOv$um1Yav}M%lK|Aq*x%#Z}_5p!6_13eE0o$QT5HgqW zYs6O@Hlo;ai~jT6>^^ZE$)NAiOr3V63fGj(K5CPgdXu_3dsSd^mb6w>4J3yFXFRHs zg39Q(WD7};QL~Du8S;kpk3#EBgp@DNE0p}lU8IQkk zcO_>3R)?t(`74p=9#N6ISB&hMl*}De3Z&czc@OPogTL|cUEW_rKx?<7V9=O4)5heZ z&Uh)~D`-odLxx+2X*MdYR|I`9*0hXE5BNklQ|8ENP3Lc41t-;7oEtgZd}th5@W@5d zNwux;FH$LHo%K$rCb<~K_h2_9FXX8p5_oHO{+Px576|ibjGY0Uc|ZUB*L1)|bqzK8 z$M|wR>6W1bi)6^xr}q5ni0X~G3zsKmJ4O&%y`1GS7 zFBx{iRI@OEf&dkw+nY!JF)7zI3;uWG)*DL{` zf5%oaBMu!Dx9L$QUi~!Wf~hjD7V2YITwb1LHS!OSKG|6N^Qlzthk7F{|A=WC_{LX8 zw>cch(VPl0oiamVdIcS6nA~*?W&YjDx!T!VKN7z4A+l2g@bmvpdgWF(&{YbD>pHn zJ-m!fLT;rjo=V%^T*|g(DDZ-)>=hLYRum0QP-SOpTYbJhVGWdcMMz2nM=^WX{}MPs zH+sj`Aw;Ow3ua*YiU?t^JeMO&Z&#QLiwtLDWBW7Uezn$+tL^x!RV=^t&zh*DkWhw_ zp|QuGpFFvXKLjp)LHp?^lg|@PsR|awT=8i( zF)wxK(0Gvj&B~Dj;<_fku}mo~zqKt1X8TgJJg;L}oIgWc6i?5V4 zS;FbylQX=~BGaF4-a5+%Fd1c$uHih>AnHdQl2Rz=C@l-<7AFrdSqcdFZdg3#rWZ$z zYQkVtFu9j&Z=3(AAiDs7yoCF)X7PeEXtyGo2Ic17VWF2IYV4OSf2&TGCQwL($NF3) zg#4Q?mvW$HURLa*?_X8VWMi4N1}1e`r5WEud{sT0DgMIWde+mDfTio&Enk80Ri314 z>!jN$HA_+_T<`AzNmfp@t{`QZN0)6oxS_1U&e~th&e)7uwKjn&~*NAnG4TaAZ z^_wj&Zz;j_wm_5bJ#l`)XT7{&5WlA7;za68kb+-g(f{WBzU9IFem zY>t~cHy%OYcks(nwc@0p875g*F8)VG*Sk~gZA6nb?w9gjXC?LHbP};_LDL8o7=ZsL z_0p42(;1GQ<9CChti0`#$9qaI$mbWZ9={m7_TBOZ1&BAU`8M zT2=D~p({>&)&+%4;bYM+?df@nE~n3BMYO<7{{;izX#Upes5IV^wK@WCPW1=z;Bfzh zPf!Z-bT)GbQhiK0JX~0R;|&u@*qpT z5P+ANGhWc8kzzu@J3PjKGB-hlH-%m%prSqV&H(zi;-tq80`TRFE~ud;OD~+R!{&D- zWhLtzUewsEbED-?@;o5V`htXsA`}pA{*kT*5|?ZS)*5sIG|`ZoYpTsc%~|@>x%Vb4 znG08FsOa|9>ixH4Vz|~O3i}qU$O)|CZA=Kz@Cik-b!a!WB zSz0Qt76JKkh)TQXJ=xje7NYNN|D~*wlD?9x4E<}tWE9^5n9V@GMqFwQnxS_#Tb~75 zI!PO4q~sQh<=cj``W&+$_3db*crAXXbREtFtp~leWROWgc`tJ8ybEcdto zmAd{|u3rHXG%ux?$0kFlanDFcDMES#9T&_CU#uZ#Q=PsWhXiGG;VC(&s*z}xB>#yU z-(v6`=o#^_mq8RB<3ws|Z^x-=u3tJ0LL-xO4ryX!E{*QXCM0EG7336~8jI?WA{^{? z{Aug7=GOjZ{#B2sC$h=f;n6>OvA+(#m6l6N$ub10)VeIhr|~9rrK{=Z^B{GUzO`-$)K^lVR6(79MZMd-HsWwSg_uZ*@hO-KVmhYM-7URT55yj_3 z+XUo34*Qr3$PTfYa^Zg-=fOaK3#3nIK(!x)<)B4%b`cupM6HCELx+Vv#`^&p%Yp9U z^m0_XSC=Byy&VDaE3NPd8r)nEF6)Rs>UYv z18PFQLtQ-Xc$dnya{^~8Gn|r?4lqQG4E}JCh}}^0RnP>DNcO}6;X`=cWfNT!a{oyn zFh?IQG3XVbL^Qd1$z|&6Lfvrq!Q@*_k*0_ky{WHT2}~1%Y?R4g5;C?V2$D+ zZGD%zRDwj~Y7izBAax>~GN`l5w=lpY55Dv2(iDo-5QfQc))KR1LyWP}=lcy>1>VRD zt}Md|#|y`L(cn_cWKO--lp5=={jO#}Gjj=(razTd^}8+^e_L*$DIW`Gcr*!4MP}S` zVu3kc#)hQ0mcg6H-+}_{h(VrcmWu z5przd7?H}%M&8WnX{*_cl_%|L{*wS10C4>Ng3+~-e=1*Wo78> z0s5jLV3=*b@4r8Fsd#}h2Ew*fQR)|g8T=n_F%{_~EJbM5h#yWI^XBr#)S>e`tAV#* zz!7U_n;^c^+H?uyV|gXcl19C<`Cdocvyym`Q=ez!{kFOs9;xLgdX&zHedzw1%g$b3 zPLIN0ROz;3k(^eu68qU)l7M(@z+7cp@GX2t@@MXEw10I@?)&0WF~MWmas1oENwjzl z+zQ*DW*rDi_Rn?|z2m&^?4Aq&(#6xJr>Hpoi(c2NAr$1bUq3_S*4ML|9s;di^qN%y z?>WOj=9)mB=N;O~PL|@?w)dktpz}2J2sz-$SXwu_)AzAQQ0us7fjWg}yZ-(ZUBBZT z2gjePexjAPnJrD{$0+$6ElmB9M7vl6C_R>eK?u9dm(6MK(kHmTtbUlJM-d2LvTsMAK?QlU z|AmYG&!idL|LTF11JnHIjdA1^adb4Jox~~Q!YZ6|x^VsjPkJ0Ku}Lhf(D8&vc%Lqu zjNCS@(@tv}0gWqHI>Yg;LM&IUVr<-a7AsrOOmcr~;+a!(ZEEL2xvlo1>kUz4&oCsZ z;BC5HtO=Wkq>gkx!ODBl*!mCb@>{OKX{HoSR=@}Yk;1HEThPR#@E*DqR$9u1;i--n z7lZmoU2j|6j7TCTs!$KP!O|5b#}ge8u$aG2MfxcxQqZJt>gE;!!eiH(+pGN7QY*}4f3}L+CNZbx z<>1sQ>IbiD%#y>7tW;E#OQ(h^$5HQ{;xGhJy!B(ZvC{PFx|uRZ zXjQt9U_xH|eiHhl@vx0q-Rx9>Xv4RvL)+;b%P{Cj%}Nd$4{L5Qdv(^+3AaC7UH1jh zth6j&LvCumqgl=ud0j(7@RB`R#9h)kD|R43rR=%l8Nt^js2&c3i9n5U&Xx{zE3?#s z^HO@-REZ<11<0jw)c!nKsKtKfI}J?8PyAV`j3~aBBDJG9dX2?+$s#RWjkMdXqd5PsJ6yxe^KI_`%cD@q%mZBqnj5B4m>wm>U9GFlum>K6uD(Kt(NJcn@;TCWyK}8R1J0T zGN{WN7wDE$Jhdq^xed(i;sBd%)XL-0muwspc0$3Mu`71I+P2hI4~!ni-ff5bwI0xp zev*~G+~o#BS2eCrjdsSy9v7F?Pd~+6EumA@yJ_7KwvDF{)!6@k#BQGpcm~KEBzMEv z<=~XRNIr97vnn1dFJDU{RgnRHV#a2@5nil!VQ(xBs{^n)3bkK&&$uy=BU~$|>^x)% zf1W~-7s-s)|2BNkbmiBfT(!A?vYPyq$v4vM+SIwzDdg;*i@4&;^1{Z2%Tcpqd%<15 z7;@v`92H<7{tHPP4f(j9DA`0Z*_VgkE&JkA=e-O{DNN|AL^LjFRJf`Mc8Vy23&ENB1d2{?GGP_piUBW+@yG>6thgYgUxM(nOyhvU515v0rYMgx!Q z7(SJZ74>0l@scxbUM@i%Y6X3Ult}wKko9p_~x5Z+|)q4>oo9;0zXp8iUKu5XL)& zd)Q+?8AJ-qjw*P|9O*wLtPU1-O^8l~?)Wa!7;|E=Gcv<@v=)h*>hD4{TH=-7klE6& z$b0yEG;Ymtj=dA3L4iumDdWAAUvsdD7bi}p^cm!q4~!&OAvM9|&x^PnQ@}&^5!xLZ z=y+0HGe+voV<;#w%z4G}fnCR^3WBTl0PZ{;yFyGUTTQ94!2WE1vihY)AtI(iM^8L! z4RZL1rsOySO{u!IT{oi9m5RXk0zh!#Zqm0C27um2&b#J`e_f92(# z-NsZ@=asFJuc32!6G2@AOqChR(WjZ4MC?Jwb{%_(qfC@;R&0NW?}mg%#Cs+2wR$-r zV+UOBWdam9GGZf98SwV^06w z(-rNFAf^{N+<3)}o%gu_-9GN)X6t?4#<`Zh*D3Df(ZW+3s7G6M@V-F8I7vNz@CSX- zpwV-r%%KN|UN-dJ`{^v@{>H!~Jh~lADm4A^An_S~CCl6#40@llXnNMF)#PuiEV(QU z_otB_uOp#=vk>^|?tdyb?>i{7K6dKX-FZCTkF<)=#Z#Itc-*Rzt<`Vq8`~5QnkF6^ zeX^&20pRM}77)1(OM83YVx9Nbp{>_+pjdi;`JcvKIB$Tl*91TC9xL^xQ-ylKndS4k zJ61E!kM7&SSUutxnwpaO|C(Is0VNZ2*3@;~3OR%f7Tur9w6UX6Ut@SemC|G{xjeZ` zLf4ZCCq$H`bod=$0<9d81BUi{k~)r1oY=T$kE?%j#Q#-<-cgcyJTdCJ&QUd8pLwNu z-0}bm%60^8iT8pIU=-h9n_q$2q5m8w|Fj22W!eSKM$7;lvpjQ*KNn9`a-Ze)a#!;Z zVdBP4$;%l^!}U#?>Z>nonT?^#0j6E^RPgD}zocaxwxSM_sLL4WEAAFse@P}A`$%9C z6OX?WNaj6lmQEgAJ@Lr3t=JJ#B}b8U^XZoF&$NtCEgS`NHgT?~wrFU)TS}9>R1qcsxO*xK1zE}0#J0a^GpY&d)6+2a+oR7}W(xrKS zVh&BSb`))#Z6mv0e;cw0!YC|~Q9B6@RD_h^h410gP|fUUHP>`q7j-%zTO*P8xWlbt z^ysntu0NrHClBem`DZdlFE3?+Ua?~u5pkA)C5u?bd%9%S9HlXOR-pxC`o4d>b*?Qb z7jOGpsX)R-7#KotcnJ*N)1z@uan$_d8nq3Kw+AFHHc&L7sbV~51}hF)Kc5lkuRWWi zrSm{YUmgk4{&4k#*YkzPWrrs5pgyYcs39HLh%tLuQ!uu+@NaHLj*UKl{&sit#At9c zZVon}#V^~<9*6tsK@_UI8VoqkwlbG(`I)ZeNCiC9o~5#RDf&cEO;Ou)&Z~qb(+-6G zKkITQ5yT~E2!*dY{XCn_bFDsJDTNb(@33ia6_8&QI6j-Vva~ruPbq-W(br#JZC?lC z$=ErE`D=4mtZLHicmO6M2@iBdkj}9N$k`-N5J5Da1Q8X51uh-1#f|q9b$0q8LPF`S z7)pv>f(mVnwp+J=uox4RhmCU{qH3b^a}*jO4)lyb2K1tx$ZYXUVZ}7|d zHLY~9;Jb^P*!?M7@1wZ^%y>`9xpP@XL-!%H*{@d50Uq{&3e?Zv-VG9}1bC!v#&cw2 z;G9vnYdnJj4I-D!ZA;`swElAo!?MN#;;W1{wb0m6&sPT}+62gVxYs%*r+!uP(*8pu zV@C)rNKw_KWLVQ?XqX<=Vh zhY~r&G{8rg0#2t!fxIX#Nt(8*ieR7Jhvb7LkxXoigaKrgPD*QQrDU8Nc@Lyrw;Y~& z(R!wexF9kq=G$Vt>y8tVYnk$*NN9}Qy4(pJ3BRfUcz1&hFH1ZH)UsF*&}y4lgEj+p zeVH#NeNj;^P8AfW5{7H@$|jZpL=j2!?J;yzx}vOKu21W(Xbj@W0x#k)MAp|Gtsh zCiz%3n`~)|+p%Ic+l!mY{)V7IZDZ<#UN#kgL3EdHvk7ClIyoV2(ow(fnO}ao{1ykZ z5CgzGH9z0F?B?K~?i)Zm#2cMY8zs{X7dTa={V^7upG0v&U7s7y&z=i?%%SI}(i=y zw_^*}%-)xbGC5c!`xRiH0|>`rkEbB$M>DfD9lPe}L<6^gvs+#u(7r}REwh?Y&`6l! zcG+P`vc_X%5PV3ARMjgzd9ZsV73~xS5%y6@+mH4=3TYmXv`6)Kg3pbkJ5DZgrWv$wR~CeW&Ke z5%Lkxw;oqc?S#3zmlNnZ$ZR!j;y*OJ9oxs$L1zCSqfq_wsmhD&Dq&4<@{A&Tx=8dm zMu4s_-;urI8^Ts>?R`LhM6=9^()bQYR>Wyu|8iDWuI~407awCAzu;OJed$>O_f5s4 ztsZE7iow#Ij=qN_Gjmg2I+=U=!vTJ)h*S!`!Tf-t_anV7L%;3!mblKWtEHjy);rYo z9Gth}DIeX_*Ma$*a!J!P8^FH4xE{0^#7yA6I>)PzGhwltNO!tfDn0spBk4V0K`Tzd zD6Iw4xbX5^{+3m<%ymmM{9IB66zxWgOTA>bLi^~+*^{70#I!LHlNUMNn=Qx2kY3{g zzN^94SR$t8U47MR{kkJyXIBSOC&nD4SQ*Mn>G-}!n<41c$z~AlO^{VX0a!YoR7K#bGMnSDqf9De9k3)0O}h z&L5G03YYE0Vvv{|vd+Yn1}LQNvw{x?=g0L5yo@ zjmIBt9OL=Cyznn&=J#Zx$ zP{jfiApY|Ml>1c#=;ogg9*_kbB?8c`#(L0O>~a$?3W?j8Z5O@2kbG|Tz2QlUdq;)i z{j@}Oa-ceLvVh|UF8jRemp?)x>zDJwhGeybY9X| z1Bb9hd_bbWYT!gOgEN4eD5DpxsKxJ@-3{7E7GBwa%4-uqY!B~bOw`z9CW^Ch1OrbK6Ux#^|rG|pjH8P*xHD$B6ySCl84B-Q+R zN^gD&t2n4Tb8k2J!!wg|Ay~;akfrnjS?DE=i>xo45bQTNM9vhAJzIh53$u5{u31T3 zis#v53`0d)Z=0hf?7|!RYk?`-$z|!};ZSx!f581*zb?)RPulRi;7Jwy_5t5pyD`kf>SOujYra;+`)< z+M|;4Pl0fS%dxSs?olOlfhAJ0EKJI1nUKP`n6xysR|pNX3H>Gx@MvT_mlP^`!rlh> zbJl6M8$03)wNZU0*UML4{fxD`lCzuJ7rRKnUMwOhNxZ(EC!MFtf3tD!C9EKr_&&Bz zl?F$-|0YLe&+~mj1PR|zcX|8OWdu5GmvM+_P`C7-kJbdch56jCFjQiOHgBd4JQKm( zjRUY_!Q&)Q6&OV36$eJvl>WbTna)A#6mx>z0g(bcVuq>+>icLSTB2S>lssMtxuRX5NFcjA#XbpP6sR>F&#Zj_RN)g(vuz@`gc+=&6S4} zmo$I>%G<8zye#7U0U?$2aM5$SI9nCTw(g${(?b12C$)gkw-+yA;1Ds$!5_T8UHeJP zSzeXoX|$Tmgh5lxhud8Wy3-4JKK0a|4Z7y;zNHC852a=nHYM;4$TXyT&t1-}jSD{8x{BEP7jA{RS*B>_yr_BQv)vT#Ymo_(6j0j(U8h}G2_L~*vF-Cz+m zxJZFB?kwWKAL;4lPYZWeFoMN$4!a7e%S$w_0f{e1Mr z?389etxXY=|IwGA#YBf(LrIEDv-vJiriRiOu_0CgUY(9k33*)E5BuDd^U6QuhwpBf zyj}kh&pMuzl-#^oImM0Ye$NT`U{g+`S;ai6+PZv zG!?yLBe`5CF9~dKe-rr1eP`Ep`yz?ZzJ4ou-?+SrIyFE9bHH|r86uHy5-ryqr7nYq z91z@GbqPdCn=Kfptn=CS7r+$c_c`SmwcBDuouI%l4zZY@SyoCxTt@32rSjYOfj z_2Vu6QB5~nUTJQ7t{@*oE%=Zh`DMR&1{*C1JR<9pyX-%?za*cYvj5}}2r=b3)FpF2 z(7L^Iqe&b9|BUYi`1!~IliWfc39h?3SRc{^Dblm=pD!hDGk!y`h5I;f4}Fs?{nb5*&o~4*{=6>y&dn7wSQ0cMce7iIFSp2oIht-?(TKB zevOafX6&-9t*ov$xM+)8T445-i!n1*wYn^cV-(}a9_q>tIV-^-prR*ilB{zAVyo!v zo)ForfM|D#Uil}vjA*qq-otkrufxilfZv_NUAlybkGo2KjrW_ojVp7D0Ti?6eiiG; zjLNm?j0(nth``x`NB>)U|5Jp&h=>D;`wHr(o!(Lv({=>vU9+v#tN%$+p~F)D7Ep~; zAKX7w8FKqM37WPk&r{Q%88&@(kR{GBR{gR)i!0l8s=xR>>%GXeQxFqkK`hhlvabma z?e=oh(+o}=%o4x4Oy~Rbo;8W~hoQmJZs7n#4B)j*Ow9Dqr;#ZJxYm>jHZ_)(a!Yp`j#ANMO!{|w2jN46QGAw6eKiZGQ7A292bXuRCXG_Fe3MQ$rl>muo2!ZY<< z4hr-+XOlRf1f34kR+82c!G!=pDo3XvKM{scxprzfIv3 zf<~;?{1QoGN8o~O785!AvNDWA*wVrvn`ml_==4Oya|hlD`P!t0ad|iYr3rN6#-3Va z73g{Lti1W)VB1HsQ|SjcbKOtgQ6)`3Q;%n5lLggXe&88J zMYG*g3?&^MX3UUJ?jFd~xWC6Ui$hUg%gZt8umbe>x^r)r>Km4PQzVw;#O9n@di-l+BSTNKTzRh@W%pH^j!_@0C}jrJ|}K5;M2&LYkxpfsEnFO z=!FnM(g~?=#sI_FcN#fTM*Ei|q!lCCdM_9lLV#@O`X6}|ZyV1hUnC7tMn?~^6tYl8 zvlIg1E-sD7(5!dw7J;=P#og-DI1Nt91Oa}(bG{b2LQ*Mu(`=vLK4IbE0&Z5pD+%Jp z*Z1}oaLR}F*dTI3zsa27jb1el5JMa0XZLY~X35sB zkQ`|lL~TLdRiGC?n$fMzuP+!R8Gg74nFuZF^|!Cv+_NzCt09(^6smCvo%nos$&4TR zotvP}Sb-AhmiUbMigVrW=Apcwo90m7@gm`rn|BR20UB~-kO1X1w#Q8yZRVuN()ND$ z5jR{CaIsZHi9HbgyTf$_3p|o}RurVg#xVYsV#763mF35(YpivSUnC$w1Drd2YS1(t z_xt4w0rN5JHV?KS_oG?!kHgs+F^m>pfVsF%=Tia{Af&l1Etqs-dW-?rLwzjCgLiwy z9bHK9%fLN3k-yg}n4^(q00Z0fXt3Q2Sl_M}rkGfIdS;vVsn8=ZvR;!}vhq~ii3zyI z$DEs6q0P3$QX?6u3;F0+iESJVOj$>g8At|^MZ8YqFi1Z+MG>8>G!~{U3|1=$B-TG? zDk66{cwC*SBhuCq#*hS7^3&w`>EvR?Ikwr3Mg3N3@-^nrw8J63IqQgPXAuWelP@^f z(q8c~(ous=Zx%T+8pLh6p{c>hkXYENSe)Yd>|PTS;f00{fSO_o-!d`+;8~9avD!$6-6S?^( zaO36Xb~v5osYh92Rx#})x6X@Yn-1#^E4qst1oybm(g37}x6Q)6)dP#A+MWlqUukMN|7 z*9_DnaOCVv7(e>Crvohl&8{Os7A;*3j#e*K6sG*>J~;(#Z+GHsTBkp`Zmlf$Tb>(R zUx!q-o-nz&;nN7aC++Msr8iLGNdq&9<4&@cmE{mUY@m8A?=|!5!cyCi8G>vRj^sfL z9>LXPmTKKhL(Z)ul9*s(<#R)UFQ(}S%ijsoq!>tAkR=f!5Gt*71bK_42v?_bHap2hB*Gq}s=^ zZv|l(f1N;RmJ;#bh|3jbV#WN08omnM2feZ@8rK?|9c8sckjy>46N)UFLtPs~KR^9` zo=B%$XS!j#fAhJrhMk$K4Yd~2JAME(2cClDV`h&~$RZj-?6w4NbPp1u&o)SVM zX_d*4WM7jwPB=ns=<#Jl-Lt@<+~Os0ixr)oXG{`!b)KAR9XoJp?;YqekFcY>x*gtmteh#(BYGEZLQl@qbUJF_^SgA}meLOS$_@8$Sq83+i5RV+TR8Bim|9r)>9BBgP?DhYVqHc&i2c& z7HZE*D~QNzIcV9i-AuglS$!c}Qa{Cafp64d@{4&$3IQuy?Ji<|Vfoi0aNPRmn;`RAx-(r#Id~yZpVtoYo<@r@8c;RH7nlT|PZF^?Opf|3n_|^NkS=pNctR zMg!Laja|94R{y%swqi2Fj$9ELfF54&XXP%Q52k*LTn~<1hn-#t&aE_qo_DfJ%tiDK z)=pI0{BpN@vIyd*TOs+2YGOL_@Fz58wziSkOU9gS-t2zM0da<$hhHdgW{ljPJ9nJp zRNI6qcsgOyc?16JXP4)R^33Sl&9?zs7jO=0V73O(5ZAM9xuPPg35m)1c_n&EaVngS zzxUK&u*KC?pVKQChs)XaV}K4a>vPOsFix&u2_9l9>N>k{CytZ3x0piH(^U9l{X}k@ zd3t_|z)H$E^1$(4OZxi-tIp`cPr|xJkn(A*>>E1tMD_{$RVXp=ys4S#g$NEPv2uof zPzgB-H$ti_wFvYwnumLQ-`}%QOqB&L;JXLO&&Lda8oJqd9=3n!xW6E}{&N}F3+FHg zb6H>gU_N~CVIDaGc(F88)g`Sg{|*0(0Yo8-j9lzzpm&xo-Ogqo2mBqRegK?sFa1^p zpS%nCpq7qF=Y?a&_22uRWiu+AFx#q+4wwzg0Sp6D1flE2qJF8UVrK6n z{2WtnW4`ya5*LySyw!}v&6F7bko$}00^HwxvRA*x!P+J{`t>VPZQehBqfkC!B_ zmg5bs`t2uv^T-E>_@B;c%A%OKSbl+IT1^RIbjXaW6I*o_?Q9DKA=}J}<2*lUWljKx z(v#&fCe_^J{m~En%5bzcquAc5cG_4*KD=n~DhjNt);X?8IhTwLA^5KI=y}_+&UEh0 ztnY^Vrx>uIkFO|yBGl-`v%Umq4D=gsiWNl5LR?bsDzcJIkEL*2K&U?P@CF2T@#v9Q z)zl*g!^RdaZM#;u5BKKdh=Zw}+aH=fGpyO=5%JvGZ*B9U#l0GC%UL}Ef(#~Pa#ni{ zoPMq4{2{k^`fR>2NQU;)pzS<4f0O5!lc)`!z<3`pRr*-}eW-}~wV6?A4#=wj4B!+! z7LZ7Lx7ZE1X(2L2-gN>ywZT#ivIUoJKH;nH)<8u03)(HNj_Vh$O~NxqeiX$jDm;9A zl74>Fbf{nLw+EZ%4a>NsfDXMglB~G#LO&XfDkfo6YNF}Fz5MK1hE=Gx)m&HfjgNO| zBMMwbN`$Y+P2lID*LYIpkO6g=s4T$J9WD(+3e{?2y&2~q3^A{Z>Jnu7Q%D3F87#*~XR)3(x?`Hjyjac?|uC%&O)d(HygW_B* zOi?8nIo2|RYx7XYc}>@!>@bWnHnmN~m22_E1CLtmP+|G@-c>7d5+-)ug|Gw+GwLi!Qv~D*WSO| zX!Jw0)BVv*RKeMy78)r7X+0QetKwf>j(SFZtPX=@>PqnTX!G)lIs4dQHNWPa-oo*E;?*9Gc6901=Kw9sywOdPd;65z=}7i!GJArw2)-6ks3NK6G-zv!fXW;JXz=obPc{b4*s9JMPWv zCKtTBrwUMV|E`huw?r-|CBJb`^fGh#WlZ zB*nNnBq&JayKN=XdMp_L(FwYLwfh~eDmR>1`})Fx2oWI0dlvbL_pr?i7Xewmx{-8P ztf}6to$Bi10n9lZXs8X}m`KQG2i!0k2V83bv_2<*c@eLEGRR(Oo=yjt^r(C$7QX)J zyuGt;>foLVVB%l6gs+~H4q(LzpO9bs2Zg_EPU-2f3^;+Aki_+E({5X?rO>|07&$IC zc_*i%^XRRY)7I~Dt}V2+iG{cK=NI#DrunZ>RP$_Zr!hLW6=JyY60T#54K04rs~7VX zYugjNdrg}>e``NGCO_NWr4QKGTCWwf;OWh__k1||w!xX&{1zDlpiGThPX;%5^!=V=*sqop%zRU7xU5b4q!!j+IM7xEEP$*3;=!d8)Ck_?MwG3eIKQgQHifl1p{iQ|ztD(p3`dj`0{v_gSDamrPtBeZY z^5~dAr-RY_O}YA%`J1l;StjxY)GQSh5PdmVh2zHt2}&o7iL7o|r3#GPNw~w9l2l6T zsF77k`L@|tZ?>#?-}r@+N6q)G`7#)k?AHw9WdGineH?Fr?~=?<$#P|wF1@on(TRiqTOp{G+iIiCWXkhH$1Ea49LvmNd-35AQk^2s_?ID?rdfCPwPGhtD ztKSjo1E1Yh?@Wgnh*Sd2-%{BcI-$n=l@ZF&qq2DVkw2D@Oy!3xlNrI;C2_R0_fe1v zaKX6(l3G<*EWRe2xp%)ZxjxyFWn8=K4!n|baqk8K zNqE&ao*g9UW8na2T05tJXV5=W6m1yP`YDA0ba0WkIS7FV`G{ioB%hUsvFo>k)6r0P zGTba(Uh7x-&5Cv|VDWQ#)|mW={VYHI@b_DIna#<*gbo_20JDAr43DR3u7v5r1|IDE zyOwIZM0So-O$wC~WPk2;DfA+I)7>{N>mfT-ExIGxGfP|r&gJZ9lA0C|8zHu#`mFe> zXZ1bayY7(@to`KV_*6X7TFLH^RKuEWW!XAyMGguvTt!yhVfN!t66MD02pin zjqZ#KJYjD?J`eZ4Y?Czfx}O3Vyavwu0E92{-atrNM&|99@GU72;Rg=h~;H43CU8qlpGwynCuT%|qPdY^w_7F_QyVn(O z|F)Avy- zDWmG@i(eA}B(P;AYinwGbf_eg$?fluvvW_kLu(Q7zhZH2M9H814)3v`5|Ns01KVNZ z1@U!WbrUo5P;!jQNgFGxpfzUZ?cWXtA1n3Pi3Qq086&{%0$sa>H#b>YcDqEQsdL0y z*tjvhJ6rcL>G~Qw;BL*tb@~4CXwKd_==0mdRw#3hZxC>z=@Gvw{NUh_3T&?W4C~D8 z9eK(EcJ}6seW*%Ave#FB0>c-9N0Zj~(dD{n8X@m5svs%0v=0_PN`2GQv-==~bMrLq z5_Dv_j(h6Q5um}a9m_r)urEcEIz931!B(*5j}JnRZi`I~W|~t3#U9Z1(W@=RHdvKs z<@O5}G5zOx6pqjH8pt$gZa$4$mX{aP`mTU>GQ+;pr$V&x`zy24a=n6j>hqhHr+;A5 zoa2|8HVJVmgu9TjpUXj7VvEu>dX1ZcQ@$Tz z%)VUaR2uD=boSAai`NV;4XBcRYr3@w@$oOGfcQ)?P_&oZl&!R!Ea2&VWrLKS4|e63 zDvRnTLKQSH+imIb?_f(ctV-uKE>|u#uB6&dJf~nwHKfBPuQc2ZL$Y^=2EAH2wIdCH z@(H;RqkPsnZHuJMeoe~SHd+Hg3Sof1IGotIxf1ggtoZP$<1!YDL%Ec*%A>Y-FCOT^ z{~-tyc=V>Q2v%T;NjArcf=2;Ax5zT^Rse}4uBXE?)~~<2tqRqbh>!w}k3a{o>47VC z1D!AQb3(2$k93B{!97DZ;-*HGV*WIEfuhC6sr+SYJz|<@oS;soKly`5WkhOld!0Cw ziEg)cmi(Z+8D0mYHJ?&;=I(iS@qmg*lN)4`h~q`kyL*>UvDI)RZ}WHUg)`~Zr2RT` zIE$f7GhW&bQwn>UHj{J5_Vs^07eTc0NtCW0i*W4}m)nqfK=^8>*aAOGQN`Gn!KFR& zq`eW#cc8!WdfsbqVWyD85MD}PLds31x4;bu%!}AZN-Bmj9>%7iXKgWpW2I7SFccm; zVAE+NaT(Tv*xn3o1j@3OBze;mJJ!B z%j)YL%X_uiZ`2yR{04@~?z{YCTjbPCM9W~`4vZO+Qa;-$YP9VmX1N{|t_+q}`~vid z>mxIluJikE%o~&QVK7+h^^JkUlJM`{Y0R9zBx9;YLT|UVa`}$fD zP)R8p7$mw2sqq%IaftKleC?>*CE|Im71J%#`~3Mqxh<@Lie{06>~Wf5og={*uYJof zT#4cHdp$~t@6z-97*(IHe})wo0ln(%(j%L~S>N8N z<=oe*$ol#`f2_)R+3#*3$G_*V0q?UgaiGG7;4y&vZJZh#+M39~-Bg=b`%)d32Td~}o7&SufGZB7$ zzb$~A2l1~wipcr}ryh3Cnb3MTK$RZq5|V=vkGp|=W|-b;z3?63&i=%LPzeLE*9-9( z;5)RafJX?WyYnd>w6wLng}hp5QKdTOc-Ma4A|R#^$E4Nm#dyVeZ|$F6Kvp;1>=~=C zr)eWZt;b?o`L(n(;FVGPRFt3#nK7YdE_500PzWY42_ro3Rua*+akZRK6r~#M6660m zu-2lBWc3xkx}hVU%$mK>H}$EhIx2grsKKDV2!0AVRAOg>fB5!7o$!e%TcLoDSuh$c zZB|VjPL%b*q9Bg{klYjYELmq!m2e&jFfu?J>X8=o!AY;{rrDJ<6uOV*djxlXSM1~6 z#{*-*1d+@bP~51utd=nWpzcInf#E-;7?`%0g>)}GNO6y=#ASHCP-18Z4TL}q(@Ja; zV`agGuL*-DRe^J@MjO*$svfCdOsn4PRn#<<3bbYKNMbdHL%Vhg`EPYvDaTRD*J!Ff z&Lj@QdtEu0i=(73^7kAv<<|v_SF5Jv{1H`4Bsf$>qbD#}Z7pBe$M>;poXJ?60FWnO zV{ED2gDfWt9lf`3;)|U>a4cN@W~_6_$=2N=DR0}CqBA6cD<0^VwETjrx{z5aaPEVz z-s=Stddfr=(V*YpTSMcI7Sm>u)?YS)M-;UulDWm+%4JCCO=OYEKJ-&bi5KvaCaljG zw&Wn_{%R4zicKf^wZ8M1m$A25VqIbM;S*M@q7_iFJW@`DEtn45xn(U1p3g9Z9UbHz zaZhHsl+A)!<@QP{ucX?e$J!ThtbJqEonqQ^u~){{WT&UO8_tZ6nd^|0@olDA|55ox zs{wRgnuvo{t3jPlVu`v zKRY8+@VN4IMUBiHpEv`Vet#|=)gw5AvX`9HOF?wJQq{U3s>g3#b4=EO3%%7Ya>RmH zu(wa;bg3m=&v^9cX4m-`z(iuwFL7DLp8s5~cM~y11A~hOuy~X(g`v^d!1S8vq#)$= zh)>MVFZ~$ByY335JTPpodd>H4EH=7#`ZB(}vV7fB`+ENOm=;i@il|pq@8$>bWG-p_ zk9b>e=8XTG2L7=ZIUbmo10`k(^2$}~=BctI3~fgCvAZI{(a;{ti}vd$`S}b03&GgW zk!v35WcK$DCIHH32W(;koL2J(hW^K%BG&`+*DFMU;<>8A3i|ff0MivR0T5$q?!96O zE_on76?|Dc7w$;a@qqhap&8m)#c zJ=6N&VaD12WA6a)`jubMzY*eD5$dM<-A5xM@dCj9C5TcvuNQw6BfzD)XcbrWGhHZb zd{S!-dSpPU)!V`mzR)2ExV^jBQ=}K%D!x++;6}ok_Wvj;sKNSAZ1dD}*T>Y9G_>f& z29qJzk0vrEHRV1}X}`d&D=Cgl_dw*zwLBI(7ax+))-nq6RB1pmMKj$@NKxW(6Fb>w zGS!qM4&dD%Sxkg7G5hYlLw#}9lZ2fLg~!c3D0iEYkks=Y&@I#kMRgrxnPOq%Gu5UC z6E1$-{?hD=@uRROA%AWCl(BbVXpxzDOF&Sh=WJLQV2lCuu*n@Ml-S0qdKj;@)%M}8 znX4T@`JG3`HhOWa?CSH4g7M#Y8zE@THiWJ_ZMY&;OUowCk#kay>Zc3L=qRJ36iN8q z!}@`Dlt@p*|J){yCkvItp|n(k79<8n`?Ch9z-#M=!4a&i=%|=1HA*~eQJR$#_85MiGY^cpqeNJFnQh zilflOGs&&X$x`9T{*6AY)+vk};0?{?C2r)oG0(WF@g^o2iqLebe~^{w1>9tJlzHb* zrw6ImekTC~G%^TWcCS&th)*{zKmGdynV!v-W@vu&dCif(;5l-ue?S3m=GF?8)Y|g* z9nz#O8IawX+;9ASU%HM}*W%ZV_8E}2p*w1Z_pH5cze#>{o%3hvFHF6ZpS}&Ce*m{Z z5{!yA&o=;vb9=O|$52BC6l zbk1}Z*td4@cd{4oLWza{{BToL8TndApZ0|;uCEE83IKwsJL*5H zTz}yH?P4<4)bmJ392%1|Sk7I#1Pcxn9Tp|i%RExV8hqZvi zJt^>*qS6R#?CCR_ZE^X|PQ9w~Pq8hPQo*-{|34M)e|BYGE&su`D9B=}nIpG-Plr}< z!JJ!~LKXR4-B(h>!_u+VYUAkA*k;~?(eeL4sw$@Ebu zxGX2R@o(l^J;-{C^nD3l0Ds=&Hzl0@Ow*EN9&6>>CBE$x?aa_%yeFsD5f@4}=g7=K+zv1~S+dtofMxm?!jk1^HBD{G!O1 znIqnJeTg9iwg$Fgd4#Cz%W_&mhx&mzJUSM=D2pEt9x`uo^fq@XawYG`N{Pw$ZbcJ# zg?fK#{eD2GCbUM!!LT`)MRLjLSY90B|fdF6=aI5Du z|D!2Wy0Z-QbzNVi%qq)h*#VLwonP;`$T*n$o1JnXq5qbFs%(_3$@2bpWDR7| zJ^*(%crfF=&L0Sy~@ z0c7~VJ<3?xw*VXRK1@oucYOQ-P)0CjWw)_+v}<$kbS9>zMyt)4(EzJ;Zf>$bLk?h# z7Xu-JP_6|96BWPOyq|7iX4O)qnwvjMZ9Pq@vozU)ECrLlB0ivc>7Kk466c{{PX5y1 z`Bxot{RG=;3% zKJYL45{|L~l*IjDYv47R15Yf&!ftjB?3gn~cwWDj22-v9VTKA0&z^tPWIL^|40za` z1oX{{rM77Mi@nW}w%e=UGcQ*GcwYL!{e7FehgYH^)75XCm#=7^B*=T7CRYmgcVfx_ ztTRF$P{%}4luu{~LRr_x2ma1blE!~uMoJIoT;}{L8KN`Nd zrt}Ef3?s_1P9JRpFTGLPGK+O90V3keoEEH_*6+&s)(1%>j24HZh)=Pr93r3~Ow2_9 z7OrWcIo3^DV`l2N!vAyo4^9vsg^zT*dlo#W-nX{1%N`v)OGiL?3TxMLcX&CrWd^3} zUQ9wDwlX%N(wGLy!HJn^x8d>O9RK2^>SO_O=cgG6o(J$AkftZa^shDM`WdpMTBm zL0t9jNfrSS5$O}?_1w(MJWa6qvqV(^DS*mtazBVkBj_9K+BBSPUuglvpWPnZg3QgS zS;*z<3Ss^`aR$wxXGtCGa{(Jw5hdvzrEIHwR+A@2nCTVoc>!6fJ_~OzkdwKNzlQ9 zG^q;tU`@%(GW1W^-<1E?{3r0YQLICRk0{jW+1gki4Xt$gXdlf(rLEQHbgz~spg4Gx zU$_J*wB&8Oa0m+X&n^U*d&mX^EJ-%M6S)6)<*?Pifk$xW#ZdTz8x#`qj$`DliLU*R zM=i?gV%A+!^0NzMMHWv5>uq?aDZ1i=2P`vU7U|SUJ7Meq*|Z zZPsr{B;Br#1ms!YhlR;9uYox@dB$hLr_*g95_BfN7QKi*?u?EQ5MJD9;DKh0Yw;0$ z0E_s;Va8##&nY(mE@O0VDuwU~N+Cw?Uuf|1;wz4UKcwS)YRmePlWsNyPvD!sK!jCS zivu03^?36kaXLqajDCPNYtO*3+|6yv_JQ3cOe9RLse?0xD}Dq>)i7EgU-^i1d~y62 z*_vtY>6D<_Utk~8O`N8feGO%d>LHc4S6w=>2PXC%_h2dEFjHA3Cabgz0}xeAyfR}X zb6%zp-$*2k447BkkqYNQ`T6g9PF!Q%g?y$D$C0%ug`~#LCis?GPbdpuue}V>3Xx=S z+GUAJMmPqdwgRn3Z8A7!wsfuGtPVdmxW^uHl-Bkwl_u{$5#UTKv@#>2F z-8)8{=FBlEjix!NU9@-Ze|;&gZX@s^ucsa~UrgRizbwsUGnw(;%8eseLWpYk<=)-c z1Z%guR^}9mg7q?K)9=#ssg`eOM$RQ0Daa;>Ee4hQOLRRk8t_K^J9AkW=Bv2%45z=0 zZOU0I^Y9CavD5{4Y1Bv)(r)Qfs^hJi4$K!vKU1%Y*Kyc`43In0hgnD#%N2cK7-zwD zd>vE>xp&059VLJKJlLk+mP@_f?=Ehv+Bhdn#?kM6{(omoxv z^!iYGVj)$m39Jau)czguo}B$~wV|f{B*g7Ed6Pt%6j3N4keO)VE-4xYiIC2E&@!%e z0;TVf2(key^1Reb(4Eu_I5?2ccgT=@6z7JvG!RLGy90_6^S-h1#l_ef3hU9~@ri_@ zj!Ky7_THg#l$6BTnfnL!`h&Nrt)Ph`Rc8%!kGa}vHA|$_mxg7L;h$&161bF4d2I?K zrMdw-`zJ4+7nkS9EG@-S?E2kZ0jzqAYVRaj0fIbjX8@xFID@muE(igfSJ1clEdZ7? zP`V`=t++%qED1%}KKrqzHaD+9Yj^$=IBl-|k3TU|WSG|%sO5L?QCI2&PU(F|0!~%Y z4)e{X`<=T#0G1jZ%EHQu1YufIOs&c{PIWN-L+KA(-STwRbzR2 zR943?DI--IFG_tc@K$eDUKPoATqV_fdF1|s5%nBjgAJfoD{{<-5{UPIHk@G6scUK! zRV*q1+M`a)`+*cqrEdsrN(8!Wt2oo7u8elc4Kepy=p1vjOQxO^--Qh{+O}*+tEA6r z^2p$_KIT&`UG5u8b(U_2=^_hp8NW6NwQtQRTMrR75xe_8f&0fte=I%**pS*Y z6^~*o>9ccpOXU&s0qe}qD=Q+GPdJPBUy5;>6zH;$MuyEe6izR}>9gdI=5`N(z%|7< zzqsY=(4=5=lXOL+KefCqFhx9z@Te^JShjOH0J)ZBkVZ})n5Cy?=C{-$3JWZSDNRwm z;zdPU5uuV&U37U9xG!F?0({b8&iH|KJ>B8>2${&fd|B3hi_>8)i|yV0uc)?=l7M#q zc3Gwjh8!+>=&Q6S)UuABvjz`IetCHeFBxxLePNY@Ur*{OHiAzkF1x6*0S1`!b9m6@ zse(!I!l$#a9I?Ypxw*%cSS(!EXKlMoVYx`p*7c<6sEFr36|w(AUhqncz43@l!--f9 zAhroW2#E8p6QmL1XuJ)a@&bz~)PTNyk~+&}T`h6fi{-tcVg*>u{r6lt@o)A|m~m&p z&(^SkO^5ia_^@g#iHdY4RzmH!v*=W&{GCpJBL@6OVH25;h~%{fBxH3Nt6GDZuzKyp zdEcOGMDC9OkItv-Wt~ncl*oN7#Thu1?9Bgfjjn>|?`wcg-29#rafC>6Eqf4Jk}LN> zLf#!Dcd5FS?j^@3Db&?$>$)d#Z5ys-xv~?^j&Iq0rXH#J!$n7mJEfjQKb@Y6mG1dR z3=}j^3Auf=1jmKpK8B=6Jk)qz9$RFmhkN-4Zbf=|mY)}*-mi6NX}g{u$~}XeqIzMt zNF)TT1Ya1wdt9eZ8D{Qpf08>k_oh;sjIYL~$N9$X3L;lvXqlBhzCJRM!81U<(ytha zOg+uU)L`WIfNslC(d2N@7yf_{s*~(I66C;Ez@|0`qI>n64_8igt`s?#%nkxEBz6OfW%#(allzP_$u()iXkRG0uRyS8ao*7C2^I(I|XjC<7RDvjwJ zEZY0;l{RRx>g+9+9vHh`6Sv)uAGp8nMmjQCQ|cLx^7}iM>H>to$52H@6c8l!w7X^|cS;cFl#Jt4n%ds{YPNYE0Q@#aaT zECwu9W0GR8-CbwD3$22J9wjAQO}{pCAdinc+LHgv*#tVx z>1Ih6ysGma5w?;m!o<9_y(jze?g!RNyqvYQ!O&S?JP=4lpB&}3cl8`V;P?&KL_taN zmVgu|afrgk`EA2MgL(@WHSN z!kWSqO5JKADC6;K&eQMO@1YQD*5|+}0%fxi!cjqg`>m`4zg^7QDS!5P&yYooVXdoa zDlHWlc7%Gfvv5fmG3iQ$+L|D_zSda?+r6#&lMW0`$Hc;t-%5`Y+8!^=->1 zKX7Wi$D2?Ur5ftON}pA$k8{1AE=NNvY0KVI8s}A|8EM{@*a2Vdz!ECjLd`WSTgzBG zJy}uPCS;uJy*L@ImfWApBx#2Gl59!7iMXk|PCQ!ZXB;^ylbqj{L6I1VYA~tUUjvss zdo;Kxk~iF;Od!Glzi;0qTgXN~ads6jKkuCmMrXplP&x3vW*oKx`)V+u^Q_qH8A!gk zr+(o|Qj z;#LGkuOhn0_gxV}Ba zpb!UIIv|*f??<|SsYCjb??5QuN2%57+Xg@pGt zHNUI3>bf)haEl~-7S_4L%M0wA5*2&L-V$z+$;4&7mlZbV`m!WUXQ4%jt`Ui%~W%Qd6x|ae>Y^scYeb4YnM^eVQY!r_L*3D zjf=Og7A2>W%|6bT7>dgY2n?#tk9-?$IK|m|91AXRH+IGqXJgalv|CCGb2J)niJi?s z{5q?F376&$kj8?42Y2Z6#bcKbffxX(iz0)E}4iMoD-_ikbj*sbH@0} z3Ag5Akl!MJd$HnNEgSrMKUnC+H#oEgL2;v&TRJVXqJ4DT6ht9ZxKI#c_X^+KGTwwW zWh+Yb$U$rJyUew}&OB5D%~oa9^3}>;GO#K=piwKPIjkru;91z2acvpc!SePInf7+L z)4Hfb60z)8UQ-wEBCPMzOWe#`QMibv60R=u!_7q*h~sOy+4#E)@1USMfKV4k&Vp_9 zI3y1{+-mTwkl=}O%8tA&J&vqKVr*Kg3rNL!;T2Wzo8IWNV#d;VF&ia%yQB3^Vd@qM zP**V7DP?3;!8@mT1D2U>8AO~bXtQzTeLK1$*$60n1T9}p$;n6>%v7q0?t9je zUmxD=JF)^=&RkufWQK<^B=8#2rQ^q*zE%o}jMM{4p;R+-pj2>td>Ssr+OvZ~{V-R1 z^77@@pyukggTwN^RWlq`?5r21fD0c6E>sZ!5;Ni6>MrZstV~SSrt0SDOfZd82efdg zdQ^=iukeDOa-xuNc?S`d1TM}^%RdZ~o4^&obj>2Y9X<`z69vaAQHMVOE&)s_?1rk5 ztV1<|f+CUA;}h9=`3&{HuK?vKFs>VV?!dz+=CJXj_${J{d8RM*3Z54vIi1(OBInuJ zQ{)x?sbpGI50d)aLF>&*OwK%;QMd2e#(Sx`a3`d4DIw&}b@@@(!|3VcO8z`lX{ZOI2r* zRWGFU*~Dj^QtyG&k&*qIuR8aS4qs3)U;mm24Giv>bS2Djj*GKv*V1~>&Z=Z1>Rlhq z)VhuIoEcp)h+<2xlYy0`CCu6B} zOQE7{POx>_N@)*cnG)YvkGwLBmee{fi9z3s`N693w&%@s40srLzOP4w9d9n z?l)WoonmQoJzOINn8prLoigSu|NRm&KV;MwG86Y3%b9R_4h98uLdgoedgJ3Vd~oSD zBX0^F&7CH51&Ns(gSBEg~GtIft`4UsSQ;Lv<26 z2_JTFmHq7#qP9|QE?O>PqQ^Lsi8cGJ=A0T9=3ZY+4#!YAaQ7deQ=g5BCM7R}h!71% zJj)(k>(GeDTr{IqZOpx96^dYouXVr9@_IHTO>yQFV~6#@>yEyOMfv5xy8F|MpP$K_ zU2(+tCWy+;LYRWsiMa;W*Ul+wh*>0g17tuoZHb|4NgdOtb+M?vI?Dr+? z>(nO1N$@6?UNR{Vq&-2A)klP71ZLK7WE2(>9P46r#}g2^W2&+l0F?Oq@5rP?!ZaEn zN*CBI{F|oa8RJP6Q5Lp>3L+*JRUH`>2cA!8|82=ILJn?6aZtRcfP7wqC26+R)_de4 znwA`>PJR0u-?xGvU4yHuA2v77rDkVu0U!s?qn5|vlC<)L6SqCHv#*BIXb$&8d&L6Z zXlR@QHj@4}XLa?Af*!t`n9d_t;*zXAogvJxC7F}R}1KxCQCyPLqf;xMQMH=5{}~bU?H?7D5e|V z^8d#rRuu9Ngq^QhkX#rf+KI(4>C0_6esRH9jQ|-z8N_ zEs?<)w>LrKfR<*ctZuYC|MAKK?>cChqS05f4gCA=1C+_AoOa4hK>pyw2)KUf{aMx? zl+d;af*nl{zPA|xz`i%E1C-z-M^r*AcasB*;O)LOlsh66bePF{+^55=*AMT9ldFpj zsN-VEYz@}+F=Xo1py$Y#UciRIdH~SVR(!HhCm1zNsm3cc;K^2{JUm;+*fqRGK2T!O zxM)k*nA(7zprtpcV%uk$iHABB(N-u6cAT<#80l%wmsNn^g*q=bMpg#9Y=ats{m?)c z^21cy{L!*niwge)5uN>h-Y9Lq>=!A4;5sa46DLjefe^B z+?(-8^yd#vU=I-<_a)HgwBbqTsygL3Q0FjZ=6*|jo3k>N7w>$dEO_2KtH_{UllJ&4 zYap?kPHu_*q{v%7p?z6g%OGtX?)C<)_yn#H{EY%sgpnDz4p&Yz5Sf~sm8}cWoVjpQ zRQnGJi2Yjd-SlB*vlr&z!3#;{R|AjDSPRFEE#u1k3lZ%GT|^Ld!8XLgZ%jwbxh93E z--4~$BKmZig^BXEm5$+0*C_)YG{BiQbT+(;8}9vd3eG|ne`PIcCx315RPl)xYX6iD zkwAMu9s^Cw+F6843?ZCews~}I3@Z|9FTXm%7&Z2Ye@gJJa6pMgdyz;zL7H*4BbbTK zKG7s#sQG;jF;HR?KNTt8ON*utN+6l=E3M5m?!W6Xbkr#2mmV!@iY`Re$|rutxlv1i zmek;ng_Z4ht*tm%uIO-Uqe5LUTjFEG^f>JQkE#X@ zLAk@Ik1lQ4;1ozo_daYl>_{7N%BhnJht^VX-Gdd)8lM1FDlO!ktf=-;TO!lq7p9%- ztSF-fnvW*e#i)07v(_}%j){H#!M)l^Q# zFj#wbuyhkJCut@nEp&(-Nlw7%D*7=UjPy=zP)?bhe9=2irGaZz!=LqWAgw8QepGFG z57w0;T}WEnTw_~*A55`Z2PjZ3@VUgb9Q|S})Dl9<7F(bt$7<@nH!Dn4?|j}&#rd}A zmWBZQDjSwzhsRHbJHsH)CgoZ&N8hOr2`=P;Z+wOH%ic%zv zAhLS&EpSN^F){P?{XbNlbyQYS*X;pG>248ecnIl6T3Wh6O1is68blhT1*E0BrMtU9 zy1VP!eDApTz4sqQ2jkJhIeVYA*P8P;(@RROa1R+~LKM3L?=MU0o10UgTjn`z9%OaP1;`iAMKW`duM_s+y<>1Ps*f(q6ZnG?(4xx^8fnuaY+$;g=T9d%% zDf2=Vr9Z!rf^GNAv0&Dyee<_G88s)zHedsUk(i;!Lyo`Pl~-UD>EUIiA1CwB=UtCT z;7#3S2HF{qh1lBu@X)ODnw;36vLGJ&ZAOW#$u%-x@pnBlh&nGqjzW_=P&wI2rA%ei zSSAW_AwW)wm;UDfPhWv{4}E0nFd_=uWUAvPNJH1mQ;n-s#yUM zpDK`6EcYc_{*=dk)~@}VU)SjJ|-rVieUxaV;~Z&dR0; zG%_#@bBaB9sTl49d$`&qkmug5;A#&g;Hdu)1NwX<(IA%JefxR+W~(u6h!cbZ8KrDY zJS--d$bn_nJGSWdPPt#n;mXT8qdp`4)Tkgd=ZXsQ`w;W}}{e!LH^t#w0)Y1gT;>@KiJpGlo_YC z)p)95B3nNiAD)6%8>^26(SRD5uT@|8pesqY2CgE6O5f|0|GSP=b_9O%cY%~RE-_{D z$ZfAtR1d*Ay6)iW#ltGCuHkiU1$}{ln$cu8!95*u;`BrIOTzv)E@nMx|aR z=-q1}sjpD`Uv-B+4a(QB*Q6c@?YqZS(Bda*y&(&AUOmkFe>!oKFRD|*FTJ-R+StEf zjsw^}qKN*=fo^Cq>?fAA{xHa5QHa{4SPgB-yb3QuL?A+e+CiqDBziNlK4PE1ZjL0u zz|ND`k4hfJo>$-lgfpo%vU({W5;yLC&ug(yAs{~n7G{}Ktwfk>B|@O+P=x+2tKg|x z>O{lsCyFnToO$tit@u7Jb38u$8o`_@yl5|x_osOS%g!W7T%wBS0l|b5g`lnQy9}S zl{lSc=H58+FJ{zi$yc=BDH(y+YG~XcA&sxL!uNfcuG2#tJBoCI*z1sB_Utq)ZSxpK zVODBd4S7CM)Km=|NFvd~-dtbSRsD4-86$Y>%HQB1CABg2rX$Iomn#J69zpLI#ulLxZ42y0`Koclzww3lKnwrrd;oUW0- zYqczKgb@taHKD>0qYYVZB&~l(y9TMFxyI@)_wi^<6rd zpMI<8-KWRd^=<(BmPU>EJ4_&jl!Fjus?Y;nkYv48v^3SCnk)RFbzkyoOYmB>AUL>0 zH_-aDEwZW7;_!I6rJ7M5)FkYS(M1^ap1ZiJQ@qr#u6!@Wlu+wKw7jgJ(F8D?X+Wg; z@hEW6C?Y<|StxwmwQ3nRbh08a;Fi)EQ7|iBG_IN$=fL7f>$fNkTkwp;@cB0Hzz`&w zi{y4F5s|F+Z8@*D`9mKz^9d672!c3c{m=Tl^cru0na(K09^!+jOsB;1OvV8H=3hjqEty- zW~%0A(az5n}AZ}nZKnenh>nKTi} ze-3LnQK4kzz9quq7N`9N6jB)90#k>~@`Ou_D|PISlIJI_SyQS%a7&F}_Gb~Um@`dc3^z(^h=koVHDOYgbMVY@0OhVA|=Wtge5&c9=cn{47z zCk`nMo{n%70izZ;qC>R??!H`O-8PYB7#SX#0XA{*$$*GMJBNDruiT^O(`723z~mrm z?W8p>I7WA2tH{hew-Rry@V&UJY|U?4t>JShWD~i*=I&v0a&yd>Z=3IYuFJk{K8!eZ zw?{=W@Q%b;7DT|*OJ@HKQgBF5HjYffu@I>WR$_Il0nCZI0VPjVU zxI&Hf(x-`vF`0C{@SLD{gYDNZN)@>gqh$Eg7u`U>baH(?RZy^pwhe>3;Cmm7u-iZr z&Ir^yOWfDNW%2(uS6aFOAGJ%4>rhx)_&)?hSy|b0piqUXdpMI}k&8_NDFoNe84kzI z89+ZDJFtBV=mxUoHM^?-x$2#v-ETaQ8>5T z&j%wR5=IX7Gv}%Y1e}g&t#>*?4${loeY40tlx9H%T`Oik_!8bL+!Y ztS?4rfnj-P!34IGv-4{cTg}JaJ?j zSLyHO5$-DymBPw|Fcy6b72KFI4JgdOC(2YEJ+dKaq7Ehbl*nMo7-8q0pA792-XnG?O@H#sS`LVc?fueXNG|J3=H|LtwHPh3n9tDT4x^;P-*(V zS~9M1|B>+%;3c|pARVI3;Ql)9O|qw@nOkX3Egnyz)D)Z9DqtbiCg_-3$~fE&qUiS5 z-&?G-bo`D9O^8uyXDNqt{r$i!LHnIW7S_g6IR`1YBTia;MIlfmSKs>2=!PR4a0*3; z3BR@)Xs==rHKdc_+;$gpxqO2^+lOrH@CGF zHJ2;@v^u($jY#gclR1JF-UWPMdA-IJ8xHR6nHWGgYQ-rzM_*|^K}*bu0yalQo7P7O zK<>Q(W{EZ`zS{F1{e}!X?m>V^9$4|Ymwe%YlzUz?0RTe^XT(_`g3y5ev1X(XUY~V)%{|1X}tiqx__M>;P z>N@O=U70Z=TBS>)>er2XT9F}{zJbtb?0EIpZNW3W|KEe^OAty|N)FJ+Q~JY z{io#`0UCq#y^BgLvFZ>UZkgo2ji%=DG+N{6IUM4|HBNuh<6vk)_<&7?L;d&Zc%mJ1-CYIIv4s&!kB z@Rm(YYDY=3B3by`e7)4QT)Vt}yRBc6Rh$Cgl+aJLt+(VLc;O@6?!m!oVUbI@`8mPL zL(%cw@l!j#-~a%&R8~4Z)IMLi66E%AwLD>jy5U&ILj%~XMom_BvwfLMN086*oNvI7 zTN9ujJ`(siMUkxPr}{X|uza@ATsU8DV~EBMXj>EPgruaDB%G&(Eh1|y#9V0hK=ANd zJY0o!!$&ON%Z4Go9}u)-%-Fxj#W>8pOJpuHUmq=WDXWX4N@R$V?~clUpybfgV`F$7p9qZ+ zDi$RIT#jFShadz0fFS`5)Pi1_UzLVE0^7-B`as&@{KA48*wB;G($;~78lZMl#~ zR@8ICTf4~B-$bsOCd$EC-s}zGV9K4IN1`t3cca@Z)E`gdNez#KgBfdgI~)&?oGA1% zdnU}V?a<&j{xni6s_fWusd*AHOgCF z=zB&rm{-yvRfRh}dlhytIfc@o-#y%Sj2@S3(V|_3{DE$v9z##M)nk1lYvM@Sa;JDt z%n)(tvr?v&25pI)GU$_hndHCy#ld)bh?{SFi;aJPQlTtP1~-b_RA{8SR;nH zqlIpEZefE86+?S-w82H;DX(2#T!r^vU8EHuMEjFkavLmV`?9whTH)ptp5FvvuzGPC zo}IO#AIuNtk_k2YnQ95V;`ze;>;SPpygj_uxL(g|Og|k<$LSCIh~~PqJW4FArq(>2 zlXbM6A6qqy(zuC}<0KeLbqYCzG(=;ghIxzsITB4&y(TU>XnM?2P1f3O)DzN*4_soE z1CwtGY7KgeB;dWcoHF|4j3LW8_J%C(C3d>=A(HZe@jD%uigTYahENAQf$G3pT%jJGiZVH?~T=iZv zR4AyIr&kNdr{Vhi-HELaaMC%fLJw;r^_SDcfX>u(dFAus$ie#>K`dF$n39yF`N8gF zRMF?8Bg1h!trjb?hfZ5wwXKxQn`oe7w%HTERN$7RwDpwpdB*pW`N4GsV1U8vFaV?J z<{tz9)lDTL`K;qmJb*LRXQ1#pxuuq)K0e*aDU2vX;@_jbGXEGBh(*NhW|qp}sxL-K zvIgoS`Ly)6c;OZ16A}({B!KdB!;>q+RR1$uGBS4POZ~-oI8q9H-mq+WRa|B($t=a@ZRHw6ZdU%T5xbmCNm=->wpG(sY|eSZElA>tii^yTd|Y#(7(}4`|$$U$HyTqb#l-RwHkn*DA+0JpDre0PBpD6QjF+9dJVTdDZ{Ec zhhtPuAo77J@!Z$-UnjTF{amS{^l1+Bl0p+x{TBjw=H?4}@G9QiL~gCRiKtzE;k{Uv z)_)Uw*WJ`oJ-gyltW3K;@`%`lKNOx^9CM2NFYEg-z0r{WmfRR*Y4R?w}2R% zVh0aTi@1DDP0!C?p|+9moecZ=a{g4c*I3iAP{MwGN1W#1Qp8cEM7!YfO@TYlv007r za>T98bsNT(Mq?AUQ1-LQ-~J*cMQJ{Ex?t+i35zeANDg^g9momuHJjrbu+(X*R*uPW z)@!wrm{|r%Uk3xz9B;8T z*Qiha&_A+FSE(M(D~jVqc*kX!&3FXrvdf@M-uVN))sUL{4ef;3-jr2Axh}hfO!YWZ zs&v&C!Tw65;_6Cy8`c4quH>u3UH588(}wZ+sY{n6(uibRn1B@Ua6d@D>WGK4JSjf7 zyvq-RpvXE+n8szW0}=wm{>E;P#l3hjB(<41F?VV^eG-{7sm?a4kD+EhX9~3r~ha%>$qsun&*w5UF@0%L>)o@y3EvJ!hW4Z z8EX%Ub})QnV{5FlFf7!7DAH>>Iajj@wRWQW+&Dh%X83k^X9NIYaGYJe6-tv~+Vi8>IH3}-(j5W#=ygCG?SkPKmuOP_ z2xt}_j-JU45@2em$w|F`fCV#1CHe&diI7C!d)^oPlJ%kWY)zNI7y-?XjDNsE*#=;L z?@|4WwQEmKM##2%qm8`QiS>;~rqlu00Q#!s5{+xADi~kiD{#F>9v}jD_x3ivn4cv2 z-ja5AOVHwkU0gb!=K+V7$oMKSTW>~iU6%u{l-DV!*(1bn`xJb-0IWsyUey}dGGd1| z={96!M+Pg+*Wc=@#>-H2c&BpnNKvx({QVlsUnsA{1To$@kj0D$cob`!oFs|O>V5U3+8yEbyO%r(UWBb4z0U?op-1C8}%Mmy%0by%re_xA{InaOrFxT>= zsIdo`A!mRowfj7@a9^$Tzs8|pcgJHsfMrt!0=wnr`*Q29X~vY37~f`rrA3GROQ4#b zt#`Z+GY{`#9T9qF1vjthv|I3~X}?6({Wjmoz#vp?v3$&lS1y-c%C%(7A?nDx^X$u) zFFQv^dNXV=ZT=Kww(efqy*wtDeNV)_bGHfUa~Q535dD?v@Z!Gcgmgj~6qqu$=A?kJ zd4r&%kCHO$M43$*8Z*2E!iHTvi;Ix83nE5*3k=vl0;v&0=?Woug{KVuBYGuDi0>pU z|rWg00o%=NMAoYIp|jYWN=y7(ST08uRj&W42$Nm!ZK*t7gEZdqyxKr}cTRySP-AZxztWuCN4TuW zPwo&XD2R^$E^S2LG_`nfTsa%*^7nG-kT_K7diFU)Pm|GQ1?j1M$Xly5>NcVQ5w49! zmmeO9y^{+;LHU=+o5arQ}{n9O<3s6HO zx73P?vtCmA+gW3c_J(MCT!vHKhwg(mm5?TgPQ{^~zFTjyY?q<-2q~Euxb9-maTQDR z3}L0>=G8YX;!gZrx|gjIABpugZazeKw;u~7?kG>J=Q|S3TpA`pcfk32RlH+1i?n2b^aK{Sh zI4-k;j{AK8gu}vw93v~M5>pw2lYKzEjc;O@uX$s#O_XMLf1ffbgaTEVce9G15|RQ) zEUPEc%2rFPO@;zQ!iaf>IrBBL6B^O8XE91|zz*8c(F|c?Vrz{OrW0o+1UAv^>h20$ zHn#J@5oSe5!p^bn<3OnO0)%msc0&fFj>t~@YHbbAmQ?64TUTxZTqlt^sVzz@dz=d-S&LDS z*Vw$dV)z~ud=D_I5GIqQ0F&=eEhRy&@29ghAg7ZPt!?abE=P;qj9j{n{brI^yDC_0 zDz{B`XPxFR0XhXL|LV8(x2_g!HoA#RU-Ct%vCuFhB;203T8$QJdHG?wq{8^B7k6 zWLPc#ii|QLAz?b>C)PKRDZ_w4Qlk zzYZz|$t{tMnpd@&aucTrWU%BwZ?ADy=VKb=cTo-p`xWsr>s_-gjAvWPM3(F)MY{=6 z*t~01bqbo;zgokja8mPmzNZ`NNmq*kMT}gG`g=P5_Yc0vjNd2S{+|5{CnfUGVu94f4^Y2^YORgd zqkv$tgh)TLkFPqS1oejRaM6hhdSjV%^}JZOWl0*I`NOvA$PK$Y62Y|#^jrvaDQaR* ztt9qj>Y%=qav;Q)w9qVz_cRAbWM%*+F;@#H-6^U?@M<#7^~u9M9!LK$A^Un&LvRF% z!AUNRT0i}gog+T5$p6ozFmqCvn)96j`4W0tac@?;E5)Ok4Zc|iwi}}y>Op&=>#LUL z)w*l01$wqo!W^2dCP|{0WhdB$X-Fb&5P6gf^aO@jmi@mqafx^Eo$L~nVr@#DvVPX_ z?>h_}#8b-1X>lO3Yymm2G=In6TwZ@%UrLqJ?yI28?);ZK|a7;DS8;!v?{<1o&^ z3K(b;WcF`aIibNgp`-KqykNCa>(gRIsL59$u?vi0IciEOTMrltT4JMRq+so-!OTUh z!qp0h$sx*!t7ydi3p@SZd9|r~s>pG-wxEYiwmA~`Tq_-)HFGs`E6G5-0Q22KJI7G6 za6G28TT)6_Kia;WqGW09zIkJ74x%~wPnE4Z zM9Cz+K!vk!GB&Cffy+KO#eQ31_XrIyGI@U3E6;VJc(YHrZ+7No{p!)I&b2hI*5x`p zo>yZmGDuK*y+5mhhORjbQYAqgaoyK_Cw#bE%+VKO%!z!TOHNvol=4$7n~-EjGn$`O z&R>og0U%`G1E$kMjcJiEkig)rt!BpRG#RZYuNQ%NyF73F+YDyV#0j0QCYPhmf-r6a zG_wATr?qypGz~x?<1{yuLIL|iLP7;?4$)mfQW6~2F8g>?+yG}rp_1>mhGYe*v~){FTw6wYk!6TneTAg@L_&(ssIUlIsdzXX}H| z6E@)JuuV8Vv56q2dmm9HB(j0l834?)^6_n}yw&xls@I8*Fp8(twzZ`JdyKGUbJkJ{ zfRH34xbGi6J~aAX3pre>HjbL1aP4Z+;rm zG*Y8&ss-<5FpIgWp;YZ| zAUOvt*fhWCV276DCfTZ4umLF~EHVQFC}>wNQDhgBDB$0JVXOjbkGOoA%RI#qNI$YH zZH`$^XJWToa#k-l>QVcUUA;JUIgg*R7;W}zl){mU!0gZNu(3$FDz~Lux zST%bdgEo%b?jh__tSHSpQg?XS^fuWyOnatU?`#2q*D+t!Y@A6>DJ*$4%^?=J_b!{^k61 ze^!F+*ay7Vi!RYcI|w(tMa>qkO0_=BjH@ssD=|1wU}DxBTx6G*lchE1B6d^wylz2 z8iww@>j=SzMSniQ9~>DvuSYn_p;+#oRKi@Sp-bdIhTHkkk?SJt6mf*4WeMWm0IJgQ zWK;^M&bAP4=Z)YG-?u3N5_TZnXZ4l6<9n7*`tI*Q>ItPc2>(HyaNpgNVSCgt$G6-K zE*Tfii^-85dHj7Ky>b9o+stF(tXBNHV4iGpuFzs9C4Rp$=a{Q`uU(=>t5yGxNs-y+ zkyMG$=&$^fV%;|++Lu-%nSG5tB|fbhGI;XNO7XVS&V8)iNC`2-r!tFUn>u|n1&QT!*nUeSKqy;&^u~4f^mGlRj(bP? zJ}FImwfKNF4Ko~A+>>ke!n@ve8XDwk%gRE7_w?YgzI*UcN{|}mt7#EH8OJjB3e^Sf zC15S}Dk&>*B?>a${t?l1J1zX|nrn{nBLGBU>nSF^Ot5IWX=c4uGme7+$m14(an8t| zCu-|2CH8C8n}fr{e^2+v zTcE>6O=J4d&$Ycoq)i7H#Bd%S4czwsaB7r(D23oPEo`HwUVNcrhUE_nE? zB;0N>W2ldyCuwPRLjT-!6_!;$BiuF8;e?63TTAu^O)1%l&ZrnO$^Zf!ZI4R(J*Xs=X;*?G z(%U6v5fmtB7w^7)D^59cB>z>Joz{5V6fa9XfI6esXTn$OJ4^XrB>*A@$QHx@V%T4D zF?@l==(EpNIxcA$SJPJF<&O8{whMp%+qb=5DbU2fB((&7kup&1<8^1_8H~~tO^bOb z^)tKk6p{@&?8n`juvnE0j8fQ{#Q-f1IiE)Qh!bpL3%HfK38dO7>~@*5di{!O2}|TE zo%my-@rCnbR-|dsDPw!4IOJm7mR}u5!W+1+=WVy!bc}8on z8Khm?wsn9_;TiD5sBhJuYoDWUMH2KM|0zCQka_!;K?^;#jr49K1KjJ+1=~ipT~=%1I8O@cQ%RCU!wLAQI^AD6A0A#a6|GkH8Z9IIBT~tu$_gz6?Nc(2r@!UMd6)SX|59{8j*DY_tLBg` zZ;hfgzKf_fZu@26xOr#@21m^v%@)xZCF=8Vp4M}DGDHXNs?gs{bMpQyEV7W&Fcq)* z2ic!Z?a6_xy%Rst#HFvfU+y>PEApo!aed0<@s8TycT3_+vI~@k)XT&A(~VVP_U5hY z3voRdA2s}`CnkSW*m)?9PfbXg_UyUJfsRv!?FuGjq1&qM7WDMCZSpJY6Wit3|1?pw z-PY&j#n#uG;J{=ThM^Z*=1s)ACMk{2O@X;Ztmcel)MKvgk5HP=V>e7X${{GX2dj5FuUo{~3n9l&Obn|N|IPzrOh=*T>_oW8Z% zM&b43nDGzr%@I;5m&2J`+7};SQo7-Vr+lbMNl8C@dBuRC=T4vN=)%GpO~*t54h4lM z{}ad_Qxf2 z0VngY#a_dFbCANL-*)ol3_@-@Xf99o*dNAGIbqBSF#GFG#fsqjl6aFxvB;M^^WyM- zc7|8+AW`owU9Jt26O95_&LZ}TR<^kF{T~T0&rpPG0qI|h)n_oK^T>m$aF+m8Dl!|t zYA{5iw_2G5u{fueGgm@2&J4_lwO#t)>O2*LQ9RII1f^&r^Cw=|($!1!5y-AVvp+#x z^-QKC%o&(y)-u)bv8T8G?TUBvvn?S$3(rWg4 zmrNXvy)~Lt%u7fsxj~UHGA2doxa z0`(uxke)VL?}J~WNQ?@qVTEqkBcc$3D|uVOt*3VLL4(I2I%(9$z3FPggYMh zf4^IYJpqsFa^_lzKE8fyZvc9za{~ngs_6K1Q30?g*F%ldm>UlChNHXw49MpoB|QX< zArQ=ww|z})dqjb$Q0BZq?Q`8Y<5i!#Fi${CyjI+NUw4qdc_-E%=9+^#6d!-OYi;o+lssPnwmSG02KSJy&V+E6jgGjmgAvGP5i^7SK6p*hf{7jEdTrxY2l-ByQ@#i5b8u(hc7 zi-c3Nb3_H=$eEqZfsgSbHD*jMq&EkuTE)4%^-x$D-r-ZL5Yj(CN`^Th17F;EB)N^T z(1Lr79h{tg6aSdeiVf)jNOZZPjN~@HD6pV;JZ`u_4A}1pI*?{Ak*To(HWjDqi(k>- zGt!N1Z2SgXbzx|`duX_Me3B0rYDedmgQC8v>n(-HeH%*QWaVc6n@K?vDsF@lc`>oD zFf`EWnKofcJ==WGib7Z3PlX~12t6SNA6*XTrEE(lCis)SpKl61kthgW5@Vg#wNAeT zpMw4ykoBb4wj_YGqm>rdq|{V{iCo1i9Y?BYvw-q31Hs2#zW1oH08!Gis^YWcvX2TX zm(K+7*GsPWbFv9@bGON^%n*ou4=L9R>A%c=P)ZEY+*0|P4;sRQIt*gR#(V%G;%AcX zFP$0!qP;GRWPpkz^WAj>QQhGWH+hjSAGYF(4oWhhlmx(N{vaF_RJ8FK5LJYkS5)MW z@a6_($f?%x6qjlr9&^K&S_{!uAO_J{U?%r zogMJ`aQIEze44_$z`tsy zej8{fQ z{^(@Dab<$|)UKxjUWrI?YIYJNb=8e=#grNOc>7C*MuaUh)Z%yQ$S3f%j8LjZF%&cc z8VM+KIj!e=sS*!98yG~_u6P6s%;*mcPNJX-JXD=HsUj-_wz2 zOc+GMZ?(&A*b6m}g?^y8{xP!b$pwXfI6JK1bHRe{a|&7kvi6r#>JB%fn2;PWQX&Jq zgkbP6-1I5SX7GsnK10FdSsMte|2tr+jOfV@kOf%*BP^V}tNSO5i|+tARN*%A*&biS z(&w&HQd3Lo3(&!wx(d1d1R{NkoX;caMYl&F#>s&?JPux6zd8IGjbyF7Cw=oJ5h!Kl z4y{A<)$fIIfOn$!+Sg~!9_D&Qx|&6*O-T6W9|%$#2Fl3Sf3I7fSr%%ozno9Yd7Y=M znCwqSh-F~{Z(vSkQEcno{&D5@e9_``RC1-$kftqZ( z>2erpK8UN<7(acmI*voIP%9FIS*+xiN+1y5yjn@DH7gSNjOeGASll3W1n;s&WuEWZ zU5l(sykXUUT`1U3+&Zq7GB)XkMpKX#ZvhHra!TjJ`PUC(nWC{mY)Ump=qE8Jh8!z8 zGO^n!>Z4W3kZEz{cw3uzYDx!=6$sV%Bm_qjJ4cC7n{L_rngGzK04(z10SjN3T|&~c z@XNu&i)@b#q_u*U%IMS-xBC=|2+@Xvc*|w+ad};xn5T9!;EK(5D+2MtOV~|E>n+za zRt|_QtVmSX_Y7w!sYAiwe+cj4@w(yW((&cUxL;gCB)`3K^^q;t_?Pi`{QUjtNe{?1 zf`Mklz_JWYWNQaaZ zqu{+~^pu_Gq-0fV@R2qiF~otT>I0y-0SaIR7#89xO(4&d9pn5a`z zDbqs$Br`~f6GYMqczX*B4h@0aX#nany*`q849NalP}cnX)ChWhc`Eef`xR-F{}ku> z=2?D=z0!AEow&Gg$&P;k!wWt2=mTVvKafnQx8A)~LVP+<0Ewj5DJ-Z`04wWzmFFuf z=}D}AKaWp~7bbsc+4qiwHN>^LSjKc10i;*}Wykg^6yPYRS4pCrtYsG;W@qyOF(rtW z2eLU39|lbuFAW4CV0!!t_dkB>mzyW7J%3stP1mg;hXH~&_8;#Z*Ie0J@^Vdkx5K}q zpx0%zF;t*Uj|gWwL;XxoqKF-O&pH`tp4>Li@qsPfbQ=%ozWkPpzkT7)NcstgQmi!w zbz6MAu$Jl(cisj*2GN0mRN$zO6l{U+TD?d1-15ug5WrVrmD!$Fg5d923LE&r_lA2k zYXb|P5yrC!>xWNJ?3+a>x9r&PBY)3W^pP)sMJqd$zUA^huV9RgqhfSFzN;U* zge(9uoIo9X49~8LXvq>hHqPtb>S$bk=5!>fj5oAgj@AgJp9+>_@j|V``VbdOgZ-<> zhqL!kKS+4LnCDqVN+M9B7GiY8X9=rk8TrRhU43< zZmA=Sp6F27M%i)FR6gf}$Ont{9V<6%bNtLLH=aOI+R0GbB+Qz$8m%wb@B6IKBFt+% zo!YO*41i1nTLxDx&LO~?0ac}DwOHo|UfVCh;c01y4`+#yFR)X;`dhfGW1(I$?^8kF zVjx`zA;q`eEPdK*JeYTWkBlq>URMNPxmLV_4;MHq_bbAsa$~^TIw3IujJ^fYNch{q z6Afj1v^2tZOmbrWLQAg7Q8q*M1iLk{O;d9D7$)ec0KzPgQ#GnqMAH`EE?@ifgD3JO ziGdC;+^Gk(3Wnj&TqFNb?l9xv7NtxMhj9dcFM`;<$I+utAeqj!TmCg!ylK<)uj9yE ziIG1uYL?q(-U?dia%ckS#U(RjRV_5P>mzIFPSX_{%yOtE_BHH0t;`x2x|_-x^;Vdy zr~v6ve^5~@CPEH0qAzjE_U?yi%s}y;D#+Hc69lbM?qMnVvG083IYIJ`dzkN;LQ7lk z2~@buKZYF-@82ht=?#Co9b9F`*Y>-IDmci%A5cBVc_93QBbnL3frFfRM{ozstWs4%^|B< z1kSf7!R^U(HM~dXYnwSW!cnk|Og*-Uy?aBBS!yk8nkWP4&BgspufBmOE}}Wrff@6n z0&Yi-*Tp#56yAvBiZ0gGDgvMpR1Qf2lg+WYXpuEazmi#JOuc)qfVYIlMs8)b@6gFX z=qx8V^&K~R{%l!hvS~TB2*8m?<^zp#rYraF5-2te2DP#L)r=)`-bm>gcJp>xAIa<1 z8W=D|9F{m5y&hAO)3?dFgnrq8lGrq`?xvWib;WXV=?q9R-a#jDW!u&PSCzb4)o7X zX2H+Y>j4FE*87%9r`&Qocxc*Pn4)FHZJ$)n{m{B<8U_8*ex}D3b-EO-#+pkfc%`)= z(G~rT#9IKgTYOGZfVG@~if|LO+o5G{x}XQ4ux{_Vn=|g7E3cRB9du^Wj<406hhrVn z+uoXDz)E4j{$!(y&Uz;fCzD`YI-|AF2s-V{-j=prjrR}JBMwoynEsP6OP}&?#6`cA}EdxPq_t4P1~+cW4|UD zxo+vul(v=!e;!@baqeN9F|1W4XypINA6U+?iX9qh z;^wjS<0!C7`=e*?%#*;;dX{85>Kkk>{JtOG9_g z4E5W~jXOI#ze{c3R!abEA^dYGGi;NZ~G;UL@fGt*M~x#e*TgW=ao8p z#q4(j_;GP=8{aP11$Ey4TId-{n`i|M3-=K{6wssiwM8(uh^Ahbb6cjV&<>mirFDkBkYkh0x?cTFLIi>1&Se?S-eMjQ$?XPCe_ci13K+)%>BjbFyrDHdR+i8bj z%9CclvN1S@#<$gGw}=+yvwonfT=M()tPzNw@F6#0NZ;0b`hgt~Jl4bNu9t z>i8%9z@GKHvOfA%iZF0x-PF{Yi_0SFu4KVKNKDP#;?i4uP{|?WrY^|;tIXPe3 zU(C`aFxgOGg`QpU1&=zX&A2oV{ky`mC}ePV-%cT8l_W#i`ggynzWlqP@Eg@3V^fVK zdP50*w=Mix#H$ak3PRN!@esYqLCeNv>gbO+-8S%B|J=9tZIzXD#6(3=J1C4g4Nu!= zhyLpDx0V^<7t38j%xyQPbUg_&enP(Mz8TcPmrvXMyXjEjrik2l{l?hX>H9j($jQGS zy7(q!LP%hZ(I{jXS@6nwTjPdn5tq+Rf=}~HGOBf5A(xP((P+vKY`#Yu6XMn(XoL|g zztQ+2i~H#VbgKYJ_#!T_%ok659UbsPm*9_HV_1BV+IWj0Tv!weIvVEdJ2R_4c`fD8 zp`XtahAv#LSM6p)X=1$gj`-$0med|>;y>zSuX}Nwx_$E$dZzo9iBY@aOx#u4+Bc3n zFzE2f1(y!)+UH2wYQ8Gnj9o(1h}0$#TX&+IuGRgs^o%pRz&!*dw6HzRb-8mwq4jIY zepL;-l8)68lsb;Ev$N{3yV{$`lo9VICZDHsebAQS+T<4^c&((XD^82k$$|o;6M$XE zozZyBWW`x&ta*nJ9*3nnsjyOt1+Cu$@zWl_+|9ZsD35$D~uqE8|gPY5eElYdhgYr6g=V+PBBsu zU~O4x5<-{~{Xen?t!$GMg=0rj(K5aMwGS_!=dDH;5-5xjNn^)-KwI$n*>U6$#QMD9 zFkve!VmS3!baJ`E2>rPYu6S_(sO}i}Rz6Iy>&?}NUtOs|P5;pw-ksP69v}V8yb6W9 z4#lejo)6Y?AR#qleX(Aim$xCGmbv50y_xauV4#=?1y;nGTs(p{EsppnW!>&1$7YE3 z_;(9sDM}6rnp`AUFK$x$AZX<^ZmFRUS-)mg9IeB<=onEA9JxPPae^xmV-1b^T)AM! zP4X7CJsPpWX7${ik(ex0Y|NQ7Vi4=mPNYF_5)AArUH&?SNpRjhIYvhejO!~54 z`|M`hptFIZC55=Su+vi6F#4stfQo9IZk)H3RsLfXkLUAy#{-F;?$EAvr|YYA`$o-r zFMET7t-pii3`}(YF6QL#;NdYvR$b~@oU&P5;Jn_QYGeQGXG*I4MS9OR+*@~Ia~FOL z-faE!RPm+k_J_DQw^xOxW^fB<+n5cef#kDJey10}$Gz&J3u|K5XTs5-mHP)^aRsszj?GB4w zfAKBi%)rmOc=9Mq#g8}O(eDu@fpoAt86MXffmG?=yms2d8P9w-;0eVgoGp`#wJ(4P72SZVnFI+;uOZVn*jm7`YmiuQ02N^?KCQ zc}O?SIDrp|1aUCG+j0kHPA4)1`xk7FjTE)n{)ei!0IKqf+P(p45E1F_ZVnyN-Ho(# zNOwsiEe(h6MnXYCQo6fDy1S(1-TvR_nfLo<9L5-S6C&-3^_vYklpsAhOVAjvtem^_TB_M$4=Vq62bA_({4y${+<(7k$71gO`liI?f z7alI)_ixw074QN$uyuHWKU~Z>jCY*aWQVmuTHd4RD{e2rSfwmzz8GCYe zvWp6g`3Bq5N!z7#QRv6N=Tv_8(@m;s+M%MDsQ1W-epj#jAaEK=O0%J*h15xe!om`v z5^5EUZ~3iEu$`RgnV9l*=e-XW)4)T)vLemCR_bLkVB28Zi>0Zx4*U&Wha4dzL85{C zvY~_JHitK#r}sslKbd2+uck*k8qPcOk8+lIWX47gmUrKdcHZ7@RXM|0SAALE+IPKr ziT)lRSasXjJ-FEM#@A&-^Hw8PPq)`v`+;`K8nc2v(t8Nqsvr)1wRUFG?yhpXjg@m6X7&1X*f%Gl>tTN2s@w8%>n#G{qwfg6~PDL{xkk zVu^Q4U4o8~8D7RDm%dBSHmHq{&PVBFH}C60rN>*SzW9A6{Lv%C6rUgRW8Tj=kr};5 z0NFR+-+bDQqFo7EZ%!fl`ZRtX4Y>Hy}u{SQbr02%ms4X<>U0* zrDkRm8c1eztjJmsP(p--CN)r7rEhdXo~iI>r1C&&{nbD*y-eLkpww4w@wB&M5{{i3% z%sP(01M^2&pOI9zL)@GWrjFJeO$y=ZhkONftZpb={)x?^TvS<^yI+nh(X%AbjMqcYUKt35c;AR3v!3LNyZMpm{vz(c!-mSf@?bCXKb4v?Sc@=%1 z!}FODj=X|6HXcG`{~JX`<>~pi!OPp!*cTtIAvkA~VabWdY(M&%;~X41yotIx?S;Mf zQ+VkaP$m~thucGBKC8RjD~eVMR)6-19{CI6O-d59P!=YH2wO5MRAQ2j>N> zILWf=8s?Z)^erN!!0a!lmUmMgHLE^2A8$f(rx#abbUckskLtmaQBhFqFpA2^B=3E{ zn3j>AZoV2s6;?OgZ6MT2j1d(TEQ$E?6Pot<&aebFDhpB?6(pB!zK0W<1J zSYr%fb7lRGUTE0RCFUQN_f){zy9(qMC4Y7aCuo6XklD$yk}mR4CJGPA-j<&vRrP4Lz&tT<05(e$vfL^Uo<+OsDw&2u%c{$|F*IIo#jLk zGRH2)MGP~f2twipx16QC7@Z=8p%m`GZxV{>da~1Go={8{Wt-}xU(1Y*K(XTlDY@#I z65HywFx@LD^b)IQ@8>bZkb7;ZYRf8fuGs!M&{iVhZd`e2!p*t9_MZGf2q#_Rt-9YZ z_Ue?XnkIMYtCt!367p9B^{QI>tV%74o`J)N6_{>HonF)^Q|K5BcfnpQcYd?$42zkh1geoIG@GdG)?ti+1AlrtnbUaK8HMy$2sLHeST-61b!n7eg?E z!E!V-EH8@OetG;w*M*sdg$5h-?0EHw(9vpPQmG$=LGL~*w}iMg5_Krdex`ST zQs?cI7_DpijuG2bJv;BGg`I7R4(8-Li-e7y5_)(;#zGE0PI`vxz~%H3u;SF$zqhRz zb{X<1nbb8N1c3q2n(1GfN=ohoy8`!TK5S1%Bs~)hOiVlNY^$RgT)T3#Ne1oCFWuc| zV`7yrsvQFe(uN};=&Y;X0RT=L6&>Ptm}y*4UXG!qh8#9B9?+5Y<@Yl`xIM{V)~qyU z^d7T({R-g(q61Fam!4w}HFd0wxy&Z#_68)W*VaoB`gH!bj4{KCj$JgnXN5!E>$|pdO#!7ChUrU(!Yarc7M!d%yQl*LFHv zUr`XAZiPspgtp%2DZE}sk-PlP2h7Wj_66VRWu2Wr8G|0_^g1$A8r$EAtG^*X4g9{m zYfq>9_=FXZo2EKouYuoTP^CL3Vn+-!=HWIuEf~0b+`V7BdE<*_#{0tcyv^g9(`eyb zAm9tqmw5^Bo~Q~p|L+1MW9GcI2QQ~o_^lZ>ZCG!j6=AJd=l5E*Fp_R#QOf-9g&t_i z@R^rEsCZCxeSEHDjEdrUpZ-Hx1*3$#oS8q19E%=)D?(mfO?b|4*sn$5C3c#c$+%ZF zfhx>1Z=a(-KBtlKyhalf;4890lu)~j+AoslhrOPmm<3atW{7_GHVoICM!?Y~1Xr@*6(HfXOt&!9nTfKQ=8+oZHG zJr}+idnAUskq8Sb>nV@lDB{{czh>0yehS#*GEayoVMeOK8KGo}ZoX%Cx#d}A;{Rx6 zo{&-5u+!V-cgPPJ%o4F|YGNS&{1a=(^dj8Ud}()m`7>7Qa`gL#NiGx|k+TJF6>u5` z1vGkmOyMEopd_FNrPb(V_3d6n0xPoGW$Qr&YAUlsNqY?;dN%aHrHvGCYT`8<;X!42 z1>=iy4Sjt%3IA{2)%7t46)p#d71eg%zTwD9l+t78)zzi;g%d`J!@3@ExGbfn;FxMi zjeU!%#{v&iydw};-=_!HsJXh8wRLjEP@?zU332YS^ma;^X}VYt^V7gwEZP#i!rKcZ z1I|YN=eB`m8Ad^_RUeMl_?R4hSbn=7>B~90Re1N}_Q|G*L01_(wtw0NPI^$`EEdb$ zF!|Y(7VBjlYjr=x%11=1aRe2Tg7b*V{~@3(R3bdn&NV zFYe>%bN*q{twE3fRYLVoVth{kMgUkl8c9z?t0ls``O*3rTf9zi;ozC^yB0F_bl*0 z!I9&p)z0vjm5V%4Vf9bzl$GX*z+TUm2wxEIV z%xrjMjAhqPz1Nh=2PKMSzd zw4e>WX;{iz55@i4?2M*P0sZ@b3V!fW-KE!xEQ9mHF|*!Gcj6!1!&XpxN&i_$NyViI z)hqb%tvO+qDOJ@-Tm7Gk=oVTSnRSzHpBrBB>G>?+>aK1iozv6H@^o*m&ZtZSwN^Hwh@!c4Y%~s6xBV?cdLy@V;XDb=k)Hka0*I9=xHHGAt0EI(g!m zud)soa~lLy_+edNu;8&p&n(yoG%$wh)lW=b9~t&D=s8hgv5UF=r38{zZ?!xYM%Oy*!qQJ)jNI`L+4K3xK_vwAQJsg*Yi?!aFM-U~VAblx zujMB)ZhuI5`IqZ-7tL^7Fm|`u(a$fc{qJi~byZN7r#rW6ip<L$(?oWNHrQOrQr711F65ooApsu8xDy zH2UcB{ylVQN#364L1_COSHqIIiseVySE^$&f$hJ=+KlkvUhqpaTP{-Y_q!XKIhicf z2MtOFgUMG}tv01U^54Yz^A$fLBFPXCWEU0D2RiJ91_xkkO-u`h&L3J@dl8rRD7(-0 z<~Gkbx4-IGwX(cH4oXf;GYZHCX9LIM-!f|S1Ap+0*5d>n;quz^Q&X5yL5(cWhlP+= zU7hiS6bJOr5&j(Li|}M1=S)ve_g}f;H!Vwf33N|PAOjJWs@4O+YTO-aq3hWpVPS!w zF3;m&FkCS^>~*_N*RXSIf9scn{S0c(*n$ei;^O>hvb7sbp3KL*aGGi3w?2aVo>jkt(J|9)HaKjlUj?O;`fhlrt5y8*HpE|QFvDC8&^ z%&#-PZB7mF-HGi?P`_Le@|7Et(5Q%qD7EBoZwvk~6A@O%Robu9!Df2sDqzTEE(*#Y z*7GaPb+p*gg%n$K*+bREA|C5MqkWcwmc%ei9^4z$%N|B3B6wR4Q+5QTi)Cljvp;<9 zBd(ud)5b+qx0Q7dx;LFnPEZR!MH{5d_NKl(s}3B1hnqIbI$1^+9W5rCg8DXJiobKo z=GUmT6#KXu z^~R{8kDBFE1I*>Gwh<}92KJClK4=cizN(7J)N|!b!3opcEn%>$fh%vWpqv_q+8MFm z7-ZWZx$fEu3{;M!SK9cRAojc1$d77eaO+eD#+f$?vro9&TyT70mUJNdoKg9i3T+@Y zEK36SvT7x@tr=O*{E~%LbUKFHK8~9qTPvk*)U_J#&W3a6tJ;q6b^x8fp&@-#UPTR1 zDKyL^6w%`g2ofvQ$qZMX&^;74JsCmyUtV3_ZP^4e#$LOP3YoEiE{vXDS62_6Dt1`h zn9;$3EokDoxw*k54h^AJR1Bd+P!S7zBo0M!f@`Z`?(5x$97;(eeK!v457nEuk(Ydi z81hjew@;*QE9As+?+DmhOihM08qc1jRmRC*gqY3DC94@3WnCIlW9$PsL9|4PtEVP*C<&+ z-ndd~-#4OOf)KTXeLQOihmEbl2J~0)AP+|F-(g|(x%K1D!^h`0j{#)8y;72tYEjV= zK)bm{hF^CIB@r~*&G9{vRKw0vru)}v`g^qcWL1F2H?M#!=B>xExj7vZqv*F6#K0b+ zp_NiBi$X%;AJ(Y}+wuD1DfPZc!1v;uB{bbr2zAqna+NRLjQ7Uzx_cobUH=r-%#&hk z^G@7K5~uHE%83E&!l8FNcA&Y??X_!ok^}9mt>9mJleMEs2k4ej2XM5y9 zGnl0hd|E#EB-I5MSWcUdNF;sDaYPtahY+YENu&prBuj7{<15B%Exk_r3y#|2V|gf| z^z;?B=igNIkn=yYMklk5r${6zrtMSOW#N)XqwOJ4ZjWTiC9#jw4DHDbt=kV$<_458 z2o!74+KcEFjSCMYgyl=z+h-6%EiXRka?XEizLH3<|6F7(e;5&$t^;ZX7mIv)OFhmQ zxAMVe^Mt8a!~2=eeo_2aJp+@kWCaynuc-_L?82F+u1c>$t`^2N1gWCYSNCCpMPHYM z+-)Hv<#Ud5c>(2(mTB<8L~(1NY_Q?x0Q2Hi{!M_en52+un= zVS;*{8WNs&yAkg_6kT&7MoU*(UcsDCt>RSJQi0uSNP~Z7c(tg$xvAmi{z_d-&2~|V z0zTZq>1L(Lbvjlb%UJi+99$fv=I6h@=XY%&!UUJLv?Q|M z>|cXfk`h*yb-6ZNmswgy2Ct$(-N;BDG!uu7+ap*q*<}7H-#ZI+)0)X?&No&L63Ete zb{oLXhW_*%H~QW&x%xLDJ?NL{5BIH z9)$@WU?8B?@c(REI)W}lzwaV{Ig#vf@#4J*^rr!2^gErB#?WNy3Ei>mXfm-P5`Vo7 zmi8I-rYfZB5AJGeq2?g`;}pi6y`Js|tBdM){y|W!6P8iWAqo_NjO~eJrsyn@srv*S z+?L*kEE!yaCw5K(A=d*LTqST6MCQ_kqy^~Ke-8`*8)*Za zCFeE_VwH)3fERBmvmzUdY}GDfM?yf+EiRWitlovT)i_$hN27EzsFX(3DOVwxvI(kU zI}uR@fA$dwI^Fc(ukyBOTCQFGP!=T*A>8~qcu6K}B0mlBX+g5FDgROSaOBZ2l5UER zy)3Flvr9*^=6|qTzxP8#r<^UaS4Qn%yz2%6M#H+m-;wig?Y8){INI=#sC( zve%~gCPm|XoK?-X=h+b@NA8>?d&3jSjVOz*Dk`JJLOd)?fmwAS%{(6(nbi*yapcC6 zcSbvu$5N%jPrtr|s0S&S?)Ta+XVu%>-D+DM$h^bd!B?=XO7gy<`tXciZe=ZRCp)*~ zzjLK0KP-1_EtCj7Ud&e_p^GHl2Q`ub-#a{oQ!)pG{$?o zG~X^tzbC^=&W?kAzwmL5T284)WZYo@Ex)}cIQ{D+Z_R5@G<%wF=yt4qbO_TZ?6p+F zG*=P3sET6L3>k3}8n0&%*fOwT?vbSN2?$E_+Y<{4M1S)*G$q})3@P{osGMSgyO7zo zvZ;okMcG^L_04ZrB9Ztv67x>Y_P=~@KJXb}oU}dp5G%K8NpoReT{e&Zj+@_Pf1#7x zj?goq*W5M81!d+N6)F&1tZ=VXCf<8eyiwV;FDLXho43FIISy4B`mE<@y^d~;%l zMTlO8s7)y;GJN>RP=WZELJ|#{-TZ^1-iU~*(x;d=?3t$!!)C}RO|?7)d+GpG(eB;@b`_0)IcwE<1?zuSVu<6xgp9R_K@7N!# z!2WiVV8rHP&$X3XNvZGXdM&itHn8UjElJKP{lvLjQBMvvw?%ikQ%2Bd_GQncWw1OG zHXF0J$K;xeestwFa~*NCnuhd9i_yv=mj#2*d5GULd!$iK4-&cPwtZGjKL_Q=4Ztrt zYQ&bM=?EC{YowsiGzjfK1R@Z2Q~$^qz~DC*65im4i}{;T4QjSsA2nZ6C(40l&+V~g z5aOk=FhV;d>R_5n3$Mz(2aaddwwiETK4<|Xgt^BMy3Sm@VMr@ z3PzFK%%C99^j4^D*+rA0Mwv!IrqgmW=11AMia@Z7t!04ATxRaK zZd$B9^w8=$@h~Ulc@>KJ6*3D9ib~YPn=|{Y?=tP)ULBR!CxUTF?f_-;o@~+kfA__I zf9s5hj<+xwvTP_F>f09Zbor~Tg{`SrYUGef&}5mV8pT;CEZVp!ZT^=Hdt|hrV%rN4 zm*~(?r~sxv2DIK6YadIJp!A~%)bdY$1!LYjjHYJmp|fhJRp+>v2CHH}bO;^F8M?iz z|Lr7Q0+-81e)zpZyKC7HRdm=yvUDRC*L2P=-`=phzJs1ekNo<9xmQ(;#tnC4m1Jb$ z%$66~5^3-GBXEV-E~b)uJw@~kKGP<+3bRDtSwmw8%HWpXrhARI)h=pQK2DDicGu}< zU1q=d<+oY#Dkk-h)XOaXX(c;5VUgA1*-5~J`u|}bPUVqc^ukgSpMo(&g}ex^iNOz1 zo<=$KWRztYsM^+4V`>)t#2id)GE+*9cvyVXg?+ z9XWrzN9aq5&h*90!E*(&wt)A!pA}rFICEf${Rx{CF7q#GJ^!NlXoSOv#c{A#x6PYs zsP8frAE(|m4R05HFZvX?D&uL@l!1cm02%sm?D%BlKE2=jI_pnJnS% zJ?wD>-Dl<@CG+6jEqE%YESKUlZ9TUO4{v+st9AyZyiojxu0_RV0C zwBsrJaN0NB@oPRyq%f;LD<9jF!uuG50|Z~E5e!68!%~yHY498vN3D|GnTyZxk9JF) z`gQYI;^Q#+bxq{=Gq)TvEMBiCk5Yrr$ZG$C@-z~8^o{P@?sfWX5|Xm0PBlGg&IC}D z=Gj>GDay%lFln=H#)5>6y@buV^m*R72HR0oKM}GzUGzW}9b+*oD_%O~ob49t7;A_; zWdb>2EC_`c)CGVK)_1>6ft=O9sDSWHPQ%qd>K`2np}s<2aS&X0sAhfG#||kDlcv%Yug?YN8wqlPpS< z?Pj)r1OX{&ucbzLO^x|v0j_jE?LyP(XZKZrHxuCF1LOfoN{yb4&2)dtqhJ!h)w83g zB=*qB_m`XJwabnol77>NoxRD;|H@@@Y}8uwK}x_beCcSrS-X!$;~v_`b&knV+BYz182fINRxin1?XD9Z`1u4B~=h()JgB1ZI; zm(k}e3jDw$gE34~R0<2y3=hWCmPV%B##PaBrgFEszdSpGKM%FchTU;bry&lh84(V7 z9hAHij$qcO{80jRV<~J{bJXO|(}(ATEMGFwf3HMDQZG3*6_6g?e~jP87a(g_8vtXb zm7iZ$!uso>VTBAR^nJgA;JMci1MgXBQB@NjwdGF}R zvNx*X*T?5wFJJ~*s13lWu2v!^$BOrQS=}VW z-lE=ftiCKOx9pEtyJ!h>zceMsRax`+Sc_zeG8;~b{fiWDSMUKj)Nf{X-f83320K$; z%9}wP8L$p&>gqA8yTzM+crf9xy;4&26~Utpg_TyI#}v}D53&lfDuz&rJ&2II?#4(7 zi4H!8hnFafxnHU3X@yS%%{Hv&#K_ICv@Rc`XQKRNIr>YtLIp81Ghr*imZ}C@Y^nT$ z7UoPeQk^JZFhPFWmO}=IJuoU zMvqs9tNl|ytXp4|{hhV>COVgjR0T#=O)Z>G_vh24-$nANHQ!aBy-;LkQQG?07F%|30i< z98@~0>1&Jv2s1(beM5O@&uf8Jp9${l{BmWGrXvO#Q!|Aio)6?x({GX zKo@#5a_q5j-Lk(=)NQH3z=|=(j~i~fl{I-|L{6$Q@s?fwgA%_;E||C^2kIqJaSaU| zp5=&3A0UfuzR_3^k|L9T{%er9tJX$y_Pr!e7>WG@srs8H+VAMqi@<9xM`%IZ6*SIy)~C0`E2{hn#>ohSX+K9|H71(@fOxXRsA zq>nQ^WL`W4>?6(T5eMfFw8cM9fJE506Dw=#@@|Ge@N_19*yaK#2XMgsya6%vMqc|` zK&`zS^3Rn*?ppPKE(Jl2R(dT(*&PpmRX{Cf&!NwMSN{r!2YUWF+1lEy_u*O`uH+bK76OZyt4eky6JFF9>mC^SKj&{UP5;*BDPoCC%ozx4z=VxyqUN$J< zlttwg7oe;JqDZJNeN9%C*vY92?b>q6YN4^4BFRI>mlN$78s_6?Wbm*9q;L4xr7*Lt z-Oo)A_6*GLLqzzW#O&WmAcrl@aNW~FnCQ9fvO+scknK@bH4#POCb$PBiM!>_7Dg|N z62oOJzKjSerhTOyo&9a|Ce*;mM{`3pPXyxGkx-N|i8BiyQb=g(iDNn%?ik?m(G32D zQMgQ>>)19CA))2XiNBW+={qP<^&t`lY1h76tykp!_h`uiVt$`sz^H0zA@~f5ERgX0 zawyFRlUfoX0%>q{j?bn*L(@&{ze`iJ{l3C_j<=VRqc17rs+WhT59JH!T^I#_D?yel#%>llO_@GLASvM`9O#;;A97F9o>y1V1hi;JoKL~1lT2=ChGG7QYC zZ^uk$1lkxlf5p=+G@N1lrJkAs!8D3mX9jRt~#fT8G#Z(t#@NTIz`&UbT<`^M-RDn5$YHkuOl~mHA%%3}W zZ<|CciE(0snu-GiPjW!^Q8e7;L_|jyMKVLDQkq$r(dzFpk)`rDJ=aWml=3Pr%j+1T z4W3jn-&532j3%0ij}XBR(M6-3zq~U)|GU>OZUNd*ENItoe!C-RnB6>0s3mZs;rV7o z=5y9Q)mdg$D$=jr$D*l%7hAy%x&Eh+vxFtY|j2AC(%+5uaC zQqL_yQiWSMSE2{!w`FpxR9bIO;G#hwEG@4<0*`xp>Uaa{UI1l@aNu6x89ONxzttLrUPOe zp0A%FkydX+AI0f;%U#?sH83Nop;3&yd)gygjc4%FCtu%HOKrzEsR+V;1yRBSvY&sE zb^UEl|ISEO8@a^+v&bG`dn+ixIOV?wd*Ka0lJ~T!tv0F7CdGYhpd~ zWu=wRKe>_nO}*Z6&b^JZyfnG2C|4}OzO+2#zh~!!aNM-1;sjL$vYJv>l-kz>$)2-6 zL(TIJ(AYpB9)&^9ciOq)he>5|+`ZbzfPrQno_qiJzG6wDXUL0BNNBp;Sh>*V z{iecpDeLOa%*HCumaD(V)KgVQM*(~jyMnD?Ba)5OQs+*XapKE18C9bB)~;~mk@>Ce z=bLKs1>0GtBOO*GJV0i#kXD7`mbVMa=w&H00AUNf&`94m=MF#hZV26M zREENV`Zl_j0hLEfN`7#kYnK5a(ZVEsmQ89}YSLDoY)0`B_3B(ti|pw4_ehbw8-O6v zBaqyDlZ1|rp`l?IIeutr;>1^)J9NQWQrdHMg`uj6UDQ?;3M^tej$|p@7XKcntsc63 zT++~*Rx#w_XY>kSb}@0W8hUD={Da}1#kuv%xGBEk0)8UU4=ka_&Ptm*$q6WeaD}1gY2YYyE!Zr(R7me(+T9OueM`>%;` zyR~6Pk}fYOFm-)WY&w^zA_!w;=~$FKw}YWUA~8RT=T`ns`7d}!nwBz4gVuW`667S< z1G}Mh_v|s)O41dvERO6H+0~}_C7W`*SIL`l*&XqksuC*G$u2xa*-&pA`O6PQw|%K; zr&k!;UmKL>-MA{rr4*nw-WEY$g9VsFOTIFzzU~GcxNy^p?BBvHp`5Rj%Il`wr!yE} zOowCU727phx0Tv8BGQ;D_7|{62FN)ZqAv#DcljAtF}tm}D56rRhNh>8B^%>1f1;I8 zxdsDdcG9GHlsFY|!A&|Pd;VdFa`Yw)$V1{{_(NIu;Av>k66#>_3K;VD17m55{fZ`4 zje9%S=t1WWt(^`x`tl^9Avq-s6B!_&N>=8$AfJX0GIV-t%;<1`?kUaRZ=p(Y~lh95_l=@@v9oq;$Y)i+YNrJCH3HTI8$_%rS9hM(edlab-mpZ}12juZqn#n~o~Q}tWZD(k z#aFX!X6^15lyhi7lD(qz;TF4!X@Q*sTSI#F>@L<*mXA5AwUuz0fklW*#PzjImW|1a zhVOPPI|gUIkI_V5k!ij5BF>Y;j|?WPGUwY5treYzbavV_P=p01XpK5IGFyJZn}fy^ zJi^K;4nJDTA;oE?cw3m_Bg(!g3YR}17AOzIX76ufullw;(5j3I3!6rs8rW_li*Jc( zD*)RwhYUnAc(AEzGH3KD<+#R{mnGQOX2X`UQy?@=E9kQMy+fsi>W zO^!*9d8VPQ9kb$4SlY^)62t(4B(|>&ePP606@)=1MOT-pfihAw9^1yXN zot{<$J6_22c2RR3qt(lXjn`Co&HOIW6;XDCJrnw7c%+C>%v~V#Ejh9jsZ{O4@y#McfzeW`cVBg`&)<3oO zHbg)CLqe(4T;CKWg9)&P;`uOgN@h;hp_6saM$6xjzAP&-lgjX-=lJ|7)|_*I2OosH z7DBe6@OJ}c9>*n7eLJdgp^gx+#9&2Ir{Gxpa@pi2=5veT+8yH(5s{OVd#z*8m?|L? zzkAj29iU7RaU4RNQLDQa$IxxiRmll(Kq~I-jfsf^R^D?T;eSi5y86%3)9(pQH>7K~ zgAK{pcpMNRaXlLp-qqS()B(5atBWgFL3##M4o-o%RbW=Lu+yFTotQSaYvh;WB@{;q z-(?cWHnRc?xM=g`R3-pRUR}R(zCZE?TIVN8Gh%)Z=unjUKRXB*e&ZcSEGYHdi3uFg zFu1V*#YD%5RW&pe6G}C4v(IXQGM@aM83nc8Mr5dzBj_}PS}s%^w$Z?wK#pZ_di;0| zTFDApvKB(uzlM`jaDn?|VBr=X=@nUFb6wn2;(L$dfQbBcHMjsWrc~DV`-wa`%k4>j z^G)q5fn=A@lebr#c4F%Zw!y*5aR-;on>X8Z`!F5sJ}eQrR0hm#Hrq=V(`JelI)GVND!TXW+ZaYj5iWCRvzH_un< z+PK~9)c>@?Wx3AN-uhDv|0q@X2@_BYalc0*OYj;mL!;2SuK_E&!I7l zDlQ&fi=$@Pj-$6`%tq8$*kkOpiGFH>6m#jJ_Vdxvi!K3C6`1n&_hv6bWTjItqm**)2y@*h`3#NFGegclDT}MTa_Zv=aY$txJ9)uXd*F%MhuCs<@5grx zODQ+Xe4ReUV6%tcJyIfW8L(Sq5j2CshXdz;mryPzMEXiDpOau#Zh+vAs{ExlLpF}~ zpfL%0knEz1AY85j`4NX^Ye?kxV2YP*JduihlUhg`Et2y%vdfkz%34@XVmH_`DiQ}8M%!sM?d>q|)PTr%Ai+W_Yg)1ZpbdoV zBEY>TtgGREOhGT}hLDcl+&#)s8=dKst+qDuOXofBlOwVmv|?1LjC z8K6)?WR-|>Z(*>*fZU*(QE2(BJK*j6(`%UMuvjH9Zr{ydzuY3j$0d>$PAr z=pEF^rjH`em`R65fh9JoqKq%waBkf{ z*{8z40!Q+$6Jeygt88A7*S+sHHKW@9+dpFOWFJtB|0Pejxm>3ZE&RPW%o1E3#UYxn ze=43AMb*q48WvnFD&ms_+sBt5brGO%V6<}0^CG0D>RnwZ@EHQN12}(2_e(!IrLQNb z0o48Ix9{ikL57-kmlxoOPDdQ4Zh-xMyuAmM28Pwc8;2rHMLCTe9^4Na%AS+-$4ogH7RTnIp4q}O>&Db#mJA_{k zI&?}oN6{oUIYeWg8h}=zSxQOUZKKIB4i$6^OVq)ooNXG}AeyQlkeQD0 zHpMUcb8J<=xHA=RuP3Wof16}Os($HI!kj#VzqPABo-aojuBU68UtjCS4iLbgZA?=gy2fP<#h8v43YvBmBr;rLX z`0LH(^cg4Yi#TUB`}+F8cNv>HQ(jXJQdo$C;Pb(R7CnezVR198RfWBpP{P*8;$<1I z@z6x$?~#Fi2s}*0in5yXr>Uv;8|RW0Uy}xxK~|5bJmn;Qsfy>C3%|{W55SAd#RriF zn5QdJGbcFefV`WLe?GpF^&4+h&0ZJ6T%lPxDJc}5OnC`^oO8*k0^wrpt3Q7LYcPt9 zhj(fGe7Jf>_wmseh*z%d4H1)*=gDSx@(K!7tu>4FkquUYpn8>-=W-o}sxXkWZbV(% zFVsRowy4@+yYb_Ovv!Svyzwf`;attuw|UPbMd%GSUKnV6t%EURmcU}1`UXN`ZEst# zJH*6`ISUVGvsiZ}l*sRs^MSX)jVJ!Y*uvH%`cO!2RoZJ% zKLDJM{M=l}K{=@Ay91P39&GU+<}`xpGa$vABa4S&qUt-Y7q31(jMJCz;;UbPsJ5_v z(p!$ERcFEcC`31#oMUVy{GUmP9#U(yi`9x$T4zO(mf3_9y(!$0s6c5=NeUO6(L# z^#X;+VF$#eu!7Gs)7^T}j1(zW(X1VWb=(UcTDLq|&CWp}=)q$=Z{^I9j-$Snh?D3G+pv z%R%E4&FDD?SL%p6VayK(fOuUkqWiy2D1?C{#-7|Rii7oAv{?uq4fDE!g{e5vZ~=htinHiYM1#F@5c zn|uAt**%&haEfLG1ecwkwpcPCJ0W>s- zw$=Y6IWj_#ISR^zO+Z-^1$AzJbzSV^PEJb$<4l5kY)U~7V0{wBeOg^$$d zHtlOu)A_!jBP_#W-KG}Mf&;;9k%Vmp+=NIsqJ?8im@)N&s&gj+5(q?-gOf*&FHw|p zbVd`ubtSIKYqR6Y?UR#Kg=yhq>n&ql4__xIE91O$9CQ0b5n{fUL0 z!$GE;(`Br3z~8k(ztdOkvD2npp0ng)W%N;EHa4F`=?AtnL+3%@Up+`jU@?-UeBHnA z1Y&X6H|-OhAVCg+iy+b>Egc`--5?;{T_WAx4bt7+4blPv5`su~cS(15pXu7`?CYFgq8CVg?~G@R zaSvNs5Kq&nv0?`4av^0A0?se4?1J8>_H42xWwn`A*#a|FT0QTAes8$c_#7czAM++& zM1t+?YO%`TVX%7R>SvSBf$Be`4Zz57`>Z2{eL~aWlz_y43;#18Ee8_nI3Ebe@S{;9 zC~-1U|85^NZeCtogycZ5V$j3VsmsA$tCjLpO z?hJ;A7l2#E<+7fLnJQIKS`&TH@TH%&`j@D<>1gH;|E7-po`Wh1oW4wx(gU9KVr6Ze zu;PQucPNg<1rfn2rR|rR@q0IE3RFy%kJa<7ai2*0cXzqeb=^NS7qhbPjC5^IRWuw~ z4=;T`qH#I&N{AjI1Un>D8mskW#)Mk+=Ya@b7e!@NA!%iPO1Ug(V!{Y8O9uBmFslg{ z5n_|2#El~L(`fx44FQ4b@2`KJ_o9RJEhOot6s37|(v48*oY}YyjX@*-Lg~$|M7RmI z@=sa|XVyGT%3D@SBcVSE$d3-u_pr|}WG60bcP6@o%~%FsHk0WmP{q_%B?i+>lcY%_ zC^|n5Y_@ul1+u#&8!{%1C#BftX;@DliDIqp5$ogb$rK*eiefV&5|rYU9$**uFKA{F zJW3siN7HQ<9fVYo7?pvTSZXQJ#T7|k5j8!ctVr=_f#jQ4lU^lv;2+2%xUURtG>v*@ z^pbs2b&WDlmHJ^qA`$yYM_W_nvG#J8yns^>QIsnAVl|Zn5d=v~S3C4(-F@zMt3$;K z0HF;?IWO0vZQ?9gTjOtu@>=TfS~`XJ2n(8vgMskN$RHm2>jdAZH(KX$^<{%mS%^AJ z!5UyL6DdIr_}*UVUMMsmMRb=4Ier0(|;0E?z>wKB(e~Sw2|6R8sx5k^gB$8=+`7x5@5!C{ZS|_r5Koq zwHU#HNqNYsWG8!h1bNohxPRRR37#P&>S)w>W;5rFGkzR(D??*L{D=rP1cZJgKbgcKDj{eKbCo3`=Q^(VfFm8!=Q&7Hf&z z`D5K;Sa2sOpK1?}>wwC3TbBgtdHY3FHR^Xfd_jlQ({`uJ^9lM?^Fe`Vqe@~?4ZmS^Xf>*aahINN$?rL9-<4fCnGM?_5 zr;xZ{qxpd(Gp%?LTcX0++NC9XUXGFVqCsj}#+_+(m+vmqN`Ka<<7?oGgx>yoD+em4 z#LYE7SWBnqo8k7N5b1e%q$kgaVqmLJ2&R2XfklWP$W6(4xqv=gy2IsMb_12MS$ww_ zx?>YlAKiF*c6Z^FaJvk_fk-E0-JXSm<#$a0<*COnfUJv-jz$qHreH?OGEy>JzITq4 zi9TJb8+APWEo9Sr#$zSN8zXRz15W>jPYX$GY@DDC+vm^ZmVSQMRZ(+ucp%Q2c<}t`S1tigKK{q&6YqqPDnc;V@*6$a zI3JwJ$KwILJtjs@iQC1nSoIvm{-mYmB@0|GkDw~Lo9uI)G3x}=?K~qP@Uup$(k6pD z&WVDyvZ(C~>R<{zC;>zb6XTk-&(2%Z2b4h|D4ZSae95nAi(Yy5nW@y2rOW>7m%~4_ zUCsfFC_~wBZMQw7Sw=$})?)~K)v#}2=WDlUz)ml(t1DPvKMly05GDc? zRz4PkFNn8y)5@b~r=2l|b&J3)w!UZD05FdtOCA@ipHtI%i&%!>o%lJnw*BK*tC{NSjP9#(2j=yPcw9uaP4RkpEvwt*Ct$jr|lRD}nw zZy)e+x6^cOO%K>JfMBI}HBbbo2WN*Dyg#j;EWEyO^18H1KCE*9-$Fv5uu$7w)B`mm zt^Umlw2W+sxvgbhX=!xh%1X@OmVtqRKYa$L{b83mPm3p*LKz>G0U-&XxbO>W+R9K9 z|7p|$im_-172-Oxiq;6hHnB1mNHNj+gFL(}SP@{#%Y5*`rV$aWHmI)wcw_dUVdbKg z@PbYd*y!k~^Q(Ph^A)~+5@u!fkP3IR9EHk6;pNnACojn%>y>*S(F=f6Y~`bR#2<+< zAqcnLFt1J2D(`$O@>@!B%xJ!CIgO0OW@l!uAI@LwHv27`WF)9D^?oblN_2c#c{*{} zK6JORq$#Ci>|{a$9?pSe+F{r3NmCv!w_6-a`7BXY)pXnglW_&5&qi0;7zpcE>6*>W z`kU5xNVo6*rRno>B^T2ivs%w)c-45drLqeQH$LSvTXA5@PQt-FCSru7qKLo$3WnaL zwVBGMys6pIOhDuMeUdS4`(I=IXF7poztSPOlPRG~^N`UE&@7vQhxI= z@oy<`B3(`$A4PW3JrI&R=eqZ#rL7!UC#BR-y(Yn6?Mq}ZrywUS=ljecJ0z(rN7S4x zqP$>kb~Klw$!El^R|nX!@bi50)YRblP1 zWbc49p~?2)&U^r$AqOQ8ygl4XnM227{QZ1C1hq6^)e*eI-tP_kT7a{uy-$q*b=F2t zKQT0&sKe783b##$ho|0ET)!6m22!Gg1c^*lyd|O-9Vhf+i!=Z~91!Ha@h~ z?Ua4WA&Ia`e$o~=? zGuocuIthBKvkfn{qk!MRu-z-Ys_F}A9M#AD`M0-|z7KDKOz^z(@+g2(l5paEq74(^ z^AEWv57HreCf0nHf6=*gRcDl5N# z4Q0FHS;RK?T_5?$8=5NoPlIK3*FSTKJ)Z8%0yYi-LFd|c$KE4O;Mk1)-G2LIt5-L# z(eCm__t(n>STul7jCEGW6H_$r6<9?QlQBq;14ON5y>57QMLCfG0j_2Bt}G3?2muKm zSPsoCK{HTZ>-xEGfR^@T8tI4(52@tcQZ_bK2#uGv1`a7 z%W9=EK#1cw2Ki+1OQFs`khRC+izYB*SJZ2dF2#yt4JEraEURElO$92c;t|H+WenS7 zK^0Q@d)uCvoUC|Dbn2ZPFF$7ZK2+ZdzI()|o{b_AVvoPPzWk?sxSC=QM_olmN9!v? zVjd5nf?-3x&s*bjJAJkFy3sXgOxv(*T%2ohB}yphY`t6`oUzf&C_6pQ=0Ei8J-oWmqiQwTxz=hXGh61+`W-Rj7BhN zvAhTJG!^aEQkWs&cjqYU==9Sv{_0b2J0~B>Ia!b5Tq$fQPXA^5tNY~n+10*`gH$ps zA8rZ7?RtJ^zTwK^81y#*s_W^n?UTU6%@G-H)Y-mei^kGQPmLjE8b01y^Fj4i-di7G zDh!~oe(l@jQdU+z^w^+Zz^-@L+_hIJRaC)%(K9ki?0k!Y3J0^he=JuH^|0cT@ym0i z#>gakwR7h7*V%pf<2cb139VWMXq9jUXInr`lZW!p5jaKNGENhD8xkUZ*W&xgoTnH2 z><0zHeP?dqDja62QRDTYWp$;u{l3$7!_oNl1MoPf=?cnI;cQ0e{(Otn{|p`CexJ4j z0Bq+8ZwZZt%aTBwO5IJ?)8n&id%xh*-x3%RAy`;gV81ACDvcw0xfJ@B2Q=)Jb2z-E z7Py%oW#Z=U-`vC)9*(kFZ2kaXbgsvII?MdPZUD?}1YHKqG_Dkcma~p zvifA3@p(DtbmJ{yZO`=UUBe{327SJ=Moj`!vwB80FT zjBr_4dVc?YMXN@)QPZ1K>vnW_yxpK}TUcHfa&{)!BSz_Vy4DL$Y{jLeP&uRGzAs-f zi9Oc33BVRt=XvwxdAR+VP|*D^3HTPkd#(4r)nN{o%`Q9pH)z_bIYkR`OzV0%FPfss1&6?EsH>5mW zj9y^AT9Bl)K&oom!=bIY+WvN$y6$1vwJKY2=4EuMq$@Lfa+9#+n zy&rN?Kf!gJ7abkWyQY5P>z{JMA%WT2Dyq8&Zr)G%V9XWKz48?D9uC}oGOFj84jxvX zg|gkBF`aZw2USysB@eVcQMTQAe(K1f5DN6vpqHHeTn4uhjtU(~d&N-X1GV#!XV<%{ zYjqqPT>as)A~z-SiB(#_HBkT<+U+HG3JO+3mCshNKf$2@TvKpntycOF8QVv0yCCBl znav9{uc3%)+%os;3LkMK@LVnu5+c3omkh$ zTE&u0i)?mkKqFoDfvSzA)(pK7#!CBJg}PU(uL-aQ>ixL0(rM)kEm5bJI4!G7oxgHk zkY-oBpy7v|7I4wBAE#LXYe&F&R7avEMfHq|(bhL^C&$~*_Gtv04!17U063mqSGc=U z+CWuh>yudE*Zp)UpB>j{%<4n0fKjh)j#pr8`RDqmI(Ev5bPetw4RLuP=}^!PvJ=;# z@Jdy+X3-k#ZhSVJ|7^WrlDWNK&I!fD!_(8RYJvJV<mH z5oCtHFrE*q)V{Uml9>6~iZkZg+M9Kw~lzhO&H*l~B2h-u(&b~%&yHixaB>>jE zz}O0nnncR%M|O1`=QjXBTUBM#BPMoxRkwI|uipO2+nWH$Bb_$rYW*LpXQiod{`OPm ztbwZWwOZr@H}BaDIAYxFfjw3}c3D@~cb4kan_z5wUj1^U>##m&kAmMfrmy^lurW*G zv+36UwATin?%GgV9oQMiCziT;q7K}z=Z~hQXL1)*czAd;TRh%?1HRW8;>~xDBP{@B z>Wg4J`hDcW!oeY@qeHKwvkacX^FP-qU|rb416N4zwgHM<2Y9$Ads-VzA9MACAklx(ZsBMH&@Ok#u6_Med~O|~m!haCb=$J^Q~dJ0%!O@*#pLN`M1etZDgo*JT+;Wqzofl$Mj`wBleb;XGp3 zRcBWA>7>KCJJ?rX7y7C%!AHmmHnGulZ$(S=s4I5xY69>+Y-J_<0qFw*PTRqZjvr3; zv^i}XV#S^MPRmHg6`$L10B20320PA|TW@fWOa9TQ zq^u)kEXoaRIzgvSiJ)cx*!Y1MYs3#MbR;Hcl*sGb}pQXzR9nl z1?McAlzS_FWz}Ici&Dpr4#)kIUqV&HqSC<(SaF+BR0#8Rzf5{6CRU#%jjqV) zHL2>1fR30#fe2q#%k(5M=>MViXROa>1uXLry5z|yzS_PU&dn52F~K2u#A5RvZzZWu zTK_ocKvfzmr13uslPpZE&~C>f2ntILp53F!+jGi3DK2intzI3SUxOfvegTIJZl~K+ z@*JywO|Yr2^o|yiQYGpp;d49qk9zeu#os>(0J9X>b-qgtCnYCs@{KY<78~0K zE~hY1LOMPC`aVFDxamL0foyGKW3A1R6nN^`+s>0l6?IgD^L9)G>0xA}*fRx|hZorE zbep&RhmOV5c^Lfso=K7!&6z;fy%&Bfph`&B7U1um=ZjwNG%*r1jMaBloB-(8O14ij zU0KG{uSC6}&x}KqCI<=mM%xzm4NmQMM|v}#vt|i3$`G(Oc^3((F6O@7nM)m{O6;mV9cBrpJqm7zZZ+FO=Rapz~wA;%8z z;FMNYZf};dnry3;d4*5zZGvTZb1j4j7+2RaR$F_JWZ>O)vX%rk&baho>kkfwMd}M` zs8Vzr2-U-*$;6{;jt45c;(5el@B#2MJj3Q^bg%CfAambY3S8{*f`*LiYc(Lh16#1> z^$nm-Qv_#d1C2-UdBeB2I%j#LXK-fi#&m=SC`n>)LSU{07~W#i79dKatg6~kEQ^Qw z`m@bDp=xNIT}V7J23}DS`Js;|k>yNPQF-|w-(gEpm}?AvXKZ{=5A2c+XPjB0-P{m^ zPNNGZJG&~FDM6jywSIP)_W&LMAm-Q6U6~4azxBPWegUAc4&TRjz607V!>k2ZEIuH_ z*%bu+xMpXBC9A5MWYuPY4zS~_rlTO9B;_nRph@P8w4BS{z0o2L;sdZ*SvtUlGJtzg zRwfmn9-OG*WpWcYvoV~(31T*G*G<@a`^Uig8v}SN-DevmxBbxX93HGW6&1grydF?O zDVRw%`FA7HecCq%UpF43cF5#j?vKJ$<&u%1W;JEiHvn}G@9hnJ5q-206lu){3+JR` zvi(t(ol-u#rl+nZ&ksmPn^P)ZzCc3>e#yaZ91L2ug$?AW(3RGT-;w7Zg<4cU%orMdw?+kG+oQU;Qh7 zut~90S`n@mu(;21&-)<@cxyVZzZXQ@*Hnt%H z(T*(zyEzOi8W?{lgBqN&ucVE?Ejht_v~w@hJGOjpQ_Zeq-y;KsSJ@;kbni1QBO}?7 zRO7rAIM)UC61}jaqbFD`du-9&V~BotKEQ;aOGXn2c1r`qc4gz2oMr0fs*Azi9N@Z- z@wp`C|Mdi15cbEPDWx3w1c^u4q#M}`6a9T)s*V*JB4c|DV0s)5>W&M)4r<>l9+<;)JoJl{c8$-XIl z-GQ3H&>jiYEUfm`kio6jd9hQhycX3hHh6-MW}fEQ-JsI~^!L@RmnT8r(Q!k{TWsG`>*JqCCSO*suz(nG z3+2JgvhFnBb&o|)*1bD>n8(T-O6*BVjtZaO*e=nZk8vq@}TD$7^Si;g1 z=wCYA-v*P&UI~b3x9E~{Z>3C$KXJ^w82~%W8`(*>+qmBM!g`Hq9n;{f`X|pd#-VD1uiq%1-BL|KSC{ud zOVquov|Z5SYlclL%2#qt!xo#P?x>^Mq9X|rN(_X}5vY=c4BO`9o*s|q>z4=dkxbrR zdd^k7vy|cT#CXiXlv>MK?Zf%Hcf?z6LzihY0VUZ!(H(gtYE>FiqN3dYPV9HsUy4g> zd}iug+JB|+p8O0-`Lfdg^5FaIcV4T+VWTmsEYBaZY$7u2{8^4t>CfpYoQOy#=*n<> z7r^El@E=%#SNz|rpYsjI=t)~efy(pWUJ*80&e&dFYO18XCix`ymm=ygSEbG8eA$uY zv;7^9mNqUpg1JloC}xcXZ=VbJGHC4xU*B_}ue{6UTN%n#!DV&tLy;PuF8*%@c?I#C z?=$wxGozptDc0+-J-RWrfVFR_lQrz<<~x6c7j*~t+ch6R4*AV;toe)I>91T~0XX~q1WJDIG+ZpPj7e*W#0r@8t%%|1KW>_Smxs5LnUA=eV8z z5|8p-kb)Q3hs6e+?v-C}K|>c+inT^3=w&c8Oi)o%I~`(W99!i5=q-XgsjQ#vWx?AU zowcs}7*VYZgd@S1ivZv)3cfl}KN}N~XJKOMBYGNl<#InqDv`_DYI_hE{P&-_ol=3e z6CJKBl>I-*7@VcqN2|;jsnIH+u`miCrrBsY<-%JZZ@bDe5$rFzL+0T9OBE%47uG>;# zSp+1b@O&nA0&+rWVCqlHjs`~EKV3$t6BER1c9C^E9^j?f=BJ;D^49x_3_!wa4Kxoj z8QtXYoaCw7r#+rmCNJNwJwSg+fce`XB1t9T=t$Px-3=ow%GUVfJq@*ff2}cF{SP3U z{8RR5)vNQp_gFBdqkA_@w)Ry&*W6i1(Uem&Ago;hO1HtAqOGJK^qNw#*7P8*cpi>0 zquU1WnVXnu^4GD&%*@K5KRoI7(T79F88a`QMM`SW%u-jzSe2ce+$5)bwgMQ?T>w_C zz-qZRt$3S)L&u#wBDwP8YmkRZDp#-BD=UwSCSD6Htj$jxI7j=;fNdRtWxthd374p% zprafyc$ELGFtun<4g5u1QYq*$H_&l*%?}Lg@zC~ z^nuWq@nA}wTQ?1Ex)#U=y8SZAxE8H^+-ZMiv}$u8i~dNh%p8zh>;ahia6zwu=IMAf zV?8xBQ@eB2xOZ^0(|ph{-ev@!Q9UpA{RhA`I)FKxDmy!!PFsBZgu^~w#y1jTi4(O5$(0&H-pZ^tF)>@T$&(W^CjE4)w>mysNmFc$`gTU~;qk8q zQ+_DvDhK5qfP+Uey^gS|D*07?J)Ld?_}!x6bG&7rRt4c3P@IY?s#sc4_IJOWqsC#2 zh0yCZ1%f82MyDI@FC;4ZAxSkU&>w35z@o`yP!-&*fal~7B4Zn9`fEx69a1(weQ3cc zKuiLDC?;9*ODJ`;k)ePS=4>|?=x zk*=Mt(PTi~@%3HHvXHbi`e1ScI3i1ex29E-KKm|%V|F?CrgMM(3?+|P{I|jbuzeBm zJLfBe2H$JVRBFo-|Lr}wsdGMOC-~A4lbVSD z*0Qd-IWC5j1l#A46pdD+_kxdWqwc$Tlo|lJQdYKZ$8}pL_#gtT53_uCn=Swo1*Vy> zZ-X_P9R4X*PZBV$EAB+P_Y=!YZk_C2dxNXwsHYbZx?VZ$FAq7V6VlaZgS|doKu$2_ zyBw^%bhKkXG21_bv-tw#v9=BHn6jcTw7yC^>0Y#@e;W4hn6u1F$kc-_B7W= zFwUt-_0P>gKpmPRfwzhp20Fr>`&v<>xn*VNfxW)#9Ne2H8F_K8Rqo$in{1+@K2EZ| zJI)1ou<6CXP8BB+2~@!P`mKv=PbUqg_w7H=sQ)IwS3|eTVS3Vxm41NTE2OByr-3sE z?5pNPGh8Yfs)>(qL4_#kY<6V`O1N;M9kIE4XsU3BG!hU=5hemo*AJdY+iCj2B#IcU zWReDItZbmE4-N*FW13ICs*n6`d$zqFY#>Amv(1rvkS=!Ukg{C8iTAVmJY@yY3>p0i z{-F4$i!GqgM6a=wOXZb$He%{MInJaLDZE|TU*}S)k1CVn$aW=Cg&&mGzr)A!2!H#; z4*kY&Fq?-+<{L&63^<3qu&+L)`2JQ{l9YjtA!tRxBtgQ+iyuSww+Y%I^bPC`S=|zR zp4Me%N`ho3LXe>wmkYJ25Yn^Zq0EB)XfOif;S2VI1E;9<<1c@vG0Q5O-1XYhz#C5D zcJePzVN<(VgWo00al-w3TUHZoc+uk2qfkKpc3M~H9# zeZA#3DtaMJF^gn$-{vh;pb02(j#i_Wr90Cv%XN&AONAH9 z=$dc}chDr6?oQB=(GZtPwmGdf-X;h>LjxyaIO>E4g`Qlp%7;}Wmj2Byi~urpHukB% zXI#S_Kb@<4>Xs?hosX(%pVb1}`?w4F}N4HD!3 zlG|l>2K69Iv43Fc4tk9hFq1~Tj~Rd>0va;@1;Cda2AvOAeN)eB;QtXI^c%|$-L_;$ zvW_;D0rf9uw)bMReW+%G5-dC)W_8=&h)5e{si(MSrH4}gTy{C+$WVo)dEhT@E&ThJ z?%yKvzX(kMEgbx`0r!~xYxV`}froXChsyq59f`EurUk~sY{V4h^c0GV;+sSY(XWFH zL$3PzJP2sbpK`ocwncC9;NY56F`&>DvjQ33e;qAacc$5G-n&hU#)AVxRN^X03d5cU zhKPuixvyeW|At>J7m&8VigS1c&5`7 zwX^za?`$x2PfO44*#R|HD!uul!$3R+g>BTd!$xTHRva+#88!=IqVC*J&;e%YVqgmf zCZ1Y+llGV8>hXn{PfWWzKv+8f@jVPEb=$Vgp6Gk3a4FkWCiZFLyI#_FNS%L& z=50V*#r{4GaK{2B_y=8}_dh-drNn)!to%E7b^)w>*4gm{>BWwqKt(Pj%CAGw!y_b2 zY{QMO;AbXE;Mdw(((+%UJ9#yE@gSKM78u-VQ&3ixxVHz#kud<=uwW7C?)Kw;kSQ2p zOp}6(q+|DZnT>e&d)p|fxdj5iZ@*mGo`PNMNN!qlI4Co}N(jGYF)cIxLolD}-jD&q zQuH^_`Ab~3b~IDDb9!-M@hBYACaEL4AL?HPYp)|b-GYj;=sfDI@5#l?1g|7+%m+y0 z1I?7A&nk_bC`w276;1Y3WCAp}Zt%0rST4A;ph?H+d>@Tu3fm^%qaFWz_!1wU@zdm) zDhxsrKc-}1D#i-~d%)0=*>K$*8I*t|djJr=#&Nt2AF`(Dc^udbICB_B&vyuU!0XVflr%Zz&YAYXrjpBb)cJPG;!KB61+fl^XYqW})}pLaf|tPs0{%GtB~gO-16QP5J1 zX^w-_Jkr$#c_(lS19Ir=@ubI14{AVhdnfn^v7D&@S)g0cpkX>+>$0$rem4&tqok!4 zKDea^T6%Q(Zn?mz9f$-q&Id`~goRi}V~+oy2lPLW>UNi{sGgKmnEvjJcCGtYkLL-w zwCmul->AaG+m!)y%t&eTnAD%PW3PiQNo02F9Q>}8aJQq!Rfx*+hYq-qeqvaK>p=`) zLmp9rV#S&GD&wY18*{pE`1oKx19kvvwDcoG$5>(TWR=o-y}b#Se`scsw(i!>yrqZhI-@8vb)!geB?uPg1cg4El(;yGdjHNmRQaEw3 z<52!hq_Ze3sVpMoKX@b+k@iOgs)3%OrT56BGrgazALu;E=!B39vp2@zr3Wj(aISpk z-jZhhxfeWK`Vdd2xil1iO#xym*9~F|+IV!?6OU0LWEGmfNLeX_6#%b5T%0q`F7T65 z38<0V8q}&;#6S`O2=tW*1Q}VmV0d|P%_%K;;=lDhnzPQu#iWQna=3Z1F$LnIH4dVd zBUjJQ@4?9eI-uYy02qNjfIpx>PSn~4BM)@1A|ofkK-Uevm!h_B$xKWPq+8s(NE51y z;6@)j3GB)BBgr!qPAdusR{(74p()MD@5ALgfOC{qe&NjQ`DKX6j(O2^Gy-v$zwQYM z&pFQVN*IbG;RNW;$k1dF#fZsko})(0@(&T889y5AVke6>wDYTD?KwMCmFx@{m`P3i zFd$Qe9}kQ>Y8)*xhpJ7LP569jo1AI?I*=4K)muW35B7P0qKEVY?nS==4Z|tstdiR2 zLAy_*@Wgl%pjC0iHaU%L7)ff6)pybOtWp{W9*?cMHS-%u7zL73Covi)T=46u+3g*6 ztcVS#ApuJ$VzjWeGcHFfyRnnENd8dod~)6{GXX2xzfwsJf3V!W79tWAA_5wJDmsP~ zS=!Wh-=Pr)g+l%Fgrp*NP=Hdh3x;E*HMqU_hApW7_ATOc?#gIX!N0Lh+UT}2Y0o>5nj|?lIg-yi| znJiha8Crf@tD~lF*%m^L{}hAd73g)EtDo|ysC3f>q036Gr+4kBq{&GbNJ3XHFXiJo z&8J4=IYmM=Kkxm{4u8jWgaB4kmkfge;YmO(&6y0IEG2ypVGEED9$6=&N932rI?p$X zb4lK|=Kz@LG4_Lx7eRx+>YiN@AvLEXkzb0yjI!1+S0k zWa4;CQxCj3tXb_&kVPE{pyAY+v-A!)?Ut&2H5w7XqKf!2$w7vgKp|Q`ycapL8^YZH zl4W=1{)u!>PLOnpP;%>JWi?z_kt_n7Jf13ZwYW65Yr37k!cQ_vgUfpYj-5B%e73p1 zOwKmJzsJbo!Vqx6{mFJkr5xMlRiT1|%i!2#MP{$up z{qTKJwuxF8K$XV933bqKlKbKB24dbH%jk}#vmri~(Wci{E{SyFE*vb5jFwe2CYn@f zran7!RKr6!OtYkT?$#KZ9@*@S6C4%->6e$E>#bCL(kBj#8lsf8>lHP>_mE+OWd{FP6)dPsiluQ5^EXiA6;aVx(4ey996Hg9PI?`PHV`}_ z8w1`ktD8hM_Qjhy2j4oJ$Pj%R6Aio%+bKcj8Cax<)KNnod2lL8+%plNR>QZBiUU&> zGnsCKr%Rc`x%hB`hbl1ZCoH_T32J9zkbYlgy>La;s)H>QaLiwtRY*V+$2bMYT8*4k2hD$Q-KIslyzlh3#wE6yZO87|LX zcg5d}tq?EDfK#@8RY3|U(;JWyNm zg}oB+JkgoyIO6==9@PE-svT;2v)7JWY@vtTOw1)iJ&&8R+V3)afh{*C3U9W?IgAB zD))|_RX`N_++5o=@=4pN=Si^ZNy|u2562vAU?@cx@kg`|ki1OCrHWy57s`<1=O<>? zU#u;x!zFjrf3W{o1#rB(Yp-Xo>Nz)Sbq@8iEe{1Y}>k!6s%S5;NW*YSlWNul1d zv#=W6!s#zFqdA|NSvWzeVdBy33%lRGLCcCS6QGrzfOr>+ugjFD*3s{eMWje7B}8jQ zb1SK+iYj9M_*OuQ7ONyS#1-BT$unSu^OgE?}@`t?C*)UI0o z$oDnpxLqTn<2fb6=!$QKsvM}!>HD0JsUWm+#C()8^r@gSlzxb0E)|)nFS6@M_kwsU ztF7C2VuxSFy45Lo)LN^OM&XW;@9JaBnu@wOa85EK`q@>EB_8Cc6S6~a8$ZRc8JH|9 z5DqBt#*`yU%F#9Yc*i$~4#!LAU?YT=_4F6!iJAU{q)=b`h^M>>Z#5+4nfc{j=v-rcx1{lXVq`OvgtL(;h` zp~1lz3=zGS;MT0Iov6_mVq~ zSjdkGUa8{Vf!7Q*11ezxHP)>py)xVPyzU#txEr%T8LfPoS2PP_zhfXmf$yJ+!ONsy zJbA0D=mc$_6o1w>Iunz%mLb?=k7``6kWT!7e~r*7tw#&HS*G(+^pG1lB@E)6XO0#Q zA&Jq#R!no^r`}_&6q^!t!b-<|${sr)#qGlz7nquJRaxSUz(P(gx{VH>Wn|7Oq>lSw zbsoCIbI41hWy8MZs*;~AQ^XjbtW7}E_*|8p>;1EpgiSTSD=(L-KftblWDw2oW9Z1p zmq;-(v4l9#by%Us>fWSDR>g^fM47p^aDoq^C3}LY3m6pyaLm$D=#)ii7Z+ILqBoMz zIfg*C*}%t-99n<|_<^9HyB|M(tX zhx6lC7EWd}f=6+NY4WH=F3~0zoE5GXFDMfHBcKM52(PGPN5M0S_(aMmSs$2DqpJ{GX9= z(fGuIs7E?MNT-;-klerzh~ysw<~0Y;tMMnpZj(B2VwcfvkI-ZKCFdYF4yeHRDiB_BG?Et%4kNxI@fsG(y4qw6K&~+Zjg+Eo^(J-#?ob zly?zTt0UH|nI=Zq>D!j};V*;2BZCk33!8+xP2$%VKEYJaird&wl*U5R;5P=pYYi0^ z%`<1nrpk)pW-RpgkKj0$E~q%U-YBaidJYI>IL7HQ$#{yt19Cv?5?y$>12c}?^L&>X z_e$8jL5D#Ul3psmCl5M>%6W(&-PW?}tlf?dCp21G+J`0k-YALqz+sbu`by|f7&zNs zTVQIv+=WNGGM-Z(EM_9cqpFJeqtTVce8TP3^)dHHS64e*~NWc zKZg{T$ETv&ZNRa9ULL5ri?4DT#FqZhDZ{|BaUR_FUEn-G;w`($IUzawf;yv{Pi(sRo$De8Z z7eCqoDF+^dsLm(xcuGs6cs3PmEjqUk{66{D?{%@6(}H*6s1k~KMad;+jKiZQqEjRp zbFk=Lo$hKiw4;B#S0y?V$oKw6wiv>Y0LhDTV^lGC=r-%h%!zX#l@@W%>)sa@NisH) zj2`4|W7y=<#8eTT9Hf`rEm$>_UPkg&XBYL`^@MbvD}+pow#tm(P`T@TGKx3)z(&ei zh!ONUB)k)YRB%~Bzxj$+b^3<{;e89PJ7T@JkqVxI-Sm5zJQLO!gYOI%kK$5W%ZMPDkOomhAYaw!$3X3JDWxTUQ> z42K>^C-HiCx#{411(iJmX3{@R4L`g zqTZuxV&OrYMw2S>!psl-BeG*&nlBXPnkK)k$f#&H7m98rFJ8?ZB`XFTiWLAs{ZF7F zH}{9bW!(@L|Bpdd5)F;*YDZ_HfP{w96Y_05VN^rO|2z<$l-X!PDLSX36`8{_%OOR~#my z5{nf!fVufHr%Rm3TT0CY7L?Oa!UjaH68+VEzDn_WJo7LaN%ap*MEw?pK^JyP>PG&* zXX+7S0n?1FM|hcT{?xe%2ByuW6k}+KGnBW^ePfXxDx@5Z7|1-I#GnpP5`LyhGnc3f z6DsbwwboHNRKH$`WoGQ|hlp~rrL5!Mg|Xyi)Ye=UecPbk4vcurPJR2e)1q*;Jl-VE z?hUC>5&Ru6O^%Hd<&v&~djRp)JgmbJ8byGN!Z_6k+xojwBObaRm$Zf2#t4&;bdM(- zzYs+C)S6+1=jg)4sLa=1?BD0>4tX zG=q~M!mghDVx}N9+DSaQGy&jCvn{ki6e6;@EE4Xi zKK=fr%tt=6ZS3Klsx*yqt6Vt!6V^e7LER^3aVHhZJ@-$mDYt)nPF+=9HN>~V-iYAL zaQ3#Bd+0LB6z6Tt#m@#|sAG$;bk7E{)iUJYKrV;VdGc2y`vWj0B_Y?t1p^r6h-iaZ zGR3!TX?Z>h5wxz4oDmF@p|;5yIuLUr$#%_PqwsehyUrzUqbJr=sAaw!lPuFCKbVA# zTqnox76vwt=p2?^Vz8w4H9~O1GOux_ z9QF|bKgRaXF4XTr3AEbru7RYJ4HwTiqp*r084F9w*qoe*VH4AfHD>gs6@v*T##j=b2 z0|T4)2Mprz#w*@8==Tp<@ZEz014edZqE^1&BN&=v*W-ov4>E2~0Wo8lu(pm>^M{#0 z)BK*{LIwgc4#MQrl#sh72}%nlBy7>P-47nUTtdFiag^Wnbfkr7!=XvD)eVZgJE-|7 z*CK9S!F9!+?8ApWv-BS06#C-QJ1!sHum1jzX1>MDmNRSRg)M#{#ms}y3qW^nwf8B8>)JotO%9EV=R+4w6H}2DnP9u;BYD)vj8H5dEK*3Y z6-|bC@Wsuma=VZXdqdSu%3OLr87(4H;m*mt--+SPjW=Oenk6iTOiCz>$0Ea8VUcAq zB(<_Z>tlKeMLCs2xe~A6{z!v7>i0R}oCUH~n7{`J{jp-xi)FiC9*9j4bLHvpKk)x# zTKWZh+!Qh>!fHTDHe@(bl296v>L`uZOz5OZ3YC6)O(K4MfWt6pc0|^YIboLu5&3}> ztY|C+SJ<<~+PYLoUR$E>g@^B;)jKQd^rH!%QhC5Z+yv(1kEMY=@VnmU zb&)^RA&8fhcDo54U~2U?`xeg(?a!^!{`JuX+ zZeU=;z$h#E56kQLc+)%N{hJQ!5{%@T&+c-p|BYq4?~hAyN5g{D&qRlkzS}|GIfbr> zj+JYLWdE@6iy{|J6HYQc?s(&~J*{UZxlt!t!f8u)HYGlHHw3I(mQa{84O{4Mr)0Fd zTos_NcV_yy%3l0Lwfqj{ezkBaq|EmGW%aIe|e+WsxF=S<`HqD=kDKTz&PTXloAlW5osTEw%GYT*t(zAgq3mqAlJ2i& ztKac$pwr+AotQ9NTT3*t++Kh#5%~8}sburBN-_dcrUW?5{&rkA7pvH;>V=S)&wR@4 z#m4Y&@9j05hTOX0;V|Bgppvi~vVw8JOe_9@Dqd`7uUO5zA{_UpD{Xf=PGUS*y7Gd}&1`p#e4q z4W>k}hBv}r9Q_*65S1%nWvP-<3Nt9b9A1BV9@kQ%j9_BJl*CDycvt?vG{a8jLiHVK ziH9yFJvspa^zE-Og4)=z9Q_T#(ytTK*Arj~-ie&3&~MUovtZp8+xw{+ba2jAwBZ*JDIL)tRv1s=R^OJQTx9m!D1><1*1zTLBk{JT zlui7#m!7iv-vd?7!{pN3O-%aVoZS)NXEda4?p_Kql~LaUh_U&(!ll zja+m_6boh7vrjd7K~&fhXDF}s1SB2DT94nnp%x@R@19)@X)mBWKwJCiVQWB2DP(XX zGD9e$mfMij*GDuLK~~6cARrmpzX0Ar%=MwvR~fYmtAPtFruYIA`$Ly%=08_p~&8?$L+&yW28R2*h=eI4nOL zUSHYTS_~IUS;&l4W^(O0Sc&+dWl=sW8AL@6l-##mQE<|mMQ*uOde9ad$)p$bwjXV} zzQ(y#HtvmDjW~O^7Q(*Udv!r3B65qEf9$uV$N3{F8MVgaT31HeDJOr;s-u0ms{=CJ zdC8U4)%1*vu%)c|gM$NRPXt{{bnLFS;5k33XLSl~fr?k}@_eKm2aEX{#c=*)(~rsX z@{7H|in+aJry38BqhfzxEhaq14>K~kzvWpjbaPG{wsg@L7#i-4)CqKlliObm3L-v4 zM7*r5bOo#McvoXW=yge3+1iU24Y=2euk#66aX9Ec|Mv8Y=!}-#R8H>}7 zb0qQEqF=B*8(I%U&B{=jVM}mLdQARbPvzz^MdL;sYqv9Y+>JDhXH56^S){Dx=#I`! z$d$-r@7IZm5*p&>8aRum|4}Sj{}ggxkS0E2LWe_CO+u(LoGww?R$E+~hhizn0Zq{; zO3j4mHtWn_TOmqxkeT7Loi-`Ol7->mL7Ci7GVu@Ka{%H@t>{s`smldsagDd8*W0!(P znseGSatTp9p2@_1>yV9iyFoyJ!NT(NJ$Fv7BoltayI)^&!>^6iUfLTNWrQatN*EiH zW>Pw5WT*Q5N==KC7Ikq&ORG;Q_NHh*xva-#(8Nz{$5yXoq&GKla`L>IA;6SgTrxt+ z{mRNN-6^2&?R%;|Eb*r1$#s*Hh6iu;Sy|-^3ZqJrL-&5HjWk`7>^6oDd#-S=9w$Bf z$u+0RBM~3=RH&GhMuCFkfwQrko%_OeZytlJXjXq`ay6;+q!=Yo?|&uSYf=XL_^H*W zgEak{y?Cj|1!RwS-+glr5~AuuF{D0re~@#}U$sRyypWI*HTkj}RYN5o?|ISQv)-6+ z^oQn~$tJm?rltn*uVcp>KiEE?_^C>7U~DXcvIE;;b!A0VN%8aNy~5FaaeS+c(bbi$ z^z!lt-gL7z&buz|ICx8ILLsv-KdiPbIBYWd;7Yrl^z)#iK0QT65h^ts{nT$VlklFQ z^<5y}jOidX+?0u@Q;u~#M~_{9j+=!WntW<2eLo_Q^+$GLE|5|9WqR&A;$DHWq+p`5 z-AzmPWSK+|M^fs+jb#*#`C_EUUR3|WcF_9T1Ouk~rEJ42le2S$ctjHdMa<;=`a&vV z7pC5}+!I?HBu%DR-bKAlYx?K7{?Cnv#zA88ffs@zgO9CMq-@w$ znbFHSS)+btQEFhn_Vbc2tjeUIXE$p7ZvgE^eT82xWtn~t#j=FXyS5w>Te{?xv&i7B z;3a9n$0Mmdd^qS69=@M$QB?~?>!{QTSqiw5_|jEfzk^~#{J<~|jjeAcd9)1iHO;ByoVV^k= zjaj?*eCB{gahbsSl>NR<)2Ge7Jbi|%_<}%I0A=fQ(u=#kVKgF|TwR|+H1*k>a25Zw z$;${63sSu@FcRgmXqHm-`gxZ?H#)~R?5DD;0eW${p!kkpvn-JTL1O=HLj3!nH0;w# z^rg--Y@*ssgMsmJvTSuNneQ$AAh+ZX2W-6P=;p+hn`!waGbI_$MQugW&v5XuK#UvL zlMH`!5XGwM5(jsYO6n=g`x)EcCTs)ScF9&pYFW2h4C}4L^vUi^mh`isi)T1EhAwDq z*!E<}5-$4fXZ1p5gd4NLnclBZw!DvKc}=a`p1wFQ#N4)+VKZD}6|N4p_XXs`yeV*n$p)CA&qdu<`Dx=e7Y0?(WdP6nFLp zgYC-7u?5l2`#52J3g;$6Oj?$mRC^>LbWR)X*K)BD!`an zZD(R(0fZ{Et{bHZp{_`<*|P#u2%_D+w|^Kfn2^=qKPqEc5E&H226^>N_y#y4^*T|^ z_y#X^eLFhj!Ei&zKq_9^$NR=wXm{!GSRtlY;&>ph7?;<1;QUnL!EL_)%)^^Eu+Va* zNt^VTb;AtZ5ZB`4+l>R;2bSl}I@_%J{{9g%@|*Wzb!Lf_nfc5+%!0p)eO(b((Ve?z zkhE_hznd*Z9qPB=8!HY)Bzs1YfHaC+m zHZ2Qw8LyT}!Tjm8_SB@K{?Y5iuhbyHcq}0L=8b@=YIvrGIR~xdq%$^EWcbAeAKz4) zmXDz!WmI%@k;|bNG_ni0+V@1H__g4%J*}h=6bx-?!Mi|Q!wZbBt@WsMb&2P5ep)1y zMJ5geH#W0B%lJ(&Y%OFy?G3MvDxo zIj8N0zV!+`jr>$yt&xxrDrUfv*jFO1O)J4-a#xc?9yRkCo03R`K@jSv>sJ-~GNZG8 zB$jCtRNgq6MK}lUGjkhpLS>kdqXF$Zr|ZuDrY0bLlmO}n_pvc(tI z!>_$PDCmP!<-;32*nZQ!kGrE!`J(O~pHQ$B{+Z@=ex^lq(E;@IIXkq&@XiEOk~+y3 z;X9~`Nn6*7i0?@IvY{LWN%LLD&8GJ0f7d$Krqh?LL+nm=5m#tv5RTV}zvIV@FL31{ zGst%1bI>66aH#Lg=MgubbpQUKEEJ=NGn!;2!>3DgSTPuEP|7@`6qYgD$(>A0;P-VF z1Iw63Sb5{&?VH*+y}||Na^L@0*rSaJ3y=Pk_71L!8Wb(I(WYeW3Y7HrfcCX7BdeJu z)n2Z(r|b+WPESNK4RNBPX6??~+uG+#c`XfR=R^Q^dFA>{lfp-5JMs#I-{4kjk;=xV z?sYu>Q8_F={eiLQ(Hr8T-bVVeX=w)sJa-hW>Zxn@7^*)2O%9RLz!(kb%@R|C#YO!v z!yA$Y)0viT>m&okHsyyQiM!`0@COAAwVp*~&5(W*z2A>#epGG$p5GnV-qXMH?Y@iG zgi|Lvn8-fPnZ>1X%dCPj(rn%rWW=k-Y%+~0;mz*TwXuN=s!d-yo3|#>tejsxJ3)5- zDjfYDCu78>(~>lrVQ4hCe&BU;WXg&j?7LPr+BJ1Gs$=(at)l%s>&lCX(`eoumvokR zC4RY2Z7DKe9~cDheg8(lW@gyjR{DV3D8OjH;)^MvbF)aJoqE&jeMs`eiN7>vAq0yO z)bDQSPcHG0DiX_+Oq_|Bs#Iw#j9~v1-}Apd^h{?*SoaeNGSe>-gjC*Gs*)D1NfH@4 zD;IGcX(F7hZxw^BxS;%$3Sa)Ueqvzju+O7c6Sw~7U)RUK3?#JcS7I=bXfR`edxDuT zxL>s_!s728Ug%NtADoe7FFO$ON%!++p-lpJ!BQc(SM_91bel}VmNR0AQ1*K$N^tl8eJ$Fcp%CuDB+idCFFcvT zJ;@WTP1QE8e}3ZkzhAH~{24W6E+pfx{<{@z-TwtnUd8Qy!TD%+29e;PG1G7F7PQ^( z+}9nv1EV1G<6z_GUb+d=j_ZxM78@#N5|s3%%l>`L$nV9MO$zDvGsk342>CQg_wTSW zg#Z5YH!g*wjK{WA;a*P`t5tYkD*x=S^Zv;6M1(*slHcLwGY#Yv+#kFXL7~fn&!ir- z>yOQm6P{y&#iT`S(W(^7s&DLZ(Eye0??x|8Se2klQfcahG(~m0@ zhMKJb?2P}6Joi8I#Omwz@?R&nK1Vl-!V^v*?5C0q&#Dsu8mItl6r zN!r2(pOO~h$OzI`!(TsZitJ3e{v|ipE3cr^rinfK)pW8&Pbmp>AVwZ>D+JwYbS{Z^ zJ()l%=C#Cbhn_!$FRV%*@E8Te#LVZbT{2t?#M5j$FjWxKnBR5cni}iKNJ!{aug*xi zcWKLn-(`}fs|Q@cX9?(IHV)bE|M5l%SL6*-ytJ{5pRJH( z3SGkwtlJTh(qO>uUx855(RQl3Me22#K)dqUpPw5oBwV_e=+&JscBxMnB7dFrmhaiv z*c1ucBK$*%Xa5%RfYgUr(s-4nV5q>EGBBY{b0YV`7ysbmr^*@|Q(qxSuR;k}jlvQW zZ6$4L5G{8RXMeF3K{!A|qYE17sJuKi=OBWZjo)|mGLW2XwQ0w%*LvH zX&LG^q81{YSrn$~jqv{+D^(%0&-*RF=gsOB_4I$MY+B@;~b z@^ZU|SU0X~TC`DMwQew`CCk<(6*#__mR}2hLG~My;mpxVKM`g^Tj4Di5QRsB3y}d2LM9k`R8QGbXNr59MuE$&Cyu69k)e{OG#$4aO zo2Rd-UMuKrrR~(7k6tV&H0tJYadjoo)(q}9A&w;B#oDg9deRF5kg=MT6tgEF3n+Ni zT!36-=@dTGCR+ljgxy1vvhhP>x9UYMP)w7{SFH+}NJ`3>mb_6P>#H!tTv%&4HNg$o zyt1+qT6dE^6_k}r!tl7-AyvKXaRt@i4oSJ`sf6LEt6X=bNN$xeepj4_+~qQS?f}f++r@#)s2>&_{PVi2!; zZ5*pmmsSMDr;d)h*F4V0rw2zzCCoP$SRnoeFLQIBZ`WO2 zXRIwrf>N1)7C%ua28PBz*-6TLsm(t?Y>sEPMt@fNFS{pVeV&-#CJHt}4GHL^B7#C6 z=V3bp&q#GzJ;p8|zh89V*(;o~+%E5-KmYrqH(#M0f%~QV$)(4Ihal7k`}v8Uou7Xc zM;q?z6KBGwz_~j(F#(BDXz%Q{Y{kT=K}LcrSvDb2{k0NqXlr9$L2VBy;^a1ctGd`i zm0q(t^7}&hYojVFT`rv{F7edV)!*P43iA+#B}e$w z;%L`5G{pbZvS6fjW`<1rd`-EJEtoonVZLvc+~u_KE7RLN+{A8KM@LRMI?a|{69T{G zk&)?MY^m5c(|s>MYo^BC-9;cbcc8ytLP4QeV2(bbE*AOxv6Lw-lGA;CI?qFP7Z;a< zbqxm2Iz;!j(`<9>%G#RI_|fBwqp#D&uDw%V4|sV^-@TI*7d*N@K0f{iM?`Q6k>r4}f02SDb7jv<7U+d~pkEhN*;9Ay3%j0Da zLKi0T&uI_tqnetSG;KOi^Pyzhet===Pa{z7*n^Oh^FeRuZqtC_#jafF-2SOtoKe18 zaBwhk2Ko7GT=+3OTMP{|**MsX-A><=kNE=#a0dZtcoo=R^RN*QJl+nnCCO6T+aE$7 zX0o|&pK1mV57F;j^4vcxLk|u@Umnhc1V8L_~@B z#CDV`sRn1Tl$x!Fhll+W6G3Uu4vr4{#}dAc!_crhA|*qcfWX!rE6LGt>(>)FnIT6U zHAuPC*6T0{O$V=7`X3H4kDmMUD~SJ~j%;^5Sb5`d-q#2zsIuG2Q0KR1&)+w_Z7{Uv zc-qY9DWk3EpDF3-bSXOaD!{LW3LXL7L$cG;_kCRObViG^Pr>?S)_(oC6oZG@X%%zc z{~mqqjtgBp0?c*B_wVQ*>gxj#_xu~bbs!OHZm2L}yoZaaz| z2)`n~2J2mU1_UKz*q<1f&){GguH+sczOk{f(@t&Df1WYx8+$mvyY0F$h2MT4`$`{M zAXU382S-G=d(0j-l>aCw?ao?p$+kS;=jYdOKg5;J&6zE1jV&_T(jn(CoMpDxL^&PV@cKwQD1GBK%qCwBx~H9 zXgS#5-wv4=y;o5KicMxc#@(Qe2v7O!8piKy0_@t9%f4SGV zCn^5Us@vgK)yn2(Mf!%4@x7eUpy7Q}GN<_`Y zfS{anTCM$kK>^^g;Pbk3b1J!%CMiZnt#u@tCLUeL-FQ<@7m5*`xz2$R_4%R3y}Y6v7b!Av<}#db0WFExYMxb)oe-e^S5Jn;1+@R7|+`j&M0_;DhUFv=pB0~yk`>!) zMwq}cF*4HodxmU%#8TX;1u|ub#6pM-K}B2NQ{v_gp)@T5?~sbwv-R?eqRySuOEz}) z{drRU+rNjuk2_xm8~otrU_zwk)~Sp0cf~Sac%J!i%Ai-Sdl#?Cjln(yK6UG>o4YL!2PV4C*0>eL)2M zlkdXrDlPMJbdWC`tV8ypcUiwb?cQjiEoc3U54>CD!2tV$hPJCaUANr>a-SO*80S^$>^6D6YFe+0)po{>?QFh6Tp`e0k2YpkjZ>Fn>rNP<8EnHit@2k>wE-czYqV2t zi4hTckf`K*d5AkL<|Q?{jUpXpshF%_qzd7tV*&QOz z%S+EMiAueg#5^6p$5?27j)Ay{ZFO2HtE1xOrTuz;(a;cLun#f(bK<$)j9@`H3Aou0 zQ?*k!{Y~5i@wIEMxVixDoff2CK9m_ONBFImL*;WsN5az2eSblINzb}S9kR9|Wo-$2 zdqepu3#&fd)ztS?d!bh+$N0ghTABzR3&$qwSm{SVWl{bjQdAn+^xoUE2`MYJ8F^f` zYABU?g(13`x$Sl?uvNX!QCa1pa&*AT##u(e*J)7HRLkpe<|wEK7xx7M(^Ic!LlwkU z*r`jDW)(lWV7x?nw>O^L?r-;#R5U^v8M~GFI9^PlV;w3pqze$<(18%XYNdV{?zA zKy3vL4dL}&4#fNwf|jxR#Ky~W1MqxfR=2w7!Q^72(YKAig^_g^i+2!<+K5;WI%16d zzw>f72P@1kXCDkjM?>!c!GTNX9J6GpSdEC1tH%P7`*vgOaA#aBU!8L^ltF5Wk9h*8wwElA1m!Rb#KmfB^%P~N z8jcS3>Tx7mA3>&Xj`1B-Z@zsEgPUV9-^T%VL_+KnfYs?dxhM4Y@i!kYMZz{9%ljuM z8&gS6@8JbT11Rq@Vjaw)VrVP{!E->-Cu7QW4f(39s))69pO;U-!EM8qO3kRQPU`BC zp1PVrp~&#D13~!HlSpU3V;RO(9L_Rh+pA~~CEtPKC@af$lw9aWJ>BUOs~ zmL)aa73}QQMNHq98)Lr`!SSWkfMzS5s=wAAOG-&{IjxX^yM@I@UsO2y`!^YDmfZa1 zvETyS*IAj1T%Ilqy#OX5x5?RUmBnFeOvX_T)5G%v2p+x7cM2Stc8c69V(Fs7K6Q3h z45A&`AFpC$shscOwMYl|liWX4=a(9^^BWk%^l$w0M|uI|o0rl!e&2MI)Uwzx@E;D&olqj zu*gW(xvAMAHa3pJcSF4W@s?U|zq|M!gp{bR3_u17SEEC{i46Ow+HRm$jQkc!>#M= zOaMyNdfk;T-*eiY7WH*bp))$eZ!6B8oVbOED4 zqRKhe;W&U1ZBq5mxjC>wk-GmY`_CaZ?rOi;a6=XnxJ%S1>p!ae;M!SX zz4i8o8f2-6UH@BS%!p)Sthkccx=&n!JX^p@8{2ETew;~~$Fb`&sXjWpJEgLV$IU$o zk*i_UzFUkSh73ucx&*fend$jwFGP0~qRAGh7s1uCnmMoXLn5w)bjwcGDU zJUU>t@Ax;SuO$ONp3qniR9F^x6KlDW*WiW@8Rc{Fv|8E0(iDT@M^O+{gA5!h-J9;Y zd)Mvk9hsf?4AzJUola&2p&T!wW6cf&IzGvnn$ox)Z_dvOUVO^W&(Cnsv@P+hovnNy z$7{?1^YPn^W1aPD#HyE~!>cZVZ}^-To@BpsmA3mHaNeVjMvRwP3PMI*f!iWRmTY_j zWvoV%AmUOkj@doI!!kol^dDTlI*N4aFV8W9+TThT_NJI66uL;uNy$02pnA`i(EC4o zaGT5U@w`oyYOzDIKqCb?Ilrm)IABsRE3B|%s5m+OuV+ISYX02+;BqdPk`UEmqayd# z5G+LD)KqPT`>_?UN%C6GhwM|XS16Zpz1!JfrZzUD&(6=B-AoO3CO?@aV~>)ypX58p z$XPOi1l_fZ!$R;sIf6%j06bBaza+ftJ6dT^1gFBNJt7dAfKU}?-oFWjTaeF-|SlarquWIXFwX9?85cWs=_FLh8Hle>&ZI{?UDbWyR|=RM;qL``EeT?bTt=#IHJF+ zwrfJ^Iw7hBmcoSFBk2X%wcnJF7?(bx)wVW$!d5AEcnkm&>O3K3#IM_koR&5c=!da! z-j&UD$_D{vJ+2EY%u8MI!Hu(DvW%WW?bpaYEB;fPo8CfR^$*O=H>(ei-a*5uyzHwX z=r+3TdF25Hc3nWT7j8?asOCHIK0j@#(a!$Xqxj3V!Ozoy_vitMpCP| zU7U+}KurG~G6CsnzK_@huSN`hVKAjWT(f}yMZ5*eQ>*H1mT#*9crU1_y`iKuT4Yaz z>irQc8KbUg&aCMV&GQ_sS}Dc~1L1_6l)@KeCl}T{Xn(5>X=52Ge9r5RA7{xVcBoro z5-7%MRrKw;cx3;qK@&daP z%k((ZnegvNMMYVy^gZFPIj?nQESvUNzkTYr{wiQ40FC5?B$8U@DbC&fOSIa~sIhip z0k@kngCKeOH9PxJByxbzIOH@VH4uD`{qBw~X&0H?TAmi=tx9h+Pb=gx19yySNL{Od zF{e6K6HnFOZ8y#LEaBi9)qEHUWc>aa8rnbV7=pu}pomGDmnWxI2XqNoZrhP$#~pa8 zm|BE=cVv5>54pShMbQ)Z#@{~;h2>WTUySH7*US>y6YBs`{z&4M7r60 ziwvao0px(@V)uYbgba@K)X+=T_J7n7W^6j}rjz(HESm+; zvhoZS_>YzK^$~N3$#!)S3?jFm%wMr@a1HZ1Zh^nxurYD#_h(#7RxW(!X~tS7>xT0! zJB*-Q$6A+T%?aDy5x4_@u(s_N3A|Q*S*k8u?jP2uJ7VwCZ6V{*ZL&xt=)s3MarKx% zv&aYTqk%tvk`#x*0j=bz!Y9TD0X>k{f72l;6*;Ca8p(WiL4IisJn8#k_YU6e>R9=a z>>?tEtqB<};w3bi4R6J>UXvgmV((W{{I_7|T6dZxuT+r_r?$of@`QiCk+V6fAXA)A zcgl))`=;@uy6IjJxOH01R4&)4cVnp55gMp1O;7i}wZ9D92qa;AonD3F2=;$XR?z!` ziqB|UR~RsGl37yQD*p7fc>EC!TU;bkC%roPR_o>6y7?8pU~5Z@4)30~x3|j|6E^i_ z;Uh5?fjmw9veA?JHkfN+fbG!rb@!JaR1r5(&{TYE?luz22dY9(P4 zNyH?G##E-nZjH(XJvDXm_kWBsGWE;Gt*f$ieu>^szqoMQaHy&!aCwH)V8S-H>$I}6 zk@4;4g8(|^ohesRCR2Iz`WIoqH$y@>!<6%}JF#haPkwD}xX=h05vRpc!#xIZaq5(V z5<7S8ywXyPYnmwl8ezN@+}y;siTQL-3o6&{{-{}c{vj&)or@YzO^y4)(xSZT8wsP9 zFfVg+^UT^G*MWRYX#B{Z;5TZP_N_c1M0!eZ3 zsWG+jzjaq%YPUT2auzhpcV14pxZ-xExWwFJjO#r^PgE&3dMtQ#>KRn-SWXAoB+Eb? z;DJFnSRYIqA?1H7w)~Ul7MI%zG*={+;es{6vq4`o%A8?8CV?FAJud@ zB(idHQfhUDGQI$!B#n$vKS!AOyt3g}*U}PIHKn0d{$bSMvl|ygm7;P+5lJN@`In75 z8qwL)qc^fOxiMAa|9#x?n$Bk)g>hb!MK*;iIJ}?EEr&jAeu{LS>4R9 zef1oQ3?1p* z7-enmXIYz11c}=Q0F){E`q`BOuJHnsUd`(ePOy&Dq4vPuC zxrF|X5ip>@mxE(^_N(1svfLVbymWh}gO+i`+xmrk70lLvU>)GYme7K%k`kZNQVuF< z{Lp4SiQIegqv)%vSlJ^}HRmg9B-~@X(Fh`Ct&mZ(rB&mUd0Op?$fF|%#8Fx7NegG~ zkLmXu)K^<=0b?k<4qHtYWvi~glG@%9bf?s84kyadbSw6%K)^<`sJOV|oYv81r|*e| z1?Ss5c2n*5Y=k-a`2fDKV_m}>r`%H^?TS7@ckkWnsnoQc{H07i!8`20ibu3y zut``oiTXmpmK6lEB|14T2=3kV>J4RF2+GNZ<0wXQc`uaj>=7YRVq0hDVuTcf(RoNR zof@R>h=?G`>8?0|*f2UT~M)HOU-9~yPV^%QvSKft`)(p_640{sbz!ElOC=fH;PFtzo1?!t9a znNr|+X|ZR6jcf3H^v1_)=SQS{k6$@d1qTJ)XMt2j{QKlvkrbaSJ@!c;_&ZwTiV21c zs6v!t?xNKG{&f3`J>|NuWo4nzP00dEX>5m-lx;4Yh^id7>&b}XILsvtD$9ByTBG0a z%{!2>HUP#`Y_s_8@-M)%a^QWTbf*TwES^i=p#n<-QjD`L>jnCfn+88B&Yo+zt>Su| z=1sqT!yE!y;2+IRQw{bFqd6DGt`K}l0cNa!OXNWPuL^@t9(>yljP1ymd!tvPFYoI)#rw|nFM z9=-mg?tCv}faSaQTh4P&f2-#B{l#P`DQw97;SPYP7h{v!U+bpZ89h#kFdmZ-e#h4i zZT}aOwYP~c1C!DTLC@1uMh_8fOVVji9h1}yxZ!sKwJ%Y@%bRpW4}RX$)3b#9;1A8J ze+Gk$Gg!^~!p-$inhF~(P&Q6ZD4xVu){+$xx;}l)mxR-cn5&j#$=hcphq(<7XQu}5iK%Q1IdOB%G-#$gIO|Cx&E{* z!C(%7UYx63|1pasB{rk;9v-0tMYG0NkB+KdG)@BzRF~>c;u1H_ci_syTZQc<|3dQ8 zaWylROo9dJjoR5eT%Qq_n*YJOtZHeUYhHc&3>8{L zqE{Vn0Bny}x2%bGKR*HjO3L0_VDqM_WJJ^+@)#-Tw*;+fxNZ(X0wpbSjSJr$RzWca zJu-7cMqzbz^=ol@V9%x;3iKff_ z!7%_^^yrT7Q*V40mH|1*Z3qs1{rTlX-Nm7GQqM;ybtK6fL?cn5Gtv}m+6bKudMhyU zCD7mF7>&bhqU&+lG$?jj%d3L&A`@XSKx7JC=X!&qxW?HTQUqcf5@V3u1su-tsFN%UGp7?Ggi?u!V6|pOPW(jx8#8r)DvF(TjGJsTQx2gcac8C?Mm}X>C z$7X)}7Sew9~_8BskHCRt-Lj+j!Y!ar|{~n-DovT>Zh6-FpowYw>kwx$2S4Xzp zkH?Wb0CkGf=VfgtERb>y^*HekNOlhS%btG9BiD?|jay~3x6n?fW%tC>b(WIE(=Deq zL7_T``pge9h>S5B>n_&oF3(5t^yo~4gL17@nsv)4YFf-Vm_6LsqoZ-5GXp4Bwj7ua zwzai=DbIjrFP|pt2GOIUV#Z;YXjEa3ff3}9m=+oTXT<9#)6~~<19!ags5&tbe zUuUYCJ1Qnx{_VpG%cZW>YoMwJZd>_k3(>dyZ)A*&p>Ugabas@lbaYMkSX! zi)7M@io77*659*V$-dAOK@T0fUY;VR{FEPk9MMYw;`K6F(}9mk6uF@T0C=pkK6&V>bPzyh&&0y3prO*bfvIIj$2g3n+|5_l_8rpKc%G& zjF@|BQL!ot!Ltuu7j7_otBg!$`*)BD>cR>c8#;Z91IJ~zeZ4lu%Th@NPTX69X^s0E zeBrza*`O0(b>( zPdZsXFI1(gtxcz)=?+*UD9&$%?5&FVBXyeR&kZ!}dVf0cCq+gkmw0sJ-LpSDG%zxH zt*O+Uz0S!5w6H}vV(iVKnS})gHdRn|30uS!@-jbNBC3G(0LW0;lgg~`B7dp;`t=K7 zZINik0pLhaQvHRqZ9EM5^wc>j3deRRS{dnBfb~O%L_Z3+jsO#!s7R&6>Iti{ zw47=!EohQXOb{>iCU#D0S9niMOk@7dNP6iF>;_C)*+@AL+9ZMy`4NLxOsz`Q+qTeo50KuHde4J6mq_OU zL=>w*-v2{NO3H=BMHa^`VvCAX(Ja|yuTi~EeCf`%uyFzSfUSGpBGSS8e(64J++LVq zP*+;|hP+)i;0I9mC$>#6G&FSK$HT*2gS-vJDfex6hmF6@Wp#($*gdk4=$XT<^ccMU zgYEr+B6*l1d~MC{q|sv0gJ1CW)a3k+1BYJ1)x!xg*^iJryj7X;VxZYB_vnI6 z?@AR6ZSeAXW1b95p4`|~%f`1s^O20qOlH_-(9Ry&o<3yU(r_Syu%k6Pbo56&TMku@ z2R#Er8cY}^Wiy-wE2NoSr{~l!R_(3S)aOW)U0IhNwvZnsgLE#{pE@KEUk5*~5zaVW z#eyD8t(Z)=ux88N9?K=c^78U-y+7%lD$$)xgYuA1m`6kgt5+$X_%e0G`+I~Nvaw|b zU$Y0l<_hY4lt#vRS(5n}gSM?GqhQ_RCHGv+ZJwb6F)3KrlyBp%tjeJxLqr4 zcUbvzR5~t5biriWp2tr5g15@JSIeSelOaXzh%4|BJ@KJt2>m18YEpFn=#{fsKiyWj znmPhn>PRslqc&GIy65KFS})tJirf!XLPbJo@q^p#kJ?x2W?L^mUPC5U{uyDvMhH2i zi=K$ks}^=;ZT6)D(ZR^wJ?e8mNUmveFQk0by2sC&r08NoXX@8@S1k1LVsmWF;Ge%u z?#GjzhOrFXrUW;=81H7kYQ5=QpTYX+<=4Id^a{C_7zt=+#b~@aW=|#olp@j)?1WzJ z43_iB%2GFJkB<&zG7fRNk0}EB7oZuHk7iW5V&n5vQtD?j_hES4O~R|nYg9hjH#Joc z(HPzv^`H?Ii$HjITz00i>NcEUu_WbwXGx%2{`~!+Ysd!1r5%s|`CfKOH6=gT=6U79#$R@QOHSj4 z9}JHC)&UPY1^U?gNGFpd>$r2e%(`E1+ufL5^B=jSVicVN@n1C3UTk)l{KtF9`?- z2ei(A)tlhLqu2VjUA1educPx~`d%Iz&ww`BNztD3O57kaD+|a?kjUZ$pg^aAbVl{G zzbH@=V?Z!Vl#q}JiWVU5U8sYoW)=9hppp6OS1=Hl*Wh~oV;l;=GjiGO53`posqV=A zCmV$Iu>@Fgk{@qNBXj*{?4I1``6qXr=0B<8@h|_)gHNLA5d{P};`TpP5dSHL_@DpC z-oT23IvB|3{%@Vce|~af2>2cKe}0SnN^x6LmqCPfa>qDTNYe?VP`bcQ> zSW!iq&Rqhk@jKg?sNQkiORO|$$f@X2IJ+@vws{&QtDWbO-}km-&Wl!@)iCMkf{%m| zFOVR8_rRZdjVJ-G4zA7B8=%=EE+_XYB7-#o@#s3UK62h7X6$^OjWsbz&DQk0OFb@^ zy=C0+({T#C2|!HKz8z zt0FGr_`6vlc-`r%Gj;*VbkAhMkG(2%bM0PmNXMI204&~ovb9cW?*GO(_^gP*@SY%Jy z?=PeJXG4Vfpz|i1O$z@0K$~Rc_8Zq|o`jmnfhTfmWN;F?@Z}>D23xX>8fL#`-{|IXesrnd#+y+x#B_v(+G4prXmo5Gy6< zQ2h(NY`nX$(gpI$7-AF8{HQcjQc?t=nGFeEKdOl0T2TS%A^fPgWudUK15mVJcL z>Vs?$A%jX+;WrOa?27303*!z;U@h$r(QkSQT@nI|QK%0}NfsZlR{a}+S|Wsu#{olR z>BqkZhk9wVG`V`ZFm>w#?W_~5M(z=R^-wA6syk2wtt6faI%LSEq2R&rT^`&!I5;Xa z-RA%SCdf`0-h_rtCg$&vt$kGVcx>@lNacjY+qO+RvC{Q<5&JVDAbFQiq2fpuL{GcJJ;m2W%aG zOww0xa3(E>ahJ1M61(v4hd&VQq8^^!{?ps)rpQd1)VsVqc`UHd7&@}{@$0O|vk#Dl z$IA5JP6qn%$o1+%JxYkCiErf*r5LHZqCsoY`!Jo~az8hliE;?PRkz_m<9e%HaE^%B z-P_}|s?g|P_dC#K86|t@#%r^H@8P*HHe374z))c1fz&COMWKfr+tz6msW`rAzq5Ih zHGVzgTs<8wbx3jE5*Zj62s4a_h&oAwuCJk-U?>o|Re6cvcglyQw)P~u(f~env!{e1 z%_koVP%v`(Z>4B$T}`z1Lprd4Bce1bculR*;QE`qa2W<9WVy0wR!JB^;z3_z`RAJnheQEvQrDitQ*~UOqY9*P>ImPE}-qIFGoO>wJ$C z)TlyWZux%%w*huKk#M`?0FlM0vYY=hSE>f^?9RiBv)?!EVy?}q7#gqJo)C|fwvZ|u zF*oKMf9ra^&v(jy*f#$LCOOu$?r1p^}o?{dUd5XGDNethb*W zE*xLyR+l;3q4)p&D`v-bdiMyh(2k5h-)j=7#fII>35;IPbv{(c74mHPs*7$T`QGX2 zX$h&(_aOa2Z!4dAW}X#{c;x{Ux{R7BJpePfnvU2(!~cWr2#iYu;6oGwB%nF5Sj$t> zTCOXBa?Q_PrQ8)WVYs`tsBU|AcLHpOLrN!LF(q;2#gBx-r@t%@LjbKy5>sFrz!9o9 zM`v>j*b`am;(@#|O^2>0OF*Qs#9U{oR-J;f?^URL^}wGsAkw$dEduzd{AxYig9B3_ zSDgk@R3N7Xqp(rp(6^iqkDY+wdcqLipWkAkQAlPOe^@e&BMH2#AD61!Qlq0FL?Ehq z3KjGrbXePdmxgM9QDU^=XEr@B1&D!)bo=@L?tebC#KK zWh^Zb0J5N3ckcn_$*XqgGP0z^VT0@CwEhNYF$9mdKY_OReC2}nBlLSP?hzVDMM^cU zXnbif(RX%0)`FJTmL*`pL72jPB3DyDkpjtJl>6c;@q#qU0%^Iy#$vXCQyKYO`z>(0m`=&5MS>Qv1)b`6Kx? z%r76Od?z{tQ%;ROTtFne8a$(KJ$a8mr}?3O$XEvsBMehh#C*vlL08vLo*5C~f-Eg@ zRH~PPq+g=kmVeV>KyRs}QG3hZZaZ%YYT0V5Ct=_{G6Pij7vQRgJ7l$(tLQkI3Q@Bi z)cdv-Je*Lu9o>8T?v2l+;T2Ge0IV9r?m}wb=1A3}%hnBnYz}Qfp(S~c3 zy5H2?x}TlS+fD}}uv^+m<}XqV@cgBQU}%eu_P_w$PE&Z~s&-H~m{GNn|qB6L0CUsFc#C@3^J_`R3sCKDeoPuqOlo4NGg`vu0q5cHnOO) z(6#`i59BM!X=t!@AsNzP0q=?s3?&-cHtE&;hpk8bL3fA2sZ=&yE+BjX`ceF0RAjXP z>;AFTm8ZC6fS0_{Zh1gtn3@JwneEdJeSoirw(nQ_B||o>x)O$9(EOPq4gnG<5%EP} zX{V+x1IHV%PW<_!<6}*otDKesOmA?^HaEA}EC4%% z(Adoll1{_2Jv)#CKtTHPy{wurAs!RVPWyt;b9mv{SSm4qpiL~zNwbws%-G^W1QB2Z z_oHV=1^`5dhQ*VZ%{hR!?$(`0qdY2yk&$64r+OI%QUF{;f6S4B=Hh7ZlvP_kjQL%r zB&#pfx&Ugp7vP@<=HnfwT_s?O+ApBJc)r}%FDxE%JMkJxt~(SdBmKYiGAtOxd>A_> zlg1F_@qjdmTlWS~rxD!GXit+*OkhLt{w0NKx1dIa;URXS=oqw!yXZA%!UP1hQA98` zi+HjxuKSdbS7- zfx9Yk%jW4wPuDtf{4T%9gaE{J2;$ zhk)A;hOjp`LxR)|$;{o|t=7{i^H(ng9?`an>J!TeKw;!Si!?XEV8k7RV=T7NbL)cNZ}M1MwUCbDf-QB(UP~ zR#18Q;*@s;2mvDJPiJ>7JML@J+=si;?+sC&1u>v}pfc40Zg>drFlUz5f@t-SMGI+B zujf{FuwN~4a@w?T-FtwPa|451fMq3e6+wzcgOKDNgD>3PK)v|iBg;LhvCN((V#Xu! zGF6S?$M=Jk+&yrs0FDpm0^ZW#&`8hL)t`$8P|t~)eka;a>7v0#$eH||=Cm?WrH|m; z$^!^L;M*{lcK)xY8&M@;t*^!*f{5EVdPGCh_4|+;6qF{{`Tka-Bnq#r(oW<1r)uYo z504u%UOTiA)ZK??;1IC@vi8f1hIPk}CCVLOO!gJ#5ZqJm!;fP>HIxj05$=Zc<-v110!P~>uB-b7AaA=kH)~STj@QtO zBd@;rsPJ$a4vyxlZ>p`Kx}QL-X56Q_W}gCh)~l7Qo4PYMSu(1ICD;9Fl6W@780H0 z0`*fOuQlTAY#do|@T5s*ZsRXNE?`rGELXslm z&$C%2_+|~D5TT$P8Uz%=`F8SqY_Rd6qZ@*60)$ocNs>T^?Jop}85tK>RKRQ3$8^Mk z15&=^!077f1(S z0pXFoez!F+G}NOLIXFCQ=1PK26BUqZ32RAg@>{18PsZ6~yo=u)CLwNR0G*gsk6u+|MMY)) zb!dP>!CZ9w?yD-sP{T#dXC2h}9|OC?vkO7lZ+l#)0yw+wWy*CxIt@~3G(t$tf?I)x zvCRlfJ|J!wY*W1_H=xN%;&j5;>Whm>ihGkR3^ceqTSKUivfxbW2Sn@6^FxRKteMzB zMaZDCx;$5xii$k=y}__b6_6C9Xv&G8KnA>{nYno)Th=F#XEm#rm2dPGF!-H1SO+qa zVSRvK-_&8h z;@7SvVqs|TkV--61NdiMI{6!CDhQq4cl-K-XNJ6&CTTjK3}gM&q3z2 z>i%B`-I^pi?685!OaK2SP#k=Fg%y9${DF5}IJU^*WZPyMVJ%=}EJ>xR+48#yH7v41wi>0@oY#A2FE{r1Y#}2!{~#M1yt9wgW}@geAD}CcY5B~S6%%5 z_Z5eJYQpo+|0+UwSyxmrGj>nSW8$n!U1^k(yA1(onkdK~<&*KTm)5%oZcZ z^EAf(Us$m{7U<(*x_m&XAOY~X49>1hP_(}VaWel4p8f|--J=9$kG-PuQ(D05?L~+*SKMfLX;yB7hFmhn9f!fgU_y|J$|vr@v06+S$n~V4`z< zyrlpjImhw&ugsaI|ABA6{lJ)%o^LfI-@yCd(&B$mw?C-{+u1U1;WVy`=|IiHFddc{O8BwiJHmoxl&YmxJ+_+92os@j&ad@XAm~3o z*XLu7DQq;8tqYbA%pW9s6j(QCq2oj>Ep79z^+^2O)dP148aa(HmFADU$%P4 z##Wia|NY!>E_gHCIOT#4hiY5!1sz=1@mH95>B_lDhPUY7zaO#m{$WA z*VcdVyTC_FHcyHtPl^W&26yWa3|o*+8-N#Kw+Z3!5&p12H<`#07D_3=<9#mPF&855 zpZ($F@kW(}zIKLgdg}-E4o#CcsP-=|hqATa={JGPd%CQjJ$wj!1#r}8Np0qm4KX!3 zuuxFfmG`$L+p6a=yEtB4-LXMpEHS!6J!B~Z^n1F&aEj=QLzUP^28lIeBLZNRYLkJ7 z;q)%M7#|6nrx>+|^G9lCOJJ%E9NP@r04EOTk7jb-RwI)H{FI1P-!Gwulcp_6wM;cU#aTrgmtGf83Rz#eu zqDIX@BlhoH)QqYbd*CVmcd`Eo`Bh9lU{jL?E^6yDOKZC_H}nqDWo9v$m-2?6k2DzL zD;?D-69)fA)*q#kii~%@mZWI`qdH%yKNX5Is{X*D&P^)K#i8C-n=ghO%^FxWO68X5Ono~_G?@j@(mb;WZgl*OaUVlC{x^jLzh;PO zfD8DeZxZdpAoAxZOn6k=ma6TY$@y0Q^n8T(E1G`p?+oHcdXC|0^o}DZ(cw#Saisie z2ioPsv@kKZcem(_Cvoa#(Wncx@$f>#S<~BhKf@UzGS zADQ08BJ&UnI{jwe)CiaqFDFjZu>0f^&vZU=5WArFvzY3f`aq8)?)4#+CL@UJ+~R=@ zcdIf=B1=vex=Ds?<|!uJzx-%>FV|Xh#h*#KiO;xa=&AMf9UWFM{8{*iitygF;i~Nz z{Xx?1Sh4avZ%I38B3Z-1oEe^QNjt~Op&q5!*CP!IursMBOz1?|6Wt!SAB00t=$jaT za|?j+=08l*K4C#tgn6&znnvIeuSBI97iX1=-!JJIp44i=Nc_R*yt)S(<^R^22C-+K ztbwqi`P8?Wq7fgC1T6RmZ1@M$Q^6tKs4%dE2AMer7z<*oM>D6QMCu45VBL5yd{Gb( zlxFD$zUsX8IvMEJ+TP_)zVNm8r}mIPobJx-KhPCmH*Gl8Ky!G&f5A#AxA|uV^;G%i7q>b}njuIcOrmiamL#;x zf;Q>?kEx=WLng?=t4)&HI^Jd6PzR?sfBS<=o2Y0K`H}}cF^Dt2>tz@{rXdhydAUk}0YnG_2&07Z4sD_aS!DUIYsx@SFh6+*fGIiV$ z;v!!Tsu7f?A*4o%IYeOWktQw<-nf?uIEI!nCHPPp=?$@+IeCJ>B?}B+iVr^1{40K$ z?XIjI2w(0Gxt*KeU9vj=aDsw{CmIWo@1{snfbCE9e^A}lWZm;@XUvy|%-GDET^6L2 zqJt0~6wE5~Rye{TbzXyEn z9bGblWFs4rSo~Ecns-OrI}tH-VF`|n{VCM3Ywm3&n(TT8O(aR?dKWD1WZ|G$;hgzy z8*Kwu+hi9Lqd3k55m(pklZkH--^D()S@M)367osySd=hEsB~^AnH9o(bVA%T%m4iAp<28=U26Mphzcgpo`26dmmdO`tisuSx7KL>0jF55j{->TG2HOK z822kI7y$$sBk$9oFHHaS(JI&vKZ0<8VX-_1iXAv$@X)-*Me=;%6dT9mu=mT~-O{kT z+98cA|IfDawlnA#lJJMOZSakV8|O@a&S$o+nKm!#(&qB+##qs$b{Z=(w%R>&pCQkw zv16C2$*PPLHh#S??Bj$TsAB7BSKPz;`R~oAjC=3)G7)Hdq(%DpM|dtNO+}Br;@Hk2 zK*T7QyCO9#hw;TX9aT#JgWzA&sKYcT-b^3{1U|R$gL?#=`pm2<=gANERqNc3WI%C% zcMiaO8$|fcn+JLowr z`R3&wJlN}QFN7pg$pcxwBJ|1dREfMdxrR`ut{z-Bj}lxzUK)5Xo5o3dPDwhA_2?#s zug8!ME}00$e&{$rwXB=u>FU#ZNNLq~tiXR8^XW-w@Y=HqHG(>D5va*`#hHIcm&GN; zJGX)YBPb<`qdrEPNoJr5ciABzPV|d7#n9);6N2kW;6XY~f-G3r*g8@GL5pW~WBVzr ztyFz^blJRl(XJ{)86^;v0aEjADOWbVwL z`nl$7e}-}Q?<2Wp&j)MmSxjGFV{ojkCxNR79*wDXGfGQqOKH~(z>rq;XOLh)14uA< z)@%p-Wy&%Jczg8~7&Rw5^oeR1!4(CT6VQ@?yqGP=S35Ay=qNReX1IT!8$euzTEf z)hg5q*5+sl8N5J5yxHT7fB+H@!I1GCTxH~{14KOb{1@t5+bpx<=N8r@J>we=tr9O> zCld%?xy?T*mQ2=1y^GtQnaMs(RCz(z#Uq#xF1*VzlkHRn(+1BoEIFPmkB-;-9xN$U zCoj2ZnW=Ub^&`%09w?gKiymM*_lB3DmYiQiMfhc5GnYT=%yv4iaZJQt@g#G;Tl<-B+I&=H3sCosAS>RS!^T1y(7=@fh7KY) zTXuaSR(39th6}wZCXF`(nKA!;f#Ag-f^c@H$=&j;#s{((JB%NPet6LerUfo;9iEyX zXy$D?9Xr67bq^Tt&%%{Xq((qOq!Z<7$tHa|VxuOP!KjoV}8;;Mzs`IHXi*%@ENAHRm` z^rldP6smp$7JZha+rBm@yKR%t)@@IS?2C)Q^XH9#)9|CTJe?`<9SFsfdH(kRM86kZ zAr;ZUB({Fi4@3g%&pTd~|1X7`L|1LSH@512IamNt`9C&px4W$E;(#?OF0Q^DG_K;r z1yY!HkM(&uW(2R9LU%yIf^0yT_r3;320zwWJA_qKkjA-gz-R$%ctm*Hhhx^snVIZ_ z3IH8-@YILanj~XVw?~4>P6ySs_4Q{UvyhmO5Fx=_)P{sofNRhos`nYvXSyemDInfi zsn|^zcV6!$v{nBWg?i(@r=(UFlVq4z4N*NfCMV8i41)TUqTHVw?T zsQ^vJqniOC!t)s6$LwBGbf+|?$8V@&^10l~^60Kq4e94;AofuJO#aS>v}rm#aQfGE zY}t2c-o0f>gtgkLNyl>U`vttNk?Nz3DrNP?^QY4LdusWOj8$aQ;v@2ZK4Ra0=`5OV zH^WgUYxt#K>PDIa(^jr*%jx;1L|(zcIdZYnO>b8_4#1;8n+}} z9IB#?9`yn;9X2*YFl;wITtHy)wo@FOA@OK*ziO+uu2TU2OyzYf1=zfSQTDT=Xppyk zKIVoOosc5nBtv`Sb;6_NV)?;o)do%}4&7p<@x$J42u#h|NRTI$epG4!lIB3#i+Q3; zvQY}mn5AA#PM2AvvJ9a}YKzGY%k&YCcuPT0@TJ(uXoues1yq__f4;Rk%MJZTFh4^9 z#-^ox_`#Q6oGy9i=aIxuVbWeHUkWK|<0}iSDGkFZ%xa9}W9WrOvN=LZIcB6qrK~;# zD2AawEH@gD4G`~wlVa;Q?gVJUby!jWEV*f}-R5g3!z}}zaL1G|Fn~PW<+>N8nFJX= zvzX%ZXU*3mcZzZ9br=eetmYeSIcTKnRHyh=~>5Jn= zVd-xSR)k59Qbb~8{1SWRuDXri_#ZdlD)fi9$T1h%!m}?z2@o()378){HXXj9Ge-DO zVZfbf=ZPf{oISaOtuy`a4bRF7W|B}{ecK)+JaY4ZfLf5t2o-Bb&q_7mL|GRaE!1wP^V0RB0-q8jB8OR~_ z5B^D!X#-sWAo+Gmqqwu_xsV4Ly_X~w1|4rJ$t?6-0aj0 zZz*TF2g6B60;XOhTBScbrhRg1`{b1H$%}?1hGOG!A|l=(U~Gar>LGf3n|(H8yQX=p zZ(R0sFL#RWIKy+2={nVX`v=EcWew|Dj|`=in(#4kX99vR7=pe`v+} ztZZ|FE=Gw0;_i}r|pIopH$;4HkIfA%yk00dYIXNw9eB?h@tZVr| z?FRC1!v398EJ}>^tOj2mOAAd(<@G> zM2@=npEu@`=FU3NM$`a3fyiKU(QP!7W8>gLy9XC#9Z zpr36Ih@lhyz}AqvE$#5^&JVENT)|l;1F`I~?*6PC-=l@)h*`ZqBI}=JlF8v@Qc+m3 zj`9{A63>)s2Fh$Fmg#cw!`)YU8`&4Pflub}(E4wG%rWE6XEtf&GkEa}%X=P$&PaZT zC0U(fUMzr@`SY>l6!N7$M@hme(YaNVp#h*>iX=! zpv?lz2f*RU0ZORfW>x!dNI(eLks9LySTVqj4#-n@vFO+56bk8cpH&TgdvowGO&gZC z%)E6z&>vo2GJ)|oAY3RcrT!er>jl5YXbd0NOyWw`fcCA%VObhP*NBU#U;;5+Z5@)7 z9SBwe-tP$QmrdSEb!uQL1J(#a5O^regz)-1FwojGt(I!mq=V@Y@4wj%+W^zO4Wi(h z-G4+PNQXSD12=fLEO4}`;~;b5^v)fqBMx@}JD}k)yTioX01gJ`kEBFg8KB=h9e=s} zm@idA48m5N*6#2PvGoYK(h%p>e^qzN* zI;Xkf65{v%4e=P)lsv8sR|zq0MEWGEFS1GZ+mANqJyUbhYbC_FykDugy_sXnX)@w9 z^0UnAbQ!`WDcf_4wnfQW@`)eQm_7$s1$%W3{tIe}H4urOyCXwjUmVHb5ZQz}km!D) zMbN}aDMM?~;-wMmehzP8S*&UVg8?DsgD(RNu*el`U2=(RMQA?pz>9ohaictIM?1g| zBYROj7iD9i%82U6@+3K6r*Gl^(fn&P64rn9^3u|9!Xfdw^Qlooq!-o0II=x6FwDc@ z=#z<2K~0d@fso`dmA~rrn}nV*;0Od^K{mbU5)i7-e^X%Yj#ladz1L;jL`ZdoI`?i+;6bZq{d+5j zYDZg1?aeoJ^-q9;w{gmFg)_6XH0~b*_S`q^wtHnL#yU)vrf5%FH+LY#mIPP%zoMfb z-BI{CP&C*1*AZb_Z(*9^8^6!k z-1+m{Dje}k=7e(Bn?32iyf9WJLeI77ohzWVLdW2+WlPN|#Y#Wv11-Q9nyOpMFGciL{}WX$VEYTt0|h-lfc z%s$Kx^?_1V4b2V`8W|$$XYmaZGCqTt8iQC>`+cmcgRRmVHl;nM^gV+yr9ozJ{3aSuc=J=BB_Io@@ z3$N@7aw#PY%i!l{#%wM_Xr)*R6ZVH{&TK)EVyQAI5@U+U@qr9=U=tN~`Jukn|pX>g@(tKY-Zeul12WY4aVcDkN$~2S3R@RE4#-Tn0HEuIi zIn%RqQAZ>)%G6iKbl3DS8s5d`jFcXWp%xffxQQ=~*j{KcMhli2$kB{Hi8dw3@1~92 zCk^m5Pq)F_kUz5q4#ZL+!vvkG-kZKL1@V<%#tC~gkf7D3ML@y@fII4cZB&ePW?n^m(_&-bpq_Y~3IY`ph)^;{CL1J`d5qDu8Q$ zUFFmo68@F)Fa)P?Drv991(Tb@9Oh@%$_YJ(`SndA`sZO6aQb9dSbGP$({cN6OKmhj`pj|-slqcGI7Rm1h=lfg&M&0i8{L)E>= z4l;E1<-uw*4Zf4=E>3AAgcnVnTC{oVqbGbsve@*HV2c^2OD zTI=1{mLMML5@74_knd>Q&LQK_G5#K!%a$np$`+Kc`$!QN3^e`0;7pUy%?fH*cLBK& z^vV_LKf5=24notM?p+2?=t2^1w=KOp2Wi&!-6%*z?_7;XTC9&e%F9|phT?=SJ<>g> zckM~;Jrv7Wa>yBxs~?OcPY!M5o0~Ag7X2bZWDm8yJBBn$!AmVC0^iPeW13W zUJsfjgHy!(WS$jH;B;L#x^>o+n3_t21)r@*Vbi1mg25m{`xdO*J52_r=1oxV5Foju ziHPU;O3R9bE9SQ@9?qcNnlOKoPWzi%T#V|EkDOd>G{hnu_#Q;O4>b$=kp<&&JTiAY z_R65@A_m5Y5`hdad^Fgs$--Ah>JO7dAD_3b4nHE^M}*!Py%T5Xd0Fo+L(4+R4}$q~af9_^Gy6$Sg_>@dS8qH@=8l%V+uI$)-;_UG8HMD|3-|< z$?0y~o++$cbhrGFq<*XMU17AoEQQ@>6YYaAVU%brtOWb3w2Zdnp2XKz03IRi#}{Co3#;GoYCmGmgMFe)P76X}XCpy+j9d_@f|%DO+0;tviaMvrR`5_{mc zO^u{NgPHD{4mFKoeIq7{THt37Vr<+|cc3E`wYj)W?~*8DYAfvs&e&zD|A`@vlXw%s zkymA!(i6w;t-Mcke=Bp&YD+>-<{?$6xN(HrlNZahchG7y!s#(|_9)gsam7QuxlWnn z&!-W2eivBDd9!hys@vs(dqM>XXGnu9C$?Sc6k4-Jk0^avy*?=*k`JPOAIqne z1dvS2@9YmL^VNMYpNMB047Fu)>g$s~bJm~kZ^ra=%O^=t9wkmoCsu>Wq!niyh;W$>;wBv@! z_sjJsILDBf?`>^us5CY2ax!U}Ce_g~H?E7#nlTDdQZ4WtCDFGv%)@xMH-`oZ7#k_| z>-D45Za^=w{pI?0Vn9k6JYUsrPr1`PVkm4dhSX42y33l8Hu|YR4tAx!n!{KNybE9} zb(=9mz>r`MLvSEJfd-#p-9!(jJKf3=>1l#u> z;jG3$M~LhGgh)AzU5n?&eEGmEsN?e?=(b?1-S^s zS(H#tg(uJpWuf^uSELC%fHh;n1fox8%$Q4*9V;ylNov)p!A;x{jjc0Rmiul_{0AwM zb-&5}K{>vzE>pRvsIXF2L0>3KR)?IH5I0Gm>^ZzC}Q(RPEZPV>)&!IVWS4M;y zlqpMASXQ=COj(gxInlF_7wOBShc>?AAFjrwRWmQ_I(Fe3JNN)aT{Ao zfZ*D?x>;zS-@)OIpaw9qL$NFyby>A>ej=DLBNq4n8fE4AfVJ^x!Ef==Z|2Q)?=L!q zL;o53gLlh=*XWDa=!NKS&HTUClPlaX2R*5B zgfX=9qG#CSuFsR9o8*Txi|@=}z)ef{n#aM`iW~Oji!IF?2FZj^lgF7TiQ7{sZK@V1 zW-Iivw222v7l|V%6r(9Mtc@8Rh=A8A4gujx1+d8C$i`_cN;<*0x1 zeEVCZUcuhY@?tsBdcc54G-6zOZ<|cu8OD7Q8NHdGN&G6dvhlX#1@6OBtdQaWyI2q7 z)0do@c%3$zk8?PzSu=+1{e_AY$;qE!{Q1Ejz>KCw*BfatHJ3gm1gM_{bH0MRH?P$a zG8G+NdV)<)Su7SDG8!8f`(twkyWVoO=iJbeX=YwdTRU)25%dYY8Wu*Q#c?2S$FNo; zXIA#Rf`CwO?O_%uG$~aaB{NF2WIzc>qQEDA3df_%%u}( z=ecjygnzhCg61q_n8}tKh-n&Uo$E@h{C636`kqj1gTuo6QZKwp^?I35DmHs{Oc0O7{Lk1n-$hJC7?@ z)zuY}yoUV995v2QRlKR01#kJR%*KV0tNG*CtUVC=^EK+grsX=^kcnwV&V&IaC>SJI zfL0I^^j`pAHJBYjOiuX(7($CRdl-;!f$gzjv0OH7S`*G2A0H2%ba*~w6O+PjJ#vvU z+%5pP+8w;I(6x)rHcgKWgcv6k;B0&o1Is_Y3Y8q?B2?eZi^cxbilj_(j^VEaheiF5eTF^6 zc*YJptXJC2ob2T3G>dT>!IaIWDvm_QdyZuZ2aqz7#ZJPk-gZ=+6(OCWmkN74DYnyp z@wqjpcuem^%@w{{%dZyQ7~KEMTbbvYljrY~-qme}NV=tzgo~eU*0+Ky+P1A$gNRzl z@XeFAZ4<)~WK<(JH2-c@QlMyF+IlR`lVM?45F58P)-yY%wLbGf{D^cXLc8SvwHjt{ z`lSRdQXK!yUbxGBOhFB`v$Jokb?we zDdMo-irc!%p}kfo1zp`BOByVVW3S(4WkY0?yTK;9ZQa4yzlg-h-#JH#z8Cv?$SgLF z<7DSd5c!a39oXm}JBs-y=Gg`@Li)$bzrNiNDbV$rJO2qlxXl)Lyz%WwuA80tEaf#; z=iqequOeddsq^T*B%{@Ze2vi&@wu0>M%=6Sf!BDyZk+AuMrJgzeuH#=`gH5ix%7gy zmHzaobV!>j)?`>sp*0G<_fSox`GYUT%Wc@mO5$lC8yC~hQ5+8m)VXtxvg6qgC3*vA`utMZg|_gFZ~^$b%!;;V-2RIjnc5XKXGwCl0Xwm zciTX3x9g|&>qY?pvu|uQEG#T=Xc($}Hy3wi!{sZIJZ|VA*N?dLw5j*dsJE{%bz)fT z!yEU%KubD@BNFanYhN0^eI8F@bHs{U`!?7twc?_H@PNn;vy;?$ zcFXAT7@=KZlyYTsFAWYp?teMX-82B-s=5i%@=*xkkcPiKYvGTzSo+0(fv-n)y|u&c z@=0HS8`6&Z-((KNt;V}pm9qR&QQuYcO;smJG!urtFV&EbJVZnz_e2-6V*JL`_}jlm zp)cGRsoQ9THPWG>WL&YTKVV}aRA%RS$8)^PevjF?FxIM2NMD`D)zK2DVQ`2R%{idj z&)C2~6>keLjE{(cBFbg($Ql#EUkkBpRwsx9)QtVad>v?y7@C z2KQJMzE=myHw~o~Q8R>K{-nzG`yCs>Dz6taE#2Z6RHi~mZ1{20bIaS$t*wXbcE(1d zF)}wXgu^fK^lOjNTL1O5=A2XmnTG4icyZ)nsyuJw*o94yM@u{zMDr zZgU+R;`UDE!jcy0$;WRoRR#8VI{qY2agLFR{aWNvdo- z=7nl4bl&i{)ZjGK`h`&kS~?xaf?b-9d zVX7nE7JznAs1vHXS`p*E-Z=Y?9MK;#Yphu$DWvZVtAi;zL!9iK(&yIYd=-0RfETAI z!W(3D%)p6BVRIRAtHd-EQpPjfG&G~&jQNlUdvLlLm)nX})+LOMT zF5|rc4VF!V$H#s|{q+a(kJ@+!)h&!D*6TOqlq}kveRaJqW%-D>HVjNh#zF_m!AypY z{MQGKlTMAT*NCN*A^XzjX`DZLgbodruy77fQ-f#OuP6HzwOUfLhtOekhZtSo+Rd7& zo55AK;D)yF3ub?fZsy zbr`Z**NPh3g1)Qo{BU;DyvcH ztP{_`-kepI+Bpeh3}<_90F@*)dOlik=5*&m{|R0D3*1UUIH8cd_V#^-S8#RMa??e= zdN{7rMpEcD8M2m#d7}1nV-oXD!o}ntyP#8dW)MT+KIF+!u&-<|o;C`QEhQ91y1;vS)A#q^t>}1%Em&Avq`pdqaE_ z(W{Y;&z5L0QQWlX$cQ>aZWHiSZb(vXD}}g1ZNS-yEYTcGxm#J{$-OoMj$#sA=B!I#$ET4w@>IWixyri@xp%s>~foaHP

IT8bq)SA30sZHahJJq4L{_M#q^j8*HXbvl zJ>G9jXl?6ss4d%)7pqW#IG)(Pr_V`gRgz^Q)LZITRLSXGpKYLQsU~jU95KDc-W}=X zjbOOEC|3nn*ZLeAI?_rAry%j39@S`bpFo($9cQo8!*8{`^nj#=Qy;9Ja-BU#INFoJ zV~nk1B$1|vdi8pB>+OpT73h$v#V;%`5ap3+%?Q0FQpJ9p9Y4EieAb{1IqN4MoJZCz zXZA>$c)|y(asB0eu@LCl*MhLZCgeGfAC_29a?6Ljg|qO9f){-G%r1+Ja$L>dw0~ih z_*_9dw4o3ax*$OQ?+K))8(@4I>_(Rt*O@|gz{oONg4X9qi)A{XZYmYLZZwqDAc^ub z{YmsCohDThJyq&4nTC|6-5_9x%2!d2M7!xMvQ$^iFa6+Y=6tFwS$-*vYAP=wMl?m; zQC^}3j8}vO?&<)DxSh2zYyyR`0oPRIEWa5hu}x)LvBi})`GE3sQ{NYFs1%2l_@$tr zYwAz{YdC$Ee_@0&BQIEez>-%_aF7}^G&q;8v6rf$HN?K#Traj4f4C&wKRB>0g4WHZ z5r~cb0MTOiBGeEbJHqsA@~bVJrn!~HwQcLD+P-p1!DAwle7Vk98-OhYjQAWmP7KWFn)Zl0*!2&4TD| z`y>{4o*-@xk}yY)y`IT~RVw!Caf)4DrmIqw6}HBZGfwdKmMC#dDAY&E_nrk;_PQ%< zJ+{V8mXwErxN{)KeFC2y0R{4 z+f6g<*d29jn;qMB$F|)a+qQO+9oy*Gww-ir>#RKQd%o|Can{Jsj9~3KYu2o~ueu9Wk17Xy?Ts8a#cOqh+gdlAesM zC60@UQODVFM~j{cD7JJf5CWSW5IgK>4vi!Xq=F-M9DgOH(pjvvcB*fI!v9*j)dY!i zToGp_#kbWnZ<61nPgh8~L#xv+vLz%N3-|343_}VIU~m{nX{2(*)8(HSVvP91O_K6d zM5l6^c=%h=43cx5w8Vic1&N>+0&8@P%6plf2)|>nXOM{ct>(?|WY(zF5@>yPag{t1 ztwChLhdZciQ&EMo*_%F3V_ix4_Zgf%C$cE0mG$%d8&Bii3PZLPrLRlcm&PD7jZ#NB zDh1uUix?-EfElnc^~X10;hvrrb!`m#_Hw}YjUySdm_Uet1jDeX4Gjkx_fsWuCzj0 z?mYHkAuGHL`%lA1H`MhdZ2^>;THlyug2!kohR&*bR#c>szKtXd=7F_$CNZ7OP0?_% zx*wK2dFgUTdJ*{sw(8k8T0@qbw<*#!wYFZiL0YU<_@~&8tW5<0l%n-c!E|4#7vplw zN$ZtWid#T9jl55$w3ubnaHcd@!Ri^v+K__pby0jQ?(solDDE~TotEgp-8h2mA#^`j zRyxkE+>LL3`i}A8x!Nnr-incN{}W)x^dZfFuCT>h_H5&-n!N6FhyJDqFM z6OoL&e&Uy0;xUKe_khC^>yHU-u>8iL?bDj|hi80~(=EB&aFX1FPw8={ ziZ?gcSG&$-Y>8!s>(h8HL$PUNt>s?N-}^;zW@Dbm!!E4p$463#iDc;-N)Iq{P3B{I zl6%%pN;%{~)^X+;>EHn1tPutdix)GE%~_kr#DDOen|*^B2B~h|o6|-5d6*>l{2NWG z(($+oS5eGZjZ0@g$*D8KRqhiBY^%a|a4}8SvtdIU#%4$~JC~t3blnsDp7a`KJXCLE zbU(}X=lDpnrv1mSluqstUp=d^sJ}`x(AV{$W;6EUeTE4& z(ybb7x9yR2<_l##J*X8p)k z?qJkc#w%&|Ej`y`ocP>u9(6n z6RGv9n24nalH_@nP5hA#PvKwe=oJ;T23r#;>KWY%q{ciqgx#4QolWXWh^fIwyk$z!^2;Ywpo^2s6VhHXR{oiX>nP2KrgE*KiYxYnB`^_ z-)@>k<@H=kcdT~2o$>Gbvod5FWyLnArbF8Q4A(7gS@X?zZg`mEdW8UD?E+E919AG& z=)JAU9arU4a11_@ipX>eTB>uIR8ahjA&Tn=FGcvls$c;w##?tpf2cI9>Fg>1SVqd& zA%ViooQwLD89!+(4^9f&zy72Ju zk?GNxo~CyzQ(Z3-LkXU@^j{44&&J9JqTNE#=8hM#WiAHc8-vuA*n5a@pF^ z3*>YC_N1DHeDlN@d((E!zPDS_RFaoi(XRz3v*%KSu@5%zvaFymQXS2}aX3x0D+B+W z5slhMwTiHyux8#m9y{Z#e7mwk?3~dVJGUsjEO7F|)szs_)Zs3vAI>l5Vc9v^eOx+I zD5c3bGY0kn^p2Sb29iGWi0#>tBfd{`&YCK8kQPLEl;_y5yRc-9Bt?hqlNwqZU^`qO zAlM((%_^xLIutB>O#E>m?9muT!&I8y>k6{MM-FynT6xHLm5u(}|bmA$00r}#auMm+m?+j~#D~c*BA4_P>v(rdVt+c_3Du*T}&sBqpY}G&;zzni1RaYHC82d*+4VED}#J zo_Mh?D?D6Ehge=H+#l=p+^IRsBY9GGeT-7#gVe3_)ZJy=3u3xu8#w|Gf%g4)GkLwqG(q{`2Ghz_D>XwQ_4a`BP-G+qMCh zE{-!$(Y1F;3kaU?>=|sRI`JZ`l1}$bGqtr>c@WHbW&+WQ0B%Qs88DGnEb)r9wTf_g@UP`JwTuywDJ=cH09(eJCw0}g_6g|)FTK9M zz&{u>5Ww*B-{EN+!EV>e(>N&jxc`Xo?+N#y?RZJ}w{}_PSg$=%a(ZtW+Lu0Fx2z@2 zGvm8mwAR-#dOwcOS*q*UTOJMb)n$*Q@QZ7*$+SMK*DzL8bJMMP;TIHFJ0TzVyj7E9 zrN7IY;t9b8#LlH?#HpDKondFUnzI-QV;`3z%E&@lxFH!~)7;8M%PHl{X=YBrXVgJ_ z4i4Oz#yi`X7xEetYMhdjGSv^Ba&pO@ zK{p)bVrPDzvVYI=Fgh=~|S5?2)BrZ_U4&pB|E)DR!#6WXT%YFnt{!74mwAkH#a=Bb@i3jC&lXf;&>**y*v3y@8iec zp7GxpEuP!%_(r169`M}TtmkgLUwe7$twYph#z1eM?}L1vao-+Q-}L94wBZKO6~hvf z&$lpFCGRdEu?~Ew3dzy-wX`0EUw9vNJyWNUzp)*Uy%^!S1hTst`lkA_noAEOZ<679 zq`)=3U;d5I2mT^qxLct0^);*U@bcwc*hwWiqYf<~B%54+{@InWe$bv=7a)xB#2+k% z-21qIt>}dk1Y|}AcD>3?+6Y7WjJ!yDeqJ&~7=`Ntm_B9E@08ppj82_-%VdC6#* z@b)+zwv|2rhFo`Vukr$&h;=Np{~S3_-(H9oEE#^VBZo{(FZWMO*b=^EHmvQg-tl#9 z+Uhq%TmfU$<$+EffHwh7D9IJ@cw?y;KT(ArA0dIzAcWd0v~Ye7<@NGOC{G@uRfldH zUi26zSN;)FzXlWXYY;$7rgP4UGh_Dxf)Ka*u#k`g$ZgA;_M5S%;9N1`fB;kGA%iHs zZ-C@b1f+1;oAh*WbX3?-kwtfRDw-n)GzXEL+}n7^oSjglswrUu1RR}iHf-6kaIi^{ zLoRP7w>`a-bndnOi+X$d{HfK}?y7L?@2i-Ax3LgGeDlOnr+G z+?nElYZoAwyZ!CB)kC3Go=jp_Z&&e75B#Es`n`I(0d%`442%wp;J-zk{}qgyoSpR} z4-I)m`K8|_yuV2M{JMhI{;oyg#v4~^J~&D%vqD5!m&rOMMuf`8s56bGDL^Md)@Sy$ z`bYG&CA0q|{U!V4@1hAsm1Qi5B!9vo;lTd8z2-3(F?FHWt*x^+{yH$f@LR`78P<@Q*$*Hh9 zy7A-i(i^ZsO~=SgH!2U0O`Lom8G_`0bA0l9$b9tU8n>%S*8L_xfdw{IsSX*QBrfOQNF;^Zk`brL58E==Z39%#Wffo!+ zh3Z^lDPg?SX}V(6@v=eywv6cvHqd_e+#l0)1$;I!v9U$UCbQ*Bn)ZWS>>fwd#~ht6 zR=I2<>b7IZ9@5?}&)n`~$lg2o|87u|!?_=VOvtIJdrs^f00vQBQ9Gkf=QkDYdgq}s zmFry_!ozAC{-+Iu&xke2lqE`(D~hC z+sVlrZ_gz@UcA;IAnAS2dq47{<^dh}^97IVYrY7s11uepJ*{(L!Bz(Q&$2z^WwS|@ zeOhem(y1B^__f z&6&4jJKNiP8aG@+ilnDw-c=SGUIAs{vF0d7ENA(SyzmzUXOwTd&XSyK9OA^7y)(R5 zcO?H)|6#-mcHMF6?SMY54CC>mV??sI2i=Hpj#%uqh+mDJA9;y!v?__~h2$i;7rpUI zimV(knYi85@t|Txm@=CKlML5eo+9HJz^SQ}cplGYO6Dv&Sy5;w!wYQ|WSw$|@~9{; zq2Nl0G^_M?x8M3XV_@7F3lQe==8qdq zaRX$nP5TWVFc1I$Q@meI___>-uKyB;5+d+kvwzJ)iZY4KdcA+bgbOUS@;KO?Kj2;# z{xcc8j=!Pmb0LWu+H2xdd#^za)F3CV zK}Ol=%dQa!f;}Cj^=0gd`>l%#2#Avl3(+hU+g@RlF45HDl&KeNUhEMi%shVD_&Gm0@V^Qp|jKa z`?xyYUs$^Kq4xyBVZ5U&@Y@jtyW1tRfk6svVo>*HJZA#T7b+F%{f!)=^n>HAjZLC- z&eg%t$laOQ`AcB_dZC))|K6FXt%WE;$pim=cMqv)iyF?2A8{ih4DtNM)!V&_fAzW$ z@?bsIiUPNrwU}iso&Zes!R%-``{C`fE(px+*8F+A$b$p#aJgfKvn``icDQl8cpC2F z|1s}F7zn4NE;cmOUdO`=p;Imx4fg~U4gGQlKeJPxVt)qA#Qn4)>3Q4BTU^%ERy{B< zk|3wHBRl@>dH189m=*8FhLozpMFH0N;r_dWx4T*Fvf`x{Jv@9wZB(&rzO zKD_tmC`xKW>P^+S0SbSHPYOy}k^l~_(gkp@CQ$-19Ye+{dtt6yJ4k%5XZ5jqiUbJ_ z%~Wu4@eW9JO{|JQQ)-}VhL8yPa>C;f`s>&$bk_a~x~ZhoflGhs;)LjaSrG{?T z<=hJH-Zb59jv|)2wzC;wX}=e$&4Tb%Bx7wsa*WObhEZ#OSQYrg=*+LyqjPy;`5r?v z*`0{M7f0qk&+W+n={q(jv&haHTJ}lg(6Sm3V@G7yU#?UNNl+B(>qoe#aO4mXzycl!Y^8IQhvpW5+kMI| zq~DLezGKhxO|pMZoO2braV$1~ne`N|CUig-umMpcM5F;~4m%=nwZ++f5wr{_jkbFR z6)CKwPJewUZ!rc2|CR5@$#!f!9y!+-JfXKgWh?_S>H&4SpW=250A>LE%$3p*Stu$>TPn$>H+|x*LTB=;)Hh*WC}3J>_YV;vQW0nFM)>Gw+y7TS}^MecymUnA2W#x-ZI&LGZ)+MfiS{m*5-wimYrk4?voCSvBxl%R8Le zXd57(8i``wwq?Eo`j|J8B^28mWDE-p=lD}W7GmuAUP zs{&35W1w_#xkt3u+ajzq*)G~zPO~Qr^$iW<6$?2zoQhHUp#5P2N+^r^uT?yWaY{w2RJ^IQ#cI5YWlih#5^Q9ayu?r zM0hVIzT^K>p0S{KFVDESXSrjxsl?2iAHK+1Hm>|&RnhU|XQBCpi|K_?qa5Y5d;Kw- zY#mS7h+eLh))?md%>#7HDyp(0@ziHBQ3|>_1r<~e*Z-QU5fE@+^lN^?Ff-^;Q3e>N za}Y9deHHa{EU@0BsHYRwrCPypuq<}aWJz(WV82i-?EQ_J&N=il%O0ifs!-xW3Z;bFDq zj39GR{PiO1O!od+yH#x8Brbm;3vk*1ZZ*L30R6T9;MhBO?T^WohQ+{ur($y(>+8hb z7a!~eQMGXDLG_a*@ZGl7Kc}Yok&u?l7QhI3p`OJdJv;l?BOoc^62Qsp{B2+!p;bnY8xy@%sD?D7c=dr}thA@+WGq((8Ual=k0QIN+3`E^ZoD(4YzD3fWPw+9xs;_Ivm=XyjLlaV>y zc$#%J)2&QJ&E6YLbPAVWyN=F3uk?mM9b&@3qV?%?XzyDsBE%TO28Er{ADUXLKWs1f3PBP zJ25uCLw1|V5ZMh4_!aY#fNBZ|hX&hyP9frl5Vv3kjutO~-^!}9iv8^4ekxo#2V-tt z8sg6Pumij1dSyi{zSVHY3)ECG3uUr4FUVe#?=nZpfE^-szGUh7a=#5#1h#5}jdR;e z!FXWDNb(*df;^W}mo8J6k7tPh%9a^XB4B3L2^CLq!sqE63?$(gBOo&y^E4GiCK+6@KXsWIqB$MbqN^M3oA*ZMq^R!e7NFq)cRx!xRb zd8r_i&Mplo;emJ$$m;=k(eq-Lm-kH{9{@KZmzK=Sn=kEQ!bR2=uAIkOO~#!a3Tj}1 zb)-@Ps_&C9FyH}_9liHtCpfkzb+*LR%B*ky>H^`-5&x|HZt}VbND2E(d7eSpy|dwKuG?0pJ{$6Q zZpR2KHyO(uj{htoarp-6d@fM>`f&lT8WRWeFhDiqC+LmmRvOf>hV>)eVD)sj-&HDelijJazrk@igAi1btn!()Bf_+|k!?X$ zT9Ug%$J>^6BJeHILLoqr+-kE0vbZqshNCdU z6x&z~V4XR8+>hG$jGvu)L4|?R`vRM5+l`p=@(kYjo)wq3Zp)R*Nc|cPBp(1S+`N#o zFQ^Fv4(wFyqxW4@2TB2`u)BAt^L_dO48Itb3E=Q{y!?jd{KU?ig%Baq-Jj(>7Ky7_ za5%bF*t={@|F0^Fi`}FCdj*{_aZH)i@4i5H@2h1;+or~3Edq&j&GWQP{;{{UikXDyGf9ZkB24I_0oCrc?w|tu4(X?Kcb3? zPN>t6@M*OXjcFaW)R!;JEW7PwR}q&LZ+kXxN1kl@tYSSg9b!T~rUMmYI+m_htnh0- z_!$+g0?e4%-cL^dU`rcu`$POqbbd2nybgX)I{Y}KNee07<#zu!+|9RMzEt%zw^eC8 zC~G-bgvsZ3kjTds&j_@(zQ2DaT_DbdS1iHJe-tDcM0N2=v5}#l@=9BCVDjqXH|N)Z zlC+#@UA)zDH~@-@KVkKl1`ip{+g8ty4(cErC8d~Eqo1$+L-gXM<14Z;wyciB+yB5i z>xog;DfVk5Xiej{&>_9mTV+;f6~X4f)FE>_^k!vGG>sTJwY+)(5R#%rZ5oT@FqA(c zZ;Ep%7%rjxZvHEvw~U5br~OAD;XyNB0SqK%!~pfE00w-mHxF02z+iA6KzJEa5+H}@ z)3VkW&q@pp50e8e0%Cb(^^jQ&admYHno;SZS@Tlmgnu^x_@WULGp|n}2v$Ib31q-P ztM<5)0U%OfAS3brmz?=U|Br&2IS29cl17?(Q*H*3+ymEXAoT}+cTu$pA>t97MR6Ih zz%qx1LQAb!F|U)uLg`baP|;Er>W*N{EsBA>=AB=V*UQOikF2g%03eo`SruT`{lH}{ zXPpMk%?*o^ikfZHYJ6hiud4Vf;0AZO?a>|tkTq7)-+<^-+dwCX_!%4fuu^RZ;HFEp z7GoH=97tPV0SP!VNFc^_qOl0j5}SvU?1d#&+ic-9nBLlo$43j<9iGjgXY`_r^PuM; zD=4MAg;D>eF?p)aq8jY4Y39wx3)`<0caX$y*h{lZ+q|L_`%P@P_fS9`<1M|ntT%YW zz=Rm_m1EV3PmsvwheS%vf|0$!geJszedM|6Vs&&zf< z)EAYEEs z22LtMM5x?pbHL&(1-pL;wMjaF6u4T+LBXh$o0 zeXa@sX#ijhP$d#UeWc=CdbgJx6$Z$>{S0nAvbHGku{FGL>gFmm_f9)W} zPM7ir!}b27O3IrWJ+9!uiOg0p(Www4_7%txtGY%K2E4V6QPrz=BU=8-feWtsMuI@` zm9FwX>4gY2EzH(~8xH>472oUW+mPwo!!OGfKb;DZGKHMv zL(~15s1!T&GbuiPg~(47qPLa@(CWAi*#w3p(|!>UfMyzSTUzFoQn+I7TLkL^~1VL$IWnELncf zZZXjv%b;EK6XQ;J)5DiMt8jY zBX{M7Y!PohjgE4pC~#MIRaRfWsfHy_0#^45?4L*}6u?#UC!=a525 zg-Uu}H;6d!fcN2?BTO;pFFOwzzHx7#?zHWERLb!Q;m&}r%DRKBLbD!~%bHR*U@0Jw zGm?}cnsvJA^X$&@ovK0{N)b@Fjj`PD<-Qya`O`b?fPSc~$_Wn^M6e^^5Hg<<96KA- zm-FY$WY4AXhfl1j4Mf?P{&EV#`fWi~av^Mx;RFIl=zD!T1gq;dOBl>KtE&DhDj!J4 z`nqx1qs1*H#RJjvCi9rrNJiAiT{U_NrhYdKfvKhFMnNb2Jqu!E9N z-OpgeK|-v1_B=iyu*LPma4q{f`He|82**WL76jSGf{#*Bn$;>X!{Gu{eXgTTzWnVu%xvzW*SxB z&W!~y&|tFTevEIMVS(o&z9ClB|BNTj44F5K|DOHD(AM~v!?m>^(D@0t{@fk18Vqb* zZ0HN+F&LDMoVq`IGN!qFR*#S6SP#~R0txWzZLaWXdaPl0DwOXQ@-6+`#^u``$$R^a znfc%{>9t4hXVdZb^5|@d-{mX8L;1p*)|2}E0ARyKGWV`jw_QafrjiS5PEh3vL1t6F~;%~DG*`7tcmmdT@Z5CjtEGhPx zRGmn=A9k=G5d1U7-3DAgG9C`e%Oq4-zNMVo+s@{l)%uAbD)F!RW@aJquc@={%!i{@|aWx?$|A{TGH9p%K;5iGy@0EX;=Eq zdmPinWu_XWkAaWSkqFcv|1bMwj8+i(Jpxtbh@#Sz-*@O}DY}dBP=Mx8pNG;Qk%0m9 z5fJIB>?ekObo%k-=fTY9(7F6ZIc8EdH$v+^KUVG>=)RBL?7plb&wg;OElK`zyYMXw zO!tI;in6%AdxxrPGOkN&ME^&sa9yQZ8~~)s)XIwM+A<&@{b5K8cR6tRvB&usQ+M@= zE3kb86|~j(^vHfW(2Ys6t5n{UXu2Tjv)|M*fO+VaqCZTcq~k<$s@PxY^B}%<{X)kr zyjXDJ`F896AI37m%;Ie{PS5w`O=K}dx1ZO!53#^?N!rlx`lT!>$>CoUe=RARj!AHJ zA7$#>F5N_860q|>X1n*&gjCObG@ZF(QY)LLoHUP*C%d81(fu4n7rKgN>`4gRNqZ`3 zf>*J+FdAJ~jfC|b5_MWR}geV{w$YsK$6fG{q%zSG4!Y=M-8lNAg zh6rR=EHC%XH8anJS}~)ta^UPUG-IRD#*@+$Ync`MQ}pK@F^LN$Bgb;-cTqB8VY13t z6CzOUj5+Debd%vFP&^9qYJzzbKgLEA6O-I-6Uw=##-A_dr*LQmHwfFE8ufHBO{aT2 zDNGX&kuhltoDVtU#+{0@%G11(T|9`jhX^bcl6p&mt`UCj<%ExTqSUq=cs+Xo3mIaA zdjk4zbw_i?-lGQuEw)|p--Y18_pfjn6aGRP!4ewL5?T=u<4AG14W$Ih(4X{EzY%jD zqoo6JuhYsbU;&R+CdK?t)2YY+j9A8`BDdhjTdjxmjTo_aK%IUIv?WO7kp56>5|H86!vG?>{2St@cDzTjmVZ~y z+YzpNpp5me08SA^B1K0%-r+p@%wN(>h)%u2zE=396XU9UT#_YtHar z*IRRy(zAyHOnyaI*TWBK))PR%Xl;v*fpx^;w(sB-7j3`wEs>H&dI}pdx)dU%+GbNV zOw_uu5E*=s$rzR5Vn5ywTvd+8lw9O%hLjIwM8Yw!nEi&Dh&hR=Ox;oZQL+TOPDgz6 zk`=Cwg}g51&ZT`FYwBpe2n`ieNlk)t7FUrqCXoOIWmPcmlN*PanTbb?rzF+h z#w4;LF@NW$q>$Bc6={x7i@rlA3BeZ7pPb;Z3I$`GT`;09ZlO^eD0FQdpoPYJO?Agj z#iEKRXdUv_h@q^Tm}k|tPH*;1lZ`ng`YKGZ@TzW7X3-}g^RWe-XsObVhV+tg_USl^2KI3=R^v zx#Os*JbpG;a!}99C9}2WAQyG6@%`TsKQF9}1v`25i?$L7wk)ORyyp^LbPzq&uUeYn-7MTod>IzvF(08 z6xLOioW6v|`GZ*4cNIqCXU(U|rYxtbHvC$32W_a{PZ6nOWT@OrIwOL{@?Fw&L0)9F zUcsC#Nxz)w7x`@NRA1&I%EkUvDA+sbFXU*h2- zx(<0Z&Y9)n7(ckFCy}~DZnG#r|Ev3mw*jLq+Xqe@8Em>5AW+ilwgaKSoXXT@Q-lxj z2?~lPdu>tujB}}%kh#n=Sn9J1!VO2{*q}u8E9@o7dbwY724+n1ZA;-A9rwCWaGWH& zz1ZfIj!K%fN(mNV@J!A$B~%b7Y%EkF_SXQq5Mnl1C2Fgy^bZ-41HYOnouj@``r)-W zGNYJU46){KV$D?IuIZlNDZ+jf9|TgkB2hO57+zE<2*~5!WX`B!w@}6HU_c-F6Ea2q z2#^pI>HDBj_9}4-Tk0m%R>*K=!VF_q$jIbLeN&`Tyef{nG+9=qK%7a@qd3@WHrsj{ z>M58ZmnXJax^Fjk*X2r(DG|z12IVW7E0a4Z_BX4wDwL$dgeBz6NP{FLQRwKbZ^8`5gEi@sl7hPcu%p1# zKIJP`gb(Q#<>wln8;%IzFX!D4byX{vNTMdq4fe7@>B{~ol`M%&9~V%;ez5^2GL$#B zs|0SuHerqAESGbtVw)p(khW&TsUJMpx3euo*a#95}HB;Kk$`K{ugfS_h&@DKRj+mP>0YHx7=w?O! zgr~0R_k|bl>kRe~~ zVMXmciC)xb7x@*1IdtJU&;1#Bpn9RhklhnvtyoytKN>iC$Qb5>Sy`)_9jQ)wljMww zy0vV2rgX&g>hP@on7dD*!oJ;6wt2aOkiyzSzbaDQd>NfVXP&au5CM+~h{0{a%Z|tj z(jgKO`nBT`6KlXM%fp2Ev?>}O5Wp(BH5PGciW6eP+nwKa6kgS-#_X9IZ)4#Y+Pfw{ z4wvUwT4Kdi?xzD&Kw4lGFYF~WShw);dX|$~(u4aW6l}8fmiqw84c;X9$VFK(w8|UP9)c&7di^>P+P6)vsfnoD$)6ipZea z7qC6brudVBB_EGWs03m{v=9;nHecov21))uM^}A53t*8VYG4 z37D*5^kGS68XxAm$a~!_E3tIZOE<~seM-`R5aKTJby=;J`T>Im^}uG9CLp#X+1MY3D;-q$BCSRs9m18OA|oI$LDDTjrH+HF(3?m6A;hv@z@D?( zzjulRwl}0%fx05Lr|6!7>}+Qu?NUR07b;dAle(67Pk<-{`9~001v#3@qZu2E}F}13KN;R~Do<|^N-2^1Gi9igs0)>*AqcAgunkj4I^e^hXF||MixeX}y z5HXDYFe$arsogsHqPa=)Vy){tIpc%MokvV@V&s&3AQK3O>j)qYV4Ct&v@0&04^t`J zi5*VNVNJHhTa6;#I~|7TI)&~rO@92gJW(8vgK3963S=sw{IVnFLmG0u?NxVBVLxVI zzMb?QEm|)2&V`n!tJeFWUrGF4=qV)rVb1U-1d{TX`-e=ZoKY2nZ9tUpi2bt**BLqC zQunS`Kn`x|>?BuBQ^bpZ*pp3E#CUF?O9_v5ZcHVXxW_ixz{k}$Zu~jK^n3+9>jn-U z*_IQ$=*SUZGz{e$bm8GZSDIYIqe%NgdFY~7IXC`qYMgCBws))q3}(7INOJakRTI^x zl&dmuz*=TatZwZU3Ta0U%R%>BV&++?4d$BnB+gR(!!K-TP@k-OiK=YPjH+gawZF_AwRq=Byjmtq^Mkbd6FKVildl4U)kU1~1u6NK zicMGTtY+wqRw{`$Zxz{Kgl@GhGYze@7j4|BQ}H=!)YuIV!4GeeLh;wVo^~?zb_0rS zNP(%UXmmO$x+h{1uZsM5jj5$1t@!8#jOqXrs;}zl8l~^c&X@2HX5_@xKnq+)72o^f zV+dBX<1a2a{7N}YTiDb3HKQIbKtR|Nw=hh3Kn`lULyr@bYAy&}_9cNCQ__q%(Llk> zF2L(PFU7ArEaEq2LBB;mkORyS&?(W?u&YUUg%gJa>nFdi0bYr&6eWNHJ}p>rvr@>V z0mC98^0tgBIu}W+&{&7Cn{6ftY{pSWGwR4ecHpwFlQ)hZqAy3WD8KxhYA0Jtb+A6v zVnM4ZjRmw^#KK~rght$UH&T2M7P-@|Si!8%GB>F<5jv|T8Rt;6BV&yKdcmb_m2*9Ww#VAe#3uyAOV64B2;4$h6kwq(*N6FTiI8e* z`+sD58jvRYhcBq_O#71i!Kcf72tU}q-Xs<`ZMgA4gQ|tLhys77^pl_@M1lmr zcuZ=l1a2boH#87N)K4^cNuc*lPNkx#Q<`$N2PowR1Uzz3y7ir@;)o>+($S^qtw!UA zx6BUVYBZUQY6?=VHJyixm4?a1aMzQ>sHpCCI**CJh4!uw`Ny->Iu6G(m&BunB^mNl zsWbnWb|?K|E)C6$rT3BCVP~)sP*8c>YgVf-N~v$=KiCa>@{eBjQ4)tyiTlL$rU|Lp zH}8!9PHv(D^~$clEqFKYDt9%@NY!+O#_Dw@ST2%~X!c60x5rr1uo?-A#MUi4Hs?1w zN;X>>g)APD^nRq#Tg7NVM^PN-v0lV@vxX8sN(X7Z#d}1PQjQZS?4lJV?itMb8s`93 zW~o4t)nsE)7Rj#$gA%=%UD;4WM0)l{jmlYG-TODNaAHYEl$)!(z`@HsF@C$Hl! zO6aO|81;QAdHck_e&8!nK~t=8=Xjmu_w4q1SjL1#!Tes}ek4=6CvXcNu^qOPnY{@U z*i;VWum;~~gsBe57sXP_krMvt+$+pjC->@^tV6XR>?0)_H7uDz*w&G_OI zS<^|Z4^w-_H6=LT;$H@?oif__2Fu|U-;6^g4!Wjm7vk@!K_QxhS@TLcmXzFCMQNMm z^fxVOh<6I54UET4$Yu&RAgt0N`%uN|-5CLs_w^Dxc?UoFw9w+O&4hqiP!rul;n$wp ze5eU7Z%qun1p3D`f*|I689cQv;udP=k{jkUN>lno`4T$*GC6u|TRL+LpY0rRfON$T zm`$E(ez1-N0Kr57e3UFtHr7YHwpCd~m@#keBVeV#n?R-U3=~)?qp~s6FM0$Q^Rwh2D!i>AcS!d(<+*M7-`YyhDd&KB6a9F53s(0Y1djEZG8iIoa*d z{AC3rrMt~kCA1nf+gBkH6cch~g#`+tZOWqK(J>W~EeGFu*;FH8|E%Re0NnUCB%6}F znyuY)ExXkRcrWI@g^laqVW6eI1=1#T=spxk ztv3u!AtnK;b^8efZe%1rQ(5tqJ0xX{QrWRXvWC*-OjT)ZG88B5ZEh)613De?NQoNJ z@kBUNS3T1OWCK!3Seab1<(4T%d*Ue#(bR_5b&E9CQxSFwoMt~b$fXfeU{Dn5(2%X~ zrXt1Hq>;6et?&I86OdeXlb6tc+;D&X;h{}$<&}7X<9}VhCzDEgRnV3?A*V0H9vqQS0bgP ztR)=cMg!WrDVinC2X|J0jB#1M$ND&wTpLq5881mClu{ON!-|sWa(IN$D*Q38*rtxU z{&%lR(?Sn+#OVE5wTiw|BYO;oAk%_T0(it-QNk7o+=K&kB|Y}&$bq3D?Pp&CddBOo zAKoU?uOi{jK4gP$#+&vbZy;LlUKdI)0Vs@JmUp(F&Sy>Nh33xoG3JdWkDcZI7B;?g zv8!&h&Xa+8Y*QWs0vqHjtxRHBMgz*Ljs9B0K(elIL(2T!Jp7x|zf$JpCH8I3KD~Y3 zNcP)NmzuE@nLE4Jg&P7s>j&7_MLbLmRpu3ftSu;NA*#0SA9M+t$%-_c-H5$8~&V z_Y5waKu!MF_|(E&{}z9Wf-tV0ZqF4tcdfsAn)G)O6Ga4|6qmzn|^o zdzg0K=^lvveKH^;pTm5p2^^jv$GGzd2bR-?sQbNn)+diC4=MGg|A)1=jH)^cx4kVw zO1eY3LApVt1f;u_ZloJjq`N`7ySp~h-Q6YKY&!4aoOACu_q_Mx>jwui+ynO7E1vcI z=WouqM_p#2TMYwQTXPqe-)g!GJ|p`gS!3UCj21L1^m!s~o1eB)oq;mi;HI(`(fbpt zG=kc!MCANOqp2EEGF|?ohO4(LqRDO#q2KxkI2M8AV9)wiP)BYl7a?aiEZZtODjWlsz?Crao zT3CHsnpdeBo>&nI_>_^}*hpvcr%#euPT+yz=| zI63aE-?ZR;U(N4@vQg{)ZGLdzB59rtUx}tehxJf^9d;YtRjw}WW9oI|j|QY|`dI#$ zDLWEi+k~EGgsRNN-~cM}IjXa_mj)yc00j&UCIY}2fiM;j2){d6f^&d8SzMwA*r*03 zl14{I19Bv5!VHh7MnPE_{%_~+V928|u*Wrb+!{Cs|7y$l7UH*C`FQqp&FpbCthGym zD_S;_rCJ1Fv4rIFN=prk%oNU~l=e>;2x69(L%2@GJqdXc*PHuodkZ4lhj&O#L|?(%(I{xSuD;& z(t?|Ek)3kdOVRLcQh#(a?ZnwX%_4KoeTBY-;+Zwx8OD8ogKox|ZJV&9!6<{a3zls> z7R-!&2v@o1^@S__gu7EhfY5Kp9!?}bsb+}RuZ)H!vNU9vZt=ZBo1EM|-hS!2Ox3Pb zwN2rU1~w}Sy02qcN zcuBkg72DnWBbujHX;;HTo+gC4O7gTTSdGu2YJn9+aeBFMTw!Mfm)h4Cv;9DwcB^#I zV$feGl^2XWZ{+S>zCZ-x4gh>=EWk}2of6y-jz$?-j=LGTe8sc2Yhr(ag?k?RSrPM? zr`}CKtx!;#YI%d!g$C}Hri;%DORT~lC!SuR_ENn``t z;kuk~;_xRCVMHu9dfuE=QoWT-hhwgT{hoBX^qPDFNYYuTOYRelF1`nm9L2@mzu?>5 zKL_GvlNIyLWaMcx`$l%-!5u6h1XNZX9T^FQ6n=DK;yGL_lV*HI=pzmPVc+&(B9oMK zFffUx=#G9P{25;S6k@WtmY$yeAQ_ZZ(+N4`5rox zI}04*z2N2D`c#8>RWsv^r%XyWh3&5$%|RyUY3(_)d3kqmhKesB`WRh1m66vY*i?WP#{@^=@UY zGf>In;erLS=>FsOmKP)ja`^fADOj+ZPMROxtmz~R+Q+HsdPYaB>(^Q>beg0c=RhrS zfUCck_Yb{?E@r?2Zx!UFW##8be0=}B5L+MipQ3&I!=7_SGN;UeVEf)i=t)7!#1W*o zE#IwT04@EgtlQ0)fU}aeC6LrV%eaul$%#iOo;NEr%D|5wE)(6KkxV>1N?e3zaxvWd zTmaB6{Fj|dnAq6sP7MtYmq|N^hjPh!R#wPYOHUtQl#GsMA-*68Bgu52w^v=j5LUH;$qe-X7_GIpZ5VpHh1$f*|v2(Is{VAFzQN6;Ie8DePy7WAB_ z#Be;<{UWIDWiP?q7$#o9(^zaZXM5t2|8UV}3^=Iz?Xa+n_-L3kLp60i915y#5o9E| zMUK&PSkjoKx2a2oLVnkYhuaOd)En2{Ws;`uu1Hu2Qx**c&n%6n&iDuZa|sXpO{wc{ z7SQA!v0IxD!mfs^mhNwuy@6#hOxeu9?nH_QfZYehd})u_UXXa5(~5L-aCfIHdM(IQ zSF;;=db@15yxZB`&B`y2sGZ(IbUR`V1{UZ^ zef5S%u3AuSpy2crHC$j!qQ;S@X2#3^@9c-m*J=NT*yd&=V-?#jhEz zJd;!pIvF3`zfXT`!n1w$AefrDl>f?}IhN0oG~{u7#OLyV2-?X><>xh%z^(_4>X zQ@!pZ9lp1Izkt^h(9}O4X}RsMfZ6j={ev-3qq>60z`ZaPs#_*eHem|_oyz|==&RvN zBZar&064P$0y9B0eQ!s&V4!$b8>g|sM6UERnG;w`!h6mE2uvoU9Lm{)jr;X&A=p5? zo<}NeCU$cUxOc=`Lv_np)!A>r@Q*wlNF;no+{gjT6$w^ky0+!~Y#-0SFW7d`^0dY! zlFjafK1}fR&9{{U?63E^|Me_4gha@<=G53+3ljW^rLM+yF)Sc{ub8n!Vm-Bx_b$K zC-eV0yD-xuLE*ocpb05cF@$I8Oe_PkkXX(1jCEL@*gF#~9H2)N1v z^0HFD%Z@JZtfrP-Nkyekx~%!<1W%hq*`aV01&~I53<>hM@7sRCf8QJZ%q-2y_XJ|( zU7roSrnPe0858kb&i3cVBcKh~NMO zXAw|)kIU=z(3e5_Mn~bF`M>a<0br2-tnjT1%}dq;P#Vb0$*rIL;^}GCT^wq86Fs7n zHD*|Hl}Q!fCC({LpXW5^0qM8MQPXxL$Qufm4|lbQk%i#**-50-r$(X7<4)! z+qb>rDlx-YPZsme1uuyyeS!G#9#1THb34bfBsT=~PE8A+UdB~gxL~rTYcv2n|na!h2P~RClD;Z0Qym< zgW2{B5xqSAtB2LQfddJ{W9&V| zGy(^%_1|)-z`1zrBvbYM&SsP}}pads< zA+~R<_!pow29g$RjGPAeOvV3`;!LwWkVAbV_;4T%l+N!2@84j> z*{POVN@OUn+BNO&9T^=%ULPzu|H#Og-6mbY)hVqtB4E=F=`C!p^QBk=Sz>29D-mv(*MVB_XQ7_b5um343dqZnH-emJ6Og2VCZeRdd zdR+WeuiijWGD5%tE?Bn&mS}NSLW87l?t{VHih5JG>7sOu?i3~Ew{8-%cNMf6Q5JEIdt5OWG(9pQXz8~XEp}amK|$2 z!0u;AlvlOT6DXbuQq~Ch9e#g(|M#SqCejqs`>z}gyFefL>J=L}iA+u3q^S0sob-km zc%MR8(F0GW+Bz05mKJ7f9Whp#_E8XIr~onx5Y1?Sw%L9Olmf?(T@B+x!kRuISM-#x zO{9UGP}j-h161*9bh*XD@%Z@Ua-qQL1|{wfy~$vfylH-MQ&{(9nxbZdz*t*9v;7Ln z>43II?&kP~vGu%$tbK`>7XgO^3gOjBpBe^qDa1ZApS{)lh}GiKJwqNIkhPJy-LRL3 zLcNc#;eO7Bd{V$1BRB_wd$44qDApWgzb0$?7o@-E^x*>DFL~R#o#rL!x!r$y^^}!+ z3zSmch>#9DU3{6M0lXc{jw8s=scJ5X&CM0h9HVh+GN9A-?b&$w)nhR+AMUR;iQGL0 zZtjR=*$f8!n|zSh0_^)SX}iCU8YJ}_RE4t{SLGz@aTDr4G;%QLE&B}_Z^zCo zztFETppfiO6k5*JzVJHh!+ADf0vAV{V^3hN#3Gv_*s&pZ&vNXkN%%iVN*p$Q?oT5I z$7}m3OYNsCzs+p-k~Cy#G4Y?TRXJhz_ba{9HQid*ey&c|v6^y^gnnqJEeJPXoV zIH4I8Z<=`>0!9u@wwh?SMJ3I=5P#8GT#7BKIWTPOR79U&^iYjAE)g%gZolUI(y$pO zblekI=4kO@2ZVv}q;33+xq63}$PHKkbn^R*V*`{Xx5`|eRsI2t7Lqg3r=A$qgY1eM z6Lq@MTkbNg=`E%g{B`Em9-NoNHpmcAopDo3aoo%xRPWK*cgx7iq9ehAJ*i&1 zwDZqDaf9OU54gx7a&HxWevAOHt191v4j1nE=O{qqa3CW)g1kWd7TxfX;~ost|f&jr+Ki>mxA3&0p%hfF3RA5g2Z}4&)O#6w> z?gPTGw=X~-`KenAJLhDT?FKKWwYG$ciWr&WEv`;&tt7fe4-(Es{oFchn|kND*Y(Rh zJ+HSc{N6#=V9pa>AKJ{Ga(Rn*E(p8`L2i!cC=pi^w;FJ!Et>aRRu|ap{#wy2rR`zL zA;qMj5HOd$J}UW6kJuJ1jNyK58<-BZw4j*N*RW49mA?F0bX2^3b0=#Os$_wA&@3>) z%=huXr>LO^({XZ6LX%bm|ArqmBz1SY0nD+Z0!1cDy~+*CAB99Rh7>+su>jmr3=BKt zb|#-g0h({;iT(VZEsI{{D@z?UZx{oUpVM0aXU^BJ-CFGI6RZ{p366N*zI%$(vS|SN z$`cwRqnu>^rM|19#@8=$6x)=%J;Fex*At$$o=URp+kxf|pI=g7yf8fkN|c~iS&<+H z4+NVm*fa&k>v=}EwUPSyiPxX{6)6oL`wLw&-Mu3O>(bC}9E>XE+V=$S$HU_r=cg_2 zkwhWcQa2(L>RZ}1%ehKy(6!9{_3L+6>>%dZNcDd>&bS(1hrXT_;<+rD!okUVvFBYK zJ>8u)WH$8tsDO8$QCYL}V;&^F)!cITk4P4tZu+7G!y>RC3s4>pZ2pSVZPLHTzSqpLTxx*9Cn4#180 z=B-IN??r%$rfvQ!xWDm)(0F?|{pgn>(sI_8acTbvls}a>Qs-FH1sIV+8&F@(3}gG7 z&4fuY5B@Xkw9po5(=dz3A-L0vT=P)mV!Ao-1S}E5d2(^^K_}cWbOPSox(LGZ|HuyW z?7S>Vy6N$TgoB+1j^Et>~ZghD4dfbiQW-UsUwkg~kPck3fi^aQP$4AyJ z1G*FtZbW4H-}$V=KPn(g>+SXH9b`AAB}lB16=S}N`7=g1sjfhSsop;T?@tbht7pnp zg`N-8NpF0FrGkQKKVXf{&2=p~F9`#b+pCo%MOGR#2I$oosPRMBFWh!_)MX7sh;;QB zAXx@@3$>P?3Y5Rnu`8%)`FxTu2X-L~byn;9Sv|H*0te0da5Xim_mCIjSwF$g2mU7d zHL9ej`yc)jek4wjjd$>(2fHX}QJPy=)bI7v(=f2Ja2jWM-mvZw?6ICDAt0b{m#P+3 zO>3#BNLpEO{CZ!WnMLH&_G3<4RLcUI?49<1h{j&NR?opN!MH5rIcIIL^|#2=?|rBn8XU zVa3G8j!#cVUGV4vgO2fj4>qP+L1UWLe`&mWChXiS2J_{Zo7pB2f#va12FS=p`=h2( zCwI4jqQ=a!GP0?Zgn!bl=3t9e*&ZGQ4>oRmky?eMo_?fREznmm*kqO0ye?^Qn0D;f z=3Za%vD2Zf>4s&OA~JX+y&to=YS`31k?;(;^;cJ_L~AiWRgazCD|#6i`4{&wUkJ^5 zO2sbg0^hn?H&`~&EYbb{!69b+HO+2m0r6M9bK1YhOyA>U0aLH~%XuA;-gNT+M~2jn zgXZ8C*_Yf`WRWym`fL`eCE3l*3}dzC7FZeIakIvH!K^RVt$9^cLw7v80%F||5M`bX zcIL-L-=m7=O@WbZ?~f&-iA@~A0!5&dloac{s)9nQ<6wD3#v?&!(sM|ZYYf8L%=Tqq zUpOiP^F7R0U?>?w(H;r!<&7&{Uj-u#l5bp6`d*^PB~ z@(H&H;fjgLILAY}In%^gZS5N+Td$dyZC`1+{^9CFj8qB}GRy~?)j$p9LHmVCq(l|8 z#n1#@_mG$&*K}YUUO)JNy&pQD_sAY8NQjbGyh|Zjzy@3%;LRO#Gc21+Q1YUmwp*WG zH%$Ps@KUUBEh+s9B_N@tqjP2)rTapk!$(}3E4D8X<1Btu;UT$^~1=k9%i9&zH zf{3Bk+Xw9Lq1}J0fF^dkiKl8Ecxzsp?U!ve;o0kx{nJm|cwZVokEU8mYZU5=Wh`?k z3I9K0jXXsu(1i<>$>3k%!c!wK-<`q6?rY2Ut7+ma0#qqjZg*<`QTp5=n&^@wNxsI=Y>Zf_{=1Y;iipHJGU6QUEw zpVTx;vm1`!Fq1Z~5`4onGqUGQGqg>>UdoE?Fyb72h8`>G=IO*lYyG#Fli|-uoNQip zMZ=HFu=Y;Xm9K;5w6USu$H-N#f~^rFr_w3G1>rZdUdhyVg1po-sU0t=1(sQ;vV=J` zm^)0%$%4M!KMH4S#NpH>o7=1;%-Bg~DSW>;LO6P~W}KRyJ$n

HL*8Q)MTgll|+M z3hN$8JC9G!#iy^mGZN8ecvx=0D8XoYCx-VABK{7IcIqsCh@%E$&N^u0)6wU(yxA0q zJSX7VO?<8nr~1Q0A(k7GbGNDI<=31e2-HpASe$Bmo=zy1Y+5;1hI#{WQ8qxkYV($W zmcd3WivvtA!>y0^R~gOfB4P!wdhZ)oyMQMDO|*ho3&#}$LSkYhiC-%o&H$ngY~=^a zXA6{LZ6wbS+%UlV>wY^sZ^!G6Y*+B`!U|`mXu9yw|ofwLEZ?LAb1C0-}}X>M9JY7bz>bgh;CeQ#bSGPH2ivLa(YIgfI0WG z)z{Hu?mWls;hsjNhECd0@iv{6f=ys3P!ZG9&HQiXq)Yg|NdZW?%<@Tbkr`a-yu#9n zQu_Z^W~xA!FcT?5{^Pwn*1ovh=$U&Oc@mv?~- zw7PeC$LgPw$M+eOV~<6PVsX;-24l=*Ch?_Ce!o7y#x5Pm3BWXB*x5P*Huk@v`@BFI zTl+k8_Ifx1;htY+k1}c?fkrB!F&2oYVj>~1)WZdXRng?&3wfHF;?l)1SrbxBJ5;2Q zVLIm>g2}Mvq2CClUNNbPR{j~=dHMLYpT&z&De^}FzxLS{BLqaNN$#eXGNw@s`C(F`q_3fZU{q+G|*zB z_f;-5W0>+LG+hL5#}8|UobB!O-?`DuU{?+*(;_OdLfiF^KtJUZk^~R5b@{Jjc6c8f z`5Qm#Q8BDyO~@~NC7v#Ga`K-b0(CWc;3;=swyUckER1n-Dq*g=LKHg(o9FcSbH;o# zO((7Qq{L^W%2LCs15QZ!dTDGUZUnC1W)Vo zEfe##2~%HOAUjOfex1T0CuKoTcuzNE_2n?Bly4Jyp`_u+p)zgfz&po!rvKjST`+r> zG66P(n`4h8vu*NIY=#pgiLB~P;=6BBj-&`Wg`YD&_in5KJBRmv9nhuZVv1lz%{j%r z%5c|e7oMa_SxSHFQUBv{`CGUJi66ZT^vMzwD_eZBY88|e3|I(kM;4v;%V2Z zm`^kJH6;lCNdo;>MQ1pCE85qd-tEUEgNbq(qw-qbIOdL|@5}Z*SkPMIIl5u3i(27+ zjC3z2jZkfNl3bj69Ai{tm!^N+tD*svCrE4B#uLuT)IY?hlJI-mumna9GivFoFLSbM zNFOz?5%%80aj_#;<;+Aud~1Dck>Zc~uf+mmdKe?QSn3k?mgurg4I?sIwc;4p7zeLi z*X-S2mD@vFX)%iE5mZh&J;t?MC8sNY5-0~%KcnS3pY?tIa;Z? zPVi=j5K3lb79H`xP#GJcsM>FRE0A<^Ypl(dNGbM2B1C4YrGCt8tDiZEQg}S;m)pw? zw6P68z$S7d{J^P=CUi%LXs>#wl_k;8?7>4HRQR7G`}(Dyp3v_yt}9-))A$ zli&u1QLJ@Z62%Q*(&pt(DjwdX26)S=9O3Z<2<#X;ci}r}l!;`qu#GVWgQ=>ybhBpH00qWp(Ee)o7;VjyQ;K-qq{hG+d8j~T2$Gq_Nvur3S9f& zv(<(2wSS^+R5cEmKG;?M*1kyzrs0TYjER|0rqvo|FA$G9%O0i@l}x--yr&_KZzQSO zk_rtb3a&7a{PgKdcBJBX=Q!o3?CNIPr_PXwLH4_DD`HtJX&rNY44ep4#>IY`Zd4w{(ylk2 zk&v~&V6XQXJ4J<)bD6E|=6~L`zw-Y$lqPtL+?~_7l@f@JSIy)s*sd_b2?O~9G?*a3 z`T28(h*cuxBGUxJSjrk!zGo4p8UhNEfI{F;YsWOng$- zq@C-J7`KS3^pm7Llp9W3Jo=aQuXa#d_Oh}{dxU>Rs3M-UbMqE6xhO|DH$PI1sc$cd z+5aN)yzA5;Eb@2(OAw%G3Sb$&n~HGFU#@ zJl8MHvwOOdlK*dy$&E-J2%9wICcKy6e72o(b_~Nn|1#h_wJi z^0so(aB~Eoc_WQ?C1Yhf0Zi-imARqquqtiMY0ecHz$BfV3q0@$FB}Lo)Q6+29^!Wh zt)?3qV9Xq8OSe=chglILy8Vy}4Mj{j@I7VsdcgFYT1s_FF5B9%* z)K1Ah69z_IQ*NrdM#6e7k3Ib$2Sc+2Hg@lR09R+}$@}t=|6|x01lprFb;TlZZtgWAZpPTKZvc1@1i`~nOv zf&IpJ%zzBx9$|Q;iQi=-5>HJJZ{U1Fh)4_$&T#?Ym*_lj7{jR9`FBmk0RlzYzVzhW zuZ?Ba=r26>2w#tz);QKm7bv+ad-W!zv zUL(vXHj=GBKewPd#afOEOMzm0Angl5^Z~V;07sMkh`&@5o$GE_!vjeTy3R)#s$dz*|& z(YXT$Tx9}%m?`EOmACR$0!_r`3$$Z&RiTrvBlNwSx*7i*MTW7#8U|822XRhVX5i*WytgUNIU$zusbwKF&*$ZRou9!m%?dH!>Z&(@VHD3SS=y@a% zvHxJVm-0AMpRrXGqeWN4N%^{tt+z=oEyME))!JlUZ7cu7#@@NzL!DNxPV#)M0W~7d zpvgtyW_0NU2ojLZ%PK9UvcUsV4JdPS@5=o}TG5u!WhXYV+p1Tw>Ol6L%58V*^&A`j z{pbuWJ$;I@4hP9n&hX;d8@9WRP6N+P1W)4T-%~>)OuL17^4%!PKJkbVDYY(IxBYzU%=*k^hwv- zj|K*n5Mdmu`cA;+UmEw+;pO)|WjJCvkDbV6h?m#pzfviPMjryV^~T0=PH@w=TQ}tMYIQSQ z1PaqbqP(|sWL(}C>#B>^TzT_+iWf+30#r&KpKLYao&zwlHoo-BzGxNtTX2a2E*UD} z%(w_+%U<~L7V=YZeZ(E9Eq6Cl!CK%^@_>6O%(e(|PZ_(Hs+$BQ0(opHDvmOl%=j4L z-0-RBl`G+XwEa1C%KENIWHwSTYx2=tCX7bdy#rp?Dg8Y0@uX4kn~k@xY4chYwdF1M zG24I3j#IvgIIop;)JtnfTcm0r8kwQ2jox$!WaT|St<2t+t?u04!;-F)Y0>XnmWvsZ znviyLhY$5#{YknHNguxlq9RJ{dY$_4@cd4zDGiCU@y64d zShVYfH}?N`wZO57=vr>}+Nnj-BHE67?`WfHjZHI&6m`(7(fgqfM(p2hlmE_AqyL1^ zoj}`RPeX>w+ZA(2BwSKy-Y_qZiA_`;EXvtrVx5co4!cTC-RR;i;{nXjwpG&VI^|7> zhHj-_lNNEe^>soC@xQnkMxjCK*#(;9GyoJblj>ERaWi(!F9H8jNI$~1#2Cj=$LirqwN z^tkZP39URG z`EV2NlBnKY60IIOJAwZjFtf4Q26vPN`W)&E-O+LnuacI+77o|e{2{Vm;@(maH*4uF z%X&ZY{K`NDp#c2ns}D#>_18C5BhU7bvpcv+oJ+DMCTe@v!2QwnK9CWUV!qj}Beqzh ziq1${&3Pm{Y|VYeH9}5sX~5(T<@>*0+dXq=>n2$*McTfL-A`up_j&WZi&2Ud9DQ|z z{|+9b`XdO-Xr)gzE0gon5>_Ol`Vz?l{-wr*ydS5n-AuO9h?5+`p%~b`L|-V#Co@WX zOP1ChtSw~&!pI*3az(8nwXC-kWsDT_y(B~&fuwJg%o3e{n>WWKC*^w8eWv3|Ry>HX z>(8-g%d%iKupS@d+r7OZbBf8#{#4%AFE>3B0^5%*5oF^?V+ z3cbub&%p74Z8_TSO5e?Zry#7uqIONlT10%Bv)6~bBmaEDjjp35ZQb!-x?IkWVc-Bl z08w8&_#!5(sE9hVJB&UgDV?5~Br6&?95c0J&1VRER+}EIF2BH9l;w3ZKmN`~PRh)s z%+#SU=_JhgmdSd(d~m)VjVac$n)h!9_IUJX+)Vqw*%c>Y&YE9V+47{)_ME zud+Hfxf3Jgj`$DPGCR2yA`=tETO_wYq1K6as4)LUXJa<>c78j9Sk~+345X~ zFwkuUC8eQ(GDtUwep;wI7L7BCW7hh_fWPseL-MkGb9bADjxIZ=Au>xM9NI_i&SvSh zm*|~Wn;VoPjlJQ};Ih4>^8##-geY(WakXpsgzMm!G5q?sufl*Dq~L6EwJwRv$Z$M| zn>8Lf0=32*#DLnmF5XCb0a(y>Z4wT0L*!{XrCVKnqoVZx{K2>Devx|4;?d~8l`Bpd z_6mGwcpu+OAri`vNO`6rJAm1s6?AAREKVCi)0M)2M$cKF|4kCQY z;?A`%sOBMfHnbEQB%=uLG^g;Z@5!Mc<7phtu0Ox{x;7hMAU>owC{HrTla{E$Hzr_G zDwpyunw9(-^C_cOiBQ1UH&XM%o&ja-byV=AQ3btFZ1`jD7X6#F3<^49RS_ckdn9nD?tWvALdZY((5$6*97IuuWiNKa)~NI`AF*t)Qv-Yhh!p1vsnETa>+8wN&G3@$?J{ z>F$U*bRv+A5598t>?B|DPPkAjHQEd^x_n+0bh$#D*U1pn++I*Z#g?Od-hi@8@_$Nx7#aGV((6vwWT~HUkq(1#BIjJoS%;u;o2CsyFsej3R3W(+I@FcIDSQEZQBPf`jyZ_+d24hbylW^}*|Z-pD;su& z8=LcZwnv1le6X9B>Ou+3t-H+20g3^mq^35YX1xsmH<-DlJ#n~R=pinNOA&l?L(cMB zSCEl*%bFBWU&;wyFqF1sC_jKHA!=_=F5u~@&VUUItDStfC!QBwe>k1=($w0zbL~4w zi}cA#{{d37+9N-Qr44W5Q{V?GYG|}gt2v<}z1i6plAyrvB00f8$bqT zTgZvk;VZmeT3RNIShaO?Y^4}t0px(yP4G70(KAga;-gU!Sff`@sP3DKZ!a(hktyDq z(+w_qIP$c*wWNJd&Dg76UHlrbk=IhJ&d$|+$q}0XkG$=T(Wz;qA~Ul~QQEA}2vl?N zdUI{fu8d$!`%Nw?swQET%}8()f<_!GKmV^KW05!`1cY@AcL_2DuZM9}h}Vj7P*Bhh zm(Ml|3Zy`~msw)Pa!6!?E+7S90!vlIsVSA;zeqK;v;xGlkluv@=S(0x`FrSOP>}#q zMPx5tui7Cig7rMW5ik@dNL4f?^&U07un;{OXhl>8o-?hCtJc2^5^XvluR~o6ii~jV(R}l^IgyKwjJhaj=gCRAMhOwku z=tfGv)TKfs;VCQi|ME&o)nqKnsg%cI36cYj&?_N5UriJE#Fm{;rJ*Wr5m z+e<6wqmJz|Ru(UVnVG+xsxb|q=7YWrn(a1DWH%(mQU}K% zbN(jLHmTFQl>P!G6UNPqErR?HI66C|2uvIlrsZ|d3)IVL{fQEjK#0zibNAHoZ0zrG zL&as0X40#V!ijH3zCJ>gv@QCQwohH)VST`9~4xiF3uFYQ`j?@-yNs0&FYVE5)0h-cu{L>@G>T6Rh=K`LuoXetPlnFsuxJDv;FLU3*Y0t-V>P`^CwmU#`P=-tr?JtUiX!cgVrM?kn@g!$nk*9ZS;V>urdfa9AKN(9z+l=zAvKJdX zQ*ti7B5Oh7)(|U>p-Y4~OwN-gd$^s`o+k*$F4E%6cVsKyJ?|bw$m|XU5lg1FhO0nI zs*>gLW6d;`QF+$gjJAp+Id;n};&@eGM}*eW$Ar~d01$}O<$H!mnpk~ zhK8`Ty+Jo35y7-xTkHM)20&D?J#wBqhVFsG=37Ow@H1{5VeAZ!*Q8EJ-rl2neQDR;le+sXD-T z9P;^t!&g(OF-7w?{yyiAr8v$_N$oJc%B5unr%OXIHH>SEKOd5pZ+H!sqSGSkPv`d& zo~9O%Nk#% zA)}%K6O6<7rDZpLX8)#*d?hz8?_F@$VA}oI70|18=(AMWZL$JB=jYcCST_zUB$m$= zIk+K%bP~|W{s!7vzKEJH>#tIqT)by`I`tJG9uvsLns{})JwmtSma6n1N3v}3o>H|$ zyBk1_esh-H##LvB{;h3oJ`&HGCC%y=Rda)W$ZG3Xa3^jp&o>g&wO=6{RSQ7fU0=_39_OWK{W1=%P|<7{-ykhaji3pVn=!V^9^c z5Bq$7=L7xqCvwT}t2)%=8qh(9w6jsq{%BHp#(HB~U+Fy>jS0K9SFz9*gAlJ}pQqyB z#w0bnk@h0f3boTzD14K)M15m(C;?r(Tn{*B6&#|7Q?j??{M>iGr>*YnyeyHC8r#@6 zTv?SUE^Ah>P*Qi5=75ZS@b`9RBDX87pKc!~px3CaptD)JPX5fXy8Bj<3xP3 zTvx8Sp`gmhC}Y{U?{s?yN5f3NSqZ#VK(v@kGiYyu=slkmlE2$mN-7${78cU&&KEK$ zM7M-LYU0a40a)pFfdC8V4?0>rUX54-@n_6W+qRDfJ>JQCU``!pH#Olz&xtN%`o5rD zIGVfXxb$#(0m`_Rt3@%ewlQuWDJ0_yy;oY2odD6^ z6CrYciQJmQ%q}r*O+sZotI$6?b;F@tMj~0HuvhQUo$~yn+2a4uYH0o{=w+9cfrk~r zBke&Y(VG4m(E1Mb-Ek}n?z#Dtk`->KpECSO#RfG9aUtlU>~e6v7zIc$c{qPET^b?r zhrnbv3xPzEHq${*5>m7M(UT8P=PQqip?Zy}Nu0WA|BJb|jLNF*8ns1{mTnNFyStTc zgp2O(?nXhnyFt1^x8^Ce{$c{-86S=#&(l`t7J&2ygLpcqY9a6`nHtoGp>EaC`X!oYV%}d=`u4 z^TZ()cgi_q{ zPz#~i`uqMyoHUc&R|(xjJdT~{eX7XTd;j47a&H^!+m=kCBv~Ff!BqQI@8FACa}x$Q8l#$|fAQ~`sqKEv0AH`5TeV}xIWa-fJa z_E;e_?U&^rD>hIGk-Zie_Yk4@n8kwc%yzmVE-IUe5^7#DX_Pm;a=ufoC>|ZTzJH=v z*A%m7H4o`EU)8E~k=8Y6? z@1X!8+&;@OriBsgLQ)Kl`OMYm`Ga7%m=palp^t@g;wC1qWs>MA36UX+x?@3Qb0&Yx zgnrjNQLADUBs}1r!&Ek#3hdA67Jh>W7qPOGFZC#Uc;8s3?y(p*(ls@Gbory;MO8aB z{BsM@?*Mkskk-bKVwGwEmXo_BeU4w@2}!kG|YpVYtEXD+^%qeCqQ;dq%aH3yvwHTT*ptcp=72g?I$pAJS#>m`ZK zg>X6gP76z>1SZ|OPjPX%4titqx#v)e<*G+3&afP_yOQ)Aov~?O6WX)SeRiFBIe(?{ zEiJfr6nT4qg*`!5JRwaw-ExzW^W5()`|0Sop3{)^M{nYoBze#;)43UJsW|S-UY3^+ zpYis4{KleNdm{b5M-y@?xm_SgYIEmsk-rdr?yPQCo4<609GZ6S z$b}iw_u=UJje}J0I>-cZLD4S}g;rQKyBBsJ70z5n6X+}ZSCm3adgXf$sn)ZWwzZKZ zPU^CIw70&lhg~E7T!$x1LE@DP)}4Y_SsAZRP`Q&iZE!(Eks+3hW{Q)2Jme_-K)>eY{#gW^meI^>6CR8c!Z_tol)5%xp1M+$c z-WJoL%LJQ4iDH`REN0D^8JwC#J$-*+e|eC6q51s&-9$$7V+0=GlGr@cYQVxz+==Pm z-)jDja~Uu)wUPU-!kOX(clpc5EePZb!na~K_4wLW>M|agbww~IXS38GRq6^YXYtFC z^Iw?BHoWKf9iimqA%I0^Rn3)@o%|jIo6S9c>H zWs=cP?n-oPO_#QiQN62U$kl6mySgxlmRc#1o3r1v+`e+YfHf~}Ft-VN{|=0Zmt7PA zXAk4CJ(Hn`W9apbdY_FxFr3!OHBn#Zz9S)dMNpP>8g+&nEZ$nr3IECHNYL}XXGTNj z3pd4ex5Hl_DyY>!0V8o(5$~E>;#xTcyWr#{Y`)~x8Cel6hCaG6ltcvdLLaCkC7Lwu2iE5<_3QYfYCriOuqZFGaK8#*O(zkbphO9=fIG;q*(M-UA{f@?kwYJ{SqM*>42Byv# zTIA3H-yU{%!oU7PcC-^1`@>spD>fzd{h{L4GwI(`Auu>2Ag9}1$#r(oPj}Ng?k7WC z*uH}wA-1r|+tvO??fC{Vmx*?>2>Q1BEiED5<{tQs4^9e*oM)*bD7#$qW=0SlneN0x zJYLg6JfPlO>4uIKKm45a2hNu%gE_6Hyfwk7r~@iYL<<}A7oEq;U_60)9rBP)nkA2t zRZApiW1sChU0eG+fZ@*jzNx9mX-mDsMS;g=Us9hjoL`E=gpF#258CQ)Qv<1n=ZA&E zmlw0?pecj}npFaQ1!HvB+rUmg@Hd#ogE1bpd!a;!# zeJv)Vp;)781yLd-Tp3k27qw#h*HbZW2tFY|aSJ907%i^H^Ot#%Nlvo+yJc908Goyv zpe%sQfVYK8$fESW?)~R?Lfb1pi|XNN0IE}RKSj%e+5FpoQi}JS_w5y@_U9gEE^#gH zLl=iBCwU}Anrq=4F6p1Q_K0o|Yy7rtjh}Dm!U|RLl@OGx9uL^7talAZbhEIFiKG#g z=UUJ$ZFM+od=NXDz+sX1{HIbUUc9Ysgfa&Wwq*oz z8E&@%GlQgL-2&ah$Bs|)cPJJ%$cjAu%daFrVrOm%^RvEcNUyNB_oV}E8BUG$i3$D5 ztkY3>c9*WuVX(yR;om8@B^h^oaZ&i&T*60l)K8DKf~5pD+8xz#x2^lsnwrsf#zNx3 zDx!Z73g1YPVsX@){e4w23Z*~a%+*}EMfd#2Xfq3^q`h=9!0jaOe@XVHk@NZCqYD?s zzewF@WLmqnIL=71+FQV5iZw?H(1mtGfc|ILWH1E~6I1c;%`PFm6Kqu8#R^}y6N87I z{v;n4(wqBJqcyD&HfkiaxzLqI;qPIRRrO9E9F@OJHq?~^^5uPyp_PDHu&WU#rlLxF zOrlJs{z@3BwhxqcyYCp0+qB1s-0JSG2hrPAzLAsmp46AKh2kOoy=>ylVCE92L28__ z+xq?Yh=*lfx%CeBXaWuyQax7)M)DWbLP{xCP0LE84YitFQBfKALSh;sj@geksTe&w z9zKdKcLD748uhz=`k%(!e4|@i`4UxG?F2zXujuAtNsM&UwEv$O^KEI)Bna(o^e&*yCFm7MJ$-1zm@m<}4)#*AxC~Pr+SZGl)Z{*V06NMM zQw*4%^I_b#MSK=E7HOBRQ2qTsL41AP?K^i!CrsgYZM=R3vnj==L_n&cYWwey!)GE_ zc9g3>zk`PpTZg*G-(TEixkreM^Y_H!WGOJfX0LRcML!U9O-|C(Uri3Qn*EqM+s=O4 zTy>m6Cc4d-*Y$H6vXQ&I)?K~fdv2VY(<8BPvP6LMGwYvm?tc;*ND4N{Q(#~aF{rpq zTe37J=r2vm@RE~r&g(?kMtzZPW3yMb!hrV2qe4fVTw6+v7hFHyQh$<1zHIBID$3pp zh#KI2`^bSM1H168Bq5#HeEssc!G7RMQ{BOZM{E;E&`)6=o(sFx{YjVk0gMRr79NiI z8Qo;gml_j?e@228oG#5Iy zfm0yx8ijkD5qlXT`ugchKhXMUDBK_50V^7nj@qb%TM5~h5-D^-gt1hEdug>Kr8>zr zDAE)>a`>c?S_s4dyreG#?dHW(cu$sBCmxrqt}|ZY?H*;>%D0`e4)~rat+d!S1_Q~* zU-$J@ymp_5`-76~=}Ctmb$W3?Lx4<5tPuPX$2{CVZG^j{;41QO~fwf8A_*@&|h3eWsp#gN1~}g`==Uy_sOV! zf81npJAmv|?niak>eokQmbJbyHn6iUMw^6eKUyf=ajK7@=VeUP$Uo!#fppe{OIc}} zUK|^J1Zl9iM0J3)LJsQp_rJEJ)j!Iwmc8@|9wb)CcLtGG;36)k+{|IyVRcn1wl6&K z@bN+HC%Uqd$gui4!|9hmd($u5=lD1~J_UNHec>7XEBH>_PlM*d*(vK}yV3YWL{ghn zK5BpnLk|@_xqEfsy}__@``|@mK)rkn{V(cEShHqzWu-2q{$lfxhB$4QqZgcOA->G@ zoV7kirt$EZx+uLqjt;9@kCP?f#C~J_$_1pHL4IF9uIaL6tC!iAH$Ez88Gj;_#|@h8 z3%OKE1TUl3y8c~jS18>Gv(MPO%2-sBzCsP3tCL29kJ zAd(d^e!P9R>Vq0gCa}2Q;REY_m#G7!VCxs|9)CaI0UrxEoS*!GbbdE&+;H`Bzs{+` zh&Oo|3VS@4+&I1J7o|@vs%SuhBH%9c>J_8!||^&ep$}GZ^iR7InLWzk>Kl(Js&K z993+NSK2zVPPaL&K*myTUkuEnJ=Y!j8 z%nH(YBM(Ac3Yg`#Q638}SP1mS*HniUlMGPDC&(~6@W8S~ zF<~N{Oxfw?JeOq_2DKTzpt?)l@%CYfae9h(N?vf6k)_0rWJ0T!wG54F>^)_wE}_TJ z;qo}ODX{)gqjH$S8pVOG*Nv8HPoAXP%_4l0^f5xeg94WfH3AJzoT~mhK=J2i7b%RS*6&aGoGEw*q_=-lZL2WR zD7`)M2^=329G58a>pxlDTi64N_Qfh%b)m25E3e z68Z>2+3=hZ7dIs%H{t=oz4_c7l85%jmYIYS1-PN7Kua<)*AUatAa>w>D3>9R^Gu|v zmIZ>qr{m6FG(jQ9h=xAI)cK{6+VO`ledZs}2pO(@jn9C5|4-XAe0-4aym#H_1W(0d zExFU+WId2xrzQogI}xBNH4$q@Sxr$fOeaqs~(my2( z^&khz6hY;Cw`Xb_Bd1IEH+B;pEkHiD_Cxm*4C|?$66#}=pWCL`+^}Z=20E$R4dTgUL{~H|Vjt;mVtj5XqKna#^q3NpGsx)SO|)uvw3TQbdx*5-D7su{U{16f~EKHz#)@O4d}D zH4O#jtUSwjF66Vmv(}JiBc~-*qwf2Ru_+!)j~jV2Z?=6>>ak$`TR7yXHH+io zWt%5d4c`p=SS!I2H))6*wP$$i}EH8I0A z`Wy=~`N9e4BiwQ1XyJp_>N?=y|03fM@i*egk=cZ%uAps4UZpOF4uFVG!|LlA*lWGU z1uqYN!N#O%4O!N%U);h4_W5O{p= zmA#RRX6|Ls#q-e8XN5(4-iG5aeyy($G-nSR=1BO#_1m=-3ilsWCV%U*V>3+kV)^by zqbAtW{7XRkZ=B2wSPStaMUyC^nFx^`7WWeAb=y#jru)j4^QQj+fc9@5 z`towvIQFB%g4vb~ZLWm$K}^3Exih+C%XJ51YNd?bzVnG#T)w-frI0RVebtX)?fhO= z`DWu)k0r^avIC~Yqm->!Hh<@nFs72nrXeb@WhHh1gV&#Turx1e&D+ z(f3or`i@%iA-2`VGap$6s(Uf-Si}+(WmRYJ%!D#2%aVrGajBS=ZB1IFb;UIu)hGl4 znEaJ0p^UP#DfXs)%}pU5Bov^6>?4~$6C;QQyuk{e9Q`bmffDJ87HV-Ug9>Nr|5!~X zYH~r+J_bU&F|ONQga@7voo#FThG#PQwZ|@ZOn2)%84y|7mgg7t zMU5Kh@7}Vm(P8}al;iWXArB_cd+_q2w|>U1dX!v?!~LU;n6q1>XYTv}{RCANd3kvY z=pD?h0!Mi@i#AAI0{AFv`EeezT8&tf)Sz2l;J9kGzCb8fr4#HV_Ivl99(x0n zW%T~R1@uZnN|wmzah=`j2asotk}v8ptwo1}er7*AI+Fg4Ujg`3TG}29{+nLIQ%r9S zhwNWKGW#MkQwJ3GXr`sBx4Lpz%~uu{7SgKlE=v@drqk!`vHh&yH`4WbkTcfUnjFZ= z2YC4gmHcVAnIF#)$22;q&wz>}XQ}fuU-z$lKe5^)nzIQ1T#6iOZe13d{y1mOR310gDjYTXP!8JWDFB#)|U!ibrn>DZi8~CNpVD3&hcOM)EL3 z;LsGr3FWk7a51L9Yz;B{ny4}M>o-0JrV#z1>oAokjF~p--0n$&P1AB>l50CYXdYnk zbOyZk566>=+re8D%JYf1ZpAwp*bd((7Le5F;+MUBskv2EJzplF#9+M7%4mO>K4zrw&aMMxkpvR6ZAS}}ghk-qDG3_r^+WtV$Y(|S7hmcZ#O zUcxVI(mc1O#y@GRKf-Jy=tAu;)6*??v_SQ1;D%coR)Z*MXAG@6&mTT-qvW&pKv~U~ z{mRAnV4_3Z8s7j66J~f{H<%^4R_x!LZPouR!)crX1ptYOn>@ZnjVr#%>6|MuJ6F<| z2a5xfc~tNH_e!NB#EphH0V`%@A98s)?e62C_fxc^T%zNNfn2Ivf1>uLlF$9VNUON2 zDzCOSocQsC>=^`sQ~G+8N5?=jSUqaYT6&8#OgHq6QkPq=&Ro#67GB~*S4LK=&Qs&l z&GDnI6&YoKtoB2=sNsUmmd4@TOl?t!J7t!&L!m``W1@f1%ag`d5Rdfxyl0Ob%)N{= zu|!BKEjMEIZB)}wEHd)b$dBD=Q7n?Ss1{G`UoJS|M{O7ZvuTiVW7f5cTW0)7dcB4( zWphBUAB#ANH8=EG&$cDzn4JX{&YJw1@i*13aZnafAsgp^fk2kTb#DDHf%&H-eB5jYueYS%}BtSU3-)>hDdRbfsJb|=%PU$#b* z-8UmvHaQIqFrnA4YC*|HeX?FqpP?e*Dl3=?!8L&cZin;61tvBx*!hBoh87rzoR*GH z!^D(VS{gSux8*QCe`+FA_^{;pKoTJ?;F-yIAtEwtCVOg<76JE?r=2N2%K2k>?vD`v z5Sl!)(-E_Tg(!K$qr8)?yg`jz)>wz(UZrJ7CJJqafZ3GtcEV7KnFWFjyPIG(O(V+~ zdf1PfZ4ZRuU5bPiWYYqgZE}Pl)_s`T{lKY**H~v#eOFjER6|?&ftxehl8cuxwYS5? zd4_Hsj-?*7F5N>;m{Lr5+uRxTvg`QKT*;6YWRI!Y>4dvj>Ju;CdZwbwv(;tek+(@~ zjq0*C*)wrzTC`qAG<`pnhU(Oja>FPnw~q!4PsCJ5iYTe342O;j%8yIkl@k-fN{6Cq zrgj-0iJP4c@tjWebV=4P$1Srh>95xg)oH^VRn$N0!^DuozeVpMVS*KJt>X;#w4#wg zunJ_RXwu(WV%w^%eTw39w^hA84GgmPSmN0h94hX_DcXkqV1!d2*+;Lt!b`^q2MtOb zb|?foLZZhd1gDn>55xz`5g>DMFfmN!HJ}1o5VVSLZH+W%7Y85oZid8%q-7Qxe5gQ{+VtVpCNM|pwF5;eW^ z^V#e5nHD(wtB;ssGiHp}n8-}*JHb{%&L$I+lC~C9RaA2J*sLvVb8~W#rQ+0E^53M7 zK3_UW(x%VY#T=ML)I{l0J@k02ux^k7goH=PUVN$cS-1fCkS`cvGJ_0nHKVq}t?7ko#9l{x&t>@-0(Qs5fB8pV(bTDK{EWsBzin z43i1lJ=)93>4=gb^59khE;u80e8^o5y&1nGc)P`oY`2aJnnWrun}}R3xHZN zL4zV$dThDH%&Mw`4aDFcT%@3LVp)xbKeZ%!Uekl$zY>(qhD_?ePyQwqZYGQF_b!cS zoo=%@k!>3Du4Ju~HE2pHf$H#us*J>>FKw6@+Grf1qau$p4&H@HB5&%A<;C>Av$(5I zy`baL4_hierZNGs*pYz2G03k}7|OGeEaB`@F{%*UApznr_dNJp!E7fs96xpWy&_0Q z2yuPxO>Xea5-!yq4VGR(h`Lg?9qq4%gvwm%ycKb8_wIX-L05>JaiT)9T(S(Z6?G0S zzM@is)SuncO{v8ma%mc`gSq?h-ta)4vxr!e`*soU)6pjuzK6(w_JTBy=qEJZ09`nU zzXloYz|MKgHE8h|I<$n0;$yPQ|LD*skhb)$i9LmFJOz4S{2@xw59R1PkNAUty9lHB zLwoI9r=p#a?hS{v^ zM?0$g@qU3*5RUXEoA_=I8@}n*8)24&Rd>nXLfiA&3H~6U8c52n!Q3kO-Y7CK_vNcR ze2F)%mt&919Z7LY*efUXp@^k152#SAM6xHaLo-XD*hqgct`A_fv_r#-_OmS!_Xn`r z4XF8)(lmE0J8!g|Mm^^$+GP!jzQ`wQDI6M<@^^$<51NT|Tr!$;#~O)puP(`Hbt;5z5p1|@HdJ@UDeLeKN$$U6_Qv;B_|W3W=KG82HsV_5LNqQ?H1WxnP@2#+GV}KxWh~DTP>; zs$i&Kn|qkvsRRz<1g{{`IY;^8V~Z_R3xDSa5Qi5Q&Ye{4=l6O|#b1jt85^Bv)cz$G zP1f^-2UVLl<04A&qdSEQ1!`#2`WxPpV2Kmx%!nH=yc4&LH!Zj)SE!MJl(v8Q;Us)^ zTrl`NUiPAx{K|i)MDWnw#!t?>KsHDVxG`uL4(D5#P zcIa37(bqy=frHF6A!)gfLn{imnSfAFKWel2=}VQ)g{3!VELu`hSE71kD00t=4=WXi zDIfDG>|FKQke`n+K)XLE9!%N;C|fQ82tn&UebJQZgM`hs8^ zRxi}GqXALdM3+tD3jg6DLO<26=o|?N8HQhx+Dl{SPvw#dNl-B^O2X`MO2SbIOY&h# zyAMs*d08ln!m&yzL-E-o>DD}w=Tv2NBn6^%$^??M{)q|dMPg;5kWfy^*$!V!t)ftnd2b_2+D&T` zoL~VF7mb%@PYhE}9D~5AFLs08@(|ZA5YsHi`fSX6OhaYqFZdD(N@yd{(_hHf_6aAJ z5MD^nGfXW(cj2IdRCmtCP|ZymA|ww@=+~oxCL%3+y~w*1`4zVd$8I*+>d6SjBBKu< z;1Llt%^7RHhDWX=HvbJ4{|lYj^y;B0;MGZS>F;+d6X&B34PQ@#;3c+E;R*?);+Ul= zRTC?X%*O3F>idWuGgbdA4!6oD= zpQ}(OB#lgVm)Ue9rD%sLrA3RRGt60+G0ei;j1)>n6#S>lsYEg1u2fohm%94QGK z1KX)(&3aW==g3_NPjFy>mHrITJ6^1>1d5=Dq)$<`Mj9jX2iLQEA z?mCx^En&f!=P;E3E#hUDv%?TuT=nYV)x@E~-MF>qE3cq2MU!d+E?ky9=W_beg8FZf z_yJk!?ji5V1<&;yuZ7$u22(oCrh1-Kc(Dyx7mDsCp#7ytq?lJHgQUzz*+qI(p&7U&-Pxe<^EYF?vw#nipIx} zqn{^h)0Q0j`Fuo@;h{B2hgsX9nDW+sH*I=P!UYe&@bGh{Nb@nT=gwIU7%&@5?v_+z zPi(2nJH@`uCHq2VM3XZ_Ok}z+AIP<1II~*Dd#`7-%WKRNL>`JJ23;F1KLs(TEu5_m zG0F=Dllrui^z`Fv|1&W-$W6?5zcGaw;@Ktiuw-m28~^v;*Rfl-x@W%YhXC%d>z%JV z0^?glk6y}}-V$|7b)i7}M1^8$1hJc52FX9sLUqI*d)o=4Xq}iBwM!#tzcC+-;Vc&$ zN*4li$C0|EQ?q_5JjBZsQnJ3yl@!D>QW}gm^fr(X5UCGY@)&~HvYJss&LLGSSZ^$I z1*v?H3nElhJyq+X!rT){C{609Hs=(>4VCI*`H=K@hiGbLlk7z`cc6HT)Z6RK$;%J~ zQw={VX~#|9I4Zr5!&px`Md}p`6m5K0u*o83c$q5KSW!o!A)!Q*yzKv*Kh}t~gRyAN z^aVV4X(v!MlA6o&6}=3Gr~pG%&@)+`b5`mG1~{69ifPS+HB%LO9kJe!*Pii_X z{-o`))cher{Qgus-57-5F`Oxb9>Y#b#PTVD$J?zUeO&q)g3KP#4W}A>4}ONUEc{MMgq1 z;4Bkp-pdu&dO}ZwC6yR)`CfV?m?8%?C7@a(7*^1U+?!*VOChBuQbgK|Yw^K|=(feaa}B^NN=Jvq5k6MUSm!L5%OgFheaLJNd|g2KX9xFjLZ7y@bU~Br=vd&heqrb! zOA=<)%o0+6cODX~PD09XJ*U{a6m;Pf{NU>NB@{n{vc?>?upQLTmoqA3kwUrhSJx%9 z=>!dM(9<7o?PzG$t`$VFDFQR{L-KwmQ-~!fZ3zzgu;!)5SzW*t95_nJ)C^Mwl4umP z)nsHaR#7KoD`WOtm|Q?LA8uRI4Ha^kh&}MjCJ3peNPdJE57AQm$%q`xSNOSWOj=2q z%E1yZ02?nhq#miqu8<=uCq5)KjQw+_kDdmyFvLh#pe3I;jMj{47{{t77Bf^CuOkSH zXH0XWA?;hac|J*bO0h0%=D8rq!(cwhT9c6BCXLpWNKaMty2f}vE@FbQ5Ga~)`EqTX z;of)MYdVXcY!|-QA}8NkEMw0$qXp*z;P7txCeB6x?Z3MoVQ1=XGPw4XK#1$0XwaZ! zS))I-TU^U)?nH0qD+T45=^%c93P&0KMKqw@MSg^BcGm)@JK=Y($bA7ba>vT92jU-L zYIDYkCFsvDKD})Hd}>Hm8T+l!HKK*A+k>L%kL1eq;15z7nwtE!ff~cGsOyegS4*Le z#E=k4?%?=~KfNDy9H*-32l}c&z0DL!W`wKMYnlT8L`;8(czgbXV{Ti*xxx0I0iVe@ z(l=s@`J$vIGs6q2Gg78Qp`4&sJrWC9bKdDM7L`e({tn;5cNxX18Lwnjnv}3pjH^qy zgd~1=CDzQ)Z`z&;D(s5pcVfp)2F77Nl^Y`%*9dz{H_}KA^5*aL5C8D^!oWj!E6w7q z&ssyvLa5&WR}hcB%0{C|+fgBdpj=a);zzsx0(#oNs9nzrgF1zY@bAmRNh$Q#Fl?g@ zj!{is9Q6e~eD9ut$`6g>Y*s#-1dqo@w>R1vs(eh zQ+j|PX9G4{VW@@uUCW2FOVD9BSkH54jG=GdoB1Ebg`C{MX2%Q(UsprR>~MVT6lh0v z7ov0#%O zr%@`{%9Bo-AKX#ORn~T%+MTl5L*G}o?Wp$5h>&58nGw=<0FZnS|y${={l{(q$$Gb8G zi&_LUot|&|g$L@cwn2C>T@Dv%n#ssHXZ72era&#n{ke2`ggEFzcpIX|(T(`$C6 zl+BFs^LrHI^xfqJc7(CAN07kY;a~0>)q9-!V$#|I+SWSH%*q`ve`T9J(td}Zs3J-g zQWEm9`rt4nLjxQArEr5H6B1OYjIISt^5aQ$ihj=Z^%b0_ zC2$wSljrwpQVmMBSf5DC*E6LM<>tUC>V33gqt=`%u7`gKg_`{;f3fo6uee#;SSTVq zv=gBlcdxnno!LlSu2O{@Dx4BK)`;2s_ha^Y18Q!*@szJlA#4gyaXG*4;CX|Uc9WK9 ze^T+9-(31kGs@d6SH}k;Zq<6uo=VN9MxYFCoSXuC)ai3!O6d)VfCmN>H4&H1vhMmO zc63ttULv6gox2PTQC|66j6a>)-S49KG4FOTzV7`aM*D*$^>@rAie{!%aI^ME0a*%x z5_uuDb^tO>b6*|)zD}iEarUaQk>lzjI|A^8#lYw_bbbjqyIe4{vuE(?#amn{k&&I!kdWpqs7A+ywXPZsc~&<` zV#&a%vEUi9@USsZl2Kh5?RxW24qU~%D9Na%Wk`m9U@y~Vr!>nK!!iLDJl~q}1INL- zk=MD3tW!#xxnYO6y}5ffy@hQtwW1i|nkzF&e{P1gDNTx`+Xw0Kwomz^$yB&X)eVcY z_Gf&Rt9y+}X?J6bWy#A9B}sJ_<;kr=X-{j<)^7$I-l2njsuxZNKeQc>`^qWCT?nr_ z;+=4KZak#n$E6K;t79HVw&2D>+h(rd^7|}UUw6!SyM(efTmJl0z*!KKkJ&qwO6z1{ zqB0V)Gh_*|hx)<#xg#fZc$B&DRCol7v_+elD+DU?lC@&=tB9y9Jfovw&B#aU_Z749 z6|7^F{ zmlP4{IX^$2oSlt76?3^dUw3Tkv1sM&8#Vq$nijmgJ;$0V|a*8=3jtey9> zc0hwcN{GC1;@J%F3VN*u<8D_O8JWTpX{+eLd>K)_9~z3H2(e-GMQj$IX)}{66-qM< zE3gw2ZY9uI5_R+x1v?nFOUe$k#wyCJ6=Gwj%YJs(kGt*B|Cv zcNHhaug#c`^xq=g!uRGz1d23~k@!ziSAOKLniqN)&xct)N5P^*&0s=DmwSCy&-qGC zUtjfhclm_VkvlhyDwyoNqbspPX~25ZQBHUD(%Tf0A@%i;FPOYGMBv5J{dI|7q>#N9=3>R|)j%L6Ekv#pAo7g$cAWj?3Ka!~r%w;mWoi}g z@WbU6jtYVXi$icyemG=Pop`@JgH-bAI(ZPJH3eIvNyiL(WG3;rGY)XkXys%aJ~~ax z(&H5wS!A@I>_vIeTTaS(4E@>HbCK-kj~rV-jei+KelM^jVX}}0EV3WoN#?|pOUt?v z!XO@nxY}V2#Nb6RY4+tv3=C(;oomJi*-DTL9lV^73-z8F@|*!xMH zl+GW2fYJUS)TN$KZIA0lE=i3q6RI9xAO#|9Jb;D9ObaWinR6IhWpfC`BP9)n7Yj%^ zXFH&CiX=|Wek+yu?4WBs_W7=NzesGvn(BU9Vzzi)u>b5LYXYi{f0L0t=Xrx9#N98O z^&Ad4)Eof#DJ>JW*y<)^WXlDlc9Xw;4L=WxXJaIe?+pQw`)^$Y&{6g70Ce>t=?Tu? z0u5{dad@@bsxjN?^5CLYWIexo0V-*qWk&>^cLKpE#9eFDxbs(3Qc6SHmw%GX0L&r{ z6n#Gcqzfp+plObfVXUW7T|KquPGkSjs2{YJNp*j9#9ysE#iXTKsw|&-`b3S}*NDK3 zQGf_Q@F&O}b5r+g!)wH@pLzKc#m&qd?1Xj%-ahpWABlx|^RsOcRimgkd=<}c=TMrR2sp9O6{omLwiPvZ?{j*o9c z06D-6+|HnT^Ds!DKO^FRo2dcB<>SfI&G^jh?BBi1dH8>W(pXX>X6EL8Q&WE}EDQsT zXa<4(>7p5IaXGz0pzbSYw<|+dyql@y%2&Vpl69fUGVl02IPnngN|>>7F+^hE8I{CQ2y?Cy zxtP@wa@g=EwHS6rC?|F&c3o0Fg(b?Ayh6|oNc(QDF(Vl!;Yhk&^=xV3zB9U-ZgrA9_XwE1^;g=kpOqw*wlrmyZua(Y>7xkm!Hz|s-3JpBb7FCJ6iZDzYSgrE zH;lLuymjL^#GW~I`GBAK_5Jd#-M4%jmj7Wt604feizgReyS}JiJ}mEaWC#G0DIhkr zy+&0^V2wU}&IBqJ05f|AWW`QibGOG^sQpu+`oVWgxHqBTa^1@aV!u0W%#@DNtt=ar z6MvqzL;_aoyx^#H9v7JL5;l+F2tw|cpXwX%Uj+0-<S}S%OMfRrDY@I{TEm_ydNxmdRkVcsG}kUfe3(>hU&6e6IaPZs!T_<1o-#>paEqX zVt}q;7?n#%!hZEpF}A}Ej8kA>v;POPENvKMEfwt1X%#eeH~!*v)DbU1>=k$HvrPgM z9OQm?cy&EZ{J2J5_4k1EO9@ZJ3cYVR!WL0q;F6z>yU!%vah~srDQ^^iP8!v&>`eVi z!GEH2B|M3M*SQ8ZosDOEa6v(+pO?4H{b$PIa_#Dj2Uz67<>c=`p|UFU-mjAlYt(ss ztE$@OP9F5XJ^@`;LF3t@6>r!g`ON3c%;#c3iuFRSS z_<_{e;cANys%fpI?B<3ktEjmoG`6=l_J5Z&4IJ88fW7zAtHoHvBe2$s67*)jD&yNPU}9|l zL`U~eF?7MGc1Q|qVwgb^v{N*`O!XY)Z)8}s$v^(#sop)#G*V%zH@$T2qhTCtZK`2v zI~O|9MkEvakOBh|LUZn+onlzSFMDvW?!45s>kQZZao#^{ zY3;hN^UU%O8s{HXYW;tJYDk|wdT!~ill^=$2C^3X$M=m6H_K>f809zZfEmTL?UIs8 z!R2{(x`8>)-Te!JT@z(bu(F0m)<%)n{-IklSf)aKXCFRF{fC~& z$KhXkB0%~Cd>G$qJ^Fo;ZJX245j8f(=zBd7{Sg95WFw8yt=hQJ>ktJhP>CqQZLpV< z`Jb*L(%b*dRrDW9gxSt#B?9M}i2DUl7AX{&_21z|7xJYuV}+d*y><#tLCQN~hE*`X zTTEFsH}cK15x@I}&Hm!IiyP^{6iFMl7DN4LqvEnRfoA|kQ5KL1?_U6JMWe$SUadke zc+t8L;C=SwL#2ts7Usnizftt-HJVL(Jh2%vq9^t9!RGn)RuiPT6R|eG^q>Lf@w4O< zXnFmA*^=QRDQPMRf6n^^ivF68S4QjDxz?`ks?|pT>sAX&je(*OROnF1tWV0FZ8xHa z4}yPpI!m_eO$+%JCOYL)$Dkn!wie{;D808Wnsd6ocv1c@OG{}r+RUL`TsVGw-?UPN zsPFs-SyWWqgle3cwr2^}g_FB`^$KiG>n8ur;iTUup5N5z!6mG_dV%t;!nV4Eya5Hr z*;^MNBqa>a)BovOR>pJyn>|n5Z9bDXzpEs~ZhD8uMmDkt1{zqa!+W&d`<(^vyhv?r z@|Lwa&Ps0E)L`%+@>em%Dsczf;@WtI7C?w*sL>?HJ>suHq=fJwAUhd%RHAc)T;dcaSMp z=#dGE`142v-$4flUs+m;gd35_NUM&T6VC-*?|fJpv;FhYQ<*@<2CKf&CjYV_a)+UL zRqXJv$blDDqopp=|0N#*7dSJB2msBwjSV6TE)pgVjzQych`15>aFSSMonKy;01jC- z#)F1)ReHgM@!&hpZYKcsOG}3VhLQ{wPQP(cz19>fGV%>i2TeitQJ70I=uqGJ+iUd> z8#_F8eVtTANO`KEWeHz+joGy|6Wr}@hBr!}No@bc1B1?#xIs<;u(tE+thB-E8Rhg6PdrG$P201-{KDbXXheo&0C0;g?;ngRT4|8b%FWdmhhUAA&} zrjY-@043nB1~lif$ZYL9^m#yFVcd zs4ahMP`=bFiu7pOe}@no!*acDU(opuOhqZnoDLVKMg500#)Br&A_>xIvoL zbo@jqIFOZ2E)D3wA&MS8aGs90;=}C}d(Z-Fl))AIsj|-8s()@Qq_9 zx29+A=uTAHUy8yFdNTJBQLEY%f+9sBi;aO24$^xqdejeD&l-pv7mQV#sZ$z7V~6*UL*Moh>$*U&wfS-@Od&0j(r6HODoZZ4h-hJdiF*&w` zZ-@oj6MG>T&9P*V!6SH{dC3I8H_t*#jH}1K;_c<7_{;T$&iuSBrkRCSB?=1h&Ccu` zvHjQe+SNZh_ED@cA4xd^QvSucsr$>h@mgwmP~dbRUCm1xx?P}LD$!|;esv@;>H_)1 z$L~ZExP}x)E)Bs{IF43het@K6x(pnBHkB{(bRv~Tx0%=P-;Q)7VZjXk>o8AykveP) zZCyJjd=Lp%w_(FYf~RC8M}2u_TwVi}v54WNrMqlf$AZgiZ30c;bC%}Fv5;Z(P$PVE)gl)IWm4Yg<+iOm1asrZ*8 zUN-PsE3sT;1eE*&-4DDIliTjo5x5|#t^=V~N{%|W^LU}=)Tmn~y>Gz`$-iF}_|6f{ zXbz8A#`{~nJ5&CP0^?zrfBysYncq7nP0~{uVT`^Xj*9*Br9?7BfT%$ENQ~uQZzZTzW{?AV z$T%GS+uDhqYfDf@57RlDQ2%c*lW2Q-=EJX3*vkz1vi zoJ1;!=P?2!`p!4as8$i~SI=G2r07emo?hetd>0N+6aMQ;hiP{~&;Rc;%@2)!eliQOvEg1{Mz)kB>oz zTqnDdPI1kL?TNhKqw;BF-UO%OnPqYsZ54y$#kwjJX_#3z=ak9ua4OAW94n{qKmLY% zZboecD{rWPme_<v)W zAIMEo2;`SR5^GI(Q6qygRYo2<#FVE&0EpDG%)^X@d%CIHdQLQj0z3iw8=h(ta;eL( z-Ew66ja~Ei0*uh_-WhsgQ*1Nyo-4FC=uzhes)9R-8OIV_Yv#1m5DN<_3ybd)jDWM? zuSi=xtKU1j?S_djKfRJSe+Vo9M$B?uOrJJgsj3;k<b{NPiPv_%4Q*0|n4X3X%E# z(a9o49o3dWjAdJqbo@S)fs<=)xoRI2Jg(MO+=lHjfS_~ybXgUxT6=Q;c5F@~BF3c~(Qj~q2tgtd*a9o1EJXLvUVj+#Su!5Xs*~2(zQr{f}Qs*7B#gCOA zH%vj?sIqDr$qf8+UD0wVa9@k&Uor*5wt!4)dB7(&0Y%xp1XVHWML z!3s`W2wGfy=gAfhpzWA5-VN~yarjK18K0T%K0m>@4L?5KcMLZOlKq$xJ z;wXIe{2>J{GSnP``v+?5TV9q0r}e2R^bcx&pzUEM&I1GTZh%iE%_aeO7eVJ0s^BQ_^8r~`|)L>fWZD4A;fIIqVj^ni$m)GsON_|j?prgH^a|>Ih zKR~b`I{Y)0bqd2O2@;^2giZ?5M=G+5q{vK!*q9osM_J3##_YpShZDFIJ0^Z@j#Ws` z)x9$}C@Z2mB%jN;i>fR{tur-Sm?=(DndjR@pn$mU?TclbII*Ey}0UhP|G<)qM2lsA0x8a2AFtg;e(AIz>3 zb|xHzQ@05WQUEQZHvTT*{t-r?qXV?{Ra8`vdktWZPJ|?xF+pAl2qetj>~j7hkj=;S z&drSi^n3 z1~&w72D1E3P}+S2w?$32@PW0>C!Okw-Ahd-`|YLI0m&}^D1e^ zd()>5MO(NakjRZGlNucbup_}OY`uBDuTpg4!RIViPVP)DcXG&7iKr@=mj~4!%%d}a zNEId_aXr#?tqMNVMAvW9P;qFYSL;!wfe~=_`~sx<&#MdKpxvY&p9V0}uNxMs7A2D2 z5f7$XwVp^*g~ILX~SQb=4N-6fwkhq9P6k=TaHX|_Q;ZIqmbOnF=CtkPaPwCLxV z_QgiAsW=af8xze^ln@b?hpt3^ZwIm2RhDlV<#hcV9@lTN*K4DPbk`fkpE99BM0x{U z!QwU65L7_gxjaJgwP5MNXP0+Agl`>-%FFqs4Zur`cK#0@(Dtii0x`!vLQ9dWwpb^!an=i^@RAL6!fA1 z0$Hogltm#e+GAxo<#R0gzhx<4yUhpvi_&I(S-H~}dmz(+Ofs&{(TKnPAo#VA(PY7M zPd`B@Yyq0tvMU)k35<#7I$2&od;#V=9`|2x4-dOqQ_U|yoZy#}fOp&kJ0Mi7&%6O> zDZ=t@SXkR;Uh%u&Pjv&JBsdR)&g(#24lx1B`Q_5dl#;>3RI%Ot*?bo?jLq*(!BpG) zrkq)?qem@JMIa-QQFS(h1^M^!KYDgmK5Ova4kOGe4 z^!|nw?|WnEl6@5`-VPM$QbmVDkgDYE>h0&t*UCx$`PCl!KCh^6BJvB@7yt138MDMR z;3hBikM>!LS+IZP!be})=l3%&jSI|+N4Q7sa*<7SA7KhRh;ucR zm_z#lSrqm81y*t=bANos>AjS{G>#`X_Qn6ubwGln4gnDg)R+NjX4 z6gC8tkoSEQRDR|qG5RwNoVfVy_%Zbf5tUCwo;4)zvXw#(`|s`nudN#=C7r;8`xjuf z{XM-92PW$OJwHYC7qq}WfH@1g7Lm>P-^BzgibLRz_#Xj5tiDoU3pI3DiU0qI`w$I# zsyP3pz2fsk23*tS6%}H65yp%EqJ9YE$IF+_gDfCf6O(`LE{V2&uai~SadP%c!t1nq z0=xGAe*_R#?+;Jj3af_ zB)NYJ7+tHwMUJ(8Dp}XtS?iwA?yQP^rTJbM+|2<`=Y=rsPu-HxX^3>dKKb74`7G<$ zD*;UWfbgH2lc$R=!@6|f1P4qhI~|=&wIwO2ZWa^>E{5kkQ<%Eh!y7ntl@82`m^Uo6+>CHRx#&bs=LSwb{Jvny z&HuiT2xLScMnxkobZ*ARZ0dD*KYuy|8TE<|L=NpYK92`X0m!`p-$4Qd24d)Mcvwsv zERYFS&{Fm?SlHJ>fsb}l!MT&)EF{iZ=)}?ARP1rEJc1PMR)N-{ut&0nH5ml>m=rTB?#aby0wu0}`U6@eiN6Qot|59+(sNDYx^8@~Slj4VQ&Jc# zT)y)CAylEg3M(u~>WmvOQ`&?F$sBItG}1dbu)Y}{d-Kfmv{;jSdf|DIpH#e19Yt*| z;u^?OoBa7xO3{D_RjlNzZW|Hxt|t#6aekQ zn{yq|nI(9|7xr(S7z#~X$|hP zSwLxWxksef(R|@YoNqv=1^mJ9-_$^CN?^u+)v|n=aMImvgoyadYe~wuK^r(yp<20t z!3fsj96+Z7R!|ASoOI%_A#+i4^0@#AHF<&Y`s&|Qh&V+BZLK}2i+o?yfA+{DmALuG zPkVth$FmD&P>NP$K*S$t2m(SGbXcofDFWz(<@KUHJs~0_K(w!EKXdkfjK%>fw>Z)+ zXl>ohO9l*sAT1C+xm65=<+Y(w|L*;13+LMo?u1ec<(H(YDdcBaoN?3~SZCaWF4<=b zqF=Xjb|q!RbrPePCuvA)F{1@rO~tkLFQgXG)E5#}B}94ACF=I%`$sLys>Cf+#1_a4 zi|ff8Ml&W=%LfU}^hw7OY^hFo7c5wls744)oQDKbuZ?BI9*c0yAX@yia(D#hzAn3 zwS3uM}0RBb-=VfxVsW@-1Zmk8Esi?W&f#-(_9O{oc` zsbW(-PeXhW-W)Ihmt*qpW?ZoFQMh*feyN9uXP{wo9XBn<(W;?S#5$0NP&z=rUvQY7 z?dgV|EmkN^xte002-3TGii-RqQj8SbM#c>b9~xg<@f% zGC&kD@!swJn#S0fz9*n~T3XMmPe(^La{-iZK#(w5?F@#B2RRC9^8=|{+nNSFmhAtT zJEOi7a_#7wQTQMQXdWPY1_mTk0C8n%>Sym_Q>8XQcz}qC@+ro7LuCk zUO??y06nb_`b=X8Mio^*xHtV~0^Hc%c6o|$D6(djeYs$qZGQzOAD$jXK~Bds@d)m# z)7k~_4T}Z&0Lfqnxqo!Dx#9y_5qquYHU`_JLOx+0pzC;o_nnol>DsR2% z3>L8Lx#~!;q_8oR78KNvw?i7qXkaO(rr!kfFO%Zb!CY3Y3QMVqEkIU1x(RtO7Z+odk)Y49>5AhB<_g`5a&`O`)%tJ2F zad=Zw<8aB?48#=t)<3DGtvT7;1?hh0h-z(@QhfslOTkO7CwxR!GAwt>l~sC{rA?eJ zyNAq1SCff2JoyG}xpHN^QLL=_cs;$oBo@1SELJv}FX`7`Z(7=I(J< zWm+V;{#54@a##k3F+go8#f_x|Y3;%DZ4tcPrsjtso_7N=XtijHk z02!nk)t^_lOJcdmZ^tg`@M8NRcA$pNuc3mHetNsnS!u|eK27=VKVUIu4-U{U*WlbS zkLB)7p=A+2zqf#HbN@S@C?7y=L=#{^Q~|SVJ_9&{^>yT(?Zp0 ztZDBUh46l~I03?i7yC+FBHUrGYx7EHo_(%2y2D2*0?9+ncnF6k) zn}wcnvtl!3(b5R)#D)=av8_!{csXs%3DYlv1Qmi?Q~5qa+R zWjW%U(;Z&6RvGO%hkcTbsiO6i1(7qe0r|G84dq>erBMcktch9A55&ZQl^-jHr(+R>3auWG^=09kv>ewVd z5E<>O`rKk%kGekGHkG@p*hqiVQ;Him{AS4@QOaf9h?PH`#jFz@A#s5_`aA^o1t|&M zs#Z+U)IK+Upy4epV#S20VAg0Dvzx3NQsFx4l8@qMWXVHt6E+{02Ir@`3YPyCnR1Ct zq#|elT8VwOoDHB80@^5oU3s911Jdlkweh`McW?$1$}mtMi$ozyPk_3*`cTxiEGSs_ z-2xtU;Jo*^{lq_>_i!Dr`e1(dgZOB*&EkCi$N9oD5J-Ks;(}urjkD9(>OJcW&4-wQ2O;~-+b?GUAD_cAT<=E<`1;E%eSSsMQW(Y|i)hiF_kHhW@E0NS14YU6 z^kG_R{Wf$}AqFmtb?VrzuKWtF>hV3qx#UN9p3>qJSax_e+a600nx68-@)u|uO;(G**|Pc z6Sx$c`*5npZK371{TLNzTNV+j3ugUT4O_0o{30WvN2SkeO?Bcvqyzxx*RrEC4qoRAdxw#d&& zB>jS4R_n_?^?$iVb{FW;2|O_WJvrr>st`&yeZKR1O4pB-DOrdZW$vm|x+U_@viTmy znz*7%wv+i(^PUhEb5b1Mo-R|SQ_wdpc1aMr#zp$*Gw-G&p{b_qWCXM-5T{Ec@4ynw zMl%u$$T-?wm)+&hz!m>`DEd)2z5l~?*KYHYZ=v1xnN@o|SZ4WV z`6g$aHzMgO!m0TM3U{qC3PgCoXctHv4jykQ*kf_bZi4A!lwepIZQ94F%o zFd^K!d8x~Ivx%t(GfhLO7lbk;dlCVfA+Clt)bopQ|JJcsBZgQX{Oz7Pn-ArGyjoPm zBSy{Us+W_V#}82{8remLOg6Oi88u;m0r0UD)dmv?_O}47f#%=pp2|FoZA=)e^KxdMzgx{{2iG z&8CxjfadQ|nXO^@q@eNebWMkg1Q_s$6vsok!$q(;9Iau-DG4(Gom7pO%NK3&i#+q| z6l-y)(Q#l1q}=E-XyxVOB=gET>T&n?m>+8gnBO3V$EcCwxQINbl1*JqBcsM;THSqp zKd+9hKah{bMwCl&OFU`6X0QXGU{X|=?+b6fFNSEp=~w(KW(Ter_wvGrl)rmoo>YSC zkiKuFNq>|5=MToTC+bgH*~F3uBsiQHa**cmkmtcVb4axnZEYOpz#g-N)vIidE&B2$ zyCl{A-kGbV-3#~NU=cv_2cTP3k@k|@@Fc{M>~xERU#Be4b`{L`ee&@?xdvqqt}1%e ze{)p8LInAyS2lY1OZtKS#rW9cJ&;8Zy`={x>jZ(%Xqa>-4PEaZcg&lgjARVR2D^*1 zyLmuueiJ;-Oci!o`AH4x)?_wo)YRW$#%fxWl+O{!e}Joo6$b1;XtoVhjr+`^HI_cy zcq*Z$I+!GKC*LYf8@94~Oj4ve4MzkecKDLcy+>a;5IL}eTq;1-#2JV^AOd~c zB{9Gpn(rSdYJ;)IO99^YWv?;ox>QUc9zK~jtr`UJ?`R8DFXpFD0ZWXEQ_}0p8^rUD z9DBQHH+#RP*?(T9(@&qRg(lv8=aB$g z{PHR#?#<_!&Yo40pvBL&P>$*X3}I+d6&6np&cV`>(m5$fymV$48c`gdfMG;}YM-0= zx*Rz7zw3Q^2Tcy30a$*gGW$9GbXe|YkBEc*R-@>(=twY;V|Qh3_hP#bB=J5}UF;Gd z*B@fw2>9)D(d%aY((@DN35|;k$3zYlNtY|hU}p*bcih9gzd!%KmS)k&VNTE(aiixZ z#h^hB1e6#U{z-~ce6iHT8SM33eUF00Fm`R~qjzda2X%QYl5+8d25qJ-H|;3+_k#`@ zjzM3+XJX3OAsb5<4wmCjQebco2)X&^OSf>H*JW7r1ze76i#yAKV%N2@xkGW&y)}LR zegHxb7(nFAV#X~o=-=aBmbQ_dZv2b{@O1s_)Tm6Bv461`(n=a;eU?*bbDr1r4}j_4 zV}AMx%Tkn{l5Ho}xtZx>6Ak;Ujzu-ou3C`q0xFQ;B4Z#q z!@u?$-=EI;*>Pi|$~zY?xH1Ny!wThbe{ZLtR@v@$YY@a$r=+FImwn==(ANZ=a`@dx zK{@cUpOgR>d~awPd90x~ZaOC--6$p`>vv0u2g*T^Ge&Wf2JJ4El8Q|+Gl>|_aO_|o z$@p#CjpY_G*|_pgqt_BSiCud4rPJ2I@0hiX>!{IqzLnRJ>12t7nq87^3xJIKY_H4) z(J!a8Va)W6GpuWZ-6;&Kx&K8Yf67wXw-^ckzlr2z>?w~;|C?Wx3jYx#!@dc)?IDtD ztCf9rIy}y;W&6Tf*L+t#;gs9OHUv!*Mtg1%y&DG|Vf@eSZvVZC`i}OY&C;8W_8WzO zFzV;umxv4pvi#cH8Z?`7SBcgl^8`hyaSQT0QNVORhL9hA>Gbn=AOsT_61{!yRKVlm z6x-q9Q2@}hfu-o?f$u~aWD)|&3CiRG0k;wJhh~nJ5o|dYs&+tanp$znG-S3f6s}bi zw;ZaMGcXW(`_=*o-*}ff)+Yct$?nhppJ@~3w+jCX=YW-G!Ct7F8DGh2xWQdJxenHM-2eWmaW4p9^SCBk3L;WItGV=C>D)|_owppX zW7o9T=8Ai8CuqJpm0tgH@B0Ubf37Z+!6J84^L>|@&4l|3zGvE1Hqizm3OdF(Yv7CC zg#Al5R&2uAMa%;`HjLB4{@sox?v*EVuu{y}d)rd0C@5E*6*?2ZyUWflr>IEu{=Go2 zu@jLAm=^%q7Qj@17Av7D*bo@9iuBc#J%4_HBBn^u#?zBLCGSr_&OW~^Ir`XX!!sbT zDdZe{-8?NicniW5fK`TgUK9QkG~pp2>)#0vo$O7V;CgG(hb@?jl*V_N3bL{emtUgX zKi+pm2V87u{IvHd(BtKPH^vzO+A9j#q^REo6V`m8Q1MTWZU{L8O%F*3*98Q(gMG7~ zXKk#*LFrLQ;`aQ>=G3kIvDp8Tw8Z_sCf-r(0p6aQ^!)6w!*}!eXE-=5SnTa__XJ$` zoG7WQ2Le0u?u1~x5Gp9i_5W8dW&i3UH64Q)$d<*36ypX>Q{d7QshvMRXr2e%f%S^Y zIbeY5SvvVuP*#RoJ1`Rb`lqB^DgrrSrmn#XIBD|)<)ey+hVuVe0}bky>zjrNRV}T- zAA7i2oXZLp7C7N3e&bYm$Hh%eUj5^x|N1^J6kA%6b+YZUH<9oknEi32GCRci*T+PO ze62^-$oUTlb9$cgm%~lhWQP*hd6?bu5w^1Dol|wn6fa%M`7cZj9cp^6%`#>q>ge^T z7VaIM(a1^nc2PmSZsBpy307Qu6}t(Xi#msE;y0Bwd0}L?PYqYA>vq{zxs1Lz&csrv zRjQpjD-*xyI6=*r1qYhY{ead&s0(6_K?UYfT1+^{^( zL$#pMSVd5kP0jL83^DpMHNSulFo{yi=rjpaJ_f1E7bV_G&kK|$PW*B;iMhGdlA@NE zb=mA*z_{_?F!4UTyOSK0xsCAEMyRhndXKHapRVGuwdVxnP}TZTb5~vl;NZIp@Z_4{ zzeCrsK>>3tQ&XhCb&18U!$4S@rv1uIuj>{cR`i*vc1dAjbee(JKeF!F3Km=*wH-N& znRxBz$Kjx(iC#Df=!I*kS@Y!A3#QuZ3%mN?jt5JZW_!T312Zteu~}Va+fl_D0r7HmEF z3H>jp!|Sx_RVMQ2&u6BY3|X_BzQB9^NrVS}T`N1EtB!bX_j@>Pb2czOVeq(bQl>V| z^k{jj?Te<2S!Uh-Tbmf8`;v(dm4@ay&Kqrwmtm$TdBgX&Dmt-Zbq^cja;@I|3bF|V z(pcMT`D9>UtDz`EBv_1$3 zy^aXMI9Uq#AfMG$TwDzu`Dts*21(g@+6@OZ^p3y(xCDG`Df^%ud%^vlvGdWK?EQNM zl()PhAYI#`moIk?neV?1_4kz-9S~@bita@>FX4{gz3=+HxRLaY0agfaZ zW>q;3eWcdfRkr}hHScCKeOy#M|G}uBDr!|@zjD})P`w;HgwuCSEn-R^T?x=sC8EO$ zc##@v+&-Np%GBHy;^{q1(`ww8fyt*cW~Ni8GDrA;-<^XPV-vsck|)lM&u!Xg0U*-d zcPMUUxiCsanX|1E>+thSM&5eT!X!0Y54+Ju8ko`HoPf!=Z9M1L_e4@mS{`mZH|7tN z`1sbqUa(mhFEp_4T4!~x0df*tGR^B8o}P6IIYxxt>X@r(0;_f{+DkZY*S(iu6$J11 zRA2nGryU*!ThsQ3ad_Z>KO3%e0O{@{RsG&Tc$&24K=5zgnJ(4tGD0e*=)=V1R(dVT zVz<;84HT8qi&=59HW)Q)4)80mQgt?0`e3{v!F|;8DU)22>k)*W%dBkY&MT+wf&tW!C#IR|Oj7`@fvgf8SZ1?2%)lY@XkJ-*1G@%nS{K8uy`wkt#Si_}5}n zcz!-{G|u~O;1yZu^uuARsBGCeNC83;04Gm8-Jd)~bbkct?`QiKhb_m8gE4W_7CM$T z4yCn1=towZS&nUbwm(`z2mDW|Wz*=5kFyu9eF2}8&$=n|=6uKWS2hBp8-&GUV8Q18 z?Eu?GnP{w=ni<633NdBInPO~i;WlPmO+nL{L`bEG#Uq(crLtK0wulBo`Xn0=!LlNX zKQO=(&q5dyEYAGQlnY|E2nW;lnb5pn>1B!nzc(TyVLhqK@Mgi-YMPa5Sp#N%QpuxB z%sWR$?ut=MS6UG#nkNoktX2vMXW5vo6#OANHlw=3q2@!DEm`EUJ8l-w^!U50O`)Sw zi?TGf6%8HV{pqdvaDj(Ar|=hbmMVp>;ev*?uD_Cudn%YOBHOn4{tDZ#i!+jzX5p&Q ze)aW@L+3#G4jatRMsp4dioW~fNQ-nf3t%>4A_21+pk!JSM z(blGyEjS${L*aBdW&;C^p998qpn!qL%Q=`*05>hNw}5pMKDdUC)G<9qyE#{aGN-ez zUd763T;2J)y73@{egiSDi%WcEHTs#X=3}FHG>=V6)V<@Na_t7(`iz>hv011YG2{Mt zdJv8yiud&g5jcSVOpW-{ZMXV|ZEFiWy!O)=)I)y@IDE zlozr*?giB*NP3%StCY!;A^GcVEVojHO|qz#8*t@Y&NR~IQM0nrN5w6SDk4vbr^PKL zktQWF#^^FZL#Lc2UP3evn;x6vBE!4h>`r#Y0x>qF0~^ZTMVnRtSlI&Vx{IG9G9XJb77RD}`U`pI#Px*7E32ucuUV*;lc(ynMu4gZ z+~~bAc6DYpm z)MjNbC~9TJqMm~F!&U?4*X8|>I=vcu+h#rRKlG0*VLsOnIDbocy}rD)C03wmrft62 z@34P#2-L^ptLmPY!ekpb?S4eQw3=&57S{ zgz9R$#wIt%Lk2DwB@jd4K=>pOa7)$I^0k4oQZwmLTmCNF@GvrBa&li*VYvTEW=bGxlP9&X}xifQ}%6T zZD)#A$@}4s8Ax42ukVWAp@+w)8D;}Xbe4|dizMri7`InzS9vF0&o`$|da4)yCs74I zJ|>R5xK(6W>Td688ad~OKKDB&4>g@v+HBGLL!X$Re}7!(1f5Gp{CZN11X15vH|FUQ z7&OqCX~ERKaohqhpLvtZfNpU}+kvA*bN&wM!f!pRj=ek!H1?g0>X`2b;z3tbx2sOhFmV7TgK6Hc2i&4~g2zdXoo!`yl*wpdoOB>QuXi(c?;p_Q zFq6YQtrfV8CIVzW{MgJdCv7>a0yoIOUCz#xx1JVohAS@q98@pzT%o3@Gy}inAXs>K z6oMVe*URAyTwHyeISSDdh52BE8;4>+e`MGx@VbzOwY;mwp3=JmMOI@DqOS-D))u0H z!(jxR{@*jLWV!uJKg?m+M^)03_Cy<=C9ZvSnt(`cmd;A4rDZZ6usF2UBs>NZ6Zuc} zf3(;lz{J6CaSsiitwfxUz)s=p>%&!1jIM#^n=FK9j;kFWbw-I@>p;=x=_ zx}1dn*qBn*IgXJ zdT_kwtXgk~$&^qO{ivLzTihs%7Ku(8lLSXf@!l(QujHBq(+u)>N~-3&I^!=hj2k(i z$YwBTWCuPjM7q&*9&nrQr}WSQs)$YIV(}V9l;-y``$BOQYbK zByoTdhh;}5?KF@YCK<=4aLpljXfl~$I z8(LH}=Bnw~uB@{mxvxfPp}`}tN;uqz=jy;C_Lbv<;6#vT0-Bs4I-gIL)#-)#B5FOm zcSXZ5K&Nz+W;Ky!3|}6&uJWMrtBF9J-9Om~*~MJ>bW*TT*WmHGy3;)>HgrFr>m?k< zX#S(0>uqV+YqJ`=Q*i-((RKOjpa%lWyM%Y1rlda2`RO_XO*2?kgiQ{>!bPe^8>wEI znwVm?Q8#*ARg)h+xQEI(kpK$rj47c9S;rsk`= zE<)qg&XZ?ajgEpk)tucE8cJ)13e)r=`KUrISByLCV;crf6DQZvLQly*oThIM3YwRF zuHM?Nw!(uWk>AydxTv4qaQgW!$1}1=4r!IX+o#{1O}-8O81?i(-j;a$eS0=^e^dL2 zn>;zV_A&g;yxu^2YlCtn2Mu&r`?zc(l;70!7Py)79#1ERCMHaFMh~fxMZ0>(Z2$^95Yp`aZcd3E!EQSZ?;9ZaUNRy9z<?q3>QL8nwz%=+5*_0Z4E{Q_yYKdU$>k)R7E8L{UbR=OJPaaLWDSHX`WF(coILv3{ zl#k?*Vv}|h+U!w?+)i#oc9M2n?paz(t`8D#m~;elId=_ZeY0j*ZwQV^6=r1Yxt#T< zk*p%;X|}E7uh=p^3dAzTkRu8xcatfl;=pf0&9%)G6VO9vj-FZhb3ltn1CfSWS%mMXdar2JfkiOu1rJhhB#D74Fp}r~CcJ zlirL;T>q$0N9@#>RM0eM-XDzm7O;55tLsC_C1b)*Ka|xi#Ic-Z#Rix5QuT-sL&Nm( zFz_ku#Jkx*jfD1Xyt>e^-?j%}v^pwZUj#l4m((zUqyO`M^vA0dCjCE~w_&&33mqBx zzop#k=yP(=5A|YrZ59Rd0!}$V4CI>7{cJ6ancR~qHKs_l2B@82c6AN<^af0P0~HwSDd780Ou`Rt6kew+W4_+ z45xX$UEo(#ooe%MsoPSW1HFnBlh$gc15t))6OwUjcNL)FnbSFzOaZymAIqkIe3fGZ)L`&T8vl zCM9@$>#Hr<7efzIGjvuJD#MUJcGDMFayFwWD5L73o(k@!i%Ykzr}Hw4bsRfDx?hq4Ha+A~Rr9)mef%7|-~H5d1veC?oG8wolg-$3`b>tL$ORN&#_tn{lE8co2 z`%$P;uH~~^Z9?eL?luHFrDZojCX+LgzP~8X)vMago$+~!g(9SUE;%@x|A(Y{FvoPs zOTe6y-uUA8Pe`fMJ2TOXzV`;!yh%BB>vLK2ri;kkjT8zOku;Q(?`bG?dhvTJ1;jM& zm6NcDi_nBAdG+gmU{prM6^i+8%dq2Mfs&^^Aycn35I85A1n41fyY>`hUPdpl%Lgn3Qfl=x8dY%lU zf~zzca%{>ili!#1&3N7yg^0q12oe_Z%W14}+5WcT!omtPvOIHT1?rhD>BJi16YtOZ zRHy7=EwBnCLiz@uQi>psr<00_mUS&JsVPX=WRk>+oQr(Pf6=$S)x^d!f?V?^U1Ate zNQ)>-^pa4}u84i6P#19|oLnz>Ubjh^(_AKj$w!1i;+?2P$V6L=QHWc|z(Oh?)xcD@ z9D<-yND2}YBJ7;rTIi4Y>Nr#2mOS*>frJ)0usPjCcy+2i-z}E~`!2Q^CR|V#=#7k4 z8e2^3t8qeplkvL7^abN8BSAk~)iOuQ<}}s>r{aq_cMFzCTlf>O@Eitv!r~@a!8d_7 zCGIx6HG@->xP=%TH56nj7_`nW{AXaQJWwoq@%F*FG zfolcmZi9KEeqt~Y=R2==>!Zb0N&2E9-O|De^N2aDX$w$#Niz&v?6rIoAx5W$+{0Ea zzG7xln9jyg>8z~%gLGDlaqTizy?Kewp^0TxEoUr?F=E!Qy1GnHZS@jW%k3oL%CBz| z8*Xg|2W7+<_;ttrT63b zA=Po=Jov=sUbVcKoRCW*gc z*}A^XCrh}Q;Qe}bpD71ys&ceRe<~2u&UvE>+oT5xX|IxvR zYs@DOeebvOjU~gvMJrApcK3E@Nbl$I+WkMD%|L{B1%sQ`MYCKM3923{AY4;<7lxG- zyK}a$CRwTe_UR$DmSLtDtPc_*Zt(YUD3On3u?dsfq(YSw9LD`Jq~JwSou?m(ArOWX zcC|s~1_3PS7N?EglpoytVi|i{`(l}ODtk_ImnLs_eHSSrBsc3_V%+QOB@Y0ow7qZa5peYX}gH>^*5=5t>;CQcMswCGQg%LAODn{c(s!AVZGs+$i zBio4Y@Wm;u6m715n(I9u#iQPbns?F{cYRn5^}Tg7{NNJt^WS z((x@vz0Xo-rXRaKz_J>4g*Yi%)enOe!6RqDi`v4k zmDpvf5?XHA*6GC~Kci)?l&l`RQl9VQheH)dXu9Sow4!Pc!>+A^|D*v%Z6d{$P5DV) z=QXxxSg9J*j~k>|0j(Gb$l|+Se`3YakjMo_WTMNVB*A?_Y2E(?_Qo_YTc%djbgZB* z2dx7XdqPEi(jWV>fKl>Gkk(In1g)bge* z2%8*9i){Xb*gCC|(7q_MbE0JP=JOJ`jp2>H#PtWuEKgw?Z8d4EBJ_Dv{H|-4K)Zgq zu~HdTY@smPCVI{|S~EH6Bqd;6*odp{y~1NKBZ+)6M$?*n$yl(DnX*n@!(C15-MYz` zQy>=F(h?~6615y0P4n!nrI@{SsDi@!-yZx&);J%w@Zo1BT!-@MAm*maq|7d z1`e=F_QQpvrWjWDaB0t@?KFRjoL6Fi6i>!@p1FlOS3fpn_3L=AeI1W5lG41#6Cb<- zg;DF72Rocjjn`qM7)dhs4+xZqkvU*bb)k?8jZuZK9vV?cfzEzNbo;wSi76~vO zQw~8DW}mW{Y05OdJ3W%gGXKX7E97VBo>8!R`1vhU3St} zrs7D)dpRrePwbHVI$VTSzl`Rv4=(TiF0ghY-pgCh2D7EItD5Ms6tCH`UXQ{x*8D|1 z>BzbW4THOo7)^`ve3CDz+6xz>qZK9GTJN56^)o#PyFL0vPf+H|{CZYUkBD+g4lFJ( zjHBNXL%RlpX?7@5dpT_Z14xl-VBy`SRvUIW~l;t98U4nJcTzzWmz_Ie^mEqNqTQor_AMiH(O<+9LC#JevtpyLCmAFdSRo*3Ng&PMFSRKY+3Zqplx(L5nk+d`_n}&YlKq`r0rYI z6l!JTQ8ROmKv1k(s#@miqCV>g8A=I$j;xt<^>cB?FRxQmtzjbb^^K@;tLB!Jp7-E{ zRS;ru$TQs`n&2(G3IjdM7pHdr1$I#hACyiUhqum`R{FNO{>vNfB@K z97b>k=W|qLPy~gO*1+adl~(5ak1znO50RjXG5Q4jFa7%Fa;O_1cJP_R7CAdRyhu{u@ zgA?54;I6ay|9juNZ)R#{Ue#2kDpGKgtiAVIy}Q5ux{$g3fK!CnHO{8y4IMqz@WzCy z+069gef`|Ds+q}9SuP``ruO^@nz7V08(w3pNw$t7+|$YVDSX*ZL{D@6bt*P@ys3cR z(4e{xY3D-$ukrVmkDBc2BJzTm$|*@zMELf#P8|_j$KS^G98Er1cWRs>6J|j|#UUmht0o`}B`E(R%I;3d(E5t-lDq%lBsPc@lNXM6J~O0M(l% zE3~+Q{bmt#K(?6zo~a;=6K8sOWBoASpW(d?(x1E4>7kpZ+o)=@<3Dul#^^$s!%MvZ z&?aU}@weIHgS*dBatZ72WF^e3s5E%;7+9jq%EMJ>5fu{$emQ&`rPf@UeRF|4cDKrC zbieRk6gy6Ihn$@r)QC>L_KGC25_`XYSSla~ zqEtQmdAmr4ygGBt^=Wd?!q!ldk|Nc6Qqt`5ZWi|Kl?~;^WuTy-hfF1}8h0mk9tM(y`+}dKP2IF`n1-8aU=JaGPA9Va_JFwd!){px*W5pI^oFVl8C_esLd_xGAYM%L2jwr7D3^`1ItN&?o+us^nqOb#%!c0c z7cW-|@avf_644}=#5THX;!SgwtuBpTQSy~FXSf9){H)E6epqt0Sq=J;>UoWYn^7y7 zNbx>*i;KKWDou|pc{w$xjO}hEX?k1i1kNy;$^QLhd}HX`ubm&Pt+&m@Ut*uz)LhTr z$#JRkN%1`!SUdg$<_(*ha~Y3R_uNU-mRf?_9todUm>nnldbn}*PLZ<|sfKekAmXMA z@J@Q?a*y&8ueVOGug|LJuTP54&&~wNR+<)m;BYzlw6{mSH34Ocyf(g*mYDtW7vHuP zkl|p74w=)+>0E|tFOWPR&rVa>ZQ)hp^&c3%gZbzHp+`Br&s_u6jCQCKa@}d~0A%(R z$}zMrO8@HqVLdYskw|YB2bhiBf`XD8SdlE6uJj_6^7W?Tt~G2O32W?26A|yvpk8sm zmcl&7?oC2D2;f@e7kl)b4^gyEB*v=eItw>uxz*LAn8vmNG7 zY<05g>OaOza{gsZZZkak3l;MF`$zsM5LJz~iGNr_rf+K>^}1jniwRodesBXRb%CK& zx#70^1Jj2K>xc57w!VL`Qw?EJDmZ;xJPLfzEuKZK;#2s8PR)#QB(bV0f zf0ga&mDp`_9o>*$gfIi znqHK)9Dcj#aw!m=!5%bb0-7^`FxY$s*eEz#(m`z@($LR1!ws&9IKxUA8JX9H{^d&~ z&?yxkM;#AJ#`1UnFVZ9L?nsdn>T{PAu(rqBvlOhdS*T9psk->{`Iw(b+m(i^N zBc!C_D6%8OXEpp+z1z7?^nYx9`k1eN`{xg;<_w_;=d@M%x`A0Qu5 zt#rhySwY9Iq+~I0acWYgVvHLbhWm3Z3HP^X#_znY#_|E6XEbU?KtJja_GiHEi0haH zs)ix18yKIC<7>UpfozrEOH8E5qdG^a7YS zxljK}RCu=Q2u5rCiC+o*#z#xbVlkAB+i|L|lyyES&HnfvbQvgq z`La^GnxbORAMSp;ZgidXxgS2X6`2pT2kk)dfHzD zX%O&}bnYmEec0Ih-14=1FfWYeQn8G}{0zg*L8|(`tm3d~0lJgz3~;HZ8U`X_4PdX1 z$9gl?92#e;U8sTbmqV&*rtT4D37=h1z=M{#h}z{icN)M#Pm2f08GO$($`@8_?+p!s zS!U65>xHYUtINh@9gtoc0^9-YF`AQ&OPmoulQCcGZW=O1fj)#N3=c)vKeL5I{r zn?NnbQ_V~BQx<~gUa!uJW3LA}Dea=-H<74<86f^8z zXZd=`avmkb7e1g}I&TnDL~5i;l@yrmUje48`Szg~4#fZhx3a^9Pg0;A zDPkyql#i4rQ^yiDBOyuC+8TI6ZK23wfU^BJ!2A}e8F~u`P7>&=@UmVFCQN}ZMxC55 z74U_Ea*pO3oxf)fD{KiPFyxQ;@OBn5(W4i$1k77CfXP}{yL*T@oOZFbwMfrB`JlLI zz8$*mp7;$7N|lvEpIE1KD-2eEG;7xm72c0=8?m~M-2b!n{{RYk-mWv>b(cT*a!7@N z`ueYn#Q=S1d4ns^Bq1$(*(}s3%gHV;<39}YF@Hk8CbaE-Z{J`xY3I{U(DpDK1M83K zr30jHBw`bj!z9l7NHr|XPmX#^DD>=Hr1chT)j-`cKHf)D9UYxD<5syzQr2E$(9aL1 zMlw6V@I~&JKo#Fm3 z*>W=5EFh?SG8zgJZm-vo4WpPz*Q(oFCEe+whY0wWnIbx2m$bD#eulQfOk zecd~Ly<1eAkQb^7ZoYqsudW+^enO{%xlX=E$dW#5N)ksl{EznE4~NKhVDJOX{~Z>I zp{1qm1AjEhTQZhGtK`2nIx#|nCn*vtwv@(rHx#}aVCEw-3bUb6@ zxm^^&JMjUTt5iRy>37;5(*o?=j=a=lKZ3iZW{s`Cq4Z5{gsEm2W8EL}y$k$H0$%Hy znqJ5B`}P}j9U?zHyZ}#8rqe=C$|V%5IFDKMc+{^}qy0~$1pr@bc0yKN02IhC{s;r2 z5xRV|s(wKknVis(Vxc-GcrJ=Oh5p`bntDmm5KpB#lbOKU0VZm zBBs2M=Yl7GB9@=9!>;Z<;o)(BRE)t|3yoEsjyD6j&W%LbniD)?`r)?ScMU+D8jH(y zX|n}oTl;W!GP|``f3X{fa=d>`zH^ALGhGHi`b{?&aP<*Vxn0bL)}%dRgRb)_q7p)^ z{`E;BM2quVPRM# z!IOZ?$;0CT0|1Wpwc{uH1~8GT)h4`v$dVjj9`8homug+9}CWLhUMsQVDZ6s=qB}g-J%1}pQ=(Kb5m4NFnq1`Qg{0g zkwv!gS8wUjXwi}Gc9li$+^TWolOWrHr zsVUaEInMg?_>c8_BkI>zYoi<>^s}^tf;l2;-{p+WdJ^zC>{7M)9^C#~v6)-dW0Wcl zvM84>1ASs%WtLCtimXmRr!-)VfyoQ0?r*dIe-AvdTFmfUYvTg|p{%+$gwIOVRBVp% z?W-50-9q5L2b(Y0yt?y-m*f=`!brrx;gB_E@=ML0f<7citT0Ix_m&a(rT=O85@j#5 z%7QLfAJ;e;&n05J{0HGAr;OQk^KHg9t+Kpu;`@IDk{-;IWQAu@4@{*2997P9QL6IyhdboE305j5b%cy3jo{%7k4D_UA*;ZCp))l z%YX7p7?YE6TQ+|5bh~Z$O^8HSoWgXI%f9IXsZT&;*=k%R2_X#uh%3wVz~8*t8R#|pz7sg+n2U-El2nIf83KW|-qeX0 z@Z(SM%kei8i;^cTyy+DdAiZhSzP$whOW#f=0DP@x@lXA=p?&qko2Dws-#;)CoOR%< z1+vEk2ln=6>P->ezc*ap+FG%hY1qj7*f&xutD^Fm0=>g*_(`Mq>C+S-C%?D9R6FDfFKf1A)44*ZeSjW#Qf+c#^(L z=dShEc=<2LCYmb1*u;L2`yOtDoS7NrX6squZCHm-$FGSAZCAfzHm7mH{)jvF( zSzQg=wiGdIpx5r>0zm#K{oz+anFYThD^KKsLk#Sid9z^}4c`c#-WvHHuOk?-&a$5# zt2lJb+^bzMvjDY6qt=1ZwFM7sb`0o7O8PHmXE8ua0@$I#mhgZ7oK{fhikYqYC|9fy zGoxBb8=DZ96;1R|zA=cQUo|UlK~3>%?bjCC+wiM{WFt0t(5$Aa3KvbnSX}W8gdUUF zAT`5n>K}8+ctguCsv+s~5{q^3?6>K2JvxIUv9TU&?JBY&D+68;J=`qzqVP;V zN+?p<*VgHY=Dt^8{}Jt$pc1x6q}2x+tG|vc{v4`*)YSQn}FA28)}i`+|>wlGU!6O>Z5QEOT-z= zZ|lKJ`14{Q5t#3pA1mle&iCmzZ2YSazNBx%_%g#fsk(qNOh}@A7u61Pu7YmJSi&4R zMcS!qB?rwql^{+sn>fWwg&845ED?`x^V((jU8yRR(`ckduOd(8{PG%88|>0Z51rcg@UlH;FZ}ok!8=AY z$rJC7_Xt(E8`gd#%_WVhcHFts9z%CMUK^+k1;BN+JHVO%4yqdOatgg{xIEyJ4^P=I z4=I}krG(7>5m|arhC55`SaLjTwmfyj%QJp_y-weZEH+Lc z^(R1)!2@m(-byAhf~`I;l_GaiRHKE$Sv*J{MwOFVBG`(zyfu4aXnY}c)qXm!SO&vw ze4%edDE7IEeP<0iJ5Gho+Be~*!tVJzd9eb;pxX33{?VPDf6ndCHnxA}?I{{v2+7m$ zK0)$G7;Ki`=06@GPPWyfz_C!(*jym|1ZjEu;gqMpSlP6`+=9_ejN2LkR*poBKf(BS zMWgTL*2q#h3wEuL(@8vLWLpVL0@4Gt32h&`y_IOb&l2$r$pP^QM4vAE17_9HRAfhR zbk>~rmd%rQcd=->FjiDeug}p>Q&dVg;}^qM*a zMfT_my0k~?G-Ns#KB^0_(M~NUHNuXl=*^n^2hOxt_wn!_oGEXL+%4G-y71mYd)j40 zPJzYV9?(r+)>hqd{NNAJmX>!pL-Sp3eP=d!Tc26R z_-A2BNUoRDbhK8!v#jw$4tM%h*OGBgK4Qu9QwG^t)_~DwG*up*G#W+I#)XKQX)!XO zPMW8;uw6fimE7+`ysKH2vEf`OTxLm$Z)N4!bOv_V2j-$g#%!|=s9Z>pjKXt5Nhuhi zIMpq57DIZ*imMx<-SS^@laWF{?eWW?Tt~HseC5?1*@Um}&v37>(rU02Y$3j3)QMWY zhA-n_Q=Bg=9G50i?oqXxXxE5_!|AIQ`F@i-5M?#DOd!CH+*bA*^o%?6{-cQpx2}*f6`KGJX@MFuhIZ?SW zaqPkv)cNk+90&afCab^f$F#Ar+%f%!pT)D)!<@=Ugqx=12W)%z|JuVoPi&M^(6#=~ zTwWq#T@~5%iwv^)hRL@?P$}AVZHTpXmowJXUY?=I@$RPsBbB^@4gzcf7s%Jru&&kT z1=e0lYyVN9N`s%*<9b;v(Vt|#rt*6C1+-dEP>cZuC(_&a{nS z9u|VB3WpXg;Qsf7Q@ycuq?*IDp=Q68GOk00AkhR+N?$_B%?1p{n7rbC%qnj}eo-Lz z&r2SbAs=x?pl+L{qc`y{YBf5yg-ywSr)yf?$AwKmuf(x^eZalExo6q(tvP#3Z3G?Q z&IE}ta%O*h6q8R7-skkt3R8-0*gBdHL`S$?oW_nEoEmpbJ%|r}OI6+x!Vrs!UNp>l z_g)~V?~^#cOLHnZE_nqV)d7WEl-P&Dgq&@b(8J;`xUb?REzuU2HjaYL^3i6i<)xoA zN<)ccDQ)kg&0{Ctl*`GDhXcAN99@GiBfhSVVI8}#niB3?N)!9}UrdwAFoWp?!#SLG zAz>wh&wAOX44~bPq(HJ|EAi_Ery0%a2Xz9hkm#nO?VFVZCkxCPpebw2j*ZafPLj``EG$Se)?Z;;=Y82{gqhk7eB(yn+*FR_vgRZ6=!qRG^rQc15qjQ5HOA`q4xskp>~K1rO^Oav zn2oI$iLU7nIeatSm7nW{6QGO|8b9(9d#+%&9zzlqidHApA!%i*A}YR!KN}u~^-%zu zH#T;Tx1AMkHJtfG3xLHI`ggW5x7{t%6BVeVBC8G3nC)>|eKEq6GTSk-OpDtzwq9tG z9%mOg`^qe1H=B8qDbXFjy_r9?U9r@(HR5`BO6LuuXpk6?GPx}OYD&XQW`kg!8O`OO z51H{?#?uLsPQ|0X>FLri&9srCq_xhu8R+5HACv#p==;~tsRZG4c6_cgo)+qE|2K$@ zoss{Xahibsz+zLG+Pt4_kK91AeL_TzC}y^{iS-23*z(pJ6D6kpWdbW0 zgYdbmu{af~?YL@zd%dEen$Zc)zTM6Ff)Zv%n=^Bb-U#NIN(9pFHj~;08A~B~^S+cO zj2cFfb<;M*i2(hyg+_eWGhMn*_oB*n=ovQIBL{+2r{L+l`-sy$Y*)F=}EJud>~NiKI{fP`0mgQQ?0RP@^fwKtEro-~~KoWV>imy8YQ%R3`SGKUrx@OQD z?VuAJtlVi2g>_DZzkTjNL-*Fd1S?9%1gzdL+pm*a`NbP3O3AhBW;vD42ou+2Rb|xc z@YT86u=e;gw8rp>`Y3_7I7_~234WFbY2TH&Cp1^jko})hAibkkOqSwmlCR!R2ZBxg zdjYXl5NB6hL5zFXvvR>Yxo%P>1(>fitD@10QOYmTDVaJ%&8h;ge2FqenWD4anHIc_ zC?`Oy3$ln1bcO`JBP318trn}| zRZt@gW`Ab%jXv!S+DH3TqKTJ*lG!yu@M`+-`uej1t4=iX)CcHVM`=X7_SzP1I6HT! z$)WW3OAT-7-$}lgeD4%&tvOU^+y*u(N{V&{+ze=!Y@);t&!F5+wP=U!H!;ZO;aXwL z-t3|q6(lc*R9#=kvY)@AEcP>lbZ9r3_(9R?OnL7JmH`c8R9oe{+X15LNsLx2r;3J# z6sWN)8I3qql8(ws6)~>L88)7(Y>>2kCaTwb!lxF2g=W_iN@+yA!D>p=ik*{&mi+)d zOUiabZ?In_c28rDL3XlTo#<-p?HNDbY|lSZd8aFYOq9_SJ4e^=it_>o;gT@(&*MZv z6E6}-JPzJvSU6N1Zg-7RBvW9pZ9H8Bm`KIlJ|FI2crolC_h|p@d=k>=N*TFz6;(a- z$s;EkJF#$y>jWIc_e*pfEIQ*(@`4iuP}G~xdIn$ZaunTT72Vh06W_wE3Etmi=U@I9 z8=&)bK+f*x?>Fgy^f~D@HecC71f|kQ(-!Lmi)`NrtYJnd?%al<6gsp=sb|*`pSOgs zrKX*8_s)fTmZFx~2geYd+ec&3lD?Cq54O@0y{rqc!8ZeZ`_t0XS_{e}#xFKKuaS<~ zw3fG_{PP}bc?YcgI1dZ1KTI)#k(}ws;6Kkmhpi@Kns)Un??i%p{&?Xp+FFHQjj^c> ztZM57hn~(pX{9aIXEG0h^I+xI1aK1_u@90If~9G@3MJywzlX2^zNK{$n#5|TSVr3# z7hLk;A4Hhqjjq}As2tIWi7;fPm^3t_@6m27&AysTFbFbm$u% z@jK6If-l=aGQ*hfbA_ieu*Ht^a|$I;OQHpf1&_t?I2KLzbi)Le#l?;jVi)OkX{ilK zDydd*NaM)hmEk^aiP{B9H~U6Wag+98z?l;uPKyQUiRdZHR=34cgojeGqtxMI>IRq@ zaA9kbi*=6KM!n%Cc^}Lq&ujN~vacdiR+g}PBpv62jGRz1b*Ec zYxUv&bdK>1`NB4ITrd(VKsD_%G>-;*U+0>Jp=!=5x9|)}X!z735 zouw(&2&Fac1ceF_aWf3(V&y2Am2Dlzh9v{GUTK>nw@zufm-1jqSR@wXY(wKEQ%Dny zz_mo}bHuXAxC>vr$2TIgTv81TR)`iCkiIvQH5F8AlknXEER9ADMZ%qiX5KJ6bwKO( z`phfLA7wBQyPc7P215j)GR^Kk2J-!#jCY97=+S@Fg0ak_ui7K051d{tFzG zn4J2W?3~1H^tgZ?>d#^Ob|Nu8;hwjSfMW zx%>kYDeh<+wUzjKkPVsZe&jUm{ob0Dch3@1zT3mJ@O%`Iqq`{Httc= z#UAbGkwRnYv(xU%*fs9r!ZJn!y&h~&SfHGxLlm!HW9G7+W}=sC3>8PTq=lnHyE z#A1RTd-Tpb-3aEb%U2YUn84KJ_&&R?F;-2%!ViXIR$6fZ(p)us*7>b_x)23&)A{+) zpUl4_*@k{Hf4&4YD`R(dv&wN{=^6mR?Br`R72CSAt$EzGf*fI}G@GLzXWjg8g+940 z`^o5BEl33~@!dZkjHgSFJtlu1Vg065DNHRl`2KU>Iu98-PN+l!WszRT`1_5 z`g^*y6Q@3G$%PR-xM0dS-{6tzAo+G#vnUElDz0!HX^OiDG zGKGaod2@KV_bc^S;lwI4dEXnzH6Ca|i&pE9wIKSll6@5pA8bXV|Euda7pQzK>u{;d zT)vBC-Wz=5Yas3522)_KB1?F{2ua%^5+AOiHL~pPG*O(RyieM@K41s)bCMrg^5NJQ zd|L!yQ?0nkn~u_U$cppcweYy{M_gYt;lD!~1mi_Qn?{qEOWz{7_N0E|0kq$x4Bsf2 zkvjel?3Xw>^IeI{^NYn`-8`snJzIXf+Y|#?35KMey3qc%yS=uG^#P$Z-YLNt_lTfJ zoT9Jee3CtkLR}LixHM)okTw373%SO$Z8lAHdFi1mduO`BYk5WXn9D&)ZyOeg3 z6EBXc*G)pKvfcGMx40ExZW&&zb{x_FvG3mEm-1M~m^-quzgb+)W;0o|0b2dVCB*-j z5P7MCf?WI*tAiRXkV$~yz)#@ca;>_x-a|7P7*Gv{l$9M=frfaMQVzj`MJK) z!H~&YcV6&IN}HJq6(Y6;@ChXxvkneUa-g6JMq%#k<~5g~hY5!bPX1{BnO!{S2ka9I z>G*rf8j6A9xgC=WKgNC<--a)^-w%^{M%}&vIwavCrK8iW^!weW6^j`P{em}QxW<3tNRsbUr^v=_ds0z%~fOU ziNh^1wC6#IJK=EX4Easan2hNhS-CknK5haI-21vTEJPu*vvCd~;X?VjRN7#8#fp=P z`S7?(85VJa_}vmHx~V~0aTK~=Q9ZgJDsdrP3JH#DE)lPkM63U@1sh)zbmpxYVCWWU?GkHGSwbY921DcKp%HY3kxZ9p+WX znmYni_;22>oL)y6CV@H&;8y{zxNe|sV!mep;5fk4=GGvB9Jc<9OfF+)ICdVE!P)dJDud+F6jjhV#vjzh>FJ2#rj+PaqR^f*{z-G|=1v(rkH8T+ za?ZH{vF`8k(| zZsop#0sdV1;~0ECQ3~|Uq%AG}e8|eaUFEmq=QtPcPS81EDlisyBn?2uUyB)SCE*+O zhfEFw-0#h`OYKZOF0Ll`zTa~-by0>Rs{jHf;OgZEO1ip5J7Q24a@m|s z02R8f!&5?Pc+ll7OW`|fu-Y5J{Tp+yb@OZoV~7mx;d@4|GM&+EWjFWfzQhw*gH<)# z)#$jF#8DLt;5ePFG9Daun?$f!fWGUTk>VrgN)f?p-+KSa%7qkwi*AG5 z2v9igp5MO-MtLt$okVyS%JA^&9~XU(q1V@75R<)VwBT?2pG8GJT!;0B&&#$ago>*| ziOzD=_r#=$afFB?0)zO8p)uV=s1YdhBTKyfeH+i zaqi6=U-aObYwUdqW0lrutG_|vQW#C~jg^nLS(INqWH0~9AM{CWvcLmqF2i7j*ywX^ z=LPDKYYgU+<${70+Mm%I@~L?9@;UNH=$N6t&y{v-a@jevUzHT^`IMcNP)yymxxGH_5I-5_k4>lR6E`URyY?dBs(wSN zma{EsJPZAIQ3uO}(I`*{tm!S^R(O4MvgV1ey#qX)`_W215Pxhtr~!rX<>Qf6y2}M= z$rKLgoz2Y^;(qL)HmO$Q)}pV%-mUjMXMy#9-d8CJ3a|8SC$Hl7X;Me54z%330POU{ zoN{=sk_cy`WVipOWh>X6zew9YbKM-a_`lMijYQE5K9MAeLq>lOzTkPRKa(U=P@4zJabf@te~F(B9o^bW z@Vc3)PMx6jE$ruy{)0s`v-wy0mMwx98Pwj#3VdH!-5_~*(*@InxI-1N zRKs&V&UyS9-dym&;bUg;8tRUT$z7T2ZYY?9bbcWZ=($itb`kOV=G4$wSeh2ZLLOk8 z?iN(6Oq*X6v2o>xy_B;oZf%y?p_$-p8lWdhno9?>|1S2LozkDRu6ze}nIAFor@Wrl(J= z+uVY)d!+#=|D+)Ex)|*JQ@~O%S>${Cl?pDVU(i$xB|mxeC?G+*ZQYNurU$2v4bP86 zF7iXubORM#%nYw(ETkcvTWs}KapEjj&Ur*`lYRP7V+W@xr>vgE>D1no=b^UHXYm?| zi|0V@dAk890N>nMP-!=g?Wm2L2WK) z^h*TeQ7-U~0RDeWgyY-Ts4O(V*nC zKQsJ&ei-Q0s;jGyFSziJPBVCisLNZsBRn1O0lm!SeDI}sa@l5v5j*T(M3b{0`F)Vy z9H4|Qmz>!Elq+*Q-F>?X2sfJel32#UK?%7+MQ~*Z#N>zCE+&}i?ErrTeqRaj3t)G% zX>7D@Ac`^uoB&X#pdbNpAk7n2`Vf#&>Dg%nM)g4E@|21TlQ>>{e>~KF2*c-bz<04l zo6ko8SxSS@mx${Vni7Ytm*6;>=_7m=Htj*eiz;(cv_v&MfY|zGh)I5rq(dN^kEGZ!n=etVl;f|{V3=rh7wFzt{u7lA zq(blhiwmxAxF$NzFt4HlDTEZEZB#@#AqHR(U#x$&v=Hn5Mf_NIG((SPxDzcjl*arq zV-z?i-2L0GCNmiF3#0sRu%{MpZA$K0l*@B|{(g3cT-J0!1xU5KPOocYe}AHkB9fTS_D5 zMf^rsIINk2SZJE z?QCx(5vbz2O4-Vv{RELwNH@Q&ElPX|4Y=>#`18YgQq-t{5L=2Jy=Udu>4+PC?$w_E z>Ye_MyW`}fghEdVxGihchVNYL^*jVJ-*GuZS27-V4jEI1K@);syN=G|+GhrE$LV?$cCY}b2E_88W z<S1{&izs&h7p8#t!|8|3=UX6?7LYEc|$yyu$Ra zPA;#yI*}TaK6q$6k_1cuCTasnG|+TWQHcYsV;^{kaC$a^{{~8t5lbtR`2B=TN+m#o zW(~6P$>o>k=QDm4WNG1}JfAdkv{26;BS3!CY|@|uG^p3_Ftt)}%B-&&K<1{TDbVw- zB}oL;^}2+Ci4=_P{rUR~kV~CzvglTAte#%mG`&_B5pu{Bi|OzBBl|8+T(3Vaq@b+G zVE#fAjGLs^z1!Smc5iaz$|V&7AW{WOu$JewRO{ozJD@sk^SpyIP~8NrA*(6pDLu{7 zkQat}58dNia8E9E8*foms#5<-{F2}D+R3KoBf+R|Ax-xb+%>civx{Rrr_>me9t0jC)gckol=Iwmf6DJLzec5b~NnuwRpB~b=SG3gyPRi=vu>s_nIYBY^7%~!l6re#h##@>oWns znzGv3@M9>M`e!V{4Wby6q#TeDmm5YwvLxJ zfRP4)A56YX-O)+0^>N0-T1M4H+5ERd(0*ZQnO$1?L*2T;8_eH|i{N`mB^HT*Oihh= zTnb|(;aCbAyI)5U_g=ssy6-2$INOp>?h%YT-T6_nreFw`U2QvArQzQ7{uE7 z6fVw=Q*(SfVgLtXrflN#fHcI9wSVTPd!OWdZY31npTAqqJIkxdhfePa|7^N`6*I!!5oH^H zyu8vP-FEZC50>nsbuwOixzWF58|q#D6+Gejfs95ZRUqxbbJ2XhTUj%}wO`;3CVYRQ6oedC1s$*_9NV3T zsdz;m?8`<4mv42w_^^Mx597c@zs8yNe%8h_U2W7?>$FoSUt;|IhNjf&Wt zMr`nY1C9f55KL)M+ou@m*KMu+ng^qIhYE_ajEquCHA{KIpm9 zgh~QiFypclI8_TuD2TbZQf_YMU_YL@@&M2ue8w{9g*L1CG;C!sJKhaaT@}Y$BS~TX zCW5(2KnVW(?%FcRo;zVu( zp;vHD=V_a95cTWkJ(!mE!lny5Zl%&7FTPXG-KvmoV-W_!dh|m^@Wh~^j2UzO0lgPP zETReIpToaMWOje2pgjEGN6ef)!#9vgP?#;V*#;IuGg$b}R5QYBX#{Ks`9LJE^RorIftP zR;gyskRk=(K!9ShE!HPd_D1gBQEndeT7srOkc6acr3E8I zJ9Wvi;K6!(?^_^%R<4PmlAc3koj-fvMX`T>Hmm@WlUi$_PC-vCL|T{#uFd~3dC98J zy(HIvnRvx(7I%icb)Wg+g((GA`U#%Ze+4g%`>Vyag!&)?TbubuwNOxNT@%S|SCo}e znv7E^iq9I~9$6G&Af)J&lLrad6z6kLLM6CAkj)$BBrj_j@1ZR|kt@!h4r9fu14RHz zWP!zZoH72*;>;MgvtCDom6Gf<*^^|i@<3M&NU;^wCp7_c^yCqy7Z9k)iEigp1o1ii z0EngKYDx0{8DfbO@>z$1kc7*{y^Zg?R(VP+{*~r}Rj4qnTG*?}qpPImUP%>El8LU(Jr^#s9rAgR>Zxkx!PUa95j{d5jMk{1Vk; zI}siIG`KpwzZ7HCC5HI=`1lIeE%jqU4=b8(=S^c8kw52;+sbTY|CPV^5x8WSylD7* zos;#{t`+Y;a0AG)W3$MeVIk#gJfSXga&rcBv4AoL{>+Xtrfrw$3P z(`hd;Q!x@tP0mN;j9wGy_G53zgj!(Kd#+dm$ zH?Otx`LO@TGe=h1vL$fBL$-*YKPfrV;Yt*@BqXR`tDEAC`Q_<{ao+F;e7iT+x1K&f zG~b@rM1OU9+0${evP~I^V=<{vTomBMmDa)#`ouE`L){2Gdv zoly#F@3NvlK#k%LHqkShST#K=*<%ibo#;STDfwer?(daAzmL7lb5gX6ta0M}x#HF5 z8iG0NDHbPJuR70CpyW@4WqWQgU9aQ@@igPNtRIBapTWP0?ZxYncQzMm9MBw_VfV^C zalk{1(Wvp6`UYg@AR$(t8csi(;zEYJPvp(`@ckn~N`0;gotYSm)Pmph_Omb1BzB>k zc&aM>LFw(LQRDOj=@$>8W^H)L(<2VD#-qYYv56)WiQfS36XYZ_>TI!nl?t>s`BJfp zu`jQw>x+(rN%G1;9N$-1;agzvpRA=^MvY~&b)Uf}yV1FMN-7*Nw}g?$xRKWh&G_d6 zg-@)d%U)tHuJyvKyZUkHv^CozBcvw9Dp1iA^Ft{IW(_Zb%wBq6J+o9~0QXgs42pv@ zLBMm9Dg@#&1wHXTUsS|re4cZId72&;vk)2k6t7hxDmqjSRqO)|=+7=jk4GhXM*wp7 z^?!Jb2$TqtV0`(CfGF>&u>{_xe^DRC!xM=rExuKgT($$U#X+`@$ndQh*GrvVR|Y1H zhb!Jwn7daJXRId2HGtdwZ)?KkymQr}W1x2=A0#ggO^PFzTgd~_NuXAAm^9H&W8f0Y zEk2#5#UG#>a5BWN1G(O<77R+wf5(?$kTeZPX%P-{N17FcH72JLb-Yo#&b!y=wRVf( z;ZcX91imsSX>=@!Zw8wgvN}`^`@Hy|YYZeC((L(CXcKme2H-;AgPF$GG~o@1;xYmg z2Vhj+ha6vif?VGBCb4e(jTE@zL`HLPW}H|GZ*aidT+I_r`}Qm4orZ_NKHu)jt^SWx zvs0NS3d+C|YDXyQN9MsWpc{FLzm?p<=sk1zZLFiy zj*-o$9R;=%eqPdwb!Eh9VYD&09)UA5U~zdJ;dX7M&DT3}b@Z(hd~CC713`jNRh3)_I^{pj_Q1S^ zglZD%I&h%wS6-9yz(dY#ImUqo3?k>tyt*MJpCbvY&E7k+fe|0e`U@3hk}38hAd=Gv*=$+yRX*!ln$b|LNUxm1Rqj(#8E^RhMATlHf{JOKNDL@C(+YJ5l?xPgn* zuPf~~pBVMkhlYBegFDd_LKpZl45LgdHl*L?BDLZ_{^veB0S$kpC$p#R@9OYZct0U# z=znk5xBQmOb)33S0D52NSLaZ?#Tm$SRq>>uL}R;qx*~^^P8aEV;3xN$oj7^Qbgq!{ zWq+Sp$`B6(Sf3DyaJj*VvVxzbOTC2oT#(IF%-4;t*eCaNwMF=({5Ze@B9oAWBje~v zOmiY3yN_0QzX0!EK2Q6G66TV>Qf}JRo;VyVT9}GH)ejR%rHNMvix-D-c{>r`gpg2h z_KE&@L@$4St-AzcCctXup_C_;5-oVTisbKZvB&$nF&t{)=pj?lFP%HwbMV8;-Fqjd ziZA_y=!LV^7QrazJ?0Xc#+*iF!)!OU0$77cTe?{{NmTz14F^^P4>uXqi&ua(xhAB( zns>FqH|?Gt4{OWDjMEC?<$Dc7O7{B=fmWnEJ9KCBwCwOYM;~9C3)!}BLD~enG$VCL zPo0IYxHT9jO-#eSJ$BQsp;sl06Q1UkQ_cA*qV%W*(-+lD%ip6Y`6=<9__!}TX5{wmxFVYY_C%WKzK>&MvBH@QWO zZydH`BK^uLfNPP~d#o@`j94hz2;aj|j1P3og;mIq_;0M8WlWvj*XFCVXp6fQcXw-X zcPQ@e?$Q=_cPs8t+@ZL;ySux?Y@R21=l_l*^I;M~n$mL4xwovf*Shxay80>k@qa!N z3>Y8g%2{HU8eBd|srBu6Emo1=djXL0k%a13Zxn>#fMEwIY4Qc@ZILZcn!~|%VTl(O z&cRN zcsG(qcs3YeihPNzUc&#L3~U6gPh4)3SFe*ArphL7nTnST^m2}mp??5TIZooKP;@*w z_5MC(JdPf?mz4iNADlH7F6T&9j+JHkEHut+LoNzVI)9uon?w1W=C3mQsoIsKy~=*S zu38${B$vK~Sir(!?R{EW$FfgLpWGMETVAyFe(O$>uq@qL{b&IQCI&rYwj?BC?GhB{ z`K9!Rb4dTXoxN!l;LVnivwGxwNNGxT)_;38!sr=#3bC{35&iRR?(XumxTM_stpeU6 z+rklpq*v0^h#xZO58lNRLRvcc6S!kzS=Cq@{SG<4pGW(6OK-N?A#G538dVU(sE7K` zi-h~WY?l}p=L=W6btTfAOIq<%gNs-@SXx42G*u4JmvGRwK}C9)m4M>4N3WJUkBFgX zIm~=@ee}C?et_&+hPUtHi3`3nr+@o{0#EvwEMh|`XlwC%)5aJRLV^ft+73&aj_1DY z8EqUy>}~Zoq{f|RX$Zs%xZgF0tt;^&l7j^x{EVJ>KQMl(wq00k%Ws8~be@xamrvSk z^}})4tzC1-#eY)Fd|WVo%!IH+RYzB&iD*1W9HV)P*{#_8o!a8g`T3uT>GZ*7yXDe< z43gfo)`ox0o|LY4K!3gc3LDpQxKaR-xACh!@}o7@CBmG?D&$9KuJPkqlE$LCT%XQpRB1K0>7QanOMwk&W_zyL@Zm} zjp%z)p$~8)dnr$Ax}1O=;aY%`-CO;6B{F$pY;Qkja@vc6_G>eDl8YGRtcqODAc8mp zkk$)~>`=Xgpp8TQlMRpnGgyONm}{_|?1{Z6zb+6?^HcYNAt?*0v<3A$L7ZPX9N*aZ zD{^&}f=zPUrzHw&f_|>d`s5tnOP1GMlb-kO8zmcW{Y8@61&H?|4HI1%IcAf~ix!97 zorg6FHB4rBD|?2CX}=+pPI(#0r7?=KQngs)b80d``Pi`o-4y(PLiY;R=vF*ggC$Y= zH<}XIaaZdzr?#b6UfpwOfWdKmWhRdNUdcp^_B(1gLoSpTmjzXU7(ej+I&B3;hzR00< z5Nul*dQz^q%bTis)d^(1bh5?_3mh3_0Er@ z1FBuI{&iW#${lC~8M}?v`N5XFt$p+M0@nG@-hh1k0p(z!VRn=Ce-O!Nbdy*dJ$R}y1sstlluq?8S}{;uc)c4P0*UC&itB7bTK*VKgnqQkujkDJ)jnj zCoAy*1Z<)Z&L23oHCA2Yy&{g7hfn@!lZa@nxpaJ@@nI^=u>EH_m9*gMQ;~*_ z?&L4EU>EzG!2~3i=6T8UAewb^Zb0U%u?N?eK6?p;WeyJ$G^ATBtlI+!(VnTL&GV;Y z;6)uRshC>;x${X==r7xk zducK7QdZ!o1HSIAlK(0t3n>n211X3$WpBHh!jF8ryCNwh9(*fdxY4!4^v-Fqpc+2| zOP1V5YDwp0nBG+wRd%)wqYzG&x=2%O*u2OoDKIJIqR!M9c>xjgoTnlK4<&9PO}?EY!N+!m^FVhIeOvY+qs=&|pt zNtZFE4uHJrb(^;JMonr-XQL*NPil#K`<4m|+l)lh5)d5CfcWYENIMhAtVYMWI60%R zJYn&Cj5FT%1h=6%&ob{p;bfiLqA~3-V40^oGmP`AMyk1*`}3yea|m$uXu-TLqka!o zTjz*sP}yKz%AXok&21p>Vn|mi_`U*tJ3CV6x0L=`rAhMY3MccgQBZ)qPZuW?40B-c z?Z#fNV14C=QAxU$ze8FOwdW`7W(yZz2%}T>-LuP)-Q&97y4dKfgDBe`B~&Us4-n7| zaP>4350E5@&6b;OYQer@a?x*$p4v?zK{?T@J9PZ)PL=U#Q8RY}40uF}d8;0M1}Rjo zWJ;GA^XVR@u|lC{Z$DmjqEq(}-`%kck>(N7o}q6T-5fuIQ(-vDwNa7F{P zl7~i47{RwxRK-9krbCYoJQUu&;k$A301b$&tdBtH1cXw+1k8*X+)h5deSmrIck?(t zEVuGUPFXorG&=+Mhf(JSm5)V6V;=7^Pmo=Kvtm(q_Z}Rn1IrOSVbUacNrapR+*g zhE9UA_@tD@%Eow_dgL0?4+NNX^P{%;1%c!0%$-9vAe7xXw*?!D4rLjbrhI8>i2DS7 zZF!7x+bp)ZEoo6Ws8mZDD(+l%?;&>18g`*zR^V!!6uDF*CsQ|-E`LZcs$w7q)Q}2%s+-9oP`un;>all(<~jk8Z^{W zKc=2~RJ=dY6m?*pojA`opjTU*1@MbLhBIZGmKjwrm=9&0`fb6!3|}_{hf|Y2gXgr9 zrs$&4QvndC*_2a(PAR>u0dio*$k?1OXe()li9d`Q+viP2th`DamNHevbY{i`oEyAy zW&@x@`J6^d!u~+lm`E zA)^lUS3YjM$LD!yRRL~g{~?`=Sa$wL-8`pwB00e|}py&m>2#kl9|GT`2 zu0@S~9`8%@ts8e=zZe}_7fq@J5m*}UM^(jol4?-4L%)BlmDHO{hWwVM8Nyu?eY`k$ z0T;rL;1f+-tYIjg)i=JaHEtM{JKUPV)agy0#GUj-ms@3W!%eR{(S8l`ZU+q|o!y=5 z0=8}!?qZyQ@vGEtPc`GaE-_)qbL)MB*p1<>JAG!jw2PI?enjRcAE2aBr0VIkgA9^= z^>!H-tD@P}^v)isdA|B>lSVhFU1Vlgg?!iaOwxQffZsDQjEqZ*8(TX5bOP{dptyVU z;DJIN-whhe8!3)FS;fWJ#gcxKg`2=Nr5mW6a+-?YidFl7g#%9PAANqk__l3(ULC)% zDgHMs8O@Ztgu6QI`4+SF#SA2HzWcS9+THBFTyfceEiWHk0ZiMPZw(N^-R;uhZW@m( zT9kf&)<*k%IEW7)c5%^uS5<{P--SK1yzs0Rr!jkbd%GBRR#$N!!{r8ZZ+F&*tym8( zE-x!C`Z|l0$_Ni{3{_Ov93BWgFJ>}gXECsGcbOLsU!y?99(}sxTbZYq(7gRHsiA#{$@GcDj&;3DXpK` zU-g^jPsS8U4rQztzVz3zJYpi`-&ip4R&Xn(*6?;hso$YWl7xb4;XP9wd-tdj&ThfBa!gY9+M1>fUJXZ1h3l|C{CGA0WE0bKwGG zi{B6RANn-66%C+6Fk5(_0>p=qo6S^L$P`JxivHfUPUzaJLuldOX$Xgp64p*awry>k1z!rNmD}@WP3Q;zp^8ZH<$Q*4GX{C1>=)-LkVAzy@5rmz*rSwJ z5>sLz&Z-~^4&LUsd*S0A;nSr432Xfw*Bbsws;66Pq+6>ehz9AmtCIH~B+N?EhJdGP zlVr2eb0|ljVwqWU3{AC~64Deud{DGXcu=pCF<6VDq>KjcGf5iZ1A|pBXqs{$wz%0V zyae>D!Px!~7PW35j)@ub7+!ijn5pyofLj{}c#r@Av$MOqdFaT!^5R?6s`Y|*(cT^F z1j46x0y0YFdhnX=RX8!Coj~ky?&3FAUEDdJ z=9lHZfA|M5N~ivp$3~^ z^H8b|9Cn`56$rd*{z{vYUzysI2Fech%#DN9O8gM}~c$sFi_gs#P)(qq# zYrBRT8+(O{9cJJ2Cqb`o-D>9cAgFYv<@ptgm||c2=4LinoDxYjXStpa&@X7bl6aoD zyE~O?^JS6ezpo^}vrvEM*P@{!%c-sP2MCHzo%Hnd&}*KD=u1pyIbcvX#ayK#0h|(F zJ$OE!Sw8Hf-*=_ZTan{?=aU83u|{&()(6Rvr=Z);zFGK2bMF$CCbyjW_iLYu1hYG{ ziinrKQZRiXY&;{x#a@T9zcL1*^4!I0gv==9UsRkn)U$Qi4<|kkH*G(ATBNl=r(^V{ z$elv$K!P&OQvbZ9Iao--mAw)NEV{K#5te&}`u zE(CW!FQRn=!uoA_WC{F2MU^bK0SO1zi%~Jw_Dt z;=&a_sWe=k9pnrQX^l+79(pLq$hNwe3ST>|4_>pzM2AYtd`Zg&jcVz_$$>N$KVTLK z0E9*+i2_33QD@m=XPjiV22Iz%it5y^IbZj~{Tit?ocj1M{QMLK+!lc$TAD|7=zfX1 z06>)&t?L5iWWb4ZX^UD%ga7MTfuBGD<%EH| z_#atgMBLsGqI~!(nO_z(>8~}-G~s-JDDkVzN9Q;1?m6Gxe?Z?m|NTx5Tc~-;LKJ&^ z*w`9h&op>Jv)NlUa4XV26%qYC0GVfWS*(%-6*_G-L}4|GcjP<$(k7~=Ms8Pzl~7?a zNb$wWL`f0#;Svi|q>9i*gI_-%WWUhOinRwX!VB;DlLx7b1Bv(b8~g+h%?_3|NZ+0F z_q*3&M-%~u>tv|Y(n2ER{*{AD^JgG00w=dMV~-QP0cH_ zQo>;wl7)kXrT55^L`p#;VVX3(-@a=H$VlJ@-s9t2fDr@jd=xPh$=skuPE4R60RlX; z>V@;#xu~$uIXSHG)}k5DC+wWLZh$!S zO$G@hkU8ellbanD!`)`|qhoUbl-#v{Ip%i9C?Fu<#Q86LCU$9wdmu*`io*;4EMdxs zvCKS0QVeJ_v}svch4DUrEmj;~UJe79eqt1#sVU*$KyMTQ4uW!Qgg$yWfGx!bLqI`8 zqd~#QsH+RGVuc2LeetaF`oyyd@WlS*<&p6}HXIrN8OYA@8fYpZ@JL7^rDpZ$5ny}; zv0MI(v;sMC3NXzDEogmUU5KjbHWqe#iF+$bEB=@5>t8ln z1CA#53wtu&)K}Waw><3^hiu#4|etrh* zNj00cXuxTzo=KFA^CNx#XM{OwaM7>32sgy;iQHdr_%&^UL}ewv+xLGYVE!6BHqW6Y zn;MELzgo4>G+Gw?r?=a;uQR82S>0}cPohsAVL-YT|5t_oyNf6R_)Wl^5uBG_5R5?u zZ=9|l!+^`Rw2VxkV&S*gm`YuZmb=9GG;_jYjSk$Y@o_(Z@&a75?Cef?1x2k2<=1~c zm1e(Rv9Z?$@;vaJ9vujBNl)&Qj!*u6IwmF|Ih&2rPYA(m$p&g-*W=*}a%TavrAaBr=Np48aYBOK`=a=exanzuPOodaiN&D%lZa?`F?A~BPdU_E zXq!{278}dYr=rzE#QnvZn-aq7LX#q%#1x9TUwdRB(X-FjG%%-GHu`uV7oc)x8kY&TXy2raS@BS+z3AK!~#dlhD?75^-o|IY1IZp?DnjJ%y-W0&0#Jqg; znZ?;*QJQ>d!m?#_-a!Vl^ciP_IZy27%a3*=O? zMqcFe!g8p|nV3`-b^5bbAakE{{=M_QB9^8p60E=Dn?uCml}jgOpd6}GG%fNtRIho# z1>1sS<=x#~t;wcMpQu<~0-F~gcM}349N2G4nhb~-4CGJeFpo#1HG|qChN}-bfR8)a zoj@qRu~}pRCijV}>(tu!SL#@tPVWdwDXo4_n&?(1{1=>Y_@o@?AE!~_iwcoQZ{R0; z)L^j<#snDULJkfZ-hlf#f-*9%K~R9)7AjUe1&TpgfXn^+v;8H-`Lnr|Gm|rJ4AfBo zh(0>Hij`^wcYDPdoFlyTr@lU6=aQXLSs93`Qr8ulo${Wqj-Sq#4d?t%e}9&F=EX;^ z*gZ>vFQro%RTc~Pdw{u21t^(yLGwN$&(*h;Hx17B11zB2s{)TarHI6oJ}q*<<6wnKIm>2Jb4pPQ8hSnXk>dU~5@*?`~P zp+zgLEE77J=mki51?69~=QsDdb`K1uiXZ?VwMfIAX;VKNmL=jyrP#L0BkD)fqac~ zNjME4G-IihgEdNDw7!4_`)YPp8K92A;)9Z+pM zZobC{Zs8%4g}STA=SqLHG$@x#2u0)-V?m+|#AE}hi}AFX`jni__?0S5CNbn!eCswX z-7hOaOXu@-ynJw{Gn&|0xF7G0O1(^5f`p7a8={RXS%V`H0z#UjM;bWChlt8?gSz|% zhR|D;81~j(Aec1l;37r_^<106fN(5jKe8fmvyQNpwla(=HD!z3@#(JK*31Ov?O&t$ zb_*I$fAz^kU(Z~!A)(pOn!=F&(8$i7G1AR$ir@%Dr5jd>sa`%^CmFvh{4c>B(7pl9 zU7I#KAVOnWs!5~{c74G05Y^S?5{si2j6i0@fPD|g0rDJT78bv;F$C}+0A2q*^p=c< zhF~ZYCX!D^8!zx6KXqyZ!d}3>v)NqpdAVKm@UYF(r8S~kwWU?22M^^_wxyCV&xqN; z#bclf?E3ywCn#WTEz=g?A1nBvedrDjr6oRcEQAB~Er+%N{mv3bI-F(vVt+x>>HJ$c%Bh`G|*V#eSO1F440upi8e^LMdd~ za#9tHBp`AV`N@YjPrkrAFHQL4pI-*SoFk|IP44uCW#0**JwPZFbD27k+lrB693IA3 zXP-AEWaCr_GZPesai2Gq&##hb5MUs5E2M~j{fC=rQ-EvmOEHT0jdd70wv;WZ`u>&G zRt#*9ZqYhfyjpDY6Yi!vyS zuXHQ(wmlNvd_Zsh%}=nx2EFw^y$tEI@7Rk+sMp>Zv{(Grj!j@siaP~)N&=uch&x;N z(d)i%4o|a8i8~5z?Cn5>J2^_Qyy;i|WW6XmF94ro5RG29C5j2FU@#F^_m8A004TOZ zJcK13#{(Dax_Asg>9MX3z^|2eEfjmZC7MM-x3xVQGvw>RV6+=Co>Zi90dP4YIZ!mb zw0(MDK-VYRk%rHFWb|yxz*j9Qu3VCq{p|-yT~)duvyh)JilQxX((iKxb-8x%&^8o5 zPai`;yo`eom=&C2j`<>TvfApPmI@jnglIWHOc0Rzt&a*Ao%X$_YnL6q?5wG1TybF} zUzM!cx9vj8h-7=J{&gH(1G*nK4`{Xi2qsqeaogx7K>@cH4YR=;|6KD`$~q zo#QMUR`q+d4YbV@xERFzWyizI%Mn1KH_e!V_+696Fu1nT3&1P?bkm7Hn^z}9a>Pkr zM(xvmM+WTv{>bJ<5}87I%5nv8T?CSkAiuWkPk<2l_dg>jBKU;-fbe!k(EWR}WHy_# zJ}=Pi{K9cYL)46Yx2>o*1K-dhM}m!JYX;@it03*8%-$PTP0vXH&{cChR9M%j*KQQQ zaQb!5_fc*fscI>>>WTdfb-}OfH}&{dR;R2pQJ#FGtATrtM8cGJG%aqGnSuW+7Rvsl zXk8;Fgzr?9Htpq{2C+%Rn`r;OdoY%BdATchxAKn%5R|aMuW7qH)AAbfRqXb(-b`db zYXQ^C%E6)36yDRz0KeYn zba;%E@%s-yh`+uP|MD@yjeC2?f5+8w(w0ME*~LOZ{lN&1uG(SRF+-YEDW2Xfx^Fr` zF<)O}?F&w?M{IyK10fkv2QqP5o@qR9epey~Y872*YGBC4)Y09X_+jouBCWo7JGzx^ zZG}l=d)-#bUcRpDJiLWi!ca5<^nDmdsnRT+0TYWmK5o? z46pzU=l>}qpWCIZAVhOWjjLZK*Ub?fl%rr$$Fgp{MYtrGNM;KD-&#Fk z)5!E|T^l+RJ{SzKFN?^U2sVzPj>2dN&?72{%FDIpjeK>~?+EY}nJjc2+TNiIhpg*` zK-XLsKK~&fqN8*F6%*iNP>F&5l?=S|kN732wY%?k4(QOv5R6pH#K8N8`ttL06LQE5 ziD9NZ=|`b2>)2yNa^y%0$nKA_lXtswE*+z=HH-dNKseOsvMK_%CP<5g3 zyus9yCM&Iw#`IOo(|=>f4@r?lw}_~~YYv&pE{Lc0JmLh&;f7~Lf7TTj6jv9LXP0}P z@F=rOoB7eOJ5mcK2z{51Fm>jVy{~~(w?gT&OLdMjNyXvjK$4E`{8LFk22+gAG@WH& z$k`hPI+RKS1l(-Q5BU&=RbC}x8_(RH{&rJvYdMi7OrCt z(OS>Fvko#>9`t%iR=X!hG_#H&(JGb%4 zChZnu5!wvpYfcOyTsChzCMOPIt+MKp5|oYOCk)hDmrmixOmr4twn!F-Hfqu1ndr+U z{R;&U9T;)ADC{+inptrD4fdAZl9be* zf3je&r+KI+o?#qFFw^C24#;}9sNjEgx4LW5F}~1~c`82)DK)5{zmLIg}gtBt7e3t~|dn8r40ITXK z<&XH(3M#=rKM-fV%=_ju7><1`dY3)&IrU>LNe9k~1L&ENMxDm?)~sq;9%DM&C=^*O zs`n*L_Nd)K-HZONmBH9Hr^YeCZSyO1;s2z45aT8t)*tL+GzB~Gc1f?q!B%o^kZS;O)(6y;Ey7O8@ z6cWFg-Al0Z7bk}?oeOc!jFNLk0)`*hr0VexijM!{_UV2*i?o&!kLeKCvsmNJAsQf3 zj2n5*tE5L=7e8m8n+L{3)$5<^(kEwV6D$0s;=Q;|`>tc^)GUBzz~nMUN>_e*A~Gq; zzO(=R&aSmiS-k$->Up@v9_EjsSl?nJd`LN5q8vTCzNg#T?q5W%D5MH*YAwbCd!McT zS_kT?Gl`RxMaF4kS*JC^yuGIUV|%~gM2xCRNM;{^W#5pucuj0RnY3ffCg8SPeLTapWpBrd)%ei2ALq8P+Ad^Wx3TsW ztnOO;OU=JY-p3H2^%Hnfgwj;znDYf54r+=CtLA|dbj16`qZAVg;y>Ym5OYKYT zZ_AP$coZQ6|26Uqk&;t7w$IUU>tw{6k&?a6(X)u@(uwWRDnh#tvj$Dv1X^qiXDuRm zyOwCPJ*d3}?do*JESbHMhoVimWwg|@$h_2$KYH8+oaalx8jQ1Wsa zI&E1>!Cs=0JFefSeN;qOm*Mg<#JhcU$C^5>!4sF|@DMIBQPt^oayq|+8+);|urNsu zS%HAL5jI4kR?UK(qR{&4YVbWal#h{_NltNb%6OGKw4o~}4tZgLHG9e{(iqW7cJs>Q zh&|Tp2kexT#>XRiI2`uC?sZ^;BKLinb|d*E^jPakn@n^Jk`kT=yx(|SkwmZ{7s#Is zc2t^fOx3-7C0?c~AMEp4SD;vyo`vHlNsiuG zQ$pQ9kAK6-w>64c<>{Xq*@h+$2Zbu7|7I-BG1q)YgKocM=k+E;MFcep=H_aw8-#W# zY!%0(Iczj%jUE-iCu2>KluRumM1m5y_X9|x%x)7V6?wp=^X*>GE-!EqUREJQNUy8& z8LzT`=YhlLTr%|BNJ9veB7-zzsG@$Zy3gyO) zJ2GABu%`E3U43!%a68u7f+tC`P#}L#6}199+`a-6&eYNAYFE!$n`BADXAgpl1SVLC z%E@UKn>~3VjpJ;h;bzGVL? zoO8@6w5Jb25gVY$BwA*yRdTSKYkK&;t`Ol~(iD*DznvD|&zomkTW@eU2I4ZC?n7u} zBeS)pPuy$w%kI7zZEkCbYkr5vmv>5cxh#-AZBC6EIZ{aj#We$lx7`#*CMJTJlNpmn zPJ60hWftvmj4V}JWh$(;IWZFxNWWTN!3mLgK33pb7i0tuE4qcw>hTs%YE{fSt)2QQ z*Q|_B`#)5Ie+mGEy2B%p8vHBJ1xUDlw?a%9sJ4X!Hj5%%2PpTA3ibTfsB zY=bDCOq}*yUjZ|OE7K7#sJ~{@jzdbKe=ByQVRpJ~y6<#(#ban%_!Iy6{_v2i)4#}G#uQ^wi_i$2jnrN$jaV4AgR6(1X` zxa91Jj#8Ka47G4PcDSLS&y>K-Dkv}oT{E-`m!sx=H~>xXQ_R&p%d%-({pjg(NOceZ zX;;bNbe0qr86DjdYt9kxIiB3?Q8&E=MrCYju4^D+y!LP^DYFb0Kz}Apr=mXN0_?(v z<@+Os&)P}}pihT2Has=C7^0Y|{ru!rq*3wnrj}KW8g=<`Xk3YMOM6&`6>BTz`|@8S z`c=EDvjv9b4kN};wE6C|qO9@)jEY|G?)A-F&)c`reWsQVqgAM7H+@K=$Xy#cI{in4 zU}KySwGh%3x$E0hfwmyVf~?3f-k`y^)_)JuZbq~AurQ9TF5Bzh#`ofaBBJgJ5mqOS z^L($b{lmJu=59`g)83qPq9y_Vs*cXi@{KDW0%pz+pRl!$o4ulAkfYM#_~hiE!HmSE zdJb-Da}y1Oo~<`0iBVtzu9ks7HPt5?#O84Dj*7|fnmZN)QcmL|l@DhXovkqDScP@ypdixZV^ z?gZ1bqjQ&CDMX~0KmeD4`jSG17N0o9uwwgM{7QmSBtiIB$?4mJKwrf8 z2p&;j7Ppw}SEqo6FL7*~^-T|5C=SOr5o>(sy4l9tsrwtZW}~#Jz?ii0b-T!zh@ZpT z>zSKrt5$YrN3Ncr?;c)0rURDfsL=!=@tlZ=WLxTIDRXt~BxXwzE~=QUEPnaN%y=+? zhl6+JSexypnwV>7yp#iO9l^K#l~ZU8WQ-t;p-@=LKW}As9(O2#LoN z79Fj}{bV=kU%{XboppT&ku$MFr!W2uHO&jZ?4#p8I8ZSqWBzF2u8l1Oz^n44kU^<2RBe>&@&wqGE&_JjYiN;tBK-&v%#5jLb|G z28XB*$IqA3+r@^@Kl#K-DORUcw-7(RGd45JXl{lF#z<=dHQ<;Hyah44rIO!i%}w+U zByf3wsUxBcGT-fijddx-v5AH0@a*jD@{Le|SCscBh#<^=%BMltHC2N?I|l|E;t8A) zTC_b!T=!%&G(bj&Y#L0YvZPf*(;U+q)fW&Jw7LC!2A%4*CIdK9j?~J*viTdD&yOuP zNiBDfi2Y(@WYjC^LTOv2o>v4vWcIDTPs4CLZ)^|(SQ4O4DN!11Ei?LshDw4!&I`tU zgk>=e?CzjBI=cGTLJC+9q5AL!^fI2+o4y=%YPn&=j}7}ox)f6-rdu(v8YEYZqxZwb zM(uwmMmHGH(xm^;hjlGcX%a;OVzLDEI5B5&_Rd%&n7s&3RcQQirEtSs%GtgS zJnv2V#^U9}wFp4H(GCMBe@SmLpEKeG;L&W6ut1V4!R6 z{RoZS%v zAIJSzUY#UCY%rWU1aJ^yAot0m_3U_5QJwea{}LZ8IEM|#oBr9NCTXso9Y~U?q64)JH&MZVc9*XprD4YnzPQ;VH29~wdgM|zhO!Uvfm-f zXq1M1#rt6~lDG*PQXst-bin}AQapto-mCS;{Cey9B|z`7IhRLT5eCbq|Hb|I>bE?3 zJeMg%9oy`|5-1qEURQWN;}c7f3+2n}Fk+mzxM$^NN2aFs6(ulaWEQ*vyB#t{h;LDm z9U}(Qs+C>`y|xw4JaBfV^~;3*F*oM|B0Jlx@<2SD4?06mc%+R3O2ySx=+1M9V7q^r zz?YL&zkU%3i7#ASOe)8*R2)iGE>sc1-l!hWP(YEM%&E|dY1s^f;AWh?{$%jk%w0M| zsXv*yp}n|pzn{}Bg!p~DSKsE6Odr$gZGe;-=?|?wA7&z_PE*X!Atd$-D7!^cVd$kN z%2Y7+$2%_#^C`-gT61(t}OX}3%pPC>M;<`$0h&#!|eWsG)d1S>HJb^w0`~R`V z4T0zRcOHYK1!c44x}G2)00o!ZR>T~W`y5yW_dY8 z+ydZ5nYIbW!dl2uUf5-rZCsK5krRNizT5rHn8{H0i! zUYqyXhxePP4FZNTjQY#AYJKtiZj9)HD36i|eTH~*%>Fk<_YoBOH~ZJk)i`d4iyJBk z-IX}+rOhO?1Cll>Bk4>pM)%PYs--@j+B2RE>apw!4^+q{>SZ&|_Fc`vIZSg{ z-3{?%C!j5sF>tZEzs~6z-aOokYqoI)`M_CmcJv%^ggG@{Z#cQTzAhofw#dU1TrwBI zMT~M#Pak?ysae)jL2JwFt-*v&OV8^M9?xU43)CzOIa2sj20<2{JFTwDbtY8EF_U)o z_GMa6ob+Skq&>syx2RA4pjQegtn(HrQW_d?$26*vAhHAmK!VvEc2Ox0tOJ3^77*!` zJB=1UUJil1=n>cwLLr4GNBawA26P!PVi+A;NrR`?zsRDHKD>>oNDOmmxR1&Idu{c@ z@%krEHBlEAjH;^3hYJ!Oz~(a+=7sv2EqewKS1&0spd~wlgA6<>CI=;Rv7(nsaZYx2 zOl)km(HF{AoUrs~h|`P=H&8`EsYqB@I1qD-DaD!Od06LpJa_tFP50$O|M^!dEpcWM z9X<0Mw-tE`q`DjPT)ezpwfscRJ3QW=MW!_w7gug;eMjr^8jYzqjJL#9KSj#kFC=n? z+=@gcpnUgU{2U~k&Yv#*`z!TE*RLTnAxjb7Vy4&d(I(gsrsP-2w^^}^VN~{KdEIkn z%)x?O(3a{yCQSmkEf_IKNqdA!$3ey_2s)nu0S-kd(5=$(AVW78P7Ga4{i>ouuMvjo zHToBTyGY3ggi5EQQepxIQM@!tNk}+Mds^n_IRKCKcTv$hfC0@As0mMqkW@>Cjgg(? zu{?f99E}o{nkonmPhV;I0lVtfnazn42Vk(#(RV=_LyQEqYEuXN0k;NgmbaT-kN7i3 z!{d?$+vY6Qm(~;6Dv1uD6iMwFy!v7@0BICW4yxO0^um}7+z`|>K>k;E zYEW(_SiUAsn0Rr+t6k6e^Az?3V*}ckOe!>;6hC4Zljn<7YW}KVrh*AsWvsRB88)S` zMjOn%1d>uet?AvJR#pf)CVLZh6E|d4eM_l$e!G@~0@p8QRT$!^2=K@TQQ9Mkg8ajR)+>36`ER{tL3$sNm`I;BP-klZ4&%NT70SgZqM}e_ zJ;R;*m+8~Hq?7}OZQio-1*^cat_X#mVN8ZR8q5dnrG*4=4ucJ%BI}jR-~!z`fAASV zK2Mq^Eh_1Nf{t!XiUb9uFn0#h<(<+>;f^vauT$o`V7LXdhy-NOO@I!yjJHI^@rvo!N%ekr+JFg%49qQ_W6@JLoNyNQQoKJ2p((D zXu=|BYL1_PAnrz?#b*vPlY`pL;b#o-wa*((RTi%9J*&yek-8R$?-D_T`9l#` zD_Bq-F1S2A^~p5zl4=q3gXGxRbotSpS#mle=@W^*BE?brX!y-vjCGqehAv$4O^!G9 zlA_j&CE=LuS3mjCxcz>$(pt{w!QS$NC-p&!nX$BXXB|{RiK<1SJH)@tM@m(b;bwM; zd;1e+mV8O8fsNZ|Z2gT{HRs+w={=tvJ;hv9 zmSH#uF3DiU(^+a4K%tQkAwaT!`}}rvw-RJs+z&f)IPN!3+Lx*GG)zvagl{kgM`}Ox zaXKzX3|VH?3el@1YM3x_CbX4;8YWIWx%W+FNiLHYfbB_V9F_+Nw38NlRvLf&Tv183@gi zYeFN|Uil8}x)LGC{&R%+cJb_i9=}H8Ac$Yx>+F<>Wrv&J>70S{eK5fq?rdLMD<%K- zs;x9SUN!@7I$1cM$%j`AiY@1zjkp6$K}8GpCcEHAYc3JSU19qDgm?@-^<2L|2NJ); z2DaI~tTG{sU$x;Wm)JLa&S1x|kqO9$k%L3eQR~yqjRetlF*-ygA0J`&m?A1`LLqy6 zemDtytd{}7T;S1TM046mzZVwa<~Upwb{8ceiXM7&#hcBPCwDgT-Xt4}qr^0yuY=4w zKXj!N$rmHD&3Y_hii}4fE5ZJQ-{Ewly_bTyIGWN znZyv0fezeJy<&1MhLu9qi2a`}UmSr=3nP-13u!Zvx}tS+3w*tNe{jye}R1IJZ*tFj`DMZXM3N=9;r67s3p)pNhJw!mkL z(H9PCkH-l!mxW6u{&0#caiPdOW?S@nyVv&=?zkZ69q)xAqfT0K$Qx>te5Wd2k)K2X z^rjfMTZCW^luJN@)72L|GBW%QSbZxULXIJRhvWc}d^&N7u zS&Z`m`w0hQ(OjMlGtV|9f^ZTKBo}UC?9Q=_vLOy&{17h7;u(GM?|ZRvdDSr0)I%;R z6(eP9wHo>0{~0-H7z_b@GT~0y@W4_g-0$WTO)-Pu6RsB+w~p`N9kkG)R35WSOB_tN z5zo=H&M5G#aVu8+G?ROi(8XFV;ZPoYx)FcSu|L3f6;+6a@BIVKD;6Ey`W54qlhNMQ z$i(_;WxGUGW*mkebS@3+kW6R`RqnjAi3&5c+)*c@U6dgeet)u5JsordH+qzT)*@q_ zv#S3-XykQ#XCVC5Gw^B~^tXTyeD+?AEoLJ-Z7=6Rhr}^*!yurC?8pY2HKZPa) z$AXnRjC5ar6oLq&j+)2uuEhaEsYd6u4PRq2Fk^-y+M7PVESA|2!l3bi>ow}&BP4}i ziys3{H>;rAX2Jx-TIG~cB((@`kbv$N4OG4i?pQSQWo#cWOr`ALP=vL_4I@r*!*y*a zL!S24%NCv1aWNTFSX6H5m!7#M&0|Y)m&ME}u5G9o`MR^f(HOwgT8{Q(WWqeuy9X7o+B zqg#G>I;pbF?fHsevhwWUPN^6Yz*>x)G$md%gt7P?LkYixrkj~t>ZsE4bCOEvP;FqB zu4zxA+q07&(MxNVfIvc+BDC}H@;$Lz!#m+Qs{e_eBe!sms47ovK`fj@x7k@7Xn@Ar5} zuCbe;KW$c*K$KMdJBm4Pw8}Dr31Vz^R~Yh4xR6PI*-Sz7pCZ-b2^msA`0}fjiytB+ z@u0Rsz4E7Y{FDan;?gVgChj>k?!*+Fdd}BCX#tct&00665r0IhF#haJfLVbs$Szw1 z5v+pD+ys&IO^o+>{cV;HJTFXmM|ADpki~k!$>^QH_F3Hj*e`vZe(^jGP9N5)Gzc)Ldd%MeW3^tlmu8KUAVF~ zK7EfKcz%tM;u9MfBHpsSt%L}jH+N1gV4H?{{2A2aKhkx{yHIU4A`Li`jds70{G?rq z3wD-oadF}E)6bT;KXFh~@2+;5Q@cX(H{U0x1|{NHX;qHD%9iw^Ze>5Pln92bQubuN z)nmx4-WlywmND_uXyU@4_+XZk(?->&Yd7+CrLflAudcq^Rpu!e_Xc| z9#ZC1>im`Q^L z@9Jx`<#oaI`rFQ~AJq6h8!JFN@j(DU5SvZ*-R}dAOSeA$*xRE{P`fA+%|_09 zhE>MTvR-cgN;4r^Hv2~gVTH@E{?D(nbWFyIk;TR=V%OP{@xrgn`ah6vVPEG-@vYd* zQT6!Pr8;J0ao9V!(4yZT5^kj1z3#X;WxH_Nu13$!6^B=H(w@$gWn$dc)mAyXa0Pns z1+P14<^>t)ApYg2_Wsg(nsF-h$jWMCO7HeZLBYj~yX^7m!lcy|Szku+9QF#*>={~& zoij4F9#RMiiw4>aTLnmhvz{G=q1b z8IJ%9tF|iLTIbf-O({8PS3V6gdkXL zd8!D_Jtklt09~N3Pflney=vGdVc>Llt;>%8_yfoOb3Xk)J0BXlGFc- zKKcW56N@$I!m;;5dv9fw>wSHZ1J(6^aU}-O-X<4?mQATQ*9!`7JD#MO8(BD5{?)C2 z@MUY;F*7HNtZ)KsrIi%}`d9qdkjg`Xq`NgNVKT#bT~QvcW(G4JMI zWQZqMZOlDLzwZRSn%>vaH^ z{6tjz+j;)mlkAAle6$R{#ds~ZoTtn@M zYg6*_kVAVxzoyrn6V(~V9h&Ol>{oZ3O%8gpk#BEsj*mIl$4esIPBE?5heiA3?gUm18H^(#X=7X~TQVQ%F`u3kn;~ewl}7{pF2_O@qiDfuxg4%4`3w zws7LXVR&3t#w>tQI&4ueOMcjtE#C3$4PrS=O9}i@uCA=mR$nw%Wv~*dnX~IXeEC?z z_7PuQ5P$>X;*YkftI+%gC7=z1$!|;Ub=~RlrQ>zQK~@l!qB-+AOxdAU9j*&z_cJ-k zan4wN;IBErJ7~PdHA>2J+$Ah3CZ^j_O4?axgrSjd@!Dg;tZb4b;2awE4JWHUj5(d4 zOSL}wEo;9yDz2nNr9LrX$VvpfkJeRIVgS$@7Ob}?ws-=Xw8;)gyc!Uabaa0z93buV z@a{_b3(ffyxSh3$LA+#&kpNYw`$+`9&q0T}cwUW<7uGD@jgR-2CN>W+$Z1(%{)H!k zNg)1dxK;-ro@3Bj|Fc(3wY_Zx%2#WfLKq!Fqe$1+FW1)DsRf;1u=_9-sX+Aq`&YCD zlyAZ>7MIz5(_UBtTN8lAd|(5tZ5$#G14ltWGW(o}tf7j64mcW1F4-M|ZqNm4u zMT0D?B`_2cz7&x+x&J`8c*gg?+Ps#`1TYK{gF7eM)go zWa&XIw>AitG+hgPfjzThWAne+4i9UiUj?cpr>_j)$Bv&or7o+L*snd@=ID8G$yc$j zS6xF&Gg!Es{y&=ulGOU?>nH8wu$f9qOAD;}l@Q1xEv@!KR!MP5Ns--{6dDRIPDcla z>pTI%Nj;_fGraet>zW&osHml4lfZW6?j!#6mKDlJ53a)G5#bIfdY0!W4lg9EtSIzS zo1n>%+?ydPQ5+f)`+=7t9@>*^W|LCRDs-Zvz8NRNOdHTDBkWK2AJ$}dJV*#WSrwvV zW@aW$l@qnHLcZm7f3)tPy^mc~teE+Yz)i965HLrA06$XV!T_;2An?O2FM-#O@c@ke zIXR=%zi5`+oFkZuynH$O)C3xz?PU)hq`iqnS)>G=}e z&YH?9DsCWG;tA-0UhUY(9o7e@^fgOVw_l z_wCgIe{GO_&*NX7^uSE1on2t1?UQgi$7W>_A;IXw%uL!B_kT}cJ;cJt_bV!kkR&b( z36A2^HZ?EvhR*$CJZ9*jZf=r+=Cxi6ZaxG_Zio%QF?4ou@%8ho@qgvA4uHW83L(ZC z%0M%3;e96#nV`LP6|Ar(Zs_ibxAWlPoy?W4+e*jqT}e=U$_dSRQ3KfS!tZ zUGcayeI}OrexyhrO!AJ7Lc`}57M@-EtKS|tsX1hkQd=3^t_G|<;2F$VI{qwnM$j5C zgz>3DeWAS${61(i->2_Jc{>r0m75KRNqPC}(J^jDBJ>B%c)s6J$?2D3g7_sQB+!03 z=o~|feR+L#wpW;J+H0!r$6@U*8Yu=UF`MbE0sr~T%i15WA}FD>*S;oA-6$jUOdtT@FBC5e6O1by4%c{n=Q*m?&Be!v;s4ddb(vJ_1?6=h$_%QFY@ zo?s!}YHD@JL~}nI$fR>W{Luj%+RgHFHu%tG^yR)oQ;y#2Igcw(ysuDGjaqSV9cztP zBbbVd-BC@zmxJRLb~&`OOed@3y7TDuyCXjiEhQg!5<17xBMlheJsh_~t@Bus9@fr5 z+y!fEY(Sxb)39^OUoFOn+sJ8nrybe2p_@Gl)bXLs$GBPq??j1`#GUym*MPAjfOPj zc4ZS>3DwmklbWTmA+rM5I5@*K2IRnzE1xhgR(S#ipYC>&>gie>ueQg;Gt&qAgU7D5 zZ}hIr>l$pI-DcSJ+~W5W=yeD^XuzCoA-^aO+uLI?Hd#Afk#>J3CWZ}UC&75~aIrS- zEjJN(v|9q><})pLh15*fzYQ0wpc|J&11VKSWi*LBfqHn3X>Te=Lm@0kD!oaYEi@*^ z%{PB%F!{vW<1F2SZ0jDq(1%*72rWkcHV!t2AHeTIa>)ry;ozn6jK1-;pGLHVIFf&) z`rSu48mkm6!o34I)31Rb+?0Sy8v<_QXfMi>c;XQCr_d~N;U8uo@gL~JKc zPTcvWSYSQdM0oZzw=*K+y z2$_S7oXQJWA?F$l7zqM|1wz71$8ik_ss}HJ1c1e)Ho)AB97yf8)Y7WIQso;l1QUea$}k zp^6FlI>4L0&&?egyZ-oM1OKuqz6Q12rY%V}=%$yz+0^A>!ukk;FmzDlF!daRl&`&D zj=HV8o9Jou&RSmOA`8RC#a)O6uPt|Z+|S4Gm5c1J-nOXHQ%k!yTxy2DReNbrJ6`S; z2c{46tyZgR#PF~QXOo`p&nx9>bX;8Z78RF#o<9`i!KzZp-JGI^xo4j)+{|O)Gsa1Ar}zU@!AL+f!+A4N#Cw9QA$9C{a#Jbdm3D^fz{eWcrx!}-%M7@_O4!ng13j~Yh zOobO)u3SUkZR3{Q*-ke<$<6H^!$6+io|6g>OrUTBgP6i<6Lw`lOj)7f%#-;=U7NAl zQ>5V(Kbx67EF|}eW#Qv=i9Q@#3=AyZ<-bQ`}`iqMVF$+Vo%9E_Sifw zmgQH8iJWG)g`s4uNhu5yTljX^kva@kXMi%1b2zVaY+G5Sq^Da02OLbSq}_LAYtPq1 z1rN5wlQ7*h(W>)Nv^P!2PihYp=>|U^227DZ%j6-3B7Szn;*vnvfco;-&m%E|MpMYx ztxFU^0MO1s@Boe~4NZ2fDt~#6kv1ACgvROpFee96)!#V?ScH8Mws~-u#Zm>}c0h)z zadiIZ?0o9{$%>JiNlefHI}4-N8Cvt4k^1;!+g2D?L6#k2|eUBi#6DY7QAM^@j&}+gHn1=i3REpSW9n$2Gter zuc{@p>OWwW^5kw79(6Z=Z+BOogus7y)*cvCike zmn0Hp&`cUn+iS|ZXCDQJVGq@U;Jy?Z7uV!=I0;TQGYhXY(pyFZf$bz5L`F?Z8@$vl z%CkP@@i}+QzIV=6`{!CDo82w;DIWa%p%&nxxq!JxQ`2=47$X-T)HUJ2F!OsRSwV5| zEBmst?bs8*N$0kmkJpO^2Zq?E_m7!kBp+9}QFwVB7dvnmS~&b18M)3W*yGU>I02~5 zAJ@aq&b>Pc$p-Px??ototcOj~Jyou-MlZ43hhsu}&J+>0L>KhjmfWYY#>%$Rva5(8%EQD~;A*3%$~jG159MBl zfD0m{)sJfkN!7st@SuLgiQ~N~qXwi1kwp=$63b>P4x>m8A^jW}5CB|-tjyc)6jMV^ z83H2-uQN$@Q#+=|@9~FqQwX~#VC#1e(1yZ*X6^#&(UBS#a&b);zeD~bpB6GVtk5=& z`3k0GyD&6obCk(fh|Eq|nGk$uK9sE0-Q&*Qs$u_K3pOY--|NAfz!(HUKe~38c2*N6 zQ{b?0uS?*sxnKiMdE=AY=9Tli|H{LC9yOT{#j)S9%bQKQqOGGtpLJF*s#;d3ndJPJd9?y;4%zJ&m|% zgj2D#t1S)iS19nBwV8qw5?W9@_=GYQ*(Onm-$ux5eFJ>EjP|>1F5;Q?sBZ> zcs?||dVA3YiWzNfZ4Rp)+;r)o9rC&({DV#I@0I(SA<-e7z*F{a{APY0;aWLs0~TUJ zk`j_MYcXtE2RSPoT$PUJT@EAVMvoB7nxNqk19AW_q2y-WrwG2Ecn9IdrpGxt)B?Hy zbIu(exAyet?MK^@@YsIvxExBbS(JF>;b=tb9YjLSNgMoy*9av;Ns+*7w zAdts{O)9Z z1juG)#tUFdL~JB@Vy=&t;J-cHs`9JaR6~0PG)|>#uNz+#XrW55JE#zqN-8J__V>31 z@Cl+dk(=g(b4M4XS2D7SU9gn;zdBdOD|BV|+(OGN_yYs!xvDBTETm%VZ8S9!!m}H1&K!%b-R4Qts_wZ@*z0K zBbpbM!|DnN`4iu3&r#btx)u+b%AUH7;!4HxG^Ib{3);lN@UGY>J$Aix>B08>{>zNJ zVz;~LZ2GhZ``~&_6!@zTQx4a(o0n z3~6t#9OC*W-B7_ZYPN;{gg%IG2MGyocAZwmRmh4xwmmI&0dn{`IMGF&kauOe=I~Mi z?&#rU&4+}uqf^R4X%>u+q3~hd~pAyq@wyb z{F)f0=A9=hCXVl3SC8xRZ&|3OktDmG07?KpNEJGF4kwFrUyoc(HgHxqhX+c;I~nJ# z+bIUd$QE%B4-kVFU)8yjz4a!qglw&a!DF8rutW18RLIs{syqSJsjPHC@_F$!JA0{m zscd@DNh12SkgMzXOJ4GB4SXcfdqnq_>>X6f(0nb-LV=I<0?zRHOff{*!`C!T1H~qs zH()IbGn{F{KP^{Gx$g3qSMBS!Q-?hT{MyRO3jeXg_mrKdo0T?9(40fabs$N;iQ+jh z$bP^pjX5O@!X8j?KoWjgy<}HkNLCqCSlHXKb9&}l?Ar9XWwATH9wMyJ<*$SMP<-DP z%bTlIoU}}pxuto?_wRr}WVohkt3ugwSIxXek1r~U@bT#`wSt1e%;6~GyxGlN6f!%$a!3$Dd!fO%Fn^nOc{v zl=6(XH7=NFge9y*B`RJT`Q)Vs;}vk@2U*jVOPooOLaD=rb!6zmdv|+UML-u98fgep zxt-+)hjTzTGBY!nOM8NlkkW?skgXk_zOB6@4C0*SVwFz3U8fFGEc~Ge3BLjr{l7JkZ`?knyz>TU7fAAYYyZd9W{6+}yjIn!0qQk)a7QJe?{sGc!YCVPOj(kT=cA z&7Zum0gpbxQtuO-%zt%MC>l$ou;mfol2X^?b^4!*pR5&R9 zS*|RY(|)h_6kc9kO{-1xt=dun!1nvrE?^VLmK-FFP0gV4_&7K?u`%z3uh~qbvmnfW z##W>+x%6`;8MHtlSme@zIsoobgF+<276TGO7zv9k^Ez^h-+JwbDD7Lt?4d%7spn*1 zj16)Gq4A}C_DKpXG&#+w*7%xJQK+1^XH}tqZZKt=v#$aW50DXrwik*6ZS5wNg@Bd;8vr4c*PyDDV&r+h1eXW{cspo+miPB$<78y17_j!DBmV-2-NH z!3hx^5Fs2l0vsT-z6R0EQnY7jx)81c5&rY*j>%5JSbZ)n_rYd%zfr|yZB@5wyg=eK zaS>$K~e3UuMHTEo%>d>CY{1;~6xD^&dShyKhzYpd-ztm#|c>y#XLPJBFHvBA7LF;J2bAt3pDQBju zY!dZED3RxEn)gBAvmIw%*S&262))O>m~~yGeim~BnPT8CEhyc?4KIL$kKb{AIN5X^ zg%KT~2za=8U{Yy20B*>P1peixL(D|$UDZzgKP1KcMFegqVjn&VvcK5$tC9yMr8uq#%X>gMdyb1`*0g zcs{A6l)yHfUc=>_lq68<*6rO$sFLygj;j|m{&Y7lPrCdN&p-6qLSjP(JT@bKryQIf z6iv;Br&?IfFIz>cc7KllBBpq`_da57vug7z7y~fWj{ku32V{cDgT@s`lcw?Rt5(2r zFJq_-52cnauv49~>F@1*E-Fef<-VC&`*gF`bB_8E6kUuZCFt|>`m&l+KRp5))<`(E z-d#>PEop-slq#EFQ(DZp5P^OE^-QVl{z(vllkib2b#|=B-7iy~YG(hqwWACADClKl zlCG{Kz^vy#y0D4mQx|{bfCqYU?jRILvYK!Oi$o&2yy(7m(_8P1uE0=M z--4a-qA5Ure9I>^LU1;q#|L1cy~`EE8=Fhv!Ca4J+e(UsNvl(VzWzQMT3Qmh2)RrW zB@fe_0FYh6St6u^kP!L!1wn%5X-OlZrbYr$5W24j%@_Z%tk0J(%zKsN<4!FC(2x`n z6@}XH_k;z16Wmnr`2g}h=;+dNa*p0FVDOP6fxGk6*IrMD>k3mT-Cm_9cp97~|%+Sn) z8W+6rRA8pF4;2dY)4rqbvIKo-IxID7u^@Vr{)F<#kvv9M_>X%Xz+j-+knwX&Oq1_% zI>2E>2Pan$SqvPz%_*V_NaH2Cca;31Hp!@8dR>pOBl~xp9P<4^enWkHoN12c|B8w% z?#j(s_igTmeC-d_DbyNLcf9uY=)`!#Qk&86XT~7SDR)t7K*a$x9_|OXelAJuUO)i) zb~ND)-l+hKgo!<*3tz3?2Mk()ZsA)m_aErPMLF3S1^xsa3Ay4nLjqwmogs_n#v~|o zUx2-D-iV#Knnpgp=bNLwk3Y*$!oX)>+lg1R0w4RvHIU&hxk)nULN~K|zZ(^zJ2p8v z43$9Tv?_eR<#tF|dpTi1U!}Gj^PUO!R@~t@Bqk~wty_LFG`97JW5+P+mW8P6m2;18 z0rekAOTm5kGQ0L;$*^Hi#xuW&RNeGS+8&9m)xm9Yn%dGoMZ1IXzyq~2P2{0pKAHJ$ zw^)%4PYMGg|ZpShu5f)X&h!!6M?)GD&!Tg)_s+r-HqCZx^L!(xpe!y%h3EJeAz zAMr(k$X6h-d_D#DcX+7WPxc+tVoLY{0W0nGSoX!;a2JY*&`z#b&>sz@mik&)7!7tH zjV(<(xzu&_>f(4F3x(lg3)e&S@tw_UZ{;eTh6m!m3NB`X8`=B`zWC%Ld#QMi8d8zm zN@9za&8Rymi9I4JZ{KJu35^W-sC0t~!&K!7+X`AW-%F&XuO7E4@|@tr;@RE9VPRo` z!X6t(=i#GAq2;f~9KET`S^AnGOcOjpd})sQWh`h?65v3f{TR($r+FA&5&O>un!N(D zTuQ2TmcPD*pEV8*vNBVL3)Cxi{DQ=@yqor9Ec_jRY5?$rty2F;GX6qj0GNsGZ}u-S zp<=rJ_1SX*pH>+?NRJ|DNmfjxyHlS%e?5xGog!#qS1!7m`LjHQSErXQzZB3LU=yO( zMPyQGGSFRRvLGFN?ePt)E4BBxDdzF7(pV5zC5f9>IvXTH<6NPe~KTA-~GV|NetaG?Z z=vU;YJ-v;vTOjhUw~UO}*is}_p@P(U6wmh=uxoM^zRJ*@jD5b~#zY+@2!F4|Ncm@b ziDR4TC?uCL5v7Jado~IbZmb9@p!NH{kjV~%AJbiT_wdnb^^{BWH^+yM*iC%}%lE57 z{8+R9`SlLa6RajL*S(jg`#!ggeM{H}i=vNTS20Yf)qXb@8yzcwMQH~n|5HUq#tB|SAp340@LS{N) zw;tXRaO83SVNHra%W#)UnT*4+YowTs5zFe^7zR>FY~Qa)3dVPXwXWp~y}U;N9uhdR zH21CqXNPrx=hn6z{z?pSna7M!s(`OhE<$D}m)*_Qcpi}VXM565wwj^gk2Pl~Ui%Bs96@anDwAoac^jY)$_Il3O^wA5OPe)>X9~wW^9s zU|~?qZ?Bt3JfM+DlB0z*kVdin4#P4EM(CfHbov|C2Rlnmo0$1ovQnVvBkL~8w6B*^ zSYGcf%k$q|zajkNoH!Vs28u>y&rz>h+LMz@w|Ct9N%#)ERk#0w(PjSJ_rJD2JOPMb zW4(DwrT}^Ict=Gu9h04;#DW7~`@5U^QA)0-fdiOl^4iJ!}eWU&f#G!uRhOSt6K#@H+qVpYFSy+*e*D zE|XKF%3y737Fia{%InO)-#))ozkla9svyiN4|6;IQ%(Hs@2u|N-nt?DEWiJ&9Gx#s z-e!4%$$chP$8u|cjY%+)`!n)X4y69}`|ysl&UbuY{6>AhT)es*E&s}7V1P9^k_hXj z_x6eBYYCO&XcIcyzg-wyqE9}0KEvA~{1^H1$ue~LDmAb2)ACtK#7r62cJ&>K+x9RiCk|?~wB8-ALcY#y&RJtTt>s z&&tXY74e~_qSEiwuEBM$BhOXhHs6QkeqVo&C_rDL{qXc0l$J?GpTz zj(VEBZVC5{iy89Em4tjLMNLV{E0EhG+G`oyTeS&pr6J%f5&`J}bi}Hbxug^ocE&E< z$*pk+?)^kBo#j_a}h z?q@Sp46@mY!%2gMtRA4K-Y6(2prmZnRN`GSHZ`4%s5@a@F*0gwX$dHo<{;7E7`3ZD zy+F-TEqe!ylESCV(2zUp=fAvNujNxc9@`Q4rfYN`$YrX)Y}<~Rx(E!2VZ$NE7j||Y z)riLQtLvuG6QIF-8;0$jN8-m@ zQ#Ef}=B@({;1?a;4gp3Y=58m zF%+yf@b`m@cS_#DfjyN3jn0MSE{FX(2SZ&Uu5kKQ=syjuJtPU#VvG4{%mU!^2Us<+ zdssfr@`{Q9V;d+wWK$!T|O9P%*r9WRCY)*x8|{nbhLMLzb154Gs3>AmFz} zM@Ji)nl{c@TAtWGfpQeQ*5rtYh=h4JfdIRct$E4rV!xG|oD3vgXIRX`T~O?4xa-ln z9ITVFet})X!pe&LvwtonZIPv3%TnZVmBSW5?_ac^Mu~`vFH9Wrea)&|oSkI(pP=w( z?HdEu=>opIH!-B+pH7O8Y;UIn%(*$Y>@k9NYkkyu2fF*+dFoZiFq`LSBi}<5*cg{v zQx|btZcAfOS8JTiJ>qb2={4?_I$Z=7>O_CTuiUZWLcK>VLFDNf89u;wHWYEQuZo+W zpI@HB=fgR+tD3RJ^M9vO1tkQFPGwL99=c&j-`Nl zC*gdZdbyYjY(P4Ip_-&*0)9wpWNv$J_%w^Yu$ue=VDFns?%9I$#e2ODKJA`Kx34mY zsY7A3p~$bx+^+(ga&f5cL>l2C^3KzH7yyf!8hREYvtrk9m99Ob{-a-^(m%(?8*ekz zzHkvn#Vhi1*{T6~dyQ8Qzh;NQBPDF#7d`=g$+;x~sa z;V4cU6pxdBVz6ZYop5ydh;3ByJLcs-0&97%dQ%Fnn)rh>`o8FrHGovk z_82_;2esccwJRbG#OCQOv=73=0IiHiukzAhYaUK&Hm?qvM84*Gw;8`_$O#kAV0;TN z5E7CH4Zl%Seh!basy~_X@F0Yqf+zG8u;QdTPS7=B_yXYs85+uQkLCq_OCae3UfyuU zY`&#_=~rkY@o{kon7IjYk4w$C8R~ZEAVvUp;o|fd-^j!yIduWeIN+9NZ!6-r@+MqB z?2Zb?2rff{E85tSV6Ng{6 zR}3CS@fh7NDJeNyt#kM6AL+>V*qs8bOioVjN1CK+QqR^~hbh(O_V8@zS}z>=&Ydlm z^~@cj0-XX=K3(cf{rlrET>S0zBI)f0a##FtvAewX#jg+6M>>9)jUgKv8tTG=0R_bU zJmzvy!Q-*P368v2s&(hD{C^%ejjwFfAErT!fmWjqAX~sDe4Z*-;JhDA(Ld_dFhkKl zXf|5xH9oFZds(w(+0n(0`N(Ee{6v}wMs1C+k|4>_a2n(9uOgPmQG%@S}u z5L~r^0RvM0DFd(rjtD6MONOX zD*w&zhAdx|4g)R;DOMmvx+~cE&U(Yes&SArDEwYH8K35Vlnz{?9O~L>udpq9UB{)>{!AJPhUuJbo6#od=Y!F$e>5NdCv&xv6|x}%*~3Rpf4U0u4*JehJ*G3I+aA^Gyf+a z_t)yCr!MDSfhNPeLJwJO7Mi=xPS`I4@;wH^+e{aMt)~x>0kLGB@$rdkj))$|e@@ETHQ{~C z%OmMap2_EG{x{r`-~VwCF>iFM)*uh1lAMpP+Pcrg6b#&LppyW;qSd^&l9HD88SF|R zX_M37d#B87z-Xn-2^`7cjhm0lo%jI6dIP@&-$}&2ma?+CvqHEsJU7?Y)#e*$4)8Pd zA07zIFal8yY<+?wB07qV>K@~m`ARAB33jBt(shlHZEr6K#?7%yx z`yN%Z80-k}a(O^c|D|fHHnhTK2`=S@vk;L=ZeUK11oYJ+W@qn%A_4>qv~+a3&HgLk zUgqcTj|Q-oPf!rT>aM)J{DL579)BMEnLbU#f3L2vaXd;y1uW=31s`}m*-Gd$>*+n@ z+57H>i#s0*E+jy>)Gvwxw)1v?Fc}rR_u?X+K>a;0uj>PYhm!q=q2!mJ=jV0xyJDY@ ze2{|_z_}(6#z?@`1i_w$t7&U*M?^{>wL#A90|y1Frv|xOAeGc(a;7hhjW3=)?Gu%f zTKuJo$7s~|0%&*59}4AwRR)0G>uN)a{&eXF&^HawRw{CDz#p%5ytA-?(|lI*U&*E) zBH0Z1E7>G?YA6gw7Osz16^^bZwt6`bYXY&?l2YIvLF3%b&jc0~>xB?m#TI@W9YAz8 z-e11j3LzO7=gy{#1oK6AvyntZSH#=ZvU*oZR)@3(1GOeEVv`o~8Em`Ig_ghJqh zh^}e-E1GBTuB6H_nX1y@QsMf3Cm0O4qHyav-QZEstB}7i|Ns24xgm&AWH@;AMKh6a zy}TxaAu8o1@a9TA)(le~cg}LQO?9aJTmsQw?%w~tHUi<9?9X9Wd|uphm3sN^=P-5Z z*Zj$6G%N>q)!+X2vRDaL5&0$>sxK+vVQ6+$=4+@U1j2s{7>HLbr~3=v{`-pL-P(6V zz4xC>MXZo0RDpBpS*<;7FVg$t9HtHerBu3$(VZUmk_jjAQk*#0h!Y2NJ$ceq$X*Vh5AtzVtj&fwN@(|NV%f-V~~O6ZP{@)vh-xlR{bhCuDJ+|e>1D0XLmUy z)juirjr9N6@o8TUv@%&HYd5b8&g&aMvGdWC-##fMr?dEu4nV$%rM1CMMd|7Vj+Iq$ zt`$zGNLE&Ci#>5xP3>g9Epy-#=Ql8*`-~~gZezmZZBC~I_N;f^=FlzCKTY9(uVuM8 zhl{%DNNG$%i_~_P@YVy~C&$&N7E>h&I@EOVVDz?7eYsn7R2qXcT(rgLazLI|)dENl z75Ae!moMWm{HrFV{K~s~3Av*n^79*C?|d^hLB_CFH!h@XL_yc(Rkb-}J}e+6cmHtQ zY3!R>*OT0wk#Ao9{tDJb%=EO~^>o=Lnb{VzrPpnQCJdJ1uPP|SK~5ZCN%I0+xd>O< zU389RTrgAQWy~ z2rW{7V_3@^Flq!rGzVyOVd2NR(pT*;-PCbu;;^l&YX(lFYW-08|JwCd>c5ZA&W=NS zIPI&i806oM7;~%F35?75nmyJQ@^Uvh2;KjSwM%u5%IQOpVQ@01_f1SRR5FwW$Lbnv z=42*+S%D5M%$N*!%U%JP8=Q_aGq}2H943X{xNm;b0c*i}8J}Yt1FbSlNse+gGKsXr z<9cGO~BY1*)WeikIH2;8t#1Es6Qo^g5Ew=?ZjG+E@E?l;ZehPQAc1s8*_gZd>Bx^(vCqL)U>3+BLDtqt+jxr=yPsR?key&ByDETy* zYHypdgJ`jLZk^QrEd1%`u&j)X``{fIJ zyT-$JV%znSw0~kkP)_@bJXLsNzj3lJ;WBYo|9D?>kNe)^m)9%Gc{L75dD_#Sa0^RF z#2J|xj0L)t^OzSCq2JuL8ZXttU@bwFju(-aos%4(_~2KSzIc{~|rL ztQZH!C+v-F*k`7o9pXz!u+ub6OdonlNm8%PX0`U7lZ4m(Q-iQ{-^AQ}L(nT`J2}Fa z*9CEmiEGC{PLWT?KP&_1+3U}qyR+rj>{FPqnfg+tA<<F~DG%Yrw3cZWR(8-4* zDNbEIL!q5wY5lX33--yfCf}$VtsyGps1*gLEi%J(@trxc zVoue4*c;GALphIpnAR;R_K=!7ILhfbxu3pyyrPK1efAon4%uHV`CbwgOB8R603iPp zwep@51w?z5b&?ip1a~YXrj@!kUc%!_Uxx3U>=(qR+~7@~ufGt@a1%ukiG*MFom6@% zBR?uq@^fhoDXOle9MS7;4+8m=D*|~>F`+ZIY*(RN^oE(+egllrUWQ8g9vm&#^`vK3 zgx^i@c)q{ltZl|L@Qc0Bx+?;@!7mSuOl)Kn<;DF6e+28?buBf%I>9RiE}JoBV25)6 zB9CLoCT9#1E+PLx0q^8cR$?}r>7PtUe42H>3~XE97p#-zGLN)(rD}(ZuVy!qkdA~! zV)5&S^}o%E=DM|0lnfnqSei5`IzV{t)=iPSoh@(Q8s+9?-1*xCKY}RH>pj@op^o^3%F!!!v!wrPWtMx6*R2Ye zU_LTXaeZ%Y)7;gm>h2d2&7=*b4i1atNZbDs9{w9_1)0o7aiPPM{VIQ9e`qSHrhzGK zU&H9>KTp<1yXSz4_ZwTG^7gi585@t3>kavw@^82D>guH>LV-UvXJ~GuvxPqfrPAX{ zJ^BgWnq^xqTu*G$o7)Aww0kJo7KZwl^*TJq0jE(s1z}|ApMk$OBaP(S zkF9s5fYD+P9!C?W7`@|t?U=RalGcTN;3>9JQt%7VkAr1YI{ zG1MLKQA;TXkJQyLdYW~o7UoHeEGb>Z4|JQ^>tW0Nf7dMD%rn|>1>J1sS z*a$)66o$KCGyU6Yl~|?RtUi{a2YD|yYGL=dty_W^&jt3)j3v-<+1o_zL7oM=7OUIa z+XYZ+{W2f^;dwa0v=@6w22!{17V_Gdy<%K2z$JGr4iOZV`WzbGec{riHzbHI~FeVRzlj(Rh&b{czvNX8(;T%A|lk^`H6O|=Hf`0<4f@M}A zRVC1}#Eh(vflKoxY0#KMQI?sK$u0?o%YSTUW?@S}?#^>sSYH1zx6kC#tlKAdg8iuM zNu=Pt;Rr{0OSVNDTHLP+G?rC04W$+1ZobcJr10Hx?lHuy=h!0QjkEX-ny~l&1ZN^n z{}(?M%R#b1Po zEh;HWNlW`~QLqIW6i)N=nZ{65IlF0wq?XoNH5zRU(A@=kI7bWt48^4Z1qKZmdB3fTj&HrERENdU#7!9vPy`JOdMoXheX^2nXRmtkR)Q%glI?>clTqK zH|?$Ghef4^SYHU!qAQK_7aC1OsIJ&mK=_{>ZUYGhy#Be}=N+k*xch&Jxk)3NVf4g{kKae7UEk+1awg#>Na#oiChb9`<_D>+9n~L3bQIqO(phte&tL_ z!0|9zDFmlBdW)3Om9M>qmInuYgM)6$J%>$wE4E=@zR18lS+Ud<(9xcwVt|CrcE&Rw zXo8r(SFA#WM2u zmXQlJSuqoxO|lm%h&Ay3zWm%V#nJ z22igqeql3@=0$%CyFmH02@i2Ig7_Tq^@~eY`D-v8-PqwiWc`40ItnB zlW;QvBf~xg1rZlkYa!BnJD0G5&EUDpG!yk9p&Seh{Gi-t6qu)4^(+yjmIvm-p ze`TW9l8;u@UX2WM#fX;j;ls~SOs=DBB`RGTw=JOP4~G6#W}CgfR6--17D%&mraU{} z;|TT|(veAWY8u|Xzj5$^V^i6h*bco5iVIk#sNw<2kkECc@uGP)kR8%Tc!N^!wndaU z92TIT{8bugC;@rO7=AZ3>%(BkNCQ+Pjb!=s9=avhg6(afQg&+D&`S>N#C!ZPaNfPE zHQFPq^|%RaQvFb?*Ev9L;l}Hx=4J*ak{~7a8*ODKPENvMoNg*{GN)-N?Hn-n;D$MW z<1Rx2X?y%Fd=1S{PVH>av?r`0TjLQNZ&VZF9Ce=p??L^Lq?ZoT=20#iexqc zf#;pFbPKoaU!@qXe3#cXFFRP}tg{jmjU;g7tL!&w7DMHbpn;7`2r@jdY5cpo2%k^n z@5$JQauL1+@Kg+0 z2g)8qi;CV-1Ie?`SEV36GAgVaFnBWA#5OJ~XXczgpOWO(c96$mKgDS!uLhd)gpZwb z4d1|Oa8JY1?u@m|(Jr+KK#EPKPj?P4cUzL1S-z8(SC?dg_y}4J>A;u*1BJdmdh=Y` z+(pxMbBk#nm-rHcExt+THQrC3Zq>=jwPy^yxSSZBY19IjpKMt=T)}vYfRm^AB2`F) z2))6764lv{>HX-^t!NW@+*=3rdnbNV4sY8GeW;SrmM9a2#KoRZW#rZO|FW~=HriU& zZJWI=7$RqRVFU7}Wb>+@Hdp;4DTy?Mr*7mSqX#^BovW`eoxo!{wHvp49IqKC1rlUR z2I|o2Sc%6v9I527q@08Ob0G2KOS6-V;kphk>MF+VtekSjZxOyHf4^aQI1sjph*Vp< zx(U8apMVRdVKe#f(C}dU$zY{d4GV#hm1+^p+N)y0{}tIjl;79R!PCweYMu`C-z!iJ z5_NS`Kf4z3k5~VIHAJy6jD}H}QK|5%z&w0)b&wTWpz>creoG<3^p%5?LTAzf;pHzJP!JuG=I-lW*u<)2Z6qZ^1r(cXms&i8?MsK<&<} ztc`FsH8ph4Q{4{)m^<7r{Mkh%0$?CA82fa5WMJFgbRq8>8xsd{{fr2K-^d4n%&#yU z2~rp?5)7D40oMpFO3?2ic!IDG7#|0<6j#M<&@zsX3xIM4iI-O@D_a@|4F%bfD-NuW z=ImXPPEoHQ{~2F34r)Y{uW4ytFuXmZqg5&^KTZY%6+I&-t9fSm+V{16Id!*a2=jxi zC7=q}K0SvCXBe3+3)b?=%91YLSKo?IV!JVT)aqYNaIG|6kH@v@+I4nQP#gkD*IhT$ zl&!M7Jac1XBIsjai>f8GJ1*jR$@+&?<}1K$d}! zVpWVc%z_|0tuhTSC>`9}k52c;4^Nuhg}Tp8Z(1dTrU>-%vhb8+=ReMMQ1~|kewV>{)Ujk}|#-!U; zgKT%1Q>zntaTOBG`2y_#nu|F~yF3kU@7A|a>PL>p;p|5{9bLfm7Fsj3*qR2H4zH9dTuJ3!_Z=G}gIcuH2&RYAA zy>-Jp^E~%+-`DlKenBF-xS+0|1BoSZvVncC-Y%>K9*~SJNa(u22_4n&y{IdDs#Ls;lI^^c`5o0-yF^+p|xAS$nX4S^Q5p|*6 zqLH6d+PFFQW=$2E_dC1R;-Ma@!H27-hZU#@;7apCR|N#1x981gT7mD7n{W5oVFF+4qoXe zYwUjQpn!r<5=b1=z5QO2t`=uopeDD2c-(vlAxB$N$9{O66r|`4Z#^c2{5C?S?F3yn z%qEW_np?*3!4X;apqXo~KRH43+i!BvKi2NmKbaW^g8#t$TFc7X0+7Cc5B_=oJR7gv z!0RDx1YJvfCnY^SQ=#3&D=3&58Cj_Yo(VsE*a1&5CMC8V>3byh=+QSR?_&LB?*8E^ zk+ssNUc);M-ot^Fo_OW>BCB8sX@kj={(<>_?Nn;_Pt*B5*Y1g=M*$_eZhNBQMgCA9 zvOu=*Yc5ARbN%51ut5VCtSEZ{uM+0wfvMRUDL+i=Yg#bhXhwsCnQPAN*PDjv>j5b0 z!otZqWAz=KRTNcFDx_x3;a77}k-x#6XIh?AqNm~LEx762Uc=6G9tXa7>m`@n-IFdP z&bQr(`vpi3LVSa5CVz&<=+=cE#5MpErR04nA*fVLy{pzd^b_L6?mJme#x-?x^i`nO2$~#?-dP zMFixVnWsM$6&3MTM~Sytl>AT*;HN!sT@($Xf+E9_4Il7qfvKQ77FH+&@X-KlTYb$fWT!8ri-Ga0BnWXKD{fO;F6M10^A5W$a4%uT<8%x22hixR{lwWo_-&igy0H;ostBqB!BAbIey zGWhdNf1t%$>mrCo;FNbR19zrQPFve+ zC-|kIp$NdweLtqXaL59!^7z=l_lW8FJG+W&6+u!6lD^Ek5(1z@wWSwj!M+bm3ZI8I z&#VZ^W{Oafz@%BNSPzV})PGM--t=L=<{$!F!D3UCh(w{ zV-3VhNdRxfb&>*3q^-kGM0f=#IAiG6?7dW0Cc_eDea(gmvPR9`H3*$N!7PmMyB}Nu zEop%sA`(=r{P({4dwPqA!o-$DM5nhyB`&jWgnb7>B}$*#tCy3Gl!C_;c$+Q$?YIiq z2tF1Ij90RM7WsoYA4$}Rn6Dl&em@E#O3p|hE!%k#D|^wd4l9zQsJhi~xl6NVBOE8{ zg`;JXieo;Qns$zh`&zp%S(H*ML41$l{1wvYm0u_2_g$ygS5`{g%-lA5dwUURpERFz zAGDL3=g%6K?JMl=h3)`H7oBsbZo^FnF#Ry-oV+ z5!co`Vdh?bhhBn5k2)*eSGdw?_{8<~>wl(cSOn=&kxr`c4Ik}nl%Kcd)lT;by+*;t zX?#?6ot1)7h%QPiS5_Xz9^oUW2TX9*t>OOOpEGCUkfc~v_Pr`QZhzl5>uaEl4F0Eq1!L6u-a@C+KGggtLfXa# z@s~dEfNE!B1vX*){{UV7%r;V~1Q!!<4yOT; z<;T(5tG;$}SxB!e5BoPiijfe+ zj6R&g%`pD>!PVY{93onpX<)3ag4`I7s>;j4-i|Y*E-t$xPwDTvJekY?a9Kq^X3}=4 zk6!4RuO6GP-y12v%`>1<9~>HSnw`536%#|2YhU@e4P0{M0T#E9r8?c%-DdoXt19Mc z9cy-zcrd}rSDozVF-izNZdIP;sdaU})iqvxj(;l!y7jMgn_YvtWO4I_s44eX%rXhx z=kNA>Dp<^^(%JHsiYD8fl9JFb4CP*HVGDAV$3;Z%o^$w3S#MMw6Q6+yTMG-D%;I7a zC!}ssNdP=q=Xm1{^)PlwIlYw-UeL=>*{^B=M1@d zh1C06^z4z#EvzdF59&ycj*fs)02aAPLPzc7VU7DK;j?_c`?{#Z*-R2cE=qiJ`-RFu{NX0=aW5-x!c-@04L@MU9kITm{! zOdPn}dfR`7ISafs&eYdEP& z>@fqgM$KCHvsQNM1C3(Akq$e5La$pG0*@w2(lD1 z)XoDHKv4mu8HBz~ARGe7CGG6!myr4<4JZ63GtsQK$jCN3{Ab-9BB#h1>biD1e?huh zOE|=2bPRYOtr*^tn2jW|YGY+rN_|Pi#=ZnAYJqcq>NPzY7YjZ=zMJjmCmg%(e#^JA zs2L-EkHAF{GrM}+cTI_NY^%^Ns7~rwXvZ8T^%CxxcOo24vVeypF9fh^9O2v;cG4@1+_FIFRBBCCW$?37N(h?pZgRV+B zSi5(bn6_o*Ma{NADly!A5O9KCk`CDTYxc11iA+?$lp%Q1miYo0i@nsqvwcAvXL(?e zmj`O}*W;vz1rM%5Z;=9Ht^qrvH}&}AQBW%EEPD$%IfM-T?_q<{IJWxx~cN63d(E~VPxS}p;e-NN)%F|l~+`>u#@Bj zL6#QdR4lbuVq|(sflCX%DdoFo65lgXRu0RX&A41N`6D|?RL zZFbWv;M$y|=KVcB(v~df`cfyWwGGqR1(tCdg=(-u%G?B`roFtpjwNF=h3QDZdZaAS zi?6k<4K;<63g*`HxUcr_tCDOx+5PnIzpqNPRTc=ZS=6cca0?efD{P#GT0Sv)a{tzx zqf6nQ@6(#ey&NIJX%+y0KpG0Rb`nxj6rexOE-qH$rDMK-|J>$b2RE23A15 z*RPA@Kvb0U5yX@~uAA;QeH=j5%~#+H4m~hHY4A|D;PRkc6ZhnGd=@4tIG=Qe^Uq(CweWUytAF9lD3kQew3{gKR2rj)H zD+wjj6NmfK(h}(Hxp~FB*ZWK1W#}Ic0Tn8B8li(bK|MU#yU_KNk4BN4^|s=*ni{Wz zCS#@T77G0zw(F0;rGeYRpcxQhfrb*zzbsyFka7QQIQ&LkUOeHAsCm58QRNHCA(zMN) zQ9^H!=%xKA;T{lD$m;9+b#p1*Lz3pN#U&L;3h?|PGC`gY`VUVw^|0l)%l#JfByMLq~fujG`JQLC|j(2T|6wnj^p6Wnl>bI>lF|^v4ku&MI!;O|aTZ2_i{^T2y)_dbhfGBSOMPmFescF^Uj^65NrYblSx zM^>ZcgnSX1+|&K->O?>Q>`a_iYGiP)?lFC{=sNKzP2%=qT38qW+TE9|%8&)Q1P-^2 z$B$S#!5Vasi2aAp{gyxzv#flJ{=t`X^M&y9%CBBMv$Z829o2+I0d7Q!lX0F9jokTd zT+M!o*6OVLR-Sp1aDG@zIK_8^1|goQa{rUs34-mY=OKR}yxj%8A|oRMvrGG~kAVdm zCAUgP3u>&Lrvx58ybhlGZx5Z4cw9O|4mOuU61YE#6WBYHAcc(YK^>BiQ z=}U5*saaM`T&j$g7S;ArkJ>hO>9<541tL+XNy)nG44Z<+9saCWkH6G;b)Z0R#!&YI z0(K|4?7>O^#_RBy!iVzJAPMuf)9CWn4`ChLOHE~-xvAuYgv_|i9Hr#vW|EgWWMm%e z@I}?2$DUbQUOl{6WxRnS%WTx-@KfyG>U4Kd>!h9511C7+RkN`0YsCymO&Kjq*}z;?3nM#|7-qusjyxeB;#@OnoV>LuABjy#O z-$&<4#@AyLkOu3YwDWQw73(V$}?u%V*a;VAv~eD!tR`~)36c{o8# zU+!*gI0q#W?kGnir(uc27d1^oel_p~hzI@8&_$(pm%X#|j41*k<=xwaksh6Nh0`~G zy}pp6N+&x>2yAcIn=&1&bHwYXMdz@TpCgkjpHMj`Ty}XpzkKy!z368m%_o}v_$bCF zcMY%4X@Tc^_hR(OZR4??@((>|uyOW$I ze2;BTdi1eZ&qxq_d0;$$u*~PR^T*tJau4t43g;99FK;sL7h?>`icBE8d}sTJ#DZ1_@?T7LG!NNlnKhLHGevkoMl?*NGGb7{oKhK2vU`l z=!@(39yff>m^5$RCA)Hg^Y(2g93sBV@Cjmibzz=yHbQ+b48dw#To}44nbBlnVKMJ_ zB3j=9hBZ|7kWYG;;CFf%oSOvlu%XaNL71<4sBa>N@zE=_$MyFY?Xn^lYasq7u*VGO zl*Tl1lA7JEqB5pGg#KgHdO!#4wz-{^Qc$K@^H7IVu!05+^{EkRUNG4)hS7^ri3V7x z|05wWn*KVx-iuB5+hQqF$wIjJZs3GE?tp3FYb=-D)S8|9wST45&AbauKF5?)TNa4b zmL8O6ETTyD4(ZH5fYfWNny`k~_e9x)Tf)h`7cSZB6}vSD0O9sANtErmErUmwJUIT_ zR2rNDe0*+_d}Z2*`Tz17{$tqM>~e?X|8+CKXUz)x2CEYk`Y;f}DA-BLHyC_)cIP0@H~+y^|7Ql>-s#Ak znv?S0db(Q@4NKe8AEtd$u`g}~ei5B@fJ^0k3=HIH^wC#du@FvB{Mqi$5b2{oAmRK% z!N0goMhNKJ?%(mnl`omMR3OuTOk}pL(+#o~!)*P)6#@o$C-2z`Jw#u{3?TZY6z1!=$w60QMT0ynXcjKxOeX^*Jl)rxp~9-HpCF_CbA zEbv<=*Kk1{nS?UT3FT_*-RL1DyFTo2TqURX2kzHD&lw)DC$}ECSiwXC{0aqu6Klws z44T`U;J*P1bUo}mF<>?&i9Oa;I67!omr+ibt^9F^-5O~Hxmj>rY@7War4g0!K&R3@ zskPP2)6)}R8sohJ$h{b7wN?Q%ytr;pAWEn<5L_60)39&Bk@Ujz7vO7!*q;dP<2zX^ zt)Fg*Q4)m?{5(jV@(T3I9UG?)y?sTF4$k;su|k!mD&5%da@|av&(>cHVj3aY2U#z4 zUbO>p)4#!>a&eoI^U0HUeXqq4xcsCy?Mt(o3_;tMo6^PJwPH`T2+?m1-}<4D)FPLH zHoXJ(e0DIDJ_SriZsI%qWYazY0d#uq7*$^kz3)+6Q*Ke-!d#0bxVBC1j&nHZ3hymQ0cnF>8YKcPwG#39i@nf9#98DzGe5wby>`@TYaIrQvZUnb8yyUU$e+<*_o9sgVB>U^k zf-K<-(;r;x@b{^|AKw@!E-)S*q+<_BWE5qq7j32xOJZR4lf-Ms173ei@%OKtbzfOn zpQv_x2v~={S9){$FnE}Q;Qsa$1G{2yKn<@g>{o(|TYVz~U&Pw@JWnnF$P<>q;de^2 zPL$cC~GxiD^SN;_nY*BUtSZ3&gz)+GSmz405^7AkreF7vTz#7vnKL~sNf>KXS zmyJf!{d8G?IFs`w(x};l>)Wn)r+uZYG(oXkAuqI4w~2zTZ%0VFoGyEkW%ltI`7p&i z6r$v$RA}l-l225SlxG@Pmc8@-Qq#ycW-OcF=87TVrSniCpPiZZJ-)0~q|ph*9I#wZ zj?r{Wy!EHqo)b*py^wlPTRcqW)J@)3?W$o*2oDM}gF~puCiq>Y%!KpP7D#S*0ru$B zg08-WX)39-y0u%YC}_N2CG&F3ERHVe&BdG#F7tqArc?bYVg#k?H!`ZAuP>UwHZtQ{ zQ@${<@eep#ib06-=xCC)*WP^yAJ0)tH{MS})EskA?gQXM^pZJqn9e{1!%}40YhzPqU$|Zd3=t3?G=9PNy zjdpONJe=Cth-vuVkDwY>oPUpuw>cr}pSvimhnPYpx4X-6GGNRUu;R`LmG62$?|pb! zwdQU`(bH21S}e@i9_<+zYCCTJzW#5e+k7cRgDqSFD%_u<+&U9lNi_B-|# zfvffaEE!mX3jqjvhn1JR2NX>gCIaYyDg{PHp!k{j9Nf_G58Q!?^R|~RU9zu&e{}H8 z+Q?EyadA309e8>jEw8L(*VH5cs9IfJ0~ClafUp9I0{l9c*9McSGjcY6q)v{Rv!-m& z!53fNSRp9ROh`+EAN3mA-QVjQ=dD%1V%c=qDA-2MoIih_kg#$HYftj+cmcz~x7;v~ zncMZm5EISr62tr4`~ew^Txz2@1uH+y<#Qm9IoD7;Ece3O3;q>G5WoA!F6EM#OnV;d zt{=noSz4lQQ&FA!weC7FG)a`3bO2#lHlx7V0MTcaW43>jR3tD>ENm^n_8^93m*~vD z(k09Cor{BXm!3X#fw^|XXc5SzZ1hx|!qqe&cA<6M)oR=+yUssy^9KUq1AzS;#=UGh zQqRt09KJNzHb^Po0xrLWwdL?tcK>H@;Kg4*Zs)0-3|Qq1wJcnBt*LU)`!u}iaN+5? zjkV?1l9D7y`GET?Nw*z8t4F5L!wRZ#HoXF-+hoN+(=RVqU*6dGQkAWWN0BlKDd2G5#Sz=J|Cm7Z=u|%{th93WoV?u<+M_FId%wl4~m2*-ck2 zRh5<|pZZcfEqB@3-OV47vY`zKNaHjN`y)ih?lpz`0Glu*j-*{*>YvBJ6fkmpU9C8L zahP*S0bL!!!@==+A(V@T@}+0jhYWb4(z9y*Cwix8Kokl_}DYiL?u5*jY>d`2AMPSdFE-E zKliSNWo({KMJ@lX5;4jy_q3=v7_fT%dajB>58gf4G^7BAj}k3W4d>3BZ(2sJtW|9f z4h=z$lFakBF@?xFY2a}sI;QD)zb|bz3j!%Dhvu7T6yJLxojRSyl7 zYmM>gjT+Vpc{%$!{8$JM-PoU7%pB4rB$}n%nS*~^N#>|-L$*lk)0wZu)7c8b2p@1G zexDm)VTZ-z+-$)amDPa>+aZ&kjsYaT<9IdS=1P>bbo367?3q%jNZm!Q-9& z>5*au{3|&9>%rM+a<&9H7EwTgxB6L%OOLTWXJ92^@Z+SX`kpXfxNgz4ytCTgcXM!f z7+!{dwArd_sq@*Mu_OKFN>yrq`dsdrt$kkLUD5UQnXWEkr}GAHYI0HAD`+sS?CK*( z_I$g$it8Hmu?y_=jv9ceTl-;IhYNLqLG+5{Mdl;pDR_lp#W)Di;FGtu6Y5RSby4_N zHmg~jXVNQSIBdX#3y+Mc6>G^rkXSu-zwJukuN7zf5%#klGt8%LWYF<3(0bIHgj|jW zY3*~i!s~-Evxxav*+Xz%G=s6%A*%kE*>{)TPZBhHB*K+R_robRdlkd??yTc?MC7EK z<9K0LXhrLG->DKf;(-)1-s|R4dftU0A=2t$hoe?PND!VDUtzNXClhJ zDc`zyKldH3@Mo^_tw00!sm=P}`f%qOwOD%!>*u5|y_6&#{VK25Qp*2xcc~M+fDQ|I zDI=nhlIu=cs*#WnbZb{LSw3@#vX$*7G5UCnYsqY8m$<}b{Mv7V+8p3Q#dm*Lt^cT3bNL{s1& z-hOZnM39+u#@?7K#DM9H>x~=u8G{3E(JN6P`(0c5pRj@1Ukg+Qhd=JWQj3R=4o_qy z2RP6ZW!5q^PYWq+M>tvNhI z`o13*<}*WpQQXM}i4tda**kc7;08m&#m?Stsr#&V{A0~_C@sSq3=G-@#bso!CvPCa z3&-_d6(5pTUeY-MGZ*}^Z3C~ktmDlgO(s-8g2e-eK8V%FICls zVRQX^Y;2K{V5Q0W3Aw7uG76Uq(82d{Yxz{IbGZnqG~Y#!0*u0~G zfA2%g4Ty#`p4X*LB014@|Ln!u|C){cnA8RR;Ibf4#3UY{uS>fRj>qG7!!B}oYwjB*wrON$uYTI z>o(n1_OmSdL*g%3f`1nmNv|A$v*oPa>8koz(nKqgLCnu zOB9!B`^m7h1(gOTh3__MwssO~&_DIKJ3u1%Cn{L~}XWk7auYS%9z&fbWwA6VP>T^d2Y$J5_n2LP@pbu3%GF=d?tY$&$s64dlW-| z#*#4^cj{;Np3=|C3e`%J3G|i8gYhv})qOsx<(BE??JNrP-C8}n?gMomV=5;z7$hqIM|opf61oe%{q9wlb7BFT zk^A6<^)R~yk`8Sk=J5mAaBnS>{QN$@?l$`U)b-4ySJQjIS1U&6cQf8S2e&KQmCz(rv(obT3TJ> zxd6M@ubX!-fNf4IHW}SIkNJU(sK5gn;oB6FvD?6*u#@+u*&_P#AnenAUsV(u3PL#I z;qt687#Qasfn6IIJM(&NzN%h=xPo}8*oA_a#$sb|`$LQtb_<`A! zSBHih6Poi==$4+2S;GAy;=s+o;8oRIfp0{gU3npia1>d3XfF9Z zRtZbZ)EwuUm%xT7GW8%O@Y3MUid+#g)WKU!MaD;ukZ z+dgg(6_Fk1w!3=nod0LrG#s#34o?1B^rqKK10vb&?ItHjO+cWCugm{_Iez%K8^=VF zLpsun-@TLPMu@Pedfm#Y%nq^fEoBMpQ^a;*ik#r#s#>+@^w!-Ytn71**|31vEK;vnz@v6HOGU4%W5@;0WP#ktJYdwPCFDTO3V*q=t+i8SjDeEHZ_A2wWC;J_Ikcv0z0__{Kcl zC+Y25A$V3M_VyoMNH?JOxBH~hIkL+V^Rn-+dAgBc*(f9~UL+(U!YoFnx+BEEZf+cQ zTCm`LGitpEBXDnr({l@^14%Enx?wEU`ujI2Fh7T;h#WCu{xIUA$}4z0|2K~tPTm%iCjkA+LPE%-FrpTBDgyn7hxw9iXV+I1WzGN~ zQ~h==PaQDtbvWv#_`9_5Aug_iTU-B`@-3K1gu#%fASrIlXa4UBw@&RV1(>%5N?ZiW z)^(Wm)l5w`0WM`K!4C+2?Log4uthiF2FRz2#BKdpfd)Eu^;31Cq4+XwGG=db2|r*s z7tru)99b z(jJG-on7X5s`c-_zC15o@$qsik}of$eLj=E;sXTXnP^XlOPX=ub$m?$LzR~=b=nj3 z^?{+6uHSM%k2^^S5&yeyx1xb~3wfhrrUo z^i4Hxp?0s07jrlmoTFEqu(no^=%Dm(>vEGelK>f`SQ~zu{ZvAd3D3Fjx|YD_a`c#j zUH9vcA1N6b&o51EaN4{!T1b@&250u3alvVofmYew+v0Wg_Omx&IR z&&tQK%$?I?bavtTqn=ssv?&C`Fpt#FyzdBY#B)RinncLR-bJz_Sby)5)TKa?>@xP>>-zA=< zrD{a)-z0qWF7^YJrz8J7I-p(h?7%| zO+T#97khD}ti0KG1(Y8@Tx zGHMMF5_^KX;@66bC@_T9KUg{Vc>kJ4opnb@Fwb?EslAFt{(_8_!6%28?}CF701w+6 zUg+%@dg1p_{2G;rBXrae*C``b`APwNO!HplcXa$w`E-J%)8xr@!isZ%d>L~Ynj_Q9 zJLUpwOSgrGi*#Fph^!z30CLE{d0pOI-K~4w3D{1%mY1(BBEQsH3jkV+-|RB`J{RT` zSPPJdRwltpF^05|+Rc8en4`(pC3|*Uz^}p6?t0S%k>=^C=g#Zbs3Q6delrF1?1ic6cT5oxjJ7q7*+{S0AMNmOj63sIKmm^*sPb7Z-+M+a z@R0P%X3OEV2{*JZ9E-6~7FcvaSqOZ!crdndm>Fn-g5i_4b||<`ArLoXI-0A?^MN9i z^>gDYqu(uous;Yb*tQ1aI~v!lv`|p^De?}Kr)_HxBKMKiO*&AJ$bwy)lCH5)BsXIk8w8Nx7!mA`wx!^!>it`-yK=A0e55s1}wPO81$KMgY=VEtK z_Ih{=7mptq3tC73^0&;^c&M$0Cpw`Xdhqzc?GhbVS8~OifUq!1nCOJ4nc&_1pwOQlWB*z&0yLhD;5B-JK;2OrW3wd;Z+Xi;@zw{52tXI{#9)|@ zxXcGk?G8>%bS^O?e?wMkfHqHbYU)M8gl(9Iz#jZ=%BL1!D9KEJ;PEW|)J`b%*q#Im z#e3<1zyp!?_I87fi6odE&;e~_F_o>)G+4u9uW!GwBc8ssW;#4Mp)Xe?7QpzUsrv!{ z&_=X=9$re6|4M)|csyH;ug`#g6%rnAF@;}<}D>CZIRbWxo;W9 zIAuvR^5qXe9Kk5d!K0X2`*}(E%%%|Q(rUj}dyXuurD~+9DN6*S56nFxzMfF<=gSYg!}wz_(P5 z<#&_BdQ==TQI~r4LGu{5r0-7lLYt1*^U}iy?Z!ttc_8kPUvl&5S$7lZr+PoDpdZn|}e%%g44EeQzV zr8UX$?SLG=OVo!@9-O^=7d?bOJXW0X1(lN%On+XZBhH;SD-8uGAS~ne=+lWu)0X9y zlvYrP0j_yRG-__{IZ&hnr_uN$BsNYV2T*f2S48lnVGc`*^0wztyqTI+O7+HOV$bgE zRf`bCWFnwqLtk|k9|gYdiYlTAqSs6AF@u%KahtHYMf1v|tGl}qkc$2Gq?QJ}_oQl{ z@P6bOU3Uc`2!52cI^=qFYa3_`;>yqYQi)+`u(G`Ts_g9_ zbwMg9BqGZL>eWGA3qbr;rhn%WvCn=VUm=bfng-@EdEy!m3^M?+16pQUnjVd-S2xGq z9bkVS(|JUxo2!q6Oc91DS2ymzUzqs<+n;Zx?y62-@3|B?gmiUd|`lU!^g)*E8qfx?rdCT!(_p%$r`X z>Ll4CASG&cpLQjO($nE_BbDt3L$0JUq**B?%y4&p8>+q2uPvb8--%N0J`mjC?2oE% zIu5d}9q^@|uLW~#3*qS1)z!04dqRDK_3!D^XsQ?B;d7qk2zb`u9mSBYS9vE;{?p)b#;C$VQ63|{O{ky<5ZN^EhJEdOWe`B;Y|VX|f)pzAxL z>`@=*?iLM>#H6Iqa8HKSrJaEZD7Z*6RTNjnvF=X?+}Du|`+MK0rR@shxU$JmU3<_A z0ev(KLLV@gic>vq-v1}-Z6%0KK!W5rR~p0FMO?DAX1o<1^H_Ab=O%AG>8e=X@(5Wj zN%ng!O7{NWy#1RaCOn43N=z{XnH?b=CXGg%#+=EV!Cvo6Ov4mYf{<^8D1FkQ;?N?T4H!q!=Jo-^V-*8;s<^MuP|ukVUYo3q4E zHx}(rF;AH>GBT#du_SD@M!HEOr5XA8Lo22{NPvP46h?>?mLOR9s(uC@>l@Gdk^Ep9 zT?*3tS{nmC9H(BD8=nw%mjI*dGO(-7qy1Pu`DJGqS%pr*z8uiG!Ll=TzD;yVz5ax< zht;xS)Zhin?Xj^jP?r6^T2P{OC$XCe1Y43`H3ILYfMIpp(KpAP%2g7C7fjaQ_POuHwy z$dPXjkE1_+nE4wl>i$8Hr(mI6w5}stE}_ak?-Q80wlV%Jsr9}DNmB;fi(c->>-!<4 zT6y0JW)3Oz?z4*q@01NDwmocEF#%Q~d?J}uN}O*(I1sC7hy_(u7v3D{Wv!1-FLtl6 zSB_0JEGoDut-6hIUd2U}`?1%b2;j?*3F)&c!3}40Cnv!Lod)?K0l+$7;oWpP?6{3N z!*m;K&lGawRd5M4r#?Z(h0Mi=S7kXuZd}dN?H04#w?YK#M7zlm;Z&p65=$H#=P9iU zjR;qXl)BpAwNcRZ{(0|RJeasI2UBHvN%_`U!X!?iUd$g4rb4NNhbMH8V)`y{33Rv( z|HuyK_uk>FKgOyMdI|wskITx8>x*!fv_B)^Av2V+wEfeKyYk^ofEf*jaf)(n$XJZw3F>g|(8YaR!j&;I5?jCKbSnORpC zJ$-VNP>o6r8M15>OOMF|}pG#jp@X#HCj%I5Lu6o6hh?TVv zTvpAlZaG0f^&Cl*ohtYE7t&Jmo@T)(S=5pyKAvq%!*%D^u$#u;tX6aL@~Hc~Mh!S# zsHg;YSZCzqD0%Jo;*PK}_+@!98C{cH;kNO$O4DZ+-C8r;B7`j2sF+@gf1^JHDhm8` z2mlk{b3TWOPY)mxGZnb)daJIT{hEVGbb7N42yY| zxZavy?NfC8rwp&O-Nq33zIY1Cw|ta6iD#u}c>ttM7T5jtc%^fG*C$=c&L^#`>=h8l zHJIonI z=4XS!RJXmZJ)lO|d1Bb^s-0+;y%s@Qd!3Ck54lFc9{urSBdnuCztiby3{alGR8){S zRXX1PQRH_r?U$MCHheAr^PMO_;OV?hD9<&VDcbD%nyLD#duC{4Y6gj03tk)B6@gdc zUE4f3(I*AdPrUDY4Q>jUsSN}W5(>TSLdtvkmc9e|bQ*j5(DyJr{T$E`?W}|Y)F10- zc+ob?j<-aVIIkE%liM{9OLEFGyCx_2n8)Vc)2H_r5h6#PT(|N5=$fV9B;Qf{=r)H% zMH_nWY|OW`NXRD(1j4VCfuy#Tl@-(7Z)C>M{oA^ViHXsOV)#JPmVwJoUx%;1` z8AGK5knI9@Gj+wMI8C`IIgCY-urIAqb&sek8yQ?K1)o8Gz5V`9v39UtAN`-V6TuR4{|_dP!xl(7gT&8 zJ_q2n3&_JT5dli@J$`{-5V;KKV#Vwcu#`Q5ZuHnSP>B=QCTYV>LKmd#*L3(IB zR+fkV%b1vm=_SS~GvnTrBye_p1M?cQ?!-&a9A6q8v|8R{=M5%8*)hY{Xq+ZWC)urR z8>@$YX3Nn@T0x=jXO~$xeMu^DO)8M|h4k=5qNn-lFSTBtlotV)tg&f0uW4k|#&wOD znmCwIh%hbYLQc#(apuraf_wLwfKDv!`0_@_Lm3DQjQR8l!X~fg<>i5g^+$+@1ETWE zN}fqpc63^rBxLS_ItO6CV9^}B>oc&8lad&73c8(lo#3zf{J4Yts0mnvg;RHSUiA+Q z?Pg`;Nzk%@=DR1q#LtoV?bRrP_bEErC6GWb7x!2tYd7y^Iz^a*kd@0ywpK!9Ph@G^tQl&nMxVLY2A*en63 z=4@ueuN@1O+;5L_0A-PA3B;ht=|H_B&ujmdZM5k4{{EN1F`SwCk_j2FQ4oAD&XEh_2|(A)u+>BN?(ubWb+w`} zMy2B#C2QnhoGqKul0hx0WqB3&^Uwg%J6VHP)_ETrn4mYG7U5=4qLB!Y`KKWkxI$3W zz0~8OjTwDs*RJIF@~+iL(OqWdaL6a@>@s`tN+$$LS0u8_boQ+W<1w5l>pTSwD;q7^$N7E zvdl$e>pbh;W7Zge_M<<2e9PS+1MC?RQRjMFI9}r6cu`=QPvijgWPI*U&Xp)BBG}2( zfjGHq+LSq`1z3R{qC6b`w)Ea;1KNF}s2{OIJRf|=his2%Vp^Nqv>j?DU%iT5`AT{5 zu*!H&!`u5L#C_HNPhM`K|EP8Aiv5Sg#P%;@QU?u;+GmVf5g^KFrD4n;`bO=y8`;-H zGFfaBtatJhPV~Bkzh+UPZUlb)N$dXoQ`%r}FP4V;cddX{K-*5T*cX0;eE@LmC@za@rjEuXzyZv|n7Dz^b zqOKw<3q+~A?7Ww)ylLXd7GT^9y4%q3(hq5$WYt{BK~)@4#e0i_Y}MB3`CAn^eIR{8 z2onf-VrHBHSI%1Wp#c@;kd^I@%gpz2mw~;xxkkGuMSl9wwLxeA=I{i%z4orI*`k`^ zdFMYa1FSg%oO7PCa!T2EMAHij-d~@UoOXLm9&YPBQDsF!MrPVQTotvnXcm*69z23- zF|6PQVh7|(v}QFtpICzi(!S<00FN-2H2|0ZQVxe%1)Dodqw4J9V#$@hoqULo7ckTN z@t4xhli~R)%cVKST^=49SC=2b`br-@%nW{QZhp5JEBz97qz>4TNN@^r3Jk2QaXV#T zGtv*+9TO|-Q=PVq;dzrFln$)^%vJ3mlx|Rha)KNQJ4N2Kj8as0_+VeI3pa@9VIpMZ zA_IF{(|G>6*f|2lU>=>%O}1_1z7YXEX2}O{CbNK&1#uFZAUJ_v2HGJRX=#Int!((o znAEsXBv5AUK~(TolbfZZr-w2|@BV$Fkz>i#M>(XUt zAm~Dv#UypVcZPeyG-b$86g@uQWJEwhAYgf*6w|j^>=))j<$XF+QO9on;N-5T-yH}w zV&-O@O`f{f^ZNrdFa^Q}pQN*PB?>OX6wEaY=0un!zr7|IyMSr>5KDf{Pyz|ie@mS} z-22nGbi8a|nN`2;odtwlJhJ{*M=-7bwC{*{yC(GA^Di2a?IwZ1-&VXlb&m?B=^CE+B;f}5|$>04f_ zx_z9vw?$~tC4Z~cz0GW=ZrW*@#N8G}4}CtT7u)4?O{|8Q`=%hQOEq`EitDYOtTZ&O z`TEg^Q}mh-Al%MwHcUnF`_6Hn&Z2QtS0bv^qeS$hw>@U(OkpY@<0#9e5YYqS379VZ zQ_Vqi>sQK51v&$&co!~3!6!skP`s-O8e=P6pE#$Q!gctFhM&VA}{x0Pa8A2Ht z9ZjB5oF`4?E!@fU+*_RxX0(Ri?(S?{&!d*-%YjPce6k0iTzX!M7rQ>J9EOUkpO%owi znrQXfHjg64>ZN+Q-~Z7=7-EZDZtzxwKC&`uu|asm$W-h+GT-5P?K%E*)QW3ZplHbC z+RsY?hSm#a?(K@nJ*`mFgT`o}kqVtiA{xsxw|!WmArG+scR=ZXlm=<*pw^MgPwX=| zTCZ8{)G^-^NaFPQw)gBAa@lKk*=JB2S*}JNW_7cQ$+OxE&eR{E2GyEn=`~^y)Lzfd za6{Ah)Rmz|Od25|k=_nWfs@Ov?3z}bC9$^F8vibo_Z38a4n6ph-N#!ShPMPGqZEyq zoNV;uJ{eYw!vRwnbRg)Ewt@mvnhmLfgB)HZ_SDEzH$Zi!YD2esjJ3BTn1_GdBs*n} zF{g1lX_bL4;U-JH17d@_599FbDb$*KA* z9dBAK4LviPNR6IU@h~&BEiXC?_q+Zp`*3jja8iB1bIjx^@3ZSLfVWX}(A9~O?LtL2 z#L53SQ2AixWaRkXR&ndue;12yy@5`jY z|5~JillgzRdkdhf+qT^oyFgMp!~hX#r9+WWDFNw{?(SA;DFNw{MpC33rMp4$CZyx0 zJNEg1-goc)eKTwJUbAM+H{Yz8XWn_A$KbyIab4GWp2zV!-0XA5*7lF333U6WPw0aE zaRglwy#%RYu8G>wyUyZ`LW2vXYI=oY>(Ic=ta^IoG_O*6p?!_A0bRRyl5?io8}iUwRiV}Nv>un8;MOs%4CP|!yFK~C9ud1=5Hg45Eu^8fKBm8G=|XrO|E)VLjn z!Uvn!RQI5T2&EJq<{-#x6ScSzbZfkA4iK*>f5;^ zXFtxp)U(4j%&Tktm(Pb1^?S}VuXl48pvaO5p9WwW{B{==N|fE4;NV=GhLra?qVwqt z4X%LY7-f)-&*$+BtJPxR4-Z0@YK~UG>2fT?nXy-Ye}6mMnEGGz`QGrbVSB?aD2Acm z@PLVFA$IcX>vGB^sfH2j1*pnqKQhGD*eMRr{Pq%qes!k@_Q}%FvF!{RL>rmr23m0B z*Kj;V`YS$^W!M@0T${h~L2~W(v+yVJ7M9_{%IXLcl&($F76D59p~2@PiIB^anrb{b z4=kNjX!1I4>siBC&`jwk&IiP-m`fiS8X0+9y#M;dFrL>oqTVNXnqq6lhO^9h_9~3R zwHc{g`6#$;0#cf#-Uk)}2xNPqyEpHn->Qo}HcVG_*W;qYCWp|iSvk9@npQ~8(E&X~VBTf;T`(KAlxSYpLq^QtVUA!@xmZ_w zx`&NSq06oHA;s}v$MHRVHWJ%J(+(;QeTt^rdiyGnrI#iv&?a?JQ6e+)TZiy1dL>qo85I9MA_Q) z0|_Us{TcWWO}Rkf9ACKypXvqFKw}AzxiQxHy?+4`>zKf9CDLIE3SnS31pQ4Fva&98 zoEzjonj&rCSN|ay6|ya@t>`xgsbP@woN;AHB|ZfC1XvR$M~bg~kiw>%?@Ke<+Op=d zU48=RMXL^{$?*dJOV@702eII$*xB9N9N*3dBqNX32o!GW6K6E$>wko$q?jdSytRgV~j}S4<9dZfN5l>@+xp%n3OPPuIHwNbZL~s{i1oUxAVddeY8b0{Hfc$}3_oep+2EG8AQ8=!F^I*&< zH)sPeEGpr1*uQCBA10YesxwlrDGE6p7(v@ch z^B{N{z}i9@8&munFq(i>l|1JEiDkC`%}G328K!<_jOtnG&s@k~NH~+l#sDoe9jr|s zKYk2puF@@25SF#R1%@ksqU;+Yjr57#qNZzi;JQI5#Guo>6C{s%Fxl>7s;z0!M1az<&8Rx@s>8?xzUs1V?>P5-)sh-fFIZ`c zc%`*xEx4JvJ26hTbBMgvkF24|O&P2Z%fX!|JY!`q)$QwG$QteIFPkq>{gfugErx|X z=-IPUc!ZwYN-%)`37)OdiX&XUc>ykq>xD|DRD|?r%M>YyTZL1Kz&#}}$R0>B~4^+0dSiR3GVD zV$%rVq{5|IKlY60vA6!)vWdH(yMqY5RGtvRjDaE7ly|qo8r<10qzNWb$G8;S!=gDw z@=T^g?oL=(61@Ar>7lrW@hFJMp~xvQvedJ2A$H}92e%>EJD?MR96fhOh?bVuDP_C* z{ez)DAx=~5n`=*n?Ij3?F+?!-{4OUA7U9hC?>W+M6&3PgWX<$E0g?LPw3ht0)XSxa z+dqk#*Fzotf%$3iWYd3*O$9^}gGVWOl-!jA72n{cbaKAG%U`{-ziS-U{;aN!gZWKe zsTT;{+OR1o;=%f}g4Aai5M}97buRn7Gg7_G!BJ?GmAjhTYUeWW72#dziSTDcH)Y-G zY2QvfSS83eMZK`*%*UZetyy8cRZw86{@Eb0kiNnao|xFY4B8{~>?N3_?HljLy%Cep z1v6~{I8FjYQj|ZE%8_it7)?e^)*tj+vzuEmV0h@f@7fVgj|I)npG%XKMe=dLY@@b;qO zIM_Y4o24w8kBU{l=Qr!H&h8(#cC<~EFKA3_oX-gu=duHh2M~D=8M0{QBs%X6^zRJfk7xGRYKGj5LwUo0GV`}rSNQh|vEtEbcHw*{$D~qt}5ST(8y$jks>yK+n zI?72ve+$rpi@&~oYF^O=JQ`4Y#_49#%*I**IFXr*EJ& z{??vFx=*zf;FEJ&5LYrJj8-^-$Q~9@)af)G$a14u(>xuFc_F1a9-7r4xgW1Rq)eBj zn}&A^4j^EA1RdXv@NixD(f9QHuk26V4WDCEbUuDuV&)uDd%98!o!mlm6fJ0VZ(el( z0j`X!jADfiE_C~mM-tpkusge*6;jRGVFxLhn@O_Q9@oo?(=jB0eqyKS9q=EjT~D8= zb0$6%BSdb47BeyN)@_(GG^9JDwE&tkXv}{(?*dWn;Vu)hM~@XUg@(on>g&_mPZlRA z$=v}fYAocM!ks3us4Uk$U3(`d_XFO1KY#y}lxh!Q|M^0A29b{oU2%{-!R^K{LWg7| zI#L=}g@aF|!rA$-x%QkMv`)x%Xh^*bvxh$p!&jk^+ZI%6*W1_k`5|Kvr@t5A{it2| zYt4vp;jU{3Nmxp2cDPCbN2YKDfgeo!u!qHj3c70uU_cmeQc{5*rx-aj$iUh#iM!&s z?iC3g`PAC{#LieWjR2FvJ}-J=pCy;U^uYrfP%iS6mvddd=mz`9L2T_&_}-5f0r_AA z-^5SE*Dq$(-xIg1t&P04UKOCJwUdB_;~RQl#o}onXib6F{1){+dY06)Ddgj z#G+vppWi~)I)8e8w*`z%QO^oP@oD*K32s`hHY|WLCK%Fb!I*~qT1qSpA_mVlwiBQG zvMk-HJCnNI*EjmcUI7~!l&`Kn$*sy(AOb11?e>Xiuxk^jO|8#Pg!^P?qg3#X=^skPN&X7*qSb0c=nPgAmQtj@3o4V$_2z5vUg|*I0D4x7!gr|ixSvg6$5*R zw34)ls6H)%H-kzE-t)_uxo)5~yjoY-T_gVD1tpulJS!*Xt4FDj9dWprB85!K2Kw;q zsw;g!Ym@xxA`}Y_*3FWD+eK<4$h8HVP@M@oBIvE*bpHqz4cK1hp)a5fRR;J*jL=uh z9X44N>T}0H;~)w|yb;KPuim`^bysHAV`wn<4Wsfa)oW4RXQzoU(ghz9f4-@E81N}4Sx5q*fVJEjAYoJ(26GBTr6Xn*fCEmtyHmj| z9+@A2*aK!>zkUJBrg9X{y$hVK^S8iS04T4&(YZ|D9^Hf*w^7euf2iZlT8-t_4hd3t zfG^~C^2NRNQ(x-DV6cy9wk&{GBo6$)>Ml#qV240101(LDIF8tWpXH6Mgxdct=Ud-C zge4I$AX97hll34W8Lo>pUwc4|$!e-hx4AilJKP71x+$x2;J4Aj%%>|TFKXcsS{+~z zg?rO}v3J&el zMDo-s7w)+^Hi!Lc?8U{!fojI&wb5c9kVNpmz5bZ|V2AlzqFw`ccfoI8#L^1K6__sn zZD(S#+F8`Eu$U)#mP0;)1IXi~tOro|eq6+xjj;Vz0QrBQKz9c^{yI^q_r*2{U`!3lu9jmIw4guh}zT&{NB%4Zl<>f$k$PsbA{dIH? z4tTKMzoky~9AN&9od(<ixskU`m)x!+1VfJuiFGH$cQTZsgYsY$^U-axN~VankiuZPu9U-YOpv#6k2AWS7&~ z6r3D6q=c!xR=xK#8{6IYK*+IOKM*>a@!lCd(|kZ~RIaLMHk1Pd6pN*-%V~#S%Pxxmow# z)fDRSBcU}49pN_o@A zin*5HbIg&a2kQk0o?rqCXQV%-?7R6B-u0Tzn)dK^0d4?F>Nv@ay^(1fK(1PHuTJaM zhd~gfS+ki!ec{->>E`T}!mO}^b!bIlg3bbg){>z|>tJG3jE3e8w9RH~B{Oh zPl~tX#iFDz_!W(~+B#Q|7Pj3HQ!0C(P!dpYwgBAbXcleKYy5oTps+44MpXOo!U8TQ zN2M|b#OokkgF68>h$n@5as@6UcuxNL!4_C4FUPUor7ONxugPlBfc z;r-;Pe%FWnB4Lt0@99&ROr?RfDm@)Iu1|85tm#*VbCbT^)!>QOT??J#KMo5{ zdu|6TP_964^@l|bsnqtC72?!J&=DZlhkl%PQ?xHwvI^beofrTsNh(;-AE1a-2fokm z)@|a`!gnnyE)9$N3MQCrGu2DQca}gr`O{=cYrZ?N9vX>7KVY3+++9p3;kJCDHE2rz z`!FBJSRT~|eQm>V9C#|U=R4kr(}bCg``aQ*^kxw5Vl%226&z%b8}?fN<@C+3@I6`d zyPlY8Jc%f%Ce;4NDG2@f2|ex37?qJ9W>{WV?r-k^SrQ)6$B*>_TFuc;=u5~+;B>ci z)1hkh)Z#p9&3BxPW^^8=^zT`tp>mHH!Z7;pWm4HwXN?x09jXON&HqlH$^_njg-^u- zFiBW^c7i8#6JN2@?a(7)vexwWsN!j3pJKB$qoBltI3jhYKxq0*TV&=gLI|n5i|e)W za-e}`Gd&N|`IhYbMi`I|i0$%+L9Yu^tin+S%xD8@8BAH>P7QE8`g3-ql2h#(zPB|2 zlvJy~ii z-dU1`#&`4pT5C-o>^#o=f12-OLxS$po{4^s?uGjVH#fVwCgQkVgG4E75<%l*Ss%Sv zCjKB5tDWfijqeOvn3&k@&6(4OS`zmkhZY_7o_n_lPD`Kt&UFzv*Zcc){I~up&Zm0! z`Y^l)IOGYRUhJN}{Z+TYT95L|sM|32(YT%!V4zDtGWphpgKO1}yRs5|51_7-LE%i0 z2~)V;?ej0l&c2q>{{miIpk6)toLtRu6Emul2Bwv8vezHB$aVnKArG_ z5iXj;p3to}*wI=a*>eB~GC8tKY3CE4XCczLBBv6glxw+MQLoKD>_eYQ&27pKOD+sX zu6%<~tJ1ODO7-VtcwHv!_(ViLzuw=Jw{4Sp8H3Wb=eLqhmx(#k`MhRsT6w-32o z{&Ip|Mi%fvpdkE=_Zu)?Fn|yh&ETeS&`7kygd;oRs_pL9-AwjUrr~52GI`J`_C`E) z{mmud`oo%U>TttnLekzL=L|4e#dSKR(?AE>KSuZ^J3BK!# zvZDtTU)8uODCi+OYOXQzEVHIGyV?U%(pf>bl|D`X(+9iEeWhchkz(!D?`00_kajsi`XquC`gOgI4BlD)sOY%Fr zm%l_t){k?smAiK4BEs?~)2uQNm~iR&Mc{Bsal3Lfd2$7aZ!lsNxk2|YtMt7)4Ir)~ z7qAS)PmB*xvhxksrwY@E(>Z)$o=|q^^_J?5aBbdm*GIYoZ4M#cH6h-$G=(>;9bge8 zMyPlA;34rJ3E&#P--^d^QulZZqg6|~9)7hRj0%}6!M6meSYtb*81y=53iqZ6e%ty_ zUo$AsXnarZrhDo6K-Jqa{m4;SF_PU1Uvxgg_8oRcmG{q^4}v~ zp1rP#rySW#Cle0C6;TUZL#KPk<9Hj{F)%3@E{DuuWdp6yL>cqHUHUekdOIurt z^%vL>p<*!{zcLuf8~oY$TMc@9DYrW;BI1qd#2w(Dos%i#Wnv4$Dbw4VM%`@}>ugEj zG|((2iKzLW<`RTyz>*3_heLmj(~HkJ&YHMI3TE;d_|^A`1Bu*I_9dXd-0;~QamGfQ zGEHq_T0-m)M5BQenB~0t{FnzkWo$q#*1WBdCp5Ghe12?hv)$#Sd57R{NMdBWcCf(9 zyTo;O+(vAQz#ol}FHa5=Prs;DPU?gDcEf=eflqCC#Ile|9JugLj#Wnj+0quF?r|NF zM-UKgR-yzNncO#JG1T3+O>^}(Acx2%|6lEb2u8IIXrMZt_IA z8nGZ=0E-F;g`?PQKbwtE%O|+*xElYQyH@QuGtU9twK}Tn9O-g*c~{l$;=DsK-NA&0 zJygo0yF?`OQl~k4Q~jhX-V5~9#nL~y8xoIm_a@4X=E@z`4f&Tmsggi?R$>rjOBGTuW+u|@|(Nf;&IdAw*xxuC)$ zyT2tRg+Q26gTYgPtBId2)t)56pdk3-^2K&uxt@O$Lg0@wt@el+{ z^BPZH`8a(;XWdTs`L4#<7)Ld381B6jtKT0!)l)hv{(!Fx82Q@0mvsM&{uLpI5(hHB z8NMo8$cu*fcl%3 zY`%F4LQCT3x?QoT0*qVI(u5%tamt4C)f-8z<*zbe@`a}r_A{_M&j6`bwCXJj9i1QY zTK%jFfE@`Ya!~^2w|{;6y=H87pNT`i!}8~tsdy}VIQ$~ibDPI54Pz!9(QILeQ{(H` z7JzMGKqCngr5FgARX;RO*T7RDalm8ys=VNM1mrQF?})v=Rr{a}%xV#4P0MTA#ui8ZL+8;X{w_0Uce)*S|V2 z_XK|l^|NQu0|W0s$o)!8>>(dRcoCu+mu-C|cAt+gFd)DNzGcfRDQtI1TDJS~AhBm< z6O~koURqv&UrIjLyM4}%C-3CM4VIVGjO-Nv7$Rv=MFRvf_hsL(w$d%{(LAILjf#3D zqjm8HxMv=4TGC{`JmVqdLiP(4K4*``qR+RdvMr=%Z)T?<>an_QCoW`7Nqwjo$sH1`TF#P zi;FJga9dBibc8uZ9DE%t_Uk5DkK3UM^EFbc*@PW3pXeU9=>tBo?!%x_T2WCHxExv2 ziY|jT1017$va*L;GrCCO4`mVvaa7+!?LhIJmY3i@^LJ z=s7N~AKzlCZsH?D1Fi)DM1l873;J9z&V>B{&UC0Ri6E>3E{iarF@Q4#0a@QN%Wy6& z^Krsj1XL1$KcqP)%+AghADhCW1%u1`{G!SQetr)h(h5F;=rDF*3?mq`xkfQ$1_`iw zY0#2DbWnKsvg_{Nn7OP^e4k&oU8Mw1A~@B+rk9$YIwfua{@-@QFA}QmNUA$;kRC?mDuOSr!o=->71~rd5A5=2zHI@P3jU&iyar9tMHm z2*LxKQ(2%t29RTLU{n~2yl`8O;v}S^61bPZO>PHW2eACW{QNuyeOXXE9*@mLa(d#7Gli8)vKi1v)yr~cP)E5IFGvGDNOGm@}g0=EUV zJ92k)!OWsvItKL%NWdZ>=LDL*pYa;j%NBKK?|g%z4I3-6~e26s|xNyXj!FZq=$yb3qvxB_Bs~u6D!8z z;Mwbo1mO6|$GhNhdB8~l*7)y^R6ZUjF1s;gt`q=`nJD7x^Vc{rKb z!U#*-s?p)#=l-SlF#E%gaPFjGizZnjAatu%7`~p=ytb)X;OTRj;@L??tHHsrKqEI6 zzx##?Dw2)BEhJF@2h=rT(GeRG=An8pG;GuwqGXnM(08P@!`X)WKWAKF{LjXf+1iZP z=BFCF_Pv5hJ*mog4L28*gSCZH$xL-JtEVS>lU{fFuS@d%G%n_jlX{w)T{5cR9OtMl zfK5eO&$*qfV!zl)mRR(+to+KwkJCxmHjB-sx*c0aD}_^@n=r)*CfT2WnNx0aa%np# zMWZqvwWT)o1{DVxQbGl1;y63eo0-keOX)o@5D5 zb%fCe@7Z5=Q2i|0mxHEm&i!QnT+Ec3NZWlN>AT=4E4~-YWC2MvdVhTXQo`8LwN<-V zcFY-rk98Jee->Ry%=w%alvD*mBDvk2Hkd0>sOA~3?GYQa8ivb{eQoGd1-Ks^*IpIW zULQ>9R`}}zVyS50lp`Q1S#36mraak-bSK=cEHG?Z+~$=gE-2Bo0oTLYY=-+8{iMq& zOhVi{jIC`**`kfNmHPs+6?l*=Gzd!(9Lw9B&3CIHrEsrZW{K&jK@OfyhE?j^6xDf( zj{4O zZf8N2jO1-?yPqu7-WQNEy`ExE6^w~Z;wmBBH>EgSfy0rKM4iYkF6TK}jX~p%I2bgO zZ8UrpYnCk>dL7$WUgu4(h^=uoM^$;KJJ~YOv~7znJWCs=uc2F0V>DsEMOdgrrc3`@ zD`@lgME(*;z-&{ZJBK3_0~EezyP1Epc>~*UnEQbqtJ+xhZ!HG%r=-#BrZ?>>v4D0R z_bdqZ3OE22*~f@KV7)wEoOhmmW@bYihD#r3%oo&qZ$XX%Pl|$&iFF{pmv~8wf@Gc1 zC{8oXQk-aYy1-X7=rylXfYz>k{q}%`&oE1sTgo0fWE=B-iGsOet#N!qr)hFqjH0Cq zq@m2js?PjRMq5`pucN`NQ1#Fg3 zbLT;dVW@2AZ@vJn=FR`d-2}Y)M&T>NIPSDvY_9RzPe)FD@0{<=#*CG8D$mKShx;E3~7mu#x-;Z8A;G8183x39iOyYvAM=AN=TfcgF zmW>3MVO*K5BGnAtM*$ltwNJrCP9rTr$7XWNNpj}s^FVZ9dZfCVzu(r${jEKj^*bn> zC6+t&rRB|E!G*GEE3Dk*8jop^LzvFNjY%yM_HQG~@O@JvLBxH+ajiAq-@MQ~xp|;C zSOq)|g1#%uPVbb}gE8}TLK_o5sm9`mY1>$bUX%If_umuTS`iF*!1B+({D=P;$Ju)S zFK^5L>uLF~`ET>)PM2yv4*|c=3I9L2X|7Y(^ouuVR?&3TkjytjRx6OegDXjXt<4@t!;v<96{mPo9P8==F zT2$~DpF{mH&)@Cd@o}g6;bS%Xl&;7zK3|mk>2~2v)3I!X^A0F9D|B(-&!Qxg-Y%xc zHU!ensZrOEZgW&$7*+uXG3cyK6y1-9Z)QLUGm9yNm?Lct{6Ns3I2q{o)!D`R07Yq7n$KB##06H^3IKPw zrfK~|2xv$Ef;kMCF<`k!gNYlUYI7Lazn4dacU8DLZyrr7j=tX_Y z2bvQ|Zz;Z8bA0t0U)9D;_Q{OE$qv1bw3=)?K!yN>T(MHBIaA@Z>X(aH*xwg6y60Me zB+5~5%>U#Rb#}yU8eNtEgJu>|C?w}x`eRw?hVP&Hae{3UvLJYW==KlaUQtHyz94#c z-1sOk;Z!SmQVohKAU4C;@Q6PD9GW)UJ(u>UZMbRG9WGL>k4f3d6TYmWUUP}(JH7&n zEl%S_;X1~yNA>uF+@AA@LxVIV$?z5zl7b zH+G~Z=HZ1iQ<)CJ3y?VwVKM| z)30+q`Xbn(nPUThJJ%cjoEQtquFYHeGw}q1%87x21LInZgHqJlM;P|9LU{*U|M^*E z^I>Pc`*+IH8wjQdpki%$;=}WfZi*&DZdJ%8-@it?4N)w zhff7rEIOc@owlpwvOOY4WRZYi@hxY75D1784T<~u3fi3rJ#J!xPqnIr%Gl4E48@q7o8Qu1tN;?S{e!83Q$|RD!E64Q>zgKrp_grGq~g_3wgb(etv#{(<^od#xxR$@b#_lLW27hm|VbEoJidvFja`wE;eu>!I{M4*SAv| z=sj@QuQs3+RA|5$QDWwbTUifQAVPF?X(Y5Ksn7x~AZ>coqCk(A;JU6GAfnx2k>>^O zdbY)1e4M_{b)7&tf?jdi#B%Mm|L?#TpS*Rmii&&ggWn;jzDqLxJH69Qrm>M+SIXPj zK42O`awXQ+0Y&pak@dpLxv1GQ3utW*P~NTV&HyHMg+dG3c+`p5iQU0WC&TFdS?tT# zFJHWzmsA=HNm!RJBF2`qVk`u(hFqDo|CO|t52PRx|8ElZLfPv-u&^zy;_L+%4}3nw z3FVZ*K49@tWgPb1EiNhP?fLUmlNkI{Y4Nhv)~u5?Fq)aUiS~yC2cy9LAym&FA#Lr# zy;y^gUFhQmIw$b(R4$?IrDat_!C&a)Ixxh-xk!Sa?%N3f`Gr$#Bx(`v5Q!xtA0-oL zBS50QTVY^EVLiE%=WhU0K;?wY0!vN`;&{CeXO2U+UNW5`FI8}Jb|)Fd@IA}&$_#y> zs;AN74UON2(*e;bA<#)o)*KU~LJTA4igd#KVShl3n5v!nQf|Xb>N%2Ag6)3?&=$bx z%(joC{ao8C(p(Ai&LB!2-0dpFI>Q$U{t_V67rTN5F$Gbjp&ZQ{xcqwBc~-pc#IsX^ zFU?kAxp;dJbf#kYCLpn75{V1;#ol-Q-4$QSW%c*K_utYq2Etp=U5B1K63%2~oDU*H zH2T!{cKphHdFAZL5`TeeXrw1NPv41?yaweCT(ivse3fEOHg5iangoF1N~x*wK_d&c z?vbNaf3Rf*(=9ADHiMja9)JX>gIKsb!}H&W2Mo zwHJym5YhfyoW`#l-`Inb@PY~cfrPibj~A|vgN_82Dz(vp{xR?ib^CHhffy9jKZtfP zJ$sF!2tdTeYmbq5mroyO$XO6nEGTqhVqy#pstIB&VAo6wkTvW6^iBFT3%mDD&>$t_lvn})UubWUcz*_lyccc1;U1MPk^7@ zDwbc>wZ6Z9q36$^hUQ~|D+4Y|UjC7ysSGLo+4n`I-m0i{haX)vEnnO+%c;Pq<~;|% z84@}5)MxuwC+JDhnR7rAuEXzKtHn;a-p>qjygNm z_7t45;fB8R?J<;taU28751m%Q5|f&1{ttunOKLuh@qyDLk`pF2 zICXpYk&`$L8%P8@axjs_{0y4zg+oU5ChTmG71@{UBr`amI-PWl9U<&U@t>0Oqj28O z0k-nFX?4t(FG!;lR%J*K)_h9ZiY@SD6qKJsIqI*C-u#Stp^17QB-f@E=>x{)<~vnP*EG4dyImA^oAMk@Yes){XOlfp)x;?2o}IN@)265v%5&7 z>U;;K*$o%S+}m?Kp?m$>uk70R$$=;~5{cD5Sd8TI9qco0X`HtUSp5BS0|_$&v?XMG zv&UjVrWpEcg8-z*;?XjKU|NdQ7?BiA4hsrmTt~TJ1Kw%_-a+UuLQ2#VjS^45=EIN1 zEo}VcZ1JUSiv&b5cfe%Pf`YpM>b#LsG(PB&uUtYz#^34ao~Tv$rl;$HMI;!WHRxdq zoR0)sR$gn);ozW+Mch7+2@OyBYluY#ZOCMe8zEC%H*mTgx0du_D1qtd^N5a43-BHY zFMjzM)y3ft{)j&W$&FbXA%dA_Qej~j4_di9C+nuV>zYJGMaAavDM)F@3(oAavL63| zm7<}svA1{fSF-T7Qnk@T#1mp=g$KLzcUduv;{BHXZrd!Nbb)&Hh9T8nQ zVVS$VnO<&*DQ_Q!L`w;YG;BBE2Qxe%4eS{iX@py8zSDNq5@~p?jvPNELCi_wTE}BN zWzMJZpaLy49$v87-+QYh-4&5*K5bXt(((g%9A)PZjz;+$ zVegq=fy4LwK;UeWxf4Xp-U}m-0#Ijz`Maj8WA2b~HVz>=+RQjp0N%8|_^T(gj6Lt? zr)zHK*G`o9S=sn5dr-S=ZYO@rdYoiIEGH+L#sX2q6r)`=mkj#@LM%;YXS?454VxL~ zd0;c#0HG9VRY_Wb1IjE!5hZgA3)G@=H!bqLU* zpMJd`Jy2k?ya-=&W+g0x%Wn0u{kWU|o{9;{&dy$+{>D@sBbt{r#~EGjPoyy_1Tw5? zi>Uk>?zU8K?o*d%&)C6hMh%q#iGtk6`stohT>r*DXG6EoRz=DF6dg*OD%CAcGF#4E zu6MnC*&}n4Q#6=zp(iQ-&*>r2*T_hcrlh}{64kfivayMe<(DYb9O&^+9+E^;V%wXS z;rrD8D&Hn@H0>u7x+gt4$}Q69WAW(es?){H>}<``iZS5OSDh^D#l$EdEVmSBc00ln zKACwyeA5SFE!vNX$D28-YrFe+V}?g{IBA zgGN?MKwL3bxjYt_TUrG;fkG_N_?i!*I+U@W_}6p^c@JiVk41GpI2L|bU#BC;lHo=v zu7^MWG-d1r2S!1G?#@%1$-TtKdsI4GsZL-=2zB7?T5zt_8R}R9G_>cMd99daNn**~ z?X!9&_nVd?X$lxrZbf0~^LpGo6^i!5YXk&;SGp@jbT9N8bTD_<9&a-pSfMTik#k9w z2+*6>RDS<{CAe8aU!Q0nRhjVfXDE8h;-+QixCLK21}rIxcK!F@gnMd!M^ajv+QZ`l z>9*iXd2pICFeuqD{X>>dlbnM=$zepZ3!KLL6NR@cC%SleCNpw!zCNi922($>yFDSi zH8-b=c^eb@3!<*B42Aj<8F1Q%H>h<+c>4mU)ebSd8Zb#?F`j>Sn}VCwga=)-e}PS3 zJY`OXKIttnsLEra_O(V7gwCudLO^HupxqUvE{x3Ox?v^n)MShH{hCdUs! zu=}hu?_yoDVhf;8i*r3VN~`O~{Dy9PD^~n-wpV$wSW^l9yc`YtYfxL&Yfz-6r;|pu z3+tu(eBNRWqBAvcxPxrVZqbAQA$oTvR8~AX{qK-3iFg(piZ$?;RT!bu^@dO>UUo6l(s>w(Qu}wk>IO_0Nr3({;bb;c?s z^AkGQsFyg{^z)FYix5L~Z$n9z3Bx&)R6sGt70ajrAIb1R$D2zTjBHddP zXc?xJN{Q;!IX;D^SO3UhC&2hbokeNQO-3Y5C7#*Z;*XSXvnewcTTM-A-X=f!3=G(< z?QI8>+5XI|wk|3AS&Ki>yx-Mp%~yFWz5pj$MnmDHk|Q0DU6s@$ay|IsxHo;i=Vv#@ zMz^v-dKK4`XK2XGK`nK(VwYiNvrIk-NA~a_OzneZOvpNK#;yB?u+vQK>VX@msW+v0r26<) zeHo#j(4T@?SIA|9k1#jT%I2~;cY!aL^^LYnni!i%6HCv`hp{=GzEmf5R25e6nD9$i z2Bw-F(&-=ajsTtk4x<#=en60P#R1O{3+Xm5Nke67dt)tpwC5|r?mK^OK;}uqCcXyT zd@)BylG96e7#Q^zop=c zbcNe#JaSbE3SJ8^-A7|B?QxY$>FPcN8-|e)O)5p!pGEFhP<^dvqiQaV7di0X_VFlO z=(3(^7zXV|-|(6*;0Rn^=t^8j3AUG(Q5AA?qx_tl>T37O{+z-QRnfQLQvjix zO#}+F4RYZIPeoMa{IVZEAjJ?(k^T)=rzS)(w0<{@anpfZE)d_pac2uRmsiL+{z-6e zo1LK0JzOo8@G{cj->=@i`JVNLS-K0)U--sD{#bHH8m@u&PkR4wMMMek;gKjOhX|3# zJ`j9LDlGBNsS$6CC06_qp{}BbCVsj(uW3Udj4!U0wl{j+A{r^T<|sv##27pgfta33 zJJ&84(Xr6qgbDW7@bI7J=P$tFtQDpH(T>vCmA}{ z{8%aEt14eJg|xk6i%M0++@Y_nw#8&2BRPR=JebV|j$*;r!R*NX-d?Xxz52+xl3k>$!g21B+(x$+ECk#afLXgjr_zm5E4XL5# zTw8OI*AUUNJCy;)waE6?ajrtep9cII6kKhfj8iPvBH>SrjOP)6AB!JmXiyvQyPTA! zP^oe=wo?&L`$DY5ypTVE^~|XbnmSjs_icWv5DoQaymWP7-;+@n`8Qf8Qw@+HTc8Mr z)T2<%Vy!~m_k|-rz(cgg4wEg&v+;p^o9Ui2Zi+HhNmWTAvq=2XcCWFu-w=F|uVx11 z82I<-0~0MvE=%rs&Uj@9Nl{jp$`ZcV5|Hk?9%J{t)oAaFB`laP8GI5YAnMLU8fXR0 z#C2t7p6&TAttAQnKjEx4c;B$&2?9k9ms?oYE4JAQnPMQvtADqt2gb`MkiG~D7K@|RrCUTDb3=plkVr!oE}3?li#;zZ zG>wDd9urd}(>}%2r1QGgS=Gq6JKBkrkFtL4B9!S7lSRIBVnp}~vyjOX1?e8N-qU`p zJpy&nYzxvIdaju-KR~Cq0O;m$zFb%xv4-TGiV9~==d+7;m4Ua27_Bz7@JUGIBbYRP zXN9-ZF);K7J3b;#EuX{dRSbB}{7q`gtvxF?`k8Ts`YWf6DFtz(Oa$}*-Fs7~(Y?(s zwQ;BRHxRzkIzhIsvyf3)Zjlrc5P&H^UiG!ne_j?c5_`3q`@KVSY)lx>$07mAYqG9b z7$YU?-Ec**$bxd(!V~tkunHvrC%UrEnir#1RF)!s$&9@Bc1}A8a!g4rk7As zqLb+C^rfHOECYXSYEF?Sq_hoGyFG`jP9n0{sAn(zGa4I(bJT6wK$P3G()o9_ z{FdRYcwb)k-VdWRJBA$Pa?F{f{s0@K4oNk5+Llm#?AxRTF!Ru*-JXGQ6XN0L#==g+ zqtD=``#@mPPxtc|d{0uI(%ABN8+yMW7gKiXPZp}V*9FaVpu2ulzmBw+;d}@8wZ1HJ zojA?EHj+o=J-NGRjR5Q9L$%l3WKsm*$T=ONzRS|C)HWJXOc=AMO*-l*!pjas3&k3j z8`%ns896o%2{qsDQk9Mgt4%aWAFkz&O;Uryqm4cmj`^z&`}NYtAypg!#ohQ#!7ru1 z3Ng9Qex^%VxvMtHn1`J`_=dChpTrwzTOr3w7^Ps%dh{Ytv5v^&+sK{XH&GOO@q(Xu zCvJFf(3F@eEMR>Wyig!)DwrRV8!ytKUKyGQYMv#DfcDu-h;wN#G7RIiIk*mq87cEN zuVML))TjE_^4&gxZVYTU8G5WcP?ptMsl#fR(i>GYDfT%zKze_w_D*pF+ckNVzpR9O-suVNMH|W|! z`)!q-r?Zp6us?gGFdf1d$&rBB0-@Q%clX;bVkVYK(9lSdOGR{x?Rr{9cG}aHmcsiX z8OQ0U795Y`F3zFTIIvf0X93Q*F>{sE+(`yg_&>$gc z=^B0lHP%bvqq2{`LqiP2nBgOZ`WEM|kWaljKYn=2dkiz9NJfg=VuP8fc8i`?U(W(%J)6c}L21@@v)QuYeLXJdgo``8v!Q`GFx9Gf5;n%UK}I%r{mshQ*Q5)nr3 z-1PhRU%)h;mEGJwk`|aUIXc<|&V%ODeN*tKH0 zepfbcfyy-MQrLW{wkcE6y5+;mteaPLGLyumI|Ty}QiT>kO;MX@H9ZqRo$ zTV(%hXMI|@SRk(LikDgoOvV!U5~q-ol5(qb%xgIIH2~SNvX-|+KHl&bMj`;@ygA z_mspF7apo6KPQ#x*TaXkx~t0!1A5zab#))6?Jl^!;)LW85fN{B!vxKT=~;0+_8+_L z&}pe?vI6SI~3d7V6JpRt6g30n^A;Dc-L2#KxtAq)ZuMYkYtdESUzcuF!%y-xo4wV1@LhbT`K&A{rn;W zXA?GA-jKO7IR^yHqI=BinJ1S}64vT2>iLuSOC8bHA0p;cyQU*Mh-gd08PO&L5%tsG z0N!T7Dfoz-ol**=bB}x|Z%oID`1<98#o74rVmmDUMD}-!Py|zh&1aIVZ_PSON1cY^ z-)m^F5?e-r>+$WQqhmk;0P!FW&ceWS=}TAnK8*j|(vrGAU2QM zIQ(T0U$)uU`#4P|gTCi+TE`Ka`p+cupVRqT(mx&$3QIH7>w)pzsQ7)c;*SST50u!v zALoSLc_p7s7?J$wrN7dJqBZ>okMp4+K$v~SU#pj1l3KbXD)YIRz#R`qgSM+5zS?dI zbu;E>L~!T0Ec%#00u8{D*zJ5g#>dGCnG(9QV9@0`Lq9-@0;DWOyXb54M9f1HOPVRO&(pr&H_h#?U&F8u>LpHv$5{vb?5 zy@R?G%BaKOuPFRf8E9AuL^-=b6IKirkBCI$QB#LXUsi@8vRv!vf=>~7K`H; z707+4+Mo2P+FI6|?}%?*iA6QcT5iu$P1G}FD{Rb&#ih4rJ)6Dyi zBSR-T!mP!xP6vZlGYhQnW=U3ZwZuoUq`F%kG!ap@{lQFBFd8_K`TQw4O1k4E39GeM z+-&a(LA7XPXq3+z7W%s>VJ_wjaMDq$+~24}pVhs;`~3gv?yaM$T-&`-V<`rRigc-@ zf^?^ffV4<=gLHS9Olc*gL0Ve6L70S;h?L}%E@4Xd=Xo@B8nJvxZ~2 z)^JXF=6vqwzOU)R0uRT??^ibA8E(0I2;Hp&=1{VWi@Q7 z6FgdJ6mNM&Xm9FZ_zs@B_j8-YE*%e%oXxwPT}z7OFL^+Ar|CaTEwc4hN>(;V(0%Pp z<8ht=rJXw~UqYxM^P|m7xvgD-#g)*tbC7^BIVr}bZ!>^B$G{*dpCl9)sw4ut*`nwp z((Z(=$@)V9udTmg%e>zYT2Yg%Irr8#Lq>zvXG6BbUE1j;6fMd_7psQUd^Te{SC|^a zBvn+ncPHz^eni{`znJ}F3Ci+rH<52q9g!CT9tIfES6aB({5W=d4u$6zm`;Hq0KR*H z9{2C6L?PGnt!dw3bMCF*1UI7BjfV-1rW1OVrJh}G6qMx`{fEaZxK=$C-5ZZ@RsMC9 z)fSpJ+Zw~KtfSIXS6zy9Md7wS@&3mrIIR!UudA^d8)GY`5RP^%KMD z`!nfOG$59bX9GJv^kNefEl=|rsm!S$ABqz z|4o)t=)Hu$D_cM&|B&gi;j(ai=^imrY`C6e(O2y>{_*#3wiM4WfrpGS^an@cC)l$` zxYTwSX*WeM>&n=zU{8iI6!S@;&3EtJ%YytIJX)`iXRNXY#wAOtfHZkdwQ4|`Π6 z4#phXoWIVTE-CRDckdPIHh%+kQpKvUfa7$=RQ;_9vFv0tWE0cuP0;Rb7x|t4!ct^A z{ad4)-d-qBC-5{;9Gfx(yA4gz$uLOt7$ z*7jKrF{#~ksA7Pn-+s2y`!6s@)zILF{(&O;{AI`V%WobcPbmNau<{}CrRnwh4E{gc z`DA6`)<4@h0c4JZJ|YUWRC|o?O&V%7#|s_QGagwHn&G0xSq}eE>jJ!#NlpG@{m^#K z2gYy3ZLMAjILgOvUAj}iUv*KEld1FNz$11W+hlu5`jouW_z3Wc6DWf0td`~T?TvWAC6y$I$0M#S@%CFbf1=O zk&#y^KQr#H9-1^s|42F=&Uy8I}puG5(>L6{a;4n@W!NYGzz zUD)KZp67wRbZXNxhnXErSFc>|HFAHqE7w#d*l<;ukYHOxk#S#Mtd(f;UQ@LjJEqtsYEFfIypHr?t{I2*8M%n&6ySW|baW zof!K}yW0DNgmeNUi*gP#r?b$MQ}Csx4X=RanqS#K=M|KK5B%5=Yef>3YR`QI*rdaR z6af;vNYpk1NFI!h=&9P)95`H;>7j=W98TzH2_!o8$CI0gU!5B?3P=|TFNbhKl6&z= zZpI}Br6clsdIaR; z$>{rM%tuOERn^pgZSH?R;7Wi|QBzO?IP#cFAd&UMuq*GNts&WwlH2 zWJRp*a=U+%hbaQov_KI-JfdLN0c4@3Ca^n2n6gqQf%KaVmokhu2)4@yhE!GbmD_;R z1mjnzy}2x(QqP$&cxj%3p!1eN0m%LZWSddR?#oIKJ=M^B1IxX8M*AfRpP1QO=bWww z=j{3Ds~0uI*)*oSeCdpsc_O)c1haW@{$BYfh^_ed2yy)<1`~U zQmUyD!$}h8s1^-F-N@)Ux_0cs;(Ae>xIG^{V$Cy-M4@ee%=Tlsavso<3X|KxV6atk zbeveUz8=;D#P65^9s)5~YuRANrYYZQtjv6u)o`#AK?%VG;llZs0*O~h?!~sZEU%kt z76cf+GUGwc)3tXIHjfuwS*wTB;*K_F~)RU=6e++5%dasigGykhlaknHT) zQQezTo(pMdFO`kd)YPA7sy@DXwPnVw*bt`+*ANktke5B@SzY}oO}R}?{raUhkQUWq z-un?|4R8+KXqA@=h^A^xIeO`1#i&T;Y7d`_d)y+ty&#+2(-Yps2|s7ON^h@D{~mV6 zN%?7-o-1Y zFDI*DZcfn`?K49$-SSGt9RrFqZcB@vnPuqI zh27-N+&zgoHi?uzv6#p`-4Y)rCZ=jOEvfYA9#e+ScRpJ1cZ?eN`fp=?HO;s!q0iMM zDpCbnQc+!L|B3heyjiIk5T-jI+3oAM9hfbxdx#(|tof|8zzBOycTJa#G?HRDRwO4m zEv;F3DSB8~buBNN+Jd_<_o2TS=iST9k2kvuMH@%q*yv8=wC!Hd4>rC9A!;Qh_WZ7) zSEbIMG0GomdH0bn;6$}M%m2W{rvFA*3vTw%iP8HV+}$%TE_jY4W4&TrU|O0tn5MxI z$}nTHMf698@VCBaTk%Q`xvsSe)bUD~bQbNH(IhXAVJlmK z6jd(`+k&DUv!PHw(WvBDwot8_kiH}*r#1Pi&e@C09>Tiw1P$Lk(Gx0O3;YD9V)wg-*0I5g3L z8zIe6kpDsZiL7$ktuJ$7o?JaE;5(lxO~cf+kXcz2-j-#K!}{aI%SoIp{lfWp)O1g} zHH~!Feuf;ax{q(uC6DiUCn}=E@TVX5Ek2R^Ie>AhUL}KM9#Hza;!GFVDjJVzoXvX- zSCcAF|M?b1__K8PGOo)XM|o3hSxjidhoN_&c*daAvY*693+nb~NCJVu$-%-M3}upe zh)A!=oA-9KQf=kHz4Y55ZJa9CNM^hqm{HFsoyDo)WUH?b?+7Cb2#huX5Ps{p#^;Dv zQA1@0%P%UWu`w3$qg6beXOcNdaYDVOu2fmG?-_pN9p45)lHeswbwt^%iTb8zDJX3F z&;9m+8GgtMFHCXirIs4@-tel4Ka{uf5dp}v(ff}wuJU9jh5619MKjq%dn8&SOJAjf zM_{6yttAwO$}4D92J(r^zdEsv8V5%l>NV_-gfK1wbpv&C<@CdU$}_hUO;jhFnCojO zOy>4gHsd!y-^5Zt?JGc~o=*}i)~Oyb7-8N#VZRgr`lfm7 z8v6TL%o_Y^nl-(U(ab1MhU#B}P)sfxayTiN*;xh`c*wgnqopyX{*i}nyc1^q)C(*H z_v^GfRxKr_Ez#2qs2c8sNWJ_>^h9O|cYdt2YZDDcu*Y6(3tc<&Py>IN;$`<|loDh7 zD{$bucbwNGvVOBdD87F+DwQ{uG@|MaPGZI$`){z|5?3oW&0 z!`6xh;v)#>1Y~Pz7Ed#d+qrk{hG6^AYYQf?9jkpGhgt*G#NY#eADY>hiZ-rIx1-#X z*Ahl-8EJJ}cc+USYvR3V8hSWueqi3S;m8ZPWwTXIk^nL)v-|C{xj5t#6S-DuB6?&X zgL52Mua*CMMeK)KyQav5h9CPL-ykN&rzED+qcNN1b!F&%@^Ji_6yNigUGkw0Z+0;( zzJBi>8mue$Mmj~j_w2H+erwI5WzH9&?B&Ya*11X8HP+=^v={a`JckDt^-nwxM!jTi zyt3nYmbH;rJ;d|SSM#+)JWrd;z5f-@V}ius^2U*Z=1)&k?OA zPmNnXp#fU*o@$UHrELM6|*2 zMmE%yzQ!7!uYrij0GU<)_Xv#96Vu~gNtA= zLJ6sZbHIP|*gX!vd1Y=cbKJANAht)sH3cY#A{&d5V5fJAQ9axOye<$Yndz>gYvIt! z@Btm}aG z#OHmgxAQgtjm>gJeIp|>us4mCTYv4?F`y~0M-JTb7 z|GNVmzX{h;QQKbSx=4@u2_D^R^@Rr^_I0IysMbR^+(*^3k&R(Qir= zxb9kp(TaE2RuGq}9LI0vb75Pt36p@|5&iD?ar@X>Wnd$?iT)bj4~7Zm zZ%X@TU65#!H@r}g6zL3iz3sBV@s&&)FQo7qurrG^MdROX~ zeJ624wa|rf_#WJF^Q}OE0o!SW^#z8ZK0(334cqqD{dIv^XFOckdokc8G}(3rrSZ+p zFUuf^K3VK|%NcY(!S~Psxw+l3oNA5d+e+qoDnBK2BwMO5>8&^TVIZy;AYw~9yIUkG zfvv`$9Muep7>9tZpiC?TkBkaREYFwinw0VJSFS6if?D5BFI|BpSgaJM}w?@JtA+le75I)ZHgKI(cl)aiWYzWo(?Ur zKmDiUn_i-TW5jgC?H#Om3#q|x%JL-OlFiM8yI;dU5B2Vr%kH09m0stKfhD69TU*X!e4!%(Q;v&Y zRC+~vp=AK9iwd_)22iLB{dHsllwH&)e!QFP_x_#^W_q!Y2)(oVrK#xW_6QAfnY3iT zz|?;ja~XvOnY=S%NCZvu*^WzSI&gIB>+f%e8zt+_7P7Uy3kgX|Ctps1mDLv19U1+k@Q6w&qKRJ$n83W+){F3;q=rSVo*&&x?KN9@^n zXXCUl(=m+0OF&xldpRplZp_WyJ-lLT3+7YO5Of3^3S5QdA&jm38+Q`mE|F8=bC6x& z5Fi6D^6U8LF9tjWdNJfZq&mdH)JOnWfq_>8r2?hWADLkCV?OTnUkjBI1ihg`&%IMX zozTY|W#RmQ&YZ270+adENIVUUOFx=Tv+LRnh$Esh*meZHcSLH%#w1ut(qVV5sBi=I z3L%J6W@mHyy$;T36TVW({`P%xlGCbDdu$Yz6lKB|3W@$fmeDct<7@+a-Q0H_U_&|c z;yG^O{g}d<4)F3Uz9jk-EM-v&OlsA zd_zNn(U`TJ-PF;WV3UC2rR{p)-$pH4u-@g@*RrXHr_l2kiZ z!464xN2IdS{m0l?drrRv$m#|Q!}~4BsPIEBsbr8|_{$RlqQheb`{#&-6_O;FCj z`10AXq{-%|O>-B$jAbl#c=Hh{8-C_lx_*2Pv0f=7vP^LVkH2|!U^q0yx}$1*WRRCt z|8CGjsQ@=yicHR&kbW@Z{%veR1jhn$@xV7XFc8n~O{5$$!KH_bw;K12qJWYi)y}MU z#4Gg8q!pt|H#1SaNeT??$+Csa`g#>?H4g{JV{cedIf>^Gg6Y&D>lacyDp@TKV!@yZ!icZ00ZOA zv^3rkz&uaOy=#y4Na1_6LZ_!~9R*UShRp?bBv)j{t(N)T9VEpGMKk%SJ?{Ow(d;&I z2z*Nvlm@~aO?U##G2n6*J}ro(@5LJRe5d?GKG8n2E`UsoAXn%a4}?2G zUI8g79jFtqRDG)lMy2Gs7~*x4|w}*YF7Va4<^vF)$!+(g`=54i=H6U3E)q zu!3&g&&MjI6=GU`Sq1iKIXRLBkgNlL9c6_$aG$mJm8D5nskOD9z}Gf0(czS0=jH9S z&7dW;mjj7IQ(FaN-o4;?3lk-|n$@f`@FJjTC6a7+kwS=}bML06e~v z-SR_|o(YpdD$3nRdK@sT`UeKO8*yX6@BQUg8w(f~d*gvu&BQ7B?j&KzonHH5)$^-3 zREZlx&k#C#^J_UyawF`Wu> zB*v8^o+oG}%{q@44beb8Ti;KvA1|>wXVIG^q09=kBSgJ<0-Jh2+yBVkD~}+!wHd(; zv$ryYz>ON2RjtqDA!Lq=D2eBxaxvPc3$}CHXPV}mA|fMu%5ox!2u-l-DY%^?aQA_U z+mur^j3Kp~srYd;_dT@$5f7(yEdxR^R1mE7mXN;wym!|pwQ+aNoA&xe)cRrRmMa`i zMnm~afW|#lnYk@4j=fa$u4Sjj8}hEL>y6J$KOaKLTE9ro{ggYD%SfW4JeX>>h|yk& z?bG`_bKv!OKVdP|Rj|X^j4Mv6o=>}be%87aCp2;wtfkU3>V`H0rs}AQ9EU$(}YJjLZEhM6ci*S+K8`v zBtjm;e0O})cy%dq$KXD^et8S#j9T6cwl+RT8}TV7w7nLFV8M3H8l*`DWs&%+ZNb%!$b}iZ0Y*C#h?8;K)c(* zi~cH`qzf0@xxrT(I+?5wKEC^hCr877oq2#b&2rV#fa$TO^B5FJ;THWXI+j*eZSn6P z1Ppd6`T4L!((zw0qBKy?L9>1ynx>t1Qe;_A{lLx3X%{HJaM zvWv{^>ZiULje(A9;cItyMrC%4>xx}=M%C9pB3KXX+4uzQKc-#?9VRX9VOrk>NXt7~ zH8_zfvbh>F45vqOy+MRgDJPJmDjMrw)ed81z(@)Rxr*-ggkTh9Gjc!z6QU4&7O|A@ zL#&RHwe{hrl{ByB@4oxZtx||Aux?Tw&`_WvAI+TXd82vIQ=ci5Ez&ulAe8W|g~w}S z3MC9`A^h`aj+SHm6>pMJ5Dx>k3ls2@=i*(`AYw4&Xkqum5vi&%+_;jSyZnjA95^r% zVh929{>w3 z!1Ay=uD_63KgfPzCMo6p(z?TLfUu(gRid!}`(eKN2lUr73kpnBeJ-FLq6?Xx*VIr9 z71bs|(oR>AT~J_>8s^-pix&5dM$0;4>M_BT zkzGlPdeq@Wiui+hxp(^>^C;VK`*afU7N)hS-ah!A?|6IaZG~7lUR3V&z-KAIdo{KK zXXDp{#-}4M5?u|oTzT8BOf)BG9(kvjmN8$wV7v#+?20wtN~Ohi2Xb7OH!r~ZAZcK6 z8*Me%Y1?fcahw)mWXP2ot0GQ_cmv1x+4^08;H|bs(LWr}S-|q)@_Y)k9zPionuX1J z1DJWbfZnEgrxL@!G^PY2m6NF$@izkLKUkg*d$3xLvxmvAv*|Uh@1I zk9q6@1|(oU)!0+gVN^gviRQyh3=F(%pUHx*;1H{)q@~s2j-(5j+f~u1d{k3Zh#UU` z%7X?q0VFTv%6S35=^H>0++Znk-Yj7_I1EbTFgg-|Md@)IY72BQXAnn#<|&pZ=Srpb zvuD>pQ`AY^<#Cv_>-lRp{3+1MQD{ZD`@s90GD8V+Cnz8%7I3Grzdce)N}iS+iGf_S zJ7h_vSd$f`YMcTb_n~vz-Yy3(*CZ&-#f}`9f=PSuetqpTfrjuL7|!O$sR+6(e*L^! zcQ}a$7<}jlxq{aZji6w(xARAh*=Zr8=zwyOjl)vSdZ+!*MpqWPlbcF=>wyd+8UWKR ze*PHXC;_SW(ka01!MAp(;>zUs&J}xrl#`OQdrqLVd}dkQ5@SH~#q`JB23Ut@v-^$q zM4#)}>&bX(Eq$8d1^pnDGBiFObjSnIO|E_GJ~TWCaR(SSqUZn)5x;5cZwAjYpypw3 z7%!^)RsXc<$vZ>l$G~o*xwnQ!kT=z$@ z|38S1tkeHQ9#YG$?nh}h-?BA`JfyvXx+s17HC@N#lfcIJ7y2H*env0LlWVqUoD)nz zsh-Nx;D3cmq?^=$21afH>oa#@<0aq0nJ9_KDI1AxyYfQH!6tw>-+{GRY@%)726W}@ zS~0v|flSHi;J+vnxs3Ql(r5%ex?OjIlZHda&_|6y2jdew*&x;_CkH0wbrqJEn+)G- z=ugP2e+b{$cnYjBBnKjouKiO%j=8SdIVJJU+aOI!N?99PI4|f2_zi=0B{k5MK_vu` zf``jYKjO3T{YkJEXMg{gb=AaU`eqcZ-$OMsLC})a?QK{?zTFd5O(0^}wb}52*-9Ko z!==jh9=NZ6eSsbtL`I;f`V10^1~E^HRvX4KEEpgrg0r=l zEkLy|MSs1o=*6%;<{>MIN%QNwzum?@TU#R9tzrKApxPN3ffPHTAIS?Q?TTQ&F9Avy zcx=-%=dN$NmjA~1zl93aVC9(u+DV8SfdDk$DM7FxqdYtZs8dKk3?&N)WY?#pg>zuY zTj6%w-p(5Z%M`tGdvK`0{#tl@`K33pxx0_~z>zpT z-wC9C9(a;_+CQ%B?eM+J!h&Rzsc_#~ebOp5{Gg^xPnY&^hx%7m>n3u>Kp#WI)WFEj zAJfnP3SC1NQC|K^hsEz2b-OreAdmUzV?Qs{J*GDX!uoJnpKl$+G$KUn_;@QAtRf5} zt8#pB)!Dlx;Eofa^{oqrG(s3JKe@rM3d7Dr?AODgXfg2+*G5wQtSSno!rVvcoYT3o zx@x!jP6>d>-b|qHZ38`OMNV&eT_Bf&3Fbs|blRS8cZ9TPi0}h|^7a2JIO2>lWaS+8 zq30@lL>E|+1rIt;Q2eK@AchJPzPKl>ouAL68Raov2XC>Zu)RUU0r?T83*RQj{l=`) zipc<8{yn-a7)<)DJ)arYyt2A_XTvd`pwHf0Bd>F#p7{lFk9jD}+G}a?y(f9^UgqfD zL_JiEikSi>1Uq}ZO+zhw>8|BOOIX@p=x}$x7}V3Z*2@9;u~xRWCS3{k#eNgin7dTj z{Y}e*T_a_dmkm-x6zuIWpNDur!iwOv(1d!3C@Q77`K*n{K|-9nW~M>}R6?L)0;{U& z)-0AuQs_BAMe%38q7tDspjVxY%C%J(hX?H*nV0f?`~A!Cxisz%{hK%YtTJ0cPrEM_ zKVo@@bf`pbU``4In^sDlielr|r|L!eir}IO4g>}t!gs>Hl^qTbV|p{?Y~jF&25tjj z&WH@#yi^9GsGz_Ldf2c85_ZFbvO6Njzk@&J26g;}X!6&m_dhvC1HBUeR9@@L4pXk9 z$vH%2F*+Kkszlaa=UFNUb37=wnNqxH8pSV%k12p>7krc!GPEN|01&HzoMetLAo9Dk zE}Xk=a>y9wUGhoa(;JkABT0$p}6 z20xED;ojMV9yqwrc9lkzV~zs9p)yXqg4!8gf{3kYry6(~0Y@FTBekp4@n3bSb*P5_ z|JGtb6xb0?6hQJn-&&76k%e=i$*Y zBsW9OUc03*DmC(y?;;{z(U1;v98Rh%_UQ95?@285Z<}**>RKk2PZW3&E4 zYLnebXHp0koX2?&M=q_C*^z!(a`?QJCCO?~6I(@rfb^g|65zyFih6-N4Y)-gjqB~!!fBWH&S9p!aPbKaFb!@6o*uKAiJluV4dPqkd2psZjlMYP6 z;uAe@E{6stx5{bNJre`67^Fap*pkUewa;%f`rbjVK8!bSpU3R6?sEu5ymm!e0Mr=d z~G1n@A$sauO8SC=BZl^Bhspy$znZ^ z-IGI`9|uXL{~oCg2brOqHA|d6AxN4690|(QGk~Lre!1_AU<*J?9Y7;0(n^z9bF!A= z4A6ne&NfaXE*xO9z4+!T-W4iykd@w$>Zoo4|PlU{<{4PMSJRtbjQCDbFi;Cjv@=5}G|D|=-W6e3_a;Z+^nW8PoLAN;b_3fMLAC8mazBiGHC z6@T-2r{znrh?8I9H~GoM6*91qZA$*WHSJ?;Pi!~iTgvd*O$jr;1W0WnNm-rjLcUCH z3&#FzMWfvX1BdCBJB&(&Ok@|JIFnLQx$KsZG(Z2LY-#YfR=*Yu#UV+0_UC$$w5`3V z*7K>&ijJ0+z?qH>PuOwRO7_=gcR<+L1?s?}m13gl@TGt}WUrnXRL}uPaEQgUArukr zSzu$3Ef1b1RjeiO%{-Q(6>bpEsXR?nc%ImOKXWHa*2>ay4n_%PJHN@t{V`rp@d&!( zUQY3$?-UF~BGqLV_y_^na5)mIn8XFZGWHhL6=)5H_ey<07+JsK%}O$ZJLG>Cw{#k8 z@WYhceZz8deGZoF7?pBpE1n}Z342e7;USeU^;02nk= z@1;{RDl0L6yrm#F=K>1t)36|CmCFPK=A?1Q!+Sm@&ZN1yNGwtbWEh(X)^;Ru?Tm;k)h+T`W#)?)ijGJHgr4P1X` z^WGoaO&zz4BQ2Bpxg)tPdJzN*0P?LV2Jliz3M@XTt???uW6XZ_;>81~K;cL&EVR>A zv>4@x2np+%^YeD1DcT7OGpZ+7Rm-gU^cKjSpvCo=ABidRtkoWaF93$RzPJzI$^p}h zAITQ?v5scNnp?xL2^%?M-xd=PFr5M3rI9kL$o_!y-^0bQ!^1;pU%<}=fTpeU7o{8- zJ;mxLyZ)+-8ua0f7#|9T~| z_eTn%Q57UT$q7X_1b`l4w3EMN<8O_3vQb0`r#=#R(PYZC4q)#F7F;;WjNFjM9N@2jw2PHV_b$KUX)}+~`UW^!UZXR$ftTx4J5jq&PHQ z5rjuO`nGpvu6tzj2xV|2$QT*8)X!*Aem4L^DP$*c_-EX?hy!%h^WTy>@MwLSv3@7a zdJ_{+!*Rk(Q;zn;j!Um(zgnNkh4Z_Xf4qZIXL9=cRC=PQcQP1$@E)Htg1rFf)!Km? zow|xwhgqIQ5c73(el(Q~%WW*8P`}$6Nvz$mpMCxRMrUOIN%{j{!=EQ@=6iKd)8}KJ z-nh{kVocNdE{oj@NthY53w7*B|QFwm4c<0Za23-%3IZvMo zmNWvU;QCkEWFU(qm@p|ioj@{eE~^D>xc>W8#C~Hc1rX0xz zOv;s&_3bqKY(T)&xN?QY%ajiE9f*7rv8E!Z6ea;OILD1Nh}u0kJioOqwR;9a;6RT9 z1~$vPFCj}KOEIatjVT#u-CIUkB>z)oWXIK`^DhD;+VG>oa_gTJtJGiu5d@R>wR&&r zOa@6%Pi!8d_^jeqJreIkGF`)egO7e}*Sq*L<8bv9RAA4+Y!;%H$k()M&3`%yg48HT zGBqzxI>mbdK^+{*5ec_YW=1I<9 zkGz*H$6a!)^|x~uJ=_WOfv|w*2L4&-9QCYbDs(g~BSpgBT7T@>-Cu0W2JSB8UTgUs z(w>lhOCG%YFyu!pGVmO~T(m)WvTaY$kDo5^0ly1uZ6B(sL50$6fScDi6|l}ff#4F< zZnaaKHM&O%$F@@IY)TwOf0reNKnoQ01 ztFXzgu|1c-(aUzs9cnt6fA(on6wDb!{?v;9Sur@qf3BfFmcNUyU*=Fa<@%1zmUOrs zZ2x{%o?ImqJrV#h17M+Wcg{D8v#i#OZF_OWef<3SIrLTmz}D7-O}oR$2bA{2#B+!> z6fFJ=Zna5pf3NnE6=;&Sng_vASIHRjHyv|;4Y4cT|kmC#` z{1HVUBSpWJ8GmuhcR#C=b=&^~dC`hYLof@TVadLYs91R~+&rofu&RY#10eHSLs}V(;R5~luqSw6v6gaL zJ5vdG3E;PDWcZ{@g)&paMAV+5K4mRV6ih3CccAa(*{>$Pd&!aR39kL*sQu))b~2FV z8WX3Wk!tIlyf|wt+9*3W*I3p4PhKXoIY?RH9E22mm`L6Mdn<5MfP|r(d{!nPaX+RH z>Rm7!>b3+A3J?}ORn`yaU7&6-aKnqE;pbFqU2+1xJ{4$>mPG#o!8)L)Fr5CXq9ooM zuq_eUlozOf3GA`pozrgBz@E+g^yw7H#VNv(!mKl)oCfwxQOG}0(N_-|n`>U#yFBO?}IqtP*8P#$D7G@PF{EY?Pzv#|me_zl$T z`RrO^w2(LSWy$4e&KQBd`sKnA-%=77R0|b`Sr6D9FO%ebOouQ@fIz8z0ENoJvbOIyxA^6%1&7 zPR>r(i=4sm9LV)Cb#+s6e)?fMLhwfejh+%1g@EYDND0NTlte09VZcpGj^UTqUZmUy zLW2(#ji5e>i;MH%7WLo~1_~!vf7#LJA#f^_tO|XGWV5|ZoIGliP_XFTZpn`$t2*$je zaBskvBfT#F5#i;JpFcgXqG*Tu84}b${Rg)LDzj5&!x6umsi zAGx{ZAQ2t-Z-my{-;=>AX`!Ff|0HE;vV8s&Zw) zBpV#T-p}khZ|w~uQjHuHMnLxhrA+opeB|Q>K86P;;q%AM&n+zU^^eK9RiuEg6#(K1 zDY#kCwMNOKxPN~C9OYg_z*EyL5@^0^J|G~K9ln5`I@p|Bm@v8a6~ie z((s8!MXNx-2_ypehU`6(SKVs;8q3F4;n5}ZPO@obY@6RUdnlr4^x*WlbDrQZ-~f*3 ze%oCsM#aoPSPH19xU#%r?O3Zf?z5>d`dQ_?;~;nuEc8!(Cc5+nx6$UXFa~^=YHp{;}h z0KT*=Fp&%nx&$kokqm#@NeIzznVDs#16pI}0!m1rIY90f6t(Ses=^xn&x1=%T}`)d zQ^Kvne?TZ@mfYUMaeDN|SvPNEtFw4)*%bmr{X__588#vM5Auk{F(rl-^BrU3pEk}Y zoRIk22DFYNBe+N8!Rld=G0e^~AF#9ZLrh(I0b=RCY)tFbru&MDicWeZAyO=eo!b2vHT49U$%)E@-rvgdj+COXi-4AM2kX$*^SY9 z^FCAp&{xn=1^#lX1{b<^7%@Q^875m)H<{{WQ1DwI0nGdkHUpKl?mvjPa9iCU3>aHA zo`);$l@0$0EA9Ge%UXnKU-|!Wj2@E{C z-N*dm{_8rMUiW&rnkUR5gI0Ykv277HzV8dCe+RSgz|6}C2U%kc)4p#XrQNy5)Udx` zQcMPpeBUzV3P3REE0zo4?p#JkRV{FYf2HjW!HXFu09iIESzy?K9}x3iQ{j zb2-zCb~a@??8?$n^V}4L_FFXrYXj(7b!+r~#*bPnYu|GAQoF5{R0)%s?wWxiYN-`A zC2gnipJ{!I-@oIX51IZnblYZcp@_c0dMY$5^8MpS_M#tZ44@^{$?h@W-w_x^y_SY8Q!{cZIyf?{wjjbDKZF z4$(w~`(#)ABt`pjHBX~7W&GVjfAf3}Hg_8-+>Y?t!8IkjBT>a{I@{j4XD*)@Y?ke- z$K67{l~%b$L<;!>Ff@ko3l}Uk|Ge{U>=eTE0)h59NNhSGxJv69PV3nav9Jl~8#3wu z-7G0P&r|KE-9-=_5`_&_UJPLOfuEijjv_lRXMHz;COxl%KQq{0%Cb&bD5<8v#nU4FGkEhbsvP(@ zvy${TIx|>G)Of$@6C=cgFPZ`H#}UzPpAR!H@ug%i)7u4#AMbA5z@7&X{rq-+r61X! ztcoi?&F6g$UV2O@lze?wgyo+~TirV?yE4o-hEO@OTs5R$qA~tOTl+@&kfP+$u;k#8 z14g>5p4fd_v$~yCfW16bJZF?8rs4K4g&dL$>tkXK%d9Z^ST!EgJ9TX*{f8u zkgd2%H??r5Au!i5+SIGCZbL!2&@T703miH<^06FOKp~mNZ2FVy>yCx8zItx2CD(`9 zs}35q$EM+*>`O2?M))U3gQ7ou6Y!c+J+mUvn7FOfweERS(v?{U_d7HAEc4)QjcU71 zBgVM?l{2UuOHk0?Og-B6eW&N35mm%ZFlLZ$bX@3mjlZJ!lJ$>P+jLir2s`ptnRNX4 zK0m!B-Z(o-jTKp18wJMx#pa%t?@8cFcy4pyiH1fx%C*`=O!bZ}BUPAT`CU^l5g@}S zzC21L8J23aFx3`SCyTjkJ!`*fS`()!iYpOSlAgR=M1R~c+WgSbHDdUYh6O($`Ey+# z76}c=)mhG+(`F}5_dfc%nQ71%^bk~^c9qIt4iH4l54?Jn27aOZ_Y0n|E-MLh9D7W; zrn)v5y~r}dXZ~}QI0z-d98O>IZv|Q}x>8U|<3Jb@pt(vdxhyvV<{ml}nq*Hi5s!8H z;p>)UKE%QR^Koj?URHyQV8>SwnCZ5ZN3(KMcKnCB3^lik+;{1Wc2x@hPEkZ>^VXha z#A$8J^nQOiNByMH1W1Q^on%Pw(i?A)A-H-u|9FBH`IfuOfN# zVfgkdmN?V(_M5}=KWE7%Vly88qXVLs@zZ-dMKAR)G9e^>>3>(*v*)KK-`coB{a+%Z ze=g*O?m|rrR;e{gRThyt{Wmd@uJ>^9mH9)J|Dif+7;fMvR$(MEJSg1#Z?8u#ZTh^i z>_C$)(}$JH9Q)poi^R|DR`v_sCI9uZr@ed9VmS>K^dDd%gYK*X>d$CHPEzBIw=S@X zSr_}a>+m@N{pJClgy~^oY){9nl|rR+(RZi<_1foo7pi_6~Y-h~_Xvg37!X>(fa#dCDPC393gUfoOa zAx`-3-@=7kE!(_x>EY_+X1$-E+3POo-^T<8L8j~@FmeK;4rcR#*q|QsTUog+Gv?66 z9x?sPmw4gU)7a}L+^Mdoo_3o9-@&{!e>Z|lFZ)t1RKF~9>(7;SJ7pu^!YE_g&FUiR;pTc$PIP>3r+>gHHr%zY3 zLYDP$KatzSQ8NFH$M~nj(%pX(kG)U6qfCCTBxV3&sBfjd8`-Szg<=f;j90D$kNtN@Fas8cnq)I SOg{zx$Ve(aDtu`8^8W%?gDVIC diff --git a/packages/gcp/1.4.1/img/logo_gcp.svg b/packages/gcp/1.4.1/img/logo_gcp.svg deleted file mode 100755 index 75e139f9b2..0000000000 --- a/packages/gcp/1.4.1/img/logo_gcp.svg +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - - - - - - - - - - - - - - diff --git a/packages/gcp/1.4.1/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json deleted file mode 100755 index be9430439a..0000000000 --- a/packages/gcp/1.4.1/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,59 +0,0 @@ -{ - "attributes": { - "description": "Overview of audit events from Google Cloud.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":false,\"mapCenter\":{\"lat\":32.1625,\"lon\":-48.67493,\"zoom\":1.97},\"openTOCDetails\":[]},\"gridData\":{\"h\":15,\"i\":\"a808a985-5cf3-463a-9aad-5159cb64cef1\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"a808a985-5cf3-463a-9aad-5159cb64cef1\",\"panelRefName\":\"panel_0\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"9e7025b6-c3bf-424f-b541-d22d00e1fa64\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"9e7025b6-c3bf-424f-b541-d22d00e1fa64\",\"panelRefName\":\"panel_1\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"5b6a8479-2c18-495e-88fa-9e3239277e3d\",\"w\":12,\"x\":0,\"y\":15},\"panelIndex\":\"5b6a8479-2c18-495e-88fa-9e3239277e3d\",\"panelRefName\":\"panel_2\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"46da4e61-e0bb-4595-a2c7-05210bfbea64\",\"w\":12,\"x\":12,\"y\":15},\"panelIndex\":\"46da4e61-e0bb-4595-a2c7-05210bfbea64\",\"panelRefName\":\"panel_3\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"4d698f07-2caf-45c0-bd48-51ea72ea79b0\",\"w\":12,\"x\":24,\"y\":15},\"panelIndex\":\"4d698f07-2caf-45c0-bd48-51ea72ea79b0\",\"panelRefName\":\"panel_4\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"c5e31da0-d4c8-4554-ab32-61da2495ab6c\",\"w\":12,\"x\":36,\"y\":15},\"panelIndex\":\"c5e31da0-d4c8-4554-ab32-61da2495ab6c\",\"panelRefName\":\"panel_5\",\"version\":\"8.0.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":9,\"i\":\"95ebbda8-9b00-4b23-b116-72569ea031e3\",\"w\":48,\"x\":0,\"y\":29},\"panelIndex\":\"95ebbda8-9b00-4b23-b116-72569ea031e3\",\"panelRefName\":\"panel_6\",\"version\":\"8.0.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Logs GCP] Audit", - "version": 1 - }, - "id": "gcp-6576c480-73a2-11ea-a345-f985c61fe654", - "migrationVersion": { - "dashboard": "7.11.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-a97de660-73a5-11ea-a345-f985c61fe654", - "name": "panel_0", - "type": "map" - }, - { - "id": "gcp-4627efa0-73a2-11ea-a345-f985c61fe654", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "gcp-eb5bf570-73a2-11ea-a345-f985c61fe654", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "gcp-33ee1320-73a5-11ea-a345-f985c61fe654", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "gcp-a8e40240-73a3-11ea-a345-f985c61fe654", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "gcp-6d90d320-73a4-11ea-a345-f985c61fe654", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "panel_6", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json deleted file mode 100755 index c3709277c6..0000000000 --- a/packages/gcp/1.4.1/kibana/map/gcp-a97de660-73a5-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"866b5ce1-6ca0-47db-a6f2-54c5e0dcd2f0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"279da950-e9a7-4287-ab37-25906e448455\",\"joins\":[],\"label\":\"Source Locations\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"79ec6461-7561-45e4-a6a2-9d6fbd4cf986\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":19.94277,\"lon\":0},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"settings\":{\"autoFitToDataBounds\":false},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"zoom\":1.97}", - "title": "Audit Source Locations [Logs GCP]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "id": "gcp-a97de660-73a5-11ea-a345-f985c61fe654", - "migrationVersion": { - "map": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json deleted file mode 100755 index e1a7679578..0000000000 --- a/packages/gcp/1.4.1/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "attributes": { - "columns": [ - "user.email", - "service.name", - "gcp.audit.type", - "event.action", - "event.outcome", - "source.ip", - "source.geo.region_name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"gcp.audit\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"gcp.audit\"}}}],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"version\":true}" - }, - "sort": [], - "title": "Audit [Logs GCP]", - "version": 1 - }, - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json deleted file mode 100755 index 2bb80adfad..0000000000 --- a/packages/gcp/1.4.1/kibana/visualization/gcp-33ee1320-73a5-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Top User Email [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user.email\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":15},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"scale\":\"linear\",\"showLabel\":true},\"title\":\"Audit Top User Email [Logs GCP]\",\"type\":\"tagcloud\"}" - }, - "id": "gcp-33ee1320-73a5-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json deleted file mode 100755 index 181dcb280b..0000000000 --- a/packages/gcp/1.4.1/kibana/visualization/gcp-4627efa0-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Events Outcome over time [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"drop_partials\":false,\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"scaleMetricValues\":false,\"timeRange\":{\"from\":\"now-7d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"event.outcome\",\"missingBucket\":true,\"missingBucketLabel\":\"[unknown]\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false},\"labels\":{\"show\":false},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Audit Event Outcome over time [Logs GCP]\",\"type\":\"histogram\"}" - }, - "id": "gcp-4627efa0-73a2-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json deleted file mode 100755 index 55d894cb52..0000000000 --- a/packages/gcp/1.4.1/kibana/visualization/gcp-6d90d320-73a4-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Resource Name [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"gcp.audit.resource_name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit Resource Name [Logs GCP]\",\"type\":\"pie\"}" - }, - "id": "gcp-6d90d320-73a4-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json deleted file mode 100755 index 1fb78e641e..0000000000 --- a/packages/gcp/1.4.1/kibana/visualization/gcp-a8e40240-73a3-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit User Agent [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user_agent.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit User Agent [Logs GCP]\",\"type\":\"pie\"}" - }, - "id": "gcp-a8e40240-73a3-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/1.4.1/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json deleted file mode 100755 index 00dddace37..0000000000 --- a/packages/gcp/1.4.1/kibana/visualization/gcp-eb5bf570-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Event Action [Logs GCP]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"event.action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit Event Action [Logs GCP]\",\"type\":\"pie\"}" - }, - "id": "gcp-eb5bf570-73a2-11ea-a345-f985c61fe654", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/gcp/1.4.1/manifest.yml b/packages/gcp/1.4.1/manifest.yml deleted file mode 100755 index 058fbd056b..0000000000 --- a/packages/gcp/1.4.1/manifest.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: gcp -title: Google Cloud Platform -version: 1.4.1 -release: ga -description: Collect logs from Google Cloud Platform with Elastic Agent. -type: integration -icons: - - src: /img/logo_gcp.svg - title: logo gcp - size: 32x32 - type: image/svg+xml -format_version: 1.0.0 -license: basic -categories: - - google_cloud - - cloud - - network - - security -conditions: - kibana.version: ^7.16.3 || ^8.0.0 -screenshots: - - src: /img/filebeat-gcp-audit.png - title: filebeat gcp audit - size: 1702x996 - type: image/png -policy_templates: - - name: gcp - title: Google Cloud Platform (GCP) logs - description: Collect logs from Google Cloud Platform (GCP) instances - inputs: - - type: gcp-pubsub - vars: - - name: alternative_host - type: text - title: Alternative host - multi: false - required: false - show_user: false - - name: project_id - type: text - title: Project Id - multi: false - required: true - show_user: true - default: SET_PROJECT_NAME - - name: credentials_file - type: text - title: Credentials File - multi: false - required: false - show_user: true - - name: credentials_json - type: text - title: Credentials Json - multi: false - required: false - show_user: true - title: "Collect Google Cloud Platform (GCP) audit, firewall and vpcflow logs (input: gcp-pubsub)" - description: "Collecting audit, firewall and vpcflow logs from Google Cloud Platform (GCP) instances (input: gcp-pubsub)" -owner: - github: elastic/security-external-integrations diff --git a/packages/juniper/1.1.0/changelog.yml b/packages/juniper/1.1.0/changelog.yml deleted file mode 100755 index 05eb97c74a..0000000000 --- a/packages/juniper/1.1.0/changelog.yml +++ /dev/null @@ -1,96 +0,0 @@ -# newer versions go on top -- version: "1.1.0" - changes: - - description: Update to ECS 8.0.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2588 -- version: "1.0.7" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.0.6" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.0.5" - changes: - - description: Deprecate in favor of new specific packages - type: enhancement - link: https://github.com/elastic/integrations/pull/2210 -- version: "1.0.4" - changes: - - description: Uniform with guidelines - type: enhancement - link: https://github.com/elastic/integrations/pull/2100 -- version: "1.0.3" - changes: - - description: Update title and description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1997 -- version: "1.0.2" - changes: - - description: Fixed a bug that prevents the package from working in 7.16. - type: bugfix - link: https://github.com/elastic/integrations/pull/1882 -- version: "1.0.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1826 -- version: "1.0.0" - changes: - - description: make GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1744 -- version: "0.9.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1666 -- version: "0.8.4" - changes: - - description: Requires version 7.14.1 of the stack - type: bugfix - link: https://github.com/elastic/integrations/pull/1541 -- version: "0.8.3" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1485 -- version: "0.8.2" - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1392 -- version: "0.8.1" - changes: - - description: Escape special characters in docs - type: enhancement - link: https://github.com/elastic/integrations/pull/1405 -- version: "0.8.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.7.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1267 -- version: "0.6.0" - changes: - - description: update to ECS 1.10.0 and add event.original options - type: enhancement - link: https://github.com/elastic/integrations/pull/1058 -- version: "0.5.1" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/853 -- version: "0.1.0" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/package-storage/pull/181 diff --git a/packages/juniper/1.1.0/data_stream/junos/agent/stream/stream.yml.hbs b/packages/juniper/1.1.0/data_stream/junos/agent/stream/stream.yml.hbs deleted file mode 100755 index f8f304c324..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,12572 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Juniper" - product: "Junos" - type: "Routers" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{day->} %{time->} %{p0}"); - - var dup2 = match("HEADER#3:0004/1_0", "nwparser.p0", "fpc0 %{p0}"); - - var dup3 = match("HEADER#3:0004/1_1", "nwparser.p0", "fpc1 %{p0}"); - - var dup4 = match("HEADER#3:0004/1_2", "nwparser.p0", "fpc2 %{p0}"); - - var dup5 = match("HEADER#3:0004/1_3", "nwparser.p0", "fpc3 %{p0}"); - - var dup6 = match("HEADER#3:0004/1_4", "nwparser.p0", "fpc4 %{p0}"); - - var dup7 = match("HEADER#3:0004/1_5", "nwparser.p0", "fpc5 %{p0}"); - - var dup8 = match("HEADER#3:0004/1_11", "nwparser.p0", "ssb %{p0}"); - - var dup9 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup10 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" "), - field("p0"), - ], - }); - - var dup11 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup12 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup13 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" ["), - field("p0"), - ], - }); - - var dup14 = match("HEADER#15:0026.upd.a/1_0", "nwparser.p0", "RT_FLOW - %{p0}"); - - var dup15 = match("HEADER#15:0026.upd.a/1_1", "nwparser.p0", "junos-ssl-proxy - %{p0}"); - - var dup16 = match("HEADER#15:0026.upd.a/1_2", "nwparser.p0", "RT_APPQOS - %{p0}"); - - var dup17 = match("HEADER#15:0026.upd.a/1_3", "nwparser.p0", "%{hfld33->} - %{p0}"); - - var dup18 = match("HEADER#16:0026.upd.b/0", "message", "%{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var dup19 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("pid"), - constant("]: "), - field("p0"), - ], - }); - - var dup20 = setc("messageid","JUNOSROUTER_GENERIC"); - - var dup21 = setc("eventcategory","1605000000"); - - var dup22 = setf("msg","$MSG"); - - var dup23 = date_time({ - dest: "event_time", - args: ["month","day","time"], - fmts: [ - [dB,dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup24 = setf("hostname","hhost"); - - var dup25 = setc("event_description","AUDIT"); - - var dup26 = setc("event_description","CRON command"); - - var dup27 = setc("eventcategory","1801030000"); - - var dup28 = setc("eventcategory","1801020000"); - - var dup29 = setc("eventcategory","1605010000"); - - var dup30 = setc("eventcategory","1603000000"); - - var dup31 = setc("event_description","Process mode"); - - var dup32 = setc("event_description","NTP Server Unreachable"); - - var dup33 = setc("eventcategory","1401060000"); - - var dup34 = setc("ec_theme","Authentication"); - - var dup35 = setc("ec_subject","User"); - - var dup36 = setc("ec_activity","Logon"); - - var dup37 = setc("ec_outcome","Success"); - - var dup38 = setc("event_description","rpd proceeding"); - - var dup39 = match("MESSAGE#77:sshd:06/0", "nwparser.payload", "%{} %{p0}"); - - var dup40 = match("MESSAGE#77:sshd:06/1_0", "nwparser.p0", "%{process}[%{process_id}]: %{p0}"); - - var dup41 = match("MESSAGE#77:sshd:06/1_1", "nwparser.p0", "%{process}: %{p0}"); - - var dup42 = setc("eventcategory","1701010000"); - - var dup43 = setc("ec_outcome","Failure"); - - var dup44 = setc("eventcategory","1401030000"); - - var dup45 = match_copy("MESSAGE#72:Failed:05/1_2", "nwparser.p0", "p0"); - - var dup46 = setc("eventcategory","1803000000"); - - var dup47 = setc("event_type","VPN"); - - var dup48 = setc("eventcategory","1605020000"); - - var dup49 = setc("eventcategory","1602020000"); - - var dup50 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{p0}"); - - var dup51 = setc("eventcategory","1603020000"); - - var dup52 = date_time({ - dest: "event_time", - args: ["hfld32"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dc("T"),dN,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup53 = setc("ec_subject","NetworkComm"); - - var dup54 = setc("ec_activity","Create"); - - var dup55 = setc("ec_activity","Stop"); - - var dup56 = setc("event_description","Trap state change"); - - var dup57 = setc("event_description","peer NLRI mismatch"); - - var dup58 = setc("eventcategory","1605030000"); - - var dup59 = setc("eventcategory","1603010000"); - - var dup60 = setc("eventcategory","1606000000"); - - var dup61 = setf("hostname","hhostname"); - - var dup62 = date_time({ - dest: "event_time", - args: ["hfld6"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dc("T"),dN,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup63 = setc("eventcategory","1401050200"); - - var dup64 = setc("event_description","Memory allocation failed during initialization for configuration load"); - - var dup65 = setc("event_description","unable to run in the background as a daemon"); - - var dup66 = setc("event_description","Another copy of this program is running"); - - var dup67 = setc("event_description","Unable to lock PID file"); - - var dup68 = setc("event_description","Unable to update process PID file"); - - var dup69 = setc("eventcategory","1301000000"); - - var dup70 = setc("event_description","Command stopped"); - - var dup71 = setc("event_description","Unable to create pipes for command"); - - var dup72 = setc("event_description","Command exited"); - - var dup73 = setc("eventcategory","1603050000"); - - var dup74 = setc("eventcategory","1801010000"); - - var dup75 = setc("event_description","Login failure"); - - var dup76 = match("MESSAGE#294:LOGIN_INFORMATION/3_0", "nwparser.p0", "User %{p0}"); - - var dup77 = match("MESSAGE#294:LOGIN_INFORMATION/3_1", "nwparser.p0", "user %{p0}"); - - var dup78 = setc("event_description","Unable to open file"); - - var dup79 = setc("event_description","SNMP index assigned changed"); - - var dup80 = setc("eventcategory","1302000000"); - - var dup81 = setc("eventcategory","1001020300"); - - var dup82 = setc("event_description","PFE FW SYSLOG_IP"); - - var dup83 = setc("event_description","process_mode"); - - var dup84 = setc("event_description","Logical interface collision"); - - var dup85 = setc("event_description","excessive runtime time during action of module"); - - var dup86 = setc("event_description","Reinitializing"); - - var dup87 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var dup88 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_0", "nwparser.p0", " connection-tag=%{fld20->} service-name=\"%{p0}"); - - var dup89 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_1", "nwparser.p0", " service-name=\"%{p0}"); - - var dup90 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/3_0", "nwparser.p0", " nat-connection-tag=%{fld6->} src-nat-rule-type=%{fld20->} %{p0}"); - - var dup91 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_1", "nwparser.p0", "name=\"%{p0}"); - - var dup92 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/8", "nwparser.p0", "]%{}"); - - var dup93 = setc("eventcategory","1803010000"); - - var dup94 = setc("ec_activity","Deny"); - - var dup95 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_0", "nwparser.payload", "%{process}: %{event_type}: session denied %{p0}"); - - var dup96 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_1", "nwparser.payload", "%{event_type}: session denied %{p0}"); - - var dup97 = setc("event_description","session denied"); - - var dup98 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var dup99 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/2", "nwparser.p0", "%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var dup100 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{rulename}\" dst-nat-rule-%{p0}"); - - var dup101 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/5_0", "nwparser.p0", "type=%{fld7->} dst-nat-rule-name=\"%{p0}"); - - var dup102 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/6", "nwparser.p0", "\"%{rule_template->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"%{p0}"); - - var dup103 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\" encrypted=%{fld16->} %{p0}"); - - var dup104 = setc("dclass_counter1_string","No.of packets from client"); - - var dup105 = setc("event_description","SNMPD AUTH FAILURE"); - - var dup106 = setc("event_description","send send-type (index1) failure"); - - var dup107 = setc("event_description","SNMP trap error"); - - var dup108 = setc("event_description","SNMP TRAP LINK DOWN"); - - var dup109 = setc("event_description","SNMP TRAP LINK UP"); - - var dup110 = setc("event_description","Login Failure"); - - var dup111 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' set: [%{action}] %{p0}"); - - var dup112 = match_copy("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_1", "nwparser.p0", "space"); - - var dup113 = setc("eventcategory","1701020000"); - - var dup114 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_1", "nwparser.p0", "\u003c\u003c%{change_old}> %{p0}"); - - var dup115 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/2", "nwparser.p0", "-> \"%{change_new}\""); - - var dup116 = setc("event_description","User set command"); - - var dup117 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{p0}"); - - var dup118 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_0", "nwparser.p0", "set %{p0}"); - - var dup119 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_1", "nwparser.p0", "replace %{p0}"); - - var dup120 = setc("event_description","User set groups to secret"); - - var dup121 = setc("event_description","UI CMDLINE READ LINE"); - - var dup122 = setc("event_description","User commit"); - - var dup123 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_0", "nwparser.p0", "Network %{p0}"); - - var dup124 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_1", "nwparser.p0", "Local %{p0}"); - - var dup125 = setc("eventcategory","1401070000"); - - var dup126 = setc("ec_activity","Logoff"); - - var dup127 = setc("event_description","Successful login"); - - var dup128 = setf("hostname","hostip"); - - var dup129 = setc("event_description","TACACS+ failure"); - - var dup130 = match("MESSAGE#755:node:05/0", "nwparser.payload", "%{hostname->} %{node->} %{p0}"); - - var dup131 = match("MESSAGE#755:node:05/1_0", "nwparser.p0", "partner%{p0}"); - - var dup132 = match("MESSAGE#755:node:05/1_1", "nwparser.p0", "actor%{p0}"); - - var dup133 = setc("eventcategory","1003010000"); - - var dup134 = setc("eventcategory","1901000000"); - - var dup135 = linear_select([ - dup14, - dup15, - dup16, - dup17, - ]); - - var dup136 = match("HEADER#15:0026.upd.a/2", "nwparser.p0", "%{messageid->} [%{p0}", processor_chain([ - dup13, - ])); - - var dup137 = linear_select([ - dup40, - dup41, - ]); - - var dup138 = match("MESSAGE#125:BFDD_TRAP_STATE_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: local discriminator: %{resultcode}, new state: %{result}", processor_chain([ - dup21, - dup22, - dup56, - dup23, - ])); - - var dup139 = match("MESSAGE#214:DCD_MALLOC_FAILED_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed during initialization for configuration load", processor_chain([ - dup51, - dup22, - dup64, - dup23, - ])); - - var dup140 = match("MESSAGE#225:ECCD_DAEMONIZE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}, unable to run in the background as a daemon: %{result}", processor_chain([ - dup30, - dup22, - dup65, - dup23, - ])); - - var dup141 = match("MESSAGE#226:ECCD_DUPLICATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Another copy of this program is running", processor_chain([ - dup30, - dup22, - dup66, - dup23, - ])); - - var dup142 = match("MESSAGE#232:ECCD_PID_FILE_LOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lock PID file: %{result}", processor_chain([ - dup30, - dup22, - dup67, - dup23, - ])); - - var dup143 = match("MESSAGE#233:ECCD_PID_FILE_UPDATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to update process PID file: %{result}", processor_chain([ - dup30, - dup22, - dup68, - dup23, - ])); - - var dup144 = match("MESSAGE#272:LIBJNX_EXEC_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipes for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - dup71, - dup23, - ])); - - var dup145 = linear_select([ - dup76, - dup77, - ]); - - var dup146 = match("MESSAGE#310:MIB2D_IFD_IFINDEX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP index assigned to %{uid->} changed from %{dclass_counter1->} to %{result}", processor_chain([ - dup30, - dup22, - dup79, - dup23, - ])); - - var dup147 = match("MESSAGE#412:RPD_IFL_INDEXCOLLISION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Logical interface collision -- %{result}, %{info}", processor_chain([ - dup30, - dup22, - dup84, - dup23, - ])); - - var dup148 = match("MESSAGE#466:RPD_SCHED_CALLBACK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime time during action of module", processor_chain([ - dup30, - dup22, - dup85, - dup23, - ])); - - var dup149 = match("MESSAGE#482:RPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitializing", processor_chain([ - dup21, - dup22, - dup86, - dup23, - ])); - - var dup150 = linear_select([ - dup88, - dup89, - ]); - - var dup151 = linear_select([ - dup90, - dup45, - ]); - - var dup152 = linear_select([ - dup95, - dup96, - ]); - - var dup153 = linear_select([ - dup101, - dup91, - ]); - - var dup154 = match("MESSAGE#498:RT_SCREEN_TCP", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var dup155 = match("MESSAGE#527:SSL_PROXY_SSL_SESSION_ALLOW", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} logical-system-name=\"%{hostname}\" session-id=\"%{sessionid}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" profile-name=\"%{rulename}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" message=\"%{info}\"]", processor_chain([ - dup27, - dup22, - dup52, - ])); - - var dup156 = linear_select([ - dup118, - dup119, - ]); - - var dup157 = linear_select([ - dup123, - dup124, - ]); - - var dup158 = match("MESSAGE#733:WEBFILTER_URL_PERMITTED", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7->} USERNAME=%{fld8->} ROLES=%{fld9}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var dup159 = match_copy("MESSAGE#747:cli", "nwparser.payload", "fld12", processor_chain([ - dup48, - dup47, - dup23, - dup22, - ])); - - var hdr1 = match("HEADER#0:0001", "message", "%{month->} %{day->} %{time->} %{messageid}: restart %{p0}", processor_chain([ - setc("header_id","0001"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(": restart "), - field("p0"), - ], - }), - ])); - - var hdr2 = match("HEADER#1:0002", "message", "%{month->} %{day->} %{time->} %{messageid->} message repeated %{p0}", processor_chain([ - setc("header_id","0002"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" message repeated "), - field("p0"), - ], - }), - ])); - - var hdr3 = match("HEADER#2:0003", "message", "%{month->} %{day->} %{time->} ssb %{messageid}(%{hfld1}): %{p0}", processor_chain([ - setc("header_id","0003"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("("), - field("hfld1"), - constant("): "), - field("p0"), - ], - }), - ])); - - var part1 = match("HEADER#3:0004/1_6", "nwparser.p0", "fpc6 %{p0}"); - - var part2 = match("HEADER#3:0004/1_7", "nwparser.p0", "fpc7 %{p0}"); - - var part3 = match("HEADER#3:0004/1_8", "nwparser.p0", "fpc8 %{p0}"); - - var part4 = match("HEADER#3:0004/1_9", "nwparser.p0", "fpc9 %{p0}"); - - var part5 = match("HEADER#3:0004/1_10", "nwparser.p0", "cfeb %{p0}"); - - var select1 = linear_select([ - dup2, - dup3, - dup4, - dup5, - dup6, - dup7, - part1, - part2, - part3, - part4, - part5, - dup8, - ]); - - var part6 = match("HEADER#3:0004/2", "nwparser.p0", "%{} %{messageid}: %{p0}", processor_chain([ - dup9, - ])); - - var all1 = all_match({ - processors: [ - dup1, - select1, - part6, - ], - on_success: processor_chain([ - setc("header_id","0004"), - ]), - }); - - var select2 = linear_select([ - dup2, - dup3, - dup4, - dup5, - dup6, - dup7, - dup8, - ]); - - var part7 = match("HEADER#4:0005/2", "nwparser.p0", "%{} %{messageid->} %{p0}", processor_chain([ - dup10, - ])); - - var all2 = all_match({ - processors: [ - dup1, - select2, - part7, - ], - on_success: processor_chain([ - setc("header_id","0005"), - ]), - }); - - var hdr4 = match("HEADER#5:0007", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2}[%{hpid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0007"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant("["), - field("hpid"), - constant("]: "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr5 = match("HEADER#6:0008", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{messageid}[%{hpid}]: %{p0}", processor_chain([ - setc("header_id","0008"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("hpid"), - constant("]: "), - field("p0"), - ], - }), - ])); - - var hdr6 = match("HEADER#7:0009", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2->} IFP trace> %{messageid}: %{p0}", processor_chain([ - setc("header_id","0009"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" IFP trace> "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr7 = match("HEADER#8:0010", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0010"), - dup11, - ])); - - var hdr8 = match("HEADER#9:0029", "message", "%{month->} %{day->} %{time->} %{hostip->} %{hfld1}[%{pid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0029"), - dup12, - ])); - - var hdr9 = match("HEADER#10:0015", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0015"), - dup12, - ])); - - var hdr10 = match("HEADER#11:0011", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0011"), - dup11, - ])); - - var hdr11 = match("HEADER#12:0027", "message", "%{month->} %{day->} %{time->} %{hhostname->} RT_FLOW: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0027"), - dup9, - ])); - - var hdr12 = match("HEADER#13:0012", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0012"), - dup9, - ])); - - var hdr13 = match("HEADER#14:0013", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hfld32->} %{hhostname->} RT_FLOW - %{messageid->} [%{p0}", processor_chain([ - setc("header_id","0013"), - dup13, - ])); - - var hdr14 = match("HEADER#15:0026.upd.a/0", "message", "%{hfld1->} %{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var all3 = all_match({ - processors: [ - hdr14, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026.upd.a"), - ]), - }); - - var all4 = all_match({ - processors: [ - dup18, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026.upd.b"), - ]), - }); - - var all5 = all_match({ - processors: [ - dup18, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026"), - ]), - }); - - var hdr15 = match("HEADER#18:0014", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid}[%{hpid}]: %{p0}", processor_chain([ - setc("header_id","0014"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant("["), - field("hpid"), - constant("]: "), - field("p0"), - ], - }), - ])); - - var hdr16 = match("HEADER#19:0016", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0016"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant(": "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr17 = match("HEADER#20:0017", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid->} %{p0}", processor_chain([ - setc("header_id","0017"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr18 = match("HEADER#21:0018", "message", "%{month->} %{day->} %{time->} %{hhost}: %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0018"), - dup19, - ])); - - var hdr19 = match("HEADER#22:0028", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0028"), - dup19, - ])); - - var hdr20 = match("HEADER#23:0019", "message", "%{month->} %{day->} %{time->} %{hhost}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0019"), - dup9, - ])); - - var hdr21 = match("HEADER#24:0020", "message", "%{month->} %{day->} %{time->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0020"), - dup19, - ])); - - var hdr22 = match("HEADER#25:0021", "message", "%{month->} %{day->} %{time->} /%{messageid}: %{p0}", processor_chain([ - setc("header_id","0021"), - dup9, - ])); - - var hdr23 = match("HEADER#26:0022", "message", "%{month->} %{day->} %{time->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0022"), - dup9, - ])); - - var hdr24 = match("HEADER#27:0023", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0023"), - dup19, - ])); - - var hdr25 = match("HEADER#28:0024", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0024"), - dup9, - ])); - - var hdr26 = match("HEADER#29:0025", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{hfld2->} %{messageid->} %{p0}", processor_chain([ - setc("header_id","0025"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr27 = match("HEADER#30:0031", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid->} %{p0}", processor_chain([ - setc("header_id","0031"), - dup10, - ])); - - var hdr28 = match("HEADER#31:0032", "message", "%{month->} %{day->} %{time->} %{hostip->} (%{hfld1}) %{hfld2->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0032"), - dup19, - ])); - - var hdr29 = match("HEADER#32:0033", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0033"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant(" "), - field("hhostname"), - constant(" "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr30 = match("HEADER#33:3336", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{messageid}: %{payload}", processor_chain([ - setc("header_id","3336"), - ])); - - var hdr31 = match("HEADER#34:3339", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{messageid->} %{payload}", processor_chain([ - setc("header_id","3339"), - ])); - - var hdr32 = match("HEADER#35:3337", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid}: %{payload}", processor_chain([ - setc("header_id","3337"), - ])); - - var hdr33 = match("HEADER#36:3341", "message", "%{hfld1->} %{hfld6->} %{hhostname->} %{hfld2->} %{hfld3->} %{messageid->} %{p0}", processor_chain([ - setc("header_id","3341"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("hfld3"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr34 = match("HEADER#37:3338", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid->} %{payload}", processor_chain([ - setc("header_id","3338"), - ])); - - var hdr35 = match("HEADER#38:3340/0", "message", "%{month->} %{day->} %{time->} %{hhost->} node%{hfld1}.fpc%{p0}", processor_chain([ - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hhost"), - constant(" node"), - field("hfld1"), - constant(".fpc"), - field("p0"), - ], - }), - ])); - - var part8 = match("HEADER#38:3340/1_0", "nwparser.p0", "%{hfld2}.pic%{hfld3->} %{p0}"); - - var part9 = match("HEADER#38:3340/1_1", "nwparser.p0", "%{hfld2->} %{p0}"); - - var select3 = linear_select([ - part8, - part9, - ]); - - var part10 = match("HEADER#38:3340/2", "nwparser.p0", "%{} %{p0}"); - - var all6 = all_match({ - processors: [ - hdr35, - select3, - part10, - ], - on_success: processor_chain([ - setc("header_id","3340"), - setc("messageid","node"), - ]), - }); - - var hdr36 = match("HEADER#39:9997/0_0", "message", "mgd[%{p0}"); - - var hdr37 = match("HEADER#39:9997/0_1", "message", "rpd[%{p0}"); - - var hdr38 = match("HEADER#39:9997/0_2", "message", "dcd[%{p0}"); - - var select4 = linear_select([ - hdr36, - hdr37, - hdr38, - ]); - - var part11 = match("HEADER#39:9997/1", "nwparser.p0", "%{process_id}]:%{payload}"); - - var all7 = all_match({ - processors: [ - select4, - part11, - ], - on_success: processor_chain([ - setc("header_id","9997"), - dup20, - ]), - }); - - var hdr39 = match("HEADER#40:9995", "message", "%{month->} %{day->} %{time->} %{hhost->} %{hfld1->} %{hfld2->} %{messageid}[%{hfld3}]:%{p0}", processor_chain([ - setc("header_id","9995"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("hfld3"), - constant("]:"), - field("p0"), - ], - }), - ])); - - var hdr40 = match("HEADER#41:9994", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{hfld1->} qsfp %{p0}", processor_chain([ - setc("header_id","9994"), - setc("messageid","qsfp"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("hfld1"), - constant(" qsfp "), - field("p0"), - ], - }), - ])); - - var hdr41 = match("HEADER#42:9999", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{hevent_type}: %{p0}", processor_chain([ - setc("header_id","9999"), - dup20, - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hevent_type"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr42 = match("HEADER#43:9998", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{process}: %{p0}", processor_chain([ - setc("header_id","9998"), - dup20, - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("process"), - constant(": "), - field("p0"), - ], - }), - ])); - - var select5 = linear_select([ - hdr1, - hdr2, - hdr3, - all1, - all2, - hdr4, - hdr5, - hdr6, - hdr7, - hdr8, - hdr9, - hdr10, - hdr11, - hdr12, - hdr13, - all3, - all4, - all5, - hdr15, - hdr16, - hdr17, - hdr18, - hdr19, - hdr20, - hdr21, - hdr22, - hdr23, - hdr24, - hdr25, - hdr26, - hdr27, - hdr28, - hdr29, - hdr30, - hdr31, - hdr32, - hdr33, - hdr34, - all6, - all7, - hdr39, - hdr40, - hdr41, - hdr42, - ]); - - var part12 = match("MESSAGE#0:/usr/sbin/sshd", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exit status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","sshd exit status"), - dup23, - ])); - - var msg1 = msg("/usr/sbin/sshd", part12); - - var part13 = match("MESSAGE#1:/usr/libexec/telnetd", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exit status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","telnetd exit status"), - dup23, - ])); - - var msg2 = msg("/usr/libexec/telnetd", part13); - - var part14 = match("MESSAGE#2:alarmd", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License color=%{severity}, class=%{device}, reason=%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Alarm Set or Cleared"), - dup23, - ])); - - var msg3 = msg("alarmd", part14); - - var part15 = match("MESSAGE#3:bigd", "nwparser.payload", "%{process}: Node detected UP for %{node}", processor_chain([ - dup21, - dup22, - setc("event_description","Node detected UP"), - dup23, - ])); - - var msg4 = msg("bigd", part15); - - var part16 = match("MESSAGE#4:bigd:01", "nwparser.payload", "%{process}: Monitor template id is %{id}", processor_chain([ - dup21, - dup22, - setc("event_description","Monitor template id"), - dup23, - ])); - - var msg5 = msg("bigd:01", part16); - - var select6 = linear_select([ - msg4, - msg5, - ]); - - var part17 = match("MESSAGE#5:bigpipe", "nwparser.payload", "%{process}: Loading the configuration file %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","Loading configuration file"), - dup23, - ])); - - var msg6 = msg("bigpipe", part17); - - var part18 = match("MESSAGE#6:bigpipe:01", "nwparser.payload", "%{process}: Begin config install operation %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","Begin config install operation"), - dup23, - ])); - - var msg7 = msg("bigpipe:01", part18); - - var part19 = match("MESSAGE#7:bigpipe:02", "nwparser.payload", "%{process}: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - setc("event_description","Audit"), - dup23, - ])); - - var msg8 = msg("bigpipe:02", part19); - - var select7 = linear_select([ - msg6, - msg7, - msg8, - ]); - - var part20 = match("MESSAGE#8:bigstart", "nwparser.payload", "%{process}: shutdown %{service}", processor_chain([ - dup21, - dup22, - setc("event_description","portal shutdown"), - dup23, - ])); - - var msg9 = msg("bigstart", part20); - - var part21 = match("MESSAGE#9:cgatool", "nwparser.payload", "%{process}: %{event_type}: generated address is %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","cga address genration"), - dup23, - ])); - - var msg10 = msg("cgatool", part21); - - var part22 = match("MESSAGE#10:chassisd:01", "nwparser.payload", "%{process}[%{process_id}]:%{fld12}", processor_chain([ - dup21, - dup22, - dup23, - dup24, - ])); - - var msg11 = msg("chassisd:01", part22); - - var part23 = match("MESSAGE#11:checkd", "nwparser.payload", "%{process}: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - dup25, - dup23, - ])); - - var msg12 = msg("checkd", part23); - - var part24 = match("MESSAGE#12:checkd:01", "nwparser.payload", "%{process}: exiting", processor_chain([ - dup21, - dup22, - setc("event_description","checkd exiting"), - dup23, - ])); - - var msg13 = msg("checkd:01", part24); - - var select8 = linear_select([ - msg12, - msg13, - ]); - - var part25 = match("MESSAGE#13:cosd", "nwparser.payload", "%{process}[%{process_id}]: link protection %{dclass_counter1->} for intf %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","link protection for interface"), - dup23, - ])); - - var msg14 = msg("cosd", part25); - - var part26 = match("MESSAGE#14:craftd", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}, %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","License expiration warning"), - dup23, - ])); - - var msg15 = msg("craftd", part26); - - var part27 = match("MESSAGE#15:CRON/0", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) %{p0}"); - - var part28 = match("MESSAGE#15:CRON/1_0", "nwparser.p0", "CMD (%{result})"); - - var part29 = match("MESSAGE#15:CRON/1_1", "nwparser.p0", "cmd='%{result}'"); - - var select9 = linear_select([ - part28, - part29, - ]); - - var all8 = all_match({ - processors: [ - part27, - select9, - ], - on_success: processor_chain([ - dup21, - dup22, - dup26, - dup23, - ]), - }); - - var msg16 = msg("CRON", all8); - - var part30 = match("MESSAGE#16:Cmerror/0_0", "nwparser.payload", "%{hostname->} %{node}Cmerror: Level%{level}count increment %{dclass_counter1->} %{fld1}"); - - var part31 = match_copy("MESSAGE#16:Cmerror/0_1", "nwparser.payload", "fld2"); - - var select10 = linear_select([ - part30, - part31, - ]); - - var all9 = all_match({ - processors: [ - select10, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg17 = msg("Cmerror", all9); - - var part32 = match("MESSAGE#17:cron", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) %{action->} (%{filename})", processor_chain([ - dup21, - dup22, - setc("event_description","cron RELOAD"), - dup23, - ])); - - var msg18 = msg("cron", part32); - - var part33 = match("MESSAGE#18:CROND", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) CMD (%{action})", processor_chain([ - dup21, - dup22, - dup23, - dup24, - ])); - - var msg19 = msg("CROND", part33); - - var part34 = match("MESSAGE#20:CROND:02", "nwparser.payload", "%{process}[%{process_id}]: pam_unix(crond:session): session closed for user %{username}", processor_chain([ - dup27, - dup22, - dup23, - dup24, - ])); - - var msg20 = msg("CROND:02", part34); - - var select11 = linear_select([ - msg19, - msg20, - ]); - - var part35 = match("MESSAGE#19:crond:01", "nwparser.payload", "%{process}[%{process_id}]: pam_unix(crond:session): session opened for user %{username->} by (uid=%{uid})", processor_chain([ - dup28, - dup22, - dup23, - dup24, - ])); - - var msg21 = msg("crond:01", part35); - - var part36 = match("MESSAGE#21:dcd", "nwparser.payload", "%{process}[%{process_id}]: %{result->} Setting ignored, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Setting ignored"), - dup23, - ])); - - var msg22 = msg("dcd", part36); - - var part37 = match("MESSAGE#22:EVENT/0", "nwparser.payload", "%{process}[%{process_id}]: EVENT %{event_type->} %{interface->} index %{resultcode->} %{p0}"); - - var part38 = match("MESSAGE#22:EVENT/1_0", "nwparser.p0", "%{saddr->} -> %{daddr->} \u003c\u003c%{p0}"); - - var part39 = match("MESSAGE#22:EVENT/1_1", "nwparser.p0", "\u003c\u003c%{p0}"); - - var select12 = linear_select([ - part38, - part39, - ]); - - var part40 = match("MESSAGE#22:EVENT/2", "nwparser.p0", ">%{result}"); - - var all10 = all_match({ - processors: [ - part37, - select12, - part40, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","EVENT"), - dup23, - ]), - }); - - var msg23 = msg("EVENT", all10); - - var part41 = match("MESSAGE#23:ftpd", "nwparser.payload", "%{process}[%{process_id}]: connection from %{saddr->} (%{shost})", processor_chain([ - setc("eventcategory","1802000000"), - dup22, - setc("event_description","ftpd connection"), - dup23, - ])); - - var msg24 = msg("ftpd", part41); - - var part42 = match("MESSAGE#24:ha_rto_stats_handler", "nwparser.payload", "%{hostname->} %{node}ha_rto_stats_handler:%{fld12}", processor_chain([ - dup29, - dup23, - dup22, - ])); - - var msg25 = msg("ha_rto_stats_handler", part42); - - var part43 = match("MESSAGE#25:hostinit", "nwparser.payload", "%{process}: %{obj_name->} -- LDAP Connection not bound correctly. %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","LDAP Connection not bound correctly"), - dup23, - ])); - - var msg26 = msg("hostinit", part43); - - var part44 = match("MESSAGE#26:ifinfo", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> Added entry - %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug - Added entry"), - dup23, - ])); - - var msg27 = msg("ifinfo", part44); - - var part45 = match("MESSAGE#27:ifinfo:01", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> Initializing spu listtype %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug Initializing spu"), - dup23, - ])); - - var msg28 = msg("ifinfo:01", part45); - - var part46 = match("MESSAGE#28:ifinfo:02", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug delete from list"), - dup23, - ])); - - var msg29 = msg("ifinfo:02", part46); - - var select13 = linear_select([ - msg27, - msg28, - msg29, - ]); - - var part47 = match("MESSAGE#29:ifp_ifl_anydown_change_event", "nwparser.payload", "%{node->} %{action}> %{process}: IFL anydown change event: \"%{event_type}\"", processor_chain([ - dup21, - dup22, - setc("event_description","IFL anydown change event"), - dup23, - ])); - - var msg30 = msg("ifp_ifl_anydown_change_event", part47); - - var part48 = match("MESSAGE#30:ifp_ifl_config_event", "nwparser.payload", "%{node->} %{action}> %{process}: IFL config: \"%{filename}\"", processor_chain([ - dup21, - dup22, - setc("event_description","ifp ifl config_event"), - dup23, - ])); - - var msg31 = msg("ifp_ifl_config_event", part48); - - var part49 = match("MESSAGE#31:ifp_ifl_ext_chg", "nwparser.payload", "%{node->} %{process}: ifp ext piid %{parent_pid->} zone_id %{zone}", processor_chain([ - dup21, - dup22, - setc("event_description","ifp_ifl_ext_chg"), - dup23, - ])); - - var msg32 = msg("ifp_ifl_ext_chg", part49); - - var part50 = match("MESSAGE#32:inetd", "nwparser.payload", "%{process}[%{process_id}]: %{protocol->} from %{saddr->} exceeded counts/min (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","connection exceeded count limit"), - dup23, - ])); - - var msg33 = msg("inetd", part50); - - var part51 = match("MESSAGE#33:inetd:01", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exited, status %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","exited"), - dup23, - ])); - - var msg34 = msg("inetd:01", part51); - - var select14 = linear_select([ - msg33, - msg34, - ]); - - var part52 = match("MESSAGE#34:init:04", "nwparser.payload", "%{process}: %{event_type->} current_mode=%{protocol}, requested_mode=%{result}, cmd=%{action}", processor_chain([ - dup21, - dup22, - dup31, - dup23, - ])); - - var msg35 = msg("init:04", part52); - - var part53 = match("MESSAGE#35:init", "nwparser.payload", "%{process}: %{event_type->} mode=%{protocol->} cmd=%{action->} master_mode=%{result}", processor_chain([ - dup21, - dup22, - dup31, - dup23, - ])); - - var msg36 = msg("init", part53); - - var part54 = match("MESSAGE#36:init:01", "nwparser.payload", "%{process}: failure target for routing set to %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","failure target for routing set"), - dup23, - ])); - - var msg37 = msg("init:01", part54); - - var part55 = match("MESSAGE#37:init:02", "nwparser.payload", "%{process}: ntp (PID %{child_pid}) started", processor_chain([ - dup21, - dup22, - setc("event_description","ntp started"), - dup23, - ])); - - var msg38 = msg("init:02", part55); - - var part56 = match("MESSAGE#38:init:03", "nwparser.payload", "%{process}: product mask %{info->} model %{dclass_counter1}", processor_chain([ - dup21, - dup22, - setc("event_description","product mask and model info"), - dup23, - ])); - - var msg39 = msg("init:03", part56); - - var select15 = linear_select([ - msg35, - msg36, - msg37, - msg38, - msg39, - ]); - - var part57 = match("MESSAGE#39:ipc_msg_write", "nwparser.payload", "%{node->} %{process}: IPC message type: %{event_type}, subtype: %{resultcode->} exceeds MTU, mtu %{dclass_counter1}, length %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","IPC message exceeds MTU"), - dup23, - ])); - - var msg40 = msg("ipc_msg_write", part57); - - var part58 = match("MESSAGE#40:connection_established", "nwparser.payload", "%{process}: %{service}: conn established: listener idx=%{dclass_counter1->} tnpaddr=%{dclass_counter2}", processor_chain([ - dup28, - dup22, - setc("event_description","listener connection established"), - dup23, - ])); - - var msg41 = msg("connection_established", part58); - - var part59 = match("MESSAGE#41:connection_dropped/0", "nwparser.payload", "%{process}: %{p0}"); - - var part60 = match("MESSAGE#41:connection_dropped/1_0", "nwparser.p0", "%{result}, connection dropped - src %{saddr}:%{sport->} dest %{daddr}:%{dport}"); - - var part61 = match("MESSAGE#41:connection_dropped/1_1", "nwparser.p0", "%{result}: conn dropped: listener idx=%{dclass_counter1->} tnpaddr=%{dclass_counter2}"); - - var select16 = linear_select([ - part60, - part61, - ]); - - var all11 = all_match({ - processors: [ - part59, - select16, - ], - on_success: processor_chain([ - dup27, - dup22, - setc("event_description","connection dropped"), - dup23, - ]), - }); - - var msg42 = msg("connection_dropped", all11); - - var part62 = match("MESSAGE#42:kernel", "nwparser.payload", "%{process}: %{interface}: Asserting SONET alarm(s) %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Asserting SONET alarm(s)"), - dup23, - ])); - - var msg43 = msg("kernel", part62); - - var part63 = match("MESSAGE#43:kernel:01", "nwparser.payload", "%{process}: %{interface->} down: %{result}.", processor_chain([ - dup21, - dup22, - setc("event_description","interface down"), - dup23, - ])); - - var msg44 = msg("kernel:01", part63); - - var part64 = match("MESSAGE#44:kernel:02", "nwparser.payload", "%{process}: %{interface}: loopback suspected; %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","loopback suspected om interface"), - dup23, - ])); - - var msg45 = msg("kernel:02", part64); - - var part65 = match("MESSAGE#45:kernel:03", "nwparser.payload", "%{process}: %{service}: soreceive() error %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","soreceive error"), - dup23, - ])); - - var msg46 = msg("kernel:03", part65); - - var part66 = match("MESSAGE#46:kernel:04", "nwparser.payload", "%{process}: %{service->} !VALID(state 4)->%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","pfe_peer_alloc state 4"), - dup23, - ])); - - var msg47 = msg("kernel:04", part66); - - var part67 = match("MESSAGE#47:kernel:05", "nwparser.payload", "%{fld1->} %{hostip->} (%{fld2}) %{fld3->} %{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg48 = msg("kernel:05", part67); - - var part68 = match("MESSAGE#48:kernel:06", "nwparser.payload", "%{fld1->} %{hostip->} %{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg49 = msg("kernel:06", part68); - - var select17 = linear_select([ - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - ]); - - var part69 = match("MESSAGE#49:successful_login", "nwparser.payload", "%{process}: login from %{saddr->} on %{interface->} as %{username}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","successful user login"), - dup23, - ])); - - var msg50 = msg("successful_login", part69); - - var part70 = match("MESSAGE#50:login_attempt", "nwparser.payload", "%{process}: Login attempt for user %{username->} from host %{hostip}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup22, - setc("event_description","user login attempt"), - dup23, - ])); - - var msg51 = msg("login_attempt", part70); - - var part71 = match("MESSAGE#51:login", "nwparser.payload", "%{process}: PAM module %{dclass_counter1->} returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup33, - dup34, - dup37, - dup22, - setc("event_description","PAM module return from login"), - dup23, - ])); - - var msg52 = msg("login", part71); - - var select18 = linear_select([ - msg50, - msg51, - msg52, - ]); - - var part72 = match("MESSAGE#52:lsys_ssam_handler", "nwparser.payload", "%{node->} %{process}: processing lsys root-logical-system %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","processing lsys root-logical-system"), - dup23, - ])); - - var msg53 = msg("lsys_ssam_handler", part72); - - var part73 = match("MESSAGE#53:mcsn", "nwparser.payload", "%{process}[%{process_id}]: Removing mif from group [%{group}] %{space->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Removing mif from group"), - dup23, - ])); - - var msg54 = msg("mcsn", part73); - - var part74 = match("MESSAGE#54:mrvl_dfw_log_effuse_status", "nwparser.payload", "%{process}: Firewall rows could not be redirected on device %{device}.", processor_chain([ - dup30, - dup22, - setc("event_description","Firewall rows could not be redirected on device"), - dup23, - ])); - - var msg55 = msg("mrvl_dfw_log_effuse_status", part74); - - var part75 = match("MESSAGE#55:MRVL-L2", "nwparser.payload", "%{process}:%{action}(),%{process_id}:MFilter (%{filter}) already exists", processor_chain([ - dup30, - dup22, - setc("event_description","mfilter already exists for add"), - dup23, - ])); - - var msg56 = msg("MRVL-L2", part75); - - var part76 = match("MESSAGE#56:profile_ssam_handler", "nwparser.payload", "%{node->} %{process}: processing profile SP-root %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","processing profile SP-root"), - dup23, - ])); - - var msg57 = msg("profile_ssam_handler", part76); - - var part77 = match("MESSAGE#57:pst_nat_binding_set_profile", "nwparser.payload", "%{node->} %{process}: %{event_source}: can't get resource bucket %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","can't get resource bucket"), - dup23, - ])); - - var msg58 = msg("pst_nat_binding_set_profile", part77); - - var part78 = match("MESSAGE#58:task_reconfigure", "nwparser.payload", "%{process}[%{process_id}]: task_reconfigure %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","reinitializing done"), - dup23, - ])); - - var msg59 = msg("task_reconfigure", part78); - - var part79 = match("MESSAGE#59:tnetd/0_0", "nwparser.payload", "%{process}[%{process_id}]:%{service}[%{fld1}]: exit status%{resultcode}"); - - var part80 = match_copy("MESSAGE#59:tnetd/0_1", "nwparser.payload", "fld3"); - - var select19 = linear_select([ - part79, - part80, - ]); - - var all12 = all_match({ - processors: [ - select19, - ], - on_success: processor_chain([ - dup21, - dup22, - dup23, - dup24, - ]), - }); - - var msg60 = msg("tnetd", all12); - - var part81 = match("MESSAGE#60:PFEMAN", "nwparser.payload", "%{process}: Session manager active", processor_chain([ - dup21, - dup22, - setc("event_description","Session manager active"), - dup23, - ])); - - var msg61 = msg("PFEMAN", part81); - - var part82 = match("MESSAGE#61:mgd", "nwparser.payload", "%{process}[%{process_id}]: Could not send message to %{service}", processor_chain([ - dup30, - dup22, - setc("event_description","Could not send message to service"), - dup23, - ])); - - var msg62 = msg("mgd", part82); - - var part83 = match("MESSAGE#62:Resolve", "nwparser.payload", "Resolve request came for an address matching on Wrong nh nh:%{result}, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Resolve request came for an address matching on Wrong nh"), - dup23, - ])); - - var msg63 = msg("Resolve", part83); - - var part84 = match("MESSAGE#63:respawn", "nwparser.payload", "%{process}: %{service->} exited with status = %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","service exited with status"), - dup23, - ])); - - var msg64 = msg("respawn", part84); - - var part85 = match("MESSAGE#64:root", "nwparser.payload", "%{process}: %{node}: This system does not have 3-DNS or Link Controller enabled", processor_chain([ - dup30, - dup22, - setc("event_description","system does not have 3-DNS or Link Controller enabled"), - dup23, - ])); - - var msg65 = msg("root", part85); - - var part86 = match("MESSAGE#65:rpd", "nwparser.payload", "%{process}[%{process_id}]: Received %{result->} for intf device %{interface}; mc_ae_id %{dclass_counter1}, status %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","Received data for interface"), - dup23, - ])); - - var msg66 = msg("rpd", part86); - - var part87 = match("MESSAGE#66:rpd:01", "nwparser.payload", "%{process}[%{process_id}]: RSVP neighbor %{daddr->} up on interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","RSVP neighbor up on interface "), - dup23, - ])); - - var msg67 = msg("rpd:01", part87); - - var part88 = match("MESSAGE#67:rpd:02", "nwparser.payload", "%{process}[%{process_id}]: %{saddr->} (%{shost}): reseting pending active connection", processor_chain([ - dup21, - dup22, - setc("event_description","reseting pending active connection"), - dup23, - ])); - - var msg68 = msg("rpd:02", part88); - - var part89 = match("MESSAGE#68:rpd_proceeding", "nwparser.payload", "%{process}: proceeding. %{param}", processor_chain([ - dup21, - dup22, - dup38, - dup23, - ])); - - var msg69 = msg("rpd_proceeding", part89); - - var select20 = linear_select([ - msg66, - msg67, - msg68, - msg69, - ]); - - var part90 = match("MESSAGE#69:rshd", "nwparser.payload", "%{process}[%{process_id}]: %{username->} as root: cmd='%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","user issuing command as root"), - dup23, - ])); - - var msg70 = msg("rshd", part90); - - var part91 = match("MESSAGE#70:sfd", "nwparser.payload", "%{process}: Waiting on accept", processor_chain([ - dup21, - dup22, - setc("event_description","sfd waiting on accept"), - dup23, - ])); - - var msg71 = msg("sfd", part91); - - var part92 = match("MESSAGE#71:sshd", "nwparser.payload", "%{process}[%{process_id}]: Accepted password for %{username->} from %{saddr->} port %{sport->} %{protocol}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","Accepted password"), - dup23, - ])); - - var msg72 = msg("sshd", part92); - - var part93 = match("MESSAGE#73:sshd:02", "nwparser.payload", "%{process}[%{process_id}]: Received disconnect from %{shost}: %{fld1}: %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","Received disconnect"), - dup23, - ])); - - var msg73 = msg("sshd:02", part93); - - var part94 = match("MESSAGE#74:sshd:03", "nwparser.payload", "%{process}[%{process_id}]: Did not receive identification string from %{saddr}", processor_chain([ - dup30, - dup22, - setc("result","no identification string"), - setc("event_description","Did not receive identification string from peer"), - dup23, - ])); - - var msg74 = msg("sshd:03", part94); - - var part95 = match("MESSAGE#75:sshd:04", "nwparser.payload", "%{process}[%{process_id}]: Could not write ident string to %{dhost}", processor_chain([ - dup30, - dup22, - setc("event_description","Could not write ident string"), - dup23, - ])); - - var msg75 = msg("sshd:04", part95); - - var part96 = match("MESSAGE#76:sshd:05", "nwparser.payload", "%{process}[%{process_id}]: subsystem request for netconf", processor_chain([ - dup21, - dup22, - setc("event_description","subsystem request for netconf"), - dup23, - ])); - - var msg76 = msg("sshd:05", part96); - - var part97 = match("MESSAGE#77:sshd:06/2", "nwparser.p0", "sendmsg to %{saddr}(%{shost}).%{sport}: %{info}"); - - var all13 = all_match({ - processors: [ - dup39, - dup137, - part97, - ], - on_success: processor_chain([ - dup29, - dup22, - setc("event_description","send message stats"), - dup23, - ]), - }); - - var msg77 = msg("sshd:06", all13); - - var part98 = match("MESSAGE#78:sshd:07/2", "nwparser.p0", "Added radius server %{saddr}(%{shost})"); - - var all14 = all_match({ - processors: [ - dup39, - dup137, - part98, - ], - on_success: processor_chain([ - dup42, - setc("ec_theme","Configuration"), - setc("ec_activity","Modify"), - dup37, - dup22, - setc("event_description","Added radius server"), - dup23, - ]), - }); - - var msg78 = msg("sshd:07", all14); - - var part99 = match("MESSAGE#79:sshd:08", "nwparser.payload", "%{process}[%{process_id}]: %{result}: %{space->} [%{resultcode}]authentication error", processor_chain([ - setc("eventcategory","1301020000"), - dup34, - dup43, - dup22, - setc("event_description","authentication error"), - dup23, - ])); - - var msg79 = msg("sshd:08", part99); - - var part100 = match("MESSAGE#80:sshd:09", "nwparser.payload", "%{process}[%{process_id}]: unrecognized attribute in %{policyname}: %{change_attribute}", processor_chain([ - dup30, - dup22, - setc("event_description","unrecognized attribute in policy"), - dup23, - ])); - - var msg80 = msg("sshd:09", part100); - - var part101 = match("MESSAGE#81:sshd:10", "nwparser.payload", "%{process}: PAM module %{dclass_counter1->} returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","PAM module return from sshd"), - dup23, - ])); - - var msg81 = msg("sshd:10", part101); - - var part102 = match("MESSAGE#82:sshd:11", "nwparser.payload", "%{process}: PAM authentication chain returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","PAM authentication chain return"), - dup23, - ])); - - var msg82 = msg("sshd:11", part102); - - var part103 = match("MESSAGE#83:sshd:12", "nwparser.payload", "%{process}: %{severity}: can't get client address: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","can't get client address"), - dup23, - ])); - - var msg83 = msg("sshd:12", part103); - - var part104 = match("MESSAGE#84:sshd:13", "nwparser.payload", "%{process}: auth server unresponsive", processor_chain([ - dup30, - dup22, - setc("event_description","auth server unresponsive"), - dup23, - ])); - - var msg84 = msg("sshd:13", part104); - - var part105 = match("MESSAGE#85:sshd:14", "nwparser.payload", "%{process}: %{service}: No valid RADIUS responses received", processor_chain([ - dup30, - dup22, - setc("event_description","No valid RADIUS responses received"), - dup23, - ])); - - var msg85 = msg("sshd:14", part105); - - var part106 = match("MESSAGE#86:sshd:15", "nwparser.payload", "%{process}: Moving to next server: %{saddr}(%{shost}).%{sport}", processor_chain([ - dup21, - dup22, - setc("event_description","Moving to next server"), - dup23, - ])); - - var msg86 = msg("sshd:15", part106); - - var part107 = match("MESSAGE#87:sshd:16", "nwparser.payload", "%{fld1->} sshd: SSHD_LOGIN_FAILED: Login failed for user '%{username}' from host '%{hostip}'.", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","Login failed for user"), - dup23, - ])); - - var msg87 = msg("sshd:16", part107); - - var select21 = linear_select([ - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - ]); - - var part108 = match("MESSAGE#72:Failed:05/0", "nwparser.payload", "%{process}[%{process_id}]: Failed password for %{p0}"); - - var part109 = match("MESSAGE#72:Failed:05/1_0", "nwparser.p0", "illegal user %{p0}"); - - var part110 = match("MESSAGE#72:Failed:05/1_1", "nwparser.p0", "invalid user %{p0}"); - - var select22 = linear_select([ - part109, - part110, - dup45, - ]); - - var part111 = match("MESSAGE#72:Failed:05/2", "nwparser.p0", "%{username->} from %{saddr->} port %{sport->} %{protocol}"); - - var all15 = all_match({ - processors: [ - part108, - select22, - part111, - ], - on_success: processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - setc("event_description","authentication failure"), - dup23, - ]), - }); - - var msg88 = msg("Failed:05", all15); - - var part112 = match("MESSAGE#746:Failed/0", "nwparser.payload", "%{hostname->} %{process}[%{process_id}]: Failed to resolve ipv%{p0}"); - - var part113 = match("MESSAGE#746:Failed/1_0", "nwparser.p0", "4%{p0}"); - - var part114 = match("MESSAGE#746:Failed/1_1", "nwparser.p0", "6%{p0}"); - - var select23 = linear_select([ - part113, - part114, - ]); - - var part115 = match("MESSAGE#746:Failed/2", "nwparser.p0", "%{}addresses for domain name %{sdomain}"); - - var all16 = all_match({ - processors: [ - part112, - select23, - part115, - ], - on_success: processor_chain([ - dup46, - dup47, - dup23, - dup22, - ]), - }); - - var msg89 = msg("Failed", all16); - - var part116 = match("MESSAGE#767:Failed:01", "nwparser.payload", "%{hostname->} %{process}[%{process_id}]: %{fld1}", processor_chain([ - dup46, - dup23, - dup22, - ])); - - var msg90 = msg("Failed:01", part116); - - var part117 = match("MESSAGE#768:Failed:02/0_0", "nwparser.payload", "%{fld1->} to create a route if table for Multiservice"); - - var part118 = match_copy("MESSAGE#768:Failed:02/0_1", "nwparser.payload", "fld10"); - - var select24 = linear_select([ - part117, - part118, - ]); - - var all17 = all_match({ - processors: [ - select24, - ], - on_success: processor_chain([ - dup46, - dup23, - dup22, - setf("hostname","hfld1"), - ]), - }); - - var msg91 = msg("Failed:02", all17); - - var select25 = linear_select([ - msg88, - msg89, - msg90, - msg91, - ]); - - var part119 = match("MESSAGE#88:syslogd", "nwparser.payload", "%{process}: restart", processor_chain([ - dup21, - dup22, - setc("event_description","syslog daemon restart"), - dup23, - ])); - - var msg92 = msg("syslogd", part119); - - var part120 = match("MESSAGE#89:ucd-snmp", "nwparser.payload", "%{process}[%{process_id}]: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - dup25, - dup23, - ])); - - var msg93 = msg("ucd-snmp", part120); - - var part121 = match("MESSAGE#90:ucd-snmp:01", "nwparser.payload", "%{process}[%{process_id}]: Received TERM or STOP signal %{space->} %{result}.", processor_chain([ - dup21, - dup22, - setc("event_description","Received TERM or STOP signal"), - dup23, - ])); - - var msg94 = msg("ucd-snmp:01", part121); - - var select26 = linear_select([ - msg93, - msg94, - ]); - - var part122 = match("MESSAGE#91:usp_ipc_client_reconnect", "nwparser.payload", "%{node->} %{process}: failed to connect to the server: %{result->} (%{resultcode})", processor_chain([ - dup27, - dup22, - setc("event_description","failed to connect to the server"), - dup23, - ])); - - var msg95 = msg("usp_ipc_client_reconnect", part122); - - var part123 = match("MESSAGE#92:usp_trace_ipc_disconnect", "nwparser.payload", "%{node->} %{process}:Trace client disconnected. %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","Trace client disconnected"), - dup23, - ])); - - var msg96 = msg("usp_trace_ipc_disconnect", part123); - - var part124 = match("MESSAGE#93:usp_trace_ipc_reconnect", "nwparser.payload", "%{node->} %{process}:USP trace client cannot reconnect to server", processor_chain([ - dup30, - dup22, - setc("event_description","USP trace client cannot reconnect to server"), - dup23, - ])); - - var msg97 = msg("usp_trace_ipc_reconnect", part124); - - var part125 = match("MESSAGE#94:uspinfo", "nwparser.payload", "%{process}: flow_print_session_summary_output received %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","flow_print_session_summary_output received"), - dup23, - ])); - - var msg98 = msg("uspinfo", part125); - - var part126 = match("MESSAGE#95:Version", "nwparser.payload", "Version %{version->} by builder on %{event_time_string}", processor_chain([ - dup21, - dup22, - setc("event_description","Version build date"), - dup23, - ])); - - var msg99 = msg("Version", part126); - - var part127 = match("MESSAGE#96:xntpd", "nwparser.payload", "%{process}[%{process_id}]: frequency initialized %{result->} from %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","frequency initialized from file"), - dup23, - ])); - - var msg100 = msg("xntpd", part127); - - var part128 = match("MESSAGE#97:xntpd:01", "nwparser.payload", "%{process}[%{process_id}]: ntpd %{version->} %{event_time_string->} (%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","nptd version build"), - dup23, - ])); - - var msg101 = msg("xntpd:01", part128); - - var part129 = match("MESSAGE#98:xntpd:02", "nwparser.payload", "%{process}: kernel time sync enabled %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","kernel time sync enabled"), - dup23, - ])); - - var msg102 = msg("xntpd:02", part129); - - var part130 = match("MESSAGE#99:xntpd:03", "nwparser.payload", "%{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg103 = msg("xntpd:03", part130); - - var select27 = linear_select([ - msg100, - msg101, - msg102, - msg103, - ]); - - var part131 = match("MESSAGE#100:last", "nwparser.payload", "last message repeated %{dclass_counter1->} times", processor_chain([ - dup21, - dup22, - setc("event_description","last message repeated"), - dup23, - ])); - - var msg104 = msg("last", part131); - - var part132 = match("MESSAGE#739:last:01", "nwparser.payload", "message repeated %{dclass_counter1->} times", processor_chain([ - dup48, - dup47, - dup23, - dup22, - dup24, - ])); - - var msg105 = msg("last:01", part132); - - var select28 = linear_select([ - msg104, - msg105, - ]); - - var part133 = match("MESSAGE#101:BCHIP", "nwparser.payload", "%{process->} %{device}: cannot write ucode mask reg", processor_chain([ - dup30, - dup22, - setc("event_description","cannot write ucode mask reg"), - dup23, - ])); - - var msg106 = msg("BCHIP", part133); - - var part134 = match("MESSAGE#102:CM", "nwparser.payload", "%{process}(%{fld1}): Slot %{device}: On-line", processor_chain([ - dup21, - dup22, - setc("event_description","Slot on-line"), - dup23, - ])); - - var msg107 = msg("CM", part134); - - var part135 = match("MESSAGE#103:COS", "nwparser.payload", "%{process}: Received FC->Q map, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Received FC Q map"), - dup23, - ])); - - var msg108 = msg("COS", part135); - - var part136 = match("MESSAGE#104:COSFPC", "nwparser.payload", "%{process}: ifd %{resultcode}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","ifd error"), - dup23, - ])); - - var msg109 = msg("COSFPC", part136); - - var part137 = match("MESSAGE#105:COSMAN", "nwparser.payload", "%{process}: %{service}: delete class_to_ifl table %{dclass_counter1}, ifl %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","delete class to ifl link"), - dup23, - ])); - - var msg110 = msg("COSMAN", part137); - - var part138 = match("MESSAGE#106:RDP", "nwparser.payload", "%{process}: Keepalive timeout for rdp.(%{interface}).(%{device}) (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","Keepalive timeout"), - dup23, - ])); - - var msg111 = msg("RDP", part138); - - var part139 = match("MESSAGE#107:SNTPD", "nwparser.payload", "%{process}: Initial time of day set", processor_chain([ - dup30, - dup22, - setc("event_description","Initial time of day set"), - dup23, - ])); - - var msg112 = msg("SNTPD", part139); - - var part140 = match("MESSAGE#108:SSB", "nwparser.payload", "%{process}(%{fld1}): Slot %{device}, serial number S/N %{serial_number}.", processor_chain([ - dup21, - dup22, - setc("event_description","Slot serial number"), - dup23, - ])); - - var msg113 = msg("SSB", part140); - - var part141 = match("MESSAGE#109:ACCT_ACCOUNTING_FERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected error %{result->} from file %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected error"), - dup23, - ])); - - var msg114 = msg("ACCT_ACCOUNTING_FERROR", part141); - - var part142 = match("MESSAGE#110:ACCT_ACCOUNTING_FOPEN_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to open file %{filename}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to open file"), - dup23, - ])); - - var msg115 = msg("ACCT_ACCOUNTING_FOPEN_ERROR", part142); - - var part143 = match("MESSAGE#111:ACCT_ACCOUNTING_SMALL_FILE_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File %{filename->} size (%{dclass_counter1}) is smaller than record size (%{dclass_counter2})", processor_chain([ - dup49, - dup22, - setc("event_description","File size mismatch"), - dup23, - ])); - - var msg116 = msg("ACCT_ACCOUNTING_SMALL_FILE_SIZE", part143); - - var part144 = match("MESSAGE#112:ACCT_BAD_RECORD_FORMAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid statistics record: %{result}", processor_chain([ - dup49, - dup22, - setc("event_description","Invalid statistics record"), - dup23, - ])); - - var msg117 = msg("ACCT_BAD_RECORD_FORMAT", part144); - - var part145 = match("MESSAGE#113:ACCT_CU_RTSLIB_error", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} getting class usage statistics for interface %{interface}: %{result}", processor_chain([ - dup49, - dup22, - setc("event_description","Class usage statistics error for interface"), - dup23, - ])); - - var msg118 = msg("ACCT_CU_RTSLIB_error", part145); - - var part146 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/1_0", "nwparser.p0", "Error %{resultcode->} trying %{p0}"); - - var part147 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/1_1", "nwparser.p0", "trying %{p0}"); - - var select29 = linear_select([ - part146, - part147, - ]); - - var part148 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/2", "nwparser.p0", "to get hostname%{}"); - - var all18 = all_match({ - processors: [ - dup50, - select29, - part148, - ], - on_success: processor_chain([ - dup49, - dup22, - setc("event_description","error trying to get hostname"), - dup23, - ]), - }); - - var msg119 = msg("ACCT_GETHOSTNAME_error", all18); - - var part149 = match("MESSAGE#115:ACCT_MALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed while reallocating %{obj_name}", processor_chain([ - dup51, - dup22, - setc("event_description","Memory allocation failure"), - dup23, - ])); - - var msg120 = msg("ACCT_MALLOC_FAILURE", part149); - - var part150 = match("MESSAGE#116:ACCT_UNDEFINED_COUNTER_NAME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} in accounting profile %{dclass_counter1->} is not defined in a firewall using this filter profile", processor_chain([ - dup30, - dup22, - setc("event_description","Accounting profile counter not defined in firewall"), - dup23, - ])); - - var msg121 = msg("ACCT_UNDEFINED_COUNTER_NAME", part150); - - var part151 = match("MESSAGE#117:ACCT_XFER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{result}: %{disposition}", processor_chain([ - dup30, - dup22, - setc("event_description","ACCT_XFER_FAILED"), - dup23, - ])); - - var msg122 = msg("ACCT_XFER_FAILED", part151); - - var part152 = match("MESSAGE#118:ACCT_XFER_POPEN_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{result}: in invoking command command to transfer file %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","POPEN FAIL invoking command command to transfer file"), - dup23, - ])); - - var msg123 = msg("ACCT_XFER_POPEN_FAIL", part152); - - var part153 = match("MESSAGE#119:APPQOS_LOG_EVENT", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} timestamp=\"%{result}\" message-type=\"%{info}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-name=\"%{protocol}\" application-name=\"%{application}\" rule-set-name=\"%{rule_group}\" rule-name=\"%{rulename}\" action=\"%{action}\" argument=\"%{fld2}\" argument1=\"%{fld3}\"]", processor_chain([ - dup28, - dup22, - dup52, - ])); - - var msg124 = msg("APPQOS_LOG_EVENT", part153); - - var part154 = match("MESSAGE#120:APPTRACK_SESSION_CREATE", "nwparser.payload", "%{event_type}: AppTrack session created %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup54, - dup22, - setc("result","AppTrack session created"), - dup23, - ])); - - var msg125 = msg("APPTRACK_SESSION_CREATE", part154); - - var part155 = match("MESSAGE#121:APPTRACK_SESSION_CLOSE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" service-name=\"%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-name=\"%{rule_template}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup28, - dup53, - dup55, - dup22, - dup52, - ])); - - var msg126 = msg("APPTRACK_SESSION_CLOSE", part155); - - var part156 = match("MESSAGE#122:APPTRACK_SESSION_CLOSE:01", "nwparser.payload", "%{event_type}: %{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{packets}(%{rbytes}) %{dclass_counter1}(%{sbytes}) %{duration->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup55, - dup22, - dup23, - ])); - - var msg127 = msg("APPTRACK_SESSION_CLOSE:01", part156); - - var select30 = linear_select([ - msg126, - msg127, - ]); - - var part157 = match("MESSAGE#123:APPTRACK_SESSION_VOL_UPDATE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" service-name=\"%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-name=\"%{rule_template}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup28, - dup53, - dup22, - dup52, - ])); - - var msg128 = msg("APPTRACK_SESSION_VOL_UPDATE", part157); - - var part158 = match("MESSAGE#124:APPTRACK_SESSION_VOL_UPDATE:01", "nwparser.payload", "%{event_type}: %{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{packets}(%{rbytes}) %{dclass_counter1}(%{sbytes}) %{duration->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup22, - dup23, - ])); - - var msg129 = msg("APPTRACK_SESSION_VOL_UPDATE:01", part158); - - var select31 = linear_select([ - msg128, - msg129, - ]); - - var msg130 = msg("BFDD_TRAP_STATE_DOWN", dup138); - - var msg131 = msg("BFDD_TRAP_STATE_UP", dup138); - - var part159 = match("MESSAGE#127:bgp_connect_start", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: connect %{saddr->} (%{shost}): %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp connect error"), - dup23, - ])); - - var msg132 = msg("bgp_connect_start", part159); - - var part160 = match("MESSAGE#128:bgp_event", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}) old state %{change_old->} event %{action->} new state %{change_new}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp peer state change"), - dup23, - ])); - - var msg133 = msg("bgp_event", part160); - - var part161 = match("MESSAGE#129:bgp_listen_accept", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection attempt from unconfigured neighbor: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Connection attempt from unconfigured neighbor"), - dup23, - ])); - - var msg134 = msg("bgp_listen_accept", part161); - - var part162 = match("MESSAGE#130:bgp_listen_reset", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp reset"), - dup23, - ])); - - var msg135 = msg("bgp_listen_reset", part162); - - var part163 = match("MESSAGE#131:bgp_nexthop_sanity", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}) next hop %{saddr->} local, %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","peer next hop local"), - dup23, - ])); - - var msg136 = msg("bgp_nexthop_sanity", part163); - - var part164 = match("MESSAGE#132:bgp_process_caps", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{severity->} (%{action}) subcode %{version->} (%{result}) value %{disposition}", processor_chain([ - dup30, - dup22, - setc("event_description","code RED error NOTIFICATION sent"), - dup23, - ])); - - var msg137 = msg("bgp_process_caps", part164); - - var part165 = match("MESSAGE#133:bgp_process_caps:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: mismatch NLRI with %{hostip->} (%{hostname}): peer: %{daddr->} us: %{saddr}", processor_chain([ - dup30, - dup22, - dup57, - dup23, - ])); - - var msg138 = msg("bgp_process_caps:01", part165); - - var select32 = linear_select([ - msg137, - msg138, - ]); - - var part166 = match("MESSAGE#134:bgp_pp_recv", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: dropping %{daddr->} (%{dhost}), %{info->} (%{protocol})", processor_chain([ - dup30, - dup22, - setc("event_description","connection collision"), - setc("result","dropping connection to peer"), - dup23, - ])); - - var msg139 = msg("bgp_pp_recv", part166); - - var part167 = match("MESSAGE#135:bgp_pp_recv:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}): received unexpected EOF", processor_chain([ - dup30, - dup22, - setc("event_description","peer received unexpected EOF"), - dup23, - ])); - - var msg140 = msg("bgp_pp_recv:01", part167); - - var select33 = linear_select([ - msg139, - msg140, - ]); - - var part168 = match("MESSAGE#136:bgp_send", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: sending %{sbytes->} bytes to %{daddr->} (%{dhost}) blocked (%{disposition}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","bgp send blocked error"), - dup23, - ])); - - var msg141 = msg("bgp_send", part168); - - var part169 = match("MESSAGE#137:bgp_traffic_timeout", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{resultcode->} (%{action}), Reason: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","bgp timeout NOTIFICATION sent"), - dup23, - ])); - - var msg142 = msg("bgp_traffic_timeout", part169); - - var part170 = match("MESSAGE#138:BOOTPD_ARG_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Ignoring unknown option %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","boot argument error"), - dup23, - ])); - - var msg143 = msg("BOOTPD_ARG_ERR", part170); - - var part171 = match("MESSAGE#139:BOOTPD_BAD_ID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected ID %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","boot unexpected Id value"), - dup23, - ])); - - var msg144 = msg("BOOTPD_BAD_ID", part171); - - var part172 = match("MESSAGE#140:BOOTPD_BOOTSTRING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Boot string: %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","Invalid boot string"), - dup23, - ])); - - var msg145 = msg("BOOTPD_BOOTSTRING", part172); - - var part173 = match("MESSAGE#141:BOOTPD_CONFIG_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Problems with configuration file '%{filename}', %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","configuration file error"), - dup23, - ])); - - var msg146 = msg("BOOTPD_CONFIG_ERR", part173); - - var part174 = match("MESSAGE#142:BOOTPD_CONF_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open configuration file '%{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to open configuration file"), - dup23, - ])); - - var msg147 = msg("BOOTPD_CONF_OPEN", part174); - - var part175 = match("MESSAGE#143:BOOTPD_DUP_REV", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate revision: %{version}", processor_chain([ - dup30, - dup22, - setc("event_description","boot - Duplicate revision"), - dup23, - ])); - - var msg148 = msg("BOOTPD_DUP_REV", part175); - - var part176 = match("MESSAGE#144:BOOTPD_DUP_SLOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate slot default: %{ssid}", processor_chain([ - dup30, - dup22, - setc("event_description","boot - duplicate slot"), - dup23, - ])); - - var msg149 = msg("BOOTPD_DUP_SLOT", part176); - - var part177 = match("MESSAGE#145:BOOTPD_MODEL_CHK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected ID %{id->} for model %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected ID for model"), - dup23, - ])); - - var msg150 = msg("BOOTPD_MODEL_CHK", part177); - - var part178 = match("MESSAGE#146:BOOTPD_MODEL_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unsupported model %{dclass_counter1}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unsupported model"), - dup23, - ])); - - var msg151 = msg("BOOTPD_MODEL_ERR", part178); - - var part179 = match("MESSAGE#147:BOOTPD_NEW_CONF", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: New configuration installed", processor_chain([ - dup21, - dup22, - setc("event_description","New configuration installed"), - dup23, - ])); - - var msg152 = msg("BOOTPD_NEW_CONF", part179); - - var part180 = match("MESSAGE#148:BOOTPD_NO_BOOTSTRING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No boot string found for type %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","No boot string found"), - dup23, - ])); - - var msg153 = msg("BOOTPD_NO_BOOTSTRING", part180); - - var part181 = match("MESSAGE#149:BOOTPD_NO_CONFIG", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No configuration file '%{filename}', %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","No configuration file found"), - dup23, - ])); - - var msg154 = msg("BOOTPD_NO_CONFIG", part181); - - var part182 = match("MESSAGE#150:BOOTPD_PARSE_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename}: number parse errors on SIGHUP", processor_chain([ - dup30, - dup22, - setc("event_description","parse errors on SIGHUP"), - dup23, - ])); - - var msg155 = msg("BOOTPD_PARSE_ERR", part182); - - var part183 = match("MESSAGE#151:BOOTPD_REPARSE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reparsing configuration file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","Reparsing configuration file"), - dup23, - ])); - - var msg156 = msg("BOOTPD_REPARSE", part183); - - var part184 = match("MESSAGE#152:BOOTPD_SELECT_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: select: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","select error"), - dup23, - ])); - - var msg157 = msg("BOOTPD_SELECT_ERR", part184); - - var part185 = match("MESSAGE#153:BOOTPD_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Timeout %{result->} unreasonable", processor_chain([ - dup30, - dup22, - setc("event_description","timeout unreasonable"), - dup23, - ])); - - var msg158 = msg("BOOTPD_TIMEOUT", part185); - - var part186 = match("MESSAGE#154:BOOTPD_VERSION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version: %{version->} built by builder on %{event_time_string}", processor_chain([ - dup21, - dup22, - setc("event_description","boot version built"), - dup23, - ])); - - var msg159 = msg("BOOTPD_VERSION", part186); - - var part187 = match("MESSAGE#155:CHASSISD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{version->} built by builder on %{event_time_string}", processor_chain([ - dup58, - dup22, - setc("event_description","CHASSISD release built"), - dup23, - ])); - - var msg160 = msg("CHASSISD", part187); - - var part188 = match("MESSAGE#156:CHASSISD_ARGUMENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown option %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD Unknown option"), - dup23, - ])); - - var msg161 = msg("CHASSISD_ARGUMENT_ERROR", part188); - - var part189 = match("MESSAGE#157:CHASSISD_BLOWERS_SPEED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fans and impellers are now running at normal speed", processor_chain([ - dup21, - dup22, - setc("event_description","Fans and impellers are now running at normal speed"), - dup23, - ])); - - var msg162 = msg("CHASSISD_BLOWERS_SPEED", part189); - - var part190 = match("MESSAGE#158:CHASSISD_BLOWERS_SPEED_FULL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fans and impellers being set to full speed [%{result}]", processor_chain([ - dup21, - dup22, - setc("event_description","Fans and impellers being set to full speed"), - dup23, - ])); - - var msg163 = msg("CHASSISD_BLOWERS_SPEED_FULL", part190); - - var part191 = match("MESSAGE#159:CHASSISD_CB_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result->} reading midplane ID EEPROM, %{dclass_counter1->} %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","reading midplane ID EEPROM"), - dup23, - ])); - - var msg164 = msg("CHASSISD_CB_READ", part191); - - var part192 = match("MESSAGE#160:CHASSISD_COMMAND_ACK_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{device->} online ack code %{dclass_counter1->} - - %{result}, %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD COMMAND ACK ERROR"), - dup23, - ])); - - var msg165 = msg("CHASSISD_COMMAND_ACK_ERROR", part192); - - var part193 = match("MESSAGE#161:CHASSISD_COMMAND_ACK_SF_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{disposition->} - %{result}, code %{resultcode}, SFM %{dclass_counter1}, FPC %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD COMMAND ACK SF ERROR"), - dup23, - ])); - - var msg166 = msg("CHASSISD_COMMAND_ACK_SF_ERROR", part193); - - var part194 = match("MESSAGE#162:CHASSISD_CONCAT_MODE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Cannot set no-concatenated mode for FPC %{dclass_counter2->} PIC %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Cannot set no-concatenated mode for FPC"), - dup23, - ])); - - var msg167 = msg("CHASSISD_CONCAT_MODE_ERROR", part194); - - var part195 = match("MESSAGE#163:CHASSISD_CONFIG_INIT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Problems with configuration file %{filename}; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CONFIG File Problem"), - dup23, - ])); - - var msg168 = msg("CHASSISD_CONFIG_INIT_ERROR", part195); - - var part196 = match("MESSAGE#164:CHASSISD_CONFIG_WARNING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename}: %{result}, FPC %{dclass_counter2->} %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD CONFIG WARNING"), - dup23, - ])); - - var msg169 = msg("CHASSISD_CONFIG_WARNING", part196); - - var part197 = match("MESSAGE#165:CHASSISD_EXISTS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: chassisd already running; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","chassisd already running"), - dup23, - ])); - - var msg170 = msg("CHASSISD_EXISTS", part197); - - var part198 = match("MESSAGE#166:CHASSISD_EXISTS_TERM_OTHER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Killing existing chassisd and exiting", processor_chain([ - dup21, - dup22, - setc("event_description","Killing existing chassisd and exiting"), - dup23, - ])); - - var msg171 = msg("CHASSISD_EXISTS_TERM_OTHER", part198); - - var part199 = match("MESSAGE#167:CHASSISD_FILE_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File open: %{filename}, error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","file open error"), - dup23, - ])); - - var msg172 = msg("CHASSISD_FILE_OPEN", part199); - - var part200 = match("MESSAGE#168:CHASSISD_FILE_STAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File stat: %{filename}, error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD file statistics error"), - dup23, - ])); - - var msg173 = msg("CHASSISD_FILE_STAT", part200); - - var part201 = match("MESSAGE#169:CHASSISD_FRU_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD received restart EVENT"), - dup23, - ])); - - var msg174 = msg("CHASSISD_FRU_EVENT", part201); - - var part202 = match("MESSAGE#170:CHASSISD_FRU_IPC_WRITE_ERROR_EXT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} FRU %{filename}#%{resultcode}, %{result->} %{dclass_counter1}, %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD restart WRITE_ERROR"), - dup23, - ])); - - var msg175 = msg("CHASSISD_FRU_IPC_WRITE_ERROR_EXT", part202); - - var part203 = match("MESSAGE#171:CHASSISD_FRU_STEP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} %{resultcode->} at step %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD FRU STEP ERROR"), - dup23, - ])); - - var msg176 = msg("CHASSISD_FRU_STEP_ERROR", part203); - - var part204 = match("MESSAGE#172:CHASSISD_GETTIMEOFDAY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected error from gettimeofday: %{resultcode->} - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected error from gettimeofday"), - dup23, - ])); - - var msg177 = msg("CHASSISD_GETTIMEOFDAY", part204); - - var part205 = match("MESSAGE#173:CHASSISD_HOST_TEMP_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result->} reading host temperature sensor", processor_chain([ - dup21, - dup22, - setc("event_description","reading host temperature sensor"), - dup23, - ])); - - var msg178 = msg("CHASSISD_HOST_TEMP_READ", part205); - - var part206 = match("MESSAGE#174:CHASSISD_IFDEV_DETACH_ALL_PSEUDO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{disposition})", processor_chain([ - dup21, - dup22, - setc("event_description","detaching all pseudo devices"), - dup23, - ])); - - var msg179 = msg("CHASSISD_IFDEV_DETACH_ALL_PSEUDO", part206); - - var part207 = match("MESSAGE#175:CHASSISD_IFDEV_DETACH_FPC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH FPC"), - dup23, - ])); - - var msg180 = msg("CHASSISD_IFDEV_DETACH_FPC", part207); - - var part208 = match("MESSAGE#176:CHASSISD_IFDEV_DETACH_PIC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH PIC"), - dup23, - ])); - - var msg181 = msg("CHASSISD_IFDEV_DETACH_PIC", part208); - - var part209 = match("MESSAGE#177:CHASSISD_IFDEV_DETACH_PSEUDO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{disposition})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH PSEUDO"), - dup23, - ])); - - var msg182 = msg("CHASSISD_IFDEV_DETACH_PSEUDO", part209); - - var part210 = match("MESSAGE#178:CHASSISD_IFDEV_DETACH_TLV_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD IFDEV DETACH TLV ERROR"), - dup23, - ])); - - var msg183 = msg("CHASSISD_IFDEV_DETACH_TLV_ERROR", part210); - - var part211 = match("MESSAGE#179:CHASSISD_IFDEV_GET_BY_INDEX_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: rtslib_ifdm_get_by_index failed: %{resultcode->} - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","rtslib_ifdm_get_by_index failed"), - dup23, - ])); - - var msg184 = msg("CHASSISD_IFDEV_GET_BY_INDEX_FAIL", part211); - - var part212 = match("MESSAGE#180:CHASSISD_IPC_MSG_QFULL_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: type = %{dclass_counter1}, subtype = %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Message Queue full"), - dup23, - ])); - - var msg185 = msg("CHASSISD_IPC_MSG_QFULL_ERROR", part212); - - var part213 = match("MESSAGE#181:CHASSISD_IPC_UNEXPECTED_RECV", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received unexpected message from %{service}: type = %{dclass_counter1}, subtype = %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Received unexpected message"), - dup23, - ])); - - var msg186 = msg("CHASSISD_IPC_UNEXPECTED_RECV", part213); - - var part214 = match("MESSAGE#182:CHASSISD_IPC_WRITE_ERR_NO_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FRU has no connection pipe %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FRU has no connection pipe"), - dup23, - ])); - - var msg187 = msg("CHASSISD_IPC_WRITE_ERR_NO_PIPE", part214); - - var part215 = match("MESSAGE#183:CHASSISD_IPC_WRITE_ERR_NULL_ARGS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FRU has no connection arguments %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FRU has no connection arguments"), - dup23, - ])); - - var msg188 = msg("CHASSISD_IPC_WRITE_ERR_NULL_ARGS", part215); - - var part216 = match("MESSAGE#184:CHASSISD_MAC_ADDRESS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: chassisd MAC address allocation error", processor_chain([ - dup30, - dup22, - setc("event_description","chassisd MAC address allocation error"), - dup23, - ])); - - var msg189 = msg("CHASSISD_MAC_ADDRESS_ERROR", part216); - - var part217 = match("MESSAGE#185:CHASSISD_MAC_DEFAULT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using default MAC address base", processor_chain([ - dup21, - dup22, - setc("event_description","Using default MAC address base"), - dup23, - ])); - - var msg190 = msg("CHASSISD_MAC_DEFAULT", part217); - - var part218 = match("MESSAGE#186:CHASSISD_MBUS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} %{resultcode}: management bus failed sanity test", processor_chain([ - dup30, - dup22, - setc("event_description","management bus failed sanity test"), - dup23, - ])); - - var msg191 = msg("CHASSISD_MBUS_ERROR", part218); - - var part219 = match("MESSAGE#187:CHASSISD_PARSE_COMPLETE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using new configuration", processor_chain([ - dup21, - dup22, - setc("event_description","Using new configuration"), - dup23, - ])); - - var msg192 = msg("CHASSISD_PARSE_COMPLETE", part219); - - var part220 = match("MESSAGE#188:CHASSISD_PARSE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{resultcode->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD PARSE ERROR"), - dup23, - ])); - - var msg193 = msg("CHASSISD_PARSE_ERROR", part220); - - var part221 = match("MESSAGE#189:CHASSISD_PARSE_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Parsing configuration file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","Parsing configuration file"), - dup23, - ])); - - var msg194 = msg("CHASSISD_PARSE_INIT", part221); - - var part222 = match("MESSAGE#190:CHASSISD_PIDFILE_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open PID file '%{filename}': %{result->} %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to open PID file"), - dup23, - ])); - - var msg195 = msg("CHASSISD_PIDFILE_OPEN", part222); - - var part223 = match("MESSAGE#191:CHASSISD_PIPE_WRITE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Pipe error: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Pipe error"), - dup23, - ])); - - var msg196 = msg("CHASSISD_PIPE_WRITE_ERROR", part223); - - var part224 = match("MESSAGE#192:CHASSISD_POWER_CHECK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{device->} %{dclass_counter1->} not powering up", processor_chain([ - dup59, - dup22, - setc("event_description","device not powering up"), - dup23, - ])); - - var msg197 = msg("CHASSISD_POWER_CHECK", part224); - - var part225 = match("MESSAGE#193:CHASSISD_RECONNECT_SUCCESSFUL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Successfully reconnected on soft restart", processor_chain([ - dup21, - dup22, - setc("event_description","Successful reconnect on soft restart"), - dup23, - ])); - - var msg198 = msg("CHASSISD_RECONNECT_SUCCESSFUL", part225); - - var part226 = match("MESSAGE#194:CHASSISD_RELEASE_MASTERSHIP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Release mastership notification", processor_chain([ - dup21, - dup22, - setc("event_description","Release mastership notification"), - dup23, - ])); - - var msg199 = msg("CHASSISD_RELEASE_MASTERSHIP", part226); - - var part227 = match("MESSAGE#195:CHASSISD_RE_INIT_INVALID_RE_SLOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: re_init: re %{resultcode}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","re_init Invalid RE slot"), - dup23, - ])); - - var msg200 = msg("CHASSISD_RE_INIT_INVALID_RE_SLOT", part227); - - var part228 = match("MESSAGE#196:CHASSISD_ROOT_MOUNT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine the mount point for root directory: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine mount point for root directory"), - dup23, - ])); - - var msg201 = msg("CHASSISD_ROOT_MOUNT_ERROR", part228); - - var part229 = match("MESSAGE#197:CHASSISD_RTS_SEQ_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifmsg sequence gap %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","ifmsg sequence gap"), - dup23, - ])); - - var msg202 = msg("CHASSISD_RTS_SEQ_ERROR", part229); - - var part230 = match("MESSAGE#198:CHASSISD_SBOARD_VERSION_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version mismatch: %{info}", processor_chain([ - setc("eventcategory","1603040000"), - dup22, - setc("event_description","Version mismatch"), - dup23, - ])); - - var msg203 = msg("CHASSISD_SBOARD_VERSION_MISMATCH", part230); - - var part231 = match("MESSAGE#199:CHASSISD_SERIAL_ID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Serial ID read error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Serial ID read error"), - dup23, - ])); - - var msg204 = msg("CHASSISD_SERIAL_ID", part231); - - var part232 = match("MESSAGE#200:CHASSISD_SMB_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: fpga download not complete: val %{resultcode}, %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","fpga download not complete"), - dup23, - ])); - - var msg205 = msg("CHASSISD_SMB_ERROR", part232); - - var part233 = match("MESSAGE#201:CHASSISD_SNMP_TRAP6", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap generated: %{result->} (%{info})", processor_chain([ - dup58, - dup22, - setc("event_description","SNMP Trap6 generated"), - dup23, - ])); - - var msg206 = msg("CHASSISD_SNMP_TRAP6", part233); - - var part234 = match("MESSAGE#202:CHASSISD_SNMP_TRAP7", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap: %{result}: %{info}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP Trap7 generated"), - dup23, - ])); - - var msg207 = msg("CHASSISD_SNMP_TRAP7", part234); - - var part235 = match("MESSAGE#203:CHASSISD_SNMP_TRAP10", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP trap - FRU power on"), - dup23, - ])); - - var msg208 = msg("CHASSISD_SNMP_TRAP10", part235); - - var part236 = match("MESSAGE#204:CHASSISD_TERM_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received SIGTERM request, %{result}", processor_chain([ - dup60, - dup22, - setc("event_description","Received SIGTERM request"), - dup23, - ])); - - var msg209 = msg("CHASSISD_TERM_SIGNAL", part236); - - var part237 = match("MESSAGE#205:CHASSISD_TRACE_PIC_OFFLINE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Taking PIC offline - - FPC slot %{dclass_counter1}, PIC slot %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","Taking PIC offline"), - dup23, - ])); - - var msg210 = msg("CHASSISD_TRACE_PIC_OFFLINE", part237); - - var part238 = match("MESSAGE#206:CHASSISD_UNEXPECTED_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} returned %{resultcode}: %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","UNEXPECTED EXIT"), - dup23, - ])); - - var msg211 = msg("CHASSISD_UNEXPECTED_EXIT", part238); - - var part239 = match("MESSAGE#207:CHASSISD_UNSUPPORTED_MODEL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Model %{dclass_counter1->} unsupported with this version of chassisd", processor_chain([ - dup59, - dup22, - setc("event_description","Model number unsupported with this version of chassisd"), - dup23, - ])); - - var msg212 = msg("CHASSISD_UNSUPPORTED_MODEL", part239); - - var part240 = match("MESSAGE#208:CHASSISD_VERSION_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version mismatch: %{info}", processor_chain([ - dup59, - dup22, - setc("event_description","Chassisd Version mismatch"), - dup23, - ])); - - var msg213 = msg("CHASSISD_VERSION_MISMATCH", part240); - - var part241 = match("MESSAGE#209:CHASSISD_HIGH_TEMP_CONDITION", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} temperature=\"%{fld2}\" message=\"%{info}\"]", processor_chain([ - dup59, - dup22, - setc("event_description","CHASSISD HIGH TEMP CONDITION"), - dup61, - dup62, - ])); - - var msg214 = msg("CHASSISD_HIGH_TEMP_CONDITION", part241); - - var part242 = match("MESSAGE#210:clean_process", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: process %{agent->} RESTART mode %{event_state->} new master=%{obj_name->} old failover=%{change_old->} new failover = %{change_new}", processor_chain([ - dup21, - dup22, - setc("event_description","process RESTART mode"), - dup23, - ])); - - var msg215 = msg("clean_process", part242); - - var part243 = match("MESSAGE#211:CM_JAVA", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Chassis %{group->} Linklocal MAC:%{macaddr}", processor_chain([ - dup21, - dup22, - setc("event_description","Chassis Linklocal to MAC"), - dup23, - ])); - - var msg216 = msg("CM_JAVA", part243); - - var part244 = match("MESSAGE#212:DCD_AS_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","DCD must be run as root"), - dup23, - ])); - - var msg217 = msg("DCD_AS_ROOT", part244); - - var part245 = match("MESSAGE#213:DCD_FILTER_LIB_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Filter library initialization failed", processor_chain([ - dup30, - dup22, - setc("event_description","Filter library initialization failed"), - dup23, - ])); - - var msg218 = msg("DCD_FILTER_LIB_ERROR", part245); - - var msg219 = msg("DCD_MALLOC_FAILED_INIT", dup139); - - var part246 = match("MESSAGE#215:DCD_PARSE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing configuration file", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing configuration file"), - dup23, - ])); - - var msg220 = msg("DCD_PARSE_EMERGENCY", part246); - - var part247 = match("MESSAGE#216:DCD_PARSE_FILTER_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing filter index file", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing filter index file"), - dup23, - ])); - - var msg221 = msg("DCD_PARSE_FILTER_EMERGENCY", part247); - - var part248 = match("MESSAGE#217:DCD_PARSE_MINI_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing configuration overlay", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing configuration overlay"), - dup23, - ])); - - var msg222 = msg("DCD_PARSE_MINI_EMERGENCY", part248); - - var part249 = match("MESSAGE#218:DCD_PARSE_STATE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: An unhandled state was encountered during interface parsing", processor_chain([ - dup30, - dup22, - setc("event_description","unhandled state was encountered during interface parsing"), - dup23, - ])); - - var msg223 = msg("DCD_PARSE_STATE_EMERGENCY", part249); - - var part250 = match("MESSAGE#219:DCD_POLICER_PARSE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing policer indexfile", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing policer indexfile"), - dup23, - ])); - - var msg224 = msg("DCD_POLICER_PARSE_EMERGENCY", part250); - - var part251 = match("MESSAGE#220:DCD_PULL_LOG_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to pull file %{filename->} after %{dclass_counter1->} retries last error=%{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to pull file"), - dup23, - ])); - - var msg225 = msg("DCD_PULL_LOG_FAILURE", part251); - - var part252 = match("MESSAGE#221:DFWD_ARGUMENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DFWD ARGUMENT ERROR"), - dup23, - ])); - - var msg226 = msg("DFWD_ARGUMENT_ERROR", part252); - - var msg227 = msg("DFWD_MALLOC_FAILED_INIT", dup139); - - var part253 = match("MESSAGE#223:DFWD_PARSE_FILTER_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} encountered errors while parsing filter index file", processor_chain([ - dup30, - dup22, - setc("event_description","errors encountered while parsing filter index file"), - dup23, - ])); - - var msg228 = msg("DFWD_PARSE_FILTER_EMERGENCY", part253); - - var part254 = match("MESSAGE#224:DFWD_PARSE_STATE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} encountered unhandled state while parsing interface", processor_chain([ - dup30, - dup22, - setc("event_description","encountered unhandled state while parsing interface"), - dup23, - ])); - - var msg229 = msg("DFWD_PARSE_STATE_EMERGENCY", part254); - - var msg230 = msg("ECCD_DAEMONIZE_FAILED", dup140); - - var msg231 = msg("ECCD_DUPLICATE", dup141); - - var part255 = match("MESSAGE#227:ECCD_LOOP_EXIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MainLoop return value: %{disposition}, error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD LOOP EXIT FAILURE"), - dup23, - ])); - - var msg232 = msg("ECCD_LOOP_EXIT_FAILURE", part255); - - var part256 = match("MESSAGE#228:ECCD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","ECCD Must be run as root"), - dup23, - ])); - - var msg233 = msg("ECCD_NOT_ROOT", part256); - - var part257 = match("MESSAGE#229:ECCD_PCI_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: open() failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD PCI FILE OPEN FAILED"), - dup23, - ])); - - var msg234 = msg("ECCD_PCI_FILE_OPEN_FAILED", part257); - - var part258 = match("MESSAGE#230:ECCD_PCI_READ_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PCI read failure"), - dup23, - ])); - - var msg235 = msg("ECCD_PCI_READ_FAILED", part258); - - var part259 = match("MESSAGE#231:ECCD_PCI_WRITE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PCI write failure"), - dup23, - ])); - - var msg236 = msg("ECCD_PCI_WRITE_FAILED", part259); - - var msg237 = msg("ECCD_PID_FILE_LOCK", dup142); - - var msg238 = msg("ECCD_PID_FILE_UPDATE", dup143); - - var part260 = match("MESSAGE#234:ECCD_TRACE_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD TRACE FILE OPEN FAILURE"), - dup23, - ])); - - var msg239 = msg("ECCD_TRACE_FILE_OPEN_FAILED", part260); - - var part261 = match("MESSAGE#235:ECCD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","ECCD Usage"), - dup23, - ])); - - var msg240 = msg("ECCD_usage", part261); - - var part262 = match("MESSAGE#236:EVENTD_AUDIT_SHOW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} viewed security audit log with arguments: %{param}", processor_chain([ - dup21, - dup22, - setc("event_description","User viewed security audit log with arguments"), - dup23, - ])); - - var msg241 = msg("EVENTD_AUDIT_SHOW", part262); - - var part263 = match("MESSAGE#237:FLOW_REASSEMBLE_SUCCEED", "nwparser.payload", "%{event_type}: Packet merged source %{saddr->} destination %{daddr->} ipid %{fld11->} succeed", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg242 = msg("FLOW_REASSEMBLE_SUCCEED", part263); - - var part264 = match("MESSAGE#238:FSAD_CHANGE_FILE_OWNER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to change owner of file `%{filename}' to user %{username}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to change owner of file"), - dup23, - ])); - - var msg243 = msg("FSAD_CHANGE_FILE_OWNER", part264); - - var part265 = match("MESSAGE#239:FSAD_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FSAD CONFIG ERROR"), - dup23, - ])); - - var msg244 = msg("FSAD_CONFIG_ERROR", part265); - - var part266 = match("MESSAGE#240:FSAD_CONNTIMEDOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection timed out to the client (%{shost}, %{saddr}) having request type %{obj_type}", processor_chain([ - dup30, - dup22, - setc("event_description","Connection timed out to client"), - dup23, - ])); - - var msg245 = msg("FSAD_CONNTIMEDOUT", part266); - - var part267 = match("MESSAGE#241:FSAD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FSAD_FAILED"), - dup23, - ])); - - var msg246 = msg("FSAD_FAILED", part267); - - var part268 = match("MESSAGE#242:FSAD_FETCHTIMEDOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fetch to server %{hostname->} for file `%{filename}' timed out", processor_chain([ - dup30, - dup22, - setc("event_description","Fetch to server to get file timed out"), - dup23, - ])); - - var msg247 = msg("FSAD_FETCHTIMEDOUT", part268); - - var part269 = match("MESSAGE#243:FSAD_FILE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: fn failed for file `%{filename}' with error message %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","fn failed for file"), - dup23, - ])); - - var msg248 = msg("FSAD_FILE_FAILED", part269); - - var part270 = match("MESSAGE#244:FSAD_FILE_REMOVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to remove file `%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to remove file"), - dup23, - ])); - - var msg249 = msg("FSAD_FILE_REMOVE", part270); - - var part271 = match("MESSAGE#245:FSAD_FILE_RENAME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to rename file `%{filename}' to `%{resultcode}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to rename file"), - dup23, - ])); - - var msg250 = msg("FSAD_FILE_RENAME", part271); - - var part272 = match("MESSAGE#246:FSAD_FILE_STAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} failed for file pathname %{filename}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","stat failed for file"), - dup23, - ])); - - var msg251 = msg("FSAD_FILE_STAT", part272); - - var part273 = match("MESSAGE#247:FSAD_FILE_SYNC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to sync file %{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to sync file"), - dup23, - ])); - - var msg252 = msg("FSAD_FILE_SYNC", part273); - - var part274 = match("MESSAGE#248:FSAD_MAXCONN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Upper limit reached in fsad for handling connections", processor_chain([ - dup30, - dup22, - setc("event_description","Upper limit reached in fsad"), - dup23, - ])); - - var msg253 = msg("FSAD_MAXCONN", part274); - - var part275 = match("MESSAGE#249:FSAD_MEMORYALLOC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} failed in the function %{action->} (%{resultcode})", processor_chain([ - dup51, - dup22, - setc("event_description","FSAD MEMORYALLOC FAILED"), - dup23, - ])); - - var msg254 = msg("FSAD_MEMORYALLOC_FAILED", part275); - - var part276 = match("MESSAGE#250:FSAD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","FSAD must be run as root"), - dup23, - ])); - - var msg255 = msg("FSAD_NOT_ROOT", part276); - - var part277 = match("MESSAGE#251:FSAD_PARENT_DIRECTORY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: invalid directory: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","invalid directory"), - dup23, - ])); - - var msg256 = msg("FSAD_PARENT_DIRECTORY", part277); - - var part278 = match("MESSAGE#252:FSAD_PATH_IS_DIRECTORY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File path cannot be a directory (%{filename})", processor_chain([ - dup30, - dup22, - setc("event_description","File path cannot be a directory"), - dup23, - ])); - - var msg257 = msg("FSAD_PATH_IS_DIRECTORY", part278); - - var part279 = match("MESSAGE#253:FSAD_PATH_IS_SPECIAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Not a regular file (%{filename})", processor_chain([ - dup30, - dup22, - setc("event_description","Not a regular file"), - dup23, - ])); - - var msg258 = msg("FSAD_PATH_IS_SPECIAL", part279); - - var part280 = match("MESSAGE#254:FSAD_RECVERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: fsad received error message from client having request type %{obj_type->} at (%{saddr}, %{sport})", processor_chain([ - dup30, - dup22, - setc("event_description","fsad received error message from client"), - dup23, - ])); - - var msg259 = msg("FSAD_RECVERROR", part280); - - var part281 = match("MESSAGE#255:FSAD_TERMINATED_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Open file %{filename}` closed due to %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","FSAD TERMINATED CONNECTION"), - dup23, - ])); - - var msg260 = msg("FSAD_TERMINATED_CONNECTION", part281); - - var part282 = match("MESSAGE#256:FSAD_TERMINATING_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received terminating %{resultcode}; %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Received terminating signal"), - dup23, - ])); - - var msg261 = msg("FSAD_TERMINATING_SIGNAL", part282); - - var part283 = match("MESSAGE#257:FSAD_TRACEOPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Open operation on trace file `%{filename}' returned error %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Open operation on trace file failed"), - dup23, - ])); - - var msg262 = msg("FSAD_TRACEOPEN_FAILED", part283); - - var part284 = match("MESSAGE#258:FSAD_USAGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect usage, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Incorrect FSAD usage"), - dup23, - ])); - - var msg263 = msg("FSAD_USAGE", part284); - - var part285 = match("MESSAGE#259:GGSN_ALARM_TRAP_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","GGSN ALARM TRAP FAILED"), - dup23, - ])); - - var msg264 = msg("GGSN_ALARM_TRAP_FAILED", part285); - - var part286 = match("MESSAGE#260:GGSN_ALARM_TRAP_SEND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","GGSN ALARM TRAP SEND FAILED"), - dup23, - ])); - - var msg265 = msg("GGSN_ALARM_TRAP_SEND", part286); - - var part287 = match("MESSAGE#261:GGSN_TRAP_SEND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown trap request type %{obj_type}", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown trap request type"), - dup23, - ])); - - var msg266 = msg("GGSN_TRAP_SEND", part287); - - var part288 = match("MESSAGE#262:JADE_AUTH_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authorization failed: %{result}", processor_chain([ - dup69, - dup34, - setc("ec_subject","Service"), - dup43, - dup22, - setc("event_description","Authorization failed"), - dup23, - ])); - - var msg267 = msg("JADE_AUTH_ERROR", part288); - - var part289 = match("MESSAGE#263:JADE_EXEC_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: CLI %{resultcode->} %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JADE EXEC ERROR"), - dup23, - ])); - - var msg268 = msg("JADE_EXEC_ERROR", part289); - - var part290 = match("MESSAGE#264:JADE_NO_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Local user %{username->} does not exist", processor_chain([ - dup30, - dup22, - setc("event_description","Local user does not exist"), - dup23, - ])); - - var msg269 = msg("JADE_NO_LOCAL_USER", part290); - - var part291 = match("MESSAGE#265:JADE_PAM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JADE PAM error"), - dup23, - ])); - - var msg270 = msg("JADE_PAM_ERROR", part291); - - var part292 = match("MESSAGE#266:JADE_PAM_NO_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to get local username from PAM: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to get local username from PAM"), - dup23, - ])); - - var msg271 = msg("JADE_PAM_NO_LOCAL_USER", part292); - - var part293 = match("MESSAGE#267:KERN_ARP_ADDR_CHANGE", "nwparser.payload", "%{process}: %{event_type}: arp info overwritten for %{saddr->} from %{smacaddr->} to %{dmacaddr}", processor_chain([ - dup30, - dup22, - setc("event_description","arp info overwritten"), - dup23, - ])); - - var msg272 = msg("KERN_ARP_ADDR_CHANGE", part293); - - var part294 = match("MESSAGE#268:KMD_PM_SA_ESTABLISHED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Local gateway: %{gateway}, Remote gateway: %{fld1}, Local ID:%{fld2}, Remote ID:%{fld3}, Direction:%{fld4}, SPI:%{fld5}", processor_chain([ - dup30, - dup22, - setc("event_description","security association has been established"), - dup23, - ])); - - var msg273 = msg("KMD_PM_SA_ESTABLISHED", part294); - - var part295 = match("MESSAGE#269:L2CPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitialized", processor_chain([ - dup21, - dup22, - setc("event_description","Task Reinitialized"), - dup61, - dup23, - ])); - - var msg274 = msg("L2CPD_TASK_REINIT", part295); - - var part296 = match("MESSAGE#270:LIBJNX_EXEC_EXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command stopped: PID %{child_pid}, signal='%{obj_type}' %{result}, command '%{action}'", processor_chain([ - dup21, - dup22, - dup70, - dup23, - ])); - - var msg275 = msg("LIBJNX_EXEC_EXITED", part296); - - var part297 = match("MESSAGE#271:LIBJNX_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exec failed for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Child exec failed for command"), - dup23, - ])); - - var msg276 = msg("LIBJNX_EXEC_FAILED", part297); - - var msg277 = msg("LIBJNX_EXEC_PIPE", dup144); - - var part298 = match("MESSAGE#273:LIBJNX_EXEC_SIGNALED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command received signal: PID %{child_pid}, signal %{result}, command '%{action}'", processor_chain([ - dup30, - dup22, - setc("event_description","Command received signal"), - dup23, - ])); - - var msg278 = msg("LIBJNX_EXEC_SIGNALED", part298); - - var part299 = match("MESSAGE#274:LIBJNX_EXEC_WEXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command exited: PID %{child_pid}, status %{result}, command '%{action}'", processor_chain([ - dup21, - dup22, - dup72, - dup23, - ])); - - var msg279 = msg("LIBJNX_EXEC_WEXIT", part299); - - var part300 = match("MESSAGE#275:LIBJNX_FILE_COPY_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: copy_file_to_transfer_dir failed to copy from source to destination", processor_chain([ - dup73, - dup22, - setc("event_description","copy_file_to_transfer_dir failed to copy"), - dup23, - ])); - - var msg280 = msg("LIBJNX_FILE_COPY_FAILED", part300); - - var part301 = match("MESSAGE#276:LIBJNX_PRIV_LOWER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lower privilege level: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Unable to lower privilege level"), - dup23, - ])); - - var msg281 = msg("LIBJNX_PRIV_LOWER_FAILED", part301); - - var part302 = match("MESSAGE#277:LIBJNX_PRIV_RAISE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to raise privilege level: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Unable to raise privilege level"), - dup23, - ])); - - var msg282 = msg("LIBJNX_PRIV_RAISE_FAILED", part302); - - var part303 = match("MESSAGE#278:LIBJNX_REPLICATE_RCP_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","rcp failed"), - dup23, - ])); - - var msg283 = msg("LIBJNX_REPLICATE_RCP_EXEC_FAILED", part303); - - var part304 = match("MESSAGE#279:LIBJNX_ROTATE_COMPRESS_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode->} %{dclass_counter1->} -f %{action}: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","ROTATE COMPRESS EXEC FAILED"), - dup23, - ])); - - var msg284 = msg("LIBJNX_ROTATE_COMPRESS_EXEC_FAILED", part304); - - var part305 = match("MESSAGE#280:LIBSERVICED_CLIENT_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Client connection error: %{result}", processor_chain([ - dup74, - dup22, - setc("event_description","Client connection error"), - dup23, - ])); - - var msg285 = msg("LIBSERVICED_CLIENT_CONNECTION", part305); - - var part306 = match("MESSAGE#281:LIBSERVICED_OUTBOUND_REQUEST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Outbound request failed for command [%{action}]: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Outbound request failed for command"), - dup23, - ])); - - var msg286 = msg("LIBSERVICED_OUTBOUND_REQUEST", part306); - - var part307 = match("MESSAGE#282:LIBSERVICED_SNMP_LOST_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection closed while receiving from client %{dclass_counter1}", processor_chain([ - dup27, - dup22, - setc("event_description","Connection closed while receiving from client"), - dup23, - ])); - - var msg287 = msg("LIBSERVICED_SNMP_LOST_CONNECTION", part307); - - var part308 = match("MESSAGE#283:LIBSERVICED_SOCKET_BIND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode}: unable to bind socket %{ssid}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to bind socket"), - dup23, - ])); - - var msg288 = msg("LIBSERVICED_SOCKET_BIND", part308); - - var part309 = match("MESSAGE#284:LIBSERVICED_SOCKET_PRIVATIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to attach socket %{ssid->} to management routing instance: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to attach socket to management routing instance"), - dup23, - ])); - - var msg289 = msg("LIBSERVICED_SOCKET_PRIVATIZE", part309); - - var part310 = match("MESSAGE#285:LICENSE_EXPIRED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LICENSE EXPIRED"), - dup23, - ])); - - var msg290 = msg("LICENSE_EXPIRED", part310); - - var part311 = match("MESSAGE#286:LICENSE_EXPIRED_KEY_DELETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License key \"%{filename}\" has expired.", processor_chain([ - dup21, - dup22, - setc("event_description","License key has expired"), - dup23, - ])); - - var msg291 = msg("LICENSE_EXPIRED_KEY_DELETED", part311); - - var part312 = match("MESSAGE#287:LICENSE_NEARING_EXPIRY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License for feature %{disposition->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","License key expiration soon"), - dup23, - ])); - - var msg292 = msg("LICENSE_NEARING_EXPIRY", part312); - - var part313 = match("MESSAGE#288:LOGIN_ABORTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Client aborted login", processor_chain([ - dup30, - dup22, - setc("event_description","client aborted login"), - dup23, - ])); - - var msg293 = msg("LOGIN_ABORTED", part313); - - var part314 = match("MESSAGE#289:LOGIN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login failed for user %{username->} from host %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - dup23, - ])); - - var msg294 = msg("LOGIN_FAILED", part314); - - var part315 = match("MESSAGE#290:LOGIN_FAILED_INCORRECT_PASSWORD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect password for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Incorrect password for user"), - dup23, - ])); - - var msg295 = msg("LOGIN_FAILED_INCORRECT_PASSWORD", part315); - - var part316 = match("MESSAGE#291:LOGIN_FAILED_SET_CONTEXT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to set context for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Failed to set context for user"), - dup23, - ])); - - var msg296 = msg("LOGIN_FAILED_SET_CONTEXT", part316); - - var part317 = match("MESSAGE#292:LOGIN_FAILED_SET_LOGIN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to set login ID for user %{username}: %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Failed to set login ID for user"), - dup23, - ])); - - var msg297 = msg("LOGIN_FAILED_SET_LOGIN", part317); - - var part318 = match("MESSAGE#293:LOGIN_HOSTNAME_UNRESOLVED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to resolve hostname %{dhost}: %{info}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Unable to resolve hostname"), - dup23, - ])); - - var msg298 = msg("LOGIN_HOSTNAME_UNRESOLVED", part318); - - var part319 = match("MESSAGE#294:LOGIN_INFORMATION/2", "nwparser.p0", "%{event_type}: %{p0}"); - - var part320 = match("MESSAGE#294:LOGIN_INFORMATION/4", "nwparser.p0", "%{username->} logged in from host %{dhost->} on %{p0}"); - - var part321 = match("MESSAGE#294:LOGIN_INFORMATION/5_0", "nwparser.p0", "device %{p0}"); - - var select34 = linear_select([ - part321, - dup45, - ]); - - var part322 = match("MESSAGE#294:LOGIN_INFORMATION/6", "nwparser.p0", "%{terminal}"); - - var all19 = all_match({ - processors: [ - dup39, - dup137, - part319, - dup145, - part320, - select34, - part322, - ], - on_success: processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","Successful Login"), - dup23, - ]), - }); - - var msg299 = msg("LOGIN_INFORMATION", all19); - - var part323 = match("MESSAGE#295:LOGIN_INVALID_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No entry in local password file for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","No entry in local password file for user"), - dup23, - ])); - - var msg300 = msg("LOGIN_INVALID_LOCAL_USER", part323); - - var part324 = match("MESSAGE#296:LOGIN_MALFORMED_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid username: %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Invalid username"), - dup23, - ])); - - var msg301 = msg("LOGIN_MALFORMED_USER", part324); - - var part325 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/1_0", "nwparser.p0", "PAM authentication error for user %{p0}"); - - var part326 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/1_1", "nwparser.p0", "Failed password for user %{p0}"); - - var select35 = linear_select([ - part325, - part326, - ]); - - var part327 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/2", "nwparser.p0", "%{username}"); - - var all20 = all_match({ - processors: [ - dup50, - select35, - part327, - ], - on_success: processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","PAM authentication error for user"), - dup23, - ]), - }); - - var msg302 = msg("LOGIN_PAM_AUTHENTICATION_ERROR", all20); - - var part328 = match("MESSAGE#298:LOGIN_PAM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failure while authenticating user %{username}: %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - setc("event_description","PAM authentication failure"), - setc("result","Failure while authenticating user"), - dup23, - ])); - - var msg303 = msg("LOGIN_PAM_ERROR", part328); - - var part329 = match("MESSAGE#299:LOGIN_PAM_MAX_RETRIES", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Too many retries while authenticating user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Too many retries while authenticating user"), - dup23, - ])); - - var msg304 = msg("LOGIN_PAM_MAX_RETRIES", part329); - - var part330 = match("MESSAGE#300:LOGIN_PAM_NONLOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} authenticated but has no local login ID", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","User authenticated but has no local login ID"), - dup23, - ])); - - var msg305 = msg("LOGIN_PAM_NONLOCAL_USER", part330); - - var part331 = match("MESSAGE#301:LOGIN_PAM_STOP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to end PAM session: %{info}", processor_chain([ - setc("eventcategory","1303000000"), - dup34, - dup43, - dup22, - setc("event_description","Failed to end PAM session"), - dup23, - ])); - - var msg306 = msg("LOGIN_PAM_STOP", part331); - - var part332 = match("MESSAGE#302:LOGIN_PAM_USER_UNKNOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Attempt to authenticate unknown user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Attempt to authenticate unknown user"), - dup23, - ])); - - var msg307 = msg("LOGIN_PAM_USER_UNKNOWN", part332); - - var part333 = match("MESSAGE#303:LOGIN_PASSWORD_EXPIRED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Forcing change of expired password for user %{username}>", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Forcing change of expired password for user"), - dup23, - ])); - - var msg308 = msg("LOGIN_PASSWORD_EXPIRED", part333); - - var part334 = match("MESSAGE#304:LOGIN_REFUSED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login of user %{username->} from host %{shost->} on %{terminal->} was refused: %{info}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Login of user refused"), - dup23, - ])); - - var msg309 = msg("LOGIN_REFUSED", part334); - - var part335 = match("MESSAGE#305:LOGIN_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} logged in as root from host %{shost->} on %{terminal}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","successful login as root"), - setc("result","User logged in as root"), - dup23, - ])); - - var msg310 = msg("LOGIN_ROOT", part335); - - var part336 = match("MESSAGE#306:LOGIN_TIMED_OUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login attempt timed out after %{dclass_counter1->} seconds", processor_chain([ - dup44, - dup34, - dup36, - dup43, - dup22, - dup75, - setc("result","Login attempt timed out"), - dup23, - ])); - - var msg311 = msg("LOGIN_TIMED_OUT", part336); - - var part337 = match("MESSAGE#307:MIB2D_ATM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D ATM ERROR"), - dup23, - ])); - - var msg312 = msg("MIB2D_ATM_ERROR", part337); - - var part338 = match("MESSAGE#308:MIB2D_CONFIG_CHECK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CONFIG CHECK FAILED"), - dup23, - ])); - - var msg313 = msg("MIB2D_CONFIG_CHECK_FAILED", part338); - - var part339 = match("MESSAGE#309:MIB2D_FILE_OPEN_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open file '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - dup78, - dup23, - ])); - - var msg314 = msg("MIB2D_FILE_OPEN_FAILURE", part339); - - var msg315 = msg("MIB2D_IFD_IFINDEX_FAILURE", dup146); - - var msg316 = msg("MIB2D_IFL_IFINDEX_FAILURE", dup146); - - var part340 = match("MESSAGE#312:MIB2D_INIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: mib2d initialization failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","mib2d initialization failure"), - dup23, - ])); - - var msg317 = msg("MIB2D_INIT_FAILURE", part340); - - var part341 = match("MESSAGE#313:MIB2D_KVM_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D KVM FAILURE"), - dup23, - ])); - - var msg318 = msg("MIB2D_KVM_FAILURE", part341); - - var part342 = match("MESSAGE#314:MIB2D_RTSLIB_READ_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: failed in %{dclass_counter1->} %{dclass_counter2->} index (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D RTSLIB READ FAILURE"), - dup23, - ])); - - var msg319 = msg("MIB2D_RTSLIB_READ_FAILURE", part342); - - var part343 = match("MESSAGE#315:MIB2D_RTSLIB_SEQ_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: sequence mismatch (%{result}), %{action}", processor_chain([ - dup30, - dup22, - setc("event_description","RTSLIB sequence mismatch"), - dup23, - ])); - - var msg320 = msg("MIB2D_RTSLIB_SEQ_MISMATCH", part343); - - var part344 = match("MESSAGE#316:MIB2D_SYSCTL_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D SYSCTL FAILURE"), - dup23, - ])); - - var msg321 = msg("MIB2D_SYSCTL_FAILURE", part344); - - var part345 = match("MESSAGE#317:MIB2D_TRAP_HEADER_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: trap_request_header failed", processor_chain([ - dup30, - dup22, - setc("event_description","trap_request_header failed"), - dup23, - ])); - - var msg322 = msg("MIB2D_TRAP_HEADER_FAILURE", part345); - - var part346 = match("MESSAGE#318:MIB2D_TRAP_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D TRAP SEND FAILURE"), - dup23, - ])); - - var msg323 = msg("MIB2D_TRAP_SEND_FAILURE", part346); - - var part347 = match("MESSAGE#319:Multiuser", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: old requested_transition==%{change_new->} sighupped=%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","user sighupped"), - dup23, - ])); - - var msg324 = msg("Multiuser", part347); - - var part348 = match("MESSAGE#320:NASD_AUTHENTICATION_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate authentication handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate authentication handle"), - dup23, - ])); - - var msg325 = msg("NASD_AUTHENTICATION_CREATE_FAILED", part348); - - var part349 = match("MESSAGE#321:NASD_CHAP_AUTHENTICATION_IN_PROGRESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename}, authentication already in progress", processor_chain([ - dup80, - dup34, - dup43, - dup22, - setc("event_description","authentication already in progress"), - dup23, - ])); - - var msg326 = msg("NASD_CHAP_AUTHENTICATION_IN_PROGRESS", part349); - - var part350 = match("MESSAGE#322:NASD_CHAP_GETHOSTNAME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: unable to obtain hostname for outgoing CHAP message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to obtain hostname for outgoing CHAP message"), - dup23, - ])); - - var msg327 = msg("NASD_CHAP_GETHOSTNAME_FAILED", part350); - - var part351 = match("MESSAGE#323:NASD_CHAP_INVALID_CHAP_IDENTIFIER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename->} expected CHAP ID: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP INVALID_CHAP IDENTIFIER"), - dup23, - ])); - - var msg328 = msg("NASD_CHAP_INVALID_CHAP_IDENTIFIER", part351); - - var part352 = match("MESSAGE#324:NASD_CHAP_INVALID_OPCODE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}.%{dclass_counter1}: invalid operation code received %{filename}, CHAP ID: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP INVALID OPCODE"), - dup23, - ])); - - var msg329 = msg("NASD_CHAP_INVALID_OPCODE", part352); - - var part353 = match("MESSAGE#325:NASD_CHAP_LOCAL_NAME_UNAVAILABLE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine value for '%{username}' in outgoing CHAP packet", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine value for username in outgoing CHAP packet"), - dup23, - ])); - - var msg330 = msg("NASD_CHAP_LOCAL_NAME_UNAVAILABLE", part353); - - var part354 = match("MESSAGE#326:NASD_CHAP_MESSAGE_UNEXPECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP MESSAGE UNEXPECTED"), - dup23, - ])); - - var msg331 = msg("NASD_CHAP_MESSAGE_UNEXPECTED", part354); - - var part355 = match("MESSAGE#327:NASD_CHAP_REPLAY_ATTACK_DETECTED", "nwparser.payload", "%{process}[%{ssid}]: %{event_type}: %{interface}.%{dclass_counter1}: received %{filename->} %{result}.%{info}", processor_chain([ - dup81, - dup22, - setc("event_description","CHAP REPLAY ATTACK DETECTED"), - dup23, - ])); - - var msg332 = msg("NASD_CHAP_REPLAY_ATTACK_DETECTED", part355); - - var part356 = match("MESSAGE#328:NASD_CONFIG_GET_LAST_MODIFIED_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine last modified time of JUNOS configuration database: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine last modified time of JUNOS configuration database"), - dup23, - ])); - - var msg333 = msg("NASD_CONFIG_GET_LAST_MODIFIED_FAILED", part356); - - var msg334 = msg("NASD_DAEMONIZE_FAILED", dup140); - - var part357 = match("MESSAGE#330:NASD_DB_ALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate database object: %{filename}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate database object"), - dup23, - ])); - - var msg335 = msg("NASD_DB_ALLOC_FAILURE", part357); - - var part358 = match("MESSAGE#331:NASD_DB_TABLE_CREATE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{filename}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DB TABLE CREATE FAILURE"), - dup23, - ])); - - var msg336 = msg("NASD_DB_TABLE_CREATE_FAILURE", part358); - - var msg337 = msg("NASD_DUPLICATE", dup141); - - var part359 = match("MESSAGE#333:NASD_EVLIB_CREATE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} with: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","EVLIB CREATE FAILURE"), - dup23, - ])); - - var msg338 = msg("NASD_EVLIB_CREATE_FAILURE", part359); - - var part360 = match("MESSAGE#334:NASD_EVLIB_EXIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} value: %{result}, error: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","EVLIB EXIT FAILURE"), - dup23, - ])); - - var msg339 = msg("NASD_EVLIB_EXIT_FAILURE", part360); - - var part361 = match("MESSAGE#335:NASD_LOCAL_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate LOCAL module handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate LOCAL module handle"), - dup23, - ])); - - var msg340 = msg("NASD_LOCAL_CREATE_FAILED", part361); - - var part362 = match("MESSAGE#336:NASD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","NASD must be run as root"), - dup23, - ])); - - var msg341 = msg("NASD_NOT_ROOT", part362); - - var msg342 = msg("NASD_PID_FILE_LOCK", dup142); - - var msg343 = msg("NASD_PID_FILE_UPDATE", dup143); - - var part363 = match("MESSAGE#339:NASD_POST_CONFIGURE_EVENT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","POST CONFIGURE EVENT FAILED"), - dup23, - ])); - - var msg344 = msg("NASD_POST_CONFIGURE_EVENT_FAILED", part363); - - var part364 = match("MESSAGE#340:NASD_PPP_READ_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PPP READ FAILURE"), - dup23, - ])); - - var msg345 = msg("NASD_PPP_READ_FAILURE", part364); - - var part365 = match("MESSAGE#341:NASD_PPP_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to send message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to send message"), - dup23, - ])); - - var msg346 = msg("NASD_PPP_SEND_FAILURE", part365); - - var part366 = match("MESSAGE#342:NASD_PPP_SEND_PARTIAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to send all of message: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to send all of message"), - dup23, - ])); - - var msg347 = msg("NASD_PPP_SEND_PARTIAL", part366); - - var part367 = match("MESSAGE#343:NASD_PPP_UNRECOGNIZED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unrecognized authentication protocol: %{protocol}", processor_chain([ - dup30, - dup22, - setc("event_description","Unrecognized authentication protocol"), - dup23, - ])); - - var msg348 = msg("NASD_PPP_UNRECOGNIZED", part367); - - var part368 = match("MESSAGE#344:NASD_RADIUS_ALLOCATE_PASSWORD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} when allocating password for RADIUS: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS password allocation failure"), - dup23, - ])); - - var msg349 = msg("NASD_RADIUS_ALLOCATE_PASSWORD_FAILED", part368); - - var part369 = match("MESSAGE#345:NASD_RADIUS_CONFIG_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS CONFIG FAILED"), - dup23, - ])); - - var msg350 = msg("NASD_RADIUS_CONFIG_FAILED", part369); - - var part370 = match("MESSAGE#346:NASD_RADIUS_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate RADIUS module handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate RADIUS module handle"), - dup23, - ])); - - var msg351 = msg("NASD_RADIUS_CREATE_FAILED", part370); - - var part371 = match("MESSAGE#347:NASD_RADIUS_CREATE_REQUEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS CREATE REQUEST FAILED"), - dup23, - ])); - - var msg352 = msg("NASD_RADIUS_CREATE_REQUEST_FAILED", part371); - - var part372 = match("MESSAGE#348:NASD_RADIUS_GETHOSTNAME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain hostname for outgoing RADIUS message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain hostname for outgoing RADIUS message"), - dup23, - ])); - - var msg353 = msg("NASD_RADIUS_GETHOSTNAME_FAILED", part372); - - var part373 = match("MESSAGE#349:NASD_RADIUS_MESSAGE_UNEXPECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown response from RADIUS server: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown response from RADIUS server"), - dup23, - ])); - - var msg354 = msg("NASD_RADIUS_MESSAGE_UNEXPECTED", part373); - - var part374 = match("MESSAGE#350:NASD_RADIUS_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS OPEN FAILED"), - dup23, - ])); - - var msg355 = msg("NASD_RADIUS_OPEN_FAILED", part374); - - var part375 = match("MESSAGE#351:NASD_RADIUS_SELECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS SELECT FAILED"), - dup23, - ])); - - var msg356 = msg("NASD_RADIUS_SELECT_FAILED", part375); - - var part376 = match("MESSAGE#352:NASD_RADIUS_SET_TIMER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS SET TIMER FAILED"), - dup23, - ])); - - var msg357 = msg("NASD_RADIUS_SET_TIMER_FAILED", part376); - - var part377 = match("MESSAGE#353:NASD_TRACE_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TRACE FILE OPEN FAILED"), - dup23, - ])); - - var msg358 = msg("NASD_TRACE_FILE_OPEN_FAILED", part377); - - var part378 = match("MESSAGE#354:NASD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","NASD Usage"), - dup23, - ])); - - var msg359 = msg("NASD_usage", part378); - - var part379 = match("MESSAGE#355:NOTICE", "nwparser.payload", "%{agent}: %{event_type}:%{action}: %{event_description}: The %{result}", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg360 = msg("NOTICE", part379); - - var part380 = match("MESSAGE#356:PFE_FW_SYSLOG_IP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FW: %{smacaddr->} %{fld10->} %{protocol->} %{saddr->} %{daddr->} %{sport->} %{dport->} (%{packets->} packets)", processor_chain([ - dup21, - dup22, - dup82, - dup23, - ])); - - var msg361 = msg("PFE_FW_SYSLOG_IP", part380); - - var part381 = match("MESSAGE#357:PFE_FW_SYSLOG_IP:01", "nwparser.payload", "%{hostip->} %{hostname->} %{event_type}: FW: %{smacaddr->} %{fld10->} %{protocol->} %{saddr->} %{daddr->} %{sport->} %{dport->} (%{packets->} packets)", processor_chain([ - dup21, - dup22, - dup82, - dup23, - ])); - - var msg362 = msg("PFE_FW_SYSLOG_IP:01", part381); - - var select36 = linear_select([ - msg361, - msg362, - ]); - - var part382 = match("MESSAGE#358:PFE_NH_RESOLVE_THROTTLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Next-hop resolution requests from interface %{interface->} throttled", processor_chain([ - dup21, - dup22, - setc("event_description","Next-hop resolution requests throttled"), - dup23, - ])); - - var msg363 = msg("PFE_NH_RESOLVE_THROTTLED", part382); - - var part383 = match("MESSAGE#359:PING_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","PING TEST COMPLETED"), - dup23, - ])); - - var msg364 = msg("PING_TEST_COMPLETED", part383); - - var part384 = match("MESSAGE#360:PING_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","PING TEST FAILED"), - dup23, - ])); - - var msg365 = msg("PING_TEST_FAILED", part384); - - var part385 = match("MESSAGE#361:process_mode/2", "nwparser.p0", "%{p0}"); - - var part386 = match("MESSAGE#361:process_mode/3_0", "nwparser.p0", "%{event_type}: %{p0}"); - - var part387 = match("MESSAGE#361:process_mode/3_1", "nwparser.p0", "%{event_type->} %{p0}"); - - var select37 = linear_select([ - part386, - part387, - ]); - - var part388 = match("MESSAGE#361:process_mode/4", "nwparser.p0", "mode=%{protocol->} cmd=%{action->} master_mode=%{result}"); - - var all21 = all_match({ - processors: [ - dup39, - dup137, - part385, - select37, - part388, - ], - on_success: processor_chain([ - dup21, - dup22, - dup83, - dup23, - ]), - }); - - var msg366 = msg("process_mode", all21); - - var part389 = match("MESSAGE#362:process_mode:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: current_mode=%{protocol}, requested_mode=%{result}, cmd=%{action}", processor_chain([ - dup21, - dup22, - dup83, - dup23, - ])); - - var msg367 = msg("process_mode:01", part389); - - var select38 = linear_select([ - msg366, - msg367, - ]); - - var part390 = match("MESSAGE#363:PWC_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} exiting with status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","process exit with status"), - dup23, - ])); - - var msg368 = msg("PWC_EXIT", part390); - - var part391 = match("MESSAGE#364:PWC_HOLD_RELEASE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} released child %{child_pid->} from %{dclass_counter1->} state", processor_chain([ - dup21, - dup22, - setc("event_description","Process released child from state"), - dup23, - ])); - - var msg369 = msg("PWC_HOLD_RELEASE", part391); - - var part392 = match("MESSAGE#365:PWC_INVALID_RUNS_ARGUMENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}, not %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","invalid runs argument"), - dup23, - ])); - - var msg370 = msg("PWC_INVALID_RUNS_ARGUMENT", part392); - - var part393 = match("MESSAGE#366:PWC_INVALID_TIMEOUT_ARGUMENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","INVALID TIMEOUT ARGUMENT"), - dup23, - ])); - - var msg371 = msg("PWC_INVALID_TIMEOUT_ARGUMENT", part393); - - var part394 = match("MESSAGE#367:PWC_KILLED_BY_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc process %{agent->} received terminating signal", processor_chain([ - dup21, - dup22, - setc("event_description","pwc process received terminating signal"), - dup23, - ])); - - var msg372 = msg("PWC_KILLED_BY_SIGNAL", part394); - - var part395 = match("MESSAGE#368:PWC_KILL_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc is sending %{resultcode->} to child %{child_pid}", processor_chain([ - dup30, - dup22, - setc("event_description","pwc is sending kill event to child"), - dup23, - ])); - - var msg373 = msg("PWC_KILL_EVENT", part395); - - var part396 = match("MESSAGE#369:PWC_KILL_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to kill process %{child_pid}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to kill process"), - dup23, - ])); - - var msg374 = msg("PWC_KILL_FAILED", part396); - - var part397 = match("MESSAGE#370:PWC_KQUEUE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: kevent failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","kevent failed"), - dup23, - ])); - - var msg375 = msg("PWC_KQUEUE_ERROR", part397); - - var part398 = match("MESSAGE#371:PWC_KQUEUE_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create kqueue: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create kqueue"), - dup23, - ])); - - var msg376 = msg("PWC_KQUEUE_INIT", part398); - - var part399 = match("MESSAGE#372:PWC_KQUEUE_REGISTER_FILTER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to register kqueue filter: %{agent->} for purpose: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to register kqueue filter"), - dup23, - ])); - - var msg377 = msg("PWC_KQUEUE_REGISTER_FILTER", part399); - - var part400 = match("MESSAGE#373:PWC_LOCKFILE_BAD_FORMAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file has bad format: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file has bad format"), - dup23, - ])); - - var msg378 = msg("PWC_LOCKFILE_BAD_FORMAT", part400); - - var part401 = match("MESSAGE#374:PWC_LOCKFILE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file had error: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file error"), - dup23, - ])); - - var msg379 = msg("PWC_LOCKFILE_ERROR", part401); - - var part402 = match("MESSAGE#375:PWC_LOCKFILE_MISSING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file not found: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file not found"), - dup23, - ])); - - var msg380 = msg("PWC_LOCKFILE_MISSING", part402); - - var part403 = match("MESSAGE#376:PWC_LOCKFILE_NOT_LOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file not locked: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file not locked"), - dup23, - ])); - - var msg381 = msg("PWC_LOCKFILE_NOT_LOCKED", part403); - - var part404 = match("MESSAGE#377:PWC_NO_PROCESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No process specified", processor_chain([ - dup30, - dup22, - setc("event_description","No process specified for PWC"), - dup23, - ])); - - var msg382 = msg("PWC_NO_PROCESS", part404); - - var part405 = match("MESSAGE#378:PWC_PROCESS_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc process %{agent->} child %{child_pid->} exited with status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","pwc process exited with status"), - dup23, - ])); - - var msg383 = msg("PWC_PROCESS_EXIT", part405); - - var part406 = match("MESSAGE#379:PWC_PROCESS_FORCED_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} forcing hold down of child %{child_pid->} until signal", processor_chain([ - dup21, - dup22, - setc("event_description","Process forcing hold down of child until signalled"), - dup23, - ])); - - var msg384 = msg("PWC_PROCESS_FORCED_HOLD", part406); - - var part407 = match("MESSAGE#380:PWC_PROCESS_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} holding down child %{child_pid->} until signal", processor_chain([ - dup21, - dup22, - setc("event_description","Process holding down child until signalled"), - dup23, - ])); - - var msg385 = msg("PWC_PROCESS_HOLD", part407); - - var part408 = match("MESSAGE#381:PWC_PROCESS_HOLD_SKIPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} will not down child %{child_pid->} because of %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Process not holding down child"), - dup23, - ])); - - var msg386 = msg("PWC_PROCESS_HOLD_SKIPPED", part408); - - var part409 = match("MESSAGE#382:PWC_PROCESS_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to create child process with pidpopen: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to create child process with pidpopen"), - dup23, - ])); - - var msg387 = msg("PWC_PROCESS_OPEN", part409); - - var part410 = match("MESSAGE#383:PWC_PROCESS_TIMED_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} holding down child %{child_pid->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Process holding down child"), - dup23, - ])); - - var msg388 = msg("PWC_PROCESS_TIMED_HOLD", part410); - - var part411 = match("MESSAGE#384:PWC_PROCESS_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child timed out %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Child process timed out"), - dup23, - ])); - - var msg389 = msg("PWC_PROCESS_TIMEOUT", part411); - - var part412 = match("MESSAGE#385:PWC_SIGNAL_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: signal(%{agent}) failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","signal failure"), - dup23, - ])); - - var msg390 = msg("PWC_SIGNAL_INIT", part412); - - var part413 = match("MESSAGE#386:PWC_SOCKET_CONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to connect socket to %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to connect socket to service"), - dup23, - ])); - - var msg391 = msg("PWC_SOCKET_CONNECT", part413); - - var part414 = match("MESSAGE#387:PWC_SOCKET_CREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to create socket: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to create socket"), - dup23, - ])); - - var msg392 = msg("PWC_SOCKET_CREATE", part414); - - var part415 = match("MESSAGE#388:PWC_SOCKET_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to set socket option %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to set socket option"), - dup23, - ])); - - var msg393 = msg("PWC_SOCKET_OPTION", part415); - - var part416 = match("MESSAGE#389:PWC_STDOUT_WRITE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Write to stdout failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Write to stdout failed"), - dup23, - ])); - - var msg394 = msg("PWC_STDOUT_WRITE", part416); - - var part417 = match("MESSAGE#390:PWC_SYSTEM_CALL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","PWC SYSTEM CALL"), - dup23, - ])); - - var msg395 = msg("PWC_SYSTEM_CALL", part417); - - var part418 = match("MESSAGE#391:PWC_UNKNOWN_KILL_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown kill option [%{agent}]", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown kill option"), - dup23, - ])); - - var msg396 = msg("PWC_UNKNOWN_KILL_OPTION", part418); - - var part419 = match("MESSAGE#392:RMOPD_ADDRESS_MULTICAST_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Multicast address is not allowed", processor_chain([ - dup30, - dup22, - setc("event_description","Multicast address not allowed"), - dup23, - ])); - - var msg397 = msg("RMOPD_ADDRESS_MULTICAST_INVALID", part419); - - var part420 = match("MESSAGE#393:RMOPD_ADDRESS_SOURCE_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Source address invalid: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RMOPD ADDRESS SOURCE INVALID"), - dup23, - ])); - - var msg398 = msg("RMOPD_ADDRESS_SOURCE_INVALID", part420); - - var part421 = match("MESSAGE#394:RMOPD_ADDRESS_STRING_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to convert numeric address to string: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to convert numeric address to string"), - dup23, - ])); - - var msg399 = msg("RMOPD_ADDRESS_STRING_FAILURE", part421); - - var part422 = match("MESSAGE#395:RMOPD_ADDRESS_TARGET_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: rmop_util_set_address status message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","rmop_util_set_address status message invalid"), - dup23, - ])); - - var msg400 = msg("RMOPD_ADDRESS_TARGET_INVALID", part422); - - var msg401 = msg("RMOPD_DUPLICATE", dup141); - - var part423 = match("MESSAGE#397:RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Only IPv4 source address is supported", processor_chain([ - dup30, - dup22, - setc("event_description","Only IPv4 source address is supported"), - dup23, - ])); - - var msg402 = msg("RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED", part423); - - var part424 = match("MESSAGE#398:RMOPD_ICMP_SENDMSG_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{fld1}: No route to host", processor_chain([ - dup30, - dup22, - setc("event_description","No route to host"), - dup23, - ])); - - var msg403 = msg("RMOPD_ICMP_SENDMSG_FAILURE", part424); - - var part425 = match("MESSAGE#399:RMOPD_IFINDEX_NOT_ACTIVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifindex: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","IFINDEX NOT ACTIVE"), - dup23, - ])); - - var msg404 = msg("RMOPD_IFINDEX_NOT_ACTIVE", part425); - - var part426 = match("MESSAGE#400:RMOPD_IFINDEX_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for %{interface}, message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IFINDEX NO INFO"), - dup23, - ])); - - var msg405 = msg("RMOPD_IFINDEX_NO_INFO", part426); - - var part427 = match("MESSAGE#401:RMOPD_IFNAME_NOT_ACTIVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifname: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","RMOPD IFNAME NOT ACTIVE"), - dup23, - ])); - - var msg406 = msg("RMOPD_IFNAME_NOT_ACTIVE", part427); - - var part428 = match("MESSAGE#402:RMOPD_IFNAME_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for %{interface}, message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IFNAME NO INFO"), - dup23, - ])); - - var msg407 = msg("RMOPD_IFNAME_NO_INFO", part428); - - var part429 = match("MESSAGE#403:RMOPD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","RMOPD Must be run as root"), - dup23, - ])); - - var msg408 = msg("RMOPD_NOT_ROOT", part429); - - var part430 = match("MESSAGE#404:RMOPD_ROUTING_INSTANCE_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for routing instance %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","No information for routing instance"), - dup23, - ])); - - var msg409 = msg("RMOPD_ROUTING_INSTANCE_NO_INFO", part430); - - var part431 = match("MESSAGE#405:RMOPD_TRACEROUTE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TRACEROUTE ERROR"), - dup23, - ])); - - var msg410 = msg("RMOPD_TRACEROUTE_ERROR", part431); - - var part432 = match("MESSAGE#406:RMOPD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","RMOPD usage"), - dup23, - ])); - - var msg411 = msg("RMOPD_usage", part432); - - var part433 = match("MESSAGE#407:RPD_ABORT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} version built by builder on %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD ABORT"), - dup23, - ])); - - var msg412 = msg("RPD_ABORT", part433); - - var part434 = match("MESSAGE#408:RPD_ACTIVE_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Exiting with active tasks: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD exiting with active tasks"), - dup23, - ])); - - var msg413 = msg("RPD_ACTIVE_TERMINATE", part434); - - var part435 = match("MESSAGE#409:RPD_ASSERT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Assertion failed %{resultcode}: file \"%{filename}\", line %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD Assertion failed"), - dup23, - ])); - - var msg414 = msg("RPD_ASSERT", part435); - - var part436 = match("MESSAGE#410:RPD_ASSERT_SOFT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Soft assertion failed %{resultcode}: file \"%{filename}\", line %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD Soft assertion failed"), - dup23, - ])); - - var msg415 = msg("RPD_ASSERT_SOFT", part436); - - var part437 = match("MESSAGE#411:RPD_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} version built by builder on %{dclass_counter1}", processor_chain([ - dup21, - dup22, - setc("event_description","RPD EXIT"), - dup23, - ])); - - var msg416 = msg("RPD_EXIT", part437); - - var msg417 = msg("RPD_IFL_INDEXCOLLISION", dup147); - - var msg418 = msg("RPD_IFL_NAMECOLLISION", dup147); - - var part438 = match("MESSAGE#414:RPD_ISIS_ADJDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS lost %{dclass_counter1->} adjacency to %{dclass_counter2->} on %{interface}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS lost adjacency"), - dup23, - ])); - - var msg419 = msg("RPD_ISIS_ADJDOWN", part438); - - var part439 = match("MESSAGE#415:RPD_ISIS_ADJUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS new %{dclass_counter1->} adjacency to %{dclass_counter2->} %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","IS-IS new adjacency"), - dup23, - ])); - - var msg420 = msg("RPD_ISIS_ADJUP", part439); - - var part440 = match("MESSAGE#416:RPD_ISIS_ADJUPNOIP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS new %{dclass_counter1->} adjacency to %{dclass_counter2->} %{interface->} without an address", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS new adjacency without an address"), - dup23, - ])); - - var msg421 = msg("RPD_ISIS_ADJUPNOIP", part440); - - var part441 = match("MESSAGE#417:RPD_ISIS_LSPCKSUM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS %{dclass_counter1->} LSP checksum error, interface %{interface}, LSP id %{id}, sequence %{dclass_counter2}, checksum %{resultcode}, lifetime %{fld2}", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS LSP checksum error on iterface"), - dup23, - ])); - - var msg422 = msg("RPD_ISIS_LSPCKSUM", part441); - - var part442 = match("MESSAGE#418:RPD_ISIS_OVERLOAD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS database overload", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS database overload"), - dup23, - ])); - - var msg423 = msg("RPD_ISIS_OVERLOAD", part442); - - var part443 = match("MESSAGE#419:RPD_KRT_AFUNSUPRT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode}: received %{agent->} message with unsupported address family %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","message with unsupported address family received"), - dup23, - ])); - - var msg424 = msg("RPD_KRT_AFUNSUPRT", part443); - - var part444 = match("MESSAGE#420:RPD_KRT_CCC_IFL_MODIFY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}, error", processor_chain([ - dup30, - dup22, - setc("event_description","RPD KRT CCC IFL MODIFY"), - dup23, - ])); - - var msg425 = msg("RPD_KRT_CCC_IFL_MODIFY", part444); - - var part445 = match("MESSAGE#421:RPD_KRT_DELETED_RTT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: received deleted routing table from the kernel for family %{dclass_counter1->} table ID %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","received deleted routing table from kernel"), - dup23, - ])); - - var msg426 = msg("RPD_KRT_DELETED_RTT", part445); - - var part446 = match("MESSAGE#422:RPD_KRT_IFA_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifa generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifa generation mismatch"), - dup23, - ])); - - var msg427 = msg("RPD_KRT_IFA_GENERATION", part446); - - var part447 = match("MESSAGE#423:RPD_KRT_IFDCHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} CHANGE for ifd %{interface->} failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","CHANGE for ifd failed"), - dup23, - ])); - - var msg428 = msg("RPD_KRT_IFDCHANGE", part447); - - var part448 = match("MESSAGE#424:RPD_KRT_IFDEST_GET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} SERVICE: %{service->} for ifd %{interface->} failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","GET SERVICE failure on interface"), - dup23, - ])); - - var msg429 = msg("RPD_KRT_IFDEST_GET", part448); - - var part449 = match("MESSAGE#425:RPD_KRT_IFDGET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} GET index for ifd interface failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","GET index for ifd interface failed"), - dup23, - ])); - - var msg430 = msg("RPD_KRT_IFDGET", part449); - - var part450 = match("MESSAGE#426:RPD_KRT_IFD_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifd %{dclass_counter1->} generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifd generation mismatch"), - dup23, - ])); - - var msg431 = msg("RPD_KRT_IFD_GENERATION", part450); - - var part451 = match("MESSAGE#427:RPD_KRT_IFL_CELL_RELAY_MODE_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl : %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","KRT IFL CELL RELAY MODE INVALID"), - dup23, - ])); - - var msg432 = msg("RPD_KRT_IFL_CELL_RELAY_MODE_INVALID", part451); - - var part452 = match("MESSAGE#428:RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl : %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","KRT IFL CELL RELAY MODE UNSPECIFIED"), - dup23, - ])); - - var msg433 = msg("RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED", part452); - - var part453 = match("MESSAGE#429:RPD_KRT_IFL_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl %{interface->} generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifl generation mismatch"), - dup23, - ])); - - var msg434 = msg("RPD_KRT_IFL_GENERATION", part453); - - var part454 = match("MESSAGE#430:RPD_KRT_KERNEL_BAD_ROUTE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: lost %{interface->} %{dclass_counter1->} for route %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","lost interface for route"), - dup23, - ])); - - var msg435 = msg("RPD_KRT_KERNEL_BAD_ROUTE", part454); - - var part455 = match("MESSAGE#431:RPD_KRT_NEXTHOP_OVERFLOW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: number of next hops (%{dclass_counter1}) exceeded the maximum allowed (%{dclass_counter2}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","number of next hops exceeded the maximum"), - dup23, - ])); - - var msg436 = msg("RPD_KRT_NEXTHOP_OVERFLOW", part455); - - var part456 = match("MESSAGE#432:RPD_KRT_NOIFD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No device %{dclass_counter1->} for interface %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","No device for interface"), - dup23, - ])); - - var msg437 = msg("RPD_KRT_NOIFD", part456); - - var part457 = match("MESSAGE#433:RPD_KRT_UNKNOWN_RTT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: received routing table message for unknown table with kernel ID %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","received routing table message for unknown table"), - dup23, - ])); - - var msg438 = msg("RPD_KRT_UNKNOWN_RTT", part457); - - var part458 = match("MESSAGE#434:RPD_KRT_VERSION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket version mismatch (%{info}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket version mismatch"), - dup23, - ])); - - var msg439 = msg("RPD_KRT_VERSION", part458); - - var part459 = match("MESSAGE#435:RPD_KRT_VERSIONNONE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket message type %{agent}'s version is not supported by kernel, %{info->} -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket message type not supported by kernel"), - dup23, - ])); - - var msg440 = msg("RPD_KRT_VERSIONNONE", part459); - - var part460 = match("MESSAGE#436:RPD_KRT_VERSIONOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket message type %{agent}'s version is older than expected (%{info}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket message type version is older than expected"), - dup23, - ])); - - var msg441 = msg("RPD_KRT_VERSIONOLD", part460); - - var part461 = match("MESSAGE#437:RPD_LDP_INTF_BLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate session ID detected from %{daddr}, interface %{interface}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Duplicate session ID detected"), - dup23, - ])); - - var msg442 = msg("RPD_LDP_INTF_BLOCKED", part461); - - var part462 = match("MESSAGE#438:RPD_LDP_INTF_UNBLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP interface %{interface->} is now %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","LDP interface now unblocked"), - dup23, - ])); - - var msg443 = msg("RPD_LDP_INTF_UNBLOCKED", part462); - - var part463 = match("MESSAGE#439:RPD_LDP_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP neighbor %{daddr->} (%{interface}) is %{result}", processor_chain([ - setc("eventcategory","1603030000"), - dup22, - setc("event_description","LDP neighbor down"), - dup23, - ])); - - var msg444 = msg("RPD_LDP_NBRDOWN", part463); - - var part464 = match("MESSAGE#440:RPD_LDP_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP neighbor %{daddr->} (%{interface}) is %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","LDP neighbor up"), - dup23, - ])); - - var msg445 = msg("RPD_LDP_NBRUP", part464); - - var part465 = match("MESSAGE#441:RPD_LDP_SESSIONDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP session %{daddr->} is down, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LDP session down"), - dup23, - ])); - - var msg446 = msg("RPD_LDP_SESSIONDOWN", part465); - - var part466 = match("MESSAGE#442:RPD_LDP_SESSIONUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP session %{daddr->} is up", processor_chain([ - dup21, - dup22, - setc("event_description","LDP session up"), - dup23, - ])); - - var msg447 = msg("RPD_LDP_SESSIONUP", part466); - - var part467 = match("MESSAGE#443:RPD_LOCK_FLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain a lock on %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain a lock"), - dup23, - ])); - - var msg448 = msg("RPD_LOCK_FLOCKED", part467); - - var part468 = match("MESSAGE#444:RPD_LOCK_LOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain a lock on %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain service lock"), - dup23, - ])); - - var msg449 = msg("RPD_LOCK_LOCKED", part468); - - var part469 = match("MESSAGE#445:RPD_MPLS_LSP_CHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result->} Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP CHANGE"), - dup23, - ])); - - var msg450 = msg("RPD_MPLS_LSP_CHANGE", part469); - - var part470 = match("MESSAGE#446:RPD_MPLS_LSP_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MPLS LSP DOWN"), - dup23, - ])); - - var msg451 = msg("RPD_MPLS_LSP_DOWN", part470); - - var part471 = match("MESSAGE#447:RPD_MPLS_LSP_SWITCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result}, Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP SWITCH"), - dup23, - ])); - - var msg452 = msg("RPD_MPLS_LSP_SWITCH", part471); - - var part472 = match("MESSAGE#448:RPD_MPLS_LSP_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result->} Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP UP"), - dup23, - ])); - - var msg453 = msg("RPD_MPLS_LSP_UP", part472); - - var part473 = match("MESSAGE#449:RPD_MSDP_PEER_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MSDP peer %{group->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MSDP PEER DOWN"), - dup23, - ])); - - var msg454 = msg("RPD_MSDP_PEER_DOWN", part473); - - var part474 = match("MESSAGE#450:RPD_MSDP_PEER_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MSDP peer %{group->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","MSDP PEER UP"), - dup23, - ])); - - var msg455 = msg("RPD_MSDP_PEER_UP", part474); - - var part475 = match("MESSAGE#451:RPD_OSPF_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: OSPF neighbor %{daddr->} (%{interface}) %{disposition->} due to %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","OSPF neighbor down"), - dup23, - ])); - - var msg456 = msg("RPD_OSPF_NBRDOWN", part475); - - var part476 = match("MESSAGE#452:RPD_OSPF_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: OSPF neighbor %{daddr->} (%{interface}) %{disposition->} due to %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","OSPF neighbor up"), - dup23, - ])); - - var msg457 = msg("RPD_OSPF_NBRUP", part476); - - var part477 = match("MESSAGE#453:RPD_OS_MEMHIGH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using %{dclass_counter1->} KB of memory, %{info}", processor_chain([ - dup51, - dup22, - setc("event_description","OS MEMHIGH"), - dup23, - ])); - - var msg458 = msg("RPD_OS_MEMHIGH", part477); - - var part478 = match("MESSAGE#454:RPD_PIM_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PIM neighbor %{daddr->} timeout interface %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","PIM neighbor down"), - setc("result","timeout"), - dup23, - ])); - - var msg459 = msg("RPD_PIM_NBRDOWN", part478); - - var part479 = match("MESSAGE#455:RPD_PIM_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PIM new neighbor %{daddr->} interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","PIM neighbor up"), - dup23, - ])); - - var msg460 = msg("RPD_PIM_NBRUP", part479); - - var part480 = match("MESSAGE#456:RPD_RDISC_CKSUM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Bad checksum for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Bad checksum for router solicitation"), - dup23, - ])); - - var msg461 = msg("RPD_RDISC_CKSUM", part480); - - var part481 = match("MESSAGE#457:RPD_RDISC_NOMULTI", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Ignoring interface %{dclass_counter1->} on %{interface->} -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Ignoring interface"), - dup23, - ])); - - var msg462 = msg("RPD_RDISC_NOMULTI", part481); - - var part482 = match("MESSAGE#458:RPD_RDISC_NORECVIF", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to locate interface for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to locate interface for router"), - dup23, - ])); - - var msg463 = msg("RPD_RDISC_NORECVIF", part482); - - var part483 = match("MESSAGE#459:RPD_RDISC_SOLICITADDR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Expected multicast (%{dclass_counter1}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Expected multicast for router solicitation"), - dup23, - ])); - - var msg464 = msg("RPD_RDISC_SOLICITADDR", part483); - - var part484 = match("MESSAGE#460:RPD_RDISC_SOLICITICMP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Nonzero ICMP code (%{resultcode}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Nonzero ICMP code for router solicitation"), - dup23, - ])); - - var msg465 = msg("RPD_RDISC_SOLICITICMP", part484); - - var part485 = match("MESSAGE#461:RPD_RDISC_SOLICITLEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Insufficient length (%{dclass_counter1}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Insufficient length for router solicitation"), - dup23, - ])); - - var msg466 = msg("RPD_RDISC_SOLICITLEN", part485); - - var part486 = match("MESSAGE#462:RPD_RIP_AUTH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Update with invalid authentication from %{saddr->} (%{interface})", processor_chain([ - dup30, - dup22, - setc("event_description","RIP update with invalid authentication"), - dup23, - ])); - - var msg467 = msg("RPD_RIP_AUTH", part486); - - var part487 = match("MESSAGE#463:RPD_RIP_JOIN_BROADCAST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to get broadcast address %{interface}; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RIP - unable to get broadcast address"), - dup23, - ])); - - var msg468 = msg("RPD_RIP_JOIN_BROADCAST", part487); - - var part488 = match("MESSAGE#464:RPD_RIP_JOIN_MULTICAST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to join multicast group %{interface}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RIP - Unable to join multicast group"), - dup23, - ])); - - var msg469 = msg("RPD_RIP_JOIN_MULTICAST", part488); - - var part489 = match("MESSAGE#465:RPD_RT_IFUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: UP route for interface %{interface->} index %{dclass_counter1->} %{saddr}/%{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","RIP interface up"), - dup23, - ])); - - var msg470 = msg("RPD_RT_IFUP", part489); - - var msg471 = msg("RPD_SCHED_CALLBACK_LONGRUNTIME", dup148); - - var part490 = match("MESSAGE#467:RPD_SCHED_CUMULATIVE_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime (%{result}) after action of module", processor_chain([ - dup30, - dup22, - setc("event_description","excessive runtime after action of module"), - dup23, - ])); - - var msg472 = msg("RPD_SCHED_CUMULATIVE_LONGRUNTIME", part490); - - var msg473 = msg("RPD_SCHED_MODULE_LONGRUNTIME", dup148); - - var part491 = match("MESSAGE#469:RPD_SCHED_TASK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} ran for %{dclass_counter1}(%{dclass_counter2})", processor_chain([ - dup30, - dup22, - setc("event_description","task extended runtime"), - dup23, - ])); - - var msg474 = msg("RPD_SCHED_TASK_LONGRUNTIME", part491); - - var part492 = match("MESSAGE#470:RPD_SIGNAL_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} termination signal received", processor_chain([ - dup30, - dup22, - setc("event_description","termination signal received for service"), - dup23, - ])); - - var msg475 = msg("RPD_SIGNAL_TERMINATE", part492); - - var part493 = match("MESSAGE#471:RPD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Start %{dclass_counter1->} version version built %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","version built"), - dup23, - ])); - - var msg476 = msg("RPD_START", part493); - - var part494 = match("MESSAGE#472:RPD_SYSTEM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: detail: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","system command"), - dup23, - ])); - - var msg477 = msg("RPD_SYSTEM", part494); - - var part495 = match("MESSAGE#473:RPD_TASK_BEGIN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Commencing routing updates, version %{dclass_counter1}, built %{dclass_counter2->} by builder", processor_chain([ - dup21, - dup22, - setc("event_description","Commencing routing updates"), - dup23, - ])); - - var msg478 = msg("RPD_TASK_BEGIN", part495); - - var part496 = match("MESSAGE#474:RPD_TASK_CHILDKILLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","task killed by signal"), - dup23, - ])); - - var msg479 = msg("RPD_TASK_CHILDKILLED", part496); - - var part497 = match("MESSAGE#475:RPD_TASK_CHILDSTOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","task stopped by signal"), - dup23, - ])); - - var msg480 = msg("RPD_TASK_CHILDSTOPPED", part497); - - var part498 = match("MESSAGE#476:RPD_TASK_FORK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fork task: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fork task"), - dup23, - ])); - - var msg481 = msg("RPD_TASK_FORK", part498); - - var part499 = match("MESSAGE#477:RPD_TASK_GETWD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: getwd: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","RPD TASK GETWD"), - dup23, - ])); - - var msg482 = msg("RPD_TASK_GETWD", part499); - - var part500 = match("MESSAGE#478:RPD_TASK_NOREINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitialization not possible", processor_chain([ - dup30, - dup22, - setc("event_description","Reinitialization not possible"), - dup23, - ])); - - var msg483 = msg("RPD_TASK_NOREINIT", part500); - - var part501 = match("MESSAGE#479:RPD_TASK_PIDCLOSED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to close and remove %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to close and remove task"), - dup23, - ])); - - var msg484 = msg("RPD_TASK_PIDCLOSED", part501); - - var part502 = match("MESSAGE#480:RPD_TASK_PIDFLOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: flock(%{agent}, %{action}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD TASK PIDFLOCK"), - dup23, - ])); - - var msg485 = msg("RPD_TASK_PIDFLOCK", part502); - - var part503 = match("MESSAGE#481:RPD_TASK_PIDWRITE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to write %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to write"), - dup23, - ])); - - var msg486 = msg("RPD_TASK_PIDWRITE", part503); - - var msg487 = msg("RPD_TASK_REINIT", dup149); - - var part504 = match("MESSAGE#483:RPD_TASK_SIGNALIGNORE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: sigaction(%{result}): %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","ignoring task signal"), - dup23, - ])); - - var msg488 = msg("RPD_TASK_SIGNALIGNORE", part504); - - var part505 = match("MESSAGE#484:RT_COS", "nwparser.payload", "%{process}: %{event_type}: COS IPC op %{dclass_counter1->} (%{agent}) failed, err %{resultcode->} (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","COS IPC op failed"), - dup23, - ])); - - var msg489 = msg("RT_COS", part505); - - var part506 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/2", "nwparser.p0", "%{fld5}\" nat-source-address=\"%{stransaddr}\" nat-source-port=\"%{stransport}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var part507 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{fld10}\" dst-nat-rule-%{p0}"); - - var part508 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_0", "nwparser.p0", "type=%{fld21->} dst-nat-rule-name=\"%{p0}"); - - var select39 = linear_select([ - part508, - dup91, - ]); - - var part509 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/6", "nwparser.p0", "\"%{fld11->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{fld13}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\"%{p0}"); - - var part510 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" encrypted=%{fld8->} %{p0}"); - - var select40 = linear_select([ - part510, - dup45, - ]); - - var all22 = all_match({ - processors: [ - dup87, - dup150, - part506, - dup151, - part507, - select39, - part509, - select40, - dup92, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - dup52, - ]), - }); - - var msg490 = msg("RT_FLOW_SESSION_CREATE:02", all22); - - var part511 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/1_0", "nwparser.p0", " service-name=\"%{service}\" nat-source-address=\"%{stransaddr}\" nat-source-port=\"%{stransport}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-type=\"%{fld20}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-type=\"%{fld10}\" dst-nat-rule-name=\"%{rule_template}\"%{p0}"); - - var select41 = linear_select([ - part511, - dup45, - ]); - - var part512 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/2", "nwparser.p0", "%{}protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\"%{p0}"); - - var part513 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/3_0", "nwparser.p0", " source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" username=\"%{username}\" roles=\"%{fld50}\" packet-incoming-interface=\"%{dinterface}\" application=\"%{application}\" nested-application=\"%{fld7}\" encrypted=\"%{fld8}\"%{p0}"); - - var select42 = linear_select([ - part513, - dup45, - ]); - - var all23 = all_match({ - processors: [ - dup87, - select41, - part512, - select42, - dup92, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - dup52, - ]), - }); - - var msg491 = msg("RT_FLOW_SESSION_CREATE", all23); - - var part514 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/0_0", "nwparser.payload", "%{process}: %{event_type}: session created %{p0}"); - - var part515 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/0_1", "nwparser.payload", "%{event_type}: session created %{p0}"); - - var select43 = linear_select([ - part514, - part515, - ]); - - var part516 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{p0}"); - - var part517 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_0", "nwparser.p0", "%{rulename->} %{rule_template->} %{fld12->} %{fld13->} %{fld14->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username}(%{fld10}) %{interface->} %{protocol->} %{fld15->} UNKNOWN UNKNOWN"); - - var part518 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_1", "nwparser.p0", "%{rulename->} %{rule_template->} %{fld12->} %{fld13->} %{fld14->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username}(%{fld10}) %{interface->} %{fld15}"); - - var part519 = match_copy("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_2", "nwparser.p0", "info"); - - var select44 = linear_select([ - part517, - part518, - part519, - ]); - - var all24 = all_match({ - processors: [ - select43, - part516, - select44, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - setc("event_description","session created"), - dup23, - ]), - }); - - var msg492 = msg("RT_FLOW_SESSION_CREATE:01", all24); - - var select45 = linear_select([ - msg490, - msg491, - msg492, - ]); - - var part520 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/2", "nwparser.p0", "%{fld5}\" protocol-id=\"%{protocol}\" icmp-type=\"%{obj_type}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{user_role}\" packet-incoming-interface=\"%{dinterface}\"%{p0}"); - - var part521 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/3_0", "nwparser.p0", " encrypted=\"%{fld16}\" reason=\"%{result}\" src-vrf-grp=\"%{fld99}\" dst-vrf-grp=\"%{fld98}\"%{p0}"); - - var part522 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/3_1", "nwparser.p0", " encrypted=%{fld16->} reason=\"%{result}\"%{p0}"); - - var select46 = linear_select([ - part521, - part522, - dup45, - ]); - - var all25 = all_match({ - processors: [ - dup87, - dup150, - part520, - select46, - dup92, - ], - on_success: processor_chain([ - dup93, - dup53, - dup94, - dup22, - dup52, - ]), - }); - - var msg493 = msg("RT_FLOW_SESSION_DENY:02", all25); - - var part523 = match("MESSAGE#489:RT_FLOW_SESSION_DENY", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" icmp-type=\"%{obj_type}\" policy-name=\"%{policyname}\"]", processor_chain([ - dup93, - dup53, - dup94, - dup22, - dup52, - ])); - - var msg494 = msg("RT_FLOW_SESSION_DENY", part523); - - var part524 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{fld1->} %{result->} %{src_zone->} %{dst_zone->} HTTP %{info}"); - - var all26 = all_match({ - processors: [ - dup152, - part524, - ], - on_success: processor_chain([ - dup27, - dup53, - dup94, - dup22, - dup97, - dup23, - ]), - }); - - var msg495 = msg("RT_FLOW_SESSION_DENY:03", all26); - - var part525 = match("MESSAGE#491:RT_FLOW_SESSION_DENY:01/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{fld1->} %{result->} %{src_zone->} %{dst_zone}"); - - var all27 = all_match({ - processors: [ - dup152, - part525, - ], - on_success: processor_chain([ - dup27, - dup53, - dup94, - dup22, - dup97, - dup23, - ]), - }); - - var msg496 = msg("RT_FLOW_SESSION_DENY:01", all27); - - var select47 = linear_select([ - msg493, - msg494, - msg495, - msg496, - ]); - - var select48 = linear_select([ - dup103, - dup45, - ]); - - var all28 = all_match({ - processors: [ - dup98, - dup150, - dup99, - dup151, - dup100, - dup153, - dup102, - select48, - dup92, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup104, - dup22, - dup52, - ]), - }); - - var msg497 = msg("RT_FLOW_SESSION_CLOSE:01", all28); - - var part526 = match("MESSAGE#493:RT_FLOW_SESSION_CLOSE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" inbound-packets=\"%{packets}\" inbound-bytes=\"%{rbytes}\" outbound-packets=\"%{dclass_counter1}\" outbound-bytes=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup27, - dup53, - dup55, - dup22, - dup52, - ])); - - var msg498 = msg("RT_FLOW_SESSION_CLOSE", part526); - - var part527 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/0_0", "nwparser.payload", "%{process}: %{event_type}: session closed %{p0}"); - - var part528 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/0_1", "nwparser.payload", "%{event_type}: session closed %{p0}"); - - var select49 = linear_select([ - part527, - part528, - ]); - - var part529 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/1", "nwparser.p0", "%{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{info}"); - - var all29 = all_match({ - processors: [ - select49, - part529, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup22, - setc("event_description","session closed"), - dup23, - ]), - }); - - var msg499 = msg("RT_FLOW_SESSION_CLOSE:02", all29); - - var part530 = match("MESSAGE#495:RT_FLOW_SESSION_CLOSE:03/7_1", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{user_role}\" packet-incoming-interface=\"%{dinterface}\" %{p0}"); - - var select50 = linear_select([ - dup103, - part530, - dup45, - ]); - - var part531 = match("MESSAGE#495:RT_FLOW_SESSION_CLOSE:03/8", "nwparser.p0", "] session closed %{fld60}: %{fld51}/%{fld52}->%{fld53}/%{fld54->} %{fld55->} %{fld56}/%{fld57}->%{fld58}/%{fld59->} %{info}"); - - var all30 = all_match({ - processors: [ - dup98, - dup150, - dup99, - dup151, - dup100, - dup153, - dup102, - select50, - part531, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup104, - dup22, - dup52, - dup61, - ]), - }); - - var msg500 = msg("RT_FLOW_SESSION_CLOSE:03", all30); - - var select51 = linear_select([ - msg497, - msg498, - msg499, - msg500, - ]); - - var part532 = match("MESSAGE#496:RT_SCREEN_IP", "nwparser.payload", "%{process}: %{event_type}: Fragmented traffic! source:%{saddr}, destination: %{daddr}, protocol-id: %{protocol}, zone name: %{zone}, interface name: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","Fragmented traffic"), - dup23, - ])); - - var msg501 = msg("RT_SCREEN_IP", part532); - - var part533 = match("MESSAGE#497:RT_SCREEN_IP:01", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" protocol-id=\"%{protocol}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg502 = msg("RT_SCREEN_IP:01", part533); - - var select52 = linear_select([ - msg501, - msg502, - ]); - - var msg503 = msg("RT_SCREEN_TCP", dup154); - - var part534 = match("MESSAGE#499:RT_SCREEN_SESSION_LIMIT", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" message=\"%{info}\" ip-address=\"%{hostip}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg504 = msg("RT_SCREEN_SESSION_LIMIT", part534); - - var msg505 = msg("RT_SCREEN_UDP", dup154); - - var part535 = match("MESSAGE#501:SERVICED_CLIENT_CONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: attempt to connect to interface failed with error: %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","attempt to connect to interface failed"), - dup23, - ])); - - var msg506 = msg("SERVICED_CLIENT_CONNECT", part535); - - var part536 = match("MESSAGE#502:SERVICED_CLIENT_DISCONNECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unexpected termination of connection to interface", processor_chain([ - dup27, - dup22, - setc("event_description","unexpected termination of connection"), - dup23, - ])); - - var msg507 = msg("SERVICED_CLIENT_DISCONNECTED", part536); - - var part537 = match("MESSAGE#503:SERVICED_CLIENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: client interface connection failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","client interface connection failure"), - dup23, - ])); - - var msg508 = msg("SERVICED_CLIENT_ERROR", part537); - - var part538 = match("MESSAGE#504:SERVICED_COMMAND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: remote command execution failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","remote command execution failed"), - dup23, - ])); - - var msg509 = msg("SERVICED_COMMAND_FAILED", part538); - - var part539 = match("MESSAGE#505:SERVICED_COMMIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: client failed to commit configuration with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","client commit configuration failed"), - dup23, - ])); - - var msg510 = msg("SERVICED_COMMIT_FAILED", part539); - - var part540 = match("MESSAGE#506:SERVICED_CONFIGURATION_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: configuration process failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","configuration process failed"), - dup23, - ])); - - var msg511 = msg("SERVICED_CONFIGURATION_FAILED", part540); - - var part541 = match("MESSAGE#507:SERVICED_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SERVICED CONFIG ERROR"), - dup23, - ])); - - var msg512 = msg("SERVICED_CONFIG_ERROR", part541); - - var part542 = match("MESSAGE#508:SERVICED_CONFIG_FILE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} failed to read path with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","service failed to read path"), - dup23, - ])); - - var msg513 = msg("SERVICED_CONFIG_FILE", part542); - - var part543 = match("MESSAGE#509:SERVICED_CONNECTION_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SERVICED CONNECTION ERROR"), - dup23, - ])); - - var msg514 = msg("SERVICED_CONNECTION_ERROR", part543); - - var part544 = match("MESSAGE#510:SERVICED_DISABLED_GGSN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: GGSN services disabled: object: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","GGSN services disabled"), - dup23, - ])); - - var msg515 = msg("SERVICED_DISABLED_GGSN", part544); - - var msg516 = msg("SERVICED_DUPLICATE", dup141); - - var part545 = match("MESSAGE#512:SERVICED_EVENT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: event function %{dclass_counter2->} failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","event function failed"), - dup23, - ])); - - var msg517 = msg("SERVICED_EVENT_FAILED", part545); - - var part546 = match("MESSAGE#513:SERVICED_INIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: initialization failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","service initialization failed"), - dup23, - ])); - - var msg518 = msg("SERVICED_INIT_FAILED", part546); - - var part547 = match("MESSAGE#514:SERVICED_MALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: failed to allocate [%{dclass_counter2}] object [%{dclass_counter1->} bytes %{bytes}]: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","memory allocation failure"), - dup23, - ])); - - var msg519 = msg("SERVICED_MALLOC_FAILURE", part547); - - var part548 = match("MESSAGE#515:SERVICED_NETWORK_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} had error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","NETWORK FAILURE"), - dup23, - ])); - - var msg520 = msg("SERVICED_NETWORK_FAILURE", part548); - - var part549 = match("MESSAGE#516:SERVICED_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","SERVICED must be run as root"), - dup23, - ])); - - var msg521 = msg("SERVICED_NOT_ROOT", part549); - - var msg522 = msg("SERVICED_PID_FILE_LOCK", dup142); - - var msg523 = msg("SERVICED_PID_FILE_UPDATE", dup143); - - var part550 = match("MESSAGE#519:SERVICED_RTSOCK_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: routing socket sequence error, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","routing socket sequence error"), - dup23, - ])); - - var msg524 = msg("SERVICED_RTSOCK_SEQUENCE", part550); - - var part551 = match("MESSAGE#520:SERVICED_SIGNAL_HANDLER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: set up of signal name handler failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","set up of signal name handler failed"), - dup23, - ])); - - var msg525 = msg("SERVICED_SIGNAL_HANDLER", part551); - - var part552 = match("MESSAGE#521:SERVICED_SOCKET_CREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket create failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","socket create failed with error"), - dup23, - ])); - - var msg526 = msg("SERVICED_SOCKET_CREATE", part552); - - var part553 = match("MESSAGE#522:SERVICED_SOCKET_IO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket function %{dclass_counter2->} failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","socket function failed"), - dup23, - ])); - - var msg527 = msg("SERVICED_SOCKET_IO", part553); - - var part554 = match("MESSAGE#523:SERVICED_SOCKET_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unable to set socket option %{dclass_counter2}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to set socket option"), - dup23, - ])); - - var msg528 = msg("SERVICED_SOCKET_OPTION", part554); - - var part555 = match("MESSAGE#524:SERVICED_STDLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} had error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","STDLIB FAILURE"), - dup23, - ])); - - var msg529 = msg("SERVICED_STDLIB_FAILURE", part555); - - var part556 = match("MESSAGE#525:SERVICED_USAGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect usage: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Incorrect service usage"), - dup23, - ])); - - var msg530 = msg("SERVICED_USAGE", part556); - - var part557 = match("MESSAGE#526:SERVICED_WORK_INCONSISTENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: object has unexpected value %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","object has unexpected value"), - dup23, - ])); - - var msg531 = msg("SERVICED_WORK_INCONSISTENCY", part557); - - var msg532 = msg("SSL_PROXY_SSL_SESSION_ALLOW", dup155); - - var msg533 = msg("SSL_PROXY_SSL_SESSION_DROP", dup155); - - var msg534 = msg("SSL_PROXY_SESSION_IGNORE", dup155); - - var part558 = match("MESSAGE#530:SNMP_NS_LOG_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NET-SNMP version %{version->} AgentX subagent connected", processor_chain([ - dup21, - dup22, - setc("event_description","AgentX subagent connected"), - dup61, - dup23, - ])); - - var msg535 = msg("SNMP_NS_LOG_INFO", part558); - - var part559 = match("MESSAGE#531:SNMP_SUBAGENT_IPC_REG_ROWS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ns_subagent_register_mibs: registering %{dclass_counter1->} rows", processor_chain([ - dup21, - dup22, - setc("event_description","ns_subagent registering rows"), - dup61, - dup23, - ])); - - var msg536 = msg("SNMP_SUBAGENT_IPC_REG_ROWS", part559); - - var part560 = match("MESSAGE#532:SNMPD_ACCESS_GROUP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} access group %{group}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD ACCESS GROUP ERROR"), - dup23, - ])); - - var msg537 = msg("SNMPD_ACCESS_GROUP_ERROR", part560); - - var part561 = match("MESSAGE#533:SNMPD_AUTH_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unauthorized SNMP community from %{daddr->} to unknown community name (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","unauthorized SNMP community to unknown community name"), - dup23, - ])); - - var msg538 = msg("SNMPD_AUTH_FAILURE", part561); - - var part562 = match("MESSAGE#534:SNMPD_AUTH_FAILURE:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: failed input interface authorization from %{daddr->} to unknown (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","failed input interface authorization to unknown"), - dup23, - ])); - - var msg539 = msg("SNMPD_AUTH_FAILURE:01", part562); - - var part563 = match("MESSAGE#535:SNMPD_AUTH_FAILURE:02", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unauthorized SNMP community from %{daddr->} to %{saddr->} (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","unauthorized SNMP community "), - dup23, - ])); - - var msg540 = msg("SNMPD_AUTH_FAILURE:02", part563); - - var part564 = match("MESSAGE#595:SNMPD_AUTH_FAILURE:03", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} function-name=\"%{fld1}\" message=\"%{info}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" index1=\"%{fld4}\"]", processor_chain([ - dup30, - dup22, - dup105, - dup61, - dup62, - ])); - - var msg541 = msg("SNMPD_AUTH_FAILURE:03", part564); - - var select53 = linear_select([ - msg538, - msg539, - msg540, - msg541, - ]); - - var part565 = match("MESSAGE#536:SNMPD_AUTH_PRIVILEGES_EXCEEDED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{saddr}: request exceeded community privileges", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP request exceeded community privileges"), - dup23, - ])); - - var msg542 = msg("SNMPD_AUTH_PRIVILEGES_EXCEEDED", part565); - - var part566 = match("MESSAGE#537:SNMPD_AUTH_RESTRICTED_ADDRESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: request from address %{daddr->} not allowed", processor_chain([ - dup48, - dup22, - setc("event_description","SNMPD AUTH RESTRICTED ADDRESS"), - setc("result","request not allowed"), - dup23, - ])); - - var msg543 = msg("SNMPD_AUTH_RESTRICTED_ADDRESS", part566); - - var part567 = match("MESSAGE#538:SNMPD_AUTH_WRONG_PDU_TYPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{saddr}: unauthorized SNMP PDU type: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unauthorized SNMP PDU type"), - dup23, - ])); - - var msg544 = msg("SNMPD_AUTH_WRONG_PDU_TYPE", part567); - - var part568 = match("MESSAGE#539:SNMPD_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Configuration database has errors", processor_chain([ - dup30, - dup22, - setc("event_description","Configuration database has errors"), - dup23, - ])); - - var msg545 = msg("SNMPD_CONFIG_ERROR", part568); - - var part569 = match("MESSAGE#540:SNMPD_CONTEXT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} context %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD CONTEXT ERROR"), - dup23, - ])); - - var msg546 = msg("SNMPD_CONTEXT_ERROR", part569); - - var part570 = match("MESSAGE#541:SNMPD_ENGINE_FILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2}: operation: %{dclass_counter1->} %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD ENGINE FILE FAILURE"), - dup23, - ])); - - var msg547 = msg("SNMPD_ENGINE_FILE_FAILURE", part570); - - var part571 = match("MESSAGE#542:SNMPD_ENGINE_PROCESS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: from-path: undecodable/unmatched subagent response", processor_chain([ - dup30, - dup22, - setc("event_description"," from-path - SNMP undecodable/unmatched subagent response"), - dup23, - ])); - - var msg548 = msg("SNMPD_ENGINE_PROCESS_ERROR", part571); - - var part572 = match("MESSAGE#543:SNMPD_FILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: fopen %{dclass_counter2}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD FILE FAILURE"), - dup23, - ])); - - var msg549 = msg("SNMPD_FILE_FAILURE", part572); - - var part573 = match("MESSAGE#544:SNMPD_GROUP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} group: '%{group}' user '%{username}' model '%{version}'", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD GROUP ERROR"), - dup23, - ])); - - var msg550 = msg("SNMPD_GROUP_ERROR", part573); - - var part574 = match("MESSAGE#545:SNMPD_INIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: snmpd initialization failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","snmpd initialization failure"), - dup23, - ])); - - var msg551 = msg("SNMPD_INIT_FAILED", part574); - - var part575 = match("MESSAGE#546:SNMPD_LIBJUNIPER_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: system_default_inaddr: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LIBJUNIPER FAILURE"), - dup23, - ])); - - var msg552 = msg("SNMPD_LIBJUNIPER_FAILURE", part575); - - var part576 = match("MESSAGE#547:SNMPD_LOOPBACK_ADDR_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LOOPBACK ADDR ERROR"), - dup23, - ])); - - var msg553 = msg("SNMPD_LOOPBACK_ADDR_ERROR", part576); - - var part577 = match("MESSAGE#548:SNMPD_MEMORY_FREED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: called for freed - already freed", processor_chain([ - dup30, - dup22, - setc("event_description","duplicate memory free"), - dup23, - ])); - - var msg554 = msg("SNMPD_MEMORY_FREED", part577); - - var part578 = match("MESSAGE#549:SNMPD_RADIX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: radix_add failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","radix_add failed"), - dup23, - ])); - - var msg555 = msg("SNMPD_RADIX_FAILURE", part578); - - var part579 = match("MESSAGE#550:SNMPD_RECEIVE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: receive %{dclass_counter1->} failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD RECEIVE FAILURE"), - dup23, - ])); - - var msg556 = msg("SNMPD_RECEIVE_FAILURE", part579); - - var part580 = match("MESSAGE#551:SNMPD_RMONFILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2}: operation: %{dclass_counter1->} %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RMONFILE FAILURE"), - dup23, - ])); - - var msg557 = msg("SNMPD_RMONFILE_FAILURE", part580); - - var part581 = match("MESSAGE#552:SNMPD_RMON_COOKIE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: Null cookie", processor_chain([ - dup30, - dup22, - setc("event_description","Null cookie"), - dup23, - ])); - - var msg558 = msg("SNMPD_RMON_COOKIE", part581); - - var part582 = match("MESSAGE#553:SNMPD_RMON_EVENTLOG", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","RMON EVENTLOG"), - dup23, - ])); - - var msg559 = msg("SNMPD_RMON_EVENTLOG", part582); - - var part583 = match("MESSAGE#554:SNMPD_RMON_IOERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: Received io error, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Received io error"), - dup23, - ])); - - var msg560 = msg("SNMPD_RMON_IOERROR", part583); - - var part584 = match("MESSAGE#555:SNMPD_RMON_MIBERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: internal Get request error: description, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","internal Get request error"), - dup23, - ])); - - var msg561 = msg("SNMPD_RMON_MIBERROR", part584); - - var part585 = match("MESSAGE#556:SNMPD_RTSLIB_ASYNC_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: sequence mismatch %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","sequence mismatch"), - dup23, - ])); - - var msg562 = msg("SNMPD_RTSLIB_ASYNC_EVENT", part585); - - var part586 = match("MESSAGE#557:SNMPD_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: send send-type (index1) failure: %{result}", processor_chain([ - dup30, - dup22, - dup106, - dup23, - ])); - - var msg563 = msg("SNMPD_SEND_FAILURE", part586); - - var part587 = match("MESSAGE#558:SNMPD_SEND_FAILURE:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: send to (%{saddr}) failure: %{result}", processor_chain([ - dup30, - dup22, - dup106, - dup23, - ])); - - var msg564 = msg("SNMPD_SEND_FAILURE:01", part587); - - var select54 = linear_select([ - msg563, - msg564, - ]); - - var part588 = match("MESSAGE#559:SNMPD_SOCKET_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD SOCKET FAILURE"), - dup23, - ])); - - var msg565 = msg("SNMPD_SOCKET_FAILURE", part588); - - var part589 = match("MESSAGE#560:SNMPD_SUBAGENT_NO_BUFFERS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No buffers available for subagent (%{agent})", processor_chain([ - dup30, - dup22, - setc("event_description","No buffers available for subagent"), - dup23, - ])); - - var msg566 = msg("SNMPD_SUBAGENT_NO_BUFFERS", part589); - - var part590 = match("MESSAGE#561:SNMPD_SUBAGENT_SEND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Send to subagent failed (%{agent}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Send to subagent failed"), - dup23, - ])); - - var msg567 = msg("SNMPD_SUBAGENT_SEND_FAILED", part590); - - var part591 = match("MESSAGE#562:SNMPD_SYSLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: system function '%{dclass_counter1}' failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","system function failed"), - dup23, - ])); - - var msg568 = msg("SNMPD_SYSLIB_FAILURE", part591); - - var part592 = match("MESSAGE#563:SNMPD_THROTTLE_QUEUE_DRAINED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: cleared all throttled traps", processor_chain([ - dup21, - dup22, - setc("event_description","cleared all throttled traps"), - dup23, - ])); - - var msg569 = msg("SNMPD_THROTTLE_QUEUE_DRAINED", part592); - - var part593 = match("MESSAGE#564:SNMPD_TRAP_COLD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap: cold start", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP trap: cold start"), - dup23, - ])); - - var msg570 = msg("SNMPD_TRAP_COLD_START", part593); - - var part594 = match("MESSAGE#565:SNMPD_TRAP_GEN_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{resultcode->} (%{result})", processor_chain([ - dup30, - dup22, - dup107, - dup23, - ])); - - var msg571 = msg("SNMPD_TRAP_GEN_FAILURE", part594); - - var part595 = match("MESSAGE#566:SNMPD_TRAP_GEN_FAILURE2", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{dclass_counter2->} %{result}", processor_chain([ - dup30, - dup22, - dup107, - dup23, - ])); - - var msg572 = msg("SNMPD_TRAP_GEN_FAILURE2", part595); - - var part596 = match("MESSAGE#567:SNMPD_TRAP_INVALID_DATA", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{result->} (%{dclass_counter2}) received", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP INVALID DATA"), - dup23, - ])); - - var msg573 = msg("SNMPD_TRAP_INVALID_DATA", part596); - - var part597 = match("MESSAGE#568:SNMPD_TRAP_NOT_ENOUGH_VARBINDS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{info->} (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP ERROR"), - dup23, - ])); - - var msg574 = msg("SNMPD_TRAP_NOT_ENOUGH_VARBINDS", part597); - - var part598 = match("MESSAGE#569:SNMPD_TRAP_QUEUED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Adding trap to %{dclass_counter2->} to %{obj_name->} queue, %{dclass_counter1->} traps in queue", processor_chain([ - dup21, - dup22, - setc("event_description","Adding trap to queue"), - dup23, - ])); - - var msg575 = msg("SNMPD_TRAP_QUEUED", part598); - - var part599 = match("MESSAGE#570:SNMPD_TRAP_QUEUE_DRAINED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: traps queued to %{obj_name->} sent successfully", processor_chain([ - dup21, - dup22, - setc("event_description","traps queued - sent successfully"), - dup23, - ])); - - var msg576 = msg("SNMPD_TRAP_QUEUE_DRAINED", part599); - - var part600 = match("MESSAGE#571:SNMPD_TRAP_QUEUE_MAX_ATTEMPTS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: after %{dclass_counter1->} attempts, deleting %{dclass_counter2->} traps queued to %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP QUEUE MAX_ATTEMPTS - deleting some traps"), - dup23, - ])); - - var msg577 = msg("SNMPD_TRAP_QUEUE_MAX_ATTEMPTS", part600); - - var part601 = match("MESSAGE#572:SNMPD_TRAP_QUEUE_MAX_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: maximum queue size exceeded (%{dclass_counter1}), discarding trap to %{dclass_counter2->} from %{obj_name->} queue", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP maximum queue size exceeded"), - dup23, - ])); - - var msg578 = msg("SNMPD_TRAP_QUEUE_MAX_SIZE", part601); - - var part602 = match("MESSAGE#573:SNMPD_TRAP_THROTTLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: traps throttled after %{dclass_counter1->} traps", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP traps throttled"), - dup23, - ])); - - var msg579 = msg("SNMPD_TRAP_THROTTLED", part602); - - var part603 = match("MESSAGE#574:SNMPD_TRAP_TYPE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unknown trap type requested (%{obj_type->} )", processor_chain([ - dup30, - dup22, - setc("event_description","unknown SNMP trap type requested"), - dup23, - ])); - - var msg580 = msg("SNMPD_TRAP_TYPE_ERROR", part603); - - var part604 = match("MESSAGE#575:SNMPD_TRAP_VARBIND_TYPE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: expecting %{dclass_counter1->} varbind to be VT_NUMBER (%{resultcode->} )", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP VARBIND TYPE ERROR"), - dup23, - ])); - - var msg581 = msg("SNMPD_TRAP_VARBIND_TYPE_ERROR", part604); - - var part605 = match("MESSAGE#576:SNMPD_TRAP_VERSION_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: invalid version signature (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP ERROR - invalid version signature"), - dup23, - ])); - - var msg582 = msg("SNMPD_TRAP_VERSION_ERROR", part605); - - var part606 = match("MESSAGE#577:SNMPD_TRAP_WARM_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap: warm start", processor_chain([ - dup21, - dup22, - setc("event_description","SNMPD TRAP WARM START"), - dup23, - ])); - - var msg583 = msg("SNMPD_TRAP_WARM_START", part606); - - var part607 = match("MESSAGE#578:SNMPD_USER_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} user '%{username}' %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD USER ERROR"), - dup23, - ])); - - var msg584 = msg("SNMPD_USER_ERROR", part607); - - var part608 = match("MESSAGE#579:SNMPD_VIEW_DELETE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: deleting view %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP deleting view"), - dup23, - ])); - - var msg585 = msg("SNMPD_VIEW_DELETE", part608); - - var part609 = match("MESSAGE#580:SNMPD_VIEW_INSTALL_DEFAULT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} installing default %{dclass_counter1->} view %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","installing default SNMP view"), - dup23, - ])); - - var msg586 = msg("SNMPD_VIEW_INSTALL_DEFAULT", part609); - - var part610 = match("MESSAGE#581:SNMPD_VIEW_OID_PARSE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: oid parsing failed for view %{dclass_counter2->} oid %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","oid parsing failed for SNMP view"), - dup23, - ])); - - var msg587 = msg("SNMPD_VIEW_OID_PARSE", part610); - - var part611 = match("MESSAGE#582:SNMP_GET_ERROR1", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP_GET_ERROR 1"), - dup23, - ])); - - var msg588 = msg("SNMP_GET_ERROR1", part611); - - var part612 = match("MESSAGE#583:SNMP_GET_ERROR2", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 2"), - dup23, - ])); - - var msg589 = msg("SNMP_GET_ERROR2", part612); - - var part613 = match("MESSAGE#584:SNMP_GET_ERROR3", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 3"), - dup23, - ])); - - var msg590 = msg("SNMP_GET_ERROR3", part613); - - var part614 = match("MESSAGE#585:SNMP_GET_ERROR4", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 4"), - dup23, - ])); - - var msg591 = msg("SNMP_GET_ERROR4", part614); - - var part615 = match("MESSAGE#586:SNMP_RTSLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: rtslib-error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP RTSLIB FAILURE"), - dup23, - ])); - - var msg592 = msg("SNMP_RTSLIB_FAILURE", part615); - - var part616 = match("MESSAGE#587:SNMP_TRAP_LINK_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifIndex %{dclass_counter1}, ifAdminStatus %{resultcode}, ifOperStatus %{result}, ifName %{interface}", processor_chain([ - dup30, - dup22, - dup108, - dup23, - ])); - - var msg593 = msg("SNMP_TRAP_LINK_DOWN", part616); - - var part617 = match("MESSAGE#596:SNMP_TRAP_LINK_DOWN:01", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} snmp-interface-index=\"%{fld1}\" admin-status=\"%{fld3}\" operational-status=\"%{fld2}\" interface-name=\"%{interface}\"]", processor_chain([ - dup30, - dup22, - dup108, - dup61, - dup62, - ])); - - var msg594 = msg("SNMP_TRAP_LINK_DOWN:01", part617); - - var select55 = linear_select([ - msg593, - msg594, - ]); - - var part618 = match("MESSAGE#588:SNMP_TRAP_LINK_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifIndex %{dclass_counter1}, ifAdminStatus %{resultcode}, ifOperStatus %{result}, ifName %{interface}", processor_chain([ - dup21, - dup22, - dup109, - dup23, - ])); - - var msg595 = msg("SNMP_TRAP_LINK_UP", part618); - - var part619 = match("MESSAGE#597:SNMP_TRAP_LINK_UP:01", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} snmp-interface-index=\"%{fld1}\" admin-status=\"%{fld3}\" operational-status=\"%{event_state}\" interface-name=\"%{interface}\"]", processor_chain([ - dup21, - dup22, - dup109, - dup61, - dup62, - ])); - - var msg596 = msg("SNMP_TRAP_LINK_UP:01", part619); - - var select56 = linear_select([ - msg595, - msg596, - ]); - - var part620 = match("MESSAGE#589:SNMP_TRAP_PING_PROBE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP PING PROBE FAILED"), - dup23, - ])); - - var msg597 = msg("SNMP_TRAP_PING_PROBE_FAILED", part620); - - var part621 = match("MESSAGE#590:SNMP_TRAP_PING_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP PING TEST COMPLETED"), - dup23, - ])); - - var msg598 = msg("SNMP_TRAP_PING_TEST_COMPLETED", part621); - - var part622 = match("MESSAGE#591:SNMP_TRAP_PING_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP PING TEST FAILED"), - dup23, - ])); - - var msg599 = msg("SNMP_TRAP_PING_TEST_FAILED", part622); - - var part623 = match("MESSAGE#592:SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE PATH CHANGE"), - dup23, - ])); - - var msg600 = msg("SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE", part623); - - var part624 = match("MESSAGE#593:SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE TEST COMPLETED"), - dup23, - ])); - - var msg601 = msg("SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED", part624); - - var part625 = match("MESSAGE#594:SNMP_TRAP_TRACE_ROUTE_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE TEST FAILED"), - dup23, - ])); - - var msg602 = msg("SNMP_TRAP_TRACE_ROUTE_TEST_FAILED", part625); - - var part626 = match("MESSAGE#598:SSHD_LOGIN_FAILED", "nwparser.payload", "%{process}: %{event_type}: Login failed for user '%{username}' from host '%{saddr}'", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup110, - dup23, - ])); - - var msg603 = msg("SSHD_LOGIN_FAILED", part626); - - var part627 = match("MESSAGE#599:SSHD_LOGIN_FAILED:01", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} username=\"%{username}\" source-address=\"%{saddr}\"]", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup110, - dup61, - dup52, - setf("process","hfld33"), - ])); - - var msg604 = msg("SSHD_LOGIN_FAILED:01", part627); - - var select57 = linear_select([ - msg603, - msg604, - ]); - - var part628 = match("MESSAGE#600:task_connect", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: task %{agent->} addr %{daddr}+%{dport}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","task connect failure"), - dup23, - ])); - - var msg605 = msg("task_connect", part628); - - var msg606 = msg("TASK_TASK_REINIT", dup149); - - var part629 = match("MESSAGE#602:TFTPD_AF_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected address family %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected address family"), - dup23, - ])); - - var msg607 = msg("TFTPD_AF_ERR", part629); - - var part630 = match("MESSAGE#603:TFTPD_BIND_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: bind: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD BIND ERROR"), - dup23, - ])); - - var msg608 = msg("TFTPD_BIND_ERR", part630); - - var part631 = match("MESSAGE#604:TFTPD_CONNECT_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: connect: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD CONNECT ERROR"), - dup23, - ])); - - var msg609 = msg("TFTPD_CONNECT_ERR", part631); - - var part632 = match("MESSAGE#605:TFTPD_CONNECT_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: TFTP %{protocol->} from address %{daddr->} port %{dport->} file %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD CONNECT INFO"), - dup23, - ])); - - var msg610 = msg("TFTPD_CONNECT_INFO", part632); - - var part633 = match("MESSAGE#606:TFTPD_CREATE_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: check_space %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD CREATE ERROR"), - dup23, - ])); - - var msg611 = msg("TFTPD_CREATE_ERR", part633); - - var part634 = match("MESSAGE#607:TFTPD_FIO_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD FIO ERR"), - dup23, - ])); - - var msg612 = msg("TFTPD_FIO_ERR", part634); - - var part635 = match("MESSAGE#608:TFTPD_FORK_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: fork: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD FORK ERROR"), - dup23, - ])); - - var msg613 = msg("TFTPD_FORK_ERR", part635); - - var part636 = match("MESSAGE#609:TFTPD_NAK_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: nak error %{resultcode}, %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD NAK ERROR"), - dup23, - ])); - - var msg614 = msg("TFTPD_NAK_ERR", part636); - - var part637 = match("MESSAGE#610:TFTPD_OPEN_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open file '%{filename}', error: %{result}", processor_chain([ - dup30, - dup22, - dup78, - dup23, - ])); - - var msg615 = msg("TFTPD_OPEN_ERR", part637); - - var part638 = match("MESSAGE#611:TFTPD_RECVCOMPLETE_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received %{dclass_counter1->} blocks of %{dclass_counter2->} size for file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD RECVCOMPLETE INFO"), - dup23, - ])); - - var msg616 = msg("TFTPD_RECVCOMPLETE_INFO", part638); - - var part639 = match("MESSAGE#612:TFTPD_RECVFROM_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: recvfrom: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD RECVFROM ERROR"), - dup23, - ])); - - var msg617 = msg("TFTPD_RECVFROM_ERR", part639); - - var part640 = match("MESSAGE#613:TFTPD_RECV_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: recv: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD RECV ERROR"), - dup23, - ])); - - var msg618 = msg("TFTPD_RECV_ERR", part640); - - var part641 = match("MESSAGE#614:TFTPD_SENDCOMPLETE_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Sent %{dclass_counter1->} blocks of %{dclass_counter2->} and %{info->} for file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD SENDCOMPLETE INFO"), - dup23, - ])); - - var msg619 = msg("TFTPD_SENDCOMPLETE_INFO", part641); - - var part642 = match("MESSAGE#615:TFTPD_SEND_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: send: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD SEND ERROR"), - dup23, - ])); - - var msg620 = msg("TFTPD_SEND_ERR", part642); - - var part643 = match("MESSAGE#616:TFTPD_SOCKET_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: socket: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD SOCKET ERROR"), - dup23, - ])); - - var msg621 = msg("TFTPD_SOCKET_ERR", part643); - - var part644 = match("MESSAGE#617:TFTPD_STATFS_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: statfs %{agent}, error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD STATFS ERROR"), - dup23, - ])); - - var msg622 = msg("TFTPD_STATFS_ERR", part644); - - var part645 = match("MESSAGE#618:TNP", "nwparser.payload", "%{process}: %{event_type}: adding neighbor %{dclass_counter1->} to interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","adding neighbor to interface"), - dup23, - ])); - - var msg623 = msg("TNP", part645); - - var part646 = match("MESSAGE#619:trace_on", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: tracing to %{fld33->} started", processor_chain([ - dup21, - dup22, - setc("event_description","tracing to file"), - dup23, - call({ - dest: "nwparser.filename", - fn: RMQ, - args: [ - field("fld33"), - ], - }), - ])); - - var msg624 = msg("trace_on", part646); - - var part647 = match("MESSAGE#620:trace_rotate", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: rotating %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","trace rotating file"), - dup23, - ])); - - var msg625 = msg("trace_rotate", part647); - - var part648 = match("MESSAGE#621:transfer-file", "nwparser.payload", "%{process}: %{event_type}: Transferred %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","transfered file"), - dup23, - ])); - - var msg626 = msg("transfer-file", part648); - - var part649 = match("MESSAGE#622:ttloop", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer died: %{result}: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","ttloop - peer died"), - dup23, - ])); - - var msg627 = msg("ttloop", part649); - - var part650 = match("MESSAGE#623:UI_AUTH_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authenticated user '%{username}' at permission level '%{privilege}'", processor_chain([ - dup80, - dup34, - dup35, - dup37, - dup22, - setc("event_description","Authenticated user"), - dup23, - ])); - - var msg628 = msg("UI_AUTH_EVENT", part650); - - var part651 = match("MESSAGE#624:UI_AUTH_INVALID_CHALLENGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received invalid authentication challenge for user '%{username}': response", processor_chain([ - dup30, - dup22, - setc("event_description","Received invalid authentication challenge for user response"), - dup23, - ])); - - var msg629 = msg("UI_AUTH_INVALID_CHALLENGE", part651); - - var part652 = match("MESSAGE#625:UI_BOOTTIME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fetch boot time: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fetch boot time"), - dup23, - ])); - - var msg630 = msg("UI_BOOTTIME_FAILED", part652); - - var part653 = match("MESSAGE#626:UI_CFG_AUDIT_NEW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' %{dclass_counter2->} path unknown", processor_chain([ - dup30, - dup22, - setc("event_description","user path unknown"), - dup23, - ])); - - var msg631 = msg("UI_CFG_AUDIT_NEW", part653); - - var part654 = match("MESSAGE#627:UI_CFG_AUDIT_NEW:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' insert: [edit-config config %{filename->} security policies %{policyname}] %{info}", processor_chain([ - dup42, - dup22, - setc("event_description"," user Inserted Security Policies in config"), - dup23, - ])); - - var msg632 = msg("UI_CFG_AUDIT_NEW:01", part654); - - var select58 = linear_select([ - msg631, - msg632, - ]); - - var part655 = match("MESSAGE#628:UI_CFG_AUDIT_OTHER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' delete: [%{filename}]", processor_chain([ - dup21, - dup22, - setc("event_description","User deleted file"), - setc("action","delete"), - dup23, - ])); - - var msg633 = msg("UI_CFG_AUDIT_OTHER", part655); - - var part656 = match("MESSAGE#629:UI_CFG_AUDIT_OTHER:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' rollback: %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","User rollback file"), - dup23, - ])); - - var msg634 = msg("UI_CFG_AUDIT_OTHER:01", part656); - - var part657 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_0", "nwparser.p0", "\"%{info}\""); - - var select59 = linear_select([ - part657, - dup112, - ]); - - var all31 = all_match({ - processors: [ - dup111, - select59, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","User set"), - dup23, - ]), - }); - - var msg635 = msg("UI_CFG_AUDIT_OTHER:02", all31); - - var part658 = match("MESSAGE#631:UI_CFG_AUDIT_OTHER:03", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' replace: [edit-config config %{filename->} applications %{info}]", processor_chain([ - dup21, - dup22, - setc("event_description","User config replace"), - setc("action","replace"), - dup23, - ])); - - var msg636 = msg("UI_CFG_AUDIT_OTHER:03", part658); - - var part659 = match("MESSAGE#632:UI_CFG_AUDIT_OTHER:04", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' deactivate: [groups %{info}]", processor_chain([ - setc("eventcategory","1701070000"), - dup22, - setc("event_description","User deactivating group(s)"), - setc("action","deactivate"), - dup23, - ])); - - var msg637 = msg("UI_CFG_AUDIT_OTHER:04", part659); - - var part660 = match("MESSAGE#633:UI_CFG_AUDIT_OTHER:05", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' update: %{filename}", processor_chain([ - dup113, - dup22, - setc("event_description","User updates config file"), - setc("action","update"), - dup23, - ])); - - var msg638 = msg("UI_CFG_AUDIT_OTHER:05", part660); - - var select60 = linear_select([ - msg633, - msg634, - msg635, - msg636, - msg637, - msg638, - ]); - - var part661 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_0", "nwparser.p0", "\"%{change_old}\" %{p0}"); - - var select61 = linear_select([ - part661, - dup114, - ]); - - var all32 = all_match({ - processors: [ - dup111, - select61, - dup115, - ], - on_success: processor_chain([ - dup21, - dup22, - dup116, - dup23, - ]), - }); - - var msg639 = msg("UI_CFG_AUDIT_SET:01", all32); - - var part662 = match("MESSAGE#635:UI_CFG_AUDIT_SET:02/1_0", "nwparser.p0", "\"%{change_old->} %{p0}"); - - var select62 = linear_select([ - part662, - dup114, - ]); - - var all33 = all_match({ - processors: [ - dup111, - select62, - dup115, - ], - on_success: processor_chain([ - dup21, - dup22, - dup116, - dup23, - ]), - }); - - var msg640 = msg("UI_CFG_AUDIT_SET:02", all33); - - var part663 = match("MESSAGE#636:UI_CFG_AUDIT_SET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' replace: [edit-config config %{filename->} applications %{info}] \u003c\u003c%{disposition}> -> \"%{agent}\"", processor_chain([ - dup21, - dup22, - setc("event_description","User replace config application(s)"), - dup23, - ])); - - var msg641 = msg("UI_CFG_AUDIT_SET", part663); - - var select63 = linear_select([ - msg639, - msg640, - msg641, - ]); - - var part664 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/2", "nwparser.p0", ": [groups %{info->} secret]"); - - var all34 = all_match({ - processors: [ - dup117, - dup156, - part664, - ], - on_success: processor_chain([ - dup113, - dup22, - dup120, - dup23, - ]), - }); - - var msg642 = msg("UI_CFG_AUDIT_SET_SECRET:01", all34); - - var part665 = match("MESSAGE#638:UI_CFG_AUDIT_SET_SECRET:02/2", "nwparser.p0", ": [%{info}]"); - - var all35 = all_match({ - processors: [ - dup117, - dup156, - part665, - ], - on_success: processor_chain([ - dup113, - dup22, - dup120, - dup23, - ]), - }); - - var msg643 = msg("UI_CFG_AUDIT_SET_SECRET:02", all35); - - var part666 = match("MESSAGE#639:UI_CFG_AUDIT_SET_SECRET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' %{dclass_counter2->} %{directory}", processor_chain([ - dup21, - dup22, - setc("event_description","UI CFG AUDIT SET SECRET"), - dup23, - ])); - - var msg644 = msg("UI_CFG_AUDIT_SET_SECRET", part666); - - var select64 = linear_select([ - msg642, - msg643, - msg644, - ]); - - var part667 = match("MESSAGE#640:UI_CHILD_ARGS_EXCEEDED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Too many arguments for child process '%{agent}'", processor_chain([ - dup30, - dup22, - setc("event_description","Too many arguments for child process"), - dup23, - ])); - - var msg645 = msg("UI_CHILD_ARGS_EXCEEDED", part667); - - var part668 = match("MESSAGE#641:UI_CHILD_CHANGE_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to switch to local user: %{username}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to switch to local user"), - dup23, - ])); - - var msg646 = msg("UI_CHILD_CHANGE_USER", part668); - - var part669 = match("MESSAGE#642:UI_CHILD_EXEC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exec failed for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Child exec failed"), - dup23, - ])); - - var msg647 = msg("UI_CHILD_EXEC", part669); - - var part670 = match("MESSAGE#643:UI_CHILD_EXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exited: PID %{child_pid}, status %{result}, command '%{action}'", processor_chain([ - dup30, - dup22, - setc("event_description","Child exited"), - dup23, - ])); - - var msg648 = msg("UI_CHILD_EXITED", part670); - - var part671 = match("MESSAGE#644:UI_CHILD_FOPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to append to log '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to append to log"), - dup23, - ])); - - var msg649 = msg("UI_CHILD_FOPEN", part671); - - var part672 = match("MESSAGE#645:UI_CHILD_PIPE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipe for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create pipe for command"), - dup23, - ])); - - var msg650 = msg("UI_CHILD_PIPE_FAILED", part672); - - var part673 = match("MESSAGE#646:UI_CHILD_SIGNALED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child received signal: PID %{child_pid}, signal %{result}: %{resultcode}, command='%{action}'", processor_chain([ - dup21, - dup22, - dup61, - setc("event_description","Child received signal"), - dup23, - ])); - - var msg651 = msg("UI_CHILD_SIGNALED", part673); - - var part674 = match("MESSAGE#647:UI_CHILD_STOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child stopped: PID %{child_pid}, signal=%{resultcode->} command='%{action}')", processor_chain([ - dup21, - dup22, - setc("event_description","Child stopped"), - dup23, - ])); - - var msg652 = msg("UI_CHILD_STOPPED", part674); - - var part675 = match("MESSAGE#648:UI_CHILD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Starting child '%{agent}'", processor_chain([ - dup21, - dup22, - setc("event_description","Starting child"), - dup23, - ])); - - var msg653 = msg("UI_CHILD_START", part675); - - var part676 = match("MESSAGE#649:UI_CHILD_STATUS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Cleanup child '%{agent}', PID %{child_pid}, status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Cleanup child"), - dup23, - ])); - - var msg654 = msg("UI_CHILD_STATUS", part676); - - var part677 = match("MESSAGE#650:UI_CHILD_WAITPID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: waitpid failed: PID %{child_pid}, rc %{dclass_counter2}, status %{resultcode}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","waitpid failed"), - dup23, - ])); - - var msg655 = msg("UI_CHILD_WAITPID", part677); - - var part678 = match("MESSAGE#651:UI_CLI_IDLE_TIMEOUT", "nwparser.payload", "%{event_type}: Idle timeout for user '%{username}' exceeded and %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Idle timeout for user exceeded"), - dup23, - ])); - - var msg656 = msg("UI_CLI_IDLE_TIMEOUT", part678); - - var part679 = match("MESSAGE#652:UI_CMDLINE_READ_LINE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}', command '%{action}'", processor_chain([ - dup21, - dup22, - dup121, - dup23, - ])); - - var msg657 = msg("UI_CMDLINE_READ_LINE", part679); - - var part680 = match("MESSAGE#653:UI_CMDSET_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command execution failed for '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Command execution failed"), - dup23, - ])); - - var msg658 = msg("UI_CMDSET_EXEC_FAILED", part680); - - var part681 = match("MESSAGE#654:UI_CMDSET_FORK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fork command '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fork command"), - dup23, - ])); - - var msg659 = msg("UI_CMDSET_FORK_FAILED", part681); - - var msg660 = msg("UI_CMDSET_PIPE_FAILED", dup144); - - var part682 = match("MESSAGE#656:UI_CMDSET_STOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command stopped: PID %{child_pid}, signal '%{resultcode}, command '%{action}'", processor_chain([ - dup30, - dup22, - dup70, - dup23, - ])); - - var msg661 = msg("UI_CMDSET_STOPPED", part682); - - var part683 = match("MESSAGE#657:UI_CMDSET_WEXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command exited: PID %{child_pid}, status %{resultcode}, command '%{action}'", processor_chain([ - dup30, - dup22, - dup72, - dup23, - ])); - - var msg662 = msg("UI_CMDSET_WEXITED", part683); - - var part684 = match("MESSAGE#658:UI_CMD_AUTH_REGEX_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid '%{action}' command authorization regular expression '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Invalid regexp command"), - dup23, - ])); - - var msg663 = msg("UI_CMD_AUTH_REGEX_INVALID", part684); - - var part685 = match("MESSAGE#659:UI_COMMIT/1_0", "nwparser.p0", "requested '%{action}' operation (comment:%{info})"); - - var part686 = match("MESSAGE#659:UI_COMMIT/1_1", "nwparser.p0", "performed %{action}"); - - var select65 = linear_select([ - part685, - part686, - ]); - - var all36 = all_match({ - processors: [ - dup117, - select65, - ], - on_success: processor_chain([ - dup21, - dup22, - dup122, - dup23, - ]), - }); - - var msg664 = msg("UI_COMMIT", all36); - - var part687 = match("MESSAGE#660:UI_COMMIT_AT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{result}", processor_chain([ - dup21, - dup22, - dup122, - dup23, - ])); - - var msg665 = msg("UI_COMMIT_AT", part687); - - var part688 = match("MESSAGE#661:UI_COMMIT_AT_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: '%{agent}' was successful", processor_chain([ - dup21, - dup22, - setc("event_description","User commit successful"), - dup23, - ])); - - var msg666 = msg("UI_COMMIT_AT_COMPLETED", part688); - - var part689 = match("MESSAGE#662:UI_COMMIT_AT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}, %{info}", processor_chain([ - dup30, - dup22, - setc("event_description","User commit failed"), - dup23, - ])); - - var msg667 = msg("UI_COMMIT_AT_FAILED", part689); - - var part690 = match("MESSAGE#663:UI_COMMIT_COMPRESS_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to compress file %{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to compress file"), - dup23, - ])); - - var msg668 = msg("UI_COMMIT_COMPRESS_FAILED", part690); - - var part691 = match("MESSAGE#664:UI_COMMIT_CONFIRMED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed '%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","UI COMMIT CONFIRMED"), - dup23, - ])); - - var msg669 = msg("UI_COMMIT_CONFIRMED", part691); - - var part692 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: '%{action}' must be confirmed within %{p0}"); - - var part693 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/1_0", "nwparser.p0", "minutes %{dclass_counter1}"); - - var part694 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/1_1", "nwparser.p0", "%{dclass_counter1->} minutes"); - - var select66 = linear_select([ - part693, - part694, - ]); - - var all37 = all_match({ - processors: [ - part692, - select66, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT must be confirmed within # minutes"), - dup23, - ]), - }); - - var msg670 = msg("UI_COMMIT_CONFIRMED_REMINDER", all37); - - var part695 = match("MESSAGE#666:UI_COMMIT_CONFIRMED_TIMED/2", "nwparser.p0", "'%{username}' performed '%{action}'"); - - var all38 = all_match({ - processors: [ - dup50, - dup145, - part695, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","user performed commit confirm"), - dup23, - ]), - }); - - var msg671 = msg("UI_COMMIT_CONFIRMED_TIMED", all38); - - var part696 = match("MESSAGE#667:UI_COMMIT_EMPTY_CONTAINER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Skipped empty object %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Skipped empty object"), - dup23, - ])); - - var msg672 = msg("UI_COMMIT_EMPTY_CONTAINER", part696); - - var part697 = match("MESSAGE#668:UI_COMMIT_NOT_CONFIRMED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Commit was not confirmed; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","COMMIT NOT CONFIRMED"), - dup23, - ])); - - var msg673 = msg("UI_COMMIT_NOT_CONFIRMED", part697); - - var part698 = match("MESSAGE#669:UI_COMMIT_PROGRESS/1_0", "nwparser.p0", "commit %{p0}"); - - var part699 = match("MESSAGE#669:UI_COMMIT_PROGRESS/1_1", "nwparser.p0", "Commit operation in progress %{p0}"); - - var select67 = linear_select([ - part698, - part699, - ]); - - var part700 = match("MESSAGE#669:UI_COMMIT_PROGRESS/2", "nwparser.p0", ": %{action}"); - - var all39 = all_match({ - processors: [ - dup50, - select67, - part700, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","Commit operation in progress"), - dup23, - ]), - }); - - var msg674 = msg("UI_COMMIT_PROGRESS", all39); - - var part701 = match("MESSAGE#670:UI_COMMIT_QUIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT QUIT"), - dup23, - ])); - - var msg675 = msg("UI_COMMIT_QUIT", part701); - - var part702 = match("MESSAGE#671:UI_COMMIT_ROLLBACK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Automatic rollback failed", processor_chain([ - dup30, - dup22, - setc("event_description","Automatic rollback failed"), - dup23, - ])); - - var msg676 = msg("UI_COMMIT_ROLLBACK_FAILED", part702); - - var part703 = match("MESSAGE#672:UI_COMMIT_SYNC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT SYNC"), - dup23, - ])); - - var msg677 = msg("UI_COMMIT_SYNC", part703); - - var part704 = match("MESSAGE#673:UI_COMMIT_SYNC_FORCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: All logins to local configuration database were terminated because %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","All logins to local configuration database were terminated"), - dup23, - ])); - - var msg678 = msg("UI_COMMIT_SYNC_FORCE", part704); - - var part705 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process: %{agent}, path: %{p0}"); - - var part706 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/1_0", "nwparser.p0", "[%{filename}], %{p0}"); - - var part707 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/1_1", "nwparser.p0", "%{filename}, %{p0}"); - - var select68 = linear_select([ - part706, - part707, - ]); - - var part708 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/2", "nwparser.p0", "statement: %{info->} %{p0}"); - - var part709 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/3_0", "nwparser.p0", ", error: %{result->} "); - - var select69 = linear_select([ - part709, - dup112, - ]); - - var all40 = all_match({ - processors: [ - part705, - select68, - part708, - select69, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","CONFIGURATION ERROR"), - dup23, - ]), - }); - - var msg679 = msg("UI_CONFIGURATION_ERROR", all40); - - var part710 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/2", "nwparser.p0", "socket connection accept failed: %{result}"); - - var all41 = all_match({ - processors: [ - dup50, - dup157, - part710, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","socket connection accept failed"), - dup23, - ]), - }); - - var msg680 = msg("UI_DAEMON_ACCEPT_FAILED", all41); - - var part711 = match("MESSAGE#676:UI_DAEMON_FORK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create session child: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create session child"), - dup23, - ])); - - var msg681 = msg("UI_DAEMON_FORK_FAILED", part711); - - var part712 = match("MESSAGE#677:UI_DAEMON_SELECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: select failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DAEMON SELECT FAILED"), - dup23, - ])); - - var msg682 = msg("UI_DAEMON_SELECT_FAILED", part712); - - var part713 = match("MESSAGE#678:UI_DAEMON_SOCKET_FAILED/2", "nwparser.p0", "socket create failed: %{result}"); - - var all42 = all_match({ - processors: [ - dup50, - dup157, - part713, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","socket create failed"), - dup23, - ]), - }); - - var msg683 = msg("UI_DAEMON_SOCKET_FAILED", all42); - - var part714 = match("MESSAGE#679:UI_DBASE_ACCESS_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to reaccess database file '%{filename}', address %{interface}, size %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to reaccess database file"), - dup23, - ])); - - var msg684 = msg("UI_DBASE_ACCESS_FAILED", part714); - - var part715 = match("MESSAGE#680:UI_DBASE_CHECKOUT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database '%{filename}' is out of data and needs to be rebuilt", processor_chain([ - dup30, - dup22, - setc("event_description","Database is out of data"), - dup23, - ])); - - var msg685 = msg("UI_DBASE_CHECKOUT_FAILED", part715); - - var part716 = match("MESSAGE#681:UI_DBASE_EXTEND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to extend database file '%{filename}' to size %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to extend database file"), - dup23, - ])); - - var msg686 = msg("UI_DBASE_EXTEND_FAILED", part716); - - var part717 = match("MESSAGE#682:UI_DBASE_LOGIN_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' entering configuration mode", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","User entering configuration mode"), - dup23, - ])); - - var msg687 = msg("UI_DBASE_LOGIN_EVENT", part717); - - var part718 = match("MESSAGE#683:UI_DBASE_LOGOUT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{event_description}", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","User exiting configuration mode"), - dup23, - ])); - - var msg688 = msg("UI_DBASE_LOGOUT_EVENT", part718); - - var part719 = match("MESSAGE#684:UI_DBASE_MISMATCH_EXTENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header extent mismatch for file '%{agent}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header extent mismatch"), - dup23, - ])); - - var msg689 = msg("UI_DBASE_MISMATCH_EXTENT", part719); - - var part720 = match("MESSAGE#685:UI_DBASE_MISMATCH_MAJOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header major version number mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header major version number mismatch"), - dup23, - ])); - - var msg690 = msg("UI_DBASE_MISMATCH_MAJOR", part720); - - var part721 = match("MESSAGE#686:UI_DBASE_MISMATCH_MINOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header minor version number mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header minor version number mismatch"), - dup23, - ])); - - var msg691 = msg("UI_DBASE_MISMATCH_MINOR", part721); - - var part722 = match("MESSAGE#687:UI_DBASE_MISMATCH_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header sequence numbers mismatch for file '%{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Database header sequence numbers mismatch"), - dup23, - ])); - - var msg692 = msg("UI_DBASE_MISMATCH_SEQUENCE", part722); - - var part723 = match("MESSAGE#688:UI_DBASE_MISMATCH_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header size mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header size mismatch"), - dup23, - ])); - - var msg693 = msg("UI_DBASE_MISMATCH_SIZE", part723); - - var part724 = match("MESSAGE#689:UI_DBASE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database open failed for file '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Database open failed"), - dup23, - ])); - - var msg694 = msg("UI_DBASE_OPEN_FAILED", part724); - - var part725 = match("MESSAGE#690:UI_DBASE_REBUILD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} Automatic rebuild of the database '%{filename}' failed", processor_chain([ - dup30, - dup22, - setc("event_description","DBASE REBUILD FAILED"), - dup23, - ])); - - var msg695 = msg("UI_DBASE_REBUILD_FAILED", part725); - - var part726 = match("MESSAGE#691:UI_DBASE_REBUILD_SCHEMA_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Automatic rebuild of the database failed", processor_chain([ - dup30, - dup22, - setc("event_description","Automatic rebuild of the database failed"), - dup23, - ])); - - var msg696 = msg("UI_DBASE_REBUILD_SCHEMA_FAILED", part726); - - var part727 = match("MESSAGE#692:UI_DBASE_REBUILD_STARTED/1_1", "nwparser.p0", "Automatic %{p0}"); - - var select70 = linear_select([ - dup76, - part727, - ]); - - var part728 = match("MESSAGE#692:UI_DBASE_REBUILD_STARTED/2", "nwparser.p0", "%{username->} rebuild/rollback of the database '%{filename}' started"); - - var all43 = all_match({ - processors: [ - dup50, - select70, - part728, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","DBASE REBUILD STARTED"), - dup23, - ]), - }); - - var msg697 = msg("UI_DBASE_REBUILD_STARTED", all43); - - var part729 = match("MESSAGE#693:UI_DBASE_RECREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' attempting database re-creation", processor_chain([ - dup21, - dup22, - setc("event_description","user attempting database re-creation"), - dup23, - ])); - - var msg698 = msg("UI_DBASE_RECREATE", part729); - - var part730 = match("MESSAGE#694:UI_DBASE_REOPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reopen of the database failed", processor_chain([ - dup30, - dup22, - setc("event_description","Reopen of the database failed"), - dup23, - ])); - - var msg699 = msg("UI_DBASE_REOPEN_FAILED", part730); - - var part731 = match("MESSAGE#695:UI_DUPLICATE_UID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Users %{username->} have the same UID %{uid}", processor_chain([ - dup30, - dup22, - setc("event_description","Users have the same UID"), - dup23, - ])); - - var msg700 = msg("UI_DUPLICATE_UID", part731); - - var part732 = match("MESSAGE#696:UI_JUNOSCRIPT_CMD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' used JUNOScript client to run command '%{action}'", processor_chain([ - setc("eventcategory","1401050100"), - dup22, - setc("event_description","User used JUNOScript client to run command"), - dup23, - ])); - - var msg701 = msg("UI_JUNOSCRIPT_CMD", part732); - - var part733 = match("MESSAGE#697:UI_JUNOSCRIPT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: JUNOScript error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JUNOScript error"), - dup23, - ])); - - var msg702 = msg("UI_JUNOSCRIPT_ERROR", part733); - - var part734 = match("MESSAGE#698:UI_LOAD_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' is performing a '%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","User command"), - dup23, - ])); - - var msg703 = msg("UI_LOAD_EVENT", part734); - - var part735 = match("MESSAGE#699:UI_LOAD_JUNOS_DEFAULT_FILE_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Loading the default config from %{filename}", processor_chain([ - setc("eventcategory","1701040000"), - dup22, - setc("event_description","Loading default config from file"), - dup23, - ])); - - var msg704 = msg("UI_LOAD_JUNOS_DEFAULT_FILE_EVENT", part735); - - var part736 = match("MESSAGE#700:UI_LOGIN_EVENT:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' login, class '%{group}' [%{fld01}], %{info->} '%{saddr->} %{sport->} %{daddr->} %{dport}', client-mode '%{fld02}'", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - dup127, - dup128, - dup23, - ])); - - var msg705 = msg("UI_LOGIN_EVENT:01", part736); - - var part737 = match("MESSAGE#701:UI_LOGIN_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' login, class '%{group}' %{info}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - dup127, - dup23, - ])); - - var msg706 = msg("UI_LOGIN_EVENT", part737); - - var select71 = linear_select([ - msg705, - msg706, - ]); - - var part738 = match("MESSAGE#702:UI_LOGOUT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' logout", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","User logout"), - dup23, - ])); - - var msg707 = msg("UI_LOGOUT_EVENT", part738); - - var part739 = match("MESSAGE#703:UI_LOST_CONN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Lost connection to daemon %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","Lost connection to daemon"), - dup23, - ])); - - var msg708 = msg("UI_LOST_CONN", part739); - - var part740 = match("MESSAGE#704:UI_MASTERSHIP_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} by '%{username}'", processor_chain([ - dup21, - dup22, - setc("event_description","MASTERSHIP EVENT"), - dup23, - ])); - - var msg709 = msg("UI_MASTERSHIP_EVENT", part740); - - var part741 = match("MESSAGE#705:UI_MGD_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Terminating operation: exit status %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","Terminating operation"), - dup23, - ])); - - var msg710 = msg("UI_MGD_TERMINATE", part741); - - var part742 = match("MESSAGE#706:UI_NETCONF_CMD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' used NETCONF client to run command '%{action}'", processor_chain([ - dup29, - dup22, - setc("event_description","User used NETCONF client to run command"), - dup23, - ])); - - var msg711 = msg("UI_NETCONF_CMD", part742); - - var part743 = match("MESSAGE#707:UI_READ_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: read failed for peer %{hostname}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","read failed for peer"), - dup23, - ])); - - var msg712 = msg("UI_READ_FAILED", part743); - - var part744 = match("MESSAGE#708:UI_READ_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Timeout on read of peer %{hostname}", processor_chain([ - dup30, - dup22, - setc("event_description","Timeout on read of peer"), - dup23, - ])); - - var msg713 = msg("UI_READ_TIMEOUT", part744); - - var part745 = match("MESSAGE#709:UI_REBOOT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: System %{action->} by '%{username}'", processor_chain([ - dup60, - dup22, - setc("event_description","System reboot or halt"), - dup23, - ])); - - var msg714 = msg("UI_REBOOT_EVENT", part745); - - var part746 = match("MESSAGE#710:UI_RESTART_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' restarting daemon %{service}", processor_chain([ - dup29, - dup22, - setc("event_description","user restarting daemon"), - dup23, - ])); - - var msg715 = msg("UI_RESTART_EVENT", part746); - - var part747 = match("MESSAGE#711:UI_SCHEMA_CHECKOUT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema is out of date and %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema is out of date"), - dup23, - ])); - - var msg716 = msg("UI_SCHEMA_CHECKOUT_FAILED", part747); - - var part748 = match("MESSAGE#712:UI_SCHEMA_MISMATCH_MAJOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema major version mismatch for package %{filename->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema major version mismatch"), - dup23, - ])); - - var msg717 = msg("UI_SCHEMA_MISMATCH_MAJOR", part748); - - var part749 = match("MESSAGE#713:UI_SCHEMA_MISMATCH_MINOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema minor version mismatch for package %{filename->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema minor version mismatch"), - dup23, - ])); - - var msg718 = msg("UI_SCHEMA_MISMATCH_MINOR", part749); - - var part750 = match("MESSAGE#714:UI_SCHEMA_MISMATCH_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema header sequence numbers mismatch for package %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema header sequence numbers mismatch"), - dup23, - ])); - - var msg719 = msg("UI_SCHEMA_MISMATCH_SEQUENCE", part750); - - var part751 = match("MESSAGE#715:UI_SCHEMA_SEQUENCE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema sequence number mismatch", processor_chain([ - dup30, - dup22, - setc("event_description","Schema sequence number mismatch"), - dup23, - ])); - - var msg720 = msg("UI_SCHEMA_SEQUENCE_ERROR", part751); - - var part752 = match("MESSAGE#716:UI_SYNC_OTHER_RE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Configuration synchronization with remote Routing Engine %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Configuration synchronization with remote Routing Engine"), - dup23, - ])); - - var msg721 = msg("UI_SYNC_OTHER_RE", part752); - - var part753 = match("MESSAGE#717:UI_TACPLUS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: TACACS+ failure: %{result}", processor_chain([ - dup30, - dup22, - dup129, - dup23, - ])); - - var msg722 = msg("UI_TACPLUS_ERROR", part753); - - var part754 = match("MESSAGE#718:UI_VERSION_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fetch system version: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fetch system version"), - dup23, - ])); - - var msg723 = msg("UI_VERSION_FAILED", part754); - - var part755 = match("MESSAGE#719:UI_WRITE_RECONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Re-establishing connection to peer %{hostname}", processor_chain([ - dup21, - dup22, - setc("event_description","Re-establishing connection to peer"), - dup23, - ])); - - var msg724 = msg("UI_WRITE_RECONNECT", part755); - - var part756 = match("MESSAGE#720:VRRPD_NEWMASTER_TRAP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Interface %{interface->} (local addr: %{saddr}) is now master for %{username}", processor_chain([ - dup21, - dup22, - setc("event_description","Interface new master for User"), - dup23, - ])); - - var msg725 = msg("VRRPD_NEWMASTER_TRAP", part756); - - var part757 = match("MESSAGE#721:WEB_AUTH_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to authenticate %{obj_name->} (username %{c_username})", processor_chain([ - dup69, - dup34, - dup35, - dup43, - dup22, - setc("event_description","Unable to authenticate client"), - dup23, - ])); - - var msg726 = msg("WEB_AUTH_FAIL", part757); - - var part758 = match("MESSAGE#722:WEB_AUTH_SUCCESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authenticated %{agent->} client (username %{c_username})", processor_chain([ - dup80, - dup34, - dup35, - dup37, - dup22, - setc("event_description","Authenticated client"), - dup23, - ])); - - var msg727 = msg("WEB_AUTH_SUCCESS", part758); - - var part759 = match("MESSAGE#723:WEB_INTERFACE_UNAUTH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Web services request received from unauthorized interface %{interface}", processor_chain([ - setc("eventcategory","1001030300"), - dup22, - setc("event_description","web request from unauthorized interface"), - dup23, - ])); - - var msg728 = msg("WEB_INTERFACE_UNAUTH", part759); - - var part760 = match("MESSAGE#724:WEB_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to read from client: %{result}", processor_chain([ - dup74, - dup22, - setc("event_description","Unable to read from client"), - dup23, - ])); - - var msg729 = msg("WEB_READ", part760); - - var part761 = match("MESSAGE#725:WEBFILTER_REQUEST_NOT_CHECKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Error encountered: %{result}, failed to check request %{url}", processor_chain([ - setc("eventcategory","1204020100"), - dup22, - setc("event_description","failed to check web request"), - dup23, - ])); - - var msg730 = msg("WEBFILTER_REQUEST_NOT_CHECKED", part761); - - var part762 = match("MESSAGE#726:FLOW_REASSEMBLE_FAIL", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" destination-address=\"%{daddr}\" assembly-id=\"%{fld1}\"]", processor_chain([ - dup74, - dup53, - dup43, - dup22, - dup52, - ])); - - var msg731 = msg("FLOW_REASSEMBLE_FAIL", part762); - - var part763 = match("MESSAGE#727:eswd", "nwparser.payload", "%{process}[%{process_id}]: Bridge Address: add %{macaddr}", processor_chain([ - dup29, - dup22, - setc("event_description","Bridge Address"), - dup23, - ])); - - var msg732 = msg("eswd", part763); - - var part764 = match("MESSAGE#728:eswd:01", "nwparser.payload", "%{process}[%{process_id}]: %{info}: STP state for interface %{interface->} context id %{id->} changed from %{fld3}", processor_chain([ - dup29, - dup22, - setc("event_description","ESWD STP State Change Info"), - dup23, - ])); - - var msg733 = msg("eswd:01", part764); - - var select72 = linear_select([ - msg732, - msg733, - ]); - - var part765 = match("MESSAGE#729:/usr/sbin/cron", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) CMD ( %{action})", processor_chain([ - dup29, - dup22, - dup26, - dup23, - ])); - - var msg734 = msg("/usr/sbin/cron", part765); - - var part766 = match("MESSAGE#730:chassism:02", "nwparser.payload", "%{process}[%{process_id}]: %{info}: ifd %{interface->} %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","Link status change event"), - dup23, - ])); - - var msg735 = msg("chassism:02", part766); - - var part767 = match("MESSAGE#731:chassism:01", "nwparser.payload", "%{process}[%{process_id}]: %{info}: %{interface}, %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","ifd process flaps"), - dup23, - ])); - - var msg736 = msg("chassism:01", part767); - - var part768 = match("MESSAGE#732:chassism", "nwparser.payload", "%{process}[%{process_id}]: %{info}: %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","IFCM "), - dup23, - ])); - - var msg737 = msg("chassism", part768); - - var select73 = linear_select([ - msg735, - msg736, - msg737, - ]); - - var msg738 = msg("WEBFILTER_URL_PERMITTED", dup158); - - var part769 = match("MESSAGE#734:WEBFILTER_URL_PERMITTED:01", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg739 = msg("WEBFILTER_URL_PERMITTED:01", part769); - - var part770 = match("MESSAGE#735:WEBFILTER_URL_PERMITTED:03", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=%{fld4}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg740 = msg("WEBFILTER_URL_PERMITTED:03", part770); - - var part771 = match("MESSAGE#736:WEBFILTER_URL_PERMITTED:02", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=%{url}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg741 = msg("WEBFILTER_URL_PERMITTED:02", part771); - - var select74 = linear_select([ - msg738, - msg739, - msg740, - msg741, - ]); - - var msg742 = msg("WEBFILTER_URL_BLOCKED", dup158); - - var part772 = match("MESSAGE#738:WEBFILTER_URL_BLOCKED:01", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg743 = msg("WEBFILTER_URL_BLOCKED:01", part772); - - var select75 = linear_select([ - msg742, - msg743, - ]); - - var part773 = match("MESSAGE#740:SECINTEL_NETWORK_CONNECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> Access url %{url->} on port %{network_port->} failed\u003c\u003c%{result}>.", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg744 = msg("SECINTEL_NETWORK_CONNECT_FAILED", part773); - - var part774 = match("MESSAGE#741:AAMWD_NETWORK_CONNECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> Access host %{hostname->} on ip %{hostip->} port %{network_port->} %{result}.", processor_chain([ - dup46, - dup47, - dup23, - ])); - - var msg745 = msg("AAMWD_NETWORK_CONNECT_FAILED", part774); - - var part775 = match("MESSAGE#742:PKID_UNABLE_TO_GET_CRL", "nwparser.payload", "%{process}[%{process_id}]: %{id}: Failed to retrieve CRL from received file for %{node}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg746 = msg("PKID_UNABLE_TO_GET_CRL", part775); - - var part776 = match("MESSAGE#743:SECINTEL_ERROR_OTHERS", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> %{result}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg747 = msg("SECINTEL_ERROR_OTHERS", part776); - - var part777 = match("MESSAGE#744:JSRPD_HA_CONTROL_LINK_UP", "nwparser.payload", "%{process}[%{process_id}]: %{id}: HA control link monitor status is marked up", processor_chain([ - dup48, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg748 = msg("JSRPD_HA_CONTROL_LINK_UP", part777); - - var part778 = match("MESSAGE#745:LACPD_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: LACPD_TIMEOUT: %{sinterface}: %{event_description}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg749 = msg("LACPD_TIMEOUT", part778); - - var msg750 = msg("cli", dup159); - - var msg751 = msg("pfed", dup159); - - var msg752 = msg("idpinfo", dup159); - - var msg753 = msg("kmd", dup159); - - var part779 = match("MESSAGE#751:node:01", "nwparser.payload", "%{hostname->} %{node->} Next-hop resolution requests from interface %{interface->} throttled", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg754 = msg("node:01", part779); - - var part780 = match("MESSAGE#752:node:02", "nwparser.payload", "%{hostname->} %{node->} %{process}: Trying peer connection, status %{resultcode}, attempt %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg755 = msg("node:02", part780); - - var part781 = match("MESSAGE#753:node:03", "nwparser.payload", "%{hostname->} %{node->} %{process}: trying master connection, status %{resultcode}, attempt %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg756 = msg("node:03", part781); - - var part782 = match("MESSAGE#754:node:04", "nwparser.payload", "%{hostname->} %{node->} %{fld1->} key %{fld2->} %{fld3->} port priority %{fld6->} %{fld4->} port %{portname->} %{fld5->} state %{resultcode}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg757 = msg("node:04", part782); - - var select76 = linear_select([ - dup131, - dup132, - ]); - - var part783 = match("MESSAGE#755:node:05/2", "nwparser.p0", "%{}sys priority %{fld4->} %{p0}"); - - var select77 = linear_select([ - dup132, - dup131, - ]); - - var part784 = match("MESSAGE#755:node:05/4", "nwparser.p0", "%{}sys %{interface}"); - - var all44 = all_match({ - processors: [ - dup130, - select76, - part783, - select77, - part784, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg758 = msg("node:05", all44); - - var part785 = match("MESSAGE#756:node:06/1_0", "nwparser.p0", "dst mac %{dinterface}"); - - var part786 = match("MESSAGE#756:node:06/1_1", "nwparser.p0", "src mac %{sinterface->} ether type %{fld1}"); - - var select78 = linear_select([ - part785, - part786, - ]); - - var all45 = all_match({ - processors: [ - dup130, - select78, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg759 = msg("node:06", all45); - - var part787 = match("MESSAGE#757:node:07", "nwparser.payload", "%{hostname->} %{node->} %{process}: interface %{interface->} trigger reth_scan", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg760 = msg("node:07", part787); - - var part788 = match("MESSAGE#758:node:08", "nwparser.payload", "%{hostname->} %{node->} %{process}: %{info}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg761 = msg("node:08", part788); - - var part789 = match("MESSAGE#759:node:09", "nwparser.payload", "%{hostname->} %{node->} %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg762 = msg("node:09", part789); - - var select79 = linear_select([ - msg754, - msg755, - msg756, - msg757, - msg758, - msg759, - msg760, - msg761, - msg762, - ]); - - var part790 = match("MESSAGE#760:(FPC:01", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: deleting active remote neighbor entry %{fld2->} from interface %{interface}.", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg763 = msg("(FPC:01", part790); - - var part791 = match("MESSAGE#761:(FPC:02", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type->} deleting nb %{fld2->} on ifd %{interface->} for cid %{fld3->} from active neighbor table", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg764 = msg("(FPC:02", part791); - - var part792 = match("MESSAGE#762:(FPC:03/0", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: M%{p0}"); - - var part793 = match("MESSAGE#762:(FPC:03/1_0", "nwparser.p0", "DOWN %{p0}"); - - var part794 = match("MESSAGE#762:(FPC:03/1_1", "nwparser.p0", "UP %{p0}"); - - var select80 = linear_select([ - part793, - part794, - ]); - - var part795 = match("MESSAGE#762:(FPC:03/2", "nwparser.p0", "received for interface %{interface}, member of %{fld4}"); - - var all46 = all_match({ - processors: [ - part792, - select80, - part795, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - dup24, - ]), - }); - - var msg765 = msg("(FPC:03", all46); - - var part796 = match("MESSAGE#763:(FPC:04", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: ifd=%{interface}, ifd flags=%{fld2}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg766 = msg("(FPC:04", part796); - - var part797 = match("MESSAGE#764:(FPC:05", "nwparser.payload", "%{fld1}) %{node->} kernel: rdp keepalive expired, connection dropped - src %{fld3}:%{fld2->} dest %{fld4}:%{fld5}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg767 = msg("(FPC:05", part797); - - var part798 = match("MESSAGE#765:(FPC", "nwparser.payload", "%{fld1}) %{node->} %{fld10}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg768 = msg("(FPC", part798); - - var select81 = linear_select([ - msg763, - msg764, - msg765, - msg766, - msg767, - msg768, - ]); - - var part799 = match("MESSAGE#766:tnp.bootpd", "nwparser.payload", "%{process}[%{process_id}]:%{fld1}", processor_chain([ - dup48, - dup23, - dup22, - dup24, - ])); - - var msg769 = msg("tnp.bootpd", part799); - - var part800 = match("MESSAGE#769:AAMW_ACTION_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} hostname=\"%{hostname}\" file-category=\"%{fld9}\" verdict-number=\"%{fld10}\" action=\"%{action}\" list-hit=\"%{fld19}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" application=\"%{fld6}\" nested-application=\"%{fld7}\" policy-name=\"%{policyname}\" username=\"%{username}\" roles=\"%{user_role}\" session-id-32=\"%{sessionid}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" url=\"%{url}\"] %{fld27}", processor_chain([ - dup48, - dup52, - dup22, - dup61, - ])); - - var msg770 = msg("AAMW_ACTION_LOG", part800); - - var part801 = match("MESSAGE#770:AAMW_HOST_INFECTED_EVENT_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} timestamp=\"%{fld30}\" tenant-id=\"%{fld1}\" client-ip-str=\"%{hostip}\" hostname=\"%{hostname}\" status=\"%{fld13}\" policy-name=\"%{policyname}\" verdict-number=\"%{fld15}\" state=\"%{fld16}\" reason=\"%{result}\" message=\"%{info}\" %{fld3}", processor_chain([ - dup133, - dup52, - dup22, - dup61, - ])); - - var msg771 = msg("AAMW_HOST_INFECTED_EVENT_LOG", part801); - - var part802 = match("MESSAGE#771:AAMW_MALWARE_EVENT_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} timestamp=\"%{fld30}\" tenant-id=\"%{fld1}\" sample-sha256=\"%{checksum}\" client-ip-str=\"%{hostip}\" verdict-number=\"%{fld26}\" malware-info=\"%{threat_name}\" username=\"%{username}\" hostname=\"%{hostname}\" %{fld3}", processor_chain([ - dup133, - dup52, - dup22, - ])); - - var msg772 = msg("AAMW_MALWARE_EVENT_LOG", part802); - - var part803 = match("MESSAGE#772:IDP_ATTACK_LOG_EVENT", "nwparser.payload", "%{event_type}[junos@%{fld32->} epoch-time=\"%{fld1}\" message-type=\"%{info}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-name=\"%{protocol}\" service-name=\"%{service}\" application-name=\"%{application}\" rule-name=\"%{fld5}\" rulebase-name=\"%{rulename}\" policy-name=\"%{policyname}\" export-id=\"%{fld6}\" repeat-count=\"%{fld7}\" action=\"%{action}\" threat-severity=\"%{severity}\" attack-name=\"%{threat_name}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" elapsed-time=%{fld8->} inbound-bytes=\"%{rbytes}\" outbound-bytes=\"%{sbytes}\" inbound-packets=\"%{packets}\" outbound-packets=\"%{dclass_counter1}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" packet-log-id=\"%{fld9}\" alert=\"%{fld19}\" username=\"%{username}\" roles=\"%{fld15}\" message=\"%{fld28}\" %{fld3}", processor_chain([ - dup81, - dup52, - dup22, - dup61, - ])); - - var msg773 = msg("IDP_ATTACK_LOG_EVENT", part803); - - var part804 = match("MESSAGE#773:RT_SCREEN_ICMP", "nwparser.payload", "%{event_type}[junos@%{fld32->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"] %{fld23}", processor_chain([ - dup81, - dup52, - dup22, - dup61, - ])); - - var msg774 = msg("RT_SCREEN_ICMP", part804); - - var part805 = match("MESSAGE#774:SECINTEL_ACTION_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} category=\"%{fld1}\" sub-category=\"%{fld2}\" action=\"%{action}\" action-detail=\"%{fld4}\" http-host=\"%{fld17}\" threat-severity=\"%{severity}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" application=\"%{fld5}\" nested-application=\"%{fld6}\" feed-name=\"%{fld18}\" policy-name=\"%{policyname}\" profile-name=\"%{rulename}\" username=\"%{username}\" roles=\"%{user_role}\" session-id-32=\"%{sessionid}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\"]%{fld10}", processor_chain([ - dup46, - dup52, - dup22, - dup61, - ])); - - var msg775 = msg("SECINTEL_ACTION_LOG", part805); - - var part806 = match("MESSAGE#775:qsfp/0", "nwparser.payload", "%{hostname->} %{fld2->} %{p0}"); - - var part807 = match("MESSAGE#775:qsfp/1_0", "nwparser.p0", "%{fld3->} %{process}: qsfp-%{p0}"); - - var part808 = match("MESSAGE#775:qsfp/1_1", "nwparser.p0", "qsfp-%{p0}"); - - var select82 = linear_select([ - part807, - part808, - ]); - - var part809 = match("MESSAGE#775:qsfp/2", "nwparser.p0", "%{}Chan# %{interface->} %{fld5}:%{event_description}"); - - var all47 = all_match({ - processors: [ - part806, - select82, - part809, - ], - on_success: processor_chain([ - dup21, - dup22, - dup23, - ]), - }); - - var msg776 = msg("qsfp", all47); - - var part810 = match("MESSAGE#776:JUNOSROUTER_GENERIC:03", "nwparser.payload", "%{event_type}: User '%{username}', command '%{action}'", processor_chain([ - dup21, - dup22, - dup121, - dup23, - ])); - - var msg777 = msg("JUNOSROUTER_GENERIC:03", part810); - - var part811 = match("MESSAGE#777:JUNOSROUTER_GENERIC:04", "nwparser.payload", "%{event_type}: User '%{username}' %{fld1}", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","LOGOUT"), - dup23, - ])); - - var msg778 = msg("JUNOSROUTER_GENERIC:04", part811); - - var part812 = match("MESSAGE#778:JUNOSROUTER_GENERIC:05", "nwparser.payload", "%{event_type}: TACACS+ failure: %{result}", processor_chain([ - dup30, - dup22, - dup129, - dup23, - ])); - - var msg779 = msg("JUNOSROUTER_GENERIC:05", part812); - - var part813 = match("MESSAGE#779:JUNOSROUTER_GENERIC:06", "nwparser.payload", "%{event_type}: mismatch NLRI with %{hostip->} (%{hostname}): peer: %{daddr->} us: %{saddr}", processor_chain([ - dup30, - dup22, - dup57, - dup23, - ])); - - var msg780 = msg("JUNOSROUTER_GENERIC:06", part813); - - var part814 = match("MESSAGE#780:JUNOSROUTER_GENERIC:07", "nwparser.payload", "%{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{resultcode->} (%{action}), Reason: %{result}", processor_chain([ - dup21, - dup22, - dup38, - dup23, - ])); - - var msg781 = msg("JUNOSROUTER_GENERIC:07", part814); - - var part815 = match("MESSAGE#781:JUNOSROUTER_GENERIC:08/0", "nwparser.payload", "%{event_type}: NOTIFICATION received from %{daddr->} (%{dhost}): code %{resultcode->} (%{action})%{p0}"); - - var part816 = match("MESSAGE#781:JUNOSROUTER_GENERIC:08/1_0", "nwparser.p0", ", socket buffer sndcc: %{fld1->} rcvcc: %{fld2->} TCP state: %{event_state}, snd_una: %{fld3->} snd_nxt: %{fld4->} snd_wnd: %{fld5->} rcv_nxt: %{fld6->} rcv_adv: %{fld7}, hold timer %{fld8}"); - - var part817 = match_copy("MESSAGE#781:JUNOSROUTER_GENERIC:08/1_1", "nwparser.p0", ""); - - var select83 = linear_select([ - part816, - part817, - ]); - - var all48 = all_match({ - processors: [ - part815, - select83, - ], - on_success: processor_chain([ - dup21, - dup22, - dup38, - dup23, - ]), - }); - - var msg782 = msg("JUNOSROUTER_GENERIC:08", all48); - - var part818 = match("MESSAGE#782:JUNOSROUTER_GENERIC:09", "nwparser.payload", "%{event_type}: [edit interfaces%{interface}unit%{fld1}family inet address%{hostip}/%{network_port}] :%{event_description}:%{info}", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg783 = msg("JUNOSROUTER_GENERIC:09", part818); - - var part819 = match("MESSAGE#783:JUNOSROUTER_GENERIC:01", "nwparser.payload", "%{event_type->} Interface Monitor failed %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - setc("event_description","Interface Monitor failed "), - dup24, - ])); - - var msg784 = msg("JUNOSROUTER_GENERIC:01", part819); - - var part820 = match("MESSAGE#784:JUNOSROUTER_GENERIC:02", "nwparser.payload", "%{event_type->} Interface Monitor failure recovered %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - setc("event_description","Interface Monitor failure recovered"), - dup24, - ])); - - var msg785 = msg("JUNOSROUTER_GENERIC:02", part820); - - var part821 = match("MESSAGE#785:JUNOSROUTER_GENERIC", "nwparser.payload", "%{event_type->} %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - dup24, - ])); - - var msg786 = msg("JUNOSROUTER_GENERIC", part821); - - var select84 = linear_select([ - msg777, - msg778, - msg779, - msg780, - msg781, - msg782, - msg783, - msg784, - msg785, - msg786, - ]); - - var chain1 = processor_chain([ - select5, - msgid_select({ - "(FPC": select81, - "/usr/libexec/telnetd": msg2, - "/usr/sbin/cron": msg734, - "/usr/sbin/sshd": msg1, - "AAMWD_NETWORK_CONNECT_FAILED": msg745, - "AAMW_ACTION_LOG": msg770, - "AAMW_HOST_INFECTED_EVENT_LOG": msg771, - "AAMW_MALWARE_EVENT_LOG": msg772, - "ACCT_ACCOUNTING_FERROR": msg114, - "ACCT_ACCOUNTING_FOPEN_ERROR": msg115, - "ACCT_ACCOUNTING_SMALL_FILE_SIZE": msg116, - "ACCT_BAD_RECORD_FORMAT": msg117, - "ACCT_CU_RTSLIB_error": msg118, - "ACCT_GETHOSTNAME_error": msg119, - "ACCT_MALLOC_FAILURE": msg120, - "ACCT_UNDEFINED_COUNTER_NAME": msg121, - "ACCT_XFER_FAILED": msg122, - "ACCT_XFER_POPEN_FAIL": msg123, - "APPQOS_LOG_EVENT": msg124, - "APPTRACK_SESSION_CLOSE": select30, - "APPTRACK_SESSION_CREATE": msg125, - "APPTRACK_SESSION_VOL_UPDATE": select31, - "BCHIP": msg106, - "BFDD_TRAP_STATE_DOWN": msg130, - "BFDD_TRAP_STATE_UP": msg131, - "BOOTPD_ARG_ERR": msg143, - "BOOTPD_BAD_ID": msg144, - "BOOTPD_BOOTSTRING": msg145, - "BOOTPD_CONFIG_ERR": msg146, - "BOOTPD_CONF_OPEN": msg147, - "BOOTPD_DUP_REV": msg148, - "BOOTPD_DUP_SLOT": msg149, - "BOOTPD_MODEL_CHK": msg150, - "BOOTPD_MODEL_ERR": msg151, - "BOOTPD_NEW_CONF": msg152, - "BOOTPD_NO_BOOTSTRING": msg153, - "BOOTPD_NO_CONFIG": msg154, - "BOOTPD_PARSE_ERR": msg155, - "BOOTPD_REPARSE": msg156, - "BOOTPD_SELECT_ERR": msg157, - "BOOTPD_TIMEOUT": msg158, - "BOOTPD_VERSION": msg159, - "CHASSISD": msg160, - "CHASSISD_ARGUMENT_ERROR": msg161, - "CHASSISD_BLOWERS_SPEED": msg162, - "CHASSISD_BLOWERS_SPEED_FULL": msg163, - "CHASSISD_CB_READ": msg164, - "CHASSISD_COMMAND_ACK_ERROR": msg165, - "CHASSISD_COMMAND_ACK_SF_ERROR": msg166, - "CHASSISD_CONCAT_MODE_ERROR": msg167, - "CHASSISD_CONFIG_INIT_ERROR": msg168, - "CHASSISD_CONFIG_WARNING": msg169, - "CHASSISD_EXISTS": msg170, - "CHASSISD_EXISTS_TERM_OTHER": msg171, - "CHASSISD_FILE_OPEN": msg172, - "CHASSISD_FILE_STAT": msg173, - "CHASSISD_FRU_EVENT": msg174, - "CHASSISD_FRU_IPC_WRITE_ERROR_EXT": msg175, - "CHASSISD_FRU_STEP_ERROR": msg176, - "CHASSISD_GETTIMEOFDAY": msg177, - "CHASSISD_HIGH_TEMP_CONDITION": msg214, - "CHASSISD_HOST_TEMP_READ": msg178, - "CHASSISD_IFDEV_DETACH_ALL_PSEUDO": msg179, - "CHASSISD_IFDEV_DETACH_FPC": msg180, - "CHASSISD_IFDEV_DETACH_PIC": msg181, - "CHASSISD_IFDEV_DETACH_PSEUDO": msg182, - "CHASSISD_IFDEV_DETACH_TLV_ERROR": msg183, - "CHASSISD_IFDEV_GET_BY_INDEX_FAIL": msg184, - "CHASSISD_IPC_MSG_QFULL_ERROR": msg185, - "CHASSISD_IPC_UNEXPECTED_RECV": msg186, - "CHASSISD_IPC_WRITE_ERR_NO_PIPE": msg187, - "CHASSISD_IPC_WRITE_ERR_NULL_ARGS": msg188, - "CHASSISD_MAC_ADDRESS_ERROR": msg189, - "CHASSISD_MAC_DEFAULT": msg190, - "CHASSISD_MBUS_ERROR": msg191, - "CHASSISD_PARSE_COMPLETE": msg192, - "CHASSISD_PARSE_ERROR": msg193, - "CHASSISD_PARSE_INIT": msg194, - "CHASSISD_PIDFILE_OPEN": msg195, - "CHASSISD_PIPE_WRITE_ERROR": msg196, - "CHASSISD_POWER_CHECK": msg197, - "CHASSISD_RECONNECT_SUCCESSFUL": msg198, - "CHASSISD_RELEASE_MASTERSHIP": msg199, - "CHASSISD_RE_INIT_INVALID_RE_SLOT": msg200, - "CHASSISD_ROOT_MOUNT_ERROR": msg201, - "CHASSISD_RTS_SEQ_ERROR": msg202, - "CHASSISD_SBOARD_VERSION_MISMATCH": msg203, - "CHASSISD_SERIAL_ID": msg204, - "CHASSISD_SMB_ERROR": msg205, - "CHASSISD_SNMP_TRAP10": msg208, - "CHASSISD_SNMP_TRAP6": msg206, - "CHASSISD_SNMP_TRAP7": msg207, - "CHASSISD_TERM_SIGNAL": msg209, - "CHASSISD_TRACE_PIC_OFFLINE": msg210, - "CHASSISD_UNEXPECTED_EXIT": msg211, - "CHASSISD_UNSUPPORTED_MODEL": msg212, - "CHASSISD_VERSION_MISMATCH": msg213, - "CM": msg107, - "CM_JAVA": msg216, - "COS": msg108, - "COSFPC": msg109, - "COSMAN": msg110, - "CRON": msg16, - "CROND": select11, - "Cmerror": msg17, - "DCD_AS_ROOT": msg217, - "DCD_FILTER_LIB_ERROR": msg218, - "DCD_MALLOC_FAILED_INIT": msg219, - "DCD_PARSE_EMERGENCY": msg220, - "DCD_PARSE_FILTER_EMERGENCY": msg221, - "DCD_PARSE_MINI_EMERGENCY": msg222, - "DCD_PARSE_STATE_EMERGENCY": msg223, - "DCD_POLICER_PARSE_EMERGENCY": msg224, - "DCD_PULL_LOG_FAILURE": msg225, - "DFWD_ARGUMENT_ERROR": msg226, - "DFWD_MALLOC_FAILED_INIT": msg227, - "DFWD_PARSE_FILTER_EMERGENCY": msg228, - "DFWD_PARSE_STATE_EMERGENCY": msg229, - "ECCD_DAEMONIZE_FAILED": msg230, - "ECCD_DUPLICATE": msg231, - "ECCD_LOOP_EXIT_FAILURE": msg232, - "ECCD_NOT_ROOT": msg233, - "ECCD_PCI_FILE_OPEN_FAILED": msg234, - "ECCD_PCI_READ_FAILED": msg235, - "ECCD_PCI_WRITE_FAILED": msg236, - "ECCD_PID_FILE_LOCK": msg237, - "ECCD_PID_FILE_UPDATE": msg238, - "ECCD_TRACE_FILE_OPEN_FAILED": msg239, - "ECCD_usage": msg240, - "EVENT": msg23, - "EVENTD_AUDIT_SHOW": msg241, - "FLOW_REASSEMBLE_FAIL": msg731, - "FLOW_REASSEMBLE_SUCCEED": msg242, - "FSAD_CHANGE_FILE_OWNER": msg243, - "FSAD_CONFIG_ERROR": msg244, - "FSAD_CONNTIMEDOUT": msg245, - "FSAD_FAILED": msg246, - "FSAD_FETCHTIMEDOUT": msg247, - "FSAD_FILE_FAILED": msg248, - "FSAD_FILE_REMOVE": msg249, - "FSAD_FILE_RENAME": msg250, - "FSAD_FILE_STAT": msg251, - "FSAD_FILE_SYNC": msg252, - "FSAD_MAXCONN": msg253, - "FSAD_MEMORYALLOC_FAILED": msg254, - "FSAD_NOT_ROOT": msg255, - "FSAD_PARENT_DIRECTORY": msg256, - "FSAD_PATH_IS_DIRECTORY": msg257, - "FSAD_PATH_IS_SPECIAL": msg258, - "FSAD_RECVERROR": msg259, - "FSAD_TERMINATED_CONNECTION": msg260, - "FSAD_TERMINATING_SIGNAL": msg261, - "FSAD_TRACEOPEN_FAILED": msg262, - "FSAD_USAGE": msg263, - "Failed": select25, - "GGSN_ALARM_TRAP_FAILED": msg264, - "GGSN_ALARM_TRAP_SEND": msg265, - "GGSN_TRAP_SEND": msg266, - "IDP_ATTACK_LOG_EVENT": msg773, - "JADE_AUTH_ERROR": msg267, - "JADE_EXEC_ERROR": msg268, - "JADE_NO_LOCAL_USER": msg269, - "JADE_PAM_ERROR": msg270, - "JADE_PAM_NO_LOCAL_USER": msg271, - "JSRPD_HA_CONTROL_LINK_UP": msg748, - "JUNOSROUTER_GENERIC": select84, - "KERN_ARP_ADDR_CHANGE": msg272, - "KMD_PM_SA_ESTABLISHED": msg273, - "L2CPD_TASK_REINIT": msg274, - "LACPD_TIMEOUT": msg749, - "LIBJNX_EXEC_EXITED": msg275, - "LIBJNX_EXEC_FAILED": msg276, - "LIBJNX_EXEC_PIPE": msg277, - "LIBJNX_EXEC_SIGNALED": msg278, - "LIBJNX_EXEC_WEXIT": msg279, - "LIBJNX_FILE_COPY_FAILED": msg280, - "LIBJNX_PRIV_LOWER_FAILED": msg281, - "LIBJNX_PRIV_RAISE_FAILED": msg282, - "LIBJNX_REPLICATE_RCP_EXEC_FAILED": msg283, - "LIBJNX_ROTATE_COMPRESS_EXEC_FAILED": msg284, - "LIBSERVICED_CLIENT_CONNECTION": msg285, - "LIBSERVICED_OUTBOUND_REQUEST": msg286, - "LIBSERVICED_SNMP_LOST_CONNECTION": msg287, - "LIBSERVICED_SOCKET_BIND": msg288, - "LIBSERVICED_SOCKET_PRIVATIZE": msg289, - "LICENSE_EXPIRED": msg290, - "LICENSE_EXPIRED_KEY_DELETED": msg291, - "LICENSE_NEARING_EXPIRY": msg292, - "LOGIN_ABORTED": msg293, - "LOGIN_FAILED": msg294, - "LOGIN_FAILED_INCORRECT_PASSWORD": msg295, - "LOGIN_FAILED_SET_CONTEXT": msg296, - "LOGIN_FAILED_SET_LOGIN": msg297, - "LOGIN_HOSTNAME_UNRESOLVED": msg298, - "LOGIN_INFORMATION": msg299, - "LOGIN_INVALID_LOCAL_USER": msg300, - "LOGIN_MALFORMED_USER": msg301, - "LOGIN_PAM_AUTHENTICATION_ERROR": msg302, - "LOGIN_PAM_ERROR": msg303, - "LOGIN_PAM_MAX_RETRIES": msg304, - "LOGIN_PAM_NONLOCAL_USER": msg305, - "LOGIN_PAM_STOP": msg306, - "LOGIN_PAM_USER_UNKNOWN": msg307, - "LOGIN_PASSWORD_EXPIRED": msg308, - "LOGIN_REFUSED": msg309, - "LOGIN_ROOT": msg310, - "LOGIN_TIMED_OUT": msg311, - "MIB2D_ATM_ERROR": msg312, - "MIB2D_CONFIG_CHECK_FAILED": msg313, - "MIB2D_FILE_OPEN_FAILURE": msg314, - "MIB2D_IFD_IFINDEX_FAILURE": msg315, - "MIB2D_IFL_IFINDEX_FAILURE": msg316, - "MIB2D_INIT_FAILURE": msg317, - "MIB2D_KVM_FAILURE": msg318, - "MIB2D_RTSLIB_READ_FAILURE": msg319, - "MIB2D_RTSLIB_SEQ_MISMATCH": msg320, - "MIB2D_SYSCTL_FAILURE": msg321, - "MIB2D_TRAP_HEADER_FAILURE": msg322, - "MIB2D_TRAP_SEND_FAILURE": msg323, - "MRVL-L2": msg56, - "Multiuser": msg324, - "NASD_AUTHENTICATION_CREATE_FAILED": msg325, - "NASD_CHAP_AUTHENTICATION_IN_PROGRESS": msg326, - "NASD_CHAP_GETHOSTNAME_FAILED": msg327, - "NASD_CHAP_INVALID_CHAP_IDENTIFIER": msg328, - "NASD_CHAP_INVALID_OPCODE": msg329, - "NASD_CHAP_LOCAL_NAME_UNAVAILABLE": msg330, - "NASD_CHAP_MESSAGE_UNEXPECTED": msg331, - "NASD_CHAP_REPLAY_ATTACK_DETECTED": msg332, - "NASD_CONFIG_GET_LAST_MODIFIED_FAILED": msg333, - "NASD_DAEMONIZE_FAILED": msg334, - "NASD_DB_ALLOC_FAILURE": msg335, - "NASD_DB_TABLE_CREATE_FAILURE": msg336, - "NASD_DUPLICATE": msg337, - "NASD_EVLIB_CREATE_FAILURE": msg338, - "NASD_EVLIB_EXIT_FAILURE": msg339, - "NASD_LOCAL_CREATE_FAILED": msg340, - "NASD_NOT_ROOT": msg341, - "NASD_PID_FILE_LOCK": msg342, - "NASD_PID_FILE_UPDATE": msg343, - "NASD_POST_CONFIGURE_EVENT_FAILED": msg344, - "NASD_PPP_READ_FAILURE": msg345, - "NASD_PPP_SEND_FAILURE": msg346, - "NASD_PPP_SEND_PARTIAL": msg347, - "NASD_PPP_UNRECOGNIZED": msg348, - "NASD_RADIUS_ALLOCATE_PASSWORD_FAILED": msg349, - "NASD_RADIUS_CONFIG_FAILED": msg350, - "NASD_RADIUS_CREATE_FAILED": msg351, - "NASD_RADIUS_CREATE_REQUEST_FAILED": msg352, - "NASD_RADIUS_GETHOSTNAME_FAILED": msg353, - "NASD_RADIUS_MESSAGE_UNEXPECTED": msg354, - "NASD_RADIUS_OPEN_FAILED": msg355, - "NASD_RADIUS_SELECT_FAILED": msg356, - "NASD_RADIUS_SET_TIMER_FAILED": msg357, - "NASD_TRACE_FILE_OPEN_FAILED": msg358, - "NASD_usage": msg359, - "NOTICE": msg360, - "PFEMAN": msg61, - "PFE_FW_SYSLOG_IP": select36, - "PFE_NH_RESOLVE_THROTTLED": msg363, - "PING_TEST_COMPLETED": msg364, - "PING_TEST_FAILED": msg365, - "PKID_UNABLE_TO_GET_CRL": msg746, - "PWC_EXIT": msg368, - "PWC_HOLD_RELEASE": msg369, - "PWC_INVALID_RUNS_ARGUMENT": msg370, - "PWC_INVALID_TIMEOUT_ARGUMENT": msg371, - "PWC_KILLED_BY_SIGNAL": msg372, - "PWC_KILL_EVENT": msg373, - "PWC_KILL_FAILED": msg374, - "PWC_KQUEUE_ERROR": msg375, - "PWC_KQUEUE_INIT": msg376, - "PWC_KQUEUE_REGISTER_FILTER": msg377, - "PWC_LOCKFILE_BAD_FORMAT": msg378, - "PWC_LOCKFILE_ERROR": msg379, - "PWC_LOCKFILE_MISSING": msg380, - "PWC_LOCKFILE_NOT_LOCKED": msg381, - "PWC_NO_PROCESS": msg382, - "PWC_PROCESS_EXIT": msg383, - "PWC_PROCESS_FORCED_HOLD": msg384, - "PWC_PROCESS_HOLD": msg385, - "PWC_PROCESS_HOLD_SKIPPED": msg386, - "PWC_PROCESS_OPEN": msg387, - "PWC_PROCESS_TIMED_HOLD": msg388, - "PWC_PROCESS_TIMEOUT": msg389, - "PWC_SIGNAL_INIT": msg390, - "PWC_SOCKET_CONNECT": msg391, - "PWC_SOCKET_CREATE": msg392, - "PWC_SOCKET_OPTION": msg393, - "PWC_STDOUT_WRITE": msg394, - "PWC_SYSTEM_CALL": msg395, - "PWC_UNKNOWN_KILL_OPTION": msg396, - "RDP": msg111, - "RMOPD_ADDRESS_MULTICAST_INVALID": msg397, - "RMOPD_ADDRESS_SOURCE_INVALID": msg398, - "RMOPD_ADDRESS_STRING_FAILURE": msg399, - "RMOPD_ADDRESS_TARGET_INVALID": msg400, - "RMOPD_DUPLICATE": msg401, - "RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED": msg402, - "RMOPD_ICMP_SENDMSG_FAILURE": msg403, - "RMOPD_IFINDEX_NOT_ACTIVE": msg404, - "RMOPD_IFINDEX_NO_INFO": msg405, - "RMOPD_IFNAME_NOT_ACTIVE": msg406, - "RMOPD_IFNAME_NO_INFO": msg407, - "RMOPD_NOT_ROOT": msg408, - "RMOPD_ROUTING_INSTANCE_NO_INFO": msg409, - "RMOPD_TRACEROUTE_ERROR": msg410, - "RMOPD_usage": msg411, - "RPD_ABORT": msg412, - "RPD_ACTIVE_TERMINATE": msg413, - "RPD_ASSERT": msg414, - "RPD_ASSERT_SOFT": msg415, - "RPD_EXIT": msg416, - "RPD_IFL_INDEXCOLLISION": msg417, - "RPD_IFL_NAMECOLLISION": msg418, - "RPD_ISIS_ADJDOWN": msg419, - "RPD_ISIS_ADJUP": msg420, - "RPD_ISIS_ADJUPNOIP": msg421, - "RPD_ISIS_LSPCKSUM": msg422, - "RPD_ISIS_OVERLOAD": msg423, - "RPD_KRT_AFUNSUPRT": msg424, - "RPD_KRT_CCC_IFL_MODIFY": msg425, - "RPD_KRT_DELETED_RTT": msg426, - "RPD_KRT_IFA_GENERATION": msg427, - "RPD_KRT_IFDCHANGE": msg428, - "RPD_KRT_IFDEST_GET": msg429, - "RPD_KRT_IFDGET": msg430, - "RPD_KRT_IFD_GENERATION": msg431, - "RPD_KRT_IFL_CELL_RELAY_MODE_INVALID": msg432, - "RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED": msg433, - "RPD_KRT_IFL_GENERATION": msg434, - "RPD_KRT_KERNEL_BAD_ROUTE": msg435, - "RPD_KRT_NEXTHOP_OVERFLOW": msg436, - "RPD_KRT_NOIFD": msg437, - "RPD_KRT_UNKNOWN_RTT": msg438, - "RPD_KRT_VERSION": msg439, - "RPD_KRT_VERSIONNONE": msg440, - "RPD_KRT_VERSIONOLD": msg441, - "RPD_LDP_INTF_BLOCKED": msg442, - "RPD_LDP_INTF_UNBLOCKED": msg443, - "RPD_LDP_NBRDOWN": msg444, - "RPD_LDP_NBRUP": msg445, - "RPD_LDP_SESSIONDOWN": msg446, - "RPD_LDP_SESSIONUP": msg447, - "RPD_LOCK_FLOCKED": msg448, - "RPD_LOCK_LOCKED": msg449, - "RPD_MPLS_LSP_CHANGE": msg450, - "RPD_MPLS_LSP_DOWN": msg451, - "RPD_MPLS_LSP_SWITCH": msg452, - "RPD_MPLS_LSP_UP": msg453, - "RPD_MSDP_PEER_DOWN": msg454, - "RPD_MSDP_PEER_UP": msg455, - "RPD_OSPF_NBRDOWN": msg456, - "RPD_OSPF_NBRUP": msg457, - "RPD_OS_MEMHIGH": msg458, - "RPD_PIM_NBRDOWN": msg459, - "RPD_PIM_NBRUP": msg460, - "RPD_RDISC_CKSUM": msg461, - "RPD_RDISC_NOMULTI": msg462, - "RPD_RDISC_NORECVIF": msg463, - "RPD_RDISC_SOLICITADDR": msg464, - "RPD_RDISC_SOLICITICMP": msg465, - "RPD_RDISC_SOLICITLEN": msg466, - "RPD_RIP_AUTH": msg467, - "RPD_RIP_JOIN_BROADCAST": msg468, - "RPD_RIP_JOIN_MULTICAST": msg469, - "RPD_RT_IFUP": msg470, - "RPD_SCHED_CALLBACK_LONGRUNTIME": msg471, - "RPD_SCHED_CUMULATIVE_LONGRUNTIME": msg472, - "RPD_SCHED_MODULE_LONGRUNTIME": msg473, - "RPD_SCHED_TASK_LONGRUNTIME": msg474, - "RPD_SIGNAL_TERMINATE": msg475, - "RPD_START": msg476, - "RPD_SYSTEM": msg477, - "RPD_TASK_BEGIN": msg478, - "RPD_TASK_CHILDKILLED": msg479, - "RPD_TASK_CHILDSTOPPED": msg480, - "RPD_TASK_FORK": msg481, - "RPD_TASK_GETWD": msg482, - "RPD_TASK_NOREINIT": msg483, - "RPD_TASK_PIDCLOSED": msg484, - "RPD_TASK_PIDFLOCK": msg485, - "RPD_TASK_PIDWRITE": msg486, - "RPD_TASK_REINIT": msg487, - "RPD_TASK_SIGNALIGNORE": msg488, - "RT_COS": msg489, - "RT_FLOW_SESSION_CLOSE": select51, - "RT_FLOW_SESSION_CREATE": select45, - "RT_FLOW_SESSION_DENY": select47, - "RT_SCREEN_ICMP": msg774, - "RT_SCREEN_IP": select52, - "RT_SCREEN_SESSION_LIMIT": msg504, - "RT_SCREEN_TCP": msg503, - "RT_SCREEN_UDP": msg505, - "Resolve": msg63, - "SECINTEL_ACTION_LOG": msg775, - "SECINTEL_ERROR_OTHERS": msg747, - "SECINTEL_NETWORK_CONNECT_FAILED": msg744, - "SERVICED_CLIENT_CONNECT": msg506, - "SERVICED_CLIENT_DISCONNECTED": msg507, - "SERVICED_CLIENT_ERROR": msg508, - "SERVICED_COMMAND_FAILED": msg509, - "SERVICED_COMMIT_FAILED": msg510, - "SERVICED_CONFIGURATION_FAILED": msg511, - "SERVICED_CONFIG_ERROR": msg512, - "SERVICED_CONFIG_FILE": msg513, - "SERVICED_CONNECTION_ERROR": msg514, - "SERVICED_DISABLED_GGSN": msg515, - "SERVICED_DUPLICATE": msg516, - "SERVICED_EVENT_FAILED": msg517, - "SERVICED_INIT_FAILED": msg518, - "SERVICED_MALLOC_FAILURE": msg519, - "SERVICED_NETWORK_FAILURE": msg520, - "SERVICED_NOT_ROOT": msg521, - "SERVICED_PID_FILE_LOCK": msg522, - "SERVICED_PID_FILE_UPDATE": msg523, - "SERVICED_RTSOCK_SEQUENCE": msg524, - "SERVICED_SIGNAL_HANDLER": msg525, - "SERVICED_SOCKET_CREATE": msg526, - "SERVICED_SOCKET_IO": msg527, - "SERVICED_SOCKET_OPTION": msg528, - "SERVICED_STDLIB_FAILURE": msg529, - "SERVICED_USAGE": msg530, - "SERVICED_WORK_INCONSISTENCY": msg531, - "SNMPD_ACCESS_GROUP_ERROR": msg537, - "SNMPD_AUTH_FAILURE": select53, - "SNMPD_AUTH_PRIVILEGES_EXCEEDED": msg542, - "SNMPD_AUTH_RESTRICTED_ADDRESS": msg543, - "SNMPD_AUTH_WRONG_PDU_TYPE": msg544, - "SNMPD_CONFIG_ERROR": msg545, - "SNMPD_CONTEXT_ERROR": msg546, - "SNMPD_ENGINE_FILE_FAILURE": msg547, - "SNMPD_ENGINE_PROCESS_ERROR": msg548, - "SNMPD_FILE_FAILURE": msg549, - "SNMPD_GROUP_ERROR": msg550, - "SNMPD_INIT_FAILED": msg551, - "SNMPD_LIBJUNIPER_FAILURE": msg552, - "SNMPD_LOOPBACK_ADDR_ERROR": msg553, - "SNMPD_MEMORY_FREED": msg554, - "SNMPD_RADIX_FAILURE": msg555, - "SNMPD_RECEIVE_FAILURE": msg556, - "SNMPD_RMONFILE_FAILURE": msg557, - "SNMPD_RMON_COOKIE": msg558, - "SNMPD_RMON_EVENTLOG": msg559, - "SNMPD_RMON_IOERROR": msg560, - "SNMPD_RMON_MIBERROR": msg561, - "SNMPD_RTSLIB_ASYNC_EVENT": msg562, - "SNMPD_SEND_FAILURE": select54, - "SNMPD_SOCKET_FAILURE": msg565, - "SNMPD_SUBAGENT_NO_BUFFERS": msg566, - "SNMPD_SUBAGENT_SEND_FAILED": msg567, - "SNMPD_SYSLIB_FAILURE": msg568, - "SNMPD_THROTTLE_QUEUE_DRAINED": msg569, - "SNMPD_TRAP_COLD_START": msg570, - "SNMPD_TRAP_GEN_FAILURE": msg571, - "SNMPD_TRAP_GEN_FAILURE2": msg572, - "SNMPD_TRAP_INVALID_DATA": msg573, - "SNMPD_TRAP_NOT_ENOUGH_VARBINDS": msg574, - "SNMPD_TRAP_QUEUED": msg575, - "SNMPD_TRAP_QUEUE_DRAINED": msg576, - "SNMPD_TRAP_QUEUE_MAX_ATTEMPTS": msg577, - "SNMPD_TRAP_QUEUE_MAX_SIZE": msg578, - "SNMPD_TRAP_THROTTLED": msg579, - "SNMPD_TRAP_TYPE_ERROR": msg580, - "SNMPD_TRAP_VARBIND_TYPE_ERROR": msg581, - "SNMPD_TRAP_VERSION_ERROR": msg582, - "SNMPD_TRAP_WARM_START": msg583, - "SNMPD_USER_ERROR": msg584, - "SNMPD_VIEW_DELETE": msg585, - "SNMPD_VIEW_INSTALL_DEFAULT": msg586, - "SNMPD_VIEW_OID_PARSE": msg587, - "SNMP_GET_ERROR1": msg588, - "SNMP_GET_ERROR2": msg589, - "SNMP_GET_ERROR3": msg590, - "SNMP_GET_ERROR4": msg591, - "SNMP_NS_LOG_INFO": msg535, - "SNMP_RTSLIB_FAILURE": msg592, - "SNMP_SUBAGENT_IPC_REG_ROWS": msg536, - "SNMP_TRAP_LINK_DOWN": select55, - "SNMP_TRAP_LINK_UP": select56, - "SNMP_TRAP_PING_PROBE_FAILED": msg597, - "SNMP_TRAP_PING_TEST_COMPLETED": msg598, - "SNMP_TRAP_PING_TEST_FAILED": msg599, - "SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE": msg600, - "SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED": msg601, - "SNMP_TRAP_TRACE_ROUTE_TEST_FAILED": msg602, - "SNTPD": msg112, - "SSB": msg113, - "SSHD_LOGIN_FAILED": select57, - "SSL_PROXY_SESSION_IGNORE": msg534, - "SSL_PROXY_SSL_SESSION_ALLOW": msg532, - "SSL_PROXY_SSL_SESSION_DROP": msg533, - "TASK_TASK_REINIT": msg606, - "TFTPD_AF_ERR": msg607, - "TFTPD_BIND_ERR": msg608, - "TFTPD_CONNECT_ERR": msg609, - "TFTPD_CONNECT_INFO": msg610, - "TFTPD_CREATE_ERR": msg611, - "TFTPD_FIO_ERR": msg612, - "TFTPD_FORK_ERR": msg613, - "TFTPD_NAK_ERR": msg614, - "TFTPD_OPEN_ERR": msg615, - "TFTPD_RECVCOMPLETE_INFO": msg616, - "TFTPD_RECVFROM_ERR": msg617, - "TFTPD_RECV_ERR": msg618, - "TFTPD_SENDCOMPLETE_INFO": msg619, - "TFTPD_SEND_ERR": msg620, - "TFTPD_SOCKET_ERR": msg621, - "TFTPD_STATFS_ERR": msg622, - "TNP": msg623, - "UI_AUTH_EVENT": msg628, - "UI_AUTH_INVALID_CHALLENGE": msg629, - "UI_BOOTTIME_FAILED": msg630, - "UI_CFG_AUDIT_NEW": select58, - "UI_CFG_AUDIT_OTHER": select60, - "UI_CFG_AUDIT_SET": select63, - "UI_CFG_AUDIT_SET_SECRET": select64, - "UI_CHILD_ARGS_EXCEEDED": msg645, - "UI_CHILD_CHANGE_USER": msg646, - "UI_CHILD_EXEC": msg647, - "UI_CHILD_EXITED": msg648, - "UI_CHILD_FOPEN": msg649, - "UI_CHILD_PIPE_FAILED": msg650, - "UI_CHILD_SIGNALED": msg651, - "UI_CHILD_START": msg653, - "UI_CHILD_STATUS": msg654, - "UI_CHILD_STOPPED": msg652, - "UI_CHILD_WAITPID": msg655, - "UI_CLI_IDLE_TIMEOUT": msg656, - "UI_CMDLINE_READ_LINE": msg657, - "UI_CMDSET_EXEC_FAILED": msg658, - "UI_CMDSET_FORK_FAILED": msg659, - "UI_CMDSET_PIPE_FAILED": msg660, - "UI_CMDSET_STOPPED": msg661, - "UI_CMDSET_WEXITED": msg662, - "UI_CMD_AUTH_REGEX_INVALID": msg663, - "UI_COMMIT": msg664, - "UI_COMMIT_AT": msg665, - "UI_COMMIT_AT_COMPLETED": msg666, - "UI_COMMIT_AT_FAILED": msg667, - "UI_COMMIT_COMPRESS_FAILED": msg668, - "UI_COMMIT_CONFIRMED": msg669, - "UI_COMMIT_CONFIRMED_REMINDER": msg670, - "UI_COMMIT_CONFIRMED_TIMED": msg671, - "UI_COMMIT_EMPTY_CONTAINER": msg672, - "UI_COMMIT_NOT_CONFIRMED": msg673, - "UI_COMMIT_PROGRESS": msg674, - "UI_COMMIT_QUIT": msg675, - "UI_COMMIT_ROLLBACK_FAILED": msg676, - "UI_COMMIT_SYNC": msg677, - "UI_COMMIT_SYNC_FORCE": msg678, - "UI_CONFIGURATION_ERROR": msg679, - "UI_DAEMON_ACCEPT_FAILED": msg680, - "UI_DAEMON_FORK_FAILED": msg681, - "UI_DAEMON_SELECT_FAILED": msg682, - "UI_DAEMON_SOCKET_FAILED": msg683, - "UI_DBASE_ACCESS_FAILED": msg684, - "UI_DBASE_CHECKOUT_FAILED": msg685, - "UI_DBASE_EXTEND_FAILED": msg686, - "UI_DBASE_LOGIN_EVENT": msg687, - "UI_DBASE_LOGOUT_EVENT": msg688, - "UI_DBASE_MISMATCH_EXTENT": msg689, - "UI_DBASE_MISMATCH_MAJOR": msg690, - "UI_DBASE_MISMATCH_MINOR": msg691, - "UI_DBASE_MISMATCH_SEQUENCE": msg692, - "UI_DBASE_MISMATCH_SIZE": msg693, - "UI_DBASE_OPEN_FAILED": msg694, - "UI_DBASE_REBUILD_FAILED": msg695, - "UI_DBASE_REBUILD_SCHEMA_FAILED": msg696, - "UI_DBASE_REBUILD_STARTED": msg697, - "UI_DBASE_RECREATE": msg698, - "UI_DBASE_REOPEN_FAILED": msg699, - "UI_DUPLICATE_UID": msg700, - "UI_JUNOSCRIPT_CMD": msg701, - "UI_JUNOSCRIPT_ERROR": msg702, - "UI_LOAD_EVENT": msg703, - "UI_LOAD_JUNOS_DEFAULT_FILE_EVENT": msg704, - "UI_LOGIN_EVENT": select71, - "UI_LOGOUT_EVENT": msg707, - "UI_LOST_CONN": msg708, - "UI_MASTERSHIP_EVENT": msg709, - "UI_MGD_TERMINATE": msg710, - "UI_NETCONF_CMD": msg711, - "UI_READ_FAILED": msg712, - "UI_READ_TIMEOUT": msg713, - "UI_REBOOT_EVENT": msg714, - "UI_RESTART_EVENT": msg715, - "UI_SCHEMA_CHECKOUT_FAILED": msg716, - "UI_SCHEMA_MISMATCH_MAJOR": msg717, - "UI_SCHEMA_MISMATCH_MINOR": msg718, - "UI_SCHEMA_MISMATCH_SEQUENCE": msg719, - "UI_SCHEMA_SEQUENCE_ERROR": msg720, - "UI_SYNC_OTHER_RE": msg721, - "UI_TACPLUS_ERROR": msg722, - "UI_VERSION_FAILED": msg723, - "UI_WRITE_RECONNECT": msg724, - "VRRPD_NEWMASTER_TRAP": msg725, - "Version": msg99, - "WEBFILTER_REQUEST_NOT_CHECKED": msg730, - "WEBFILTER_URL_BLOCKED": select75, - "WEBFILTER_URL_PERMITTED": select74, - "WEB_AUTH_FAIL": msg726, - "WEB_AUTH_SUCCESS": msg727, - "WEB_INTERFACE_UNAUTH": msg728, - "WEB_READ": msg729, - "alarmd": msg3, - "bgp_connect_start": msg132, - "bgp_event": msg133, - "bgp_listen_accept": msg134, - "bgp_listen_reset": msg135, - "bgp_nexthop_sanity": msg136, - "bgp_pp_recv": select33, - "bgp_process_caps": select32, - "bgp_send": msg141, - "bgp_traffic_timeout": msg142, - "bigd": select6, - "bigpipe": select7, - "bigstart": msg9, - "cgatool": msg10, - "chassisd": msg11, - "chassism": select73, - "checkd": select8, - "clean_process": msg215, - "cli": msg750, - "cosd": msg14, - "craftd": msg15, - "cron": msg18, - "crond": msg21, - "dcd": msg22, - "eswd": select72, - "ftpd": msg24, - "ha_rto_stats_handler": msg25, - "hostinit": msg26, - "idpinfo": msg752, - "ifinfo": select13, - "ifp_ifl_anydown_change_event": msg30, - "ifp_ifl_config_event": msg31, - "ifp_ifl_ext_chg": msg32, - "inetd": select14, - "init": select15, - "ipc_msg_write": msg40, - "kernel": select17, - "kmd": msg753, - "last": select28, - "login": select18, - "lsys_ssam_handler": msg53, - "mcsn": msg54, - "mgd": msg62, - "mrvl_dfw_log_effuse_status": msg55, - "node": select79, - "pfed": msg751, - "process_mode": select38, - "profile_ssam_handler": msg57, - "pst_nat_binding_set_profile": msg58, - "qsfp": msg776, - "respawn": msg64, - "root": msg65, - "rpd": select20, - "rshd": msg70, - "sfd": msg71, - "sshd": select21, - "syslogd": msg92, - "task_connect": msg605, - "task_reconfigure": msg59, - "tnetd": msg60, - "tnp.bootpd": msg769, - "trace_on": msg624, - "trace_rotate": msg625, - "transfer-file": msg626, - "ttloop": msg627, - "ucd-snmp": select26, - "usp_ipc_client_reconnect": msg95, - "usp_trace_ipc_disconnect": msg96, - "usp_trace_ipc_reconnect": msg97, - "uspinfo": msg98, - "xntpd": select27, - }), - ]); - - var hdr43 = match("HEADER#3:0004/0", "message", "%{month->} %{day->} %{time->} %{p0}"); - - var part822 = match("HEADER#3:0004/1_0", "nwparser.p0", "fpc0 %{p0}"); - - var part823 = match("HEADER#3:0004/1_1", "nwparser.p0", "fpc1 %{p0}"); - - var part824 = match("HEADER#3:0004/1_2", "nwparser.p0", "fpc2 %{p0}"); - - var part825 = match("HEADER#3:0004/1_3", "nwparser.p0", "fpc3 %{p0}"); - - var part826 = match("HEADER#3:0004/1_4", "nwparser.p0", "fpc4 %{p0}"); - - var part827 = match("HEADER#3:0004/1_5", "nwparser.p0", "fpc5 %{p0}"); - - var part828 = match("HEADER#3:0004/1_11", "nwparser.p0", "ssb %{p0}"); - - var part829 = match("HEADER#15:0026.upd.a/1_0", "nwparser.p0", "RT_FLOW - %{p0}"); - - var part830 = match("HEADER#15:0026.upd.a/1_1", "nwparser.p0", "junos-ssl-proxy - %{p0}"); - - var part831 = match("HEADER#15:0026.upd.a/1_2", "nwparser.p0", "RT_APPQOS - %{p0}"); - - var part832 = match("HEADER#15:0026.upd.a/1_3", "nwparser.p0", "%{hfld33->} - %{p0}"); - - var hdr44 = match("HEADER#16:0026.upd.b/0", "message", "%{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var part833 = match("MESSAGE#77:sshd:06/0", "nwparser.payload", "%{} %{p0}"); - - var part834 = match("MESSAGE#77:sshd:06/1_0", "nwparser.p0", "%{process}[%{process_id}]: %{p0}"); - - var part835 = match("MESSAGE#77:sshd:06/1_1", "nwparser.p0", "%{process}: %{p0}"); - - var part836 = match_copy("MESSAGE#72:Failed:05/1_2", "nwparser.p0", "p0"); - - var part837 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{p0}"); - - var part838 = match("MESSAGE#294:LOGIN_INFORMATION/3_0", "nwparser.p0", "User %{p0}"); - - var part839 = match("MESSAGE#294:LOGIN_INFORMATION/3_1", "nwparser.p0", "user %{p0}"); - - var part840 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var part841 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_0", "nwparser.p0", " connection-tag=%{fld20->} service-name=\"%{p0}"); - - var part842 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_1", "nwparser.p0", " service-name=\"%{p0}"); - - var part843 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/3_0", "nwparser.p0", " nat-connection-tag=%{fld6->} src-nat-rule-type=%{fld20->} %{p0}"); - - var part844 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_1", "nwparser.p0", "name=\"%{p0}"); - - var part845 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/8", "nwparser.p0", "]%{}"); - - var part846 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_0", "nwparser.payload", "%{process}: %{event_type}: session denied %{p0}"); - - var part847 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_1", "nwparser.payload", "%{event_type}: session denied %{p0}"); - - var part848 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var part849 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/2", "nwparser.p0", "%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var part850 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{rulename}\" dst-nat-rule-%{p0}"); - - var part851 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/5_0", "nwparser.p0", "type=%{fld7->} dst-nat-rule-name=\"%{p0}"); - - var part852 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/6", "nwparser.p0", "\"%{rule_template->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"%{p0}"); - - var part853 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\" encrypted=%{fld16->} %{p0}"); - - var part854 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' set: [%{action}] %{p0}"); - - var part855 = match_copy("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_1", "nwparser.p0", "space"); - - var part856 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_1", "nwparser.p0", "\u003c\u003c%{change_old}> %{p0}"); - - var part857 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/2", "nwparser.p0", "-> \"%{change_new}\""); - - var part858 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{p0}"); - - var part859 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_0", "nwparser.p0", "set %{p0}"); - - var part860 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_1", "nwparser.p0", "replace %{p0}"); - - var part861 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_0", "nwparser.p0", "Network %{p0}"); - - var part862 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_1", "nwparser.p0", "Local %{p0}"); - - var part863 = match("MESSAGE#755:node:05/0", "nwparser.payload", "%{hostname->} %{node->} %{p0}"); - - var part864 = match("MESSAGE#755:node:05/1_0", "nwparser.p0", "partner%{p0}"); - - var part865 = match("MESSAGE#755:node:05/1_1", "nwparser.p0", "actor%{p0}"); - - var select85 = linear_select([ - dup14, - dup15, - dup16, - dup17, - ]); - - var part866 = match("HEADER#15:0026.upd.a/2", "nwparser.p0", "%{messageid->} [%{p0}", processor_chain([ - dup13, - ])); - - var select86 = linear_select([ - dup40, - dup41, - ]); - - var part867 = match("MESSAGE#125:BFDD_TRAP_STATE_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: local discriminator: %{resultcode}, new state: %{result}", processor_chain([ - dup21, - dup22, - dup56, - dup23, - ])); - - var part868 = match("MESSAGE#214:DCD_MALLOC_FAILED_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed during initialization for configuration load", processor_chain([ - dup51, - dup22, - dup64, - dup23, - ])); - - var part869 = match("MESSAGE#225:ECCD_DAEMONIZE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}, unable to run in the background as a daemon: %{result}", processor_chain([ - dup30, - dup22, - dup65, - dup23, - ])); - - var part870 = match("MESSAGE#226:ECCD_DUPLICATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Another copy of this program is running", processor_chain([ - dup30, - dup22, - dup66, - dup23, - ])); - - var part871 = match("MESSAGE#232:ECCD_PID_FILE_LOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lock PID file: %{result}", processor_chain([ - dup30, - dup22, - dup67, - dup23, - ])); - - var part872 = match("MESSAGE#233:ECCD_PID_FILE_UPDATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to update process PID file: %{result}", processor_chain([ - dup30, - dup22, - dup68, - dup23, - ])); - - var part873 = match("MESSAGE#272:LIBJNX_EXEC_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipes for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - dup71, - dup23, - ])); - - var select87 = linear_select([ - dup76, - dup77, - ]); - - var part874 = match("MESSAGE#310:MIB2D_IFD_IFINDEX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP index assigned to %{uid->} changed from %{dclass_counter1->} to %{result}", processor_chain([ - dup30, - dup22, - dup79, - dup23, - ])); - - var part875 = match("MESSAGE#412:RPD_IFL_INDEXCOLLISION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Logical interface collision -- %{result}, %{info}", processor_chain([ - dup30, - dup22, - dup84, - dup23, - ])); - - var part876 = match("MESSAGE#466:RPD_SCHED_CALLBACK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime time during action of module", processor_chain([ - dup30, - dup22, - dup85, - dup23, - ])); - - var part877 = match("MESSAGE#482:RPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitializing", processor_chain([ - dup21, - dup22, - dup86, - dup23, - ])); - - var select88 = linear_select([ - dup88, - dup89, - ]); - - var select89 = linear_select([ - dup90, - dup45, - ]); - - var select90 = linear_select([ - dup95, - dup96, - ]); - - var select91 = linear_select([ - dup101, - dup91, - ]); - - var part878 = match("MESSAGE#498:RT_SCREEN_TCP", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var part879 = match("MESSAGE#527:SSL_PROXY_SSL_SESSION_ALLOW", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} logical-system-name=\"%{hostname}\" session-id=\"%{sessionid}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" profile-name=\"%{rulename}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" message=\"%{info}\"]", processor_chain([ - dup27, - dup22, - dup52, - ])); - - var select92 = linear_select([ - dup118, - dup119, - ]); - - var select93 = linear_select([ - dup123, - dup124, - ]); - - var part880 = match("MESSAGE#733:WEBFILTER_URL_PERMITTED", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7->} USERNAME=%{fld8->} ROLES=%{fld9}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var part881 = match_copy("MESSAGE#747:cli", "nwparser.payload", "fld12", processor_chain([ - dup48, - dup47, - dup23, - dup22, - ])); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/junos/agent/stream/tcp.yml.hbs b/packages/juniper/1.1.0/data_stream/junos/agent/stream/tcp.yml.hbs deleted file mode 100755 index 1d71b4b9f8..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,12569 +0,0 @@ -tcp: -host: "{{tcp_host}}:{{tcp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Juniper" - product: "Junos" - type: "Routers" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{day->} %{time->} %{p0}"); - - var dup2 = match("HEADER#3:0004/1_0", "nwparser.p0", "fpc0 %{p0}"); - - var dup3 = match("HEADER#3:0004/1_1", "nwparser.p0", "fpc1 %{p0}"); - - var dup4 = match("HEADER#3:0004/1_2", "nwparser.p0", "fpc2 %{p0}"); - - var dup5 = match("HEADER#3:0004/1_3", "nwparser.p0", "fpc3 %{p0}"); - - var dup6 = match("HEADER#3:0004/1_4", "nwparser.p0", "fpc4 %{p0}"); - - var dup7 = match("HEADER#3:0004/1_5", "nwparser.p0", "fpc5 %{p0}"); - - var dup8 = match("HEADER#3:0004/1_11", "nwparser.p0", "ssb %{p0}"); - - var dup9 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup10 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" "), - field("p0"), - ], - }); - - var dup11 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup12 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup13 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" ["), - field("p0"), - ], - }); - - var dup14 = match("HEADER#15:0026.upd.a/1_0", "nwparser.p0", "RT_FLOW - %{p0}"); - - var dup15 = match("HEADER#15:0026.upd.a/1_1", "nwparser.p0", "junos-ssl-proxy - %{p0}"); - - var dup16 = match("HEADER#15:0026.upd.a/1_2", "nwparser.p0", "RT_APPQOS - %{p0}"); - - var dup17 = match("HEADER#15:0026.upd.a/1_3", "nwparser.p0", "%{hfld33->} - %{p0}"); - - var dup18 = match("HEADER#16:0026.upd.b/0", "message", "%{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var dup19 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("pid"), - constant("]: "), - field("p0"), - ], - }); - - var dup20 = setc("messageid","JUNOSROUTER_GENERIC"); - - var dup21 = setc("eventcategory","1605000000"); - - var dup22 = setf("msg","$MSG"); - - var dup23 = date_time({ - dest: "event_time", - args: ["month","day","time"], - fmts: [ - [dB,dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup24 = setf("hostname","hhost"); - - var dup25 = setc("event_description","AUDIT"); - - var dup26 = setc("event_description","CRON command"); - - var dup27 = setc("eventcategory","1801030000"); - - var dup28 = setc("eventcategory","1801020000"); - - var dup29 = setc("eventcategory","1605010000"); - - var dup30 = setc("eventcategory","1603000000"); - - var dup31 = setc("event_description","Process mode"); - - var dup32 = setc("event_description","NTP Server Unreachable"); - - var dup33 = setc("eventcategory","1401060000"); - - var dup34 = setc("ec_theme","Authentication"); - - var dup35 = setc("ec_subject","User"); - - var dup36 = setc("ec_activity","Logon"); - - var dup37 = setc("ec_outcome","Success"); - - var dup38 = setc("event_description","rpd proceeding"); - - var dup39 = match("MESSAGE#77:sshd:06/0", "nwparser.payload", "%{} %{p0}"); - - var dup40 = match("MESSAGE#77:sshd:06/1_0", "nwparser.p0", "%{process}[%{process_id}]: %{p0}"); - - var dup41 = match("MESSAGE#77:sshd:06/1_1", "nwparser.p0", "%{process}: %{p0}"); - - var dup42 = setc("eventcategory","1701010000"); - - var dup43 = setc("ec_outcome","Failure"); - - var dup44 = setc("eventcategory","1401030000"); - - var dup45 = match_copy("MESSAGE#72:Failed:05/1_2", "nwparser.p0", "p0"); - - var dup46 = setc("eventcategory","1803000000"); - - var dup47 = setc("event_type","VPN"); - - var dup48 = setc("eventcategory","1605020000"); - - var dup49 = setc("eventcategory","1602020000"); - - var dup50 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{p0}"); - - var dup51 = setc("eventcategory","1603020000"); - - var dup52 = date_time({ - dest: "event_time", - args: ["hfld32"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dc("T"),dN,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup53 = setc("ec_subject","NetworkComm"); - - var dup54 = setc("ec_activity","Create"); - - var dup55 = setc("ec_activity","Stop"); - - var dup56 = setc("event_description","Trap state change"); - - var dup57 = setc("event_description","peer NLRI mismatch"); - - var dup58 = setc("eventcategory","1605030000"); - - var dup59 = setc("eventcategory","1603010000"); - - var dup60 = setc("eventcategory","1606000000"); - - var dup61 = setf("hostname","hhostname"); - - var dup62 = date_time({ - dest: "event_time", - args: ["hfld6"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dc("T"),dN,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup63 = setc("eventcategory","1401050200"); - - var dup64 = setc("event_description","Memory allocation failed during initialization for configuration load"); - - var dup65 = setc("event_description","unable to run in the background as a daemon"); - - var dup66 = setc("event_description","Another copy of this program is running"); - - var dup67 = setc("event_description","Unable to lock PID file"); - - var dup68 = setc("event_description","Unable to update process PID file"); - - var dup69 = setc("eventcategory","1301000000"); - - var dup70 = setc("event_description","Command stopped"); - - var dup71 = setc("event_description","Unable to create pipes for command"); - - var dup72 = setc("event_description","Command exited"); - - var dup73 = setc("eventcategory","1603050000"); - - var dup74 = setc("eventcategory","1801010000"); - - var dup75 = setc("event_description","Login failure"); - - var dup76 = match("MESSAGE#294:LOGIN_INFORMATION/3_0", "nwparser.p0", "User %{p0}"); - - var dup77 = match("MESSAGE#294:LOGIN_INFORMATION/3_1", "nwparser.p0", "user %{p0}"); - - var dup78 = setc("event_description","Unable to open file"); - - var dup79 = setc("event_description","SNMP index assigned changed"); - - var dup80 = setc("eventcategory","1302000000"); - - var dup81 = setc("eventcategory","1001020300"); - - var dup82 = setc("event_description","PFE FW SYSLOG_IP"); - - var dup83 = setc("event_description","process_mode"); - - var dup84 = setc("event_description","Logical interface collision"); - - var dup85 = setc("event_description","excessive runtime time during action of module"); - - var dup86 = setc("event_description","Reinitializing"); - - var dup87 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var dup88 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_0", "nwparser.p0", " connection-tag=%{fld20->} service-name=\"%{p0}"); - - var dup89 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_1", "nwparser.p0", " service-name=\"%{p0}"); - - var dup90 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/3_0", "nwparser.p0", " nat-connection-tag=%{fld6->} src-nat-rule-type=%{fld20->} %{p0}"); - - var dup91 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_1", "nwparser.p0", "name=\"%{p0}"); - - var dup92 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/8", "nwparser.p0", "]%{}"); - - var dup93 = setc("eventcategory","1803010000"); - - var dup94 = setc("ec_activity","Deny"); - - var dup95 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_0", "nwparser.payload", "%{process}: %{event_type}: session denied %{p0}"); - - var dup96 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_1", "nwparser.payload", "%{event_type}: session denied %{p0}"); - - var dup97 = setc("event_description","session denied"); - - var dup98 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var dup99 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/2", "nwparser.p0", "%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var dup100 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{rulename}\" dst-nat-rule-%{p0}"); - - var dup101 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/5_0", "nwparser.p0", "type=%{fld7->} dst-nat-rule-name=\"%{p0}"); - - var dup102 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/6", "nwparser.p0", "\"%{rule_template->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"%{p0}"); - - var dup103 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\" encrypted=%{fld16->} %{p0}"); - - var dup104 = setc("dclass_counter1_string","No.of packets from client"); - - var dup105 = setc("event_description","SNMPD AUTH FAILURE"); - - var dup106 = setc("event_description","send send-type (index1) failure"); - - var dup107 = setc("event_description","SNMP trap error"); - - var dup108 = setc("event_description","SNMP TRAP LINK DOWN"); - - var dup109 = setc("event_description","SNMP TRAP LINK UP"); - - var dup110 = setc("event_description","Login Failure"); - - var dup111 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' set: [%{action}] %{p0}"); - - var dup112 = match_copy("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_1", "nwparser.p0", "space"); - - var dup113 = setc("eventcategory","1701020000"); - - var dup114 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_1", "nwparser.p0", "\u003c\u003c%{change_old}> %{p0}"); - - var dup115 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/2", "nwparser.p0", "-> \"%{change_new}\""); - - var dup116 = setc("event_description","User set command"); - - var dup117 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{p0}"); - - var dup118 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_0", "nwparser.p0", "set %{p0}"); - - var dup119 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_1", "nwparser.p0", "replace %{p0}"); - - var dup120 = setc("event_description","User set groups to secret"); - - var dup121 = setc("event_description","UI CMDLINE READ LINE"); - - var dup122 = setc("event_description","User commit"); - - var dup123 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_0", "nwparser.p0", "Network %{p0}"); - - var dup124 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_1", "nwparser.p0", "Local %{p0}"); - - var dup125 = setc("eventcategory","1401070000"); - - var dup126 = setc("ec_activity","Logoff"); - - var dup127 = setc("event_description","Successful login"); - - var dup128 = setf("hostname","hostip"); - - var dup129 = setc("event_description","TACACS+ failure"); - - var dup130 = match("MESSAGE#755:node:05/0", "nwparser.payload", "%{hostname->} %{node->} %{p0}"); - - var dup131 = match("MESSAGE#755:node:05/1_0", "nwparser.p0", "partner%{p0}"); - - var dup132 = match("MESSAGE#755:node:05/1_1", "nwparser.p0", "actor%{p0}"); - - var dup133 = setc("eventcategory","1003010000"); - - var dup134 = setc("eventcategory","1901000000"); - - var dup135 = linear_select([ - dup14, - dup15, - dup16, - dup17, - ]); - - var dup136 = match("HEADER#15:0026.upd.a/2", "nwparser.p0", "%{messageid->} [%{p0}", processor_chain([ - dup13, - ])); - - var dup137 = linear_select([ - dup40, - dup41, - ]); - - var dup138 = match("MESSAGE#125:BFDD_TRAP_STATE_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: local discriminator: %{resultcode}, new state: %{result}", processor_chain([ - dup21, - dup22, - dup56, - dup23, - ])); - - var dup139 = match("MESSAGE#214:DCD_MALLOC_FAILED_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed during initialization for configuration load", processor_chain([ - dup51, - dup22, - dup64, - dup23, - ])); - - var dup140 = match("MESSAGE#225:ECCD_DAEMONIZE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}, unable to run in the background as a daemon: %{result}", processor_chain([ - dup30, - dup22, - dup65, - dup23, - ])); - - var dup141 = match("MESSAGE#226:ECCD_DUPLICATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Another copy of this program is running", processor_chain([ - dup30, - dup22, - dup66, - dup23, - ])); - - var dup142 = match("MESSAGE#232:ECCD_PID_FILE_LOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lock PID file: %{result}", processor_chain([ - dup30, - dup22, - dup67, - dup23, - ])); - - var dup143 = match("MESSAGE#233:ECCD_PID_FILE_UPDATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to update process PID file: %{result}", processor_chain([ - dup30, - dup22, - dup68, - dup23, - ])); - - var dup144 = match("MESSAGE#272:LIBJNX_EXEC_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipes for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - dup71, - dup23, - ])); - - var dup145 = linear_select([ - dup76, - dup77, - ]); - - var dup146 = match("MESSAGE#310:MIB2D_IFD_IFINDEX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP index assigned to %{uid->} changed from %{dclass_counter1->} to %{result}", processor_chain([ - dup30, - dup22, - dup79, - dup23, - ])); - - var dup147 = match("MESSAGE#412:RPD_IFL_INDEXCOLLISION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Logical interface collision -- %{result}, %{info}", processor_chain([ - dup30, - dup22, - dup84, - dup23, - ])); - - var dup148 = match("MESSAGE#466:RPD_SCHED_CALLBACK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime time during action of module", processor_chain([ - dup30, - dup22, - dup85, - dup23, - ])); - - var dup149 = match("MESSAGE#482:RPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitializing", processor_chain([ - dup21, - dup22, - dup86, - dup23, - ])); - - var dup150 = linear_select([ - dup88, - dup89, - ]); - - var dup151 = linear_select([ - dup90, - dup45, - ]); - - var dup152 = linear_select([ - dup95, - dup96, - ]); - - var dup153 = linear_select([ - dup101, - dup91, - ]); - - var dup154 = match("MESSAGE#498:RT_SCREEN_TCP", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var dup155 = match("MESSAGE#527:SSL_PROXY_SSL_SESSION_ALLOW", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} logical-system-name=\"%{hostname}\" session-id=\"%{sessionid}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" profile-name=\"%{rulename}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" message=\"%{info}\"]", processor_chain([ - dup27, - dup22, - dup52, - ])); - - var dup156 = linear_select([ - dup118, - dup119, - ]); - - var dup157 = linear_select([ - dup123, - dup124, - ]); - - var dup158 = match("MESSAGE#733:WEBFILTER_URL_PERMITTED", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7->} USERNAME=%{fld8->} ROLES=%{fld9}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var dup159 = match_copy("MESSAGE#747:cli", "nwparser.payload", "fld12", processor_chain([ - dup48, - dup47, - dup23, - dup22, - ])); - - var hdr1 = match("HEADER#0:0001", "message", "%{month->} %{day->} %{time->} %{messageid}: restart %{p0}", processor_chain([ - setc("header_id","0001"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(": restart "), - field("p0"), - ], - }), - ])); - - var hdr2 = match("HEADER#1:0002", "message", "%{month->} %{day->} %{time->} %{messageid->} message repeated %{p0}", processor_chain([ - setc("header_id","0002"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" message repeated "), - field("p0"), - ], - }), - ])); - - var hdr3 = match("HEADER#2:0003", "message", "%{month->} %{day->} %{time->} ssb %{messageid}(%{hfld1}): %{p0}", processor_chain([ - setc("header_id","0003"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("("), - field("hfld1"), - constant("): "), - field("p0"), - ], - }), - ])); - - var part1 = match("HEADER#3:0004/1_6", "nwparser.p0", "fpc6 %{p0}"); - - var part2 = match("HEADER#3:0004/1_7", "nwparser.p0", "fpc7 %{p0}"); - - var part3 = match("HEADER#3:0004/1_8", "nwparser.p0", "fpc8 %{p0}"); - - var part4 = match("HEADER#3:0004/1_9", "nwparser.p0", "fpc9 %{p0}"); - - var part5 = match("HEADER#3:0004/1_10", "nwparser.p0", "cfeb %{p0}"); - - var select1 = linear_select([ - dup2, - dup3, - dup4, - dup5, - dup6, - dup7, - part1, - part2, - part3, - part4, - part5, - dup8, - ]); - - var part6 = match("HEADER#3:0004/2", "nwparser.p0", "%{} %{messageid}: %{p0}", processor_chain([ - dup9, - ])); - - var all1 = all_match({ - processors: [ - dup1, - select1, - part6, - ], - on_success: processor_chain([ - setc("header_id","0004"), - ]), - }); - - var select2 = linear_select([ - dup2, - dup3, - dup4, - dup5, - dup6, - dup7, - dup8, - ]); - - var part7 = match("HEADER#4:0005/2", "nwparser.p0", "%{} %{messageid->} %{p0}", processor_chain([ - dup10, - ])); - - var all2 = all_match({ - processors: [ - dup1, - select2, - part7, - ], - on_success: processor_chain([ - setc("header_id","0005"), - ]), - }); - - var hdr4 = match("HEADER#5:0007", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2}[%{hpid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0007"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant("["), - field("hpid"), - constant("]: "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr5 = match("HEADER#6:0008", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{messageid}[%{hpid}]: %{p0}", processor_chain([ - setc("header_id","0008"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("hpid"), - constant("]: "), - field("p0"), - ], - }), - ])); - - var hdr6 = match("HEADER#7:0009", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2->} IFP trace> %{messageid}: %{p0}", processor_chain([ - setc("header_id","0009"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" IFP trace> "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr7 = match("HEADER#8:0010", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0010"), - dup11, - ])); - - var hdr8 = match("HEADER#9:0029", "message", "%{month->} %{day->} %{time->} %{hostip->} %{hfld1}[%{pid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0029"), - dup12, - ])); - - var hdr9 = match("HEADER#10:0015", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0015"), - dup12, - ])); - - var hdr10 = match("HEADER#11:0011", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0011"), - dup11, - ])); - - var hdr11 = match("HEADER#12:0027", "message", "%{month->} %{day->} %{time->} %{hhostname->} RT_FLOW: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0027"), - dup9, - ])); - - var hdr12 = match("HEADER#13:0012", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0012"), - dup9, - ])); - - var hdr13 = match("HEADER#14:0013", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hfld32->} %{hhostname->} RT_FLOW - %{messageid->} [%{p0}", processor_chain([ - setc("header_id","0013"), - dup13, - ])); - - var hdr14 = match("HEADER#15:0026.upd.a/0", "message", "%{hfld1->} %{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var all3 = all_match({ - processors: [ - hdr14, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026.upd.a"), - ]), - }); - - var all4 = all_match({ - processors: [ - dup18, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026.upd.b"), - ]), - }); - - var all5 = all_match({ - processors: [ - dup18, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026"), - ]), - }); - - var hdr15 = match("HEADER#18:0014", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid}[%{hpid}]: %{p0}", processor_chain([ - setc("header_id","0014"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant("["), - field("hpid"), - constant("]: "), - field("p0"), - ], - }), - ])); - - var hdr16 = match("HEADER#19:0016", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0016"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant(": "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr17 = match("HEADER#20:0017", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid->} %{p0}", processor_chain([ - setc("header_id","0017"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr18 = match("HEADER#21:0018", "message", "%{month->} %{day->} %{time->} %{hhost}: %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0018"), - dup19, - ])); - - var hdr19 = match("HEADER#22:0028", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0028"), - dup19, - ])); - - var hdr20 = match("HEADER#23:0019", "message", "%{month->} %{day->} %{time->} %{hhost}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0019"), - dup9, - ])); - - var hdr21 = match("HEADER#24:0020", "message", "%{month->} %{day->} %{time->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0020"), - dup19, - ])); - - var hdr22 = match("HEADER#25:0021", "message", "%{month->} %{day->} %{time->} /%{messageid}: %{p0}", processor_chain([ - setc("header_id","0021"), - dup9, - ])); - - var hdr23 = match("HEADER#26:0022", "message", "%{month->} %{day->} %{time->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0022"), - dup9, - ])); - - var hdr24 = match("HEADER#27:0023", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0023"), - dup19, - ])); - - var hdr25 = match("HEADER#28:0024", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0024"), - dup9, - ])); - - var hdr26 = match("HEADER#29:0025", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{hfld2->} %{messageid->} %{p0}", processor_chain([ - setc("header_id","0025"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr27 = match("HEADER#30:0031", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid->} %{p0}", processor_chain([ - setc("header_id","0031"), - dup10, - ])); - - var hdr28 = match("HEADER#31:0032", "message", "%{month->} %{day->} %{time->} %{hostip->} (%{hfld1}) %{hfld2->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0032"), - dup19, - ])); - - var hdr29 = match("HEADER#32:0033", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0033"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant(" "), - field("hhostname"), - constant(" "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr30 = match("HEADER#33:3336", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{messageid}: %{payload}", processor_chain([ - setc("header_id","3336"), - ])); - - var hdr31 = match("HEADER#34:3339", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{messageid->} %{payload}", processor_chain([ - setc("header_id","3339"), - ])); - - var hdr32 = match("HEADER#35:3337", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid}: %{payload}", processor_chain([ - setc("header_id","3337"), - ])); - - var hdr33 = match("HEADER#36:3341", "message", "%{hfld1->} %{hfld6->} %{hhostname->} %{hfld2->} %{hfld3->} %{messageid->} %{p0}", processor_chain([ - setc("header_id","3341"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("hfld3"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr34 = match("HEADER#37:3338", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid->} %{payload}", processor_chain([ - setc("header_id","3338"), - ])); - - var hdr35 = match("HEADER#38:3340/0", "message", "%{month->} %{day->} %{time->} %{hhost->} node%{hfld1}.fpc%{p0}", processor_chain([ - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hhost"), - constant(" node"), - field("hfld1"), - constant(".fpc"), - field("p0"), - ], - }), - ])); - - var part8 = match("HEADER#38:3340/1_0", "nwparser.p0", "%{hfld2}.pic%{hfld3->} %{p0}"); - - var part9 = match("HEADER#38:3340/1_1", "nwparser.p0", "%{hfld2->} %{p0}"); - - var select3 = linear_select([ - part8, - part9, - ]); - - var part10 = match("HEADER#38:3340/2", "nwparser.p0", "%{} %{p0}"); - - var all6 = all_match({ - processors: [ - hdr35, - select3, - part10, - ], - on_success: processor_chain([ - setc("header_id","3340"), - setc("messageid","node"), - ]), - }); - - var hdr36 = match("HEADER#39:9997/0_0", "message", "mgd[%{p0}"); - - var hdr37 = match("HEADER#39:9997/0_1", "message", "rpd[%{p0}"); - - var hdr38 = match("HEADER#39:9997/0_2", "message", "dcd[%{p0}"); - - var select4 = linear_select([ - hdr36, - hdr37, - hdr38, - ]); - - var part11 = match("HEADER#39:9997/1", "nwparser.p0", "%{process_id}]:%{payload}"); - - var all7 = all_match({ - processors: [ - select4, - part11, - ], - on_success: processor_chain([ - setc("header_id","9997"), - dup20, - ]), - }); - - var hdr39 = match("HEADER#40:9995", "message", "%{month->} %{day->} %{time->} %{hhost->} %{hfld1->} %{hfld2->} %{messageid}[%{hfld3}]:%{p0}", processor_chain([ - setc("header_id","9995"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("hfld3"), - constant("]:"), - field("p0"), - ], - }), - ])); - - var hdr40 = match("HEADER#41:9994", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{hfld1->} qsfp %{p0}", processor_chain([ - setc("header_id","9994"), - setc("messageid","qsfp"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("hfld1"), - constant(" qsfp "), - field("p0"), - ], - }), - ])); - - var hdr41 = match("HEADER#42:9999", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{hevent_type}: %{p0}", processor_chain([ - setc("header_id","9999"), - dup20, - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hevent_type"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr42 = match("HEADER#43:9998", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{process}: %{p0}", processor_chain([ - setc("header_id","9998"), - dup20, - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("process"), - constant(": "), - field("p0"), - ], - }), - ])); - - var select5 = linear_select([ - hdr1, - hdr2, - hdr3, - all1, - all2, - hdr4, - hdr5, - hdr6, - hdr7, - hdr8, - hdr9, - hdr10, - hdr11, - hdr12, - hdr13, - all3, - all4, - all5, - hdr15, - hdr16, - hdr17, - hdr18, - hdr19, - hdr20, - hdr21, - hdr22, - hdr23, - hdr24, - hdr25, - hdr26, - hdr27, - hdr28, - hdr29, - hdr30, - hdr31, - hdr32, - hdr33, - hdr34, - all6, - all7, - hdr39, - hdr40, - hdr41, - hdr42, - ]); - - var part12 = match("MESSAGE#0:/usr/sbin/sshd", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exit status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","sshd exit status"), - dup23, - ])); - - var msg1 = msg("/usr/sbin/sshd", part12); - - var part13 = match("MESSAGE#1:/usr/libexec/telnetd", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exit status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","telnetd exit status"), - dup23, - ])); - - var msg2 = msg("/usr/libexec/telnetd", part13); - - var part14 = match("MESSAGE#2:alarmd", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License color=%{severity}, class=%{device}, reason=%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Alarm Set or Cleared"), - dup23, - ])); - - var msg3 = msg("alarmd", part14); - - var part15 = match("MESSAGE#3:bigd", "nwparser.payload", "%{process}: Node detected UP for %{node}", processor_chain([ - dup21, - dup22, - setc("event_description","Node detected UP"), - dup23, - ])); - - var msg4 = msg("bigd", part15); - - var part16 = match("MESSAGE#4:bigd:01", "nwparser.payload", "%{process}: Monitor template id is %{id}", processor_chain([ - dup21, - dup22, - setc("event_description","Monitor template id"), - dup23, - ])); - - var msg5 = msg("bigd:01", part16); - - var select6 = linear_select([ - msg4, - msg5, - ]); - - var part17 = match("MESSAGE#5:bigpipe", "nwparser.payload", "%{process}: Loading the configuration file %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","Loading configuration file"), - dup23, - ])); - - var msg6 = msg("bigpipe", part17); - - var part18 = match("MESSAGE#6:bigpipe:01", "nwparser.payload", "%{process}: Begin config install operation %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","Begin config install operation"), - dup23, - ])); - - var msg7 = msg("bigpipe:01", part18); - - var part19 = match("MESSAGE#7:bigpipe:02", "nwparser.payload", "%{process}: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - setc("event_description","Audit"), - dup23, - ])); - - var msg8 = msg("bigpipe:02", part19); - - var select7 = linear_select([ - msg6, - msg7, - msg8, - ]); - - var part20 = match("MESSAGE#8:bigstart", "nwparser.payload", "%{process}: shutdown %{service}", processor_chain([ - dup21, - dup22, - setc("event_description","portal shutdown"), - dup23, - ])); - - var msg9 = msg("bigstart", part20); - - var part21 = match("MESSAGE#9:cgatool", "nwparser.payload", "%{process}: %{event_type}: generated address is %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","cga address genration"), - dup23, - ])); - - var msg10 = msg("cgatool", part21); - - var part22 = match("MESSAGE#10:chassisd:01", "nwparser.payload", "%{process}[%{process_id}]:%{fld12}", processor_chain([ - dup21, - dup22, - dup23, - dup24, - ])); - - var msg11 = msg("chassisd:01", part22); - - var part23 = match("MESSAGE#11:checkd", "nwparser.payload", "%{process}: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - dup25, - dup23, - ])); - - var msg12 = msg("checkd", part23); - - var part24 = match("MESSAGE#12:checkd:01", "nwparser.payload", "%{process}: exiting", processor_chain([ - dup21, - dup22, - setc("event_description","checkd exiting"), - dup23, - ])); - - var msg13 = msg("checkd:01", part24); - - var select8 = linear_select([ - msg12, - msg13, - ]); - - var part25 = match("MESSAGE#13:cosd", "nwparser.payload", "%{process}[%{process_id}]: link protection %{dclass_counter1->} for intf %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","link protection for interface"), - dup23, - ])); - - var msg14 = msg("cosd", part25); - - var part26 = match("MESSAGE#14:craftd", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}, %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","License expiration warning"), - dup23, - ])); - - var msg15 = msg("craftd", part26); - - var part27 = match("MESSAGE#15:CRON/0", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) %{p0}"); - - var part28 = match("MESSAGE#15:CRON/1_0", "nwparser.p0", "CMD (%{result})"); - - var part29 = match("MESSAGE#15:CRON/1_1", "nwparser.p0", "cmd='%{result}'"); - - var select9 = linear_select([ - part28, - part29, - ]); - - var all8 = all_match({ - processors: [ - part27, - select9, - ], - on_success: processor_chain([ - dup21, - dup22, - dup26, - dup23, - ]), - }); - - var msg16 = msg("CRON", all8); - - var part30 = match("MESSAGE#16:Cmerror/0_0", "nwparser.payload", "%{hostname->} %{node}Cmerror: Level%{level}count increment %{dclass_counter1->} %{fld1}"); - - var part31 = match_copy("MESSAGE#16:Cmerror/0_1", "nwparser.payload", "fld2"); - - var select10 = linear_select([ - part30, - part31, - ]); - - var all9 = all_match({ - processors: [ - select10, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg17 = msg("Cmerror", all9); - - var part32 = match("MESSAGE#17:cron", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) %{action->} (%{filename})", processor_chain([ - dup21, - dup22, - setc("event_description","cron RELOAD"), - dup23, - ])); - - var msg18 = msg("cron", part32); - - var part33 = match("MESSAGE#18:CROND", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) CMD (%{action})", processor_chain([ - dup21, - dup22, - dup23, - dup24, - ])); - - var msg19 = msg("CROND", part33); - - var part34 = match("MESSAGE#20:CROND:02", "nwparser.payload", "%{process}[%{process_id}]: pam_unix(crond:session): session closed for user %{username}", processor_chain([ - dup27, - dup22, - dup23, - dup24, - ])); - - var msg20 = msg("CROND:02", part34); - - var select11 = linear_select([ - msg19, - msg20, - ]); - - var part35 = match("MESSAGE#19:crond:01", "nwparser.payload", "%{process}[%{process_id}]: pam_unix(crond:session): session opened for user %{username->} by (uid=%{uid})", processor_chain([ - dup28, - dup22, - dup23, - dup24, - ])); - - var msg21 = msg("crond:01", part35); - - var part36 = match("MESSAGE#21:dcd", "nwparser.payload", "%{process}[%{process_id}]: %{result->} Setting ignored, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Setting ignored"), - dup23, - ])); - - var msg22 = msg("dcd", part36); - - var part37 = match("MESSAGE#22:EVENT/0", "nwparser.payload", "%{process}[%{process_id}]: EVENT %{event_type->} %{interface->} index %{resultcode->} %{p0}"); - - var part38 = match("MESSAGE#22:EVENT/1_0", "nwparser.p0", "%{saddr->} -> %{daddr->} \u003c\u003c%{p0}"); - - var part39 = match("MESSAGE#22:EVENT/1_1", "nwparser.p0", "\u003c\u003c%{p0}"); - - var select12 = linear_select([ - part38, - part39, - ]); - - var part40 = match("MESSAGE#22:EVENT/2", "nwparser.p0", ">%{result}"); - - var all10 = all_match({ - processors: [ - part37, - select12, - part40, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","EVENT"), - dup23, - ]), - }); - - var msg23 = msg("EVENT", all10); - - var part41 = match("MESSAGE#23:ftpd", "nwparser.payload", "%{process}[%{process_id}]: connection from %{saddr->} (%{shost})", processor_chain([ - setc("eventcategory","1802000000"), - dup22, - setc("event_description","ftpd connection"), - dup23, - ])); - - var msg24 = msg("ftpd", part41); - - var part42 = match("MESSAGE#24:ha_rto_stats_handler", "nwparser.payload", "%{hostname->} %{node}ha_rto_stats_handler:%{fld12}", processor_chain([ - dup29, - dup23, - dup22, - ])); - - var msg25 = msg("ha_rto_stats_handler", part42); - - var part43 = match("MESSAGE#25:hostinit", "nwparser.payload", "%{process}: %{obj_name->} -- LDAP Connection not bound correctly. %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","LDAP Connection not bound correctly"), - dup23, - ])); - - var msg26 = msg("hostinit", part43); - - var part44 = match("MESSAGE#26:ifinfo", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> Added entry - %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug - Added entry"), - dup23, - ])); - - var msg27 = msg("ifinfo", part44); - - var part45 = match("MESSAGE#27:ifinfo:01", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> Initializing spu listtype %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug Initializing spu"), - dup23, - ])); - - var msg28 = msg("ifinfo:01", part45); - - var part46 = match("MESSAGE#28:ifinfo:02", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug delete from list"), - dup23, - ])); - - var msg29 = msg("ifinfo:02", part46); - - var select13 = linear_select([ - msg27, - msg28, - msg29, - ]); - - var part47 = match("MESSAGE#29:ifp_ifl_anydown_change_event", "nwparser.payload", "%{node->} %{action}> %{process}: IFL anydown change event: \"%{event_type}\"", processor_chain([ - dup21, - dup22, - setc("event_description","IFL anydown change event"), - dup23, - ])); - - var msg30 = msg("ifp_ifl_anydown_change_event", part47); - - var part48 = match("MESSAGE#30:ifp_ifl_config_event", "nwparser.payload", "%{node->} %{action}> %{process}: IFL config: \"%{filename}\"", processor_chain([ - dup21, - dup22, - setc("event_description","ifp ifl config_event"), - dup23, - ])); - - var msg31 = msg("ifp_ifl_config_event", part48); - - var part49 = match("MESSAGE#31:ifp_ifl_ext_chg", "nwparser.payload", "%{node->} %{process}: ifp ext piid %{parent_pid->} zone_id %{zone}", processor_chain([ - dup21, - dup22, - setc("event_description","ifp_ifl_ext_chg"), - dup23, - ])); - - var msg32 = msg("ifp_ifl_ext_chg", part49); - - var part50 = match("MESSAGE#32:inetd", "nwparser.payload", "%{process}[%{process_id}]: %{protocol->} from %{saddr->} exceeded counts/min (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","connection exceeded count limit"), - dup23, - ])); - - var msg33 = msg("inetd", part50); - - var part51 = match("MESSAGE#33:inetd:01", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exited, status %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","exited"), - dup23, - ])); - - var msg34 = msg("inetd:01", part51); - - var select14 = linear_select([ - msg33, - msg34, - ]); - - var part52 = match("MESSAGE#34:init:04", "nwparser.payload", "%{process}: %{event_type->} current_mode=%{protocol}, requested_mode=%{result}, cmd=%{action}", processor_chain([ - dup21, - dup22, - dup31, - dup23, - ])); - - var msg35 = msg("init:04", part52); - - var part53 = match("MESSAGE#35:init", "nwparser.payload", "%{process}: %{event_type->} mode=%{protocol->} cmd=%{action->} master_mode=%{result}", processor_chain([ - dup21, - dup22, - dup31, - dup23, - ])); - - var msg36 = msg("init", part53); - - var part54 = match("MESSAGE#36:init:01", "nwparser.payload", "%{process}: failure target for routing set to %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","failure target for routing set"), - dup23, - ])); - - var msg37 = msg("init:01", part54); - - var part55 = match("MESSAGE#37:init:02", "nwparser.payload", "%{process}: ntp (PID %{child_pid}) started", processor_chain([ - dup21, - dup22, - setc("event_description","ntp started"), - dup23, - ])); - - var msg38 = msg("init:02", part55); - - var part56 = match("MESSAGE#38:init:03", "nwparser.payload", "%{process}: product mask %{info->} model %{dclass_counter1}", processor_chain([ - dup21, - dup22, - setc("event_description","product mask and model info"), - dup23, - ])); - - var msg39 = msg("init:03", part56); - - var select15 = linear_select([ - msg35, - msg36, - msg37, - msg38, - msg39, - ]); - - var part57 = match("MESSAGE#39:ipc_msg_write", "nwparser.payload", "%{node->} %{process}: IPC message type: %{event_type}, subtype: %{resultcode->} exceeds MTU, mtu %{dclass_counter1}, length %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","IPC message exceeds MTU"), - dup23, - ])); - - var msg40 = msg("ipc_msg_write", part57); - - var part58 = match("MESSAGE#40:connection_established", "nwparser.payload", "%{process}: %{service}: conn established: listener idx=%{dclass_counter1->} tnpaddr=%{dclass_counter2}", processor_chain([ - dup28, - dup22, - setc("event_description","listener connection established"), - dup23, - ])); - - var msg41 = msg("connection_established", part58); - - var part59 = match("MESSAGE#41:connection_dropped/0", "nwparser.payload", "%{process}: %{p0}"); - - var part60 = match("MESSAGE#41:connection_dropped/1_0", "nwparser.p0", "%{result}, connection dropped - src %{saddr}:%{sport->} dest %{daddr}:%{dport}"); - - var part61 = match("MESSAGE#41:connection_dropped/1_1", "nwparser.p0", "%{result}: conn dropped: listener idx=%{dclass_counter1->} tnpaddr=%{dclass_counter2}"); - - var select16 = linear_select([ - part60, - part61, - ]); - - var all11 = all_match({ - processors: [ - part59, - select16, - ], - on_success: processor_chain([ - dup27, - dup22, - setc("event_description","connection dropped"), - dup23, - ]), - }); - - var msg42 = msg("connection_dropped", all11); - - var part62 = match("MESSAGE#42:kernel", "nwparser.payload", "%{process}: %{interface}: Asserting SONET alarm(s) %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Asserting SONET alarm(s)"), - dup23, - ])); - - var msg43 = msg("kernel", part62); - - var part63 = match("MESSAGE#43:kernel:01", "nwparser.payload", "%{process}: %{interface->} down: %{result}.", processor_chain([ - dup21, - dup22, - setc("event_description","interface down"), - dup23, - ])); - - var msg44 = msg("kernel:01", part63); - - var part64 = match("MESSAGE#44:kernel:02", "nwparser.payload", "%{process}: %{interface}: loopback suspected; %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","loopback suspected om interface"), - dup23, - ])); - - var msg45 = msg("kernel:02", part64); - - var part65 = match("MESSAGE#45:kernel:03", "nwparser.payload", "%{process}: %{service}: soreceive() error %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","soreceive error"), - dup23, - ])); - - var msg46 = msg("kernel:03", part65); - - var part66 = match("MESSAGE#46:kernel:04", "nwparser.payload", "%{process}: %{service->} !VALID(state 4)->%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","pfe_peer_alloc state 4"), - dup23, - ])); - - var msg47 = msg("kernel:04", part66); - - var part67 = match("MESSAGE#47:kernel:05", "nwparser.payload", "%{fld1->} %{hostip->} (%{fld2}) %{fld3->} %{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg48 = msg("kernel:05", part67); - - var part68 = match("MESSAGE#48:kernel:06", "nwparser.payload", "%{fld1->} %{hostip->} %{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg49 = msg("kernel:06", part68); - - var select17 = linear_select([ - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - ]); - - var part69 = match("MESSAGE#49:successful_login", "nwparser.payload", "%{process}: login from %{saddr->} on %{interface->} as %{username}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","successful user login"), - dup23, - ])); - - var msg50 = msg("successful_login", part69); - - var part70 = match("MESSAGE#50:login_attempt", "nwparser.payload", "%{process}: Login attempt for user %{username->} from host %{hostip}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup22, - setc("event_description","user login attempt"), - dup23, - ])); - - var msg51 = msg("login_attempt", part70); - - var part71 = match("MESSAGE#51:login", "nwparser.payload", "%{process}: PAM module %{dclass_counter1->} returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup33, - dup34, - dup37, - dup22, - setc("event_description","PAM module return from login"), - dup23, - ])); - - var msg52 = msg("login", part71); - - var select18 = linear_select([ - msg50, - msg51, - msg52, - ]); - - var part72 = match("MESSAGE#52:lsys_ssam_handler", "nwparser.payload", "%{node->} %{process}: processing lsys root-logical-system %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","processing lsys root-logical-system"), - dup23, - ])); - - var msg53 = msg("lsys_ssam_handler", part72); - - var part73 = match("MESSAGE#53:mcsn", "nwparser.payload", "%{process}[%{process_id}]: Removing mif from group [%{group}] %{space->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Removing mif from group"), - dup23, - ])); - - var msg54 = msg("mcsn", part73); - - var part74 = match("MESSAGE#54:mrvl_dfw_log_effuse_status", "nwparser.payload", "%{process}: Firewall rows could not be redirected on device %{device}.", processor_chain([ - dup30, - dup22, - setc("event_description","Firewall rows could not be redirected on device"), - dup23, - ])); - - var msg55 = msg("mrvl_dfw_log_effuse_status", part74); - - var part75 = match("MESSAGE#55:MRVL-L2", "nwparser.payload", "%{process}:%{action}(),%{process_id}:MFilter (%{filter}) already exists", processor_chain([ - dup30, - dup22, - setc("event_description","mfilter already exists for add"), - dup23, - ])); - - var msg56 = msg("MRVL-L2", part75); - - var part76 = match("MESSAGE#56:profile_ssam_handler", "nwparser.payload", "%{node->} %{process}: processing profile SP-root %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","processing profile SP-root"), - dup23, - ])); - - var msg57 = msg("profile_ssam_handler", part76); - - var part77 = match("MESSAGE#57:pst_nat_binding_set_profile", "nwparser.payload", "%{node->} %{process}: %{event_source}: can't get resource bucket %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","can't get resource bucket"), - dup23, - ])); - - var msg58 = msg("pst_nat_binding_set_profile", part77); - - var part78 = match("MESSAGE#58:task_reconfigure", "nwparser.payload", "%{process}[%{process_id}]: task_reconfigure %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","reinitializing done"), - dup23, - ])); - - var msg59 = msg("task_reconfigure", part78); - - var part79 = match("MESSAGE#59:tnetd/0_0", "nwparser.payload", "%{process}[%{process_id}]:%{service}[%{fld1}]: exit status%{resultcode}"); - - var part80 = match_copy("MESSAGE#59:tnetd/0_1", "nwparser.payload", "fld3"); - - var select19 = linear_select([ - part79, - part80, - ]); - - var all12 = all_match({ - processors: [ - select19, - ], - on_success: processor_chain([ - dup21, - dup22, - dup23, - dup24, - ]), - }); - - var msg60 = msg("tnetd", all12); - - var part81 = match("MESSAGE#60:PFEMAN", "nwparser.payload", "%{process}: Session manager active", processor_chain([ - dup21, - dup22, - setc("event_description","Session manager active"), - dup23, - ])); - - var msg61 = msg("PFEMAN", part81); - - var part82 = match("MESSAGE#61:mgd", "nwparser.payload", "%{process}[%{process_id}]: Could not send message to %{service}", processor_chain([ - dup30, - dup22, - setc("event_description","Could not send message to service"), - dup23, - ])); - - var msg62 = msg("mgd", part82); - - var part83 = match("MESSAGE#62:Resolve", "nwparser.payload", "Resolve request came for an address matching on Wrong nh nh:%{result}, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Resolve request came for an address matching on Wrong nh"), - dup23, - ])); - - var msg63 = msg("Resolve", part83); - - var part84 = match("MESSAGE#63:respawn", "nwparser.payload", "%{process}: %{service->} exited with status = %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","service exited with status"), - dup23, - ])); - - var msg64 = msg("respawn", part84); - - var part85 = match("MESSAGE#64:root", "nwparser.payload", "%{process}: %{node}: This system does not have 3-DNS or Link Controller enabled", processor_chain([ - dup30, - dup22, - setc("event_description","system does not have 3-DNS or Link Controller enabled"), - dup23, - ])); - - var msg65 = msg("root", part85); - - var part86 = match("MESSAGE#65:rpd", "nwparser.payload", "%{process}[%{process_id}]: Received %{result->} for intf device %{interface}; mc_ae_id %{dclass_counter1}, status %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","Received data for interface"), - dup23, - ])); - - var msg66 = msg("rpd", part86); - - var part87 = match("MESSAGE#66:rpd:01", "nwparser.payload", "%{process}[%{process_id}]: RSVP neighbor %{daddr->} up on interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","RSVP neighbor up on interface "), - dup23, - ])); - - var msg67 = msg("rpd:01", part87); - - var part88 = match("MESSAGE#67:rpd:02", "nwparser.payload", "%{process}[%{process_id}]: %{saddr->} (%{shost}): reseting pending active connection", processor_chain([ - dup21, - dup22, - setc("event_description","reseting pending active connection"), - dup23, - ])); - - var msg68 = msg("rpd:02", part88); - - var part89 = match("MESSAGE#68:rpd_proceeding", "nwparser.payload", "%{process}: proceeding. %{param}", processor_chain([ - dup21, - dup22, - dup38, - dup23, - ])); - - var msg69 = msg("rpd_proceeding", part89); - - var select20 = linear_select([ - msg66, - msg67, - msg68, - msg69, - ]); - - var part90 = match("MESSAGE#69:rshd", "nwparser.payload", "%{process}[%{process_id}]: %{username->} as root: cmd='%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","user issuing command as root"), - dup23, - ])); - - var msg70 = msg("rshd", part90); - - var part91 = match("MESSAGE#70:sfd", "nwparser.payload", "%{process}: Waiting on accept", processor_chain([ - dup21, - dup22, - setc("event_description","sfd waiting on accept"), - dup23, - ])); - - var msg71 = msg("sfd", part91); - - var part92 = match("MESSAGE#71:sshd", "nwparser.payload", "%{process}[%{process_id}]: Accepted password for %{username->} from %{saddr->} port %{sport->} %{protocol}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","Accepted password"), - dup23, - ])); - - var msg72 = msg("sshd", part92); - - var part93 = match("MESSAGE#73:sshd:02", "nwparser.payload", "%{process}[%{process_id}]: Received disconnect from %{shost}: %{fld1}: %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","Received disconnect"), - dup23, - ])); - - var msg73 = msg("sshd:02", part93); - - var part94 = match("MESSAGE#74:sshd:03", "nwparser.payload", "%{process}[%{process_id}]: Did not receive identification string from %{saddr}", processor_chain([ - dup30, - dup22, - setc("result","no identification string"), - setc("event_description","Did not receive identification string from peer"), - dup23, - ])); - - var msg74 = msg("sshd:03", part94); - - var part95 = match("MESSAGE#75:sshd:04", "nwparser.payload", "%{process}[%{process_id}]: Could not write ident string to %{dhost}", processor_chain([ - dup30, - dup22, - setc("event_description","Could not write ident string"), - dup23, - ])); - - var msg75 = msg("sshd:04", part95); - - var part96 = match("MESSAGE#76:sshd:05", "nwparser.payload", "%{process}[%{process_id}]: subsystem request for netconf", processor_chain([ - dup21, - dup22, - setc("event_description","subsystem request for netconf"), - dup23, - ])); - - var msg76 = msg("sshd:05", part96); - - var part97 = match("MESSAGE#77:sshd:06/2", "nwparser.p0", "sendmsg to %{saddr}(%{shost}).%{sport}: %{info}"); - - var all13 = all_match({ - processors: [ - dup39, - dup137, - part97, - ], - on_success: processor_chain([ - dup29, - dup22, - setc("event_description","send message stats"), - dup23, - ]), - }); - - var msg77 = msg("sshd:06", all13); - - var part98 = match("MESSAGE#78:sshd:07/2", "nwparser.p0", "Added radius server %{saddr}(%{shost})"); - - var all14 = all_match({ - processors: [ - dup39, - dup137, - part98, - ], - on_success: processor_chain([ - dup42, - setc("ec_theme","Configuration"), - setc("ec_activity","Modify"), - dup37, - dup22, - setc("event_description","Added radius server"), - dup23, - ]), - }); - - var msg78 = msg("sshd:07", all14); - - var part99 = match("MESSAGE#79:sshd:08", "nwparser.payload", "%{process}[%{process_id}]: %{result}: %{space->} [%{resultcode}]authentication error", processor_chain([ - setc("eventcategory","1301020000"), - dup34, - dup43, - dup22, - setc("event_description","authentication error"), - dup23, - ])); - - var msg79 = msg("sshd:08", part99); - - var part100 = match("MESSAGE#80:sshd:09", "nwparser.payload", "%{process}[%{process_id}]: unrecognized attribute in %{policyname}: %{change_attribute}", processor_chain([ - dup30, - dup22, - setc("event_description","unrecognized attribute in policy"), - dup23, - ])); - - var msg80 = msg("sshd:09", part100); - - var part101 = match("MESSAGE#81:sshd:10", "nwparser.payload", "%{process}: PAM module %{dclass_counter1->} returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","PAM module return from sshd"), - dup23, - ])); - - var msg81 = msg("sshd:10", part101); - - var part102 = match("MESSAGE#82:sshd:11", "nwparser.payload", "%{process}: PAM authentication chain returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","PAM authentication chain return"), - dup23, - ])); - - var msg82 = msg("sshd:11", part102); - - var part103 = match("MESSAGE#83:sshd:12", "nwparser.payload", "%{process}: %{severity}: can't get client address: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","can't get client address"), - dup23, - ])); - - var msg83 = msg("sshd:12", part103); - - var part104 = match("MESSAGE#84:sshd:13", "nwparser.payload", "%{process}: auth server unresponsive", processor_chain([ - dup30, - dup22, - setc("event_description","auth server unresponsive"), - dup23, - ])); - - var msg84 = msg("sshd:13", part104); - - var part105 = match("MESSAGE#85:sshd:14", "nwparser.payload", "%{process}: %{service}: No valid RADIUS responses received", processor_chain([ - dup30, - dup22, - setc("event_description","No valid RADIUS responses received"), - dup23, - ])); - - var msg85 = msg("sshd:14", part105); - - var part106 = match("MESSAGE#86:sshd:15", "nwparser.payload", "%{process}: Moving to next server: %{saddr}(%{shost}).%{sport}", processor_chain([ - dup21, - dup22, - setc("event_description","Moving to next server"), - dup23, - ])); - - var msg86 = msg("sshd:15", part106); - - var part107 = match("MESSAGE#87:sshd:16", "nwparser.payload", "%{fld1->} sshd: SSHD_LOGIN_FAILED: Login failed for user '%{username}' from host '%{hostip}'.", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","Login failed for user"), - dup23, - ])); - - var msg87 = msg("sshd:16", part107); - - var select21 = linear_select([ - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - ]); - - var part108 = match("MESSAGE#72:Failed:05/0", "nwparser.payload", "%{process}[%{process_id}]: Failed password for %{p0}"); - - var part109 = match("MESSAGE#72:Failed:05/1_0", "nwparser.p0", "illegal user %{p0}"); - - var part110 = match("MESSAGE#72:Failed:05/1_1", "nwparser.p0", "invalid user %{p0}"); - - var select22 = linear_select([ - part109, - part110, - dup45, - ]); - - var part111 = match("MESSAGE#72:Failed:05/2", "nwparser.p0", "%{username->} from %{saddr->} port %{sport->} %{protocol}"); - - var all15 = all_match({ - processors: [ - part108, - select22, - part111, - ], - on_success: processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - setc("event_description","authentication failure"), - dup23, - ]), - }); - - var msg88 = msg("Failed:05", all15); - - var part112 = match("MESSAGE#746:Failed/0", "nwparser.payload", "%{hostname->} %{process}[%{process_id}]: Failed to resolve ipv%{p0}"); - - var part113 = match("MESSAGE#746:Failed/1_0", "nwparser.p0", "4%{p0}"); - - var part114 = match("MESSAGE#746:Failed/1_1", "nwparser.p0", "6%{p0}"); - - var select23 = linear_select([ - part113, - part114, - ]); - - var part115 = match("MESSAGE#746:Failed/2", "nwparser.p0", "%{}addresses for domain name %{sdomain}"); - - var all16 = all_match({ - processors: [ - part112, - select23, - part115, - ], - on_success: processor_chain([ - dup46, - dup47, - dup23, - dup22, - ]), - }); - - var msg89 = msg("Failed", all16); - - var part116 = match("MESSAGE#767:Failed:01", "nwparser.payload", "%{hostname->} %{process}[%{process_id}]: %{fld1}", processor_chain([ - dup46, - dup23, - dup22, - ])); - - var msg90 = msg("Failed:01", part116); - - var part117 = match("MESSAGE#768:Failed:02/0_0", "nwparser.payload", "%{fld1->} to create a route if table for Multiservice"); - - var part118 = match_copy("MESSAGE#768:Failed:02/0_1", "nwparser.payload", "fld10"); - - var select24 = linear_select([ - part117, - part118, - ]); - - var all17 = all_match({ - processors: [ - select24, - ], - on_success: processor_chain([ - dup46, - dup23, - dup22, - setf("hostname","hfld1"), - ]), - }); - - var msg91 = msg("Failed:02", all17); - - var select25 = linear_select([ - msg88, - msg89, - msg90, - msg91, - ]); - - var part119 = match("MESSAGE#88:syslogd", "nwparser.payload", "%{process}: restart", processor_chain([ - dup21, - dup22, - setc("event_description","syslog daemon restart"), - dup23, - ])); - - var msg92 = msg("syslogd", part119); - - var part120 = match("MESSAGE#89:ucd-snmp", "nwparser.payload", "%{process}[%{process_id}]: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - dup25, - dup23, - ])); - - var msg93 = msg("ucd-snmp", part120); - - var part121 = match("MESSAGE#90:ucd-snmp:01", "nwparser.payload", "%{process}[%{process_id}]: Received TERM or STOP signal %{space->} %{result}.", processor_chain([ - dup21, - dup22, - setc("event_description","Received TERM or STOP signal"), - dup23, - ])); - - var msg94 = msg("ucd-snmp:01", part121); - - var select26 = linear_select([ - msg93, - msg94, - ]); - - var part122 = match("MESSAGE#91:usp_ipc_client_reconnect", "nwparser.payload", "%{node->} %{process}: failed to connect to the server: %{result->} (%{resultcode})", processor_chain([ - dup27, - dup22, - setc("event_description","failed to connect to the server"), - dup23, - ])); - - var msg95 = msg("usp_ipc_client_reconnect", part122); - - var part123 = match("MESSAGE#92:usp_trace_ipc_disconnect", "nwparser.payload", "%{node->} %{process}:Trace client disconnected. %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","Trace client disconnected"), - dup23, - ])); - - var msg96 = msg("usp_trace_ipc_disconnect", part123); - - var part124 = match("MESSAGE#93:usp_trace_ipc_reconnect", "nwparser.payload", "%{node->} %{process}:USP trace client cannot reconnect to server", processor_chain([ - dup30, - dup22, - setc("event_description","USP trace client cannot reconnect to server"), - dup23, - ])); - - var msg97 = msg("usp_trace_ipc_reconnect", part124); - - var part125 = match("MESSAGE#94:uspinfo", "nwparser.payload", "%{process}: flow_print_session_summary_output received %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","flow_print_session_summary_output received"), - dup23, - ])); - - var msg98 = msg("uspinfo", part125); - - var part126 = match("MESSAGE#95:Version", "nwparser.payload", "Version %{version->} by builder on %{event_time_string}", processor_chain([ - dup21, - dup22, - setc("event_description","Version build date"), - dup23, - ])); - - var msg99 = msg("Version", part126); - - var part127 = match("MESSAGE#96:xntpd", "nwparser.payload", "%{process}[%{process_id}]: frequency initialized %{result->} from %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","frequency initialized from file"), - dup23, - ])); - - var msg100 = msg("xntpd", part127); - - var part128 = match("MESSAGE#97:xntpd:01", "nwparser.payload", "%{process}[%{process_id}]: ntpd %{version->} %{event_time_string->} (%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","nptd version build"), - dup23, - ])); - - var msg101 = msg("xntpd:01", part128); - - var part129 = match("MESSAGE#98:xntpd:02", "nwparser.payload", "%{process}: kernel time sync enabled %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","kernel time sync enabled"), - dup23, - ])); - - var msg102 = msg("xntpd:02", part129); - - var part130 = match("MESSAGE#99:xntpd:03", "nwparser.payload", "%{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg103 = msg("xntpd:03", part130); - - var select27 = linear_select([ - msg100, - msg101, - msg102, - msg103, - ]); - - var part131 = match("MESSAGE#100:last", "nwparser.payload", "last message repeated %{dclass_counter1->} times", processor_chain([ - dup21, - dup22, - setc("event_description","last message repeated"), - dup23, - ])); - - var msg104 = msg("last", part131); - - var part132 = match("MESSAGE#739:last:01", "nwparser.payload", "message repeated %{dclass_counter1->} times", processor_chain([ - dup48, - dup47, - dup23, - dup22, - dup24, - ])); - - var msg105 = msg("last:01", part132); - - var select28 = linear_select([ - msg104, - msg105, - ]); - - var part133 = match("MESSAGE#101:BCHIP", "nwparser.payload", "%{process->} %{device}: cannot write ucode mask reg", processor_chain([ - dup30, - dup22, - setc("event_description","cannot write ucode mask reg"), - dup23, - ])); - - var msg106 = msg("BCHIP", part133); - - var part134 = match("MESSAGE#102:CM", "nwparser.payload", "%{process}(%{fld1}): Slot %{device}: On-line", processor_chain([ - dup21, - dup22, - setc("event_description","Slot on-line"), - dup23, - ])); - - var msg107 = msg("CM", part134); - - var part135 = match("MESSAGE#103:COS", "nwparser.payload", "%{process}: Received FC->Q map, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Received FC Q map"), - dup23, - ])); - - var msg108 = msg("COS", part135); - - var part136 = match("MESSAGE#104:COSFPC", "nwparser.payload", "%{process}: ifd %{resultcode}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","ifd error"), - dup23, - ])); - - var msg109 = msg("COSFPC", part136); - - var part137 = match("MESSAGE#105:COSMAN", "nwparser.payload", "%{process}: %{service}: delete class_to_ifl table %{dclass_counter1}, ifl %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","delete class to ifl link"), - dup23, - ])); - - var msg110 = msg("COSMAN", part137); - - var part138 = match("MESSAGE#106:RDP", "nwparser.payload", "%{process}: Keepalive timeout for rdp.(%{interface}).(%{device}) (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","Keepalive timeout"), - dup23, - ])); - - var msg111 = msg("RDP", part138); - - var part139 = match("MESSAGE#107:SNTPD", "nwparser.payload", "%{process}: Initial time of day set", processor_chain([ - dup30, - dup22, - setc("event_description","Initial time of day set"), - dup23, - ])); - - var msg112 = msg("SNTPD", part139); - - var part140 = match("MESSAGE#108:SSB", "nwparser.payload", "%{process}(%{fld1}): Slot %{device}, serial number S/N %{serial_number}.", processor_chain([ - dup21, - dup22, - setc("event_description","Slot serial number"), - dup23, - ])); - - var msg113 = msg("SSB", part140); - - var part141 = match("MESSAGE#109:ACCT_ACCOUNTING_FERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected error %{result->} from file %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected error"), - dup23, - ])); - - var msg114 = msg("ACCT_ACCOUNTING_FERROR", part141); - - var part142 = match("MESSAGE#110:ACCT_ACCOUNTING_FOPEN_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to open file %{filename}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to open file"), - dup23, - ])); - - var msg115 = msg("ACCT_ACCOUNTING_FOPEN_ERROR", part142); - - var part143 = match("MESSAGE#111:ACCT_ACCOUNTING_SMALL_FILE_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File %{filename->} size (%{dclass_counter1}) is smaller than record size (%{dclass_counter2})", processor_chain([ - dup49, - dup22, - setc("event_description","File size mismatch"), - dup23, - ])); - - var msg116 = msg("ACCT_ACCOUNTING_SMALL_FILE_SIZE", part143); - - var part144 = match("MESSAGE#112:ACCT_BAD_RECORD_FORMAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid statistics record: %{result}", processor_chain([ - dup49, - dup22, - setc("event_description","Invalid statistics record"), - dup23, - ])); - - var msg117 = msg("ACCT_BAD_RECORD_FORMAT", part144); - - var part145 = match("MESSAGE#113:ACCT_CU_RTSLIB_error", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} getting class usage statistics for interface %{interface}: %{result}", processor_chain([ - dup49, - dup22, - setc("event_description","Class usage statistics error for interface"), - dup23, - ])); - - var msg118 = msg("ACCT_CU_RTSLIB_error", part145); - - var part146 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/1_0", "nwparser.p0", "Error %{resultcode->} trying %{p0}"); - - var part147 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/1_1", "nwparser.p0", "trying %{p0}"); - - var select29 = linear_select([ - part146, - part147, - ]); - - var part148 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/2", "nwparser.p0", "to get hostname%{}"); - - var all18 = all_match({ - processors: [ - dup50, - select29, - part148, - ], - on_success: processor_chain([ - dup49, - dup22, - setc("event_description","error trying to get hostname"), - dup23, - ]), - }); - - var msg119 = msg("ACCT_GETHOSTNAME_error", all18); - - var part149 = match("MESSAGE#115:ACCT_MALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed while reallocating %{obj_name}", processor_chain([ - dup51, - dup22, - setc("event_description","Memory allocation failure"), - dup23, - ])); - - var msg120 = msg("ACCT_MALLOC_FAILURE", part149); - - var part150 = match("MESSAGE#116:ACCT_UNDEFINED_COUNTER_NAME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} in accounting profile %{dclass_counter1->} is not defined in a firewall using this filter profile", processor_chain([ - dup30, - dup22, - setc("event_description","Accounting profile counter not defined in firewall"), - dup23, - ])); - - var msg121 = msg("ACCT_UNDEFINED_COUNTER_NAME", part150); - - var part151 = match("MESSAGE#117:ACCT_XFER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{result}: %{disposition}", processor_chain([ - dup30, - dup22, - setc("event_description","ACCT_XFER_FAILED"), - dup23, - ])); - - var msg122 = msg("ACCT_XFER_FAILED", part151); - - var part152 = match("MESSAGE#118:ACCT_XFER_POPEN_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{result}: in invoking command command to transfer file %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","POPEN FAIL invoking command command to transfer file"), - dup23, - ])); - - var msg123 = msg("ACCT_XFER_POPEN_FAIL", part152); - - var part153 = match("MESSAGE#119:APPQOS_LOG_EVENT", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} timestamp=\"%{result}\" message-type=\"%{info}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-name=\"%{protocol}\" application-name=\"%{application}\" rule-set-name=\"%{rule_group}\" rule-name=\"%{rulename}\" action=\"%{action}\" argument=\"%{fld2}\" argument1=\"%{fld3}\"]", processor_chain([ - dup28, - dup22, - dup52, - ])); - - var msg124 = msg("APPQOS_LOG_EVENT", part153); - - var part154 = match("MESSAGE#120:APPTRACK_SESSION_CREATE", "nwparser.payload", "%{event_type}: AppTrack session created %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup54, - dup22, - setc("result","AppTrack session created"), - dup23, - ])); - - var msg125 = msg("APPTRACK_SESSION_CREATE", part154); - - var part155 = match("MESSAGE#121:APPTRACK_SESSION_CLOSE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" service-name=\"%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-name=\"%{rule_template}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup28, - dup53, - dup55, - dup22, - dup52, - ])); - - var msg126 = msg("APPTRACK_SESSION_CLOSE", part155); - - var part156 = match("MESSAGE#122:APPTRACK_SESSION_CLOSE:01", "nwparser.payload", "%{event_type}: %{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{packets}(%{rbytes}) %{dclass_counter1}(%{sbytes}) %{duration->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup55, - dup22, - dup23, - ])); - - var msg127 = msg("APPTRACK_SESSION_CLOSE:01", part156); - - var select30 = linear_select([ - msg126, - msg127, - ]); - - var part157 = match("MESSAGE#123:APPTRACK_SESSION_VOL_UPDATE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" service-name=\"%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-name=\"%{rule_template}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup28, - dup53, - dup22, - dup52, - ])); - - var msg128 = msg("APPTRACK_SESSION_VOL_UPDATE", part157); - - var part158 = match("MESSAGE#124:APPTRACK_SESSION_VOL_UPDATE:01", "nwparser.payload", "%{event_type}: %{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{packets}(%{rbytes}) %{dclass_counter1}(%{sbytes}) %{duration->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup22, - dup23, - ])); - - var msg129 = msg("APPTRACK_SESSION_VOL_UPDATE:01", part158); - - var select31 = linear_select([ - msg128, - msg129, - ]); - - var msg130 = msg("BFDD_TRAP_STATE_DOWN", dup138); - - var msg131 = msg("BFDD_TRAP_STATE_UP", dup138); - - var part159 = match("MESSAGE#127:bgp_connect_start", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: connect %{saddr->} (%{shost}): %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp connect error"), - dup23, - ])); - - var msg132 = msg("bgp_connect_start", part159); - - var part160 = match("MESSAGE#128:bgp_event", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}) old state %{change_old->} event %{action->} new state %{change_new}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp peer state change"), - dup23, - ])); - - var msg133 = msg("bgp_event", part160); - - var part161 = match("MESSAGE#129:bgp_listen_accept", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection attempt from unconfigured neighbor: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Connection attempt from unconfigured neighbor"), - dup23, - ])); - - var msg134 = msg("bgp_listen_accept", part161); - - var part162 = match("MESSAGE#130:bgp_listen_reset", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp reset"), - dup23, - ])); - - var msg135 = msg("bgp_listen_reset", part162); - - var part163 = match("MESSAGE#131:bgp_nexthop_sanity", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}) next hop %{saddr->} local, %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","peer next hop local"), - dup23, - ])); - - var msg136 = msg("bgp_nexthop_sanity", part163); - - var part164 = match("MESSAGE#132:bgp_process_caps", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{severity->} (%{action}) subcode %{version->} (%{result}) value %{disposition}", processor_chain([ - dup30, - dup22, - setc("event_description","code RED error NOTIFICATION sent"), - dup23, - ])); - - var msg137 = msg("bgp_process_caps", part164); - - var part165 = match("MESSAGE#133:bgp_process_caps:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: mismatch NLRI with %{hostip->} (%{hostname}): peer: %{daddr->} us: %{saddr}", processor_chain([ - dup30, - dup22, - dup57, - dup23, - ])); - - var msg138 = msg("bgp_process_caps:01", part165); - - var select32 = linear_select([ - msg137, - msg138, - ]); - - var part166 = match("MESSAGE#134:bgp_pp_recv", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: dropping %{daddr->} (%{dhost}), %{info->} (%{protocol})", processor_chain([ - dup30, - dup22, - setc("event_description","connection collision"), - setc("result","dropping connection to peer"), - dup23, - ])); - - var msg139 = msg("bgp_pp_recv", part166); - - var part167 = match("MESSAGE#135:bgp_pp_recv:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}): received unexpected EOF", processor_chain([ - dup30, - dup22, - setc("event_description","peer received unexpected EOF"), - dup23, - ])); - - var msg140 = msg("bgp_pp_recv:01", part167); - - var select33 = linear_select([ - msg139, - msg140, - ]); - - var part168 = match("MESSAGE#136:bgp_send", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: sending %{sbytes->} bytes to %{daddr->} (%{dhost}) blocked (%{disposition}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","bgp send blocked error"), - dup23, - ])); - - var msg141 = msg("bgp_send", part168); - - var part169 = match("MESSAGE#137:bgp_traffic_timeout", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{resultcode->} (%{action}), Reason: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","bgp timeout NOTIFICATION sent"), - dup23, - ])); - - var msg142 = msg("bgp_traffic_timeout", part169); - - var part170 = match("MESSAGE#138:BOOTPD_ARG_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Ignoring unknown option %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","boot argument error"), - dup23, - ])); - - var msg143 = msg("BOOTPD_ARG_ERR", part170); - - var part171 = match("MESSAGE#139:BOOTPD_BAD_ID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected ID %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","boot unexpected Id value"), - dup23, - ])); - - var msg144 = msg("BOOTPD_BAD_ID", part171); - - var part172 = match("MESSAGE#140:BOOTPD_BOOTSTRING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Boot string: %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","Invalid boot string"), - dup23, - ])); - - var msg145 = msg("BOOTPD_BOOTSTRING", part172); - - var part173 = match("MESSAGE#141:BOOTPD_CONFIG_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Problems with configuration file '%{filename}', %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","configuration file error"), - dup23, - ])); - - var msg146 = msg("BOOTPD_CONFIG_ERR", part173); - - var part174 = match("MESSAGE#142:BOOTPD_CONF_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open configuration file '%{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to open configuration file"), - dup23, - ])); - - var msg147 = msg("BOOTPD_CONF_OPEN", part174); - - var part175 = match("MESSAGE#143:BOOTPD_DUP_REV", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate revision: %{version}", processor_chain([ - dup30, - dup22, - setc("event_description","boot - Duplicate revision"), - dup23, - ])); - - var msg148 = msg("BOOTPD_DUP_REV", part175); - - var part176 = match("MESSAGE#144:BOOTPD_DUP_SLOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate slot default: %{ssid}", processor_chain([ - dup30, - dup22, - setc("event_description","boot - duplicate slot"), - dup23, - ])); - - var msg149 = msg("BOOTPD_DUP_SLOT", part176); - - var part177 = match("MESSAGE#145:BOOTPD_MODEL_CHK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected ID %{id->} for model %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected ID for model"), - dup23, - ])); - - var msg150 = msg("BOOTPD_MODEL_CHK", part177); - - var part178 = match("MESSAGE#146:BOOTPD_MODEL_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unsupported model %{dclass_counter1}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unsupported model"), - dup23, - ])); - - var msg151 = msg("BOOTPD_MODEL_ERR", part178); - - var part179 = match("MESSAGE#147:BOOTPD_NEW_CONF", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: New configuration installed", processor_chain([ - dup21, - dup22, - setc("event_description","New configuration installed"), - dup23, - ])); - - var msg152 = msg("BOOTPD_NEW_CONF", part179); - - var part180 = match("MESSAGE#148:BOOTPD_NO_BOOTSTRING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No boot string found for type %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","No boot string found"), - dup23, - ])); - - var msg153 = msg("BOOTPD_NO_BOOTSTRING", part180); - - var part181 = match("MESSAGE#149:BOOTPD_NO_CONFIG", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No configuration file '%{filename}', %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","No configuration file found"), - dup23, - ])); - - var msg154 = msg("BOOTPD_NO_CONFIG", part181); - - var part182 = match("MESSAGE#150:BOOTPD_PARSE_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename}: number parse errors on SIGHUP", processor_chain([ - dup30, - dup22, - setc("event_description","parse errors on SIGHUP"), - dup23, - ])); - - var msg155 = msg("BOOTPD_PARSE_ERR", part182); - - var part183 = match("MESSAGE#151:BOOTPD_REPARSE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reparsing configuration file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","Reparsing configuration file"), - dup23, - ])); - - var msg156 = msg("BOOTPD_REPARSE", part183); - - var part184 = match("MESSAGE#152:BOOTPD_SELECT_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: select: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","select error"), - dup23, - ])); - - var msg157 = msg("BOOTPD_SELECT_ERR", part184); - - var part185 = match("MESSAGE#153:BOOTPD_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Timeout %{result->} unreasonable", processor_chain([ - dup30, - dup22, - setc("event_description","timeout unreasonable"), - dup23, - ])); - - var msg158 = msg("BOOTPD_TIMEOUT", part185); - - var part186 = match("MESSAGE#154:BOOTPD_VERSION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version: %{version->} built by builder on %{event_time_string}", processor_chain([ - dup21, - dup22, - setc("event_description","boot version built"), - dup23, - ])); - - var msg159 = msg("BOOTPD_VERSION", part186); - - var part187 = match("MESSAGE#155:CHASSISD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{version->} built by builder on %{event_time_string}", processor_chain([ - dup58, - dup22, - setc("event_description","CHASSISD release built"), - dup23, - ])); - - var msg160 = msg("CHASSISD", part187); - - var part188 = match("MESSAGE#156:CHASSISD_ARGUMENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown option %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD Unknown option"), - dup23, - ])); - - var msg161 = msg("CHASSISD_ARGUMENT_ERROR", part188); - - var part189 = match("MESSAGE#157:CHASSISD_BLOWERS_SPEED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fans and impellers are now running at normal speed", processor_chain([ - dup21, - dup22, - setc("event_description","Fans and impellers are now running at normal speed"), - dup23, - ])); - - var msg162 = msg("CHASSISD_BLOWERS_SPEED", part189); - - var part190 = match("MESSAGE#158:CHASSISD_BLOWERS_SPEED_FULL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fans and impellers being set to full speed [%{result}]", processor_chain([ - dup21, - dup22, - setc("event_description","Fans and impellers being set to full speed"), - dup23, - ])); - - var msg163 = msg("CHASSISD_BLOWERS_SPEED_FULL", part190); - - var part191 = match("MESSAGE#159:CHASSISD_CB_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result->} reading midplane ID EEPROM, %{dclass_counter1->} %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","reading midplane ID EEPROM"), - dup23, - ])); - - var msg164 = msg("CHASSISD_CB_READ", part191); - - var part192 = match("MESSAGE#160:CHASSISD_COMMAND_ACK_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{device->} online ack code %{dclass_counter1->} - - %{result}, %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD COMMAND ACK ERROR"), - dup23, - ])); - - var msg165 = msg("CHASSISD_COMMAND_ACK_ERROR", part192); - - var part193 = match("MESSAGE#161:CHASSISD_COMMAND_ACK_SF_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{disposition->} - %{result}, code %{resultcode}, SFM %{dclass_counter1}, FPC %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD COMMAND ACK SF ERROR"), - dup23, - ])); - - var msg166 = msg("CHASSISD_COMMAND_ACK_SF_ERROR", part193); - - var part194 = match("MESSAGE#162:CHASSISD_CONCAT_MODE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Cannot set no-concatenated mode for FPC %{dclass_counter2->} PIC %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Cannot set no-concatenated mode for FPC"), - dup23, - ])); - - var msg167 = msg("CHASSISD_CONCAT_MODE_ERROR", part194); - - var part195 = match("MESSAGE#163:CHASSISD_CONFIG_INIT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Problems with configuration file %{filename}; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CONFIG File Problem"), - dup23, - ])); - - var msg168 = msg("CHASSISD_CONFIG_INIT_ERROR", part195); - - var part196 = match("MESSAGE#164:CHASSISD_CONFIG_WARNING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename}: %{result}, FPC %{dclass_counter2->} %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD CONFIG WARNING"), - dup23, - ])); - - var msg169 = msg("CHASSISD_CONFIG_WARNING", part196); - - var part197 = match("MESSAGE#165:CHASSISD_EXISTS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: chassisd already running; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","chassisd already running"), - dup23, - ])); - - var msg170 = msg("CHASSISD_EXISTS", part197); - - var part198 = match("MESSAGE#166:CHASSISD_EXISTS_TERM_OTHER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Killing existing chassisd and exiting", processor_chain([ - dup21, - dup22, - setc("event_description","Killing existing chassisd and exiting"), - dup23, - ])); - - var msg171 = msg("CHASSISD_EXISTS_TERM_OTHER", part198); - - var part199 = match("MESSAGE#167:CHASSISD_FILE_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File open: %{filename}, error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","file open error"), - dup23, - ])); - - var msg172 = msg("CHASSISD_FILE_OPEN", part199); - - var part200 = match("MESSAGE#168:CHASSISD_FILE_STAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File stat: %{filename}, error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD file statistics error"), - dup23, - ])); - - var msg173 = msg("CHASSISD_FILE_STAT", part200); - - var part201 = match("MESSAGE#169:CHASSISD_FRU_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD received restart EVENT"), - dup23, - ])); - - var msg174 = msg("CHASSISD_FRU_EVENT", part201); - - var part202 = match("MESSAGE#170:CHASSISD_FRU_IPC_WRITE_ERROR_EXT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} FRU %{filename}#%{resultcode}, %{result->} %{dclass_counter1}, %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD restart WRITE_ERROR"), - dup23, - ])); - - var msg175 = msg("CHASSISD_FRU_IPC_WRITE_ERROR_EXT", part202); - - var part203 = match("MESSAGE#171:CHASSISD_FRU_STEP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} %{resultcode->} at step %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD FRU STEP ERROR"), - dup23, - ])); - - var msg176 = msg("CHASSISD_FRU_STEP_ERROR", part203); - - var part204 = match("MESSAGE#172:CHASSISD_GETTIMEOFDAY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected error from gettimeofday: %{resultcode->} - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected error from gettimeofday"), - dup23, - ])); - - var msg177 = msg("CHASSISD_GETTIMEOFDAY", part204); - - var part205 = match("MESSAGE#173:CHASSISD_HOST_TEMP_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result->} reading host temperature sensor", processor_chain([ - dup21, - dup22, - setc("event_description","reading host temperature sensor"), - dup23, - ])); - - var msg178 = msg("CHASSISD_HOST_TEMP_READ", part205); - - var part206 = match("MESSAGE#174:CHASSISD_IFDEV_DETACH_ALL_PSEUDO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{disposition})", processor_chain([ - dup21, - dup22, - setc("event_description","detaching all pseudo devices"), - dup23, - ])); - - var msg179 = msg("CHASSISD_IFDEV_DETACH_ALL_PSEUDO", part206); - - var part207 = match("MESSAGE#175:CHASSISD_IFDEV_DETACH_FPC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH FPC"), - dup23, - ])); - - var msg180 = msg("CHASSISD_IFDEV_DETACH_FPC", part207); - - var part208 = match("MESSAGE#176:CHASSISD_IFDEV_DETACH_PIC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH PIC"), - dup23, - ])); - - var msg181 = msg("CHASSISD_IFDEV_DETACH_PIC", part208); - - var part209 = match("MESSAGE#177:CHASSISD_IFDEV_DETACH_PSEUDO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{disposition})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH PSEUDO"), - dup23, - ])); - - var msg182 = msg("CHASSISD_IFDEV_DETACH_PSEUDO", part209); - - var part210 = match("MESSAGE#178:CHASSISD_IFDEV_DETACH_TLV_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD IFDEV DETACH TLV ERROR"), - dup23, - ])); - - var msg183 = msg("CHASSISD_IFDEV_DETACH_TLV_ERROR", part210); - - var part211 = match("MESSAGE#179:CHASSISD_IFDEV_GET_BY_INDEX_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: rtslib_ifdm_get_by_index failed: %{resultcode->} - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","rtslib_ifdm_get_by_index failed"), - dup23, - ])); - - var msg184 = msg("CHASSISD_IFDEV_GET_BY_INDEX_FAIL", part211); - - var part212 = match("MESSAGE#180:CHASSISD_IPC_MSG_QFULL_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: type = %{dclass_counter1}, subtype = %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Message Queue full"), - dup23, - ])); - - var msg185 = msg("CHASSISD_IPC_MSG_QFULL_ERROR", part212); - - var part213 = match("MESSAGE#181:CHASSISD_IPC_UNEXPECTED_RECV", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received unexpected message from %{service}: type = %{dclass_counter1}, subtype = %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Received unexpected message"), - dup23, - ])); - - var msg186 = msg("CHASSISD_IPC_UNEXPECTED_RECV", part213); - - var part214 = match("MESSAGE#182:CHASSISD_IPC_WRITE_ERR_NO_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FRU has no connection pipe %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FRU has no connection pipe"), - dup23, - ])); - - var msg187 = msg("CHASSISD_IPC_WRITE_ERR_NO_PIPE", part214); - - var part215 = match("MESSAGE#183:CHASSISD_IPC_WRITE_ERR_NULL_ARGS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FRU has no connection arguments %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FRU has no connection arguments"), - dup23, - ])); - - var msg188 = msg("CHASSISD_IPC_WRITE_ERR_NULL_ARGS", part215); - - var part216 = match("MESSAGE#184:CHASSISD_MAC_ADDRESS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: chassisd MAC address allocation error", processor_chain([ - dup30, - dup22, - setc("event_description","chassisd MAC address allocation error"), - dup23, - ])); - - var msg189 = msg("CHASSISD_MAC_ADDRESS_ERROR", part216); - - var part217 = match("MESSAGE#185:CHASSISD_MAC_DEFAULT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using default MAC address base", processor_chain([ - dup21, - dup22, - setc("event_description","Using default MAC address base"), - dup23, - ])); - - var msg190 = msg("CHASSISD_MAC_DEFAULT", part217); - - var part218 = match("MESSAGE#186:CHASSISD_MBUS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} %{resultcode}: management bus failed sanity test", processor_chain([ - dup30, - dup22, - setc("event_description","management bus failed sanity test"), - dup23, - ])); - - var msg191 = msg("CHASSISD_MBUS_ERROR", part218); - - var part219 = match("MESSAGE#187:CHASSISD_PARSE_COMPLETE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using new configuration", processor_chain([ - dup21, - dup22, - setc("event_description","Using new configuration"), - dup23, - ])); - - var msg192 = msg("CHASSISD_PARSE_COMPLETE", part219); - - var part220 = match("MESSAGE#188:CHASSISD_PARSE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{resultcode->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD PARSE ERROR"), - dup23, - ])); - - var msg193 = msg("CHASSISD_PARSE_ERROR", part220); - - var part221 = match("MESSAGE#189:CHASSISD_PARSE_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Parsing configuration file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","Parsing configuration file"), - dup23, - ])); - - var msg194 = msg("CHASSISD_PARSE_INIT", part221); - - var part222 = match("MESSAGE#190:CHASSISD_PIDFILE_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open PID file '%{filename}': %{result->} %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to open PID file"), - dup23, - ])); - - var msg195 = msg("CHASSISD_PIDFILE_OPEN", part222); - - var part223 = match("MESSAGE#191:CHASSISD_PIPE_WRITE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Pipe error: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Pipe error"), - dup23, - ])); - - var msg196 = msg("CHASSISD_PIPE_WRITE_ERROR", part223); - - var part224 = match("MESSAGE#192:CHASSISD_POWER_CHECK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{device->} %{dclass_counter1->} not powering up", processor_chain([ - dup59, - dup22, - setc("event_description","device not powering up"), - dup23, - ])); - - var msg197 = msg("CHASSISD_POWER_CHECK", part224); - - var part225 = match("MESSAGE#193:CHASSISD_RECONNECT_SUCCESSFUL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Successfully reconnected on soft restart", processor_chain([ - dup21, - dup22, - setc("event_description","Successful reconnect on soft restart"), - dup23, - ])); - - var msg198 = msg("CHASSISD_RECONNECT_SUCCESSFUL", part225); - - var part226 = match("MESSAGE#194:CHASSISD_RELEASE_MASTERSHIP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Release mastership notification", processor_chain([ - dup21, - dup22, - setc("event_description","Release mastership notification"), - dup23, - ])); - - var msg199 = msg("CHASSISD_RELEASE_MASTERSHIP", part226); - - var part227 = match("MESSAGE#195:CHASSISD_RE_INIT_INVALID_RE_SLOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: re_init: re %{resultcode}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","re_init Invalid RE slot"), - dup23, - ])); - - var msg200 = msg("CHASSISD_RE_INIT_INVALID_RE_SLOT", part227); - - var part228 = match("MESSAGE#196:CHASSISD_ROOT_MOUNT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine the mount point for root directory: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine mount point for root directory"), - dup23, - ])); - - var msg201 = msg("CHASSISD_ROOT_MOUNT_ERROR", part228); - - var part229 = match("MESSAGE#197:CHASSISD_RTS_SEQ_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifmsg sequence gap %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","ifmsg sequence gap"), - dup23, - ])); - - var msg202 = msg("CHASSISD_RTS_SEQ_ERROR", part229); - - var part230 = match("MESSAGE#198:CHASSISD_SBOARD_VERSION_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version mismatch: %{info}", processor_chain([ - setc("eventcategory","1603040000"), - dup22, - setc("event_description","Version mismatch"), - dup23, - ])); - - var msg203 = msg("CHASSISD_SBOARD_VERSION_MISMATCH", part230); - - var part231 = match("MESSAGE#199:CHASSISD_SERIAL_ID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Serial ID read error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Serial ID read error"), - dup23, - ])); - - var msg204 = msg("CHASSISD_SERIAL_ID", part231); - - var part232 = match("MESSAGE#200:CHASSISD_SMB_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: fpga download not complete: val %{resultcode}, %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","fpga download not complete"), - dup23, - ])); - - var msg205 = msg("CHASSISD_SMB_ERROR", part232); - - var part233 = match("MESSAGE#201:CHASSISD_SNMP_TRAP6", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap generated: %{result->} (%{info})", processor_chain([ - dup58, - dup22, - setc("event_description","SNMP Trap6 generated"), - dup23, - ])); - - var msg206 = msg("CHASSISD_SNMP_TRAP6", part233); - - var part234 = match("MESSAGE#202:CHASSISD_SNMP_TRAP7", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap: %{result}: %{info}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP Trap7 generated"), - dup23, - ])); - - var msg207 = msg("CHASSISD_SNMP_TRAP7", part234); - - var part235 = match("MESSAGE#203:CHASSISD_SNMP_TRAP10", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP trap - FRU power on"), - dup23, - ])); - - var msg208 = msg("CHASSISD_SNMP_TRAP10", part235); - - var part236 = match("MESSAGE#204:CHASSISD_TERM_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received SIGTERM request, %{result}", processor_chain([ - dup60, - dup22, - setc("event_description","Received SIGTERM request"), - dup23, - ])); - - var msg209 = msg("CHASSISD_TERM_SIGNAL", part236); - - var part237 = match("MESSAGE#205:CHASSISD_TRACE_PIC_OFFLINE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Taking PIC offline - - FPC slot %{dclass_counter1}, PIC slot %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","Taking PIC offline"), - dup23, - ])); - - var msg210 = msg("CHASSISD_TRACE_PIC_OFFLINE", part237); - - var part238 = match("MESSAGE#206:CHASSISD_UNEXPECTED_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} returned %{resultcode}: %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","UNEXPECTED EXIT"), - dup23, - ])); - - var msg211 = msg("CHASSISD_UNEXPECTED_EXIT", part238); - - var part239 = match("MESSAGE#207:CHASSISD_UNSUPPORTED_MODEL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Model %{dclass_counter1->} unsupported with this version of chassisd", processor_chain([ - dup59, - dup22, - setc("event_description","Model number unsupported with this version of chassisd"), - dup23, - ])); - - var msg212 = msg("CHASSISD_UNSUPPORTED_MODEL", part239); - - var part240 = match("MESSAGE#208:CHASSISD_VERSION_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version mismatch: %{info}", processor_chain([ - dup59, - dup22, - setc("event_description","Chassisd Version mismatch"), - dup23, - ])); - - var msg213 = msg("CHASSISD_VERSION_MISMATCH", part240); - - var part241 = match("MESSAGE#209:CHASSISD_HIGH_TEMP_CONDITION", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} temperature=\"%{fld2}\" message=\"%{info}\"]", processor_chain([ - dup59, - dup22, - setc("event_description","CHASSISD HIGH TEMP CONDITION"), - dup61, - dup62, - ])); - - var msg214 = msg("CHASSISD_HIGH_TEMP_CONDITION", part241); - - var part242 = match("MESSAGE#210:clean_process", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: process %{agent->} RESTART mode %{event_state->} new master=%{obj_name->} old failover=%{change_old->} new failover = %{change_new}", processor_chain([ - dup21, - dup22, - setc("event_description","process RESTART mode"), - dup23, - ])); - - var msg215 = msg("clean_process", part242); - - var part243 = match("MESSAGE#211:CM_JAVA", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Chassis %{group->} Linklocal MAC:%{macaddr}", processor_chain([ - dup21, - dup22, - setc("event_description","Chassis Linklocal to MAC"), - dup23, - ])); - - var msg216 = msg("CM_JAVA", part243); - - var part244 = match("MESSAGE#212:DCD_AS_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","DCD must be run as root"), - dup23, - ])); - - var msg217 = msg("DCD_AS_ROOT", part244); - - var part245 = match("MESSAGE#213:DCD_FILTER_LIB_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Filter library initialization failed", processor_chain([ - dup30, - dup22, - setc("event_description","Filter library initialization failed"), - dup23, - ])); - - var msg218 = msg("DCD_FILTER_LIB_ERROR", part245); - - var msg219 = msg("DCD_MALLOC_FAILED_INIT", dup139); - - var part246 = match("MESSAGE#215:DCD_PARSE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing configuration file", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing configuration file"), - dup23, - ])); - - var msg220 = msg("DCD_PARSE_EMERGENCY", part246); - - var part247 = match("MESSAGE#216:DCD_PARSE_FILTER_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing filter index file", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing filter index file"), - dup23, - ])); - - var msg221 = msg("DCD_PARSE_FILTER_EMERGENCY", part247); - - var part248 = match("MESSAGE#217:DCD_PARSE_MINI_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing configuration overlay", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing configuration overlay"), - dup23, - ])); - - var msg222 = msg("DCD_PARSE_MINI_EMERGENCY", part248); - - var part249 = match("MESSAGE#218:DCD_PARSE_STATE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: An unhandled state was encountered during interface parsing", processor_chain([ - dup30, - dup22, - setc("event_description","unhandled state was encountered during interface parsing"), - dup23, - ])); - - var msg223 = msg("DCD_PARSE_STATE_EMERGENCY", part249); - - var part250 = match("MESSAGE#219:DCD_POLICER_PARSE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing policer indexfile", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing policer indexfile"), - dup23, - ])); - - var msg224 = msg("DCD_POLICER_PARSE_EMERGENCY", part250); - - var part251 = match("MESSAGE#220:DCD_PULL_LOG_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to pull file %{filename->} after %{dclass_counter1->} retries last error=%{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to pull file"), - dup23, - ])); - - var msg225 = msg("DCD_PULL_LOG_FAILURE", part251); - - var part252 = match("MESSAGE#221:DFWD_ARGUMENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DFWD ARGUMENT ERROR"), - dup23, - ])); - - var msg226 = msg("DFWD_ARGUMENT_ERROR", part252); - - var msg227 = msg("DFWD_MALLOC_FAILED_INIT", dup139); - - var part253 = match("MESSAGE#223:DFWD_PARSE_FILTER_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} encountered errors while parsing filter index file", processor_chain([ - dup30, - dup22, - setc("event_description","errors encountered while parsing filter index file"), - dup23, - ])); - - var msg228 = msg("DFWD_PARSE_FILTER_EMERGENCY", part253); - - var part254 = match("MESSAGE#224:DFWD_PARSE_STATE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} encountered unhandled state while parsing interface", processor_chain([ - dup30, - dup22, - setc("event_description","encountered unhandled state while parsing interface"), - dup23, - ])); - - var msg229 = msg("DFWD_PARSE_STATE_EMERGENCY", part254); - - var msg230 = msg("ECCD_DAEMONIZE_FAILED", dup140); - - var msg231 = msg("ECCD_DUPLICATE", dup141); - - var part255 = match("MESSAGE#227:ECCD_LOOP_EXIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MainLoop return value: %{disposition}, error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD LOOP EXIT FAILURE"), - dup23, - ])); - - var msg232 = msg("ECCD_LOOP_EXIT_FAILURE", part255); - - var part256 = match("MESSAGE#228:ECCD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","ECCD Must be run as root"), - dup23, - ])); - - var msg233 = msg("ECCD_NOT_ROOT", part256); - - var part257 = match("MESSAGE#229:ECCD_PCI_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: open() failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD PCI FILE OPEN FAILED"), - dup23, - ])); - - var msg234 = msg("ECCD_PCI_FILE_OPEN_FAILED", part257); - - var part258 = match("MESSAGE#230:ECCD_PCI_READ_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PCI read failure"), - dup23, - ])); - - var msg235 = msg("ECCD_PCI_READ_FAILED", part258); - - var part259 = match("MESSAGE#231:ECCD_PCI_WRITE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PCI write failure"), - dup23, - ])); - - var msg236 = msg("ECCD_PCI_WRITE_FAILED", part259); - - var msg237 = msg("ECCD_PID_FILE_LOCK", dup142); - - var msg238 = msg("ECCD_PID_FILE_UPDATE", dup143); - - var part260 = match("MESSAGE#234:ECCD_TRACE_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD TRACE FILE OPEN FAILURE"), - dup23, - ])); - - var msg239 = msg("ECCD_TRACE_FILE_OPEN_FAILED", part260); - - var part261 = match("MESSAGE#235:ECCD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","ECCD Usage"), - dup23, - ])); - - var msg240 = msg("ECCD_usage", part261); - - var part262 = match("MESSAGE#236:EVENTD_AUDIT_SHOW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} viewed security audit log with arguments: %{param}", processor_chain([ - dup21, - dup22, - setc("event_description","User viewed security audit log with arguments"), - dup23, - ])); - - var msg241 = msg("EVENTD_AUDIT_SHOW", part262); - - var part263 = match("MESSAGE#237:FLOW_REASSEMBLE_SUCCEED", "nwparser.payload", "%{event_type}: Packet merged source %{saddr->} destination %{daddr->} ipid %{fld11->} succeed", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg242 = msg("FLOW_REASSEMBLE_SUCCEED", part263); - - var part264 = match("MESSAGE#238:FSAD_CHANGE_FILE_OWNER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to change owner of file `%{filename}' to user %{username}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to change owner of file"), - dup23, - ])); - - var msg243 = msg("FSAD_CHANGE_FILE_OWNER", part264); - - var part265 = match("MESSAGE#239:FSAD_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FSAD CONFIG ERROR"), - dup23, - ])); - - var msg244 = msg("FSAD_CONFIG_ERROR", part265); - - var part266 = match("MESSAGE#240:FSAD_CONNTIMEDOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection timed out to the client (%{shost}, %{saddr}) having request type %{obj_type}", processor_chain([ - dup30, - dup22, - setc("event_description","Connection timed out to client"), - dup23, - ])); - - var msg245 = msg("FSAD_CONNTIMEDOUT", part266); - - var part267 = match("MESSAGE#241:FSAD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FSAD_FAILED"), - dup23, - ])); - - var msg246 = msg("FSAD_FAILED", part267); - - var part268 = match("MESSAGE#242:FSAD_FETCHTIMEDOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fetch to server %{hostname->} for file `%{filename}' timed out", processor_chain([ - dup30, - dup22, - setc("event_description","Fetch to server to get file timed out"), - dup23, - ])); - - var msg247 = msg("FSAD_FETCHTIMEDOUT", part268); - - var part269 = match("MESSAGE#243:FSAD_FILE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: fn failed for file `%{filename}' with error message %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","fn failed for file"), - dup23, - ])); - - var msg248 = msg("FSAD_FILE_FAILED", part269); - - var part270 = match("MESSAGE#244:FSAD_FILE_REMOVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to remove file `%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to remove file"), - dup23, - ])); - - var msg249 = msg("FSAD_FILE_REMOVE", part270); - - var part271 = match("MESSAGE#245:FSAD_FILE_RENAME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to rename file `%{filename}' to `%{resultcode}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to rename file"), - dup23, - ])); - - var msg250 = msg("FSAD_FILE_RENAME", part271); - - var part272 = match("MESSAGE#246:FSAD_FILE_STAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} failed for file pathname %{filename}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","stat failed for file"), - dup23, - ])); - - var msg251 = msg("FSAD_FILE_STAT", part272); - - var part273 = match("MESSAGE#247:FSAD_FILE_SYNC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to sync file %{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to sync file"), - dup23, - ])); - - var msg252 = msg("FSAD_FILE_SYNC", part273); - - var part274 = match("MESSAGE#248:FSAD_MAXCONN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Upper limit reached in fsad for handling connections", processor_chain([ - dup30, - dup22, - setc("event_description","Upper limit reached in fsad"), - dup23, - ])); - - var msg253 = msg("FSAD_MAXCONN", part274); - - var part275 = match("MESSAGE#249:FSAD_MEMORYALLOC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} failed in the function %{action->} (%{resultcode})", processor_chain([ - dup51, - dup22, - setc("event_description","FSAD MEMORYALLOC FAILED"), - dup23, - ])); - - var msg254 = msg("FSAD_MEMORYALLOC_FAILED", part275); - - var part276 = match("MESSAGE#250:FSAD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","FSAD must be run as root"), - dup23, - ])); - - var msg255 = msg("FSAD_NOT_ROOT", part276); - - var part277 = match("MESSAGE#251:FSAD_PARENT_DIRECTORY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: invalid directory: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","invalid directory"), - dup23, - ])); - - var msg256 = msg("FSAD_PARENT_DIRECTORY", part277); - - var part278 = match("MESSAGE#252:FSAD_PATH_IS_DIRECTORY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File path cannot be a directory (%{filename})", processor_chain([ - dup30, - dup22, - setc("event_description","File path cannot be a directory"), - dup23, - ])); - - var msg257 = msg("FSAD_PATH_IS_DIRECTORY", part278); - - var part279 = match("MESSAGE#253:FSAD_PATH_IS_SPECIAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Not a regular file (%{filename})", processor_chain([ - dup30, - dup22, - setc("event_description","Not a regular file"), - dup23, - ])); - - var msg258 = msg("FSAD_PATH_IS_SPECIAL", part279); - - var part280 = match("MESSAGE#254:FSAD_RECVERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: fsad received error message from client having request type %{obj_type->} at (%{saddr}, %{sport})", processor_chain([ - dup30, - dup22, - setc("event_description","fsad received error message from client"), - dup23, - ])); - - var msg259 = msg("FSAD_RECVERROR", part280); - - var part281 = match("MESSAGE#255:FSAD_TERMINATED_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Open file %{filename}` closed due to %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","FSAD TERMINATED CONNECTION"), - dup23, - ])); - - var msg260 = msg("FSAD_TERMINATED_CONNECTION", part281); - - var part282 = match("MESSAGE#256:FSAD_TERMINATING_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received terminating %{resultcode}; %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Received terminating signal"), - dup23, - ])); - - var msg261 = msg("FSAD_TERMINATING_SIGNAL", part282); - - var part283 = match("MESSAGE#257:FSAD_TRACEOPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Open operation on trace file `%{filename}' returned error %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Open operation on trace file failed"), - dup23, - ])); - - var msg262 = msg("FSAD_TRACEOPEN_FAILED", part283); - - var part284 = match("MESSAGE#258:FSAD_USAGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect usage, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Incorrect FSAD usage"), - dup23, - ])); - - var msg263 = msg("FSAD_USAGE", part284); - - var part285 = match("MESSAGE#259:GGSN_ALARM_TRAP_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","GGSN ALARM TRAP FAILED"), - dup23, - ])); - - var msg264 = msg("GGSN_ALARM_TRAP_FAILED", part285); - - var part286 = match("MESSAGE#260:GGSN_ALARM_TRAP_SEND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","GGSN ALARM TRAP SEND FAILED"), - dup23, - ])); - - var msg265 = msg("GGSN_ALARM_TRAP_SEND", part286); - - var part287 = match("MESSAGE#261:GGSN_TRAP_SEND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown trap request type %{obj_type}", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown trap request type"), - dup23, - ])); - - var msg266 = msg("GGSN_TRAP_SEND", part287); - - var part288 = match("MESSAGE#262:JADE_AUTH_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authorization failed: %{result}", processor_chain([ - dup69, - dup34, - setc("ec_subject","Service"), - dup43, - dup22, - setc("event_description","Authorization failed"), - dup23, - ])); - - var msg267 = msg("JADE_AUTH_ERROR", part288); - - var part289 = match("MESSAGE#263:JADE_EXEC_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: CLI %{resultcode->} %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JADE EXEC ERROR"), - dup23, - ])); - - var msg268 = msg("JADE_EXEC_ERROR", part289); - - var part290 = match("MESSAGE#264:JADE_NO_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Local user %{username->} does not exist", processor_chain([ - dup30, - dup22, - setc("event_description","Local user does not exist"), - dup23, - ])); - - var msg269 = msg("JADE_NO_LOCAL_USER", part290); - - var part291 = match("MESSAGE#265:JADE_PAM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JADE PAM error"), - dup23, - ])); - - var msg270 = msg("JADE_PAM_ERROR", part291); - - var part292 = match("MESSAGE#266:JADE_PAM_NO_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to get local username from PAM: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to get local username from PAM"), - dup23, - ])); - - var msg271 = msg("JADE_PAM_NO_LOCAL_USER", part292); - - var part293 = match("MESSAGE#267:KERN_ARP_ADDR_CHANGE", "nwparser.payload", "%{process}: %{event_type}: arp info overwritten for %{saddr->} from %{smacaddr->} to %{dmacaddr}", processor_chain([ - dup30, - dup22, - setc("event_description","arp info overwritten"), - dup23, - ])); - - var msg272 = msg("KERN_ARP_ADDR_CHANGE", part293); - - var part294 = match("MESSAGE#268:KMD_PM_SA_ESTABLISHED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Local gateway: %{gateway}, Remote gateway: %{fld1}, Local ID:%{fld2}, Remote ID:%{fld3}, Direction:%{fld4}, SPI:%{fld5}", processor_chain([ - dup30, - dup22, - setc("event_description","security association has been established"), - dup23, - ])); - - var msg273 = msg("KMD_PM_SA_ESTABLISHED", part294); - - var part295 = match("MESSAGE#269:L2CPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitialized", processor_chain([ - dup21, - dup22, - setc("event_description","Task Reinitialized"), - dup61, - dup23, - ])); - - var msg274 = msg("L2CPD_TASK_REINIT", part295); - - var part296 = match("MESSAGE#270:LIBJNX_EXEC_EXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command stopped: PID %{child_pid}, signal='%{obj_type}' %{result}, command '%{action}'", processor_chain([ - dup21, - dup22, - dup70, - dup23, - ])); - - var msg275 = msg("LIBJNX_EXEC_EXITED", part296); - - var part297 = match("MESSAGE#271:LIBJNX_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exec failed for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Child exec failed for command"), - dup23, - ])); - - var msg276 = msg("LIBJNX_EXEC_FAILED", part297); - - var msg277 = msg("LIBJNX_EXEC_PIPE", dup144); - - var part298 = match("MESSAGE#273:LIBJNX_EXEC_SIGNALED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command received signal: PID %{child_pid}, signal %{result}, command '%{action}'", processor_chain([ - dup30, - dup22, - setc("event_description","Command received signal"), - dup23, - ])); - - var msg278 = msg("LIBJNX_EXEC_SIGNALED", part298); - - var part299 = match("MESSAGE#274:LIBJNX_EXEC_WEXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command exited: PID %{child_pid}, status %{result}, command '%{action}'", processor_chain([ - dup21, - dup22, - dup72, - dup23, - ])); - - var msg279 = msg("LIBJNX_EXEC_WEXIT", part299); - - var part300 = match("MESSAGE#275:LIBJNX_FILE_COPY_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: copy_file_to_transfer_dir failed to copy from source to destination", processor_chain([ - dup73, - dup22, - setc("event_description","copy_file_to_transfer_dir failed to copy"), - dup23, - ])); - - var msg280 = msg("LIBJNX_FILE_COPY_FAILED", part300); - - var part301 = match("MESSAGE#276:LIBJNX_PRIV_LOWER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lower privilege level: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Unable to lower privilege level"), - dup23, - ])); - - var msg281 = msg("LIBJNX_PRIV_LOWER_FAILED", part301); - - var part302 = match("MESSAGE#277:LIBJNX_PRIV_RAISE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to raise privilege level: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Unable to raise privilege level"), - dup23, - ])); - - var msg282 = msg("LIBJNX_PRIV_RAISE_FAILED", part302); - - var part303 = match("MESSAGE#278:LIBJNX_REPLICATE_RCP_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","rcp failed"), - dup23, - ])); - - var msg283 = msg("LIBJNX_REPLICATE_RCP_EXEC_FAILED", part303); - - var part304 = match("MESSAGE#279:LIBJNX_ROTATE_COMPRESS_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode->} %{dclass_counter1->} -f %{action}: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","ROTATE COMPRESS EXEC FAILED"), - dup23, - ])); - - var msg284 = msg("LIBJNX_ROTATE_COMPRESS_EXEC_FAILED", part304); - - var part305 = match("MESSAGE#280:LIBSERVICED_CLIENT_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Client connection error: %{result}", processor_chain([ - dup74, - dup22, - setc("event_description","Client connection error"), - dup23, - ])); - - var msg285 = msg("LIBSERVICED_CLIENT_CONNECTION", part305); - - var part306 = match("MESSAGE#281:LIBSERVICED_OUTBOUND_REQUEST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Outbound request failed for command [%{action}]: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Outbound request failed for command"), - dup23, - ])); - - var msg286 = msg("LIBSERVICED_OUTBOUND_REQUEST", part306); - - var part307 = match("MESSAGE#282:LIBSERVICED_SNMP_LOST_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection closed while receiving from client %{dclass_counter1}", processor_chain([ - dup27, - dup22, - setc("event_description","Connection closed while receiving from client"), - dup23, - ])); - - var msg287 = msg("LIBSERVICED_SNMP_LOST_CONNECTION", part307); - - var part308 = match("MESSAGE#283:LIBSERVICED_SOCKET_BIND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode}: unable to bind socket %{ssid}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to bind socket"), - dup23, - ])); - - var msg288 = msg("LIBSERVICED_SOCKET_BIND", part308); - - var part309 = match("MESSAGE#284:LIBSERVICED_SOCKET_PRIVATIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to attach socket %{ssid->} to management routing instance: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to attach socket to management routing instance"), - dup23, - ])); - - var msg289 = msg("LIBSERVICED_SOCKET_PRIVATIZE", part309); - - var part310 = match("MESSAGE#285:LICENSE_EXPIRED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LICENSE EXPIRED"), - dup23, - ])); - - var msg290 = msg("LICENSE_EXPIRED", part310); - - var part311 = match("MESSAGE#286:LICENSE_EXPIRED_KEY_DELETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License key \"%{filename}\" has expired.", processor_chain([ - dup21, - dup22, - setc("event_description","License key has expired"), - dup23, - ])); - - var msg291 = msg("LICENSE_EXPIRED_KEY_DELETED", part311); - - var part312 = match("MESSAGE#287:LICENSE_NEARING_EXPIRY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License for feature %{disposition->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","License key expiration soon"), - dup23, - ])); - - var msg292 = msg("LICENSE_NEARING_EXPIRY", part312); - - var part313 = match("MESSAGE#288:LOGIN_ABORTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Client aborted login", processor_chain([ - dup30, - dup22, - setc("event_description","client aborted login"), - dup23, - ])); - - var msg293 = msg("LOGIN_ABORTED", part313); - - var part314 = match("MESSAGE#289:LOGIN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login failed for user %{username->} from host %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - dup23, - ])); - - var msg294 = msg("LOGIN_FAILED", part314); - - var part315 = match("MESSAGE#290:LOGIN_FAILED_INCORRECT_PASSWORD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect password for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Incorrect password for user"), - dup23, - ])); - - var msg295 = msg("LOGIN_FAILED_INCORRECT_PASSWORD", part315); - - var part316 = match("MESSAGE#291:LOGIN_FAILED_SET_CONTEXT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to set context for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Failed to set context for user"), - dup23, - ])); - - var msg296 = msg("LOGIN_FAILED_SET_CONTEXT", part316); - - var part317 = match("MESSAGE#292:LOGIN_FAILED_SET_LOGIN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to set login ID for user %{username}: %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Failed to set login ID for user"), - dup23, - ])); - - var msg297 = msg("LOGIN_FAILED_SET_LOGIN", part317); - - var part318 = match("MESSAGE#293:LOGIN_HOSTNAME_UNRESOLVED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to resolve hostname %{dhost}: %{info}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Unable to resolve hostname"), - dup23, - ])); - - var msg298 = msg("LOGIN_HOSTNAME_UNRESOLVED", part318); - - var part319 = match("MESSAGE#294:LOGIN_INFORMATION/2", "nwparser.p0", "%{event_type}: %{p0}"); - - var part320 = match("MESSAGE#294:LOGIN_INFORMATION/4", "nwparser.p0", "%{username->} logged in from host %{dhost->} on %{p0}"); - - var part321 = match("MESSAGE#294:LOGIN_INFORMATION/5_0", "nwparser.p0", "device %{p0}"); - - var select34 = linear_select([ - part321, - dup45, - ]); - - var part322 = match("MESSAGE#294:LOGIN_INFORMATION/6", "nwparser.p0", "%{terminal}"); - - var all19 = all_match({ - processors: [ - dup39, - dup137, - part319, - dup145, - part320, - select34, - part322, - ], - on_success: processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","Successful Login"), - dup23, - ]), - }); - - var msg299 = msg("LOGIN_INFORMATION", all19); - - var part323 = match("MESSAGE#295:LOGIN_INVALID_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No entry in local password file for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","No entry in local password file for user"), - dup23, - ])); - - var msg300 = msg("LOGIN_INVALID_LOCAL_USER", part323); - - var part324 = match("MESSAGE#296:LOGIN_MALFORMED_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid username: %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Invalid username"), - dup23, - ])); - - var msg301 = msg("LOGIN_MALFORMED_USER", part324); - - var part325 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/1_0", "nwparser.p0", "PAM authentication error for user %{p0}"); - - var part326 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/1_1", "nwparser.p0", "Failed password for user %{p0}"); - - var select35 = linear_select([ - part325, - part326, - ]); - - var part327 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/2", "nwparser.p0", "%{username}"); - - var all20 = all_match({ - processors: [ - dup50, - select35, - part327, - ], - on_success: processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","PAM authentication error for user"), - dup23, - ]), - }); - - var msg302 = msg("LOGIN_PAM_AUTHENTICATION_ERROR", all20); - - var part328 = match("MESSAGE#298:LOGIN_PAM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failure while authenticating user %{username}: %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - setc("event_description","PAM authentication failure"), - setc("result","Failure while authenticating user"), - dup23, - ])); - - var msg303 = msg("LOGIN_PAM_ERROR", part328); - - var part329 = match("MESSAGE#299:LOGIN_PAM_MAX_RETRIES", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Too many retries while authenticating user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Too many retries while authenticating user"), - dup23, - ])); - - var msg304 = msg("LOGIN_PAM_MAX_RETRIES", part329); - - var part330 = match("MESSAGE#300:LOGIN_PAM_NONLOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} authenticated but has no local login ID", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","User authenticated but has no local login ID"), - dup23, - ])); - - var msg305 = msg("LOGIN_PAM_NONLOCAL_USER", part330); - - var part331 = match("MESSAGE#301:LOGIN_PAM_STOP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to end PAM session: %{info}", processor_chain([ - setc("eventcategory","1303000000"), - dup34, - dup43, - dup22, - setc("event_description","Failed to end PAM session"), - dup23, - ])); - - var msg306 = msg("LOGIN_PAM_STOP", part331); - - var part332 = match("MESSAGE#302:LOGIN_PAM_USER_UNKNOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Attempt to authenticate unknown user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Attempt to authenticate unknown user"), - dup23, - ])); - - var msg307 = msg("LOGIN_PAM_USER_UNKNOWN", part332); - - var part333 = match("MESSAGE#303:LOGIN_PASSWORD_EXPIRED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Forcing change of expired password for user %{username}>", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Forcing change of expired password for user"), - dup23, - ])); - - var msg308 = msg("LOGIN_PASSWORD_EXPIRED", part333); - - var part334 = match("MESSAGE#304:LOGIN_REFUSED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login of user %{username->} from host %{shost->} on %{terminal->} was refused: %{info}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Login of user refused"), - dup23, - ])); - - var msg309 = msg("LOGIN_REFUSED", part334); - - var part335 = match("MESSAGE#305:LOGIN_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} logged in as root from host %{shost->} on %{terminal}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","successful login as root"), - setc("result","User logged in as root"), - dup23, - ])); - - var msg310 = msg("LOGIN_ROOT", part335); - - var part336 = match("MESSAGE#306:LOGIN_TIMED_OUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login attempt timed out after %{dclass_counter1->} seconds", processor_chain([ - dup44, - dup34, - dup36, - dup43, - dup22, - dup75, - setc("result","Login attempt timed out"), - dup23, - ])); - - var msg311 = msg("LOGIN_TIMED_OUT", part336); - - var part337 = match("MESSAGE#307:MIB2D_ATM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D ATM ERROR"), - dup23, - ])); - - var msg312 = msg("MIB2D_ATM_ERROR", part337); - - var part338 = match("MESSAGE#308:MIB2D_CONFIG_CHECK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CONFIG CHECK FAILED"), - dup23, - ])); - - var msg313 = msg("MIB2D_CONFIG_CHECK_FAILED", part338); - - var part339 = match("MESSAGE#309:MIB2D_FILE_OPEN_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open file '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - dup78, - dup23, - ])); - - var msg314 = msg("MIB2D_FILE_OPEN_FAILURE", part339); - - var msg315 = msg("MIB2D_IFD_IFINDEX_FAILURE", dup146); - - var msg316 = msg("MIB2D_IFL_IFINDEX_FAILURE", dup146); - - var part340 = match("MESSAGE#312:MIB2D_INIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: mib2d initialization failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","mib2d initialization failure"), - dup23, - ])); - - var msg317 = msg("MIB2D_INIT_FAILURE", part340); - - var part341 = match("MESSAGE#313:MIB2D_KVM_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D KVM FAILURE"), - dup23, - ])); - - var msg318 = msg("MIB2D_KVM_FAILURE", part341); - - var part342 = match("MESSAGE#314:MIB2D_RTSLIB_READ_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: failed in %{dclass_counter1->} %{dclass_counter2->} index (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D RTSLIB READ FAILURE"), - dup23, - ])); - - var msg319 = msg("MIB2D_RTSLIB_READ_FAILURE", part342); - - var part343 = match("MESSAGE#315:MIB2D_RTSLIB_SEQ_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: sequence mismatch (%{result}), %{action}", processor_chain([ - dup30, - dup22, - setc("event_description","RTSLIB sequence mismatch"), - dup23, - ])); - - var msg320 = msg("MIB2D_RTSLIB_SEQ_MISMATCH", part343); - - var part344 = match("MESSAGE#316:MIB2D_SYSCTL_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D SYSCTL FAILURE"), - dup23, - ])); - - var msg321 = msg("MIB2D_SYSCTL_FAILURE", part344); - - var part345 = match("MESSAGE#317:MIB2D_TRAP_HEADER_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: trap_request_header failed", processor_chain([ - dup30, - dup22, - setc("event_description","trap_request_header failed"), - dup23, - ])); - - var msg322 = msg("MIB2D_TRAP_HEADER_FAILURE", part345); - - var part346 = match("MESSAGE#318:MIB2D_TRAP_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D TRAP SEND FAILURE"), - dup23, - ])); - - var msg323 = msg("MIB2D_TRAP_SEND_FAILURE", part346); - - var part347 = match("MESSAGE#319:Multiuser", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: old requested_transition==%{change_new->} sighupped=%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","user sighupped"), - dup23, - ])); - - var msg324 = msg("Multiuser", part347); - - var part348 = match("MESSAGE#320:NASD_AUTHENTICATION_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate authentication handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate authentication handle"), - dup23, - ])); - - var msg325 = msg("NASD_AUTHENTICATION_CREATE_FAILED", part348); - - var part349 = match("MESSAGE#321:NASD_CHAP_AUTHENTICATION_IN_PROGRESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename}, authentication already in progress", processor_chain([ - dup80, - dup34, - dup43, - dup22, - setc("event_description","authentication already in progress"), - dup23, - ])); - - var msg326 = msg("NASD_CHAP_AUTHENTICATION_IN_PROGRESS", part349); - - var part350 = match("MESSAGE#322:NASD_CHAP_GETHOSTNAME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: unable to obtain hostname for outgoing CHAP message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to obtain hostname for outgoing CHAP message"), - dup23, - ])); - - var msg327 = msg("NASD_CHAP_GETHOSTNAME_FAILED", part350); - - var part351 = match("MESSAGE#323:NASD_CHAP_INVALID_CHAP_IDENTIFIER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename->} expected CHAP ID: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP INVALID_CHAP IDENTIFIER"), - dup23, - ])); - - var msg328 = msg("NASD_CHAP_INVALID_CHAP_IDENTIFIER", part351); - - var part352 = match("MESSAGE#324:NASD_CHAP_INVALID_OPCODE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}.%{dclass_counter1}: invalid operation code received %{filename}, CHAP ID: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP INVALID OPCODE"), - dup23, - ])); - - var msg329 = msg("NASD_CHAP_INVALID_OPCODE", part352); - - var part353 = match("MESSAGE#325:NASD_CHAP_LOCAL_NAME_UNAVAILABLE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine value for '%{username}' in outgoing CHAP packet", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine value for username in outgoing CHAP packet"), - dup23, - ])); - - var msg330 = msg("NASD_CHAP_LOCAL_NAME_UNAVAILABLE", part353); - - var part354 = match("MESSAGE#326:NASD_CHAP_MESSAGE_UNEXPECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP MESSAGE UNEXPECTED"), - dup23, - ])); - - var msg331 = msg("NASD_CHAP_MESSAGE_UNEXPECTED", part354); - - var part355 = match("MESSAGE#327:NASD_CHAP_REPLAY_ATTACK_DETECTED", "nwparser.payload", "%{process}[%{ssid}]: %{event_type}: %{interface}.%{dclass_counter1}: received %{filename->} %{result}.%{info}", processor_chain([ - dup81, - dup22, - setc("event_description","CHAP REPLAY ATTACK DETECTED"), - dup23, - ])); - - var msg332 = msg("NASD_CHAP_REPLAY_ATTACK_DETECTED", part355); - - var part356 = match("MESSAGE#328:NASD_CONFIG_GET_LAST_MODIFIED_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine last modified time of JUNOS configuration database: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine last modified time of JUNOS configuration database"), - dup23, - ])); - - var msg333 = msg("NASD_CONFIG_GET_LAST_MODIFIED_FAILED", part356); - - var msg334 = msg("NASD_DAEMONIZE_FAILED", dup140); - - var part357 = match("MESSAGE#330:NASD_DB_ALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate database object: %{filename}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate database object"), - dup23, - ])); - - var msg335 = msg("NASD_DB_ALLOC_FAILURE", part357); - - var part358 = match("MESSAGE#331:NASD_DB_TABLE_CREATE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{filename}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DB TABLE CREATE FAILURE"), - dup23, - ])); - - var msg336 = msg("NASD_DB_TABLE_CREATE_FAILURE", part358); - - var msg337 = msg("NASD_DUPLICATE", dup141); - - var part359 = match("MESSAGE#333:NASD_EVLIB_CREATE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} with: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","EVLIB CREATE FAILURE"), - dup23, - ])); - - var msg338 = msg("NASD_EVLIB_CREATE_FAILURE", part359); - - var part360 = match("MESSAGE#334:NASD_EVLIB_EXIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} value: %{result}, error: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","EVLIB EXIT FAILURE"), - dup23, - ])); - - var msg339 = msg("NASD_EVLIB_EXIT_FAILURE", part360); - - var part361 = match("MESSAGE#335:NASD_LOCAL_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate LOCAL module handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate LOCAL module handle"), - dup23, - ])); - - var msg340 = msg("NASD_LOCAL_CREATE_FAILED", part361); - - var part362 = match("MESSAGE#336:NASD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","NASD must be run as root"), - dup23, - ])); - - var msg341 = msg("NASD_NOT_ROOT", part362); - - var msg342 = msg("NASD_PID_FILE_LOCK", dup142); - - var msg343 = msg("NASD_PID_FILE_UPDATE", dup143); - - var part363 = match("MESSAGE#339:NASD_POST_CONFIGURE_EVENT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","POST CONFIGURE EVENT FAILED"), - dup23, - ])); - - var msg344 = msg("NASD_POST_CONFIGURE_EVENT_FAILED", part363); - - var part364 = match("MESSAGE#340:NASD_PPP_READ_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PPP READ FAILURE"), - dup23, - ])); - - var msg345 = msg("NASD_PPP_READ_FAILURE", part364); - - var part365 = match("MESSAGE#341:NASD_PPP_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to send message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to send message"), - dup23, - ])); - - var msg346 = msg("NASD_PPP_SEND_FAILURE", part365); - - var part366 = match("MESSAGE#342:NASD_PPP_SEND_PARTIAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to send all of message: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to send all of message"), - dup23, - ])); - - var msg347 = msg("NASD_PPP_SEND_PARTIAL", part366); - - var part367 = match("MESSAGE#343:NASD_PPP_UNRECOGNIZED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unrecognized authentication protocol: %{protocol}", processor_chain([ - dup30, - dup22, - setc("event_description","Unrecognized authentication protocol"), - dup23, - ])); - - var msg348 = msg("NASD_PPP_UNRECOGNIZED", part367); - - var part368 = match("MESSAGE#344:NASD_RADIUS_ALLOCATE_PASSWORD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} when allocating password for RADIUS: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS password allocation failure"), - dup23, - ])); - - var msg349 = msg("NASD_RADIUS_ALLOCATE_PASSWORD_FAILED", part368); - - var part369 = match("MESSAGE#345:NASD_RADIUS_CONFIG_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS CONFIG FAILED"), - dup23, - ])); - - var msg350 = msg("NASD_RADIUS_CONFIG_FAILED", part369); - - var part370 = match("MESSAGE#346:NASD_RADIUS_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate RADIUS module handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate RADIUS module handle"), - dup23, - ])); - - var msg351 = msg("NASD_RADIUS_CREATE_FAILED", part370); - - var part371 = match("MESSAGE#347:NASD_RADIUS_CREATE_REQUEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS CREATE REQUEST FAILED"), - dup23, - ])); - - var msg352 = msg("NASD_RADIUS_CREATE_REQUEST_FAILED", part371); - - var part372 = match("MESSAGE#348:NASD_RADIUS_GETHOSTNAME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain hostname for outgoing RADIUS message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain hostname for outgoing RADIUS message"), - dup23, - ])); - - var msg353 = msg("NASD_RADIUS_GETHOSTNAME_FAILED", part372); - - var part373 = match("MESSAGE#349:NASD_RADIUS_MESSAGE_UNEXPECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown response from RADIUS server: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown response from RADIUS server"), - dup23, - ])); - - var msg354 = msg("NASD_RADIUS_MESSAGE_UNEXPECTED", part373); - - var part374 = match("MESSAGE#350:NASD_RADIUS_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS OPEN FAILED"), - dup23, - ])); - - var msg355 = msg("NASD_RADIUS_OPEN_FAILED", part374); - - var part375 = match("MESSAGE#351:NASD_RADIUS_SELECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS SELECT FAILED"), - dup23, - ])); - - var msg356 = msg("NASD_RADIUS_SELECT_FAILED", part375); - - var part376 = match("MESSAGE#352:NASD_RADIUS_SET_TIMER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS SET TIMER FAILED"), - dup23, - ])); - - var msg357 = msg("NASD_RADIUS_SET_TIMER_FAILED", part376); - - var part377 = match("MESSAGE#353:NASD_TRACE_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TRACE FILE OPEN FAILED"), - dup23, - ])); - - var msg358 = msg("NASD_TRACE_FILE_OPEN_FAILED", part377); - - var part378 = match("MESSAGE#354:NASD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","NASD Usage"), - dup23, - ])); - - var msg359 = msg("NASD_usage", part378); - - var part379 = match("MESSAGE#355:NOTICE", "nwparser.payload", "%{agent}: %{event_type}:%{action}: %{event_description}: The %{result}", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg360 = msg("NOTICE", part379); - - var part380 = match("MESSAGE#356:PFE_FW_SYSLOG_IP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FW: %{smacaddr->} %{fld10->} %{protocol->} %{saddr->} %{daddr->} %{sport->} %{dport->} (%{packets->} packets)", processor_chain([ - dup21, - dup22, - dup82, - dup23, - ])); - - var msg361 = msg("PFE_FW_SYSLOG_IP", part380); - - var part381 = match("MESSAGE#357:PFE_FW_SYSLOG_IP:01", "nwparser.payload", "%{hostip->} %{hostname->} %{event_type}: FW: %{smacaddr->} %{fld10->} %{protocol->} %{saddr->} %{daddr->} %{sport->} %{dport->} (%{packets->} packets)", processor_chain([ - dup21, - dup22, - dup82, - dup23, - ])); - - var msg362 = msg("PFE_FW_SYSLOG_IP:01", part381); - - var select36 = linear_select([ - msg361, - msg362, - ]); - - var part382 = match("MESSAGE#358:PFE_NH_RESOLVE_THROTTLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Next-hop resolution requests from interface %{interface->} throttled", processor_chain([ - dup21, - dup22, - setc("event_description","Next-hop resolution requests throttled"), - dup23, - ])); - - var msg363 = msg("PFE_NH_RESOLVE_THROTTLED", part382); - - var part383 = match("MESSAGE#359:PING_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","PING TEST COMPLETED"), - dup23, - ])); - - var msg364 = msg("PING_TEST_COMPLETED", part383); - - var part384 = match("MESSAGE#360:PING_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","PING TEST FAILED"), - dup23, - ])); - - var msg365 = msg("PING_TEST_FAILED", part384); - - var part385 = match("MESSAGE#361:process_mode/2", "nwparser.p0", "%{p0}"); - - var part386 = match("MESSAGE#361:process_mode/3_0", "nwparser.p0", "%{event_type}: %{p0}"); - - var part387 = match("MESSAGE#361:process_mode/3_1", "nwparser.p0", "%{event_type->} %{p0}"); - - var select37 = linear_select([ - part386, - part387, - ]); - - var part388 = match("MESSAGE#361:process_mode/4", "nwparser.p0", "mode=%{protocol->} cmd=%{action->} master_mode=%{result}"); - - var all21 = all_match({ - processors: [ - dup39, - dup137, - part385, - select37, - part388, - ], - on_success: processor_chain([ - dup21, - dup22, - dup83, - dup23, - ]), - }); - - var msg366 = msg("process_mode", all21); - - var part389 = match("MESSAGE#362:process_mode:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: current_mode=%{protocol}, requested_mode=%{result}, cmd=%{action}", processor_chain([ - dup21, - dup22, - dup83, - dup23, - ])); - - var msg367 = msg("process_mode:01", part389); - - var select38 = linear_select([ - msg366, - msg367, - ]); - - var part390 = match("MESSAGE#363:PWC_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} exiting with status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","process exit with status"), - dup23, - ])); - - var msg368 = msg("PWC_EXIT", part390); - - var part391 = match("MESSAGE#364:PWC_HOLD_RELEASE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} released child %{child_pid->} from %{dclass_counter1->} state", processor_chain([ - dup21, - dup22, - setc("event_description","Process released child from state"), - dup23, - ])); - - var msg369 = msg("PWC_HOLD_RELEASE", part391); - - var part392 = match("MESSAGE#365:PWC_INVALID_RUNS_ARGUMENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}, not %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","invalid runs argument"), - dup23, - ])); - - var msg370 = msg("PWC_INVALID_RUNS_ARGUMENT", part392); - - var part393 = match("MESSAGE#366:PWC_INVALID_TIMEOUT_ARGUMENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","INVALID TIMEOUT ARGUMENT"), - dup23, - ])); - - var msg371 = msg("PWC_INVALID_TIMEOUT_ARGUMENT", part393); - - var part394 = match("MESSAGE#367:PWC_KILLED_BY_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc process %{agent->} received terminating signal", processor_chain([ - dup21, - dup22, - setc("event_description","pwc process received terminating signal"), - dup23, - ])); - - var msg372 = msg("PWC_KILLED_BY_SIGNAL", part394); - - var part395 = match("MESSAGE#368:PWC_KILL_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc is sending %{resultcode->} to child %{child_pid}", processor_chain([ - dup30, - dup22, - setc("event_description","pwc is sending kill event to child"), - dup23, - ])); - - var msg373 = msg("PWC_KILL_EVENT", part395); - - var part396 = match("MESSAGE#369:PWC_KILL_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to kill process %{child_pid}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to kill process"), - dup23, - ])); - - var msg374 = msg("PWC_KILL_FAILED", part396); - - var part397 = match("MESSAGE#370:PWC_KQUEUE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: kevent failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","kevent failed"), - dup23, - ])); - - var msg375 = msg("PWC_KQUEUE_ERROR", part397); - - var part398 = match("MESSAGE#371:PWC_KQUEUE_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create kqueue: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create kqueue"), - dup23, - ])); - - var msg376 = msg("PWC_KQUEUE_INIT", part398); - - var part399 = match("MESSAGE#372:PWC_KQUEUE_REGISTER_FILTER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to register kqueue filter: %{agent->} for purpose: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to register kqueue filter"), - dup23, - ])); - - var msg377 = msg("PWC_KQUEUE_REGISTER_FILTER", part399); - - var part400 = match("MESSAGE#373:PWC_LOCKFILE_BAD_FORMAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file has bad format: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file has bad format"), - dup23, - ])); - - var msg378 = msg("PWC_LOCKFILE_BAD_FORMAT", part400); - - var part401 = match("MESSAGE#374:PWC_LOCKFILE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file had error: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file error"), - dup23, - ])); - - var msg379 = msg("PWC_LOCKFILE_ERROR", part401); - - var part402 = match("MESSAGE#375:PWC_LOCKFILE_MISSING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file not found: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file not found"), - dup23, - ])); - - var msg380 = msg("PWC_LOCKFILE_MISSING", part402); - - var part403 = match("MESSAGE#376:PWC_LOCKFILE_NOT_LOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file not locked: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file not locked"), - dup23, - ])); - - var msg381 = msg("PWC_LOCKFILE_NOT_LOCKED", part403); - - var part404 = match("MESSAGE#377:PWC_NO_PROCESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No process specified", processor_chain([ - dup30, - dup22, - setc("event_description","No process specified for PWC"), - dup23, - ])); - - var msg382 = msg("PWC_NO_PROCESS", part404); - - var part405 = match("MESSAGE#378:PWC_PROCESS_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc process %{agent->} child %{child_pid->} exited with status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","pwc process exited with status"), - dup23, - ])); - - var msg383 = msg("PWC_PROCESS_EXIT", part405); - - var part406 = match("MESSAGE#379:PWC_PROCESS_FORCED_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} forcing hold down of child %{child_pid->} until signal", processor_chain([ - dup21, - dup22, - setc("event_description","Process forcing hold down of child until signalled"), - dup23, - ])); - - var msg384 = msg("PWC_PROCESS_FORCED_HOLD", part406); - - var part407 = match("MESSAGE#380:PWC_PROCESS_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} holding down child %{child_pid->} until signal", processor_chain([ - dup21, - dup22, - setc("event_description","Process holding down child until signalled"), - dup23, - ])); - - var msg385 = msg("PWC_PROCESS_HOLD", part407); - - var part408 = match("MESSAGE#381:PWC_PROCESS_HOLD_SKIPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} will not down child %{child_pid->} because of %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Process not holding down child"), - dup23, - ])); - - var msg386 = msg("PWC_PROCESS_HOLD_SKIPPED", part408); - - var part409 = match("MESSAGE#382:PWC_PROCESS_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to create child process with pidpopen: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to create child process with pidpopen"), - dup23, - ])); - - var msg387 = msg("PWC_PROCESS_OPEN", part409); - - var part410 = match("MESSAGE#383:PWC_PROCESS_TIMED_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} holding down child %{child_pid->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Process holding down child"), - dup23, - ])); - - var msg388 = msg("PWC_PROCESS_TIMED_HOLD", part410); - - var part411 = match("MESSAGE#384:PWC_PROCESS_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child timed out %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Child process timed out"), - dup23, - ])); - - var msg389 = msg("PWC_PROCESS_TIMEOUT", part411); - - var part412 = match("MESSAGE#385:PWC_SIGNAL_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: signal(%{agent}) failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","signal failure"), - dup23, - ])); - - var msg390 = msg("PWC_SIGNAL_INIT", part412); - - var part413 = match("MESSAGE#386:PWC_SOCKET_CONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to connect socket to %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to connect socket to service"), - dup23, - ])); - - var msg391 = msg("PWC_SOCKET_CONNECT", part413); - - var part414 = match("MESSAGE#387:PWC_SOCKET_CREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to create socket: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to create socket"), - dup23, - ])); - - var msg392 = msg("PWC_SOCKET_CREATE", part414); - - var part415 = match("MESSAGE#388:PWC_SOCKET_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to set socket option %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to set socket option"), - dup23, - ])); - - var msg393 = msg("PWC_SOCKET_OPTION", part415); - - var part416 = match("MESSAGE#389:PWC_STDOUT_WRITE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Write to stdout failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Write to stdout failed"), - dup23, - ])); - - var msg394 = msg("PWC_STDOUT_WRITE", part416); - - var part417 = match("MESSAGE#390:PWC_SYSTEM_CALL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","PWC SYSTEM CALL"), - dup23, - ])); - - var msg395 = msg("PWC_SYSTEM_CALL", part417); - - var part418 = match("MESSAGE#391:PWC_UNKNOWN_KILL_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown kill option [%{agent}]", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown kill option"), - dup23, - ])); - - var msg396 = msg("PWC_UNKNOWN_KILL_OPTION", part418); - - var part419 = match("MESSAGE#392:RMOPD_ADDRESS_MULTICAST_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Multicast address is not allowed", processor_chain([ - dup30, - dup22, - setc("event_description","Multicast address not allowed"), - dup23, - ])); - - var msg397 = msg("RMOPD_ADDRESS_MULTICAST_INVALID", part419); - - var part420 = match("MESSAGE#393:RMOPD_ADDRESS_SOURCE_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Source address invalid: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RMOPD ADDRESS SOURCE INVALID"), - dup23, - ])); - - var msg398 = msg("RMOPD_ADDRESS_SOURCE_INVALID", part420); - - var part421 = match("MESSAGE#394:RMOPD_ADDRESS_STRING_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to convert numeric address to string: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to convert numeric address to string"), - dup23, - ])); - - var msg399 = msg("RMOPD_ADDRESS_STRING_FAILURE", part421); - - var part422 = match("MESSAGE#395:RMOPD_ADDRESS_TARGET_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: rmop_util_set_address status message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","rmop_util_set_address status message invalid"), - dup23, - ])); - - var msg400 = msg("RMOPD_ADDRESS_TARGET_INVALID", part422); - - var msg401 = msg("RMOPD_DUPLICATE", dup141); - - var part423 = match("MESSAGE#397:RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Only IPv4 source address is supported", processor_chain([ - dup30, - dup22, - setc("event_description","Only IPv4 source address is supported"), - dup23, - ])); - - var msg402 = msg("RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED", part423); - - var part424 = match("MESSAGE#398:RMOPD_ICMP_SENDMSG_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{fld1}: No route to host", processor_chain([ - dup30, - dup22, - setc("event_description","No route to host"), - dup23, - ])); - - var msg403 = msg("RMOPD_ICMP_SENDMSG_FAILURE", part424); - - var part425 = match("MESSAGE#399:RMOPD_IFINDEX_NOT_ACTIVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifindex: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","IFINDEX NOT ACTIVE"), - dup23, - ])); - - var msg404 = msg("RMOPD_IFINDEX_NOT_ACTIVE", part425); - - var part426 = match("MESSAGE#400:RMOPD_IFINDEX_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for %{interface}, message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IFINDEX NO INFO"), - dup23, - ])); - - var msg405 = msg("RMOPD_IFINDEX_NO_INFO", part426); - - var part427 = match("MESSAGE#401:RMOPD_IFNAME_NOT_ACTIVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifname: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","RMOPD IFNAME NOT ACTIVE"), - dup23, - ])); - - var msg406 = msg("RMOPD_IFNAME_NOT_ACTIVE", part427); - - var part428 = match("MESSAGE#402:RMOPD_IFNAME_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for %{interface}, message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IFNAME NO INFO"), - dup23, - ])); - - var msg407 = msg("RMOPD_IFNAME_NO_INFO", part428); - - var part429 = match("MESSAGE#403:RMOPD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","RMOPD Must be run as root"), - dup23, - ])); - - var msg408 = msg("RMOPD_NOT_ROOT", part429); - - var part430 = match("MESSAGE#404:RMOPD_ROUTING_INSTANCE_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for routing instance %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","No information for routing instance"), - dup23, - ])); - - var msg409 = msg("RMOPD_ROUTING_INSTANCE_NO_INFO", part430); - - var part431 = match("MESSAGE#405:RMOPD_TRACEROUTE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TRACEROUTE ERROR"), - dup23, - ])); - - var msg410 = msg("RMOPD_TRACEROUTE_ERROR", part431); - - var part432 = match("MESSAGE#406:RMOPD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","RMOPD usage"), - dup23, - ])); - - var msg411 = msg("RMOPD_usage", part432); - - var part433 = match("MESSAGE#407:RPD_ABORT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} version built by builder on %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD ABORT"), - dup23, - ])); - - var msg412 = msg("RPD_ABORT", part433); - - var part434 = match("MESSAGE#408:RPD_ACTIVE_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Exiting with active tasks: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD exiting with active tasks"), - dup23, - ])); - - var msg413 = msg("RPD_ACTIVE_TERMINATE", part434); - - var part435 = match("MESSAGE#409:RPD_ASSERT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Assertion failed %{resultcode}: file \"%{filename}\", line %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD Assertion failed"), - dup23, - ])); - - var msg414 = msg("RPD_ASSERT", part435); - - var part436 = match("MESSAGE#410:RPD_ASSERT_SOFT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Soft assertion failed %{resultcode}: file \"%{filename}\", line %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD Soft assertion failed"), - dup23, - ])); - - var msg415 = msg("RPD_ASSERT_SOFT", part436); - - var part437 = match("MESSAGE#411:RPD_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} version built by builder on %{dclass_counter1}", processor_chain([ - dup21, - dup22, - setc("event_description","RPD EXIT"), - dup23, - ])); - - var msg416 = msg("RPD_EXIT", part437); - - var msg417 = msg("RPD_IFL_INDEXCOLLISION", dup147); - - var msg418 = msg("RPD_IFL_NAMECOLLISION", dup147); - - var part438 = match("MESSAGE#414:RPD_ISIS_ADJDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS lost %{dclass_counter1->} adjacency to %{dclass_counter2->} on %{interface}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS lost adjacency"), - dup23, - ])); - - var msg419 = msg("RPD_ISIS_ADJDOWN", part438); - - var part439 = match("MESSAGE#415:RPD_ISIS_ADJUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS new %{dclass_counter1->} adjacency to %{dclass_counter2->} %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","IS-IS new adjacency"), - dup23, - ])); - - var msg420 = msg("RPD_ISIS_ADJUP", part439); - - var part440 = match("MESSAGE#416:RPD_ISIS_ADJUPNOIP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS new %{dclass_counter1->} adjacency to %{dclass_counter2->} %{interface->} without an address", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS new adjacency without an address"), - dup23, - ])); - - var msg421 = msg("RPD_ISIS_ADJUPNOIP", part440); - - var part441 = match("MESSAGE#417:RPD_ISIS_LSPCKSUM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS %{dclass_counter1->} LSP checksum error, interface %{interface}, LSP id %{id}, sequence %{dclass_counter2}, checksum %{resultcode}, lifetime %{fld2}", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS LSP checksum error on iterface"), - dup23, - ])); - - var msg422 = msg("RPD_ISIS_LSPCKSUM", part441); - - var part442 = match("MESSAGE#418:RPD_ISIS_OVERLOAD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS database overload", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS database overload"), - dup23, - ])); - - var msg423 = msg("RPD_ISIS_OVERLOAD", part442); - - var part443 = match("MESSAGE#419:RPD_KRT_AFUNSUPRT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode}: received %{agent->} message with unsupported address family %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","message with unsupported address family received"), - dup23, - ])); - - var msg424 = msg("RPD_KRT_AFUNSUPRT", part443); - - var part444 = match("MESSAGE#420:RPD_KRT_CCC_IFL_MODIFY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}, error", processor_chain([ - dup30, - dup22, - setc("event_description","RPD KRT CCC IFL MODIFY"), - dup23, - ])); - - var msg425 = msg("RPD_KRT_CCC_IFL_MODIFY", part444); - - var part445 = match("MESSAGE#421:RPD_KRT_DELETED_RTT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: received deleted routing table from the kernel for family %{dclass_counter1->} table ID %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","received deleted routing table from kernel"), - dup23, - ])); - - var msg426 = msg("RPD_KRT_DELETED_RTT", part445); - - var part446 = match("MESSAGE#422:RPD_KRT_IFA_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifa generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifa generation mismatch"), - dup23, - ])); - - var msg427 = msg("RPD_KRT_IFA_GENERATION", part446); - - var part447 = match("MESSAGE#423:RPD_KRT_IFDCHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} CHANGE for ifd %{interface->} failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","CHANGE for ifd failed"), - dup23, - ])); - - var msg428 = msg("RPD_KRT_IFDCHANGE", part447); - - var part448 = match("MESSAGE#424:RPD_KRT_IFDEST_GET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} SERVICE: %{service->} for ifd %{interface->} failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","GET SERVICE failure on interface"), - dup23, - ])); - - var msg429 = msg("RPD_KRT_IFDEST_GET", part448); - - var part449 = match("MESSAGE#425:RPD_KRT_IFDGET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} GET index for ifd interface failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","GET index for ifd interface failed"), - dup23, - ])); - - var msg430 = msg("RPD_KRT_IFDGET", part449); - - var part450 = match("MESSAGE#426:RPD_KRT_IFD_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifd %{dclass_counter1->} generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifd generation mismatch"), - dup23, - ])); - - var msg431 = msg("RPD_KRT_IFD_GENERATION", part450); - - var part451 = match("MESSAGE#427:RPD_KRT_IFL_CELL_RELAY_MODE_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl : %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","KRT IFL CELL RELAY MODE INVALID"), - dup23, - ])); - - var msg432 = msg("RPD_KRT_IFL_CELL_RELAY_MODE_INVALID", part451); - - var part452 = match("MESSAGE#428:RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl : %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","KRT IFL CELL RELAY MODE UNSPECIFIED"), - dup23, - ])); - - var msg433 = msg("RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED", part452); - - var part453 = match("MESSAGE#429:RPD_KRT_IFL_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl %{interface->} generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifl generation mismatch"), - dup23, - ])); - - var msg434 = msg("RPD_KRT_IFL_GENERATION", part453); - - var part454 = match("MESSAGE#430:RPD_KRT_KERNEL_BAD_ROUTE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: lost %{interface->} %{dclass_counter1->} for route %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","lost interface for route"), - dup23, - ])); - - var msg435 = msg("RPD_KRT_KERNEL_BAD_ROUTE", part454); - - var part455 = match("MESSAGE#431:RPD_KRT_NEXTHOP_OVERFLOW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: number of next hops (%{dclass_counter1}) exceeded the maximum allowed (%{dclass_counter2}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","number of next hops exceeded the maximum"), - dup23, - ])); - - var msg436 = msg("RPD_KRT_NEXTHOP_OVERFLOW", part455); - - var part456 = match("MESSAGE#432:RPD_KRT_NOIFD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No device %{dclass_counter1->} for interface %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","No device for interface"), - dup23, - ])); - - var msg437 = msg("RPD_KRT_NOIFD", part456); - - var part457 = match("MESSAGE#433:RPD_KRT_UNKNOWN_RTT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: received routing table message for unknown table with kernel ID %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","received routing table message for unknown table"), - dup23, - ])); - - var msg438 = msg("RPD_KRT_UNKNOWN_RTT", part457); - - var part458 = match("MESSAGE#434:RPD_KRT_VERSION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket version mismatch (%{info}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket version mismatch"), - dup23, - ])); - - var msg439 = msg("RPD_KRT_VERSION", part458); - - var part459 = match("MESSAGE#435:RPD_KRT_VERSIONNONE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket message type %{agent}'s version is not supported by kernel, %{info->} -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket message type not supported by kernel"), - dup23, - ])); - - var msg440 = msg("RPD_KRT_VERSIONNONE", part459); - - var part460 = match("MESSAGE#436:RPD_KRT_VERSIONOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket message type %{agent}'s version is older than expected (%{info}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket message type version is older than expected"), - dup23, - ])); - - var msg441 = msg("RPD_KRT_VERSIONOLD", part460); - - var part461 = match("MESSAGE#437:RPD_LDP_INTF_BLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate session ID detected from %{daddr}, interface %{interface}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Duplicate session ID detected"), - dup23, - ])); - - var msg442 = msg("RPD_LDP_INTF_BLOCKED", part461); - - var part462 = match("MESSAGE#438:RPD_LDP_INTF_UNBLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP interface %{interface->} is now %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","LDP interface now unblocked"), - dup23, - ])); - - var msg443 = msg("RPD_LDP_INTF_UNBLOCKED", part462); - - var part463 = match("MESSAGE#439:RPD_LDP_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP neighbor %{daddr->} (%{interface}) is %{result}", processor_chain([ - setc("eventcategory","1603030000"), - dup22, - setc("event_description","LDP neighbor down"), - dup23, - ])); - - var msg444 = msg("RPD_LDP_NBRDOWN", part463); - - var part464 = match("MESSAGE#440:RPD_LDP_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP neighbor %{daddr->} (%{interface}) is %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","LDP neighbor up"), - dup23, - ])); - - var msg445 = msg("RPD_LDP_NBRUP", part464); - - var part465 = match("MESSAGE#441:RPD_LDP_SESSIONDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP session %{daddr->} is down, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LDP session down"), - dup23, - ])); - - var msg446 = msg("RPD_LDP_SESSIONDOWN", part465); - - var part466 = match("MESSAGE#442:RPD_LDP_SESSIONUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP session %{daddr->} is up", processor_chain([ - dup21, - dup22, - setc("event_description","LDP session up"), - dup23, - ])); - - var msg447 = msg("RPD_LDP_SESSIONUP", part466); - - var part467 = match("MESSAGE#443:RPD_LOCK_FLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain a lock on %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain a lock"), - dup23, - ])); - - var msg448 = msg("RPD_LOCK_FLOCKED", part467); - - var part468 = match("MESSAGE#444:RPD_LOCK_LOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain a lock on %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain service lock"), - dup23, - ])); - - var msg449 = msg("RPD_LOCK_LOCKED", part468); - - var part469 = match("MESSAGE#445:RPD_MPLS_LSP_CHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result->} Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP CHANGE"), - dup23, - ])); - - var msg450 = msg("RPD_MPLS_LSP_CHANGE", part469); - - var part470 = match("MESSAGE#446:RPD_MPLS_LSP_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MPLS LSP DOWN"), - dup23, - ])); - - var msg451 = msg("RPD_MPLS_LSP_DOWN", part470); - - var part471 = match("MESSAGE#447:RPD_MPLS_LSP_SWITCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result}, Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP SWITCH"), - dup23, - ])); - - var msg452 = msg("RPD_MPLS_LSP_SWITCH", part471); - - var part472 = match("MESSAGE#448:RPD_MPLS_LSP_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result->} Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP UP"), - dup23, - ])); - - var msg453 = msg("RPD_MPLS_LSP_UP", part472); - - var part473 = match("MESSAGE#449:RPD_MSDP_PEER_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MSDP peer %{group->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MSDP PEER DOWN"), - dup23, - ])); - - var msg454 = msg("RPD_MSDP_PEER_DOWN", part473); - - var part474 = match("MESSAGE#450:RPD_MSDP_PEER_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MSDP peer %{group->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","MSDP PEER UP"), - dup23, - ])); - - var msg455 = msg("RPD_MSDP_PEER_UP", part474); - - var part475 = match("MESSAGE#451:RPD_OSPF_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: OSPF neighbor %{daddr->} (%{interface}) %{disposition->} due to %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","OSPF neighbor down"), - dup23, - ])); - - var msg456 = msg("RPD_OSPF_NBRDOWN", part475); - - var part476 = match("MESSAGE#452:RPD_OSPF_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: OSPF neighbor %{daddr->} (%{interface}) %{disposition->} due to %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","OSPF neighbor up"), - dup23, - ])); - - var msg457 = msg("RPD_OSPF_NBRUP", part476); - - var part477 = match("MESSAGE#453:RPD_OS_MEMHIGH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using %{dclass_counter1->} KB of memory, %{info}", processor_chain([ - dup51, - dup22, - setc("event_description","OS MEMHIGH"), - dup23, - ])); - - var msg458 = msg("RPD_OS_MEMHIGH", part477); - - var part478 = match("MESSAGE#454:RPD_PIM_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PIM neighbor %{daddr->} timeout interface %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","PIM neighbor down"), - setc("result","timeout"), - dup23, - ])); - - var msg459 = msg("RPD_PIM_NBRDOWN", part478); - - var part479 = match("MESSAGE#455:RPD_PIM_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PIM new neighbor %{daddr->} interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","PIM neighbor up"), - dup23, - ])); - - var msg460 = msg("RPD_PIM_NBRUP", part479); - - var part480 = match("MESSAGE#456:RPD_RDISC_CKSUM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Bad checksum for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Bad checksum for router solicitation"), - dup23, - ])); - - var msg461 = msg("RPD_RDISC_CKSUM", part480); - - var part481 = match("MESSAGE#457:RPD_RDISC_NOMULTI", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Ignoring interface %{dclass_counter1->} on %{interface->} -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Ignoring interface"), - dup23, - ])); - - var msg462 = msg("RPD_RDISC_NOMULTI", part481); - - var part482 = match("MESSAGE#458:RPD_RDISC_NORECVIF", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to locate interface for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to locate interface for router"), - dup23, - ])); - - var msg463 = msg("RPD_RDISC_NORECVIF", part482); - - var part483 = match("MESSAGE#459:RPD_RDISC_SOLICITADDR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Expected multicast (%{dclass_counter1}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Expected multicast for router solicitation"), - dup23, - ])); - - var msg464 = msg("RPD_RDISC_SOLICITADDR", part483); - - var part484 = match("MESSAGE#460:RPD_RDISC_SOLICITICMP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Nonzero ICMP code (%{resultcode}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Nonzero ICMP code for router solicitation"), - dup23, - ])); - - var msg465 = msg("RPD_RDISC_SOLICITICMP", part484); - - var part485 = match("MESSAGE#461:RPD_RDISC_SOLICITLEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Insufficient length (%{dclass_counter1}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Insufficient length for router solicitation"), - dup23, - ])); - - var msg466 = msg("RPD_RDISC_SOLICITLEN", part485); - - var part486 = match("MESSAGE#462:RPD_RIP_AUTH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Update with invalid authentication from %{saddr->} (%{interface})", processor_chain([ - dup30, - dup22, - setc("event_description","RIP update with invalid authentication"), - dup23, - ])); - - var msg467 = msg("RPD_RIP_AUTH", part486); - - var part487 = match("MESSAGE#463:RPD_RIP_JOIN_BROADCAST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to get broadcast address %{interface}; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RIP - unable to get broadcast address"), - dup23, - ])); - - var msg468 = msg("RPD_RIP_JOIN_BROADCAST", part487); - - var part488 = match("MESSAGE#464:RPD_RIP_JOIN_MULTICAST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to join multicast group %{interface}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RIP - Unable to join multicast group"), - dup23, - ])); - - var msg469 = msg("RPD_RIP_JOIN_MULTICAST", part488); - - var part489 = match("MESSAGE#465:RPD_RT_IFUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: UP route for interface %{interface->} index %{dclass_counter1->} %{saddr}/%{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","RIP interface up"), - dup23, - ])); - - var msg470 = msg("RPD_RT_IFUP", part489); - - var msg471 = msg("RPD_SCHED_CALLBACK_LONGRUNTIME", dup148); - - var part490 = match("MESSAGE#467:RPD_SCHED_CUMULATIVE_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime (%{result}) after action of module", processor_chain([ - dup30, - dup22, - setc("event_description","excessive runtime after action of module"), - dup23, - ])); - - var msg472 = msg("RPD_SCHED_CUMULATIVE_LONGRUNTIME", part490); - - var msg473 = msg("RPD_SCHED_MODULE_LONGRUNTIME", dup148); - - var part491 = match("MESSAGE#469:RPD_SCHED_TASK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} ran for %{dclass_counter1}(%{dclass_counter2})", processor_chain([ - dup30, - dup22, - setc("event_description","task extended runtime"), - dup23, - ])); - - var msg474 = msg("RPD_SCHED_TASK_LONGRUNTIME", part491); - - var part492 = match("MESSAGE#470:RPD_SIGNAL_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} termination signal received", processor_chain([ - dup30, - dup22, - setc("event_description","termination signal received for service"), - dup23, - ])); - - var msg475 = msg("RPD_SIGNAL_TERMINATE", part492); - - var part493 = match("MESSAGE#471:RPD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Start %{dclass_counter1->} version version built %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","version built"), - dup23, - ])); - - var msg476 = msg("RPD_START", part493); - - var part494 = match("MESSAGE#472:RPD_SYSTEM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: detail: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","system command"), - dup23, - ])); - - var msg477 = msg("RPD_SYSTEM", part494); - - var part495 = match("MESSAGE#473:RPD_TASK_BEGIN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Commencing routing updates, version %{dclass_counter1}, built %{dclass_counter2->} by builder", processor_chain([ - dup21, - dup22, - setc("event_description","Commencing routing updates"), - dup23, - ])); - - var msg478 = msg("RPD_TASK_BEGIN", part495); - - var part496 = match("MESSAGE#474:RPD_TASK_CHILDKILLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","task killed by signal"), - dup23, - ])); - - var msg479 = msg("RPD_TASK_CHILDKILLED", part496); - - var part497 = match("MESSAGE#475:RPD_TASK_CHILDSTOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","task stopped by signal"), - dup23, - ])); - - var msg480 = msg("RPD_TASK_CHILDSTOPPED", part497); - - var part498 = match("MESSAGE#476:RPD_TASK_FORK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fork task: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fork task"), - dup23, - ])); - - var msg481 = msg("RPD_TASK_FORK", part498); - - var part499 = match("MESSAGE#477:RPD_TASK_GETWD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: getwd: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","RPD TASK GETWD"), - dup23, - ])); - - var msg482 = msg("RPD_TASK_GETWD", part499); - - var part500 = match("MESSAGE#478:RPD_TASK_NOREINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitialization not possible", processor_chain([ - dup30, - dup22, - setc("event_description","Reinitialization not possible"), - dup23, - ])); - - var msg483 = msg("RPD_TASK_NOREINIT", part500); - - var part501 = match("MESSAGE#479:RPD_TASK_PIDCLOSED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to close and remove %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to close and remove task"), - dup23, - ])); - - var msg484 = msg("RPD_TASK_PIDCLOSED", part501); - - var part502 = match("MESSAGE#480:RPD_TASK_PIDFLOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: flock(%{agent}, %{action}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD TASK PIDFLOCK"), - dup23, - ])); - - var msg485 = msg("RPD_TASK_PIDFLOCK", part502); - - var part503 = match("MESSAGE#481:RPD_TASK_PIDWRITE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to write %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to write"), - dup23, - ])); - - var msg486 = msg("RPD_TASK_PIDWRITE", part503); - - var msg487 = msg("RPD_TASK_REINIT", dup149); - - var part504 = match("MESSAGE#483:RPD_TASK_SIGNALIGNORE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: sigaction(%{result}): %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","ignoring task signal"), - dup23, - ])); - - var msg488 = msg("RPD_TASK_SIGNALIGNORE", part504); - - var part505 = match("MESSAGE#484:RT_COS", "nwparser.payload", "%{process}: %{event_type}: COS IPC op %{dclass_counter1->} (%{agent}) failed, err %{resultcode->} (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","COS IPC op failed"), - dup23, - ])); - - var msg489 = msg("RT_COS", part505); - - var part506 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/2", "nwparser.p0", "%{fld5}\" nat-source-address=\"%{stransaddr}\" nat-source-port=\"%{stransport}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var part507 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{fld10}\" dst-nat-rule-%{p0}"); - - var part508 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_0", "nwparser.p0", "type=%{fld21->} dst-nat-rule-name=\"%{p0}"); - - var select39 = linear_select([ - part508, - dup91, - ]); - - var part509 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/6", "nwparser.p0", "\"%{fld11->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{fld13}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\"%{p0}"); - - var part510 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" encrypted=%{fld8->} %{p0}"); - - var select40 = linear_select([ - part510, - dup45, - ]); - - var all22 = all_match({ - processors: [ - dup87, - dup150, - part506, - dup151, - part507, - select39, - part509, - select40, - dup92, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - dup52, - ]), - }); - - var msg490 = msg("RT_FLOW_SESSION_CREATE:02", all22); - - var part511 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/1_0", "nwparser.p0", " service-name=\"%{service}\" nat-source-address=\"%{stransaddr}\" nat-source-port=\"%{stransport}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-type=\"%{fld20}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-type=\"%{fld10}\" dst-nat-rule-name=\"%{rule_template}\"%{p0}"); - - var select41 = linear_select([ - part511, - dup45, - ]); - - var part512 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/2", "nwparser.p0", "%{}protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\"%{p0}"); - - var part513 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/3_0", "nwparser.p0", " source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" username=\"%{username}\" roles=\"%{fld50}\" packet-incoming-interface=\"%{dinterface}\" application=\"%{application}\" nested-application=\"%{fld7}\" encrypted=\"%{fld8}\"%{p0}"); - - var select42 = linear_select([ - part513, - dup45, - ]); - - var all23 = all_match({ - processors: [ - dup87, - select41, - part512, - select42, - dup92, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - dup52, - ]), - }); - - var msg491 = msg("RT_FLOW_SESSION_CREATE", all23); - - var part514 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/0_0", "nwparser.payload", "%{process}: %{event_type}: session created %{p0}"); - - var part515 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/0_1", "nwparser.payload", "%{event_type}: session created %{p0}"); - - var select43 = linear_select([ - part514, - part515, - ]); - - var part516 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{p0}"); - - var part517 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_0", "nwparser.p0", "%{rulename->} %{rule_template->} %{fld12->} %{fld13->} %{fld14->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username}(%{fld10}) %{interface->} %{protocol->} %{fld15->} UNKNOWN UNKNOWN"); - - var part518 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_1", "nwparser.p0", "%{rulename->} %{rule_template->} %{fld12->} %{fld13->} %{fld14->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username}(%{fld10}) %{interface->} %{fld15}"); - - var part519 = match_copy("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_2", "nwparser.p0", "info"); - - var select44 = linear_select([ - part517, - part518, - part519, - ]); - - var all24 = all_match({ - processors: [ - select43, - part516, - select44, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - setc("event_description","session created"), - dup23, - ]), - }); - - var msg492 = msg("RT_FLOW_SESSION_CREATE:01", all24); - - var select45 = linear_select([ - msg490, - msg491, - msg492, - ]); - - var part520 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/2", "nwparser.p0", "%{fld5}\" protocol-id=\"%{protocol}\" icmp-type=\"%{obj_type}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{user_role}\" packet-incoming-interface=\"%{dinterface}\"%{p0}"); - - var part521 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/3_0", "nwparser.p0", " encrypted=\"%{fld16}\" reason=\"%{result}\" src-vrf-grp=\"%{fld99}\" dst-vrf-grp=\"%{fld98}\"%{p0}"); - - var part522 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/3_1", "nwparser.p0", " encrypted=%{fld16->} reason=\"%{result}\"%{p0}"); - - var select46 = linear_select([ - part521, - part522, - dup45, - ]); - - var all25 = all_match({ - processors: [ - dup87, - dup150, - part520, - select46, - dup92, - ], - on_success: processor_chain([ - dup93, - dup53, - dup94, - dup22, - dup52, - ]), - }); - - var msg493 = msg("RT_FLOW_SESSION_DENY:02", all25); - - var part523 = match("MESSAGE#489:RT_FLOW_SESSION_DENY", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" icmp-type=\"%{obj_type}\" policy-name=\"%{policyname}\"]", processor_chain([ - dup93, - dup53, - dup94, - dup22, - dup52, - ])); - - var msg494 = msg("RT_FLOW_SESSION_DENY", part523); - - var part524 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{fld1->} %{result->} %{src_zone->} %{dst_zone->} HTTP %{info}"); - - var all26 = all_match({ - processors: [ - dup152, - part524, - ], - on_success: processor_chain([ - dup27, - dup53, - dup94, - dup22, - dup97, - dup23, - ]), - }); - - var msg495 = msg("RT_FLOW_SESSION_DENY:03", all26); - - var part525 = match("MESSAGE#491:RT_FLOW_SESSION_DENY:01/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{fld1->} %{result->} %{src_zone->} %{dst_zone}"); - - var all27 = all_match({ - processors: [ - dup152, - part525, - ], - on_success: processor_chain([ - dup27, - dup53, - dup94, - dup22, - dup97, - dup23, - ]), - }); - - var msg496 = msg("RT_FLOW_SESSION_DENY:01", all27); - - var select47 = linear_select([ - msg493, - msg494, - msg495, - msg496, - ]); - - var select48 = linear_select([ - dup103, - dup45, - ]); - - var all28 = all_match({ - processors: [ - dup98, - dup150, - dup99, - dup151, - dup100, - dup153, - dup102, - select48, - dup92, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup104, - dup22, - dup52, - ]), - }); - - var msg497 = msg("RT_FLOW_SESSION_CLOSE:01", all28); - - var part526 = match("MESSAGE#493:RT_FLOW_SESSION_CLOSE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" inbound-packets=\"%{packets}\" inbound-bytes=\"%{rbytes}\" outbound-packets=\"%{dclass_counter1}\" outbound-bytes=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup27, - dup53, - dup55, - dup22, - dup52, - ])); - - var msg498 = msg("RT_FLOW_SESSION_CLOSE", part526); - - var part527 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/0_0", "nwparser.payload", "%{process}: %{event_type}: session closed %{p0}"); - - var part528 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/0_1", "nwparser.payload", "%{event_type}: session closed %{p0}"); - - var select49 = linear_select([ - part527, - part528, - ]); - - var part529 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/1", "nwparser.p0", "%{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{info}"); - - var all29 = all_match({ - processors: [ - select49, - part529, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup22, - setc("event_description","session closed"), - dup23, - ]), - }); - - var msg499 = msg("RT_FLOW_SESSION_CLOSE:02", all29); - - var part530 = match("MESSAGE#495:RT_FLOW_SESSION_CLOSE:03/7_1", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{user_role}\" packet-incoming-interface=\"%{dinterface}\" %{p0}"); - - var select50 = linear_select([ - dup103, - part530, - dup45, - ]); - - var part531 = match("MESSAGE#495:RT_FLOW_SESSION_CLOSE:03/8", "nwparser.p0", "] session closed %{fld60}: %{fld51}/%{fld52}->%{fld53}/%{fld54->} %{fld55->} %{fld56}/%{fld57}->%{fld58}/%{fld59->} %{info}"); - - var all30 = all_match({ - processors: [ - dup98, - dup150, - dup99, - dup151, - dup100, - dup153, - dup102, - select50, - part531, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup104, - dup22, - dup52, - dup61, - ]), - }); - - var msg500 = msg("RT_FLOW_SESSION_CLOSE:03", all30); - - var select51 = linear_select([ - msg497, - msg498, - msg499, - msg500, - ]); - - var part532 = match("MESSAGE#496:RT_SCREEN_IP", "nwparser.payload", "%{process}: %{event_type}: Fragmented traffic! source:%{saddr}, destination: %{daddr}, protocol-id: %{protocol}, zone name: %{zone}, interface name: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","Fragmented traffic"), - dup23, - ])); - - var msg501 = msg("RT_SCREEN_IP", part532); - - var part533 = match("MESSAGE#497:RT_SCREEN_IP:01", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" protocol-id=\"%{protocol}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg502 = msg("RT_SCREEN_IP:01", part533); - - var select52 = linear_select([ - msg501, - msg502, - ]); - - var msg503 = msg("RT_SCREEN_TCP", dup154); - - var part534 = match("MESSAGE#499:RT_SCREEN_SESSION_LIMIT", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" message=\"%{info}\" ip-address=\"%{hostip}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg504 = msg("RT_SCREEN_SESSION_LIMIT", part534); - - var msg505 = msg("RT_SCREEN_UDP", dup154); - - var part535 = match("MESSAGE#501:SERVICED_CLIENT_CONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: attempt to connect to interface failed with error: %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","attempt to connect to interface failed"), - dup23, - ])); - - var msg506 = msg("SERVICED_CLIENT_CONNECT", part535); - - var part536 = match("MESSAGE#502:SERVICED_CLIENT_DISCONNECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unexpected termination of connection to interface", processor_chain([ - dup27, - dup22, - setc("event_description","unexpected termination of connection"), - dup23, - ])); - - var msg507 = msg("SERVICED_CLIENT_DISCONNECTED", part536); - - var part537 = match("MESSAGE#503:SERVICED_CLIENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: client interface connection failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","client interface connection failure"), - dup23, - ])); - - var msg508 = msg("SERVICED_CLIENT_ERROR", part537); - - var part538 = match("MESSAGE#504:SERVICED_COMMAND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: remote command execution failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","remote command execution failed"), - dup23, - ])); - - var msg509 = msg("SERVICED_COMMAND_FAILED", part538); - - var part539 = match("MESSAGE#505:SERVICED_COMMIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: client failed to commit configuration with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","client commit configuration failed"), - dup23, - ])); - - var msg510 = msg("SERVICED_COMMIT_FAILED", part539); - - var part540 = match("MESSAGE#506:SERVICED_CONFIGURATION_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: configuration process failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","configuration process failed"), - dup23, - ])); - - var msg511 = msg("SERVICED_CONFIGURATION_FAILED", part540); - - var part541 = match("MESSAGE#507:SERVICED_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SERVICED CONFIG ERROR"), - dup23, - ])); - - var msg512 = msg("SERVICED_CONFIG_ERROR", part541); - - var part542 = match("MESSAGE#508:SERVICED_CONFIG_FILE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} failed to read path with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","service failed to read path"), - dup23, - ])); - - var msg513 = msg("SERVICED_CONFIG_FILE", part542); - - var part543 = match("MESSAGE#509:SERVICED_CONNECTION_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SERVICED CONNECTION ERROR"), - dup23, - ])); - - var msg514 = msg("SERVICED_CONNECTION_ERROR", part543); - - var part544 = match("MESSAGE#510:SERVICED_DISABLED_GGSN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: GGSN services disabled: object: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","GGSN services disabled"), - dup23, - ])); - - var msg515 = msg("SERVICED_DISABLED_GGSN", part544); - - var msg516 = msg("SERVICED_DUPLICATE", dup141); - - var part545 = match("MESSAGE#512:SERVICED_EVENT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: event function %{dclass_counter2->} failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","event function failed"), - dup23, - ])); - - var msg517 = msg("SERVICED_EVENT_FAILED", part545); - - var part546 = match("MESSAGE#513:SERVICED_INIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: initialization failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","service initialization failed"), - dup23, - ])); - - var msg518 = msg("SERVICED_INIT_FAILED", part546); - - var part547 = match("MESSAGE#514:SERVICED_MALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: failed to allocate [%{dclass_counter2}] object [%{dclass_counter1->} bytes %{bytes}]: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","memory allocation failure"), - dup23, - ])); - - var msg519 = msg("SERVICED_MALLOC_FAILURE", part547); - - var part548 = match("MESSAGE#515:SERVICED_NETWORK_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} had error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","NETWORK FAILURE"), - dup23, - ])); - - var msg520 = msg("SERVICED_NETWORK_FAILURE", part548); - - var part549 = match("MESSAGE#516:SERVICED_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","SERVICED must be run as root"), - dup23, - ])); - - var msg521 = msg("SERVICED_NOT_ROOT", part549); - - var msg522 = msg("SERVICED_PID_FILE_LOCK", dup142); - - var msg523 = msg("SERVICED_PID_FILE_UPDATE", dup143); - - var part550 = match("MESSAGE#519:SERVICED_RTSOCK_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: routing socket sequence error, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","routing socket sequence error"), - dup23, - ])); - - var msg524 = msg("SERVICED_RTSOCK_SEQUENCE", part550); - - var part551 = match("MESSAGE#520:SERVICED_SIGNAL_HANDLER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: set up of signal name handler failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","set up of signal name handler failed"), - dup23, - ])); - - var msg525 = msg("SERVICED_SIGNAL_HANDLER", part551); - - var part552 = match("MESSAGE#521:SERVICED_SOCKET_CREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket create failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","socket create failed with error"), - dup23, - ])); - - var msg526 = msg("SERVICED_SOCKET_CREATE", part552); - - var part553 = match("MESSAGE#522:SERVICED_SOCKET_IO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket function %{dclass_counter2->} failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","socket function failed"), - dup23, - ])); - - var msg527 = msg("SERVICED_SOCKET_IO", part553); - - var part554 = match("MESSAGE#523:SERVICED_SOCKET_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unable to set socket option %{dclass_counter2}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to set socket option"), - dup23, - ])); - - var msg528 = msg("SERVICED_SOCKET_OPTION", part554); - - var part555 = match("MESSAGE#524:SERVICED_STDLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} had error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","STDLIB FAILURE"), - dup23, - ])); - - var msg529 = msg("SERVICED_STDLIB_FAILURE", part555); - - var part556 = match("MESSAGE#525:SERVICED_USAGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect usage: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Incorrect service usage"), - dup23, - ])); - - var msg530 = msg("SERVICED_USAGE", part556); - - var part557 = match("MESSAGE#526:SERVICED_WORK_INCONSISTENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: object has unexpected value %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","object has unexpected value"), - dup23, - ])); - - var msg531 = msg("SERVICED_WORK_INCONSISTENCY", part557); - - var msg532 = msg("SSL_PROXY_SSL_SESSION_ALLOW", dup155); - - var msg533 = msg("SSL_PROXY_SSL_SESSION_DROP", dup155); - - var msg534 = msg("SSL_PROXY_SESSION_IGNORE", dup155); - - var part558 = match("MESSAGE#530:SNMP_NS_LOG_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NET-SNMP version %{version->} AgentX subagent connected", processor_chain([ - dup21, - dup22, - setc("event_description","AgentX subagent connected"), - dup61, - dup23, - ])); - - var msg535 = msg("SNMP_NS_LOG_INFO", part558); - - var part559 = match("MESSAGE#531:SNMP_SUBAGENT_IPC_REG_ROWS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ns_subagent_register_mibs: registering %{dclass_counter1->} rows", processor_chain([ - dup21, - dup22, - setc("event_description","ns_subagent registering rows"), - dup61, - dup23, - ])); - - var msg536 = msg("SNMP_SUBAGENT_IPC_REG_ROWS", part559); - - var part560 = match("MESSAGE#532:SNMPD_ACCESS_GROUP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} access group %{group}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD ACCESS GROUP ERROR"), - dup23, - ])); - - var msg537 = msg("SNMPD_ACCESS_GROUP_ERROR", part560); - - var part561 = match("MESSAGE#533:SNMPD_AUTH_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unauthorized SNMP community from %{daddr->} to unknown community name (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","unauthorized SNMP community to unknown community name"), - dup23, - ])); - - var msg538 = msg("SNMPD_AUTH_FAILURE", part561); - - var part562 = match("MESSAGE#534:SNMPD_AUTH_FAILURE:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: failed input interface authorization from %{daddr->} to unknown (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","failed input interface authorization to unknown"), - dup23, - ])); - - var msg539 = msg("SNMPD_AUTH_FAILURE:01", part562); - - var part563 = match("MESSAGE#535:SNMPD_AUTH_FAILURE:02", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unauthorized SNMP community from %{daddr->} to %{saddr->} (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","unauthorized SNMP community "), - dup23, - ])); - - var msg540 = msg("SNMPD_AUTH_FAILURE:02", part563); - - var part564 = match("MESSAGE#595:SNMPD_AUTH_FAILURE:03", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} function-name=\"%{fld1}\" message=\"%{info}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" index1=\"%{fld4}\"]", processor_chain([ - dup30, - dup22, - dup105, - dup61, - dup62, - ])); - - var msg541 = msg("SNMPD_AUTH_FAILURE:03", part564); - - var select53 = linear_select([ - msg538, - msg539, - msg540, - msg541, - ]); - - var part565 = match("MESSAGE#536:SNMPD_AUTH_PRIVILEGES_EXCEEDED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{saddr}: request exceeded community privileges", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP request exceeded community privileges"), - dup23, - ])); - - var msg542 = msg("SNMPD_AUTH_PRIVILEGES_EXCEEDED", part565); - - var part566 = match("MESSAGE#537:SNMPD_AUTH_RESTRICTED_ADDRESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: request from address %{daddr->} not allowed", processor_chain([ - dup48, - dup22, - setc("event_description","SNMPD AUTH RESTRICTED ADDRESS"), - setc("result","request not allowed"), - dup23, - ])); - - var msg543 = msg("SNMPD_AUTH_RESTRICTED_ADDRESS", part566); - - var part567 = match("MESSAGE#538:SNMPD_AUTH_WRONG_PDU_TYPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{saddr}: unauthorized SNMP PDU type: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unauthorized SNMP PDU type"), - dup23, - ])); - - var msg544 = msg("SNMPD_AUTH_WRONG_PDU_TYPE", part567); - - var part568 = match("MESSAGE#539:SNMPD_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Configuration database has errors", processor_chain([ - dup30, - dup22, - setc("event_description","Configuration database has errors"), - dup23, - ])); - - var msg545 = msg("SNMPD_CONFIG_ERROR", part568); - - var part569 = match("MESSAGE#540:SNMPD_CONTEXT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} context %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD CONTEXT ERROR"), - dup23, - ])); - - var msg546 = msg("SNMPD_CONTEXT_ERROR", part569); - - var part570 = match("MESSAGE#541:SNMPD_ENGINE_FILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2}: operation: %{dclass_counter1->} %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD ENGINE FILE FAILURE"), - dup23, - ])); - - var msg547 = msg("SNMPD_ENGINE_FILE_FAILURE", part570); - - var part571 = match("MESSAGE#542:SNMPD_ENGINE_PROCESS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: from-path: undecodable/unmatched subagent response", processor_chain([ - dup30, - dup22, - setc("event_description"," from-path - SNMP undecodable/unmatched subagent response"), - dup23, - ])); - - var msg548 = msg("SNMPD_ENGINE_PROCESS_ERROR", part571); - - var part572 = match("MESSAGE#543:SNMPD_FILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: fopen %{dclass_counter2}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD FILE FAILURE"), - dup23, - ])); - - var msg549 = msg("SNMPD_FILE_FAILURE", part572); - - var part573 = match("MESSAGE#544:SNMPD_GROUP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} group: '%{group}' user '%{username}' model '%{version}'", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD GROUP ERROR"), - dup23, - ])); - - var msg550 = msg("SNMPD_GROUP_ERROR", part573); - - var part574 = match("MESSAGE#545:SNMPD_INIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: snmpd initialization failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","snmpd initialization failure"), - dup23, - ])); - - var msg551 = msg("SNMPD_INIT_FAILED", part574); - - var part575 = match("MESSAGE#546:SNMPD_LIBJUNIPER_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: system_default_inaddr: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LIBJUNIPER FAILURE"), - dup23, - ])); - - var msg552 = msg("SNMPD_LIBJUNIPER_FAILURE", part575); - - var part576 = match("MESSAGE#547:SNMPD_LOOPBACK_ADDR_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LOOPBACK ADDR ERROR"), - dup23, - ])); - - var msg553 = msg("SNMPD_LOOPBACK_ADDR_ERROR", part576); - - var part577 = match("MESSAGE#548:SNMPD_MEMORY_FREED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: called for freed - already freed", processor_chain([ - dup30, - dup22, - setc("event_description","duplicate memory free"), - dup23, - ])); - - var msg554 = msg("SNMPD_MEMORY_FREED", part577); - - var part578 = match("MESSAGE#549:SNMPD_RADIX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: radix_add failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","radix_add failed"), - dup23, - ])); - - var msg555 = msg("SNMPD_RADIX_FAILURE", part578); - - var part579 = match("MESSAGE#550:SNMPD_RECEIVE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: receive %{dclass_counter1->} failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD RECEIVE FAILURE"), - dup23, - ])); - - var msg556 = msg("SNMPD_RECEIVE_FAILURE", part579); - - var part580 = match("MESSAGE#551:SNMPD_RMONFILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2}: operation: %{dclass_counter1->} %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RMONFILE FAILURE"), - dup23, - ])); - - var msg557 = msg("SNMPD_RMONFILE_FAILURE", part580); - - var part581 = match("MESSAGE#552:SNMPD_RMON_COOKIE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: Null cookie", processor_chain([ - dup30, - dup22, - setc("event_description","Null cookie"), - dup23, - ])); - - var msg558 = msg("SNMPD_RMON_COOKIE", part581); - - var part582 = match("MESSAGE#553:SNMPD_RMON_EVENTLOG", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","RMON EVENTLOG"), - dup23, - ])); - - var msg559 = msg("SNMPD_RMON_EVENTLOG", part582); - - var part583 = match("MESSAGE#554:SNMPD_RMON_IOERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: Received io error, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Received io error"), - dup23, - ])); - - var msg560 = msg("SNMPD_RMON_IOERROR", part583); - - var part584 = match("MESSAGE#555:SNMPD_RMON_MIBERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: internal Get request error: description, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","internal Get request error"), - dup23, - ])); - - var msg561 = msg("SNMPD_RMON_MIBERROR", part584); - - var part585 = match("MESSAGE#556:SNMPD_RTSLIB_ASYNC_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: sequence mismatch %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","sequence mismatch"), - dup23, - ])); - - var msg562 = msg("SNMPD_RTSLIB_ASYNC_EVENT", part585); - - var part586 = match("MESSAGE#557:SNMPD_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: send send-type (index1) failure: %{result}", processor_chain([ - dup30, - dup22, - dup106, - dup23, - ])); - - var msg563 = msg("SNMPD_SEND_FAILURE", part586); - - var part587 = match("MESSAGE#558:SNMPD_SEND_FAILURE:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: send to (%{saddr}) failure: %{result}", processor_chain([ - dup30, - dup22, - dup106, - dup23, - ])); - - var msg564 = msg("SNMPD_SEND_FAILURE:01", part587); - - var select54 = linear_select([ - msg563, - msg564, - ]); - - var part588 = match("MESSAGE#559:SNMPD_SOCKET_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD SOCKET FAILURE"), - dup23, - ])); - - var msg565 = msg("SNMPD_SOCKET_FAILURE", part588); - - var part589 = match("MESSAGE#560:SNMPD_SUBAGENT_NO_BUFFERS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No buffers available for subagent (%{agent})", processor_chain([ - dup30, - dup22, - setc("event_description","No buffers available for subagent"), - dup23, - ])); - - var msg566 = msg("SNMPD_SUBAGENT_NO_BUFFERS", part589); - - var part590 = match("MESSAGE#561:SNMPD_SUBAGENT_SEND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Send to subagent failed (%{agent}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Send to subagent failed"), - dup23, - ])); - - var msg567 = msg("SNMPD_SUBAGENT_SEND_FAILED", part590); - - var part591 = match("MESSAGE#562:SNMPD_SYSLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: system function '%{dclass_counter1}' failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","system function failed"), - dup23, - ])); - - var msg568 = msg("SNMPD_SYSLIB_FAILURE", part591); - - var part592 = match("MESSAGE#563:SNMPD_THROTTLE_QUEUE_DRAINED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: cleared all throttled traps", processor_chain([ - dup21, - dup22, - setc("event_description","cleared all throttled traps"), - dup23, - ])); - - var msg569 = msg("SNMPD_THROTTLE_QUEUE_DRAINED", part592); - - var part593 = match("MESSAGE#564:SNMPD_TRAP_COLD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap: cold start", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP trap: cold start"), - dup23, - ])); - - var msg570 = msg("SNMPD_TRAP_COLD_START", part593); - - var part594 = match("MESSAGE#565:SNMPD_TRAP_GEN_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{resultcode->} (%{result})", processor_chain([ - dup30, - dup22, - dup107, - dup23, - ])); - - var msg571 = msg("SNMPD_TRAP_GEN_FAILURE", part594); - - var part595 = match("MESSAGE#566:SNMPD_TRAP_GEN_FAILURE2", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{dclass_counter2->} %{result}", processor_chain([ - dup30, - dup22, - dup107, - dup23, - ])); - - var msg572 = msg("SNMPD_TRAP_GEN_FAILURE2", part595); - - var part596 = match("MESSAGE#567:SNMPD_TRAP_INVALID_DATA", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{result->} (%{dclass_counter2}) received", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP INVALID DATA"), - dup23, - ])); - - var msg573 = msg("SNMPD_TRAP_INVALID_DATA", part596); - - var part597 = match("MESSAGE#568:SNMPD_TRAP_NOT_ENOUGH_VARBINDS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{info->} (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP ERROR"), - dup23, - ])); - - var msg574 = msg("SNMPD_TRAP_NOT_ENOUGH_VARBINDS", part597); - - var part598 = match("MESSAGE#569:SNMPD_TRAP_QUEUED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Adding trap to %{dclass_counter2->} to %{obj_name->} queue, %{dclass_counter1->} traps in queue", processor_chain([ - dup21, - dup22, - setc("event_description","Adding trap to queue"), - dup23, - ])); - - var msg575 = msg("SNMPD_TRAP_QUEUED", part598); - - var part599 = match("MESSAGE#570:SNMPD_TRAP_QUEUE_DRAINED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: traps queued to %{obj_name->} sent successfully", processor_chain([ - dup21, - dup22, - setc("event_description","traps queued - sent successfully"), - dup23, - ])); - - var msg576 = msg("SNMPD_TRAP_QUEUE_DRAINED", part599); - - var part600 = match("MESSAGE#571:SNMPD_TRAP_QUEUE_MAX_ATTEMPTS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: after %{dclass_counter1->} attempts, deleting %{dclass_counter2->} traps queued to %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP QUEUE MAX_ATTEMPTS - deleting some traps"), - dup23, - ])); - - var msg577 = msg("SNMPD_TRAP_QUEUE_MAX_ATTEMPTS", part600); - - var part601 = match("MESSAGE#572:SNMPD_TRAP_QUEUE_MAX_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: maximum queue size exceeded (%{dclass_counter1}), discarding trap to %{dclass_counter2->} from %{obj_name->} queue", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP maximum queue size exceeded"), - dup23, - ])); - - var msg578 = msg("SNMPD_TRAP_QUEUE_MAX_SIZE", part601); - - var part602 = match("MESSAGE#573:SNMPD_TRAP_THROTTLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: traps throttled after %{dclass_counter1->} traps", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP traps throttled"), - dup23, - ])); - - var msg579 = msg("SNMPD_TRAP_THROTTLED", part602); - - var part603 = match("MESSAGE#574:SNMPD_TRAP_TYPE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unknown trap type requested (%{obj_type->} )", processor_chain([ - dup30, - dup22, - setc("event_description","unknown SNMP trap type requested"), - dup23, - ])); - - var msg580 = msg("SNMPD_TRAP_TYPE_ERROR", part603); - - var part604 = match("MESSAGE#575:SNMPD_TRAP_VARBIND_TYPE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: expecting %{dclass_counter1->} varbind to be VT_NUMBER (%{resultcode->} )", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP VARBIND TYPE ERROR"), - dup23, - ])); - - var msg581 = msg("SNMPD_TRAP_VARBIND_TYPE_ERROR", part604); - - var part605 = match("MESSAGE#576:SNMPD_TRAP_VERSION_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: invalid version signature (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP ERROR - invalid version signature"), - dup23, - ])); - - var msg582 = msg("SNMPD_TRAP_VERSION_ERROR", part605); - - var part606 = match("MESSAGE#577:SNMPD_TRAP_WARM_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap: warm start", processor_chain([ - dup21, - dup22, - setc("event_description","SNMPD TRAP WARM START"), - dup23, - ])); - - var msg583 = msg("SNMPD_TRAP_WARM_START", part606); - - var part607 = match("MESSAGE#578:SNMPD_USER_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} user '%{username}' %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD USER ERROR"), - dup23, - ])); - - var msg584 = msg("SNMPD_USER_ERROR", part607); - - var part608 = match("MESSAGE#579:SNMPD_VIEW_DELETE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: deleting view %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP deleting view"), - dup23, - ])); - - var msg585 = msg("SNMPD_VIEW_DELETE", part608); - - var part609 = match("MESSAGE#580:SNMPD_VIEW_INSTALL_DEFAULT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} installing default %{dclass_counter1->} view %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","installing default SNMP view"), - dup23, - ])); - - var msg586 = msg("SNMPD_VIEW_INSTALL_DEFAULT", part609); - - var part610 = match("MESSAGE#581:SNMPD_VIEW_OID_PARSE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: oid parsing failed for view %{dclass_counter2->} oid %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","oid parsing failed for SNMP view"), - dup23, - ])); - - var msg587 = msg("SNMPD_VIEW_OID_PARSE", part610); - - var part611 = match("MESSAGE#582:SNMP_GET_ERROR1", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP_GET_ERROR 1"), - dup23, - ])); - - var msg588 = msg("SNMP_GET_ERROR1", part611); - - var part612 = match("MESSAGE#583:SNMP_GET_ERROR2", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 2"), - dup23, - ])); - - var msg589 = msg("SNMP_GET_ERROR2", part612); - - var part613 = match("MESSAGE#584:SNMP_GET_ERROR3", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 3"), - dup23, - ])); - - var msg590 = msg("SNMP_GET_ERROR3", part613); - - var part614 = match("MESSAGE#585:SNMP_GET_ERROR4", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 4"), - dup23, - ])); - - var msg591 = msg("SNMP_GET_ERROR4", part614); - - var part615 = match("MESSAGE#586:SNMP_RTSLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: rtslib-error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP RTSLIB FAILURE"), - dup23, - ])); - - var msg592 = msg("SNMP_RTSLIB_FAILURE", part615); - - var part616 = match("MESSAGE#587:SNMP_TRAP_LINK_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifIndex %{dclass_counter1}, ifAdminStatus %{resultcode}, ifOperStatus %{result}, ifName %{interface}", processor_chain([ - dup30, - dup22, - dup108, - dup23, - ])); - - var msg593 = msg("SNMP_TRAP_LINK_DOWN", part616); - - var part617 = match("MESSAGE#596:SNMP_TRAP_LINK_DOWN:01", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} snmp-interface-index=\"%{fld1}\" admin-status=\"%{fld3}\" operational-status=\"%{fld2}\" interface-name=\"%{interface}\"]", processor_chain([ - dup30, - dup22, - dup108, - dup61, - dup62, - ])); - - var msg594 = msg("SNMP_TRAP_LINK_DOWN:01", part617); - - var select55 = linear_select([ - msg593, - msg594, - ]); - - var part618 = match("MESSAGE#588:SNMP_TRAP_LINK_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifIndex %{dclass_counter1}, ifAdminStatus %{resultcode}, ifOperStatus %{result}, ifName %{interface}", processor_chain([ - dup21, - dup22, - dup109, - dup23, - ])); - - var msg595 = msg("SNMP_TRAP_LINK_UP", part618); - - var part619 = match("MESSAGE#597:SNMP_TRAP_LINK_UP:01", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} snmp-interface-index=\"%{fld1}\" admin-status=\"%{fld3}\" operational-status=\"%{event_state}\" interface-name=\"%{interface}\"]", processor_chain([ - dup21, - dup22, - dup109, - dup61, - dup62, - ])); - - var msg596 = msg("SNMP_TRAP_LINK_UP:01", part619); - - var select56 = linear_select([ - msg595, - msg596, - ]); - - var part620 = match("MESSAGE#589:SNMP_TRAP_PING_PROBE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP PING PROBE FAILED"), - dup23, - ])); - - var msg597 = msg("SNMP_TRAP_PING_PROBE_FAILED", part620); - - var part621 = match("MESSAGE#590:SNMP_TRAP_PING_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP PING TEST COMPLETED"), - dup23, - ])); - - var msg598 = msg("SNMP_TRAP_PING_TEST_COMPLETED", part621); - - var part622 = match("MESSAGE#591:SNMP_TRAP_PING_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP PING TEST FAILED"), - dup23, - ])); - - var msg599 = msg("SNMP_TRAP_PING_TEST_FAILED", part622); - - var part623 = match("MESSAGE#592:SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE PATH CHANGE"), - dup23, - ])); - - var msg600 = msg("SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE", part623); - - var part624 = match("MESSAGE#593:SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE TEST COMPLETED"), - dup23, - ])); - - var msg601 = msg("SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED", part624); - - var part625 = match("MESSAGE#594:SNMP_TRAP_TRACE_ROUTE_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE TEST FAILED"), - dup23, - ])); - - var msg602 = msg("SNMP_TRAP_TRACE_ROUTE_TEST_FAILED", part625); - - var part626 = match("MESSAGE#598:SSHD_LOGIN_FAILED", "nwparser.payload", "%{process}: %{event_type}: Login failed for user '%{username}' from host '%{saddr}'", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup110, - dup23, - ])); - - var msg603 = msg("SSHD_LOGIN_FAILED", part626); - - var part627 = match("MESSAGE#599:SSHD_LOGIN_FAILED:01", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} username=\"%{username}\" source-address=\"%{saddr}\"]", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup110, - dup61, - dup52, - setf("process","hfld33"), - ])); - - var msg604 = msg("SSHD_LOGIN_FAILED:01", part627); - - var select57 = linear_select([ - msg603, - msg604, - ]); - - var part628 = match("MESSAGE#600:task_connect", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: task %{agent->} addr %{daddr}+%{dport}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","task connect failure"), - dup23, - ])); - - var msg605 = msg("task_connect", part628); - - var msg606 = msg("TASK_TASK_REINIT", dup149); - - var part629 = match("MESSAGE#602:TFTPD_AF_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected address family %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected address family"), - dup23, - ])); - - var msg607 = msg("TFTPD_AF_ERR", part629); - - var part630 = match("MESSAGE#603:TFTPD_BIND_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: bind: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD BIND ERROR"), - dup23, - ])); - - var msg608 = msg("TFTPD_BIND_ERR", part630); - - var part631 = match("MESSAGE#604:TFTPD_CONNECT_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: connect: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD CONNECT ERROR"), - dup23, - ])); - - var msg609 = msg("TFTPD_CONNECT_ERR", part631); - - var part632 = match("MESSAGE#605:TFTPD_CONNECT_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: TFTP %{protocol->} from address %{daddr->} port %{dport->} file %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD CONNECT INFO"), - dup23, - ])); - - var msg610 = msg("TFTPD_CONNECT_INFO", part632); - - var part633 = match("MESSAGE#606:TFTPD_CREATE_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: check_space %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD CREATE ERROR"), - dup23, - ])); - - var msg611 = msg("TFTPD_CREATE_ERR", part633); - - var part634 = match("MESSAGE#607:TFTPD_FIO_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD FIO ERR"), - dup23, - ])); - - var msg612 = msg("TFTPD_FIO_ERR", part634); - - var part635 = match("MESSAGE#608:TFTPD_FORK_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: fork: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD FORK ERROR"), - dup23, - ])); - - var msg613 = msg("TFTPD_FORK_ERR", part635); - - var part636 = match("MESSAGE#609:TFTPD_NAK_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: nak error %{resultcode}, %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD NAK ERROR"), - dup23, - ])); - - var msg614 = msg("TFTPD_NAK_ERR", part636); - - var part637 = match("MESSAGE#610:TFTPD_OPEN_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open file '%{filename}', error: %{result}", processor_chain([ - dup30, - dup22, - dup78, - dup23, - ])); - - var msg615 = msg("TFTPD_OPEN_ERR", part637); - - var part638 = match("MESSAGE#611:TFTPD_RECVCOMPLETE_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received %{dclass_counter1->} blocks of %{dclass_counter2->} size for file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD RECVCOMPLETE INFO"), - dup23, - ])); - - var msg616 = msg("TFTPD_RECVCOMPLETE_INFO", part638); - - var part639 = match("MESSAGE#612:TFTPD_RECVFROM_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: recvfrom: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD RECVFROM ERROR"), - dup23, - ])); - - var msg617 = msg("TFTPD_RECVFROM_ERR", part639); - - var part640 = match("MESSAGE#613:TFTPD_RECV_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: recv: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD RECV ERROR"), - dup23, - ])); - - var msg618 = msg("TFTPD_RECV_ERR", part640); - - var part641 = match("MESSAGE#614:TFTPD_SENDCOMPLETE_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Sent %{dclass_counter1->} blocks of %{dclass_counter2->} and %{info->} for file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD SENDCOMPLETE INFO"), - dup23, - ])); - - var msg619 = msg("TFTPD_SENDCOMPLETE_INFO", part641); - - var part642 = match("MESSAGE#615:TFTPD_SEND_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: send: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD SEND ERROR"), - dup23, - ])); - - var msg620 = msg("TFTPD_SEND_ERR", part642); - - var part643 = match("MESSAGE#616:TFTPD_SOCKET_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: socket: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD SOCKET ERROR"), - dup23, - ])); - - var msg621 = msg("TFTPD_SOCKET_ERR", part643); - - var part644 = match("MESSAGE#617:TFTPD_STATFS_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: statfs %{agent}, error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD STATFS ERROR"), - dup23, - ])); - - var msg622 = msg("TFTPD_STATFS_ERR", part644); - - var part645 = match("MESSAGE#618:TNP", "nwparser.payload", "%{process}: %{event_type}: adding neighbor %{dclass_counter1->} to interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","adding neighbor to interface"), - dup23, - ])); - - var msg623 = msg("TNP", part645); - - var part646 = match("MESSAGE#619:trace_on", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: tracing to %{fld33->} started", processor_chain([ - dup21, - dup22, - setc("event_description","tracing to file"), - dup23, - call({ - dest: "nwparser.filename", - fn: RMQ, - args: [ - field("fld33"), - ], - }), - ])); - - var msg624 = msg("trace_on", part646); - - var part647 = match("MESSAGE#620:trace_rotate", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: rotating %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","trace rotating file"), - dup23, - ])); - - var msg625 = msg("trace_rotate", part647); - - var part648 = match("MESSAGE#621:transfer-file", "nwparser.payload", "%{process}: %{event_type}: Transferred %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","transfered file"), - dup23, - ])); - - var msg626 = msg("transfer-file", part648); - - var part649 = match("MESSAGE#622:ttloop", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer died: %{result}: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","ttloop - peer died"), - dup23, - ])); - - var msg627 = msg("ttloop", part649); - - var part650 = match("MESSAGE#623:UI_AUTH_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authenticated user '%{username}' at permission level '%{privilege}'", processor_chain([ - dup80, - dup34, - dup35, - dup37, - dup22, - setc("event_description","Authenticated user"), - dup23, - ])); - - var msg628 = msg("UI_AUTH_EVENT", part650); - - var part651 = match("MESSAGE#624:UI_AUTH_INVALID_CHALLENGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received invalid authentication challenge for user '%{username}': response", processor_chain([ - dup30, - dup22, - setc("event_description","Received invalid authentication challenge for user response"), - dup23, - ])); - - var msg629 = msg("UI_AUTH_INVALID_CHALLENGE", part651); - - var part652 = match("MESSAGE#625:UI_BOOTTIME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fetch boot time: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fetch boot time"), - dup23, - ])); - - var msg630 = msg("UI_BOOTTIME_FAILED", part652); - - var part653 = match("MESSAGE#626:UI_CFG_AUDIT_NEW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' %{dclass_counter2->} path unknown", processor_chain([ - dup30, - dup22, - setc("event_description","user path unknown"), - dup23, - ])); - - var msg631 = msg("UI_CFG_AUDIT_NEW", part653); - - var part654 = match("MESSAGE#627:UI_CFG_AUDIT_NEW:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' insert: [edit-config config %{filename->} security policies %{policyname}] %{info}", processor_chain([ - dup42, - dup22, - setc("event_description"," user Inserted Security Policies in config"), - dup23, - ])); - - var msg632 = msg("UI_CFG_AUDIT_NEW:01", part654); - - var select58 = linear_select([ - msg631, - msg632, - ]); - - var part655 = match("MESSAGE#628:UI_CFG_AUDIT_OTHER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' delete: [%{filename}]", processor_chain([ - dup21, - dup22, - setc("event_description","User deleted file"), - setc("action","delete"), - dup23, - ])); - - var msg633 = msg("UI_CFG_AUDIT_OTHER", part655); - - var part656 = match("MESSAGE#629:UI_CFG_AUDIT_OTHER:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' rollback: %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","User rollback file"), - dup23, - ])); - - var msg634 = msg("UI_CFG_AUDIT_OTHER:01", part656); - - var part657 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_0", "nwparser.p0", "\"%{info}\""); - - var select59 = linear_select([ - part657, - dup112, - ]); - - var all31 = all_match({ - processors: [ - dup111, - select59, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","User set"), - dup23, - ]), - }); - - var msg635 = msg("UI_CFG_AUDIT_OTHER:02", all31); - - var part658 = match("MESSAGE#631:UI_CFG_AUDIT_OTHER:03", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' replace: [edit-config config %{filename->} applications %{info}]", processor_chain([ - dup21, - dup22, - setc("event_description","User config replace"), - setc("action","replace"), - dup23, - ])); - - var msg636 = msg("UI_CFG_AUDIT_OTHER:03", part658); - - var part659 = match("MESSAGE#632:UI_CFG_AUDIT_OTHER:04", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' deactivate: [groups %{info}]", processor_chain([ - setc("eventcategory","1701070000"), - dup22, - setc("event_description","User deactivating group(s)"), - setc("action","deactivate"), - dup23, - ])); - - var msg637 = msg("UI_CFG_AUDIT_OTHER:04", part659); - - var part660 = match("MESSAGE#633:UI_CFG_AUDIT_OTHER:05", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' update: %{filename}", processor_chain([ - dup113, - dup22, - setc("event_description","User updates config file"), - setc("action","update"), - dup23, - ])); - - var msg638 = msg("UI_CFG_AUDIT_OTHER:05", part660); - - var select60 = linear_select([ - msg633, - msg634, - msg635, - msg636, - msg637, - msg638, - ]); - - var part661 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_0", "nwparser.p0", "\"%{change_old}\" %{p0}"); - - var select61 = linear_select([ - part661, - dup114, - ]); - - var all32 = all_match({ - processors: [ - dup111, - select61, - dup115, - ], - on_success: processor_chain([ - dup21, - dup22, - dup116, - dup23, - ]), - }); - - var msg639 = msg("UI_CFG_AUDIT_SET:01", all32); - - var part662 = match("MESSAGE#635:UI_CFG_AUDIT_SET:02/1_0", "nwparser.p0", "\"%{change_old->} %{p0}"); - - var select62 = linear_select([ - part662, - dup114, - ]); - - var all33 = all_match({ - processors: [ - dup111, - select62, - dup115, - ], - on_success: processor_chain([ - dup21, - dup22, - dup116, - dup23, - ]), - }); - - var msg640 = msg("UI_CFG_AUDIT_SET:02", all33); - - var part663 = match("MESSAGE#636:UI_CFG_AUDIT_SET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' replace: [edit-config config %{filename->} applications %{info}] \u003c\u003c%{disposition}> -> \"%{agent}\"", processor_chain([ - dup21, - dup22, - setc("event_description","User replace config application(s)"), - dup23, - ])); - - var msg641 = msg("UI_CFG_AUDIT_SET", part663); - - var select63 = linear_select([ - msg639, - msg640, - msg641, - ]); - - var part664 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/2", "nwparser.p0", ": [groups %{info->} secret]"); - - var all34 = all_match({ - processors: [ - dup117, - dup156, - part664, - ], - on_success: processor_chain([ - dup113, - dup22, - dup120, - dup23, - ]), - }); - - var msg642 = msg("UI_CFG_AUDIT_SET_SECRET:01", all34); - - var part665 = match("MESSAGE#638:UI_CFG_AUDIT_SET_SECRET:02/2", "nwparser.p0", ": [%{info}]"); - - var all35 = all_match({ - processors: [ - dup117, - dup156, - part665, - ], - on_success: processor_chain([ - dup113, - dup22, - dup120, - dup23, - ]), - }); - - var msg643 = msg("UI_CFG_AUDIT_SET_SECRET:02", all35); - - var part666 = match("MESSAGE#639:UI_CFG_AUDIT_SET_SECRET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' %{dclass_counter2->} %{directory}", processor_chain([ - dup21, - dup22, - setc("event_description","UI CFG AUDIT SET SECRET"), - dup23, - ])); - - var msg644 = msg("UI_CFG_AUDIT_SET_SECRET", part666); - - var select64 = linear_select([ - msg642, - msg643, - msg644, - ]); - - var part667 = match("MESSAGE#640:UI_CHILD_ARGS_EXCEEDED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Too many arguments for child process '%{agent}'", processor_chain([ - dup30, - dup22, - setc("event_description","Too many arguments for child process"), - dup23, - ])); - - var msg645 = msg("UI_CHILD_ARGS_EXCEEDED", part667); - - var part668 = match("MESSAGE#641:UI_CHILD_CHANGE_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to switch to local user: %{username}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to switch to local user"), - dup23, - ])); - - var msg646 = msg("UI_CHILD_CHANGE_USER", part668); - - var part669 = match("MESSAGE#642:UI_CHILD_EXEC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exec failed for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Child exec failed"), - dup23, - ])); - - var msg647 = msg("UI_CHILD_EXEC", part669); - - var part670 = match("MESSAGE#643:UI_CHILD_EXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exited: PID %{child_pid}, status %{result}, command '%{action}'", processor_chain([ - dup30, - dup22, - setc("event_description","Child exited"), - dup23, - ])); - - var msg648 = msg("UI_CHILD_EXITED", part670); - - var part671 = match("MESSAGE#644:UI_CHILD_FOPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to append to log '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to append to log"), - dup23, - ])); - - var msg649 = msg("UI_CHILD_FOPEN", part671); - - var part672 = match("MESSAGE#645:UI_CHILD_PIPE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipe for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create pipe for command"), - dup23, - ])); - - var msg650 = msg("UI_CHILD_PIPE_FAILED", part672); - - var part673 = match("MESSAGE#646:UI_CHILD_SIGNALED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child received signal: PID %{child_pid}, signal %{result}: %{resultcode}, command='%{action}'", processor_chain([ - dup21, - dup22, - dup61, - setc("event_description","Child received signal"), - dup23, - ])); - - var msg651 = msg("UI_CHILD_SIGNALED", part673); - - var part674 = match("MESSAGE#647:UI_CHILD_STOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child stopped: PID %{child_pid}, signal=%{resultcode->} command='%{action}')", processor_chain([ - dup21, - dup22, - setc("event_description","Child stopped"), - dup23, - ])); - - var msg652 = msg("UI_CHILD_STOPPED", part674); - - var part675 = match("MESSAGE#648:UI_CHILD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Starting child '%{agent}'", processor_chain([ - dup21, - dup22, - setc("event_description","Starting child"), - dup23, - ])); - - var msg653 = msg("UI_CHILD_START", part675); - - var part676 = match("MESSAGE#649:UI_CHILD_STATUS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Cleanup child '%{agent}', PID %{child_pid}, status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Cleanup child"), - dup23, - ])); - - var msg654 = msg("UI_CHILD_STATUS", part676); - - var part677 = match("MESSAGE#650:UI_CHILD_WAITPID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: waitpid failed: PID %{child_pid}, rc %{dclass_counter2}, status %{resultcode}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","waitpid failed"), - dup23, - ])); - - var msg655 = msg("UI_CHILD_WAITPID", part677); - - var part678 = match("MESSAGE#651:UI_CLI_IDLE_TIMEOUT", "nwparser.payload", "%{event_type}: Idle timeout for user '%{username}' exceeded and %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Idle timeout for user exceeded"), - dup23, - ])); - - var msg656 = msg("UI_CLI_IDLE_TIMEOUT", part678); - - var part679 = match("MESSAGE#652:UI_CMDLINE_READ_LINE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}', command '%{action}'", processor_chain([ - dup21, - dup22, - dup121, - dup23, - ])); - - var msg657 = msg("UI_CMDLINE_READ_LINE", part679); - - var part680 = match("MESSAGE#653:UI_CMDSET_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command execution failed for '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Command execution failed"), - dup23, - ])); - - var msg658 = msg("UI_CMDSET_EXEC_FAILED", part680); - - var part681 = match("MESSAGE#654:UI_CMDSET_FORK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fork command '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fork command"), - dup23, - ])); - - var msg659 = msg("UI_CMDSET_FORK_FAILED", part681); - - var msg660 = msg("UI_CMDSET_PIPE_FAILED", dup144); - - var part682 = match("MESSAGE#656:UI_CMDSET_STOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command stopped: PID %{child_pid}, signal '%{resultcode}, command '%{action}'", processor_chain([ - dup30, - dup22, - dup70, - dup23, - ])); - - var msg661 = msg("UI_CMDSET_STOPPED", part682); - - var part683 = match("MESSAGE#657:UI_CMDSET_WEXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command exited: PID %{child_pid}, status %{resultcode}, command '%{action}'", processor_chain([ - dup30, - dup22, - dup72, - dup23, - ])); - - var msg662 = msg("UI_CMDSET_WEXITED", part683); - - var part684 = match("MESSAGE#658:UI_CMD_AUTH_REGEX_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid '%{action}' command authorization regular expression '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Invalid regexp command"), - dup23, - ])); - - var msg663 = msg("UI_CMD_AUTH_REGEX_INVALID", part684); - - var part685 = match("MESSAGE#659:UI_COMMIT/1_0", "nwparser.p0", "requested '%{action}' operation (comment:%{info})"); - - var part686 = match("MESSAGE#659:UI_COMMIT/1_1", "nwparser.p0", "performed %{action}"); - - var select65 = linear_select([ - part685, - part686, - ]); - - var all36 = all_match({ - processors: [ - dup117, - select65, - ], - on_success: processor_chain([ - dup21, - dup22, - dup122, - dup23, - ]), - }); - - var msg664 = msg("UI_COMMIT", all36); - - var part687 = match("MESSAGE#660:UI_COMMIT_AT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{result}", processor_chain([ - dup21, - dup22, - dup122, - dup23, - ])); - - var msg665 = msg("UI_COMMIT_AT", part687); - - var part688 = match("MESSAGE#661:UI_COMMIT_AT_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: '%{agent}' was successful", processor_chain([ - dup21, - dup22, - setc("event_description","User commit successful"), - dup23, - ])); - - var msg666 = msg("UI_COMMIT_AT_COMPLETED", part688); - - var part689 = match("MESSAGE#662:UI_COMMIT_AT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}, %{info}", processor_chain([ - dup30, - dup22, - setc("event_description","User commit failed"), - dup23, - ])); - - var msg667 = msg("UI_COMMIT_AT_FAILED", part689); - - var part690 = match("MESSAGE#663:UI_COMMIT_COMPRESS_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to compress file %{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to compress file"), - dup23, - ])); - - var msg668 = msg("UI_COMMIT_COMPRESS_FAILED", part690); - - var part691 = match("MESSAGE#664:UI_COMMIT_CONFIRMED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed '%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","UI COMMIT CONFIRMED"), - dup23, - ])); - - var msg669 = msg("UI_COMMIT_CONFIRMED", part691); - - var part692 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: '%{action}' must be confirmed within %{p0}"); - - var part693 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/1_0", "nwparser.p0", "minutes %{dclass_counter1}"); - - var part694 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/1_1", "nwparser.p0", "%{dclass_counter1->} minutes"); - - var select66 = linear_select([ - part693, - part694, - ]); - - var all37 = all_match({ - processors: [ - part692, - select66, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT must be confirmed within # minutes"), - dup23, - ]), - }); - - var msg670 = msg("UI_COMMIT_CONFIRMED_REMINDER", all37); - - var part695 = match("MESSAGE#666:UI_COMMIT_CONFIRMED_TIMED/2", "nwparser.p0", "'%{username}' performed '%{action}'"); - - var all38 = all_match({ - processors: [ - dup50, - dup145, - part695, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","user performed commit confirm"), - dup23, - ]), - }); - - var msg671 = msg("UI_COMMIT_CONFIRMED_TIMED", all38); - - var part696 = match("MESSAGE#667:UI_COMMIT_EMPTY_CONTAINER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Skipped empty object %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Skipped empty object"), - dup23, - ])); - - var msg672 = msg("UI_COMMIT_EMPTY_CONTAINER", part696); - - var part697 = match("MESSAGE#668:UI_COMMIT_NOT_CONFIRMED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Commit was not confirmed; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","COMMIT NOT CONFIRMED"), - dup23, - ])); - - var msg673 = msg("UI_COMMIT_NOT_CONFIRMED", part697); - - var part698 = match("MESSAGE#669:UI_COMMIT_PROGRESS/1_0", "nwparser.p0", "commit %{p0}"); - - var part699 = match("MESSAGE#669:UI_COMMIT_PROGRESS/1_1", "nwparser.p0", "Commit operation in progress %{p0}"); - - var select67 = linear_select([ - part698, - part699, - ]); - - var part700 = match("MESSAGE#669:UI_COMMIT_PROGRESS/2", "nwparser.p0", ": %{action}"); - - var all39 = all_match({ - processors: [ - dup50, - select67, - part700, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","Commit operation in progress"), - dup23, - ]), - }); - - var msg674 = msg("UI_COMMIT_PROGRESS", all39); - - var part701 = match("MESSAGE#670:UI_COMMIT_QUIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT QUIT"), - dup23, - ])); - - var msg675 = msg("UI_COMMIT_QUIT", part701); - - var part702 = match("MESSAGE#671:UI_COMMIT_ROLLBACK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Automatic rollback failed", processor_chain([ - dup30, - dup22, - setc("event_description","Automatic rollback failed"), - dup23, - ])); - - var msg676 = msg("UI_COMMIT_ROLLBACK_FAILED", part702); - - var part703 = match("MESSAGE#672:UI_COMMIT_SYNC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT SYNC"), - dup23, - ])); - - var msg677 = msg("UI_COMMIT_SYNC", part703); - - var part704 = match("MESSAGE#673:UI_COMMIT_SYNC_FORCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: All logins to local configuration database were terminated because %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","All logins to local configuration database were terminated"), - dup23, - ])); - - var msg678 = msg("UI_COMMIT_SYNC_FORCE", part704); - - var part705 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process: %{agent}, path: %{p0}"); - - var part706 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/1_0", "nwparser.p0", "[%{filename}], %{p0}"); - - var part707 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/1_1", "nwparser.p0", "%{filename}, %{p0}"); - - var select68 = linear_select([ - part706, - part707, - ]); - - var part708 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/2", "nwparser.p0", "statement: %{info->} %{p0}"); - - var part709 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/3_0", "nwparser.p0", ", error: %{result->} "); - - var select69 = linear_select([ - part709, - dup112, - ]); - - var all40 = all_match({ - processors: [ - part705, - select68, - part708, - select69, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","CONFIGURATION ERROR"), - dup23, - ]), - }); - - var msg679 = msg("UI_CONFIGURATION_ERROR", all40); - - var part710 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/2", "nwparser.p0", "socket connection accept failed: %{result}"); - - var all41 = all_match({ - processors: [ - dup50, - dup157, - part710, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","socket connection accept failed"), - dup23, - ]), - }); - - var msg680 = msg("UI_DAEMON_ACCEPT_FAILED", all41); - - var part711 = match("MESSAGE#676:UI_DAEMON_FORK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create session child: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create session child"), - dup23, - ])); - - var msg681 = msg("UI_DAEMON_FORK_FAILED", part711); - - var part712 = match("MESSAGE#677:UI_DAEMON_SELECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: select failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DAEMON SELECT FAILED"), - dup23, - ])); - - var msg682 = msg("UI_DAEMON_SELECT_FAILED", part712); - - var part713 = match("MESSAGE#678:UI_DAEMON_SOCKET_FAILED/2", "nwparser.p0", "socket create failed: %{result}"); - - var all42 = all_match({ - processors: [ - dup50, - dup157, - part713, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","socket create failed"), - dup23, - ]), - }); - - var msg683 = msg("UI_DAEMON_SOCKET_FAILED", all42); - - var part714 = match("MESSAGE#679:UI_DBASE_ACCESS_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to reaccess database file '%{filename}', address %{interface}, size %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to reaccess database file"), - dup23, - ])); - - var msg684 = msg("UI_DBASE_ACCESS_FAILED", part714); - - var part715 = match("MESSAGE#680:UI_DBASE_CHECKOUT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database '%{filename}' is out of data and needs to be rebuilt", processor_chain([ - dup30, - dup22, - setc("event_description","Database is out of data"), - dup23, - ])); - - var msg685 = msg("UI_DBASE_CHECKOUT_FAILED", part715); - - var part716 = match("MESSAGE#681:UI_DBASE_EXTEND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to extend database file '%{filename}' to size %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to extend database file"), - dup23, - ])); - - var msg686 = msg("UI_DBASE_EXTEND_FAILED", part716); - - var part717 = match("MESSAGE#682:UI_DBASE_LOGIN_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' entering configuration mode", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","User entering configuration mode"), - dup23, - ])); - - var msg687 = msg("UI_DBASE_LOGIN_EVENT", part717); - - var part718 = match("MESSAGE#683:UI_DBASE_LOGOUT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{event_description}", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","User exiting configuration mode"), - dup23, - ])); - - var msg688 = msg("UI_DBASE_LOGOUT_EVENT", part718); - - var part719 = match("MESSAGE#684:UI_DBASE_MISMATCH_EXTENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header extent mismatch for file '%{agent}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header extent mismatch"), - dup23, - ])); - - var msg689 = msg("UI_DBASE_MISMATCH_EXTENT", part719); - - var part720 = match("MESSAGE#685:UI_DBASE_MISMATCH_MAJOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header major version number mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header major version number mismatch"), - dup23, - ])); - - var msg690 = msg("UI_DBASE_MISMATCH_MAJOR", part720); - - var part721 = match("MESSAGE#686:UI_DBASE_MISMATCH_MINOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header minor version number mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header minor version number mismatch"), - dup23, - ])); - - var msg691 = msg("UI_DBASE_MISMATCH_MINOR", part721); - - var part722 = match("MESSAGE#687:UI_DBASE_MISMATCH_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header sequence numbers mismatch for file '%{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Database header sequence numbers mismatch"), - dup23, - ])); - - var msg692 = msg("UI_DBASE_MISMATCH_SEQUENCE", part722); - - var part723 = match("MESSAGE#688:UI_DBASE_MISMATCH_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header size mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header size mismatch"), - dup23, - ])); - - var msg693 = msg("UI_DBASE_MISMATCH_SIZE", part723); - - var part724 = match("MESSAGE#689:UI_DBASE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database open failed for file '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Database open failed"), - dup23, - ])); - - var msg694 = msg("UI_DBASE_OPEN_FAILED", part724); - - var part725 = match("MESSAGE#690:UI_DBASE_REBUILD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} Automatic rebuild of the database '%{filename}' failed", processor_chain([ - dup30, - dup22, - setc("event_description","DBASE REBUILD FAILED"), - dup23, - ])); - - var msg695 = msg("UI_DBASE_REBUILD_FAILED", part725); - - var part726 = match("MESSAGE#691:UI_DBASE_REBUILD_SCHEMA_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Automatic rebuild of the database failed", processor_chain([ - dup30, - dup22, - setc("event_description","Automatic rebuild of the database failed"), - dup23, - ])); - - var msg696 = msg("UI_DBASE_REBUILD_SCHEMA_FAILED", part726); - - var part727 = match("MESSAGE#692:UI_DBASE_REBUILD_STARTED/1_1", "nwparser.p0", "Automatic %{p0}"); - - var select70 = linear_select([ - dup76, - part727, - ]); - - var part728 = match("MESSAGE#692:UI_DBASE_REBUILD_STARTED/2", "nwparser.p0", "%{username->} rebuild/rollback of the database '%{filename}' started"); - - var all43 = all_match({ - processors: [ - dup50, - select70, - part728, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","DBASE REBUILD STARTED"), - dup23, - ]), - }); - - var msg697 = msg("UI_DBASE_REBUILD_STARTED", all43); - - var part729 = match("MESSAGE#693:UI_DBASE_RECREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' attempting database re-creation", processor_chain([ - dup21, - dup22, - setc("event_description","user attempting database re-creation"), - dup23, - ])); - - var msg698 = msg("UI_DBASE_RECREATE", part729); - - var part730 = match("MESSAGE#694:UI_DBASE_REOPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reopen of the database failed", processor_chain([ - dup30, - dup22, - setc("event_description","Reopen of the database failed"), - dup23, - ])); - - var msg699 = msg("UI_DBASE_REOPEN_FAILED", part730); - - var part731 = match("MESSAGE#695:UI_DUPLICATE_UID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Users %{username->} have the same UID %{uid}", processor_chain([ - dup30, - dup22, - setc("event_description","Users have the same UID"), - dup23, - ])); - - var msg700 = msg("UI_DUPLICATE_UID", part731); - - var part732 = match("MESSAGE#696:UI_JUNOSCRIPT_CMD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' used JUNOScript client to run command '%{action}'", processor_chain([ - setc("eventcategory","1401050100"), - dup22, - setc("event_description","User used JUNOScript client to run command"), - dup23, - ])); - - var msg701 = msg("UI_JUNOSCRIPT_CMD", part732); - - var part733 = match("MESSAGE#697:UI_JUNOSCRIPT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: JUNOScript error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JUNOScript error"), - dup23, - ])); - - var msg702 = msg("UI_JUNOSCRIPT_ERROR", part733); - - var part734 = match("MESSAGE#698:UI_LOAD_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' is performing a '%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","User command"), - dup23, - ])); - - var msg703 = msg("UI_LOAD_EVENT", part734); - - var part735 = match("MESSAGE#699:UI_LOAD_JUNOS_DEFAULT_FILE_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Loading the default config from %{filename}", processor_chain([ - setc("eventcategory","1701040000"), - dup22, - setc("event_description","Loading default config from file"), - dup23, - ])); - - var msg704 = msg("UI_LOAD_JUNOS_DEFAULT_FILE_EVENT", part735); - - var part736 = match("MESSAGE#700:UI_LOGIN_EVENT:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' login, class '%{group}' [%{fld01}], %{info->} '%{saddr->} %{sport->} %{daddr->} %{dport}', client-mode '%{fld02}'", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - dup127, - dup128, - dup23, - ])); - - var msg705 = msg("UI_LOGIN_EVENT:01", part736); - - var part737 = match("MESSAGE#701:UI_LOGIN_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' login, class '%{group}' %{info}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - dup127, - dup23, - ])); - - var msg706 = msg("UI_LOGIN_EVENT", part737); - - var select71 = linear_select([ - msg705, - msg706, - ]); - - var part738 = match("MESSAGE#702:UI_LOGOUT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' logout", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","User logout"), - dup23, - ])); - - var msg707 = msg("UI_LOGOUT_EVENT", part738); - - var part739 = match("MESSAGE#703:UI_LOST_CONN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Lost connection to daemon %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","Lost connection to daemon"), - dup23, - ])); - - var msg708 = msg("UI_LOST_CONN", part739); - - var part740 = match("MESSAGE#704:UI_MASTERSHIP_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} by '%{username}'", processor_chain([ - dup21, - dup22, - setc("event_description","MASTERSHIP EVENT"), - dup23, - ])); - - var msg709 = msg("UI_MASTERSHIP_EVENT", part740); - - var part741 = match("MESSAGE#705:UI_MGD_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Terminating operation: exit status %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","Terminating operation"), - dup23, - ])); - - var msg710 = msg("UI_MGD_TERMINATE", part741); - - var part742 = match("MESSAGE#706:UI_NETCONF_CMD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' used NETCONF client to run command '%{action}'", processor_chain([ - dup29, - dup22, - setc("event_description","User used NETCONF client to run command"), - dup23, - ])); - - var msg711 = msg("UI_NETCONF_CMD", part742); - - var part743 = match("MESSAGE#707:UI_READ_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: read failed for peer %{hostname}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","read failed for peer"), - dup23, - ])); - - var msg712 = msg("UI_READ_FAILED", part743); - - var part744 = match("MESSAGE#708:UI_READ_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Timeout on read of peer %{hostname}", processor_chain([ - dup30, - dup22, - setc("event_description","Timeout on read of peer"), - dup23, - ])); - - var msg713 = msg("UI_READ_TIMEOUT", part744); - - var part745 = match("MESSAGE#709:UI_REBOOT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: System %{action->} by '%{username}'", processor_chain([ - dup60, - dup22, - setc("event_description","System reboot or halt"), - dup23, - ])); - - var msg714 = msg("UI_REBOOT_EVENT", part745); - - var part746 = match("MESSAGE#710:UI_RESTART_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' restarting daemon %{service}", processor_chain([ - dup29, - dup22, - setc("event_description","user restarting daemon"), - dup23, - ])); - - var msg715 = msg("UI_RESTART_EVENT", part746); - - var part747 = match("MESSAGE#711:UI_SCHEMA_CHECKOUT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema is out of date and %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema is out of date"), - dup23, - ])); - - var msg716 = msg("UI_SCHEMA_CHECKOUT_FAILED", part747); - - var part748 = match("MESSAGE#712:UI_SCHEMA_MISMATCH_MAJOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema major version mismatch for package %{filename->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema major version mismatch"), - dup23, - ])); - - var msg717 = msg("UI_SCHEMA_MISMATCH_MAJOR", part748); - - var part749 = match("MESSAGE#713:UI_SCHEMA_MISMATCH_MINOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema minor version mismatch for package %{filename->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema minor version mismatch"), - dup23, - ])); - - var msg718 = msg("UI_SCHEMA_MISMATCH_MINOR", part749); - - var part750 = match("MESSAGE#714:UI_SCHEMA_MISMATCH_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema header sequence numbers mismatch for package %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema header sequence numbers mismatch"), - dup23, - ])); - - var msg719 = msg("UI_SCHEMA_MISMATCH_SEQUENCE", part750); - - var part751 = match("MESSAGE#715:UI_SCHEMA_SEQUENCE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema sequence number mismatch", processor_chain([ - dup30, - dup22, - setc("event_description","Schema sequence number mismatch"), - dup23, - ])); - - var msg720 = msg("UI_SCHEMA_SEQUENCE_ERROR", part751); - - var part752 = match("MESSAGE#716:UI_SYNC_OTHER_RE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Configuration synchronization with remote Routing Engine %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Configuration synchronization with remote Routing Engine"), - dup23, - ])); - - var msg721 = msg("UI_SYNC_OTHER_RE", part752); - - var part753 = match("MESSAGE#717:UI_TACPLUS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: TACACS+ failure: %{result}", processor_chain([ - dup30, - dup22, - dup129, - dup23, - ])); - - var msg722 = msg("UI_TACPLUS_ERROR", part753); - - var part754 = match("MESSAGE#718:UI_VERSION_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fetch system version: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fetch system version"), - dup23, - ])); - - var msg723 = msg("UI_VERSION_FAILED", part754); - - var part755 = match("MESSAGE#719:UI_WRITE_RECONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Re-establishing connection to peer %{hostname}", processor_chain([ - dup21, - dup22, - setc("event_description","Re-establishing connection to peer"), - dup23, - ])); - - var msg724 = msg("UI_WRITE_RECONNECT", part755); - - var part756 = match("MESSAGE#720:VRRPD_NEWMASTER_TRAP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Interface %{interface->} (local addr: %{saddr}) is now master for %{username}", processor_chain([ - dup21, - dup22, - setc("event_description","Interface new master for User"), - dup23, - ])); - - var msg725 = msg("VRRPD_NEWMASTER_TRAP", part756); - - var part757 = match("MESSAGE#721:WEB_AUTH_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to authenticate %{obj_name->} (username %{c_username})", processor_chain([ - dup69, - dup34, - dup35, - dup43, - dup22, - setc("event_description","Unable to authenticate client"), - dup23, - ])); - - var msg726 = msg("WEB_AUTH_FAIL", part757); - - var part758 = match("MESSAGE#722:WEB_AUTH_SUCCESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authenticated %{agent->} client (username %{c_username})", processor_chain([ - dup80, - dup34, - dup35, - dup37, - dup22, - setc("event_description","Authenticated client"), - dup23, - ])); - - var msg727 = msg("WEB_AUTH_SUCCESS", part758); - - var part759 = match("MESSAGE#723:WEB_INTERFACE_UNAUTH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Web services request received from unauthorized interface %{interface}", processor_chain([ - setc("eventcategory","1001030300"), - dup22, - setc("event_description","web request from unauthorized interface"), - dup23, - ])); - - var msg728 = msg("WEB_INTERFACE_UNAUTH", part759); - - var part760 = match("MESSAGE#724:WEB_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to read from client: %{result}", processor_chain([ - dup74, - dup22, - setc("event_description","Unable to read from client"), - dup23, - ])); - - var msg729 = msg("WEB_READ", part760); - - var part761 = match("MESSAGE#725:WEBFILTER_REQUEST_NOT_CHECKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Error encountered: %{result}, failed to check request %{url}", processor_chain([ - setc("eventcategory","1204020100"), - dup22, - setc("event_description","failed to check web request"), - dup23, - ])); - - var msg730 = msg("WEBFILTER_REQUEST_NOT_CHECKED", part761); - - var part762 = match("MESSAGE#726:FLOW_REASSEMBLE_FAIL", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" destination-address=\"%{daddr}\" assembly-id=\"%{fld1}\"]", processor_chain([ - dup74, - dup53, - dup43, - dup22, - dup52, - ])); - - var msg731 = msg("FLOW_REASSEMBLE_FAIL", part762); - - var part763 = match("MESSAGE#727:eswd", "nwparser.payload", "%{process}[%{process_id}]: Bridge Address: add %{macaddr}", processor_chain([ - dup29, - dup22, - setc("event_description","Bridge Address"), - dup23, - ])); - - var msg732 = msg("eswd", part763); - - var part764 = match("MESSAGE#728:eswd:01", "nwparser.payload", "%{process}[%{process_id}]: %{info}: STP state for interface %{interface->} context id %{id->} changed from %{fld3}", processor_chain([ - dup29, - dup22, - setc("event_description","ESWD STP State Change Info"), - dup23, - ])); - - var msg733 = msg("eswd:01", part764); - - var select72 = linear_select([ - msg732, - msg733, - ]); - - var part765 = match("MESSAGE#729:/usr/sbin/cron", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) CMD ( %{action})", processor_chain([ - dup29, - dup22, - dup26, - dup23, - ])); - - var msg734 = msg("/usr/sbin/cron", part765); - - var part766 = match("MESSAGE#730:chassism:02", "nwparser.payload", "%{process}[%{process_id}]: %{info}: ifd %{interface->} %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","Link status change event"), - dup23, - ])); - - var msg735 = msg("chassism:02", part766); - - var part767 = match("MESSAGE#731:chassism:01", "nwparser.payload", "%{process}[%{process_id}]: %{info}: %{interface}, %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","ifd process flaps"), - dup23, - ])); - - var msg736 = msg("chassism:01", part767); - - var part768 = match("MESSAGE#732:chassism", "nwparser.payload", "%{process}[%{process_id}]: %{info}: %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","IFCM "), - dup23, - ])); - - var msg737 = msg("chassism", part768); - - var select73 = linear_select([ - msg735, - msg736, - msg737, - ]); - - var msg738 = msg("WEBFILTER_URL_PERMITTED", dup158); - - var part769 = match("MESSAGE#734:WEBFILTER_URL_PERMITTED:01", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg739 = msg("WEBFILTER_URL_PERMITTED:01", part769); - - var part770 = match("MESSAGE#735:WEBFILTER_URL_PERMITTED:03", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=%{fld4}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg740 = msg("WEBFILTER_URL_PERMITTED:03", part770); - - var part771 = match("MESSAGE#736:WEBFILTER_URL_PERMITTED:02", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=%{url}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg741 = msg("WEBFILTER_URL_PERMITTED:02", part771); - - var select74 = linear_select([ - msg738, - msg739, - msg740, - msg741, - ]); - - var msg742 = msg("WEBFILTER_URL_BLOCKED", dup158); - - var part772 = match("MESSAGE#738:WEBFILTER_URL_BLOCKED:01", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg743 = msg("WEBFILTER_URL_BLOCKED:01", part772); - - var select75 = linear_select([ - msg742, - msg743, - ]); - - var part773 = match("MESSAGE#740:SECINTEL_NETWORK_CONNECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> Access url %{url->} on port %{network_port->} failed\u003c\u003c%{result}>.", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg744 = msg("SECINTEL_NETWORK_CONNECT_FAILED", part773); - - var part774 = match("MESSAGE#741:AAMWD_NETWORK_CONNECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> Access host %{hostname->} on ip %{hostip->} port %{network_port->} %{result}.", processor_chain([ - dup46, - dup47, - dup23, - ])); - - var msg745 = msg("AAMWD_NETWORK_CONNECT_FAILED", part774); - - var part775 = match("MESSAGE#742:PKID_UNABLE_TO_GET_CRL", "nwparser.payload", "%{process}[%{process_id}]: %{id}: Failed to retrieve CRL from received file for %{node}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg746 = msg("PKID_UNABLE_TO_GET_CRL", part775); - - var part776 = match("MESSAGE#743:SECINTEL_ERROR_OTHERS", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> %{result}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg747 = msg("SECINTEL_ERROR_OTHERS", part776); - - var part777 = match("MESSAGE#744:JSRPD_HA_CONTROL_LINK_UP", "nwparser.payload", "%{process}[%{process_id}]: %{id}: HA control link monitor status is marked up", processor_chain([ - dup48, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg748 = msg("JSRPD_HA_CONTROL_LINK_UP", part777); - - var part778 = match("MESSAGE#745:LACPD_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: LACPD_TIMEOUT: %{sinterface}: %{event_description}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg749 = msg("LACPD_TIMEOUT", part778); - - var msg750 = msg("cli", dup159); - - var msg751 = msg("pfed", dup159); - - var msg752 = msg("idpinfo", dup159); - - var msg753 = msg("kmd", dup159); - - var part779 = match("MESSAGE#751:node:01", "nwparser.payload", "%{hostname->} %{node->} Next-hop resolution requests from interface %{interface->} throttled", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg754 = msg("node:01", part779); - - var part780 = match("MESSAGE#752:node:02", "nwparser.payload", "%{hostname->} %{node->} %{process}: Trying peer connection, status %{resultcode}, attempt %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg755 = msg("node:02", part780); - - var part781 = match("MESSAGE#753:node:03", "nwparser.payload", "%{hostname->} %{node->} %{process}: trying master connection, status %{resultcode}, attempt %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg756 = msg("node:03", part781); - - var part782 = match("MESSAGE#754:node:04", "nwparser.payload", "%{hostname->} %{node->} %{fld1->} key %{fld2->} %{fld3->} port priority %{fld6->} %{fld4->} port %{portname->} %{fld5->} state %{resultcode}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg757 = msg("node:04", part782); - - var select76 = linear_select([ - dup131, - dup132, - ]); - - var part783 = match("MESSAGE#755:node:05/2", "nwparser.p0", "%{}sys priority %{fld4->} %{p0}"); - - var select77 = linear_select([ - dup132, - dup131, - ]); - - var part784 = match("MESSAGE#755:node:05/4", "nwparser.p0", "%{}sys %{interface}"); - - var all44 = all_match({ - processors: [ - dup130, - select76, - part783, - select77, - part784, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg758 = msg("node:05", all44); - - var part785 = match("MESSAGE#756:node:06/1_0", "nwparser.p0", "dst mac %{dinterface}"); - - var part786 = match("MESSAGE#756:node:06/1_1", "nwparser.p0", "src mac %{sinterface->} ether type %{fld1}"); - - var select78 = linear_select([ - part785, - part786, - ]); - - var all45 = all_match({ - processors: [ - dup130, - select78, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg759 = msg("node:06", all45); - - var part787 = match("MESSAGE#757:node:07", "nwparser.payload", "%{hostname->} %{node->} %{process}: interface %{interface->} trigger reth_scan", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg760 = msg("node:07", part787); - - var part788 = match("MESSAGE#758:node:08", "nwparser.payload", "%{hostname->} %{node->} %{process}: %{info}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg761 = msg("node:08", part788); - - var part789 = match("MESSAGE#759:node:09", "nwparser.payload", "%{hostname->} %{node->} %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg762 = msg("node:09", part789); - - var select79 = linear_select([ - msg754, - msg755, - msg756, - msg757, - msg758, - msg759, - msg760, - msg761, - msg762, - ]); - - var part790 = match("MESSAGE#760:(FPC:01", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: deleting active remote neighbor entry %{fld2->} from interface %{interface}.", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg763 = msg("(FPC:01", part790); - - var part791 = match("MESSAGE#761:(FPC:02", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type->} deleting nb %{fld2->} on ifd %{interface->} for cid %{fld3->} from active neighbor table", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg764 = msg("(FPC:02", part791); - - var part792 = match("MESSAGE#762:(FPC:03/0", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: M%{p0}"); - - var part793 = match("MESSAGE#762:(FPC:03/1_0", "nwparser.p0", "DOWN %{p0}"); - - var part794 = match("MESSAGE#762:(FPC:03/1_1", "nwparser.p0", "UP %{p0}"); - - var select80 = linear_select([ - part793, - part794, - ]); - - var part795 = match("MESSAGE#762:(FPC:03/2", "nwparser.p0", "received for interface %{interface}, member of %{fld4}"); - - var all46 = all_match({ - processors: [ - part792, - select80, - part795, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - dup24, - ]), - }); - - var msg765 = msg("(FPC:03", all46); - - var part796 = match("MESSAGE#763:(FPC:04", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: ifd=%{interface}, ifd flags=%{fld2}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg766 = msg("(FPC:04", part796); - - var part797 = match("MESSAGE#764:(FPC:05", "nwparser.payload", "%{fld1}) %{node->} kernel: rdp keepalive expired, connection dropped - src %{fld3}:%{fld2->} dest %{fld4}:%{fld5}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg767 = msg("(FPC:05", part797); - - var part798 = match("MESSAGE#765:(FPC", "nwparser.payload", "%{fld1}) %{node->} %{fld10}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg768 = msg("(FPC", part798); - - var select81 = linear_select([ - msg763, - msg764, - msg765, - msg766, - msg767, - msg768, - ]); - - var part799 = match("MESSAGE#766:tnp.bootpd", "nwparser.payload", "%{process}[%{process_id}]:%{fld1}", processor_chain([ - dup48, - dup23, - dup22, - dup24, - ])); - - var msg769 = msg("tnp.bootpd", part799); - - var part800 = match("MESSAGE#769:AAMW_ACTION_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} hostname=\"%{hostname}\" file-category=\"%{fld9}\" verdict-number=\"%{fld10}\" action=\"%{action}\" list-hit=\"%{fld19}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" application=\"%{fld6}\" nested-application=\"%{fld7}\" policy-name=\"%{policyname}\" username=\"%{username}\" roles=\"%{user_role}\" session-id-32=\"%{sessionid}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" url=\"%{url}\"] %{fld27}", processor_chain([ - dup48, - dup52, - dup22, - dup61, - ])); - - var msg770 = msg("AAMW_ACTION_LOG", part800); - - var part801 = match("MESSAGE#770:AAMW_HOST_INFECTED_EVENT_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} timestamp=\"%{fld30}\" tenant-id=\"%{fld1}\" client-ip-str=\"%{hostip}\" hostname=\"%{hostname}\" status=\"%{fld13}\" policy-name=\"%{policyname}\" verdict-number=\"%{fld15}\" state=\"%{fld16}\" reason=\"%{result}\" message=\"%{info}\" %{fld3}", processor_chain([ - dup133, - dup52, - dup22, - dup61, - ])); - - var msg771 = msg("AAMW_HOST_INFECTED_EVENT_LOG", part801); - - var part802 = match("MESSAGE#771:AAMW_MALWARE_EVENT_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} timestamp=\"%{fld30}\" tenant-id=\"%{fld1}\" sample-sha256=\"%{checksum}\" client-ip-str=\"%{hostip}\" verdict-number=\"%{fld26}\" malware-info=\"%{threat_name}\" username=\"%{username}\" hostname=\"%{hostname}\" %{fld3}", processor_chain([ - dup133, - dup52, - dup22, - ])); - - var msg772 = msg("AAMW_MALWARE_EVENT_LOG", part802); - - var part803 = match("MESSAGE#772:IDP_ATTACK_LOG_EVENT", "nwparser.payload", "%{event_type}[junos@%{fld32->} epoch-time=\"%{fld1}\" message-type=\"%{info}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-name=\"%{protocol}\" service-name=\"%{service}\" application-name=\"%{application}\" rule-name=\"%{fld5}\" rulebase-name=\"%{rulename}\" policy-name=\"%{policyname}\" export-id=\"%{fld6}\" repeat-count=\"%{fld7}\" action=\"%{action}\" threat-severity=\"%{severity}\" attack-name=\"%{threat_name}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" elapsed-time=%{fld8->} inbound-bytes=\"%{rbytes}\" outbound-bytes=\"%{sbytes}\" inbound-packets=\"%{packets}\" outbound-packets=\"%{dclass_counter1}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" packet-log-id=\"%{fld9}\" alert=\"%{fld19}\" username=\"%{username}\" roles=\"%{fld15}\" message=\"%{fld28}\" %{fld3}", processor_chain([ - dup81, - dup52, - dup22, - dup61, - ])); - - var msg773 = msg("IDP_ATTACK_LOG_EVENT", part803); - - var part804 = match("MESSAGE#773:RT_SCREEN_ICMP", "nwparser.payload", "%{event_type}[junos@%{fld32->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"] %{fld23}", processor_chain([ - dup81, - dup52, - dup22, - dup61, - ])); - - var msg774 = msg("RT_SCREEN_ICMP", part804); - - var part805 = match("MESSAGE#774:SECINTEL_ACTION_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} category=\"%{fld1}\" sub-category=\"%{fld2}\" action=\"%{action}\" action-detail=\"%{fld4}\" http-host=\"%{fld17}\" threat-severity=\"%{severity}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" application=\"%{fld5}\" nested-application=\"%{fld6}\" feed-name=\"%{fld18}\" policy-name=\"%{policyname}\" profile-name=\"%{rulename}\" username=\"%{username}\" roles=\"%{user_role}\" session-id-32=\"%{sessionid}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\"]%{fld10}", processor_chain([ - dup46, - dup52, - dup22, - dup61, - ])); - - var msg775 = msg("SECINTEL_ACTION_LOG", part805); - - var part806 = match("MESSAGE#775:qsfp/0", "nwparser.payload", "%{hostname->} %{fld2->} %{p0}"); - - var part807 = match("MESSAGE#775:qsfp/1_0", "nwparser.p0", "%{fld3->} %{process}: qsfp-%{p0}"); - - var part808 = match("MESSAGE#775:qsfp/1_1", "nwparser.p0", "qsfp-%{p0}"); - - var select82 = linear_select([ - part807, - part808, - ]); - - var part809 = match("MESSAGE#775:qsfp/2", "nwparser.p0", "%{}Chan# %{interface->} %{fld5}:%{event_description}"); - - var all47 = all_match({ - processors: [ - part806, - select82, - part809, - ], - on_success: processor_chain([ - dup21, - dup22, - dup23, - ]), - }); - - var msg776 = msg("qsfp", all47); - - var part810 = match("MESSAGE#776:JUNOSROUTER_GENERIC:03", "nwparser.payload", "%{event_type}: User '%{username}', command '%{action}'", processor_chain([ - dup21, - dup22, - dup121, - dup23, - ])); - - var msg777 = msg("JUNOSROUTER_GENERIC:03", part810); - - var part811 = match("MESSAGE#777:JUNOSROUTER_GENERIC:04", "nwparser.payload", "%{event_type}: User '%{username}' %{fld1}", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","LOGOUT"), - dup23, - ])); - - var msg778 = msg("JUNOSROUTER_GENERIC:04", part811); - - var part812 = match("MESSAGE#778:JUNOSROUTER_GENERIC:05", "nwparser.payload", "%{event_type}: TACACS+ failure: %{result}", processor_chain([ - dup30, - dup22, - dup129, - dup23, - ])); - - var msg779 = msg("JUNOSROUTER_GENERIC:05", part812); - - var part813 = match("MESSAGE#779:JUNOSROUTER_GENERIC:06", "nwparser.payload", "%{event_type}: mismatch NLRI with %{hostip->} (%{hostname}): peer: %{daddr->} us: %{saddr}", processor_chain([ - dup30, - dup22, - dup57, - dup23, - ])); - - var msg780 = msg("JUNOSROUTER_GENERIC:06", part813); - - var part814 = match("MESSAGE#780:JUNOSROUTER_GENERIC:07", "nwparser.payload", "%{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{resultcode->} (%{action}), Reason: %{result}", processor_chain([ - dup21, - dup22, - dup38, - dup23, - ])); - - var msg781 = msg("JUNOSROUTER_GENERIC:07", part814); - - var part815 = match("MESSAGE#781:JUNOSROUTER_GENERIC:08/0", "nwparser.payload", "%{event_type}: NOTIFICATION received from %{daddr->} (%{dhost}): code %{resultcode->} (%{action})%{p0}"); - - var part816 = match("MESSAGE#781:JUNOSROUTER_GENERIC:08/1_0", "nwparser.p0", ", socket buffer sndcc: %{fld1->} rcvcc: %{fld2->} TCP state: %{event_state}, snd_una: %{fld3->} snd_nxt: %{fld4->} snd_wnd: %{fld5->} rcv_nxt: %{fld6->} rcv_adv: %{fld7}, hold timer %{fld8}"); - - var part817 = match_copy("MESSAGE#781:JUNOSROUTER_GENERIC:08/1_1", "nwparser.p0", ""); - - var select83 = linear_select([ - part816, - part817, - ]); - - var all48 = all_match({ - processors: [ - part815, - select83, - ], - on_success: processor_chain([ - dup21, - dup22, - dup38, - dup23, - ]), - }); - - var msg782 = msg("JUNOSROUTER_GENERIC:08", all48); - - var part818 = match("MESSAGE#782:JUNOSROUTER_GENERIC:09", "nwparser.payload", "%{event_type}: [edit interfaces%{interface}unit%{fld1}family inet address%{hostip}/%{network_port}] :%{event_description}:%{info}", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg783 = msg("JUNOSROUTER_GENERIC:09", part818); - - var part819 = match("MESSAGE#783:JUNOSROUTER_GENERIC:01", "nwparser.payload", "%{event_type->} Interface Monitor failed %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - setc("event_description","Interface Monitor failed "), - dup24, - ])); - - var msg784 = msg("JUNOSROUTER_GENERIC:01", part819); - - var part820 = match("MESSAGE#784:JUNOSROUTER_GENERIC:02", "nwparser.payload", "%{event_type->} Interface Monitor failure recovered %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - setc("event_description","Interface Monitor failure recovered"), - dup24, - ])); - - var msg785 = msg("JUNOSROUTER_GENERIC:02", part820); - - var part821 = match("MESSAGE#785:JUNOSROUTER_GENERIC", "nwparser.payload", "%{event_type->} %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - dup24, - ])); - - var msg786 = msg("JUNOSROUTER_GENERIC", part821); - - var select84 = linear_select([ - msg777, - msg778, - msg779, - msg780, - msg781, - msg782, - msg783, - msg784, - msg785, - msg786, - ]); - - var chain1 = processor_chain([ - select5, - msgid_select({ - "(FPC": select81, - "/usr/libexec/telnetd": msg2, - "/usr/sbin/cron": msg734, - "/usr/sbin/sshd": msg1, - "AAMWD_NETWORK_CONNECT_FAILED": msg745, - "AAMW_ACTION_LOG": msg770, - "AAMW_HOST_INFECTED_EVENT_LOG": msg771, - "AAMW_MALWARE_EVENT_LOG": msg772, - "ACCT_ACCOUNTING_FERROR": msg114, - "ACCT_ACCOUNTING_FOPEN_ERROR": msg115, - "ACCT_ACCOUNTING_SMALL_FILE_SIZE": msg116, - "ACCT_BAD_RECORD_FORMAT": msg117, - "ACCT_CU_RTSLIB_error": msg118, - "ACCT_GETHOSTNAME_error": msg119, - "ACCT_MALLOC_FAILURE": msg120, - "ACCT_UNDEFINED_COUNTER_NAME": msg121, - "ACCT_XFER_FAILED": msg122, - "ACCT_XFER_POPEN_FAIL": msg123, - "APPQOS_LOG_EVENT": msg124, - "APPTRACK_SESSION_CLOSE": select30, - "APPTRACK_SESSION_CREATE": msg125, - "APPTRACK_SESSION_VOL_UPDATE": select31, - "BCHIP": msg106, - "BFDD_TRAP_STATE_DOWN": msg130, - "BFDD_TRAP_STATE_UP": msg131, - "BOOTPD_ARG_ERR": msg143, - "BOOTPD_BAD_ID": msg144, - "BOOTPD_BOOTSTRING": msg145, - "BOOTPD_CONFIG_ERR": msg146, - "BOOTPD_CONF_OPEN": msg147, - "BOOTPD_DUP_REV": msg148, - "BOOTPD_DUP_SLOT": msg149, - "BOOTPD_MODEL_CHK": msg150, - "BOOTPD_MODEL_ERR": msg151, - "BOOTPD_NEW_CONF": msg152, - "BOOTPD_NO_BOOTSTRING": msg153, - "BOOTPD_NO_CONFIG": msg154, - "BOOTPD_PARSE_ERR": msg155, - "BOOTPD_REPARSE": msg156, - "BOOTPD_SELECT_ERR": msg157, - "BOOTPD_TIMEOUT": msg158, - "BOOTPD_VERSION": msg159, - "CHASSISD": msg160, - "CHASSISD_ARGUMENT_ERROR": msg161, - "CHASSISD_BLOWERS_SPEED": msg162, - "CHASSISD_BLOWERS_SPEED_FULL": msg163, - "CHASSISD_CB_READ": msg164, - "CHASSISD_COMMAND_ACK_ERROR": msg165, - "CHASSISD_COMMAND_ACK_SF_ERROR": msg166, - "CHASSISD_CONCAT_MODE_ERROR": msg167, - "CHASSISD_CONFIG_INIT_ERROR": msg168, - "CHASSISD_CONFIG_WARNING": msg169, - "CHASSISD_EXISTS": msg170, - "CHASSISD_EXISTS_TERM_OTHER": msg171, - "CHASSISD_FILE_OPEN": msg172, - "CHASSISD_FILE_STAT": msg173, - "CHASSISD_FRU_EVENT": msg174, - "CHASSISD_FRU_IPC_WRITE_ERROR_EXT": msg175, - "CHASSISD_FRU_STEP_ERROR": msg176, - "CHASSISD_GETTIMEOFDAY": msg177, - "CHASSISD_HIGH_TEMP_CONDITION": msg214, - "CHASSISD_HOST_TEMP_READ": msg178, - "CHASSISD_IFDEV_DETACH_ALL_PSEUDO": msg179, - "CHASSISD_IFDEV_DETACH_FPC": msg180, - "CHASSISD_IFDEV_DETACH_PIC": msg181, - "CHASSISD_IFDEV_DETACH_PSEUDO": msg182, - "CHASSISD_IFDEV_DETACH_TLV_ERROR": msg183, - "CHASSISD_IFDEV_GET_BY_INDEX_FAIL": msg184, - "CHASSISD_IPC_MSG_QFULL_ERROR": msg185, - "CHASSISD_IPC_UNEXPECTED_RECV": msg186, - "CHASSISD_IPC_WRITE_ERR_NO_PIPE": msg187, - "CHASSISD_IPC_WRITE_ERR_NULL_ARGS": msg188, - "CHASSISD_MAC_ADDRESS_ERROR": msg189, - "CHASSISD_MAC_DEFAULT": msg190, - "CHASSISD_MBUS_ERROR": msg191, - "CHASSISD_PARSE_COMPLETE": msg192, - "CHASSISD_PARSE_ERROR": msg193, - "CHASSISD_PARSE_INIT": msg194, - "CHASSISD_PIDFILE_OPEN": msg195, - "CHASSISD_PIPE_WRITE_ERROR": msg196, - "CHASSISD_POWER_CHECK": msg197, - "CHASSISD_RECONNECT_SUCCESSFUL": msg198, - "CHASSISD_RELEASE_MASTERSHIP": msg199, - "CHASSISD_RE_INIT_INVALID_RE_SLOT": msg200, - "CHASSISD_ROOT_MOUNT_ERROR": msg201, - "CHASSISD_RTS_SEQ_ERROR": msg202, - "CHASSISD_SBOARD_VERSION_MISMATCH": msg203, - "CHASSISD_SERIAL_ID": msg204, - "CHASSISD_SMB_ERROR": msg205, - "CHASSISD_SNMP_TRAP10": msg208, - "CHASSISD_SNMP_TRAP6": msg206, - "CHASSISD_SNMP_TRAP7": msg207, - "CHASSISD_TERM_SIGNAL": msg209, - "CHASSISD_TRACE_PIC_OFFLINE": msg210, - "CHASSISD_UNEXPECTED_EXIT": msg211, - "CHASSISD_UNSUPPORTED_MODEL": msg212, - "CHASSISD_VERSION_MISMATCH": msg213, - "CM": msg107, - "CM_JAVA": msg216, - "COS": msg108, - "COSFPC": msg109, - "COSMAN": msg110, - "CRON": msg16, - "CROND": select11, - "Cmerror": msg17, - "DCD_AS_ROOT": msg217, - "DCD_FILTER_LIB_ERROR": msg218, - "DCD_MALLOC_FAILED_INIT": msg219, - "DCD_PARSE_EMERGENCY": msg220, - "DCD_PARSE_FILTER_EMERGENCY": msg221, - "DCD_PARSE_MINI_EMERGENCY": msg222, - "DCD_PARSE_STATE_EMERGENCY": msg223, - "DCD_POLICER_PARSE_EMERGENCY": msg224, - "DCD_PULL_LOG_FAILURE": msg225, - "DFWD_ARGUMENT_ERROR": msg226, - "DFWD_MALLOC_FAILED_INIT": msg227, - "DFWD_PARSE_FILTER_EMERGENCY": msg228, - "DFWD_PARSE_STATE_EMERGENCY": msg229, - "ECCD_DAEMONIZE_FAILED": msg230, - "ECCD_DUPLICATE": msg231, - "ECCD_LOOP_EXIT_FAILURE": msg232, - "ECCD_NOT_ROOT": msg233, - "ECCD_PCI_FILE_OPEN_FAILED": msg234, - "ECCD_PCI_READ_FAILED": msg235, - "ECCD_PCI_WRITE_FAILED": msg236, - "ECCD_PID_FILE_LOCK": msg237, - "ECCD_PID_FILE_UPDATE": msg238, - "ECCD_TRACE_FILE_OPEN_FAILED": msg239, - "ECCD_usage": msg240, - "EVENT": msg23, - "EVENTD_AUDIT_SHOW": msg241, - "FLOW_REASSEMBLE_FAIL": msg731, - "FLOW_REASSEMBLE_SUCCEED": msg242, - "FSAD_CHANGE_FILE_OWNER": msg243, - "FSAD_CONFIG_ERROR": msg244, - "FSAD_CONNTIMEDOUT": msg245, - "FSAD_FAILED": msg246, - "FSAD_FETCHTIMEDOUT": msg247, - "FSAD_FILE_FAILED": msg248, - "FSAD_FILE_REMOVE": msg249, - "FSAD_FILE_RENAME": msg250, - "FSAD_FILE_STAT": msg251, - "FSAD_FILE_SYNC": msg252, - "FSAD_MAXCONN": msg253, - "FSAD_MEMORYALLOC_FAILED": msg254, - "FSAD_NOT_ROOT": msg255, - "FSAD_PARENT_DIRECTORY": msg256, - "FSAD_PATH_IS_DIRECTORY": msg257, - "FSAD_PATH_IS_SPECIAL": msg258, - "FSAD_RECVERROR": msg259, - "FSAD_TERMINATED_CONNECTION": msg260, - "FSAD_TERMINATING_SIGNAL": msg261, - "FSAD_TRACEOPEN_FAILED": msg262, - "FSAD_USAGE": msg263, - "Failed": select25, - "GGSN_ALARM_TRAP_FAILED": msg264, - "GGSN_ALARM_TRAP_SEND": msg265, - "GGSN_TRAP_SEND": msg266, - "IDP_ATTACK_LOG_EVENT": msg773, - "JADE_AUTH_ERROR": msg267, - "JADE_EXEC_ERROR": msg268, - "JADE_NO_LOCAL_USER": msg269, - "JADE_PAM_ERROR": msg270, - "JADE_PAM_NO_LOCAL_USER": msg271, - "JSRPD_HA_CONTROL_LINK_UP": msg748, - "JUNOSROUTER_GENERIC": select84, - "KERN_ARP_ADDR_CHANGE": msg272, - "KMD_PM_SA_ESTABLISHED": msg273, - "L2CPD_TASK_REINIT": msg274, - "LACPD_TIMEOUT": msg749, - "LIBJNX_EXEC_EXITED": msg275, - "LIBJNX_EXEC_FAILED": msg276, - "LIBJNX_EXEC_PIPE": msg277, - "LIBJNX_EXEC_SIGNALED": msg278, - "LIBJNX_EXEC_WEXIT": msg279, - "LIBJNX_FILE_COPY_FAILED": msg280, - "LIBJNX_PRIV_LOWER_FAILED": msg281, - "LIBJNX_PRIV_RAISE_FAILED": msg282, - "LIBJNX_REPLICATE_RCP_EXEC_FAILED": msg283, - "LIBJNX_ROTATE_COMPRESS_EXEC_FAILED": msg284, - "LIBSERVICED_CLIENT_CONNECTION": msg285, - "LIBSERVICED_OUTBOUND_REQUEST": msg286, - "LIBSERVICED_SNMP_LOST_CONNECTION": msg287, - "LIBSERVICED_SOCKET_BIND": msg288, - "LIBSERVICED_SOCKET_PRIVATIZE": msg289, - "LICENSE_EXPIRED": msg290, - "LICENSE_EXPIRED_KEY_DELETED": msg291, - "LICENSE_NEARING_EXPIRY": msg292, - "LOGIN_ABORTED": msg293, - "LOGIN_FAILED": msg294, - "LOGIN_FAILED_INCORRECT_PASSWORD": msg295, - "LOGIN_FAILED_SET_CONTEXT": msg296, - "LOGIN_FAILED_SET_LOGIN": msg297, - "LOGIN_HOSTNAME_UNRESOLVED": msg298, - "LOGIN_INFORMATION": msg299, - "LOGIN_INVALID_LOCAL_USER": msg300, - "LOGIN_MALFORMED_USER": msg301, - "LOGIN_PAM_AUTHENTICATION_ERROR": msg302, - "LOGIN_PAM_ERROR": msg303, - "LOGIN_PAM_MAX_RETRIES": msg304, - "LOGIN_PAM_NONLOCAL_USER": msg305, - "LOGIN_PAM_STOP": msg306, - "LOGIN_PAM_USER_UNKNOWN": msg307, - "LOGIN_PASSWORD_EXPIRED": msg308, - "LOGIN_REFUSED": msg309, - "LOGIN_ROOT": msg310, - "LOGIN_TIMED_OUT": msg311, - "MIB2D_ATM_ERROR": msg312, - "MIB2D_CONFIG_CHECK_FAILED": msg313, - "MIB2D_FILE_OPEN_FAILURE": msg314, - "MIB2D_IFD_IFINDEX_FAILURE": msg315, - "MIB2D_IFL_IFINDEX_FAILURE": msg316, - "MIB2D_INIT_FAILURE": msg317, - "MIB2D_KVM_FAILURE": msg318, - "MIB2D_RTSLIB_READ_FAILURE": msg319, - "MIB2D_RTSLIB_SEQ_MISMATCH": msg320, - "MIB2D_SYSCTL_FAILURE": msg321, - "MIB2D_TRAP_HEADER_FAILURE": msg322, - "MIB2D_TRAP_SEND_FAILURE": msg323, - "MRVL-L2": msg56, - "Multiuser": msg324, - "NASD_AUTHENTICATION_CREATE_FAILED": msg325, - "NASD_CHAP_AUTHENTICATION_IN_PROGRESS": msg326, - "NASD_CHAP_GETHOSTNAME_FAILED": msg327, - "NASD_CHAP_INVALID_CHAP_IDENTIFIER": msg328, - "NASD_CHAP_INVALID_OPCODE": msg329, - "NASD_CHAP_LOCAL_NAME_UNAVAILABLE": msg330, - "NASD_CHAP_MESSAGE_UNEXPECTED": msg331, - "NASD_CHAP_REPLAY_ATTACK_DETECTED": msg332, - "NASD_CONFIG_GET_LAST_MODIFIED_FAILED": msg333, - "NASD_DAEMONIZE_FAILED": msg334, - "NASD_DB_ALLOC_FAILURE": msg335, - "NASD_DB_TABLE_CREATE_FAILURE": msg336, - "NASD_DUPLICATE": msg337, - "NASD_EVLIB_CREATE_FAILURE": msg338, - "NASD_EVLIB_EXIT_FAILURE": msg339, - "NASD_LOCAL_CREATE_FAILED": msg340, - "NASD_NOT_ROOT": msg341, - "NASD_PID_FILE_LOCK": msg342, - "NASD_PID_FILE_UPDATE": msg343, - "NASD_POST_CONFIGURE_EVENT_FAILED": msg344, - "NASD_PPP_READ_FAILURE": msg345, - "NASD_PPP_SEND_FAILURE": msg346, - "NASD_PPP_SEND_PARTIAL": msg347, - "NASD_PPP_UNRECOGNIZED": msg348, - "NASD_RADIUS_ALLOCATE_PASSWORD_FAILED": msg349, - "NASD_RADIUS_CONFIG_FAILED": msg350, - "NASD_RADIUS_CREATE_FAILED": msg351, - "NASD_RADIUS_CREATE_REQUEST_FAILED": msg352, - "NASD_RADIUS_GETHOSTNAME_FAILED": msg353, - "NASD_RADIUS_MESSAGE_UNEXPECTED": msg354, - "NASD_RADIUS_OPEN_FAILED": msg355, - "NASD_RADIUS_SELECT_FAILED": msg356, - "NASD_RADIUS_SET_TIMER_FAILED": msg357, - "NASD_TRACE_FILE_OPEN_FAILED": msg358, - "NASD_usage": msg359, - "NOTICE": msg360, - "PFEMAN": msg61, - "PFE_FW_SYSLOG_IP": select36, - "PFE_NH_RESOLVE_THROTTLED": msg363, - "PING_TEST_COMPLETED": msg364, - "PING_TEST_FAILED": msg365, - "PKID_UNABLE_TO_GET_CRL": msg746, - "PWC_EXIT": msg368, - "PWC_HOLD_RELEASE": msg369, - "PWC_INVALID_RUNS_ARGUMENT": msg370, - "PWC_INVALID_TIMEOUT_ARGUMENT": msg371, - "PWC_KILLED_BY_SIGNAL": msg372, - "PWC_KILL_EVENT": msg373, - "PWC_KILL_FAILED": msg374, - "PWC_KQUEUE_ERROR": msg375, - "PWC_KQUEUE_INIT": msg376, - "PWC_KQUEUE_REGISTER_FILTER": msg377, - "PWC_LOCKFILE_BAD_FORMAT": msg378, - "PWC_LOCKFILE_ERROR": msg379, - "PWC_LOCKFILE_MISSING": msg380, - "PWC_LOCKFILE_NOT_LOCKED": msg381, - "PWC_NO_PROCESS": msg382, - "PWC_PROCESS_EXIT": msg383, - "PWC_PROCESS_FORCED_HOLD": msg384, - "PWC_PROCESS_HOLD": msg385, - "PWC_PROCESS_HOLD_SKIPPED": msg386, - "PWC_PROCESS_OPEN": msg387, - "PWC_PROCESS_TIMED_HOLD": msg388, - "PWC_PROCESS_TIMEOUT": msg389, - "PWC_SIGNAL_INIT": msg390, - "PWC_SOCKET_CONNECT": msg391, - "PWC_SOCKET_CREATE": msg392, - "PWC_SOCKET_OPTION": msg393, - "PWC_STDOUT_WRITE": msg394, - "PWC_SYSTEM_CALL": msg395, - "PWC_UNKNOWN_KILL_OPTION": msg396, - "RDP": msg111, - "RMOPD_ADDRESS_MULTICAST_INVALID": msg397, - "RMOPD_ADDRESS_SOURCE_INVALID": msg398, - "RMOPD_ADDRESS_STRING_FAILURE": msg399, - "RMOPD_ADDRESS_TARGET_INVALID": msg400, - "RMOPD_DUPLICATE": msg401, - "RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED": msg402, - "RMOPD_ICMP_SENDMSG_FAILURE": msg403, - "RMOPD_IFINDEX_NOT_ACTIVE": msg404, - "RMOPD_IFINDEX_NO_INFO": msg405, - "RMOPD_IFNAME_NOT_ACTIVE": msg406, - "RMOPD_IFNAME_NO_INFO": msg407, - "RMOPD_NOT_ROOT": msg408, - "RMOPD_ROUTING_INSTANCE_NO_INFO": msg409, - "RMOPD_TRACEROUTE_ERROR": msg410, - "RMOPD_usage": msg411, - "RPD_ABORT": msg412, - "RPD_ACTIVE_TERMINATE": msg413, - "RPD_ASSERT": msg414, - "RPD_ASSERT_SOFT": msg415, - "RPD_EXIT": msg416, - "RPD_IFL_INDEXCOLLISION": msg417, - "RPD_IFL_NAMECOLLISION": msg418, - "RPD_ISIS_ADJDOWN": msg419, - "RPD_ISIS_ADJUP": msg420, - "RPD_ISIS_ADJUPNOIP": msg421, - "RPD_ISIS_LSPCKSUM": msg422, - "RPD_ISIS_OVERLOAD": msg423, - "RPD_KRT_AFUNSUPRT": msg424, - "RPD_KRT_CCC_IFL_MODIFY": msg425, - "RPD_KRT_DELETED_RTT": msg426, - "RPD_KRT_IFA_GENERATION": msg427, - "RPD_KRT_IFDCHANGE": msg428, - "RPD_KRT_IFDEST_GET": msg429, - "RPD_KRT_IFDGET": msg430, - "RPD_KRT_IFD_GENERATION": msg431, - "RPD_KRT_IFL_CELL_RELAY_MODE_INVALID": msg432, - "RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED": msg433, - "RPD_KRT_IFL_GENERATION": msg434, - "RPD_KRT_KERNEL_BAD_ROUTE": msg435, - "RPD_KRT_NEXTHOP_OVERFLOW": msg436, - "RPD_KRT_NOIFD": msg437, - "RPD_KRT_UNKNOWN_RTT": msg438, - "RPD_KRT_VERSION": msg439, - "RPD_KRT_VERSIONNONE": msg440, - "RPD_KRT_VERSIONOLD": msg441, - "RPD_LDP_INTF_BLOCKED": msg442, - "RPD_LDP_INTF_UNBLOCKED": msg443, - "RPD_LDP_NBRDOWN": msg444, - "RPD_LDP_NBRUP": msg445, - "RPD_LDP_SESSIONDOWN": msg446, - "RPD_LDP_SESSIONUP": msg447, - "RPD_LOCK_FLOCKED": msg448, - "RPD_LOCK_LOCKED": msg449, - "RPD_MPLS_LSP_CHANGE": msg450, - "RPD_MPLS_LSP_DOWN": msg451, - "RPD_MPLS_LSP_SWITCH": msg452, - "RPD_MPLS_LSP_UP": msg453, - "RPD_MSDP_PEER_DOWN": msg454, - "RPD_MSDP_PEER_UP": msg455, - "RPD_OSPF_NBRDOWN": msg456, - "RPD_OSPF_NBRUP": msg457, - "RPD_OS_MEMHIGH": msg458, - "RPD_PIM_NBRDOWN": msg459, - "RPD_PIM_NBRUP": msg460, - "RPD_RDISC_CKSUM": msg461, - "RPD_RDISC_NOMULTI": msg462, - "RPD_RDISC_NORECVIF": msg463, - "RPD_RDISC_SOLICITADDR": msg464, - "RPD_RDISC_SOLICITICMP": msg465, - "RPD_RDISC_SOLICITLEN": msg466, - "RPD_RIP_AUTH": msg467, - "RPD_RIP_JOIN_BROADCAST": msg468, - "RPD_RIP_JOIN_MULTICAST": msg469, - "RPD_RT_IFUP": msg470, - "RPD_SCHED_CALLBACK_LONGRUNTIME": msg471, - "RPD_SCHED_CUMULATIVE_LONGRUNTIME": msg472, - "RPD_SCHED_MODULE_LONGRUNTIME": msg473, - "RPD_SCHED_TASK_LONGRUNTIME": msg474, - "RPD_SIGNAL_TERMINATE": msg475, - "RPD_START": msg476, - "RPD_SYSTEM": msg477, - "RPD_TASK_BEGIN": msg478, - "RPD_TASK_CHILDKILLED": msg479, - "RPD_TASK_CHILDSTOPPED": msg480, - "RPD_TASK_FORK": msg481, - "RPD_TASK_GETWD": msg482, - "RPD_TASK_NOREINIT": msg483, - "RPD_TASK_PIDCLOSED": msg484, - "RPD_TASK_PIDFLOCK": msg485, - "RPD_TASK_PIDWRITE": msg486, - "RPD_TASK_REINIT": msg487, - "RPD_TASK_SIGNALIGNORE": msg488, - "RT_COS": msg489, - "RT_FLOW_SESSION_CLOSE": select51, - "RT_FLOW_SESSION_CREATE": select45, - "RT_FLOW_SESSION_DENY": select47, - "RT_SCREEN_ICMP": msg774, - "RT_SCREEN_IP": select52, - "RT_SCREEN_SESSION_LIMIT": msg504, - "RT_SCREEN_TCP": msg503, - "RT_SCREEN_UDP": msg505, - "Resolve": msg63, - "SECINTEL_ACTION_LOG": msg775, - "SECINTEL_ERROR_OTHERS": msg747, - "SECINTEL_NETWORK_CONNECT_FAILED": msg744, - "SERVICED_CLIENT_CONNECT": msg506, - "SERVICED_CLIENT_DISCONNECTED": msg507, - "SERVICED_CLIENT_ERROR": msg508, - "SERVICED_COMMAND_FAILED": msg509, - "SERVICED_COMMIT_FAILED": msg510, - "SERVICED_CONFIGURATION_FAILED": msg511, - "SERVICED_CONFIG_ERROR": msg512, - "SERVICED_CONFIG_FILE": msg513, - "SERVICED_CONNECTION_ERROR": msg514, - "SERVICED_DISABLED_GGSN": msg515, - "SERVICED_DUPLICATE": msg516, - "SERVICED_EVENT_FAILED": msg517, - "SERVICED_INIT_FAILED": msg518, - "SERVICED_MALLOC_FAILURE": msg519, - "SERVICED_NETWORK_FAILURE": msg520, - "SERVICED_NOT_ROOT": msg521, - "SERVICED_PID_FILE_LOCK": msg522, - "SERVICED_PID_FILE_UPDATE": msg523, - "SERVICED_RTSOCK_SEQUENCE": msg524, - "SERVICED_SIGNAL_HANDLER": msg525, - "SERVICED_SOCKET_CREATE": msg526, - "SERVICED_SOCKET_IO": msg527, - "SERVICED_SOCKET_OPTION": msg528, - "SERVICED_STDLIB_FAILURE": msg529, - "SERVICED_USAGE": msg530, - "SERVICED_WORK_INCONSISTENCY": msg531, - "SNMPD_ACCESS_GROUP_ERROR": msg537, - "SNMPD_AUTH_FAILURE": select53, - "SNMPD_AUTH_PRIVILEGES_EXCEEDED": msg542, - "SNMPD_AUTH_RESTRICTED_ADDRESS": msg543, - "SNMPD_AUTH_WRONG_PDU_TYPE": msg544, - "SNMPD_CONFIG_ERROR": msg545, - "SNMPD_CONTEXT_ERROR": msg546, - "SNMPD_ENGINE_FILE_FAILURE": msg547, - "SNMPD_ENGINE_PROCESS_ERROR": msg548, - "SNMPD_FILE_FAILURE": msg549, - "SNMPD_GROUP_ERROR": msg550, - "SNMPD_INIT_FAILED": msg551, - "SNMPD_LIBJUNIPER_FAILURE": msg552, - "SNMPD_LOOPBACK_ADDR_ERROR": msg553, - "SNMPD_MEMORY_FREED": msg554, - "SNMPD_RADIX_FAILURE": msg555, - "SNMPD_RECEIVE_FAILURE": msg556, - "SNMPD_RMONFILE_FAILURE": msg557, - "SNMPD_RMON_COOKIE": msg558, - "SNMPD_RMON_EVENTLOG": msg559, - "SNMPD_RMON_IOERROR": msg560, - "SNMPD_RMON_MIBERROR": msg561, - "SNMPD_RTSLIB_ASYNC_EVENT": msg562, - "SNMPD_SEND_FAILURE": select54, - "SNMPD_SOCKET_FAILURE": msg565, - "SNMPD_SUBAGENT_NO_BUFFERS": msg566, - "SNMPD_SUBAGENT_SEND_FAILED": msg567, - "SNMPD_SYSLIB_FAILURE": msg568, - "SNMPD_THROTTLE_QUEUE_DRAINED": msg569, - "SNMPD_TRAP_COLD_START": msg570, - "SNMPD_TRAP_GEN_FAILURE": msg571, - "SNMPD_TRAP_GEN_FAILURE2": msg572, - "SNMPD_TRAP_INVALID_DATA": msg573, - "SNMPD_TRAP_NOT_ENOUGH_VARBINDS": msg574, - "SNMPD_TRAP_QUEUED": msg575, - "SNMPD_TRAP_QUEUE_DRAINED": msg576, - "SNMPD_TRAP_QUEUE_MAX_ATTEMPTS": msg577, - "SNMPD_TRAP_QUEUE_MAX_SIZE": msg578, - "SNMPD_TRAP_THROTTLED": msg579, - "SNMPD_TRAP_TYPE_ERROR": msg580, - "SNMPD_TRAP_VARBIND_TYPE_ERROR": msg581, - "SNMPD_TRAP_VERSION_ERROR": msg582, - "SNMPD_TRAP_WARM_START": msg583, - "SNMPD_USER_ERROR": msg584, - "SNMPD_VIEW_DELETE": msg585, - "SNMPD_VIEW_INSTALL_DEFAULT": msg586, - "SNMPD_VIEW_OID_PARSE": msg587, - "SNMP_GET_ERROR1": msg588, - "SNMP_GET_ERROR2": msg589, - "SNMP_GET_ERROR3": msg590, - "SNMP_GET_ERROR4": msg591, - "SNMP_NS_LOG_INFO": msg535, - "SNMP_RTSLIB_FAILURE": msg592, - "SNMP_SUBAGENT_IPC_REG_ROWS": msg536, - "SNMP_TRAP_LINK_DOWN": select55, - "SNMP_TRAP_LINK_UP": select56, - "SNMP_TRAP_PING_PROBE_FAILED": msg597, - "SNMP_TRAP_PING_TEST_COMPLETED": msg598, - "SNMP_TRAP_PING_TEST_FAILED": msg599, - "SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE": msg600, - "SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED": msg601, - "SNMP_TRAP_TRACE_ROUTE_TEST_FAILED": msg602, - "SNTPD": msg112, - "SSB": msg113, - "SSHD_LOGIN_FAILED": select57, - "SSL_PROXY_SESSION_IGNORE": msg534, - "SSL_PROXY_SSL_SESSION_ALLOW": msg532, - "SSL_PROXY_SSL_SESSION_DROP": msg533, - "TASK_TASK_REINIT": msg606, - "TFTPD_AF_ERR": msg607, - "TFTPD_BIND_ERR": msg608, - "TFTPD_CONNECT_ERR": msg609, - "TFTPD_CONNECT_INFO": msg610, - "TFTPD_CREATE_ERR": msg611, - "TFTPD_FIO_ERR": msg612, - "TFTPD_FORK_ERR": msg613, - "TFTPD_NAK_ERR": msg614, - "TFTPD_OPEN_ERR": msg615, - "TFTPD_RECVCOMPLETE_INFO": msg616, - "TFTPD_RECVFROM_ERR": msg617, - "TFTPD_RECV_ERR": msg618, - "TFTPD_SENDCOMPLETE_INFO": msg619, - "TFTPD_SEND_ERR": msg620, - "TFTPD_SOCKET_ERR": msg621, - "TFTPD_STATFS_ERR": msg622, - "TNP": msg623, - "UI_AUTH_EVENT": msg628, - "UI_AUTH_INVALID_CHALLENGE": msg629, - "UI_BOOTTIME_FAILED": msg630, - "UI_CFG_AUDIT_NEW": select58, - "UI_CFG_AUDIT_OTHER": select60, - "UI_CFG_AUDIT_SET": select63, - "UI_CFG_AUDIT_SET_SECRET": select64, - "UI_CHILD_ARGS_EXCEEDED": msg645, - "UI_CHILD_CHANGE_USER": msg646, - "UI_CHILD_EXEC": msg647, - "UI_CHILD_EXITED": msg648, - "UI_CHILD_FOPEN": msg649, - "UI_CHILD_PIPE_FAILED": msg650, - "UI_CHILD_SIGNALED": msg651, - "UI_CHILD_START": msg653, - "UI_CHILD_STATUS": msg654, - "UI_CHILD_STOPPED": msg652, - "UI_CHILD_WAITPID": msg655, - "UI_CLI_IDLE_TIMEOUT": msg656, - "UI_CMDLINE_READ_LINE": msg657, - "UI_CMDSET_EXEC_FAILED": msg658, - "UI_CMDSET_FORK_FAILED": msg659, - "UI_CMDSET_PIPE_FAILED": msg660, - "UI_CMDSET_STOPPED": msg661, - "UI_CMDSET_WEXITED": msg662, - "UI_CMD_AUTH_REGEX_INVALID": msg663, - "UI_COMMIT": msg664, - "UI_COMMIT_AT": msg665, - "UI_COMMIT_AT_COMPLETED": msg666, - "UI_COMMIT_AT_FAILED": msg667, - "UI_COMMIT_COMPRESS_FAILED": msg668, - "UI_COMMIT_CONFIRMED": msg669, - "UI_COMMIT_CONFIRMED_REMINDER": msg670, - "UI_COMMIT_CONFIRMED_TIMED": msg671, - "UI_COMMIT_EMPTY_CONTAINER": msg672, - "UI_COMMIT_NOT_CONFIRMED": msg673, - "UI_COMMIT_PROGRESS": msg674, - "UI_COMMIT_QUIT": msg675, - "UI_COMMIT_ROLLBACK_FAILED": msg676, - "UI_COMMIT_SYNC": msg677, - "UI_COMMIT_SYNC_FORCE": msg678, - "UI_CONFIGURATION_ERROR": msg679, - "UI_DAEMON_ACCEPT_FAILED": msg680, - "UI_DAEMON_FORK_FAILED": msg681, - "UI_DAEMON_SELECT_FAILED": msg682, - "UI_DAEMON_SOCKET_FAILED": msg683, - "UI_DBASE_ACCESS_FAILED": msg684, - "UI_DBASE_CHECKOUT_FAILED": msg685, - "UI_DBASE_EXTEND_FAILED": msg686, - "UI_DBASE_LOGIN_EVENT": msg687, - "UI_DBASE_LOGOUT_EVENT": msg688, - "UI_DBASE_MISMATCH_EXTENT": msg689, - "UI_DBASE_MISMATCH_MAJOR": msg690, - "UI_DBASE_MISMATCH_MINOR": msg691, - "UI_DBASE_MISMATCH_SEQUENCE": msg692, - "UI_DBASE_MISMATCH_SIZE": msg693, - "UI_DBASE_OPEN_FAILED": msg694, - "UI_DBASE_REBUILD_FAILED": msg695, - "UI_DBASE_REBUILD_SCHEMA_FAILED": msg696, - "UI_DBASE_REBUILD_STARTED": msg697, - "UI_DBASE_RECREATE": msg698, - "UI_DBASE_REOPEN_FAILED": msg699, - "UI_DUPLICATE_UID": msg700, - "UI_JUNOSCRIPT_CMD": msg701, - "UI_JUNOSCRIPT_ERROR": msg702, - "UI_LOAD_EVENT": msg703, - "UI_LOAD_JUNOS_DEFAULT_FILE_EVENT": msg704, - "UI_LOGIN_EVENT": select71, - "UI_LOGOUT_EVENT": msg707, - "UI_LOST_CONN": msg708, - "UI_MASTERSHIP_EVENT": msg709, - "UI_MGD_TERMINATE": msg710, - "UI_NETCONF_CMD": msg711, - "UI_READ_FAILED": msg712, - "UI_READ_TIMEOUT": msg713, - "UI_REBOOT_EVENT": msg714, - "UI_RESTART_EVENT": msg715, - "UI_SCHEMA_CHECKOUT_FAILED": msg716, - "UI_SCHEMA_MISMATCH_MAJOR": msg717, - "UI_SCHEMA_MISMATCH_MINOR": msg718, - "UI_SCHEMA_MISMATCH_SEQUENCE": msg719, - "UI_SCHEMA_SEQUENCE_ERROR": msg720, - "UI_SYNC_OTHER_RE": msg721, - "UI_TACPLUS_ERROR": msg722, - "UI_VERSION_FAILED": msg723, - "UI_WRITE_RECONNECT": msg724, - "VRRPD_NEWMASTER_TRAP": msg725, - "Version": msg99, - "WEBFILTER_REQUEST_NOT_CHECKED": msg730, - "WEBFILTER_URL_BLOCKED": select75, - "WEBFILTER_URL_PERMITTED": select74, - "WEB_AUTH_FAIL": msg726, - "WEB_AUTH_SUCCESS": msg727, - "WEB_INTERFACE_UNAUTH": msg728, - "WEB_READ": msg729, - "alarmd": msg3, - "bgp_connect_start": msg132, - "bgp_event": msg133, - "bgp_listen_accept": msg134, - "bgp_listen_reset": msg135, - "bgp_nexthop_sanity": msg136, - "bgp_pp_recv": select33, - "bgp_process_caps": select32, - "bgp_send": msg141, - "bgp_traffic_timeout": msg142, - "bigd": select6, - "bigpipe": select7, - "bigstart": msg9, - "cgatool": msg10, - "chassisd": msg11, - "chassism": select73, - "checkd": select8, - "clean_process": msg215, - "cli": msg750, - "cosd": msg14, - "craftd": msg15, - "cron": msg18, - "crond": msg21, - "dcd": msg22, - "eswd": select72, - "ftpd": msg24, - "ha_rto_stats_handler": msg25, - "hostinit": msg26, - "idpinfo": msg752, - "ifinfo": select13, - "ifp_ifl_anydown_change_event": msg30, - "ifp_ifl_config_event": msg31, - "ifp_ifl_ext_chg": msg32, - "inetd": select14, - "init": select15, - "ipc_msg_write": msg40, - "kernel": select17, - "kmd": msg753, - "last": select28, - "login": select18, - "lsys_ssam_handler": msg53, - "mcsn": msg54, - "mgd": msg62, - "mrvl_dfw_log_effuse_status": msg55, - "node": select79, - "pfed": msg751, - "process_mode": select38, - "profile_ssam_handler": msg57, - "pst_nat_binding_set_profile": msg58, - "qsfp": msg776, - "respawn": msg64, - "root": msg65, - "rpd": select20, - "rshd": msg70, - "sfd": msg71, - "sshd": select21, - "syslogd": msg92, - "task_connect": msg605, - "task_reconfigure": msg59, - "tnetd": msg60, - "tnp.bootpd": msg769, - "trace_on": msg624, - "trace_rotate": msg625, - "transfer-file": msg626, - "ttloop": msg627, - "ucd-snmp": select26, - "usp_ipc_client_reconnect": msg95, - "usp_trace_ipc_disconnect": msg96, - "usp_trace_ipc_reconnect": msg97, - "uspinfo": msg98, - "xntpd": select27, - }), - ]); - - var hdr43 = match("HEADER#3:0004/0", "message", "%{month->} %{day->} %{time->} %{p0}"); - - var part822 = match("HEADER#3:0004/1_0", "nwparser.p0", "fpc0 %{p0}"); - - var part823 = match("HEADER#3:0004/1_1", "nwparser.p0", "fpc1 %{p0}"); - - var part824 = match("HEADER#3:0004/1_2", "nwparser.p0", "fpc2 %{p0}"); - - var part825 = match("HEADER#3:0004/1_3", "nwparser.p0", "fpc3 %{p0}"); - - var part826 = match("HEADER#3:0004/1_4", "nwparser.p0", "fpc4 %{p0}"); - - var part827 = match("HEADER#3:0004/1_5", "nwparser.p0", "fpc5 %{p0}"); - - var part828 = match("HEADER#3:0004/1_11", "nwparser.p0", "ssb %{p0}"); - - var part829 = match("HEADER#15:0026.upd.a/1_0", "nwparser.p0", "RT_FLOW - %{p0}"); - - var part830 = match("HEADER#15:0026.upd.a/1_1", "nwparser.p0", "junos-ssl-proxy - %{p0}"); - - var part831 = match("HEADER#15:0026.upd.a/1_2", "nwparser.p0", "RT_APPQOS - %{p0}"); - - var part832 = match("HEADER#15:0026.upd.a/1_3", "nwparser.p0", "%{hfld33->} - %{p0}"); - - var hdr44 = match("HEADER#16:0026.upd.b/0", "message", "%{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var part833 = match("MESSAGE#77:sshd:06/0", "nwparser.payload", "%{} %{p0}"); - - var part834 = match("MESSAGE#77:sshd:06/1_0", "nwparser.p0", "%{process}[%{process_id}]: %{p0}"); - - var part835 = match("MESSAGE#77:sshd:06/1_1", "nwparser.p0", "%{process}: %{p0}"); - - var part836 = match_copy("MESSAGE#72:Failed:05/1_2", "nwparser.p0", "p0"); - - var part837 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{p0}"); - - var part838 = match("MESSAGE#294:LOGIN_INFORMATION/3_0", "nwparser.p0", "User %{p0}"); - - var part839 = match("MESSAGE#294:LOGIN_INFORMATION/3_1", "nwparser.p0", "user %{p0}"); - - var part840 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var part841 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_0", "nwparser.p0", " connection-tag=%{fld20->} service-name=\"%{p0}"); - - var part842 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_1", "nwparser.p0", " service-name=\"%{p0}"); - - var part843 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/3_0", "nwparser.p0", " nat-connection-tag=%{fld6->} src-nat-rule-type=%{fld20->} %{p0}"); - - var part844 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_1", "nwparser.p0", "name=\"%{p0}"); - - var part845 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/8", "nwparser.p0", "]%{}"); - - var part846 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_0", "nwparser.payload", "%{process}: %{event_type}: session denied %{p0}"); - - var part847 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_1", "nwparser.payload", "%{event_type}: session denied %{p0}"); - - var part848 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var part849 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/2", "nwparser.p0", "%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var part850 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{rulename}\" dst-nat-rule-%{p0}"); - - var part851 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/5_0", "nwparser.p0", "type=%{fld7->} dst-nat-rule-name=\"%{p0}"); - - var part852 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/6", "nwparser.p0", "\"%{rule_template->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"%{p0}"); - - var part853 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\" encrypted=%{fld16->} %{p0}"); - - var part854 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' set: [%{action}] %{p0}"); - - var part855 = match_copy("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_1", "nwparser.p0", "space"); - - var part856 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_1", "nwparser.p0", "\u003c\u003c%{change_old}> %{p0}"); - - var part857 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/2", "nwparser.p0", "-> \"%{change_new}\""); - - var part858 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{p0}"); - - var part859 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_0", "nwparser.p0", "set %{p0}"); - - var part860 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_1", "nwparser.p0", "replace %{p0}"); - - var part861 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_0", "nwparser.p0", "Network %{p0}"); - - var part862 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_1", "nwparser.p0", "Local %{p0}"); - - var part863 = match("MESSAGE#755:node:05/0", "nwparser.payload", "%{hostname->} %{node->} %{p0}"); - - var part864 = match("MESSAGE#755:node:05/1_0", "nwparser.p0", "partner%{p0}"); - - var part865 = match("MESSAGE#755:node:05/1_1", "nwparser.p0", "actor%{p0}"); - - var select85 = linear_select([ - dup14, - dup15, - dup16, - dup17, - ]); - - var part866 = match("HEADER#15:0026.upd.a/2", "nwparser.p0", "%{messageid->} [%{p0}", processor_chain([ - dup13, - ])); - - var select86 = linear_select([ - dup40, - dup41, - ]); - - var part867 = match("MESSAGE#125:BFDD_TRAP_STATE_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: local discriminator: %{resultcode}, new state: %{result}", processor_chain([ - dup21, - dup22, - dup56, - dup23, - ])); - - var part868 = match("MESSAGE#214:DCD_MALLOC_FAILED_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed during initialization for configuration load", processor_chain([ - dup51, - dup22, - dup64, - dup23, - ])); - - var part869 = match("MESSAGE#225:ECCD_DAEMONIZE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}, unable to run in the background as a daemon: %{result}", processor_chain([ - dup30, - dup22, - dup65, - dup23, - ])); - - var part870 = match("MESSAGE#226:ECCD_DUPLICATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Another copy of this program is running", processor_chain([ - dup30, - dup22, - dup66, - dup23, - ])); - - var part871 = match("MESSAGE#232:ECCD_PID_FILE_LOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lock PID file: %{result}", processor_chain([ - dup30, - dup22, - dup67, - dup23, - ])); - - var part872 = match("MESSAGE#233:ECCD_PID_FILE_UPDATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to update process PID file: %{result}", processor_chain([ - dup30, - dup22, - dup68, - dup23, - ])); - - var part873 = match("MESSAGE#272:LIBJNX_EXEC_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipes for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - dup71, - dup23, - ])); - - var select87 = linear_select([ - dup76, - dup77, - ]); - - var part874 = match("MESSAGE#310:MIB2D_IFD_IFINDEX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP index assigned to %{uid->} changed from %{dclass_counter1->} to %{result}", processor_chain([ - dup30, - dup22, - dup79, - dup23, - ])); - - var part875 = match("MESSAGE#412:RPD_IFL_INDEXCOLLISION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Logical interface collision -- %{result}, %{info}", processor_chain([ - dup30, - dup22, - dup84, - dup23, - ])); - - var part876 = match("MESSAGE#466:RPD_SCHED_CALLBACK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime time during action of module", processor_chain([ - dup30, - dup22, - dup85, - dup23, - ])); - - var part877 = match("MESSAGE#482:RPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitializing", processor_chain([ - dup21, - dup22, - dup86, - dup23, - ])); - - var select88 = linear_select([ - dup88, - dup89, - ]); - - var select89 = linear_select([ - dup90, - dup45, - ]); - - var select90 = linear_select([ - dup95, - dup96, - ]); - - var select91 = linear_select([ - dup101, - dup91, - ]); - - var part878 = match("MESSAGE#498:RT_SCREEN_TCP", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var part879 = match("MESSAGE#527:SSL_PROXY_SSL_SESSION_ALLOW", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} logical-system-name=\"%{hostname}\" session-id=\"%{sessionid}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" profile-name=\"%{rulename}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" message=\"%{info}\"]", processor_chain([ - dup27, - dup22, - dup52, - ])); - - var select92 = linear_select([ - dup118, - dup119, - ]); - - var select93 = linear_select([ - dup123, - dup124, - ]); - - var part880 = match("MESSAGE#733:WEBFILTER_URL_PERMITTED", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7->} USERNAME=%{fld8->} ROLES=%{fld9}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var part881 = match_copy("MESSAGE#747:cli", "nwparser.payload", "fld12", processor_chain([ - dup48, - dup47, - dup23, - dup22, - ])); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/junos/agent/stream/udp.yml.hbs b/packages/juniper/1.1.0/data_stream/junos/agent/stream/udp.yml.hbs deleted file mode 100755 index 2abb5c1182..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,12569 +0,0 @@ -udp: -host: "{{udp_host}}:{{udp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Juniper" - product: "Junos" - type: "Routers" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{day->} %{time->} %{p0}"); - - var dup2 = match("HEADER#3:0004/1_0", "nwparser.p0", "fpc0 %{p0}"); - - var dup3 = match("HEADER#3:0004/1_1", "nwparser.p0", "fpc1 %{p0}"); - - var dup4 = match("HEADER#3:0004/1_2", "nwparser.p0", "fpc2 %{p0}"); - - var dup5 = match("HEADER#3:0004/1_3", "nwparser.p0", "fpc3 %{p0}"); - - var dup6 = match("HEADER#3:0004/1_4", "nwparser.p0", "fpc4 %{p0}"); - - var dup7 = match("HEADER#3:0004/1_5", "nwparser.p0", "fpc5 %{p0}"); - - var dup8 = match("HEADER#3:0004/1_11", "nwparser.p0", "ssb %{p0}"); - - var dup9 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup10 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" "), - field("p0"), - ], - }); - - var dup11 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup12 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant(": "), - field("p0"), - ], - }); - - var dup13 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" ["), - field("p0"), - ], - }); - - var dup14 = match("HEADER#15:0026.upd.a/1_0", "nwparser.p0", "RT_FLOW - %{p0}"); - - var dup15 = match("HEADER#15:0026.upd.a/1_1", "nwparser.p0", "junos-ssl-proxy - %{p0}"); - - var dup16 = match("HEADER#15:0026.upd.a/1_2", "nwparser.p0", "RT_APPQOS - %{p0}"); - - var dup17 = match("HEADER#15:0026.upd.a/1_3", "nwparser.p0", "%{hfld33->} - %{p0}"); - - var dup18 = match("HEADER#16:0026.upd.b/0", "message", "%{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var dup19 = call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("pid"), - constant("]: "), - field("p0"), - ], - }); - - var dup20 = setc("messageid","JUNOSROUTER_GENERIC"); - - var dup21 = setc("eventcategory","1605000000"); - - var dup22 = setf("msg","$MSG"); - - var dup23 = date_time({ - dest: "event_time", - args: ["month","day","time"], - fmts: [ - [dB,dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup24 = setf("hostname","hhost"); - - var dup25 = setc("event_description","AUDIT"); - - var dup26 = setc("event_description","CRON command"); - - var dup27 = setc("eventcategory","1801030000"); - - var dup28 = setc("eventcategory","1801020000"); - - var dup29 = setc("eventcategory","1605010000"); - - var dup30 = setc("eventcategory","1603000000"); - - var dup31 = setc("event_description","Process mode"); - - var dup32 = setc("event_description","NTP Server Unreachable"); - - var dup33 = setc("eventcategory","1401060000"); - - var dup34 = setc("ec_theme","Authentication"); - - var dup35 = setc("ec_subject","User"); - - var dup36 = setc("ec_activity","Logon"); - - var dup37 = setc("ec_outcome","Success"); - - var dup38 = setc("event_description","rpd proceeding"); - - var dup39 = match("MESSAGE#77:sshd:06/0", "nwparser.payload", "%{} %{p0}"); - - var dup40 = match("MESSAGE#77:sshd:06/1_0", "nwparser.p0", "%{process}[%{process_id}]: %{p0}"); - - var dup41 = match("MESSAGE#77:sshd:06/1_1", "nwparser.p0", "%{process}: %{p0}"); - - var dup42 = setc("eventcategory","1701010000"); - - var dup43 = setc("ec_outcome","Failure"); - - var dup44 = setc("eventcategory","1401030000"); - - var dup45 = match_copy("MESSAGE#72:Failed:05/1_2", "nwparser.p0", "p0"); - - var dup46 = setc("eventcategory","1803000000"); - - var dup47 = setc("event_type","VPN"); - - var dup48 = setc("eventcategory","1605020000"); - - var dup49 = setc("eventcategory","1602020000"); - - var dup50 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{p0}"); - - var dup51 = setc("eventcategory","1603020000"); - - var dup52 = date_time({ - dest: "event_time", - args: ["hfld32"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dc("T"),dN,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup53 = setc("ec_subject","NetworkComm"); - - var dup54 = setc("ec_activity","Create"); - - var dup55 = setc("ec_activity","Stop"); - - var dup56 = setc("event_description","Trap state change"); - - var dup57 = setc("event_description","peer NLRI mismatch"); - - var dup58 = setc("eventcategory","1605030000"); - - var dup59 = setc("eventcategory","1603010000"); - - var dup60 = setc("eventcategory","1606000000"); - - var dup61 = setf("hostname","hhostname"); - - var dup62 = date_time({ - dest: "event_time", - args: ["hfld6"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dc("T"),dN,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup63 = setc("eventcategory","1401050200"); - - var dup64 = setc("event_description","Memory allocation failed during initialization for configuration load"); - - var dup65 = setc("event_description","unable to run in the background as a daemon"); - - var dup66 = setc("event_description","Another copy of this program is running"); - - var dup67 = setc("event_description","Unable to lock PID file"); - - var dup68 = setc("event_description","Unable to update process PID file"); - - var dup69 = setc("eventcategory","1301000000"); - - var dup70 = setc("event_description","Command stopped"); - - var dup71 = setc("event_description","Unable to create pipes for command"); - - var dup72 = setc("event_description","Command exited"); - - var dup73 = setc("eventcategory","1603050000"); - - var dup74 = setc("eventcategory","1801010000"); - - var dup75 = setc("event_description","Login failure"); - - var dup76 = match("MESSAGE#294:LOGIN_INFORMATION/3_0", "nwparser.p0", "User %{p0}"); - - var dup77 = match("MESSAGE#294:LOGIN_INFORMATION/3_1", "nwparser.p0", "user %{p0}"); - - var dup78 = setc("event_description","Unable to open file"); - - var dup79 = setc("event_description","SNMP index assigned changed"); - - var dup80 = setc("eventcategory","1302000000"); - - var dup81 = setc("eventcategory","1001020300"); - - var dup82 = setc("event_description","PFE FW SYSLOG_IP"); - - var dup83 = setc("event_description","process_mode"); - - var dup84 = setc("event_description","Logical interface collision"); - - var dup85 = setc("event_description","excessive runtime time during action of module"); - - var dup86 = setc("event_description","Reinitializing"); - - var dup87 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var dup88 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_0", "nwparser.p0", " connection-tag=%{fld20->} service-name=\"%{p0}"); - - var dup89 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_1", "nwparser.p0", " service-name=\"%{p0}"); - - var dup90 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/3_0", "nwparser.p0", " nat-connection-tag=%{fld6->} src-nat-rule-type=%{fld20->} %{p0}"); - - var dup91 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_1", "nwparser.p0", "name=\"%{p0}"); - - var dup92 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/8", "nwparser.p0", "]%{}"); - - var dup93 = setc("eventcategory","1803010000"); - - var dup94 = setc("ec_activity","Deny"); - - var dup95 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_0", "nwparser.payload", "%{process}: %{event_type}: session denied %{p0}"); - - var dup96 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_1", "nwparser.payload", "%{event_type}: session denied %{p0}"); - - var dup97 = setc("event_description","session denied"); - - var dup98 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var dup99 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/2", "nwparser.p0", "%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var dup100 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{rulename}\" dst-nat-rule-%{p0}"); - - var dup101 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/5_0", "nwparser.p0", "type=%{fld7->} dst-nat-rule-name=\"%{p0}"); - - var dup102 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/6", "nwparser.p0", "\"%{rule_template->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"%{p0}"); - - var dup103 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\" encrypted=%{fld16->} %{p0}"); - - var dup104 = setc("dclass_counter1_string","No.of packets from client"); - - var dup105 = setc("event_description","SNMPD AUTH FAILURE"); - - var dup106 = setc("event_description","send send-type (index1) failure"); - - var dup107 = setc("event_description","SNMP trap error"); - - var dup108 = setc("event_description","SNMP TRAP LINK DOWN"); - - var dup109 = setc("event_description","SNMP TRAP LINK UP"); - - var dup110 = setc("event_description","Login Failure"); - - var dup111 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' set: [%{action}] %{p0}"); - - var dup112 = match_copy("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_1", "nwparser.p0", "space"); - - var dup113 = setc("eventcategory","1701020000"); - - var dup114 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_1", "nwparser.p0", "\u003c\u003c%{change_old}> %{p0}"); - - var dup115 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/2", "nwparser.p0", "-> \"%{change_new}\""); - - var dup116 = setc("event_description","User set command"); - - var dup117 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{p0}"); - - var dup118 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_0", "nwparser.p0", "set %{p0}"); - - var dup119 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_1", "nwparser.p0", "replace %{p0}"); - - var dup120 = setc("event_description","User set groups to secret"); - - var dup121 = setc("event_description","UI CMDLINE READ LINE"); - - var dup122 = setc("event_description","User commit"); - - var dup123 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_0", "nwparser.p0", "Network %{p0}"); - - var dup124 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_1", "nwparser.p0", "Local %{p0}"); - - var dup125 = setc("eventcategory","1401070000"); - - var dup126 = setc("ec_activity","Logoff"); - - var dup127 = setc("event_description","Successful login"); - - var dup128 = setf("hostname","hostip"); - - var dup129 = setc("event_description","TACACS+ failure"); - - var dup130 = match("MESSAGE#755:node:05/0", "nwparser.payload", "%{hostname->} %{node->} %{p0}"); - - var dup131 = match("MESSAGE#755:node:05/1_0", "nwparser.p0", "partner%{p0}"); - - var dup132 = match("MESSAGE#755:node:05/1_1", "nwparser.p0", "actor%{p0}"); - - var dup133 = setc("eventcategory","1003010000"); - - var dup134 = setc("eventcategory","1901000000"); - - var dup135 = linear_select([ - dup14, - dup15, - dup16, - dup17, - ]); - - var dup136 = match("HEADER#15:0026.upd.a/2", "nwparser.p0", "%{messageid->} [%{p0}", processor_chain([ - dup13, - ])); - - var dup137 = linear_select([ - dup40, - dup41, - ]); - - var dup138 = match("MESSAGE#125:BFDD_TRAP_STATE_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: local discriminator: %{resultcode}, new state: %{result}", processor_chain([ - dup21, - dup22, - dup56, - dup23, - ])); - - var dup139 = match("MESSAGE#214:DCD_MALLOC_FAILED_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed during initialization for configuration load", processor_chain([ - dup51, - dup22, - dup64, - dup23, - ])); - - var dup140 = match("MESSAGE#225:ECCD_DAEMONIZE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}, unable to run in the background as a daemon: %{result}", processor_chain([ - dup30, - dup22, - dup65, - dup23, - ])); - - var dup141 = match("MESSAGE#226:ECCD_DUPLICATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Another copy of this program is running", processor_chain([ - dup30, - dup22, - dup66, - dup23, - ])); - - var dup142 = match("MESSAGE#232:ECCD_PID_FILE_LOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lock PID file: %{result}", processor_chain([ - dup30, - dup22, - dup67, - dup23, - ])); - - var dup143 = match("MESSAGE#233:ECCD_PID_FILE_UPDATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to update process PID file: %{result}", processor_chain([ - dup30, - dup22, - dup68, - dup23, - ])); - - var dup144 = match("MESSAGE#272:LIBJNX_EXEC_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipes for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - dup71, - dup23, - ])); - - var dup145 = linear_select([ - dup76, - dup77, - ]); - - var dup146 = match("MESSAGE#310:MIB2D_IFD_IFINDEX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP index assigned to %{uid->} changed from %{dclass_counter1->} to %{result}", processor_chain([ - dup30, - dup22, - dup79, - dup23, - ])); - - var dup147 = match("MESSAGE#412:RPD_IFL_INDEXCOLLISION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Logical interface collision -- %{result}, %{info}", processor_chain([ - dup30, - dup22, - dup84, - dup23, - ])); - - var dup148 = match("MESSAGE#466:RPD_SCHED_CALLBACK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime time during action of module", processor_chain([ - dup30, - dup22, - dup85, - dup23, - ])); - - var dup149 = match("MESSAGE#482:RPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitializing", processor_chain([ - dup21, - dup22, - dup86, - dup23, - ])); - - var dup150 = linear_select([ - dup88, - dup89, - ]); - - var dup151 = linear_select([ - dup90, - dup45, - ]); - - var dup152 = linear_select([ - dup95, - dup96, - ]); - - var dup153 = linear_select([ - dup101, - dup91, - ]); - - var dup154 = match("MESSAGE#498:RT_SCREEN_TCP", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var dup155 = match("MESSAGE#527:SSL_PROXY_SSL_SESSION_ALLOW", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} logical-system-name=\"%{hostname}\" session-id=\"%{sessionid}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" profile-name=\"%{rulename}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" message=\"%{info}\"]", processor_chain([ - dup27, - dup22, - dup52, - ])); - - var dup156 = linear_select([ - dup118, - dup119, - ]); - - var dup157 = linear_select([ - dup123, - dup124, - ]); - - var dup158 = match("MESSAGE#733:WEBFILTER_URL_PERMITTED", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7->} USERNAME=%{fld8->} ROLES=%{fld9}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var dup159 = match_copy("MESSAGE#747:cli", "nwparser.payload", "fld12", processor_chain([ - dup48, - dup47, - dup23, - dup22, - ])); - - var hdr1 = match("HEADER#0:0001", "message", "%{month->} %{day->} %{time->} %{messageid}: restart %{p0}", processor_chain([ - setc("header_id","0001"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(": restart "), - field("p0"), - ], - }), - ])); - - var hdr2 = match("HEADER#1:0002", "message", "%{month->} %{day->} %{time->} %{messageid->} message repeated %{p0}", processor_chain([ - setc("header_id","0002"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant(" message repeated "), - field("p0"), - ], - }), - ])); - - var hdr3 = match("HEADER#2:0003", "message", "%{month->} %{day->} %{time->} ssb %{messageid}(%{hfld1}): %{p0}", processor_chain([ - setc("header_id","0003"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("("), - field("hfld1"), - constant("): "), - field("p0"), - ], - }), - ])); - - var part1 = match("HEADER#3:0004/1_6", "nwparser.p0", "fpc6 %{p0}"); - - var part2 = match("HEADER#3:0004/1_7", "nwparser.p0", "fpc7 %{p0}"); - - var part3 = match("HEADER#3:0004/1_8", "nwparser.p0", "fpc8 %{p0}"); - - var part4 = match("HEADER#3:0004/1_9", "nwparser.p0", "fpc9 %{p0}"); - - var part5 = match("HEADER#3:0004/1_10", "nwparser.p0", "cfeb %{p0}"); - - var select1 = linear_select([ - dup2, - dup3, - dup4, - dup5, - dup6, - dup7, - part1, - part2, - part3, - part4, - part5, - dup8, - ]); - - var part6 = match("HEADER#3:0004/2", "nwparser.p0", "%{} %{messageid}: %{p0}", processor_chain([ - dup9, - ])); - - var all1 = all_match({ - processors: [ - dup1, - select1, - part6, - ], - on_success: processor_chain([ - setc("header_id","0004"), - ]), - }); - - var select2 = linear_select([ - dup2, - dup3, - dup4, - dup5, - dup6, - dup7, - dup8, - ]); - - var part7 = match("HEADER#4:0005/2", "nwparser.p0", "%{} %{messageid->} %{p0}", processor_chain([ - dup10, - ])); - - var all2 = all_match({ - processors: [ - dup1, - select2, - part7, - ], - on_success: processor_chain([ - setc("header_id","0005"), - ]), - }); - - var hdr4 = match("HEADER#5:0007", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2}[%{hpid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0007"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant("["), - field("hpid"), - constant("]: "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr5 = match("HEADER#6:0008", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{messageid}[%{hpid}]: %{p0}", processor_chain([ - setc("header_id","0008"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("hpid"), - constant("]: "), - field("p0"), - ], - }), - ])); - - var hdr6 = match("HEADER#7:0009", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2->} IFP trace> %{messageid}: %{p0}", processor_chain([ - setc("header_id","0009"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" IFP trace> "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr7 = match("HEADER#8:0010", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{hfld2->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0010"), - dup11, - ])); - - var hdr8 = match("HEADER#9:0029", "message", "%{month->} %{day->} %{time->} %{hostip->} %{hfld1}[%{pid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0029"), - dup12, - ])); - - var hdr9 = match("HEADER#10:0015", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0015"), - dup12, - ])); - - var hdr10 = match("HEADER#11:0011", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0011"), - dup11, - ])); - - var hdr11 = match("HEADER#12:0027", "message", "%{month->} %{day->} %{time->} %{hhostname->} RT_FLOW: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0027"), - dup9, - ])); - - var hdr12 = match("HEADER#13:0012", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhost}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0012"), - dup9, - ])); - - var hdr13 = match("HEADER#14:0013", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hfld32->} %{hhostname->} RT_FLOW - %{messageid->} [%{p0}", processor_chain([ - setc("header_id","0013"), - dup13, - ])); - - var hdr14 = match("HEADER#15:0026.upd.a/0", "message", "%{hfld1->} %{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var all3 = all_match({ - processors: [ - hdr14, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026.upd.a"), - ]), - }); - - var all4 = all_match({ - processors: [ - dup18, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026.upd.b"), - ]), - }); - - var all5 = all_match({ - processors: [ - dup18, - dup135, - dup136, - ], - on_success: processor_chain([ - setc("header_id","0026"), - ]), - }); - - var hdr15 = match("HEADER#18:0014", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid}[%{hpid}]: %{p0}", processor_chain([ - setc("header_id","0014"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant("["), - field("hpid"), - constant("]: "), - field("p0"), - ], - }), - ])); - - var hdr16 = match("HEADER#19:0016", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0016"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant(": "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr17 = match("HEADER#20:0017", "message", "%{month->} %{day->} %{time->} %{hfld1}[%{pid}]: %{messageid->} %{p0}", processor_chain([ - setc("header_id","0017"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant("["), - field("pid"), - constant("]: "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr18 = match("HEADER#21:0018", "message", "%{month->} %{day->} %{time->} %{hhost}: %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0018"), - dup19, - ])); - - var hdr19 = match("HEADER#22:0028", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0028"), - dup19, - ])); - - var hdr20 = match("HEADER#23:0019", "message", "%{month->} %{day->} %{time->} %{hhost}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0019"), - dup9, - ])); - - var hdr21 = match("HEADER#24:0020", "message", "%{month->} %{day->} %{time->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0020"), - dup19, - ])); - - var hdr22 = match("HEADER#25:0021", "message", "%{month->} %{day->} %{time->} /%{messageid}: %{p0}", processor_chain([ - setc("header_id","0021"), - dup9, - ])); - - var hdr23 = match("HEADER#26:0022", "message", "%{month->} %{day->} %{time->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0022"), - dup9, - ])); - - var hdr24 = match("HEADER#27:0023", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0023"), - dup19, - ])); - - var hdr25 = match("HEADER#28:0024", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid}: %{p0}", processor_chain([ - setc("header_id","0024"), - dup9, - ])); - - var hdr26 = match("HEADER#29:0025", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{hfld2->} %{messageid->} %{p0}", processor_chain([ - setc("header_id","0025"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr27 = match("HEADER#30:0031", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname}: %{messageid->} %{p0}", processor_chain([ - setc("header_id","0031"), - dup10, - ])); - - var hdr28 = match("HEADER#31:0032", "message", "%{month->} %{day->} %{time->} %{hostip->} (%{hfld1}) %{hfld2->} %{messageid}[%{pid}]: %{p0}", processor_chain([ - setc("header_id","0032"), - dup19, - ])); - - var hdr29 = match("HEADER#32:0033", "message", "%{month->} %{day->} %{time->} %{hfld1->} %{hhostname->} %{messageid}: %{p0}", processor_chain([ - setc("header_id","0033"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld1"), - constant(" "), - field("hhostname"), - constant(" "), - field("messageid"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr30 = match("HEADER#33:3336", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{messageid}: %{payload}", processor_chain([ - setc("header_id","3336"), - ])); - - var hdr31 = match("HEADER#34:3339", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{messageid->} %{payload}", processor_chain([ - setc("header_id","3339"), - ])); - - var hdr32 = match("HEADER#35:3337", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid}: %{payload}", processor_chain([ - setc("header_id","3337"), - ])); - - var hdr33 = match("HEADER#36:3341", "message", "%{hfld1->} %{hfld6->} %{hhostname->} %{hfld2->} %{hfld3->} %{messageid->} %{p0}", processor_chain([ - setc("header_id","3341"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("hfld3"), - constant(" "), - field("messageid"), - constant(" "), - field("p0"), - ], - }), - ])); - - var hdr34 = match("HEADER#37:3338", "message", "%{month->} %{day->} %{time->} %{hhost->} %{messageid->} %{payload}", processor_chain([ - setc("header_id","3338"), - ])); - - var hdr35 = match("HEADER#38:3340/0", "message", "%{month->} %{day->} %{time->} %{hhost->} node%{hfld1}.fpc%{p0}", processor_chain([ - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hhost"), - constant(" node"), - field("hfld1"), - constant(".fpc"), - field("p0"), - ], - }), - ])); - - var part8 = match("HEADER#38:3340/1_0", "nwparser.p0", "%{hfld2}.pic%{hfld3->} %{p0}"); - - var part9 = match("HEADER#38:3340/1_1", "nwparser.p0", "%{hfld2->} %{p0}"); - - var select3 = linear_select([ - part8, - part9, - ]); - - var part10 = match("HEADER#38:3340/2", "nwparser.p0", "%{} %{p0}"); - - var all6 = all_match({ - processors: [ - hdr35, - select3, - part10, - ], - on_success: processor_chain([ - setc("header_id","3340"), - setc("messageid","node"), - ]), - }); - - var hdr36 = match("HEADER#39:9997/0_0", "message", "mgd[%{p0}"); - - var hdr37 = match("HEADER#39:9997/0_1", "message", "rpd[%{p0}"); - - var hdr38 = match("HEADER#39:9997/0_2", "message", "dcd[%{p0}"); - - var select4 = linear_select([ - hdr36, - hdr37, - hdr38, - ]); - - var part11 = match("HEADER#39:9997/1", "nwparser.p0", "%{process_id}]:%{payload}"); - - var all7 = all_match({ - processors: [ - select4, - part11, - ], - on_success: processor_chain([ - setc("header_id","9997"), - dup20, - ]), - }); - - var hdr39 = match("HEADER#40:9995", "message", "%{month->} %{day->} %{time->} %{hhost->} %{hfld1->} %{hfld2->} %{messageid}[%{hfld3}]:%{p0}", processor_chain([ - setc("header_id","9995"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("messageid"), - constant("["), - field("hfld3"), - constant("]:"), - field("p0"), - ], - }), - ])); - - var hdr40 = match("HEADER#41:9994", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{hfld1->} qsfp %{p0}", processor_chain([ - setc("header_id","9994"), - setc("messageid","qsfp"), - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("hfld1"), - constant(" qsfp "), - field("p0"), - ], - }), - ])); - - var hdr41 = match("HEADER#42:9999", "message", "%{month->} %{day->} %{time->} %{hhost->} %{process}[%{process_id}]: %{hevent_type}: %{p0}", processor_chain([ - setc("header_id","9999"), - dup20, - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hevent_type"), - constant(": "), - field("p0"), - ], - }), - ])); - - var hdr42 = match("HEADER#43:9998", "message", "%{month->} %{day->} %{time->} %{hfld2->} %{process}: %{p0}", processor_chain([ - setc("header_id","9998"), - dup20, - call({ - dest: "nwparser.payload", - fn: STRCAT, - args: [ - field("hfld2"), - constant(" "), - field("process"), - constant(": "), - field("p0"), - ], - }), - ])); - - var select5 = linear_select([ - hdr1, - hdr2, - hdr3, - all1, - all2, - hdr4, - hdr5, - hdr6, - hdr7, - hdr8, - hdr9, - hdr10, - hdr11, - hdr12, - hdr13, - all3, - all4, - all5, - hdr15, - hdr16, - hdr17, - hdr18, - hdr19, - hdr20, - hdr21, - hdr22, - hdr23, - hdr24, - hdr25, - hdr26, - hdr27, - hdr28, - hdr29, - hdr30, - hdr31, - hdr32, - hdr33, - hdr34, - all6, - all7, - hdr39, - hdr40, - hdr41, - hdr42, - ]); - - var part12 = match("MESSAGE#0:/usr/sbin/sshd", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exit status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","sshd exit status"), - dup23, - ])); - - var msg1 = msg("/usr/sbin/sshd", part12); - - var part13 = match("MESSAGE#1:/usr/libexec/telnetd", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exit status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","telnetd exit status"), - dup23, - ])); - - var msg2 = msg("/usr/libexec/telnetd", part13); - - var part14 = match("MESSAGE#2:alarmd", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License color=%{severity}, class=%{device}, reason=%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Alarm Set or Cleared"), - dup23, - ])); - - var msg3 = msg("alarmd", part14); - - var part15 = match("MESSAGE#3:bigd", "nwparser.payload", "%{process}: Node detected UP for %{node}", processor_chain([ - dup21, - dup22, - setc("event_description","Node detected UP"), - dup23, - ])); - - var msg4 = msg("bigd", part15); - - var part16 = match("MESSAGE#4:bigd:01", "nwparser.payload", "%{process}: Monitor template id is %{id}", processor_chain([ - dup21, - dup22, - setc("event_description","Monitor template id"), - dup23, - ])); - - var msg5 = msg("bigd:01", part16); - - var select6 = linear_select([ - msg4, - msg5, - ]); - - var part17 = match("MESSAGE#5:bigpipe", "nwparser.payload", "%{process}: Loading the configuration file %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","Loading configuration file"), - dup23, - ])); - - var msg6 = msg("bigpipe", part17); - - var part18 = match("MESSAGE#6:bigpipe:01", "nwparser.payload", "%{process}: Begin config install operation %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","Begin config install operation"), - dup23, - ])); - - var msg7 = msg("bigpipe:01", part18); - - var part19 = match("MESSAGE#7:bigpipe:02", "nwparser.payload", "%{process}: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - setc("event_description","Audit"), - dup23, - ])); - - var msg8 = msg("bigpipe:02", part19); - - var select7 = linear_select([ - msg6, - msg7, - msg8, - ]); - - var part20 = match("MESSAGE#8:bigstart", "nwparser.payload", "%{process}: shutdown %{service}", processor_chain([ - dup21, - dup22, - setc("event_description","portal shutdown"), - dup23, - ])); - - var msg9 = msg("bigstart", part20); - - var part21 = match("MESSAGE#9:cgatool", "nwparser.payload", "%{process}: %{event_type}: generated address is %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","cga address genration"), - dup23, - ])); - - var msg10 = msg("cgatool", part21); - - var part22 = match("MESSAGE#10:chassisd:01", "nwparser.payload", "%{process}[%{process_id}]:%{fld12}", processor_chain([ - dup21, - dup22, - dup23, - dup24, - ])); - - var msg11 = msg("chassisd:01", part22); - - var part23 = match("MESSAGE#11:checkd", "nwparser.payload", "%{process}: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - dup25, - dup23, - ])); - - var msg12 = msg("checkd", part23); - - var part24 = match("MESSAGE#12:checkd:01", "nwparser.payload", "%{process}: exiting", processor_chain([ - dup21, - dup22, - setc("event_description","checkd exiting"), - dup23, - ])); - - var msg13 = msg("checkd:01", part24); - - var select8 = linear_select([ - msg12, - msg13, - ]); - - var part25 = match("MESSAGE#13:cosd", "nwparser.payload", "%{process}[%{process_id}]: link protection %{dclass_counter1->} for intf %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","link protection for interface"), - dup23, - ])); - - var msg14 = msg("cosd", part25); - - var part26 = match("MESSAGE#14:craftd", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}, %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","License expiration warning"), - dup23, - ])); - - var msg15 = msg("craftd", part26); - - var part27 = match("MESSAGE#15:CRON/0", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) %{p0}"); - - var part28 = match("MESSAGE#15:CRON/1_0", "nwparser.p0", "CMD (%{result})"); - - var part29 = match("MESSAGE#15:CRON/1_1", "nwparser.p0", "cmd='%{result}'"); - - var select9 = linear_select([ - part28, - part29, - ]); - - var all8 = all_match({ - processors: [ - part27, - select9, - ], - on_success: processor_chain([ - dup21, - dup22, - dup26, - dup23, - ]), - }); - - var msg16 = msg("CRON", all8); - - var part30 = match("MESSAGE#16:Cmerror/0_0", "nwparser.payload", "%{hostname->} %{node}Cmerror: Level%{level}count increment %{dclass_counter1->} %{fld1}"); - - var part31 = match_copy("MESSAGE#16:Cmerror/0_1", "nwparser.payload", "fld2"); - - var select10 = linear_select([ - part30, - part31, - ]); - - var all9 = all_match({ - processors: [ - select10, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg17 = msg("Cmerror", all9); - - var part32 = match("MESSAGE#17:cron", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) %{action->} (%{filename})", processor_chain([ - dup21, - dup22, - setc("event_description","cron RELOAD"), - dup23, - ])); - - var msg18 = msg("cron", part32); - - var part33 = match("MESSAGE#18:CROND", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) CMD (%{action})", processor_chain([ - dup21, - dup22, - dup23, - dup24, - ])); - - var msg19 = msg("CROND", part33); - - var part34 = match("MESSAGE#20:CROND:02", "nwparser.payload", "%{process}[%{process_id}]: pam_unix(crond:session): session closed for user %{username}", processor_chain([ - dup27, - dup22, - dup23, - dup24, - ])); - - var msg20 = msg("CROND:02", part34); - - var select11 = linear_select([ - msg19, - msg20, - ]); - - var part35 = match("MESSAGE#19:crond:01", "nwparser.payload", "%{process}[%{process_id}]: pam_unix(crond:session): session opened for user %{username->} by (uid=%{uid})", processor_chain([ - dup28, - dup22, - dup23, - dup24, - ])); - - var msg21 = msg("crond:01", part35); - - var part36 = match("MESSAGE#21:dcd", "nwparser.payload", "%{process}[%{process_id}]: %{result->} Setting ignored, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Setting ignored"), - dup23, - ])); - - var msg22 = msg("dcd", part36); - - var part37 = match("MESSAGE#22:EVENT/0", "nwparser.payload", "%{process}[%{process_id}]: EVENT %{event_type->} %{interface->} index %{resultcode->} %{p0}"); - - var part38 = match("MESSAGE#22:EVENT/1_0", "nwparser.p0", "%{saddr->} -> %{daddr->} \u003c\u003c%{p0}"); - - var part39 = match("MESSAGE#22:EVENT/1_1", "nwparser.p0", "\u003c\u003c%{p0}"); - - var select12 = linear_select([ - part38, - part39, - ]); - - var part40 = match("MESSAGE#22:EVENT/2", "nwparser.p0", ">%{result}"); - - var all10 = all_match({ - processors: [ - part37, - select12, - part40, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","EVENT"), - dup23, - ]), - }); - - var msg23 = msg("EVENT", all10); - - var part41 = match("MESSAGE#23:ftpd", "nwparser.payload", "%{process}[%{process_id}]: connection from %{saddr->} (%{shost})", processor_chain([ - setc("eventcategory","1802000000"), - dup22, - setc("event_description","ftpd connection"), - dup23, - ])); - - var msg24 = msg("ftpd", part41); - - var part42 = match("MESSAGE#24:ha_rto_stats_handler", "nwparser.payload", "%{hostname->} %{node}ha_rto_stats_handler:%{fld12}", processor_chain([ - dup29, - dup23, - dup22, - ])); - - var msg25 = msg("ha_rto_stats_handler", part42); - - var part43 = match("MESSAGE#25:hostinit", "nwparser.payload", "%{process}: %{obj_name->} -- LDAP Connection not bound correctly. %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","LDAP Connection not bound correctly"), - dup23, - ])); - - var msg26 = msg("hostinit", part43); - - var part44 = match("MESSAGE#26:ifinfo", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> Added entry - %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug - Added entry"), - dup23, - ])); - - var msg27 = msg("ifinfo", part44); - - var part45 = match("MESSAGE#27:ifinfo:01", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> Initializing spu listtype %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug Initializing spu"), - dup23, - ])); - - var msg28 = msg("ifinfo:01", part45); - - var part46 = match("MESSAGE#28:ifinfo:02", "nwparser.payload", "%{process}: %{service}: PIC_INFO debug> %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","PIC_INFO debug delete from list"), - dup23, - ])); - - var msg29 = msg("ifinfo:02", part46); - - var select13 = linear_select([ - msg27, - msg28, - msg29, - ]); - - var part47 = match("MESSAGE#29:ifp_ifl_anydown_change_event", "nwparser.payload", "%{node->} %{action}> %{process}: IFL anydown change event: \"%{event_type}\"", processor_chain([ - dup21, - dup22, - setc("event_description","IFL anydown change event"), - dup23, - ])); - - var msg30 = msg("ifp_ifl_anydown_change_event", part47); - - var part48 = match("MESSAGE#30:ifp_ifl_config_event", "nwparser.payload", "%{node->} %{action}> %{process}: IFL config: \"%{filename}\"", processor_chain([ - dup21, - dup22, - setc("event_description","ifp ifl config_event"), - dup23, - ])); - - var msg31 = msg("ifp_ifl_config_event", part48); - - var part49 = match("MESSAGE#31:ifp_ifl_ext_chg", "nwparser.payload", "%{node->} %{process}: ifp ext piid %{parent_pid->} zone_id %{zone}", processor_chain([ - dup21, - dup22, - setc("event_description","ifp_ifl_ext_chg"), - dup23, - ])); - - var msg32 = msg("ifp_ifl_ext_chg", part49); - - var part50 = match("MESSAGE#32:inetd", "nwparser.payload", "%{process}[%{process_id}]: %{protocol->} from %{saddr->} exceeded counts/min (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","connection exceeded count limit"), - dup23, - ])); - - var msg33 = msg("inetd", part50); - - var part51 = match("MESSAGE#33:inetd:01", "nwparser.payload", "%{process}[%{process_id}]: %{agent}[%{id}]: exited, status %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","exited"), - dup23, - ])); - - var msg34 = msg("inetd:01", part51); - - var select14 = linear_select([ - msg33, - msg34, - ]); - - var part52 = match("MESSAGE#34:init:04", "nwparser.payload", "%{process}: %{event_type->} current_mode=%{protocol}, requested_mode=%{result}, cmd=%{action}", processor_chain([ - dup21, - dup22, - dup31, - dup23, - ])); - - var msg35 = msg("init:04", part52); - - var part53 = match("MESSAGE#35:init", "nwparser.payload", "%{process}: %{event_type->} mode=%{protocol->} cmd=%{action->} master_mode=%{result}", processor_chain([ - dup21, - dup22, - dup31, - dup23, - ])); - - var msg36 = msg("init", part53); - - var part54 = match("MESSAGE#36:init:01", "nwparser.payload", "%{process}: failure target for routing set to %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","failure target for routing set"), - dup23, - ])); - - var msg37 = msg("init:01", part54); - - var part55 = match("MESSAGE#37:init:02", "nwparser.payload", "%{process}: ntp (PID %{child_pid}) started", processor_chain([ - dup21, - dup22, - setc("event_description","ntp started"), - dup23, - ])); - - var msg38 = msg("init:02", part55); - - var part56 = match("MESSAGE#38:init:03", "nwparser.payload", "%{process}: product mask %{info->} model %{dclass_counter1}", processor_chain([ - dup21, - dup22, - setc("event_description","product mask and model info"), - dup23, - ])); - - var msg39 = msg("init:03", part56); - - var select15 = linear_select([ - msg35, - msg36, - msg37, - msg38, - msg39, - ]); - - var part57 = match("MESSAGE#39:ipc_msg_write", "nwparser.payload", "%{node->} %{process}: IPC message type: %{event_type}, subtype: %{resultcode->} exceeds MTU, mtu %{dclass_counter1}, length %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","IPC message exceeds MTU"), - dup23, - ])); - - var msg40 = msg("ipc_msg_write", part57); - - var part58 = match("MESSAGE#40:connection_established", "nwparser.payload", "%{process}: %{service}: conn established: listener idx=%{dclass_counter1->} tnpaddr=%{dclass_counter2}", processor_chain([ - dup28, - dup22, - setc("event_description","listener connection established"), - dup23, - ])); - - var msg41 = msg("connection_established", part58); - - var part59 = match("MESSAGE#41:connection_dropped/0", "nwparser.payload", "%{process}: %{p0}"); - - var part60 = match("MESSAGE#41:connection_dropped/1_0", "nwparser.p0", "%{result}, connection dropped - src %{saddr}:%{sport->} dest %{daddr}:%{dport}"); - - var part61 = match("MESSAGE#41:connection_dropped/1_1", "nwparser.p0", "%{result}: conn dropped: listener idx=%{dclass_counter1->} tnpaddr=%{dclass_counter2}"); - - var select16 = linear_select([ - part60, - part61, - ]); - - var all11 = all_match({ - processors: [ - part59, - select16, - ], - on_success: processor_chain([ - dup27, - dup22, - setc("event_description","connection dropped"), - dup23, - ]), - }); - - var msg42 = msg("connection_dropped", all11); - - var part62 = match("MESSAGE#42:kernel", "nwparser.payload", "%{process}: %{interface}: Asserting SONET alarm(s) %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Asserting SONET alarm(s)"), - dup23, - ])); - - var msg43 = msg("kernel", part62); - - var part63 = match("MESSAGE#43:kernel:01", "nwparser.payload", "%{process}: %{interface->} down: %{result}.", processor_chain([ - dup21, - dup22, - setc("event_description","interface down"), - dup23, - ])); - - var msg44 = msg("kernel:01", part63); - - var part64 = match("MESSAGE#44:kernel:02", "nwparser.payload", "%{process}: %{interface}: loopback suspected; %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","loopback suspected om interface"), - dup23, - ])); - - var msg45 = msg("kernel:02", part64); - - var part65 = match("MESSAGE#45:kernel:03", "nwparser.payload", "%{process}: %{service}: soreceive() error %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","soreceive error"), - dup23, - ])); - - var msg46 = msg("kernel:03", part65); - - var part66 = match("MESSAGE#46:kernel:04", "nwparser.payload", "%{process}: %{service->} !VALID(state 4)->%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","pfe_peer_alloc state 4"), - dup23, - ])); - - var msg47 = msg("kernel:04", part66); - - var part67 = match("MESSAGE#47:kernel:05", "nwparser.payload", "%{fld1->} %{hostip->} (%{fld2}) %{fld3->} %{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg48 = msg("kernel:05", part67); - - var part68 = match("MESSAGE#48:kernel:06", "nwparser.payload", "%{fld1->} %{hostip->} %{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg49 = msg("kernel:06", part68); - - var select17 = linear_select([ - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - ]); - - var part69 = match("MESSAGE#49:successful_login", "nwparser.payload", "%{process}: login from %{saddr->} on %{interface->} as %{username}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","successful user login"), - dup23, - ])); - - var msg50 = msg("successful_login", part69); - - var part70 = match("MESSAGE#50:login_attempt", "nwparser.payload", "%{process}: Login attempt for user %{username->} from host %{hostip}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup22, - setc("event_description","user login attempt"), - dup23, - ])); - - var msg51 = msg("login_attempt", part70); - - var part71 = match("MESSAGE#51:login", "nwparser.payload", "%{process}: PAM module %{dclass_counter1->} returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup33, - dup34, - dup37, - dup22, - setc("event_description","PAM module return from login"), - dup23, - ])); - - var msg52 = msg("login", part71); - - var select18 = linear_select([ - msg50, - msg51, - msg52, - ]); - - var part72 = match("MESSAGE#52:lsys_ssam_handler", "nwparser.payload", "%{node->} %{process}: processing lsys root-logical-system %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","processing lsys root-logical-system"), - dup23, - ])); - - var msg53 = msg("lsys_ssam_handler", part72); - - var part73 = match("MESSAGE#53:mcsn", "nwparser.payload", "%{process}[%{process_id}]: Removing mif from group [%{group}] %{space->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Removing mif from group"), - dup23, - ])); - - var msg54 = msg("mcsn", part73); - - var part74 = match("MESSAGE#54:mrvl_dfw_log_effuse_status", "nwparser.payload", "%{process}: Firewall rows could not be redirected on device %{device}.", processor_chain([ - dup30, - dup22, - setc("event_description","Firewall rows could not be redirected on device"), - dup23, - ])); - - var msg55 = msg("mrvl_dfw_log_effuse_status", part74); - - var part75 = match("MESSAGE#55:MRVL-L2", "nwparser.payload", "%{process}:%{action}(),%{process_id}:MFilter (%{filter}) already exists", processor_chain([ - dup30, - dup22, - setc("event_description","mfilter already exists for add"), - dup23, - ])); - - var msg56 = msg("MRVL-L2", part75); - - var part76 = match("MESSAGE#56:profile_ssam_handler", "nwparser.payload", "%{node->} %{process}: processing profile SP-root %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","processing profile SP-root"), - dup23, - ])); - - var msg57 = msg("profile_ssam_handler", part76); - - var part77 = match("MESSAGE#57:pst_nat_binding_set_profile", "nwparser.payload", "%{node->} %{process}: %{event_source}: can't get resource bucket %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","can't get resource bucket"), - dup23, - ])); - - var msg58 = msg("pst_nat_binding_set_profile", part77); - - var part78 = match("MESSAGE#58:task_reconfigure", "nwparser.payload", "%{process}[%{process_id}]: task_reconfigure %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","reinitializing done"), - dup23, - ])); - - var msg59 = msg("task_reconfigure", part78); - - var part79 = match("MESSAGE#59:tnetd/0_0", "nwparser.payload", "%{process}[%{process_id}]:%{service}[%{fld1}]: exit status%{resultcode}"); - - var part80 = match_copy("MESSAGE#59:tnetd/0_1", "nwparser.payload", "fld3"); - - var select19 = linear_select([ - part79, - part80, - ]); - - var all12 = all_match({ - processors: [ - select19, - ], - on_success: processor_chain([ - dup21, - dup22, - dup23, - dup24, - ]), - }); - - var msg60 = msg("tnetd", all12); - - var part81 = match("MESSAGE#60:PFEMAN", "nwparser.payload", "%{process}: Session manager active", processor_chain([ - dup21, - dup22, - setc("event_description","Session manager active"), - dup23, - ])); - - var msg61 = msg("PFEMAN", part81); - - var part82 = match("MESSAGE#61:mgd", "nwparser.payload", "%{process}[%{process_id}]: Could not send message to %{service}", processor_chain([ - dup30, - dup22, - setc("event_description","Could not send message to service"), - dup23, - ])); - - var msg62 = msg("mgd", part82); - - var part83 = match("MESSAGE#62:Resolve", "nwparser.payload", "Resolve request came for an address matching on Wrong nh nh:%{result}, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Resolve request came for an address matching on Wrong nh"), - dup23, - ])); - - var msg63 = msg("Resolve", part83); - - var part84 = match("MESSAGE#63:respawn", "nwparser.payload", "%{process}: %{service->} exited with status = %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","service exited with status"), - dup23, - ])); - - var msg64 = msg("respawn", part84); - - var part85 = match("MESSAGE#64:root", "nwparser.payload", "%{process}: %{node}: This system does not have 3-DNS or Link Controller enabled", processor_chain([ - dup30, - dup22, - setc("event_description","system does not have 3-DNS or Link Controller enabled"), - dup23, - ])); - - var msg65 = msg("root", part85); - - var part86 = match("MESSAGE#65:rpd", "nwparser.payload", "%{process}[%{process_id}]: Received %{result->} for intf device %{interface}; mc_ae_id %{dclass_counter1}, status %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","Received data for interface"), - dup23, - ])); - - var msg66 = msg("rpd", part86); - - var part87 = match("MESSAGE#66:rpd:01", "nwparser.payload", "%{process}[%{process_id}]: RSVP neighbor %{daddr->} up on interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","RSVP neighbor up on interface "), - dup23, - ])); - - var msg67 = msg("rpd:01", part87); - - var part88 = match("MESSAGE#67:rpd:02", "nwparser.payload", "%{process}[%{process_id}]: %{saddr->} (%{shost}): reseting pending active connection", processor_chain([ - dup21, - dup22, - setc("event_description","reseting pending active connection"), - dup23, - ])); - - var msg68 = msg("rpd:02", part88); - - var part89 = match("MESSAGE#68:rpd_proceeding", "nwparser.payload", "%{process}: proceeding. %{param}", processor_chain([ - dup21, - dup22, - dup38, - dup23, - ])); - - var msg69 = msg("rpd_proceeding", part89); - - var select20 = linear_select([ - msg66, - msg67, - msg68, - msg69, - ]); - - var part90 = match("MESSAGE#69:rshd", "nwparser.payload", "%{process}[%{process_id}]: %{username->} as root: cmd='%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","user issuing command as root"), - dup23, - ])); - - var msg70 = msg("rshd", part90); - - var part91 = match("MESSAGE#70:sfd", "nwparser.payload", "%{process}: Waiting on accept", processor_chain([ - dup21, - dup22, - setc("event_description","sfd waiting on accept"), - dup23, - ])); - - var msg71 = msg("sfd", part91); - - var part92 = match("MESSAGE#71:sshd", "nwparser.payload", "%{process}[%{process_id}]: Accepted password for %{username->} from %{saddr->} port %{sport->} %{protocol}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","Accepted password"), - dup23, - ])); - - var msg72 = msg("sshd", part92); - - var part93 = match("MESSAGE#73:sshd:02", "nwparser.payload", "%{process}[%{process_id}]: Received disconnect from %{shost}: %{fld1}: %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","Received disconnect"), - dup23, - ])); - - var msg73 = msg("sshd:02", part93); - - var part94 = match("MESSAGE#74:sshd:03", "nwparser.payload", "%{process}[%{process_id}]: Did not receive identification string from %{saddr}", processor_chain([ - dup30, - dup22, - setc("result","no identification string"), - setc("event_description","Did not receive identification string from peer"), - dup23, - ])); - - var msg74 = msg("sshd:03", part94); - - var part95 = match("MESSAGE#75:sshd:04", "nwparser.payload", "%{process}[%{process_id}]: Could not write ident string to %{dhost}", processor_chain([ - dup30, - dup22, - setc("event_description","Could not write ident string"), - dup23, - ])); - - var msg75 = msg("sshd:04", part95); - - var part96 = match("MESSAGE#76:sshd:05", "nwparser.payload", "%{process}[%{process_id}]: subsystem request for netconf", processor_chain([ - dup21, - dup22, - setc("event_description","subsystem request for netconf"), - dup23, - ])); - - var msg76 = msg("sshd:05", part96); - - var part97 = match("MESSAGE#77:sshd:06/2", "nwparser.p0", "sendmsg to %{saddr}(%{shost}).%{sport}: %{info}"); - - var all13 = all_match({ - processors: [ - dup39, - dup137, - part97, - ], - on_success: processor_chain([ - dup29, - dup22, - setc("event_description","send message stats"), - dup23, - ]), - }); - - var msg77 = msg("sshd:06", all13); - - var part98 = match("MESSAGE#78:sshd:07/2", "nwparser.p0", "Added radius server %{saddr}(%{shost})"); - - var all14 = all_match({ - processors: [ - dup39, - dup137, - part98, - ], - on_success: processor_chain([ - dup42, - setc("ec_theme","Configuration"), - setc("ec_activity","Modify"), - dup37, - dup22, - setc("event_description","Added radius server"), - dup23, - ]), - }); - - var msg78 = msg("sshd:07", all14); - - var part99 = match("MESSAGE#79:sshd:08", "nwparser.payload", "%{process}[%{process_id}]: %{result}: %{space->} [%{resultcode}]authentication error", processor_chain([ - setc("eventcategory","1301020000"), - dup34, - dup43, - dup22, - setc("event_description","authentication error"), - dup23, - ])); - - var msg79 = msg("sshd:08", part99); - - var part100 = match("MESSAGE#80:sshd:09", "nwparser.payload", "%{process}[%{process_id}]: unrecognized attribute in %{policyname}: %{change_attribute}", processor_chain([ - dup30, - dup22, - setc("event_description","unrecognized attribute in policy"), - dup23, - ])); - - var msg80 = msg("sshd:09", part100); - - var part101 = match("MESSAGE#81:sshd:10", "nwparser.payload", "%{process}: PAM module %{dclass_counter1->} returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","PAM module return from sshd"), - dup23, - ])); - - var msg81 = msg("sshd:10", part101); - - var part102 = match("MESSAGE#82:sshd:11", "nwparser.payload", "%{process}: PAM authentication chain returned: %{space}[%{resultcode}]%{result}", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","PAM authentication chain return"), - dup23, - ])); - - var msg82 = msg("sshd:11", part102); - - var part103 = match("MESSAGE#83:sshd:12", "nwparser.payload", "%{process}: %{severity}: can't get client address: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","can't get client address"), - dup23, - ])); - - var msg83 = msg("sshd:12", part103); - - var part104 = match("MESSAGE#84:sshd:13", "nwparser.payload", "%{process}: auth server unresponsive", processor_chain([ - dup30, - dup22, - setc("event_description","auth server unresponsive"), - dup23, - ])); - - var msg84 = msg("sshd:13", part104); - - var part105 = match("MESSAGE#85:sshd:14", "nwparser.payload", "%{process}: %{service}: No valid RADIUS responses received", processor_chain([ - dup30, - dup22, - setc("event_description","No valid RADIUS responses received"), - dup23, - ])); - - var msg85 = msg("sshd:14", part105); - - var part106 = match("MESSAGE#86:sshd:15", "nwparser.payload", "%{process}: Moving to next server: %{saddr}(%{shost}).%{sport}", processor_chain([ - dup21, - dup22, - setc("event_description","Moving to next server"), - dup23, - ])); - - var msg86 = msg("sshd:15", part106); - - var part107 = match("MESSAGE#87:sshd:16", "nwparser.payload", "%{fld1->} sshd: SSHD_LOGIN_FAILED: Login failed for user '%{username}' from host '%{hostip}'.", processor_chain([ - dup44, - dup34, - dup43, - dup22, - setc("event_description","Login failed for user"), - dup23, - ])); - - var msg87 = msg("sshd:16", part107); - - var select21 = linear_select([ - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - ]); - - var part108 = match("MESSAGE#72:Failed:05/0", "nwparser.payload", "%{process}[%{process_id}]: Failed password for %{p0}"); - - var part109 = match("MESSAGE#72:Failed:05/1_0", "nwparser.p0", "illegal user %{p0}"); - - var part110 = match("MESSAGE#72:Failed:05/1_1", "nwparser.p0", "invalid user %{p0}"); - - var select22 = linear_select([ - part109, - part110, - dup45, - ]); - - var part111 = match("MESSAGE#72:Failed:05/2", "nwparser.p0", "%{username->} from %{saddr->} port %{sport->} %{protocol}"); - - var all15 = all_match({ - processors: [ - part108, - select22, - part111, - ], - on_success: processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - setc("event_description","authentication failure"), - dup23, - ]), - }); - - var msg88 = msg("Failed:05", all15); - - var part112 = match("MESSAGE#746:Failed/0", "nwparser.payload", "%{hostname->} %{process}[%{process_id}]: Failed to resolve ipv%{p0}"); - - var part113 = match("MESSAGE#746:Failed/1_0", "nwparser.p0", "4%{p0}"); - - var part114 = match("MESSAGE#746:Failed/1_1", "nwparser.p0", "6%{p0}"); - - var select23 = linear_select([ - part113, - part114, - ]); - - var part115 = match("MESSAGE#746:Failed/2", "nwparser.p0", "%{}addresses for domain name %{sdomain}"); - - var all16 = all_match({ - processors: [ - part112, - select23, - part115, - ], - on_success: processor_chain([ - dup46, - dup47, - dup23, - dup22, - ]), - }); - - var msg89 = msg("Failed", all16); - - var part116 = match("MESSAGE#767:Failed:01", "nwparser.payload", "%{hostname->} %{process}[%{process_id}]: %{fld1}", processor_chain([ - dup46, - dup23, - dup22, - ])); - - var msg90 = msg("Failed:01", part116); - - var part117 = match("MESSAGE#768:Failed:02/0_0", "nwparser.payload", "%{fld1->} to create a route if table for Multiservice"); - - var part118 = match_copy("MESSAGE#768:Failed:02/0_1", "nwparser.payload", "fld10"); - - var select24 = linear_select([ - part117, - part118, - ]); - - var all17 = all_match({ - processors: [ - select24, - ], - on_success: processor_chain([ - dup46, - dup23, - dup22, - setf("hostname","hfld1"), - ]), - }); - - var msg91 = msg("Failed:02", all17); - - var select25 = linear_select([ - msg88, - msg89, - msg90, - msg91, - ]); - - var part119 = match("MESSAGE#88:syslogd", "nwparser.payload", "%{process}: restart", processor_chain([ - dup21, - dup22, - setc("event_description","syslog daemon restart"), - dup23, - ])); - - var msg92 = msg("syslogd", part119); - - var part120 = match("MESSAGE#89:ucd-snmp", "nwparser.payload", "%{process}[%{process_id}]: AUDIT -- Action %{action->} User: %{username}", processor_chain([ - dup21, - dup22, - dup25, - dup23, - ])); - - var msg93 = msg("ucd-snmp", part120); - - var part121 = match("MESSAGE#90:ucd-snmp:01", "nwparser.payload", "%{process}[%{process_id}]: Received TERM or STOP signal %{space->} %{result}.", processor_chain([ - dup21, - dup22, - setc("event_description","Received TERM or STOP signal"), - dup23, - ])); - - var msg94 = msg("ucd-snmp:01", part121); - - var select26 = linear_select([ - msg93, - msg94, - ]); - - var part122 = match("MESSAGE#91:usp_ipc_client_reconnect", "nwparser.payload", "%{node->} %{process}: failed to connect to the server: %{result->} (%{resultcode})", processor_chain([ - dup27, - dup22, - setc("event_description","failed to connect to the server"), - dup23, - ])); - - var msg95 = msg("usp_ipc_client_reconnect", part122); - - var part123 = match("MESSAGE#92:usp_trace_ipc_disconnect", "nwparser.payload", "%{node->} %{process}:Trace client disconnected. %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","Trace client disconnected"), - dup23, - ])); - - var msg96 = msg("usp_trace_ipc_disconnect", part123); - - var part124 = match("MESSAGE#93:usp_trace_ipc_reconnect", "nwparser.payload", "%{node->} %{process}:USP trace client cannot reconnect to server", processor_chain([ - dup30, - dup22, - setc("event_description","USP trace client cannot reconnect to server"), - dup23, - ])); - - var msg97 = msg("usp_trace_ipc_reconnect", part124); - - var part125 = match("MESSAGE#94:uspinfo", "nwparser.payload", "%{process}: flow_print_session_summary_output received %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","flow_print_session_summary_output received"), - dup23, - ])); - - var msg98 = msg("uspinfo", part125); - - var part126 = match("MESSAGE#95:Version", "nwparser.payload", "Version %{version->} by builder on %{event_time_string}", processor_chain([ - dup21, - dup22, - setc("event_description","Version build date"), - dup23, - ])); - - var msg99 = msg("Version", part126); - - var part127 = match("MESSAGE#96:xntpd", "nwparser.payload", "%{process}[%{process_id}]: frequency initialized %{result->} from %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","frequency initialized from file"), - dup23, - ])); - - var msg100 = msg("xntpd", part127); - - var part128 = match("MESSAGE#97:xntpd:01", "nwparser.payload", "%{process}[%{process_id}]: ntpd %{version->} %{event_time_string->} (%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","nptd version build"), - dup23, - ])); - - var msg101 = msg("xntpd:01", part128); - - var part129 = match("MESSAGE#98:xntpd:02", "nwparser.payload", "%{process}: kernel time sync enabled %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","kernel time sync enabled"), - dup23, - ])); - - var msg102 = msg("xntpd:02", part129); - - var part130 = match("MESSAGE#99:xntpd:03", "nwparser.payload", "%{process}[%{process_id}]: NTP Server %{result}", processor_chain([ - dup21, - dup22, - dup32, - dup23, - ])); - - var msg103 = msg("xntpd:03", part130); - - var select27 = linear_select([ - msg100, - msg101, - msg102, - msg103, - ]); - - var part131 = match("MESSAGE#100:last", "nwparser.payload", "last message repeated %{dclass_counter1->} times", processor_chain([ - dup21, - dup22, - setc("event_description","last message repeated"), - dup23, - ])); - - var msg104 = msg("last", part131); - - var part132 = match("MESSAGE#739:last:01", "nwparser.payload", "message repeated %{dclass_counter1->} times", processor_chain([ - dup48, - dup47, - dup23, - dup22, - dup24, - ])); - - var msg105 = msg("last:01", part132); - - var select28 = linear_select([ - msg104, - msg105, - ]); - - var part133 = match("MESSAGE#101:BCHIP", "nwparser.payload", "%{process->} %{device}: cannot write ucode mask reg", processor_chain([ - dup30, - dup22, - setc("event_description","cannot write ucode mask reg"), - dup23, - ])); - - var msg106 = msg("BCHIP", part133); - - var part134 = match("MESSAGE#102:CM", "nwparser.payload", "%{process}(%{fld1}): Slot %{device}: On-line", processor_chain([ - dup21, - dup22, - setc("event_description","Slot on-line"), - dup23, - ])); - - var msg107 = msg("CM", part134); - - var part135 = match("MESSAGE#103:COS", "nwparser.payload", "%{process}: Received FC->Q map, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Received FC Q map"), - dup23, - ])); - - var msg108 = msg("COS", part135); - - var part136 = match("MESSAGE#104:COSFPC", "nwparser.payload", "%{process}: ifd %{resultcode}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","ifd error"), - dup23, - ])); - - var msg109 = msg("COSFPC", part136); - - var part137 = match("MESSAGE#105:COSMAN", "nwparser.payload", "%{process}: %{service}: delete class_to_ifl table %{dclass_counter1}, ifl %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","delete class to ifl link"), - dup23, - ])); - - var msg110 = msg("COSMAN", part137); - - var part138 = match("MESSAGE#106:RDP", "nwparser.payload", "%{process}: Keepalive timeout for rdp.(%{interface}).(%{device}) (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","Keepalive timeout"), - dup23, - ])); - - var msg111 = msg("RDP", part138); - - var part139 = match("MESSAGE#107:SNTPD", "nwparser.payload", "%{process}: Initial time of day set", processor_chain([ - dup30, - dup22, - setc("event_description","Initial time of day set"), - dup23, - ])); - - var msg112 = msg("SNTPD", part139); - - var part140 = match("MESSAGE#108:SSB", "nwparser.payload", "%{process}(%{fld1}): Slot %{device}, serial number S/N %{serial_number}.", processor_chain([ - dup21, - dup22, - setc("event_description","Slot serial number"), - dup23, - ])); - - var msg113 = msg("SSB", part140); - - var part141 = match("MESSAGE#109:ACCT_ACCOUNTING_FERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected error %{result->} from file %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected error"), - dup23, - ])); - - var msg114 = msg("ACCT_ACCOUNTING_FERROR", part141); - - var part142 = match("MESSAGE#110:ACCT_ACCOUNTING_FOPEN_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to open file %{filename}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to open file"), - dup23, - ])); - - var msg115 = msg("ACCT_ACCOUNTING_FOPEN_ERROR", part142); - - var part143 = match("MESSAGE#111:ACCT_ACCOUNTING_SMALL_FILE_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File %{filename->} size (%{dclass_counter1}) is smaller than record size (%{dclass_counter2})", processor_chain([ - dup49, - dup22, - setc("event_description","File size mismatch"), - dup23, - ])); - - var msg116 = msg("ACCT_ACCOUNTING_SMALL_FILE_SIZE", part143); - - var part144 = match("MESSAGE#112:ACCT_BAD_RECORD_FORMAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid statistics record: %{result}", processor_chain([ - dup49, - dup22, - setc("event_description","Invalid statistics record"), - dup23, - ])); - - var msg117 = msg("ACCT_BAD_RECORD_FORMAT", part144); - - var part145 = match("MESSAGE#113:ACCT_CU_RTSLIB_error", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} getting class usage statistics for interface %{interface}: %{result}", processor_chain([ - dup49, - dup22, - setc("event_description","Class usage statistics error for interface"), - dup23, - ])); - - var msg118 = msg("ACCT_CU_RTSLIB_error", part145); - - var part146 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/1_0", "nwparser.p0", "Error %{resultcode->} trying %{p0}"); - - var part147 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/1_1", "nwparser.p0", "trying %{p0}"); - - var select29 = linear_select([ - part146, - part147, - ]); - - var part148 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/2", "nwparser.p0", "to get hostname%{}"); - - var all18 = all_match({ - processors: [ - dup50, - select29, - part148, - ], - on_success: processor_chain([ - dup49, - dup22, - setc("event_description","error trying to get hostname"), - dup23, - ]), - }); - - var msg119 = msg("ACCT_GETHOSTNAME_error", all18); - - var part149 = match("MESSAGE#115:ACCT_MALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed while reallocating %{obj_name}", processor_chain([ - dup51, - dup22, - setc("event_description","Memory allocation failure"), - dup23, - ])); - - var msg120 = msg("ACCT_MALLOC_FAILURE", part149); - - var part150 = match("MESSAGE#116:ACCT_UNDEFINED_COUNTER_NAME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} in accounting profile %{dclass_counter1->} is not defined in a firewall using this filter profile", processor_chain([ - dup30, - dup22, - setc("event_description","Accounting profile counter not defined in firewall"), - dup23, - ])); - - var msg121 = msg("ACCT_UNDEFINED_COUNTER_NAME", part150); - - var part151 = match("MESSAGE#117:ACCT_XFER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{result}: %{disposition}", processor_chain([ - dup30, - dup22, - setc("event_description","ACCT_XFER_FAILED"), - dup23, - ])); - - var msg122 = msg("ACCT_XFER_FAILED", part151); - - var part152 = match("MESSAGE#118:ACCT_XFER_POPEN_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{result}: in invoking command command to transfer file %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","POPEN FAIL invoking command command to transfer file"), - dup23, - ])); - - var msg123 = msg("ACCT_XFER_POPEN_FAIL", part152); - - var part153 = match("MESSAGE#119:APPQOS_LOG_EVENT", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} timestamp=\"%{result}\" message-type=\"%{info}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-name=\"%{protocol}\" application-name=\"%{application}\" rule-set-name=\"%{rule_group}\" rule-name=\"%{rulename}\" action=\"%{action}\" argument=\"%{fld2}\" argument1=\"%{fld3}\"]", processor_chain([ - dup28, - dup22, - dup52, - ])); - - var msg124 = msg("APPQOS_LOG_EVENT", part153); - - var part154 = match("MESSAGE#120:APPTRACK_SESSION_CREATE", "nwparser.payload", "%{event_type}: AppTrack session created %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup54, - dup22, - setc("result","AppTrack session created"), - dup23, - ])); - - var msg125 = msg("APPTRACK_SESSION_CREATE", part154); - - var part155 = match("MESSAGE#121:APPTRACK_SESSION_CLOSE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" service-name=\"%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-name=\"%{rule_template}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup28, - dup53, - dup55, - dup22, - dup52, - ])); - - var msg126 = msg("APPTRACK_SESSION_CLOSE", part155); - - var part156 = match("MESSAGE#122:APPTRACK_SESSION_CLOSE:01", "nwparser.payload", "%{event_type}: %{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{packets}(%{rbytes}) %{dclass_counter1}(%{sbytes}) %{duration->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup55, - dup22, - dup23, - ])); - - var msg127 = msg("APPTRACK_SESSION_CLOSE:01", part156); - - var select30 = linear_select([ - msg126, - msg127, - ]); - - var part157 = match("MESSAGE#123:APPTRACK_SESSION_VOL_UPDATE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" service-name=\"%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-name=\"%{rule_template}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup28, - dup53, - dup22, - dup52, - ])); - - var msg128 = msg("APPTRACK_SESSION_VOL_UPDATE", part157); - - var part158 = match("MESSAGE#124:APPTRACK_SESSION_VOL_UPDATE:01", "nwparser.payload", "%{event_type}: %{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{service->} %{protocol->} %{fld11->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{rulename->} %{rule_template->} %{fld12->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{packets}(%{rbytes}) %{dclass_counter1}(%{sbytes}) %{duration->} %{username->} %{fld10}", processor_chain([ - dup28, - dup53, - dup22, - dup23, - ])); - - var msg129 = msg("APPTRACK_SESSION_VOL_UPDATE:01", part158); - - var select31 = linear_select([ - msg128, - msg129, - ]); - - var msg130 = msg("BFDD_TRAP_STATE_DOWN", dup138); - - var msg131 = msg("BFDD_TRAP_STATE_UP", dup138); - - var part159 = match("MESSAGE#127:bgp_connect_start", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: connect %{saddr->} (%{shost}): %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp connect error"), - dup23, - ])); - - var msg132 = msg("bgp_connect_start", part159); - - var part160 = match("MESSAGE#128:bgp_event", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}) old state %{change_old->} event %{action->} new state %{change_new}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp peer state change"), - dup23, - ])); - - var msg133 = msg("bgp_event", part160); - - var part161 = match("MESSAGE#129:bgp_listen_accept", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection attempt from unconfigured neighbor: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Connection attempt from unconfigured neighbor"), - dup23, - ])); - - var msg134 = msg("bgp_listen_accept", part161); - - var part162 = match("MESSAGE#130:bgp_listen_reset", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","bgp reset"), - dup23, - ])); - - var msg135 = msg("bgp_listen_reset", part162); - - var part163 = match("MESSAGE#131:bgp_nexthop_sanity", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}) next hop %{saddr->} local, %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","peer next hop local"), - dup23, - ])); - - var msg136 = msg("bgp_nexthop_sanity", part163); - - var part164 = match("MESSAGE#132:bgp_process_caps", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{severity->} (%{action}) subcode %{version->} (%{result}) value %{disposition}", processor_chain([ - dup30, - dup22, - setc("event_description","code RED error NOTIFICATION sent"), - dup23, - ])); - - var msg137 = msg("bgp_process_caps", part164); - - var part165 = match("MESSAGE#133:bgp_process_caps:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: mismatch NLRI with %{hostip->} (%{hostname}): peer: %{daddr->} us: %{saddr}", processor_chain([ - dup30, - dup22, - dup57, - dup23, - ])); - - var msg138 = msg("bgp_process_caps:01", part165); - - var select32 = linear_select([ - msg137, - msg138, - ]); - - var part166 = match("MESSAGE#134:bgp_pp_recv", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: dropping %{daddr->} (%{dhost}), %{info->} (%{protocol})", processor_chain([ - dup30, - dup22, - setc("event_description","connection collision"), - setc("result","dropping connection to peer"), - dup23, - ])); - - var msg139 = msg("bgp_pp_recv", part166); - - var part167 = match("MESSAGE#135:bgp_pp_recv:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer %{daddr->} (%{dhost}): received unexpected EOF", processor_chain([ - dup30, - dup22, - setc("event_description","peer received unexpected EOF"), - dup23, - ])); - - var msg140 = msg("bgp_pp_recv:01", part167); - - var select33 = linear_select([ - msg139, - msg140, - ]); - - var part168 = match("MESSAGE#136:bgp_send", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: sending %{sbytes->} bytes to %{daddr->} (%{dhost}) blocked (%{disposition}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","bgp send blocked error"), - dup23, - ])); - - var msg141 = msg("bgp_send", part168); - - var part169 = match("MESSAGE#137:bgp_traffic_timeout", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{resultcode->} (%{action}), Reason: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","bgp timeout NOTIFICATION sent"), - dup23, - ])); - - var msg142 = msg("bgp_traffic_timeout", part169); - - var part170 = match("MESSAGE#138:BOOTPD_ARG_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Ignoring unknown option %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","boot argument error"), - dup23, - ])); - - var msg143 = msg("BOOTPD_ARG_ERR", part170); - - var part171 = match("MESSAGE#139:BOOTPD_BAD_ID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected ID %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","boot unexpected Id value"), - dup23, - ])); - - var msg144 = msg("BOOTPD_BAD_ID", part171); - - var part172 = match("MESSAGE#140:BOOTPD_BOOTSTRING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Boot string: %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","Invalid boot string"), - dup23, - ])); - - var msg145 = msg("BOOTPD_BOOTSTRING", part172); - - var part173 = match("MESSAGE#141:BOOTPD_CONFIG_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Problems with configuration file '%{filename}', %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","configuration file error"), - dup23, - ])); - - var msg146 = msg("BOOTPD_CONFIG_ERR", part173); - - var part174 = match("MESSAGE#142:BOOTPD_CONF_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open configuration file '%{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to open configuration file"), - dup23, - ])); - - var msg147 = msg("BOOTPD_CONF_OPEN", part174); - - var part175 = match("MESSAGE#143:BOOTPD_DUP_REV", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate revision: %{version}", processor_chain([ - dup30, - dup22, - setc("event_description","boot - Duplicate revision"), - dup23, - ])); - - var msg148 = msg("BOOTPD_DUP_REV", part175); - - var part176 = match("MESSAGE#144:BOOTPD_DUP_SLOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate slot default: %{ssid}", processor_chain([ - dup30, - dup22, - setc("event_description","boot - duplicate slot"), - dup23, - ])); - - var msg149 = msg("BOOTPD_DUP_SLOT", part176); - - var part177 = match("MESSAGE#145:BOOTPD_MODEL_CHK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected ID %{id->} for model %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected ID for model"), - dup23, - ])); - - var msg150 = msg("BOOTPD_MODEL_CHK", part177); - - var part178 = match("MESSAGE#146:BOOTPD_MODEL_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unsupported model %{dclass_counter1}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unsupported model"), - dup23, - ])); - - var msg151 = msg("BOOTPD_MODEL_ERR", part178); - - var part179 = match("MESSAGE#147:BOOTPD_NEW_CONF", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: New configuration installed", processor_chain([ - dup21, - dup22, - setc("event_description","New configuration installed"), - dup23, - ])); - - var msg152 = msg("BOOTPD_NEW_CONF", part179); - - var part180 = match("MESSAGE#148:BOOTPD_NO_BOOTSTRING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No boot string found for type %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","No boot string found"), - dup23, - ])); - - var msg153 = msg("BOOTPD_NO_BOOTSTRING", part180); - - var part181 = match("MESSAGE#149:BOOTPD_NO_CONFIG", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No configuration file '%{filename}', %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","No configuration file found"), - dup23, - ])); - - var msg154 = msg("BOOTPD_NO_CONFIG", part181); - - var part182 = match("MESSAGE#150:BOOTPD_PARSE_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename}: number parse errors on SIGHUP", processor_chain([ - dup30, - dup22, - setc("event_description","parse errors on SIGHUP"), - dup23, - ])); - - var msg155 = msg("BOOTPD_PARSE_ERR", part182); - - var part183 = match("MESSAGE#151:BOOTPD_REPARSE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reparsing configuration file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","Reparsing configuration file"), - dup23, - ])); - - var msg156 = msg("BOOTPD_REPARSE", part183); - - var part184 = match("MESSAGE#152:BOOTPD_SELECT_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: select: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","select error"), - dup23, - ])); - - var msg157 = msg("BOOTPD_SELECT_ERR", part184); - - var part185 = match("MESSAGE#153:BOOTPD_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Timeout %{result->} unreasonable", processor_chain([ - dup30, - dup22, - setc("event_description","timeout unreasonable"), - dup23, - ])); - - var msg158 = msg("BOOTPD_TIMEOUT", part185); - - var part186 = match("MESSAGE#154:BOOTPD_VERSION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version: %{version->} built by builder on %{event_time_string}", processor_chain([ - dup21, - dup22, - setc("event_description","boot version built"), - dup23, - ])); - - var msg159 = msg("BOOTPD_VERSION", part186); - - var part187 = match("MESSAGE#155:CHASSISD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} %{version->} built by builder on %{event_time_string}", processor_chain([ - dup58, - dup22, - setc("event_description","CHASSISD release built"), - dup23, - ])); - - var msg160 = msg("CHASSISD", part187); - - var part188 = match("MESSAGE#156:CHASSISD_ARGUMENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown option %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD Unknown option"), - dup23, - ])); - - var msg161 = msg("CHASSISD_ARGUMENT_ERROR", part188); - - var part189 = match("MESSAGE#157:CHASSISD_BLOWERS_SPEED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fans and impellers are now running at normal speed", processor_chain([ - dup21, - dup22, - setc("event_description","Fans and impellers are now running at normal speed"), - dup23, - ])); - - var msg162 = msg("CHASSISD_BLOWERS_SPEED", part189); - - var part190 = match("MESSAGE#158:CHASSISD_BLOWERS_SPEED_FULL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fans and impellers being set to full speed [%{result}]", processor_chain([ - dup21, - dup22, - setc("event_description","Fans and impellers being set to full speed"), - dup23, - ])); - - var msg163 = msg("CHASSISD_BLOWERS_SPEED_FULL", part190); - - var part191 = match("MESSAGE#159:CHASSISD_CB_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result->} reading midplane ID EEPROM, %{dclass_counter1->} %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","reading midplane ID EEPROM"), - dup23, - ])); - - var msg164 = msg("CHASSISD_CB_READ", part191); - - var part192 = match("MESSAGE#160:CHASSISD_COMMAND_ACK_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{device->} online ack code %{dclass_counter1->} - - %{result}, %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD COMMAND ACK ERROR"), - dup23, - ])); - - var msg165 = msg("CHASSISD_COMMAND_ACK_ERROR", part192); - - var part193 = match("MESSAGE#161:CHASSISD_COMMAND_ACK_SF_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{disposition->} - %{result}, code %{resultcode}, SFM %{dclass_counter1}, FPC %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD COMMAND ACK SF ERROR"), - dup23, - ])); - - var msg166 = msg("CHASSISD_COMMAND_ACK_SF_ERROR", part193); - - var part194 = match("MESSAGE#162:CHASSISD_CONCAT_MODE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Cannot set no-concatenated mode for FPC %{dclass_counter2->} PIC %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Cannot set no-concatenated mode for FPC"), - dup23, - ])); - - var msg167 = msg("CHASSISD_CONCAT_MODE_ERROR", part194); - - var part195 = match("MESSAGE#163:CHASSISD_CONFIG_INIT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Problems with configuration file %{filename}; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CONFIG File Problem"), - dup23, - ])); - - var msg168 = msg("CHASSISD_CONFIG_INIT_ERROR", part195); - - var part196 = match("MESSAGE#164:CHASSISD_CONFIG_WARNING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename}: %{result}, FPC %{dclass_counter2->} %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD CONFIG WARNING"), - dup23, - ])); - - var msg169 = msg("CHASSISD_CONFIG_WARNING", part196); - - var part197 = match("MESSAGE#165:CHASSISD_EXISTS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: chassisd already running; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","chassisd already running"), - dup23, - ])); - - var msg170 = msg("CHASSISD_EXISTS", part197); - - var part198 = match("MESSAGE#166:CHASSISD_EXISTS_TERM_OTHER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Killing existing chassisd and exiting", processor_chain([ - dup21, - dup22, - setc("event_description","Killing existing chassisd and exiting"), - dup23, - ])); - - var msg171 = msg("CHASSISD_EXISTS_TERM_OTHER", part198); - - var part199 = match("MESSAGE#167:CHASSISD_FILE_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File open: %{filename}, error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","file open error"), - dup23, - ])); - - var msg172 = msg("CHASSISD_FILE_OPEN", part199); - - var part200 = match("MESSAGE#168:CHASSISD_FILE_STAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File stat: %{filename}, error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD file statistics error"), - dup23, - ])); - - var msg173 = msg("CHASSISD_FILE_STAT", part200); - - var part201 = match("MESSAGE#169:CHASSISD_FRU_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD received restart EVENT"), - dup23, - ])); - - var msg174 = msg("CHASSISD_FRU_EVENT", part201); - - var part202 = match("MESSAGE#170:CHASSISD_FRU_IPC_WRITE_ERROR_EXT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} FRU %{filename}#%{resultcode}, %{result->} %{dclass_counter1}, %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD restart WRITE_ERROR"), - dup23, - ])); - - var msg175 = msg("CHASSISD_FRU_IPC_WRITE_ERROR_EXT", part202); - - var part203 = match("MESSAGE#171:CHASSISD_FRU_STEP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{filename->} %{resultcode->} at step %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD FRU STEP ERROR"), - dup23, - ])); - - var msg176 = msg("CHASSISD_FRU_STEP_ERROR", part203); - - var part204 = match("MESSAGE#172:CHASSISD_GETTIMEOFDAY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected error from gettimeofday: %{resultcode->} - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected error from gettimeofday"), - dup23, - ])); - - var msg177 = msg("CHASSISD_GETTIMEOFDAY", part204); - - var part205 = match("MESSAGE#173:CHASSISD_HOST_TEMP_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result->} reading host temperature sensor", processor_chain([ - dup21, - dup22, - setc("event_description","reading host temperature sensor"), - dup23, - ])); - - var msg178 = msg("CHASSISD_HOST_TEMP_READ", part205); - - var part206 = match("MESSAGE#174:CHASSISD_IFDEV_DETACH_ALL_PSEUDO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{disposition})", processor_chain([ - dup21, - dup22, - setc("event_description","detaching all pseudo devices"), - dup23, - ])); - - var msg179 = msg("CHASSISD_IFDEV_DETACH_ALL_PSEUDO", part206); - - var part207 = match("MESSAGE#175:CHASSISD_IFDEV_DETACH_FPC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH FPC"), - dup23, - ])); - - var msg180 = msg("CHASSISD_IFDEV_DETACH_FPC", part207); - - var part208 = match("MESSAGE#176:CHASSISD_IFDEV_DETACH_PIC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{resultcode})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH PIC"), - dup23, - ])); - - var msg181 = msg("CHASSISD_IFDEV_DETACH_PIC", part208); - - var part209 = match("MESSAGE#177:CHASSISD_IFDEV_DETACH_PSEUDO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}(%{disposition})", processor_chain([ - dup21, - dup22, - setc("event_description","CHASSISD IFDEV DETACH PSEUDO"), - dup23, - ])); - - var msg182 = msg("CHASSISD_IFDEV_DETACH_PSEUDO", part209); - - var part210 = match("MESSAGE#178:CHASSISD_IFDEV_DETACH_TLV_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD IFDEV DETACH TLV ERROR"), - dup23, - ])); - - var msg183 = msg("CHASSISD_IFDEV_DETACH_TLV_ERROR", part210); - - var part211 = match("MESSAGE#179:CHASSISD_IFDEV_GET_BY_INDEX_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: rtslib_ifdm_get_by_index failed: %{resultcode->} - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","rtslib_ifdm_get_by_index failed"), - dup23, - ])); - - var msg184 = msg("CHASSISD_IFDEV_GET_BY_INDEX_FAIL", part211); - - var part212 = match("MESSAGE#180:CHASSISD_IPC_MSG_QFULL_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: type = %{dclass_counter1}, subtype = %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Message Queue full"), - dup23, - ])); - - var msg185 = msg("CHASSISD_IPC_MSG_QFULL_ERROR", part212); - - var part213 = match("MESSAGE#181:CHASSISD_IPC_UNEXPECTED_RECV", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received unexpected message from %{service}: type = %{dclass_counter1}, subtype = %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Received unexpected message"), - dup23, - ])); - - var msg186 = msg("CHASSISD_IPC_UNEXPECTED_RECV", part213); - - var part214 = match("MESSAGE#182:CHASSISD_IPC_WRITE_ERR_NO_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FRU has no connection pipe %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FRU has no connection pipe"), - dup23, - ])); - - var msg187 = msg("CHASSISD_IPC_WRITE_ERR_NO_PIPE", part214); - - var part215 = match("MESSAGE#183:CHASSISD_IPC_WRITE_ERR_NULL_ARGS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FRU has no connection arguments %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FRU has no connection arguments"), - dup23, - ])); - - var msg188 = msg("CHASSISD_IPC_WRITE_ERR_NULL_ARGS", part215); - - var part216 = match("MESSAGE#184:CHASSISD_MAC_ADDRESS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: chassisd MAC address allocation error", processor_chain([ - dup30, - dup22, - setc("event_description","chassisd MAC address allocation error"), - dup23, - ])); - - var msg189 = msg("CHASSISD_MAC_ADDRESS_ERROR", part216); - - var part217 = match("MESSAGE#185:CHASSISD_MAC_DEFAULT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using default MAC address base", processor_chain([ - dup21, - dup22, - setc("event_description","Using default MAC address base"), - dup23, - ])); - - var msg190 = msg("CHASSISD_MAC_DEFAULT", part217); - - var part218 = match("MESSAGE#186:CHASSISD_MBUS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} %{resultcode}: management bus failed sanity test", processor_chain([ - dup30, - dup22, - setc("event_description","management bus failed sanity test"), - dup23, - ])); - - var msg191 = msg("CHASSISD_MBUS_ERROR", part218); - - var part219 = match("MESSAGE#187:CHASSISD_PARSE_COMPLETE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using new configuration", processor_chain([ - dup21, - dup22, - setc("event_description","Using new configuration"), - dup23, - ])); - - var msg192 = msg("CHASSISD_PARSE_COMPLETE", part219); - - var part220 = match("MESSAGE#188:CHASSISD_PARSE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{resultcode->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CHASSISD PARSE ERROR"), - dup23, - ])); - - var msg193 = msg("CHASSISD_PARSE_ERROR", part220); - - var part221 = match("MESSAGE#189:CHASSISD_PARSE_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Parsing configuration file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","Parsing configuration file"), - dup23, - ])); - - var msg194 = msg("CHASSISD_PARSE_INIT", part221); - - var part222 = match("MESSAGE#190:CHASSISD_PIDFILE_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open PID file '%{filename}': %{result->} %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to open PID file"), - dup23, - ])); - - var msg195 = msg("CHASSISD_PIDFILE_OPEN", part222); - - var part223 = match("MESSAGE#191:CHASSISD_PIPE_WRITE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Pipe error: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Pipe error"), - dup23, - ])); - - var msg196 = msg("CHASSISD_PIPE_WRITE_ERROR", part223); - - var part224 = match("MESSAGE#192:CHASSISD_POWER_CHECK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{device->} %{dclass_counter1->} not powering up", processor_chain([ - dup59, - dup22, - setc("event_description","device not powering up"), - dup23, - ])); - - var msg197 = msg("CHASSISD_POWER_CHECK", part224); - - var part225 = match("MESSAGE#193:CHASSISD_RECONNECT_SUCCESSFUL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Successfully reconnected on soft restart", processor_chain([ - dup21, - dup22, - setc("event_description","Successful reconnect on soft restart"), - dup23, - ])); - - var msg198 = msg("CHASSISD_RECONNECT_SUCCESSFUL", part225); - - var part226 = match("MESSAGE#194:CHASSISD_RELEASE_MASTERSHIP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Release mastership notification", processor_chain([ - dup21, - dup22, - setc("event_description","Release mastership notification"), - dup23, - ])); - - var msg199 = msg("CHASSISD_RELEASE_MASTERSHIP", part226); - - var part227 = match("MESSAGE#195:CHASSISD_RE_INIT_INVALID_RE_SLOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: re_init: re %{resultcode}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","re_init Invalid RE slot"), - dup23, - ])); - - var msg200 = msg("CHASSISD_RE_INIT_INVALID_RE_SLOT", part227); - - var part228 = match("MESSAGE#196:CHASSISD_ROOT_MOUNT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine the mount point for root directory: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine mount point for root directory"), - dup23, - ])); - - var msg201 = msg("CHASSISD_ROOT_MOUNT_ERROR", part228); - - var part229 = match("MESSAGE#197:CHASSISD_RTS_SEQ_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifmsg sequence gap %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","ifmsg sequence gap"), - dup23, - ])); - - var msg202 = msg("CHASSISD_RTS_SEQ_ERROR", part229); - - var part230 = match("MESSAGE#198:CHASSISD_SBOARD_VERSION_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version mismatch: %{info}", processor_chain([ - setc("eventcategory","1603040000"), - dup22, - setc("event_description","Version mismatch"), - dup23, - ])); - - var msg203 = msg("CHASSISD_SBOARD_VERSION_MISMATCH", part230); - - var part231 = match("MESSAGE#199:CHASSISD_SERIAL_ID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Serial ID read error: %{resultcode->} - - %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","Serial ID read error"), - dup23, - ])); - - var msg204 = msg("CHASSISD_SERIAL_ID", part231); - - var part232 = match("MESSAGE#200:CHASSISD_SMB_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: fpga download not complete: val %{resultcode}, %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","fpga download not complete"), - dup23, - ])); - - var msg205 = msg("CHASSISD_SMB_ERROR", part232); - - var part233 = match("MESSAGE#201:CHASSISD_SNMP_TRAP6", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap generated: %{result->} (%{info})", processor_chain([ - dup58, - dup22, - setc("event_description","SNMP Trap6 generated"), - dup23, - ])); - - var msg206 = msg("CHASSISD_SNMP_TRAP6", part233); - - var part234 = match("MESSAGE#202:CHASSISD_SNMP_TRAP7", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap: %{result}: %{info}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP Trap7 generated"), - dup23, - ])); - - var msg207 = msg("CHASSISD_SNMP_TRAP7", part234); - - var part235 = match("MESSAGE#203:CHASSISD_SNMP_TRAP10", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP trap: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP trap - FRU power on"), - dup23, - ])); - - var msg208 = msg("CHASSISD_SNMP_TRAP10", part235); - - var part236 = match("MESSAGE#204:CHASSISD_TERM_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received SIGTERM request, %{result}", processor_chain([ - dup60, - dup22, - setc("event_description","Received SIGTERM request"), - dup23, - ])); - - var msg209 = msg("CHASSISD_TERM_SIGNAL", part236); - - var part237 = match("MESSAGE#205:CHASSISD_TRACE_PIC_OFFLINE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Taking PIC offline - - FPC slot %{dclass_counter1}, PIC slot %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","Taking PIC offline"), - dup23, - ])); - - var msg210 = msg("CHASSISD_TRACE_PIC_OFFLINE", part237); - - var part238 = match("MESSAGE#206:CHASSISD_UNEXPECTED_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} returned %{resultcode}: %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","UNEXPECTED EXIT"), - dup23, - ])); - - var msg211 = msg("CHASSISD_UNEXPECTED_EXIT", part238); - - var part239 = match("MESSAGE#207:CHASSISD_UNSUPPORTED_MODEL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Model %{dclass_counter1->} unsupported with this version of chassisd", processor_chain([ - dup59, - dup22, - setc("event_description","Model number unsupported with this version of chassisd"), - dup23, - ])); - - var msg212 = msg("CHASSISD_UNSUPPORTED_MODEL", part239); - - var part240 = match("MESSAGE#208:CHASSISD_VERSION_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Version mismatch: %{info}", processor_chain([ - dup59, - dup22, - setc("event_description","Chassisd Version mismatch"), - dup23, - ])); - - var msg213 = msg("CHASSISD_VERSION_MISMATCH", part240); - - var part241 = match("MESSAGE#209:CHASSISD_HIGH_TEMP_CONDITION", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} temperature=\"%{fld2}\" message=\"%{info}\"]", processor_chain([ - dup59, - dup22, - setc("event_description","CHASSISD HIGH TEMP CONDITION"), - dup61, - dup62, - ])); - - var msg214 = msg("CHASSISD_HIGH_TEMP_CONDITION", part241); - - var part242 = match("MESSAGE#210:clean_process", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: process %{agent->} RESTART mode %{event_state->} new master=%{obj_name->} old failover=%{change_old->} new failover = %{change_new}", processor_chain([ - dup21, - dup22, - setc("event_description","process RESTART mode"), - dup23, - ])); - - var msg215 = msg("clean_process", part242); - - var part243 = match("MESSAGE#211:CM_JAVA", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Chassis %{group->} Linklocal MAC:%{macaddr}", processor_chain([ - dup21, - dup22, - setc("event_description","Chassis Linklocal to MAC"), - dup23, - ])); - - var msg216 = msg("CM_JAVA", part243); - - var part244 = match("MESSAGE#212:DCD_AS_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","DCD must be run as root"), - dup23, - ])); - - var msg217 = msg("DCD_AS_ROOT", part244); - - var part245 = match("MESSAGE#213:DCD_FILTER_LIB_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Filter library initialization failed", processor_chain([ - dup30, - dup22, - setc("event_description","Filter library initialization failed"), - dup23, - ])); - - var msg218 = msg("DCD_FILTER_LIB_ERROR", part245); - - var msg219 = msg("DCD_MALLOC_FAILED_INIT", dup139); - - var part246 = match("MESSAGE#215:DCD_PARSE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing configuration file", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing configuration file"), - dup23, - ])); - - var msg220 = msg("DCD_PARSE_EMERGENCY", part246); - - var part247 = match("MESSAGE#216:DCD_PARSE_FILTER_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing filter index file", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing filter index file"), - dup23, - ])); - - var msg221 = msg("DCD_PARSE_FILTER_EMERGENCY", part247); - - var part248 = match("MESSAGE#217:DCD_PARSE_MINI_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing configuration overlay", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing configuration overlay"), - dup23, - ])); - - var msg222 = msg("DCD_PARSE_MINI_EMERGENCY", part248); - - var part249 = match("MESSAGE#218:DCD_PARSE_STATE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: An unhandled state was encountered during interface parsing", processor_chain([ - dup30, - dup22, - setc("event_description","unhandled state was encountered during interface parsing"), - dup23, - ])); - - var msg223 = msg("DCD_PARSE_STATE_EMERGENCY", part249); - - var part250 = match("MESSAGE#219:DCD_POLICER_PARSE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: errors while parsing policer indexfile", processor_chain([ - dup30, - dup22, - setc("event_description","errors while parsing policer indexfile"), - dup23, - ])); - - var msg224 = msg("DCD_POLICER_PARSE_EMERGENCY", part250); - - var part251 = match("MESSAGE#220:DCD_PULL_LOG_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to pull file %{filename->} after %{dclass_counter1->} retries last error=%{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to pull file"), - dup23, - ])); - - var msg225 = msg("DCD_PULL_LOG_FAILURE", part251); - - var part252 = match("MESSAGE#221:DFWD_ARGUMENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DFWD ARGUMENT ERROR"), - dup23, - ])); - - var msg226 = msg("DFWD_ARGUMENT_ERROR", part252); - - var msg227 = msg("DFWD_MALLOC_FAILED_INIT", dup139); - - var part253 = match("MESSAGE#223:DFWD_PARSE_FILTER_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} encountered errors while parsing filter index file", processor_chain([ - dup30, - dup22, - setc("event_description","errors encountered while parsing filter index file"), - dup23, - ])); - - var msg228 = msg("DFWD_PARSE_FILTER_EMERGENCY", part253); - - var part254 = match("MESSAGE#224:DFWD_PARSE_STATE_EMERGENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} encountered unhandled state while parsing interface", processor_chain([ - dup30, - dup22, - setc("event_description","encountered unhandled state while parsing interface"), - dup23, - ])); - - var msg229 = msg("DFWD_PARSE_STATE_EMERGENCY", part254); - - var msg230 = msg("ECCD_DAEMONIZE_FAILED", dup140); - - var msg231 = msg("ECCD_DUPLICATE", dup141); - - var part255 = match("MESSAGE#227:ECCD_LOOP_EXIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MainLoop return value: %{disposition}, error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD LOOP EXIT FAILURE"), - dup23, - ])); - - var msg232 = msg("ECCD_LOOP_EXIT_FAILURE", part255); - - var part256 = match("MESSAGE#228:ECCD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","ECCD Must be run as root"), - dup23, - ])); - - var msg233 = msg("ECCD_NOT_ROOT", part256); - - var part257 = match("MESSAGE#229:ECCD_PCI_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: open() failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD PCI FILE OPEN FAILED"), - dup23, - ])); - - var msg234 = msg("ECCD_PCI_FILE_OPEN_FAILED", part257); - - var part258 = match("MESSAGE#230:ECCD_PCI_READ_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PCI read failure"), - dup23, - ])); - - var msg235 = msg("ECCD_PCI_READ_FAILED", part258); - - var part259 = match("MESSAGE#231:ECCD_PCI_WRITE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PCI write failure"), - dup23, - ])); - - var msg236 = msg("ECCD_PCI_WRITE_FAILED", part259); - - var msg237 = msg("ECCD_PID_FILE_LOCK", dup142); - - var msg238 = msg("ECCD_PID_FILE_UPDATE", dup143); - - var part260 = match("MESSAGE#234:ECCD_TRACE_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ECCD TRACE FILE OPEN FAILURE"), - dup23, - ])); - - var msg239 = msg("ECCD_TRACE_FILE_OPEN_FAILED", part260); - - var part261 = match("MESSAGE#235:ECCD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","ECCD Usage"), - dup23, - ])); - - var msg240 = msg("ECCD_usage", part261); - - var part262 = match("MESSAGE#236:EVENTD_AUDIT_SHOW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} viewed security audit log with arguments: %{param}", processor_chain([ - dup21, - dup22, - setc("event_description","User viewed security audit log with arguments"), - dup23, - ])); - - var msg241 = msg("EVENTD_AUDIT_SHOW", part262); - - var part263 = match("MESSAGE#237:FLOW_REASSEMBLE_SUCCEED", "nwparser.payload", "%{event_type}: Packet merged source %{saddr->} destination %{daddr->} ipid %{fld11->} succeed", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg242 = msg("FLOW_REASSEMBLE_SUCCEED", part263); - - var part264 = match("MESSAGE#238:FSAD_CHANGE_FILE_OWNER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to change owner of file `%{filename}' to user %{username}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to change owner of file"), - dup23, - ])); - - var msg243 = msg("FSAD_CHANGE_FILE_OWNER", part264); - - var part265 = match("MESSAGE#239:FSAD_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FSAD CONFIG ERROR"), - dup23, - ])); - - var msg244 = msg("FSAD_CONFIG_ERROR", part265); - - var part266 = match("MESSAGE#240:FSAD_CONNTIMEDOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection timed out to the client (%{shost}, %{saddr}) having request type %{obj_type}", processor_chain([ - dup30, - dup22, - setc("event_description","Connection timed out to client"), - dup23, - ])); - - var msg245 = msg("FSAD_CONNTIMEDOUT", part266); - - var part267 = match("MESSAGE#241:FSAD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","FSAD_FAILED"), - dup23, - ])); - - var msg246 = msg("FSAD_FAILED", part267); - - var part268 = match("MESSAGE#242:FSAD_FETCHTIMEDOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Fetch to server %{hostname->} for file `%{filename}' timed out", processor_chain([ - dup30, - dup22, - setc("event_description","Fetch to server to get file timed out"), - dup23, - ])); - - var msg247 = msg("FSAD_FETCHTIMEDOUT", part268); - - var part269 = match("MESSAGE#243:FSAD_FILE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: fn failed for file `%{filename}' with error message %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","fn failed for file"), - dup23, - ])); - - var msg248 = msg("FSAD_FILE_FAILED", part269); - - var part270 = match("MESSAGE#244:FSAD_FILE_REMOVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to remove file `%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to remove file"), - dup23, - ])); - - var msg249 = msg("FSAD_FILE_REMOVE", part270); - - var part271 = match("MESSAGE#245:FSAD_FILE_RENAME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to rename file `%{filename}' to `%{resultcode}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to rename file"), - dup23, - ])); - - var msg250 = msg("FSAD_FILE_RENAME", part271); - - var part272 = match("MESSAGE#246:FSAD_FILE_STAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} failed for file pathname %{filename}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","stat failed for file"), - dup23, - ])); - - var msg251 = msg("FSAD_FILE_STAT", part272); - - var part273 = match("MESSAGE#247:FSAD_FILE_SYNC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to sync file %{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to sync file"), - dup23, - ])); - - var msg252 = msg("FSAD_FILE_SYNC", part273); - - var part274 = match("MESSAGE#248:FSAD_MAXCONN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Upper limit reached in fsad for handling connections", processor_chain([ - dup30, - dup22, - setc("event_description","Upper limit reached in fsad"), - dup23, - ])); - - var msg253 = msg("FSAD_MAXCONN", part274); - - var part275 = match("MESSAGE#249:FSAD_MEMORYALLOC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service->} failed in the function %{action->} (%{resultcode})", processor_chain([ - dup51, - dup22, - setc("event_description","FSAD MEMORYALLOC FAILED"), - dup23, - ])); - - var msg254 = msg("FSAD_MEMORYALLOC_FAILED", part275); - - var part276 = match("MESSAGE#250:FSAD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","FSAD must be run as root"), - dup23, - ])); - - var msg255 = msg("FSAD_NOT_ROOT", part276); - - var part277 = match("MESSAGE#251:FSAD_PARENT_DIRECTORY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: invalid directory: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","invalid directory"), - dup23, - ])); - - var msg256 = msg("FSAD_PARENT_DIRECTORY", part277); - - var part278 = match("MESSAGE#252:FSAD_PATH_IS_DIRECTORY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: File path cannot be a directory (%{filename})", processor_chain([ - dup30, - dup22, - setc("event_description","File path cannot be a directory"), - dup23, - ])); - - var msg257 = msg("FSAD_PATH_IS_DIRECTORY", part278); - - var part279 = match("MESSAGE#253:FSAD_PATH_IS_SPECIAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Not a regular file (%{filename})", processor_chain([ - dup30, - dup22, - setc("event_description","Not a regular file"), - dup23, - ])); - - var msg258 = msg("FSAD_PATH_IS_SPECIAL", part279); - - var part280 = match("MESSAGE#254:FSAD_RECVERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: fsad received error message from client having request type %{obj_type->} at (%{saddr}, %{sport})", processor_chain([ - dup30, - dup22, - setc("event_description","fsad received error message from client"), - dup23, - ])); - - var msg259 = msg("FSAD_RECVERROR", part280); - - var part281 = match("MESSAGE#255:FSAD_TERMINATED_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Open file %{filename}` closed due to %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","FSAD TERMINATED CONNECTION"), - dup23, - ])); - - var msg260 = msg("FSAD_TERMINATED_CONNECTION", part281); - - var part282 = match("MESSAGE#256:FSAD_TERMINATING_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received terminating %{resultcode}; %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Received terminating signal"), - dup23, - ])); - - var msg261 = msg("FSAD_TERMINATING_SIGNAL", part282); - - var part283 = match("MESSAGE#257:FSAD_TRACEOPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Open operation on trace file `%{filename}' returned error %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Open operation on trace file failed"), - dup23, - ])); - - var msg262 = msg("FSAD_TRACEOPEN_FAILED", part283); - - var part284 = match("MESSAGE#258:FSAD_USAGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect usage, %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","Incorrect FSAD usage"), - dup23, - ])); - - var msg263 = msg("FSAD_USAGE", part284); - - var part285 = match("MESSAGE#259:GGSN_ALARM_TRAP_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","GGSN ALARM TRAP FAILED"), - dup23, - ])); - - var msg264 = msg("GGSN_ALARM_TRAP_FAILED", part285); - - var part286 = match("MESSAGE#260:GGSN_ALARM_TRAP_SEND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","GGSN ALARM TRAP SEND FAILED"), - dup23, - ])); - - var msg265 = msg("GGSN_ALARM_TRAP_SEND", part286); - - var part287 = match("MESSAGE#261:GGSN_TRAP_SEND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown trap request type %{obj_type}", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown trap request type"), - dup23, - ])); - - var msg266 = msg("GGSN_TRAP_SEND", part287); - - var part288 = match("MESSAGE#262:JADE_AUTH_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authorization failed: %{result}", processor_chain([ - dup69, - dup34, - setc("ec_subject","Service"), - dup43, - dup22, - setc("event_description","Authorization failed"), - dup23, - ])); - - var msg267 = msg("JADE_AUTH_ERROR", part288); - - var part289 = match("MESSAGE#263:JADE_EXEC_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: CLI %{resultcode->} %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JADE EXEC ERROR"), - dup23, - ])); - - var msg268 = msg("JADE_EXEC_ERROR", part289); - - var part290 = match("MESSAGE#264:JADE_NO_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Local user %{username->} does not exist", processor_chain([ - dup30, - dup22, - setc("event_description","Local user does not exist"), - dup23, - ])); - - var msg269 = msg("JADE_NO_LOCAL_USER", part290); - - var part291 = match("MESSAGE#265:JADE_PAM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JADE PAM error"), - dup23, - ])); - - var msg270 = msg("JADE_PAM_ERROR", part291); - - var part292 = match("MESSAGE#266:JADE_PAM_NO_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to get local username from PAM: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to get local username from PAM"), - dup23, - ])); - - var msg271 = msg("JADE_PAM_NO_LOCAL_USER", part292); - - var part293 = match("MESSAGE#267:KERN_ARP_ADDR_CHANGE", "nwparser.payload", "%{process}: %{event_type}: arp info overwritten for %{saddr->} from %{smacaddr->} to %{dmacaddr}", processor_chain([ - dup30, - dup22, - setc("event_description","arp info overwritten"), - dup23, - ])); - - var msg272 = msg("KERN_ARP_ADDR_CHANGE", part293); - - var part294 = match("MESSAGE#268:KMD_PM_SA_ESTABLISHED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Local gateway: %{gateway}, Remote gateway: %{fld1}, Local ID:%{fld2}, Remote ID:%{fld3}, Direction:%{fld4}, SPI:%{fld5}", processor_chain([ - dup30, - dup22, - setc("event_description","security association has been established"), - dup23, - ])); - - var msg273 = msg("KMD_PM_SA_ESTABLISHED", part294); - - var part295 = match("MESSAGE#269:L2CPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitialized", processor_chain([ - dup21, - dup22, - setc("event_description","Task Reinitialized"), - dup61, - dup23, - ])); - - var msg274 = msg("L2CPD_TASK_REINIT", part295); - - var part296 = match("MESSAGE#270:LIBJNX_EXEC_EXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command stopped: PID %{child_pid}, signal='%{obj_type}' %{result}, command '%{action}'", processor_chain([ - dup21, - dup22, - dup70, - dup23, - ])); - - var msg275 = msg("LIBJNX_EXEC_EXITED", part296); - - var part297 = match("MESSAGE#271:LIBJNX_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exec failed for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Child exec failed for command"), - dup23, - ])); - - var msg276 = msg("LIBJNX_EXEC_FAILED", part297); - - var msg277 = msg("LIBJNX_EXEC_PIPE", dup144); - - var part298 = match("MESSAGE#273:LIBJNX_EXEC_SIGNALED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command received signal: PID %{child_pid}, signal %{result}, command '%{action}'", processor_chain([ - dup30, - dup22, - setc("event_description","Command received signal"), - dup23, - ])); - - var msg278 = msg("LIBJNX_EXEC_SIGNALED", part298); - - var part299 = match("MESSAGE#274:LIBJNX_EXEC_WEXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command exited: PID %{child_pid}, status %{result}, command '%{action}'", processor_chain([ - dup21, - dup22, - dup72, - dup23, - ])); - - var msg279 = msg("LIBJNX_EXEC_WEXIT", part299); - - var part300 = match("MESSAGE#275:LIBJNX_FILE_COPY_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: copy_file_to_transfer_dir failed to copy from source to destination", processor_chain([ - dup73, - dup22, - setc("event_description","copy_file_to_transfer_dir failed to copy"), - dup23, - ])); - - var msg280 = msg("LIBJNX_FILE_COPY_FAILED", part300); - - var part301 = match("MESSAGE#276:LIBJNX_PRIV_LOWER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lower privilege level: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Unable to lower privilege level"), - dup23, - ])); - - var msg281 = msg("LIBJNX_PRIV_LOWER_FAILED", part301); - - var part302 = match("MESSAGE#277:LIBJNX_PRIV_RAISE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to raise privilege level: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Unable to raise privilege level"), - dup23, - ])); - - var msg282 = msg("LIBJNX_PRIV_RAISE_FAILED", part302); - - var part303 = match("MESSAGE#278:LIBJNX_REPLICATE_RCP_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","rcp failed"), - dup23, - ])); - - var msg283 = msg("LIBJNX_REPLICATE_RCP_EXEC_FAILED", part303); - - var part304 = match("MESSAGE#279:LIBJNX_ROTATE_COMPRESS_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode->} %{dclass_counter1->} -f %{action}: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","ROTATE COMPRESS EXEC FAILED"), - dup23, - ])); - - var msg284 = msg("LIBJNX_ROTATE_COMPRESS_EXEC_FAILED", part304); - - var part305 = match("MESSAGE#280:LIBSERVICED_CLIENT_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Client connection error: %{result}", processor_chain([ - dup74, - dup22, - setc("event_description","Client connection error"), - dup23, - ])); - - var msg285 = msg("LIBSERVICED_CLIENT_CONNECTION", part305); - - var part306 = match("MESSAGE#281:LIBSERVICED_OUTBOUND_REQUEST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Outbound request failed for command [%{action}]: %{result}", processor_chain([ - dup73, - dup22, - setc("event_description","Outbound request failed for command"), - dup23, - ])); - - var msg286 = msg("LIBSERVICED_OUTBOUND_REQUEST", part306); - - var part307 = match("MESSAGE#282:LIBSERVICED_SNMP_LOST_CONNECTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Connection closed while receiving from client %{dclass_counter1}", processor_chain([ - dup27, - dup22, - setc("event_description","Connection closed while receiving from client"), - dup23, - ])); - - var msg287 = msg("LIBSERVICED_SNMP_LOST_CONNECTION", part307); - - var part308 = match("MESSAGE#283:LIBSERVICED_SOCKET_BIND", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode}: unable to bind socket %{ssid}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to bind socket"), - dup23, - ])); - - var msg288 = msg("LIBSERVICED_SOCKET_BIND", part308); - - var part309 = match("MESSAGE#284:LIBSERVICED_SOCKET_PRIVATIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to attach socket %{ssid->} to management routing instance: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to attach socket to management routing instance"), - dup23, - ])); - - var msg289 = msg("LIBSERVICED_SOCKET_PRIVATIZE", part309); - - var part310 = match("MESSAGE#285:LICENSE_EXPIRED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LICENSE EXPIRED"), - dup23, - ])); - - var msg290 = msg("LICENSE_EXPIRED", part310); - - var part311 = match("MESSAGE#286:LICENSE_EXPIRED_KEY_DELETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License key \"%{filename}\" has expired.", processor_chain([ - dup21, - dup22, - setc("event_description","License key has expired"), - dup23, - ])); - - var msg291 = msg("LICENSE_EXPIRED_KEY_DELETED", part311); - - var part312 = match("MESSAGE#287:LICENSE_NEARING_EXPIRY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: License for feature %{disposition->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","License key expiration soon"), - dup23, - ])); - - var msg292 = msg("LICENSE_NEARING_EXPIRY", part312); - - var part313 = match("MESSAGE#288:LOGIN_ABORTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Client aborted login", processor_chain([ - dup30, - dup22, - setc("event_description","client aborted login"), - dup23, - ])); - - var msg293 = msg("LOGIN_ABORTED", part313); - - var part314 = match("MESSAGE#289:LOGIN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login failed for user %{username->} from host %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - dup23, - ])); - - var msg294 = msg("LOGIN_FAILED", part314); - - var part315 = match("MESSAGE#290:LOGIN_FAILED_INCORRECT_PASSWORD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect password for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Incorrect password for user"), - dup23, - ])); - - var msg295 = msg("LOGIN_FAILED_INCORRECT_PASSWORD", part315); - - var part316 = match("MESSAGE#291:LOGIN_FAILED_SET_CONTEXT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to set context for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Failed to set context for user"), - dup23, - ])); - - var msg296 = msg("LOGIN_FAILED_SET_CONTEXT", part316); - - var part317 = match("MESSAGE#292:LOGIN_FAILED_SET_LOGIN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to set login ID for user %{username}: %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Failed to set login ID for user"), - dup23, - ])); - - var msg297 = msg("LOGIN_FAILED_SET_LOGIN", part317); - - var part318 = match("MESSAGE#293:LOGIN_HOSTNAME_UNRESOLVED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to resolve hostname %{dhost}: %{info}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Unable to resolve hostname"), - dup23, - ])); - - var msg298 = msg("LOGIN_HOSTNAME_UNRESOLVED", part318); - - var part319 = match("MESSAGE#294:LOGIN_INFORMATION/2", "nwparser.p0", "%{event_type}: %{p0}"); - - var part320 = match("MESSAGE#294:LOGIN_INFORMATION/4", "nwparser.p0", "%{username->} logged in from host %{dhost->} on %{p0}"); - - var part321 = match("MESSAGE#294:LOGIN_INFORMATION/5_0", "nwparser.p0", "device %{p0}"); - - var select34 = linear_select([ - part321, - dup45, - ]); - - var part322 = match("MESSAGE#294:LOGIN_INFORMATION/6", "nwparser.p0", "%{terminal}"); - - var all19 = all_match({ - processors: [ - dup39, - dup137, - part319, - dup145, - part320, - select34, - part322, - ], - on_success: processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","Successful Login"), - dup23, - ]), - }); - - var msg299 = msg("LOGIN_INFORMATION", all19); - - var part323 = match("MESSAGE#295:LOGIN_INVALID_LOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No entry in local password file for user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","No entry in local password file for user"), - dup23, - ])); - - var msg300 = msg("LOGIN_INVALID_LOCAL_USER", part323); - - var part324 = match("MESSAGE#296:LOGIN_MALFORMED_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid username: %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Invalid username"), - dup23, - ])); - - var msg301 = msg("LOGIN_MALFORMED_USER", part324); - - var part325 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/1_0", "nwparser.p0", "PAM authentication error for user %{p0}"); - - var part326 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/1_1", "nwparser.p0", "Failed password for user %{p0}"); - - var select35 = linear_select([ - part325, - part326, - ]); - - var part327 = match("MESSAGE#297:LOGIN_PAM_AUTHENTICATION_ERROR/2", "nwparser.p0", "%{username}"); - - var all20 = all_match({ - processors: [ - dup50, - select35, - part327, - ], - on_success: processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","PAM authentication error for user"), - dup23, - ]), - }); - - var msg302 = msg("LOGIN_PAM_AUTHENTICATION_ERROR", all20); - - var part328 = match("MESSAGE#298:LOGIN_PAM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failure while authenticating user %{username}: %{dhost}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - setc("event_description","PAM authentication failure"), - setc("result","Failure while authenticating user"), - dup23, - ])); - - var msg303 = msg("LOGIN_PAM_ERROR", part328); - - var part329 = match("MESSAGE#299:LOGIN_PAM_MAX_RETRIES", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Too many retries while authenticating user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Too many retries while authenticating user"), - dup23, - ])); - - var msg304 = msg("LOGIN_PAM_MAX_RETRIES", part329); - - var part330 = match("MESSAGE#300:LOGIN_PAM_NONLOCAL_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} authenticated but has no local login ID", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","User authenticated but has no local login ID"), - dup23, - ])); - - var msg305 = msg("LOGIN_PAM_NONLOCAL_USER", part330); - - var part331 = match("MESSAGE#301:LOGIN_PAM_STOP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to end PAM session: %{info}", processor_chain([ - setc("eventcategory","1303000000"), - dup34, - dup43, - dup22, - setc("event_description","Failed to end PAM session"), - dup23, - ])); - - var msg306 = msg("LOGIN_PAM_STOP", part331); - - var part332 = match("MESSAGE#302:LOGIN_PAM_USER_UNKNOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Attempt to authenticate unknown user %{username}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Attempt to authenticate unknown user"), - dup23, - ])); - - var msg307 = msg("LOGIN_PAM_USER_UNKNOWN", part332); - - var part333 = match("MESSAGE#303:LOGIN_PASSWORD_EXPIRED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Forcing change of expired password for user %{username}>", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Forcing change of expired password for user"), - dup23, - ])); - - var msg308 = msg("LOGIN_PASSWORD_EXPIRED", part333); - - var part334 = match("MESSAGE#304:LOGIN_REFUSED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login of user %{username->} from host %{shost->} on %{terminal->} was refused: %{info}", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup75, - setc("result","Login of user refused"), - dup23, - ])); - - var msg309 = msg("LOGIN_REFUSED", part334); - - var part335 = match("MESSAGE#305:LOGIN_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} logged in as root from host %{shost->} on %{terminal}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","successful login as root"), - setc("result","User logged in as root"), - dup23, - ])); - - var msg310 = msg("LOGIN_ROOT", part335); - - var part336 = match("MESSAGE#306:LOGIN_TIMED_OUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Login attempt timed out after %{dclass_counter1->} seconds", processor_chain([ - dup44, - dup34, - dup36, - dup43, - dup22, - dup75, - setc("result","Login attempt timed out"), - dup23, - ])); - - var msg311 = msg("LOGIN_TIMED_OUT", part336); - - var part337 = match("MESSAGE#307:MIB2D_ATM_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D ATM ERROR"), - dup23, - ])); - - var msg312 = msg("MIB2D_ATM_ERROR", part337); - - var part338 = match("MESSAGE#308:MIB2D_CONFIG_CHECK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","CONFIG CHECK FAILED"), - dup23, - ])); - - var msg313 = msg("MIB2D_CONFIG_CHECK_FAILED", part338); - - var part339 = match("MESSAGE#309:MIB2D_FILE_OPEN_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open file '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - dup78, - dup23, - ])); - - var msg314 = msg("MIB2D_FILE_OPEN_FAILURE", part339); - - var msg315 = msg("MIB2D_IFD_IFINDEX_FAILURE", dup146); - - var msg316 = msg("MIB2D_IFL_IFINDEX_FAILURE", dup146); - - var part340 = match("MESSAGE#312:MIB2D_INIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: mib2d initialization failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","mib2d initialization failure"), - dup23, - ])); - - var msg317 = msg("MIB2D_INIT_FAILURE", part340); - - var part341 = match("MESSAGE#313:MIB2D_KVM_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D KVM FAILURE"), - dup23, - ])); - - var msg318 = msg("MIB2D_KVM_FAILURE", part341); - - var part342 = match("MESSAGE#314:MIB2D_RTSLIB_READ_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: failed in %{dclass_counter1->} %{dclass_counter2->} index (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D RTSLIB READ FAILURE"), - dup23, - ])); - - var msg319 = msg("MIB2D_RTSLIB_READ_FAILURE", part342); - - var part343 = match("MESSAGE#315:MIB2D_RTSLIB_SEQ_MISMATCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: sequence mismatch (%{result}), %{action}", processor_chain([ - dup30, - dup22, - setc("event_description","RTSLIB sequence mismatch"), - dup23, - ])); - - var msg320 = msg("MIB2D_RTSLIB_SEQ_MISMATCH", part343); - - var part344 = match("MESSAGE#316:MIB2D_SYSCTL_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D SYSCTL FAILURE"), - dup23, - ])); - - var msg321 = msg("MIB2D_SYSCTL_FAILURE", part344); - - var part345 = match("MESSAGE#317:MIB2D_TRAP_HEADER_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: trap_request_header failed", processor_chain([ - dup30, - dup22, - setc("event_description","trap_request_header failed"), - dup23, - ])); - - var msg322 = msg("MIB2D_TRAP_HEADER_FAILURE", part345); - - var part346 = match("MESSAGE#318:MIB2D_TRAP_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{service}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MIB2D TRAP SEND FAILURE"), - dup23, - ])); - - var msg323 = msg("MIB2D_TRAP_SEND_FAILURE", part346); - - var part347 = match("MESSAGE#319:Multiuser", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: old requested_transition==%{change_new->} sighupped=%{result}", processor_chain([ - dup21, - dup22, - setc("event_description","user sighupped"), - dup23, - ])); - - var msg324 = msg("Multiuser", part347); - - var part348 = match("MESSAGE#320:NASD_AUTHENTICATION_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate authentication handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate authentication handle"), - dup23, - ])); - - var msg325 = msg("NASD_AUTHENTICATION_CREATE_FAILED", part348); - - var part349 = match("MESSAGE#321:NASD_CHAP_AUTHENTICATION_IN_PROGRESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename}, authentication already in progress", processor_chain([ - dup80, - dup34, - dup43, - dup22, - setc("event_description","authentication already in progress"), - dup23, - ])); - - var msg326 = msg("NASD_CHAP_AUTHENTICATION_IN_PROGRESS", part349); - - var part350 = match("MESSAGE#322:NASD_CHAP_GETHOSTNAME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: unable to obtain hostname for outgoing CHAP message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to obtain hostname for outgoing CHAP message"), - dup23, - ])); - - var msg327 = msg("NASD_CHAP_GETHOSTNAME_FAILED", part350); - - var part351 = match("MESSAGE#323:NASD_CHAP_INVALID_CHAP_IDENTIFIER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename->} expected CHAP ID: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP INVALID_CHAP IDENTIFIER"), - dup23, - ])); - - var msg328 = msg("NASD_CHAP_INVALID_CHAP_IDENTIFIER", part351); - - var part352 = match("MESSAGE#324:NASD_CHAP_INVALID_OPCODE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}.%{dclass_counter1}: invalid operation code received %{filename}, CHAP ID: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP INVALID OPCODE"), - dup23, - ])); - - var msg329 = msg("NASD_CHAP_INVALID_OPCODE", part352); - - var part353 = match("MESSAGE#325:NASD_CHAP_LOCAL_NAME_UNAVAILABLE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine value for '%{username}' in outgoing CHAP packet", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine value for username in outgoing CHAP packet"), - dup23, - ])); - - var msg330 = msg("NASD_CHAP_LOCAL_NAME_UNAVAILABLE", part353); - - var part354 = match("MESSAGE#326:NASD_CHAP_MESSAGE_UNEXPECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{interface}: received %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","CHAP MESSAGE UNEXPECTED"), - dup23, - ])); - - var msg331 = msg("NASD_CHAP_MESSAGE_UNEXPECTED", part354); - - var part355 = match("MESSAGE#327:NASD_CHAP_REPLAY_ATTACK_DETECTED", "nwparser.payload", "%{process}[%{ssid}]: %{event_type}: %{interface}.%{dclass_counter1}: received %{filename->} %{result}.%{info}", processor_chain([ - dup81, - dup22, - setc("event_description","CHAP REPLAY ATTACK DETECTED"), - dup23, - ])); - - var msg332 = msg("NASD_CHAP_REPLAY_ATTACK_DETECTED", part355); - - var part356 = match("MESSAGE#328:NASD_CONFIG_GET_LAST_MODIFIED_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to determine last modified time of JUNOS configuration database: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to determine last modified time of JUNOS configuration database"), - dup23, - ])); - - var msg333 = msg("NASD_CONFIG_GET_LAST_MODIFIED_FAILED", part356); - - var msg334 = msg("NASD_DAEMONIZE_FAILED", dup140); - - var part357 = match("MESSAGE#330:NASD_DB_ALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate database object: %{filename}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate database object"), - dup23, - ])); - - var msg335 = msg("NASD_DB_ALLOC_FAILURE", part357); - - var part358 = match("MESSAGE#331:NASD_DB_TABLE_CREATE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{filename}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DB TABLE CREATE FAILURE"), - dup23, - ])); - - var msg336 = msg("NASD_DB_TABLE_CREATE_FAILURE", part358); - - var msg337 = msg("NASD_DUPLICATE", dup141); - - var part359 = match("MESSAGE#333:NASD_EVLIB_CREATE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} with: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","EVLIB CREATE FAILURE"), - dup23, - ])); - - var msg338 = msg("NASD_EVLIB_CREATE_FAILURE", part359); - - var part360 = match("MESSAGE#334:NASD_EVLIB_EXIT_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} value: %{result}, error: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","EVLIB EXIT FAILURE"), - dup23, - ])); - - var msg339 = msg("NASD_EVLIB_EXIT_FAILURE", part360); - - var part361 = match("MESSAGE#335:NASD_LOCAL_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate LOCAL module handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate LOCAL module handle"), - dup23, - ])); - - var msg340 = msg("NASD_LOCAL_CREATE_FAILED", part361); - - var part362 = match("MESSAGE#336:NASD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","NASD must be run as root"), - dup23, - ])); - - var msg341 = msg("NASD_NOT_ROOT", part362); - - var msg342 = msg("NASD_PID_FILE_LOCK", dup142); - - var msg343 = msg("NASD_PID_FILE_UPDATE", dup143); - - var part363 = match("MESSAGE#339:NASD_POST_CONFIGURE_EVENT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","POST CONFIGURE EVENT FAILED"), - dup23, - ])); - - var msg344 = msg("NASD_POST_CONFIGURE_EVENT_FAILED", part363); - - var part364 = match("MESSAGE#340:NASD_PPP_READ_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PPP READ FAILURE"), - dup23, - ])); - - var msg345 = msg("NASD_PPP_READ_FAILURE", part364); - - var part365 = match("MESSAGE#341:NASD_PPP_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to send message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to send message"), - dup23, - ])); - - var msg346 = msg("NASD_PPP_SEND_FAILURE", part365); - - var part366 = match("MESSAGE#342:NASD_PPP_SEND_PARTIAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to send all of message: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to send all of message"), - dup23, - ])); - - var msg347 = msg("NASD_PPP_SEND_PARTIAL", part366); - - var part367 = match("MESSAGE#343:NASD_PPP_UNRECOGNIZED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unrecognized authentication protocol: %{protocol}", processor_chain([ - dup30, - dup22, - setc("event_description","Unrecognized authentication protocol"), - dup23, - ])); - - var msg348 = msg("NASD_PPP_UNRECOGNIZED", part367); - - var part368 = match("MESSAGE#344:NASD_RADIUS_ALLOCATE_PASSWORD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} when allocating password for RADIUS: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS password allocation failure"), - dup23, - ])); - - var msg349 = msg("NASD_RADIUS_ALLOCATE_PASSWORD_FAILED", part368); - - var part369 = match("MESSAGE#345:NASD_RADIUS_CONFIG_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS CONFIG FAILED"), - dup23, - ])); - - var msg350 = msg("NASD_RADIUS_CONFIG_FAILED", part369); - - var part370 = match("MESSAGE#346:NASD_RADIUS_CREATE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to allocate RADIUS module handle: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to allocate RADIUS module handle"), - dup23, - ])); - - var msg351 = msg("NASD_RADIUS_CREATE_FAILED", part370); - - var part371 = match("MESSAGE#347:NASD_RADIUS_CREATE_REQUEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS CREATE REQUEST FAILED"), - dup23, - ])); - - var msg352 = msg("NASD_RADIUS_CREATE_REQUEST_FAILED", part371); - - var part372 = match("MESSAGE#348:NASD_RADIUS_GETHOSTNAME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain hostname for outgoing RADIUS message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain hostname for outgoing RADIUS message"), - dup23, - ])); - - var msg353 = msg("NASD_RADIUS_GETHOSTNAME_FAILED", part372); - - var part373 = match("MESSAGE#349:NASD_RADIUS_MESSAGE_UNEXPECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown response from RADIUS server: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown response from RADIUS server"), - dup23, - ])); - - var msg354 = msg("NASD_RADIUS_MESSAGE_UNEXPECTED", part373); - - var part374 = match("MESSAGE#350:NASD_RADIUS_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS OPEN FAILED"), - dup23, - ])); - - var msg355 = msg("NASD_RADIUS_OPEN_FAILED", part374); - - var part375 = match("MESSAGE#351:NASD_RADIUS_SELECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS SELECT FAILED"), - dup23, - ])); - - var msg356 = msg("NASD_RADIUS_SELECT_FAILED", part375); - - var part376 = match("MESSAGE#352:NASD_RADIUS_SET_TIMER_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RADIUS SET TIMER FAILED"), - dup23, - ])); - - var msg357 = msg("NASD_RADIUS_SET_TIMER_FAILED", part376); - - var part377 = match("MESSAGE#353:NASD_TRACE_FILE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TRACE FILE OPEN FAILED"), - dup23, - ])); - - var msg358 = msg("NASD_TRACE_FILE_OPEN_FAILED", part377); - - var part378 = match("MESSAGE#354:NASD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","NASD Usage"), - dup23, - ])); - - var msg359 = msg("NASD_usage", part378); - - var part379 = match("MESSAGE#355:NOTICE", "nwparser.payload", "%{agent}: %{event_type}:%{action}: %{event_description}: The %{result}", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg360 = msg("NOTICE", part379); - - var part380 = match("MESSAGE#356:PFE_FW_SYSLOG_IP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: FW: %{smacaddr->} %{fld10->} %{protocol->} %{saddr->} %{daddr->} %{sport->} %{dport->} (%{packets->} packets)", processor_chain([ - dup21, - dup22, - dup82, - dup23, - ])); - - var msg361 = msg("PFE_FW_SYSLOG_IP", part380); - - var part381 = match("MESSAGE#357:PFE_FW_SYSLOG_IP:01", "nwparser.payload", "%{hostip->} %{hostname->} %{event_type}: FW: %{smacaddr->} %{fld10->} %{protocol->} %{saddr->} %{daddr->} %{sport->} %{dport->} (%{packets->} packets)", processor_chain([ - dup21, - dup22, - dup82, - dup23, - ])); - - var msg362 = msg("PFE_FW_SYSLOG_IP:01", part381); - - var select36 = linear_select([ - msg361, - msg362, - ]); - - var part382 = match("MESSAGE#358:PFE_NH_RESOLVE_THROTTLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Next-hop resolution requests from interface %{interface->} throttled", processor_chain([ - dup21, - dup22, - setc("event_description","Next-hop resolution requests throttled"), - dup23, - ])); - - var msg363 = msg("PFE_NH_RESOLVE_THROTTLED", part382); - - var part383 = match("MESSAGE#359:PING_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","PING TEST COMPLETED"), - dup23, - ])); - - var msg364 = msg("PING_TEST_COMPLETED", part383); - - var part384 = match("MESSAGE#360:PING_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","PING TEST FAILED"), - dup23, - ])); - - var msg365 = msg("PING_TEST_FAILED", part384); - - var part385 = match("MESSAGE#361:process_mode/2", "nwparser.p0", "%{p0}"); - - var part386 = match("MESSAGE#361:process_mode/3_0", "nwparser.p0", "%{event_type}: %{p0}"); - - var part387 = match("MESSAGE#361:process_mode/3_1", "nwparser.p0", "%{event_type->} %{p0}"); - - var select37 = linear_select([ - part386, - part387, - ]); - - var part388 = match("MESSAGE#361:process_mode/4", "nwparser.p0", "mode=%{protocol->} cmd=%{action->} master_mode=%{result}"); - - var all21 = all_match({ - processors: [ - dup39, - dup137, - part385, - select37, - part388, - ], - on_success: processor_chain([ - dup21, - dup22, - dup83, - dup23, - ]), - }); - - var msg366 = msg("process_mode", all21); - - var part389 = match("MESSAGE#362:process_mode:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: current_mode=%{protocol}, requested_mode=%{result}, cmd=%{action}", processor_chain([ - dup21, - dup22, - dup83, - dup23, - ])); - - var msg367 = msg("process_mode:01", part389); - - var select38 = linear_select([ - msg366, - msg367, - ]); - - var part390 = match("MESSAGE#363:PWC_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} exiting with status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","process exit with status"), - dup23, - ])); - - var msg368 = msg("PWC_EXIT", part390); - - var part391 = match("MESSAGE#364:PWC_HOLD_RELEASE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} released child %{child_pid->} from %{dclass_counter1->} state", processor_chain([ - dup21, - dup22, - setc("event_description","Process released child from state"), - dup23, - ])); - - var msg369 = msg("PWC_HOLD_RELEASE", part391); - - var part392 = match("MESSAGE#365:PWC_INVALID_RUNS_ARGUMENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}, not %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","invalid runs argument"), - dup23, - ])); - - var msg370 = msg("PWC_INVALID_RUNS_ARGUMENT", part392); - - var part393 = match("MESSAGE#366:PWC_INVALID_TIMEOUT_ARGUMENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","INVALID TIMEOUT ARGUMENT"), - dup23, - ])); - - var msg371 = msg("PWC_INVALID_TIMEOUT_ARGUMENT", part393); - - var part394 = match("MESSAGE#367:PWC_KILLED_BY_SIGNAL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc process %{agent->} received terminating signal", processor_chain([ - dup21, - dup22, - setc("event_description","pwc process received terminating signal"), - dup23, - ])); - - var msg372 = msg("PWC_KILLED_BY_SIGNAL", part394); - - var part395 = match("MESSAGE#368:PWC_KILL_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc is sending %{resultcode->} to child %{child_pid}", processor_chain([ - dup30, - dup22, - setc("event_description","pwc is sending kill event to child"), - dup23, - ])); - - var msg373 = msg("PWC_KILL_EVENT", part395); - - var part396 = match("MESSAGE#369:PWC_KILL_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to kill process %{child_pid}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to kill process"), - dup23, - ])); - - var msg374 = msg("PWC_KILL_FAILED", part396); - - var part397 = match("MESSAGE#370:PWC_KQUEUE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: kevent failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","kevent failed"), - dup23, - ])); - - var msg375 = msg("PWC_KQUEUE_ERROR", part397); - - var part398 = match("MESSAGE#371:PWC_KQUEUE_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create kqueue: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create kqueue"), - dup23, - ])); - - var msg376 = msg("PWC_KQUEUE_INIT", part398); - - var part399 = match("MESSAGE#372:PWC_KQUEUE_REGISTER_FILTER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to register kqueue filter: %{agent->} for purpose: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to register kqueue filter"), - dup23, - ])); - - var msg377 = msg("PWC_KQUEUE_REGISTER_FILTER", part399); - - var part400 = match("MESSAGE#373:PWC_LOCKFILE_BAD_FORMAT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file has bad format: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file has bad format"), - dup23, - ])); - - var msg378 = msg("PWC_LOCKFILE_BAD_FORMAT", part400); - - var part401 = match("MESSAGE#374:PWC_LOCKFILE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file had error: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file error"), - dup23, - ])); - - var msg379 = msg("PWC_LOCKFILE_ERROR", part401); - - var part402 = match("MESSAGE#375:PWC_LOCKFILE_MISSING", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file not found: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file not found"), - dup23, - ])); - - var msg380 = msg("PWC_LOCKFILE_MISSING", part402); - - var part403 = match("MESSAGE#376:PWC_LOCKFILE_NOT_LOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PID lock file not locked: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","PID lock file not locked"), - dup23, - ])); - - var msg381 = msg("PWC_LOCKFILE_NOT_LOCKED", part403); - - var part404 = match("MESSAGE#377:PWC_NO_PROCESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No process specified", processor_chain([ - dup30, - dup22, - setc("event_description","No process specified for PWC"), - dup23, - ])); - - var msg382 = msg("PWC_NO_PROCESS", part404); - - var part405 = match("MESSAGE#378:PWC_PROCESS_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pwc process %{agent->} child %{child_pid->} exited with status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","pwc process exited with status"), - dup23, - ])); - - var msg383 = msg("PWC_PROCESS_EXIT", part405); - - var part406 = match("MESSAGE#379:PWC_PROCESS_FORCED_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} forcing hold down of child %{child_pid->} until signal", processor_chain([ - dup21, - dup22, - setc("event_description","Process forcing hold down of child until signalled"), - dup23, - ])); - - var msg384 = msg("PWC_PROCESS_FORCED_HOLD", part406); - - var part407 = match("MESSAGE#380:PWC_PROCESS_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} holding down child %{child_pid->} until signal", processor_chain([ - dup21, - dup22, - setc("event_description","Process holding down child until signalled"), - dup23, - ])); - - var msg385 = msg("PWC_PROCESS_HOLD", part407); - - var part408 = match("MESSAGE#381:PWC_PROCESS_HOLD_SKIPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} will not down child %{child_pid->} because of %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Process not holding down child"), - dup23, - ])); - - var msg386 = msg("PWC_PROCESS_HOLD_SKIPPED", part408); - - var part409 = match("MESSAGE#382:PWC_PROCESS_OPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to create child process with pidpopen: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to create child process with pidpopen"), - dup23, - ])); - - var msg387 = msg("PWC_PROCESS_OPEN", part409); - - var part410 = match("MESSAGE#383:PWC_PROCESS_TIMED_HOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process %{agent->} holding down child %{child_pid->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Process holding down child"), - dup23, - ])); - - var msg388 = msg("PWC_PROCESS_TIMED_HOLD", part410); - - var part411 = match("MESSAGE#384:PWC_PROCESS_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child timed out %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Child process timed out"), - dup23, - ])); - - var msg389 = msg("PWC_PROCESS_TIMEOUT", part411); - - var part412 = match("MESSAGE#385:PWC_SIGNAL_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: signal(%{agent}) failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","signal failure"), - dup23, - ])); - - var msg390 = msg("PWC_SIGNAL_INIT", part412); - - var part413 = match("MESSAGE#386:PWC_SOCKET_CONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to connect socket to %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to connect socket to service"), - dup23, - ])); - - var msg391 = msg("PWC_SOCKET_CONNECT", part413); - - var part414 = match("MESSAGE#387:PWC_SOCKET_CREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Failed to create socket: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Failed to create socket"), - dup23, - ])); - - var msg392 = msg("PWC_SOCKET_CREATE", part414); - - var part415 = match("MESSAGE#388:PWC_SOCKET_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to set socket option %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to set socket option"), - dup23, - ])); - - var msg393 = msg("PWC_SOCKET_OPTION", part415); - - var part416 = match("MESSAGE#389:PWC_STDOUT_WRITE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Write to stdout failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Write to stdout failed"), - dup23, - ])); - - var msg394 = msg("PWC_STDOUT_WRITE", part416); - - var part417 = match("MESSAGE#390:PWC_SYSTEM_CALL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","PWC SYSTEM CALL"), - dup23, - ])); - - var msg395 = msg("PWC_SYSTEM_CALL", part417); - - var part418 = match("MESSAGE#391:PWC_UNKNOWN_KILL_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unknown kill option [%{agent}]", processor_chain([ - dup30, - dup22, - setc("event_description","Unknown kill option"), - dup23, - ])); - - var msg396 = msg("PWC_UNKNOWN_KILL_OPTION", part418); - - var part419 = match("MESSAGE#392:RMOPD_ADDRESS_MULTICAST_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Multicast address is not allowed", processor_chain([ - dup30, - dup22, - setc("event_description","Multicast address not allowed"), - dup23, - ])); - - var msg397 = msg("RMOPD_ADDRESS_MULTICAST_INVALID", part419); - - var part420 = match("MESSAGE#393:RMOPD_ADDRESS_SOURCE_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Source address invalid: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RMOPD ADDRESS SOURCE INVALID"), - dup23, - ])); - - var msg398 = msg("RMOPD_ADDRESS_SOURCE_INVALID", part420); - - var part421 = match("MESSAGE#394:RMOPD_ADDRESS_STRING_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to convert numeric address to string: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to convert numeric address to string"), - dup23, - ])); - - var msg399 = msg("RMOPD_ADDRESS_STRING_FAILURE", part421); - - var part422 = match("MESSAGE#395:RMOPD_ADDRESS_TARGET_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: rmop_util_set_address status message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","rmop_util_set_address status message invalid"), - dup23, - ])); - - var msg400 = msg("RMOPD_ADDRESS_TARGET_INVALID", part422); - - var msg401 = msg("RMOPD_DUPLICATE", dup141); - - var part423 = match("MESSAGE#397:RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Only IPv4 source address is supported", processor_chain([ - dup30, - dup22, - setc("event_description","Only IPv4 source address is supported"), - dup23, - ])); - - var msg402 = msg("RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED", part423); - - var part424 = match("MESSAGE#398:RMOPD_ICMP_SENDMSG_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{fld1}: No route to host", processor_chain([ - dup30, - dup22, - setc("event_description","No route to host"), - dup23, - ])); - - var msg403 = msg("RMOPD_ICMP_SENDMSG_FAILURE", part424); - - var part425 = match("MESSAGE#399:RMOPD_IFINDEX_NOT_ACTIVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifindex: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","IFINDEX NOT ACTIVE"), - dup23, - ])); - - var msg404 = msg("RMOPD_IFINDEX_NOT_ACTIVE", part425); - - var part426 = match("MESSAGE#400:RMOPD_IFINDEX_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for %{interface}, message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IFINDEX NO INFO"), - dup23, - ])); - - var msg405 = msg("RMOPD_IFINDEX_NO_INFO", part426); - - var part427 = match("MESSAGE#401:RMOPD_IFNAME_NOT_ACTIVE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifname: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","RMOPD IFNAME NOT ACTIVE"), - dup23, - ])); - - var msg406 = msg("RMOPD_IFNAME_NOT_ACTIVE", part427); - - var part428 = match("MESSAGE#402:RMOPD_IFNAME_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for %{interface}, message: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IFNAME NO INFO"), - dup23, - ])); - - var msg407 = msg("RMOPD_IFNAME_NO_INFO", part428); - - var part429 = match("MESSAGE#403:RMOPD_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","RMOPD Must be run as root"), - dup23, - ])); - - var msg408 = msg("RMOPD_NOT_ROOT", part429); - - var part430 = match("MESSAGE#404:RMOPD_ROUTING_INSTANCE_NO_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No information for routing instance %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","No information for routing instance"), - dup23, - ])); - - var msg409 = msg("RMOPD_ROUTING_INSTANCE_NO_INFO", part430); - - var part431 = match("MESSAGE#405:RMOPD_TRACEROUTE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TRACEROUTE ERROR"), - dup23, - ])); - - var msg410 = msg("RMOPD_TRACEROUTE_ERROR", part431); - - var part432 = match("MESSAGE#406:RMOPD_usage", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}: %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","RMOPD usage"), - dup23, - ])); - - var msg411 = msg("RMOPD_usage", part432); - - var part433 = match("MESSAGE#407:RPD_ABORT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} version built by builder on %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD ABORT"), - dup23, - ])); - - var msg412 = msg("RPD_ABORT", part433); - - var part434 = match("MESSAGE#408:RPD_ACTIVE_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Exiting with active tasks: %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD exiting with active tasks"), - dup23, - ])); - - var msg413 = msg("RPD_ACTIVE_TERMINATE", part434); - - var part435 = match("MESSAGE#409:RPD_ASSERT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Assertion failed %{resultcode}: file \"%{filename}\", line %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD Assertion failed"), - dup23, - ])); - - var msg414 = msg("RPD_ASSERT", part435); - - var part436 = match("MESSAGE#410:RPD_ASSERT_SOFT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Soft assertion failed %{resultcode}: file \"%{filename}\", line %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD Soft assertion failed"), - dup23, - ])); - - var msg415 = msg("RPD_ASSERT_SOFT", part436); - - var part437 = match("MESSAGE#411:RPD_EXIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} version built by builder on %{dclass_counter1}", processor_chain([ - dup21, - dup22, - setc("event_description","RPD EXIT"), - dup23, - ])); - - var msg416 = msg("RPD_EXIT", part437); - - var msg417 = msg("RPD_IFL_INDEXCOLLISION", dup147); - - var msg418 = msg("RPD_IFL_NAMECOLLISION", dup147); - - var part438 = match("MESSAGE#414:RPD_ISIS_ADJDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS lost %{dclass_counter1->} adjacency to %{dclass_counter2->} on %{interface}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS lost adjacency"), - dup23, - ])); - - var msg419 = msg("RPD_ISIS_ADJDOWN", part438); - - var part439 = match("MESSAGE#415:RPD_ISIS_ADJUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS new %{dclass_counter1->} adjacency to %{dclass_counter2->} %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","IS-IS new adjacency"), - dup23, - ])); - - var msg420 = msg("RPD_ISIS_ADJUP", part439); - - var part440 = match("MESSAGE#416:RPD_ISIS_ADJUPNOIP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS new %{dclass_counter1->} adjacency to %{dclass_counter2->} %{interface->} without an address", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS new adjacency without an address"), - dup23, - ])); - - var msg421 = msg("RPD_ISIS_ADJUPNOIP", part440); - - var part441 = match("MESSAGE#417:RPD_ISIS_LSPCKSUM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS %{dclass_counter1->} LSP checksum error, interface %{interface}, LSP id %{id}, sequence %{dclass_counter2}, checksum %{resultcode}, lifetime %{fld2}", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS LSP checksum error on iterface"), - dup23, - ])); - - var msg422 = msg("RPD_ISIS_LSPCKSUM", part441); - - var part442 = match("MESSAGE#418:RPD_ISIS_OVERLOAD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: IS-IS database overload", processor_chain([ - dup30, - dup22, - setc("event_description","IS-IS database overload"), - dup23, - ])); - - var msg423 = msg("RPD_ISIS_OVERLOAD", part442); - - var part443 = match("MESSAGE#419:RPD_KRT_AFUNSUPRT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{resultcode}: received %{agent->} message with unsupported address family %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","message with unsupported address family received"), - dup23, - ])); - - var msg424 = msg("RPD_KRT_AFUNSUPRT", part443); - - var part444 = match("MESSAGE#420:RPD_KRT_CCC_IFL_MODIFY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}, error", processor_chain([ - dup30, - dup22, - setc("event_description","RPD KRT CCC IFL MODIFY"), - dup23, - ])); - - var msg425 = msg("RPD_KRT_CCC_IFL_MODIFY", part444); - - var part445 = match("MESSAGE#421:RPD_KRT_DELETED_RTT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: received deleted routing table from the kernel for family %{dclass_counter1->} table ID %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","received deleted routing table from kernel"), - dup23, - ])); - - var msg426 = msg("RPD_KRT_DELETED_RTT", part445); - - var part446 = match("MESSAGE#422:RPD_KRT_IFA_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifa generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifa generation mismatch"), - dup23, - ])); - - var msg427 = msg("RPD_KRT_IFA_GENERATION", part446); - - var part447 = match("MESSAGE#423:RPD_KRT_IFDCHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} CHANGE for ifd %{interface->} failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","CHANGE for ifd failed"), - dup23, - ])); - - var msg428 = msg("RPD_KRT_IFDCHANGE", part447); - - var part448 = match("MESSAGE#424:RPD_KRT_IFDEST_GET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type->} SERVICE: %{service->} for ifd %{interface->} failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","GET SERVICE failure on interface"), - dup23, - ])); - - var msg429 = msg("RPD_KRT_IFDEST_GET", part448); - - var part449 = match("MESSAGE#425:RPD_KRT_IFDGET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} GET index for ifd interface failed, error \"%{result}\"", processor_chain([ - dup30, - dup22, - setc("event_description","GET index for ifd interface failed"), - dup23, - ])); - - var msg430 = msg("RPD_KRT_IFDGET", part449); - - var part450 = match("MESSAGE#426:RPD_KRT_IFD_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifd %{dclass_counter1->} generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifd generation mismatch"), - dup23, - ])); - - var msg431 = msg("RPD_KRT_IFD_GENERATION", part450); - - var part451 = match("MESSAGE#427:RPD_KRT_IFL_CELL_RELAY_MODE_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl : %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","KRT IFL CELL RELAY MODE INVALID"), - dup23, - ])); - - var msg432 = msg("RPD_KRT_IFL_CELL_RELAY_MODE_INVALID", part451); - - var part452 = match("MESSAGE#428:RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl : %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","KRT IFL CELL RELAY MODE UNSPECIFIED"), - dup23, - ])); - - var msg433 = msg("RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED", part452); - - var part453 = match("MESSAGE#429:RPD_KRT_IFL_GENERATION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifl %{interface->} generation mismatch -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","ifl generation mismatch"), - dup23, - ])); - - var msg434 = msg("RPD_KRT_IFL_GENERATION", part453); - - var part454 = match("MESSAGE#430:RPD_KRT_KERNEL_BAD_ROUTE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: lost %{interface->} %{dclass_counter1->} for route %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","lost interface for route"), - dup23, - ])); - - var msg435 = msg("RPD_KRT_KERNEL_BAD_ROUTE", part454); - - var part455 = match("MESSAGE#431:RPD_KRT_NEXTHOP_OVERFLOW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: number of next hops (%{dclass_counter1}) exceeded the maximum allowed (%{dclass_counter2}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","number of next hops exceeded the maximum"), - dup23, - ])); - - var msg436 = msg("RPD_KRT_NEXTHOP_OVERFLOW", part455); - - var part456 = match("MESSAGE#432:RPD_KRT_NOIFD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No device %{dclass_counter1->} for interface %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","No device for interface"), - dup23, - ])); - - var msg437 = msg("RPD_KRT_NOIFD", part456); - - var part457 = match("MESSAGE#433:RPD_KRT_UNKNOWN_RTT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: received routing table message for unknown table with kernel ID %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","received routing table message for unknown table"), - dup23, - ])); - - var msg438 = msg("RPD_KRT_UNKNOWN_RTT", part457); - - var part458 = match("MESSAGE#434:RPD_KRT_VERSION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket version mismatch (%{info}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket version mismatch"), - dup23, - ])); - - var msg439 = msg("RPD_KRT_VERSION", part458); - - var part459 = match("MESSAGE#435:RPD_KRT_VERSIONNONE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket message type %{agent}'s version is not supported by kernel, %{info->} -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket message type not supported by kernel"), - dup23, - ])); - - var msg440 = msg("RPD_KRT_VERSIONNONE", part459); - - var part460 = match("MESSAGE#436:RPD_KRT_VERSIONOLD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Routing socket message type %{agent}'s version is older than expected (%{info}) -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Routing socket message type version is older than expected"), - dup23, - ])); - - var msg441 = msg("RPD_KRT_VERSIONOLD", part460); - - var part461 = match("MESSAGE#437:RPD_LDP_INTF_BLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Duplicate session ID detected from %{daddr}, interface %{interface}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Duplicate session ID detected"), - dup23, - ])); - - var msg442 = msg("RPD_LDP_INTF_BLOCKED", part461); - - var part462 = match("MESSAGE#438:RPD_LDP_INTF_UNBLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP interface %{interface->} is now %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","LDP interface now unblocked"), - dup23, - ])); - - var msg443 = msg("RPD_LDP_INTF_UNBLOCKED", part462); - - var part463 = match("MESSAGE#439:RPD_LDP_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP neighbor %{daddr->} (%{interface}) is %{result}", processor_chain([ - setc("eventcategory","1603030000"), - dup22, - setc("event_description","LDP neighbor down"), - dup23, - ])); - - var msg444 = msg("RPD_LDP_NBRDOWN", part463); - - var part464 = match("MESSAGE#440:RPD_LDP_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP neighbor %{daddr->} (%{interface}) is %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","LDP neighbor up"), - dup23, - ])); - - var msg445 = msg("RPD_LDP_NBRUP", part464); - - var part465 = match("MESSAGE#441:RPD_LDP_SESSIONDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP session %{daddr->} is down, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LDP session down"), - dup23, - ])); - - var msg446 = msg("RPD_LDP_SESSIONDOWN", part465); - - var part466 = match("MESSAGE#442:RPD_LDP_SESSIONUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: LDP session %{daddr->} is up", processor_chain([ - dup21, - dup22, - setc("event_description","LDP session up"), - dup23, - ])); - - var msg447 = msg("RPD_LDP_SESSIONUP", part466); - - var part467 = match("MESSAGE#443:RPD_LOCK_FLOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain a lock on %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain a lock"), - dup23, - ])); - - var msg448 = msg("RPD_LOCK_FLOCKED", part467); - - var part468 = match("MESSAGE#444:RPD_LOCK_LOCKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to obtain a lock on %{agent}, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to obtain service lock"), - dup23, - ])); - - var msg449 = msg("RPD_LOCK_LOCKED", part468); - - var part469 = match("MESSAGE#445:RPD_MPLS_LSP_CHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result->} Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP CHANGE"), - dup23, - ])); - - var msg450 = msg("RPD_MPLS_LSP_CHANGE", part469); - - var part470 = match("MESSAGE#446:RPD_MPLS_LSP_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MPLS LSP DOWN"), - dup23, - ])); - - var msg451 = msg("RPD_MPLS_LSP_DOWN", part470); - - var part471 = match("MESSAGE#447:RPD_MPLS_LSP_SWITCH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result}, Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP SWITCH"), - dup23, - ])); - - var msg452 = msg("RPD_MPLS_LSP_SWITCH", part471); - - var part472 = match("MESSAGE#448:RPD_MPLS_LSP_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MPLS LSP %{interface->} %{result->} Route %{info}", processor_chain([ - dup21, - dup22, - setc("event_description","MPLS LSP UP"), - dup23, - ])); - - var msg453 = msg("RPD_MPLS_LSP_UP", part472); - - var part473 = match("MESSAGE#449:RPD_MSDP_PEER_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MSDP peer %{group->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","MSDP PEER DOWN"), - dup23, - ])); - - var msg454 = msg("RPD_MSDP_PEER_DOWN", part473); - - var part474 = match("MESSAGE#450:RPD_MSDP_PEER_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: MSDP peer %{group->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","MSDP PEER UP"), - dup23, - ])); - - var msg455 = msg("RPD_MSDP_PEER_UP", part474); - - var part475 = match("MESSAGE#451:RPD_OSPF_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: OSPF neighbor %{daddr->} (%{interface}) %{disposition->} due to %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","OSPF neighbor down"), - dup23, - ])); - - var msg456 = msg("RPD_OSPF_NBRDOWN", part475); - - var part476 = match("MESSAGE#452:RPD_OSPF_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: OSPF neighbor %{daddr->} (%{interface}) %{disposition->} due to %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","OSPF neighbor up"), - dup23, - ])); - - var msg457 = msg("RPD_OSPF_NBRUP", part476); - - var part477 = match("MESSAGE#453:RPD_OS_MEMHIGH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Using %{dclass_counter1->} KB of memory, %{info}", processor_chain([ - dup51, - dup22, - setc("event_description","OS MEMHIGH"), - dup23, - ])); - - var msg458 = msg("RPD_OS_MEMHIGH", part477); - - var part478 = match("MESSAGE#454:RPD_PIM_NBRDOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PIM neighbor %{daddr->} timeout interface %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","PIM neighbor down"), - setc("result","timeout"), - dup23, - ])); - - var msg459 = msg("RPD_PIM_NBRDOWN", part478); - - var part479 = match("MESSAGE#455:RPD_PIM_NBRUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: PIM new neighbor %{daddr->} interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","PIM neighbor up"), - dup23, - ])); - - var msg460 = msg("RPD_PIM_NBRUP", part479); - - var part480 = match("MESSAGE#456:RPD_RDISC_CKSUM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Bad checksum for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Bad checksum for router solicitation"), - dup23, - ])); - - var msg461 = msg("RPD_RDISC_CKSUM", part480); - - var part481 = match("MESSAGE#457:RPD_RDISC_NOMULTI", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Ignoring interface %{dclass_counter1->} on %{interface->} -- %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Ignoring interface"), - dup23, - ])); - - var msg462 = msg("RPD_RDISC_NOMULTI", part481); - - var part482 = match("MESSAGE#458:RPD_RDISC_NORECVIF", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to locate interface for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to locate interface for router"), - dup23, - ])); - - var msg463 = msg("RPD_RDISC_NORECVIF", part482); - - var part483 = match("MESSAGE#459:RPD_RDISC_SOLICITADDR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Expected multicast (%{dclass_counter1}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Expected multicast for router solicitation"), - dup23, - ])); - - var msg464 = msg("RPD_RDISC_SOLICITADDR", part483); - - var part484 = match("MESSAGE#460:RPD_RDISC_SOLICITICMP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Nonzero ICMP code (%{resultcode}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Nonzero ICMP code for router solicitation"), - dup23, - ])); - - var msg465 = msg("RPD_RDISC_SOLICITICMP", part484); - - var part485 = match("MESSAGE#461:RPD_RDISC_SOLICITLEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Insufficient length (%{dclass_counter1}) for router solicitation from %{saddr->} to %{daddr}", processor_chain([ - dup30, - dup22, - setc("event_description","Insufficient length for router solicitation"), - dup23, - ])); - - var msg466 = msg("RPD_RDISC_SOLICITLEN", part485); - - var part486 = match("MESSAGE#462:RPD_RIP_AUTH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Update with invalid authentication from %{saddr->} (%{interface})", processor_chain([ - dup30, - dup22, - setc("event_description","RIP update with invalid authentication"), - dup23, - ])); - - var msg467 = msg("RPD_RIP_AUTH", part486); - - var part487 = match("MESSAGE#463:RPD_RIP_JOIN_BROADCAST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to get broadcast address %{interface}; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RIP - unable to get broadcast address"), - dup23, - ])); - - var msg468 = msg("RPD_RIP_JOIN_BROADCAST", part487); - - var part488 = match("MESSAGE#464:RPD_RIP_JOIN_MULTICAST", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to join multicast group %{interface}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RIP - Unable to join multicast group"), - dup23, - ])); - - var msg469 = msg("RPD_RIP_JOIN_MULTICAST", part488); - - var part489 = match("MESSAGE#465:RPD_RT_IFUP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: UP route for interface %{interface->} index %{dclass_counter1->} %{saddr}/%{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","RIP interface up"), - dup23, - ])); - - var msg470 = msg("RPD_RT_IFUP", part489); - - var msg471 = msg("RPD_SCHED_CALLBACK_LONGRUNTIME", dup148); - - var part490 = match("MESSAGE#467:RPD_SCHED_CUMULATIVE_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime (%{result}) after action of module", processor_chain([ - dup30, - dup22, - setc("event_description","excessive runtime after action of module"), - dup23, - ])); - - var msg472 = msg("RPD_SCHED_CUMULATIVE_LONGRUNTIME", part490); - - var msg473 = msg("RPD_SCHED_MODULE_LONGRUNTIME", dup148); - - var part491 = match("MESSAGE#469:RPD_SCHED_TASK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} ran for %{dclass_counter1}(%{dclass_counter2})", processor_chain([ - dup30, - dup22, - setc("event_description","task extended runtime"), - dup23, - ])); - - var msg474 = msg("RPD_SCHED_TASK_LONGRUNTIME", part491); - - var part492 = match("MESSAGE#470:RPD_SIGNAL_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} termination signal received", processor_chain([ - dup30, - dup22, - setc("event_description","termination signal received for service"), - dup23, - ])); - - var msg475 = msg("RPD_SIGNAL_TERMINATE", part492); - - var part493 = match("MESSAGE#471:RPD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Start %{dclass_counter1->} version version built %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","version built"), - dup23, - ])); - - var msg476 = msg("RPD_START", part493); - - var part494 = match("MESSAGE#472:RPD_SYSTEM", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: detail: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","system command"), - dup23, - ])); - - var msg477 = msg("RPD_SYSTEM", part494); - - var part495 = match("MESSAGE#473:RPD_TASK_BEGIN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Commencing routing updates, version %{dclass_counter1}, built %{dclass_counter2->} by builder", processor_chain([ - dup21, - dup22, - setc("event_description","Commencing routing updates"), - dup23, - ])); - - var msg478 = msg("RPD_TASK_BEGIN", part495); - - var part496 = match("MESSAGE#474:RPD_TASK_CHILDKILLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","task killed by signal"), - dup23, - ])); - - var msg479 = msg("RPD_TASK_CHILDKILLED", part496); - - var part497 = match("MESSAGE#475:RPD_TASK_CHILDSTOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","task stopped by signal"), - dup23, - ])); - - var msg480 = msg("RPD_TASK_CHILDSTOPPED", part497); - - var part498 = match("MESSAGE#476:RPD_TASK_FORK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fork task: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fork task"), - dup23, - ])); - - var msg481 = msg("RPD_TASK_FORK", part498); - - var part499 = match("MESSAGE#477:RPD_TASK_GETWD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: getwd: %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","RPD TASK GETWD"), - dup23, - ])); - - var msg482 = msg("RPD_TASK_GETWD", part499); - - var part500 = match("MESSAGE#478:RPD_TASK_NOREINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitialization not possible", processor_chain([ - dup30, - dup22, - setc("event_description","Reinitialization not possible"), - dup23, - ])); - - var msg483 = msg("RPD_TASK_NOREINIT", part500); - - var part501 = match("MESSAGE#479:RPD_TASK_PIDCLOSED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to close and remove %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to close and remove task"), - dup23, - ])); - - var msg484 = msg("RPD_TASK_PIDCLOSED", part501); - - var part502 = match("MESSAGE#480:RPD_TASK_PIDFLOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: flock(%{agent}, %{action}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RPD TASK PIDFLOCK"), - dup23, - ])); - - var msg485 = msg("RPD_TASK_PIDFLOCK", part502); - - var part503 = match("MESSAGE#481:RPD_TASK_PIDWRITE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to write %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to write"), - dup23, - ])); - - var msg486 = msg("RPD_TASK_PIDWRITE", part503); - - var msg487 = msg("RPD_TASK_REINIT", dup149); - - var part504 = match("MESSAGE#483:RPD_TASK_SIGNALIGNORE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: sigaction(%{result}): %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","ignoring task signal"), - dup23, - ])); - - var msg488 = msg("RPD_TASK_SIGNALIGNORE", part504); - - var part505 = match("MESSAGE#484:RT_COS", "nwparser.payload", "%{process}: %{event_type}: COS IPC op %{dclass_counter1->} (%{agent}) failed, err %{resultcode->} (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","COS IPC op failed"), - dup23, - ])); - - var msg489 = msg("RT_COS", part505); - - var part506 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/2", "nwparser.p0", "%{fld5}\" nat-source-address=\"%{stransaddr}\" nat-source-port=\"%{stransport}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var part507 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{fld10}\" dst-nat-rule-%{p0}"); - - var part508 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_0", "nwparser.p0", "type=%{fld21->} dst-nat-rule-name=\"%{p0}"); - - var select39 = linear_select([ - part508, - dup91, - ]); - - var part509 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/6", "nwparser.p0", "\"%{fld11->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{fld13}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\"%{p0}"); - - var part510 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" encrypted=%{fld8->} %{p0}"); - - var select40 = linear_select([ - part510, - dup45, - ]); - - var all22 = all_match({ - processors: [ - dup87, - dup150, - part506, - dup151, - part507, - select39, - part509, - select40, - dup92, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - dup52, - ]), - }); - - var msg490 = msg("RT_FLOW_SESSION_CREATE:02", all22); - - var part511 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/1_0", "nwparser.p0", " service-name=\"%{service}\" nat-source-address=\"%{stransaddr}\" nat-source-port=\"%{stransport}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" src-nat-rule-type=\"%{fld20}\" src-nat-rule-name=\"%{rulename}\" dst-nat-rule-type=\"%{fld10}\" dst-nat-rule-name=\"%{rule_template}\"%{p0}"); - - var select41 = linear_select([ - part511, - dup45, - ]); - - var part512 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/2", "nwparser.p0", "%{}protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\"%{p0}"); - - var part513 = match("MESSAGE#486:RT_FLOW_SESSION_CREATE/3_0", "nwparser.p0", " source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" username=\"%{username}\" roles=\"%{fld50}\" packet-incoming-interface=\"%{dinterface}\" application=\"%{application}\" nested-application=\"%{fld7}\" encrypted=\"%{fld8}\"%{p0}"); - - var select42 = linear_select([ - part513, - dup45, - ]); - - var all23 = all_match({ - processors: [ - dup87, - select41, - part512, - select42, - dup92, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - dup52, - ]), - }); - - var msg491 = msg("RT_FLOW_SESSION_CREATE", all23); - - var part514 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/0_0", "nwparser.payload", "%{process}: %{event_type}: session created %{p0}"); - - var part515 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/0_1", "nwparser.payload", "%{event_type}: session created %{p0}"); - - var select43 = linear_select([ - part514, - part515, - ]); - - var part516 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{p0}"); - - var part517 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_0", "nwparser.p0", "%{rulename->} %{rule_template->} %{fld12->} %{fld13->} %{fld14->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username}(%{fld10}) %{interface->} %{protocol->} %{fld15->} UNKNOWN UNKNOWN"); - - var part518 = match("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_1", "nwparser.p0", "%{rulename->} %{rule_template->} %{fld12->} %{fld13->} %{fld14->} %{policyname->} %{src_zone->} %{dst_zone->} %{sessionid->} %{username}(%{fld10}) %{interface->} %{fld15}"); - - var part519 = match_copy("MESSAGE#487:RT_FLOW_SESSION_CREATE:01/2_2", "nwparser.p0", "info"); - - var select44 = linear_select([ - part517, - part518, - part519, - ]); - - var all24 = all_match({ - processors: [ - select43, - part516, - select44, - ], - on_success: processor_chain([ - dup28, - dup53, - dup54, - dup22, - setc("event_description","session created"), - dup23, - ]), - }); - - var msg492 = msg("RT_FLOW_SESSION_CREATE:01", all24); - - var select45 = linear_select([ - msg490, - msg491, - msg492, - ]); - - var part520 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/2", "nwparser.p0", "%{fld5}\" protocol-id=\"%{protocol}\" icmp-type=\"%{obj_type}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{user_role}\" packet-incoming-interface=\"%{dinterface}\"%{p0}"); - - var part521 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/3_0", "nwparser.p0", " encrypted=\"%{fld16}\" reason=\"%{result}\" src-vrf-grp=\"%{fld99}\" dst-vrf-grp=\"%{fld98}\"%{p0}"); - - var part522 = match("MESSAGE#488:RT_FLOW_SESSION_DENY:02/3_1", "nwparser.p0", " encrypted=%{fld16->} reason=\"%{result}\"%{p0}"); - - var select46 = linear_select([ - part521, - part522, - dup45, - ]); - - var all25 = all_match({ - processors: [ - dup87, - dup150, - part520, - select46, - dup92, - ], - on_success: processor_chain([ - dup93, - dup53, - dup94, - dup22, - dup52, - ]), - }); - - var msg493 = msg("RT_FLOW_SESSION_DENY:02", all25); - - var part523 = match("MESSAGE#489:RT_FLOW_SESSION_DENY", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" icmp-type=\"%{obj_type}\" policy-name=\"%{policyname}\"]", processor_chain([ - dup93, - dup53, - dup94, - dup22, - dup52, - ])); - - var msg494 = msg("RT_FLOW_SESSION_DENY", part523); - - var part524 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{fld1->} %{result->} %{src_zone->} %{dst_zone->} HTTP %{info}"); - - var all26 = all_match({ - processors: [ - dup152, - part524, - ], - on_success: processor_chain([ - dup27, - dup53, - dup94, - dup22, - dup97, - dup23, - ]), - }); - - var msg495 = msg("RT_FLOW_SESSION_DENY:03", all26); - - var part525 = match("MESSAGE#491:RT_FLOW_SESSION_DENY:01/1", "nwparser.p0", "%{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{fld1->} %{result->} %{src_zone->} %{dst_zone}"); - - var all27 = all_match({ - processors: [ - dup152, - part525, - ], - on_success: processor_chain([ - dup27, - dup53, - dup94, - dup22, - dup97, - dup23, - ]), - }); - - var msg496 = msg("RT_FLOW_SESSION_DENY:01", all27); - - var select47 = linear_select([ - msg493, - msg494, - msg495, - msg496, - ]); - - var select48 = linear_select([ - dup103, - dup45, - ]); - - var all28 = all_match({ - processors: [ - dup98, - dup150, - dup99, - dup151, - dup100, - dup153, - dup102, - select48, - dup92, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup104, - dup22, - dup52, - ]), - }); - - var msg497 = msg("RT_FLOW_SESSION_CLOSE:01", all28); - - var part526 = match("MESSAGE#493:RT_FLOW_SESSION_CLOSE", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" inbound-packets=\"%{packets}\" inbound-bytes=\"%{rbytes}\" outbound-packets=\"%{dclass_counter1}\" outbound-bytes=\"%{sbytes}\" elapsed-time=\"%{duration}\"]", processor_chain([ - dup27, - dup53, - dup55, - dup22, - dup52, - ])); - - var msg498 = msg("RT_FLOW_SESSION_CLOSE", part526); - - var part527 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/0_0", "nwparser.payload", "%{process}: %{event_type}: session closed %{p0}"); - - var part528 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/0_1", "nwparser.payload", "%{event_type}: session closed %{p0}"); - - var select49 = linear_select([ - part527, - part528, - ]); - - var part529 = match("MESSAGE#494:RT_FLOW_SESSION_CLOSE:02/1", "nwparser.p0", "%{result}: %{saddr}/%{sport}->%{daddr}/%{dport->} %{fld20->} %{hostip}/%{network_port}->%{dtransaddr}/%{dtransport->} %{info}"); - - var all29 = all_match({ - processors: [ - select49, - part529, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup22, - setc("event_description","session closed"), - dup23, - ]), - }); - - var msg499 = msg("RT_FLOW_SESSION_CLOSE:02", all29); - - var part530 = match("MESSAGE#495:RT_FLOW_SESSION_CLOSE:03/7_1", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{user_role}\" packet-incoming-interface=\"%{dinterface}\" %{p0}"); - - var select50 = linear_select([ - dup103, - part530, - dup45, - ]); - - var part531 = match("MESSAGE#495:RT_FLOW_SESSION_CLOSE:03/8", "nwparser.p0", "] session closed %{fld60}: %{fld51}/%{fld52}->%{fld53}/%{fld54->} %{fld55->} %{fld56}/%{fld57}->%{fld58}/%{fld59->} %{info}"); - - var all30 = all_match({ - processors: [ - dup98, - dup150, - dup99, - dup151, - dup100, - dup153, - dup102, - select50, - part531, - ], - on_success: processor_chain([ - dup27, - dup53, - dup55, - dup104, - dup22, - dup52, - dup61, - ]), - }); - - var msg500 = msg("RT_FLOW_SESSION_CLOSE:03", all30); - - var select51 = linear_select([ - msg497, - msg498, - msg499, - msg500, - ]); - - var part532 = match("MESSAGE#496:RT_SCREEN_IP", "nwparser.payload", "%{process}: %{event_type}: Fragmented traffic! source:%{saddr}, destination: %{daddr}, protocol-id: %{protocol}, zone name: %{zone}, interface name: %{interface}", processor_chain([ - dup30, - dup22, - setc("event_description","Fragmented traffic"), - dup23, - ])); - - var msg501 = msg("RT_SCREEN_IP", part532); - - var part533 = match("MESSAGE#497:RT_SCREEN_IP:01", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" protocol-id=\"%{protocol}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg502 = msg("RT_SCREEN_IP:01", part533); - - var select52 = linear_select([ - msg501, - msg502, - ]); - - var msg503 = msg("RT_SCREEN_TCP", dup154); - - var part534 = match("MESSAGE#499:RT_SCREEN_SESSION_LIMIT", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" message=\"%{info}\" ip-address=\"%{hostip}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg504 = msg("RT_SCREEN_SESSION_LIMIT", part534); - - var msg505 = msg("RT_SCREEN_UDP", dup154); - - var part535 = match("MESSAGE#501:SERVICED_CLIENT_CONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: attempt to connect to interface failed with error: %{result}", processor_chain([ - dup27, - dup22, - setc("event_description","attempt to connect to interface failed"), - dup23, - ])); - - var msg506 = msg("SERVICED_CLIENT_CONNECT", part535); - - var part536 = match("MESSAGE#502:SERVICED_CLIENT_DISCONNECTED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unexpected termination of connection to interface", processor_chain([ - dup27, - dup22, - setc("event_description","unexpected termination of connection"), - dup23, - ])); - - var msg507 = msg("SERVICED_CLIENT_DISCONNECTED", part536); - - var part537 = match("MESSAGE#503:SERVICED_CLIENT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: client interface connection failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","client interface connection failure"), - dup23, - ])); - - var msg508 = msg("SERVICED_CLIENT_ERROR", part537); - - var part538 = match("MESSAGE#504:SERVICED_COMMAND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: remote command execution failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","remote command execution failed"), - dup23, - ])); - - var msg509 = msg("SERVICED_COMMAND_FAILED", part538); - - var part539 = match("MESSAGE#505:SERVICED_COMMIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: client failed to commit configuration with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","client commit configuration failed"), - dup23, - ])); - - var msg510 = msg("SERVICED_COMMIT_FAILED", part539); - - var part540 = match("MESSAGE#506:SERVICED_CONFIGURATION_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: configuration process failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","configuration process failed"), - dup23, - ])); - - var msg511 = msg("SERVICED_CONFIGURATION_FAILED", part540); - - var part541 = match("MESSAGE#507:SERVICED_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SERVICED CONFIG ERROR"), - dup23, - ])); - - var msg512 = msg("SERVICED_CONFIG_ERROR", part541); - - var part542 = match("MESSAGE#508:SERVICED_CONFIG_FILE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} failed to read path with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","service failed to read path"), - dup23, - ])); - - var msg513 = msg("SERVICED_CONFIG_FILE", part542); - - var part543 = match("MESSAGE#509:SERVICED_CONNECTION_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SERVICED CONNECTION ERROR"), - dup23, - ])); - - var msg514 = msg("SERVICED_CONNECTION_ERROR", part543); - - var part544 = match("MESSAGE#510:SERVICED_DISABLED_GGSN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: GGSN services disabled: object: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","GGSN services disabled"), - dup23, - ])); - - var msg515 = msg("SERVICED_DISABLED_GGSN", part544); - - var msg516 = msg("SERVICED_DUPLICATE", dup141); - - var part545 = match("MESSAGE#512:SERVICED_EVENT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: event function %{dclass_counter2->} failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","event function failed"), - dup23, - ])); - - var msg517 = msg("SERVICED_EVENT_FAILED", part545); - - var part546 = match("MESSAGE#513:SERVICED_INIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: initialization failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","service initialization failed"), - dup23, - ])); - - var msg518 = msg("SERVICED_INIT_FAILED", part546); - - var part547 = match("MESSAGE#514:SERVICED_MALLOC_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: failed to allocate [%{dclass_counter2}] object [%{dclass_counter1->} bytes %{bytes}]: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","memory allocation failure"), - dup23, - ])); - - var msg519 = msg("SERVICED_MALLOC_FAILURE", part547); - - var part548 = match("MESSAGE#515:SERVICED_NETWORK_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} had error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","NETWORK FAILURE"), - dup23, - ])); - - var msg520 = msg("SERVICED_NETWORK_FAILURE", part548); - - var part549 = match("MESSAGE#516:SERVICED_NOT_ROOT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Must be run as root", processor_chain([ - dup63, - dup22, - setc("event_description","SERVICED must be run as root"), - dup23, - ])); - - var msg521 = msg("SERVICED_NOT_ROOT", part549); - - var msg522 = msg("SERVICED_PID_FILE_LOCK", dup142); - - var msg523 = msg("SERVICED_PID_FILE_UPDATE", dup143); - - var part550 = match("MESSAGE#519:SERVICED_RTSOCK_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: routing socket sequence error, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","routing socket sequence error"), - dup23, - ])); - - var msg524 = msg("SERVICED_RTSOCK_SEQUENCE", part550); - - var part551 = match("MESSAGE#520:SERVICED_SIGNAL_HANDLER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: set up of signal name handler failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","set up of signal name handler failed"), - dup23, - ])); - - var msg525 = msg("SERVICED_SIGNAL_HANDLER", part551); - - var part552 = match("MESSAGE#521:SERVICED_SOCKET_CREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket create failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","socket create failed with error"), - dup23, - ])); - - var msg526 = msg("SERVICED_SOCKET_CREATE", part552); - - var part553 = match("MESSAGE#522:SERVICED_SOCKET_IO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket function %{dclass_counter2->} failed with error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","socket function failed"), - dup23, - ])); - - var msg527 = msg("SERVICED_SOCKET_IO", part553); - - var part554 = match("MESSAGE#523:SERVICED_SOCKET_OPTION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unable to set socket option %{dclass_counter2}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unable to set socket option"), - dup23, - ])); - - var msg528 = msg("SERVICED_SOCKET_OPTION", part554); - - var part555 = match("MESSAGE#524:SERVICED_STDLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{dclass_counter2->} had error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","STDLIB FAILURE"), - dup23, - ])); - - var msg529 = msg("SERVICED_STDLIB_FAILURE", part555); - - var part556 = match("MESSAGE#525:SERVICED_USAGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Incorrect usage: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Incorrect service usage"), - dup23, - ])); - - var msg530 = msg("SERVICED_USAGE", part556); - - var part557 = match("MESSAGE#526:SERVICED_WORK_INCONSISTENCY", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: object has unexpected value %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","object has unexpected value"), - dup23, - ])); - - var msg531 = msg("SERVICED_WORK_INCONSISTENCY", part557); - - var msg532 = msg("SSL_PROXY_SSL_SESSION_ALLOW", dup155); - - var msg533 = msg("SSL_PROXY_SSL_SESSION_DROP", dup155); - - var msg534 = msg("SSL_PROXY_SESSION_IGNORE", dup155); - - var part558 = match("MESSAGE#530:SNMP_NS_LOG_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: NET-SNMP version %{version->} AgentX subagent connected", processor_chain([ - dup21, - dup22, - setc("event_description","AgentX subagent connected"), - dup61, - dup23, - ])); - - var msg535 = msg("SNMP_NS_LOG_INFO", part558); - - var part559 = match("MESSAGE#531:SNMP_SUBAGENT_IPC_REG_ROWS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ns_subagent_register_mibs: registering %{dclass_counter1->} rows", processor_chain([ - dup21, - dup22, - setc("event_description","ns_subagent registering rows"), - dup61, - dup23, - ])); - - var msg536 = msg("SNMP_SUBAGENT_IPC_REG_ROWS", part559); - - var part560 = match("MESSAGE#532:SNMPD_ACCESS_GROUP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} access group %{group}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD ACCESS GROUP ERROR"), - dup23, - ])); - - var msg537 = msg("SNMPD_ACCESS_GROUP_ERROR", part560); - - var part561 = match("MESSAGE#533:SNMPD_AUTH_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unauthorized SNMP community from %{daddr->} to unknown community name (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","unauthorized SNMP community to unknown community name"), - dup23, - ])); - - var msg538 = msg("SNMPD_AUTH_FAILURE", part561); - - var part562 = match("MESSAGE#534:SNMPD_AUTH_FAILURE:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: failed input interface authorization from %{daddr->} to unknown (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","failed input interface authorization to unknown"), - dup23, - ])); - - var msg539 = msg("SNMPD_AUTH_FAILURE:01", part562); - - var part563 = match("MESSAGE#535:SNMPD_AUTH_FAILURE:02", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unauthorized SNMP community from %{daddr->} to %{saddr->} (%{pool_name})", processor_chain([ - dup30, - dup22, - dup105, - setc("result","unauthorized SNMP community "), - dup23, - ])); - - var msg540 = msg("SNMPD_AUTH_FAILURE:02", part563); - - var part564 = match("MESSAGE#595:SNMPD_AUTH_FAILURE:03", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} function-name=\"%{fld1}\" message=\"%{info}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" index1=\"%{fld4}\"]", processor_chain([ - dup30, - dup22, - dup105, - dup61, - dup62, - ])); - - var msg541 = msg("SNMPD_AUTH_FAILURE:03", part564); - - var select53 = linear_select([ - msg538, - msg539, - msg540, - msg541, - ]); - - var part565 = match("MESSAGE#536:SNMPD_AUTH_PRIVILEGES_EXCEEDED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{saddr}: request exceeded community privileges", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP request exceeded community privileges"), - dup23, - ])); - - var msg542 = msg("SNMPD_AUTH_PRIVILEGES_EXCEEDED", part565); - - var part566 = match("MESSAGE#537:SNMPD_AUTH_RESTRICTED_ADDRESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: request from address %{daddr->} not allowed", processor_chain([ - dup48, - dup22, - setc("event_description","SNMPD AUTH RESTRICTED ADDRESS"), - setc("result","request not allowed"), - dup23, - ])); - - var msg543 = msg("SNMPD_AUTH_RESTRICTED_ADDRESS", part566); - - var part567 = match("MESSAGE#538:SNMPD_AUTH_WRONG_PDU_TYPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{saddr}: unauthorized SNMP PDU type: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","unauthorized SNMP PDU type"), - dup23, - ])); - - var msg544 = msg("SNMPD_AUTH_WRONG_PDU_TYPE", part567); - - var part568 = match("MESSAGE#539:SNMPD_CONFIG_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Configuration database has errors", processor_chain([ - dup30, - dup22, - setc("event_description","Configuration database has errors"), - dup23, - ])); - - var msg545 = msg("SNMPD_CONFIG_ERROR", part568); - - var part569 = match("MESSAGE#540:SNMPD_CONTEXT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} context %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD CONTEXT ERROR"), - dup23, - ])); - - var msg546 = msg("SNMPD_CONTEXT_ERROR", part569); - - var part570 = match("MESSAGE#541:SNMPD_ENGINE_FILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2}: operation: %{dclass_counter1->} %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD ENGINE FILE FAILURE"), - dup23, - ])); - - var msg547 = msg("SNMPD_ENGINE_FILE_FAILURE", part570); - - var part571 = match("MESSAGE#542:SNMPD_ENGINE_PROCESS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: from-path: undecodable/unmatched subagent response", processor_chain([ - dup30, - dup22, - setc("event_description"," from-path - SNMP undecodable/unmatched subagent response"), - dup23, - ])); - - var msg548 = msg("SNMPD_ENGINE_PROCESS_ERROR", part571); - - var part572 = match("MESSAGE#543:SNMPD_FILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: fopen %{dclass_counter2}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD FILE FAILURE"), - dup23, - ])); - - var msg549 = msg("SNMPD_FILE_FAILURE", part572); - - var part573 = match("MESSAGE#544:SNMPD_GROUP_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} group: '%{group}' user '%{username}' model '%{version}'", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD GROUP ERROR"), - dup23, - ])); - - var msg550 = msg("SNMPD_GROUP_ERROR", part573); - - var part574 = match("MESSAGE#545:SNMPD_INIT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: snmpd initialization failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","snmpd initialization failure"), - dup23, - ])); - - var msg551 = msg("SNMPD_INIT_FAILED", part574); - - var part575 = match("MESSAGE#546:SNMPD_LIBJUNIPER_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: system_default_inaddr: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LIBJUNIPER FAILURE"), - dup23, - ])); - - var msg552 = msg("SNMPD_LIBJUNIPER_FAILURE", part575); - - var part576 = match("MESSAGE#547:SNMPD_LOOPBACK_ADDR_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","LOOPBACK ADDR ERROR"), - dup23, - ])); - - var msg553 = msg("SNMPD_LOOPBACK_ADDR_ERROR", part576); - - var part577 = match("MESSAGE#548:SNMPD_MEMORY_FREED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: called for freed - already freed", processor_chain([ - dup30, - dup22, - setc("event_description","duplicate memory free"), - dup23, - ])); - - var msg554 = msg("SNMPD_MEMORY_FREED", part577); - - var part578 = match("MESSAGE#549:SNMPD_RADIX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: radix_add failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","radix_add failed"), - dup23, - ])); - - var msg555 = msg("SNMPD_RADIX_FAILURE", part578); - - var part579 = match("MESSAGE#550:SNMPD_RECEIVE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: receive %{dclass_counter1->} failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD RECEIVE FAILURE"), - dup23, - ])); - - var msg556 = msg("SNMPD_RECEIVE_FAILURE", part579); - - var part580 = match("MESSAGE#551:SNMPD_RMONFILE_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{dclass_counter2}: operation: %{dclass_counter1->} %{agent}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","RMONFILE FAILURE"), - dup23, - ])); - - var msg557 = msg("SNMPD_RMONFILE_FAILURE", part580); - - var part581 = match("MESSAGE#552:SNMPD_RMON_COOKIE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: Null cookie", processor_chain([ - dup30, - dup22, - setc("event_description","Null cookie"), - dup23, - ])); - - var msg558 = msg("SNMPD_RMON_COOKIE", part581); - - var part582 = match("MESSAGE#553:SNMPD_RMON_EVENTLOG", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","RMON EVENTLOG"), - dup23, - ])); - - var msg559 = msg("SNMPD_RMON_EVENTLOG", part582); - - var part583 = match("MESSAGE#554:SNMPD_RMON_IOERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: Received io error, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Received io error"), - dup23, - ])); - - var msg560 = msg("SNMPD_RMON_IOERROR", part583); - - var part584 = match("MESSAGE#555:SNMPD_RMON_MIBERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: internal Get request error: description, %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","internal Get request error"), - dup23, - ])); - - var msg561 = msg("SNMPD_RMON_MIBERROR", part584); - - var part585 = match("MESSAGE#556:SNMPD_RTSLIB_ASYNC_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: sequence mismatch %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","sequence mismatch"), - dup23, - ])); - - var msg562 = msg("SNMPD_RTSLIB_ASYNC_EVENT", part585); - - var part586 = match("MESSAGE#557:SNMPD_SEND_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: send send-type (index1) failure: %{result}", processor_chain([ - dup30, - dup22, - dup106, - dup23, - ])); - - var msg563 = msg("SNMPD_SEND_FAILURE", part586); - - var part587 = match("MESSAGE#558:SNMPD_SEND_FAILURE:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: send to (%{saddr}) failure: %{result}", processor_chain([ - dup30, - dup22, - dup106, - dup23, - ])); - - var msg564 = msg("SNMPD_SEND_FAILURE:01", part587); - - var select54 = linear_select([ - msg563, - msg564, - ]); - - var part588 = match("MESSAGE#559:SNMPD_SOCKET_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: socket failure: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD SOCKET FAILURE"), - dup23, - ])); - - var msg565 = msg("SNMPD_SOCKET_FAILURE", part588); - - var part589 = match("MESSAGE#560:SNMPD_SUBAGENT_NO_BUFFERS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: No buffers available for subagent (%{agent})", processor_chain([ - dup30, - dup22, - setc("event_description","No buffers available for subagent"), - dup23, - ])); - - var msg566 = msg("SNMPD_SUBAGENT_NO_BUFFERS", part589); - - var part590 = match("MESSAGE#561:SNMPD_SUBAGENT_SEND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Send to subagent failed (%{agent}): %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Send to subagent failed"), - dup23, - ])); - - var msg567 = msg("SNMPD_SUBAGENT_SEND_FAILED", part590); - - var part591 = match("MESSAGE#562:SNMPD_SYSLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: system function '%{dclass_counter1}' failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","system function failed"), - dup23, - ])); - - var msg568 = msg("SNMPD_SYSLIB_FAILURE", part591); - - var part592 = match("MESSAGE#563:SNMPD_THROTTLE_QUEUE_DRAINED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: cleared all throttled traps", processor_chain([ - dup21, - dup22, - setc("event_description","cleared all throttled traps"), - dup23, - ])); - - var msg569 = msg("SNMPD_THROTTLE_QUEUE_DRAINED", part592); - - var part593 = match("MESSAGE#564:SNMPD_TRAP_COLD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap: cold start", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP trap: cold start"), - dup23, - ])); - - var msg570 = msg("SNMPD_TRAP_COLD_START", part593); - - var part594 = match("MESSAGE#565:SNMPD_TRAP_GEN_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{resultcode->} (%{result})", processor_chain([ - dup30, - dup22, - dup107, - dup23, - ])); - - var msg571 = msg("SNMPD_TRAP_GEN_FAILURE", part594); - - var part595 = match("MESSAGE#566:SNMPD_TRAP_GEN_FAILURE2", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{dclass_counter2->} %{result}", processor_chain([ - dup30, - dup22, - dup107, - dup23, - ])); - - var msg572 = msg("SNMPD_TRAP_GEN_FAILURE2", part595); - - var part596 = match("MESSAGE#567:SNMPD_TRAP_INVALID_DATA", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{result->} (%{dclass_counter2}) received", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP INVALID DATA"), - dup23, - ])); - - var msg573 = msg("SNMPD_TRAP_INVALID_DATA", part596); - - var part597 = match("MESSAGE#568:SNMPD_TRAP_NOT_ENOUGH_VARBINDS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: %{info->} (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP ERROR"), - dup23, - ])); - - var msg574 = msg("SNMPD_TRAP_NOT_ENOUGH_VARBINDS", part597); - - var part598 = match("MESSAGE#569:SNMPD_TRAP_QUEUED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Adding trap to %{dclass_counter2->} to %{obj_name->} queue, %{dclass_counter1->} traps in queue", processor_chain([ - dup21, - dup22, - setc("event_description","Adding trap to queue"), - dup23, - ])); - - var msg575 = msg("SNMPD_TRAP_QUEUED", part598); - - var part599 = match("MESSAGE#570:SNMPD_TRAP_QUEUE_DRAINED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: traps queued to %{obj_name->} sent successfully", processor_chain([ - dup21, - dup22, - setc("event_description","traps queued - sent successfully"), - dup23, - ])); - - var msg576 = msg("SNMPD_TRAP_QUEUE_DRAINED", part599); - - var part600 = match("MESSAGE#571:SNMPD_TRAP_QUEUE_MAX_ATTEMPTS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: after %{dclass_counter1->} attempts, deleting %{dclass_counter2->} traps queued to %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP QUEUE MAX_ATTEMPTS - deleting some traps"), - dup23, - ])); - - var msg577 = msg("SNMPD_TRAP_QUEUE_MAX_ATTEMPTS", part600); - - var part601 = match("MESSAGE#572:SNMPD_TRAP_QUEUE_MAX_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: maximum queue size exceeded (%{dclass_counter1}), discarding trap to %{dclass_counter2->} from %{obj_name->} queue", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP maximum queue size exceeded"), - dup23, - ])); - - var msg578 = msg("SNMPD_TRAP_QUEUE_MAX_SIZE", part601); - - var part602 = match("MESSAGE#573:SNMPD_TRAP_THROTTLED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: traps throttled after %{dclass_counter1->} traps", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP traps throttled"), - dup23, - ])); - - var msg579 = msg("SNMPD_TRAP_THROTTLED", part602); - - var part603 = match("MESSAGE#574:SNMPD_TRAP_TYPE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: unknown trap type requested (%{obj_type->} )", processor_chain([ - dup30, - dup22, - setc("event_description","unknown SNMP trap type requested"), - dup23, - ])); - - var msg580 = msg("SNMPD_TRAP_TYPE_ERROR", part603); - - var part604 = match("MESSAGE#575:SNMPD_TRAP_VARBIND_TYPE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: expecting %{dclass_counter1->} varbind to be VT_NUMBER (%{resultcode->} )", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP VARBIND TYPE ERROR"), - dup23, - ])); - - var msg581 = msg("SNMPD_TRAP_VARBIND_TYPE_ERROR", part604); - - var part605 = match("MESSAGE#576:SNMPD_TRAP_VERSION_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap error: invalid version signature (%{result})", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD TRAP ERROR - invalid version signature"), - dup23, - ])); - - var msg582 = msg("SNMPD_TRAP_VERSION_ERROR", part605); - - var part606 = match("MESSAGE#577:SNMPD_TRAP_WARM_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: SNMP trap: warm start", processor_chain([ - dup21, - dup22, - setc("event_description","SNMPD TRAP WARM START"), - dup23, - ])); - - var msg583 = msg("SNMPD_TRAP_WARM_START", part606); - - var part607 = match("MESSAGE#578:SNMPD_USER_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} in %{dclass_counter1->} user '%{username}' %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMPD USER ERROR"), - dup23, - ])); - - var msg584 = msg("SNMPD_USER_ERROR", part607); - - var part608 = match("MESSAGE#579:SNMPD_VIEW_DELETE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: deleting view %{dclass_counter2->} %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP deleting view"), - dup23, - ])); - - var msg585 = msg("SNMPD_VIEW_DELETE", part608); - - var part609 = match("MESSAGE#580:SNMPD_VIEW_INSTALL_DEFAULT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: %{result->} installing default %{dclass_counter1->} view %{dclass_counter2}", processor_chain([ - dup21, - dup22, - setc("event_description","installing default SNMP view"), - dup23, - ])); - - var msg586 = msg("SNMPD_VIEW_INSTALL_DEFAULT", part609); - - var part610 = match("MESSAGE#581:SNMPD_VIEW_OID_PARSE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: oid parsing failed for view %{dclass_counter2->} oid %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","oid parsing failed for SNMP view"), - dup23, - ])); - - var msg587 = msg("SNMPD_VIEW_OID_PARSE", part610); - - var part611 = match("MESSAGE#582:SNMP_GET_ERROR1", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP_GET_ERROR 1"), - dup23, - ])); - - var msg588 = msg("SNMP_GET_ERROR1", part611); - - var part612 = match("MESSAGE#583:SNMP_GET_ERROR2", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 2"), - dup23, - ])); - - var msg589 = msg("SNMP_GET_ERROR2", part612); - - var part613 = match("MESSAGE#584:SNMP_GET_ERROR3", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 3"), - dup23, - ])); - - var msg590 = msg("SNMP_GET_ERROR3", part613); - - var part614 = match("MESSAGE#585:SNMP_GET_ERROR4", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent->} %{dclass_counter1->} failed for %{dclass_counter2->} : %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP GET ERROR 4"), - dup23, - ])); - - var msg591 = msg("SNMP_GET_ERROR4", part614); - - var part615 = match("MESSAGE#586:SNMP_RTSLIB_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: rtslib-error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP RTSLIB FAILURE"), - dup23, - ])); - - var msg592 = msg("SNMP_RTSLIB_FAILURE", part615); - - var part616 = match("MESSAGE#587:SNMP_TRAP_LINK_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifIndex %{dclass_counter1}, ifAdminStatus %{resultcode}, ifOperStatus %{result}, ifName %{interface}", processor_chain([ - dup30, - dup22, - dup108, - dup23, - ])); - - var msg593 = msg("SNMP_TRAP_LINK_DOWN", part616); - - var part617 = match("MESSAGE#596:SNMP_TRAP_LINK_DOWN:01", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} snmp-interface-index=\"%{fld1}\" admin-status=\"%{fld3}\" operational-status=\"%{fld2}\" interface-name=\"%{interface}\"]", processor_chain([ - dup30, - dup22, - dup108, - dup61, - dup62, - ])); - - var msg594 = msg("SNMP_TRAP_LINK_DOWN:01", part617); - - var select55 = linear_select([ - msg593, - msg594, - ]); - - var part618 = match("MESSAGE#588:SNMP_TRAP_LINK_UP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: ifIndex %{dclass_counter1}, ifAdminStatus %{resultcode}, ifOperStatus %{result}, ifName %{interface}", processor_chain([ - dup21, - dup22, - dup109, - dup23, - ])); - - var msg595 = msg("SNMP_TRAP_LINK_UP", part618); - - var part619 = match("MESSAGE#597:SNMP_TRAP_LINK_UP:01", "nwparser.payload", "%{process->} %{process_id->} %{event_type->} [junos@%{obj_name->} snmp-interface-index=\"%{fld1}\" admin-status=\"%{fld3}\" operational-status=\"%{event_state}\" interface-name=\"%{interface}\"]", processor_chain([ - dup21, - dup22, - dup109, - dup61, - dup62, - ])); - - var msg596 = msg("SNMP_TRAP_LINK_UP:01", part619); - - var select56 = linear_select([ - msg595, - msg596, - ]); - - var part620 = match("MESSAGE#589:SNMP_TRAP_PING_PROBE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP PING PROBE FAILED"), - dup23, - ])); - - var msg597 = msg("SNMP_TRAP_PING_PROBE_FAILED", part620); - - var part621 = match("MESSAGE#590:SNMP_TRAP_PING_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP PING TEST COMPLETED"), - dup23, - ])); - - var msg598 = msg("SNMP_TRAP_PING_TEST_COMPLETED", part621); - - var part622 = match("MESSAGE#591:SNMP_TRAP_PING_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: pingCtlOwnerIndex = %{dclass_counter1}, pingCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP PING TEST FAILED"), - dup23, - ])); - - var msg599 = msg("SNMP_TRAP_PING_TEST_FAILED", part622); - - var part623 = match("MESSAGE#592:SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE PATH CHANGE"), - dup23, - ])); - - var msg600 = msg("SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE", part623); - - var part624 = match("MESSAGE#593:SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup21, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE TEST COMPLETED"), - dup23, - ])); - - var msg601 = msg("SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED", part624); - - var part625 = match("MESSAGE#594:SNMP_TRAP_TRACE_ROUTE_TEST_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: traceRouteCtlOwnerIndex = %{dclass_counter1}, traceRouteCtlTestName = %{obj_name}", processor_chain([ - dup30, - dup22, - setc("event_description","SNMP TRAP TRACE ROUTE TEST FAILED"), - dup23, - ])); - - var msg602 = msg("SNMP_TRAP_TRACE_ROUTE_TEST_FAILED", part625); - - var part626 = match("MESSAGE#598:SSHD_LOGIN_FAILED", "nwparser.payload", "%{process}: %{event_type}: Login failed for user '%{username}' from host '%{saddr}'", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup110, - dup23, - ])); - - var msg603 = msg("SSHD_LOGIN_FAILED", part626); - - var part627 = match("MESSAGE#599:SSHD_LOGIN_FAILED:01", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} username=\"%{username}\" source-address=\"%{saddr}\"]", processor_chain([ - dup44, - dup34, - dup35, - dup36, - dup43, - dup22, - dup110, - dup61, - dup52, - setf("process","hfld33"), - ])); - - var msg604 = msg("SSHD_LOGIN_FAILED:01", part627); - - var select57 = linear_select([ - msg603, - msg604, - ]); - - var part628 = match("MESSAGE#600:task_connect", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: task %{agent->} addr %{daddr}+%{dport}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","task connect failure"), - dup23, - ])); - - var msg605 = msg("task_connect", part628); - - var msg606 = msg("TASK_TASK_REINIT", dup149); - - var part629 = match("MESSAGE#602:TFTPD_AF_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unexpected address family %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Unexpected address family"), - dup23, - ])); - - var msg607 = msg("TFTPD_AF_ERR", part629); - - var part630 = match("MESSAGE#603:TFTPD_BIND_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: bind: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD BIND ERROR"), - dup23, - ])); - - var msg608 = msg("TFTPD_BIND_ERR", part630); - - var part631 = match("MESSAGE#604:TFTPD_CONNECT_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: connect: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD CONNECT ERROR"), - dup23, - ])); - - var msg609 = msg("TFTPD_CONNECT_ERR", part631); - - var part632 = match("MESSAGE#605:TFTPD_CONNECT_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: TFTP %{protocol->} from address %{daddr->} port %{dport->} file %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD CONNECT INFO"), - dup23, - ])); - - var msg610 = msg("TFTPD_CONNECT_INFO", part632); - - var part633 = match("MESSAGE#606:TFTPD_CREATE_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: check_space %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD CREATE ERROR"), - dup23, - ])); - - var msg611 = msg("TFTPD_CREATE_ERR", part633); - - var part634 = match("MESSAGE#607:TFTPD_FIO_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD FIO ERR"), - dup23, - ])); - - var msg612 = msg("TFTPD_FIO_ERR", part634); - - var part635 = match("MESSAGE#608:TFTPD_FORK_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: fork: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD FORK ERROR"), - dup23, - ])); - - var msg613 = msg("TFTPD_FORK_ERR", part635); - - var part636 = match("MESSAGE#609:TFTPD_NAK_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: nak error %{resultcode}, %{dclass_counter1}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD NAK ERROR"), - dup23, - ])); - - var msg614 = msg("TFTPD_NAK_ERR", part636); - - var part637 = match("MESSAGE#610:TFTPD_OPEN_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to open file '%{filename}', error: %{result}", processor_chain([ - dup30, - dup22, - dup78, - dup23, - ])); - - var msg615 = msg("TFTPD_OPEN_ERR", part637); - - var part638 = match("MESSAGE#611:TFTPD_RECVCOMPLETE_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received %{dclass_counter1->} blocks of %{dclass_counter2->} size for file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD RECVCOMPLETE INFO"), - dup23, - ])); - - var msg616 = msg("TFTPD_RECVCOMPLETE_INFO", part638); - - var part639 = match("MESSAGE#612:TFTPD_RECVFROM_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: recvfrom: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD RECVFROM ERROR"), - dup23, - ])); - - var msg617 = msg("TFTPD_RECVFROM_ERR", part639); - - var part640 = match("MESSAGE#613:TFTPD_RECV_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: recv: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD RECV ERROR"), - dup23, - ])); - - var msg618 = msg("TFTPD_RECV_ERR", part640); - - var part641 = match("MESSAGE#614:TFTPD_SENDCOMPLETE_INFO", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Sent %{dclass_counter1->} blocks of %{dclass_counter2->} and %{info->} for file '%{filename}'", processor_chain([ - dup21, - dup22, - setc("event_description","TFTPD SENDCOMPLETE INFO"), - dup23, - ])); - - var msg619 = msg("TFTPD_SENDCOMPLETE_INFO", part641); - - var part642 = match("MESSAGE#615:TFTPD_SEND_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: send: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD SEND ERROR"), - dup23, - ])); - - var msg620 = msg("TFTPD_SEND_ERR", part642); - - var part643 = match("MESSAGE#616:TFTPD_SOCKET_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: socket: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD SOCKET ERROR"), - dup23, - ])); - - var msg621 = msg("TFTPD_SOCKET_ERR", part643); - - var part644 = match("MESSAGE#617:TFTPD_STATFS_ERR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: statfs %{agent}, error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","TFTPD STATFS ERROR"), - dup23, - ])); - - var msg622 = msg("TFTPD_STATFS_ERR", part644); - - var part645 = match("MESSAGE#618:TNP", "nwparser.payload", "%{process}: %{event_type}: adding neighbor %{dclass_counter1->} to interface %{interface}", processor_chain([ - dup21, - dup22, - setc("event_description","adding neighbor to interface"), - dup23, - ])); - - var msg623 = msg("TNP", part645); - - var part646 = match("MESSAGE#619:trace_on", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: tracing to %{fld33->} started", processor_chain([ - dup21, - dup22, - setc("event_description","tracing to file"), - dup23, - call({ - dest: "nwparser.filename", - fn: RMQ, - args: [ - field("fld33"), - ], - }), - ])); - - var msg624 = msg("trace_on", part646); - - var part647 = match("MESSAGE#620:trace_rotate", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: rotating %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","trace rotating file"), - dup23, - ])); - - var msg625 = msg("trace_rotate", part647); - - var part648 = match("MESSAGE#621:transfer-file", "nwparser.payload", "%{process}: %{event_type}: Transferred %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","transfered file"), - dup23, - ])); - - var msg626 = msg("transfer-file", part648); - - var part649 = match("MESSAGE#622:ttloop", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: peer died: %{result}: %{resultcode}", processor_chain([ - dup30, - dup22, - setc("event_description","ttloop - peer died"), - dup23, - ])); - - var msg627 = msg("ttloop", part649); - - var part650 = match("MESSAGE#623:UI_AUTH_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authenticated user '%{username}' at permission level '%{privilege}'", processor_chain([ - dup80, - dup34, - dup35, - dup37, - dup22, - setc("event_description","Authenticated user"), - dup23, - ])); - - var msg628 = msg("UI_AUTH_EVENT", part650); - - var part651 = match("MESSAGE#624:UI_AUTH_INVALID_CHALLENGE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Received invalid authentication challenge for user '%{username}': response", processor_chain([ - dup30, - dup22, - setc("event_description","Received invalid authentication challenge for user response"), - dup23, - ])); - - var msg629 = msg("UI_AUTH_INVALID_CHALLENGE", part651); - - var part652 = match("MESSAGE#625:UI_BOOTTIME_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fetch boot time: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fetch boot time"), - dup23, - ])); - - var msg630 = msg("UI_BOOTTIME_FAILED", part652); - - var part653 = match("MESSAGE#626:UI_CFG_AUDIT_NEW", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' %{dclass_counter2->} path unknown", processor_chain([ - dup30, - dup22, - setc("event_description","user path unknown"), - dup23, - ])); - - var msg631 = msg("UI_CFG_AUDIT_NEW", part653); - - var part654 = match("MESSAGE#627:UI_CFG_AUDIT_NEW:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' insert: [edit-config config %{filename->} security policies %{policyname}] %{info}", processor_chain([ - dup42, - dup22, - setc("event_description"," user Inserted Security Policies in config"), - dup23, - ])); - - var msg632 = msg("UI_CFG_AUDIT_NEW:01", part654); - - var select58 = linear_select([ - msg631, - msg632, - ]); - - var part655 = match("MESSAGE#628:UI_CFG_AUDIT_OTHER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' delete: [%{filename}]", processor_chain([ - dup21, - dup22, - setc("event_description","User deleted file"), - setc("action","delete"), - dup23, - ])); - - var msg633 = msg("UI_CFG_AUDIT_OTHER", part655); - - var part656 = match("MESSAGE#629:UI_CFG_AUDIT_OTHER:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' rollback: %{filename}", processor_chain([ - dup21, - dup22, - setc("event_description","User rollback file"), - dup23, - ])); - - var msg634 = msg("UI_CFG_AUDIT_OTHER:01", part656); - - var part657 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_0", "nwparser.p0", "\"%{info}\""); - - var select59 = linear_select([ - part657, - dup112, - ]); - - var all31 = all_match({ - processors: [ - dup111, - select59, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","User set"), - dup23, - ]), - }); - - var msg635 = msg("UI_CFG_AUDIT_OTHER:02", all31); - - var part658 = match("MESSAGE#631:UI_CFG_AUDIT_OTHER:03", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' replace: [edit-config config %{filename->} applications %{info}]", processor_chain([ - dup21, - dup22, - setc("event_description","User config replace"), - setc("action","replace"), - dup23, - ])); - - var msg636 = msg("UI_CFG_AUDIT_OTHER:03", part658); - - var part659 = match("MESSAGE#632:UI_CFG_AUDIT_OTHER:04", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' deactivate: [groups %{info}]", processor_chain([ - setc("eventcategory","1701070000"), - dup22, - setc("event_description","User deactivating group(s)"), - setc("action","deactivate"), - dup23, - ])); - - var msg637 = msg("UI_CFG_AUDIT_OTHER:04", part659); - - var part660 = match("MESSAGE#633:UI_CFG_AUDIT_OTHER:05", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' update: %{filename}", processor_chain([ - dup113, - dup22, - setc("event_description","User updates config file"), - setc("action","update"), - dup23, - ])); - - var msg638 = msg("UI_CFG_AUDIT_OTHER:05", part660); - - var select60 = linear_select([ - msg633, - msg634, - msg635, - msg636, - msg637, - msg638, - ]); - - var part661 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_0", "nwparser.p0", "\"%{change_old}\" %{p0}"); - - var select61 = linear_select([ - part661, - dup114, - ]); - - var all32 = all_match({ - processors: [ - dup111, - select61, - dup115, - ], - on_success: processor_chain([ - dup21, - dup22, - dup116, - dup23, - ]), - }); - - var msg639 = msg("UI_CFG_AUDIT_SET:01", all32); - - var part662 = match("MESSAGE#635:UI_CFG_AUDIT_SET:02/1_0", "nwparser.p0", "\"%{change_old->} %{p0}"); - - var select62 = linear_select([ - part662, - dup114, - ]); - - var all33 = all_match({ - processors: [ - dup111, - select62, - dup115, - ], - on_success: processor_chain([ - dup21, - dup22, - dup116, - dup23, - ]), - }); - - var msg640 = msg("UI_CFG_AUDIT_SET:02", all33); - - var part663 = match("MESSAGE#636:UI_CFG_AUDIT_SET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' replace: [edit-config config %{filename->} applications %{info}] \u003c\u003c%{disposition}> -> \"%{agent}\"", processor_chain([ - dup21, - dup22, - setc("event_description","User replace config application(s)"), - dup23, - ])); - - var msg641 = msg("UI_CFG_AUDIT_SET", part663); - - var select63 = linear_select([ - msg639, - msg640, - msg641, - ]); - - var part664 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/2", "nwparser.p0", ": [groups %{info->} secret]"); - - var all34 = all_match({ - processors: [ - dup117, - dup156, - part664, - ], - on_success: processor_chain([ - dup113, - dup22, - dup120, - dup23, - ]), - }); - - var msg642 = msg("UI_CFG_AUDIT_SET_SECRET:01", all34); - - var part665 = match("MESSAGE#638:UI_CFG_AUDIT_SET_SECRET:02/2", "nwparser.p0", ": [%{info}]"); - - var all35 = all_match({ - processors: [ - dup117, - dup156, - part665, - ], - on_success: processor_chain([ - dup113, - dup22, - dup120, - dup23, - ]), - }); - - var msg643 = msg("UI_CFG_AUDIT_SET_SECRET:02", all35); - - var part666 = match("MESSAGE#639:UI_CFG_AUDIT_SET_SECRET", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' %{dclass_counter2->} %{directory}", processor_chain([ - dup21, - dup22, - setc("event_description","UI CFG AUDIT SET SECRET"), - dup23, - ])); - - var msg644 = msg("UI_CFG_AUDIT_SET_SECRET", part666); - - var select64 = linear_select([ - msg642, - msg643, - msg644, - ]); - - var part667 = match("MESSAGE#640:UI_CHILD_ARGS_EXCEEDED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Too many arguments for child process '%{agent}'", processor_chain([ - dup30, - dup22, - setc("event_description","Too many arguments for child process"), - dup23, - ])); - - var msg645 = msg("UI_CHILD_ARGS_EXCEEDED", part667); - - var part668 = match("MESSAGE#641:UI_CHILD_CHANGE_USER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to switch to local user: %{username}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to switch to local user"), - dup23, - ])); - - var msg646 = msg("UI_CHILD_CHANGE_USER", part668); - - var part669 = match("MESSAGE#642:UI_CHILD_EXEC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exec failed for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Child exec failed"), - dup23, - ])); - - var msg647 = msg("UI_CHILD_EXEC", part669); - - var part670 = match("MESSAGE#643:UI_CHILD_EXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child exited: PID %{child_pid}, status %{result}, command '%{action}'", processor_chain([ - dup30, - dup22, - setc("event_description","Child exited"), - dup23, - ])); - - var msg648 = msg("UI_CHILD_EXITED", part670); - - var part671 = match("MESSAGE#644:UI_CHILD_FOPEN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to append to log '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to append to log"), - dup23, - ])); - - var msg649 = msg("UI_CHILD_FOPEN", part671); - - var part672 = match("MESSAGE#645:UI_CHILD_PIPE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipe for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create pipe for command"), - dup23, - ])); - - var msg650 = msg("UI_CHILD_PIPE_FAILED", part672); - - var part673 = match("MESSAGE#646:UI_CHILD_SIGNALED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child received signal: PID %{child_pid}, signal %{result}: %{resultcode}, command='%{action}'", processor_chain([ - dup21, - dup22, - dup61, - setc("event_description","Child received signal"), - dup23, - ])); - - var msg651 = msg("UI_CHILD_SIGNALED", part673); - - var part674 = match("MESSAGE#647:UI_CHILD_STOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Child stopped: PID %{child_pid}, signal=%{resultcode->} command='%{action}')", processor_chain([ - dup21, - dup22, - setc("event_description","Child stopped"), - dup23, - ])); - - var msg652 = msg("UI_CHILD_STOPPED", part674); - - var part675 = match("MESSAGE#648:UI_CHILD_START", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Starting child '%{agent}'", processor_chain([ - dup21, - dup22, - setc("event_description","Starting child"), - dup23, - ])); - - var msg653 = msg("UI_CHILD_START", part675); - - var part676 = match("MESSAGE#649:UI_CHILD_STATUS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Cleanup child '%{agent}', PID %{child_pid}, status %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Cleanup child"), - dup23, - ])); - - var msg654 = msg("UI_CHILD_STATUS", part676); - - var part677 = match("MESSAGE#650:UI_CHILD_WAITPID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: waitpid failed: PID %{child_pid}, rc %{dclass_counter2}, status %{resultcode}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","waitpid failed"), - dup23, - ])); - - var msg655 = msg("UI_CHILD_WAITPID", part677); - - var part678 = match("MESSAGE#651:UI_CLI_IDLE_TIMEOUT", "nwparser.payload", "%{event_type}: Idle timeout for user '%{username}' exceeded and %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Idle timeout for user exceeded"), - dup23, - ])); - - var msg656 = msg("UI_CLI_IDLE_TIMEOUT", part678); - - var part679 = match("MESSAGE#652:UI_CMDLINE_READ_LINE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}', command '%{action}'", processor_chain([ - dup21, - dup22, - dup121, - dup23, - ])); - - var msg657 = msg("UI_CMDLINE_READ_LINE", part679); - - var part680 = match("MESSAGE#653:UI_CMDSET_EXEC_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command execution failed for '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Command execution failed"), - dup23, - ])); - - var msg658 = msg("UI_CMDSET_EXEC_FAILED", part680); - - var part681 = match("MESSAGE#654:UI_CMDSET_FORK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fork command '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fork command"), - dup23, - ])); - - var msg659 = msg("UI_CMDSET_FORK_FAILED", part681); - - var msg660 = msg("UI_CMDSET_PIPE_FAILED", dup144); - - var part682 = match("MESSAGE#656:UI_CMDSET_STOPPED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command stopped: PID %{child_pid}, signal '%{resultcode}, command '%{action}'", processor_chain([ - dup30, - dup22, - dup70, - dup23, - ])); - - var msg661 = msg("UI_CMDSET_STOPPED", part682); - - var part683 = match("MESSAGE#657:UI_CMDSET_WEXITED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Command exited: PID %{child_pid}, status %{resultcode}, command '%{action}'", processor_chain([ - dup30, - dup22, - dup72, - dup23, - ])); - - var msg662 = msg("UI_CMDSET_WEXITED", part683); - - var part684 = match("MESSAGE#658:UI_CMD_AUTH_REGEX_INVALID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Invalid '%{action}' command authorization regular expression '%{agent}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Invalid regexp command"), - dup23, - ])); - - var msg663 = msg("UI_CMD_AUTH_REGEX_INVALID", part684); - - var part685 = match("MESSAGE#659:UI_COMMIT/1_0", "nwparser.p0", "requested '%{action}' operation (comment:%{info})"); - - var part686 = match("MESSAGE#659:UI_COMMIT/1_1", "nwparser.p0", "performed %{action}"); - - var select65 = linear_select([ - part685, - part686, - ]); - - var all36 = all_match({ - processors: [ - dup117, - select65, - ], - on_success: processor_chain([ - dup21, - dup22, - dup122, - dup23, - ]), - }); - - var msg664 = msg("UI_COMMIT", all36); - - var part687 = match("MESSAGE#660:UI_COMMIT_AT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{result}", processor_chain([ - dup21, - dup22, - dup122, - dup23, - ])); - - var msg665 = msg("UI_COMMIT_AT", part687); - - var part688 = match("MESSAGE#661:UI_COMMIT_AT_COMPLETED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: '%{agent}' was successful", processor_chain([ - dup21, - dup22, - setc("event_description","User commit successful"), - dup23, - ])); - - var msg666 = msg("UI_COMMIT_AT_COMPLETED", part688); - - var part689 = match("MESSAGE#662:UI_COMMIT_AT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{result}, %{info}", processor_chain([ - dup30, - dup22, - setc("event_description","User commit failed"), - dup23, - ])); - - var msg667 = msg("UI_COMMIT_AT_FAILED", part689); - - var part690 = match("MESSAGE#663:UI_COMMIT_COMPRESS_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to compress file %{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to compress file"), - dup23, - ])); - - var msg668 = msg("UI_COMMIT_COMPRESS_FAILED", part690); - - var part691 = match("MESSAGE#664:UI_COMMIT_CONFIRMED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed '%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","UI COMMIT CONFIRMED"), - dup23, - ])); - - var msg669 = msg("UI_COMMIT_CONFIRMED", part691); - - var part692 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: '%{action}' must be confirmed within %{p0}"); - - var part693 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/1_0", "nwparser.p0", "minutes %{dclass_counter1}"); - - var part694 = match("MESSAGE#665:UI_COMMIT_CONFIRMED_REMINDER/1_1", "nwparser.p0", "%{dclass_counter1->} minutes"); - - var select66 = linear_select([ - part693, - part694, - ]); - - var all37 = all_match({ - processors: [ - part692, - select66, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT must be confirmed within # minutes"), - dup23, - ]), - }); - - var msg670 = msg("UI_COMMIT_CONFIRMED_REMINDER", all37); - - var part695 = match("MESSAGE#666:UI_COMMIT_CONFIRMED_TIMED/2", "nwparser.p0", "'%{username}' performed '%{action}'"); - - var all38 = all_match({ - processors: [ - dup50, - dup145, - part695, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","user performed commit confirm"), - dup23, - ]), - }); - - var msg671 = msg("UI_COMMIT_CONFIRMED_TIMED", all38); - - var part696 = match("MESSAGE#667:UI_COMMIT_EMPTY_CONTAINER", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Skipped empty object %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Skipped empty object"), - dup23, - ])); - - var msg672 = msg("UI_COMMIT_EMPTY_CONTAINER", part696); - - var part697 = match("MESSAGE#668:UI_COMMIT_NOT_CONFIRMED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Commit was not confirmed; %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","COMMIT NOT CONFIRMED"), - dup23, - ])); - - var msg673 = msg("UI_COMMIT_NOT_CONFIRMED", part697); - - var part698 = match("MESSAGE#669:UI_COMMIT_PROGRESS/1_0", "nwparser.p0", "commit %{p0}"); - - var part699 = match("MESSAGE#669:UI_COMMIT_PROGRESS/1_1", "nwparser.p0", "Commit operation in progress %{p0}"); - - var select67 = linear_select([ - part698, - part699, - ]); - - var part700 = match("MESSAGE#669:UI_COMMIT_PROGRESS/2", "nwparser.p0", ": %{action}"); - - var all39 = all_match({ - processors: [ - dup50, - select67, - part700, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","Commit operation in progress"), - dup23, - ]), - }); - - var msg674 = msg("UI_COMMIT_PROGRESS", all39); - - var part701 = match("MESSAGE#670:UI_COMMIT_QUIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT QUIT"), - dup23, - ])); - - var msg675 = msg("UI_COMMIT_QUIT", part701); - - var part702 = match("MESSAGE#671:UI_COMMIT_ROLLBACK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Automatic rollback failed", processor_chain([ - dup30, - dup22, - setc("event_description","Automatic rollback failed"), - dup23, - ])); - - var msg676 = msg("UI_COMMIT_ROLLBACK_FAILED", part702); - - var part703 = match("MESSAGE#672:UI_COMMIT_SYNC", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' performed %{action}", processor_chain([ - dup21, - dup22, - setc("event_description","COMMIT SYNC"), - dup23, - ])); - - var msg677 = msg("UI_COMMIT_SYNC", part703); - - var part704 = match("MESSAGE#673:UI_COMMIT_SYNC_FORCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: All logins to local configuration database were terminated because %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","All logins to local configuration database were terminated"), - dup23, - ])); - - var msg678 = msg("UI_COMMIT_SYNC_FORCE", part704); - - var part705 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Process: %{agent}, path: %{p0}"); - - var part706 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/1_0", "nwparser.p0", "[%{filename}], %{p0}"); - - var part707 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/1_1", "nwparser.p0", "%{filename}, %{p0}"); - - var select68 = linear_select([ - part706, - part707, - ]); - - var part708 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/2", "nwparser.p0", "statement: %{info->} %{p0}"); - - var part709 = match("MESSAGE#674:UI_CONFIGURATION_ERROR/3_0", "nwparser.p0", ", error: %{result->} "); - - var select69 = linear_select([ - part709, - dup112, - ]); - - var all40 = all_match({ - processors: [ - part705, - select68, - part708, - select69, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","CONFIGURATION ERROR"), - dup23, - ]), - }); - - var msg679 = msg("UI_CONFIGURATION_ERROR", all40); - - var part710 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/2", "nwparser.p0", "socket connection accept failed: %{result}"); - - var all41 = all_match({ - processors: [ - dup50, - dup157, - part710, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","socket connection accept failed"), - dup23, - ]), - }); - - var msg680 = msg("UI_DAEMON_ACCEPT_FAILED", all41); - - var part711 = match("MESSAGE#676:UI_DAEMON_FORK_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create session child: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to create session child"), - dup23, - ])); - - var msg681 = msg("UI_DAEMON_FORK_FAILED", part711); - - var part712 = match("MESSAGE#677:UI_DAEMON_SELECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: select failed: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","DAEMON SELECT FAILED"), - dup23, - ])); - - var msg682 = msg("UI_DAEMON_SELECT_FAILED", part712); - - var part713 = match("MESSAGE#678:UI_DAEMON_SOCKET_FAILED/2", "nwparser.p0", "socket create failed: %{result}"); - - var all42 = all_match({ - processors: [ - dup50, - dup157, - part713, - ], - on_success: processor_chain([ - dup30, - dup22, - setc("event_description","socket create failed"), - dup23, - ]), - }); - - var msg683 = msg("UI_DAEMON_SOCKET_FAILED", all42); - - var part714 = match("MESSAGE#679:UI_DBASE_ACCESS_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to reaccess database file '%{filename}', address %{interface}, size %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to reaccess database file"), - dup23, - ])); - - var msg684 = msg("UI_DBASE_ACCESS_FAILED", part714); - - var part715 = match("MESSAGE#680:UI_DBASE_CHECKOUT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database '%{filename}' is out of data and needs to be rebuilt", processor_chain([ - dup30, - dup22, - setc("event_description","Database is out of data"), - dup23, - ])); - - var msg685 = msg("UI_DBASE_CHECKOUT_FAILED", part715); - - var part716 = match("MESSAGE#681:UI_DBASE_EXTEND_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to extend database file '%{filename}' to size %{dclass_counter1}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to extend database file"), - dup23, - ])); - - var msg686 = msg("UI_DBASE_EXTEND_FAILED", part716); - - var part717 = match("MESSAGE#682:UI_DBASE_LOGIN_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' entering configuration mode", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - setc("event_description","User entering configuration mode"), - dup23, - ])); - - var msg687 = msg("UI_DBASE_LOGIN_EVENT", part717); - - var part718 = match("MESSAGE#683:UI_DBASE_LOGOUT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{event_description}", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","User exiting configuration mode"), - dup23, - ])); - - var msg688 = msg("UI_DBASE_LOGOUT_EVENT", part718); - - var part719 = match("MESSAGE#684:UI_DBASE_MISMATCH_EXTENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header extent mismatch for file '%{agent}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header extent mismatch"), - dup23, - ])); - - var msg689 = msg("UI_DBASE_MISMATCH_EXTENT", part719); - - var part720 = match("MESSAGE#685:UI_DBASE_MISMATCH_MAJOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header major version number mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header major version number mismatch"), - dup23, - ])); - - var msg690 = msg("UI_DBASE_MISMATCH_MAJOR", part720); - - var part721 = match("MESSAGE#686:UI_DBASE_MISMATCH_MINOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header minor version number mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header minor version number mismatch"), - dup23, - ])); - - var msg691 = msg("UI_DBASE_MISMATCH_MINOR", part721); - - var part722 = match("MESSAGE#687:UI_DBASE_MISMATCH_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header sequence numbers mismatch for file '%{filename}'", processor_chain([ - dup30, - dup22, - setc("event_description","Database header sequence numbers mismatch"), - dup23, - ])); - - var msg692 = msg("UI_DBASE_MISMATCH_SEQUENCE", part722); - - var part723 = match("MESSAGE#688:UI_DBASE_MISMATCH_SIZE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database header size mismatch for file '%{filename}': expecting %{dclass_counter1}, got %{dclass_counter2}", processor_chain([ - dup30, - dup22, - setc("event_description","Database header size mismatch"), - dup23, - ])); - - var msg693 = msg("UI_DBASE_MISMATCH_SIZE", part723); - - var part724 = match("MESSAGE#689:UI_DBASE_OPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Database open failed for file '%{filename}': %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Database open failed"), - dup23, - ])); - - var msg694 = msg("UI_DBASE_OPEN_FAILED", part724); - - var part725 = match("MESSAGE#690:UI_DBASE_REBUILD_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User %{username->} Automatic rebuild of the database '%{filename}' failed", processor_chain([ - dup30, - dup22, - setc("event_description","DBASE REBUILD FAILED"), - dup23, - ])); - - var msg695 = msg("UI_DBASE_REBUILD_FAILED", part725); - - var part726 = match("MESSAGE#691:UI_DBASE_REBUILD_SCHEMA_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Automatic rebuild of the database failed", processor_chain([ - dup30, - dup22, - setc("event_description","Automatic rebuild of the database failed"), - dup23, - ])); - - var msg696 = msg("UI_DBASE_REBUILD_SCHEMA_FAILED", part726); - - var part727 = match("MESSAGE#692:UI_DBASE_REBUILD_STARTED/1_1", "nwparser.p0", "Automatic %{p0}"); - - var select70 = linear_select([ - dup76, - part727, - ]); - - var part728 = match("MESSAGE#692:UI_DBASE_REBUILD_STARTED/2", "nwparser.p0", "%{username->} rebuild/rollback of the database '%{filename}' started"); - - var all43 = all_match({ - processors: [ - dup50, - select70, - part728, - ], - on_success: processor_chain([ - dup21, - dup22, - setc("event_description","DBASE REBUILD STARTED"), - dup23, - ]), - }); - - var msg697 = msg("UI_DBASE_REBUILD_STARTED", all43); - - var part729 = match("MESSAGE#693:UI_DBASE_RECREATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' attempting database re-creation", processor_chain([ - dup21, - dup22, - setc("event_description","user attempting database re-creation"), - dup23, - ])); - - var msg698 = msg("UI_DBASE_RECREATE", part729); - - var part730 = match("MESSAGE#694:UI_DBASE_REOPEN_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reopen of the database failed", processor_chain([ - dup30, - dup22, - setc("event_description","Reopen of the database failed"), - dup23, - ])); - - var msg699 = msg("UI_DBASE_REOPEN_FAILED", part730); - - var part731 = match("MESSAGE#695:UI_DUPLICATE_UID", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Users %{username->} have the same UID %{uid}", processor_chain([ - dup30, - dup22, - setc("event_description","Users have the same UID"), - dup23, - ])); - - var msg700 = msg("UI_DUPLICATE_UID", part731); - - var part732 = match("MESSAGE#696:UI_JUNOSCRIPT_CMD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' used JUNOScript client to run command '%{action}'", processor_chain([ - setc("eventcategory","1401050100"), - dup22, - setc("event_description","User used JUNOScript client to run command"), - dup23, - ])); - - var msg701 = msg("UI_JUNOSCRIPT_CMD", part732); - - var part733 = match("MESSAGE#697:UI_JUNOSCRIPT_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: JUNOScript error: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","JUNOScript error"), - dup23, - ])); - - var msg702 = msg("UI_JUNOSCRIPT_ERROR", part733); - - var part734 = match("MESSAGE#698:UI_LOAD_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' is performing a '%{action}'", processor_chain([ - dup21, - dup22, - setc("event_description","User command"), - dup23, - ])); - - var msg703 = msg("UI_LOAD_EVENT", part734); - - var part735 = match("MESSAGE#699:UI_LOAD_JUNOS_DEFAULT_FILE_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Loading the default config from %{filename}", processor_chain([ - setc("eventcategory","1701040000"), - dup22, - setc("event_description","Loading default config from file"), - dup23, - ])); - - var msg704 = msg("UI_LOAD_JUNOS_DEFAULT_FILE_EVENT", part735); - - var part736 = match("MESSAGE#700:UI_LOGIN_EVENT:01", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' login, class '%{group}' [%{fld01}], %{info->} '%{saddr->} %{sport->} %{daddr->} %{dport}', client-mode '%{fld02}'", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - dup127, - dup128, - dup23, - ])); - - var msg705 = msg("UI_LOGIN_EVENT:01", part736); - - var part737 = match("MESSAGE#701:UI_LOGIN_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' login, class '%{group}' %{info}", processor_chain([ - dup33, - dup34, - dup35, - dup36, - dup37, - dup22, - dup127, - dup23, - ])); - - var msg706 = msg("UI_LOGIN_EVENT", part737); - - var select71 = linear_select([ - msg705, - msg706, - ]); - - var part738 = match("MESSAGE#702:UI_LOGOUT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' logout", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","User logout"), - dup23, - ])); - - var msg707 = msg("UI_LOGOUT_EVENT", part738); - - var part739 = match("MESSAGE#703:UI_LOST_CONN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Lost connection to daemon %{agent}", processor_chain([ - dup30, - dup22, - setc("event_description","Lost connection to daemon"), - dup23, - ])); - - var msg708 = msg("UI_LOST_CONN", part739); - - var part740 = match("MESSAGE#704:UI_MASTERSHIP_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action->} by '%{username}'", processor_chain([ - dup21, - dup22, - setc("event_description","MASTERSHIP EVENT"), - dup23, - ])); - - var msg709 = msg("UI_MASTERSHIP_EVENT", part740); - - var part741 = match("MESSAGE#705:UI_MGD_TERMINATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Terminating operation: exit status %{resultcode}", processor_chain([ - dup21, - dup22, - setc("event_description","Terminating operation"), - dup23, - ])); - - var msg710 = msg("UI_MGD_TERMINATE", part741); - - var part742 = match("MESSAGE#706:UI_NETCONF_CMD", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' used NETCONF client to run command '%{action}'", processor_chain([ - dup29, - dup22, - setc("event_description","User used NETCONF client to run command"), - dup23, - ])); - - var msg711 = msg("UI_NETCONF_CMD", part742); - - var part743 = match("MESSAGE#707:UI_READ_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: read failed for peer %{hostname}: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","read failed for peer"), - dup23, - ])); - - var msg712 = msg("UI_READ_FAILED", part743); - - var part744 = match("MESSAGE#708:UI_READ_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Timeout on read of peer %{hostname}", processor_chain([ - dup30, - dup22, - setc("event_description","Timeout on read of peer"), - dup23, - ])); - - var msg713 = msg("UI_READ_TIMEOUT", part744); - - var part745 = match("MESSAGE#709:UI_REBOOT_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: System %{action->} by '%{username}'", processor_chain([ - dup60, - dup22, - setc("event_description","System reboot or halt"), - dup23, - ])); - - var msg714 = msg("UI_REBOOT_EVENT", part745); - - var part746 = match("MESSAGE#710:UI_RESTART_EVENT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: user '%{username}' restarting daemon %{service}", processor_chain([ - dup29, - dup22, - setc("event_description","user restarting daemon"), - dup23, - ])); - - var msg715 = msg("UI_RESTART_EVENT", part746); - - var part747 = match("MESSAGE#711:UI_SCHEMA_CHECKOUT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema is out of date and %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema is out of date"), - dup23, - ])); - - var msg716 = msg("UI_SCHEMA_CHECKOUT_FAILED", part747); - - var part748 = match("MESSAGE#712:UI_SCHEMA_MISMATCH_MAJOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema major version mismatch for package %{filename->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema major version mismatch"), - dup23, - ])); - - var msg717 = msg("UI_SCHEMA_MISMATCH_MAJOR", part748); - - var part749 = match("MESSAGE#713:UI_SCHEMA_MISMATCH_MINOR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema minor version mismatch for package %{filename->} %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema minor version mismatch"), - dup23, - ])); - - var msg718 = msg("UI_SCHEMA_MISMATCH_MINOR", part749); - - var part750 = match("MESSAGE#714:UI_SCHEMA_MISMATCH_SEQUENCE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema header sequence numbers mismatch for package %{filename}", processor_chain([ - dup30, - dup22, - setc("event_description","Schema header sequence numbers mismatch"), - dup23, - ])); - - var msg719 = msg("UI_SCHEMA_MISMATCH_SEQUENCE", part750); - - var part751 = match("MESSAGE#715:UI_SCHEMA_SEQUENCE_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Schema sequence number mismatch", processor_chain([ - dup30, - dup22, - setc("event_description","Schema sequence number mismatch"), - dup23, - ])); - - var msg720 = msg("UI_SCHEMA_SEQUENCE_ERROR", part751); - - var part752 = match("MESSAGE#716:UI_SYNC_OTHER_RE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Configuration synchronization with remote Routing Engine %{result}", processor_chain([ - dup21, - dup22, - setc("event_description","Configuration synchronization with remote Routing Engine"), - dup23, - ])); - - var msg721 = msg("UI_SYNC_OTHER_RE", part752); - - var part753 = match("MESSAGE#717:UI_TACPLUS_ERROR", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: TACACS+ failure: %{result}", processor_chain([ - dup30, - dup22, - dup129, - dup23, - ])); - - var msg722 = msg("UI_TACPLUS_ERROR", part753); - - var part754 = match("MESSAGE#718:UI_VERSION_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to fetch system version: %{result}", processor_chain([ - dup30, - dup22, - setc("event_description","Unable to fetch system version"), - dup23, - ])); - - var msg723 = msg("UI_VERSION_FAILED", part754); - - var part755 = match("MESSAGE#719:UI_WRITE_RECONNECT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Re-establishing connection to peer %{hostname}", processor_chain([ - dup21, - dup22, - setc("event_description","Re-establishing connection to peer"), - dup23, - ])); - - var msg724 = msg("UI_WRITE_RECONNECT", part755); - - var part756 = match("MESSAGE#720:VRRPD_NEWMASTER_TRAP", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Interface %{interface->} (local addr: %{saddr}) is now master for %{username}", processor_chain([ - dup21, - dup22, - setc("event_description","Interface new master for User"), - dup23, - ])); - - var msg725 = msg("VRRPD_NEWMASTER_TRAP", part756); - - var part757 = match("MESSAGE#721:WEB_AUTH_FAIL", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to authenticate %{obj_name->} (username %{c_username})", processor_chain([ - dup69, - dup34, - dup35, - dup43, - dup22, - setc("event_description","Unable to authenticate client"), - dup23, - ])); - - var msg726 = msg("WEB_AUTH_FAIL", part757); - - var part758 = match("MESSAGE#722:WEB_AUTH_SUCCESS", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Authenticated %{agent->} client (username %{c_username})", processor_chain([ - dup80, - dup34, - dup35, - dup37, - dup22, - setc("event_description","Authenticated client"), - dup23, - ])); - - var msg727 = msg("WEB_AUTH_SUCCESS", part758); - - var part759 = match("MESSAGE#723:WEB_INTERFACE_UNAUTH", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Web services request received from unauthorized interface %{interface}", processor_chain([ - setc("eventcategory","1001030300"), - dup22, - setc("event_description","web request from unauthorized interface"), - dup23, - ])); - - var msg728 = msg("WEB_INTERFACE_UNAUTH", part759); - - var part760 = match("MESSAGE#724:WEB_READ", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to read from client: %{result}", processor_chain([ - dup74, - dup22, - setc("event_description","Unable to read from client"), - dup23, - ])); - - var msg729 = msg("WEB_READ", part760); - - var part761 = match("MESSAGE#725:WEBFILTER_REQUEST_NOT_CHECKED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Error encountered: %{result}, failed to check request %{url}", processor_chain([ - setc("eventcategory","1204020100"), - dup22, - setc("event_description","failed to check web request"), - dup23, - ])); - - var msg730 = msg("WEBFILTER_REQUEST_NOT_CHECKED", part761); - - var part762 = match("MESSAGE#726:FLOW_REASSEMBLE_FAIL", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" destination-address=\"%{daddr}\" assembly-id=\"%{fld1}\"]", processor_chain([ - dup74, - dup53, - dup43, - dup22, - dup52, - ])); - - var msg731 = msg("FLOW_REASSEMBLE_FAIL", part762); - - var part763 = match("MESSAGE#727:eswd", "nwparser.payload", "%{process}[%{process_id}]: Bridge Address: add %{macaddr}", processor_chain([ - dup29, - dup22, - setc("event_description","Bridge Address"), - dup23, - ])); - - var msg732 = msg("eswd", part763); - - var part764 = match("MESSAGE#728:eswd:01", "nwparser.payload", "%{process}[%{process_id}]: %{info}: STP state for interface %{interface->} context id %{id->} changed from %{fld3}", processor_chain([ - dup29, - dup22, - setc("event_description","ESWD STP State Change Info"), - dup23, - ])); - - var msg733 = msg("eswd:01", part764); - - var select72 = linear_select([ - msg732, - msg733, - ]); - - var part765 = match("MESSAGE#729:/usr/sbin/cron", "nwparser.payload", "%{process}[%{process_id}]: (%{username}) CMD ( %{action})", processor_chain([ - dup29, - dup22, - dup26, - dup23, - ])); - - var msg734 = msg("/usr/sbin/cron", part765); - - var part766 = match("MESSAGE#730:chassism:02", "nwparser.payload", "%{process}[%{process_id}]: %{info}: ifd %{interface->} %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","Link status change event"), - dup23, - ])); - - var msg735 = msg("chassism:02", part766); - - var part767 = match("MESSAGE#731:chassism:01", "nwparser.payload", "%{process}[%{process_id}]: %{info}: %{interface}, %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","ifd process flaps"), - dup23, - ])); - - var msg736 = msg("chassism:01", part767); - - var part768 = match("MESSAGE#732:chassism", "nwparser.payload", "%{process}[%{process_id}]: %{info}: %{action}", processor_chain([ - dup29, - dup22, - setc("event_description","IFCM "), - dup23, - ])); - - var msg737 = msg("chassism", part768); - - var select73 = linear_select([ - msg735, - msg736, - msg737, - ]); - - var msg738 = msg("WEBFILTER_URL_PERMITTED", dup158); - - var part769 = match("MESSAGE#734:WEBFILTER_URL_PERMITTED:01", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg739 = msg("WEBFILTER_URL_PERMITTED:01", part769); - - var part770 = match("MESSAGE#735:WEBFILTER_URL_PERMITTED:03", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=%{fld4}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg740 = msg("WEBFILTER_URL_PERMITTED:03", part770); - - var part771 = match("MESSAGE#736:WEBFILTER_URL_PERMITTED:02", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=%{url}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg741 = msg("WEBFILTER_URL_PERMITTED:02", part771); - - var select74 = linear_select([ - msg738, - msg739, - msg740, - msg741, - ]); - - var msg742 = msg("WEBFILTER_URL_BLOCKED", dup158); - - var part772 = match("MESSAGE#738:WEBFILTER_URL_BLOCKED:01", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var msg743 = msg("WEBFILTER_URL_BLOCKED:01", part772); - - var select75 = linear_select([ - msg742, - msg743, - ]); - - var part773 = match("MESSAGE#740:SECINTEL_NETWORK_CONNECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> Access url %{url->} on port %{network_port->} failed\u003c\u003c%{result}>.", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg744 = msg("SECINTEL_NETWORK_CONNECT_FAILED", part773); - - var part774 = match("MESSAGE#741:AAMWD_NETWORK_CONNECT_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> Access host %{hostname->} on ip %{hostip->} port %{network_port->} %{result}.", processor_chain([ - dup46, - dup47, - dup23, - ])); - - var msg745 = msg("AAMWD_NETWORK_CONNECT_FAILED", part774); - - var part775 = match("MESSAGE#742:PKID_UNABLE_TO_GET_CRL", "nwparser.payload", "%{process}[%{process_id}]: %{id}: Failed to retrieve CRL from received file for %{node}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg746 = msg("PKID_UNABLE_TO_GET_CRL", part775); - - var part776 = match("MESSAGE#743:SECINTEL_ERROR_OTHERS", "nwparser.payload", "%{process}[%{process_id}]: %{id}: \u003c\u003c%{fld12}> %{result}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg747 = msg("SECINTEL_ERROR_OTHERS", part776); - - var part777 = match("MESSAGE#744:JSRPD_HA_CONTROL_LINK_UP", "nwparser.payload", "%{process}[%{process_id}]: %{id}: HA control link monitor status is marked up", processor_chain([ - dup48, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg748 = msg("JSRPD_HA_CONTROL_LINK_UP", part777); - - var part778 = match("MESSAGE#745:LACPD_TIMEOUT", "nwparser.payload", "%{process}[%{process_id}]: LACPD_TIMEOUT: %{sinterface}: %{event_description}", processor_chain([ - dup46, - dup47, - dup23, - dup22, - dup128, - ])); - - var msg749 = msg("LACPD_TIMEOUT", part778); - - var msg750 = msg("cli", dup159); - - var msg751 = msg("pfed", dup159); - - var msg752 = msg("idpinfo", dup159); - - var msg753 = msg("kmd", dup159); - - var part779 = match("MESSAGE#751:node:01", "nwparser.payload", "%{hostname->} %{node->} Next-hop resolution requests from interface %{interface->} throttled", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg754 = msg("node:01", part779); - - var part780 = match("MESSAGE#752:node:02", "nwparser.payload", "%{hostname->} %{node->} %{process}: Trying peer connection, status %{resultcode}, attempt %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg755 = msg("node:02", part780); - - var part781 = match("MESSAGE#753:node:03", "nwparser.payload", "%{hostname->} %{node->} %{process}: trying master connection, status %{resultcode}, attempt %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg756 = msg("node:03", part781); - - var part782 = match("MESSAGE#754:node:04", "nwparser.payload", "%{hostname->} %{node->} %{fld1->} key %{fld2->} %{fld3->} port priority %{fld6->} %{fld4->} port %{portname->} %{fld5->} state %{resultcode}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg757 = msg("node:04", part782); - - var select76 = linear_select([ - dup131, - dup132, - ]); - - var part783 = match("MESSAGE#755:node:05/2", "nwparser.p0", "%{}sys priority %{fld4->} %{p0}"); - - var select77 = linear_select([ - dup132, - dup131, - ]); - - var part784 = match("MESSAGE#755:node:05/4", "nwparser.p0", "%{}sys %{interface}"); - - var all44 = all_match({ - processors: [ - dup130, - select76, - part783, - select77, - part784, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg758 = msg("node:05", all44); - - var part785 = match("MESSAGE#756:node:06/1_0", "nwparser.p0", "dst mac %{dinterface}"); - - var part786 = match("MESSAGE#756:node:06/1_1", "nwparser.p0", "src mac %{sinterface->} ether type %{fld1}"); - - var select78 = linear_select([ - part785, - part786, - ]); - - var all45 = all_match({ - processors: [ - dup130, - select78, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - ]), - }); - - var msg759 = msg("node:06", all45); - - var part787 = match("MESSAGE#757:node:07", "nwparser.payload", "%{hostname->} %{node->} %{process}: interface %{interface->} trigger reth_scan", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg760 = msg("node:07", part787); - - var part788 = match("MESSAGE#758:node:08", "nwparser.payload", "%{hostname->} %{node->} %{process}: %{info}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg761 = msg("node:08", part788); - - var part789 = match("MESSAGE#759:node:09", "nwparser.payload", "%{hostname->} %{node->} %{fld1}", processor_chain([ - dup21, - dup23, - dup22, - ])); - - var msg762 = msg("node:09", part789); - - var select79 = linear_select([ - msg754, - msg755, - msg756, - msg757, - msg758, - msg759, - msg760, - msg761, - msg762, - ]); - - var part790 = match("MESSAGE#760:(FPC:01", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: deleting active remote neighbor entry %{fld2->} from interface %{interface}.", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg763 = msg("(FPC:01", part790); - - var part791 = match("MESSAGE#761:(FPC:02", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type->} deleting nb %{fld2->} on ifd %{interface->} for cid %{fld3->} from active neighbor table", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg764 = msg("(FPC:02", part791); - - var part792 = match("MESSAGE#762:(FPC:03/0", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: M%{p0}"); - - var part793 = match("MESSAGE#762:(FPC:03/1_0", "nwparser.p0", "DOWN %{p0}"); - - var part794 = match("MESSAGE#762:(FPC:03/1_1", "nwparser.p0", "UP %{p0}"); - - var select80 = linear_select([ - part793, - part794, - ]); - - var part795 = match("MESSAGE#762:(FPC:03/2", "nwparser.p0", "received for interface %{interface}, member of %{fld4}"); - - var all46 = all_match({ - processors: [ - part792, - select80, - part795, - ], - on_success: processor_chain([ - dup21, - dup23, - dup22, - dup24, - ]), - }); - - var msg765 = msg("(FPC:03", all46); - - var part796 = match("MESSAGE#763:(FPC:04", "nwparser.payload", "%{fld1}) %{node->} kernel: %{event_type}: ifd=%{interface}, ifd flags=%{fld2}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg766 = msg("(FPC:04", part796); - - var part797 = match("MESSAGE#764:(FPC:05", "nwparser.payload", "%{fld1}) %{node->} kernel: rdp keepalive expired, connection dropped - src %{fld3}:%{fld2->} dest %{fld4}:%{fld5}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg767 = msg("(FPC:05", part797); - - var part798 = match("MESSAGE#765:(FPC", "nwparser.payload", "%{fld1}) %{node->} %{fld10}", processor_chain([ - dup21, - dup23, - dup22, - dup24, - ])); - - var msg768 = msg("(FPC", part798); - - var select81 = linear_select([ - msg763, - msg764, - msg765, - msg766, - msg767, - msg768, - ]); - - var part799 = match("MESSAGE#766:tnp.bootpd", "nwparser.payload", "%{process}[%{process_id}]:%{fld1}", processor_chain([ - dup48, - dup23, - dup22, - dup24, - ])); - - var msg769 = msg("tnp.bootpd", part799); - - var part800 = match("MESSAGE#769:AAMW_ACTION_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} hostname=\"%{hostname}\" file-category=\"%{fld9}\" verdict-number=\"%{fld10}\" action=\"%{action}\" list-hit=\"%{fld19}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" application=\"%{fld6}\" nested-application=\"%{fld7}\" policy-name=\"%{policyname}\" username=\"%{username}\" roles=\"%{user_role}\" session-id-32=\"%{sessionid}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" url=\"%{url}\"] %{fld27}", processor_chain([ - dup48, - dup52, - dup22, - dup61, - ])); - - var msg770 = msg("AAMW_ACTION_LOG", part800); - - var part801 = match("MESSAGE#770:AAMW_HOST_INFECTED_EVENT_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} timestamp=\"%{fld30}\" tenant-id=\"%{fld1}\" client-ip-str=\"%{hostip}\" hostname=\"%{hostname}\" status=\"%{fld13}\" policy-name=\"%{policyname}\" verdict-number=\"%{fld15}\" state=\"%{fld16}\" reason=\"%{result}\" message=\"%{info}\" %{fld3}", processor_chain([ - dup133, - dup52, - dup22, - dup61, - ])); - - var msg771 = msg("AAMW_HOST_INFECTED_EVENT_LOG", part801); - - var part802 = match("MESSAGE#771:AAMW_MALWARE_EVENT_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} timestamp=\"%{fld30}\" tenant-id=\"%{fld1}\" sample-sha256=\"%{checksum}\" client-ip-str=\"%{hostip}\" verdict-number=\"%{fld26}\" malware-info=\"%{threat_name}\" username=\"%{username}\" hostname=\"%{hostname}\" %{fld3}", processor_chain([ - dup133, - dup52, - dup22, - ])); - - var msg772 = msg("AAMW_MALWARE_EVENT_LOG", part802); - - var part803 = match("MESSAGE#772:IDP_ATTACK_LOG_EVENT", "nwparser.payload", "%{event_type}[junos@%{fld32->} epoch-time=\"%{fld1}\" message-type=\"%{info}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-name=\"%{protocol}\" service-name=\"%{service}\" application-name=\"%{application}\" rule-name=\"%{fld5}\" rulebase-name=\"%{rulename}\" policy-name=\"%{policyname}\" export-id=\"%{fld6}\" repeat-count=\"%{fld7}\" action=\"%{action}\" threat-severity=\"%{severity}\" attack-name=\"%{threat_name}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" elapsed-time=%{fld8->} inbound-bytes=\"%{rbytes}\" outbound-bytes=\"%{sbytes}\" inbound-packets=\"%{packets}\" outbound-packets=\"%{dclass_counter1}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" packet-log-id=\"%{fld9}\" alert=\"%{fld19}\" username=\"%{username}\" roles=\"%{fld15}\" message=\"%{fld28}\" %{fld3}", processor_chain([ - dup81, - dup52, - dup22, - dup61, - ])); - - var msg773 = msg("IDP_ATTACK_LOG_EVENT", part803); - - var part804 = match("MESSAGE#773:RT_SCREEN_ICMP", "nwparser.payload", "%{event_type}[junos@%{fld32->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" destination-address=\"%{daddr}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"] %{fld23}", processor_chain([ - dup81, - dup52, - dup22, - dup61, - ])); - - var msg774 = msg("RT_SCREEN_ICMP", part804); - - var part805 = match("MESSAGE#774:SECINTEL_ACTION_LOG", "nwparser.payload", "%{event_type}[junos@%{fld32->} category=\"%{fld1}\" sub-category=\"%{fld2}\" action=\"%{action}\" action-detail=\"%{fld4}\" http-host=\"%{fld17}\" threat-severity=\"%{severity}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" protocol-id=\"%{protocol}\" application=\"%{fld5}\" nested-application=\"%{fld6}\" feed-name=\"%{fld18}\" policy-name=\"%{policyname}\" profile-name=\"%{rulename}\" username=\"%{username}\" roles=\"%{user_role}\" session-id-32=\"%{sessionid}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\"]%{fld10}", processor_chain([ - dup46, - dup52, - dup22, - dup61, - ])); - - var msg775 = msg("SECINTEL_ACTION_LOG", part805); - - var part806 = match("MESSAGE#775:qsfp/0", "nwparser.payload", "%{hostname->} %{fld2->} %{p0}"); - - var part807 = match("MESSAGE#775:qsfp/1_0", "nwparser.p0", "%{fld3->} %{process}: qsfp-%{p0}"); - - var part808 = match("MESSAGE#775:qsfp/1_1", "nwparser.p0", "qsfp-%{p0}"); - - var select82 = linear_select([ - part807, - part808, - ]); - - var part809 = match("MESSAGE#775:qsfp/2", "nwparser.p0", "%{}Chan# %{interface->} %{fld5}:%{event_description}"); - - var all47 = all_match({ - processors: [ - part806, - select82, - part809, - ], - on_success: processor_chain([ - dup21, - dup22, - dup23, - ]), - }); - - var msg776 = msg("qsfp", all47); - - var part810 = match("MESSAGE#776:JUNOSROUTER_GENERIC:03", "nwparser.payload", "%{event_type}: User '%{username}', command '%{action}'", processor_chain([ - dup21, - dup22, - dup121, - dup23, - ])); - - var msg777 = msg("JUNOSROUTER_GENERIC:03", part810); - - var part811 = match("MESSAGE#777:JUNOSROUTER_GENERIC:04", "nwparser.payload", "%{event_type}: User '%{username}' %{fld1}", processor_chain([ - dup125, - dup34, - dup35, - dup126, - dup37, - dup22, - setc("event_description","LOGOUT"), - dup23, - ])); - - var msg778 = msg("JUNOSROUTER_GENERIC:04", part811); - - var part812 = match("MESSAGE#778:JUNOSROUTER_GENERIC:05", "nwparser.payload", "%{event_type}: TACACS+ failure: %{result}", processor_chain([ - dup30, - dup22, - dup129, - dup23, - ])); - - var msg779 = msg("JUNOSROUTER_GENERIC:05", part812); - - var part813 = match("MESSAGE#779:JUNOSROUTER_GENERIC:06", "nwparser.payload", "%{event_type}: mismatch NLRI with %{hostip->} (%{hostname}): peer: %{daddr->} us: %{saddr}", processor_chain([ - dup30, - dup22, - dup57, - dup23, - ])); - - var msg780 = msg("JUNOSROUTER_GENERIC:06", part813); - - var part814 = match("MESSAGE#780:JUNOSROUTER_GENERIC:07", "nwparser.payload", "%{event_type}: NOTIFICATION sent to %{daddr->} (%{dhost}): code %{resultcode->} (%{action}), Reason: %{result}", processor_chain([ - dup21, - dup22, - dup38, - dup23, - ])); - - var msg781 = msg("JUNOSROUTER_GENERIC:07", part814); - - var part815 = match("MESSAGE#781:JUNOSROUTER_GENERIC:08/0", "nwparser.payload", "%{event_type}: NOTIFICATION received from %{daddr->} (%{dhost}): code %{resultcode->} (%{action})%{p0}"); - - var part816 = match("MESSAGE#781:JUNOSROUTER_GENERIC:08/1_0", "nwparser.p0", ", socket buffer sndcc: %{fld1->} rcvcc: %{fld2->} TCP state: %{event_state}, snd_una: %{fld3->} snd_nxt: %{fld4->} snd_wnd: %{fld5->} rcv_nxt: %{fld6->} rcv_adv: %{fld7}, hold timer %{fld8}"); - - var part817 = match_copy("MESSAGE#781:JUNOSROUTER_GENERIC:08/1_1", "nwparser.p0", ""); - - var select83 = linear_select([ - part816, - part817, - ]); - - var all48 = all_match({ - processors: [ - part815, - select83, - ], - on_success: processor_chain([ - dup21, - dup22, - dup38, - dup23, - ]), - }); - - var msg782 = msg("JUNOSROUTER_GENERIC:08", all48); - - var part818 = match("MESSAGE#782:JUNOSROUTER_GENERIC:09", "nwparser.payload", "%{event_type}: [edit interfaces%{interface}unit%{fld1}family inet address%{hostip}/%{network_port}] :%{event_description}:%{info}", processor_chain([ - dup21, - dup22, - dup23, - ])); - - var msg783 = msg("JUNOSROUTER_GENERIC:09", part818); - - var part819 = match("MESSAGE#783:JUNOSROUTER_GENERIC:01", "nwparser.payload", "%{event_type->} Interface Monitor failed %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - setc("event_description","Interface Monitor failed "), - dup24, - ])); - - var msg784 = msg("JUNOSROUTER_GENERIC:01", part819); - - var part820 = match("MESSAGE#784:JUNOSROUTER_GENERIC:02", "nwparser.payload", "%{event_type->} Interface Monitor failure recovered %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - setc("event_description","Interface Monitor failure recovered"), - dup24, - ])); - - var msg785 = msg("JUNOSROUTER_GENERIC:02", part820); - - var part821 = match("MESSAGE#785:JUNOSROUTER_GENERIC", "nwparser.payload", "%{event_type->} %{fld1}", processor_chain([ - dup134, - dup23, - dup22, - dup24, - ])); - - var msg786 = msg("JUNOSROUTER_GENERIC", part821); - - var select84 = linear_select([ - msg777, - msg778, - msg779, - msg780, - msg781, - msg782, - msg783, - msg784, - msg785, - msg786, - ]); - - var chain1 = processor_chain([ - select5, - msgid_select({ - "(FPC": select81, - "/usr/libexec/telnetd": msg2, - "/usr/sbin/cron": msg734, - "/usr/sbin/sshd": msg1, - "AAMWD_NETWORK_CONNECT_FAILED": msg745, - "AAMW_ACTION_LOG": msg770, - "AAMW_HOST_INFECTED_EVENT_LOG": msg771, - "AAMW_MALWARE_EVENT_LOG": msg772, - "ACCT_ACCOUNTING_FERROR": msg114, - "ACCT_ACCOUNTING_FOPEN_ERROR": msg115, - "ACCT_ACCOUNTING_SMALL_FILE_SIZE": msg116, - "ACCT_BAD_RECORD_FORMAT": msg117, - "ACCT_CU_RTSLIB_error": msg118, - "ACCT_GETHOSTNAME_error": msg119, - "ACCT_MALLOC_FAILURE": msg120, - "ACCT_UNDEFINED_COUNTER_NAME": msg121, - "ACCT_XFER_FAILED": msg122, - "ACCT_XFER_POPEN_FAIL": msg123, - "APPQOS_LOG_EVENT": msg124, - "APPTRACK_SESSION_CLOSE": select30, - "APPTRACK_SESSION_CREATE": msg125, - "APPTRACK_SESSION_VOL_UPDATE": select31, - "BCHIP": msg106, - "BFDD_TRAP_STATE_DOWN": msg130, - "BFDD_TRAP_STATE_UP": msg131, - "BOOTPD_ARG_ERR": msg143, - "BOOTPD_BAD_ID": msg144, - "BOOTPD_BOOTSTRING": msg145, - "BOOTPD_CONFIG_ERR": msg146, - "BOOTPD_CONF_OPEN": msg147, - "BOOTPD_DUP_REV": msg148, - "BOOTPD_DUP_SLOT": msg149, - "BOOTPD_MODEL_CHK": msg150, - "BOOTPD_MODEL_ERR": msg151, - "BOOTPD_NEW_CONF": msg152, - "BOOTPD_NO_BOOTSTRING": msg153, - "BOOTPD_NO_CONFIG": msg154, - "BOOTPD_PARSE_ERR": msg155, - "BOOTPD_REPARSE": msg156, - "BOOTPD_SELECT_ERR": msg157, - "BOOTPD_TIMEOUT": msg158, - "BOOTPD_VERSION": msg159, - "CHASSISD": msg160, - "CHASSISD_ARGUMENT_ERROR": msg161, - "CHASSISD_BLOWERS_SPEED": msg162, - "CHASSISD_BLOWERS_SPEED_FULL": msg163, - "CHASSISD_CB_READ": msg164, - "CHASSISD_COMMAND_ACK_ERROR": msg165, - "CHASSISD_COMMAND_ACK_SF_ERROR": msg166, - "CHASSISD_CONCAT_MODE_ERROR": msg167, - "CHASSISD_CONFIG_INIT_ERROR": msg168, - "CHASSISD_CONFIG_WARNING": msg169, - "CHASSISD_EXISTS": msg170, - "CHASSISD_EXISTS_TERM_OTHER": msg171, - "CHASSISD_FILE_OPEN": msg172, - "CHASSISD_FILE_STAT": msg173, - "CHASSISD_FRU_EVENT": msg174, - "CHASSISD_FRU_IPC_WRITE_ERROR_EXT": msg175, - "CHASSISD_FRU_STEP_ERROR": msg176, - "CHASSISD_GETTIMEOFDAY": msg177, - "CHASSISD_HIGH_TEMP_CONDITION": msg214, - "CHASSISD_HOST_TEMP_READ": msg178, - "CHASSISD_IFDEV_DETACH_ALL_PSEUDO": msg179, - "CHASSISD_IFDEV_DETACH_FPC": msg180, - "CHASSISD_IFDEV_DETACH_PIC": msg181, - "CHASSISD_IFDEV_DETACH_PSEUDO": msg182, - "CHASSISD_IFDEV_DETACH_TLV_ERROR": msg183, - "CHASSISD_IFDEV_GET_BY_INDEX_FAIL": msg184, - "CHASSISD_IPC_MSG_QFULL_ERROR": msg185, - "CHASSISD_IPC_UNEXPECTED_RECV": msg186, - "CHASSISD_IPC_WRITE_ERR_NO_PIPE": msg187, - "CHASSISD_IPC_WRITE_ERR_NULL_ARGS": msg188, - "CHASSISD_MAC_ADDRESS_ERROR": msg189, - "CHASSISD_MAC_DEFAULT": msg190, - "CHASSISD_MBUS_ERROR": msg191, - "CHASSISD_PARSE_COMPLETE": msg192, - "CHASSISD_PARSE_ERROR": msg193, - "CHASSISD_PARSE_INIT": msg194, - "CHASSISD_PIDFILE_OPEN": msg195, - "CHASSISD_PIPE_WRITE_ERROR": msg196, - "CHASSISD_POWER_CHECK": msg197, - "CHASSISD_RECONNECT_SUCCESSFUL": msg198, - "CHASSISD_RELEASE_MASTERSHIP": msg199, - "CHASSISD_RE_INIT_INVALID_RE_SLOT": msg200, - "CHASSISD_ROOT_MOUNT_ERROR": msg201, - "CHASSISD_RTS_SEQ_ERROR": msg202, - "CHASSISD_SBOARD_VERSION_MISMATCH": msg203, - "CHASSISD_SERIAL_ID": msg204, - "CHASSISD_SMB_ERROR": msg205, - "CHASSISD_SNMP_TRAP10": msg208, - "CHASSISD_SNMP_TRAP6": msg206, - "CHASSISD_SNMP_TRAP7": msg207, - "CHASSISD_TERM_SIGNAL": msg209, - "CHASSISD_TRACE_PIC_OFFLINE": msg210, - "CHASSISD_UNEXPECTED_EXIT": msg211, - "CHASSISD_UNSUPPORTED_MODEL": msg212, - "CHASSISD_VERSION_MISMATCH": msg213, - "CM": msg107, - "CM_JAVA": msg216, - "COS": msg108, - "COSFPC": msg109, - "COSMAN": msg110, - "CRON": msg16, - "CROND": select11, - "Cmerror": msg17, - "DCD_AS_ROOT": msg217, - "DCD_FILTER_LIB_ERROR": msg218, - "DCD_MALLOC_FAILED_INIT": msg219, - "DCD_PARSE_EMERGENCY": msg220, - "DCD_PARSE_FILTER_EMERGENCY": msg221, - "DCD_PARSE_MINI_EMERGENCY": msg222, - "DCD_PARSE_STATE_EMERGENCY": msg223, - "DCD_POLICER_PARSE_EMERGENCY": msg224, - "DCD_PULL_LOG_FAILURE": msg225, - "DFWD_ARGUMENT_ERROR": msg226, - "DFWD_MALLOC_FAILED_INIT": msg227, - "DFWD_PARSE_FILTER_EMERGENCY": msg228, - "DFWD_PARSE_STATE_EMERGENCY": msg229, - "ECCD_DAEMONIZE_FAILED": msg230, - "ECCD_DUPLICATE": msg231, - "ECCD_LOOP_EXIT_FAILURE": msg232, - "ECCD_NOT_ROOT": msg233, - "ECCD_PCI_FILE_OPEN_FAILED": msg234, - "ECCD_PCI_READ_FAILED": msg235, - "ECCD_PCI_WRITE_FAILED": msg236, - "ECCD_PID_FILE_LOCK": msg237, - "ECCD_PID_FILE_UPDATE": msg238, - "ECCD_TRACE_FILE_OPEN_FAILED": msg239, - "ECCD_usage": msg240, - "EVENT": msg23, - "EVENTD_AUDIT_SHOW": msg241, - "FLOW_REASSEMBLE_FAIL": msg731, - "FLOW_REASSEMBLE_SUCCEED": msg242, - "FSAD_CHANGE_FILE_OWNER": msg243, - "FSAD_CONFIG_ERROR": msg244, - "FSAD_CONNTIMEDOUT": msg245, - "FSAD_FAILED": msg246, - "FSAD_FETCHTIMEDOUT": msg247, - "FSAD_FILE_FAILED": msg248, - "FSAD_FILE_REMOVE": msg249, - "FSAD_FILE_RENAME": msg250, - "FSAD_FILE_STAT": msg251, - "FSAD_FILE_SYNC": msg252, - "FSAD_MAXCONN": msg253, - "FSAD_MEMORYALLOC_FAILED": msg254, - "FSAD_NOT_ROOT": msg255, - "FSAD_PARENT_DIRECTORY": msg256, - "FSAD_PATH_IS_DIRECTORY": msg257, - "FSAD_PATH_IS_SPECIAL": msg258, - "FSAD_RECVERROR": msg259, - "FSAD_TERMINATED_CONNECTION": msg260, - "FSAD_TERMINATING_SIGNAL": msg261, - "FSAD_TRACEOPEN_FAILED": msg262, - "FSAD_USAGE": msg263, - "Failed": select25, - "GGSN_ALARM_TRAP_FAILED": msg264, - "GGSN_ALARM_TRAP_SEND": msg265, - "GGSN_TRAP_SEND": msg266, - "IDP_ATTACK_LOG_EVENT": msg773, - "JADE_AUTH_ERROR": msg267, - "JADE_EXEC_ERROR": msg268, - "JADE_NO_LOCAL_USER": msg269, - "JADE_PAM_ERROR": msg270, - "JADE_PAM_NO_LOCAL_USER": msg271, - "JSRPD_HA_CONTROL_LINK_UP": msg748, - "JUNOSROUTER_GENERIC": select84, - "KERN_ARP_ADDR_CHANGE": msg272, - "KMD_PM_SA_ESTABLISHED": msg273, - "L2CPD_TASK_REINIT": msg274, - "LACPD_TIMEOUT": msg749, - "LIBJNX_EXEC_EXITED": msg275, - "LIBJNX_EXEC_FAILED": msg276, - "LIBJNX_EXEC_PIPE": msg277, - "LIBJNX_EXEC_SIGNALED": msg278, - "LIBJNX_EXEC_WEXIT": msg279, - "LIBJNX_FILE_COPY_FAILED": msg280, - "LIBJNX_PRIV_LOWER_FAILED": msg281, - "LIBJNX_PRIV_RAISE_FAILED": msg282, - "LIBJNX_REPLICATE_RCP_EXEC_FAILED": msg283, - "LIBJNX_ROTATE_COMPRESS_EXEC_FAILED": msg284, - "LIBSERVICED_CLIENT_CONNECTION": msg285, - "LIBSERVICED_OUTBOUND_REQUEST": msg286, - "LIBSERVICED_SNMP_LOST_CONNECTION": msg287, - "LIBSERVICED_SOCKET_BIND": msg288, - "LIBSERVICED_SOCKET_PRIVATIZE": msg289, - "LICENSE_EXPIRED": msg290, - "LICENSE_EXPIRED_KEY_DELETED": msg291, - "LICENSE_NEARING_EXPIRY": msg292, - "LOGIN_ABORTED": msg293, - "LOGIN_FAILED": msg294, - "LOGIN_FAILED_INCORRECT_PASSWORD": msg295, - "LOGIN_FAILED_SET_CONTEXT": msg296, - "LOGIN_FAILED_SET_LOGIN": msg297, - "LOGIN_HOSTNAME_UNRESOLVED": msg298, - "LOGIN_INFORMATION": msg299, - "LOGIN_INVALID_LOCAL_USER": msg300, - "LOGIN_MALFORMED_USER": msg301, - "LOGIN_PAM_AUTHENTICATION_ERROR": msg302, - "LOGIN_PAM_ERROR": msg303, - "LOGIN_PAM_MAX_RETRIES": msg304, - "LOGIN_PAM_NONLOCAL_USER": msg305, - "LOGIN_PAM_STOP": msg306, - "LOGIN_PAM_USER_UNKNOWN": msg307, - "LOGIN_PASSWORD_EXPIRED": msg308, - "LOGIN_REFUSED": msg309, - "LOGIN_ROOT": msg310, - "LOGIN_TIMED_OUT": msg311, - "MIB2D_ATM_ERROR": msg312, - "MIB2D_CONFIG_CHECK_FAILED": msg313, - "MIB2D_FILE_OPEN_FAILURE": msg314, - "MIB2D_IFD_IFINDEX_FAILURE": msg315, - "MIB2D_IFL_IFINDEX_FAILURE": msg316, - "MIB2D_INIT_FAILURE": msg317, - "MIB2D_KVM_FAILURE": msg318, - "MIB2D_RTSLIB_READ_FAILURE": msg319, - "MIB2D_RTSLIB_SEQ_MISMATCH": msg320, - "MIB2D_SYSCTL_FAILURE": msg321, - "MIB2D_TRAP_HEADER_FAILURE": msg322, - "MIB2D_TRAP_SEND_FAILURE": msg323, - "MRVL-L2": msg56, - "Multiuser": msg324, - "NASD_AUTHENTICATION_CREATE_FAILED": msg325, - "NASD_CHAP_AUTHENTICATION_IN_PROGRESS": msg326, - "NASD_CHAP_GETHOSTNAME_FAILED": msg327, - "NASD_CHAP_INVALID_CHAP_IDENTIFIER": msg328, - "NASD_CHAP_INVALID_OPCODE": msg329, - "NASD_CHAP_LOCAL_NAME_UNAVAILABLE": msg330, - "NASD_CHAP_MESSAGE_UNEXPECTED": msg331, - "NASD_CHAP_REPLAY_ATTACK_DETECTED": msg332, - "NASD_CONFIG_GET_LAST_MODIFIED_FAILED": msg333, - "NASD_DAEMONIZE_FAILED": msg334, - "NASD_DB_ALLOC_FAILURE": msg335, - "NASD_DB_TABLE_CREATE_FAILURE": msg336, - "NASD_DUPLICATE": msg337, - "NASD_EVLIB_CREATE_FAILURE": msg338, - "NASD_EVLIB_EXIT_FAILURE": msg339, - "NASD_LOCAL_CREATE_FAILED": msg340, - "NASD_NOT_ROOT": msg341, - "NASD_PID_FILE_LOCK": msg342, - "NASD_PID_FILE_UPDATE": msg343, - "NASD_POST_CONFIGURE_EVENT_FAILED": msg344, - "NASD_PPP_READ_FAILURE": msg345, - "NASD_PPP_SEND_FAILURE": msg346, - "NASD_PPP_SEND_PARTIAL": msg347, - "NASD_PPP_UNRECOGNIZED": msg348, - "NASD_RADIUS_ALLOCATE_PASSWORD_FAILED": msg349, - "NASD_RADIUS_CONFIG_FAILED": msg350, - "NASD_RADIUS_CREATE_FAILED": msg351, - "NASD_RADIUS_CREATE_REQUEST_FAILED": msg352, - "NASD_RADIUS_GETHOSTNAME_FAILED": msg353, - "NASD_RADIUS_MESSAGE_UNEXPECTED": msg354, - "NASD_RADIUS_OPEN_FAILED": msg355, - "NASD_RADIUS_SELECT_FAILED": msg356, - "NASD_RADIUS_SET_TIMER_FAILED": msg357, - "NASD_TRACE_FILE_OPEN_FAILED": msg358, - "NASD_usage": msg359, - "NOTICE": msg360, - "PFEMAN": msg61, - "PFE_FW_SYSLOG_IP": select36, - "PFE_NH_RESOLVE_THROTTLED": msg363, - "PING_TEST_COMPLETED": msg364, - "PING_TEST_FAILED": msg365, - "PKID_UNABLE_TO_GET_CRL": msg746, - "PWC_EXIT": msg368, - "PWC_HOLD_RELEASE": msg369, - "PWC_INVALID_RUNS_ARGUMENT": msg370, - "PWC_INVALID_TIMEOUT_ARGUMENT": msg371, - "PWC_KILLED_BY_SIGNAL": msg372, - "PWC_KILL_EVENT": msg373, - "PWC_KILL_FAILED": msg374, - "PWC_KQUEUE_ERROR": msg375, - "PWC_KQUEUE_INIT": msg376, - "PWC_KQUEUE_REGISTER_FILTER": msg377, - "PWC_LOCKFILE_BAD_FORMAT": msg378, - "PWC_LOCKFILE_ERROR": msg379, - "PWC_LOCKFILE_MISSING": msg380, - "PWC_LOCKFILE_NOT_LOCKED": msg381, - "PWC_NO_PROCESS": msg382, - "PWC_PROCESS_EXIT": msg383, - "PWC_PROCESS_FORCED_HOLD": msg384, - "PWC_PROCESS_HOLD": msg385, - "PWC_PROCESS_HOLD_SKIPPED": msg386, - "PWC_PROCESS_OPEN": msg387, - "PWC_PROCESS_TIMED_HOLD": msg388, - "PWC_PROCESS_TIMEOUT": msg389, - "PWC_SIGNAL_INIT": msg390, - "PWC_SOCKET_CONNECT": msg391, - "PWC_SOCKET_CREATE": msg392, - "PWC_SOCKET_OPTION": msg393, - "PWC_STDOUT_WRITE": msg394, - "PWC_SYSTEM_CALL": msg395, - "PWC_UNKNOWN_KILL_OPTION": msg396, - "RDP": msg111, - "RMOPD_ADDRESS_MULTICAST_INVALID": msg397, - "RMOPD_ADDRESS_SOURCE_INVALID": msg398, - "RMOPD_ADDRESS_STRING_FAILURE": msg399, - "RMOPD_ADDRESS_TARGET_INVALID": msg400, - "RMOPD_DUPLICATE": msg401, - "RMOPD_ICMP_ADDRESS_TYPE_UNSUPPORTED": msg402, - "RMOPD_ICMP_SENDMSG_FAILURE": msg403, - "RMOPD_IFINDEX_NOT_ACTIVE": msg404, - "RMOPD_IFINDEX_NO_INFO": msg405, - "RMOPD_IFNAME_NOT_ACTIVE": msg406, - "RMOPD_IFNAME_NO_INFO": msg407, - "RMOPD_NOT_ROOT": msg408, - "RMOPD_ROUTING_INSTANCE_NO_INFO": msg409, - "RMOPD_TRACEROUTE_ERROR": msg410, - "RMOPD_usage": msg411, - "RPD_ABORT": msg412, - "RPD_ACTIVE_TERMINATE": msg413, - "RPD_ASSERT": msg414, - "RPD_ASSERT_SOFT": msg415, - "RPD_EXIT": msg416, - "RPD_IFL_INDEXCOLLISION": msg417, - "RPD_IFL_NAMECOLLISION": msg418, - "RPD_ISIS_ADJDOWN": msg419, - "RPD_ISIS_ADJUP": msg420, - "RPD_ISIS_ADJUPNOIP": msg421, - "RPD_ISIS_LSPCKSUM": msg422, - "RPD_ISIS_OVERLOAD": msg423, - "RPD_KRT_AFUNSUPRT": msg424, - "RPD_KRT_CCC_IFL_MODIFY": msg425, - "RPD_KRT_DELETED_RTT": msg426, - "RPD_KRT_IFA_GENERATION": msg427, - "RPD_KRT_IFDCHANGE": msg428, - "RPD_KRT_IFDEST_GET": msg429, - "RPD_KRT_IFDGET": msg430, - "RPD_KRT_IFD_GENERATION": msg431, - "RPD_KRT_IFL_CELL_RELAY_MODE_INVALID": msg432, - "RPD_KRT_IFL_CELL_RELAY_MODE_UNSPECIFIED": msg433, - "RPD_KRT_IFL_GENERATION": msg434, - "RPD_KRT_KERNEL_BAD_ROUTE": msg435, - "RPD_KRT_NEXTHOP_OVERFLOW": msg436, - "RPD_KRT_NOIFD": msg437, - "RPD_KRT_UNKNOWN_RTT": msg438, - "RPD_KRT_VERSION": msg439, - "RPD_KRT_VERSIONNONE": msg440, - "RPD_KRT_VERSIONOLD": msg441, - "RPD_LDP_INTF_BLOCKED": msg442, - "RPD_LDP_INTF_UNBLOCKED": msg443, - "RPD_LDP_NBRDOWN": msg444, - "RPD_LDP_NBRUP": msg445, - "RPD_LDP_SESSIONDOWN": msg446, - "RPD_LDP_SESSIONUP": msg447, - "RPD_LOCK_FLOCKED": msg448, - "RPD_LOCK_LOCKED": msg449, - "RPD_MPLS_LSP_CHANGE": msg450, - "RPD_MPLS_LSP_DOWN": msg451, - "RPD_MPLS_LSP_SWITCH": msg452, - "RPD_MPLS_LSP_UP": msg453, - "RPD_MSDP_PEER_DOWN": msg454, - "RPD_MSDP_PEER_UP": msg455, - "RPD_OSPF_NBRDOWN": msg456, - "RPD_OSPF_NBRUP": msg457, - "RPD_OS_MEMHIGH": msg458, - "RPD_PIM_NBRDOWN": msg459, - "RPD_PIM_NBRUP": msg460, - "RPD_RDISC_CKSUM": msg461, - "RPD_RDISC_NOMULTI": msg462, - "RPD_RDISC_NORECVIF": msg463, - "RPD_RDISC_SOLICITADDR": msg464, - "RPD_RDISC_SOLICITICMP": msg465, - "RPD_RDISC_SOLICITLEN": msg466, - "RPD_RIP_AUTH": msg467, - "RPD_RIP_JOIN_BROADCAST": msg468, - "RPD_RIP_JOIN_MULTICAST": msg469, - "RPD_RT_IFUP": msg470, - "RPD_SCHED_CALLBACK_LONGRUNTIME": msg471, - "RPD_SCHED_CUMULATIVE_LONGRUNTIME": msg472, - "RPD_SCHED_MODULE_LONGRUNTIME": msg473, - "RPD_SCHED_TASK_LONGRUNTIME": msg474, - "RPD_SIGNAL_TERMINATE": msg475, - "RPD_START": msg476, - "RPD_SYSTEM": msg477, - "RPD_TASK_BEGIN": msg478, - "RPD_TASK_CHILDKILLED": msg479, - "RPD_TASK_CHILDSTOPPED": msg480, - "RPD_TASK_FORK": msg481, - "RPD_TASK_GETWD": msg482, - "RPD_TASK_NOREINIT": msg483, - "RPD_TASK_PIDCLOSED": msg484, - "RPD_TASK_PIDFLOCK": msg485, - "RPD_TASK_PIDWRITE": msg486, - "RPD_TASK_REINIT": msg487, - "RPD_TASK_SIGNALIGNORE": msg488, - "RT_COS": msg489, - "RT_FLOW_SESSION_CLOSE": select51, - "RT_FLOW_SESSION_CREATE": select45, - "RT_FLOW_SESSION_DENY": select47, - "RT_SCREEN_ICMP": msg774, - "RT_SCREEN_IP": select52, - "RT_SCREEN_SESSION_LIMIT": msg504, - "RT_SCREEN_TCP": msg503, - "RT_SCREEN_UDP": msg505, - "Resolve": msg63, - "SECINTEL_ACTION_LOG": msg775, - "SECINTEL_ERROR_OTHERS": msg747, - "SECINTEL_NETWORK_CONNECT_FAILED": msg744, - "SERVICED_CLIENT_CONNECT": msg506, - "SERVICED_CLIENT_DISCONNECTED": msg507, - "SERVICED_CLIENT_ERROR": msg508, - "SERVICED_COMMAND_FAILED": msg509, - "SERVICED_COMMIT_FAILED": msg510, - "SERVICED_CONFIGURATION_FAILED": msg511, - "SERVICED_CONFIG_ERROR": msg512, - "SERVICED_CONFIG_FILE": msg513, - "SERVICED_CONNECTION_ERROR": msg514, - "SERVICED_DISABLED_GGSN": msg515, - "SERVICED_DUPLICATE": msg516, - "SERVICED_EVENT_FAILED": msg517, - "SERVICED_INIT_FAILED": msg518, - "SERVICED_MALLOC_FAILURE": msg519, - "SERVICED_NETWORK_FAILURE": msg520, - "SERVICED_NOT_ROOT": msg521, - "SERVICED_PID_FILE_LOCK": msg522, - "SERVICED_PID_FILE_UPDATE": msg523, - "SERVICED_RTSOCK_SEQUENCE": msg524, - "SERVICED_SIGNAL_HANDLER": msg525, - "SERVICED_SOCKET_CREATE": msg526, - "SERVICED_SOCKET_IO": msg527, - "SERVICED_SOCKET_OPTION": msg528, - "SERVICED_STDLIB_FAILURE": msg529, - "SERVICED_USAGE": msg530, - "SERVICED_WORK_INCONSISTENCY": msg531, - "SNMPD_ACCESS_GROUP_ERROR": msg537, - "SNMPD_AUTH_FAILURE": select53, - "SNMPD_AUTH_PRIVILEGES_EXCEEDED": msg542, - "SNMPD_AUTH_RESTRICTED_ADDRESS": msg543, - "SNMPD_AUTH_WRONG_PDU_TYPE": msg544, - "SNMPD_CONFIG_ERROR": msg545, - "SNMPD_CONTEXT_ERROR": msg546, - "SNMPD_ENGINE_FILE_FAILURE": msg547, - "SNMPD_ENGINE_PROCESS_ERROR": msg548, - "SNMPD_FILE_FAILURE": msg549, - "SNMPD_GROUP_ERROR": msg550, - "SNMPD_INIT_FAILED": msg551, - "SNMPD_LIBJUNIPER_FAILURE": msg552, - "SNMPD_LOOPBACK_ADDR_ERROR": msg553, - "SNMPD_MEMORY_FREED": msg554, - "SNMPD_RADIX_FAILURE": msg555, - "SNMPD_RECEIVE_FAILURE": msg556, - "SNMPD_RMONFILE_FAILURE": msg557, - "SNMPD_RMON_COOKIE": msg558, - "SNMPD_RMON_EVENTLOG": msg559, - "SNMPD_RMON_IOERROR": msg560, - "SNMPD_RMON_MIBERROR": msg561, - "SNMPD_RTSLIB_ASYNC_EVENT": msg562, - "SNMPD_SEND_FAILURE": select54, - "SNMPD_SOCKET_FAILURE": msg565, - "SNMPD_SUBAGENT_NO_BUFFERS": msg566, - "SNMPD_SUBAGENT_SEND_FAILED": msg567, - "SNMPD_SYSLIB_FAILURE": msg568, - "SNMPD_THROTTLE_QUEUE_DRAINED": msg569, - "SNMPD_TRAP_COLD_START": msg570, - "SNMPD_TRAP_GEN_FAILURE": msg571, - "SNMPD_TRAP_GEN_FAILURE2": msg572, - "SNMPD_TRAP_INVALID_DATA": msg573, - "SNMPD_TRAP_NOT_ENOUGH_VARBINDS": msg574, - "SNMPD_TRAP_QUEUED": msg575, - "SNMPD_TRAP_QUEUE_DRAINED": msg576, - "SNMPD_TRAP_QUEUE_MAX_ATTEMPTS": msg577, - "SNMPD_TRAP_QUEUE_MAX_SIZE": msg578, - "SNMPD_TRAP_THROTTLED": msg579, - "SNMPD_TRAP_TYPE_ERROR": msg580, - "SNMPD_TRAP_VARBIND_TYPE_ERROR": msg581, - "SNMPD_TRAP_VERSION_ERROR": msg582, - "SNMPD_TRAP_WARM_START": msg583, - "SNMPD_USER_ERROR": msg584, - "SNMPD_VIEW_DELETE": msg585, - "SNMPD_VIEW_INSTALL_DEFAULT": msg586, - "SNMPD_VIEW_OID_PARSE": msg587, - "SNMP_GET_ERROR1": msg588, - "SNMP_GET_ERROR2": msg589, - "SNMP_GET_ERROR3": msg590, - "SNMP_GET_ERROR4": msg591, - "SNMP_NS_LOG_INFO": msg535, - "SNMP_RTSLIB_FAILURE": msg592, - "SNMP_SUBAGENT_IPC_REG_ROWS": msg536, - "SNMP_TRAP_LINK_DOWN": select55, - "SNMP_TRAP_LINK_UP": select56, - "SNMP_TRAP_PING_PROBE_FAILED": msg597, - "SNMP_TRAP_PING_TEST_COMPLETED": msg598, - "SNMP_TRAP_PING_TEST_FAILED": msg599, - "SNMP_TRAP_TRACE_ROUTE_PATH_CHANGE": msg600, - "SNMP_TRAP_TRACE_ROUTE_TEST_COMPLETED": msg601, - "SNMP_TRAP_TRACE_ROUTE_TEST_FAILED": msg602, - "SNTPD": msg112, - "SSB": msg113, - "SSHD_LOGIN_FAILED": select57, - "SSL_PROXY_SESSION_IGNORE": msg534, - "SSL_PROXY_SSL_SESSION_ALLOW": msg532, - "SSL_PROXY_SSL_SESSION_DROP": msg533, - "TASK_TASK_REINIT": msg606, - "TFTPD_AF_ERR": msg607, - "TFTPD_BIND_ERR": msg608, - "TFTPD_CONNECT_ERR": msg609, - "TFTPD_CONNECT_INFO": msg610, - "TFTPD_CREATE_ERR": msg611, - "TFTPD_FIO_ERR": msg612, - "TFTPD_FORK_ERR": msg613, - "TFTPD_NAK_ERR": msg614, - "TFTPD_OPEN_ERR": msg615, - "TFTPD_RECVCOMPLETE_INFO": msg616, - "TFTPD_RECVFROM_ERR": msg617, - "TFTPD_RECV_ERR": msg618, - "TFTPD_SENDCOMPLETE_INFO": msg619, - "TFTPD_SEND_ERR": msg620, - "TFTPD_SOCKET_ERR": msg621, - "TFTPD_STATFS_ERR": msg622, - "TNP": msg623, - "UI_AUTH_EVENT": msg628, - "UI_AUTH_INVALID_CHALLENGE": msg629, - "UI_BOOTTIME_FAILED": msg630, - "UI_CFG_AUDIT_NEW": select58, - "UI_CFG_AUDIT_OTHER": select60, - "UI_CFG_AUDIT_SET": select63, - "UI_CFG_AUDIT_SET_SECRET": select64, - "UI_CHILD_ARGS_EXCEEDED": msg645, - "UI_CHILD_CHANGE_USER": msg646, - "UI_CHILD_EXEC": msg647, - "UI_CHILD_EXITED": msg648, - "UI_CHILD_FOPEN": msg649, - "UI_CHILD_PIPE_FAILED": msg650, - "UI_CHILD_SIGNALED": msg651, - "UI_CHILD_START": msg653, - "UI_CHILD_STATUS": msg654, - "UI_CHILD_STOPPED": msg652, - "UI_CHILD_WAITPID": msg655, - "UI_CLI_IDLE_TIMEOUT": msg656, - "UI_CMDLINE_READ_LINE": msg657, - "UI_CMDSET_EXEC_FAILED": msg658, - "UI_CMDSET_FORK_FAILED": msg659, - "UI_CMDSET_PIPE_FAILED": msg660, - "UI_CMDSET_STOPPED": msg661, - "UI_CMDSET_WEXITED": msg662, - "UI_CMD_AUTH_REGEX_INVALID": msg663, - "UI_COMMIT": msg664, - "UI_COMMIT_AT": msg665, - "UI_COMMIT_AT_COMPLETED": msg666, - "UI_COMMIT_AT_FAILED": msg667, - "UI_COMMIT_COMPRESS_FAILED": msg668, - "UI_COMMIT_CONFIRMED": msg669, - "UI_COMMIT_CONFIRMED_REMINDER": msg670, - "UI_COMMIT_CONFIRMED_TIMED": msg671, - "UI_COMMIT_EMPTY_CONTAINER": msg672, - "UI_COMMIT_NOT_CONFIRMED": msg673, - "UI_COMMIT_PROGRESS": msg674, - "UI_COMMIT_QUIT": msg675, - "UI_COMMIT_ROLLBACK_FAILED": msg676, - "UI_COMMIT_SYNC": msg677, - "UI_COMMIT_SYNC_FORCE": msg678, - "UI_CONFIGURATION_ERROR": msg679, - "UI_DAEMON_ACCEPT_FAILED": msg680, - "UI_DAEMON_FORK_FAILED": msg681, - "UI_DAEMON_SELECT_FAILED": msg682, - "UI_DAEMON_SOCKET_FAILED": msg683, - "UI_DBASE_ACCESS_FAILED": msg684, - "UI_DBASE_CHECKOUT_FAILED": msg685, - "UI_DBASE_EXTEND_FAILED": msg686, - "UI_DBASE_LOGIN_EVENT": msg687, - "UI_DBASE_LOGOUT_EVENT": msg688, - "UI_DBASE_MISMATCH_EXTENT": msg689, - "UI_DBASE_MISMATCH_MAJOR": msg690, - "UI_DBASE_MISMATCH_MINOR": msg691, - "UI_DBASE_MISMATCH_SEQUENCE": msg692, - "UI_DBASE_MISMATCH_SIZE": msg693, - "UI_DBASE_OPEN_FAILED": msg694, - "UI_DBASE_REBUILD_FAILED": msg695, - "UI_DBASE_REBUILD_SCHEMA_FAILED": msg696, - "UI_DBASE_REBUILD_STARTED": msg697, - "UI_DBASE_RECREATE": msg698, - "UI_DBASE_REOPEN_FAILED": msg699, - "UI_DUPLICATE_UID": msg700, - "UI_JUNOSCRIPT_CMD": msg701, - "UI_JUNOSCRIPT_ERROR": msg702, - "UI_LOAD_EVENT": msg703, - "UI_LOAD_JUNOS_DEFAULT_FILE_EVENT": msg704, - "UI_LOGIN_EVENT": select71, - "UI_LOGOUT_EVENT": msg707, - "UI_LOST_CONN": msg708, - "UI_MASTERSHIP_EVENT": msg709, - "UI_MGD_TERMINATE": msg710, - "UI_NETCONF_CMD": msg711, - "UI_READ_FAILED": msg712, - "UI_READ_TIMEOUT": msg713, - "UI_REBOOT_EVENT": msg714, - "UI_RESTART_EVENT": msg715, - "UI_SCHEMA_CHECKOUT_FAILED": msg716, - "UI_SCHEMA_MISMATCH_MAJOR": msg717, - "UI_SCHEMA_MISMATCH_MINOR": msg718, - "UI_SCHEMA_MISMATCH_SEQUENCE": msg719, - "UI_SCHEMA_SEQUENCE_ERROR": msg720, - "UI_SYNC_OTHER_RE": msg721, - "UI_TACPLUS_ERROR": msg722, - "UI_VERSION_FAILED": msg723, - "UI_WRITE_RECONNECT": msg724, - "VRRPD_NEWMASTER_TRAP": msg725, - "Version": msg99, - "WEBFILTER_REQUEST_NOT_CHECKED": msg730, - "WEBFILTER_URL_BLOCKED": select75, - "WEBFILTER_URL_PERMITTED": select74, - "WEB_AUTH_FAIL": msg726, - "WEB_AUTH_SUCCESS": msg727, - "WEB_INTERFACE_UNAUTH": msg728, - "WEB_READ": msg729, - "alarmd": msg3, - "bgp_connect_start": msg132, - "bgp_event": msg133, - "bgp_listen_accept": msg134, - "bgp_listen_reset": msg135, - "bgp_nexthop_sanity": msg136, - "bgp_pp_recv": select33, - "bgp_process_caps": select32, - "bgp_send": msg141, - "bgp_traffic_timeout": msg142, - "bigd": select6, - "bigpipe": select7, - "bigstart": msg9, - "cgatool": msg10, - "chassisd": msg11, - "chassism": select73, - "checkd": select8, - "clean_process": msg215, - "cli": msg750, - "cosd": msg14, - "craftd": msg15, - "cron": msg18, - "crond": msg21, - "dcd": msg22, - "eswd": select72, - "ftpd": msg24, - "ha_rto_stats_handler": msg25, - "hostinit": msg26, - "idpinfo": msg752, - "ifinfo": select13, - "ifp_ifl_anydown_change_event": msg30, - "ifp_ifl_config_event": msg31, - "ifp_ifl_ext_chg": msg32, - "inetd": select14, - "init": select15, - "ipc_msg_write": msg40, - "kernel": select17, - "kmd": msg753, - "last": select28, - "login": select18, - "lsys_ssam_handler": msg53, - "mcsn": msg54, - "mgd": msg62, - "mrvl_dfw_log_effuse_status": msg55, - "node": select79, - "pfed": msg751, - "process_mode": select38, - "profile_ssam_handler": msg57, - "pst_nat_binding_set_profile": msg58, - "qsfp": msg776, - "respawn": msg64, - "root": msg65, - "rpd": select20, - "rshd": msg70, - "sfd": msg71, - "sshd": select21, - "syslogd": msg92, - "task_connect": msg605, - "task_reconfigure": msg59, - "tnetd": msg60, - "tnp.bootpd": msg769, - "trace_on": msg624, - "trace_rotate": msg625, - "transfer-file": msg626, - "ttloop": msg627, - "ucd-snmp": select26, - "usp_ipc_client_reconnect": msg95, - "usp_trace_ipc_disconnect": msg96, - "usp_trace_ipc_reconnect": msg97, - "uspinfo": msg98, - "xntpd": select27, - }), - ]); - - var hdr43 = match("HEADER#3:0004/0", "message", "%{month->} %{day->} %{time->} %{p0}"); - - var part822 = match("HEADER#3:0004/1_0", "nwparser.p0", "fpc0 %{p0}"); - - var part823 = match("HEADER#3:0004/1_1", "nwparser.p0", "fpc1 %{p0}"); - - var part824 = match("HEADER#3:0004/1_2", "nwparser.p0", "fpc2 %{p0}"); - - var part825 = match("HEADER#3:0004/1_3", "nwparser.p0", "fpc3 %{p0}"); - - var part826 = match("HEADER#3:0004/1_4", "nwparser.p0", "fpc4 %{p0}"); - - var part827 = match("HEADER#3:0004/1_5", "nwparser.p0", "fpc5 %{p0}"); - - var part828 = match("HEADER#3:0004/1_11", "nwparser.p0", "ssb %{p0}"); - - var part829 = match("HEADER#15:0026.upd.a/1_0", "nwparser.p0", "RT_FLOW - %{p0}"); - - var part830 = match("HEADER#15:0026.upd.a/1_1", "nwparser.p0", "junos-ssl-proxy - %{p0}"); - - var part831 = match("HEADER#15:0026.upd.a/1_2", "nwparser.p0", "RT_APPQOS - %{p0}"); - - var part832 = match("HEADER#15:0026.upd.a/1_3", "nwparser.p0", "%{hfld33->} - %{p0}"); - - var hdr44 = match("HEADER#16:0026.upd.b/0", "message", "%{event_time->} %{hfld32->} %{hhostname->} %{p0}"); - - var part833 = match("MESSAGE#77:sshd:06/0", "nwparser.payload", "%{} %{p0}"); - - var part834 = match("MESSAGE#77:sshd:06/1_0", "nwparser.p0", "%{process}[%{process_id}]: %{p0}"); - - var part835 = match("MESSAGE#77:sshd:06/1_1", "nwparser.p0", "%{process}: %{p0}"); - - var part836 = match_copy("MESSAGE#72:Failed:05/1_2", "nwparser.p0", "p0"); - - var part837 = match("MESSAGE#114:ACCT_GETHOSTNAME_error/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{p0}"); - - var part838 = match("MESSAGE#294:LOGIN_INFORMATION/3_0", "nwparser.p0", "User %{p0}"); - - var part839 = match("MESSAGE#294:LOGIN_INFORMATION/3_1", "nwparser.p0", "user %{p0}"); - - var part840 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var part841 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_0", "nwparser.p0", " connection-tag=%{fld20->} service-name=\"%{p0}"); - - var part842 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/1_1", "nwparser.p0", " service-name=\"%{p0}"); - - var part843 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/3_0", "nwparser.p0", " nat-connection-tag=%{fld6->} src-nat-rule-type=%{fld20->} %{p0}"); - - var part844 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/5_1", "nwparser.p0", "name=\"%{p0}"); - - var part845 = match("MESSAGE#485:RT_FLOW_SESSION_CREATE:02/8", "nwparser.p0", "]%{}"); - - var part846 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_0", "nwparser.payload", "%{process}: %{event_type}: session denied %{p0}"); - - var part847 = match("MESSAGE#490:RT_FLOW_SESSION_DENY:03/0_1", "nwparser.payload", "%{event_type}: session denied %{p0}"); - - var part848 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/0", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} reason=\"%{result}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\"%{p0}"); - - var part849 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/2", "nwparser.p0", "%{service}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\"%{p0}"); - - var part850 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/4", "nwparser.p0", "%{}src-nat-rule-name=\"%{rulename}\" dst-nat-rule-%{p0}"); - - var part851 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/5_0", "nwparser.p0", "type=%{fld7->} dst-nat-rule-name=\"%{p0}"); - - var part852 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/6", "nwparser.p0", "\"%{rule_template->} protocol-id=\"%{protocol}\" policy-name=\"%{policyname}\" source-zone-name=\"%{src_zone}\" destination-zone-name=\"%{dst_zone}\" session-id-32=\"%{sessionid}\" packets-from-client=\"%{packets}\" bytes-from-client=\"%{rbytes}\" packets-from-server=\"%{dclass_counter1}\" bytes-from-server=\"%{sbytes}\" elapsed-time=\"%{duration}\"%{p0}"); - - var part853 = match("MESSAGE#492:RT_FLOW_SESSION_CLOSE:01/7_0", "nwparser.p0", " application=\"%{fld6}\" nested-application=\"%{fld7}\" username=\"%{username}\" roles=\"%{fld15}\" packet-incoming-interface=\"%{dinterface}\" encrypted=%{fld16->} %{p0}"); - - var part854 = match("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' set: [%{action}] %{p0}"); - - var part855 = match_copy("MESSAGE#630:UI_CFG_AUDIT_OTHER:02/1_1", "nwparser.p0", "space"); - - var part856 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/1_1", "nwparser.p0", "\u003c\u003c%{change_old}> %{p0}"); - - var part857 = match("MESSAGE#634:UI_CFG_AUDIT_SET:01/2", "nwparser.p0", "-> \"%{change_new}\""); - - var part858 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/0", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: User '%{username}' %{p0}"); - - var part859 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_0", "nwparser.p0", "set %{p0}"); - - var part860 = match("MESSAGE#637:UI_CFG_AUDIT_SET_SECRET:01/1_1", "nwparser.p0", "replace %{p0}"); - - var part861 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_0", "nwparser.p0", "Network %{p0}"); - - var part862 = match("MESSAGE#675:UI_DAEMON_ACCEPT_FAILED/1_1", "nwparser.p0", "Local %{p0}"); - - var part863 = match("MESSAGE#755:node:05/0", "nwparser.payload", "%{hostname->} %{node->} %{p0}"); - - var part864 = match("MESSAGE#755:node:05/1_0", "nwparser.p0", "partner%{p0}"); - - var part865 = match("MESSAGE#755:node:05/1_1", "nwparser.p0", "actor%{p0}"); - - var select85 = linear_select([ - dup14, - dup15, - dup16, - dup17, - ]); - - var part866 = match("HEADER#15:0026.upd.a/2", "nwparser.p0", "%{messageid->} [%{p0}", processor_chain([ - dup13, - ])); - - var select86 = linear_select([ - dup40, - dup41, - ]); - - var part867 = match("MESSAGE#125:BFDD_TRAP_STATE_DOWN", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: local discriminator: %{resultcode}, new state: %{result}", processor_chain([ - dup21, - dup22, - dup56, - dup23, - ])); - - var part868 = match("MESSAGE#214:DCD_MALLOC_FAILED_INIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Memory allocation failed during initialization for configuration load", processor_chain([ - dup51, - dup22, - dup64, - dup23, - ])); - - var part869 = match("MESSAGE#225:ECCD_DAEMONIZE_FAILED", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{action}, unable to run in the background as a daemon: %{result}", processor_chain([ - dup30, - dup22, - dup65, - dup23, - ])); - - var part870 = match("MESSAGE#226:ECCD_DUPLICATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Another copy of this program is running", processor_chain([ - dup30, - dup22, - dup66, - dup23, - ])); - - var part871 = match("MESSAGE#232:ECCD_PID_FILE_LOCK", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to lock PID file: %{result}", processor_chain([ - dup30, - dup22, - dup67, - dup23, - ])); - - var part872 = match("MESSAGE#233:ECCD_PID_FILE_UPDATE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to update process PID file: %{result}", processor_chain([ - dup30, - dup22, - dup68, - dup23, - ])); - - var part873 = match("MESSAGE#272:LIBJNX_EXEC_PIPE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Unable to create pipes for command '%{action}': %{result}", processor_chain([ - dup30, - dup22, - dup71, - dup23, - ])); - - var select87 = linear_select([ - dup76, - dup77, - ]); - - var part874 = match("MESSAGE#310:MIB2D_IFD_IFINDEX_FAILURE", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: SNMP index assigned to %{uid->} changed from %{dclass_counter1->} to %{result}", processor_chain([ - dup30, - dup22, - dup79, - dup23, - ])); - - var part875 = match("MESSAGE#412:RPD_IFL_INDEXCOLLISION", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Logical interface collision -- %{result}, %{info}", processor_chain([ - dup30, - dup22, - dup84, - dup23, - ])); - - var part876 = match("MESSAGE#466:RPD_SCHED_CALLBACK_LONGRUNTIME", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: %{agent}: excessive runtime time during action of module", processor_chain([ - dup30, - dup22, - dup85, - dup23, - ])); - - var part877 = match("MESSAGE#482:RPD_TASK_REINIT", "nwparser.payload", "%{process}[%{process_id}]: %{event_type}: Reinitializing", processor_chain([ - dup21, - dup22, - dup86, - dup23, - ])); - - var select88 = linear_select([ - dup88, - dup89, - ]); - - var select89 = linear_select([ - dup90, - dup45, - ]); - - var select90 = linear_select([ - dup95, - dup96, - ]); - - var select91 = linear_select([ - dup101, - dup91, - ]); - - var part878 = match("MESSAGE#498:RT_SCREEN_TCP", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} attack-name=\"%{threat_name}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" source-zone-name=\"%{src_zone}\" interface-name=\"%{interface}\" action=\"%{action}\"]", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var part879 = match("MESSAGE#527:SSL_PROXY_SSL_SESSION_ALLOW", "nwparser.payload", "%{event_type->} [junos@%{obj_name->} logical-system-name=\"%{hostname}\" session-id=\"%{sessionid}\" source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" nat-source-address=\"%{hostip}\" nat-source-port=\"%{network_port}\" nat-destination-address=\"%{dtransaddr}\" nat-destination-port=\"%{dtransport}\" profile-name=\"%{rulename}\" source-zone-name=\"%{src_zone}\" source-interface-name=\"%{sinterface}\" destination-zone-name=\"%{dst_zone}\" destination-interface-name=\"%{dinterface}\" message=\"%{info}\"]", processor_chain([ - dup27, - dup22, - dup52, - ])); - - var select92 = linear_select([ - dup118, - dup119, - ]); - - var select93 = linear_select([ - dup123, - dup124, - ]); - - var part880 = match("MESSAGE#733:WEBFILTER_URL_PERMITTED", "nwparser.payload", "%{event_type->} [junos@%{fld21->} source-address=\"%{saddr}\" source-port=\"%{sport}\" destination-address=\"%{daddr}\" destination-port=\"%{dport}\" name=\"%{info}\" error-message=\"%{result}\" profile-name=\"%{profile}\" object-name=\"%{obj_name}\" pathname=\"%{directory}\" username=\"%{username}\" roles=\"%{user_role}\"] WebFilter: ACTION=\"%{action}\" %{fld2}->%{fld3->} CATEGORY=\"%{category}\" REASON=\"%{fld4}\" PROFILE=\"%{fld6}\" URL=%{url->} OBJ=%{fld7->} USERNAME=%{fld8->} ROLES=%{fld9}", processor_chain([ - dup30, - dup22, - dup52, - ])); - - var part881 = match_copy("MESSAGE#747:cli", "nwparser.payload", "fld12", processor_chain([ - dup48, - dup47, - dup23, - dup22, - ])); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/junos/elasticsearch/ingest_pipeline/default.yml b/packages/juniper/1.1.0/data_stream/junos/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 57565b4f7e..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,71 +0,0 @@ ---- -description: Pipeline for Juniper JUNOS - -processors: - # ECS event.ingested - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - - set: - field: ecs.version - value: '8.0.0' - # User agent - - user_agent: - field: user_agent.original - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - append: - field: related.hosts - value: '{{host.name}}' - allow_duplicates: false - if: ctx.host?.name != null && ctx.host?.name != '' - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - append: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/juniper/1.1.0/data_stream/junos/fields/agent.yml b/packages/juniper/1.1.0/data_stream/junos/fields/agent.yml deleted file mode 100755 index da4e652c53..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/fields/agent.yml +++ /dev/null @@ -1,198 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - diff --git a/packages/juniper/1.1.0/data_stream/junos/fields/base-fields.yml b/packages/juniper/1.1.0/data_stream/junos/fields/base-fields.yml deleted file mode 100755 index 6092398a3f..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/fields/base-fields.yml +++ /dev/null @@ -1,46 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: juniper -- name: event.dataset - type: constant_keyword - description: Event dataset - value: juniper.junos -- name: '@timestamp' - type: date - description: Event timestamp. -- name: container.id - description: Unique container id. - ignore_above: 1024 - type: keyword -- name: input.type - description: Type of Filebeat input. - type: keyword -- name: log.file.path - description: Full path to the log file this event came from. - example: /var/log/fun-times.log - ignore_above: 1024 - type: keyword -- name: log.source.address - description: Source address from which the log event was read / sent from. - type: keyword -- name: log.flags - description: Flags for the log file. - type: keyword -- name: log.offset - description: Offset of the entry in the log file. - type: long -- name: tags - description: List of keywords used to tag each event. - example: '["production", "env2"]' - ignore_above: 1024 - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/junos/fields/ecs.yml b/packages/juniper/1.1.0/data_stream/junos/fields/ecs.yml deleted file mode 100755 index 83d707fc6b..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/fields/ecs.yml +++ /dev/null @@ -1,506 +0,0 @@ -- description: |- - Date/time when the event originated. - This is the date/time extracted from the event, typically representing when the event was generated by the source. - If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. - Required field for all events. - name: '@timestamp' - type: date -- description: |- - The domain name of the client system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: client.domain - type: keyword -- description: |- - The highest registered client domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: client.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: client.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: client.top_level_domain - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - MAC address of the destination. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: destination.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - The highest registered destination domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: destination.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: destination.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: destination.top_level_domain - type: keyword -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: The type of data contained in this resource record. - name: dns.answers.type - type: keyword -- description: |- - The highest registered domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: dns.question.registered_domain - type: keyword -- description: |- - The subdomain is all of the labels under the registered_domain. - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: dns.question.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: dns.question.top_level_domain - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Error message. - name: error.message - type: match_only_text -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - name: event.original - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. - Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - name: event.timezone - type: keyword -- description: |- - Array of file attributes. - Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. - name: file.attributes - type: keyword -- description: Directory where the file is located. It should include the drive letter, when appropriate. - name: file.directory - type: keyword -- description: |- - File extension, excluding the leading dot. - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: file.extension - type: keyword -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - name: file.path - type: keyword -- description: |- - File size in bytes. - Only relevant when `file.type` is "file". - name: file.size - type: long -- description: File type (file, dir, or symlink). - name: file.type - type: keyword -- description: City name. - name: geo.city_name - type: keyword -- description: Country name. - name: geo.country_name - type: keyword -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: geo.name - type: keyword -- description: Region name. - name: geo.region_name - type: keyword -- description: Unique identifier for the group on the system/platform. - name: group.id - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Host MAC addresses. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: host.mac - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: |- - Original log level of the log event. - If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). - Some examples are `warn`, `err`, `i`, `informational`. - name: log.level - type: keyword -- description: |- - The Syslog numeric facility of the log event, if available. - According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. - name: log.syslog.facility.code - type: long -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - The Syslog numeric severity of the log event, if available. - If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. - name: log.syslog.severity.code - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: Host IP address when the source IP address is the proxy. - name: network.forwarded_ip - type: ip -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: The product name of the observer. - name: observer.product - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.name - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.parent.name - type: keyword -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.parent.title - type: keyword -- description: Process id. - name: process.pid - type: long -- description: Process id. - name: process.parent.pid - type: long -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.title - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: |- - The highest registered server domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: server.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: server.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: server.top_level_domain - type: keyword -- description: |- - Name of the service data is collected from. - The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. - In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - name: service.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - MAC address of the source. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: source.mac - type: keyword -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Port of the source. - name: source.port - type: long -- description: |- - The highest registered source domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: source.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: source.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: source.top_level_domain - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - The highest registered url domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: url.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: url.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword -- description: User's full name, if available. - name: user.full_name - type: keyword -- description: Unique identifier of the user. - name: user.id - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/junos/fields/fields.yml b/packages/juniper/1.1.0/data_stream/junos/fields/fields.yml deleted file mode 100755 index ea69cd79e3..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/fields/fields.yml +++ /dev/null @@ -1,1754 +0,0 @@ -- name: rsa - type: group - fields: - - name: internal - type: group - fields: - - name: msg - type: keyword - description: This key is used to capture the raw message that comes into the Log Decoder - - name: messageid - type: keyword - - name: event_desc - type: keyword - - name: message - type: keyword - description: This key captures the contents of instant messages - - name: time - type: date - description: This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - - name: level - type: long - description: Deprecated key defined only in table map. - - name: msg_id - type: keyword - description: This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: msg_vid - type: keyword - description: This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: data - type: keyword - description: Deprecated key defined only in table map. - - name: obj_server - type: keyword - description: Deprecated key defined only in table map. - - name: obj_val - type: keyword - description: Deprecated key defined only in table map. - - name: resource - type: keyword - description: Deprecated key defined only in table map. - - name: obj_id - type: keyword - description: Deprecated key defined only in table map. - - name: statement - type: keyword - description: Deprecated key defined only in table map. - - name: audit_class - type: keyword - description: Deprecated key defined only in table map. - - name: entry - type: keyword - description: Deprecated key defined only in table map. - - name: hcode - type: keyword - description: Deprecated key defined only in table map. - - name: inode - type: long - description: Deprecated key defined only in table map. - - name: resource_class - type: keyword - description: Deprecated key defined only in table map. - - name: dead - type: long - description: Deprecated key defined only in table map. - - name: feed_desc - type: keyword - description: This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: feed_name - type: keyword - description: This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: cid - type: keyword - description: This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_class - type: keyword - description: This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_group - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_host - type: keyword - description: This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ip - type: ip - description: This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ipv6 - type: ip - description: This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type - type: keyword - description: This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type_id - type: long - description: Deprecated key defined only in table map. - - name: did - type: keyword - description: This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: entropy_req - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: entropy_res - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: event_name - type: keyword - description: Deprecated key defined only in table map. - - name: feed_category - type: keyword - description: This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: forward_ip - type: ip - description: This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - - name: forward_ipv6 - type: ip - description: This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: header_id - type: keyword - description: This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_cid - type: keyword - description: This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_ctime - type: date - description: This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: mcb_req - type: long - description: This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most - - name: mcb_res - type: long - description: This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most - - name: mcbc_req - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: mcbc_res - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: medium - type: long - description: "This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session" - - name: node_name - type: keyword - description: Deprecated key defined only in table map. - - name: nwe_callback_id - type: keyword - description: This key denotes that event is endpoint related - - name: parse_error - type: keyword - description: This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: payload_req - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: payload_res - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: process_vid_dst - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - - name: process_vid_src - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. - - name: rid - type: long - description: This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: session_split - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: site - type: keyword - description: Deprecated key defined only in table map. - - name: size - type: long - description: This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: sourcefile - type: keyword - description: This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: ubc_req - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: ubc_res - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: word - type: keyword - description: This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log - - name: time - type: group - fields: - - name: event_time - type: date - description: This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - - name: duration_time - type: double - description: This key is used to capture the normalized duration/lifetime in seconds. - - name: event_time_str - type: keyword - description: This key is used to capture the incomplete time mentioned in a session as a string - - name: starttime - type: date - description: This key is used to capture the Start time mentioned in a session in a standard form - - name: month - type: keyword - - name: day - type: keyword - - name: endtime - type: date - description: This key is used to capture the End time mentioned in a session in a standard form - - name: timezone - type: keyword - description: This key is used to capture the timezone of the Event Time - - name: duration_str - type: keyword - description: A text string version of the duration - - name: date - type: keyword - - name: year - type: keyword - - name: recorded_time - type: date - description: The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - - name: datetime - type: keyword - - name: effective_time - type: date - description: This key is the effective time referenced by an individual event in a Standard Timestamp format - - name: expire_time - type: date - description: This key is the timestamp that explicitly refers to an expiration. - - name: process_time - type: keyword - description: Deprecated, use duration.time - - name: hour - type: keyword - - name: min - type: keyword - - name: timestamp - type: keyword - - name: event_queue_time - type: date - description: This key is the Time that the event was queued. - - name: p_time1 - type: keyword - - name: tzone - type: keyword - - name: eventtime - type: keyword - - name: gmtdate - type: keyword - - name: gmttime - type: keyword - - name: p_date - type: keyword - - name: p_month - type: keyword - - name: p_time - type: keyword - - name: p_time2 - type: keyword - - name: p_year - type: keyword - - name: expire_time_str - type: keyword - description: This key is used to capture incomplete timestamp that explicitly refers to an expiration. - - name: stamp - type: date - description: Deprecated key defined only in table map. - - name: misc - type: group - fields: - - name: action - type: keyword - - name: result - type: keyword - description: This key is used to capture the outcome/result string value of an action in a session. - - name: severity - type: keyword - description: This key is used to capture the severity given the session - - name: event_type - type: keyword - description: This key captures the event category type as specified by the event source. - - name: reference_id - type: keyword - description: This key is used to capture an event id from the session directly - - name: version - type: keyword - description: This key captures Version of the application or OS which is generating the event. - - name: disposition - type: keyword - description: This key captures the The end state of an action. - - name: result_code - type: keyword - description: This key is used to capture the outcome/result numeric value of an action in a session - - name: category - type: keyword - description: This key is used to capture the category of an event given by the vendor in the session - - name: obj_name - type: keyword - description: This is used to capture name of object - - name: obj_type - type: keyword - description: This is used to capture type of object - - name: event_source - type: keyword - description: "This key captures Source of the event that’s not a hostname" - - name: log_session_id - type: keyword - description: This key is used to capture a sessionid from the session directly - - name: group - type: keyword - description: This key captures the Group Name value - - name: policy_name - type: keyword - description: This key is used to capture the Policy Name only. - - name: rule_name - type: keyword - description: This key captures the Rule Name - - name: context - type: keyword - description: This key captures Information which adds additional context to the event. - - name: change_new - type: keyword - description: "This key is used to capture the new values of the attribute that’s changing in a session" - - name: space - type: keyword - - name: client - type: keyword - description: This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - - name: msgIdPart1 - type: keyword - - name: msgIdPart2 - type: keyword - - name: change_old - type: keyword - description: "This key is used to capture the old value of the attribute that’s changing in a session" - - name: operation_id - type: keyword - description: An alert number or operation number. The values should be unique and non-repeating. - - name: event_state - type: keyword - description: This key captures the current state of the object/item referenced within the event. Describing an on-going event. - - name: group_object - type: keyword - description: This key captures a collection/grouping of entities. Specific usage - - name: node - type: keyword - description: Common use case is the node name within a cluster. The cluster name is reflected by the host name. - - name: rule - type: keyword - description: This key captures the Rule number - - name: device_name - type: keyword - description: 'This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc' - - name: param - type: keyword - description: This key is the parameters passed as part of a command or application, etc. - - name: change_attrib - type: keyword - description: "This key is used to capture the name of the attribute that’s changing in a session" - - name: event_computer - type: keyword - description: This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - - name: reference_id1 - type: keyword - description: This key is for Linked ID to be used as an addition to "reference.id" - - name: event_log - type: keyword - description: This key captures the Name of the event log - - name: OS - type: keyword - description: This key captures the Name of the Operating System - - name: terminal - type: keyword - description: This key captures the Terminal Names only - - name: msgIdPart3 - type: keyword - - name: filter - type: keyword - description: This key captures Filter used to reduce result set - - name: serial_number - type: keyword - description: This key is the Serial number associated with a physical asset. - - name: checksum - type: keyword - description: This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - - name: event_user - type: keyword - description: This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - - name: virusname - type: keyword - description: This key captures the name of the virus - - name: content_type - type: keyword - description: This key is used to capture Content Type only. - - name: group_id - type: keyword - description: This key captures Group ID Number (related to the group name) - - name: policy_id - type: keyword - description: This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - - name: vsys - type: keyword - description: This key captures Virtual System Name - - name: connection_id - type: keyword - description: This key captures the Connection ID - - name: reference_id2 - type: keyword - description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - - name: sensor - type: keyword - description: This key captures Name of the sensor. Typically used in IDS/IPS based devices - - name: sig_id - type: long - description: This key captures IDS/IPS Int Signature ID - - name: port_name - type: keyword - description: 'This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name).' - - name: rule_group - type: keyword - description: This key captures the Rule group name - - name: risk_num - type: double - description: This key captures a Numeric Risk value - - name: trigger_val - type: keyword - description: This key captures the Value of the trigger or threshold condition. - - name: log_session_id1 - type: keyword - description: This key is used to capture a Linked (Related) Session ID from the session directly - - name: comp_version - type: keyword - description: This key captures the Version level of a sub-component of a product. - - name: content_version - type: keyword - description: This key captures Version level of a signature or database content. - - name: hardware_id - type: keyword - description: This key is used to capture unique identifier for a device or system (NOT a Mac address) - - name: risk - type: keyword - description: This key captures the non-numeric risk value - - name: event_id - type: keyword - - name: reason - type: keyword - - name: status - type: keyword - - name: mail_id - type: keyword - description: This key is used to capture the mailbox id/name - - name: rule_uid - type: keyword - description: This key is the Unique Identifier for a rule. - - name: trigger_desc - type: keyword - description: This key captures the Description of the trigger or threshold condition. - - name: inout - type: keyword - - name: p_msgid - type: keyword - - name: data_type - type: keyword - - name: msgIdPart4 - type: keyword - - name: error - type: keyword - description: This key captures All non successful Error codes or responses - - name: index - type: keyword - - name: listnum - type: keyword - description: This key is used to capture listname or listnumber, primarily for collecting access-list - - name: ntype - type: keyword - - name: observed_val - type: keyword - description: This key captures the Value observed (from the perspective of the device generating the log). - - name: policy_value - type: keyword - description: This key captures the contents of the policy. This contains details about the policy - - name: pool_name - type: keyword - description: This key captures the name of a resource pool - - name: rule_template - type: keyword - description: A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - - name: count - type: keyword - - name: number - type: keyword - - name: sigcat - type: keyword - - name: type - type: keyword - - name: comments - type: keyword - description: Comment information provided in the log message - - name: doc_number - type: long - description: This key captures File Identification number - - name: expected_val - type: keyword - description: This key captures the Value expected (from the perspective of the device generating the log). - - name: job_num - type: keyword - description: This key captures the Job Number - - name: spi_dst - type: keyword - description: Destination SPI Index - - name: spi_src - type: keyword - description: Source SPI Index - - name: code - type: keyword - - name: agent_id - type: keyword - description: This key is used to capture agent id - - name: message_body - type: keyword - description: This key captures the The contents of the message body. - - name: phone - type: keyword - - name: sig_id_str - type: keyword - description: This key captures a string object of the sigid variable. - - name: cmd - type: keyword - - name: misc - type: keyword - - name: name - type: keyword - - name: cpu - type: long - description: This key is the CPU time used in the execution of the event being recorded. - - name: event_desc - type: keyword - description: This key is used to capture a description of an event available directly or inferred - - name: sig_id1 - type: long - description: This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - - name: im_buddyid - type: keyword - - name: im_client - type: keyword - - name: im_userid - type: keyword - - name: pid - type: keyword - - name: priority - type: keyword - - name: context_subject - type: keyword - description: This key is to be used in an audit context where the subject is the object being identified - - name: context_target - type: keyword - - name: cve - type: keyword - description: This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - - name: fcatnum - type: keyword - description: This key captures Filter Category Number. Legacy Usage - - name: library - type: keyword - description: This key is used to capture library information in mainframe devices - - name: parent_node - type: keyword - description: This key captures the Parent Node Name. Must be related to node variable. - - name: risk_info - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: tcp_flags - type: long - description: This key is captures the TCP flags set in any packet of session - - name: tos - type: long - description: This key describes the type of service - - name: vm_target - type: keyword - description: VMWare Target **VMWARE** only varaible. - - name: workspace - type: keyword - description: This key captures Workspace Description - - name: command - type: keyword - - name: event_category - type: keyword - - name: facilityname - type: keyword - - name: forensic_info - type: keyword - - name: jobname - type: keyword - - name: mode - type: keyword - - name: policy - type: keyword - - name: policy_waiver - type: keyword - - name: second - type: keyword - - name: space1 - type: keyword - - name: subcategory - type: keyword - - name: tbdstr2 - type: keyword - - name: alert_id - type: keyword - description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: checksum_dst - type: keyword - description: This key is used to capture the checksum or hash of the the target entity such as a process or file. - - name: checksum_src - type: keyword - description: This key is used to capture the checksum or hash of the source entity such as a file or process. - - name: fresult - type: long - description: This key captures the Filter Result - - name: payload_dst - type: keyword - description: This key is used to capture destination payload - - name: payload_src - type: keyword - description: This key is used to capture source payload - - name: pool_id - type: keyword - description: This key captures the identifier (typically numeric field) of a resource pool - - name: process_id_val - type: keyword - description: This key is a failure key for Process ID when it is not an integer value - - name: risk_num_comm - type: double - description: This key captures Risk Number Community - - name: risk_num_next - type: double - description: This key captures Risk Number NextGen - - name: risk_num_sand - type: double - description: This key captures Risk Number SandBox - - name: risk_num_static - type: double - description: This key captures Risk Number Static - - name: risk_suspicious - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: risk_warning - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: snmp_oid - type: keyword - description: SNMP Object Identifier - - name: sql - type: keyword - description: This key captures the SQL query - - name: vuln_ref - type: keyword - description: This key captures the Vulnerability Reference details - - name: acl_id - type: keyword - - name: acl_op - type: keyword - - name: acl_pos - type: keyword - - name: acl_table - type: keyword - - name: admin - type: keyword - - name: alarm_id - type: keyword - - name: alarmname - type: keyword - - name: app_id - type: keyword - - name: audit - type: keyword - - name: audit_object - type: keyword - - name: auditdata - type: keyword - - name: benchmark - type: keyword - - name: bypass - type: keyword - - name: cache - type: keyword - - name: cache_hit - type: keyword - - name: cefversion - type: keyword - - name: cfg_attr - type: keyword - - name: cfg_obj - type: keyword - - name: cfg_path - type: keyword - - name: changes - type: keyword - - name: client_ip - type: keyword - - name: clustermembers - type: keyword - - name: cn_acttimeout - type: keyword - - name: cn_asn_src - type: keyword - - name: cn_bgpv4nxthop - type: keyword - - name: cn_ctr_dst_code - type: keyword - - name: cn_dst_tos - type: keyword - - name: cn_dst_vlan - type: keyword - - name: cn_engine_id - type: keyword - - name: cn_engine_type - type: keyword - - name: cn_f_switch - type: keyword - - name: cn_flowsampid - type: keyword - - name: cn_flowsampintv - type: keyword - - name: cn_flowsampmode - type: keyword - - name: cn_inacttimeout - type: keyword - - name: cn_inpermbyts - type: keyword - - name: cn_inpermpckts - type: keyword - - name: cn_invalid - type: keyword - - name: cn_ip_proto_ver - type: keyword - - name: cn_ipv4_ident - type: keyword - - name: cn_l_switch - type: keyword - - name: cn_log_did - type: keyword - - name: cn_log_rid - type: keyword - - name: cn_max_ttl - type: keyword - - name: cn_maxpcktlen - type: keyword - - name: cn_min_ttl - type: keyword - - name: cn_minpcktlen - type: keyword - - name: cn_mpls_lbl_1 - type: keyword - - name: cn_mpls_lbl_10 - type: keyword - - name: cn_mpls_lbl_2 - type: keyword - - name: cn_mpls_lbl_3 - type: keyword - - name: cn_mpls_lbl_4 - type: keyword - - name: cn_mpls_lbl_5 - type: keyword - - name: cn_mpls_lbl_6 - type: keyword - - name: cn_mpls_lbl_7 - type: keyword - - name: cn_mpls_lbl_8 - type: keyword - - name: cn_mpls_lbl_9 - type: keyword - - name: cn_mplstoplabel - type: keyword - - name: cn_mplstoplabip - type: keyword - - name: cn_mul_dst_byt - type: keyword - - name: cn_mul_dst_pks - type: keyword - - name: cn_muligmptype - type: keyword - - name: cn_sampalgo - type: keyword - - name: cn_sampint - type: keyword - - name: cn_seqctr - type: keyword - - name: cn_spackets - type: keyword - - name: cn_src_tos - type: keyword - - name: cn_src_vlan - type: keyword - - name: cn_sysuptime - type: keyword - - name: cn_template_id - type: keyword - - name: cn_totbytsexp - type: keyword - - name: cn_totflowexp - type: keyword - - name: cn_totpcktsexp - type: keyword - - name: cn_unixnanosecs - type: keyword - - name: cn_v6flowlabel - type: keyword - - name: cn_v6optheaders - type: keyword - - name: comp_class - type: keyword - - name: comp_name - type: keyword - - name: comp_rbytes - type: keyword - - name: comp_sbytes - type: keyword - - name: cpu_data - type: keyword - - name: criticality - type: keyword - - name: cs_agency_dst - type: keyword - - name: cs_analyzedby - type: keyword - - name: cs_av_other - type: keyword - - name: cs_av_primary - type: keyword - - name: cs_av_secondary - type: keyword - - name: cs_bgpv6nxthop - type: keyword - - name: cs_bit9status - type: keyword - - name: cs_context - type: keyword - - name: cs_control - type: keyword - - name: cs_data - type: keyword - - name: cs_datecret - type: keyword - - name: cs_dst_tld - type: keyword - - name: cs_eth_dst_ven - type: keyword - - name: cs_eth_src_ven - type: keyword - - name: cs_event_uuid - type: keyword - - name: cs_filetype - type: keyword - - name: cs_fld - type: keyword - - name: cs_if_desc - type: keyword - - name: cs_if_name - type: keyword - - name: cs_ip_next_hop - type: keyword - - name: cs_ipv4dstpre - type: keyword - - name: cs_ipv4srcpre - type: keyword - - name: cs_lifetime - type: keyword - - name: cs_log_medium - type: keyword - - name: cs_loginname - type: keyword - - name: cs_modulescore - type: keyword - - name: cs_modulesign - type: keyword - - name: cs_opswatresult - type: keyword - - name: cs_payload - type: keyword - - name: cs_registrant - type: keyword - - name: cs_registrar - type: keyword - - name: cs_represult - type: keyword - - name: cs_rpayload - type: keyword - - name: cs_sampler_name - type: keyword - - name: cs_sourcemodule - type: keyword - - name: cs_streams - type: keyword - - name: cs_targetmodule - type: keyword - - name: cs_v6nxthop - type: keyword - - name: cs_whois_server - type: keyword - - name: cs_yararesult - type: keyword - - name: description - type: keyword - - name: devvendor - type: keyword - - name: distance - type: keyword - - name: dstburb - type: keyword - - name: edomain - type: keyword - - name: edomaub - type: keyword - - name: euid - type: keyword - - name: facility - type: keyword - - name: finterface - type: keyword - - name: flags - type: keyword - - name: gaddr - type: keyword - - name: id3 - type: keyword - - name: im_buddyname - type: keyword - - name: im_croomid - type: keyword - - name: im_croomtype - type: keyword - - name: im_members - type: keyword - - name: im_username - type: keyword - - name: ipkt - type: keyword - - name: ipscat - type: keyword - - name: ipspri - type: keyword - - name: latitude - type: keyword - - name: linenum - type: keyword - - name: list_name - type: keyword - - name: load_data - type: keyword - - name: location_floor - type: keyword - - name: location_mark - type: keyword - - name: log_id - type: keyword - - name: log_type - type: keyword - - name: logid - type: keyword - - name: logip - type: keyword - - name: logname - type: keyword - - name: longitude - type: keyword - - name: lport - type: keyword - - name: mbug_data - type: keyword - - name: misc_name - type: keyword - - name: msg_type - type: keyword - - name: msgid - type: keyword - - name: netsessid - type: keyword - - name: num - type: keyword - - name: number1 - type: keyword - - name: number2 - type: keyword - - name: nwwn - type: keyword - - name: object - type: keyword - - name: operation - type: keyword - - name: opkt - type: keyword - - name: orig_from - type: keyword - - name: owner_id - type: keyword - - name: p_action - type: keyword - - name: p_filter - type: keyword - - name: p_group_object - type: keyword - - name: p_id - type: keyword - - name: p_msgid1 - type: keyword - - name: p_msgid2 - type: keyword - - name: p_result1 - type: keyword - - name: password_chg - type: keyword - - name: password_expire - type: keyword - - name: permgranted - type: keyword - - name: permwanted - type: keyword - - name: pgid - type: keyword - - name: policyUUID - type: keyword - - name: prog_asp_num - type: keyword - - name: program - type: keyword - - name: real_data - type: keyword - - name: rec_asp_device - type: keyword - - name: rec_asp_num - type: keyword - - name: rec_library - type: keyword - - name: recordnum - type: keyword - - name: ruid - type: keyword - - name: sburb - type: keyword - - name: sdomain_fld - type: keyword - - name: sec - type: keyword - - name: sensorname - type: keyword - - name: seqnum - type: keyword - - name: session - type: keyword - - name: sessiontype - type: keyword - - name: sigUUID - type: keyword - - name: spi - type: keyword - - name: srcburb - type: keyword - - name: srcdom - type: keyword - - name: srcservice - type: keyword - - name: state - type: keyword - - name: status1 - type: keyword - - name: svcno - type: keyword - - name: system - type: keyword - - name: tbdstr1 - type: keyword - - name: tgtdom - type: keyword - - name: tgtdomain - type: keyword - - name: threshold - type: keyword - - name: type1 - type: keyword - - name: udb_class - type: keyword - - name: url_fld - type: keyword - - name: user_div - type: keyword - - name: userid - type: keyword - - name: username_fld - type: keyword - - name: utcstamp - type: keyword - - name: v_instafname - type: keyword - - name: virt_data - type: keyword - - name: vpnid - type: keyword - - name: autorun_type - type: keyword - description: This is used to capture Auto Run type - - name: cc_number - type: long - description: Valid Credit Card Numbers only - - name: content - type: keyword - description: This key captures the content type from protocol headers - - name: ein_number - type: long - description: Employee Identification Numbers only - - name: found - type: keyword - description: This is used to capture the results of regex match - - name: language - type: keyword - description: This is used to capture list of languages the client support and what it prefers - - name: lifetime - type: long - description: This key is used to capture the session lifetime in seconds. - - name: link - type: keyword - description: This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: match - type: keyword - description: This key is for regex match name from search.ini - - name: param_dst - type: keyword - description: This key captures the command line/launch argument of the target process or file - - name: param_src - type: keyword - description: This key captures source parameter - - name: search_text - type: keyword - description: This key captures the Search Text used - - name: sig_name - type: keyword - description: This key is used to capture the Signature Name only. - - name: snmp_value - type: keyword - description: SNMP set request value - - name: streams - type: long - description: This key captures number of streams in session - - name: db - type: group - fields: - - name: index - type: keyword - description: This key captures IndexID of the index. - - name: instance - type: keyword - description: This key is used to capture the database server instance name - - name: database - type: keyword - description: This key is used to capture the name of a database or an instance as seen in a session - - name: transact_id - type: keyword - description: This key captures the SQL transantion ID of the current session - - name: permissions - type: keyword - description: This key captures permission or privilege level assigned to a resource. - - name: table_name - type: keyword - description: This key is used to capture the table name - - name: db_id - type: keyword - description: This key is used to capture the unique identifier for a database - - name: db_pid - type: long - description: This key captures the process id of a connection with database server - - name: lread - type: long - description: This key is used for the number of logical reads - - name: lwrite - type: long - description: This key is used for the number of logical writes - - name: pread - type: long - description: This key is used for the number of physical writes - - name: network - type: group - fields: - - name: alias_host - type: keyword - description: This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - - name: domain - type: keyword - - name: host_dst - type: keyword - description: "This key should only be used when it’s a Destination Hostname" - - name: network_service - type: keyword - description: This is used to capture layer 7 protocols/service names - - name: interface - type: keyword - description: This key should be used when the source or destination context of an interface is not clear - - name: network_port - type: long - description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' - - name: eth_host - type: keyword - description: Deprecated, use alias.mac - - name: sinterface - type: keyword - description: "This key should only be used when it’s a Source Interface" - - name: dinterface - type: keyword - description: "This key should only be used when it’s a Destination Interface" - - name: vlan - type: long - description: This key should only be used to capture the ID of the Virtual LAN - - name: zone_src - type: keyword - description: "This key should only be used when it’s a Source Zone." - - name: zone - type: keyword - description: This key should be used when the source or destination context of a Zone is not clear - - name: zone_dst - type: keyword - description: "This key should only be used when it’s a Destination Zone." - - name: gateway - type: keyword - description: This key is used to capture the IP Address of the gateway - - name: icmp_type - type: long - description: This key is used to capture the ICMP type only - - name: mask - type: keyword - description: This key is used to capture the device network IPmask. - - name: icmp_code - type: long - description: This key is used to capture the ICMP code only - - name: protocol_detail - type: keyword - description: This key should be used to capture additional protocol information - - name: dmask - type: keyword - description: This key is used for Destionation Device network mask - - name: port - type: long - description: This key should only be used to capture a Network Port when the directionality is not clear - - name: smask - type: keyword - description: This key is used for capturing source Network Mask - - name: netname - type: keyword - description: This key is used to capture the network name associated with an IP range. This is configured by the end user. - - name: paddr - type: ip - description: Deprecated - - name: faddr - type: keyword - - name: lhost - type: keyword - - name: origin - type: keyword - - name: remote_domain_id - type: keyword - - name: addr - type: keyword - - name: dns_a_record - type: keyword - - name: dns_ptr_record - type: keyword - - name: fhost - type: keyword - - name: fport - type: keyword - - name: laddr - type: keyword - - name: linterface - type: keyword - - name: phost - type: keyword - - name: ad_computer_dst - type: keyword - description: Deprecated, use host.dst - - name: eth_type - type: long - description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - - name: ip_proto - type: long - description: This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - - name: dns_cname_record - type: keyword - - name: dns_id - type: keyword - - name: dns_opcode - type: keyword - - name: dns_resp - type: keyword - - name: dns_type - type: keyword - - name: domain1 - type: keyword - - name: host_type - type: keyword - - name: packet_length - type: keyword - - name: host_orig - type: keyword - description: This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - - name: rpayload - type: keyword - description: This key is used to capture the total number of payload bytes seen in the retransmitted packets. - - name: vlan_name - type: keyword - description: This key should only be used to capture the name of the Virtual LAN - - name: investigations - type: group - fields: - - name: ec_activity - type: keyword - description: This key captures the particular event activity(Ex:Logoff) - - name: ec_theme - type: keyword - description: This key captures the Theme of a particular Event(Ex:Authentication) - - name: ec_subject - type: keyword - description: This key captures the Subject of a particular Event(Ex:User) - - name: ec_outcome - type: keyword - description: This key captures the outcome of a particular Event(Ex:Success) - - name: event_cat - type: long - description: This key captures the Event category number - - name: event_cat_name - type: keyword - description: This key captures the event category name corresponding to the event cat code - - name: event_vcat - type: keyword - description: This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - - name: analysis_file - type: keyword - description: This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - - name: analysis_service - type: keyword - description: This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - - name: analysis_session - type: keyword - description: This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - - name: boc - type: keyword - description: This is used to capture behaviour of compromise - - name: eoc - type: keyword - description: This is used to capture Enablers of Compromise - - name: inv_category - type: keyword - description: This used to capture investigation category - - name: inv_context - type: keyword - description: This used to capture investigation context - - name: ioc - type: keyword - description: This is key capture indicator of compromise - - name: counters - type: group - fields: - - name: dclass_c1 - type: long - description: This is a generic counter key that should be used with the label dclass.c1.str only - - name: dclass_c2 - type: long - description: This is a generic counter key that should be used with the label dclass.c2.str only - - name: event_counter - type: long - description: This is used to capture the number of times an event repeated - - name: dclass_r1 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r1.str only - - name: dclass_c3 - type: long - description: This is a generic counter key that should be used with the label dclass.c3.str only - - name: dclass_c1_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c1 only - - name: dclass_c2_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c2 only - - name: dclass_r1_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r1 only - - name: dclass_r2 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r2.str only - - name: dclass_c3_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c3 only - - name: dclass_r3 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r3.str only - - name: dclass_r2_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r2 only - - name: dclass_r3_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r3 only - - name: identity - type: group - fields: - - name: auth_method - type: keyword - description: This key is used to capture authentication methods used only - - name: user_role - type: keyword - description: This key is used to capture the Role of a user only - - name: dn - type: keyword - description: X.500 (LDAP) Distinguished Name - - name: logon_type - type: keyword - description: This key is used to capture the type of logon method used. - - name: profile - type: keyword - description: This key is used to capture the user profile - - name: accesses - type: keyword - description: This key is used to capture actual privileges used in accessing an object - - name: realm - type: keyword - description: Radius realm or similar grouping of accounts - - name: user_sid_dst - type: keyword - description: This key captures Destination User Session ID - - name: dn_src - type: keyword - description: An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - - name: org - type: keyword - description: This key captures the User organization - - name: dn_dst - type: keyword - description: An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - - name: firstname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: lastname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: user_dept - type: keyword - description: User's Department Names only - - name: user_sid_src - type: keyword - description: This key captures Source User Session ID - - name: federated_sp - type: keyword - description: This key is the Federated Service Provider. This is the application requesting authentication. - - name: federated_idp - type: keyword - description: This key is the federated Identity Provider. This is the server providing the authentication. - - name: logon_type_desc - type: keyword - description: This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - - name: middlename - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: password - type: keyword - description: This key is for Passwords seen in any session, plain text or encrypted - - name: host_role - type: keyword - description: This key should only be used to capture the role of a Host Machine - - name: ldap - type: keyword - description: "This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context" - - name: ldap_query - type: keyword - description: This key is the Search criteria from an LDAP search - - name: ldap_response - type: keyword - description: This key is to capture Results from an LDAP search - - name: owner - type: keyword - description: This is used to capture username the process or service is running as, the author of the task - - name: service_account - type: keyword - description: This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - - name: email - type: group - fields: - - name: email_dst - type: keyword - description: This key is used to capture the Destination email address only, when the destination context is not clear use email - - name: email_src - type: keyword - description: This key is used to capture the source email address only, when the source context is not clear use email - - name: subject - type: keyword - description: This key is used to capture the subject string from an Email only. - - name: email - type: keyword - description: This key is used to capture a generic email address where the source or destination context is not clear - - name: trans_from - type: keyword - description: Deprecated key defined only in table map. - - name: trans_to - type: keyword - description: Deprecated key defined only in table map. - - name: file - type: group - fields: - - name: privilege - type: keyword - description: Deprecated, use permissions - - name: attachment - type: keyword - description: This key captures the attachment file name - - name: filesystem - type: keyword - - name: binary - type: keyword - description: Deprecated key defined only in table map. - - name: filename_dst - type: keyword - description: This is used to capture name of the file targeted by the action - - name: filename_src - type: keyword - description: This is used to capture name of the parent filename, the file which performed the action - - name: filename_tmp - type: keyword - - name: directory_dst - type: keyword - description: This key is used to capture the directory of the target process or file - - name: directory_src - type: keyword - description: This key is used to capture the directory of the source process or file - - name: file_entropy - type: double - description: This is used to capture entropy vale of a file - - name: file_vendor - type: keyword - description: This is used to capture Company name of file located in version_info - - name: task_name - type: keyword - description: This is used to capture name of the task - - name: web - type: group - fields: - - name: fqdn - type: keyword - description: Fully Qualified Domain Names - - name: web_cookie - type: keyword - description: This key is used to capture the Web cookies specifically. - - name: alias_host - type: keyword - - name: reputation_num - type: double - description: Reputation Number of an entity. Typically used for Web Domains - - name: web_ref_domain - type: keyword - description: Web referer's domain - - name: web_ref_query - type: keyword - description: This key captures Web referer's query portion of the URL - - name: remote_domain - type: keyword - - name: web_ref_page - type: keyword - description: This key captures Web referer's page information - - name: web_ref_root - type: keyword - description: Web referer's root URL path - - name: cn_asn_dst - type: keyword - - name: cn_rpackets - type: keyword - - name: urlpage - type: keyword - - name: urlroot - type: keyword - - name: p_url - type: keyword - - name: p_user_agent - type: keyword - - name: p_web_cookie - type: keyword - - name: p_web_method - type: keyword - - name: p_web_referer - type: keyword - - name: web_extension_tmp - type: keyword - - name: web_page - type: keyword - - name: threat - type: group - fields: - - name: threat_category - type: keyword - description: This key captures Threat Name/Threat Category/Categorization of alert - - name: threat_desc - type: keyword - description: This key is used to capture the threat description from the session directly or inferred - - name: alert - type: keyword - description: This key is used to capture name of the alert - - name: threat_source - type: keyword - description: This key is used to capture source of the threat - - name: crypto - type: group - fields: - - name: crypto - type: keyword - description: This key is used to capture the Encryption Type or Encryption Key only - - name: cipher_src - type: keyword - description: This key is for Source (Client) Cipher - - name: cert_subject - type: keyword - description: This key is used to capture the Certificate organization only - - name: peer - type: keyword - description: This key is for Encryption peer's IP Address - - name: cipher_size_src - type: long - description: This key captures Source (Client) Cipher Size - - name: ike - type: keyword - description: IKE negotiation phase. - - name: scheme - type: keyword - description: This key captures the Encryption scheme used - - name: peer_id - type: keyword - description: "This key is for Encryption peer’s identity" - - name: sig_type - type: keyword - description: This key captures the Signature Type - - name: cert_issuer - type: keyword - - name: cert_host_name - type: keyword - description: Deprecated key defined only in table map. - - name: cert_error - type: keyword - description: This key captures the Certificate Error String - - name: cipher_dst - type: keyword - description: This key is for Destination (Server) Cipher - - name: cipher_size_dst - type: long - description: This key captures Destination (Server) Cipher Size - - name: ssl_ver_src - type: keyword - description: Deprecated, use version - - name: d_certauth - type: keyword - - name: s_certauth - type: keyword - - name: ike_cookie1 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase One" - - name: ike_cookie2 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase Two" - - name: cert_checksum - type: keyword - - name: cert_host_cat - type: keyword - description: This key is used for the hostname category value of a certificate - - name: cert_serial - type: keyword - description: This key is used to capture the Certificate serial number only - - name: cert_status - type: keyword - description: This key captures Certificate validation status - - name: ssl_ver_dst - type: keyword - description: Deprecated, use version - - name: cert_keysize - type: keyword - - name: cert_username - type: keyword - - name: https_insact - type: keyword - - name: https_valid - type: keyword - - name: cert_ca - type: keyword - description: This key is used to capture the Certificate signing authority only - - name: cert_common - type: keyword - description: This key is used to capture the Certificate common name only - - name: wireless - type: group - fields: - - name: wlan_ssid - type: keyword - description: This key is used to capture the ssid of a Wireless Session - - name: access_point - type: keyword - description: This key is used to capture the access point name. - - name: wlan_channel - type: long - description: This is used to capture the channel names - - name: wlan_name - type: keyword - description: This key captures either WLAN number/name - - name: storage - type: group - fields: - - name: disk_volume - type: keyword - description: A unique name assigned to logical units (volumes) within a physical disk - - name: lun - type: keyword - description: Logical Unit Number.This key is a very useful concept in Storage. - - name: pwwn - type: keyword - description: This uniquely identifies a port on a HBA. - - name: physical - type: group - fields: - - name: org_dst - type: keyword - description: This is used to capture the destination organization based on the GEOPIP Maxmind database. - - name: org_src - type: keyword - description: This is used to capture the source organization based on the GEOPIP Maxmind database. - - name: healthcare - type: group - fields: - - name: patient_fname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_id - type: keyword - description: This key captures the unique ID for a patient - - name: patient_lname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_mname - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: endpoint - type: group - fields: - - name: host_state - type: keyword - description: This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - - name: registry_key - type: keyword - description: This key captures the path to the registry key - - name: registry_value - type: keyword - description: This key captures values or decorators used within a registry entry -- name: dns.question.domain - type: keyword - ignore_above: 1024 - description: Server domain. -- name: network.interface.name - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/junos/manifest.yml b/packages/juniper/1.1.0/data_stream/junos/manifest.yml deleted file mode 100755 index 21a652b50e..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/manifest.yml +++ /dev/null @@ -1,204 +0,0 @@ -title: Juniper JUNOS logs -release: experimental -type: logs -streams: - - input: udp - title: Juniper JUNOS logs - description: Collect Juniper JUNOS logs - template_path: udp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-junos - - forwarded - - name: udp_host - type: text - title: UDP host to listen on - multi: false - required: true - show_user: true - default: localhost - - name: udp_port - type: integer - title: UDP port to listen on - multi: false - required: true - show_user: true - default: 9512 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: tcp - title: Juniper JUNOS logs - description: Collect Juniper JUNOS logs - template_path: tcp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-junos - - forwarded - - name: tcp_host - type: text - title: TCP host to listen on - multi: false - required: true - show_user: true - default: localhost - - name: tcp_port - type: integer - title: TCP port to listen on - multi: false - required: true - show_user: true - default: 9512 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: logfile - enabled: false - title: Juniper JUNOS logs - description: Collect Juniper JUNOS logs from file - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/juniper-junos.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-junos - - forwarded - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/juniper/1.1.0/data_stream/junos/sample_event.json b/packages/juniper/1.1.0/data_stream/junos/sample_event.json deleted file mode 100755 index 34b395dcad..0000000000 --- a/packages/juniper/1.1.0/data_stream/junos/sample_event.json +++ /dev/null @@ -1,73 +0,0 @@ -{ - "@timestamp": "2021-01-29T06:09:59.000Z", - "agent": { - "ephemeral_id": "a290626c-b4c4-41a5-82c7-6477dcca1031", - "hostname": "docker-fleet-agent", - "id": "0a0be70a-90aa-494d-8be3-b06a8a05e08c", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "juniper.junos", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "1.12.0" - }, - "elastic_agent": { - "id": "0a0be70a-90aa-494d-8be3-b06a8a05e08c", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "RPD_SCHED_TASK_LONGRUNTIME", - "agent_id_status": "verified", - "code": "RPD_SCHED_TASK_LONGRUNTIME", - "dataset": "juniper.junos", - "ingested": "2022-01-25T08:58:20Z", - "timezone": "+00:00" - }, - "input": { - "type": "udp" - }, - "log": { - "source": { - "address": "172.19.0.4:45440" - } - }, - "observer": { - "product": "Junos", - "type": "Routers", - "vendor": "Juniper" - }, - "process": { - "name": "ceroinBC.exe", - "pid": 6713 - }, - "rsa": { - "counters": { - "dclass_c1": 7309, - "dclass_c2": 5049 - }, - "internal": { - "event_desc": "task extended runtime", - "messageid": "RPD_SCHED_TASK_LONGRUNTIME" - }, - "misc": { - "client": ": exe", - "event_type": "RPD_SCHED_TASK_LONGRUNTIME", - "pid": "6713" - }, - "time": { - "day": "29", - "event_time": "2021-01-29T06:09:59.000Z", - "month": "Jan" - } - }, - "tags": [ - "juniper-junos", - "forwarded" - ] -} \ No newline at end of file diff --git a/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/logfile.yml.hbs b/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/logfile.yml.hbs deleted file mode 100755 index dc684103a4..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/logfile.yml.hbs +++ /dev/null @@ -1,26357 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Juniper" - product: "Netscreen" - type: "Firewall" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} for %{p0}"); - - var dup7 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); - - var dup8 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); - - var dup9 = date_time({ - dest: "event_time", - args: ["fld1"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup10 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); - - var dup11 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); - - var dup12 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); - - var dup13 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); - - var dup14 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); - - var dup15 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); - - var dup16 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); - - var dup17 = setc("eventcategory","1502000000"); - - var dup18 = setc("eventcategory","1703000000"); - - var dup19 = setc("eventcategory","1603000000"); - - var dup20 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); - - var dup21 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); - - var dup22 = setc("eventcategory","1502050000"); - - var dup23 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); - - var dup24 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); - - var dup25 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); - - var dup26 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); - - var dup27 = setc("eventcategory","1801010000"); - - var dup28 = setc("eventcategory","1401060000"); - - var dup29 = setc("ec_subject","User"); - - var dup30 = setc("ec_activity","Logon"); - - var dup31 = setc("ec_theme","Authentication"); - - var dup32 = setc("ec_outcome","Success"); - - var dup33 = setc("eventcategory","1401070000"); - - var dup34 = setc("ec_activity","Logoff"); - - var dup35 = setc("eventcategory","1303000000"); - - var dup36 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); - - var dup37 = setc("eventcategory","1402020200"); - - var dup38 = setc("ec_theme","UserGroup"); - - var dup39 = setc("ec_outcome","Error"); - - var dup40 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); - - var dup41 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); - - var dup42 = setc("eventcategory","1402020300"); - - var dup43 = setc("ec_activity","Modify"); - - var dup44 = setc("eventcategory","1605000000"); - - var dup45 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); - - var dup46 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); - - var dup47 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); - - var dup48 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); - - var dup49 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); - - var dup50 = setc("eventcategory","1701020000"); - - var dup51 = setc("ec_theme","Configuration"); - - var dup52 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); - - var dup53 = setc("eventcategory","1301000000"); - - var dup54 = setc("ec_outcome","Failure"); - - var dup55 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); - - var dup56 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); - - var dup57 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); - - var dup58 = setc("eventcategory","1001000000"); - - var dup59 = setc("dclass_counter1_string","Number of times the attack occurred"); - - var dup60 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("saddr"), - field("daddr"), - ], - }); - - var dup61 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("saddr"), - field("daddr"), - field("sport"), - field("dport"), - ], - }); - - var dup62 = setc("eventcategory","1608010000"); - - var dup63 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); - - var dup64 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); - - var dup65 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); - - var dup66 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); - - var dup67 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup68 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); - - var dup69 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); - - var dup70 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); - - var dup71 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); - - var dup72 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); - - var dup73 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); - - var dup74 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); - - var dup75 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); - - var dup76 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); - - var dup77 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); - - var dup78 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); - - var dup79 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); - - var dup80 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup81 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); - - var dup82 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); - - var dup83 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup84 = setc("eventcategory","1002020000"); - - var dup85 = setc("eventcategory","1002000000"); - - var dup86 = setc("eventcategory","1603110000"); - - var dup87 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); - - var dup88 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); - - var dup89 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); - - var dup90 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); - - var dup91 = setc("eventcategory","1613040200"); - - var dup92 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); - - var dup93 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); - - var dup94 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); - - var dup95 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); - - var dup96 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); - - var dup97 = setc("eventcategory","1613050200"); - - var dup98 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); - - var dup99 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); - - var dup100 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); - - var dup101 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); - - var dup102 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); - - var dup103 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); - - var dup104 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); - - var dup105 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); - - var dup106 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); - - var dup107 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); - - var dup108 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); - - var dup109 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); - - var dup110 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); - - var dup111 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); - - var dup112 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); - - var dup113 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); - - var dup114 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); - - var dup115 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); - - var dup116 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); - - var dup117 = setc("eventcategory","1603090000"); - - var dup118 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); - - var dup119 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); - - var dup120 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); - - var dup121 = setc("eventcategory","1603030000"); - - var dup122 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); - - var dup123 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); - - var dup124 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); - - var dup125 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); - - var dup126 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); - - var dup127 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); - - var dup128 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); - - var dup129 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); - - var dup130 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); - - var dup131 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup132 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup133 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); - - var dup134 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); - - var dup135 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); - - var dup136 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); - - var dup137 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); - - var dup138 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); - - var dup139 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); - - var dup140 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); - - var dup141 = setc("eventcategory","1702030000"); - - var dup142 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); - - var dup143 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); - - var dup144 = setc("eventcategory","1601000000"); - - var dup145 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); - - var dup146 = date_time({ - dest: "event_time", - args: ["fld2"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup147 = setc("eventcategory","1103000000"); - - var dup148 = setc("ec_subject","NetworkComm"); - - var dup149 = setc("ec_activity","Scan"); - - var dup150 = setc("ec_theme","TEV"); - - var dup151 = setc("eventcategory","1103010000"); - - var dup152 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); - - var dup153 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); - - var dup154 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); - - var dup155 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); - - var dup156 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); - - var dup157 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); - - var dup158 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); - - var dup159 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); - - var dup160 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); - - var dup161 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); - - var dup162 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); - - var dup163 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); - - var dup164 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); - - var dup165 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); - - var dup166 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); - - var dup167 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); - - var dup168 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); - - var dup169 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); - - var dup170 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); - - var dup171 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); - - var dup172 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); - - var dup173 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); - - var dup174 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); - - var dup175 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); - - var dup176 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); - - var dup177 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); - - var dup178 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); - - var dup179 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); - - var dup180 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); - - var dup181 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); - - var dup182 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); - - var dup183 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); - - var dup184 = setc("eventcategory","1603020000"); - - var dup185 = setc("eventcategory","1803000000"); - - var dup186 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); - - var dup187 = setc("eventcategory","1603010000"); - - var dup188 = setc("eventcategory","1603100000"); - - var dup189 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); - - var dup190 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); - - var dup191 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); - - var dup192 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); - - var dup193 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); - - var dup194 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); - - var dup195 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); - - var dup196 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); - - var dup197 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); - - var dup198 = setc("eventcategory","1801030000"); - - var dup199 = setc("eventcategory","1302010200"); - - var dup200 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); - - var dup201 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); - - var dup202 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); - - var dup203 = setc("eventcategory","1304000000"); - - var dup204 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); - - var dup205 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); - - var dup206 = setc("eventcategory","1401030000"); - - var dup207 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); - - var dup208 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); - - var dup209 = setc("eventcategory","1605020000"); - - var dup210 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); - - var dup211 = setc("ec_subject","Certificate"); - - var dup212 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); - - var dup213 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); - - var dup214 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); - - var dup215 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); - - var dup216 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); - - var dup217 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); - - var dup218 = setc("ec_subject","CryptoKey"); - - var dup219 = setc("ec_subject","Configuration"); - - var dup220 = setc("ec_activity","Request"); - - var dup221 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); - - var dup222 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); - - var dup223 = setc("eventcategory","1612000000"); - - var dup224 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); - - var dup225 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); - - var dup226 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); - - var dup227 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); - - var dup228 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); - - var dup229 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); - - var dup230 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); - - var dup231 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); - - var dup232 = setc("eventcategory","1201000000"); - - var dup233 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); - - var dup234 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); - - var dup235 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); - - var dup236 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); - - var dup237 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); - - var dup238 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); - - var dup239 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup240 = setc("eventcategory","1401000000"); - - var dup241 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); - - var dup242 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); - - var dup243 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); - - var dup244 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); - - var dup245 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); - - var dup246 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); - - var dup247 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); - - var dup248 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); - - var dup249 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); - - var dup250 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); - - var dup251 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); - - var dup252 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); - - var dup253 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); - - var dup254 = setc("eventcategory","1608000000"); - - var dup255 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); - - var dup256 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); - - var dup257 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); - - var dup258 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); - - var dup259 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); - - var dup260 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); - - var dup261 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); - - var dup262 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); - - var dup263 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); - - var dup264 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); - - var dup265 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); - - var dup266 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var dup267 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); - - var dup268 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); - - var dup269 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); - - var dup270 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); - - var dup271 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var dup272 = setc("eventcategory","1805010000"); - - var dup273 = setc("eventcategory","1805000000"); - - var dup274 = date_time({ - dest: "starttime", - args: ["fld2"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup275 = call({ - dest: "nwparser.bytes", - fn: CALC, - args: [ - field("sbytes"), - constant("+"), - field("rbytes"), - ], - }); - - var dup276 = setc("action","Deny"); - - var dup277 = setc("disposition","Deny"); - - var dup278 = setc("direction","outgoing"); - - var dup279 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("saddr"), - field("daddr"), - field("sport"), - field("dport"), - ], - }); - - var dup280 = setc("direction","incoming"); - - var dup281 = setc("eventcategory","1801000000"); - - var dup282 = setf("action","disposition"); - - var dup283 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); - - var dup284 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); - - var dup285 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); - - var dup286 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); - - var dup287 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); - - var dup288 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); - - var dup289 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); - - var dup290 = setc("eventcategory","1401050200"); - - var dup291 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("daddr"), - field("saddr"), - ], - }); - - var dup292 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("daddr"), - field("saddr"), - field("dport"), - field("sport"), - ], - }); - - var dup293 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); - - var dup294 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); - - var dup295 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); - - var dup296 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup297 = setc("eventcategory","1204000000"); - - var dup298 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup299 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var dup300 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); - - var dup301 = setc("eventcategory","1801020000"); - - var dup302 = setc("disposition","failed"); - - var dup303 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); - - var dup304 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); - - var dup305 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); - - var dup306 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); - - var dup307 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); - - var dup308 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); - - var dup309 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); - - var dup310 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); - - var dup311 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); - - var dup312 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); - - var dup313 = setc("eventcategory","1803020000"); - - var dup314 = setc("eventcategory","1613030000"); - - var dup315 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); - - var dup316 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); - - var dup317 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); - - var dup318 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); - - var dup319 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); - - var dup320 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); - - var dup321 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); - - var dup322 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); - - var dup323 = setc("event_description","Cannot connect to NSM server"); - - var dup324 = setc("eventcategory","1603040000"); - - var dup325 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); - - var dup326 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); - - var dup327 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); - - var dup328 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); - - var dup329 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); - - var dup330 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - - var dup331 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); - - var dup332 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("daddr"), - field("saddr"), - field("dport"), - field("sport"), - ], - }); - - var dup333 = linear_select([ - dup10, - dup11, - ]); - - var dup334 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup335 = linear_select([ - dup13, - dup14, - ]); - - var dup336 = linear_select([ - dup15, - dup16, - ]); - - var dup337 = linear_select([ - dup56, - dup57, - ]); - - var dup338 = linear_select([ - dup65, - dup66, - ]); - - var dup339 = linear_select([ - dup68, - dup69, - ]); - - var dup340 = linear_select([ - dup71, - dup72, - ]); - - var dup341 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var dup342 = linear_select([ - dup74, - dup75, - ]); - - var dup343 = linear_select([ - dup81, - dup82, - ]); - - var dup344 = linear_select([ - dup24, - dup90, - ]); - - var dup345 = linear_select([ - dup94, - dup95, - ]); - - var dup346 = linear_select([ - dup98, - dup99, - ]); - - var dup347 = linear_select([ - dup100, - dup101, - dup102, - ]); - - var dup348 = linear_select([ - dup113, - dup114, - ]); - - var dup349 = linear_select([ - dup111, - dup16, - ]); - - var dup350 = linear_select([ - dup127, - dup107, - ]); - - var dup351 = linear_select([ - dup8, - dup21, - ]); - - var dup352 = linear_select([ - dup122, - dup133, - ]); - - var dup353 = linear_select([ - dup142, - dup143, - ]); - - var dup354 = linear_select([ - dup145, - dup21, - ]); - - var dup355 = linear_select([ - dup127, - dup106, - ]); - - var dup356 = linear_select([ - dup152, - dup96, - ]); - - var dup357 = linear_select([ - dup154, - dup155, - ]); - - var dup358 = linear_select([ - dup156, - dup157, - ]); - - var dup359 = linear_select([ - dup99, - dup134, - ]); - - var dup360 = linear_select([ - dup158, - dup159, - ]); - - var dup361 = linear_select([ - dup161, - dup162, - ]); - - var dup362 = linear_select([ - dup163, - dup103, - ]); - - var dup363 = linear_select([ - dup162, - dup161, - ]); - - var dup364 = linear_select([ - dup46, - dup47, - ]); - - var dup365 = linear_select([ - dup166, - dup167, - ]); - - var dup366 = linear_select([ - dup172, - dup173, - ]); - - var dup367 = linear_select([ - dup174, - dup175, - dup176, - dup177, - dup178, - dup179, - dup180, - dup181, - dup182, - ]); - - var dup368 = linear_select([ - dup49, - dup21, - ]); - - var dup369 = linear_select([ - dup189, - dup190, - ]); - - var dup370 = linear_select([ - dup96, - dup152, - ]); - - var dup371 = linear_select([ - dup196, - dup197, - ]); - - var dup372 = linear_select([ - dup24, - dup200, - ]); - - var dup373 = linear_select([ - dup103, - dup163, - ]); - - var dup374 = linear_select([ - dup205, - dup118, - ]); - - var dup375 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup376 = linear_select([ - dup212, - dup213, - ]); - - var dup377 = linear_select([ - dup215, - dup216, - ]); - - var dup378 = linear_select([ - dup222, - dup215, - ]); - - var dup379 = linear_select([ - dup224, - dup225, - ]); - - var dup380 = linear_select([ - dup231, - dup124, - ]); - - var dup381 = linear_select([ - dup229, - dup230, - ]); - - var dup382 = linear_select([ - dup233, - dup234, - ]); - - var dup383 = linear_select([ - dup236, - dup237, - ]); - - var dup384 = linear_select([ - dup242, - dup243, - ]); - - var dup385 = linear_select([ - dup245, - dup246, - ]); - - var dup386 = linear_select([ - dup247, - dup248, - ]); - - var dup387 = linear_select([ - dup249, - dup250, - ]); - - var dup388 = linear_select([ - dup251, - dup252, - ]); - - var dup389 = linear_select([ - dup260, - dup261, - ]); - - var dup390 = linear_select([ - dup264, - dup265, - ]); - - var dup391 = linear_select([ - dup268, - dup269, - ]); - - var dup392 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup393 = linear_select([ - dup284, - dup285, - ]); - - var dup394 = linear_select([ - dup287, - dup288, - ]); - - var dup395 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup60, - ])); - - var dup396 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var dup397 = linear_select([ - dup300, - dup26, - ]); - - var dup398 = linear_select([ - dup115, - dup303, - ]); - - var dup399 = linear_select([ - dup125, - dup96, - ]); - - var dup400 = linear_select([ - dup189, - dup308, - dup309, - ]); - - var dup401 = linear_select([ - dup310, - dup16, - ]); - - var dup402 = linear_select([ - dup317, - dup318, - ]); - - var dup403 = linear_select([ - dup319, - dup315, - ]); - - var dup404 = linear_select([ - dup322, - dup250, - ]); - - var dup405 = linear_select([ - dup327, - dup329, - ]); - - var dup406 = linear_select([ - dup330, - dup129, - ]); - - var dup407 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var dup408 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup60, - ])); - - var dup409 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var dup410 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var dup411 = all_match({ - processors: [ - dup263, - dup390, - dup266, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var dup412 = all_match({ - processors: [ - dup267, - dup391, - dup270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var dup413 = all_match({ - processors: [ - dup80, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var dup414 = all_match({ - processors: [ - dup296, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var dup415 = all_match({ - processors: [ - dup298, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var hdr1 = match("HEADER#0:0001", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [No Name]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0001"), - ])); - - var hdr2 = match("HEADER#1:0003", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [%{hvsys}]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0003"), - ])); - - var hdr3 = match("HEADER#2:0004", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0004"), - ])); - - var hdr4 = match("HEADER#3:0002/0", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} %{p0}"); - - var part1 = match("HEADER#3:0002/1_0", "nwparser.p0", "[No Name]system%{p0}"); - - var part2 = match("HEADER#3:0002/1_1", "nwparser.p0", "[%{hvsys}]system%{p0}"); - - var part3 = match("HEADER#3:0002/1_2", "nwparser.p0", "system%{p0}"); - - var select1 = linear_select([ - part1, - part2, - part3, - ]); - - var part4 = match("HEADER#3:0002/2", "nwparser.p0", "-%{hseverity}-%{messageid}: %{payload}"); - - var all1 = all_match({ - processors: [ - hdr4, - select1, - part4, - ], - on_success: processor_chain([ - setc("header_id","0002"), - ]), - }); - - var select2 = linear_select([ - hdr1, - hdr2, - hdr3, - all1, - ]); - - var part5 = match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} with ip address %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1 = msg("00001", part5); - - var part6 = match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface->} with domain name %{domain->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg2 = msg("00001:01", part6); - - var part7 = match("MESSAGE#2:00001:02/1_0", "nwparser.p0", "ip address %{hostip->} in zone %{p0}"); - - var select3 = linear_select([ - part7, - dup7, - ]); - - var part8 = match("MESSAGE#2:00001:02/2", "nwparser.p0", "%{zone->} has been %{disposition}"); - - var all2 = all_match({ - processors: [ - dup6, - select3, - part8, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg3 = msg("00001:02", all2); - - var part9 = match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface changed!", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg4 = msg("00001:03", part9); - - var part10 = match("MESSAGE#4:00001:04/1_0", "nwparser.p0", "IP address %{hostip->} in zone %{p0}"); - - var select4 = linear_select([ - part10, - dup7, - ]); - - var part11 = match("MESSAGE#4:00001:04/2", "nwparser.p0", "%{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} session%{p0}"); - - var part12 = match("MESSAGE#4:00001:04/3_1", "nwparser.p0", ".%{fld1}"); - - var select5 = linear_select([ - dup8, - part12, - ]); - - var all3 = all_match({ - processors: [ - dup6, - select4, - part11, - select5, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg5 = msg("00001:04", all3); - - var part13 = match("MESSAGE#5:00001:05/0", "nwparser.payload", "%{fld2}: Address %{group_object->} for ip address %{hostip->} in zone %{zone->} has been %{disposition->} from host %{saddr->} session %{p0}"); - - var all4 = all_match({ - processors: [ - part13, - dup333, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg6 = msg("00001:05", all4); - - var part14 = match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg7 = msg("00001:06", part14); - - var msg8 = msg("00001:07", dup334); - - var part15 = match("MESSAGE#8:00001:08/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{p0}"); - - var part16 = match("MESSAGE#8:00001:08/4", "nwparser.p0", "%{} %{username}via NSRP Peer session. (%{fld1})"); - - var all5 = all_match({ - processors: [ - dup12, - dup335, - part15, - dup336, - part16, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg9 = msg("00001:08", all5); - - var part17 = match("MESSAGE#9:00001:09/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} session. (%{fld1})"); - - var all6 = all_match({ - processors: [ - dup12, - dup335, - part17, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg10 = msg("00001:09", all6); - - var select6 = linear_select([ - msg1, - msg2, - msg3, - msg4, - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - ]); - - var part18 = match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg11 = msg("00002:03", part18); - - var part19 = match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg12 = msg("00002:04", part19); - - var part20 = match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg13 = msg("00002:05", part20); - - var part21 = match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with e-mail notification of event alarms has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg14 = msg("00002:06", part21); - - var part22 = match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action->} and the LCD control keys have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg15 = msg("00002:07", part22); - - var part23 = match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{fld2->} is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg16 = msg("00002:55", part23); - - var part24 = match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg17 = msg("00002:08", part24); - - var part25 = match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg18 = msg("00002:09", part25); - - var part26 = match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg19 = msg("00002:10", part26); - - var part27 = match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg20 = msg("00002:11", part27); - - var part28 = match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg21 = msg("00002:12", part28); - - var part29 = match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been %{disposition}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg22 = msg("00002:15", part29); - - var msg23 = msg("00002:17", dup334); - - var part30 = match("MESSAGE#23:00002:18/0", "nwparser.payload", "Unexpected error from e%{p0}"); - - var part31 = match("MESSAGE#23:00002:18/1_0", "nwparser.p0", "-mail %{p0}"); - - var part32 = match("MESSAGE#23:00002:18/1_1", "nwparser.p0", "mail %{p0}"); - - var select7 = linear_select([ - part31, - part32, - ]); - - var part33 = match("MESSAGE#23:00002:18/2", "nwparser.p0", "server(%{fld2}):"); - - var all7 = all_match({ - processors: [ - part30, - select7, - part33, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg24 = msg("00002:18", all7); - - var part34 = match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute->} value has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg25 = msg("00002:19", part34); - - var part35 = match("MESSAGE#25:00002:20/0", "nwparser.payload", "Root admin password restriction of minimum %{fld2->} characters has been %{disposition->} by admin %{administrator->} %{p0}"); - - var part36 = match("MESSAGE#25:00002:20/1_0", "nwparser.p0", "from Console %{}"); - - var select8 = linear_select([ - part36, - dup20, - dup21, - ]); - - var all8 = all_match({ - processors: [ - part35, - select8, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg26 = msg("00002:20", all8); - - var part37 = match("MESSAGE#26:00002:21/0_0", "nwparser.payload", "Root admin %{p0}"); - - var part38 = match("MESSAGE#26:00002:21/0_1", "nwparser.payload", "%{fld2->} admin %{p0}"); - - var select9 = linear_select([ - part37, - part38, - ]); - - var select10 = linear_select([ - dup24, - dup25, - ]); - - var part39 = match("MESSAGE#26:00002:21/3", "nwparser.p0", "has been changed by admin %{administrator}"); - - var all9 = all_match({ - processors: [ - select9, - dup23, - select10, - part39, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg27 = msg("00002:21", all9); - - var part40 = match("MESSAGE#27:00002:22/0", "nwparser.payload", "%{change_attribute->} from %{protocol->} before administrative session disconnects has been changed from %{change_old->} to %{change_new->} by admin %{p0}"); - - var part41 = match("MESSAGE#27:00002:22/1_0", "nwparser.p0", "%{administrator->} from Console"); - - var part42 = match("MESSAGE#27:00002:22/1_1", "nwparser.p0", "%{administrator->} from host %{saddr}"); - - var select11 = linear_select([ - part41, - part42, - dup26, - ]); - - var all10 = all_match({ - processors: [ - part40, - select11, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg28 = msg("00002:22", all10); - - var part43 = match("MESSAGE#28:00002:23/0", "nwparser.payload", "Root admin access restriction through console only has been %{disposition->} by admin %{administrator->} %{p0}"); - - var part44 = match("MESSAGE#28:00002:23/1_1", "nwparser.p0", "from Console%{}"); - - var select12 = linear_select([ - dup20, - part44, - dup21, - ]); - - var all11 = all_match({ - processors: [ - part43, - select12, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg29 = msg("00002:23", all11); - - var part45 = match("MESSAGE#29:00002:24/0", "nwparser.payload", "Admin access restriction of %{protocol->} administration through tunnel only has been %{disposition->} by admin %{administrator->} from %{p0}"); - - var part46 = match("MESSAGE#29:00002:24/1_0", "nwparser.p0", "host %{saddr}"); - - var part47 = match("MESSAGE#29:00002:24/1_1", "nwparser.p0", "Console%{}"); - - var select13 = linear_select([ - part46, - part47, - ]); - - var all12 = all_match({ - processors: [ - part45, - select13, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg30 = msg("00002:24", all12); - - var part48 = match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of an %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - setc("eventcategory","1402000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg31 = msg("00002:25", part48); - - var part49 = match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail server %{hostip}.", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg32 = msg("00002:26", part49); - - var part50 = match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg33 = msg("00002:27", part50); - - var part51 = match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not configured.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg34 = msg("00002:28", part51); - - var part52 = match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restriction for read-write administrators has been %{disposition->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg35 = msg("00002:29", part52); - - var part53 = match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ - dup28, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg36 = msg("00002:30", part53); - - var part54 = match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ - dup33, - dup29, - dup34, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg37 = msg("00002:41", part54); - - var part55 = match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} %{space->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup35, - dup29, - dup30, - dup31, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg38 = msg("00002:31", part55); - - var part56 = match("MESSAGE#38:00002:32/0_0", "nwparser.payload", "E-mail notification %{p0}"); - - var part57 = match("MESSAGE#38:00002:32/0_1", "nwparser.payload", "Transparent virutal %{p0}"); - - var select14 = linear_select([ - part56, - part57, - ]); - - var part58 = match("MESSAGE#38:00002:32/1", "nwparser.p0", "wire mode has been %{disposition}"); - - var all13 = all_match({ - processors: [ - select14, - part58, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg39 = msg("00002:32", all13); - - var part59 = match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has been %{disposition->} for zone %{zone}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg40 = msg("00002:35", part59); - - var part60 = match("MESSAGE#40:00002:36/0", "nwparser.payload", "Bypass%{p0}"); - - var part61 = match("MESSAGE#40:00002:36/1_0", "nwparser.p0", "-others-IPSec %{p0}"); - - var part62 = match("MESSAGE#40:00002:36/1_1", "nwparser.p0", " non-IP traffic %{p0}"); - - var select15 = linear_select([ - part61, - part62, - ]); - - var part63 = match("MESSAGE#40:00002:36/2", "nwparser.p0", "option has been %{disposition}"); - - var all14 = all_match({ - processors: [ - part60, - select15, - part63, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg41 = msg("00002:36", all14); - - var part64 = match("MESSAGE#41:00002:37/0", "nwparser.payload", "Logging of %{p0}"); - - var part65 = match("MESSAGE#41:00002:37/1_0", "nwparser.p0", "dropped %{p0}"); - - var part66 = match("MESSAGE#41:00002:37/1_1", "nwparser.p0", "IKE %{p0}"); - - var part67 = match("MESSAGE#41:00002:37/1_2", "nwparser.p0", "SNMP %{p0}"); - - var part68 = match("MESSAGE#41:00002:37/1_3", "nwparser.p0", "ICMP %{p0}"); - - var select16 = linear_select([ - part65, - part66, - part67, - part68, - ]); - - var part69 = match("MESSAGE#41:00002:37/2", "nwparser.p0", "traffic to self has been %{disposition}"); - - var all15 = all_match({ - processors: [ - part64, - select16, - part69, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg42 = msg("00002:37", all15); - - var part70 = match("MESSAGE#42:00002:38/0", "nwparser.payload", "Logging of dropped traffic to self (excluding multicast) has been %{p0}"); - - var part71 = match("MESSAGE#42:00002:38/1_0", "nwparser.p0", "%{disposition->} on %{zone}"); - - var select17 = linear_select([ - part71, - dup36, - ]); - - var all16 = all_match({ - processors: [ - part70, - select17, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg43 = msg("00002:38", all16); - - var part72 = match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg44 = msg("00002:39", part72); - - var part73 = match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{username}' by %{administrator->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ - dup37, - dup29, - setc("ec_activity","Create"), - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg45 = msg("00002:40", part73); - - var part74 = match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requested for unknown user %{username}. Possible HA syncronization problem.", processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg46 = msg("00002:44", part74); - - var part75 = match("MESSAGE#46:00002:42/0", "nwparser.payload", "%{change_attribute->} for account '%{change_old}' has been %{disposition->} to '%{change_new}' %{p0}"); - - var part76 = match("MESSAGE#46:00002:42/1_0", "nwparser.p0", "by %{administrator->} via %{p0}"); - - var select18 = linear_select([ - part76, - dup40, - ]); - - var part77 = match("MESSAGE#46:00002:42/2", "nwparser.p0", "%{logon_type->} from host %{p0}"); - - var part78 = match("MESSAGE#46:00002:42/3_0", "nwparser.p0", "%{saddr->} to %{daddr}:%{dport->} (%{p0}"); - - var part79 = match("MESSAGE#46:00002:42/3_1", "nwparser.p0", "%{saddr}:%{sport->} (%{p0}"); - - var select19 = linear_select([ - part78, - part79, - ]); - - var all17 = all_match({ - processors: [ - part75, - select18, - part77, - select19, - dup41, - ], - on_success: processor_chain([ - dup42, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg47 = msg("00002:42", all17); - - var part80 = match("MESSAGE#47:00002:43/0", "nwparser.payload", "Admin account %{disposition->} for %{p0}"); - - var part81 = match("MESSAGE#47:00002:43/1_0", "nwparser.p0", "'%{username}'%{p0}"); - - var part82 = match("MESSAGE#47:00002:43/1_1", "nwparser.p0", "\"%{username}\"%{p0}"); - - var select20 = linear_select([ - part81, - part82, - ]); - - var part83 = match("MESSAGE#47:00002:43/2", "nwparser.p0", "%{}by %{administrator->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all18 = all_match({ - processors: [ - part80, - select20, - part83, - ], - on_success: processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg48 = msg("00002:43", all18); - - var part84 = match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg49 = msg("00002:50", part84); - - var part85 = match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} %{fld2->} via %{logon_type->} (%{fld1})", processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg50 = msg("00002:51", part85); - - var part86 = match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg51 = msg("00002:45", part86); - - var part87 = match("MESSAGE#51:00002:47/0_0", "nwparser.payload", "Ping of Death attack protection %{p0}"); - - var part88 = match("MESSAGE#51:00002:47/0_1", "nwparser.payload", "Src Route IP option filtering %{p0}"); - - var part89 = match("MESSAGE#51:00002:47/0_2", "nwparser.payload", "Teardrop attack protection %{p0}"); - - var part90 = match("MESSAGE#51:00002:47/0_3", "nwparser.payload", "Land attack protection %{p0}"); - - var part91 = match("MESSAGE#51:00002:47/0_4", "nwparser.payload", "SYN flood protection %{p0}"); - - var select21 = linear_select([ - part87, - part88, - part89, - part90, - part91, - ]); - - var part92 = match("MESSAGE#51:00002:47/1", "nwparser.p0", "is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})"); - - var all19 = all_match({ - processors: [ - select21, - part92, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg52 = msg("00002:47", all19); - - var part93 = match("MESSAGE#52:00002:48/0", "nwparser.payload", "Dropping pkts if not %{p0}"); - - var part94 = match("MESSAGE#52:00002:48/1_0", "nwparser.p0", "exactly same with incoming if %{p0}"); - - var part95 = match("MESSAGE#52:00002:48/1_1", "nwparser.p0", "in route table %{p0}"); - - var select22 = linear_select([ - part94, - part95, - ]); - - var part96 = match("MESSAGE#52:00002:48/2", "nwparser.p0", "(IP spoof protection) is %{disposition->} on zone %{zone->} by %{username->} via %{p0}"); - - var part97 = match("MESSAGE#52:00002:48/3_0", "nwparser.p0", "NSRP Peer. (%{p0}"); - - var select23 = linear_select([ - part97, - dup45, - ]); - - var all20 = all_match({ - processors: [ - part93, - select22, - part96, - select23, - dup41, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg53 = msg("00002:48", all20); - - var part98 = match("MESSAGE#53:00002:52/0", "nwparser.payload", "%{signame->} %{p0}"); - - var part99 = match("MESSAGE#53:00002:52/1_0", "nwparser.p0", "protection%{p0}"); - - var part100 = match("MESSAGE#53:00002:52/1_1", "nwparser.p0", "limiting%{p0}"); - - var part101 = match("MESSAGE#53:00002:52/1_2", "nwparser.p0", "detection%{p0}"); - - var part102 = match("MESSAGE#53:00002:52/1_3", "nwparser.p0", "filtering %{p0}"); - - var select24 = linear_select([ - part99, - part100, - part101, - part102, - ]); - - var part103 = match("MESSAGE#53:00002:52/2", "nwparser.p0", "%{}is %{disposition->} on zone %{zone->} by %{p0}"); - - var part104 = match("MESSAGE#53:00002:52/3_1", "nwparser.p0", "admin via %{p0}"); - - var select25 = linear_select([ - dup46, - part104, - dup47, - ]); - - var select26 = linear_select([ - dup48, - dup45, - ]); - - var all21 = all_match({ - processors: [ - part98, - select24, - part103, - select25, - select26, - dup41, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg54 = msg("00002:52", all21); - - var part105 = match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"%{username}\" has been %{disposition->} by %{administrator->} via %{logon_type->} (%{fld1})", processor_chain([ - dup42, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg55 = msg("00002:53", part105); - - var part106 = match("MESSAGE#55:00002:54/0", "nwparser.payload", "Traffic shaping clearing DSCP selector is turned O%{p0}"); - - var part107 = match("MESSAGE#55:00002:54/1_0", "nwparser.p0", "FF%{p0}"); - - var part108 = match("MESSAGE#55:00002:54/1_1", "nwparser.p0", "N%{p0}"); - - var select27 = linear_select([ - part107, - part108, - ]); - - var all22 = all_match({ - processors: [ - part106, - select27, - dup49, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg56 = msg("00002:54", all22); - - var part109 = match("MESSAGE#56:00002/0", "nwparser.payload", "%{change_attribute->} %{p0}"); - - var part110 = match("MESSAGE#56:00002/1_0", "nwparser.p0", "has been changed%{p0}"); - - var select28 = linear_select([ - part110, - dup52, - ]); - - var part111 = match("MESSAGE#56:00002/2", "nwparser.p0", "%{}from %{change_old->} to %{change_new}"); - - var all23 = all_match({ - processors: [ - part109, - select28, - part111, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg57 = msg("00002", all23); - - var part112 = match("MESSAGE#1215:00002:56", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed. (%{fld1})", processor_chain([ - dup53, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg58 = msg("00002:56", part112); - - var select29 = linear_select([ - msg11, - msg12, - msg13, - msg14, - msg15, - msg16, - msg17, - msg18, - msg19, - msg20, - msg21, - msg22, - msg23, - msg24, - msg25, - msg26, - msg27, - msg28, - msg29, - msg30, - msg31, - msg32, - msg33, - msg34, - msg35, - msg36, - msg37, - msg38, - msg39, - msg40, - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - msg50, - msg51, - msg52, - msg53, - msg54, - msg55, - msg56, - msg57, - msg58, - ]); - - var part113 = match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup53, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg59 = msg("00003", part113); - - var part114 = match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failures have been detected!%{}", processor_chain([ - dup53, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg60 = msg("00003:01", part114); - - var part115 = match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg61 = msg("00003:02", part115); - - var part116 = match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed from %{change_old->} to %{change_new}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg62 = msg("00003:03", part116); - - var part117 = match("MESSAGE#61:00003:05/1_0", "nwparser.p0", "serial%{p0}"); - - var part118 = match("MESSAGE#61:00003:05/1_1", "nwparser.p0", "local%{p0}"); - - var select30 = linear_select([ - part117, - part118, - ]); - - var part119 = match("MESSAGE#61:00003:05/2", "nwparser.p0", "%{}console has been %{disposition->} by admin %{administrator}."); - - var all24 = all_match({ - processors: [ - dup55, - select30, - part119, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg63 = msg("00003:05", all24); - - var select31 = linear_select([ - msg59, - msg60, - msg61, - msg62, - msg63, - ]); - - var part120 = match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been changed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg64 = msg("00004", part120); - - var part121 = match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg65 = msg("00004:01", part121); - - var part122 = match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg66 = msg("00004:02", part122); - - var part123 = match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg67 = msg("00004:03", part123); - - var part124 = match("MESSAGE#66:00004:04/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on %{p0}"); - - var part125 = match("MESSAGE#66:00004:04/2", "nwparser.p0", "%{} %{interface->} %{space}The attack occurred %{dclass_counter1->} times"); - - var all25 = all_match({ - processors: [ - part124, - dup337, - part125, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup59, - dup3, - dup60, - ]), - }); - - var msg68 = msg("00004:04", all25); - - var part126 = match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol}", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg69 = msg("00004:05", part126); - - var part127 = match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been changed to start at %{fld2}:%{fld3->} with an interval of %{fld4}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg70 = msg("00004:06", part127); - - var part128 = match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have been refreshed as result of external event.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg71 = msg("00004:07", part128); - - var part129 = match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg72 = msg("00004:08", part129); - - var part130 = match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more concurrent client requests than allowed.%{}", processor_chain([ - dup62, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg73 = msg("00004:09", part130); - - var part131 = match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table entries exceeded maximum limit.%{}", processor_chain([ - dup62, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg74 = msg("00004:10", part131); - - var part132 = match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table added with domain %{domain}, interface %{interface}, primary-ip %{fld2}, secondary-ip %{fld3}, tertiary-ip %{fld4}, failover %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg75 = msg("00004:11", part132); - - var part133 = match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table entry %{disposition->} with domain %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg76 = msg("00004:12", part133); - - var part134 = match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} returned incorrect ip %{fld2}, local-ip should be %{fld3}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg77 = msg("00004:13", part134); - - var part135 = match("MESSAGE#76:00004:14/1_0", "nwparser.p0", "automatically refreshed %{p0}"); - - var part136 = match("MESSAGE#76:00004:14/1_1", "nwparser.p0", "refreshed by HA %{p0}"); - - var select32 = linear_select([ - part135, - part136, - ]); - - var all26 = all_match({ - processors: [ - dup63, - select32, - dup49, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg78 = msg("00004:14", all26); - - var part137 = match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshed as result of DNS server address change. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg79 = msg("00004:15", part137); - - var part138 = match("MESSAGE#78:00004:16", "nwparser.payload", "DNS entries have been manually refreshed. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg80 = msg("00004:16", part138); - - var all27 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup9, - dup5, - dup3, - dup60, - ]), - }); - - var msg81 = msg("00004:17", all27); - - var select33 = linear_select([ - msg64, - msg65, - msg66, - msg67, - msg68, - msg69, - msg70, - msg71, - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - ]); - - var part139 = match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from the same source has been changed to %{trigger_val}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg82 = msg("00005", part139); - - var part140 = match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic to self has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg83 = msg("00005:01", part140); - - var part141 = match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been changed to %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg84 = msg("00005:02", part141); - - var part142 = match("MESSAGE#83:00005:03/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); - - var part143 = match("MESSAGE#83:00005:03/4", "nwparser.p0", "%{fld99}interface %{interface->} %{p0}"); - - var part144 = match("MESSAGE#83:00005:03/5_0", "nwparser.p0", "in zone %{zone}. %{p0}"); - - var select34 = linear_select([ - part144, - dup73, - ]); - - var part145 = match("MESSAGE#83:00005:03/6", "nwparser.p0", "%{space}The attack occurred %{dclass_counter1->} times"); - - var all28 = all_match({ - processors: [ - part142, - dup339, - dup70, - dup340, - part143, - select34, - part145, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ]), - }); - - var msg85 = msg("00005:03", all28); - - var msg86 = msg("00005:04", dup341); - - var part146 = match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2->} mode when receiving unknown dst mac has been %{disposition->} on %{zone}.", processor_chain([ - setc("eventcategory","1001020100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg87 = msg("00005:05", part146); - - var part147 = match("MESSAGE#86:00005:06/1", "nwparser.p0", "flood timeout has been set to %{trigger_val->} on %{zone}."); - - var all29 = all_match({ - processors: [ - dup342, - part147, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg88 = msg("00005:06", all29); - - var part148 = match("MESSAGE#87:00005:07/0", "nwparser.payload", "SYN flood %{p0}"); - - var part149 = match("MESSAGE#87:00005:07/1_0", "nwparser.p0", "alarm threshold %{p0}"); - - var part150 = match("MESSAGE#87:00005:07/1_1", "nwparser.p0", "packet queue size %{p0}"); - - var part151 = match("MESSAGE#87:00005:07/1_3", "nwparser.p0", "attack threshold %{p0}"); - - var part152 = match("MESSAGE#87:00005:07/1_4", "nwparser.p0", "same source IP threshold %{p0}"); - - var select35 = linear_select([ - part149, - part150, - dup76, - part151, - part152, - ]); - - var part153 = match("MESSAGE#87:00005:07/2", "nwparser.p0", "is set to %{trigger_val}."); - - var all30 = all_match({ - processors: [ - part148, - select35, - part153, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg89 = msg("00005:07", all30); - - var part154 = match("MESSAGE#88:00005:08/1", "nwparser.p0", "flood same %{p0}"); - - var select36 = linear_select([ - dup77, - dup78, - ]); - - var part155 = match("MESSAGE#88:00005:08/3", "nwparser.p0", "ip threshold has been set to %{trigger_val->} on %{zone}."); - - var all31 = all_match({ - processors: [ - dup342, - part154, - select36, - part155, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg90 = msg("00005:08", all31); - - var part156 = match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is %{disposition->} on interface %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg91 = msg("00005:09", part156); - - var part157 = match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is %{disposition->} on %{zone}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg92 = msg("00005:10", part157); - - var part158 = match("MESSAGE#91:00005:11/0", "nwparser.payload", "The SYN flood %{p0}"); - - var part159 = match("MESSAGE#91:00005:11/1_0", "nwparser.p0", "alarm threshold%{}"); - - var part160 = match("MESSAGE#91:00005:11/1_1", "nwparser.p0", "packet queue size%{}"); - - var part161 = match("MESSAGE#91:00005:11/1_2", "nwparser.p0", "timeout value%{}"); - - var part162 = match("MESSAGE#91:00005:11/1_3", "nwparser.p0", "attack threshold%{}"); - - var part163 = match("MESSAGE#91:00005:11/1_4", "nwparser.p0", "same source IP%{}"); - - var select37 = linear_select([ - part159, - part160, - part161, - part162, - part163, - ]); - - var all32 = all_match({ - processors: [ - part158, - select37, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg93 = msg("00005:11", all32); - - var part164 = match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshold value has been set to %{trigger_val->} on %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg94 = msg("00005:12", part164); - - var part165 = match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg95 = msg("00005:13", part165); - - var part166 = match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unknown mac!%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg96 = msg("00005:14", part166); - - var part167 = match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold has been changed to %{trigger_val}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg97 = msg("00005:15", part167); - - var part168 = match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg98 = msg("00005:16", part168); - - var part169 = match("MESSAGE#97:00005:17/1_0", "nwparser.p0", "destination-based %{p0}"); - - var part170 = match("MESSAGE#97:00005:17/1_1", "nwparser.p0", "source-based %{p0}"); - - var select38 = linear_select([ - part169, - part170, - ]); - - var part171 = match("MESSAGE#97:00005:17/2", "nwparser.p0", "session-limit threshold has been set at %{trigger_val->} in zone %{zone}."); - - var all33 = all_match({ - processors: [ - dup79, - select38, - part171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg99 = msg("00005:17", all33); - - var all34 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg100 = msg("00005:18", all34); - - var part172 = match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup84, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg101 = msg("00005:19", part172); - - var part173 = match("MESSAGE#100:00005:20", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} int %{interface}).%{space->} Occurred %{fld2->} times. (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup84, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg102 = msg("00005:20", part173); - - var select39 = linear_select([ - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - msg88, - msg89, - msg90, - msg91, - msg92, - msg93, - msg94, - msg95, - msg96, - msg97, - msg98, - msg99, - msg100, - msg101, - msg102, - ]); - - var part174 = match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg103 = msg("00006", part174); - - var part175 = match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname}\"", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg104 = msg("00006:01", part175); - - var part176 = match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg105 = msg("00006:02", part176); - - var part177 = match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg106 = msg("00006:03", part177); - - var part178 = match("MESSAGE#105:00006:04/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var all35 = all_match({ - processors: [ - part178, - dup338, - dup67, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg107 = msg("00006:04", all35); - - var all36 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg108 = msg("00006:05", all36); - - var select40 = linear_select([ - msg103, - msg104, - msg105, - msg106, - msg107, - msg108, - ]); - - var part179 = match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg109 = msg("00007", part179); - - var part180 = match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the local NetScreen device has changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg110 = msg("00007:01", part180); - - var part181 = match("MESSAGE#109:00007:02/0", "nwparser.payload", "HA state of the local device has changed to backup because a device with a %{p0}"); - - var part182 = match("MESSAGE#109:00007:02/1_0", "nwparser.p0", "higher priority has been detected%{}"); - - var part183 = match("MESSAGE#109:00007:02/1_1", "nwparser.p0", "lower MAC value has been detected%{}"); - - var select41 = linear_select([ - part182, - part183, - ]); - - var all37 = all_match({ - processors: [ - part181, - select41, - ], - on_success: processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg111 = msg("00007:02", all37); - - var part184 = match("MESSAGE#110:00007:03", "nwparser.payload", "HA state of the local device has changed to init because IP tracking has failed%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg112 = msg("00007:03", part184); - - var select42 = linear_select([ - dup88, - dup89, - ]); - - var part185 = match("MESSAGE#111:00007:04/4", "nwparser.p0", "has been changed%{}"); - - var all38 = all_match({ - processors: [ - dup87, - select42, - dup23, - dup344, - part185, - ], - on_success: processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg113 = msg("00007:04", all38); - - var part186 = match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device has been elected backup because a master already exists%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg114 = msg("00007:05", part186); - - var part187 = match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg115 = msg("00007:06", part187); - - var part188 = match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg116 = msg("00007:07", part188); - - var part189 = match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been elected master because no other master exists%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg117 = msg("00007:08", part189); - - var part190 = match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg118 = msg("00007:09", part190); - - var part191 = match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promoted the local NetScreen device to master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg119 = msg("00007:10", part191); - - var part192 = match("MESSAGE#118:00007:11/0", "nwparser.payload", "IP tracking device failover threshold has been %{p0}"); - - var select43 = linear_select([ - dup92, - dup93, - ]); - - var all39 = all_match({ - processors: [ - part192, - select43, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg120 = msg("00007:11", all39); - - var part193 = match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg121 = msg("00007:12", part193); - - var part194 = match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} with interval %{fld2->} threshold %{trigger_val->} weight %{fld4->} interface %{interface->} method %{fld5->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg122 = msg("00007:13", part194); - - var part195 = match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup60, - ])); - - var msg123 = msg("00007:14", part195); - - var part196 = match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been changed to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg124 = msg("00007:15", part196); - - var part197 = match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration and status changes to NetScreen-Global Manager has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg125 = msg("00007:16", part197); - - var part198 = match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg126 = msg("00007:17", part198); - - var part199 = match("MESSAGE#125:00007:18/0", "nwparser.payload", "Tracked IP %{hostip->} options have been changed from int %{fld2->} thr %{fld3->} wgt %{fld4->} inf %{fld5->} %{p0}"); - - var part200 = match("MESSAGE#125:00007:18/1_0", "nwparser.p0", "ping %{p0}"); - - var part201 = match("MESSAGE#125:00007:18/1_1", "nwparser.p0", "ARP %{p0}"); - - var select44 = linear_select([ - part200, - part201, - ]); - - var part202 = match("MESSAGE#125:00007:18/2", "nwparser.p0", "to %{fld6->} %{p0}"); - - var part203 = match("MESSAGE#125:00007:18/3_0", "nwparser.p0", "ping%{}"); - - var part204 = match("MESSAGE#125:00007:18/3_1", "nwparser.p0", "ARP%{}"); - - var select45 = linear_select([ - part203, - part204, - ]); - - var all40 = all_match({ - processors: [ - part199, - select44, - part202, - select45, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg127 = msg("00007:18", all40); - - var part205 = match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} path from %{change_old->} to %{change_new}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg128 = msg("00007:20", part205); - - var part206 = match("MESSAGE#127:00007:21/0", "nwparser.payload", "HA Slave is %{p0}"); - - var all41 = all_match({ - processors: [ - part206, - dup345, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg129 = msg("00007:21", all41); - - var part207 = match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{groupid}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg130 = msg("00007:22", part207); - - var part208 = match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg131 = msg("00007:23", part208); - - var part209 = match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg132 = msg("00007:24", part209); - - var part210 = match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial state.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg133 = msg("00007:25", part210); - - var part211 = match("MESSAGE#132:00007:26/0", "nwparser.payload", "HA: Change state to slave for %{p0}"); - - var part212 = match("MESSAGE#132:00007:26/1_0", "nwparser.p0", "tracking ip failed%{}"); - - var part213 = match("MESSAGE#132:00007:26/1_1", "nwparser.p0", "linkdown%{}"); - - var select46 = linear_select([ - part212, - part213, - ]); - - var all42 = all_match({ - processors: [ - part211, - select46, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg134 = msg("00007:26", all42); - - var part214 = match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command issued from original master to change state%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg135 = msg("00007:27", part214); - - var part215 = match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg136 = msg("00007:28", part215); - - var part216 = match("MESSAGE#135:00007:29/0", "nwparser.payload", "HA: Elected slave %{p0}"); - - var part217 = match("MESSAGE#135:00007:29/1_0", "nwparser.p0", "lower priority%{}"); - - var part218 = match("MESSAGE#135:00007:29/1_1", "nwparser.p0", "MAC value is larger%{}"); - - var part219 = match("MESSAGE#135:00007:29/1_2", "nwparser.p0", "master already exists%{}"); - - var part220 = match("MESSAGE#135:00007:29/1_3", "nwparser.p0", "detect new master with higher priority%{}"); - - var part221 = match("MESSAGE#135:00007:29/1_4", "nwparser.p0", "detect new master with smaller MAC value%{}"); - - var select47 = linear_select([ - part217, - part218, - part219, - part220, - part221, - ]); - - var all43 = all_match({ - processors: [ - part216, - select47, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg137 = msg("00007:29", all43); - - var part222 = match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command issued from original master to change state%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg138 = msg("00007:30", part222); - - var part223 = match("MESSAGE#137:00007:31/0", "nwparser.payload", "HA: ha link %{p0}"); - - var all44 = all_match({ - processors: [ - part223, - dup345, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg139 = msg("00007:31", all44); - - var part224 = match("MESSAGE#138:00007:32/0", "nwparser.payload", "NSRP %{fld2->} %{p0}"); - - var select48 = linear_select([ - dup89, - dup88, - ]); - - var part225 = match("MESSAGE#138:00007:32/4", "nwparser.p0", "changed.%{}"); - - var all45 = all_match({ - processors: [ - part224, - select48, - dup23, - dup344, - part225, - ], - on_success: processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg140 = msg("00007:32", all45); - - var part226 = match("MESSAGE#139:00007:33/0_0", "nwparser.payload", "NSRP: VSD %{p0}"); - - var part227 = match("MESSAGE#139:00007:33/0_1", "nwparser.payload", "Virtual Security Device group %{p0}"); - - var select49 = linear_select([ - part226, - part227, - ]); - - var part228 = match("MESSAGE#139:00007:33/1", "nwparser.p0", "%{fld2->} change%{p0}"); - - var part229 = match("MESSAGE#139:00007:33/2_0", "nwparser.p0", "d %{p0}"); - - var select50 = linear_select([ - part229, - dup96, - ]); - - var part230 = match("MESSAGE#139:00007:33/3", "nwparser.p0", "to %{fld3->} mode."); - - var all46 = all_match({ - processors: [ - select49, - part228, - select50, - part230, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg141 = msg("00007:33", all46); - - var part231 = match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropped: invalid encryption password.", processor_chain([ - dup97, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg142 = msg("00007:34", part231); - - var part232 = match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change to %{interface}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg143 = msg("00007:35", part232); - - var part233 = match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} local unit=%{fld3->} duplicate from unit=%{fld4}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg144 = msg("00007:36", part233); - - var part234 = match("MESSAGE#143:00007:37/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} is %{p0}"); - - var all47 = all_match({ - processors: [ - part234, - dup346, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg145 = msg("00007:37", all47); - - var part235 = match("MESSAGE#144:00007:38/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} peer=%{fld3->} from %{p0}"); - - var part236 = match("MESSAGE#144:00007:38/4", "nwparser.p0", "state %{p0}"); - - var part237 = match("MESSAGE#144:00007:38/5_0", "nwparser.p0", "missed heartbeat%{}"); - - var part238 = match("MESSAGE#144:00007:38/5_1", "nwparser.p0", "group detached%{}"); - - var select51 = linear_select([ - part237, - part238, - ]); - - var all48 = all_match({ - processors: [ - part235, - dup347, - dup103, - dup347, - part236, - select51, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg146 = msg("00007:38", all48); - - var part239 = match("MESSAGE#145:00007:39/0", "nwparser.payload", "RTO mirror group id=%{groupid->} is %{p0}"); - - var all49 = all_match({ - processors: [ - part239, - dup346, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg147 = msg("00007:39", all49); - - var part240 = match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (ifnum=%{fld3}) as secondary HA path", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg148 = msg("00007:40", part240); - - var part241 = match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg149 = msg("00007:41", part241); - - var part242 = match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fld2->} (ifnum=%{fld3})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg150 = msg("00007:42", part242); - - var part243 = match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg151 = msg("00007:43", part243); - - var part244 = match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is %{disposition->} total number=%{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg152 = msg("00007:44", part244); - - var part245 = match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local unit %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg153 = msg("00007:45", part245); - - var part246 = match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup60, - ])); - - var msg154 = msg("00007:46", part246); - - var part247 = match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg155 = msg("00007:47", part247); - - var part248 = match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped because it contained an invalid encryption password.", processor_chain([ - dup97, - dup2, - dup3, - dup4, - setc("disposition","dropped"), - setc("result","Invalid encryption Password"), - ])); - - var msg156 = msg("00007:48", part248); - - var part249 = match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of all Virtual Security Device groups changed from %{change_old->} to %{change_new}", processor_chain([ - setc("eventcategory","1604000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg157 = msg("00007:49", part249); - - var part250 = match("MESSAGE#156:00007:50/0", "nwparser.payload", "Device %{fld2->} %{p0}"); - - var part251 = match("MESSAGE#156:00007:50/1_0", "nwparser.p0", "has joined %{p0}"); - - var part252 = match("MESSAGE#156:00007:50/1_1", "nwparser.p0", "quit current %{p0}"); - - var select52 = linear_select([ - part251, - part252, - ]); - - var part253 = match("MESSAGE#156:00007:50/2", "nwparser.p0", "NSRP cluster %{fld3}"); - - var all50 = all_match({ - processors: [ - part250, - select52, - part253, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg158 = msg("00007:50", all50); - - var part254 = match("MESSAGE#157:00007:51/0", "nwparser.payload", "Virtual Security Device group %{group->} was %{p0}"); - - var part255 = match("MESSAGE#157:00007:51/1_1", "nwparser.p0", "deleted %{p0}"); - - var select53 = linear_select([ - dup104, - part255, - ]); - - var select54 = linear_select([ - dup105, - dup73, - ]); - - var part256 = match("MESSAGE#157:00007:51/4", "nwparser.p0", "The total number of members in the group %{p0}"); - - var select55 = linear_select([ - dup106, - dup107, - ]); - - var all51 = all_match({ - processors: [ - part254, - select53, - dup23, - select54, - part256, - select55, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg159 = msg("00007:51", all51); - - var part257 = match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group %{group->} %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg160 = msg("00007:52", part257); - - var part258 = match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the devices was set to interface %{interface->} with ifnum %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg161 = msg("00007:53", part258); - - var part259 = match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of the devices changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg162 = msg("00007:54", part259); - - var part260 = match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} with ifnum %{fld2->} was removed from the secondary HA path of the devices.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg163 = msg("00007:55", part260); - - var part261 = match("MESSAGE#162:00007:56", "nwparser.payload", "The probe that detects the status of High Availability link %{fld2->} was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg164 = msg("00007:56", part261); - - var select56 = linear_select([ - dup109, - dup110, - ]); - - var select57 = linear_select([ - dup111, - dup112, - ]); - - var part262 = match("MESSAGE#163:00007:57/4", "nwparser.p0", "the probe detecting the status of High Availability link %{fld2->} was set to %{fld3}"); - - var all52 = all_match({ - processors: [ - dup55, - select56, - dup23, - select57, - part262, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg165 = msg("00007:57", all52); - - var part263 = match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} for session synchronization(s) was accepted.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg166 = msg("00007:58", part263); - - var part264 = match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchronization by device %{fld2->} completed.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg167 = msg("00007:59", part264); - - var part265 = match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group %{group->} direction was set to %{direction}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg168 = msg("00007:60", part265); - - var part266 = match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group %{group->} was set.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg169 = msg("00007:61", part266); - - var part267 = match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group %{group->} with direction %{direction->} was unset.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg170 = msg("00007:62", part267); - - var part268 = match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} was unset.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg171 = msg("00007:63", part268); - - var part269 = match("MESSAGE#170:00007:64/1", "nwparser.p0", "%{fld2->} was removed from the monitoring list %{p0}"); - - var part270 = match("MESSAGE#170:00007:64/3", "nwparser.p0", "%{fld3}"); - - var all53 = all_match({ - processors: [ - dup348, - part269, - dup349, - part270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg172 = msg("00007:64", all53); - - var part271 = match("MESSAGE#171:00007:65/1", "nwparser.p0", "%{fld2->} with weight %{fld3->} was added%{p0}"); - - var part272 = match("MESSAGE#171:00007:65/2_0", "nwparser.p0", " to or updated on %{p0}"); - - var part273 = match("MESSAGE#171:00007:65/2_1", "nwparser.p0", "/updated to %{p0}"); - - var select58 = linear_select([ - part272, - part273, - ]); - - var part274 = match("MESSAGE#171:00007:65/3", "nwparser.p0", "the monitoring list %{p0}"); - - var part275 = match("MESSAGE#171:00007:65/5", "nwparser.p0", "%{fld4}"); - - var all54 = all_match({ - processors: [ - dup348, - part271, - select58, - part274, - dup349, - part275, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg173 = msg("00007:65", all54); - - var part276 = match("MESSAGE#172:00007:66/0_0", "nwparser.payload", "The monitoring %{p0}"); - - var part277 = match("MESSAGE#172:00007:66/0_1", "nwparser.payload", "Monitoring %{p0}"); - - var select59 = linear_select([ - part276, - part277, - ]); - - var part278 = match("MESSAGE#172:00007:66/1", "nwparser.p0", "threshold was modified to %{trigger_val->} o%{p0}"); - - var part279 = match("MESSAGE#172:00007:66/2_0", "nwparser.p0", "f %{p0}"); - - var select60 = linear_select([ - part279, - dup115, - ]); - - var all55 = all_match({ - processors: [ - select59, - part278, - select60, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg174 = msg("00007:66", all55); - - var part280 = match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg175 = msg("00007:67", part280); - - var part281 = match("MESSAGE#174:00007:68/0", "nwparser.payload", "NSRP b%{p0}"); - - var part282 = match("MESSAGE#174:00007:68/1_0", "nwparser.p0", "lack %{p0}"); - - var part283 = match("MESSAGE#174:00007:68/1_1", "nwparser.p0", "ack %{p0}"); - - var select61 = linear_select([ - part282, - part283, - ]); - - var part284 = match("MESSAGE#174:00007:68/2", "nwparser.p0", "hole prevention %{disposition}. Master(s) of Virtual Security Device groups %{p0}"); - - var part285 = match("MESSAGE#174:00007:68/3_0", "nwparser.p0", "may not exist %{p0}"); - - var part286 = match("MESSAGE#174:00007:68/3_1", "nwparser.p0", "always exists %{p0}"); - - var select62 = linear_select([ - part285, - part286, - ]); - - var all56 = all_match({ - processors: [ - part281, - select61, - part284, - select62, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg176 = msg("00007:68", all56); - - var part287 = match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchronization between devices was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg177 = msg("00007:69", part287); - - var part288 = match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was changed.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg178 = msg("00007:70", part288); - - var part289 = match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Active mode was %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg179 = msg("00007:71", part289); - - var part290 = match("MESSAGE#178:00007:72", "nwparser.payload", "NSRP: nsrp link probe enable on %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg180 = msg("00007:72", part290); - - var select63 = linear_select([ - msg109, - msg110, - msg111, - msg112, - msg113, - msg114, - msg115, - msg116, - msg117, - msg118, - msg119, - msg120, - msg121, - msg122, - msg123, - msg124, - msg125, - msg126, - msg127, - msg128, - msg129, - msg130, - msg131, - msg132, - msg133, - msg134, - msg135, - msg136, - msg137, - msg138, - msg139, - msg140, - msg141, - msg142, - msg143, - msg144, - msg145, - msg146, - msg147, - msg148, - msg149, - msg150, - msg151, - msg152, - msg153, - msg154, - msg155, - msg156, - msg157, - msg158, - msg159, - msg160, - msg161, - msg162, - msg163, - msg164, - msg165, - msg166, - msg167, - msg168, - msg169, - msg170, - msg171, - msg172, - msg173, - msg174, - msg175, - msg176, - msg177, - msg178, - msg179, - msg180, - ]); - - var part291 = match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg181 = msg("00008", part291); - - var msg182 = msg("00008:01", dup341); - - var part292 = match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg183 = msg("00008:02", part292); - - var part293 = match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been updated through NTP%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg184 = msg("00008:03", part293); - - var part294 = match("MESSAGE#183:00008:04/0", "nwparser.payload", "System clock %{p0}"); - - var part295 = match("MESSAGE#183:00008:04/1_0", "nwparser.p0", "configurations have been%{p0}"); - - var part296 = match("MESSAGE#183:00008:04/1_1", "nwparser.p0", "was%{p0}"); - - var part297 = match("MESSAGE#183:00008:04/1_2", "nwparser.p0", "is%{p0}"); - - var select64 = linear_select([ - part295, - part296, - part297, - ]); - - var part298 = match("MESSAGE#183:00008:04/2", "nwparser.p0", "%{}changed%{p0}"); - - var part299 = match("MESSAGE#183:00008:04/3_0", "nwparser.p0", " by admin %{administrator}"); - - var part300 = match("MESSAGE#183:00008:04/3_1", "nwparser.p0", " by %{username->} (%{fld1})"); - - var part301 = match("MESSAGE#183:00008:04/3_2", "nwparser.p0", " by %{username}"); - - var part302 = match("MESSAGE#183:00008:04/3_3", "nwparser.p0", " manually.%{}"); - - var part303 = match("MESSAGE#183:00008:04/3_4", "nwparser.p0", " manually%{}"); - - var select65 = linear_select([ - part299, - part300, - part301, - part302, - part303, - dup21, - ]); - - var all57 = all_match({ - processors: [ - part294, - select64, - part298, - select65, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg185 = msg("00008:04", all57); - - var part304 = match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg186 = msg("00008:05", part304); - - var part305 = match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg187 = msg("00008:06", part305); - - var part306 = match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup60, - ])); - - var msg188 = msg("00008:07", part306); - - var part307 = match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup60, - ])); - - var msg189 = msg("00008:08", part307); - - var part308 = match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manually%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg190 = msg("00008:09", part308); - - var part309 = match("MESSAGE#189:00008:10/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol}(zone %{p0}"); - - var all58 = all_match({ - processors: [ - part309, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ]), - }); - - var msg191 = msg("00008:10", all58); - - var select66 = linear_select([ - msg181, - msg182, - msg183, - msg184, - msg185, - msg186, - msg187, - msg188, - msg189, - msg190, - msg191, - ]); - - var part310 = match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg192 = msg("00009", part310); - - var part311 = match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg193 = msg("00009:01", part311); - - var part312 = match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg194 = msg("00009:02", part312); - - var part313 = match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for interface %{interface->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg195 = msg("00009:03", part313); - - var part314 = match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg196 = msg("00009:05", part314); - - var part315 = match("MESSAGE#195:00009:06/0_0", "nwparser.payload", "%{fld2}: The 802.1Q tag %{p0}"); - - var part316 = match("MESSAGE#195:00009:06/0_1", "nwparser.payload", "The 802.1Q tag %{p0}"); - - var select67 = linear_select([ - part315, - part316, - ]); - - var select68 = linear_select([ - dup119, - dup16, - ]); - - var part317 = match("MESSAGE#195:00009:06/3", "nwparser.p0", "interface %{interface->} has been %{p0}"); - - var part318 = match("MESSAGE#195:00009:06/4_1", "nwparser.p0", "changed to %{p0}"); - - var select69 = linear_select([ - dup120, - part318, - ]); - - var part319 = match("MESSAGE#195:00009:06/6_0", "nwparser.p0", "%{info->} from host %{saddr}"); - - var part320 = match_copy("MESSAGE#195:00009:06/6_1", "nwparser.p0", "info"); - - var select70 = linear_select([ - part319, - part320, - ]); - - var all59 = all_match({ - processors: [ - select67, - dup118, - select68, - part317, - select69, - dup23, - select70, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg197 = msg("00009:06", all59); - - var part321 = match("MESSAGE#196:00009:07/0", "nwparser.payload", "Maximum bandwidth %{fld2->} on %{p0}"); - - var part322 = match("MESSAGE#196:00009:07/2", "nwparser.p0", "%{} %{interface->} is less than t%{p0}"); - - var part323 = match("MESSAGE#196:00009:07/3_0", "nwparser.p0", "he total %{p0}"); - - var part324 = match("MESSAGE#196:00009:07/3_1", "nwparser.p0", "otal %{p0}"); - - var select71 = linear_select([ - part323, - part324, - ]); - - var part325 = match("MESSAGE#196:00009:07/4", "nwparser.p0", "guaranteed bandwidth %{fld3}"); - - var all60 = all_match({ - processors: [ - part321, - dup337, - part322, - select71, - part325, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg198 = msg("00009:07", all60); - - var part326 = match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth setting on the interface %{interface->} has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg199 = msg("00009:09", part326); - - var part327 = match("MESSAGE#198:00009:10/0", "nwparser.payload", "The operational mode for the interface %{interface->} has been changed to %{p0}"); - - var part328 = match("MESSAGE#198:00009:10/1_0", "nwparser.p0", "Route%{}"); - - var part329 = match("MESSAGE#198:00009:10/1_1", "nwparser.p0", "NAT%{}"); - - var select72 = linear_select([ - part328, - part329, - ]); - - var all61 = all_match({ - processors: [ - part327, - select72, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg200 = msg("00009:10", all61); - - var part330 = match("MESSAGE#199:00009:11/0_0", "nwparser.payload", "%{fld1}: VLAN %{p0}"); - - var part331 = match("MESSAGE#199:00009:11/0_1", "nwparser.payload", "VLAN %{p0}"); - - var select73 = linear_select([ - part330, - part331, - ]); - - var part332 = match("MESSAGE#199:00009:11/1", "nwparser.p0", "tag %{fld2->} has been %{disposition}"); - - var all62 = all_match({ - processors: [ - select73, - part332, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg201 = msg("00009:11", all62); - - var part333 = match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{disposition->} on interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg202 = msg("00009:12", part333); - - var part334 = match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on %{interface->} have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg203 = msg("00009:13", part334); - - var part335 = match("MESSAGE#202:00009:14/0_0", "nwparser.payload", "Global-PRO has been %{p0}"); - - var part336 = match("MESSAGE#202:00009:14/0_1", "nwparser.payload", "Global PRO has been %{p0}"); - - var part337 = match("MESSAGE#202:00009:14/0_2", "nwparser.payload", "DNS proxy was %{p0}"); - - var select74 = linear_select([ - part335, - part336, - part337, - ]); - - var part338 = match("MESSAGE#202:00009:14/1", "nwparser.p0", "%{disposition->} on %{p0}"); - - var select75 = linear_select([ - dup122, - dup123, - ]); - - var part339 = match("MESSAGE#202:00009:14/4_0", "nwparser.p0", "%{interface->} (%{fld2})"); - - var select76 = linear_select([ - part339, - dup124, - ]); - - var all63 = all_match({ - processors: [ - select74, - part338, - select75, - dup23, - select76, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg204 = msg("00009:14", all63); - - var part340 = match("MESSAGE#203:00009:15/0", "nwparser.payload", "Route between secondary IP%{p0}"); - - var part341 = match("MESSAGE#203:00009:15/1_0", "nwparser.p0", " addresses %{p0}"); - - var select77 = linear_select([ - part341, - dup125, - ]); - - var all64 = all_match({ - processors: [ - part340, - select77, - dup126, - dup350, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg205 = msg("00009:15", all64); - - var part342 = match("MESSAGE#204:00009:16/0", "nwparser.payload", "Secondary IP address %{hostip}/%{mask->} %{p0}"); - - var part343 = match("MESSAGE#204:00009:16/3_2", "nwparser.p0", "deleted from %{p0}"); - - var select78 = linear_select([ - dup129, - dup130, - part343, - ]); - - var part344 = match("MESSAGE#204:00009:16/4", "nwparser.p0", "interface %{interface}."); - - var all65 = all_match({ - processors: [ - part342, - dup350, - dup23, - select78, - part344, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg206 = msg("00009:16", all65); - - var part345 = match("MESSAGE#205:00009:17/0", "nwparser.payload", "Secondary IP address %{p0}"); - - var part346 = match("MESSAGE#205:00009:17/1_0", "nwparser.p0", "%{hostip}/%{mask->} was added to interface %{p0}"); - - var part347 = match("MESSAGE#205:00009:17/1_1", "nwparser.p0", "%{hostip->} was added to interface %{p0}"); - - var select79 = linear_select([ - part346, - part347, - ]); - - var part348 = match("MESSAGE#205:00009:17/2", "nwparser.p0", "%{interface}."); - - var all66 = all_match({ - processors: [ - part345, - select79, - part348, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg207 = msg("00009:17", all66); - - var part349 = match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on the interface %{interface->} has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg208 = msg("00009:18", part349); - - var part350 = match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg209 = msg("00009:19", part350); - - var part351 = match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg210 = msg("00009:27", part351); - - var part352 = match("MESSAGE#209:00009:20/0_0", "nwparser.payload", "%{fld2}: %{service->} has been %{p0}"); - - var part353 = match("MESSAGE#209:00009:20/0_1", "nwparser.payload", "%{service->} has been %{p0}"); - - var select80 = linear_select([ - part352, - part353, - ]); - - var part354 = match("MESSAGE#209:00009:20/1", "nwparser.p0", "%{disposition->} on interface %{interface->} %{p0}"); - - var part355 = match("MESSAGE#209:00009:20/2_0", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}"); - - var part356 = match("MESSAGE#209:00009:20/2_1", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}:%{sport}"); - - var part357 = match("MESSAGE#209:00009:20/2_2", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}"); - - var part358 = match("MESSAGE#209:00009:20/2_3", "nwparser.p0", "from host %{saddr->} (%{fld1})"); - - var select81 = linear_select([ - part355, - part356, - part357, - part358, - ]); - - var all67 = all_match({ - processors: [ - select80, - part354, - select81, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg211 = msg("00009:20", all67); - - var part359 = match("MESSAGE#210:00009:21/0", "nwparser.payload", "Source Route IP option! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var all68 = all_match({ - processors: [ - part359, - dup343, - dup131, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ]), - }); - - var msg212 = msg("00009:21", all68); - - var part360 = match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface->} has been changed to %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg213 = msg("00009:22", part360); - - var part361 = match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip->} has been added to interface %{interface->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg214 = msg("00009:23", part361); - - var part362 = match("MESSAGE#213:00009:24/0", "nwparser.payload", "Web has been enabled on interface %{interface->} by admin %{administrator->} via %{p0}"); - - var part363 = match("MESSAGE#213:00009:24/1_0", "nwparser.p0", "%{logon_type->} %{space}(%{p0}"); - - var part364 = match("MESSAGE#213:00009:24/1_1", "nwparser.p0", "%{logon_type}. (%{p0}"); - - var select82 = linear_select([ - part363, - part364, - ]); - - var part365 = match("MESSAGE#213:00009:24/2", "nwparser.p0", ")%{fld1}"); - - var all69 = all_match({ - processors: [ - part362, - select82, - part365, - ], - on_success: processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg215 = msg("00009:24", all69); - - var part366 = match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on interface %{interface->} by %{username->} via %{logon_type}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg216 = msg("00009:25", part366); - - var part367 = match("MESSAGE#215:00009:26/0", "nwparser.payload", "%{protocol->} has been %{disposition->} on interface %{interface->} by %{username->} via NSRP Peer . %{p0}"); - - var all70 = all_match({ - processors: [ - part367, - dup333, - ], - on_success: processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg217 = msg("00009:26", all70); - - var select83 = linear_select([ - msg192, - msg193, - msg194, - msg195, - msg196, - msg197, - msg198, - msg199, - msg200, - msg201, - msg202, - msg203, - msg204, - msg205, - msg206, - msg207, - msg208, - msg209, - msg210, - msg211, - msg212, - msg213, - msg214, - msg215, - msg216, - msg217, - ]); - - var part368 = match("MESSAGE#216:00010/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} %{p0}"); - - var part369 = match("MESSAGE#216:00010/1_0", "nwparser.p0", "using protocol %{p0}"); - - var part370 = match("MESSAGE#216:00010/1_1", "nwparser.p0", "proto %{p0}"); - - var select84 = linear_select([ - part369, - part370, - ]); - - var part371 = match("MESSAGE#216:00010/2", "nwparser.p0", "%{protocol->} %{p0}"); - - var part372 = match("MESSAGE#216:00010/3_0", "nwparser.p0", "( zone %{zone}, int %{interface}) %{p0}"); - - var part373 = match("MESSAGE#216:00010/3_1", "nwparser.p0", "zone %{zone->} int %{interface}) %{p0}"); - - var select85 = linear_select([ - part372, - part373, - dup126, - ]); - - var part374 = match("MESSAGE#216:00010/4", "nwparser.p0", ".%{space}The attack occurred %{dclass_counter1->} times%{p0}"); - - var all71 = all_match({ - processors: [ - part368, - select84, - part371, - select85, - part374, - dup351, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup5, - dup9, - dup3, - dup61, - ]), - }); - - var msg218 = msg("00010", all71); - - var part375 = match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg219 = msg("00010:01", part375); - - var part376 = match("MESSAGE#218:00010:02", "nwparser.payload", "Mapped IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg220 = msg("00010:02", part376); - - var all72 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup9, - dup3, - dup60, - ]), - }); - - var msg221 = msg("00010:03", all72); - - var select86 = linear_select([ - msg218, - msg219, - msg220, - msg221, - ]); - - var part377 = match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg222 = msg("00011", part377); - - var part378 = match("MESSAGE#221:00011:01/0", "nwparser.payload", "Route to %{daddr}/%{fld2->} [ %{p0}"); - - var select87 = linear_select([ - dup57, - dup56, - ]); - - var part379 = match("MESSAGE#221:00011:01/2", "nwparser.p0", "%{} %{interface->} gateway %{fld3->} ] has been %{disposition}"); - - var all73 = all_match({ - processors: [ - part378, - select87, - part379, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg223 = msg("00011:01", all73); - - var part380 = match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} to %{daddr->} protocol %{protocol->} (%{fld2})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg224 = msg("00011:02", part380); - - var part381 = match("MESSAGE#223:00011:03/0", "nwparser.payload", "An %{p0}"); - - var part382 = match("MESSAGE#223:00011:03/1_0", "nwparser.p0", "import %{p0}"); - - var part383 = match("MESSAGE#223:00011:03/1_1", "nwparser.p0", "export %{p0}"); - - var select88 = linear_select([ - part382, - part383, - ]); - - var part384 = match("MESSAGE#223:00011:03/2", "nwparser.p0", "rule in virtual router %{node->} to virtual router %{fld4->} with %{p0}"); - - var part385 = match("MESSAGE#223:00011:03/3_0", "nwparser.p0", "route-map %{fld3->} and protocol %{protocol->} has been %{p0}"); - - var part386 = match("MESSAGE#223:00011:03/3_1", "nwparser.p0", "IP-prefix %{hostip}/%{interface->} has been %{p0}"); - - var select89 = linear_select([ - part385, - part386, - ]); - - var all74 = all_match({ - processors: [ - part381, - select88, - part384, - select89, - dup36, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg225 = msg("00011:03", all74); - - var part387 = match("MESSAGE#224:00011:04/0", "nwparser.payload", "A route in virtual router %{node->} that has IP address %{hostip}/%{fld2->} through %{p0}"); - - var part388 = match("MESSAGE#224:00011:04/2", "nwparser.p0", "%{interface->} and gateway %{fld3->} with metric %{fld4->} has been %{disposition}"); - - var all75 = all_match({ - processors: [ - part387, - dup352, - part388, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg226 = msg("00011:04", all75); - - var part389 = match("MESSAGE#225:00011:05/1_0", "nwparser.p0", "sharable virtual router using name%{p0}"); - - var part390 = match("MESSAGE#225:00011:05/1_1", "nwparser.p0", "virtual router with name%{p0}"); - - var select90 = linear_select([ - part389, - part390, - ]); - - var part391 = match("MESSAGE#225:00011:05/2", "nwparser.p0", "%{} %{node->} and id %{fld2->} has been %{disposition}"); - - var all76 = all_match({ - processors: [ - dup79, - select90, - part391, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg227 = msg("00011:05", all76); - - var part392 = match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup59, - dup3, - dup60, - ])); - - var msg228 = msg("00011:07", part392); - - var part393 = match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{node->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg229 = msg("00011:08", part393); - - var part394 = match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg230 = msg("00011:09", part394); - - var part395 = match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes that can be created in virtual router %{node->} is %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg231 = msg("00011:10", part395); - - var part396 = match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg232 = msg("00011:11", part396); - - var part397 = match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual router %{node->} used by OSPF BGP routing instances id has been uninitialized", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg233 = msg("00011:12", part397); - - var part398 = match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be used by OSPF BGP routing instances in virtual router %{node->} has been set to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg234 = msg("00011:13", part398); - - var part399 = match("MESSAGE#233:00011:14/0", "nwparser.payload", "The routing preference for protocol %{protocol->} in virtual router %{node->} has been %{p0}"); - - var part400 = match("MESSAGE#233:00011:14/1_1", "nwparser.p0", "reset%{}"); - - var select91 = linear_select([ - dup134, - part400, - ]); - - var all77 = all_match({ - processors: [ - part399, - select91, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg235 = msg("00011:14", all77); - - var part401 = match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg236 = msg("00011:15", part401); - - var part402 = match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route through virtual router %{node->} has been added in virtual router %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg237 = msg("00011:16", part402); - - var part403 = match("MESSAGE#236:00011:17/0", "nwparser.payload", "The virtual router %{node->} has been made %{p0}"); - - var part404 = match("MESSAGE#236:00011:17/1_0", "nwparser.p0", "sharable%{}"); - - var part405 = match("MESSAGE#236:00011:17/1_1", "nwparser.p0", "unsharable%{}"); - - var part406 = match("MESSAGE#236:00011:17/1_2", "nwparser.p0", "default virtual router for virtual system %{fld2}"); - - var select92 = linear_select([ - part404, - part405, - part406, - ]); - - var all78 = all_match({ - processors: [ - part403, - select92, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg238 = msg("00011:17", all78); - - var part407 = match("MESSAGE#237:00011:18/0_0", "nwparser.payload", "Source route(s) %{p0}"); - - var part408 = match("MESSAGE#237:00011:18/0_1", "nwparser.payload", "A source route %{p0}"); - - var select93 = linear_select([ - part407, - part408, - ]); - - var part409 = match("MESSAGE#237:00011:18/1", "nwparser.p0", "in virtual router %{node->} %{p0}"); - - var part410 = match("MESSAGE#237:00011:18/2_0", "nwparser.p0", "with route addresses of %{p0}"); - - var part411 = match("MESSAGE#237:00011:18/2_1", "nwparser.p0", "that has IP address %{p0}"); - - var select94 = linear_select([ - part410, - part411, - ]); - - var part412 = match("MESSAGE#237:00011:18/3", "nwparser.p0", "%{hostip}/%{fld2->} through interface %{interface->} and %{p0}"); - - var part413 = match("MESSAGE#237:00011:18/4_0", "nwparser.p0", "a default gateway address %{p0}"); - - var select95 = linear_select([ - part413, - dup135, - ]); - - var part414 = match("MESSAGE#237:00011:18/5", "nwparser.p0", "%{fld3->} with metric %{fld4->} %{p0}"); - - var all79 = all_match({ - processors: [ - select93, - part409, - select94, - part412, - select95, - part414, - dup350, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg239 = msg("00011:18", all79); - - var part415 = match("MESSAGE#238:00011:19/0", "nwparser.payload", "Source Route(s) in virtual router %{node->} with %{p0}"); - - var part416 = match("MESSAGE#238:00011:19/1_0", "nwparser.p0", "route addresses of %{p0}"); - - var part417 = match("MESSAGE#238:00011:19/1_1", "nwparser.p0", "an IP address %{p0}"); - - var select96 = linear_select([ - part416, - part417, - ]); - - var part418 = match("MESSAGE#238:00011:19/2", "nwparser.p0", "%{hostip}/%{fld3->} and %{p0}"); - - var part419 = match("MESSAGE#238:00011:19/3_0", "nwparser.p0", "a default gateway address of %{p0}"); - - var select97 = linear_select([ - part419, - dup135, - ]); - - var part420 = match("MESSAGE#238:00011:19/4", "nwparser.p0", "%{fld4->} %{p0}"); - - var part421 = match("MESSAGE#238:00011:19/5_1", "nwparser.p0", "has been%{p0}"); - - var select98 = linear_select([ - dup107, - part421, - ]); - - var all80 = all_match({ - processors: [ - part415, - select96, - part418, - select97, - part420, - select98, - dup136, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg240 = msg("00011:19", all80); - - var part422 = match("MESSAGE#239:00011:20/0_0", "nwparser.payload", "%{fld2}: A %{p0}"); - - var select99 = linear_select([ - part422, - dup79, - ]); - - var part423 = match("MESSAGE#239:00011:20/1", "nwparser.p0", "route has been created in virtual router \"%{node}\"%{space}with an IP address %{hostip->} and next-hop as virtual router \"%{fld3}\""); - - var all81 = all_match({ - processors: [ - select99, - part423, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg241 = msg("00011:20", all81); - - var part424 = match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual router %{node->} for interface %{interface->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg242 = msg("00011:21", part424); - - var part425 = match("MESSAGE#241:00011:22", "nwparser.payload", "SIBR route in virtual router %{node->} for interface %{interface->} that has IP address %{hostip->} through interface %{fld3->} and gateway %{fld4->} with metric %{fld5->} was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg243 = msg("00011:22", part425); - - var all82 = all_match({ - processors: [ - dup132, - dup343, - dup131, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("saddr"), - field("daddr"), - ], - }), - ]), - }); - - var msg244 = msg("00011:23", all82); - - var part426 = match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{node}\" that has IP address %{hostip->} through interface %{interface->} and gateway %{fld2->} with metric %{fld3->} %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg245 = msg("00011:24", part426); - - var part427 = match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \"%{node}\" with an IP address %{hostip}/%{fld2->} and gateway %{fld3->} %{disposition}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg246 = msg("00011:25", part427); - - var part428 = match("MESSAGE#245:00011:26", "nwparser.payload", "Route in virtual router \"%{node}\" with IP address %{hostip}/%{fld2->} and next-hop as virtual router \"%{fld3}\" created. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg247 = msg("00011:26", part428); - - var select100 = linear_select([ - msg222, - msg223, - msg224, - msg225, - msg226, - msg227, - msg228, - msg229, - msg230, - msg231, - msg232, - msg233, - msg234, - msg235, - msg236, - msg237, - msg238, - msg239, - msg240, - msg241, - msg242, - msg243, - msg244, - msg245, - msg246, - msg247, - ]); - - var part429 = match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comments have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg248 = msg("00012:02", part429); - - var part430 = match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} %{change_attribute->} has been changed to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg249 = msg("00012:03", part430); - - var part431 = match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{group->} has %{disposition->} member %{username->} from host %{saddr}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg250 = msg("00012:04", part431); - - var part432 = match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2}) (%{fld3})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg251 = msg("00012:05", part432); - - var part433 = match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg252 = msg("00012:06", part433); - - var part434 = match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - dup59, - ])); - - var msg253 = msg("00012:07", part434); - - var part435 = match("MESSAGE#252:00012:08", "nwparser.payload", "%{fld2}: Service %{service->} has been %{disposition->} from host %{saddr->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg254 = msg("00012:08", part435); - - var all83 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg255 = msg("00012:09", all83); - - var all84 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg256 = msg("00012:10", all84); - - var part436 = match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup9, - dup61, - ])); - - var msg257 = msg("00012:11", part436); - - var part437 = match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{zone}) %{info->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg258 = msg("00012:12", part437); - - var part438 = match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg259 = msg("00012", part438); - - var part439 = match("MESSAGE#258:00012:01", "nwparser.payload", "Service %{service->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg260 = msg("00012:01", part439); - - var select101 = linear_select([ - msg248, - msg249, - msg250, - msg251, - msg252, - msg253, - msg254, - msg255, - msg256, - msg257, - msg258, - msg259, - msg260, - ]); - - var part440 = match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding bytes has been detected%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg261 = msg("00013", part440); - - var part441 = match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to connect to the NetScreen-Global Manager port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - setc("signame","An Attempt to connect to NetScreen-Global Manager Port."), - ])); - - var msg262 = msg("00013:01", part441); - - var part442 = match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has been changed to %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg263 = msg("00013:02", part442); - - var part443 = match("MESSAGE#262:00013:03", "nwparser.payload", "Web Filtering has been %{disposition->} (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg264 = msg("00013:03", part443); - - var select102 = linear_select([ - msg261, - msg262, - msg263, - msg264, - ]); - - var part444 = match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes has changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg265 = msg("00014", part444); - - var part445 = match("MESSAGE#264:00014:01/0", "nwparser.payload", "The group member %{username->} has been %{disposition->} %{p0}"); - - var part446 = match("MESSAGE#264:00014:01/1_0", "nwparser.p0", "to a group%{}"); - - var part447 = match("MESSAGE#264:00014:01/1_1", "nwparser.p0", "from a group%{}"); - - var select103 = linear_select([ - part446, - part447, - ]); - - var all85 = all_match({ - processors: [ - part445, - select103, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg266 = msg("00014:01", all85); - - var part448 = match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has been %{disposition->} by %{username}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg267 = msg("00014:02", part448); - - var part449 = match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has been %{disposition->} by %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg268 = msg("00014:03", part449); - - var part450 = match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{hostname->} server { %{hostip->} }: SrvErr (%{fld2}), SockErr (%{fld3}), Valid (%{fld4}),Connected (%{fld5})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg269 = msg("00014:04", part450); - - var part451 = match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations have been %{disposition->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg270 = msg("00014:05", part451); - - var part452 = match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition->} manually.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg271 = msg("00014:06", part452); - - var part453 = match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{disposition->} by %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg272 = msg("00014:07", part453); - - var part454 = match("MESSAGE#271:00014:08", "nwparser.payload", "Communication error with %{hostname->} server[%{hostip}]: SrvErr(%{fld2}),SockErr(%{fld3}),Valid(%{fld4}),Connected(%{fld5}) (%{fld1})", processor_chain([ - dup27, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg273 = msg("00014:08", part454); - - var select104 = linear_select([ - msg265, - msg266, - msg267, - msg268, - msg269, - msg270, - msg271, - msg272, - msg273, - ]); - - var part455 = match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been changed to %{authmethod}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg274 = msg("00015", part455); - - var part456 = match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has %{disposition}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg275 = msg("00015:01", part456); - - var part457 = match("MESSAGE#274:00015:02/0", "nwparser.payload", "LDAP %{p0}"); - - var part458 = match("MESSAGE#274:00015:02/1_0", "nwparser.p0", "server name %{p0}"); - - var part459 = match("MESSAGE#274:00015:02/1_2", "nwparser.p0", "distinguished name %{p0}"); - - var part460 = match("MESSAGE#274:00015:02/1_3", "nwparser.p0", "common name %{p0}"); - - var select105 = linear_select([ - part458, - dup137, - part459, - part460, - ]); - - var all86 = all_match({ - processors: [ - part457, - select105, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg276 = msg("00015:02", all86); - - var part461 = match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg277 = msg("00015:03", part461); - - var part462 = match("MESSAGE#276:00015:04/0", "nwparser.payload", "RADIUS server %{p0}"); - - var part463 = match("MESSAGE#276:00015:04/1_2", "nwparser.p0", "secret %{p0}"); - - var select106 = linear_select([ - dup139, - dup140, - part463, - ]); - - var all87 = all_match({ - processors: [ - part462, - select106, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg278 = msg("00015:04", all87); - - var part464 = match("MESSAGE#277:00015:05/0", "nwparser.payload", "SecurID %{p0}"); - - var part465 = match("MESSAGE#277:00015:05/1_0", "nwparser.p0", "authentication port %{p0}"); - - var part466 = match("MESSAGE#277:00015:05/1_1", "nwparser.p0", "duress mode %{p0}"); - - var part467 = match("MESSAGE#277:00015:05/1_3", "nwparser.p0", "number of retries value %{p0}"); - - var select107 = linear_select([ - part465, - part466, - dup76, - part467, - ]); - - var all88 = all_match({ - processors: [ - part464, - select107, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg279 = msg("00015:05", all88); - - var part468 = match("MESSAGE#278:00015:06/0_0", "nwparser.payload", "Master %{p0}"); - - var part469 = match("MESSAGE#278:00015:06/0_1", "nwparser.payload", "Backup %{p0}"); - - var select108 = linear_select([ - part468, - part469, - ]); - - var part470 = match("MESSAGE#278:00015:06/1", "nwparser.p0", "SecurID server IP address has been %{disposition}"); - - var all89 = all_match({ - processors: [ - select108, - part470, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg280 = msg("00015:06", all89); - - var part471 = match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg281 = msg("00015:07", part471); - - var part472 = match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration between master and slave%{}", processor_chain([ - dup141, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg282 = msg("00015:08", part472); - - var part473 = match("MESSAGE#281:00015:09/0_0", "nwparser.payload", "configuration %{p0}"); - - var part474 = match("MESSAGE#281:00015:09/0_1", "nwparser.payload", "Configuration %{p0}"); - - var select109 = linear_select([ - part473, - part474, - ]); - - var part475 = match("MESSAGE#281:00015:09/1", "nwparser.p0", "out of sync between local unit and remote unit%{}"); - - var all90 = all_match({ - processors: [ - select109, - part475, - ], - on_success: processor_chain([ - dup141, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg283 = msg("00015:09", all90); - - var part476 = match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg284 = msg("00015:10", part476); - - var part477 = match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg285 = msg("00015:11", part477); - - var part478 = match("MESSAGE#284:00015:12/1_0", "nwparser.p0", "control %{p0}"); - - var part479 = match("MESSAGE#284:00015:12/1_1", "nwparser.p0", "data %{p0}"); - - var select110 = linear_select([ - part478, - part479, - ]); - - var part480 = match("MESSAGE#284:00015:12/2", "nwparser.p0", "channel moved from link %{p0}"); - - var part481 = match("MESSAGE#284:00015:12/6", "nwparser.p0", "(%{interface})"); - - var all91 = all_match({ - processors: [ - dup87, - select110, - part480, - dup353, - dup103, - dup353, - part481, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg286 = msg("00015:12", all91); - - var part482 = match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg287 = msg("00015:13", part482); - - var part483 = match("MESSAGE#286:00015:14/0", "nwparser.payload", "NSRP link %{p0}"); - - var all92 = all_match({ - processors: [ - part483, - dup353, - dup116, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg288 = msg("00015:14", all92); - - var part484 = match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel available (%{fld3->} used by other channel)", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg289 = msg("00015:15", part484); - - var part485 = match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out of synchronization between the local device and the peer device.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg290 = msg("00015:16", part485); - - var part486 = match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{change_old->} changed to link channel %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg291 = msg("00015:17", part486); - - var part487 = match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on peer device %{fld2->} changed from %{fld3->} to %{fld4->} state.", processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - setc("change_attribute","RTO mirror group"), - ])); - - var msg292 = msg("00015:18", part487); - - var part488 = match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on local device %{fld2}, detected a duplicate direction on the peer device %{fld3}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg293 = msg("00015:19", part488); - - var part489 = match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} changed on the local device from %{fld2->} to up state, it had peer device %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg294 = msg("00015:20", part489); - - var part490 = match("MESSAGE#293:00015:21/0", "nwparser.payload", "Peer device %{fld2->} %{p0}"); - - var part491 = match("MESSAGE#293:00015:21/1_0", "nwparser.p0", "disappeared %{p0}"); - - var part492 = match("MESSAGE#293:00015:21/1_1", "nwparser.p0", "was discovered %{p0}"); - - var select111 = linear_select([ - part491, - part492, - ]); - - var all93 = all_match({ - processors: [ - part490, - select111, - dup116, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg295 = msg("00015:21", all93); - - var part493 = match("MESSAGE#294:00015:22/0_0", "nwparser.payload", "The local %{p0}"); - - var part494 = match("MESSAGE#294:00015:22/0_1", "nwparser.payload", "The peer %{p0}"); - - var part495 = match("MESSAGE#294:00015:22/0_2", "nwparser.payload", "Peer %{p0}"); - - var select112 = linear_select([ - part493, - part494, - part495, - ]); - - var part496 = match("MESSAGE#294:00015:22/1", "nwparser.p0", "device %{fld2->} in the Virtual Security Device group %{group->} changed %{change_attribute->} from %{change_old->} to %{change_new->} %{p0}"); - - var all94 = all_match({ - processors: [ - select112, - part496, - dup354, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg296 = msg("00015:22", all94); - - var part497 = match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg297 = msg("00015:23", part497); - - var part498 = match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authentication server has been changed to %{hostname}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg298 = msg("00015:24", part498); - - var part499 = match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification was successful", processor_chain([ - setc("eventcategory","1613050100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg299 = msg("00015:25", part499); - - var part500 = match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification failed", processor_chain([ - dup97, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg300 = msg("00015:29", part500); - - var part501 = match("MESSAGE#299:00015:26/0", "nwparser.payload", "unit %{fld2->} just dis%{p0}"); - - var part502 = match("MESSAGE#299:00015:26/1_0", "nwparser.p0", "appeared%{}"); - - var part503 = match("MESSAGE#299:00015:26/1_1", "nwparser.p0", "covered%{}"); - - var select113 = linear_select([ - part502, - part503, - ]); - - var all95 = all_match({ - processors: [ - part501, - select113, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg301 = msg("00015:26", all95); - - var part504 = match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change to %{interface}. (%{fld2})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - dup146, - ])); - - var msg302 = msg("00015:33", part504); - - var part505 = match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg303 = msg("00015:27", part505); - - var part506 = match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RADIUS retry timeout has been set to default of %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg304 = msg("00015:28", part506); - - var part507 = match("MESSAGE#303:00015:30/0", "nwparser.payload", "Number of RADIUS retries for auth server %{hostname->} %{p0}"); - - var part508 = match("MESSAGE#303:00015:30/2", "nwparser.p0", "set to %{fld2->} (%{fld1})"); - - var all96 = all_match({ - processors: [ - part507, - dup355, - part508, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg305 = msg("00015:30", all96); - - var part509 = match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth server %{hostname->} is unset to its default value, %{info->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg306 = msg("00015:31", part509); - - var part510 = match("MESSAGE#305:00015:32", "nwparser.payload", "Accounting port of server RADIUS is set to %{network_port}. (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg307 = msg("00015:32", part510); - - var select114 = linear_select([ - msg274, - msg275, - msg276, - msg277, - msg278, - msg279, - msg280, - msg281, - msg282, - msg283, - msg284, - msg285, - msg286, - msg287, - msg288, - msg289, - msg290, - msg291, - msg292, - msg293, - msg294, - msg295, - msg296, - msg297, - msg298, - msg299, - msg300, - msg301, - msg302, - msg303, - msg304, - msg305, - msg306, - msg307, - ]); - - var part511 = match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg308 = msg("00016", part511); - - var part512 = match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg309 = msg("00016:01", part512); - - var part513 = match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disposition}", processor_chain([ - dup1, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg310 = msg("00016:02", part513); - - var part514 = match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2})", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg311 = msg("00016:03", part514); - - var part515 = match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg312 = msg("00016:05", part515); - - var part516 = match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg313 = msg("00016:06", part516); - - var part517 = match("MESSAGE#312:00016:07/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} ( zone %{p0}"); - - var all97 = all_match({ - processors: [ - part517, - dup338, - dup67, - ], - on_success: processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg314 = msg("00016:07", all97); - - var part518 = match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) Modify by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - setc("eventcategory","1001020305"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg315 = msg("00016:08", part518); - - var part519 = match("MESSAGE#314:00016:09", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) New by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - setc("eventcategory","1001030305"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg316 = msg("00016:09", part519); - - var select115 = linear_select([ - msg308, - msg309, - msg310, - msg311, - msg312, - msg313, - msg314, - msg315, - msg316, - ]); - - var part520 = match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ])); - - var msg317 = msg("00017", part520); - - var part521 = match("MESSAGE#316:00017:23/0", "nwparser.payload", "Gateway %{fld2->} at %{fld3->} in %{fld5->} mode with ID %{p0}"); - - var part522 = match("MESSAGE#316:00017:23/1_0", "nwparser.p0", "[%{fld4}] %{p0}"); - - var part523 = match("MESSAGE#316:00017:23/1_1", "nwparser.p0", "%{fld4->} %{p0}"); - - var select116 = linear_select([ - part522, - part523, - ]); - - var part524 = match("MESSAGE#316:00017:23/2", "nwparser.p0", "has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} %{fld}"); - - var all98 = all_match({ - processors: [ - part521, - select116, - part524, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg318 = msg("00017:23", all98); - - var part525 = match("MESSAGE#317:00017:01/0_0", "nwparser.payload", "%{fld1}: Gateway %{p0}"); - - var part526 = match("MESSAGE#317:00017:01/0_1", "nwparser.payload", "Gateway %{p0}"); - - var select117 = linear_select([ - part525, - part526, - ]); - - var part527 = match("MESSAGE#317:00017:01/1", "nwparser.p0", "%{fld2->} at %{fld3->} in %{fld5->} mode with ID%{p0}"); - - var part528 = match("MESSAGE#317:00017:01/3", "nwparser.p0", "%{fld4->} has been %{disposition}"); - - var all99 = all_match({ - processors: [ - select117, - part527, - dup356, - part528, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg319 = msg("00017:01", all99); - - var part529 = match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settings have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg320 = msg("00017:02", part529); - - var part530 = match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg321 = msg("00017:03", part530); - - var part531 = match("MESSAGE#320:00017:04/2", "nwparser.p0", "%{group_object->} with range %{fld2->} has been %{disposition}"); - - var all100 = all_match({ - processors: [ - dup153, - dup357, - part531, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg322 = msg("00017:04", all100); - - var part532 = match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg323 = msg("00017:05", part532); - - var part533 = match("MESSAGE#322:00017:06/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been set to %{p0}"); - - var part534 = match("MESSAGE#322:00017:06/1_0", "nwparser.p0", "clear %{p0}"); - - var part535 = match("MESSAGE#322:00017:06/1_2", "nwparser.p0", "copy %{p0}"); - - var select118 = linear_select([ - part534, - dup101, - part535, - ]); - - var all101 = all_match({ - processors: [ - part533, - select118, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg324 = msg("00017:06", all101); - - var part536 = match("MESSAGE#323:00017:07/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been %{p0}"); - - var part537 = match("MESSAGE#323:00017:07/1_0", "nwparser.p0", "clear%{}"); - - var part538 = match("MESSAGE#323:00017:07/1_1", "nwparser.p0", "cleared%{}"); - - var part539 = match("MESSAGE#323:00017:07/1_3", "nwparser.p0", "copy%{}"); - - var part540 = match("MESSAGE#323:00017:07/1_4", "nwparser.p0", "copied%{}"); - - var select119 = linear_select([ - part537, - part538, - dup98, - part539, - part540, - ]); - - var all102 = all_match({ - processors: [ - part536, - select119, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg325 = msg("00017:07", all102); - - var part541 = match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and SPI %{fld3}/%{fld4->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg326 = msg("00017:08", part541); - - var part542 = match("MESSAGE#325:00017:09/0_0", "nwparser.payload", "%{fld1}: VPN %{p0}"); - - var part543 = match("MESSAGE#325:00017:09/0_1", "nwparser.payload", "VPN %{p0}"); - - var select120 = linear_select([ - part542, - part543, - ]); - - var part544 = match("MESSAGE#325:00017:09/1", "nwparser.p0", "%{group->} with gateway %{fld2->} %{p0}"); - - var part545 = match("MESSAGE#325:00017:09/2_0", "nwparser.p0", "no-rekey %{p0}"); - - var part546 = match("MESSAGE#325:00017:09/2_1", "nwparser.p0", "rekey, %{p0}"); - - var part547 = match("MESSAGE#325:00017:09/2_2", "nwparser.p0", "rekey %{p0}"); - - var select121 = linear_select([ - part545, - part546, - part547, - ]); - - var part548 = match("MESSAGE#325:00017:09/3", "nwparser.p0", "and p2-proposal %{fld3->} has been %{p0}"); - - var part549 = match("MESSAGE#325:00017:09/4_0", "nwparser.p0", "%{disposition->} from peer unit"); - - var part550 = match("MESSAGE#325:00017:09/4_1", "nwparser.p0", "%{disposition->} from host %{saddr}"); - - var select122 = linear_select([ - part549, - part550, - dup36, - ]); - - var all103 = all_match({ - processors: [ - select120, - part544, - select121, - part548, - select122, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg327 = msg("00017:09", all103); - - var part551 = match("MESSAGE#326:00017:10/0", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}. Src IF %{sinterface->} dst IP %{daddr->} with rekeying %{p0}"); - - var all104 = all_match({ - processors: [ - part551, - dup358, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg328 = msg("00017:10", all104); - - var part552 = match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg329 = msg("00017:11", part552); - - var part553 = match("MESSAGE#328:00017:12/0", "nwparser.payload", "VPN monitoring %{p0}"); - - var part554 = match("MESSAGE#328:00017:12/1_2", "nwparser.p0", "frequency %{p0}"); - - var select123 = linear_select([ - dup109, - dup110, - part554, - ]); - - var all105 = all_match({ - processors: [ - part553, - select123, - dup127, - dup359, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg330 = msg("00017:12", all105); - - var part555 = match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been added by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg331 = msg("00017:26", part555); - - var part556 = match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. You cannot allocate an IP address.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg332 = msg("00017:13", part556); - - var part557 = match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail}, DH group %{group}, ESP %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup9, - dup5, - ])); - - var msg333 = msg("00017:14", part557); - - var part558 = match("MESSAGE#332:00017:15/0", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group->} %{p0}"); - - var part559 = match("MESSAGE#332:00017:15/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime (%{fld3}) (%{fld4}) has been %{disposition}."); - - var all106 = all_match({ - processors: [ - part558, - dup360, - part559, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg334 = msg("00017:15", all106); - - var part560 = match("MESSAGE#333:00017:31/0", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail->} DH group %{group->} %{p0}"); - - var part561 = match("MESSAGE#333:00017:31/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime %{fld3->} has been %{disposition}."); - - var all107 = all_match({ - processors: [ - part560, - dup360, - part561, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg335 = msg("00017:31", all107); - - var part562 = match("MESSAGE#334:00017:16/0", "nwparser.payload", "vpnmonitor interval is %{p0}"); - - var all108 = all_match({ - processors: [ - part562, - dup359, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg336 = msg("00017:16", all108); - - var part563 = match("MESSAGE#335:00017:17/0", "nwparser.payload", "vpnmonitor threshold is %{p0}"); - - var select124 = linear_select([ - dup99, - dup93, - ]); - - var all109 = all_match({ - processors: [ - part563, - select124, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg337 = msg("00017:17", all109); - - var part564 = match("MESSAGE#336:00017:18/2", "nwparser.p0", "%{group_object->} with range %{fld2->} was %{disposition}"); - - var all110 = all_match({ - processors: [ - dup153, - dup357, - part564, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg338 = msg("00017:18", all110); - - var part565 = match("MESSAGE#337:00017:19/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at %{p0}"); - - var part566 = match("MESSAGE#337:00017:19/2", "nwparser.p0", "%{} %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all111 = all_match({ - processors: [ - part565, - dup337, - part566, - ], - on_success: processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ]), - }); - - var msg339 = msg("00017:19", all111); - - var all112 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup151, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - ]), - }); - - var msg340 = msg("00017:20", all112); - - var part567 = match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ])); - - var msg341 = msg("00017:21", part567); - - var part568 = match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg342 = msg("00017:22", part568); - - var part569 = match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bound to tunnel interface %{interface}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg343 = msg("00017:24", part569); - - var part570 = match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal standard has been added by admin %{administrator->} via NSRP Peer (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg344 = msg("00017:25", part570); - - var part571 = match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group}, ESP, enc %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg345 = msg("00017:28", part571); - - var part572 = match("MESSAGE#344:00017:29", "nwparser.payload", "L2TP \"%{fld2}\", all-L2TP-users secret \"%{fld3}\" keepalive %{fld4->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg346 = msg("00017:29", part572); - - var select125 = linear_select([ - msg317, - msg318, - msg319, - msg320, - msg321, - msg322, - msg323, - msg324, - msg325, - msg326, - msg327, - msg328, - msg329, - msg330, - msg331, - msg332, - msg333, - msg334, - msg335, - msg336, - msg337, - msg338, - msg339, - msg340, - msg341, - msg342, - msg343, - msg344, - msg345, - msg346, - ]); - - var part573 = match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} and %{fld3->} have been exchanged", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg347 = msg("00018", part573); - - var part574 = match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", processor_chain([ - setc("eventcategory","1502010000"), - dup2, - dup4, - dup5, - dup3, - ])); - - var msg348 = msg("00018:01", part574); - - var part575 = match("MESSAGE#347:00018:02", "nwparser.payload", "Device%{quote}s %{change_attribute->} has been changed from %{change_old->} to %{change_new->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg349 = msg("00018:02", part575); - - var part576 = match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg350 = msg("00018:04", part576); - - var part577 = match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} by admin %{administrator->} via NSRP Peer", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg351 = msg("00018:16", part577); - - var part578 = match("MESSAGE#350:00018:06/0", "nwparser.payload", "%{fld2->} Policy %{policy_id->} has been moved %{p0}"); - - var part579 = match("MESSAGE#350:00018:06/1_0", "nwparser.p0", "before %{p0}"); - - var part580 = match("MESSAGE#350:00018:06/1_1", "nwparser.p0", "after %{p0}"); - - var select126 = linear_select([ - part579, - part580, - ]); - - var part581 = match("MESSAGE#350:00018:06/2", "nwparser.p0", "%{fld3->} by admin %{administrator}"); - - var all113 = all_match({ - processors: [ - part578, - select126, - part581, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg352 = msg("00018:06", all113); - - var part582 = match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} application was modified to %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg353 = msg("00018:08", part582); - - var part583 = match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup3, - dup2, - dup9, - dup4, - dup5, - ])); - - var msg354 = msg("00018:09", part583); - - var part584 = match("MESSAGE#353:00018:10/0", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{p0}"); - - var part585 = match("MESSAGE#353:00018:10/1_0", "nwparser.p0", "%{disposition->} from peer unit by %{p0}"); - - var part586 = match("MESSAGE#353:00018:10/1_1", "nwparser.p0", "%{disposition->} by %{p0}"); - - var select127 = linear_select([ - part585, - part586, - ]); - - var part587 = match("MESSAGE#353:00018:10/2", "nwparser.p0", "%{username->} via %{interface->} from host %{saddr->} (%{fld1})"); - - var all114 = all_match({ - processors: [ - part584, - select127, - part587, - ], - on_success: processor_chain([ - dup17, - dup3, - dup2, - dup9, - dup4, - dup5, - ]), - }); - - var msg355 = msg("00018:10", all114); - - var part588 = match("MESSAGE#354:00018:11/1_0", "nwparser.p0", "Service %{service->} was %{p0}"); - - var part589 = match("MESSAGE#354:00018:11/1_1", "nwparser.p0", "Attack group %{signame->} was %{p0}"); - - var select128 = linear_select([ - part588, - part589, - ]); - - var part590 = match("MESSAGE#354:00018:11/2", "nwparser.p0", "%{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} %{p0}"); - - var part591 = match("MESSAGE#354:00018:11/3_0", "nwparser.p0", "to %{daddr}:%{dport}. %{p0}"); - - var select129 = linear_select([ - part591, - dup16, - ]); - - var all115 = all_match({ - processors: [ - dup160, - select128, - part590, - select129, - dup10, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg356 = msg("00018:11", all115); - - var part592 = match("MESSAGE#355:00018:12/0", "nwparser.payload", "In policy %{policy_id}, the %{p0}"); - - var part593 = match("MESSAGE#355:00018:12/1_0", "nwparser.p0", "application %{p0}"); - - var part594 = match("MESSAGE#355:00018:12/1_1", "nwparser.p0", "attack severity %{p0}"); - - var part595 = match("MESSAGE#355:00018:12/1_2", "nwparser.p0", "DI attack component %{p0}"); - - var select130 = linear_select([ - part593, - part594, - part595, - ]); - - var part596 = match("MESSAGE#355:00018:12/2", "nwparser.p0", "was modified by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all116 = all_match({ - processors: [ - part592, - select130, - part596, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg357 = msg("00018:12", all116); - - var part597 = match("MESSAGE#356:00018:32/1", "nwparser.p0", "%{}address %{dhost}(%{daddr}) was %{disposition->} %{p0}"); - - var all117 = all_match({ - processors: [ - dup361, - part597, - dup362, - dup164, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg358 = msg("00018:32", all117); - - var part598 = match("MESSAGE#357:00018:22/1", "nwparser.p0", "%{}address %{dhost->} was %{disposition->} %{p0}"); - - var all118 = all_match({ - processors: [ - dup361, - part598, - dup362, - dup164, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg359 = msg("00018:22", all118); - - var part599 = match("MESSAGE#358:00018:15/0", "nwparser.payload", "%{agent->} was %{disposition->} from policy %{policy_id->} %{p0}"); - - var select131 = linear_select([ - dup78, - dup77, - ]); - - var part600 = match("MESSAGE#358:00018:15/2", "nwparser.p0", "address by admin %{administrator->} via NSRP Peer"); - - var all119 = all_match({ - processors: [ - part599, - select131, - part600, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg360 = msg("00018:15", all119); - - var part601 = match("MESSAGE#359:00018:14/0", "nwparser.payload", "%{agent->} was %{disposition->} %{p0}"); - - var part602 = match("MESSAGE#359:00018:14/1_0", "nwparser.p0", "to%{p0}"); - - var part603 = match("MESSAGE#359:00018:14/1_1", "nwparser.p0", "from%{p0}"); - - var select132 = linear_select([ - part602, - part603, - ]); - - var part604 = match("MESSAGE#359:00018:14/2", "nwparser.p0", "%{}policy %{policy_id->} %{p0}"); - - var part605 = match("MESSAGE#359:00018:14/3_0", "nwparser.p0", "service %{p0}"); - - var part606 = match("MESSAGE#359:00018:14/3_1", "nwparser.p0", "source address %{p0}"); - - var part607 = match("MESSAGE#359:00018:14/3_2", "nwparser.p0", "destination address %{p0}"); - - var select133 = linear_select([ - part605, - part606, - part607, - ]); - - var part608 = match("MESSAGE#359:00018:14/4", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all120 = all_match({ - processors: [ - part601, - select132, - part604, - select133, - part608, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg361 = msg("00018:14", all120); - - var part609 = match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg362 = msg("00018:29", part609); - - var part610 = match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to policy %{policy_id->} %{rule_group->} by admin %{administrator->} via NSRP Peer %{space->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg363 = msg("00018:07", part610); - - var part611 = match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg364 = msg("00018:18", part611); - - var part612 = match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{disposition->} from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg365 = msg("00018:17", part612); - - var part613 = match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg366 = msg("00018:19", part613); - - var part614 = match("MESSAGE#365:00018:23/0_0", "nwparser.payload", "Destination %{p0}"); - - var part615 = match("MESSAGE#365:00018:23/0_1", "nwparser.payload", "Source %{p0}"); - - var select134 = linear_select([ - part614, - part615, - ]); - - var part616 = match("MESSAGE#365:00018:23/1", "nwparser.p0", "address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} %{p0}"); - - var part617 = match("MESSAGE#365:00018:23/2_0", "nwparser.p0", "from host %{p0}"); - - var select135 = linear_select([ - part617, - dup103, - ]); - - var part618 = match("MESSAGE#365:00018:23/4_0", "nwparser.p0", "%{saddr->} to %{daddr->} %{p0}"); - - var part619 = match("MESSAGE#365:00018:23/4_1", "nwparser.p0", "%{daddr->} %{p0}"); - - var select136 = linear_select([ - part618, - part619, - ]); - - var part620 = match("MESSAGE#365:00018:23/5", "nwparser.p0", "%{dport}:(%{fld1})"); - - var all121 = all_match({ - processors: [ - select134, - part616, - select135, - dup23, - select136, - part620, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg367 = msg("00018:23", all121); - - var part621 = match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg368 = msg("00018:21", part621); - - var part622 = match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{disposition->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg369 = msg("00018:24", part622); - - var part623 = match("MESSAGE#368:00018:25/1", "nwparser.p0", "%{}address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); - - var all122 = all_match({ - processors: [ - dup363, - part623, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg370 = msg("00018:25", all122); - - var part624 = match("MESSAGE#369:00018:30/1", "nwparser.p0", "%{}address %{info->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); - - var all123 = all_match({ - processors: [ - dup363, - part624, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg371 = msg("00018:30", all123); - - var part625 = match("MESSAGE#370:00018:26/0", "nwparser.payload", "In policy %{policy_id}, the application was modified to %{disposition->} by %{p0}"); - - var part626 = match("MESSAGE#370:00018:26/2_1", "nwparser.p0", "%{logon_type->} from host %{saddr}. (%{p0}"); - - var select137 = linear_select([ - dup48, - part626, - ]); - - var all124 = all_match({ - processors: [ - part625, - dup364, - select137, - dup41, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg372 = msg("00018:26", all124); - - var part627 = match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the DI attack component was modified by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg373 = msg("00018:27", part627); - - var part628 = match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the DI attack component was modified by admin %{administrator->} via %{logon_type}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup4, - dup5, - dup9, - setc("info","the DI attack component was modified"), - ])); - - var msg374 = msg("00018:28", part628); - - var part629 = match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition}", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg375 = msg("00018:03", part629); - - var part630 = match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the option %{fld2->} was %{disposition}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg376 = msg("00018:31", part630); - - var select138 = linear_select([ - msg347, - msg348, - msg349, - msg350, - msg351, - msg352, - msg353, - msg354, - msg355, - msg356, - msg357, - msg358, - msg359, - msg360, - msg361, - msg362, - msg363, - msg364, - msg365, - msg366, - msg367, - msg368, - msg369, - msg370, - msg371, - msg372, - msg373, - msg374, - msg375, - msg376, - ]); - - var part631 = match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has %{disposition->} because WebTrends settings have not yet been configured", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg377 = msg("00019", part631); - - var part632 = match("MESSAGE#375:00019:01/2", "nwparser.p0", "has %{disposition->} because syslog settings have not yet been configured"); - - var all125 = all_match({ - processors: [ - dup165, - dup365, - part632, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg378 = msg("00019:01", all125); - - var part633 = match("MESSAGE#376:00019:02/0", "nwparser.payload", "Socket cannot be assigned for %{p0}"); - - var part634 = match("MESSAGE#376:00019:02/1_0", "nwparser.p0", "WebTrends%{}"); - - var part635 = match("MESSAGE#376:00019:02/1_1", "nwparser.p0", "syslog%{}"); - - var select139 = linear_select([ - part634, - part635, - ]); - - var all126 = all_match({ - processors: [ - part633, - select139, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg379 = msg("00019:02", all126); - - var part636 = match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has been %{disposition}", processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg380 = msg("00019:03", part636); - - var select140 = linear_select([ - dup169, - dup78, - ]); - - var select141 = linear_select([ - dup139, - dup170, - dup137, - dup122, - ]); - - var all127 = all_match({ - processors: [ - dup168, - select140, - dup23, - select141, - dup171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg381 = msg("00019:04", all127); - - var part637 = match("MESSAGE#379:00019:05/0", "nwparser.payload", "Syslog message level has been changed to %{p0}"); - - var part638 = match("MESSAGE#379:00019:05/1_0", "nwparser.p0", "debug%{}"); - - var part639 = match("MESSAGE#379:00019:05/1_1", "nwparser.p0", "information%{}"); - - var part640 = match("MESSAGE#379:00019:05/1_2", "nwparser.p0", "notification%{}"); - - var part641 = match("MESSAGE#379:00019:05/1_3", "nwparser.p0", "warning%{}"); - - var part642 = match("MESSAGE#379:00019:05/1_4", "nwparser.p0", "error%{}"); - - var part643 = match("MESSAGE#379:00019:05/1_5", "nwparser.p0", "critical%{}"); - - var part644 = match("MESSAGE#379:00019:05/1_6", "nwparser.p0", "alert%{}"); - - var part645 = match("MESSAGE#379:00019:05/1_7", "nwparser.p0", "emergency%{}"); - - var select142 = linear_select([ - part638, - part639, - part640, - part641, - part642, - part643, - part644, - part645, - ]); - - var all128 = all_match({ - processors: [ - part637, - select142, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg382 = msg("00019:05", all128); - - var part646 = match("MESSAGE#380:00019:06/2", "nwparser.p0", "has been changed to %{p0}"); - - var all129 = all_match({ - processors: [ - dup168, - dup366, - part646, - dup367, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg383 = msg("00019:06", all129); - - var part647 = match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has been %{disposition}", processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg384 = msg("00019:07", part647); - - var part648 = match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg385 = msg("00019:08", part648); - - var part649 = match("MESSAGE#383:00019:09/0", "nwparser.payload", "WebTrends host %{p0}"); - - var select143 = linear_select([ - dup139, - dup170, - dup137, - ]); - - var all130 = all_match({ - processors: [ - part649, - select143, - dup171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg386 = msg("00019:09", all130); - - var part650 = match("MESSAGE#384:00019:10/1_0", "nwparser.p0", "Traffic logging via syslog %{p0}"); - - var part651 = match("MESSAGE#384:00019:10/1_1", "nwparser.p0", "Syslog %{p0}"); - - var select144 = linear_select([ - part650, - part651, - ]); - - var all131 = all_match({ - processors: [ - dup183, - select144, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg387 = msg("00019:10", all131); - - var part652 = match("MESSAGE#385:00019:11/2", "nwparser.p0", "has %{disposition->} because there is no syslog server defined"); - - var all132 = all_match({ - processors: [ - dup165, - dup365, - part652, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg388 = msg("00019:11", all132); - - var part653 = match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg389 = msg("00019:12", part653); - - var part654 = match("MESSAGE#387:00019:13/0", "nwparser.payload", "Syslog server %{hostip->} %{p0}"); - - var select145 = linear_select([ - dup107, - dup106, - ]); - - var part655 = match("MESSAGE#387:00019:13/2", "nwparser.p0", "%{disposition}"); - - var all133 = all_match({ - processors: [ - part654, - select145, - part655, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg390 = msg("00019:13", all133); - - var part656 = match("MESSAGE#388:00019:14/2", "nwparser.p0", "for %{hostip->} has been changed to %{p0}"); - - var all134 = all_match({ - processors: [ - dup168, - dup366, - part656, - dup367, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg391 = msg("00019:14", all134); - - var part657 = match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the TCP server %{hostip}; the connection is closed.", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg392 = msg("00019:15", part657); - - var part658 = match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were removed.%{}", processor_chain([ - setc("eventcategory","1701030000"), - setc("ec_activity","Delete"), - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg393 = msg("00019:16", part658); - - var part659 = match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} host port number has been changed to %{network_port->} %{fld5}", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg394 = msg("00019:17", part659); - - var part660 = match("MESSAGE#392:00019:18/0", "nwparser.payload", "Traffic logging %{p0}"); - - var part661 = match("MESSAGE#392:00019:18/1_0", "nwparser.p0", "via syslog %{p0}"); - - var part662 = match("MESSAGE#392:00019:18/1_1", "nwparser.p0", "for syslog server %{hostip->} %{p0}"); - - var select146 = linear_select([ - part661, - part662, - ]); - - var all135 = all_match({ - processors: [ - part660, - select146, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg395 = msg("00019:18", all135); - - var part663 = match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog server %{hostip->} was changed to udp", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg396 = msg("00019:19", part663); - - var part664 = match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is enabled on backup device by netscreen via web from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg397 = msg("00019:20", part664); - - var select147 = linear_select([ - msg377, - msg378, - msg379, - msg380, - msg381, - msg382, - msg383, - msg384, - msg385, - msg386, - msg387, - msg388, - msg389, - msg390, - msg391, - msg392, - msg393, - msg394, - msg395, - msg396, - msg397, - ]); - - var part665 = match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg398 = msg("00020", part665); - - var part666 = match("MESSAGE#396:00020:01/0", "nwparser.payload", "System memory is low %{p0}"); - - var part667 = match("MESSAGE#396:00020:01/1_1", "nwparser.p0", "( %{p0}"); - - var select148 = linear_select([ - dup152, - part667, - ]); - - var part668 = match("MESSAGE#396:00020:01/2", "nwparser.p0", "%{fld2->} bytes allocated out of %{p0}"); - - var part669 = match("MESSAGE#396:00020:01/3_0", "nwparser.p0", "total %{fld3->} bytes"); - - var part670 = match("MESSAGE#396:00020:01/3_1", "nwparser.p0", "%{fld4->} bytes total"); - - var select149 = linear_select([ - part669, - part670, - ]); - - var all136 = all_match({ - processors: [ - part666, - select148, - part668, - select149, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg399 = msg("00020:01", all136); - - var part671 = match("MESSAGE#397:00020:02", "nwparser.payload", "System memory is low (%{fld2->} allocated out of %{fld3->} ) %{fld4->} times in %{fld5}", processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg400 = msg("00020:02", part671); - - var select150 = linear_select([ - msg398, - msg399, - msg400, - ]); - - var part672 = match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg401 = msg("00021", part672); - - var part673 = match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range %{info->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg402 = msg("00021:01", part673); - - var part674 = match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg403 = msg("00021:02", part674); - - var part675 = match("MESSAGE#401:00021:03", "nwparser.payload", "Connection refused by the DNS server%{}", processor_chain([ - dup185, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg404 = msg("00021:03", part675); - - var part676 = match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg405 = msg("00021:04", part676); - - var part677 = match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg406 = msg("00021:05", part677); - - var part678 = match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - setc("info","DIP port-translation stickiness was modified"), - ])); - - var msg407 = msg("00021:06", part678); - - var select151 = linear_select([ - msg401, - msg402, - msg403, - msg404, - msg405, - msg406, - msg407, - ]); - - var part679 = match("MESSAGE#405:00022/1_0", "nwparser.p0", "power supplies %{p0}"); - - var part680 = match("MESSAGE#405:00022/1_1", "nwparser.p0", "fans %{p0}"); - - var select152 = linear_select([ - part679, - part680, - ]); - - var part681 = match("MESSAGE#405:00022/2", "nwparser.p0", "are %{fld2->} functioning properly"); - - var all137 = all_match({ - processors: [ - dup186, - select152, - part681, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg408 = msg("00022", all137); - - var part682 = match("MESSAGE#406:00022:01/0_0", "nwparser.payload", "At least one power supply %{p0}"); - - var part683 = match("MESSAGE#406:00022:01/0_1", "nwparser.payload", "The power supply %{fld2->} %{p0}"); - - var part684 = match("MESSAGE#406:00022:01/0_2", "nwparser.payload", "At least one fan %{p0}"); - - var select153 = linear_select([ - part682, - part683, - part684, - ]); - - var part685 = match("MESSAGE#406:00022:01/1", "nwparser.p0", "is not functioning properly%{p0}"); - - var all138 = all_match({ - processors: [ - select153, - part685, - dup368, - ], - on_success: processor_chain([ - dup187, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg409 = msg("00022:01", all138); - - var part686 = match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management tunnel has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg410 = msg("00022:02", part686); - - var part687 = match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name has been defined as %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg411 = msg("00022:03", part687); - - var part688 = match("MESSAGE#409:00022:04/0", "nwparser.payload", "Reporting of the %{p0}"); - - var part689 = match("MESSAGE#409:00022:04/1_0", "nwparser.p0", "network activities %{p0}"); - - var part690 = match("MESSAGE#409:00022:04/1_1", "nwparser.p0", "device resources %{p0}"); - - var part691 = match("MESSAGE#409:00022:04/1_2", "nwparser.p0", "event logs %{p0}"); - - var part692 = match("MESSAGE#409:00022:04/1_3", "nwparser.p0", "summary logs %{p0}"); - - var select154 = linear_select([ - part689, - part690, - part691, - part692, - ]); - - var part693 = match("MESSAGE#409:00022:04/2", "nwparser.p0", "to Global Manager has been %{disposition}"); - - var all139 = all_match({ - processors: [ - part688, - select154, - part693, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg412 = msg("00022:04", all139); - - var part694 = match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg413 = msg("00022:05", part694); - - var part695 = match("MESSAGE#411:00022:06/0", "nwparser.payload", "Global Manager %{p0}"); - - var part696 = match("MESSAGE#411:00022:06/1_0", "nwparser.p0", "report %{p0}"); - - var part697 = match("MESSAGE#411:00022:06/1_1", "nwparser.p0", "listen %{p0}"); - - var select155 = linear_select([ - part696, - part697, - ]); - - var part698 = match("MESSAGE#411:00022:06/2", "nwparser.p0", "port has been set to %{interface}"); - - var all140 = all_match({ - processors: [ - part695, - select155, - part698, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg414 = msg("00022:06", all140); - - var part699 = match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive value has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg415 = msg("00022:07", part699); - - var part700 = match("MESSAGE#413:00022:08/0_0", "nwparser.payload", "System temperature %{p0}"); - - var part701 = match("MESSAGE#413:00022:08/0_1", "nwparser.payload", "System's temperature: %{p0}"); - - var part702 = match("MESSAGE#413:00022:08/0_2", "nwparser.payload", "The system temperature %{p0}"); - - var select156 = linear_select([ - part700, - part701, - part702, - ]); - - var part703 = match("MESSAGE#413:00022:08/1", "nwparser.p0", "(%{fld2->} C%{p0}"); - - var part704 = match("MESSAGE#413:00022:08/2_0", "nwparser.p0", "entigrade, %{p0}"); - - var select157 = linear_select([ - part704, - dup96, - ]); - - var part705 = match("MESSAGE#413:00022:08/3", "nwparser.p0", "%{fld3->} F%{p0}"); - - var part706 = match("MESSAGE#413:00022:08/4_0", "nwparser.p0", "ahrenheit %{p0}"); - - var select158 = linear_select([ - part706, - dup96, - ]); - - var part707 = match("MESSAGE#413:00022:08/5", "nwparser.p0", ") is too high%{}"); - - var all141 = all_match({ - processors: [ - select156, - part703, - select157, - part705, - select158, - part707, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg416 = msg("00022:08", all141); - - var part708 = match("MESSAGE#414:00022:09/2", "nwparser.p0", "power supply is no%{p0}"); - - var select159 = linear_select([ - dup191, - dup192, - ]); - - var part709 = match("MESSAGE#414:00022:09/4", "nwparser.p0", "functioning properly%{}"); - - var all142 = all_match({ - processors: [ - dup55, - dup369, - part708, - select159, - part709, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg417 = msg("00022:09", all142); - - var part710 = match("MESSAGE#415:00022:10/0", "nwparser.payload", "The NetScreen device was unable to upgrade the file system%{p0}"); - - var part711 = match("MESSAGE#415:00022:10/1_0", "nwparser.p0", " due to an internal conflict%{}"); - - var part712 = match("MESSAGE#415:00022:10/1_1", "nwparser.p0", ", but the old file system is intact%{}"); - - var select160 = linear_select([ - part711, - part712, - ]); - - var all143 = all_match({ - processors: [ - part710, - select160, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg418 = msg("00022:10", all143); - - var part713 = match("MESSAGE#416:00022:11/0", "nwparser.payload", "The NetScreen device was unable to upgrade %{p0}"); - - var part714 = match("MESSAGE#416:00022:11/1_0", "nwparser.p0", "due to an internal conflict%{}"); - - var part715 = match("MESSAGE#416:00022:11/1_1", "nwparser.p0", "the loader, but the loader is intact%{}"); - - var select161 = linear_select([ - part714, - part715, - ]); - - var all144 = all_match({ - processors: [ - part713, - select161, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg419 = msg("00022:11", all144); - - var part716 = match("MESSAGE#417:00022:12/0", "nwparser.payload", "Battery is no%{p0}"); - - var select162 = linear_select([ - dup192, - dup191, - ]); - - var part717 = match("MESSAGE#417:00022:12/2", "nwparser.p0", "functioning properly.%{}"); - - var all145 = all_match({ - processors: [ - part716, - select162, - part717, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg420 = msg("00022:12", all145); - - var part718 = match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2->} Centigrade, %{fld3->} Fahrenheit) is OK now.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg421 = msg("00022:13", part718); - - var part719 = match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is functioning properly. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg422 = msg("00022:14", part719); - - var select163 = linear_select([ - msg408, - msg409, - msg410, - msg411, - msg412, - msg413, - msg414, - msg415, - msg416, - msg417, - msg418, - msg419, - msg420, - msg421, - msg422, - ]); - - var part720 = match("MESSAGE#420:00023", "nwparser.payload", "VIP server %{hostip->} is not responding", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg423 = msg("00023", part720); - - var part721 = match("MESSAGE#421:00023:01", "nwparser.payload", "VIP/load balance server %{hostip->} cannot be contacted", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg424 = msg("00023:01", part721); - - var part722 = match("MESSAGE#422:00023:02", "nwparser.payload", "VIP server %{hostip->} cannot be contacted", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg425 = msg("00023:02", part722); - - var select164 = linear_select([ - msg423, - msg424, - msg425, - ]); - - var part723 = match("MESSAGE#423:00024/0_0", "nwparser.payload", "The DHCP %{p0}"); - - var part724 = match("MESSAGE#423:00024/0_1", "nwparser.payload", " DHCP %{p0}"); - - var select165 = linear_select([ - part723, - part724, - ]); - - var part725 = match("MESSAGE#423:00024/2_0", "nwparser.p0", "IP address pool has %{p0}"); - - var part726 = match("MESSAGE#423:00024/2_1", "nwparser.p0", "options have been %{p0}"); - - var select166 = linear_select([ - part725, - part726, - ]); - - var all146 = all_match({ - processors: [ - select165, - dup193, - select166, - dup52, - dup368, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg426 = msg("00024", all146); - - var part727 = match("MESSAGE#424:00024:01/0_0", "nwparser.payload", "Traffic log %{p0}"); - - var part728 = match("MESSAGE#424:00024:01/0_1", "nwparser.payload", "Alarm log %{p0}"); - - var part729 = match("MESSAGE#424:00024:01/0_2", "nwparser.payload", "Event log %{p0}"); - - var part730 = match("MESSAGE#424:00024:01/0_3", "nwparser.payload", "Self log %{p0}"); - - var part731 = match("MESSAGE#424:00024:01/0_4", "nwparser.payload", "Asset Recovery log %{p0}"); - - var select167 = linear_select([ - part727, - part728, - part729, - part730, - part731, - ]); - - var part732 = match("MESSAGE#424:00024:01/1", "nwparser.p0", "has overflowed%{}"); - - var all147 = all_match({ - processors: [ - select167, - part732, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg427 = msg("00024:01", all147); - - var part733 = match("MESSAGE#425:00024:02/0", "nwparser.payload", "DHCP relay agent settings on %{fld2->} %{p0}"); - - var part734 = match("MESSAGE#425:00024:02/1_0", "nwparser.p0", "are %{p0}"); - - var part735 = match("MESSAGE#425:00024:02/1_1", "nwparser.p0", "have been %{p0}"); - - var select168 = linear_select([ - part734, - part735, - ]); - - var part736 = match("MESSAGE#425:00024:02/2", "nwparser.p0", "%{disposition->} (%{fld1})"); - - var all148 = all_match({ - processors: [ - part733, - select168, - part736, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg428 = msg("00024:02", all148); - - var part737 = match("MESSAGE#426:00024:03/0", "nwparser.payload", "DHCP server IP address pool %{p0}"); - - var select169 = linear_select([ - dup194, - dup106, - ]); - - var part738 = match("MESSAGE#426:00024:03/2", "nwparser.p0", "changed. (%{fld1})"); - - var all149 = all_match({ - processors: [ - part737, - select169, - part738, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg429 = msg("00024:03", all149); - - var select170 = linear_select([ - msg426, - msg427, - msg428, - msg429, - ]); - - var part739 = match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool has changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg430 = msg("00025", part739); - - var part740 = match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{disposition->} to save the certificate authority configuration.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg431 = msg("00025:01", part740); - - var part741 = match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the X509 request file via e-mail", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg432 = msg("00025:02", part741); - - var part742 = match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the CA configuration", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg433 = msg("00025:03", part742); - - var part743 = match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certificates. The %{result}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg434 = msg("00025:04", part743); - - var select171 = linear_select([ - msg430, - msg431, - msg432, - msg433, - msg434, - ]); - - var part744 = match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg435 = msg("00026", part744); - - var part745 = match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on interface %{interface}", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg436 = msg("00026:13", part745); - - var part746 = match("MESSAGE#434:00026:01/2", "nwparser.p0", "PKA key has been %{p0}"); - - var part747 = match("MESSAGE#434:00026:01/4", "nwparser.p0", "admin user %{administrator}. (Key ID = %{fld2})"); - - var all150 = all_match({ - processors: [ - dup195, - dup370, - part746, - dup371, - part747, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg437 = msg("00026:01", all150); - - var part748 = match("MESSAGE#435:00026:02/1_0", "nwparser.p0", ": SCS %{p0}"); - - var select172 = linear_select([ - part748, - dup96, - ]); - - var part749 = match("MESSAGE#435:00026:02/2", "nwparser.p0", "has been %{disposition->} for %{p0}"); - - var part750 = match("MESSAGE#435:00026:02/3_0", "nwparser.p0", "root system %{p0}"); - - var part751 = match("MESSAGE#435:00026:02/3_1", "nwparser.p0", "%{interface->} %{p0}"); - - var select173 = linear_select([ - part750, - part751, - ]); - - var all151 = all_match({ - processors: [ - dup195, - select172, - part749, - select173, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg438 = msg("00026:02", all151); - - var part752 = match("MESSAGE#436:00026:03/2", "nwparser.p0", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}"); - - var all152 = all_match({ - processors: [ - dup195, - dup370, - part752, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg439 = msg("00026:03", all152); - - var part753 = match("MESSAGE#437:00026:04", "nwparser.payload", "SCS: Connection has been terminated for admin user %{administrator->} at %{hostip}:%{network_port}", processor_chain([ - dup198, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg440 = msg("00026:04", part753); - - var part754 = match("MESSAGE#438:00026:05", "nwparser.payload", "SCS: Host client has requested NO cipher from %{interface}", processor_chain([ - dup198, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg441 = msg("00026:05", part754); - - var part755 = match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using PKA RSA from %{saddr}:%{sport}. (key-ID=%{fld2}", processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg442 = msg("00026:06", part755); - - var part756 = match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using password from %{saddr}:%{sport}.", processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg443 = msg("00026:07", part756); - - var part757 = match("MESSAGE#441:00026:08/0", "nwparser.payload", "SSH user %{username->} has been authenticated using %{p0}"); - - var part758 = match("MESSAGE#441:00026:08/2", "nwparser.p0", "from %{saddr}:%{sport->} [ with key ID %{fld2->} ]"); - - var all153 = all_match({ - processors: [ - part757, - dup372, - part758, - ], - on_success: processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg444 = msg("00026:08", all153); - - var part759 = match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interface->} with tunnel ID %{fld2->} received a packet with a bad SPI.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg445 = msg("00026:09", part759); - - var part760 = match("MESSAGE#443:00026:10/0", "nwparser.payload", "SSH: %{p0}"); - - var part761 = match("MESSAGE#443:00026:10/1_0", "nwparser.p0", "Failed %{p0}"); - - var part762 = match("MESSAGE#443:00026:10/1_1", "nwparser.p0", "Attempt %{p0}"); - - var select174 = linear_select([ - part761, - part762, - ]); - - var part763 = match("MESSAGE#443:00026:10/3_0", "nwparser.p0", "bind duplicate %{p0}"); - - var select175 = linear_select([ - part763, - dup201, - ]); - - var part764 = match("MESSAGE#443:00026:10/6", "nwparser.p0", "admin user '%{administrator}' (Key ID %{fld2})"); - - var all154 = all_match({ - processors: [ - part760, - select174, - dup103, - select175, - dup202, - dup373, - part764, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg446 = msg("00026:10", all154); - - var part765 = match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA keys (%{fld2}) has been bound to user '%{username}' Key not bound. (Key ID %{fld3})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg447 = msg("00026:11", part765); - - var part766 = match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg448 = msg("00026:12", part766); - - var select176 = linear_select([ - msg435, - msg436, - msg437, - msg438, - msg439, - msg440, - msg441, - msg442, - msg443, - msg444, - msg445, - msg446, - msg447, - msg448, - ]); - - var part767 = match("MESSAGE#446:00027/2", "nwparser.p0", "user %{username->} from %{p0}"); - - var part768 = match("MESSAGE#446:00027/3_0", "nwparser.p0", "IP address %{saddr}:%{sport}"); - - var part769 = match("MESSAGE#446:00027/3_1", "nwparser.p0", "%{saddr}:%{sport}"); - - var part770 = match("MESSAGE#446:00027/3_2", "nwparser.p0", "console%{}"); - - var select177 = linear_select([ - part768, - part769, - part770, - ]); - - var all155 = all_match({ - processors: [ - dup204, - dup374, - part767, - select177, - ], - on_success: processor_chain([ - dup206, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg449 = msg("00027", all155); - - var part771 = match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg450 = msg("00027:01", part771); - - var part772 = match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg451 = msg("00027:02", part772); - - var part773 = match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg452 = msg("00027:03", part773); - - var part774 = match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg453 = msg("00027:04", part774); - - var part775 = match("MESSAGE#451:00027:05/0", "nwparser.payload", "ScreenOS %{version->} %{p0}"); - - var part776 = match("MESSAGE#451:00027:05/1_0", "nwparser.p0", "Serial %{p0}"); - - var part777 = match("MESSAGE#451:00027:05/1_1", "nwparser.p0", "serial %{p0}"); - - var select178 = linear_select([ - part776, - part777, - ]); - - var part778 = match("MESSAGE#451:00027:05/2", "nwparser.p0", "# %{fld2}: Asset recovery %{p0}"); - - var part779 = match("MESSAGE#451:00027:05/3_0", "nwparser.p0", "performed %{p0}"); - - var select179 = linear_select([ - part779, - dup127, - ]); - - var select180 = linear_select([ - dup207, - dup208, - ]); - - var all156 = all_match({ - processors: [ - part775, - select178, - part778, - select179, - dup23, - select180, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg454 = msg("00027:05", all156); - - var part780 = match("MESSAGE#452:00027:06/0", "nwparser.payload", "Device Reset (Asset Recovery) has been %{p0}"); - - var select181 = linear_select([ - dup208, - dup207, - ]); - - var all157 = all_match({ - processors: [ - part780, - select181, - ], - on_success: processor_chain([ - setc("eventcategory","1606000000"), - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg455 = msg("00027:06", all157); - - var part781 = match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg456 = msg("00027:07", part781); - - var part782 = match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been erased%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg457 = msg("00027:08", part782); - - var part783 = match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due to expire in %{fld3}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg458 = msg("00027:09", part783); - - var part784 = match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has expired.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg459 = msg("00027:10", part784); - - var part785 = match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired after 30-day grace period.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg460 = msg("00027:11", part785); - - var part786 = match("MESSAGE#458:00027:12/0", "nwparser.payload", "Request to retrieve license key failed to reach %{p0}"); - - var part787 = match("MESSAGE#458:00027:12/1_0", "nwparser.p0", "the server %{p0}"); - - var select182 = linear_select([ - part787, - dup193, - ]); - - var part788 = match("MESSAGE#458:00027:12/2", "nwparser.p0", "by %{fld2}. Server url: %{url}"); - - var all158 = all_match({ - processors: [ - part786, - select182, - part788, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg461 = msg("00027:12", all158); - - var part789 = match("MESSAGE#459:00027:13/2", "nwparser.p0", "user %{username}"); - - var all159 = all_match({ - processors: [ - dup204, - dup374, - part789, - ], - on_success: processor_chain([ - dup206, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg462 = msg("00027:13", all159); - - var part790 = match("MESSAGE#460:00027:14/0", "nwparser.payload", "Configuration Erasure Process %{p0}"); - - var part791 = match("MESSAGE#460:00027:14/1_0", "nwparser.p0", "has been initiated %{p0}"); - - var part792 = match("MESSAGE#460:00027:14/1_1", "nwparser.p0", "aborted %{p0}"); - - var select183 = linear_select([ - part791, - part792, - ]); - - var part793 = match("MESSAGE#460:00027:14/2", "nwparser.p0", ".%{space}(%{fld1})"); - - var all160 = all_match({ - processors: [ - part790, - select183, - part793, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg463 = msg("00027:14", all160); - - var part794 = match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg464 = msg("00027:15", part794); - - var part795 = match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{policy_id->} name \"%{fld2->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg465 = msg("00027:16", part795); - - var part796 = match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locked and will be unlocked after %{duration->} minutes (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg466 = msg("00027:17", part796); - - var part797 = match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{username->} from %{saddr->} is refused as this account is locked (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg467 = msg("00027:18", part797); - - var part798 = match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg468 = msg("00027:19", part798); - - var select184 = linear_select([ - msg449, - msg450, - msg451, - msg452, - msg453, - msg454, - msg455, - msg456, - msg457, - msg458, - msg459, - msg460, - msg461, - msg462, - msg463, - msg464, - msg465, - msg466, - msg467, - msg468, - ]); - - var part799 = match("MESSAGE#462:00028/0_0", "nwparser.payload", "An Intruder%{p0}"); - - var part800 = match("MESSAGE#462:00028/0_1", "nwparser.payload", "Intruder%{p0}"); - - var part801 = match("MESSAGE#462:00028/0_2", "nwparser.payload", "An intruter%{p0}"); - - var select185 = linear_select([ - part799, - part800, - part801, - ]); - - var part802 = match("MESSAGE#462:00028/1", "nwparser.p0", "%{}has attempted to connect to the NetScreen-Global PRO port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all161 = all_match({ - processors: [ - select185, - part802, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - setc("signame","Attempt to Connect to the NetScreen-Global Port"), - ]), - }); - - var msg469 = msg("00028", all161); - - var part803 = match("MESSAGE#463:00029", "nwparser.payload", "DNS has been refreshed%{}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg470 = msg("00029", part803); - - var part804 = match("MESSAGE#464:00029:01", "nwparser.payload", "DHCP file write: out of memory.%{}", processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg471 = msg("00029:01", part804); - - var part805 = match("MESSAGE#465:00029:02/0", "nwparser.payload", "The DHCP process cannot open file %{fld2->} to %{p0}"); - - var part806 = match("MESSAGE#465:00029:02/1_0", "nwparser.p0", "read %{p0}"); - - var part807 = match("MESSAGE#465:00029:02/1_1", "nwparser.p0", "write %{p0}"); - - var select186 = linear_select([ - part806, - part807, - ]); - - var part808 = match("MESSAGE#465:00029:02/2", "nwparser.p0", "data.%{}"); - - var all162 = all_match({ - processors: [ - part805, - select186, - part808, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg472 = msg("00029:02", all162); - - var part809 = match("MESSAGE#466:00029:03/2", "nwparser.p0", "%{} %{interface->} is full. Unable to %{p0}"); - - var part810 = match("MESSAGE#466:00029:03/3_0", "nwparser.p0", "commit %{p0}"); - - var part811 = match("MESSAGE#466:00029:03/3_1", "nwparser.p0", "offer %{p0}"); - - var select187 = linear_select([ - part810, - part811, - ]); - - var part812 = match("MESSAGE#466:00029:03/4", "nwparser.p0", "IP address to client at %{fld2}"); - - var all163 = all_match({ - processors: [ - dup210, - dup337, - part809, - select187, - part812, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg473 = msg("00029:03", all163); - - var part813 = match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{interface->} (another server found on %{hostip}).", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg474 = msg("00029:04", part813); - - var select188 = linear_select([ - msg470, - msg471, - msg472, - msg473, - msg474, - ]); - - var part814 = match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg475 = msg("00030", part814); - - var part815 = match("MESSAGE#469:00030:01/0", "nwparser.payload", "DSS checking of CRLs has been changed from %{p0}"); - - var part816 = match("MESSAGE#469:00030:01/1_0", "nwparser.p0", "0 to 1%{}"); - - var part817 = match("MESSAGE#469:00030:01/1_1", "nwparser.p0", "1 to 0%{}"); - - var select189 = linear_select([ - part816, - part817, - ]); - - var all164 = all_match({ - processors: [ - part815, - select189, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg476 = msg("00030:01", all164); - - var part818 = match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg477 = msg("00030:05", part818); - - var part819 = match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate request the %{fld2->} field has been changed from %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg478 = msg("00030:06", part819); - - var part820 = match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be loaded%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg479 = msg("00030:07", part820); - - var part821 = match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate cannot be generated%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg480 = msg("00030:10", part821); - - var part822 = match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS image has successfully been updated%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg481 = msg("00030:12", part822); - - var part823 = match("MESSAGE#475:00030:13/0", "nwparser.payload", "The public key used for ScreenOS image authentication cannot be %{p0}"); - - var part824 = match("MESSAGE#475:00030:13/1_0", "nwparser.p0", "decoded%{}"); - - var part825 = match("MESSAGE#475:00030:13/1_1", "nwparser.p0", "loaded%{}"); - - var select190 = linear_select([ - part824, - part825, - ]); - - var all165 = all_match({ - processors: [ - part823, - select190, - ], - on_success: processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg482 = msg("00030:13", all165); - - var part826 = match("MESSAGE#476:00030:14/1_0", "nwparser.p0", "CA IDENT %{p0}"); - - var part827 = match("MESSAGE#476:00030:14/1_1", "nwparser.p0", "Challenge password %{p0}"); - - var part828 = match("MESSAGE#476:00030:14/1_2", "nwparser.p0", "CA CGI URL %{p0}"); - - var part829 = match("MESSAGE#476:00030:14/1_3", "nwparser.p0", "RA CGI URL %{p0}"); - - var select191 = linear_select([ - part826, - part827, - part828, - part829, - ]); - - var part830 = match("MESSAGE#476:00030:14/2", "nwparser.p0", "for SCEP %{p0}"); - - var part831 = match("MESSAGE#476:00030:14/3_0", "nwparser.p0", "requests %{p0}"); - - var select192 = linear_select([ - part831, - dup16, - ]); - - var part832 = match("MESSAGE#476:00030:14/4", "nwparser.p0", "has been changed from %{change_old->} to %{change_new}"); - - var all166 = all_match({ - processors: [ - dup55, - select191, - part830, - select192, - part832, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg483 = msg("00030:14", all166); - - var msg484 = msg("00030:02", dup375); - - var part833 = match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS image authentication is invalid%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg485 = msg("00030:15", part833); - - var part834 = match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been deleted%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg486 = msg("00030:16", part834); - - var part835 = match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accept per config DN %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg487 = msg("00030:18", part835); - - var part836 = match("MESSAGE#481:00030:19/0", "nwparser.payload", "PKI: A configurable item %{change_attribute->} %{p0}"); - - var part837 = match("MESSAGE#481:00030:19/1_0", "nwparser.p0", "mode %{p0}"); - - var part838 = match("MESSAGE#481:00030:19/1_1", "nwparser.p0", "field%{p0}"); - - var select193 = linear_select([ - part837, - part838, - ]); - - var part839 = match("MESSAGE#481:00030:19/2", "nwparser.p0", "%{}has changed from %{change_old->} to %{change_new}"); - - var all167 = all_match({ - processors: [ - part836, - select193, - part839, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg488 = msg("00030:19", all167); - - var part840 = match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for total of %{fld2->} items.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg489 = msg("00030:30", part840); - - var part841 = match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} out of order expect %{fld3->} of %{fld4}.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg490 = msg("00030:31", part841); - - var part842 = match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} without first item.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg491 = msg("00030:32", part842); - - var part843 = match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received normal item during cold sync.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg492 = msg("00030:33", part843); - - var part844 = match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} is deleted.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg493 = msg("00030:34", part844); - - var part845 = match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availability synchronization %{fld2->} failed.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg494 = msg("00030:35", part845); - - var part846 = match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute->} has changed from %{change_old->} to %{change_new}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg495 = msg("00030:36", part846); - - var part847 = match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate for the ScreenOS image authentication is invalid.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg496 = msg("00030:37", part847); - - var part848 = match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certificate cannot be sync to vsd member.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg497 = msg("00030:38", part848); - - var part849 = match("MESSAGE#491:00030:39/0", "nwparser.payload", "PKI: The X.509 certificate %{p0}"); - - var part850 = match("MESSAGE#491:00030:39/1_0", "nwparser.p0", "revocation list %{p0}"); - - var select194 = linear_select([ - part850, - dup16, - ]); - - var part851 = match("MESSAGE#491:00030:39/2", "nwparser.p0", "cannot be loaded during NSRP synchronization.%{}"); - - var all168 = all_match({ - processors: [ - part849, - select194, - part851, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg498 = msg("00030:39", all168); - - var part852 = match("MESSAGE#492:00030:17/0", "nwparser.payload", "X509 %{p0}"); - - var part853 = match("MESSAGE#492:00030:17/2", "nwparser.p0", "cannot be loaded%{}"); - - var all169 = all_match({ - processors: [ - part852, - dup376, - part853, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg499 = msg("00030:17", all169); - - var part854 = match("MESSAGE#493:00030:40/0", "nwparser.payload", "PKI: The certificate %{fld2->} will expire %{p0}"); - - var part855 = match("MESSAGE#493:00030:40/1_1", "nwparser.p0", "please %{p0}"); - - var select195 = linear_select([ - dup214, - part855, - ]); - - var part856 = match("MESSAGE#493:00030:40/2", "nwparser.p0", "renew.%{}"); - - var all170 = all_match({ - processors: [ - part854, - select195, - part856, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg500 = msg("00030:40", all170); - - var part857 = match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocation list has expired issued by certificate authority %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg501 = msg("00030:41", part857); - - var part858 = match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration content of certificate authority %{fld2->} is not valid.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg502 = msg("00030:42", part858); - - var part859 = match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot allocate this object id number %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg503 = msg("00030:43", part859); - - var part860 = match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg504 = msg("00030:44", part860); - - var part861 = match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find the PKI object %{fld2->} during cold sync.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg505 = msg("00030:45", part861); - - var part862 = match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X.509 certificate onto the device certificate %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg506 = msg("00030:46", part862); - - var part863 = match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a certificate pending SCEP completion.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg507 = msg("00030:47", part863); - - var part864 = match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load an X.509 certificate revocation list (CRL).%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg508 = msg("00030:48", part864); - - var part865 = match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load the CA certificate received through SCEP.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg509 = msg("00030:49", part865); - - var part866 = match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg510 = msg("00030:50", part866); - - var part867 = match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load the X.509 local certificate received through SCEP.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg511 = msg("00030:51", part867); - - var part868 = match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load the X.509 %{product->} during boot.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg512 = msg("00030:52", part868); - - var part869 = match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load the X.509 certificate file.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg513 = msg("00030:53", part869); - - var part870 = match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the coldsync of the PKI object at %{fld2->} attempt.", processor_chain([ - dup44, - dup211, - dup31, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg514 = msg("00030:54", part870); - - var part871 = match("MESSAGE#508:00030:55/0", "nwparser.payload", "PKI: The device could not generate %{p0}"); - - var all171 = all_match({ - processors: [ - part871, - dup377, - dup217, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg515 = msg("00030:55", all171); - - var part872 = match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an invalid RSA key.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg516 = msg("00030:56", part872); - - var part873 = match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an invalid digital signature algorithm (DSA) key.%{}", processor_chain([ - dup35, - dup218, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg517 = msg("00030:57", part873); - - var part874 = match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to coldsync the PKI object at %{fld2->} attempt.", processor_chain([ - dup86, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg518 = msg("00030:58", part874); - - var part875 = match("MESSAGE#512:00030:59", "nwparser.payload", "PKI: The device failed to decode the public key of the image%{quote}s signer certificate.", processor_chain([ - dup35, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg519 = msg("00030:59", part875); - - var part876 = match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to install the RSA key.%{}", processor_chain([ - dup35, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg520 = msg("00030:60", part876); - - var part877 = match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to retrieve the pending certificate %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg521 = msg("00030:61", part877); - - var part878 = match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to save the certificate authority related configuration.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg522 = msg("00030:62", part878); - - var part879 = match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to store the authority configuration.%{}", processor_chain([ - dup18, - dup219, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg523 = msg("00030:63", part879); - - var part880 = match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg524 = msg("00030:64", part880); - - var part881 = match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg525 = msg("00030:65", part881); - - var part882 = match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected an invalid X.509 object attribute %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg526 = msg("00030:66", part882); - - var part883 = match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected invalid X.509 object content.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg527 = msg("00030:67", part883); - - var part884 = match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to load an invalid X.509 object.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg528 = msg("00030:68", part884); - - var part885 = match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading the version 0 PKI data.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg529 = msg("00030:69", part885); - - var part886 = match("MESSAGE#523:00030:70/0", "nwparser.payload", "PKI: The device successfully generated a new %{p0}"); - - var all172 = all_match({ - processors: [ - part886, - dup377, - dup217, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg530 = msg("00030:70", all172); - - var part887 = match("MESSAGE#524:00030:71", "nwparser.payload", "PKI: The public key of image%{quote}s signer has been loaded successfully, for future image authentication.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg531 = msg("00030:71", part887); - - var part888 = match("MESSAGE#525:00030:72", "nwparser.payload", "PKI: The signature of the image%{quote}s signer certificate cannot be verified.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg532 = msg("00030:72", part888); - - var part889 = match("MESSAGE#526:00030:73/0", "nwparser.payload", "PKI: The %{p0}"); - - var part890 = match("MESSAGE#526:00030:73/1_0", "nwparser.p0", "file name %{p0}"); - - var part891 = match("MESSAGE#526:00030:73/1_1", "nwparser.p0", "friendly name of a certificate %{p0}"); - - var part892 = match("MESSAGE#526:00030:73/1_2", "nwparser.p0", "vsys name %{p0}"); - - var select196 = linear_select([ - part890, - part891, - part892, - ]); - - var part893 = match("MESSAGE#526:00030:73/2", "nwparser.p0", "is too long %{fld2->} to do NSRP synchronization allowed %{fld3}."); - - var all173 = all_match({ - processors: [ - part889, - select196, - part893, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg533 = msg("00030:73", all173); - - var part894 = match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier version save to file.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg534 = msg("00030:74", part894); - - var part895 = match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has been deleted distinguished name %{username}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg535 = msg("00030:75", part895); - - var part896 = match("MESSAGE#529:00030:76/0", "nwparser.payload", "PKI: X.509 %{p0}"); - - var part897 = match("MESSAGE#529:00030:76/2", "nwparser.p0", "file has been loaded successfully filename %{fld2}."); - - var all174 = all_match({ - processors: [ - part896, - dup376, - part897, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg536 = msg("00030:76", all174); - - var part898 = match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA key.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg537 = msg("00030:77", part898); - - var part899 = match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when requesting certificate.%{}", processor_chain([ - dup35, - dup211, - dup220, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg538 = msg("00030:78", part899); - - var part900 = match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check per config DN %{username}.", processor_chain([ - dup35, - dup211, - dup220, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg539 = msg("00030:79", part900); - - var part901 = match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 objects.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg540 = msg("00030:80", part901); - - var part902 = match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject name %{fld2->} is deleted.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg541 = msg("00030:81", part902); - - var part903 = match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg542 = msg("00030:82", part903); - - var part904 = match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire authcfg for this CA cert %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg543 = msg("00030:83", part904); - - var part905 = match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg from global.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg544 = msg("00030:84", part905); - - var part906 = match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is high (%{fld2->} alarm threshold: %{trigger_val}) %{info}", processor_chain([ - setc("eventcategory","1603080000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg545 = msg("00030:85", part906); - - var part907 = match("MESSAGE#539:00030:86/2", "nwparser.p0", "Pair-wise invoked by started after key generation. (%{fld1})"); - - var all175 = all_match({ - processors: [ - dup221, - dup378, - part907, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg546 = msg("00030:86", all175); - - var part908 = match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is high (%{fld2->} > %{fld3->} ) %{fld4->} times in %{fld5->} minute (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg547 = msg("00030:87", part908); - - var part909 = match("MESSAGE#1217:00030:88/2", "nwparser.p0", "Pair-wise invoked by passed. (%{fld1})\u003c\u003c%{fld6}>"); - - var all176 = all_match({ - processors: [ - dup221, - dup378, - part909, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg548 = msg("00030:88", all176); - - var select197 = linear_select([ - msg475, - msg476, - msg477, - msg478, - msg479, - msg480, - msg481, - msg482, - msg483, - msg484, - msg485, - msg486, - msg487, - msg488, - msg489, - msg490, - msg491, - msg492, - msg493, - msg494, - msg495, - msg496, - msg497, - msg498, - msg499, - msg500, - msg501, - msg502, - msg503, - msg504, - msg505, - msg506, - msg507, - msg508, - msg509, - msg510, - msg511, - msg512, - msg513, - msg514, - msg515, - msg516, - msg517, - msg518, - msg519, - msg520, - msg521, - msg522, - msg523, - msg524, - msg525, - msg526, - msg527, - msg528, - msg529, - msg530, - msg531, - msg532, - msg533, - msg534, - msg535, - msg536, - msg537, - msg538, - msg539, - msg540, - msg541, - msg542, - msg543, - msg544, - msg545, - msg546, - msg547, - msg548, - ]); - - var part910 = match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP address %{hostip->} changed from %{sinterface->} to interface %{dinterface->} (%{fld1})", processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg549 = msg("00031:13", part910); - - var part911 = match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg550 = msg("00031", part911); - - var part912 = match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg551 = msg("00031:01", part912); - - var part913 = match("MESSAGE#543:00031:02/0", "nwparser.payload", "SNMP community %{fld2->} attributes-write access %{p0}"); - - var part914 = match("MESSAGE#543:00031:02/2", "nwparser.p0", "; receive traps %{p0}"); - - var part915 = match("MESSAGE#543:00031:02/4", "nwparser.p0", "; receive traffic alarms %{p0}"); - - var part916 = match("MESSAGE#543:00031:02/6", "nwparser.p0", "-have been modified%{}"); - - var all177 = all_match({ - processors: [ - part913, - dup379, - part914, - dup379, - part915, - dup379, - part916, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg552 = msg("00031:02", all177); - - var part917 = match("MESSAGE#544:00031:03/0", "nwparser.payload", "%{fld2->} SNMP host %{hostip->} has been %{p0}"); - - var select198 = linear_select([ - dup130, - dup129, - ]); - - var part918 = match("MESSAGE#544:00031:03/2", "nwparser.p0", "SNMP community %{fld3}"); - - var all178 = all_match({ - processors: [ - part917, - select198, - part918, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg553 = msg("00031:03", all178); - - var part919 = match("MESSAGE#545:00031:04/0", "nwparser.payload", "SNMP %{p0}"); - - var part920 = match("MESSAGE#545:00031:04/1_0", "nwparser.p0", "contact %{p0}"); - - var select199 = linear_select([ - part920, - dup226, - ]); - - var part921 = match("MESSAGE#545:00031:04/2", "nwparser.p0", "description has been modified%{}"); - - var all179 = all_match({ - processors: [ - part919, - select199, - part921, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg554 = msg("00031:04", all179); - - var part922 = match("MESSAGE#546:00031:11/0", "nwparser.payload", "SNMP system %{p0}"); - - var select200 = linear_select([ - dup226, - dup25, - ]); - - var part923 = match("MESSAGE#546:00031:11/2", "nwparser.p0", "has been changed to %{fld2}. (%{fld1})"); - - var all180 = all_match({ - processors: [ - part922, - select200, - part923, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg555 = msg("00031:11", all180); - - var part924 = match("MESSAGE#547:00031:08/0", "nwparser.payload", "%{fld2}: SNMP community name \"%{fld3}\" %{p0}"); - - var part925 = match("MESSAGE#547:00031:08/1_0", "nwparser.p0", "attributes -- %{p0}"); - - var part926 = match("MESSAGE#547:00031:08/1_1", "nwparser.p0", "-- %{p0}"); - - var select201 = linear_select([ - part925, - part926, - ]); - - var part927 = match("MESSAGE#547:00031:08/2", "nwparser.p0", "write access, %{p0}"); - - var part928 = match("MESSAGE#547:00031:08/4", "nwparser.p0", "; receive traps, %{p0}"); - - var part929 = match("MESSAGE#547:00031:08/6", "nwparser.p0", "; receive traffic alarms, %{p0}"); - - var part930 = match("MESSAGE#547:00031:08/8", "nwparser.p0", "-%{p0}"); - - var part931 = match("MESSAGE#547:00031:08/9_0", "nwparser.p0", "- %{p0}"); - - var select202 = linear_select([ - part931, - dup96, - ]); - - var part932 = match("MESSAGE#547:00031:08/10", "nwparser.p0", "have been modified%{}"); - - var all181 = all_match({ - processors: [ - part924, - select201, - part927, - dup379, - part928, - dup379, - part929, - dup379, - part930, - select202, - part932, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg556 = msg("00031:08", all181); - - var part933 = match("MESSAGE#548:00031:05/0", "nwparser.payload", "Detect IP conflict (%{fld2}) on %{p0}"); - - var all182 = all_match({ - processors: [ - part933, - dup337, - dup227, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg557 = msg("00031:05", all182); - - var part934 = match("MESSAGE#549:00031:06/1_0", "nwparser.p0", "q, %{p0}"); - - var select203 = linear_select([ - part934, - dup229, - dup230, - ]); - - var part935 = match("MESSAGE#549:00031:06/2", "nwparser.p0", "detect IP conflict ( %{hostip->} )%{p0}"); - - var select204 = linear_select([ - dup105, - dup96, - ]); - - var part936 = match("MESSAGE#549:00031:06/4", "nwparser.p0", "mac%{p0}"); - - var part937 = match("MESSAGE#549:00031:06/6", "nwparser.p0", "%{macaddr->} on %{p0}"); - - var all183 = all_match({ - processors: [ - dup228, - select203, - part935, - select204, - part936, - dup356, - part937, - dup352, - dup23, - dup380, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg558 = msg("00031:06", all183); - - var part938 = match("MESSAGE#550:00031:07/2", "nwparser.p0", "detects a duplicate virtual security device group master IP address %{hostip}, MAC address %{macaddr->} on %{p0}"); - - var all184 = all_match({ - processors: [ - dup228, - dup381, - part938, - dup337, - dup227, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg559 = msg("00031:07", all184); - - var part939 = match("MESSAGE#551:00031:09/2", "nwparser.p0", "detected an IP conflict (IP %{hostip}, MAC %{macaddr}) on interface %{p0}"); - - var all185 = all_match({ - processors: [ - dup228, - dup381, - part939, - dup380, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg560 = msg("00031:09", all185); - - var part940 = match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{fld3}\" has been moved. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg561 = msg("00031:10", part940); - - var part941 = match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has been changed to %{fld3}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg562 = msg("00031:12", part941); - - var select205 = linear_select([ - msg549, - msg550, - msg551, - msg552, - msg553, - msg554, - msg555, - msg556, - msg557, - msg558, - msg559, - msg560, - msg561, - msg562, - ]); - - var part942 = match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup232, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg563 = msg("00032", part942); - - var part943 = match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg564 = msg("00032:01", part943); - - var part944 = match("MESSAGE#556:00032:03/0", "nwparser.payload", "Vsys %{fld2->} has been %{p0}"); - - var part945 = match("MESSAGE#556:00032:03/1_0", "nwparser.p0", "changed to %{fld3}"); - - var part946 = match("MESSAGE#556:00032:03/1_1", "nwparser.p0", "created%{}"); - - var part947 = match("MESSAGE#556:00032:03/1_2", "nwparser.p0", "deleted%{}"); - - var part948 = match("MESSAGE#556:00032:03/1_3", "nwparser.p0", "removed%{}"); - - var select206 = linear_select([ - part945, - part946, - part947, - part948, - ]); - - var all186 = all_match({ - processors: [ - part944, - select206, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg565 = msg("00032:03", all186); - - var part949 = match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg566 = msg("00032:04", part949); - - var part950 = match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsys %{fld2->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg567 = msg("00032:05", part950); - - var msg568 = msg("00032:02", dup375); - - var select207 = linear_select([ - msg563, - msg564, - msg565, - msg566, - msg567, - msg568, - ]); - - var part951 = match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("agent","NSM"), - ])); - - var msg569 = msg("00033:25", part951); - - var part952 = match("MESSAGE#561:00033/1", "nwparser.p0", "timeout value has been %{p0}"); - - var part953 = match("MESSAGE#561:00033/2_1", "nwparser.p0", "returned%{p0}"); - - var select208 = linear_select([ - dup52, - part953, - ]); - - var part954 = match("MESSAGE#561:00033/3", "nwparser.p0", "%{}to %{fld2}"); - - var all187 = all_match({ - processors: [ - dup382, - part952, - select208, - part954, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg570 = msg("00033", all187); - - var part955 = match("MESSAGE#562:00033:03/1_0", "nwparser.p0", "Global PRO %{p0}"); - - var part956 = match("MESSAGE#562:00033:03/1_1", "nwparser.p0", "%{fld3->} %{p0}"); - - var select209 = linear_select([ - part955, - part956, - ]); - - var part957 = match("MESSAGE#562:00033:03/4", "nwparser.p0", "host has been set to %{fld4}"); - - var all188 = all_match({ - processors: [ - dup160, - select209, - dup23, - dup369, - part957, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg571 = msg("00033:03", all188); - - var part958 = match("MESSAGE#563:00033:02/3", "nwparser.p0", "host has been %{disposition}"); - - var all189 = all_match({ - processors: [ - dup382, - dup23, - dup369, - part958, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg572 = msg("00033:02", all189); - - var part959 = match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg573 = msg("00033:04", part959); - - var part960 = match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg574 = msg("00033:05", part960); - - var part961 = match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The attack occurred %{dclass_counter1->} times", processor_chain([ - dup27, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg575 = msg("00033:06", part961); - - var part962 = match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The threshold was exceeded %{dclass_counter1->} times", processor_chain([ - dup27, - dup2, - dup3, - setc("dclass_counter1_string","Number of times the threshold was exceeded"), - dup4, - dup5, - dup61, - ])); - - var msg576 = msg("00033:01", part962); - - var part963 = match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{service->} has been %{disposition->} from %{fld2->} distribution", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg577 = msg("00033:07", part963); - - var part964 = match("MESSAGE#569:00033:08/2", "nwparser.p0", "?s CA certificate field has not been specified.%{}"); - - var all190 = all_match({ - processors: [ - dup235, - dup383, - part964, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg578 = msg("00033:08", all190); - - var part965 = match("MESSAGE#570:00033:09/2", "nwparser.p0", "?s Cert-Subject field has not been specified.%{}"); - - var all191 = all_match({ - processors: [ - dup235, - dup383, - part965, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg579 = msg("00033:09", all191); - - var part966 = match("MESSAGE#571:00033:10/2", "nwparser.p0", "?s host field has been %{p0}"); - - var part967 = match("MESSAGE#571:00033:10/3_0", "nwparser.p0", "set to %{fld2->} %{p0}"); - - var select210 = linear_select([ - part967, - dup238, - ]); - - var all192 = all_match({ - processors: [ - dup235, - dup383, - part966, - select210, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg580 = msg("00033:10", all192); - - var part968 = match("MESSAGE#572:00033:11/2", "nwparser.p0", "?s outgoing interface used to report NACN to Policy Manager %{p0}"); - - var part969 = match("MESSAGE#572:00033:11/4", "nwparser.p0", "has not been specified.%{}"); - - var all193 = all_match({ - processors: [ - dup235, - dup383, - part968, - dup383, - part969, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg581 = msg("00033:11", all193); - - var part970 = match("MESSAGE#573:00033:12/2", "nwparser.p0", "?s password field has been %{p0}"); - - var select211 = linear_select([ - dup101, - dup238, - ]); - - var all194 = all_match({ - processors: [ - dup235, - dup383, - part970, - select211, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg582 = msg("00033:12", all194); - - var part971 = match("MESSAGE#574:00033:13/2", "nwparser.p0", "?s policy-domain field has been %{p0}"); - - var part972 = match("MESSAGE#574:00033:13/3_0", "nwparser.p0", "unset .%{}"); - - var part973 = match("MESSAGE#574:00033:13/3_1", "nwparser.p0", "set to %{domain}."); - - var select212 = linear_select([ - part972, - part973, - ]); - - var all195 = all_match({ - processors: [ - dup235, - dup383, - part971, - select212, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg583 = msg("00033:13", all195); - - var part974 = match("MESSAGE#575:00033:14/2", "nwparser.p0", "?s CA certificate field has been set to %{fld2}."); - - var all196 = all_match({ - processors: [ - dup235, - dup383, - part974, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg584 = msg("00033:14", all196); - - var part975 = match("MESSAGE#576:00033:15/2", "nwparser.p0", "?s Cert-Subject field has been set to %{fld2}."); - - var all197 = all_match({ - processors: [ - dup235, - dup383, - part975, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg585 = msg("00033:15", all197); - - var part976 = match("MESSAGE#577:00033:16/2", "nwparser.p0", "?s outgoing-interface field has been set to %{interface}."); - - var all198 = all_match({ - processors: [ - dup235, - dup383, - part976, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg586 = msg("00033:16", all198); - - var part977 = match("MESSAGE#578:00033:17/2", "nwparser.p0", "?s port field has been %{p0}"); - - var part978 = match("MESSAGE#578:00033:17/3_0", "nwparser.p0", "set to %{network_port->} %{p0}"); - - var part979 = match("MESSAGE#578:00033:17/3_1", "nwparser.p0", "reset to the default value %{p0}"); - - var select213 = linear_select([ - part978, - part979, - ]); - - var all199 = all_match({ - processors: [ - dup235, - dup383, - part977, - select213, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg587 = msg("00033:17", all199); - - var part980 = match("MESSAGE#579:00033:19/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); - - var part981 = match("MESSAGE#579:00033:19/4", "nwparser.p0", "%{fld99}arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time."); - - var all200 = all_match({ - processors: [ - part980, - dup339, - dup70, - dup340, - part981, - ], - on_success: processor_chain([ - dup27, - dup2, - dup4, - dup5, - dup3, - dup59, - dup61, - ]), - }); - - var msg588 = msg("00033:19", all200); - - var part982 = match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time.", processor_chain([ - dup27, - dup2, - dup4, - dup5, - dup3, - dup59, - dup60, - ])); - - var msg589 = msg("00033:20", part982); - - var all201 = all_match({ - processors: [ - dup239, - dup343, - dup83, - ], - on_success: processor_chain([ - dup27, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg590 = msg("00033:21", all201); - - var part983 = match("MESSAGE#582:00033:22/0", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var all202 = all_match({ - processors: [ - part983, - dup343, - dup83, - ], - on_success: processor_chain([ - dup27, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg591 = msg("00033:22", all202); - - var part984 = match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name %{hostname->} was set: addr %{hostip}, port %{network_port}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg592 = msg("00033:23", part984); - - var part985 = match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{info}. (%{fld1})", processor_chain([ - setc("eventcategory","1001030500"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg593 = msg("00033:24", part985); - - var select214 = linear_select([ - msg569, - msg570, - msg571, - msg572, - msg573, - msg574, - msg575, - msg576, - msg577, - msg578, - msg579, - msg580, - msg581, - msg582, - msg583, - msg584, - msg585, - msg586, - msg587, - msg588, - msg589, - msg590, - msg591, - msg592, - msg593, - ]); - - var part986 = match("MESSAGE#585:00034/0_0", "nwparser.payload", "SCS: Failed %{p0}"); - - var part987 = match("MESSAGE#585:00034/0_1", "nwparser.payload", "Failed %{p0}"); - - var select215 = linear_select([ - part986, - part987, - ]); - - var part988 = match("MESSAGE#585:00034/2_0", "nwparser.p0", "bind %{p0}"); - - var part989 = match("MESSAGE#585:00034/2_2", "nwparser.p0", "retrieve %{p0}"); - - var select216 = linear_select([ - part988, - dup201, - part989, - ]); - - var select217 = linear_select([ - dup196, - dup103, - dup163, - ]); - - var part990 = match("MESSAGE#585:00034/5", "nwparser.p0", "SSH user %{username}. (Key ID=%{fld2})"); - - var all203 = all_match({ - processors: [ - select215, - dup103, - select216, - dup202, - select217, - part990, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg594 = msg("00034", all203); - - var part991 = match("MESSAGE#586:00034:01/0_0", "nwparser.payload", "SCS: Incompatible %{p0}"); - - var part992 = match("MESSAGE#586:00034:01/0_1", "nwparser.payload", "Incompatible %{p0}"); - - var select218 = linear_select([ - part991, - part992, - ]); - - var part993 = match("MESSAGE#586:00034:01/1", "nwparser.p0", "SSH version %{version->} has been received from %{p0}"); - - var part994 = match("MESSAGE#586:00034:01/2_0", "nwparser.p0", "the SSH %{p0}"); - - var select219 = linear_select([ - part994, - dup241, - ]); - - var part995 = match("MESSAGE#586:00034:01/3", "nwparser.p0", "client at %{saddr}:%{sport}"); - - var all204 = all_match({ - processors: [ - select218, - part993, - select219, - part995, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg595 = msg("00034:01", all204); - - var part996 = match("MESSAGE#587:00034:02", "nwparser.payload", "Maximum number of SCS sessions %{fld2->} has been reached. Connection request from SSH user %{username->} at %{saddr}:%{sport->} has been %{disposition}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg596 = msg("00034:02", part996); - - var part997 = match("MESSAGE#588:00034:03/1", "nwparser.p0", "device failed to authenticate the SSH client at %{saddr}:%{sport}"); - - var all205 = all_match({ - processors: [ - dup384, - part997, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg597 = msg("00034:03", all205); - - var part998 = match("MESSAGE#589:00034:04", "nwparser.payload", "SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user %{username->} at %{saddr}:%{sport}. (Key ID=%{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg598 = msg("00034:04", part998); - - var part999 = match("MESSAGE#590:00034:05", "nwparser.payload", "NetScreen device failed to generate a PKA RSA challenge for SSH user %{username}. (Key ID=%{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg599 = msg("00034:05", part999); - - var part1000 = match("MESSAGE#591:00034:06/1", "nwparser.p0", "device failed to %{p0}"); - - var part1001 = match("MESSAGE#591:00034:06/2_0", "nwparser.p0", "identify itself %{p0}"); - - var part1002 = match("MESSAGE#591:00034:06/2_1", "nwparser.p0", "send the identification string %{p0}"); - - var select220 = linear_select([ - part1001, - part1002, - ]); - - var part1003 = match("MESSAGE#591:00034:06/3", "nwparser.p0", "to the SSH client at %{saddr}:%{sport}"); - - var all206 = all_match({ - processors: [ - dup384, - part1000, - select220, - part1003, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg600 = msg("00034:06", all206); - - var part1004 = match("MESSAGE#592:00034:07", "nwparser.payload", "SCS connection has been terminated for admin user %{username->} at %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg601 = msg("00034:07", part1004); - - var part1005 = match("MESSAGE#593:00034:08", "nwparser.payload", "SCS: SCS has been %{disposition->} for %{username->} with %{fld2->} existing PKA keys already bound to %{fld3->} SSH users.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg602 = msg("00034:08", part1005); - - var part1006 = match("MESSAGE#594:00034:09", "nwparser.payload", "SCS has been %{disposition->} for %{username->} with %{fld2->} PKA keys already bound to %{fld3->} SSH users", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg603 = msg("00034:09", part1006); - - var part1007 = match("MESSAGE#595:00034:10/2", "nwparser.p0", "%{}client at %{saddr->} has attempted to make an SCS connection to %{p0}"); - - var part1008 = match("MESSAGE#595:00034:10/4", "nwparser.p0", "%{interface->} %{p0}"); - - var part1009 = match("MESSAGE#595:00034:10/5_0", "nwparser.p0", "with%{p0}"); - - var part1010 = match("MESSAGE#595:00034:10/5_1", "nwparser.p0", "at%{p0}"); - - var select221 = linear_select([ - part1009, - part1010, - ]); - - var part1011 = match("MESSAGE#595:00034:10/6", "nwparser.p0", "%{}IP %{hostip->} but %{disposition->} because %{result}"); - - var all207 = all_match({ - processors: [ - dup244, - dup385, - part1007, - dup352, - part1008, - select221, - part1011, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg604 = msg("00034:10", all207); - - var part1012 = match("MESSAGE#596:00034:12/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has attempted to make an SCS connection to %{p0}"); - - var part1013 = match("MESSAGE#596:00034:12/4", "nwparser.p0", "but %{disposition->} because %{result}"); - - var all208 = all_match({ - processors: [ - dup244, - dup385, - part1012, - dup386, - part1013, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg605 = msg("00034:12", all208); - - var part1014 = match("MESSAGE#597:00034:11/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to %{p0}"); - - var part1015 = match("MESSAGE#597:00034:11/4", "nwparser.p0", "because %{result}"); - - var all209 = all_match({ - processors: [ - dup244, - dup385, - part1014, - dup386, - part1015, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg606 = msg("00034:11", all209); - - var part1016 = match("MESSAGE#598:00034:15", "nwparser.payload", "SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection because %{result}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg607 = msg("00034:15", part1016); - - var part1017 = match("MESSAGE#599:00034:18/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} cannot log in via SCS to %{service->} using the shared %{interface->} interface because %{result}"); - - var all210 = all_match({ - processors: [ - dup244, - dup387, - part1017, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg608 = msg("00034:18", all210); - - var part1018 = match("MESSAGE#600:00034:20/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has %{disposition->} the PKA RSA challenge"); - - var all211 = all_match({ - processors: [ - dup244, - dup387, - part1018, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg609 = msg("00034:20", all211); - - var part1019 = match("MESSAGE#601:00034:21/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has requested %{p0}"); - - var part1020 = match("MESSAGE#601:00034:21/4", "nwparser.p0", "authentication which is not %{p0}"); - - var part1021 = match("MESSAGE#601:00034:21/5_0", "nwparser.p0", "supported %{p0}"); - - var select222 = linear_select([ - part1021, - dup156, - ]); - - var part1022 = match("MESSAGE#601:00034:21/6", "nwparser.p0", "for that %{p0}"); - - var part1023 = match("MESSAGE#601:00034:21/7_0", "nwparser.p0", "client%{}"); - - var part1024 = match("MESSAGE#601:00034:21/7_1", "nwparser.p0", "user%{}"); - - var select223 = linear_select([ - part1023, - part1024, - ]); - - var all212 = all_match({ - processors: [ - dup244, - dup387, - part1019, - dup372, - part1020, - select222, - part1022, - select223, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg610 = msg("00034:21", all212); - - var part1025 = match("MESSAGE#602:00034:22", "nwparser.payload", "SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to vsys %{fld2->} using the shared untrusted interface", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg611 = msg("00034:22", part1025); - - var part1026 = match("MESSAGE#603:00034:23/1_0", "nwparser.p0", "SCS: Unable %{p0}"); - - var part1027 = match("MESSAGE#603:00034:23/1_1", "nwparser.p0", "Unable %{p0}"); - - var select224 = linear_select([ - part1026, - part1027, - ]); - - var part1028 = match("MESSAGE#603:00034:23/2", "nwparser.p0", "to validate cookie from the SSH client at %{saddr}:%{sport}"); - - var all213 = all_match({ - processors: [ - dup160, - select224, - part1028, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg612 = msg("00034:23", all213); - - var part1029 = match("MESSAGE#604:00034:24", "nwparser.payload", "AC %{username->} is advertising URL %{fld2}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg613 = msg("00034:24", part1029); - - var part1030 = match("MESSAGE#605:00034:25", "nwparser.payload", "Message from AC %{username}: %{fld2}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg614 = msg("00034:25", part1030); - - var part1031 = match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg615 = msg("00034:26", part1031); - - var part1032 = match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on %{interface->} interface", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg616 = msg("00034:27", part1032); - - var part1033 = match("MESSAGE#608:00034:28", "nwparser.payload", "PPPoE%{quote}s session closed by AC", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg617 = msg("00034:28", part1033); - - var part1034 = match("MESSAGE#609:00034:29", "nwparser.payload", "SCS: Disabled for %{username}. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg618 = msg("00034:29", part1034); - - var part1035 = match("MESSAGE#610:00034:30", "nwparser.payload", "SCS: %{disposition->} to remove PKA key removed.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg619 = msg("00034:30", part1035); - - var part1036 = match("MESSAGE#611:00034:31", "nwparser.payload", "SCS: %{disposition->} to retrieve host key", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg620 = msg("00034:31", part1036); - - var part1037 = match("MESSAGE#612:00034:32", "nwparser.payload", "SCS: %{disposition->} to send identification string to client host at %{saddr}:%{sport}.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg621 = msg("00034:32", part1037); - - var part1038 = match("MESSAGE#613:00034:33", "nwparser.payload", "SCS: Max %{fld2->} sessions reached unabel to accept connection : %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg622 = msg("00034:33", part1038); - - var part1039 = match("MESSAGE#614:00034:34", "nwparser.payload", "SCS: Maximum number for SCS sessions %{fld2->} has been reached. Connection request from SSH user at %{saddr}:%{sport->} has been %{disposition}.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg623 = msg("00034:34", part1039); - - var part1040 = match("MESSAGE#615:00034:35", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to %{service->} using the shared untrusted interface because SCS is disabled on that interface.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg624 = msg("00034:35", part1040); - - var part1041 = match("MESSAGE#616:00034:36", "nwparser.payload", "SCS: Unsupported cipher type %{fld2->} requested from: %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg625 = msg("00034:36", part1041); - - var part1042 = match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg626 = msg("00034:37", part1042); - - var part1043 = match("MESSAGE#618:00034:38", "nwparser.payload", "SSH: %{disposition->} to retreive PKA key bound to SSH user %{username->} (Key ID %{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg627 = msg("00034:38", part1043); - - var part1044 = match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet from host %{saddr->} (Code %{fld2})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg628 = msg("00034:39", part1044); - - var part1045 = match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send initialization string to client at %{saddr}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg629 = msg("00034:40", part1045); - - var part1046 = match("MESSAGE#621:00034:41/0", "nwparser.payload", "SCP: Admin user '%{administrator}' attempted to transfer file %{p0}"); - - var part1047 = match("MESSAGE#621:00034:41/2", "nwparser.p0", "the device with insufficient privilege.%{}"); - - var all214 = all_match({ - processors: [ - part1046, - dup373, - part1047, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg630 = msg("00034:41", all214); - - var part1048 = match("MESSAGE#622:00034:42", "nwparser.payload", "SSH: Maximum number of SSH sessions (%{fld2}) exceeded. Connection request from SSH user %{username->} at %{saddr->} denied.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg631 = msg("00034:42", part1048); - - var part1049 = match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx bd (port %{network_port})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg632 = msg("00034:43", part1049); - - var part1050 = match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack detected on SSH connection initiated from %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg633 = msg("00034:44", part1050); - - var select225 = linear_select([ - msg594, - msg595, - msg596, - msg597, - msg598, - msg599, - msg600, - msg601, - msg602, - msg603, - msg604, - msg605, - msg606, - msg607, - msg608, - msg609, - msg610, - msg611, - msg612, - msg613, - msg614, - msg615, - msg616, - msg617, - msg618, - msg619, - msg620, - msg621, - msg622, - msg623, - msg624, - msg625, - msg626, - msg627, - msg628, - msg629, - msg630, - msg631, - msg632, - msg633, - ]); - - var part1051 = match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}:%{result}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg634 = msg("00035", part1051); - - var part1052 = match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in incoming mail - %{fld2}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg635 = msg("00035:01", part1052); - - var part1053 = match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} is not allowed in export or firewall only system", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg636 = msg("00035:02", part1053); - - var part1054 = match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg637 = msg("00035:03", part1054); - - var part1055 = match("MESSAGE#628:00035:04/0", "nwparser.payload", "SSL Error when retrieve local c%{p0}"); - - var part1056 = match("MESSAGE#628:00035:04/1_0", "nwparser.p0", "a(verify) %{p0}"); - - var part1057 = match("MESSAGE#628:00035:04/1_1", "nwparser.p0", "ert(verify) %{p0}"); - - var part1058 = match("MESSAGE#628:00035:04/1_2", "nwparser.p0", "ert(all) %{p0}"); - - var select226 = linear_select([ - part1056, - part1057, - part1058, - ]); - - var part1059 = match("MESSAGE#628:00035:04/2", "nwparser.p0", ": %{fld2}"); - - var all215 = all_match({ - processors: [ - part1055, - select226, - part1059, - ], - on_success: processor_chain([ - dup117, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg638 = msg("00035:04", all215); - - var part1060 = match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready for connections.%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg639 = msg("00035:05", part1060); - - var part1061 = match("MESSAGE#630:00035:06/0", "nwparser.payload", "SSL c%{p0}"); - - var part1062 = match("MESSAGE#630:00035:06/2", "nwparser.p0", "changed to none%{}"); - - var all216 = all_match({ - processors: [ - part1061, - dup388, - part1062, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg640 = msg("00035:06", all216); - - var part1063 = match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{fld2->} recieved %{fld3->} is expected", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg641 = msg("00035:07", part1063); - - var part1064 = match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg642 = msg("00035:08", part1064); - - var part1065 = match("MESSAGE#633:00035:09/1_0", "nwparser.p0", "enabled%{}"); - - var select227 = linear_select([ - part1065, - dup92, - ]); - - var all217 = all_match({ - processors: [ - dup253, - select227, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg643 = msg("00035:09", all217); - - var part1066 = match("MESSAGE#634:00035:10/0", "nwparser.payload", "SSL memory allocation fails in process_c%{p0}"); - - var part1067 = match("MESSAGE#634:00035:10/1_0", "nwparser.p0", "a()%{}"); - - var part1068 = match("MESSAGE#634:00035:10/1_1", "nwparser.p0", "ert()%{}"); - - var select228 = linear_select([ - part1067, - part1068, - ]); - - var all218 = all_match({ - processors: [ - part1066, - select228, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg644 = msg("00035:10", all218); - - var part1069 = match("MESSAGE#635:00035:11/0", "nwparser.payload", "SSL no ssl c%{p0}"); - - var part1070 = match("MESSAGE#635:00035:11/1_0", "nwparser.p0", "a%{}"); - - var part1071 = match("MESSAGE#635:00035:11/1_1", "nwparser.p0", "ert%{}"); - - var select229 = linear_select([ - part1070, - part1071, - ]); - - var all219 = all_match({ - processors: [ - part1069, - select229, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg645 = msg("00035:11", all219); - - var part1072 = match("MESSAGE#636:00035:12/0", "nwparser.payload", "SSL set c%{p0}"); - - var part1073 = match("MESSAGE#636:00035:12/2", "nwparser.p0", "id is invalid %{fld2}"); - - var all220 = all_match({ - processors: [ - part1072, - dup388, - part1073, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg646 = msg("00035:12", all220); - - var part1074 = match("MESSAGE#637:00035:13/1_1", "nwparser.p0", "verify %{p0}"); - - var select230 = linear_select([ - dup101, - part1074, - ]); - - var part1075 = match("MESSAGE#637:00035:13/2", "nwparser.p0", "cert failed. Key type is not RSA%{}"); - - var all221 = all_match({ - processors: [ - dup253, - select230, - part1075, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg647 = msg("00035:13", all221); - - var part1076 = match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg648 = msg("00035:14", part1076); - - var part1077 = match("MESSAGE#639:00035:15/0", "nwparser.payload", "%{change_attribute->} has been changed %{p0}"); - - var part1078 = match("MESSAGE#639:00035:15/1_0", "nwparser.p0", "from %{change_old->} to %{change_new}"); - - var part1079 = match("MESSAGE#639:00035:15/1_1", "nwparser.p0", "to %{fld2}"); - - var select231 = linear_select([ - part1078, - part1079, - ]); - - var all222 = all_match({ - processors: [ - part1077, - select231, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg649 = msg("00035:15", all222); - - var part1080 = match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed to by %{username->} via web from host %{saddr->} to %{daddr}:%{dport->} %{fld5}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg650 = msg("00035:16", part1080); - - var select232 = linear_select([ - msg634, - msg635, - msg636, - msg637, - msg638, - msg639, - msg640, - msg641, - msg642, - msg643, - msg644, - msg645, - msg646, - msg647, - msg648, - msg649, - msg650, - ]); - - var part1081 = match("MESSAGE#641:00036", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key%{}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg651 = msg("00036", part1081); - - var part1082 = match("MESSAGE#642:00036:01/0", "nwparser.payload", "%{fld2->} license keys were updated successfully by %{p0}"); - - var part1083 = match("MESSAGE#642:00036:01/1_1", "nwparser.p0", "manual %{p0}"); - - var select233 = linear_select([ - dup214, - part1083, - ]); - - var part1084 = match("MESSAGE#642:00036:01/2", "nwparser.p0", "retrieval%{}"); - - var all223 = all_match({ - processors: [ - part1082, - select233, - part1084, - ], - on_success: processor_chain([ - dup254, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg652 = msg("00036:01", all223); - - var select234 = linear_select([ - msg651, - msg652, - ]); - - var part1085 = match("MESSAGE#643:00037/0", "nwparser.payload", "Intra-zone block for zone %{zone->} was set to o%{p0}"); - - var part1086 = match("MESSAGE#643:00037/1_0", "nwparser.p0", "n%{}"); - - var part1087 = match("MESSAGE#643:00037/1_1", "nwparser.p0", "ff%{}"); - - var select235 = linear_select([ - part1086, - part1087, - ]); - - var all224 = all_match({ - processors: [ - part1085, - select235, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg653 = msg("00037", all224); - - var part1088 = match("MESSAGE#644:00037:01/0", "nwparser.payload", "New zone %{zone->} ( %{p0}"); - - var select236 = linear_select([ - dup255, - dup256, - ]); - - var part1089 = match("MESSAGE#644:00037:01/2", "nwparser.p0", "%{fld2}) was created.%{p0}"); - - var all225 = all_match({ - processors: [ - part1088, - select236, - part1089, - dup351, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg654 = msg("00037:01", all225); - - var part1090 = match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was bound to out zone %{dst_zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg655 = msg("00037:02", part1090); - - var part1091 = match("MESSAGE#646:00037:03/1_0", "nwparser.p0", "was was %{p0}"); - - var part1092 = match("MESSAGE#646:00037:03/1_1", "nwparser.p0", "%{zone->} was %{p0}"); - - var select237 = linear_select([ - part1091, - part1092, - ]); - - var part1093 = match("MESSAGE#646:00037:03/3", "nwparser.p0", "virtual router %{p0}"); - - var part1094 = match("MESSAGE#646:00037:03/4_0", "nwparser.p0", "%{node->} (%{fld1})"); - - var part1095 = match("MESSAGE#646:00037:03/4_1", "nwparser.p0", "%{node}."); - - var select238 = linear_select([ - part1094, - part1095, - ]); - - var all226 = all_match({ - processors: [ - dup113, - select237, - dup371, - part1093, - select238, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg656 = msg("00037:03", all226); - - var part1096 = match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to non-shared.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg657 = msg("00037:04", part1096); - - var part1097 = match("MESSAGE#648:00037:05/0", "nwparser.payload", "Zone %{zone->} ( %{p0}"); - - var select239 = linear_select([ - dup256, - dup255, - ]); - - var part1098 = match("MESSAGE#648:00037:05/2", "nwparser.p0", "%{fld2}) was deleted. %{p0}"); - - var part1099 = match_copy("MESSAGE#648:00037:05/3_1", "nwparser.p0", "space"); - - var select240 = linear_select([ - dup10, - part1099, - ]); - - var all227 = all_match({ - processors: [ - part1097, - select239, - part1098, - select240, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg658 = msg("00037:05", all227); - - var part1100 = match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was %{disposition->} on zone %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg659 = msg("00037:06", part1100); - - var select241 = linear_select([ - msg653, - msg654, - msg655, - msg656, - msg657, - msg658, - msg659, - ]); - - var part1101 = match("MESSAGE#650:00038/0", "nwparser.payload", "OSPF routing instance in vrouter %{p0}"); - - var part1102 = match("MESSAGE#650:00038/1_0", "nwparser.p0", "%{node->} is %{p0}"); - - var part1103 = match("MESSAGE#650:00038/1_1", "nwparser.p0", "%{node->} %{p0}"); - - var select242 = linear_select([ - part1102, - part1103, - ]); - - var all228 = all_match({ - processors: [ - part1101, - select242, - dup36, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg660 = msg("00038", all228); - - var part1104 = match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr %{node}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg661 = msg("00039", part1104); - - var part1105 = match("MESSAGE#652:00040/0_0", "nwparser.payload", "Low watermark%{p0}"); - - var part1106 = match("MESSAGE#652:00040/0_1", "nwparser.payload", "High watermark%{p0}"); - - var select243 = linear_select([ - part1105, - part1106, - ]); - - var part1107 = match("MESSAGE#652:00040/1", "nwparser.p0", "%{}for early aging has been changed to the default %{fld2}"); - - var all229 = all_match({ - processors: [ - select243, - part1107, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg662 = msg("00040", all229); - - var part1108 = match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg663 = msg("00040:01", part1108); - - var select244 = linear_select([ - msg662, - msg663, - ]); - - var part1109 = match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual router %{node->} has been removed", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg664 = msg("00041", part1109); - - var part1110 = match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg665 = msg("00041:01", part1110); - - var select245 = linear_select([ - msg664, - msg665, - ]); - - var part1111 = match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec tunnel on %{interface->} with tunnel ID %{fld2}! From %{saddr->} to %{daddr}/%{dport}, %{info->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg666 = msg("00042", part1111); - - var part1112 = match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup9, - dup4, - dup5, - dup60, - ])); - - var msg667 = msg("00042:01", part1112); - - var select246 = linear_select([ - msg666, - msg667, - ]); - - var part1113 = match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp tunnel (%{fld2}-%{fld3}), Result code %{resultcode->} (%{result}). (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg668 = msg("00043", part1113); - - var part1114 = match("MESSAGE#659:00044/0", "nwparser.payload", "access list %{listnum->} sequence number %{fld3->} %{p0}"); - - var part1115 = match("MESSAGE#659:00044/1_1", "nwparser.p0", "deny %{p0}"); - - var select247 = linear_select([ - dup257, - part1115, - ]); - - var part1116 = match("MESSAGE#659:00044/2", "nwparser.p0", "ip %{hostip}/%{mask->} %{disposition->} in vrouter %{node}"); - - var all230 = all_match({ - processors: [ - part1114, - select247, - part1116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg669 = msg("00044", all230); - - var part1117 = match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{disposition->} in vrouter %{node}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg670 = msg("00044:01", part1117); - - var select248 = linear_select([ - msg669, - msg670, - ]); - - var part1118 = match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router %{node->} was %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg671 = msg("00045", part1118); - - var part1119 = match("MESSAGE#662:00047/1_0", "nwparser.p0", "remove %{p0}"); - - var part1120 = match("MESSAGE#662:00047/1_1", "nwparser.p0", "add %{p0}"); - - var select249 = linear_select([ - part1119, - part1120, - ]); - - var part1121 = match("MESSAGE#662:00047/2", "nwparser.p0", "multicast policy from %{src_zone->} %{fld4->} to %{dst_zone->} %{fld3->} (%{fld1})"); - - var all231 = all_match({ - processors: [ - dup183, - select249, - part1121, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg672 = msg("00047", all231); - - var part1122 = match("MESSAGE#663:00048/0", "nwparser.payload", "Access list entry %{listnum->} with %{p0}"); - - var part1123 = match("MESSAGE#663:00048/1_0", "nwparser.p0", "a sequence %{p0}"); - - var part1124 = match("MESSAGE#663:00048/1_1", "nwparser.p0", "sequence %{p0}"); - - var select250 = linear_select([ - part1123, - part1124, - ]); - - var part1125 = match("MESSAGE#663:00048/2", "nwparser.p0", "number %{fld2->} %{p0}"); - - var part1126 = match("MESSAGE#663:00048/3_0", "nwparser.p0", "with an action of %{p0}"); - - var select251 = linear_select([ - part1126, - dup112, - ]); - - var part1127 = match("MESSAGE#663:00048/5_0", "nwparser.p0", "with an IP %{p0}"); - - var select252 = linear_select([ - part1127, - dup139, - ]); - - var part1128 = match("MESSAGE#663:00048/6", "nwparser.p0", "address %{p0}"); - - var part1129 = match("MESSAGE#663:00048/7_0", "nwparser.p0", "and subnetwork mask of %{p0}"); - - var select253 = linear_select([ - part1129, - dup16, - ]); - - var part1130 = match("MESSAGE#663:00048/8", "nwparser.p0", "%{} %{fld3}was %{p0}"); - - var part1131 = match("MESSAGE#663:00048/9_0", "nwparser.p0", "created on %{p0}"); - - var select254 = linear_select([ - part1131, - dup129, - ]); - - var part1132 = match("MESSAGE#663:00048/10", "nwparser.p0", "virtual router %{node->} (%{fld1})"); - - var all232 = all_match({ - processors: [ - part1122, - select250, - part1125, - select251, - dup257, - select252, - part1128, - select253, - part1130, - select254, - part1132, - ], - on_success: processor_chain([ - setc("eventcategory","1501000000"), - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg673 = msg("00048", all232); - - var part1133 = match("MESSAGE#664:00048:01/0", "nwparser.payload", "Route %{p0}"); - - var part1134 = match("MESSAGE#664:00048:01/1_0", "nwparser.p0", "map entry %{p0}"); - - var part1135 = match("MESSAGE#664:00048:01/1_1", "nwparser.p0", "entry %{p0}"); - - var select255 = linear_select([ - part1134, - part1135, - ]); - - var part1136 = match("MESSAGE#664:00048:01/2", "nwparser.p0", "with sequence number %{fld2->} in route map binck-ospf%{p0}"); - - var part1137 = match("MESSAGE#664:00048:01/3_0", "nwparser.p0", " in %{p0}"); - - var select256 = linear_select([ - part1137, - dup105, - ]); - - var part1138 = match("MESSAGE#664:00048:01/4", "nwparser.p0", "virtual router %{node->} was %{disposition->} (%{fld1})"); - - var all233 = all_match({ - processors: [ - part1133, - select255, - part1136, - select256, - part1138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg674 = msg("00048:01", all233); - - var part1139 = match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface %{interface->} (%{fld1})", processor_chain([ - dup209, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg675 = msg("00048:02", part1139); - - var select257 = linear_select([ - msg673, - msg674, - msg675, - ]); - - var part1140 = match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed to %{fld8->} (%{fld2}) => %{fld3->} (%{fld4}) => %{fld5->} (%{fld6}) in virtual router (%{node})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg676 = msg("00049", part1140); - - var part1141 = match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} in virtual router %{node}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg677 = msg("00049:01", part1141); - - var part1142 = match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{node->} and ID %{fld2->} has been removed", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg678 = msg("00049:02", part1142); - - var part1143 = match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual router \"%{node}\" used by OSPF, BGP routing instances id has been uninitialized. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg679 = msg("00049:03", part1143); - - var part1144 = match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route through virtual router \"%{node}\" has been added in virtual router \"%{fld4}\" (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg680 = msg("00049:04", part1144); - - var part1145 = match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking for interfaces in virtual router (%{node}) has been enabled. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg681 = msg("00049:05", part1145); - - var select258 = linear_select([ - msg676, - msg677, - msg678, - msg679, - msg680, - msg681, - ]); - - var part1146 = match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg682 = msg("00050", part1146); - - var part1147 = match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached %{fld2}, which is %{fld3->} of the system capacity!", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg683 = msg("00051", part1147); - - var part1148 = match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:%{sport}->%{daddr}:%{dport->} used %{fld2->} percent of AV resources, which exceeded the max of %{fld3->} percent.", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg684 = msg("00052", part1148); - - var part1149 = match("MESSAGE#675:00055/1_1", "nwparser.p0", "router %{p0}"); - - var select259 = linear_select([ - dup169, - part1149, - ]); - - var part1150 = match("MESSAGE#675:00055/2", "nwparser.p0", "instance was %{disposition->} on interface %{interface}."); - - var all234 = all_match({ - processors: [ - dup258, - select259, - part1150, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg685 = msg("00055", all234); - - var part1151 = match("MESSAGE#676:00055:01/1_0", "nwparser.p0", "proxy %{p0}"); - - var part1152 = match("MESSAGE#676:00055:01/1_1", "nwparser.p0", "function %{p0}"); - - var select260 = linear_select([ - part1151, - part1152, - ]); - - var part1153 = match("MESSAGE#676:00055:01/2", "nwparser.p0", "was %{disposition->} on interface %{interface}."); - - var all235 = all_match({ - processors: [ - dup258, - select260, - part1153, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg686 = msg("00055:01", all235); - - var part1154 = match("MESSAGE#677:00055:02/2", "nwparser.p0", "same subnet check on interface %{interface}."); - - var all236 = all_match({ - processors: [ - dup259, - dup389, - part1154, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg687 = msg("00055:02", all236); - - var part1155 = match("MESSAGE#678:00055:03/2", "nwparser.p0", "router alert IP option check on interface %{interface}."); - - var all237 = all_match({ - processors: [ - dup259, - dup389, - part1155, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg688 = msg("00055:03", all237); - - var part1156 = match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to %{version->} on interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg689 = msg("00055:04", part1156); - - var part1157 = match("MESSAGE#680:00055:05/0", "nwparser.payload", "IGMP query %{p0}"); - - var part1158 = match("MESSAGE#680:00055:05/1_1", "nwparser.p0", "max response time %{p0}"); - - var select261 = linear_select([ - dup110, - part1158, - ]); - - var part1159 = match("MESSAGE#680:00055:05/2", "nwparser.p0", "was changed to %{fld2->} on interface %{interface}"); - - var all238 = all_match({ - processors: [ - part1157, - select261, - part1159, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg690 = msg("00055:05", all238); - - var part1160 = match("MESSAGE#681:00055:06/0", "nwparser.payload", "IGMP l%{p0}"); - - var part1161 = match("MESSAGE#681:00055:06/1_0", "nwparser.p0", "eave %{p0}"); - - var part1162 = match("MESSAGE#681:00055:06/1_1", "nwparser.p0", "ast member query %{p0}"); - - var select262 = linear_select([ - part1161, - part1162, - ]); - - var part1163 = match("MESSAGE#681:00055:06/2", "nwparser.p0", "interval was changed to %{fld2->} on interface %{interface}."); - - var all239 = all_match({ - processors: [ - part1160, - select262, - part1163, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg691 = msg("00055:06", all239); - - var part1164 = match("MESSAGE#682:00055:07/1_0", "nwparser.p0", "routers %{p0}"); - - var part1165 = match("MESSAGE#682:00055:07/1_1", "nwparser.p0", "hosts %{p0}"); - - var part1166 = match("MESSAGE#682:00055:07/1_2", "nwparser.p0", "groups %{p0}"); - - var select263 = linear_select([ - part1164, - part1165, - part1166, - ]); - - var part1167 = match("MESSAGE#682:00055:07/2", "nwparser.p0", "accept list ID was changed to %{fld2->} on interface %{interface}."); - - var all240 = all_match({ - processors: [ - dup258, - select263, - part1167, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg692 = msg("00055:07", all240); - - var part1168 = match("MESSAGE#683:00055:08/1_0", "nwparser.p0", "all groups %{p0}"); - - var part1169 = match("MESSAGE#683:00055:08/1_1", "nwparser.p0", "group %{p0}"); - - var select264 = linear_select([ - part1168, - part1169, - ]); - - var part1170 = match("MESSAGE#683:00055:08/2", "nwparser.p0", "%{group->} static flag was %{disposition->} on interface %{interface}."); - - var all241 = all_match({ - processors: [ - dup258, - select264, - part1170, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg693 = msg("00055:08", all241); - - var part1171 = match("MESSAGE#684:00055:09", "nwparser.payload", "IGMP static group %{group->} was added on interface %{interface}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg694 = msg("00055:09", part1171); - - var part1172 = match("MESSAGE#685:00055:10", "nwparser.payload", "IGMP proxy always is %{disposition->} on interface %{interface}.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg695 = msg("00055:10", part1172); - - var select265 = linear_select([ - msg685, - msg686, - msg687, - msg688, - msg689, - msg690, - msg691, - msg692, - msg693, - msg694, - msg695, - ]); - - var part1173 = match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{src_zone->} %{saddr->} to %{dst_zone->} %{daddr}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg696 = msg("00056", part1173); - - var part1174 = match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route src=%{saddr}, grp=%{group->} input ifp = %{sinterface->} output ifp = %{dinterface->} added", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg697 = msg("00057", part1174); - - var part1175 = match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on interface %{interface}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg698 = msg("00058", part1175); - - var part1176 = match("MESSAGE#689:00059/0", "nwparser.payload", "DDNS module is %{p0}"); - - var part1177 = match("MESSAGE#689:00059/1_0", "nwparser.p0", "initialized %{p0}"); - - var select266 = linear_select([ - part1177, - dup262, - dup157, - dup156, - ]); - - var all242 = all_match({ - processors: [ - part1176, - select266, - dup116, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg699 = msg("00059", all242); - - var part1178 = match("MESSAGE#690:00059:02/0", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with server type \"%{fld3}\" name \"%{hostname}\" refresh-interval %{fld5->} hours minimum update interval %{fld6->} minutes with %{p0}"); - - var part1179 = match("MESSAGE#690:00059:02/1_0", "nwparser.p0", "secure %{p0}"); - - var part1180 = match("MESSAGE#690:00059:02/1_1", "nwparser.p0", "clear-text %{p0}"); - - var select267 = linear_select([ - part1179, - part1180, - ]); - - var part1181 = match("MESSAGE#690:00059:02/2", "nwparser.p0", "secure connection.%{}"); - - var all243 = all_match({ - processors: [ - part1178, - select267, - part1181, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg700 = msg("00059:02", all243); - - var part1182 = match("MESSAGE#691:00059:03", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with user name \"%{username}\" agent \"%{fld3}\"", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg701 = msg("00059:03", part1182); - - var part1183 = match("MESSAGE#692:00059:04", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with interface \"%{interface}\" host-name \"%{hostname}\"", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg702 = msg("00059:04", part1183); - - var part1184 = match("MESSAGE#693:00059:05/0_0", "nwparser.payload", "Hostname %{p0}"); - - var part1185 = match("MESSAGE#693:00059:05/0_1", "nwparser.payload", "Source interface %{p0}"); - - var part1186 = match("MESSAGE#693:00059:05/0_2", "nwparser.payload", "Username and password %{p0}"); - - var part1187 = match("MESSAGE#693:00059:05/0_3", "nwparser.payload", "Server %{p0}"); - - var select268 = linear_select([ - part1184, - part1185, - part1186, - part1187, - ]); - - var part1188 = match("MESSAGE#693:00059:05/1", "nwparser.p0", "of DDNS entry with id %{fld2->} is cleared."); - - var all244 = all_match({ - processors: [ - select268, - part1188, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg703 = msg("00059:05", all244); - - var part1189 = match("MESSAGE#694:00059:06", "nwparser.payload", "Agent of DDNS entry with id %{fld2->} is reset to its default value.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg704 = msg("00059:06", part1189); - - var part1190 = match("MESSAGE#695:00059:07", "nwparser.payload", "Updates for DDNS entry with id %{fld2->} are set to be sent in secure (%{protocol}) mode.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg705 = msg("00059:07", part1190); - - var part1191 = match("MESSAGE#696:00059:08/0_0", "nwparser.payload", "Refresh %{p0}"); - - var part1192 = match("MESSAGE#696:00059:08/0_1", "nwparser.payload", "Minimum update %{p0}"); - - var select269 = linear_select([ - part1191, - part1192, - ]); - - var part1193 = match("MESSAGE#696:00059:08/1", "nwparser.p0", "interval of DDNS entry with id %{fld2->} is set to default value (%{fld3})."); - - var all245 = all_match({ - processors: [ - select269, - part1193, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg706 = msg("00059:08", all245); - - var part1194 = match("MESSAGE#697:00059:09/1_0", "nwparser.p0", "No-Change %{p0}"); - - var part1195 = match("MESSAGE#697:00059:09/1_1", "nwparser.p0", "Error %{p0}"); - - var select270 = linear_select([ - part1194, - part1195, - ]); - - var part1196 = match("MESSAGE#697:00059:09/2", "nwparser.p0", "response received for DDNS entry update for id %{fld2->} user \"%{username}\" domain \"%{domain}\" server type \" d%{p0}"); - - var part1197 = match("MESSAGE#697:00059:09/3_1", "nwparser.p0", "yndns %{p0}"); - - var select271 = linear_select([ - dup261, - part1197, - ]); - - var part1198 = match("MESSAGE#697:00059:09/4", "nwparser.p0", "\", server name \"%{hostname}\""); - - var all246 = all_match({ - processors: [ - dup160, - select270, - part1196, - select271, - part1198, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg707 = msg("00059:09", all246); - - var part1199 = match("MESSAGE#698:00059:01", "nwparser.payload", "DDNS entry with id %{fld2->} is %{disposition}.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg708 = msg("00059:01", part1199); - - var select272 = linear_select([ - msg699, - msg700, - msg701, - msg702, - msg703, - msg704, - msg705, - msg706, - msg707, - msg708, - ]); - - var part1200 = match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip->} failed. (%{event_time_string})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP failed"), - ])); - - var msg709 = msg("00062:01", part1200); - - var part1201 = match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached threshold. (%{event_time_string})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP failure reached threshold"), - ])); - - var msg710 = msg("00062:02", part1201); - - var part1202 = match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip->} succeeded. (%{event_time_string})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP succeeded"), - ])); - - var msg711 = msg("00062:03", part1202); - - var part1203 = match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg712 = msg("00062", part1203); - - var select273 = linear_select([ - msg709, - msg710, - msg711, - msg712, - ]); - - var part1204 = match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{disposition}!", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg713 = msg("00063", part1204); - - var part1205 = match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg714 = msg("00064", part1205); - - var part1206 = match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches threshold system may fail over!%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg715 = msg("00064:01", part1206); - - var part1207 = match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from policy ID %{policy_id}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg716 = msg("00064:02", part1207); - - var select274 = linear_select([ - msg714, - msg715, - msg716, - ]); - - var msg717 = msg("00070", dup411); - - var part1208 = match("MESSAGE#708:00070:01/2", "nwparser.p0", "%{}Device group %{group->} changed state from %{fld3->} to %{p0}"); - - var part1209 = match("MESSAGE#708:00070:01/3_0", "nwparser.p0", "Init%{}"); - - var part1210 = match("MESSAGE#708:00070:01/3_1", "nwparser.p0", "init. (%{fld1})"); - - var select275 = linear_select([ - part1209, - part1210, - ]); - - var all247 = all_match({ - processors: [ - dup267, - dup391, - part1208, - select275, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg718 = msg("00070:01", all247); - - var part1211 = match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg719 = msg("00070:02", part1211); - - var select276 = linear_select([ - msg717, - msg718, - msg719, - ]); - - var msg720 = msg("00071", dup411); - - var part1212 = match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in the Virtual Security Device group %{group->} changed state", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg721 = msg("00071:01", part1212); - - var select277 = linear_select([ - msg720, - msg721, - ]); - - var msg722 = msg("00072", dup411); - - var msg723 = msg("00072:01", dup412); - - var select278 = linear_select([ - msg722, - msg723, - ]); - - var msg724 = msg("00073", dup411); - - var msg725 = msg("00073:01", dup412); - - var select279 = linear_select([ - msg724, - msg725, - ]); - - var msg726 = msg("00074", dup392); - - var all248 = all_match({ - processors: [ - dup263, - dup390, - dup271, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg727 = msg("00075", all248); - - var part1213 = match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} changed state from %{event_state->} to inoperable. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","local device in the Virtual Security Device group changed state to inoperable"), - ])); - - var msg728 = msg("00075:02", part1213); - - var part1214 = match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg729 = msg("00075:01", part1214); - - var select280 = linear_select([ - msg727, - msg728, - msg729, - ]); - - var msg730 = msg("00076", dup392); - - var part1215 = match("MESSAGE#721:00076:01/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} send 2nd path request to unit=%{fld3}"); - - var all249 = all_match({ - processors: [ - dup263, - dup390, - part1215, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg731 = msg("00076:01", all249); - - var select281 = linear_select([ - msg730, - msg731, - ]); - - var part1216 = match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use second path of HA%{}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg732 = msg("00077", part1216); - - var all250 = all_match({ - processors: [ - dup263, - dup390, - dup271, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg733 = msg("00077:01", all250); - - var part1217 = match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group}", processor_chain([ - setc("eventcategory","1607000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg734 = msg("00077:02", part1217); - - var select282 = linear_select([ - msg732, - msg733, - msg734, - ]); - - var part1218 = match("MESSAGE#725:00084", "nwparser.payload", "RTSYNC: NSRP route synchronization is %{disposition}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg735 = msg("00084", part1218); - - var part1219 = match("MESSAGE#726:00090/0_0", "nwparser.payload", "Failover %{p0}"); - - var part1220 = match("MESSAGE#726:00090/0_1", "nwparser.payload", "Recovery %{p0}"); - - var select283 = linear_select([ - part1219, - part1220, - ]); - - var part1221 = match("MESSAGE#726:00090/3", "nwparser.p0", "untrust interface occurred.%{}"); - - var all251 = all_match({ - processors: [ - select283, - dup103, - dup369, - part1221, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg736 = msg("00090", all251); - - var part1222 = match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to the device because the maximum number of system route entries %{fld2->} has been exceeded", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg737 = msg("00200", part1222); - - var part1223 = match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cannot be added to the virtual router %{node->} because the number of route entries in the virtual router exceeds the maximum number of routes %{fld3->} allowed", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg738 = msg("00201", part1223); - - var part1224 = match("MESSAGE#729:00202", "nwparser.payload", "%{fld2->} hello-packet flood from neighbor (ip = %{hostip->} router-id = %{fld3}) on interface %{interface->} packet is dropped", processor_chain([ - dup272, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg739 = msg("00202", part1224); - - var part1225 = match("MESSAGE#730:00203", "nwparser.payload", "%{fld2->} lsa flood on interface %{interface->} has dropped a packet.", processor_chain([ - dup272, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg740 = msg("00203", part1225); - - var part1226 = match("MESSAGE#731:00206/0", "nwparser.payload", "The total number of redistributed routes into %{p0}"); - - var part1227 = match("MESSAGE#731:00206/1_0", "nwparser.p0", "BGP %{p0}"); - - var part1228 = match("MESSAGE#731:00206/1_1", "nwparser.p0", "OSPF %{p0}"); - - var select284 = linear_select([ - part1227, - part1228, - ]); - - var part1229 = match("MESSAGE#731:00206/2", "nwparser.p0", "in vrouter %{node->} exceeded system limit (%{fld2})"); - - var all252 = all_match({ - processors: [ - part1226, - select284, - part1229, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg741 = msg("00206", all252); - - var part1230 = match("MESSAGE#732:00206:01/0", "nwparser.payload", "LSA flood in OSPF with router-id %{fld2->} on %{p0}"); - - var part1231 = match("MESSAGE#732:00206:01/2", "nwparser.p0", "%{interface->} forced the interface to drop a packet."); - - var all253 = all_match({ - processors: [ - part1230, - dup352, - part1231, - ], - on_success: processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg742 = msg("00206:01", all253); - - var part1232 = match("MESSAGE#733:00206:02/0", "nwparser.payload", "OSPF instance with router-id %{fld3->} received a Hello packet flood from neighbor (IP address %{hostip}, router ID %{fld2}) on %{p0}"); - - var part1233 = match("MESSAGE#733:00206:02/2", "nwparser.p0", "%{interface->} forcing the interface to drop the packet."); - - var all254 = all_match({ - processors: [ - part1232, - dup352, - part1233, - ], - on_success: processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg743 = msg("00206:02", all254); - - var part1234 = match("MESSAGE#734:00206:03", "nwparser.payload", "Link State Advertisement Id %{fld2}, router ID %{fld3}, type %{fld4->} cannot be deleted from the real-time database in area %{fld5}", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg744 = msg("00206:03", part1234); - - var part1235 = match("MESSAGE#735:00206:04", "nwparser.payload", "Reject second OSPF neighbor (%{fld2}) on interface (%{interface}) since it_s configured as point-to-point interface", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg745 = msg("00206:04", part1235); - - var select285 = linear_select([ - msg741, - msg742, - msg743, - msg744, - msg745, - ]); - - var part1236 = match("MESSAGE#736:00207", "nwparser.payload", "System wide RIP route limit exceeded, RIP route dropped.%{}", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg746 = msg("00207", part1236); - - var part1237 = match("MESSAGE#737:00207:01", "nwparser.payload", "%{fld2->} RIP routes dropped from last system wide RIP route limit exceed.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg747 = msg("00207:01", part1237); - - var part1238 = match("MESSAGE#738:00207:02", "nwparser.payload", "RIP database size limit exceeded for %{fld2}, RIP route dropped.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg748 = msg("00207:02", part1238); - - var part1239 = match("MESSAGE#739:00207:03", "nwparser.payload", "%{fld2->} RIP routes dropped from the last database size exceed in vr %{fld3}.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg749 = msg("00207:03", part1239); - - var select286 = linear_select([ - msg746, - msg747, - msg748, - msg749, - ]); - - var part1240 = match("MESSAGE#740:00257", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - dup278, - ])); - - var msg750 = msg("00257", part1240); - - var part1241 = match("MESSAGE#741:00257:14", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup279, - dup276, - dup277, - dup280, - ])); - - var msg751 = msg("00257:14", part1241); - - var part1242 = match("MESSAGE#742:00257:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - dup278, - ])); - - var msg752 = msg("00257:01", part1242); - - var part1243 = match("MESSAGE#743:00257:15", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup279, - dup282, - dup280, - ])); - - var msg753 = msg("00257:15", part1243); - - var part1244 = match("MESSAGE#744:00257:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ])); - - var msg754 = msg("00257:02", part1244); - - var part1245 = match("MESSAGE#745:00257:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg755 = msg("00257:03", part1245); - - var part1246 = match("MESSAGE#746:00257:04", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ])); - - var msg756 = msg("00257:04", part1246); - - var part1247 = match("MESSAGE#747:00257:05", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid->} reason=%{result}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg757 = msg("00257:05", part1247); - - var part1248 = match("MESSAGE#748:00257:19/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} icmp code=%{icmpcode->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid->} reason=%{result}"); - - var all255 = all_match({ - processors: [ - dup283, - dup393, - part1248, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg758 = msg("00257:19", all255); - - var part1249 = match("MESSAGE#749:00257:16/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid}"); - - var all256 = all_match({ - processors: [ - dup283, - dup393, - part1249, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg759 = msg("00257:16", all256); - - var part1250 = match("MESSAGE#750:00257:17/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid}"); - - var all257 = all_match({ - processors: [ - dup283, - dup393, - part1250, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ]), - }); - - var msg760 = msg("00257:17", all257); - - var part1251 = match("MESSAGE#751:00257:18/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} session_id=%{sessionid}"); - - var all258 = all_match({ - processors: [ - dup283, - dup393, - part1251, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ]), - }); - - var msg761 = msg("00257:18", all258); - - var part1252 = match("MESSAGE#752:00257:06/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{p0}"); - - var part1253 = match("MESSAGE#752:00257:06/1_0", "nwparser.p0", "%{dport->} session_id=%{sessionid}"); - - var part1254 = match_copy("MESSAGE#752:00257:06/1_1", "nwparser.p0", "dport"); - - var select287 = linear_select([ - part1253, - part1254, - ]); - - var all259 = all_match({ - processors: [ - part1252, - select287, - ], - on_success: processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ]), - }); - - var msg762 = msg("00257:06", all259); - - var part1255 = match("MESSAGE#753:00257:07", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg763 = msg("00257:07", part1255); - - var part1256 = match("MESSAGE#754:00257:08", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} tcp=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup276, - dup277, - ])); - - var msg764 = msg("00257:08", part1256); - - var part1257 = match("MESSAGE#755:00257:09/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{p0}"); - - var part1258 = match("MESSAGE#755:00257:09/1_0", "nwparser.p0", "%{icmptype->} icmp code=%{icmpcode->} session_id=%{sessionid->} reason=%{result}"); - - var part1259 = match("MESSAGE#755:00257:09/1_1", "nwparser.p0", "%{icmptype->} session_id=%{sessionid}"); - - var part1260 = match_copy("MESSAGE#755:00257:09/1_2", "nwparser.p0", "icmptype"); - - var select288 = linear_select([ - part1258, - part1259, - part1260, - ]); - - var all260 = all_match({ - processors: [ - part1257, - select288, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg765 = msg("00257:09", all260); - - var part1261 = match("MESSAGE#756:00257:10/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); - - var part1262 = match("MESSAGE#756:00257:10/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid}"); - - var select289 = linear_select([ - part1262, - dup286, - ]); - - var all261 = all_match({ - processors: [ - part1261, - select289, - ], - on_success: processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup276, - dup277, - ]), - }); - - var msg766 = msg("00257:10", all261); - - var part1263 = match("MESSAGE#757:00257:11/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); - - var part1264 = match("MESSAGE#757:00257:11/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid->} reason=%{result}"); - - var select290 = linear_select([ - part1264, - dup286, - ]); - - var all262 = all_match({ - processors: [ - part1263, - select290, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg767 = msg("00257:11", all262); - - var part1265 = match("MESSAGE#758:00257:12", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} type=%{fld3}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ])); - - var msg768 = msg("00257:12", part1265); - - var part1266 = match("MESSAGE#759:00257:13", "nwparser.payload", "start_time=\"%{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup274, - dup4, - dup5, - ])); - - var msg769 = msg("00257:13", part1266); - - var select291 = linear_select([ - msg750, - msg751, - msg752, - msg753, - msg754, - msg755, - msg756, - msg757, - msg758, - msg759, - msg760, - msg761, - msg762, - msg763, - msg764, - msg765, - msg766, - msg767, - msg768, - msg769, - ]); - - var part1267 = match("MESSAGE#760:00259/1", "nwparser.p0", "user %{username->} has logged on via %{p0}"); - - var part1268 = match("MESSAGE#760:00259/2_0", "nwparser.p0", "the console %{p0}"); - - var select292 = linear_select([ - part1268, - dup289, - dup241, - ]); - - var part1269 = match("MESSAGE#760:00259/3", "nwparser.p0", "from %{saddr}:%{sport}"); - - var all263 = all_match({ - processors: [ - dup394, - part1267, - select292, - part1269, - ], - on_success: processor_chain([ - dup28, - dup29, - dup30, - dup31, - dup32, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg770 = msg("00259", all263); - - var part1270 = match("MESSAGE#761:00259:07/1", "nwparser.p0", "user %{administrator->} has logged out via %{logon_type->} from %{saddr}:%{sport}"); - - var all264 = all_match({ - processors: [ - dup394, - part1270, - ], - on_success: processor_chain([ - dup33, - dup29, - dup34, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg771 = msg("00259:07", all264); - - var part1271 = match("MESSAGE#762:00259:01", "nwparser.payload", "Management session via %{logon_type->} from %{saddr}:%{sport->} for [vsys] admin %{administrator->} has timed out", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg772 = msg("00259:01", part1271); - - var part1272 = match("MESSAGE#763:00259:02", "nwparser.payload", "Management session via %{logon_type->} for [ vsys ] admin %{administrator->} has timed out", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg773 = msg("00259:02", part1272); - - var part1273 = match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by admin %{administrator->} via the %{logon_type->} has failed", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg774 = msg("00259:03", part1273); - - var part1274 = match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{logon_type->} from %{saddr}:%{sport->} has failed", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg775 = msg("00259:04", part1274); - - var part1275 = match("MESSAGE#766:00259:05/0", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the %{p0}"); - - var part1276 = match("MESSAGE#766:00259:05/1_2", "nwparser.p0", "Web %{p0}"); - - var select293 = linear_select([ - dup241, - dup289, - part1276, - ]); - - var part1277 = match("MESSAGE#766:00259:05/2", "nwparser.p0", "session on host %{daddr}:%{dport}"); - - var all265 = all_match({ - processors: [ - part1275, - select293, - part1277, - ], - on_success: processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg776 = msg("00259:05", all265); - - var part1278 = match("MESSAGE#767:00259:06", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the serial console session.", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg777 = msg("00259:06", part1278); - - var select294 = linear_select([ - msg770, - msg771, - msg772, - msg773, - msg774, - msg775, - msg776, - msg777, - ]); - - var part1279 = match("MESSAGE#768:00262", "nwparser.payload", "Admin user %{administrator->} has been rejected via the %{logon_type->} server at %{hostip}", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg778 = msg("00262", part1279); - - var part1280 = match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} has been accepted via the %{logon_type->} server at %{hostip}", processor_chain([ - setc("eventcategory","1401050100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg779 = msg("00263", part1280); - - var part1281 = match("MESSAGE#770:00400/0_0", "nwparser.payload", "ActiveX control %{p0}"); - - var part1282 = match("MESSAGE#770:00400/0_1", "nwparser.payload", "JAVA applet %{p0}"); - - var part1283 = match("MESSAGE#770:00400/0_2", "nwparser.payload", "EXE file %{p0}"); - - var part1284 = match("MESSAGE#770:00400/0_3", "nwparser.payload", "ZIP file %{p0}"); - - var select295 = linear_select([ - part1281, - part1282, - part1283, - part1284, - ]); - - var part1285 = match("MESSAGE#770:00400/1", "nwparser.p0", "has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{dinterface->} in zone %{dst_zone}. %{info}"); - - var all266 = all_match({ - processors: [ - select295, - part1285, - ], - on_success: processor_chain([ - setc("eventcategory","1003000000"), - dup2, - dup4, - dup5, - dup3, - dup61, - ]), - }); - - var msg780 = msg("00400", all266); - - var part1286 = match("MESSAGE#771:00401", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg781 = msg("00401", part1286); - - var part1287 = match("MESSAGE#772:00402", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup292, - ])); - - var msg782 = msg("00402", part1287); - - var part1288 = match("MESSAGE#773:00402:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at %{p0}"); - - var part1289 = match("MESSAGE#773:00402:01/2", "nwparser.p0", "%{} %{interface->} in zone %{zone}. %{info}"); - - var all267 = all_match({ - processors: [ - part1288, - dup337, - part1289, - ], - on_success: processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup292, - ]), - }); - - var msg783 = msg("00402:01", all267); - - var select296 = linear_select([ - msg782, - msg783, - ]); - - var part1290 = match("MESSAGE#774:00403", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg784 = msg("00403", part1290); - - var part1291 = match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup4, - dup5, - dup3, - dup292, - ])); - - var msg785 = msg("00404", part1291); - - var part1292 = match("MESSAGE#776:00405", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup147, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg786 = msg("00405", part1292); - - var msg787 = msg("00406", dup413); - - var msg788 = msg("00407", dup413); - - var msg789 = msg("00408", dup413); - - var all268 = all_match({ - processors: [ - dup132, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg790 = msg("00409", all268); - - var msg791 = msg("00410", dup413); - - var part1293 = match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup60, - ])); - - var msg792 = msg("00410:01", part1293); - - var select297 = linear_select([ - msg791, - msg792, - ]); - - var part1294 = match("MESSAGE#783:00411/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto TCP (zone %{zone->} %{p0}"); - - var all269 = all_match({ - processors: [ - part1294, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg793 = msg("00411", all269); - - var part1295 = match("MESSAGE#784:00413/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at %{p0}"); - - var part1296 = match("MESSAGE#784:00413/2", "nwparser.p0", "%{} %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all270 = all_match({ - processors: [ - part1295, - dup337, - part1296, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg794 = msg("00413", all270); - - var part1297 = match("MESSAGE#785:00413:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}(zone %{group->} %{p0}"); - - var all271 = all_match({ - processors: [ - part1297, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup61, - ]), - }); - - var msg795 = msg("00413:01", all271); - - var part1298 = match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup9, - ])); - - var msg796 = msg("00413:02", part1298); - - var select298 = linear_select([ - msg794, - msg795, - msg796, - ]); - - var part1299 = match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg797 = msg("00414", part1299); - - var part1300 = match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup9, - ])); - - var msg798 = msg("00414:01", part1300); - - var select299 = linear_select([ - msg797, - msg798, - ]); - - var part1301 = match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg799 = msg("00415", part1301); - - var all272 = all_match({ - processors: [ - dup132, - dup343, - dup294, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg800 = msg("00423", all272); - - var all273 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup60, - ]), - }); - - var msg801 = msg("00429", all273); - - var all274 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup60, - ]), - }); - - var msg802 = msg("00429:01", all274); - - var select300 = linear_select([ - msg801, - msg802, - ]); - - var all275 = all_match({ - processors: [ - dup80, - dup343, - dup295, - dup351, - ], - on_success: processor_chain([ - dup85, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ]), - }); - - var msg803 = msg("00430", all275); - - var all276 = all_match({ - processors: [ - dup132, - dup343, - dup295, - dup351, - ], - on_success: processor_chain([ - dup85, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup60, - ]), - }); - - var msg804 = msg("00430:01", all276); - - var select301 = linear_select([ - msg803, - msg804, - ]); - - var msg805 = msg("00431", dup414); - - var msg806 = msg("00432", dup414); - - var msg807 = msg("00433", dup415); - - var msg808 = msg("00434", dup415); - - var msg809 = msg("00435", dup395); - - var all277 = all_match({ - processors: [ - dup132, - dup343, - dup294, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup5, - dup3, - dup60, - ]), - }); - - var msg810 = msg("00435:01", all277); - - var select302 = linear_select([ - msg809, - msg810, - ]); - - var msg811 = msg("00436", dup395); - - var all278 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup4, - dup5, - dup3, - dup60, - ]), - }); - - var msg812 = msg("00436:01", all278); - - var select303 = linear_select([ - msg811, - msg812, - ]); - - var part1302 = match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg813 = msg("00437", part1302); - - var all279 = all_match({ - processors: [ - dup299, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - dup9, - ]), - }); - - var msg814 = msg("00437:01", all279); - - var part1303 = match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - dup9, - ])); - - var msg815 = msg("00437:02", part1303); - - var select304 = linear_select([ - msg813, - msg814, - msg815, - ]); - - var part1304 = match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg816 = msg("00438", part1304); - - var part1305 = match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg817 = msg("00438:01", part1305); - - var all280 = all_match({ - processors: [ - dup299, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup61, - ]), - }); - - var msg818 = msg("00438:02", all280); - - var select305 = linear_select([ - msg816, - msg817, - msg818, - ]); - - var part1306 = match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ])); - - var msg819 = msg("00440", part1306); - - var part1307 = match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg820 = msg("00440:02", part1307); - - var all281 = all_match({ - processors: [ - dup239, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup9, - dup61, - ]), - }); - - var msg821 = msg("00440:01", all281); - - var part1308 = match("MESSAGE#812:00440:03/0", "nwparser.payload", "Fragmented traffic! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{group->} %{p0}"); - - var all282 = all_match({ - processors: [ - part1308, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup9, - dup60, - ]), - }); - - var msg822 = msg("00440:03", all282); - - var select306 = linear_select([ - msg819, - msg820, - msg821, - msg822, - ]); - - var part1309 = match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var msg823 = msg("00441", part1309); - - var msg824 = msg("00442", dup396); - - var msg825 = msg("00443", dup396); - - var part1310 = match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued command %{fld2->} to redirect output.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg826 = msg("00511", part1310); - - var part1311 = match("MESSAGE#817:00511:01/0", "nwparser.payload", "All System Config saved by admin %{p0}"); - - var all283 = all_match({ - processors: [ - part1311, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg827 = msg("00511:01", all283); - - var part1312 = match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms are cleared by admin %{administrator}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg828 = msg("00511:02", part1312); - - var part1313 = match("MESSAGE#819:00511:03/0", "nwparser.payload", "Get new software from flash to slot (file: %{fld2}) by admin %{p0}"); - - var all284 = all_match({ - processors: [ - part1313, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg829 = msg("00511:03", all284); - - var part1314 = match("MESSAGE#820:00511:04/0", "nwparser.payload", "Get new software from %{hostip->} (file: %{fld2}) to slot (file: %{fld3}) by admin %{p0}"); - - var all285 = all_match({ - processors: [ - part1314, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg830 = msg("00511:04", all285); - - var part1315 = match("MESSAGE#821:00511:05/0", "nwparser.payload", "Get new software to %{hostip->} (file: %{fld2}) by admin %{p0}"); - - var all286 = all_match({ - processors: [ - part1315, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg831 = msg("00511:05", all286); - - var part1316 = match("MESSAGE#822:00511:06/0", "nwparser.payload", "Log setting is modified by admin %{p0}"); - - var all287 = all_match({ - processors: [ - part1316, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg832 = msg("00511:06", all287); - - var part1317 = match("MESSAGE#823:00511:07/0", "nwparser.payload", "Save configuration to %{hostip->} (file: %{fld2}) by admin %{p0}"); - - var all288 = all_match({ - processors: [ - part1317, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg833 = msg("00511:07", all288); - - var part1318 = match("MESSAGE#824:00511:08/0", "nwparser.payload", "Save new software from slot (file: %{fld2}) to flash by admin %{p0}"); - - var all289 = all_match({ - processors: [ - part1318, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg834 = msg("00511:08", all289); - - var part1319 = match("MESSAGE#825:00511:09/0", "nwparser.payload", "Save new software from %{hostip->} (file: %{result}) to flash by admin %{p0}"); - - var all290 = all_match({ - processors: [ - part1319, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg835 = msg("00511:09", all290); - - var part1320 = match("MESSAGE#826:00511:10/0", "nwparser.payload", "System Config from flash to slot - %{fld2->} by admin %{p0}"); - - var all291 = all_match({ - processors: [ - part1320, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg836 = msg("00511:10", all291); - - var part1321 = match("MESSAGE#827:00511:11/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) to slot - %{fld3->} by admin %{p0}"); - - var all292 = all_match({ - processors: [ - part1321, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg837 = msg("00511:11", all292); - - var part1322 = match("MESSAGE#828:00511:12/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) by admin %{p0}"); - - var all293 = all_match({ - processors: [ - part1322, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg838 = msg("00511:12", all293); - - var part1323 = match("MESSAGE#829:00511:13/0", "nwparser.payload", "The system configuration was loaded from the slot by admin %{p0}"); - - var all294 = all_match({ - processors: [ - part1323, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg839 = msg("00511:13", all294); - - var part1324 = match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS shared secret with invalid length %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg840 = msg("00511:14", part1324); - - var select307 = linear_select([ - msg826, - msg827, - msg828, - msg829, - msg830, - msg831, - msg832, - msg833, - msg834, - msg835, - msg836, - msg837, - msg838, - msg839, - msg840, - ]); - - var part1325 = match("MESSAGE#831:00513/0", "nwparser.payload", "The physical state of %{p0}"); - - var part1326 = match("MESSAGE#831:00513/1_1", "nwparser.p0", "the Interface %{p0}"); - - var select308 = linear_select([ - dup123, - part1326, - dup122, - ]); - - var part1327 = match("MESSAGE#831:00513/2", "nwparser.p0", "%{interface->} has changed to %{p0}"); - - var part1328 = match("MESSAGE#831:00513/3_0", "nwparser.p0", "%{result}. (%{fld1})"); - - var part1329 = match_copy("MESSAGE#831:00513/3_1", "nwparser.p0", "result"); - - var select309 = linear_select([ - part1328, - part1329, - ]); - - var all295 = all_match({ - processors: [ - part1325, - select308, - part1327, - select309, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg841 = msg("00513", all295); - - var part1330 = match("MESSAGE#832:00515/0_0", "nwparser.payload", "Vsys Admin %{p0}"); - - var select310 = linear_select([ - part1330, - dup287, - ]); - - var part1331 = match("MESSAGE#832:00515/1", "nwparser.p0", "%{administrator->} has logged on via the %{logon_type->} ( HTTP%{p0}"); - - var part1332 = match("MESSAGE#832:00515/2_1", "nwparser.p0", "S%{p0}"); - - var select311 = linear_select([ - dup96, - part1332, - ]); - - var part1333 = match("MESSAGE#832:00515/3", "nwparser.p0", "%{}) to port %{interface->} from %{saddr}:%{sport}"); - - var all296 = all_match({ - processors: [ - select310, - part1331, - select311, - part1333, - ], - on_success: processor_chain([ - dup301, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg842 = msg("00515", all296); - - var part1334 = match("MESSAGE#833:00515:01/0", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{p0}"); - - var part1335 = match("MESSAGE#833:00515:01/1_0", "nwparser.p0", "the %{logon_type->} has failed %{p0}"); - - var part1336 = match("MESSAGE#833:00515:01/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} has failed %{p0}"); - - var select312 = linear_select([ - part1335, - part1336, - ]); - - var part1337 = match_copy("MESSAGE#833:00515:01/2", "nwparser.p0", "fld2"); - - var all297 = all_match({ - processors: [ - part1334, - select312, - part1337, - ], - on_success: processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup4, - dup5, - dup302, - dup3, - ]), - }); - - var msg843 = msg("00515:01", all297); - - var part1338 = match("MESSAGE#834:00515:02/0", "nwparser.payload", "Management session via %{p0}"); - - var part1339 = match("MESSAGE#834:00515:02/1_0", "nwparser.p0", "the %{logon_type->} for %{p0}"); - - var part1340 = match("MESSAGE#834:00515:02/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} for %{p0}"); - - var select313 = linear_select([ - part1339, - part1340, - ]); - - var part1341 = match("MESSAGE#834:00515:02/2_0", "nwparser.p0", "[vsys] admin %{p0}"); - - var part1342 = match("MESSAGE#834:00515:02/2_1", "nwparser.p0", "vsys admin %{p0}"); - - var select314 = linear_select([ - part1341, - part1342, - dup15, - ]); - - var part1343 = match("MESSAGE#834:00515:02/3", "nwparser.p0", "%{administrator->} has timed out"); - - var all298 = all_match({ - processors: [ - part1338, - select313, - select314, - part1343, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg844 = msg("00515:02", all298); - - var part1344 = match("MESSAGE#835:00515:04/0_0", "nwparser.payload", "[Vsys] %{p0}"); - - var part1345 = match("MESSAGE#835:00515:04/0_1", "nwparser.payload", "Vsys %{p0}"); - - var select315 = linear_select([ - part1344, - part1345, - ]); - - var part1346 = match("MESSAGE#835:00515:04/1", "nwparser.p0", "Admin %{administrator->} has logged o%{p0}"); - - var part1347 = match_copy("MESSAGE#835:00515:04/4_1", "nwparser.p0", "logon_type"); - - var select316 = linear_select([ - dup304, - part1347, - ]); - - var all299 = all_match({ - processors: [ - select315, - part1346, - dup398, - dup40, - select316, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg845 = msg("00515:04", all299); - - var part1348 = match("MESSAGE#836:00515:06", "nwparser.payload", "Admin User %{administrator->} has logged on via %{logon_type->} from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg846 = msg("00515:06", part1348); - - var part1349 = match("MESSAGE#837:00515:05/0", "nwparser.payload", "%{}Admin %{p0}"); - - var select317 = linear_select([ - dup305, - dup16, - ]); - - var part1350 = match("MESSAGE#837:00515:05/2", "nwparser.p0", "%{administrator->} has logged o%{p0}"); - - var part1351 = match("MESSAGE#837:00515:05/5_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{fld2})"); - - var select318 = linear_select([ - dup306, - part1351, - dup304, - ]); - - var all300 = all_match({ - processors: [ - part1349, - select317, - part1350, - dup398, - dup40, - select318, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg847 = msg("00515:05", all300); - - var part1352 = match("MESSAGE#838:00515:07", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(http) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg848 = msg("00515:07", part1352); - - var part1353 = match("MESSAGE#839:00515:08/0", "nwparser.payload", "%{fld2->} Admin User \"%{administrator}\" logged in for %{logon_type}(http%{p0}"); - - var part1354 = match("MESSAGE#839:00515:08/1_0", "nwparser.p0", ") %{p0}"); - - var part1355 = match("MESSAGE#839:00515:08/1_1", "nwparser.p0", "s) %{p0}"); - - var select319 = linear_select([ - part1354, - part1355, - ]); - - var part1356 = match("MESSAGE#839:00515:08/2", "nwparser.p0", "management (port %{network_port}) from %{saddr}:%{sport}"); - - var all301 = all_match({ - processors: [ - part1353, - select319, - part1356, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg849 = msg("00515:08", all301); - - var part1357 = match("MESSAGE#840:00515:09", "nwparser.payload", "User %{username->} telnet management session from (%{saddr}:%{sport}) timed out", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg850 = msg("00515:09", part1357); - - var part1358 = match("MESSAGE#841:00515:10", "nwparser.payload", "User %{username->} logged out of telnet session from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg851 = msg("00515:10", part1358); - - var part1359 = match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on zone %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg852 = msg("00515:11", part1359); - - var part1360 = match("MESSAGE#843:00515:12/0", "nwparser.payload", "[ Vsys ] Admin User \"%{administrator}\" logged in for Web( http%{p0}"); - - var part1361 = match("MESSAGE#843:00515:12/2", "nwparser.p0", ") management (port %{network_port})"); - - var all302 = all_match({ - processors: [ - part1360, - dup399, - part1361, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg853 = msg("00515:12", all302); - - var select320 = linear_select([ - dup288, - dup287, - ]); - - var part1362 = match("MESSAGE#844:00515:13/1", "nwparser.p0", "user %{administrator->} has logged o%{p0}"); - - var select321 = linear_select([ - dup306, - dup304, - ]); - - var all303 = all_match({ - processors: [ - select320, - part1362, - dup398, - dup40, - select321, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg854 = msg("00515:13", all303); - - var part1363 = match("MESSAGE#845:00515:14/0_0", "nwparser.payload", "Admin user %{administrator->} has been forced to log o%{p0}"); - - var part1364 = match("MESSAGE#845:00515:14/0_1", "nwparser.payload", "%{username->} %{fld1->} has been forced to log o%{p0}"); - - var select322 = linear_select([ - part1363, - part1364, - ]); - - var part1365 = match("MESSAGE#845:00515:14/2", "nwparser.p0", "of the %{p0}"); - - var part1366 = match("MESSAGE#845:00515:14/3_0", "nwparser.p0", "serial %{logon_type->} session."); - - var part1367 = match("MESSAGE#845:00515:14/3_1", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port->} (%{event_time})"); - - var part1368 = match("MESSAGE#845:00515:14/3_2", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port}"); - - var select323 = linear_select([ - part1366, - part1367, - part1368, - ]); - - var all304 = all_match({ - processors: [ - select322, - dup398, - part1365, - select323, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg855 = msg("00515:14", all304); - - var part1369 = match("MESSAGE#846:00515:15/0", "nwparser.payload", "%{fld2}: Admin User %{administrator->} has logged o%{p0}"); - - var part1370 = match("MESSAGE#846:00515:15/3_0", "nwparser.p0", "the %{logon_type->} (%{p0}"); - - var part1371 = match("MESSAGE#846:00515:15/3_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{p0}"); - - var select324 = linear_select([ - part1370, - part1371, - ]); - - var all305 = all_match({ - processors: [ - part1369, - dup398, - dup40, - select324, - dup41, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg856 = msg("00515:15", all305); - - var part1372 = match("MESSAGE#847:00515:16/0_0", "nwparser.payload", "%{fld2}: Admin %{p0}"); - - var select325 = linear_select([ - part1372, - dup287, - ]); - - var part1373 = match("MESSAGE#847:00515:16/1", "nwparser.p0", "user %{administrator->} attempt access to %{url->} illegal from %{logon_type}( http%{p0}"); - - var part1374 = match("MESSAGE#847:00515:16/3", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}. (%{fld1})"); - - var all306 = all_match({ - processors: [ - select325, - part1373, - dup399, - part1374, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg857 = msg("00515:16", all306); - - var part1375 = match("MESSAGE#848:00515:17/0", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{p0}"); - - var part1376 = match("MESSAGE#848:00515:17/1_0", "nwparser.p0", "https %{p0}"); - - var part1377 = match("MESSAGE#848:00515:17/1_1", "nwparser.p0", " http %{p0}"); - - var select326 = linear_select([ - part1376, - part1377, - ]); - - var part1378 = match("MESSAGE#848:00515:17/2", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}"); - - var all307 = all_match({ - processors: [ - part1375, - select326, - part1378, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg858 = msg("00515:17", all307); - - var part1379 = match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(https) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg859 = msg("00515:18", part1379); - - var part1380 = match("MESSAGE#850:00515:19/0", "nwparser.payload", "Vsys admin user %{administrator->} logged on via %{p0}"); - - var part1381 = match("MESSAGE#850:00515:19/1_0", "nwparser.p0", "%{logon_type->} from remote IP address %{saddr->} using port %{sport}. (%{p0}"); - - var part1382 = match("MESSAGE#850:00515:19/1_1", "nwparser.p0", "the console. (%{p0}"); - - var select327 = linear_select([ - part1381, - part1382, - ]); - - var all308 = all_match({ - processors: [ - part1380, - select327, - dup41, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg860 = msg("00515:19", all308); - - var part1383 = match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session via SCS from %{saddr}:%{sport->} for admin netscreen has timed out (%{fld1})", processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg861 = msg("00515:20", part1383); - - var select328 = linear_select([ - msg842, - msg843, - msg844, - msg845, - msg846, - msg847, - msg848, - msg849, - msg850, - msg851, - msg852, - msg853, - msg854, - msg855, - msg856, - msg857, - msg858, - msg859, - msg860, - msg861, - ]); - - var part1384 = match("MESSAGE#852:00518", "nwparser.payload", "Admin user %{administrator->} %{fld1}at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg862 = msg("00518", part1384); - - var part1385 = match("MESSAGE#853:00518:17", "nwparser.payload", "Admin user %{administrator->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg863 = msg("00518:17", part1385); - - var part1386 = match("MESSAGE#854:00518:01", "nwparser.payload", "Local authentication for WebAuth user %{username->} was %{disposition}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg864 = msg("00518:01", part1386); - - var part1387 = match("MESSAGE#855:00518:02", "nwparser.payload", "Local authentication for user %{username->} was %{disposition}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg865 = msg("00518:02", part1387); - - var part1388 = match("MESSAGE#856:00518:03", "nwparser.payload", "User %{username->} at %{saddr->} must enter \"Next Code\" for SecurID %{hostip}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg866 = msg("00518:03", part1388); - - var part1389 = match("MESSAGE#857:00518:04", "nwparser.payload", "WebAuth user %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg867 = msg("00518:04", part1389); - - var part1390 = match("MESSAGE#858:00518:05", "nwparser.payload", "User %{username->} at %{saddr->} has been challenged via the %{authmethod->} server at %{hostip->} (Rejected since challenge is not supported for %{logon_type})", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg868 = msg("00518:05", part1390); - - var part1391 = match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for WebAuth user %{username}", processor_chain([ - dup35, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg869 = msg("00518:06", part1391); - - var part1392 = match("MESSAGE#860:00518:07/0", "nwparser.payload", "Authentication for user %{username->} was denied (long %{p0}"); - - var part1393 = match("MESSAGE#860:00518:07/1_1", "nwparser.p0", "username %{p0}"); - - var select329 = linear_select([ - dup24, - part1393, - ]); - - var part1394 = match("MESSAGE#860:00518:07/2", "nwparser.p0", ")%{}"); - - var all309 = all_match({ - processors: [ - part1392, - select329, - part1394, - ], - on_success: processor_chain([ - dup53, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg870 = msg("00518:07", all309); - - var part1395 = match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr->} %{authmethod->} authentication attempt has timed out", processor_chain([ - dup35, - dup29, - dup31, - dup39, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg871 = msg("00518:08", part1395); - - var part1396 = match("MESSAGE#862:00518:09", "nwparser.payload", "User %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg872 = msg("00518:09", part1396); - - var part1397 = match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed due to %{result}. (%{fld1})", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup4, - dup9, - dup5, - dup3, - dup302, - ])); - - var msg873 = msg("00518:10", part1397); - - var part1398 = match("MESSAGE#864:00518:11/0", "nwparser.payload", "ADM: Local admin authentication failed for login name %{p0}"); - - var part1399 = match("MESSAGE#864:00518:11/1_0", "nwparser.p0", "'%{username}': %{p0}"); - - var part1400 = match("MESSAGE#864:00518:11/1_1", "nwparser.p0", "%{username}: %{p0}"); - - var select330 = linear_select([ - part1399, - part1400, - ]); - - var part1401 = match("MESSAGE#864:00518:11/2", "nwparser.p0", "%{result->} (%{fld1})"); - - var all310 = all_match({ - processors: [ - part1398, - select330, - part1401, - ], - on_success: processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup9, - dup4, - dup5, - dup3, - ]), - }); - - var msg874 = msg("00518:11", all310); - - var part1402 = match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup9, - dup5, - dup3, - ])); - - var msg875 = msg("00518:12", part1402); - - var part1403 = match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr->} is rejected by the Radius server at %{hostip}. (%{fld1})", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup9, - dup5, - ])); - - var msg876 = msg("00518:13", part1403); - - var part1404 = match("MESSAGE#867:00518:14", "nwparser.payload", "%{fld2}: Admin user has been rejected via the Radius server at %{hostip->} (%{fld1})", processor_chain([ - dup290, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg877 = msg("00518:14", part1404); - - var select331 = linear_select([ - msg862, - msg863, - msg864, - msg865, - msg866, - msg867, - msg868, - msg869, - msg870, - msg871, - msg872, - msg873, - msg874, - msg875, - msg876, - msg877, - ]); - - var part1405 = match("MESSAGE#868:00519/0", "nwparser.payload", "Admin user %{administrator->} %{p0}"); - - var part1406 = match("MESSAGE#868:00519/1_1", "nwparser.p0", "of group %{group->} at %{saddr->} has %{p0}"); - - var part1407 = match("MESSAGE#868:00519/1_2", "nwparser.p0", "%{group->} at %{saddr->} has %{p0}"); - - var select332 = linear_select([ - dup194, - part1406, - part1407, - ]); - - var part1408 = match("MESSAGE#868:00519/2", "nwparser.p0", "been %{disposition->} via the %{logon_type->} server %{p0}"); - - var part1409 = match("MESSAGE#868:00519/3_0", "nwparser.p0", "at %{p0}"); - - var select333 = linear_select([ - part1409, - dup16, - ]); - - var part1410 = match("MESSAGE#868:00519/4", "nwparser.p0", "%{hostip}"); - - var all311 = all_match({ - processors: [ - part1405, - select332, - part1408, - select333, - part1410, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg878 = msg("00519", all311); - - var part1411 = match("MESSAGE#869:00519:01/0", "nwparser.payload", "Local authentication for %{p0}"); - - var select334 = linear_select([ - dup307, - dup305, - ]); - - var part1412 = match("MESSAGE#869:00519:01/2", "nwparser.p0", "%{username->} was %{disposition}"); - - var all312 = all_match({ - processors: [ - part1411, - select334, - part1412, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg879 = msg("00519:01", all312); - - var part1413 = match("MESSAGE#870:00519:02/1_1", "nwparser.p0", "User %{p0}"); - - var select335 = linear_select([ - dup307, - part1413, - ]); - - var part1414 = match("MESSAGE#870:00519:02/2", "nwparser.p0", "%{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}"); - - var all313 = all_match({ - processors: [ - dup160, - select335, - part1414, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg880 = msg("00519:02", all313); - - var part1415 = match("MESSAGE#871:00519:03", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{fld4}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg881 = msg("00519:03", part1415); - - var part1416 = match("MESSAGE#872:00519:04", "nwparser.payload", "ADM: Local admin authentication successful for login name %{username->} (%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg882 = msg("00519:04", part1416); - - var part1417 = match("MESSAGE#873:00519:05", "nwparser.payload", "%{fld2}Admin user %{administrator->} has been accepted via the Radius server at %{hostip}(%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg883 = msg("00519:05", part1417); - - var select336 = linear_select([ - msg878, - msg879, - msg880, - msg881, - msg882, - msg883, - ]); - - var part1418 = match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authentication attempt has timed out", processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg884 = msg("00520", part1418); - - var part1419 = match("MESSAGE#875:00520:01/0", "nwparser.payload", "User %{username->} at %{hostip->} %{p0}"); - - var part1420 = match("MESSAGE#875:00520:01/1_0", "nwparser.p0", "RADIUS %{p0}"); - - var part1421 = match("MESSAGE#875:00520:01/1_1", "nwparser.p0", "SecurID %{p0}"); - - var part1422 = match("MESSAGE#875:00520:01/1_2", "nwparser.p0", "LDAP %{p0}"); - - var part1423 = match("MESSAGE#875:00520:01/1_3", "nwparser.p0", "Local %{p0}"); - - var select337 = linear_select([ - part1420, - part1421, - part1422, - part1423, - ]); - - var part1424 = match("MESSAGE#875:00520:01/2", "nwparser.p0", "authentication attempt has timed out%{}"); - - var all314 = all_match({ - processors: [ - part1419, - select337, - part1424, - ], - on_success: processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg885 = msg("00520:01", all314); - - var part1425 = match("MESSAGE#876:00520:02/0", "nwparser.payload", "Trying %{p0}"); - - var part1426 = match("MESSAGE#876:00520:02/2", "nwparser.p0", "server %{fld2}"); - - var all315 = all_match({ - processors: [ - part1425, - dup400, - part1426, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg886 = msg("00520:02", all315); - - var part1427 = match("MESSAGE#877:00520:03/1_0", "nwparser.p0", "Primary %{p0}"); - - var part1428 = match("MESSAGE#877:00520:03/1_1", "nwparser.p0", "Backup1 %{p0}"); - - var part1429 = match("MESSAGE#877:00520:03/1_2", "nwparser.p0", "Backup2 %{p0}"); - - var select338 = linear_select([ - part1427, - part1428, - part1429, - ]); - - var part1430 = match("MESSAGE#877:00520:03/2", "nwparser.p0", "%{fld2}, %{p0}"); - - var part1431 = match("MESSAGE#877:00520:03/4", "nwparser.p0", "%{fld3}, and %{p0}"); - - var part1432 = match("MESSAGE#877:00520:03/6", "nwparser.p0", "%{fld4->} servers failed"); - - var all316 = all_match({ - processors: [ - dup160, - select338, - part1430, - dup400, - part1431, - dup400, - part1432, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg887 = msg("00520:03", all316); - - var part1433 = match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hostip->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg888 = msg("00520:04", part1433); - - var part1434 = match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: New requests for %{fld31->} server will try %{fld32->} from now on. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg889 = msg("00520:05", part1434); - - var select339 = linear_select([ - msg884, - msg885, - msg886, - msg887, - msg888, - msg889, - ]); - - var part1435 = match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg890 = msg("00521", part1435); - - var part1436 = match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg891 = msg("00522", part1436); - - var part1437 = match("MESSAGE#881:00523", "nwparser.payload", "URL filtering received an error from %{fld2->} (error %{resultcode}).", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg892 = msg("00523", part1437); - - var part1438 = match("MESSAGE#882:00524", "nwparser.payload", "NetScreen device at %{hostip}:%{network_port->} has responded successfully to SNMP request from %{saddr}:%{sport}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg893 = msg("00524", part1438); - - var part1439 = match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown SNMP community public at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg894 = msg("00524:02", part1439); - - var part1440 = match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has responded successfully to the SNMP request from %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg895 = msg("00524:03", part1440); - - var part1441 = match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown SNMP community admin at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg896 = msg("00524:04", part1441); - - var part1442 = match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg897 = msg("00524:05", part1442); - - var part1443 = match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been received from an unknown host in SNMP community %{fld2->} at %{hostip}:%{network_port}. (%{fld1})", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg898 = msg("00524:06", part1443); - - var part1444 = match("MESSAGE#888:00524:12", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{saddr}:%{sport->} to %{daddr}:%{dport->} has been received", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg899 = msg("00524:12", part1444); - - var part1445 = match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{sport->} has been received, but the SNMP version type is incorrect. (%{fld1})", processor_chain([ - dup19, - dup2, - dup4, - setc("result","the SNMP version type is incorrect"), - dup5, - dup9, - ])); - - var msg900 = msg("00524:14", part1445); - - var part1446 = match("MESSAGE#890:00524:13/0", "nwparser.payload", "SNMP request has been received%{p0}"); - - var part1447 = match("MESSAGE#890:00524:13/2", "nwparser.p0", "%{}but %{result}"); - - var all317 = all_match({ - processors: [ - part1446, - dup401, - part1447, - ], - on_success: processor_chain([ - dup18, - dup2, - dup4, - dup5, - ]), - }); - - var msg901 = msg("00524:13", all317); - - var part1448 = match("MESSAGE#891:00524:07", "nwparser.payload", "Response to SNMP request from %{saddr}:%{sport->} to %{daddr}:%{dport->} has %{disposition->} due to %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg902 = msg("00524:07", part1448); - - var part1449 = match("MESSAGE#892:00524:08", "nwparser.payload", "SNMP community %{fld2->} cannot be added because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg903 = msg("00524:08", part1449); - - var part1450 = match("MESSAGE#893:00524:09", "nwparser.payload", "SNMP host %{hostip->} cannot be added to community %{fld2->} because of %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg904 = msg("00524:09", part1450); - - var part1451 = match("MESSAGE#894:00524:10", "nwparser.payload", "SNMP host %{hostip->} cannot be added because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg905 = msg("00524:10", part1451); - - var part1452 = match("MESSAGE#895:00524:11", "nwparser.payload", "SNMP host %{hostip->} cannot be removed from community %{fld2->} because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg906 = msg("00524:11", part1452); - - var part1453 = match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34->} doesn't exist. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg907 = msg("00524:16", part1453); - - var select340 = linear_select([ - msg893, - msg894, - msg895, - msg896, - msg897, - msg898, - msg899, - msg900, - msg901, - msg902, - msg903, - msg904, - msg905, - msg906, - msg907, - ]); - - var part1454 = match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username->} at %{hostip->} has been %{disposition->} by SecurID %{fld2}", processor_chain([ - dup203, - setc("ec_subject","Password"), - dup38, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg908 = msg("00525", part1454); - - var part1455 = match("MESSAGE#897:00525:01", "nwparser.payload", "User %{username->} at %{hostip->} has selected a system-generated PIN for authentication with SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg909 = msg("00525:01", part1455); - - var part1456 = match("MESSAGE#898:00525:02", "nwparser.payload", "User %{username->} at %{hostip->} must enter the \"new PIN\" for SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg910 = msg("00525:02", part1456); - - var part1457 = match("MESSAGE#899:00525:03", "nwparser.payload", "User %{username->} at %{hostip->} must make a \"New PIN\" choice for SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg911 = msg("00525:03", part1457); - - var select341 = linear_select([ - msg908, - msg909, - msg910, - msg911, - ]); - - var part1458 = match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded and %{hostip->} cannot be added", processor_chain([ - dup37, - dup219, - dup38, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg912 = msg("00526", part1458); - - var part1459 = match("MESSAGE#901:00527/0", "nwparser.payload", "A DHCP-%{p0}"); - - var part1460 = match("MESSAGE#901:00527/1_1", "nwparser.p0", " assigned %{p0}"); - - var select342 = linear_select([ - dup311, - part1460, - ]); - - var part1461 = match("MESSAGE#901:00527/2", "nwparser.p0", "IP address %{hostip->} has been %{p0}"); - - var part1462 = match("MESSAGE#901:00527/3_1", "nwparser.p0", "freed from %{p0}"); - - var part1463 = match("MESSAGE#901:00527/3_2", "nwparser.p0", "freed %{p0}"); - - var select343 = linear_select([ - dup312, - part1462, - part1463, - ]); - - var all318 = all_match({ - processors: [ - part1459, - select342, - part1461, - select343, - dup108, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg913 = msg("00527", all318); - - var part1464 = match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address has been manually released%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg914 = msg("00527:01", part1464); - - var part1465 = match("MESSAGE#903:00527:02/0", "nwparser.payload", "DHCP server has %{p0}"); - - var part1466 = match("MESSAGE#903:00527:02/1_1", "nwparser.p0", "released %{p0}"); - - var part1467 = match("MESSAGE#903:00527:02/1_2", "nwparser.p0", "assigned or released %{p0}"); - - var select344 = linear_select([ - dup311, - part1466, - part1467, - ]); - - var part1468 = match("MESSAGE#903:00527:02/2", "nwparser.p0", "an IP address%{}"); - - var all319 = all_match({ - processors: [ - part1465, - select344, - part1468, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg915 = msg("00527:02", all319); - - var part1469 = match("MESSAGE#904:00527:03", "nwparser.payload", "MAC address %{macaddr->} has detected an IP conflict and has declined address %{hostip}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg916 = msg("00527:03", part1469); - - var part1470 = match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP addresses have been manually released.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg917 = msg("00527:04", part1470); - - var part1471 = match("MESSAGE#906:00527:05/2", "nwparser.p0", "%{} %{interface->} is more than %{fld2->} allocated."); - - var all320 = all_match({ - processors: [ - dup210, - dup337, - part1471, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg918 = msg("00527:05", all320); - - var part1472 = match("MESSAGE#907:00527:06/0", "nwparser.payload", "IP address %{hostip->} %{p0}"); - - var select345 = linear_select([ - dup106, - dup127, - ]); - - var part1473 = match("MESSAGE#907:00527:06/3_1", "nwparser.p0", "released from %{p0}"); - - var select346 = linear_select([ - dup312, - part1473, - ]); - - var part1474 = match("MESSAGE#907:00527:06/4", "nwparser.p0", "%{fld2->} (%{fld1})"); - - var all321 = all_match({ - processors: [ - part1472, - select345, - dup23, - select346, - part1474, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg919 = msg("00527:06", all321); - - var part1475 = match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have expired. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg920 = msg("00527:07", part1475); - - var part1476 = match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{interface->} received %{protocol_detail->} from %{smacaddr->} requesting out-of-scope IP address %{hostip}/%{mask->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg921 = msg("00527:08", part1476); - - var part1477 = match("MESSAGE#910:00527:09/0", "nwparser.payload", "MAC address %{macaddr->} has %{disposition->} %{p0}"); - - var part1478 = match("MESSAGE#910:00527:09/1_0", "nwparser.p0", "address %{hostip->} (%{p0}"); - - var part1479 = match("MESSAGE#910:00527:09/1_1", "nwparser.p0", "%{hostip->} (%{p0}"); - - var select347 = linear_select([ - part1478, - part1479, - ]); - - var all322 = all_match({ - processors: [ - part1477, - select347, - dup41, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg922 = msg("00527:09", all322); - - var part1480 = match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are expired. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg923 = msg("00527:10", part1480); - - var select348 = linear_select([ - msg913, - msg914, - msg915, - msg916, - msg917, - msg918, - msg919, - msg920, - msg921, - msg922, - msg923, - ]); - - var part1481 = match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenticated using password :", processor_chain([ - setc("eventcategory","1302010000"), - dup29, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg924 = msg("00528", part1481); - - var part1482 = match("MESSAGE#913:00528:01", "nwparser.payload", "SCS: Connection terminated for user %{username->} from", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg925 = msg("00528:01", part1482); - - var part1483 = match("MESSAGE#914:00528:02", "nwparser.payload", "SCS: Disabled for all root/vsys on device. Client host attempting connection to interface '%{interface}' with address %{hostip->} from %{saddr}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg926 = msg("00528:02", part1483); - - var part1484 = match("MESSAGE#915:00528:03", "nwparser.payload", "SSH: NetScreen device %{disposition->} to identify itself to the SSH client at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg927 = msg("00528:03", part1484); - - var part1485 = match("MESSAGE#916:00528:04", "nwparser.payload", "SSH: Incompatible SSH version string has been received from SSH client at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg928 = msg("00528:04", part1485); - - var part1486 = match("MESSAGE#917:00528:05", "nwparser.payload", "SSH: %{disposition->} to send identification string to client host at %{hostip}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg929 = msg("00528:05", part1486); - - var part1487 = match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} attempted to connect with invalid version string.", processor_chain([ - dup313, - dup2, - dup3, - dup4, - dup5, - setc("result","invalid version string"), - ])); - - var msg930 = msg("00528:06", part1487); - - var part1488 = match("MESSAGE#919:00528:07/0", "nwparser.payload", "SSH: %{disposition->} to negotiate %{p0}"); - - var part1489 = match("MESSAGE#919:00528:07/1_1", "nwparser.p0", "MAC %{p0}"); - - var part1490 = match("MESSAGE#919:00528:07/1_2", "nwparser.p0", "key exchange %{p0}"); - - var part1491 = match("MESSAGE#919:00528:07/1_3", "nwparser.p0", "host key %{p0}"); - - var select349 = linear_select([ - dup88, - part1489, - part1490, - part1491, - ]); - - var part1492 = match("MESSAGE#919:00528:07/2", "nwparser.p0", "algorithm with host %{hostip}"); - - var all323 = all_match({ - processors: [ - part1488, - select349, - part1492, - ], - on_success: processor_chain([ - dup314, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg931 = msg("00528:07", all323); - - var part1493 = match("MESSAGE#920:00528:08", "nwparser.payload", "SSH: Unsupported cipher type %{fld2->} requested from %{saddr}", processor_chain([ - dup314, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg932 = msg("00528:08", part1493); - - var part1494 = match("MESSAGE#921:00528:09", "nwparser.payload", "SSH: Host client has requested NO cipher from %{saddr}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg933 = msg("00528:09", part1494); - - var part1495 = match("MESSAGE#922:00528:10", "nwparser.payload", "SSH: Disabled for '%{vsys}'. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg934 = msg("00528:10", part1495); - - var part1496 = match("MESSAGE#923:00528:11", "nwparser.payload", "SSH: Disabled for %{fld2->} Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg935 = msg("00528:11", part1496); - - var part1497 = match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} at %{saddr->} tried unsuccessfully to log in to %{vsys->} using the shared untrusted interface. SSH disabled on that interface.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("disposition","disabled"), - ])); - - var msg936 = msg("00528:12", part1497); - - var part1498 = match("MESSAGE#925:00528:13/0", "nwparser.payload", "SSH: SSH client at %{saddr->} tried unsuccessfully to %{p0}"); - - var part1499 = match("MESSAGE#925:00528:13/1_0", "nwparser.p0", "make %{p0}"); - - var part1500 = match("MESSAGE#925:00528:13/1_1", "nwparser.p0", "establish %{p0}"); - - var select350 = linear_select([ - part1499, - part1500, - ]); - - var part1501 = match("MESSAGE#925:00528:13/2", "nwparser.p0", "an SSH connection to %{p0}"); - - var part1502 = match("MESSAGE#925:00528:13/4", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} SSH %{p0}"); - - var part1503 = match("MESSAGE#925:00528:13/5_0", "nwparser.p0", "not enabled %{p0}"); - - var select351 = linear_select([ - part1503, - dup157, - ]); - - var part1504 = match("MESSAGE#925:00528:13/6", "nwparser.p0", "on that interface.%{}"); - - var all324 = all_match({ - processors: [ - part1498, - select350, - part1501, - dup337, - part1502, - select351, - part1504, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg937 = msg("00528:13", all324); - - var part1505 = match("MESSAGE#926:00528:14", "nwparser.payload", "SSH: SSH client %{saddr->} unsuccessfully attempted to make an SSH connection to %{vsys->} SSH was not completely initialized for that system.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg938 = msg("00528:14", part1505); - - var part1506 = match("MESSAGE#927:00528:15/0", "nwparser.payload", "SSH: Admin user %{p0}"); - - var part1507 = match("MESSAGE#927:00528:15/1_1", "nwparser.p0", "%{administrator->} %{p0}"); - - var select352 = linear_select([ - dup315, - part1507, - ]); - - var part1508 = match("MESSAGE#927:00528:15/2", "nwparser.p0", "at host %{saddr->} requested unsupported %{p0}"); - - var part1509 = match("MESSAGE#927:00528:15/3_0", "nwparser.p0", "PKA algorithm %{p0}"); - - var part1510 = match("MESSAGE#927:00528:15/3_1", "nwparser.p0", "authentication method %{p0}"); - - var select353 = linear_select([ - part1509, - part1510, - ]); - - var all325 = all_match({ - processors: [ - part1506, - select352, - part1508, - select353, - dup108, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg939 = msg("00528:15", all325); - - var part1511 = match("MESSAGE#928:00528:16", "nwparser.payload", "SCP: Admin '%{administrator}' at host %{saddr->} executed invalid scp command: '%{fld2}'", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg940 = msg("00528:16", part1511); - - var part1512 = match("MESSAGE#929:00528:17", "nwparser.payload", "SCP: Disabled for '%{username}'. Attempted file transfer failed from host %{saddr}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg941 = msg("00528:17", part1512); - - var part1513 = match("MESSAGE#930:00528:18/2", "nwparser.p0", "authentication successful for admin user %{p0}"); - - var all326 = all_match({ - processors: [ - dup316, - dup402, - part1513, - dup403, - dup320, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("disposition","successful"), - setc("event_description","authentication successful for admin user"), - ]), - }); - - var msg942 = msg("00528:18", all326); - - var part1514 = match("MESSAGE#931:00528:26/2", "nwparser.p0", "authentication failed for admin user %{p0}"); - - var all327 = all_match({ - processors: [ - dup316, - dup402, - part1514, - dup403, - dup320, - ], - on_success: processor_chain([ - dup206, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup302, - dup3, - setc("event_description","authentication failed for admin user"), - ]), - }); - - var msg943 = msg("00528:26", all327); - - var part1515 = match("MESSAGE#932:00528:19/2", "nwparser.p0", ": SSH user %{username->} has been %{disposition->} using password from %{saddr}:%{sport}"); - - var all328 = all_match({ - processors: [ - dup321, - dup404, - part1515, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg944 = msg("00528:19", all328); - - var part1516 = match("MESSAGE#933:00528:20/2", "nwparser.p0", ": Connection has been %{disposition->} for admin user %{administrator->} at %{saddr}:%{sport}"); - - var all329 = all_match({ - processors: [ - dup321, - dup404, - part1516, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg945 = msg("00528:20", all329); - - var part1517 = match("MESSAGE#934:00528:21", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has requested PKA RSA authentication, which is not supported for that client.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg946 = msg("00528:21", part1517); - - var part1518 = match("MESSAGE#935:00528:22/0", "nwparser.payload", "SCS: SSH client at %{saddr->} has attempted to make an SCS connection to %{p0}"); - - var part1519 = match("MESSAGE#935:00528:22/2", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} but %{disposition->} because SCS is not enabled for that interface."); - - var all330 = all_match({ - processors: [ - part1518, - dup337, - part1519, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("result","SCS is not enabled for that interface"), - ]), - }); - - var msg947 = msg("00528:22", all330); - - var part1520 = match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to vsys %{vsys->} because SCS cannot generate the host and server keys before timing out.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("result","SCS cannot generate the host and server keys before timing out"), - ])); - - var msg948 = msg("00528:23", part1520); - - var part1521 = match("MESSAGE#937:00528:24", "nwparser.payload", "SSH: %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg949 = msg("00528:24", part1521); - - var part1522 = match("MESSAGE#938:00528:25/0", "nwparser.payload", "SSH: Admin %{p0}"); - - var part1523 = match("MESSAGE#938:00528:25/2", "nwparser.p0", "at host %{saddr->} attempted to be authenticated with no authentication methods enabled."); - - var all331 = all_match({ - processors: [ - part1522, - dup403, - part1523, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg950 = msg("00528:25", all331); - - var select354 = linear_select([ - msg924, - msg925, - msg926, - msg927, - msg928, - msg929, - msg930, - msg931, - msg932, - msg933, - msg934, - msg935, - msg936, - msg937, - msg938, - msg939, - msg940, - msg941, - msg942, - msg943, - msg944, - msg945, - msg946, - msg947, - msg948, - msg949, - msg950, - ]); - - var part1524 = match("MESSAGE#939:00529/1_0", "nwparser.p0", "manually %{p0}"); - - var part1525 = match("MESSAGE#939:00529/1_1", "nwparser.p0", "automatically %{p0}"); - - var select355 = linear_select([ - part1524, - part1525, - ]); - - var part1526 = match("MESSAGE#939:00529/2", "nwparser.p0", "refreshed%{}"); - - var all332 = all_match({ - processors: [ - dup63, - select355, - part1526, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg951 = msg("00529", all332); - - var part1527 = match("MESSAGE#940:00529:01/0", "nwparser.payload", "DNS entries have been refreshed by %{p0}"); - - var part1528 = match("MESSAGE#940:00529:01/1_0", "nwparser.p0", "state change%{}"); - - var part1529 = match("MESSAGE#940:00529:01/1_1", "nwparser.p0", "HA%{}"); - - var select356 = linear_select([ - part1528, - part1529, - ]); - - var all333 = all_match({ - processors: [ - part1527, - select356, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg952 = msg("00529:01", all333); - - var select357 = linear_select([ - msg951, - msg952, - ]); - - var part1530 = match("MESSAGE#941:00530", "nwparser.payload", "An IP conflict has been detected and the DHCP client has declined address %{hostip}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg953 = msg("00530", part1530); - - var part1531 = match("MESSAGE#942:00530:01/0", "nwparser.payload", "DHCP client IP %{hostip->} for the %{p0}"); - - var part1532 = match("MESSAGE#942:00530:01/2", "nwparser.p0", "%{} %{interface->} has been manually released"); - - var all334 = all_match({ - processors: [ - part1531, - dup337, - part1532, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg954 = msg("00530:01", all334); - - var part1533 = match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get an IP address for the %{interface->} interface", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg955 = msg("00530:02", part1533); - - var part1534 = match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hostip->} has expired", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg956 = msg("00530:03", part1534); - - var part1535 = match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has assigned the untrust Interface %{interface->} with lease %{fld2}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg957 = msg("00530:04", part1535); - - var part1536 = match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has assigned the %{interface->} interface %{fld2->} with lease %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg958 = msg("00530:05", part1536); - - var part1537 = match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get IP address for the untrust interface.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg959 = msg("00530:06", part1537); - - var select358 = linear_select([ - msg953, - msg954, - msg955, - msg956, - msg957, - msg958, - msg959, - ]); - - var part1538 = match("MESSAGE#948:00531/0", "nwparser.payload", "System clock configurations have been changed by admin %{p0}"); - - var all335 = all_match({ - processors: [ - part1538, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg960 = msg("00531", all335); - - var part1539 = match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg961 = msg("00531:01", part1539); - - var part1540 = match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been updated through NTP.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg962 = msg("00531:02", part1540); - - var part1541 = match("MESSAGE#951:00531:03/0", "nwparser.payload", "The system clock was updated from %{type->} NTP server type %{hostname->} with a%{p0}"); - - var part1542 = match("MESSAGE#951:00531:03/1_0", "nwparser.p0", " ms %{p0}"); - - var select359 = linear_select([ - part1542, - dup115, - ]); - - var part1543 = match("MESSAGE#951:00531:03/2", "nwparser.p0", "adjustment of %{fld3}. Authentication was %{fld4}. Update mode was %{p0}"); - - var part1544 = match("MESSAGE#951:00531:03/3_0", "nwparser.p0", "%{fld5}(%{fld2})"); - - var part1545 = match_copy("MESSAGE#951:00531:03/3_1", "nwparser.p0", "fld5"); - - var select360 = linear_select([ - part1544, - part1545, - ]); - - var all336 = all_match({ - processors: [ - part1541, - select359, - part1543, - select360, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup146, - ]), - }); - - var msg963 = msg("00531:03", all336); - - var part1546 = match("MESSAGE#952:00531:04/0", "nwparser.payload", "The NetScreen device is attempting to contact the %{p0}"); - - var part1547 = match("MESSAGE#952:00531:04/1_0", "nwparser.p0", "primary backup %{p0}"); - - var part1548 = match("MESSAGE#952:00531:04/1_1", "nwparser.p0", "secondary backup %{p0}"); - - var select361 = linear_select([ - part1547, - part1548, - dup189, - ]); - - var part1549 = match("MESSAGE#952:00531:04/2", "nwparser.p0", "NTP server %{hostname}"); - - var all337 = all_match({ - processors: [ - part1546, - select361, - part1549, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg964 = msg("00531:04", all337); - - var part1550 = match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contacted. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg965 = msg("00531:05", part1550); - - var part1551 = match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustment of %{fld2->} from NTP server %{hostname->} exceeds the allowed adjustment of %{fld3}. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg966 = msg("00531:06", part1551); - - var part1552 = match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be obtained from any NTP server. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg967 = msg("00531:07", part1552); - - var part1553 = match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator->} changed the %{change_attribute->} from %{change_old->} to %{change_new->} (by %{fld3->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}) (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg968 = msg("00531:08", part1553); - - var part1554 = match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol settings changed. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg969 = msg("00531:09", part1554); - - var part1555 = match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition->} on interface %{interface->} (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg970 = msg("00531:10", part1555); - - var part1556 = match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be changed from %{change_old->} to %{change_new->} received from primary NTP server %{hostip->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","system clock changed based on receive from primary NTP server"), - ])); - - var msg971 = msg("00531:11", part1556); - - var part1557 = match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{saddr->} could not be contacted. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg972 = msg("00531:12", part1557); - - var select362 = linear_select([ - msg960, - msg961, - msg962, - msg963, - msg964, - msg965, - msg966, - msg967, - msg968, - msg969, - msg970, - msg971, - msg972, - ]); - - var part1558 = match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now responding", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg973 = msg("00533", part1558); - - var part1559 = match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg974 = msg("00534", part1559); - - var part1560 = match("MESSAGE#962:00535", "nwparser.payload", "Cannot find the CA certificate with distinguished name %{fld2}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg975 = msg("00535", part1560); - - var part1561 = match("MESSAGE#963:00535:01", "nwparser.payload", "Distinguished name %{dn->} in the X509 certificate request is %{disposition}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg976 = msg("00535:01", part1561); - - var part1562 = match("MESSAGE#964:00535:02", "nwparser.payload", "Local certificate with distinguished name %{dn->} is %{disposition}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg977 = msg("00535:02", part1562); - - var part1563 = match("MESSAGE#965:00535:03", "nwparser.payload", "PKCS #7 data cannot be decapsulated%{}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg978 = msg("00535:03", part1563); - - var part1564 = match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been received from the CA%{}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - setc("result","SCEP_FAILURE message"), - ])); - - var msg979 = msg("00535:04", part1564); - - var part1565 = match("MESSAGE#967:00535:05", "nwparser.payload", "PKI error message has been received: %{result}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg980 = msg("00535:05", part1565); - - var part1566 = match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration (CA cert subject name %{dn}). (%{event_time_string})", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Saved CA configuration - cert subject name"), - ])); - - var msg981 = msg("00535:06", part1566); - - var select363 = linear_select([ - msg975, - msg976, - msg977, - msg978, - msg979, - msg980, - msg981, - ]); - - var part1567 = match("MESSAGE#969:00536:49/0", "nwparser.payload", "IKE %{hostip->} %{p0}"); - - var part1568 = match("MESSAGE#969:00536:49/1_0", "nwparser.p0", "Phase 2 msg ID %{sessionid}: %{disposition}. %{p0}"); - - var part1569 = match("MESSAGE#969:00536:49/1_1", "nwparser.p0", "Phase 1: %{disposition->} %{p0}"); - - var part1570 = match("MESSAGE#969:00536:49/1_2", "nwparser.p0", "phase 2:%{disposition}. %{p0}"); - - var part1571 = match("MESSAGE#969:00536:49/1_3", "nwparser.p0", "phase 1:%{disposition}. %{p0}"); - - var select364 = linear_select([ - part1568, - part1569, - part1570, - part1571, - ]); - - var all338 = all_match({ - processors: [ - part1567, - select364, - dup10, - ], - on_success: processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg982 = msg("00536:49", all338); - - var part1572 = match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received from %{saddr}/%{sport->} at interface %{interface->} at %{daddr}/%{dport}", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg983 = msg("00536", part1572); - - var part1573 = match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2}) without IP address at both end points! Check outgoing interface.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg984 = msg("00536:01", part1573); - - var part1574 = match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip->} in %{fld4->} mode with ID: %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg985 = msg("00536:02", part1574); - - var part1575 = match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has been %{disposition}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg986 = msg("00536:03", part1575); - - var part1576 = match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{group->} has deactivated the SA with ID %{fld2}.", processor_chain([ - setc("eventcategory","1801010100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg987 = msg("00536:04", part1576); - - var part1577 = match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assigned%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg988 = msg("00536:05", part1577); - - var part1578 = match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has changed to %{fld2}. VPNs cannot terminate at an interface with IP %{hostip}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg989 = msg("00536:06", part1578); - - var part1579 = match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has changed from %{change_old->} to another setting", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg990 = msg("00536:07", part1579); - - var part1580 = match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification message", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg991 = msg("00536:08", part1580); - - var part1581 = match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg992 = msg("00536:09", part1581); - - var part1582 = match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a packet with a bad SPI after rebooting", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg993 = msg("00536:10", part1582); - - var part1583 = match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase 2 SAs after receiving a notification message", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg994 = msg("00536:11", part1583); - - var part1584 = match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first Phase 1 packet from an unrecognized source", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg995 = msg("00536:12", part1584); - - var part1585 = match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an initial Phase 1 packet from an unrecognized peer gateway", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg996 = msg("00536:13", part1585); - - var part1586 = match("MESSAGE#984:00536:14/0", "nwparser.payload", "IKE %{hostip}: Received initial contact notification and removed Phase %{p0}"); - - var part1587 = match("MESSAGE#984:00536:14/2", "nwparser.p0", "SAs%{}"); - - var all339 = all_match({ - processors: [ - part1586, - dup383, - part1587, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg997 = msg("00536:14", all339); - - var part1588 = match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a notification message for %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg998 = msg("00536:50", part1588); - - var part1589 = match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incorrect ID payload: IP address %{fld2->} instead of IP address %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg999 = msg("00536:15", part1589); - - var part1590 = match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negotiation request is already in the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1000 = msg("00536:16", part1590); - - var part1591 = match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats have been lost %{fld2->} times", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1001 = msg("00536:17", part1591); - - var part1592 = match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer packet because no policy uses the peer configuration", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1002 = msg("00536:18", part1592); - - var part1593 = match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1003 = msg("00536:19", part1593); - - var part1594 = match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the initial contact task to the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1004 = msg("00536:20", part1594); - - var part1595 = match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 session tasks to the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1005 = msg("00536:21", part1595); - - var part1596 = match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{disposition->} proposals from peer. Negotiations failed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("result","Negotiations failed"), - ])); - - var msg1006 = msg("00536:22", part1596); - - var part1597 = match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Aborted negotiations because the time limit has elapsed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("result","The time limit has elapsed"), - setc("disposition","Aborted"), - ])); - - var msg1007 = msg("00536:23", part1597); - - var part1598 = match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1008 = msg("00536:24", part1598); - - var part1599 = match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Received DH group %{fld2->} instead of expected group %{fld3->} for PFS", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1009 = msg("00536:25", part1599); - - var part1600 = match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No policy exists for the proxy ID received: local ID %{fld2->} remote ID %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1010 = msg("00536:26", part1600); - - var part1601 = match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA private key is needed to sign packets", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1011 = msg("00536:27", part1601); - - var part1602 = match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggressive mode negotiations have %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1012 = msg("00536:28", part1602); - - var part1603 = match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Vendor ID payload indicates that the peer does not support NAT-T", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1013 = msg("00536:29", part1603); - - var part1604 = match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Retransmission limit has been reached", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1014 = msg("00536:30", part1604); - - var part1605 = match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an invalid RSA signature", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1015 = msg("00536:31", part1605); - - var part1606 = match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an incorrect public key authentication method", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1016 = msg("00536:32", part1606); - - var part1607 = match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No private key exists to sign packets", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1017 = msg("00536:33", part1607); - - var part1608 = match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1018 = msg("00536:34", part1608); - - var part1609 = match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE initiator has detected NAT in front of the local device", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1019 = msg("00536:35", part1609); - - var part1610 = match("MESSAGE#1007:00536:36/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Discarded a second initial packet%{p0}"); - - var part1611 = match("MESSAGE#1007:00536:36/2", "nwparser.p0", "%{}which arrived within %{fld2->} after the first"); - - var all340 = all_match({ - processors: [ - part1610, - dup401, - part1611, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1020 = msg("00536:36", all340); - - var part1612 = match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Completed Aggressive mode negotiations with a %{fld2->} lifetime", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1021 = msg("00536:37", part1612); - - var part1613 = match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a subject name that does not match the ID payload", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1022 = msg("00536:38", part1613); - - var part1614 = match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a different IP address %{fld2->} than expected", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1023 = msg("00536:39", part1614); - - var part1615 = match("MESSAGE#1011:00536:40", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot use a preshared key because the peer%{quote}s gateway has a dynamic IP address and negotiations are in Main mode", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1024 = msg("00536:40", part1615); - - var part1616 = match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated negotiations in Aggressive mode", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1025 = msg("00536:47", part1616); - - var part1617 = match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot verify RSA signature", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1026 = msg("00536:41", part1617); - - var part1618 = match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated Main mode negotiations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1027 = msg("00536:42", part1618); - - var part1619 = match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Initiated negotiations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1028 = msg("00536:43", part1619); - - var part1620 = match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heartbeat interval to %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1029 = msg("00536:44", part1620); - - var part1621 = match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats have been %{disposition->} because %{result}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1030 = msg("00536:45", part1621); - - var part1622 = match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{interface->} from %{saddr}:%{sport->} to %{daddr}:%{dport}/%{fld1}. Cookies: %{ike_cookie1}, %{ike_cookie2}. (%{event_time_string})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Received an IKE packet on interface"), - ])); - - var msg1031 = msg("00536:48", part1622); - - var part1623 = match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a bad SPI", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1032 = msg("00536:46", part1623); - - var select365 = linear_select([ - msg982, - msg983, - msg984, - msg985, - msg986, - msg987, - msg988, - msg989, - msg990, - msg991, - msg992, - msg993, - msg994, - msg995, - msg996, - msg997, - msg998, - msg999, - msg1000, - msg1001, - msg1002, - msg1003, - msg1004, - msg1005, - msg1006, - msg1007, - msg1008, - msg1009, - msg1010, - msg1011, - msg1012, - msg1013, - msg1014, - msg1015, - msg1016, - msg1017, - msg1018, - msg1019, - msg1020, - msg1021, - msg1022, - msg1023, - msg1024, - msg1025, - msg1026, - msg1027, - msg1028, - msg1029, - msg1030, - msg1031, - msg1032, - ]); - - var part1624 = match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to establish a session: %{info}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg1033 = msg("00537", part1624); - - var part1625 = match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{result}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1034 = msg("00537:01", part1625); - - var part1626 = match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: %{result}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1035 = msg("00537:02", part1626); - - var part1627 = match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successfully established%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1036 = msg("00537:03", part1627); - - var select366 = linear_select([ - msg1033, - msg1034, - msg1035, - msg1036, - ]); - - var part1628 = match("MESSAGE#1024:00538/0", "nwparser.payload", "NACN failed to register to Policy Manager %{fld2->} because %{p0}"); - - var select367 = linear_select([ - dup111, - dup119, - ]); - - var part1629 = match("MESSAGE#1024:00538/2", "nwparser.p0", "%{result}"); - - var all341 = all_match({ - processors: [ - part1628, - select367, - part1629, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1037 = msg("00538", all341); - - var part1630 = match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered to Policy Manager %{fld2}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1038 = msg("00538:01", part1630); - - var part1631 = match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has started for Policy Manager %{fld2->} on hostname %{hostname->} IP address %{hostip->} port %{network_port}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1039 = msg("00538:02", part1631); - - var part1632 = match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server at %{hostip->} (%{fld2->} connect attempt(s)) %{fld3}", processor_chain([ - dup19, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg1040 = msg("00538:03", part1632); - - var part1633 = match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Global PRO data collector at %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1041 = msg("00538:04", part1633); - - var part1634 = match("MESSAGE#1029:00538:05/0", "nwparser.payload", "Lost %{p0}"); - - var part1635 = match("MESSAGE#1029:00538:05/1_0", "nwparser.p0", "socket connection%{p0}"); - - var part1636 = match("MESSAGE#1029:00538:05/1_1", "nwparser.p0", "connection%{p0}"); - - var select368 = linear_select([ - part1635, - part1636, - ]); - - var part1637 = match("MESSAGE#1029:00538:05/2", "nwparser.p0", "%{}to Global PRO data collector at %{hostip}"); - - var all342 = all_match({ - processors: [ - part1634, - select368, - part1637, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1042 = msg("00538:05", all342); - - var part1638 = match("MESSAGE#1030:00538:06/0", "nwparser.payload", "Device has connected to the Global PRO%{p0}"); - - var part1639 = match("MESSAGE#1030:00538:06/1_0", "nwparser.p0", " %{fld2->} primary data collector at %{p0}"); - - var part1640 = match("MESSAGE#1030:00538:06/1_1", "nwparser.p0", " primary data collector at %{p0}"); - - var select369 = linear_select([ - part1639, - part1640, - ]); - - var part1641 = match_copy("MESSAGE#1030:00538:06/2", "nwparser.p0", "hostip"); - - var all343 = all_match({ - processors: [ - part1638, - select369, - part1641, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1043 = msg("00538:06", all343); - - var part1642 = match("MESSAGE#1031:00538:07/0", "nwparser.payload", "Connection to Global PRO data collector at %{hostip->} has%{p0}"); - - var part1643 = match("MESSAGE#1031:00538:07/1_0", "nwparser.p0", " been%{p0}"); - - var select370 = linear_select([ - part1643, - dup16, - ]); - - var all344 = all_match({ - processors: [ - part1642, - select370, - dup136, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1044 = msg("00538:07", all344); - - var part1644 = match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO data collector at %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1045 = msg("00538:08", part1644); - - var part1645 = match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server at %{hostip->} (%{info}) (%{fld1})", processor_chain([ - dup301, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Connected to NSM server"), - ])); - - var msg1046 = msg("00538:09", part1645); - - var part1646 = match("MESSAGE#1034:00538:10/0", "nwparser.payload", "NSM: Connection to NSM server at %{hostip->} is down. Reason: %{resultcode}, %{result->} (%{p0}"); - - var part1647 = match("MESSAGE#1034:00538:10/1_0", "nwparser.p0", "%{info}) (%{fld1})"); - - var select371 = linear_select([ - part1647, - dup41, - ]); - - var all345 = all_match({ - processors: [ - part1646, - select371, - ], - on_success: processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Connection to NSM server is down"), - ]), - }); - - var msg1047 = msg("00538:10", all345); - - var part1648 = match("MESSAGE#1035:00538:11", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld2->} connect attempt(s)) (%{fld1})", processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - dup323, - ])); - - var msg1048 = msg("00538:11", part1648); - - var part1649 = match("MESSAGE#1036:00538:12", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld1})", processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - dup323, - ])); - - var msg1049 = msg("00538:12", part1649); - - var part1650 = match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Sent 2B message"), - ])); - - var msg1050 = msg("00538:13", part1650); - - var select372 = linear_select([ - msg1037, - msg1038, - msg1039, - msg1040, - msg1041, - msg1042, - msg1043, - msg1044, - msg1045, - msg1046, - msg1047, - msg1048, - msg1049, - msg1050, - ]); - - var part1651 = match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1051 = msg("00539", part1651); - - var part1652 = match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1052 = msg("00539:01", part1652); - - var part1653 = match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from Pool %{group_object->} for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1053 = msg("00539:02", part1653); - - var part1654 = match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to establish a session: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1054 = msg("00539:03", part1654); - - var part1655 = match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has successfully established.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1055 = msg("00539:04", part1655); - - var part1656 = match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned. You cannot allocate an IP address%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1056 = msg("00539:05", part1656); - - var part1657 = match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1057 = msg("00539:06", part1657); - - var select373 = linear_select([ - msg1051, - msg1052, - msg1053, - msg1054, - msg1055, - msg1056, - msg1057, - ]); - - var part1658 = match("MESSAGE#1045:00541", "nwparser.payload", "ScreenOS %{fld2->} serial # %{serial_number}: Asset recovery has been %{disposition}", processor_chain([ - dup324, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1058 = msg("00541", part1658); - - var part1659 = match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2->} IP address - %{hostip->} changed its state to %{change_new}. (%{fld1})", processor_chain([ - dup273, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1059 = msg("00541:01", part1659); - - var part1660 = match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from %{change_old->} to %{change_new->} state, (neighbor router-id 1%{fld2}, ip-address %{hostip}). (%{fld1})", processor_chain([ - dup273, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1060 = msg("00541:02", part1660); - - var part1661 = match("MESSAGE#1219:00541:03/0", "nwparser.payload", "LSA in following area aged out: LSA area ID %{fld3}, LSA ID %{fld4}, router ID %{fld2}, type %{fld7->} in OSPF. (%{fld1})%{p0}"); - - var part1662 = match("MESSAGE#1219:00541:03/1_0", "nwparser.p0", "\u003c\u003c%{fld16}>"); - - var select374 = linear_select([ - part1662, - dup21, - ]); - - var all346 = all_match({ - processors: [ - part1661, - select374, - ], - on_success: processor_chain([ - dup44, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1061 = msg("00541:03", all346); - - var select375 = linear_select([ - msg1058, - msg1059, - msg1060, - msg1061, - ]); - - var part1663 = match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix adding: %{fld2}, ribin overflow %{fld3->} times (max rib-in %{fld4})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1062 = msg("00542", part1663); - - var part1664 = match("MESSAGE#1047:00543/0", "nwparser.payload", "Access for %{p0}"); - - var part1665 = match("MESSAGE#1047:00543/1_0", "nwparser.p0", "WebAuth firewall %{p0}"); - - var part1666 = match("MESSAGE#1047:00543/1_1", "nwparser.p0", "firewall %{p0}"); - - var select376 = linear_select([ - part1665, - part1666, - ]); - - var part1667 = match("MESSAGE#1047:00543/2", "nwparser.p0", "user %{username->} %{space}at %{hostip->} (accepted at %{fld2->} for duration %{duration->} via the %{logon_type}) %{p0}"); - - var part1668 = match("MESSAGE#1047:00543/3_0", "nwparser.p0", "by policy id %{policy_id->} is %{p0}"); - - var select377 = linear_select([ - part1668, - dup106, - ]); - - var part1669 = match("MESSAGE#1047:00543/4", "nwparser.p0", "now over (%{fld1})"); - - var all347 = all_match({ - processors: [ - part1664, - select376, - part1667, - select377, - part1669, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup9, - dup3, - ]), - }); - - var msg1063 = msg("00543", all347); - - var part1670 = match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group %{group->} ] at %{hostip->} has been challenged by the RADIUS server at %{daddr}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup60, - setc("action","RADIUS server challenge"), - ])); - - var msg1064 = msg("00544", part1670); - - var part1671 = match("MESSAGE#1049:00546", "nwparser.payload", "delete-route-> trust-vr: %{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1065 = msg("00546", part1671); - - var part1672 = match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned because max content size was exceeded.", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg1066 = msg("00547", part1672); - - var part1673 = match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned due to a scan engine error or constraint.", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg1067 = msg("00547:01", part1673); - - var part1674 = match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1068 = msg("00547:02", part1674); - - var part1675 = match("MESSAGE#1053:00547:03/0", "nwparser.payload", "AV: Content from %{location_desc}, http url: %{url}, is passed %{p0}"); - - var part1676 = match("MESSAGE#1053:00547:03/1_0", "nwparser.p0", "due to %{p0}"); - - var part1677 = match("MESSAGE#1053:00547:03/1_1", "nwparser.p0", "because %{p0}"); - - var select378 = linear_select([ - part1676, - part1677, - ]); - - var part1678 = match("MESSAGE#1053:00547:03/2", "nwparser.p0", "%{result}. (%{event_time_string})"); - - var all348 = all_match({ - processors: [ - part1675, - select378, - part1678, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Content is bypassed for connection"), - ]), - }); - - var msg1069 = msg("00547:03", all348); - - var select379 = linear_select([ - msg1066, - msg1067, - msg1068, - msg1069, - ]); - - var part1679 = match("MESSAGE#1054:00549", "nwparser.payload", "add-route-> untrust-vr: %{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1070 = msg("00549", part1679); - - var part1680 = match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred during configlet file processing.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1071 = msg("00551", part1680); - - var part1681 = match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurred, causing failure to establish secure management with Management System.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1072 = msg("00551:01", part1681); - - var part1682 = match("MESSAGE#1057:00551:02/0", "nwparser.payload", "Configlet file %{p0}"); - - var part1683 = match("MESSAGE#1057:00551:02/1_0", "nwparser.p0", "decryption %{p0}"); - - var select380 = linear_select([ - part1683, - dup89, - ]); - - var all349 = all_match({ - processors: [ - part1682, - select380, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1073 = msg("00551:02", all349); - - var part1684 = match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot start because gateway has undergone configuration changes. (%{fld1})", processor_chain([ - dup18, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1074 = msg("00551:03", part1684); - - var part1685 = match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management established successfully with remote server. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1075 = msg("00551:04", part1685); - - var select381 = linear_select([ - msg1071, - msg1072, - msg1073, - msg1074, - msg1075, - ]); - - var part1686 = match("MESSAGE#1060:00553/0", "nwparser.payload", "SCAN-MGR: Failed to get %{p0}"); - - var part1687 = match("MESSAGE#1060:00553/1_0", "nwparser.p0", "AltServer %{p0}"); - - var part1688 = match("MESSAGE#1060:00553/1_1", "nwparser.p0", "Version %{p0}"); - - var part1689 = match("MESSAGE#1060:00553/1_2", "nwparser.p0", "Path_GateLockCE %{p0}"); - - var select382 = linear_select([ - part1687, - part1688, - part1689, - ]); - - var all350 = all_match({ - processors: [ - part1686, - select382, - dup325, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1076 = msg("00553", all350); - - var part1690 = match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size from server.ini.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1077 = msg("00553:01", part1690); - - var part1691 = match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from server.ini is too large: %{bytes->} (bytes).", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1078 = msg("00553:02", part1691); - - var part1692 = match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from server.ini is too long: %{fld2}; max is %{fld3}.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1079 = msg("00553:03", part1692); - - var part1693 = match("MESSAGE#1064:00553:04/0", "nwparser.payload", "SCAN-MGR: Failed to retrieve %{p0}"); - - var select383 = linear_select([ - dup326, - dup327, - ]); - - var part1694 = match("MESSAGE#1064:00553:04/2", "nwparser.p0", "file: %{fld2}; http status code: %{resultcode}."); - - var all351 = all_match({ - processors: [ - part1693, - select383, - part1694, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1080 = msg("00553:04", all351); - - var part1695 = match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pattern into a RAM file.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1081 = msg("00553:05", part1695); - - var part1696 = match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File failed: code from VSAPI: %{resultcode}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1082 = msg("00553:06", part1696); - - var part1697 = match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pattern into flash.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1083 = msg("00553:07", part1697); - - var part1698 = match("MESSAGE#1068:00553:08/0", "nwparser.payload", "SCAN-MGR: Internal error while setting up for retrieving %{p0}"); - - var select384 = linear_select([ - dup327, - dup326, - ]); - - var all352 = all_match({ - processors: [ - part1698, - select384, - dup328, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1084 = msg("00553:08", all352); - - var part1699 = match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{disposition}: Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1085 = msg("00553:09", part1699); - - var part1700 = match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{disposition->} due to %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1086 = msg("00553:10", part1700); - - var part1701 = match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern Creation Date(%{fld2}) is after AV Key Expiration date(%{fld3}).", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1087 = msg("00553:11", part1701); - - var part1702 = match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompressLayer %{disposition}: Layer: %{fld2}, Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1088 = msg("00553:12", part1702); - - var part1703 = match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFileSizeLimit %{disposition}: Limit: %{fld2}, Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1089 = msg("00553:13", part1703); - - var part1704 = match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{disposition}: ret: %{fld2}; cpapiErrCode: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1090 = msg("00553:14", part1704); - - var part1705 = match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usage error. Left usage: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1091 = msg("00553:15", part1705); - - var part1706 = match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress layer to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1092 = msg("00553:16", part1706); - - var part1707 = match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum content size to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1093 = msg("00553:17", part1707); - - var part1708 = match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number of concurrent messages to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1094 = msg("00553:18", part1708); - - var part1709 = match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1095 = msg("00553:19", part1709); - - var part1710 = match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to %{fld2}; update interval is %{fld3}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1096 = msg("00553:20", part1710); - - var part1711 = match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1097 = msg("00553:21", part1711); - - var part1712 = match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern updated: version: %{version}, size: %{bytes->} (bytes).", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1098 = msg("00553:22", part1712); - - var select385 = linear_select([ - msg1076, - msg1077, - msg1078, - msg1079, - msg1080, - msg1081, - msg1082, - msg1083, - msg1084, - msg1085, - msg1086, - msg1087, - msg1088, - msg1089, - msg1090, - msg1091, - msg1092, - msg1093, - msg1094, - msg1095, - msg1096, - msg1097, - msg1098, - ]); - - var part1713 = match("MESSAGE#1083:00554/0", "nwparser.payload", "SCAN-MGR: Cannot get %{p0}"); - - var part1714 = match("MESSAGE#1083:00554/1_0", "nwparser.p0", "AltServer info %{p0}"); - - var part1715 = match("MESSAGE#1083:00554/1_1", "nwparser.p0", "Version number %{p0}"); - - var part1716 = match("MESSAGE#1083:00554/1_2", "nwparser.p0", "Path_GateLockCE info %{p0}"); - - var select386 = linear_select([ - part1714, - part1715, - part1716, - ]); - - var all353 = all_match({ - processors: [ - part1713, - select386, - dup325, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1099 = msg("00554", all353); - - var part1717 = match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini file, the AV pattern file size is zero.%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1100 = msg("00554:01", part1717); - - var part1718 = match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file size is too large (%{bytes->} bytes).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1101 = msg("00554:02", part1718); - - var part1719 = match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV pattern file server URL is too long: %{bytes->} bytes. Max: %{fld2->} bytes.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1102 = msg("00554:03", part1719); - - var part1720 = match("MESSAGE#1087:00554:04/0", "nwparser.payload", "SCAN-MGR: Cannot retrieve %{p0}"); - - var part1721 = match("MESSAGE#1087:00554:04/2", "nwparser.p0", "file from %{hostip}:%{network_port}. HTTP status code: %{fld2}."); - - var all354 = all_match({ - processors: [ - part1720, - dup405, - part1721, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1103 = msg("00554:04", all354); - - var part1722 = match("MESSAGE#1088:00554:05/0", "nwparser.payload", "SCAN-MGR: Cannot write AV pattern file to %{p0}"); - - var part1723 = match("MESSAGE#1088:00554:05/1_0", "nwparser.p0", "RAM %{p0}"); - - var part1724 = match("MESSAGE#1088:00554:05/1_1", "nwparser.p0", "flash %{p0}"); - - var select387 = linear_select([ - part1723, - part1724, - ]); - - var all355 = all_match({ - processors: [ - part1722, - select387, - dup116, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1104 = msg("00554:05", all355); - - var part1725 = match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pattern file. VSAPI code: %{fld2}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1105 = msg("00554:06", part1725); - - var part1726 = match("MESSAGE#1090:00554:07/0", "nwparser.payload", "SCAN-MGR: Internal error occurred while retrieving %{p0}"); - - var all356 = all_match({ - processors: [ - part1726, - dup405, - dup328, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1106 = msg("00554:07", all356); - - var part1727 = match("MESSAGE#1091:00554:08/0", "nwparser.payload", "SCAN-MGR: Internal error occurred when calling this function: %{fld2}. %{fld3->} %{p0}"); - - var part1728 = match("MESSAGE#1091:00554:08/1_0", "nwparser.p0", "Error: %{resultcode->} %{p0}"); - - var part1729 = match("MESSAGE#1091:00554:08/1_1", "nwparser.p0", "Returned a NULL VSC handler %{p0}"); - - var part1730 = match("MESSAGE#1091:00554:08/1_2", "nwparser.p0", "cpapiErrCode: %{resultcode->} %{p0}"); - - var select388 = linear_select([ - part1728, - part1729, - part1730, - ]); - - var all357 = all_match({ - processors: [ - part1727, - select388, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1107 = msg("00554:08", all357); - - var part1731 = match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompression layers has been set to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1108 = msg("00554:09", part1731); - - var part1732 = match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content size has been set to %{fld2->} KB.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1109 = msg("00554:10", part1732); - - var part1733 = match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of concurrent messages has been set to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1110 = msg("00554:11", part1733); - - var part1734 = match("MESSAGE#1095:00554:12/0", "nwparser.payload", "SCAN-MGR: Fail mode has been set to %{p0}"); - - var part1735 = match("MESSAGE#1095:00554:12/1_0", "nwparser.p0", "drop %{p0}"); - - var part1736 = match("MESSAGE#1095:00554:12/1_1", "nwparser.p0", "pass %{p0}"); - - var select389 = linear_select([ - part1735, - part1736, - ]); - - var part1737 = match("MESSAGE#1095:00554:12/2", "nwparser.p0", "unexamined traffic if %{p0}"); - - var part1738 = match("MESSAGE#1095:00554:12/3_0", "nwparser.p0", "content size %{p0}"); - - var part1739 = match("MESSAGE#1095:00554:12/3_1", "nwparser.p0", "number of concurrent messages %{p0}"); - - var select390 = linear_select([ - part1738, - part1739, - ]); - - var part1740 = match("MESSAGE#1095:00554:12/4", "nwparser.p0", "exceeds max.%{}"); - - var all358 = all_match({ - processors: [ - part1734, - select389, - part1737, - select390, - part1740, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1111 = msg("00554:12", all358); - - var part1741 = match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been set to %{fld2}, and the update interval to %{fld3->} minutes.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1112 = msg("00554:13", part1741); - - var part1742 = match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1113 = msg("00554:14", part1742); - - var part1743 = match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern file has been updated. Version: %{version}; size: %{bytes->} bytes.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1114 = msg("00554:15", part1743); - - var part1744 = match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1115 = msg("00554:16", part1744); - - var part1745 = match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load AV pattern file created %{fld2->} after the AV subscription expired. (Exp: %{fld3})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1116 = msg("00554:17", part1745); - - var select391 = linear_select([ - msg1099, - msg1100, - msg1101, - msg1102, - msg1103, - msg1104, - msg1105, - msg1106, - msg1107, - msg1108, - msg1109, - msg1110, - msg1111, - msg1112, - msg1113, - msg1114, - msg1115, - msg1116, - ]); - - var part1746 = match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot process non-multicast address %{hostip}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1117 = msg("00555", part1746); - - var part1747 = match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a request. Reason: %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1118 = msg("00556", part1747); - - var part1748 = match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a transaction. Reason: %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1119 = msg("00556:01", part1748); - - var part1749 = match("MESSAGE#1104:00556:02/0", "nwparser.payload", "UF-MGR: UF %{p0}"); - - var part1750 = match("MESSAGE#1104:00556:02/1_0", "nwparser.p0", "K%{p0}"); - - var part1751 = match("MESSAGE#1104:00556:02/1_1", "nwparser.p0", "k%{p0}"); - - var select392 = linear_select([ - part1750, - part1751, - ]); - - var part1752 = match("MESSAGE#1104:00556:02/2", "nwparser.p0", "ey %{p0}"); - - var part1753 = match("MESSAGE#1104:00556:02/3_0", "nwparser.p0", "Expired%{p0}"); - - var part1754 = match("MESSAGE#1104:00556:02/3_1", "nwparser.p0", "expired%{p0}"); - - var select393 = linear_select([ - part1753, - part1754, - ]); - - var part1755 = match("MESSAGE#1104:00556:02/4", "nwparser.p0", "%{}(expiration date: %{fld2}; current date: %{fld3})."); - - var all359 = all_match({ - processors: [ - part1749, - select392, - part1752, - select393, - part1755, - ], - on_success: processor_chain([ - dup254, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1120 = msg("00556:02", all359); - - var part1756 = match("MESSAGE#1105:00556:03/0", "nwparser.payload", "UF-MGR: Failed to %{p0}"); - - var part1757 = match("MESSAGE#1105:00556:03/1_0", "nwparser.p0", "enable %{p0}"); - - var part1758 = match("MESSAGE#1105:00556:03/1_1", "nwparser.p0", "disable %{p0}"); - - var select394 = linear_select([ - part1757, - part1758, - ]); - - var part1759 = match("MESSAGE#1105:00556:03/2", "nwparser.p0", "cache.%{}"); - - var all360 = all_match({ - processors: [ - part1756, - select394, - part1759, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1121 = msg("00556:03", all360); - - var part1760 = match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{resultcode}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1122 = msg("00556:04", part1760); - - var part1761 = match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed to %{fld2}(K).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1123 = msg("00556:05", part1761); - - var part1762 = match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout changes to %{fld2->} (hours).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1124 = msg("00556:06", part1762); - - var part1763 = match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update interval changed to %{fld2->} (weeks).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1125 = msg("00556:07", part1763); - - var part1764 = match("MESSAGE#1110:00556:08/0", "nwparser.payload", "UF-MGR: Cache %{p0}"); - - var all361 = all_match({ - processors: [ - part1764, - dup358, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1126 = msg("00556:08", all361); - - var part1765 = match("MESSAGE#1111:00556:09", "nwparser.payload", "UF-MGR: URL BLOCKED: ip_addr (%{fld2}) -> ip_addr (%{fld3}), %{fld4->} action: %{disposition}, category: %{fld5}, reason %{result}", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - dup282, - ])); - - var msg1127 = msg("00556:09", part1765); - - var part1766 = match("MESSAGE#1112:00556:10", "nwparser.payload", "UF-MGR: URL FILTER ERR: ip_addr (%{fld2}) -> ip_addr (%{fld3}), host: %{fld5->} page: %{fld4->} code: %{resultcode->} reason: %{result}.", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1128 = msg("00556:10", part1766); - - var part1767 = match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server changed to %{fld2}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1129 = msg("00556:11", part1767); - - var part1768 = match("MESSAGE#1114:00556:12/0", "nwparser.payload", "UF-MGR: %{fld2->} CPA server %{p0}"); - - var select395 = linear_select([ - dup140, - dup169, - ]); - - var part1769 = match("MESSAGE#1114:00556:12/2", "nwparser.p0", "changed to %{fld3}."); - - var all362 = all_match({ - processors: [ - part1768, - select395, - part1769, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1130 = msg("00556:12", all362); - - var part1770 = match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filtering %{disposition}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1131 = msg("00556:13", part1770); - - var part1771 = match("MESSAGE#1116:00556:14/0", "nwparser.payload", "UF-MGR: The url %{url->} was %{p0}"); - - var part1772 = match("MESSAGE#1116:00556:14/2", "nwparser.p0", "category %{fld2}."); - - var all363 = all_match({ - processors: [ - part1771, - dup406, - part1772, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1132 = msg("00556:14", all363); - - var part1773 = match("MESSAGE#1117:00556:15/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was %{p0}"); - - var part1774 = match("MESSAGE#1117:00556:15/2", "nwparser.p0", "profile %{fld3->} with action %{disposition}."); - - var all364 = all_match({ - processors: [ - part1773, - dup406, - part1774, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - dup282, - ]), - }); - - var msg1133 = msg("00556:15", all364); - - var part1775 = match("MESSAGE#1118:00556:16/0", "nwparser.payload", "UF-MGR: The %{p0}"); - - var part1776 = match("MESSAGE#1118:00556:16/1_0", "nwparser.p0", "profile %{p0}"); - - var part1777 = match("MESSAGE#1118:00556:16/1_1", "nwparser.p0", "category %{p0}"); - - var select396 = linear_select([ - part1776, - part1777, - ]); - - var part1778 = match("MESSAGE#1118:00556:16/2", "nwparser.p0", "%{fld2->} was %{p0}"); - - var select397 = linear_select([ - dup104, - dup120, - ]); - - var all365 = all_match({ - processors: [ - part1775, - select396, - part1778, - select397, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1134 = msg("00556:16", all365); - - var part1779 = match("MESSAGE#1119:00556:17/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was set in profile %{profile->} as the %{p0}"); - - var part1780 = match("MESSAGE#1119:00556:17/1_0", "nwparser.p0", "black %{p0}"); - - var part1781 = match("MESSAGE#1119:00556:17/1_1", "nwparser.p0", "white %{p0}"); - - var select398 = linear_select([ - part1780, - part1781, - ]); - - var part1782 = match("MESSAGE#1119:00556:17/2", "nwparser.p0", "list.%{}"); - - var all366 = all_match({ - processors: [ - part1779, - select398, - part1782, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1135 = msg("00556:17", all366); - - var part1783 = match("MESSAGE#1120:00556:18/0", "nwparser.payload", "UF-MGR: The action for %{fld2->} in profile %{profile->} was %{p0}"); - - var part1784 = match("MESSAGE#1120:00556:18/1_1", "nwparser.p0", "changed %{p0}"); - - var select399 = linear_select([ - dup101, - part1784, - ]); - - var part1785 = match("MESSAGE#1120:00556:18/2", "nwparser.p0", "to %{fld3}."); - - var all367 = all_match({ - processors: [ - part1783, - select399, - part1785, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1136 = msg("00556:18", all367); - - var part1786 = match("MESSAGE#1121:00556:20/0", "nwparser.payload", "UF-MGR: The category list from the CPA server %{p0}"); - - var part1787 = match("MESSAGE#1121:00556:20/2", "nwparser.p0", "updated on%{p0}"); - - var select400 = linear_select([ - dup103, - dup96, - ]); - - var part1788 = match("MESSAGE#1121:00556:20/4", "nwparser.p0", "the device.%{}"); - - var all368 = all_match({ - processors: [ - part1786, - dup355, - part1787, - select400, - part1788, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1137 = msg("00556:20", all368); - - var part1789 = match("MESSAGE#1122:00556:21", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} action: %{disposition}, category: %{category}, reason: %{result->} (%{fld1})", processor_chain([ - dup232, - dup2, - dup3, - dup9, - dup4, - dup5, - dup282, - ])); - - var msg1138 = msg("00556:21", part1789); - - var part1790 = match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} (%{fld1})", processor_chain([ - dup232, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1139 = msg("00556:22", part1790); - - var select401 = linear_select([ - msg1118, - msg1119, - msg1120, - msg1121, - msg1122, - msg1123, - msg1124, - msg1125, - msg1126, - msg1127, - msg1128, - msg1129, - msg1130, - msg1131, - msg1132, - msg1133, - msg1134, - msg1135, - msg1136, - msg1137, - msg1138, - msg1139, - ]); - - var part1791 = match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interface->} is %{fld2}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1140 = msg("00572", part1791); - - var part1792 = match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on interface %{interface}: %{result}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1141 = msg("00572:01", part1792); - - var part1793 = match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface->} is %{disposition->} by receiving Terminate-Request. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1142 = msg("00572:03", part1793); - - var select402 = linear_select([ - msg1140, - msg1141, - msg1142, - ]); - - var part1794 = match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" rebuilding lookup tree for virtual router \"%{node}\". (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1143 = msg("00615", part1794); - - var part1795 = match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" lookup tree rebuilt successfully in virtual router \"%{node}\". (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1144 = msg("00615:01", part1795); - - var select403 = linear_select([ - msg1143, - msg1144, - ]); - - var part1796 = match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}, through policy %{policyname}. Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ])); - - var msg1145 = msg("00601", part1796); - - var part1797 = match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detected from %{saddr}/%{sport->} to %{daddr}/%{dport->} through policy %{policyname->} %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ])); - - var msg1146 = msg("00601:01", part1797); - - var part1798 = match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multicast.%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1147 = msg("00601:18", part1798); - - var select404 = linear_select([ - msg1145, - msg1146, - msg1147, - ]); - - var part1799 = match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing interface state change%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1148 = msg("00602", part1799); - - var part1800 = match("MESSAGE#1133:00612/0", "nwparser.payload", "Switch event: the status of ethernet port %{fld2->} changed to link %{p0}"); - - var part1801 = match("MESSAGE#1133:00612/2", "nwparser.p0", ", duplex %{p0}"); - - var part1802 = match("MESSAGE#1133:00612/3_0", "nwparser.p0", "full %{p0}"); - - var part1803 = match("MESSAGE#1133:00612/3_1", "nwparser.p0", "half %{p0}"); - - var select405 = linear_select([ - part1802, - part1803, - ]); - - var part1804 = match("MESSAGE#1133:00612/4", "nwparser.p0", ", speed 10%{p0}"); - - var part1805 = match("MESSAGE#1133:00612/5_0", "nwparser.p0", "0 %{p0}"); - - var select406 = linear_select([ - part1805, - dup96, - ]); - - var part1806 = match("MESSAGE#1133:00612/6", "nwparser.p0", "M. (%{fld1})"); - - var all369 = all_match({ - processors: [ - part1800, - dup353, - part1801, - select405, - part1804, - select406, - part1806, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1149 = msg("00612", all369); - - var part1807 = match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send all the DRP routes to backup device. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1150 = msg("00620", part1807); - - var part1808 = match("MESSAGE#1135:00620:01/0", "nwparser.payload", "RTSYNC: %{p0}"); - - var part1809 = match("MESSAGE#1135:00620:01/1_0", "nwparser.p0", "Serviced%{p0}"); - - var part1810 = match("MESSAGE#1135:00620:01/1_1", "nwparser.p0", "Recieved%{p0}"); - - var select407 = linear_select([ - part1809, - part1810, - ]); - - var part1811 = match("MESSAGE#1135:00620:01/2", "nwparser.p0", "%{}coldstart request for route synchronization from NSRP peer. (%{fld1})"); - - var all370 = all_match({ - processors: [ - part1808, - select407, - part1811, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1151 = msg("00620:01", all370); - - var part1812 = match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to purge all the DRP backup routes - %{fld2->} (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1152 = msg("00620:02", part1812); - - var part1813 = match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purge backup routes in all vrouters. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1153 = msg("00620:03", part1813); - - var part1814 = match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the DRP backup routes is stopped. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1154 = msg("00620:04", part1814); - - var select408 = linear_select([ - msg1150, - msg1151, - msg1152, - msg1153, - msg1154, - ]); - - var part1815 = match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual router %{node->} is created. (%{fld1})", processor_chain([ - dup273, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1155 = msg("00622", part1815); - - var part1816 = match("MESSAGE#1140:00625/0", "nwparser.payload", "Session (id %{sessionid->} src-ip %{saddr->} dst-ip %{daddr->} dst port %{dport}) route is %{p0}"); - - var part1817 = match("MESSAGE#1140:00625/1_0", "nwparser.p0", "invalid%{p0}"); - - var part1818 = match("MESSAGE#1140:00625/1_1", "nwparser.p0", "valid%{p0}"); - - var select409 = linear_select([ - part1817, - part1818, - ]); - - var all371 = all_match({ - processors: [ - part1816, - select409, - dup49, - ], - on_success: processor_chain([ - dup273, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1156 = msg("00625", all371); - - var part1819 = match("MESSAGE#1141:00628/0", "nwparser.payload", "audit log queue %{p0}"); - - var part1820 = match("MESSAGE#1141:00628/1_0", "nwparser.p0", "Traffic Log %{p0}"); - - var part1821 = match("MESSAGE#1141:00628/1_1", "nwparser.p0", "Event Alarm Log %{p0}"); - - var part1822 = match("MESSAGE#1141:00628/1_2", "nwparser.p0", "Event Log %{p0}"); - - var select410 = linear_select([ - part1820, - part1821, - part1822, - ]); - - var part1823 = match("MESSAGE#1141:00628/2", "nwparser.p0", "is overwritten (%{fld1})"); - - var all372 = all_match({ - processors: [ - part1819, - select410, - part1823, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1157 = msg("00628", all372); - - var part1824 = match("MESSAGE#1142:00767:50", "nwparser.payload", "Log setting was modified to %{disposition->} %{fld2->} level by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - dup282, - ])); - - var msg1158 = msg("00767:50", part1824); - - var part1825 = match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1159 = msg("00767:51", part1825); - - var part1826 = match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1160 = msg("00767:52", part1826); - - var part1827 = match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is added to attack group %{group->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1161 = msg("00767:53", part1827); - - var part1828 = match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID server%{}", processor_chain([ - dup27, - setc("ec_theme","Communication"), - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1162 = msg("00767", part1828); - - var part1829 = match("MESSAGE#1147:00767:01/0", "nwparser.payload", "System auto-config of file %{fld2->} from TFTP server %{hostip->} has %{p0}"); - - var part1830 = match("MESSAGE#1147:00767:01/1_0", "nwparser.p0", "been loaded successfully%{}"); - - var part1831 = match("MESSAGE#1147:00767:01/1_1", "nwparser.p0", "failed%{}"); - - var select411 = linear_select([ - part1830, - part1831, - ]); - - var all373 = all_match({ - processors: [ - part1829, - select411, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1163 = msg("00767:01", all373); - - var part1832 = match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config saved from host %{saddr}", processor_chain([ - setc("eventcategory","1702000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1164 = msg("00767:02", part1832); - - var part1833 = match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filename %{filename}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1165 = msg("00767:03", part1833); - - var part1834 = match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1166 = msg("00767:04", part1834); - - var part1835 = match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact the SecurID server%{}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1167 = msg("00767:05", part1835); - - var part1836 = match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data to the SecurID server%{}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1168 = msg("00767:06", part1836); - - var part1837 = match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was saved from peer unit by admin%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1169 = msg("00767:07", part1837); - - var part1838 = match("MESSAGE#1154:00767:08/0", "nwparser.payload", "The system configuration was saved by admin %{p0}"); - - var all374 = all_match({ - processors: [ - part1838, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1170 = msg("00767:08", all374); - - var part1839 = match("MESSAGE#1155:00767:09/0", "nwparser.payload", "traffic shaping is turned O%{p0}"); - - var part1840 = match("MESSAGE#1155:00767:09/1_0", "nwparser.p0", "N%{}"); - - var part1841 = match("MESSAGE#1155:00767:09/1_1", "nwparser.p0", "FF%{}"); - - var select412 = linear_select([ - part1840, - part1841, - ]); - - var all375 = all_match({ - processors: [ - part1839, - select412, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1171 = msg("00767:09", all375); - - var part1842 = match("MESSAGE#1156:00767:10/0", "nwparser.payload", "The system configuration was saved from host %{saddr->} by admin %{p0}"); - - var all376 = all_match({ - processors: [ - part1842, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1172 = msg("00767:10", all376); - - var part1843 = match("MESSAGE#1157:00767:11/0", "nwparser.payload", "Fatal error. The NetScreen device was unable to upgrade the %{p0}"); - - var part1844 = match("MESSAGE#1157:00767:11/1_1", "nwparser.p0", "file system %{p0}"); - - var select413 = linear_select([ - dup331, - part1844, - ]); - - var part1845 = match("MESSAGE#1157:00767:11/2", "nwparser.p0", ", and the %{p0}"); - - var part1846 = match("MESSAGE#1157:00767:11/3_1", "nwparser.p0", "old file system %{p0}"); - - var select414 = linear_select([ - dup331, - part1846, - ]); - - var part1847 = match("MESSAGE#1157:00767:11/4", "nwparser.p0", "is damaged.%{}"); - - var all377 = all_match({ - processors: [ - part1843, - select413, - part1845, - select414, - part1847, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1173 = msg("00767:11", all377); - - var part1848 = match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1174 = msg("00767:12", part1848); - - var part1849 = match("MESSAGE#1159:00767:13/0", "nwparser.payload", "%{fld2}Environment variable %{fld3->} is changed to %{fld4->} by admin %{p0}"); - - var all378 = all_match({ - processors: [ - part1849, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1175 = msg("00767:13", all378); - - var part1850 = match("MESSAGE#1160:00767:14/0", "nwparser.payload", "System was %{p0}"); - - var part1851 = match("MESSAGE#1160:00767:14/1_0", "nwparser.p0", "reset %{p0}"); - - var select415 = linear_select([ - part1851, - dup262, - ]); - - var part1852 = match("MESSAGE#1160:00767:14/2", "nwparser.p0", "at %{fld2->} by %{p0}"); - - var part1853 = match("MESSAGE#1160:00767:14/3_0", "nwparser.p0", "admin %{administrator}"); - - var part1854 = match_copy("MESSAGE#1160:00767:14/3_1", "nwparser.p0", "username"); - - var select416 = linear_select([ - part1853, - part1854, - ]); - - var all379 = all_match({ - processors: [ - part1850, - select415, - part1852, - select416, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1176 = msg("00767:14", all379); - - var part1855 = match("MESSAGE#1161:00767:15/1_0", "nwparser.p0", "System %{p0}"); - - var part1856 = match("MESSAGE#1161:00767:15/1_1", "nwparser.p0", "Event %{p0}"); - - var part1857 = match("MESSAGE#1161:00767:15/1_2", "nwparser.p0", "Traffic %{p0}"); - - var select417 = linear_select([ - part1855, - part1856, - part1857, - ]); - - var part1858 = match("MESSAGE#1161:00767:15/2", "nwparser.p0", "log was reviewed by %{p0}"); - - var part1859 = match("MESSAGE#1161:00767:15/4", "nwparser.p0", "%{} %{username}."); - - var all380 = all_match({ - processors: [ - dup183, - select417, - part1858, - dup336, - part1859, - ], - on_success: processor_chain([ - dup223, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1177 = msg("00767:15", all380); - - var part1860 = match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administrator->} issued command %{info->} to redirect output.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1178 = msg("00767:16", part1860); - - var part1861 = match("MESSAGE#1163:00767:17/0", "nwparser.payload", "%{fld2->} Save new software from %{fld3->} to flash by admin %{p0}"); - - var all381 = all_match({ - processors: [ - part1861, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1179 = msg("00767:17", all381); - - var part1862 = match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{version->} has been %{fld2->} saved to flash.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1180 = msg("00767:18", part1862); - - var part1863 = match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{version->} was rejected because the authentication check failed.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1181 = msg("00767:19", part1863); - - var part1864 = match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version of the RADIUS server %{hostname->} does not match %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1182 = msg("00767:20", part1864); - - var part1865 = match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, %{fld4}) cleared %{fld5}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1183 = msg("00767:21", part1865); - - var part1866 = match("MESSAGE#1168:00767:22/0", "nwparser.payload", "The system configuration was not saved %{p0}"); - - var part1867 = match("MESSAGE#1168:00767:22/1_0", "nwparser.p0", "%{fld2->} by admin %{administrator->} via NSRP Peer %{p0}"); - - var part1868 = match("MESSAGE#1168:00767:22/1_1", "nwparser.p0", "%{fld2->} %{p0}"); - - var select418 = linear_select([ - part1867, - part1868, - ]); - - var part1869 = match("MESSAGE#1168:00767:22/2", "nwparser.p0", "by administrator %{fld3}. %{p0}"); - - var part1870 = match("MESSAGE#1168:00767:22/3_0", "nwparser.p0", "It was locked %{p0}"); - - var part1871 = match("MESSAGE#1168:00767:22/3_1", "nwparser.p0", "Locked %{p0}"); - - var select419 = linear_select([ - part1870, - part1871, - ]); - - var part1872 = match("MESSAGE#1168:00767:22/4", "nwparser.p0", "by administrator %{fld4->} %{p0}"); - - var all382 = all_match({ - processors: [ - part1866, - select418, - part1869, - select419, - part1872, - dup354, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1184 = msg("00767:22", all382); - - var part1873 = match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot filename %{filename->} to flash memory by administrator %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1185 = msg("00767:23", part1873); - - var part1874 = match("MESSAGE#1170:00767:25/0", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from %{p0}"); - - var select420 = linear_select([ - dup169, - dup16, - ]); - - var part1875 = match("MESSAGE#1170:00767:25/3_0", "nwparser.p0", "%{saddr}:%{sport->} by %{p0}"); - - var part1876 = match("MESSAGE#1170:00767:25/3_1", "nwparser.p0", "%{saddr->} by %{p0}"); - - var select421 = linear_select([ - part1875, - part1876, - ]); - - var all383 = all_match({ - processors: [ - part1874, - select420, - dup23, - select421, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1186 = msg("00767:25", all383); - - var part1877 = match("MESSAGE#1171:00767:26/0", "nwparser.payload", "Lock configuration %{p0}"); - - var part1878 = match("MESSAGE#1171:00767:26/1_0", "nwparser.p0", "started%{p0}"); - - var part1879 = match("MESSAGE#1171:00767:26/1_1", "nwparser.p0", "ended%{p0}"); - - var select422 = linear_select([ - part1878, - part1879, - ]); - - var part1880 = match("MESSAGE#1171:00767:26/2", "nwparser.p0", "%{}by task %{p0}"); - - var part1881 = match("MESSAGE#1171:00767:26/3_0", "nwparser.p0", "%{fld3}, with a timeout value of %{fld2}"); - - var part1882 = match("MESSAGE#1171:00767:26/3_1", "nwparser.p0", "%{fld2->} (%{fld1})"); - - var select423 = linear_select([ - part1881, - part1882, - ]); - - var all384 = all_match({ - processors: [ - part1877, - select422, - part1880, - select423, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1187 = msg("00767:26", all384); - - var part1883 = match("MESSAGE#1172:00767:27/0", "nwparser.payload", "Environment variable %{fld2->} changed to %{p0}"); - - var part1884 = match("MESSAGE#1172:00767:27/1_0", "nwparser.p0", "%{fld3->} by %{username->} (%{fld1})"); - - var part1885 = match_copy("MESSAGE#1172:00767:27/1_1", "nwparser.p0", "fld3"); - - var select424 = linear_select([ - part1884, - part1885, - ]); - - var all385 = all_match({ - processors: [ - part1883, - select424, - ], - on_success: processor_chain([ - dup223, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1188 = msg("00767:27", all385); - - var part1886 = match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was loaded from IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1189 = msg("00767:28", part1886); - - var part1887 = match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1190 = msg("00767:29", part1887); - - var part1888 = match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configuration was saved from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1191 = msg("00767:30", part1888); - - var part1889 = match("MESSAGE#1176:00767:31/1_0", "nwparser.p0", "logged events or alarms %{p0}"); - - var part1890 = match("MESSAGE#1176:00767:31/1_1", "nwparser.p0", "traffic logs %{p0}"); - - var select425 = linear_select([ - part1889, - part1890, - ]); - - var part1891 = match("MESSAGE#1176:00767:31/2", "nwparser.p0", "were cleared by admin %{p0}"); - - var all386 = all_match({ - processors: [ - dup186, - select425, - part1891, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1192 = msg("00767:31", all386); - - var part1892 = match("MESSAGE#1177:00767:32/0", "nwparser.payload", "SIP parser error %{p0}"); - - var part1893 = match("MESSAGE#1177:00767:32/1_0", "nwparser.p0", "SIP-field%{p0}"); - - var part1894 = match("MESSAGE#1177:00767:32/1_1", "nwparser.p0", "Message%{p0}"); - - var select426 = linear_select([ - part1893, - part1894, - ]); - - var part1895 = match("MESSAGE#1177:00767:32/2", "nwparser.p0", ": %{result}(%{fld1})"); - - var all387 = all_match({ - processors: [ - part1892, - select426, - part1895, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1193 = msg("00767:32", all387); - - var part1896 = match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has started. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1194 = msg("00767:33", part1896); - - var part1897 = match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not support multiple IP addresses %{hostip->} or ports %{network_port->} in SIP headers RESPONSE (%{fld1})", processor_chain([ - dup313, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1195 = msg("00767:34", part1897); - - var part1898 = match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2->} set to %{fld3->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1196 = msg("00767:35", part1898); - - var part1899 = match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved from %{fld2->} by %{username->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1197 = msg("00767:36", part1899); - - var part1900 = match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to download to enable advanced features. %{space->} To find out, please visit %{url->} (%{fld1})", processor_chain([ - dup254, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1198 = msg("00767:37", part1900); - - var part1901 = match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and remaining messages were sent to external destination. %{fld2->} packets were dropped. (%{fld1})", processor_chain([ - setc("eventcategory","1602000000"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1199 = msg("00767:38", part1901); - - var part1902 = match("MESSAGE#1184:00767:39/0", "nwparser.payload", "Cannot %{p0}"); - - var part1903 = match("MESSAGE#1184:00767:39/1_0", "nwparser.p0", "download %{p0}"); - - var part1904 = match("MESSAGE#1184:00767:39/1_1", "nwparser.p0", "parse %{p0}"); - - var select427 = linear_select([ - part1903, - part1904, - ]); - - var part1905 = match("MESSAGE#1184:00767:39/2", "nwparser.p0", "attack database %{p0}"); - - var part1906 = match("MESSAGE#1184:00767:39/3_0", "nwparser.p0", "from %{url->} (%{result}). %{p0}"); - - var part1907 = match("MESSAGE#1184:00767:39/3_1", "nwparser.p0", "%{fld2->} %{p0}"); - - var select428 = linear_select([ - part1906, - part1907, - ]); - - var all388 = all_match({ - processors: [ - part1902, - select427, - part1905, - select428, - dup10, - ], - on_success: processor_chain([ - dup324, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1200 = msg("00767:39", all388); - - var part1908 = match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key is %{disposition}. (%{fld1})", processor_chain([ - dup62, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1201 = msg("00767:40", part1908); - - var part1909 = match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1202 = msg("00767:42", part1909); - - var part1910 = match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1203 = msg("00767:43", part1910); - - var part1911 = match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind by %{fld2->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1204 = msg("00767:44", part1911); - - var part1912 = match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{version->} is saved to flash. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1205 = msg("00767:45", part1912); - - var part1913 = match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved by netscreen via %{logon_type->} by netscreen. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1206 = msg("00767:46", part1913); - - var part1914 = match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs to a different group in the RADIUS server than that allowed in the device. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg1207 = msg("00767:47", part1914); - - var part1915 = match("MESSAGE#1192:00767:24/0", "nwparser.payload", "System configuration saved by %{p0}"); - - var part1916 = match("MESSAGE#1192:00767:24/2", "nwparser.p0", "%{logon_type->} by %{fld2->} (%{fld1})"); - - var all389 = all_match({ - processors: [ - part1915, - dup364, - part1916, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1208 = msg("00767:24", all389); - - var part1917 = match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1209 = msg("00767:48", part1917); - - var part1918 = match("MESSAGE#1194:00767:49/0", "nwparser.payload", "%{fld2->} turn o%{p0}"); - - var part1919 = match("MESSAGE#1194:00767:49/1_0", "nwparser.p0", "n%{p0}"); - - var part1920 = match("MESSAGE#1194:00767:49/1_1", "nwparser.p0", "ff%{p0}"); - - var select429 = linear_select([ - part1919, - part1920, - ]); - - var part1921 = match("MESSAGE#1194:00767:49/2", "nwparser.p0", "%{}debug switch for %{fld3->} (%{fld1})"); - - var all390 = all_match({ - processors: [ - part1918, - select429, - part1921, - ], - on_success: processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1210 = msg("00767:49", all390); - - var select430 = linear_select([ - msg1158, - msg1159, - msg1160, - msg1161, - msg1162, - msg1163, - msg1164, - msg1165, - msg1166, - msg1167, - msg1168, - msg1169, - msg1170, - msg1171, - msg1172, - msg1173, - msg1174, - msg1175, - msg1176, - msg1177, - msg1178, - msg1179, - msg1180, - msg1181, - msg1182, - msg1183, - msg1184, - msg1185, - msg1186, - msg1187, - msg1188, - msg1189, - msg1190, - msg1191, - msg1192, - msg1193, - msg1194, - msg1195, - msg1196, - msg1197, - msg1198, - msg1199, - msg1200, - msg1201, - msg1202, - msg1203, - msg1204, - msg1205, - msg1206, - msg1207, - msg1208, - msg1209, - msg1210, - ]); - - var part1922 = match("MESSAGE#1195:01269", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup277, - dup3, - dup275, - dup60, - ])); - - var msg1211 = msg("01269", part1922); - - var msg1212 = msg("01269:01", dup407); - - var msg1213 = msg("01269:02", dup408); - - var msg1214 = msg("01269:03", dup409); - - var select431 = linear_select([ - msg1211, - msg1212, - msg1213, - msg1214, - ]); - - var part1923 = match("MESSAGE#1199:17852", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup276, - dup277, - dup275, - dup332, - ])); - - var msg1215 = msg("17852", part1923); - - var part1924 = match("MESSAGE#1200:17852:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1216 = msg("17852:01", part1924); - - var part1925 = match("MESSAGE#1201:17852:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var msg1217 = msg("17852:02", part1925); - - var part1926 = match("MESSAGE#1202:17852:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1218 = msg("17852:03", part1926); - - var select432 = linear_select([ - msg1215, - msg1216, - msg1217, - msg1218, - ]); - - var msg1219 = msg("23184", dup410); - - var part1927 = match("MESSAGE#1204:23184:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup61, - dup282, - ])); - - var msg1220 = msg("23184:01", part1927); - - var part1928 = match("MESSAGE#1205:23184:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup276, - dup277, - dup275, - dup61, - ])); - - var msg1221 = msg("23184:02", part1928); - - var part1929 = match("MESSAGE#1206:23184:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1222 = msg("23184:03", part1929); - - var select433 = linear_select([ - msg1219, - msg1220, - msg1221, - msg1222, - ]); - - var msg1223 = msg("27052", dup410); - - var part1930 = match("MESSAGE#1208:27052:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol}direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup61, - dup282, - ])); - - var msg1224 = msg("27052:01", part1930); - - var select434 = linear_select([ - msg1223, - msg1224, - ]); - - var part1931 = match("MESSAGE#1209:39568", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup277, - dup5, - dup274, - dup3, - dup275, - dup276, - dup60, - ])); - - var msg1225 = msg("39568", part1931); - - var msg1226 = msg("39568:01", dup407); - - var msg1227 = msg("39568:02", dup408); - - var msg1228 = msg("39568:03", dup409); - - var select435 = linear_select([ - msg1225, - msg1226, - msg1227, - msg1228, - ]); - - var chain1 = processor_chain([ - select2, - msgid_select({ - "00001": select6, - "00002": select29, - "00003": select31, - "00004": select33, - "00005": select39, - "00006": select40, - "00007": select63, - "00008": select66, - "00009": select83, - "00010": select86, - "00011": select100, - "00012": select101, - "00013": select102, - "00014": select104, - "00015": select114, - "00016": select115, - "00017": select125, - "00018": select138, - "00019": select147, - "00020": select150, - "00021": select151, - "00022": select163, - "00023": select164, - "00024": select170, - "00025": select171, - "00026": select176, - "00027": select184, - "00028": msg469, - "00029": select188, - "00030": select197, - "00031": select205, - "00032": select207, - "00033": select214, - "00034": select225, - "00035": select232, - "00036": select234, - "00037": select241, - "00038": msg660, - "00039": msg661, - "00040": select244, - "00041": select245, - "00042": select246, - "00043": msg668, - "00044": select248, - "00045": msg671, - "00047": msg672, - "00048": select257, - "00049": select258, - "00050": msg682, - "00051": msg683, - "00052": msg684, - "00055": select265, - "00056": msg696, - "00057": msg697, - "00058": msg698, - "00059": select272, - "00062": select273, - "00063": msg713, - "00064": select274, - "00070": select276, - "00071": select277, - "00072": select278, - "00073": select279, - "00074": msg726, - "00075": select280, - "00076": select281, - "00077": select282, - "00084": msg735, - "00090": msg736, - "00200": msg737, - "00201": msg738, - "00202": msg739, - "00203": msg740, - "00206": select285, - "00207": select286, - "00257": select291, - "00259": select294, - "00262": msg778, - "00263": msg779, - "00400": msg780, - "00401": msg781, - "00402": select296, - "00403": msg784, - "00404": msg785, - "00405": msg786, - "00406": msg787, - "00407": msg788, - "00408": msg789, - "00409": msg790, - "00410": select297, - "00411": msg793, - "00413": select298, - "00414": select299, - "00415": msg799, - "00423": msg800, - "00429": select300, - "00430": select301, - "00431": msg805, - "00432": msg806, - "00433": msg807, - "00434": msg808, - "00435": select302, - "00436": select303, - "00437": select304, - "00438": select305, - "00440": select306, - "00441": msg823, - "00442": msg824, - "00443": msg825, - "00511": select307, - "00513": msg841, - "00515": select328, - "00518": select331, - "00519": select336, - "00520": select339, - "00521": msg890, - "00522": msg891, - "00523": msg892, - "00524": select340, - "00525": select341, - "00526": msg912, - "00527": select348, - "00528": select354, - "00529": select357, - "00530": select358, - "00531": select362, - "00533": msg973, - "00534": msg974, - "00535": select363, - "00536": select365, - "00537": select366, - "00538": select372, - "00539": select373, - "00541": select375, - "00542": msg1062, - "00543": msg1063, - "00544": msg1064, - "00546": msg1065, - "00547": select379, - "00549": msg1070, - "00551": select381, - "00553": select385, - "00554": select391, - "00555": msg1117, - "00556": select401, - "00572": select402, - "00601": select404, - "00602": msg1148, - "00612": msg1149, - "00615": select403, - "00620": select408, - "00622": msg1155, - "00625": msg1156, - "00628": msg1157, - "00767": select430, - "01269": select431, - "17852": select432, - "23184": select433, - "27052": select434, - "39568": select435, - }), - ]); - - var part1932 = match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); - - var part1933 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); - - var part1934 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); - - var part1935 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); - - var part1936 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); - - var part1937 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); - - var part1938 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); - - var part1939 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); - - var part1940 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); - - var part1941 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); - - var part1942 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); - - var part1943 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); - - var part1944 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); - - var part1945 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); - - var part1946 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); - - var part1947 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); - - var part1948 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); - - var part1949 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); - - var part1950 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); - - var part1951 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); - - var part1952 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); - - var part1953 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); - - var part1954 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); - - var part1955 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); - - var part1956 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); - - var part1957 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); - - var part1958 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); - - var part1959 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); - - var part1960 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); - - var part1961 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); - - var part1962 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); - - var part1963 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); - - var part1964 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part1965 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); - - var part1966 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); - - var part1967 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); - - var part1968 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); - - var part1969 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); - - var part1970 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); - - var part1971 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); - - var part1972 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); - - var part1973 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); - - var part1974 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); - - var part1975 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); - - var part1976 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); - - var part1977 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part1978 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); - - var part1979 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); - - var part1980 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part1981 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); - - var part1982 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); - - var part1983 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); - - var part1984 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); - - var part1985 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); - - var part1986 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); - - var part1987 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); - - var part1988 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); - - var part1989 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); - - var part1990 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); - - var part1991 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); - - var part1992 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); - - var part1993 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); - - var part1994 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); - - var part1995 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); - - var part1996 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); - - var part1997 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); - - var part1998 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); - - var part1999 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); - - var part2000 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); - - var part2001 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); - - var part2002 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); - - var part2003 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); - - var part2004 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); - - var part2005 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); - - var part2006 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); - - var part2007 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); - - var part2008 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); - - var part2009 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); - - var part2010 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); - - var part2011 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); - - var part2012 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); - - var part2013 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); - - var part2014 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); - - var part2015 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); - - var part2016 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); - - var part2017 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); - - var part2018 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); - - var part2019 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); - - var part2020 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); - - var part2021 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part2022 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2023 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); - - var part2024 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); - - var part2025 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); - - var part2026 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); - - var part2027 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); - - var part2028 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); - - var part2029 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); - - var part2030 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); - - var part2031 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); - - var part2032 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); - - var part2033 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); - - var part2034 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); - - var part2035 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); - - var part2036 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); - - var part2037 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); - - var part2038 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); - - var part2039 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); - - var part2040 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); - - var part2041 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); - - var part2042 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); - - var part2043 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); - - var part2044 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); - - var part2045 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); - - var part2046 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); - - var part2047 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); - - var part2048 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); - - var part2049 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); - - var part2050 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); - - var part2051 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); - - var part2052 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); - - var part2053 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); - - var part2054 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); - - var part2055 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); - - var part2056 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); - - var part2057 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); - - var part2058 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); - - var part2059 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); - - var part2060 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); - - var part2061 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); - - var part2062 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); - - var part2063 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); - - var part2064 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); - - var part2065 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); - - var part2066 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); - - var part2067 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); - - var part2068 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); - - var part2069 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); - - var part2070 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); - - var part2071 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); - - var part2072 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); - - var part2073 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); - - var part2074 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); - - var part2075 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); - - var part2076 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); - - var part2077 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); - - var part2078 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); - - var part2079 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); - - var part2080 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); - - var part2081 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); - - var part2082 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); - - var part2083 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); - - var part2084 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); - - var part2085 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); - - var part2086 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); - - var part2087 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); - - var part2088 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); - - var part2089 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); - - var part2090 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); - - var part2091 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); - - var part2092 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); - - var part2093 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); - - var part2094 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); - - var part2095 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); - - var part2096 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); - - var part2097 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); - - var part2098 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); - - var part2099 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); - - var part2100 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); - - var part2101 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); - - var part2102 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); - - var part2103 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); - - var part2104 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); - - var part2105 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); - - var part2106 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2107 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); - - var part2108 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); - - var part2109 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); - - var part2110 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); - - var part2111 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); - - var part2112 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); - - var part2113 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); - - var part2114 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); - - var part2115 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); - - var part2116 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); - - var part2117 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); - - var part2118 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); - - var part2119 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); - - var part2120 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); - - var part2121 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); - - var part2122 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); - - var part2123 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); - - var part2124 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); - - var part2125 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); - - var part2126 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); - - var part2127 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); - - var part2128 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); - - var part2129 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); - - var part2130 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); - - var part2131 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var part2132 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); - - var part2133 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); - - var part2134 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); - - var part2135 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); - - var part2136 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var part2137 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); - - var part2138 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); - - var part2139 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); - - var part2140 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); - - var part2141 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); - - var part2142 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); - - var part2143 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); - - var part2144 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); - - var part2145 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); - - var part2146 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); - - var part2147 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2148 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2149 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var part2150 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); - - var part2151 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); - - var part2152 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); - - var part2153 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); - - var part2154 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); - - var part2155 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); - - var part2156 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); - - var part2157 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); - - var part2158 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); - - var part2159 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); - - var part2160 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); - - var part2161 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); - - var part2162 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); - - var part2163 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); - - var part2164 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); - - var part2165 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); - - var part2166 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); - - var part2167 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); - - var part2168 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); - - var part2169 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); - - var part2170 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); - - var part2171 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); - - var part2172 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); - - var part2173 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); - - var part2174 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - - var part2175 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); - - var select436 = linear_select([ - dup10, - dup11, - ]); - - var part2176 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select437 = linear_select([ - dup13, - dup14, - ]); - - var select438 = linear_select([ - dup15, - dup16, - ]); - - var select439 = linear_select([ - dup56, - dup57, - ]); - - var select440 = linear_select([ - dup65, - dup66, - ]); - - var select441 = linear_select([ - dup68, - dup69, - ]); - - var select442 = linear_select([ - dup71, - dup72, - ]); - - var part2177 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var select443 = linear_select([ - dup74, - dup75, - ]); - - var select444 = linear_select([ - dup81, - dup82, - ]); - - var select445 = linear_select([ - dup24, - dup90, - ]); - - var select446 = linear_select([ - dup94, - dup95, - ]); - - var select447 = linear_select([ - dup98, - dup99, - ]); - - var select448 = linear_select([ - dup100, - dup101, - dup102, - ]); - - var select449 = linear_select([ - dup113, - dup114, - ]); - - var select450 = linear_select([ - dup111, - dup16, - ]); - - var select451 = linear_select([ - dup127, - dup107, - ]); - - var select452 = linear_select([ - dup8, - dup21, - ]); - - var select453 = linear_select([ - dup122, - dup133, - ]); - - var select454 = linear_select([ - dup142, - dup143, - ]); - - var select455 = linear_select([ - dup145, - dup21, - ]); - - var select456 = linear_select([ - dup127, - dup106, - ]); - - var select457 = linear_select([ - dup152, - dup96, - ]); - - var select458 = linear_select([ - dup154, - dup155, - ]); - - var select459 = linear_select([ - dup156, - dup157, - ]); - - var select460 = linear_select([ - dup99, - dup134, - ]); - - var select461 = linear_select([ - dup158, - dup159, - ]); - - var select462 = linear_select([ - dup161, - dup162, - ]); - - var select463 = linear_select([ - dup163, - dup103, - ]); - - var select464 = linear_select([ - dup162, - dup161, - ]); - - var select465 = linear_select([ - dup46, - dup47, - ]); - - var select466 = linear_select([ - dup166, - dup167, - ]); - - var select467 = linear_select([ - dup172, - dup173, - ]); - - var select468 = linear_select([ - dup174, - dup175, - dup176, - dup177, - dup178, - dup179, - dup180, - dup181, - dup182, - ]); - - var select469 = linear_select([ - dup49, - dup21, - ]); - - var select470 = linear_select([ - dup189, - dup190, - ]); - - var select471 = linear_select([ - dup96, - dup152, - ]); - - var select472 = linear_select([ - dup196, - dup197, - ]); - - var select473 = linear_select([ - dup24, - dup200, - ]); - - var select474 = linear_select([ - dup103, - dup163, - ]); - - var select475 = linear_select([ - dup205, - dup118, - ]); - - var part2178 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select476 = linear_select([ - dup212, - dup213, - ]); - - var select477 = linear_select([ - dup215, - dup216, - ]); - - var select478 = linear_select([ - dup222, - dup215, - ]); - - var select479 = linear_select([ - dup224, - dup225, - ]); - - var select480 = linear_select([ - dup231, - dup124, - ]); - - var select481 = linear_select([ - dup229, - dup230, - ]); - - var select482 = linear_select([ - dup233, - dup234, - ]); - - var select483 = linear_select([ - dup236, - dup237, - ]); - - var select484 = linear_select([ - dup242, - dup243, - ]); - - var select485 = linear_select([ - dup245, - dup246, - ]); - - var select486 = linear_select([ - dup247, - dup248, - ]); - - var select487 = linear_select([ - dup249, - dup250, - ]); - - var select488 = linear_select([ - dup251, - dup252, - ]); - - var select489 = linear_select([ - dup260, - dup261, - ]); - - var select490 = linear_select([ - dup264, - dup265, - ]); - - var select491 = linear_select([ - dup268, - dup269, - ]); - - var part2179 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select492 = linear_select([ - dup284, - dup285, - ]); - - var select493 = linear_select([ - dup287, - dup288, - ]); - - var part2180 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup60, - ])); - - var part2181 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var select494 = linear_select([ - dup300, - dup26, - ]); - - var select495 = linear_select([ - dup115, - dup303, - ]); - - var select496 = linear_select([ - dup125, - dup96, - ]); - - var select497 = linear_select([ - dup189, - dup308, - dup309, - ]); - - var select498 = linear_select([ - dup310, - dup16, - ]); - - var select499 = linear_select([ - dup317, - dup318, - ]); - - var select500 = linear_select([ - dup319, - dup315, - ]); - - var select501 = linear_select([ - dup322, - dup250, - ]); - - var select502 = linear_select([ - dup327, - dup329, - ]); - - var select503 = linear_select([ - dup330, - dup129, - ]); - - var part2182 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var part2183 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup60, - ])); - - var part2184 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var part2185 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var all391 = all_match({ - processors: [ - dup263, - dup390, - dup266, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var all392 = all_match({ - processors: [ - dup267, - dup391, - dup270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var all393 = all_match({ - processors: [ - dup80, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var all394 = all_match({ - processors: [ - dup296, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var all395 = all_match({ - processors: [ - dup298, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/tcp.yml.hbs b/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/tcp.yml.hbs deleted file mode 100755 index 0a6ba053fa..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,26354 +0,0 @@ -tcp: -host: "{{tcp_host}}:{{tcp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Juniper" - product: "Netscreen" - type: "Firewall" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} for %{p0}"); - - var dup7 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); - - var dup8 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); - - var dup9 = date_time({ - dest: "event_time", - args: ["fld1"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup10 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); - - var dup11 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); - - var dup12 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); - - var dup13 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); - - var dup14 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); - - var dup15 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); - - var dup16 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); - - var dup17 = setc("eventcategory","1502000000"); - - var dup18 = setc("eventcategory","1703000000"); - - var dup19 = setc("eventcategory","1603000000"); - - var dup20 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); - - var dup21 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); - - var dup22 = setc("eventcategory","1502050000"); - - var dup23 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); - - var dup24 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); - - var dup25 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); - - var dup26 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); - - var dup27 = setc("eventcategory","1801010000"); - - var dup28 = setc("eventcategory","1401060000"); - - var dup29 = setc("ec_subject","User"); - - var dup30 = setc("ec_activity","Logon"); - - var dup31 = setc("ec_theme","Authentication"); - - var dup32 = setc("ec_outcome","Success"); - - var dup33 = setc("eventcategory","1401070000"); - - var dup34 = setc("ec_activity","Logoff"); - - var dup35 = setc("eventcategory","1303000000"); - - var dup36 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); - - var dup37 = setc("eventcategory","1402020200"); - - var dup38 = setc("ec_theme","UserGroup"); - - var dup39 = setc("ec_outcome","Error"); - - var dup40 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); - - var dup41 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); - - var dup42 = setc("eventcategory","1402020300"); - - var dup43 = setc("ec_activity","Modify"); - - var dup44 = setc("eventcategory","1605000000"); - - var dup45 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); - - var dup46 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); - - var dup47 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); - - var dup48 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); - - var dup49 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); - - var dup50 = setc("eventcategory","1701020000"); - - var dup51 = setc("ec_theme","Configuration"); - - var dup52 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); - - var dup53 = setc("eventcategory","1301000000"); - - var dup54 = setc("ec_outcome","Failure"); - - var dup55 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); - - var dup56 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); - - var dup57 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); - - var dup58 = setc("eventcategory","1001000000"); - - var dup59 = setc("dclass_counter1_string","Number of times the attack occurred"); - - var dup60 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("saddr"), - field("daddr"), - ], - }); - - var dup61 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("saddr"), - field("daddr"), - field("sport"), - field("dport"), - ], - }); - - var dup62 = setc("eventcategory","1608010000"); - - var dup63 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); - - var dup64 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); - - var dup65 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); - - var dup66 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); - - var dup67 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup68 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); - - var dup69 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); - - var dup70 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); - - var dup71 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); - - var dup72 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); - - var dup73 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); - - var dup74 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); - - var dup75 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); - - var dup76 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); - - var dup77 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); - - var dup78 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); - - var dup79 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); - - var dup80 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup81 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); - - var dup82 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); - - var dup83 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup84 = setc("eventcategory","1002020000"); - - var dup85 = setc("eventcategory","1002000000"); - - var dup86 = setc("eventcategory","1603110000"); - - var dup87 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); - - var dup88 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); - - var dup89 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); - - var dup90 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); - - var dup91 = setc("eventcategory","1613040200"); - - var dup92 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); - - var dup93 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); - - var dup94 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); - - var dup95 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); - - var dup96 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); - - var dup97 = setc("eventcategory","1613050200"); - - var dup98 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); - - var dup99 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); - - var dup100 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); - - var dup101 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); - - var dup102 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); - - var dup103 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); - - var dup104 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); - - var dup105 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); - - var dup106 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); - - var dup107 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); - - var dup108 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); - - var dup109 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); - - var dup110 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); - - var dup111 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); - - var dup112 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); - - var dup113 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); - - var dup114 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); - - var dup115 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); - - var dup116 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); - - var dup117 = setc("eventcategory","1603090000"); - - var dup118 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); - - var dup119 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); - - var dup120 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); - - var dup121 = setc("eventcategory","1603030000"); - - var dup122 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); - - var dup123 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); - - var dup124 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); - - var dup125 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); - - var dup126 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); - - var dup127 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); - - var dup128 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); - - var dup129 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); - - var dup130 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); - - var dup131 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup132 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup133 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); - - var dup134 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); - - var dup135 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); - - var dup136 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); - - var dup137 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); - - var dup138 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); - - var dup139 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); - - var dup140 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); - - var dup141 = setc("eventcategory","1702030000"); - - var dup142 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); - - var dup143 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); - - var dup144 = setc("eventcategory","1601000000"); - - var dup145 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); - - var dup146 = date_time({ - dest: "event_time", - args: ["fld2"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup147 = setc("eventcategory","1103000000"); - - var dup148 = setc("ec_subject","NetworkComm"); - - var dup149 = setc("ec_activity","Scan"); - - var dup150 = setc("ec_theme","TEV"); - - var dup151 = setc("eventcategory","1103010000"); - - var dup152 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); - - var dup153 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); - - var dup154 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); - - var dup155 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); - - var dup156 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); - - var dup157 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); - - var dup158 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); - - var dup159 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); - - var dup160 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); - - var dup161 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); - - var dup162 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); - - var dup163 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); - - var dup164 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); - - var dup165 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); - - var dup166 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); - - var dup167 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); - - var dup168 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); - - var dup169 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); - - var dup170 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); - - var dup171 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); - - var dup172 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); - - var dup173 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); - - var dup174 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); - - var dup175 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); - - var dup176 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); - - var dup177 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); - - var dup178 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); - - var dup179 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); - - var dup180 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); - - var dup181 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); - - var dup182 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); - - var dup183 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); - - var dup184 = setc("eventcategory","1603020000"); - - var dup185 = setc("eventcategory","1803000000"); - - var dup186 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); - - var dup187 = setc("eventcategory","1603010000"); - - var dup188 = setc("eventcategory","1603100000"); - - var dup189 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); - - var dup190 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); - - var dup191 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); - - var dup192 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); - - var dup193 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); - - var dup194 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); - - var dup195 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); - - var dup196 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); - - var dup197 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); - - var dup198 = setc("eventcategory","1801030000"); - - var dup199 = setc("eventcategory","1302010200"); - - var dup200 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); - - var dup201 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); - - var dup202 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); - - var dup203 = setc("eventcategory","1304000000"); - - var dup204 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); - - var dup205 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); - - var dup206 = setc("eventcategory","1401030000"); - - var dup207 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); - - var dup208 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); - - var dup209 = setc("eventcategory","1605020000"); - - var dup210 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); - - var dup211 = setc("ec_subject","Certificate"); - - var dup212 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); - - var dup213 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); - - var dup214 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); - - var dup215 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); - - var dup216 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); - - var dup217 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); - - var dup218 = setc("ec_subject","CryptoKey"); - - var dup219 = setc("ec_subject","Configuration"); - - var dup220 = setc("ec_activity","Request"); - - var dup221 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); - - var dup222 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); - - var dup223 = setc("eventcategory","1612000000"); - - var dup224 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); - - var dup225 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); - - var dup226 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); - - var dup227 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); - - var dup228 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); - - var dup229 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); - - var dup230 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); - - var dup231 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); - - var dup232 = setc("eventcategory","1201000000"); - - var dup233 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); - - var dup234 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); - - var dup235 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); - - var dup236 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); - - var dup237 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); - - var dup238 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); - - var dup239 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup240 = setc("eventcategory","1401000000"); - - var dup241 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); - - var dup242 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); - - var dup243 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); - - var dup244 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); - - var dup245 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); - - var dup246 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); - - var dup247 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); - - var dup248 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); - - var dup249 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); - - var dup250 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); - - var dup251 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); - - var dup252 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); - - var dup253 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); - - var dup254 = setc("eventcategory","1608000000"); - - var dup255 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); - - var dup256 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); - - var dup257 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); - - var dup258 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); - - var dup259 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); - - var dup260 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); - - var dup261 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); - - var dup262 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); - - var dup263 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); - - var dup264 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); - - var dup265 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); - - var dup266 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var dup267 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); - - var dup268 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); - - var dup269 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); - - var dup270 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); - - var dup271 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var dup272 = setc("eventcategory","1805010000"); - - var dup273 = setc("eventcategory","1805000000"); - - var dup274 = date_time({ - dest: "starttime", - args: ["fld2"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup275 = call({ - dest: "nwparser.bytes", - fn: CALC, - args: [ - field("sbytes"), - constant("+"), - field("rbytes"), - ], - }); - - var dup276 = setc("action","Deny"); - - var dup277 = setc("disposition","Deny"); - - var dup278 = setc("direction","outgoing"); - - var dup279 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("saddr"), - field("daddr"), - field("sport"), - field("dport"), - ], - }); - - var dup280 = setc("direction","incoming"); - - var dup281 = setc("eventcategory","1801000000"); - - var dup282 = setf("action","disposition"); - - var dup283 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); - - var dup284 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); - - var dup285 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); - - var dup286 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); - - var dup287 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); - - var dup288 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); - - var dup289 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); - - var dup290 = setc("eventcategory","1401050200"); - - var dup291 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("daddr"), - field("saddr"), - ], - }); - - var dup292 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("daddr"), - field("saddr"), - field("dport"), - field("sport"), - ], - }); - - var dup293 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); - - var dup294 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); - - var dup295 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); - - var dup296 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup297 = setc("eventcategory","1204000000"); - - var dup298 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup299 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var dup300 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); - - var dup301 = setc("eventcategory","1801020000"); - - var dup302 = setc("disposition","failed"); - - var dup303 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); - - var dup304 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); - - var dup305 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); - - var dup306 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); - - var dup307 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); - - var dup308 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); - - var dup309 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); - - var dup310 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); - - var dup311 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); - - var dup312 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); - - var dup313 = setc("eventcategory","1803020000"); - - var dup314 = setc("eventcategory","1613030000"); - - var dup315 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); - - var dup316 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); - - var dup317 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); - - var dup318 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); - - var dup319 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); - - var dup320 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); - - var dup321 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); - - var dup322 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); - - var dup323 = setc("event_description","Cannot connect to NSM server"); - - var dup324 = setc("eventcategory","1603040000"); - - var dup325 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); - - var dup326 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); - - var dup327 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); - - var dup328 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); - - var dup329 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); - - var dup330 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - - var dup331 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); - - var dup332 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("daddr"), - field("saddr"), - field("dport"), - field("sport"), - ], - }); - - var dup333 = linear_select([ - dup10, - dup11, - ]); - - var dup334 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup335 = linear_select([ - dup13, - dup14, - ]); - - var dup336 = linear_select([ - dup15, - dup16, - ]); - - var dup337 = linear_select([ - dup56, - dup57, - ]); - - var dup338 = linear_select([ - dup65, - dup66, - ]); - - var dup339 = linear_select([ - dup68, - dup69, - ]); - - var dup340 = linear_select([ - dup71, - dup72, - ]); - - var dup341 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var dup342 = linear_select([ - dup74, - dup75, - ]); - - var dup343 = linear_select([ - dup81, - dup82, - ]); - - var dup344 = linear_select([ - dup24, - dup90, - ]); - - var dup345 = linear_select([ - dup94, - dup95, - ]); - - var dup346 = linear_select([ - dup98, - dup99, - ]); - - var dup347 = linear_select([ - dup100, - dup101, - dup102, - ]); - - var dup348 = linear_select([ - dup113, - dup114, - ]); - - var dup349 = linear_select([ - dup111, - dup16, - ]); - - var dup350 = linear_select([ - dup127, - dup107, - ]); - - var dup351 = linear_select([ - dup8, - dup21, - ]); - - var dup352 = linear_select([ - dup122, - dup133, - ]); - - var dup353 = linear_select([ - dup142, - dup143, - ]); - - var dup354 = linear_select([ - dup145, - dup21, - ]); - - var dup355 = linear_select([ - dup127, - dup106, - ]); - - var dup356 = linear_select([ - dup152, - dup96, - ]); - - var dup357 = linear_select([ - dup154, - dup155, - ]); - - var dup358 = linear_select([ - dup156, - dup157, - ]); - - var dup359 = linear_select([ - dup99, - dup134, - ]); - - var dup360 = linear_select([ - dup158, - dup159, - ]); - - var dup361 = linear_select([ - dup161, - dup162, - ]); - - var dup362 = linear_select([ - dup163, - dup103, - ]); - - var dup363 = linear_select([ - dup162, - dup161, - ]); - - var dup364 = linear_select([ - dup46, - dup47, - ]); - - var dup365 = linear_select([ - dup166, - dup167, - ]); - - var dup366 = linear_select([ - dup172, - dup173, - ]); - - var dup367 = linear_select([ - dup174, - dup175, - dup176, - dup177, - dup178, - dup179, - dup180, - dup181, - dup182, - ]); - - var dup368 = linear_select([ - dup49, - dup21, - ]); - - var dup369 = linear_select([ - dup189, - dup190, - ]); - - var dup370 = linear_select([ - dup96, - dup152, - ]); - - var dup371 = linear_select([ - dup196, - dup197, - ]); - - var dup372 = linear_select([ - dup24, - dup200, - ]); - - var dup373 = linear_select([ - dup103, - dup163, - ]); - - var dup374 = linear_select([ - dup205, - dup118, - ]); - - var dup375 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup376 = linear_select([ - dup212, - dup213, - ]); - - var dup377 = linear_select([ - dup215, - dup216, - ]); - - var dup378 = linear_select([ - dup222, - dup215, - ]); - - var dup379 = linear_select([ - dup224, - dup225, - ]); - - var dup380 = linear_select([ - dup231, - dup124, - ]); - - var dup381 = linear_select([ - dup229, - dup230, - ]); - - var dup382 = linear_select([ - dup233, - dup234, - ]); - - var dup383 = linear_select([ - dup236, - dup237, - ]); - - var dup384 = linear_select([ - dup242, - dup243, - ]); - - var dup385 = linear_select([ - dup245, - dup246, - ]); - - var dup386 = linear_select([ - dup247, - dup248, - ]); - - var dup387 = linear_select([ - dup249, - dup250, - ]); - - var dup388 = linear_select([ - dup251, - dup252, - ]); - - var dup389 = linear_select([ - dup260, - dup261, - ]); - - var dup390 = linear_select([ - dup264, - dup265, - ]); - - var dup391 = linear_select([ - dup268, - dup269, - ]); - - var dup392 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup393 = linear_select([ - dup284, - dup285, - ]); - - var dup394 = linear_select([ - dup287, - dup288, - ]); - - var dup395 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup60, - ])); - - var dup396 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var dup397 = linear_select([ - dup300, - dup26, - ]); - - var dup398 = linear_select([ - dup115, - dup303, - ]); - - var dup399 = linear_select([ - dup125, - dup96, - ]); - - var dup400 = linear_select([ - dup189, - dup308, - dup309, - ]); - - var dup401 = linear_select([ - dup310, - dup16, - ]); - - var dup402 = linear_select([ - dup317, - dup318, - ]); - - var dup403 = linear_select([ - dup319, - dup315, - ]); - - var dup404 = linear_select([ - dup322, - dup250, - ]); - - var dup405 = linear_select([ - dup327, - dup329, - ]); - - var dup406 = linear_select([ - dup330, - dup129, - ]); - - var dup407 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var dup408 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup60, - ])); - - var dup409 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var dup410 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var dup411 = all_match({ - processors: [ - dup263, - dup390, - dup266, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var dup412 = all_match({ - processors: [ - dup267, - dup391, - dup270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var dup413 = all_match({ - processors: [ - dup80, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var dup414 = all_match({ - processors: [ - dup296, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var dup415 = all_match({ - processors: [ - dup298, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var hdr1 = match("HEADER#0:0001", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [No Name]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0001"), - ])); - - var hdr2 = match("HEADER#1:0003", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [%{hvsys}]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0003"), - ])); - - var hdr3 = match("HEADER#2:0004", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0004"), - ])); - - var hdr4 = match("HEADER#3:0002/0", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} %{p0}"); - - var part1 = match("HEADER#3:0002/1_0", "nwparser.p0", "[No Name]system%{p0}"); - - var part2 = match("HEADER#3:0002/1_1", "nwparser.p0", "[%{hvsys}]system%{p0}"); - - var part3 = match("HEADER#3:0002/1_2", "nwparser.p0", "system%{p0}"); - - var select1 = linear_select([ - part1, - part2, - part3, - ]); - - var part4 = match("HEADER#3:0002/2", "nwparser.p0", "-%{hseverity}-%{messageid}: %{payload}"); - - var all1 = all_match({ - processors: [ - hdr4, - select1, - part4, - ], - on_success: processor_chain([ - setc("header_id","0002"), - ]), - }); - - var select2 = linear_select([ - hdr1, - hdr2, - hdr3, - all1, - ]); - - var part5 = match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} with ip address %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1 = msg("00001", part5); - - var part6 = match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface->} with domain name %{domain->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg2 = msg("00001:01", part6); - - var part7 = match("MESSAGE#2:00001:02/1_0", "nwparser.p0", "ip address %{hostip->} in zone %{p0}"); - - var select3 = linear_select([ - part7, - dup7, - ]); - - var part8 = match("MESSAGE#2:00001:02/2", "nwparser.p0", "%{zone->} has been %{disposition}"); - - var all2 = all_match({ - processors: [ - dup6, - select3, - part8, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg3 = msg("00001:02", all2); - - var part9 = match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface changed!", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg4 = msg("00001:03", part9); - - var part10 = match("MESSAGE#4:00001:04/1_0", "nwparser.p0", "IP address %{hostip->} in zone %{p0}"); - - var select4 = linear_select([ - part10, - dup7, - ]); - - var part11 = match("MESSAGE#4:00001:04/2", "nwparser.p0", "%{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} session%{p0}"); - - var part12 = match("MESSAGE#4:00001:04/3_1", "nwparser.p0", ".%{fld1}"); - - var select5 = linear_select([ - dup8, - part12, - ]); - - var all3 = all_match({ - processors: [ - dup6, - select4, - part11, - select5, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg5 = msg("00001:04", all3); - - var part13 = match("MESSAGE#5:00001:05/0", "nwparser.payload", "%{fld2}: Address %{group_object->} for ip address %{hostip->} in zone %{zone->} has been %{disposition->} from host %{saddr->} session %{p0}"); - - var all4 = all_match({ - processors: [ - part13, - dup333, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg6 = msg("00001:05", all4); - - var part14 = match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg7 = msg("00001:06", part14); - - var msg8 = msg("00001:07", dup334); - - var part15 = match("MESSAGE#8:00001:08/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{p0}"); - - var part16 = match("MESSAGE#8:00001:08/4", "nwparser.p0", "%{} %{username}via NSRP Peer session. (%{fld1})"); - - var all5 = all_match({ - processors: [ - dup12, - dup335, - part15, - dup336, - part16, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg9 = msg("00001:08", all5); - - var part17 = match("MESSAGE#9:00001:09/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} session. (%{fld1})"); - - var all6 = all_match({ - processors: [ - dup12, - dup335, - part17, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg10 = msg("00001:09", all6); - - var select6 = linear_select([ - msg1, - msg2, - msg3, - msg4, - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - ]); - - var part18 = match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg11 = msg("00002:03", part18); - - var part19 = match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg12 = msg("00002:04", part19); - - var part20 = match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg13 = msg("00002:05", part20); - - var part21 = match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with e-mail notification of event alarms has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg14 = msg("00002:06", part21); - - var part22 = match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action->} and the LCD control keys have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg15 = msg("00002:07", part22); - - var part23 = match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{fld2->} is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg16 = msg("00002:55", part23); - - var part24 = match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg17 = msg("00002:08", part24); - - var part25 = match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg18 = msg("00002:09", part25); - - var part26 = match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg19 = msg("00002:10", part26); - - var part27 = match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg20 = msg("00002:11", part27); - - var part28 = match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg21 = msg("00002:12", part28); - - var part29 = match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been %{disposition}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg22 = msg("00002:15", part29); - - var msg23 = msg("00002:17", dup334); - - var part30 = match("MESSAGE#23:00002:18/0", "nwparser.payload", "Unexpected error from e%{p0}"); - - var part31 = match("MESSAGE#23:00002:18/1_0", "nwparser.p0", "-mail %{p0}"); - - var part32 = match("MESSAGE#23:00002:18/1_1", "nwparser.p0", "mail %{p0}"); - - var select7 = linear_select([ - part31, - part32, - ]); - - var part33 = match("MESSAGE#23:00002:18/2", "nwparser.p0", "server(%{fld2}):"); - - var all7 = all_match({ - processors: [ - part30, - select7, - part33, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg24 = msg("00002:18", all7); - - var part34 = match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute->} value has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg25 = msg("00002:19", part34); - - var part35 = match("MESSAGE#25:00002:20/0", "nwparser.payload", "Root admin password restriction of minimum %{fld2->} characters has been %{disposition->} by admin %{administrator->} %{p0}"); - - var part36 = match("MESSAGE#25:00002:20/1_0", "nwparser.p0", "from Console %{}"); - - var select8 = linear_select([ - part36, - dup20, - dup21, - ]); - - var all8 = all_match({ - processors: [ - part35, - select8, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg26 = msg("00002:20", all8); - - var part37 = match("MESSAGE#26:00002:21/0_0", "nwparser.payload", "Root admin %{p0}"); - - var part38 = match("MESSAGE#26:00002:21/0_1", "nwparser.payload", "%{fld2->} admin %{p0}"); - - var select9 = linear_select([ - part37, - part38, - ]); - - var select10 = linear_select([ - dup24, - dup25, - ]); - - var part39 = match("MESSAGE#26:00002:21/3", "nwparser.p0", "has been changed by admin %{administrator}"); - - var all9 = all_match({ - processors: [ - select9, - dup23, - select10, - part39, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg27 = msg("00002:21", all9); - - var part40 = match("MESSAGE#27:00002:22/0", "nwparser.payload", "%{change_attribute->} from %{protocol->} before administrative session disconnects has been changed from %{change_old->} to %{change_new->} by admin %{p0}"); - - var part41 = match("MESSAGE#27:00002:22/1_0", "nwparser.p0", "%{administrator->} from Console"); - - var part42 = match("MESSAGE#27:00002:22/1_1", "nwparser.p0", "%{administrator->} from host %{saddr}"); - - var select11 = linear_select([ - part41, - part42, - dup26, - ]); - - var all10 = all_match({ - processors: [ - part40, - select11, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg28 = msg("00002:22", all10); - - var part43 = match("MESSAGE#28:00002:23/0", "nwparser.payload", "Root admin access restriction through console only has been %{disposition->} by admin %{administrator->} %{p0}"); - - var part44 = match("MESSAGE#28:00002:23/1_1", "nwparser.p0", "from Console%{}"); - - var select12 = linear_select([ - dup20, - part44, - dup21, - ]); - - var all11 = all_match({ - processors: [ - part43, - select12, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg29 = msg("00002:23", all11); - - var part45 = match("MESSAGE#29:00002:24/0", "nwparser.payload", "Admin access restriction of %{protocol->} administration through tunnel only has been %{disposition->} by admin %{administrator->} from %{p0}"); - - var part46 = match("MESSAGE#29:00002:24/1_0", "nwparser.p0", "host %{saddr}"); - - var part47 = match("MESSAGE#29:00002:24/1_1", "nwparser.p0", "Console%{}"); - - var select13 = linear_select([ - part46, - part47, - ]); - - var all12 = all_match({ - processors: [ - part45, - select13, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg30 = msg("00002:24", all12); - - var part48 = match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of an %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - setc("eventcategory","1402000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg31 = msg("00002:25", part48); - - var part49 = match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail server %{hostip}.", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg32 = msg("00002:26", part49); - - var part50 = match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg33 = msg("00002:27", part50); - - var part51 = match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not configured.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg34 = msg("00002:28", part51); - - var part52 = match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restriction for read-write administrators has been %{disposition->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg35 = msg("00002:29", part52); - - var part53 = match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ - dup28, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg36 = msg("00002:30", part53); - - var part54 = match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ - dup33, - dup29, - dup34, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg37 = msg("00002:41", part54); - - var part55 = match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} %{space->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup35, - dup29, - dup30, - dup31, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg38 = msg("00002:31", part55); - - var part56 = match("MESSAGE#38:00002:32/0_0", "nwparser.payload", "E-mail notification %{p0}"); - - var part57 = match("MESSAGE#38:00002:32/0_1", "nwparser.payload", "Transparent virutal %{p0}"); - - var select14 = linear_select([ - part56, - part57, - ]); - - var part58 = match("MESSAGE#38:00002:32/1", "nwparser.p0", "wire mode has been %{disposition}"); - - var all13 = all_match({ - processors: [ - select14, - part58, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg39 = msg("00002:32", all13); - - var part59 = match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has been %{disposition->} for zone %{zone}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg40 = msg("00002:35", part59); - - var part60 = match("MESSAGE#40:00002:36/0", "nwparser.payload", "Bypass%{p0}"); - - var part61 = match("MESSAGE#40:00002:36/1_0", "nwparser.p0", "-others-IPSec %{p0}"); - - var part62 = match("MESSAGE#40:00002:36/1_1", "nwparser.p0", " non-IP traffic %{p0}"); - - var select15 = linear_select([ - part61, - part62, - ]); - - var part63 = match("MESSAGE#40:00002:36/2", "nwparser.p0", "option has been %{disposition}"); - - var all14 = all_match({ - processors: [ - part60, - select15, - part63, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg41 = msg("00002:36", all14); - - var part64 = match("MESSAGE#41:00002:37/0", "nwparser.payload", "Logging of %{p0}"); - - var part65 = match("MESSAGE#41:00002:37/1_0", "nwparser.p0", "dropped %{p0}"); - - var part66 = match("MESSAGE#41:00002:37/1_1", "nwparser.p0", "IKE %{p0}"); - - var part67 = match("MESSAGE#41:00002:37/1_2", "nwparser.p0", "SNMP %{p0}"); - - var part68 = match("MESSAGE#41:00002:37/1_3", "nwparser.p0", "ICMP %{p0}"); - - var select16 = linear_select([ - part65, - part66, - part67, - part68, - ]); - - var part69 = match("MESSAGE#41:00002:37/2", "nwparser.p0", "traffic to self has been %{disposition}"); - - var all15 = all_match({ - processors: [ - part64, - select16, - part69, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg42 = msg("00002:37", all15); - - var part70 = match("MESSAGE#42:00002:38/0", "nwparser.payload", "Logging of dropped traffic to self (excluding multicast) has been %{p0}"); - - var part71 = match("MESSAGE#42:00002:38/1_0", "nwparser.p0", "%{disposition->} on %{zone}"); - - var select17 = linear_select([ - part71, - dup36, - ]); - - var all16 = all_match({ - processors: [ - part70, - select17, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg43 = msg("00002:38", all16); - - var part72 = match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg44 = msg("00002:39", part72); - - var part73 = match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{username}' by %{administrator->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ - dup37, - dup29, - setc("ec_activity","Create"), - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg45 = msg("00002:40", part73); - - var part74 = match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requested for unknown user %{username}. Possible HA syncronization problem.", processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg46 = msg("00002:44", part74); - - var part75 = match("MESSAGE#46:00002:42/0", "nwparser.payload", "%{change_attribute->} for account '%{change_old}' has been %{disposition->} to '%{change_new}' %{p0}"); - - var part76 = match("MESSAGE#46:00002:42/1_0", "nwparser.p0", "by %{administrator->} via %{p0}"); - - var select18 = linear_select([ - part76, - dup40, - ]); - - var part77 = match("MESSAGE#46:00002:42/2", "nwparser.p0", "%{logon_type->} from host %{p0}"); - - var part78 = match("MESSAGE#46:00002:42/3_0", "nwparser.p0", "%{saddr->} to %{daddr}:%{dport->} (%{p0}"); - - var part79 = match("MESSAGE#46:00002:42/3_1", "nwparser.p0", "%{saddr}:%{sport->} (%{p0}"); - - var select19 = linear_select([ - part78, - part79, - ]); - - var all17 = all_match({ - processors: [ - part75, - select18, - part77, - select19, - dup41, - ], - on_success: processor_chain([ - dup42, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg47 = msg("00002:42", all17); - - var part80 = match("MESSAGE#47:00002:43/0", "nwparser.payload", "Admin account %{disposition->} for %{p0}"); - - var part81 = match("MESSAGE#47:00002:43/1_0", "nwparser.p0", "'%{username}'%{p0}"); - - var part82 = match("MESSAGE#47:00002:43/1_1", "nwparser.p0", "\"%{username}\"%{p0}"); - - var select20 = linear_select([ - part81, - part82, - ]); - - var part83 = match("MESSAGE#47:00002:43/2", "nwparser.p0", "%{}by %{administrator->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all18 = all_match({ - processors: [ - part80, - select20, - part83, - ], - on_success: processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg48 = msg("00002:43", all18); - - var part84 = match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg49 = msg("00002:50", part84); - - var part85 = match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} %{fld2->} via %{logon_type->} (%{fld1})", processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg50 = msg("00002:51", part85); - - var part86 = match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg51 = msg("00002:45", part86); - - var part87 = match("MESSAGE#51:00002:47/0_0", "nwparser.payload", "Ping of Death attack protection %{p0}"); - - var part88 = match("MESSAGE#51:00002:47/0_1", "nwparser.payload", "Src Route IP option filtering %{p0}"); - - var part89 = match("MESSAGE#51:00002:47/0_2", "nwparser.payload", "Teardrop attack protection %{p0}"); - - var part90 = match("MESSAGE#51:00002:47/0_3", "nwparser.payload", "Land attack protection %{p0}"); - - var part91 = match("MESSAGE#51:00002:47/0_4", "nwparser.payload", "SYN flood protection %{p0}"); - - var select21 = linear_select([ - part87, - part88, - part89, - part90, - part91, - ]); - - var part92 = match("MESSAGE#51:00002:47/1", "nwparser.p0", "is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})"); - - var all19 = all_match({ - processors: [ - select21, - part92, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg52 = msg("00002:47", all19); - - var part93 = match("MESSAGE#52:00002:48/0", "nwparser.payload", "Dropping pkts if not %{p0}"); - - var part94 = match("MESSAGE#52:00002:48/1_0", "nwparser.p0", "exactly same with incoming if %{p0}"); - - var part95 = match("MESSAGE#52:00002:48/1_1", "nwparser.p0", "in route table %{p0}"); - - var select22 = linear_select([ - part94, - part95, - ]); - - var part96 = match("MESSAGE#52:00002:48/2", "nwparser.p0", "(IP spoof protection) is %{disposition->} on zone %{zone->} by %{username->} via %{p0}"); - - var part97 = match("MESSAGE#52:00002:48/3_0", "nwparser.p0", "NSRP Peer. (%{p0}"); - - var select23 = linear_select([ - part97, - dup45, - ]); - - var all20 = all_match({ - processors: [ - part93, - select22, - part96, - select23, - dup41, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg53 = msg("00002:48", all20); - - var part98 = match("MESSAGE#53:00002:52/0", "nwparser.payload", "%{signame->} %{p0}"); - - var part99 = match("MESSAGE#53:00002:52/1_0", "nwparser.p0", "protection%{p0}"); - - var part100 = match("MESSAGE#53:00002:52/1_1", "nwparser.p0", "limiting%{p0}"); - - var part101 = match("MESSAGE#53:00002:52/1_2", "nwparser.p0", "detection%{p0}"); - - var part102 = match("MESSAGE#53:00002:52/1_3", "nwparser.p0", "filtering %{p0}"); - - var select24 = linear_select([ - part99, - part100, - part101, - part102, - ]); - - var part103 = match("MESSAGE#53:00002:52/2", "nwparser.p0", "%{}is %{disposition->} on zone %{zone->} by %{p0}"); - - var part104 = match("MESSAGE#53:00002:52/3_1", "nwparser.p0", "admin via %{p0}"); - - var select25 = linear_select([ - dup46, - part104, - dup47, - ]); - - var select26 = linear_select([ - dup48, - dup45, - ]); - - var all21 = all_match({ - processors: [ - part98, - select24, - part103, - select25, - select26, - dup41, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg54 = msg("00002:52", all21); - - var part105 = match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"%{username}\" has been %{disposition->} by %{administrator->} via %{logon_type->} (%{fld1})", processor_chain([ - dup42, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg55 = msg("00002:53", part105); - - var part106 = match("MESSAGE#55:00002:54/0", "nwparser.payload", "Traffic shaping clearing DSCP selector is turned O%{p0}"); - - var part107 = match("MESSAGE#55:00002:54/1_0", "nwparser.p0", "FF%{p0}"); - - var part108 = match("MESSAGE#55:00002:54/1_1", "nwparser.p0", "N%{p0}"); - - var select27 = linear_select([ - part107, - part108, - ]); - - var all22 = all_match({ - processors: [ - part106, - select27, - dup49, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg56 = msg("00002:54", all22); - - var part109 = match("MESSAGE#56:00002/0", "nwparser.payload", "%{change_attribute->} %{p0}"); - - var part110 = match("MESSAGE#56:00002/1_0", "nwparser.p0", "has been changed%{p0}"); - - var select28 = linear_select([ - part110, - dup52, - ]); - - var part111 = match("MESSAGE#56:00002/2", "nwparser.p0", "%{}from %{change_old->} to %{change_new}"); - - var all23 = all_match({ - processors: [ - part109, - select28, - part111, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg57 = msg("00002", all23); - - var part112 = match("MESSAGE#1215:00002:56", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed. (%{fld1})", processor_chain([ - dup53, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg58 = msg("00002:56", part112); - - var select29 = linear_select([ - msg11, - msg12, - msg13, - msg14, - msg15, - msg16, - msg17, - msg18, - msg19, - msg20, - msg21, - msg22, - msg23, - msg24, - msg25, - msg26, - msg27, - msg28, - msg29, - msg30, - msg31, - msg32, - msg33, - msg34, - msg35, - msg36, - msg37, - msg38, - msg39, - msg40, - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - msg50, - msg51, - msg52, - msg53, - msg54, - msg55, - msg56, - msg57, - msg58, - ]); - - var part113 = match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup53, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg59 = msg("00003", part113); - - var part114 = match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failures have been detected!%{}", processor_chain([ - dup53, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg60 = msg("00003:01", part114); - - var part115 = match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg61 = msg("00003:02", part115); - - var part116 = match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed from %{change_old->} to %{change_new}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg62 = msg("00003:03", part116); - - var part117 = match("MESSAGE#61:00003:05/1_0", "nwparser.p0", "serial%{p0}"); - - var part118 = match("MESSAGE#61:00003:05/1_1", "nwparser.p0", "local%{p0}"); - - var select30 = linear_select([ - part117, - part118, - ]); - - var part119 = match("MESSAGE#61:00003:05/2", "nwparser.p0", "%{}console has been %{disposition->} by admin %{administrator}."); - - var all24 = all_match({ - processors: [ - dup55, - select30, - part119, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg63 = msg("00003:05", all24); - - var select31 = linear_select([ - msg59, - msg60, - msg61, - msg62, - msg63, - ]); - - var part120 = match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been changed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg64 = msg("00004", part120); - - var part121 = match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg65 = msg("00004:01", part121); - - var part122 = match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg66 = msg("00004:02", part122); - - var part123 = match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg67 = msg("00004:03", part123); - - var part124 = match("MESSAGE#66:00004:04/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on %{p0}"); - - var part125 = match("MESSAGE#66:00004:04/2", "nwparser.p0", "%{} %{interface->} %{space}The attack occurred %{dclass_counter1->} times"); - - var all25 = all_match({ - processors: [ - part124, - dup337, - part125, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup59, - dup3, - dup60, - ]), - }); - - var msg68 = msg("00004:04", all25); - - var part126 = match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol}", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg69 = msg("00004:05", part126); - - var part127 = match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been changed to start at %{fld2}:%{fld3->} with an interval of %{fld4}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg70 = msg("00004:06", part127); - - var part128 = match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have been refreshed as result of external event.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg71 = msg("00004:07", part128); - - var part129 = match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg72 = msg("00004:08", part129); - - var part130 = match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more concurrent client requests than allowed.%{}", processor_chain([ - dup62, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg73 = msg("00004:09", part130); - - var part131 = match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table entries exceeded maximum limit.%{}", processor_chain([ - dup62, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg74 = msg("00004:10", part131); - - var part132 = match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table added with domain %{domain}, interface %{interface}, primary-ip %{fld2}, secondary-ip %{fld3}, tertiary-ip %{fld4}, failover %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg75 = msg("00004:11", part132); - - var part133 = match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table entry %{disposition->} with domain %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg76 = msg("00004:12", part133); - - var part134 = match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} returned incorrect ip %{fld2}, local-ip should be %{fld3}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg77 = msg("00004:13", part134); - - var part135 = match("MESSAGE#76:00004:14/1_0", "nwparser.p0", "automatically refreshed %{p0}"); - - var part136 = match("MESSAGE#76:00004:14/1_1", "nwparser.p0", "refreshed by HA %{p0}"); - - var select32 = linear_select([ - part135, - part136, - ]); - - var all26 = all_match({ - processors: [ - dup63, - select32, - dup49, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg78 = msg("00004:14", all26); - - var part137 = match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshed as result of DNS server address change. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg79 = msg("00004:15", part137); - - var part138 = match("MESSAGE#78:00004:16", "nwparser.payload", "DNS entries have been manually refreshed. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg80 = msg("00004:16", part138); - - var all27 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup9, - dup5, - dup3, - dup60, - ]), - }); - - var msg81 = msg("00004:17", all27); - - var select33 = linear_select([ - msg64, - msg65, - msg66, - msg67, - msg68, - msg69, - msg70, - msg71, - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - ]); - - var part139 = match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from the same source has been changed to %{trigger_val}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg82 = msg("00005", part139); - - var part140 = match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic to self has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg83 = msg("00005:01", part140); - - var part141 = match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been changed to %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg84 = msg("00005:02", part141); - - var part142 = match("MESSAGE#83:00005:03/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); - - var part143 = match("MESSAGE#83:00005:03/4", "nwparser.p0", "%{fld99}interface %{interface->} %{p0}"); - - var part144 = match("MESSAGE#83:00005:03/5_0", "nwparser.p0", "in zone %{zone}. %{p0}"); - - var select34 = linear_select([ - part144, - dup73, - ]); - - var part145 = match("MESSAGE#83:00005:03/6", "nwparser.p0", "%{space}The attack occurred %{dclass_counter1->} times"); - - var all28 = all_match({ - processors: [ - part142, - dup339, - dup70, - dup340, - part143, - select34, - part145, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ]), - }); - - var msg85 = msg("00005:03", all28); - - var msg86 = msg("00005:04", dup341); - - var part146 = match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2->} mode when receiving unknown dst mac has been %{disposition->} on %{zone}.", processor_chain([ - setc("eventcategory","1001020100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg87 = msg("00005:05", part146); - - var part147 = match("MESSAGE#86:00005:06/1", "nwparser.p0", "flood timeout has been set to %{trigger_val->} on %{zone}."); - - var all29 = all_match({ - processors: [ - dup342, - part147, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg88 = msg("00005:06", all29); - - var part148 = match("MESSAGE#87:00005:07/0", "nwparser.payload", "SYN flood %{p0}"); - - var part149 = match("MESSAGE#87:00005:07/1_0", "nwparser.p0", "alarm threshold %{p0}"); - - var part150 = match("MESSAGE#87:00005:07/1_1", "nwparser.p0", "packet queue size %{p0}"); - - var part151 = match("MESSAGE#87:00005:07/1_3", "nwparser.p0", "attack threshold %{p0}"); - - var part152 = match("MESSAGE#87:00005:07/1_4", "nwparser.p0", "same source IP threshold %{p0}"); - - var select35 = linear_select([ - part149, - part150, - dup76, - part151, - part152, - ]); - - var part153 = match("MESSAGE#87:00005:07/2", "nwparser.p0", "is set to %{trigger_val}."); - - var all30 = all_match({ - processors: [ - part148, - select35, - part153, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg89 = msg("00005:07", all30); - - var part154 = match("MESSAGE#88:00005:08/1", "nwparser.p0", "flood same %{p0}"); - - var select36 = linear_select([ - dup77, - dup78, - ]); - - var part155 = match("MESSAGE#88:00005:08/3", "nwparser.p0", "ip threshold has been set to %{trigger_val->} on %{zone}."); - - var all31 = all_match({ - processors: [ - dup342, - part154, - select36, - part155, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg90 = msg("00005:08", all31); - - var part156 = match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is %{disposition->} on interface %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg91 = msg("00005:09", part156); - - var part157 = match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is %{disposition->} on %{zone}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg92 = msg("00005:10", part157); - - var part158 = match("MESSAGE#91:00005:11/0", "nwparser.payload", "The SYN flood %{p0}"); - - var part159 = match("MESSAGE#91:00005:11/1_0", "nwparser.p0", "alarm threshold%{}"); - - var part160 = match("MESSAGE#91:00005:11/1_1", "nwparser.p0", "packet queue size%{}"); - - var part161 = match("MESSAGE#91:00005:11/1_2", "nwparser.p0", "timeout value%{}"); - - var part162 = match("MESSAGE#91:00005:11/1_3", "nwparser.p0", "attack threshold%{}"); - - var part163 = match("MESSAGE#91:00005:11/1_4", "nwparser.p0", "same source IP%{}"); - - var select37 = linear_select([ - part159, - part160, - part161, - part162, - part163, - ]); - - var all32 = all_match({ - processors: [ - part158, - select37, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg93 = msg("00005:11", all32); - - var part164 = match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshold value has been set to %{trigger_val->} on %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg94 = msg("00005:12", part164); - - var part165 = match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg95 = msg("00005:13", part165); - - var part166 = match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unknown mac!%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg96 = msg("00005:14", part166); - - var part167 = match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold has been changed to %{trigger_val}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg97 = msg("00005:15", part167); - - var part168 = match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg98 = msg("00005:16", part168); - - var part169 = match("MESSAGE#97:00005:17/1_0", "nwparser.p0", "destination-based %{p0}"); - - var part170 = match("MESSAGE#97:00005:17/1_1", "nwparser.p0", "source-based %{p0}"); - - var select38 = linear_select([ - part169, - part170, - ]); - - var part171 = match("MESSAGE#97:00005:17/2", "nwparser.p0", "session-limit threshold has been set at %{trigger_val->} in zone %{zone}."); - - var all33 = all_match({ - processors: [ - dup79, - select38, - part171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg99 = msg("00005:17", all33); - - var all34 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg100 = msg("00005:18", all34); - - var part172 = match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup84, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg101 = msg("00005:19", part172); - - var part173 = match("MESSAGE#100:00005:20", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} int %{interface}).%{space->} Occurred %{fld2->} times. (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup84, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg102 = msg("00005:20", part173); - - var select39 = linear_select([ - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - msg88, - msg89, - msg90, - msg91, - msg92, - msg93, - msg94, - msg95, - msg96, - msg97, - msg98, - msg99, - msg100, - msg101, - msg102, - ]); - - var part174 = match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg103 = msg("00006", part174); - - var part175 = match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname}\"", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg104 = msg("00006:01", part175); - - var part176 = match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg105 = msg("00006:02", part176); - - var part177 = match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg106 = msg("00006:03", part177); - - var part178 = match("MESSAGE#105:00006:04/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var all35 = all_match({ - processors: [ - part178, - dup338, - dup67, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg107 = msg("00006:04", all35); - - var all36 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg108 = msg("00006:05", all36); - - var select40 = linear_select([ - msg103, - msg104, - msg105, - msg106, - msg107, - msg108, - ]); - - var part179 = match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg109 = msg("00007", part179); - - var part180 = match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the local NetScreen device has changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg110 = msg("00007:01", part180); - - var part181 = match("MESSAGE#109:00007:02/0", "nwparser.payload", "HA state of the local device has changed to backup because a device with a %{p0}"); - - var part182 = match("MESSAGE#109:00007:02/1_0", "nwparser.p0", "higher priority has been detected%{}"); - - var part183 = match("MESSAGE#109:00007:02/1_1", "nwparser.p0", "lower MAC value has been detected%{}"); - - var select41 = linear_select([ - part182, - part183, - ]); - - var all37 = all_match({ - processors: [ - part181, - select41, - ], - on_success: processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg111 = msg("00007:02", all37); - - var part184 = match("MESSAGE#110:00007:03", "nwparser.payload", "HA state of the local device has changed to init because IP tracking has failed%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg112 = msg("00007:03", part184); - - var select42 = linear_select([ - dup88, - dup89, - ]); - - var part185 = match("MESSAGE#111:00007:04/4", "nwparser.p0", "has been changed%{}"); - - var all38 = all_match({ - processors: [ - dup87, - select42, - dup23, - dup344, - part185, - ], - on_success: processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg113 = msg("00007:04", all38); - - var part186 = match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device has been elected backup because a master already exists%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg114 = msg("00007:05", part186); - - var part187 = match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg115 = msg("00007:06", part187); - - var part188 = match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg116 = msg("00007:07", part188); - - var part189 = match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been elected master because no other master exists%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg117 = msg("00007:08", part189); - - var part190 = match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg118 = msg("00007:09", part190); - - var part191 = match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promoted the local NetScreen device to master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg119 = msg("00007:10", part191); - - var part192 = match("MESSAGE#118:00007:11/0", "nwparser.payload", "IP tracking device failover threshold has been %{p0}"); - - var select43 = linear_select([ - dup92, - dup93, - ]); - - var all39 = all_match({ - processors: [ - part192, - select43, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg120 = msg("00007:11", all39); - - var part193 = match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg121 = msg("00007:12", part193); - - var part194 = match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} with interval %{fld2->} threshold %{trigger_val->} weight %{fld4->} interface %{interface->} method %{fld5->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg122 = msg("00007:13", part194); - - var part195 = match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup60, - ])); - - var msg123 = msg("00007:14", part195); - - var part196 = match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been changed to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg124 = msg("00007:15", part196); - - var part197 = match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration and status changes to NetScreen-Global Manager has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg125 = msg("00007:16", part197); - - var part198 = match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg126 = msg("00007:17", part198); - - var part199 = match("MESSAGE#125:00007:18/0", "nwparser.payload", "Tracked IP %{hostip->} options have been changed from int %{fld2->} thr %{fld3->} wgt %{fld4->} inf %{fld5->} %{p0}"); - - var part200 = match("MESSAGE#125:00007:18/1_0", "nwparser.p0", "ping %{p0}"); - - var part201 = match("MESSAGE#125:00007:18/1_1", "nwparser.p0", "ARP %{p0}"); - - var select44 = linear_select([ - part200, - part201, - ]); - - var part202 = match("MESSAGE#125:00007:18/2", "nwparser.p0", "to %{fld6->} %{p0}"); - - var part203 = match("MESSAGE#125:00007:18/3_0", "nwparser.p0", "ping%{}"); - - var part204 = match("MESSAGE#125:00007:18/3_1", "nwparser.p0", "ARP%{}"); - - var select45 = linear_select([ - part203, - part204, - ]); - - var all40 = all_match({ - processors: [ - part199, - select44, - part202, - select45, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg127 = msg("00007:18", all40); - - var part205 = match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} path from %{change_old->} to %{change_new}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg128 = msg("00007:20", part205); - - var part206 = match("MESSAGE#127:00007:21/0", "nwparser.payload", "HA Slave is %{p0}"); - - var all41 = all_match({ - processors: [ - part206, - dup345, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg129 = msg("00007:21", all41); - - var part207 = match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{groupid}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg130 = msg("00007:22", part207); - - var part208 = match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg131 = msg("00007:23", part208); - - var part209 = match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg132 = msg("00007:24", part209); - - var part210 = match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial state.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg133 = msg("00007:25", part210); - - var part211 = match("MESSAGE#132:00007:26/0", "nwparser.payload", "HA: Change state to slave for %{p0}"); - - var part212 = match("MESSAGE#132:00007:26/1_0", "nwparser.p0", "tracking ip failed%{}"); - - var part213 = match("MESSAGE#132:00007:26/1_1", "nwparser.p0", "linkdown%{}"); - - var select46 = linear_select([ - part212, - part213, - ]); - - var all42 = all_match({ - processors: [ - part211, - select46, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg134 = msg("00007:26", all42); - - var part214 = match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command issued from original master to change state%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg135 = msg("00007:27", part214); - - var part215 = match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg136 = msg("00007:28", part215); - - var part216 = match("MESSAGE#135:00007:29/0", "nwparser.payload", "HA: Elected slave %{p0}"); - - var part217 = match("MESSAGE#135:00007:29/1_0", "nwparser.p0", "lower priority%{}"); - - var part218 = match("MESSAGE#135:00007:29/1_1", "nwparser.p0", "MAC value is larger%{}"); - - var part219 = match("MESSAGE#135:00007:29/1_2", "nwparser.p0", "master already exists%{}"); - - var part220 = match("MESSAGE#135:00007:29/1_3", "nwparser.p0", "detect new master with higher priority%{}"); - - var part221 = match("MESSAGE#135:00007:29/1_4", "nwparser.p0", "detect new master with smaller MAC value%{}"); - - var select47 = linear_select([ - part217, - part218, - part219, - part220, - part221, - ]); - - var all43 = all_match({ - processors: [ - part216, - select47, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg137 = msg("00007:29", all43); - - var part222 = match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command issued from original master to change state%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg138 = msg("00007:30", part222); - - var part223 = match("MESSAGE#137:00007:31/0", "nwparser.payload", "HA: ha link %{p0}"); - - var all44 = all_match({ - processors: [ - part223, - dup345, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg139 = msg("00007:31", all44); - - var part224 = match("MESSAGE#138:00007:32/0", "nwparser.payload", "NSRP %{fld2->} %{p0}"); - - var select48 = linear_select([ - dup89, - dup88, - ]); - - var part225 = match("MESSAGE#138:00007:32/4", "nwparser.p0", "changed.%{}"); - - var all45 = all_match({ - processors: [ - part224, - select48, - dup23, - dup344, - part225, - ], - on_success: processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg140 = msg("00007:32", all45); - - var part226 = match("MESSAGE#139:00007:33/0_0", "nwparser.payload", "NSRP: VSD %{p0}"); - - var part227 = match("MESSAGE#139:00007:33/0_1", "nwparser.payload", "Virtual Security Device group %{p0}"); - - var select49 = linear_select([ - part226, - part227, - ]); - - var part228 = match("MESSAGE#139:00007:33/1", "nwparser.p0", "%{fld2->} change%{p0}"); - - var part229 = match("MESSAGE#139:00007:33/2_0", "nwparser.p0", "d %{p0}"); - - var select50 = linear_select([ - part229, - dup96, - ]); - - var part230 = match("MESSAGE#139:00007:33/3", "nwparser.p0", "to %{fld3->} mode."); - - var all46 = all_match({ - processors: [ - select49, - part228, - select50, - part230, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg141 = msg("00007:33", all46); - - var part231 = match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropped: invalid encryption password.", processor_chain([ - dup97, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg142 = msg("00007:34", part231); - - var part232 = match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change to %{interface}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg143 = msg("00007:35", part232); - - var part233 = match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} local unit=%{fld3->} duplicate from unit=%{fld4}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg144 = msg("00007:36", part233); - - var part234 = match("MESSAGE#143:00007:37/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} is %{p0}"); - - var all47 = all_match({ - processors: [ - part234, - dup346, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg145 = msg("00007:37", all47); - - var part235 = match("MESSAGE#144:00007:38/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} peer=%{fld3->} from %{p0}"); - - var part236 = match("MESSAGE#144:00007:38/4", "nwparser.p0", "state %{p0}"); - - var part237 = match("MESSAGE#144:00007:38/5_0", "nwparser.p0", "missed heartbeat%{}"); - - var part238 = match("MESSAGE#144:00007:38/5_1", "nwparser.p0", "group detached%{}"); - - var select51 = linear_select([ - part237, - part238, - ]); - - var all48 = all_match({ - processors: [ - part235, - dup347, - dup103, - dup347, - part236, - select51, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg146 = msg("00007:38", all48); - - var part239 = match("MESSAGE#145:00007:39/0", "nwparser.payload", "RTO mirror group id=%{groupid->} is %{p0}"); - - var all49 = all_match({ - processors: [ - part239, - dup346, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg147 = msg("00007:39", all49); - - var part240 = match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (ifnum=%{fld3}) as secondary HA path", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg148 = msg("00007:40", part240); - - var part241 = match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg149 = msg("00007:41", part241); - - var part242 = match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fld2->} (ifnum=%{fld3})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg150 = msg("00007:42", part242); - - var part243 = match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg151 = msg("00007:43", part243); - - var part244 = match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is %{disposition->} total number=%{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg152 = msg("00007:44", part244); - - var part245 = match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local unit %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg153 = msg("00007:45", part245); - - var part246 = match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup60, - ])); - - var msg154 = msg("00007:46", part246); - - var part247 = match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg155 = msg("00007:47", part247); - - var part248 = match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped because it contained an invalid encryption password.", processor_chain([ - dup97, - dup2, - dup3, - dup4, - setc("disposition","dropped"), - setc("result","Invalid encryption Password"), - ])); - - var msg156 = msg("00007:48", part248); - - var part249 = match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of all Virtual Security Device groups changed from %{change_old->} to %{change_new}", processor_chain([ - setc("eventcategory","1604000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg157 = msg("00007:49", part249); - - var part250 = match("MESSAGE#156:00007:50/0", "nwparser.payload", "Device %{fld2->} %{p0}"); - - var part251 = match("MESSAGE#156:00007:50/1_0", "nwparser.p0", "has joined %{p0}"); - - var part252 = match("MESSAGE#156:00007:50/1_1", "nwparser.p0", "quit current %{p0}"); - - var select52 = linear_select([ - part251, - part252, - ]); - - var part253 = match("MESSAGE#156:00007:50/2", "nwparser.p0", "NSRP cluster %{fld3}"); - - var all50 = all_match({ - processors: [ - part250, - select52, - part253, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg158 = msg("00007:50", all50); - - var part254 = match("MESSAGE#157:00007:51/0", "nwparser.payload", "Virtual Security Device group %{group->} was %{p0}"); - - var part255 = match("MESSAGE#157:00007:51/1_1", "nwparser.p0", "deleted %{p0}"); - - var select53 = linear_select([ - dup104, - part255, - ]); - - var select54 = linear_select([ - dup105, - dup73, - ]); - - var part256 = match("MESSAGE#157:00007:51/4", "nwparser.p0", "The total number of members in the group %{p0}"); - - var select55 = linear_select([ - dup106, - dup107, - ]); - - var all51 = all_match({ - processors: [ - part254, - select53, - dup23, - select54, - part256, - select55, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg159 = msg("00007:51", all51); - - var part257 = match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group %{group->} %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg160 = msg("00007:52", part257); - - var part258 = match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the devices was set to interface %{interface->} with ifnum %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg161 = msg("00007:53", part258); - - var part259 = match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of the devices changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg162 = msg("00007:54", part259); - - var part260 = match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} with ifnum %{fld2->} was removed from the secondary HA path of the devices.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg163 = msg("00007:55", part260); - - var part261 = match("MESSAGE#162:00007:56", "nwparser.payload", "The probe that detects the status of High Availability link %{fld2->} was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg164 = msg("00007:56", part261); - - var select56 = linear_select([ - dup109, - dup110, - ]); - - var select57 = linear_select([ - dup111, - dup112, - ]); - - var part262 = match("MESSAGE#163:00007:57/4", "nwparser.p0", "the probe detecting the status of High Availability link %{fld2->} was set to %{fld3}"); - - var all52 = all_match({ - processors: [ - dup55, - select56, - dup23, - select57, - part262, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg165 = msg("00007:57", all52); - - var part263 = match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} for session synchronization(s) was accepted.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg166 = msg("00007:58", part263); - - var part264 = match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchronization by device %{fld2->} completed.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg167 = msg("00007:59", part264); - - var part265 = match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group %{group->} direction was set to %{direction}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg168 = msg("00007:60", part265); - - var part266 = match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group %{group->} was set.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg169 = msg("00007:61", part266); - - var part267 = match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group %{group->} with direction %{direction->} was unset.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg170 = msg("00007:62", part267); - - var part268 = match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} was unset.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg171 = msg("00007:63", part268); - - var part269 = match("MESSAGE#170:00007:64/1", "nwparser.p0", "%{fld2->} was removed from the monitoring list %{p0}"); - - var part270 = match("MESSAGE#170:00007:64/3", "nwparser.p0", "%{fld3}"); - - var all53 = all_match({ - processors: [ - dup348, - part269, - dup349, - part270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg172 = msg("00007:64", all53); - - var part271 = match("MESSAGE#171:00007:65/1", "nwparser.p0", "%{fld2->} with weight %{fld3->} was added%{p0}"); - - var part272 = match("MESSAGE#171:00007:65/2_0", "nwparser.p0", " to or updated on %{p0}"); - - var part273 = match("MESSAGE#171:00007:65/2_1", "nwparser.p0", "/updated to %{p0}"); - - var select58 = linear_select([ - part272, - part273, - ]); - - var part274 = match("MESSAGE#171:00007:65/3", "nwparser.p0", "the monitoring list %{p0}"); - - var part275 = match("MESSAGE#171:00007:65/5", "nwparser.p0", "%{fld4}"); - - var all54 = all_match({ - processors: [ - dup348, - part271, - select58, - part274, - dup349, - part275, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg173 = msg("00007:65", all54); - - var part276 = match("MESSAGE#172:00007:66/0_0", "nwparser.payload", "The monitoring %{p0}"); - - var part277 = match("MESSAGE#172:00007:66/0_1", "nwparser.payload", "Monitoring %{p0}"); - - var select59 = linear_select([ - part276, - part277, - ]); - - var part278 = match("MESSAGE#172:00007:66/1", "nwparser.p0", "threshold was modified to %{trigger_val->} o%{p0}"); - - var part279 = match("MESSAGE#172:00007:66/2_0", "nwparser.p0", "f %{p0}"); - - var select60 = linear_select([ - part279, - dup115, - ]); - - var all55 = all_match({ - processors: [ - select59, - part278, - select60, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg174 = msg("00007:66", all55); - - var part280 = match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg175 = msg("00007:67", part280); - - var part281 = match("MESSAGE#174:00007:68/0", "nwparser.payload", "NSRP b%{p0}"); - - var part282 = match("MESSAGE#174:00007:68/1_0", "nwparser.p0", "lack %{p0}"); - - var part283 = match("MESSAGE#174:00007:68/1_1", "nwparser.p0", "ack %{p0}"); - - var select61 = linear_select([ - part282, - part283, - ]); - - var part284 = match("MESSAGE#174:00007:68/2", "nwparser.p0", "hole prevention %{disposition}. Master(s) of Virtual Security Device groups %{p0}"); - - var part285 = match("MESSAGE#174:00007:68/3_0", "nwparser.p0", "may not exist %{p0}"); - - var part286 = match("MESSAGE#174:00007:68/3_1", "nwparser.p0", "always exists %{p0}"); - - var select62 = linear_select([ - part285, - part286, - ]); - - var all56 = all_match({ - processors: [ - part281, - select61, - part284, - select62, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg176 = msg("00007:68", all56); - - var part287 = match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchronization between devices was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg177 = msg("00007:69", part287); - - var part288 = match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was changed.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg178 = msg("00007:70", part288); - - var part289 = match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Active mode was %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg179 = msg("00007:71", part289); - - var part290 = match("MESSAGE#178:00007:72", "nwparser.payload", "NSRP: nsrp link probe enable on %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg180 = msg("00007:72", part290); - - var select63 = linear_select([ - msg109, - msg110, - msg111, - msg112, - msg113, - msg114, - msg115, - msg116, - msg117, - msg118, - msg119, - msg120, - msg121, - msg122, - msg123, - msg124, - msg125, - msg126, - msg127, - msg128, - msg129, - msg130, - msg131, - msg132, - msg133, - msg134, - msg135, - msg136, - msg137, - msg138, - msg139, - msg140, - msg141, - msg142, - msg143, - msg144, - msg145, - msg146, - msg147, - msg148, - msg149, - msg150, - msg151, - msg152, - msg153, - msg154, - msg155, - msg156, - msg157, - msg158, - msg159, - msg160, - msg161, - msg162, - msg163, - msg164, - msg165, - msg166, - msg167, - msg168, - msg169, - msg170, - msg171, - msg172, - msg173, - msg174, - msg175, - msg176, - msg177, - msg178, - msg179, - msg180, - ]); - - var part291 = match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg181 = msg("00008", part291); - - var msg182 = msg("00008:01", dup341); - - var part292 = match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg183 = msg("00008:02", part292); - - var part293 = match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been updated through NTP%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg184 = msg("00008:03", part293); - - var part294 = match("MESSAGE#183:00008:04/0", "nwparser.payload", "System clock %{p0}"); - - var part295 = match("MESSAGE#183:00008:04/1_0", "nwparser.p0", "configurations have been%{p0}"); - - var part296 = match("MESSAGE#183:00008:04/1_1", "nwparser.p0", "was%{p0}"); - - var part297 = match("MESSAGE#183:00008:04/1_2", "nwparser.p0", "is%{p0}"); - - var select64 = linear_select([ - part295, - part296, - part297, - ]); - - var part298 = match("MESSAGE#183:00008:04/2", "nwparser.p0", "%{}changed%{p0}"); - - var part299 = match("MESSAGE#183:00008:04/3_0", "nwparser.p0", " by admin %{administrator}"); - - var part300 = match("MESSAGE#183:00008:04/3_1", "nwparser.p0", " by %{username->} (%{fld1})"); - - var part301 = match("MESSAGE#183:00008:04/3_2", "nwparser.p0", " by %{username}"); - - var part302 = match("MESSAGE#183:00008:04/3_3", "nwparser.p0", " manually.%{}"); - - var part303 = match("MESSAGE#183:00008:04/3_4", "nwparser.p0", " manually%{}"); - - var select65 = linear_select([ - part299, - part300, - part301, - part302, - part303, - dup21, - ]); - - var all57 = all_match({ - processors: [ - part294, - select64, - part298, - select65, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg185 = msg("00008:04", all57); - - var part304 = match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg186 = msg("00008:05", part304); - - var part305 = match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg187 = msg("00008:06", part305); - - var part306 = match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup60, - ])); - - var msg188 = msg("00008:07", part306); - - var part307 = match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup60, - ])); - - var msg189 = msg("00008:08", part307); - - var part308 = match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manually%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg190 = msg("00008:09", part308); - - var part309 = match("MESSAGE#189:00008:10/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol}(zone %{p0}"); - - var all58 = all_match({ - processors: [ - part309, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ]), - }); - - var msg191 = msg("00008:10", all58); - - var select66 = linear_select([ - msg181, - msg182, - msg183, - msg184, - msg185, - msg186, - msg187, - msg188, - msg189, - msg190, - msg191, - ]); - - var part310 = match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg192 = msg("00009", part310); - - var part311 = match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg193 = msg("00009:01", part311); - - var part312 = match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg194 = msg("00009:02", part312); - - var part313 = match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for interface %{interface->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg195 = msg("00009:03", part313); - - var part314 = match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg196 = msg("00009:05", part314); - - var part315 = match("MESSAGE#195:00009:06/0_0", "nwparser.payload", "%{fld2}: The 802.1Q tag %{p0}"); - - var part316 = match("MESSAGE#195:00009:06/0_1", "nwparser.payload", "The 802.1Q tag %{p0}"); - - var select67 = linear_select([ - part315, - part316, - ]); - - var select68 = linear_select([ - dup119, - dup16, - ]); - - var part317 = match("MESSAGE#195:00009:06/3", "nwparser.p0", "interface %{interface->} has been %{p0}"); - - var part318 = match("MESSAGE#195:00009:06/4_1", "nwparser.p0", "changed to %{p0}"); - - var select69 = linear_select([ - dup120, - part318, - ]); - - var part319 = match("MESSAGE#195:00009:06/6_0", "nwparser.p0", "%{info->} from host %{saddr}"); - - var part320 = match_copy("MESSAGE#195:00009:06/6_1", "nwparser.p0", "info"); - - var select70 = linear_select([ - part319, - part320, - ]); - - var all59 = all_match({ - processors: [ - select67, - dup118, - select68, - part317, - select69, - dup23, - select70, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg197 = msg("00009:06", all59); - - var part321 = match("MESSAGE#196:00009:07/0", "nwparser.payload", "Maximum bandwidth %{fld2->} on %{p0}"); - - var part322 = match("MESSAGE#196:00009:07/2", "nwparser.p0", "%{} %{interface->} is less than t%{p0}"); - - var part323 = match("MESSAGE#196:00009:07/3_0", "nwparser.p0", "he total %{p0}"); - - var part324 = match("MESSAGE#196:00009:07/3_1", "nwparser.p0", "otal %{p0}"); - - var select71 = linear_select([ - part323, - part324, - ]); - - var part325 = match("MESSAGE#196:00009:07/4", "nwparser.p0", "guaranteed bandwidth %{fld3}"); - - var all60 = all_match({ - processors: [ - part321, - dup337, - part322, - select71, - part325, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg198 = msg("00009:07", all60); - - var part326 = match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth setting on the interface %{interface->} has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg199 = msg("00009:09", part326); - - var part327 = match("MESSAGE#198:00009:10/0", "nwparser.payload", "The operational mode for the interface %{interface->} has been changed to %{p0}"); - - var part328 = match("MESSAGE#198:00009:10/1_0", "nwparser.p0", "Route%{}"); - - var part329 = match("MESSAGE#198:00009:10/1_1", "nwparser.p0", "NAT%{}"); - - var select72 = linear_select([ - part328, - part329, - ]); - - var all61 = all_match({ - processors: [ - part327, - select72, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg200 = msg("00009:10", all61); - - var part330 = match("MESSAGE#199:00009:11/0_0", "nwparser.payload", "%{fld1}: VLAN %{p0}"); - - var part331 = match("MESSAGE#199:00009:11/0_1", "nwparser.payload", "VLAN %{p0}"); - - var select73 = linear_select([ - part330, - part331, - ]); - - var part332 = match("MESSAGE#199:00009:11/1", "nwparser.p0", "tag %{fld2->} has been %{disposition}"); - - var all62 = all_match({ - processors: [ - select73, - part332, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg201 = msg("00009:11", all62); - - var part333 = match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{disposition->} on interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg202 = msg("00009:12", part333); - - var part334 = match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on %{interface->} have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg203 = msg("00009:13", part334); - - var part335 = match("MESSAGE#202:00009:14/0_0", "nwparser.payload", "Global-PRO has been %{p0}"); - - var part336 = match("MESSAGE#202:00009:14/0_1", "nwparser.payload", "Global PRO has been %{p0}"); - - var part337 = match("MESSAGE#202:00009:14/0_2", "nwparser.payload", "DNS proxy was %{p0}"); - - var select74 = linear_select([ - part335, - part336, - part337, - ]); - - var part338 = match("MESSAGE#202:00009:14/1", "nwparser.p0", "%{disposition->} on %{p0}"); - - var select75 = linear_select([ - dup122, - dup123, - ]); - - var part339 = match("MESSAGE#202:00009:14/4_0", "nwparser.p0", "%{interface->} (%{fld2})"); - - var select76 = linear_select([ - part339, - dup124, - ]); - - var all63 = all_match({ - processors: [ - select74, - part338, - select75, - dup23, - select76, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg204 = msg("00009:14", all63); - - var part340 = match("MESSAGE#203:00009:15/0", "nwparser.payload", "Route between secondary IP%{p0}"); - - var part341 = match("MESSAGE#203:00009:15/1_0", "nwparser.p0", " addresses %{p0}"); - - var select77 = linear_select([ - part341, - dup125, - ]); - - var all64 = all_match({ - processors: [ - part340, - select77, - dup126, - dup350, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg205 = msg("00009:15", all64); - - var part342 = match("MESSAGE#204:00009:16/0", "nwparser.payload", "Secondary IP address %{hostip}/%{mask->} %{p0}"); - - var part343 = match("MESSAGE#204:00009:16/3_2", "nwparser.p0", "deleted from %{p0}"); - - var select78 = linear_select([ - dup129, - dup130, - part343, - ]); - - var part344 = match("MESSAGE#204:00009:16/4", "nwparser.p0", "interface %{interface}."); - - var all65 = all_match({ - processors: [ - part342, - dup350, - dup23, - select78, - part344, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg206 = msg("00009:16", all65); - - var part345 = match("MESSAGE#205:00009:17/0", "nwparser.payload", "Secondary IP address %{p0}"); - - var part346 = match("MESSAGE#205:00009:17/1_0", "nwparser.p0", "%{hostip}/%{mask->} was added to interface %{p0}"); - - var part347 = match("MESSAGE#205:00009:17/1_1", "nwparser.p0", "%{hostip->} was added to interface %{p0}"); - - var select79 = linear_select([ - part346, - part347, - ]); - - var part348 = match("MESSAGE#205:00009:17/2", "nwparser.p0", "%{interface}."); - - var all66 = all_match({ - processors: [ - part345, - select79, - part348, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg207 = msg("00009:17", all66); - - var part349 = match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on the interface %{interface->} has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg208 = msg("00009:18", part349); - - var part350 = match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg209 = msg("00009:19", part350); - - var part351 = match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg210 = msg("00009:27", part351); - - var part352 = match("MESSAGE#209:00009:20/0_0", "nwparser.payload", "%{fld2}: %{service->} has been %{p0}"); - - var part353 = match("MESSAGE#209:00009:20/0_1", "nwparser.payload", "%{service->} has been %{p0}"); - - var select80 = linear_select([ - part352, - part353, - ]); - - var part354 = match("MESSAGE#209:00009:20/1", "nwparser.p0", "%{disposition->} on interface %{interface->} %{p0}"); - - var part355 = match("MESSAGE#209:00009:20/2_0", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}"); - - var part356 = match("MESSAGE#209:00009:20/2_1", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}:%{sport}"); - - var part357 = match("MESSAGE#209:00009:20/2_2", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}"); - - var part358 = match("MESSAGE#209:00009:20/2_3", "nwparser.p0", "from host %{saddr->} (%{fld1})"); - - var select81 = linear_select([ - part355, - part356, - part357, - part358, - ]); - - var all67 = all_match({ - processors: [ - select80, - part354, - select81, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg211 = msg("00009:20", all67); - - var part359 = match("MESSAGE#210:00009:21/0", "nwparser.payload", "Source Route IP option! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var all68 = all_match({ - processors: [ - part359, - dup343, - dup131, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ]), - }); - - var msg212 = msg("00009:21", all68); - - var part360 = match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface->} has been changed to %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg213 = msg("00009:22", part360); - - var part361 = match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip->} has been added to interface %{interface->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg214 = msg("00009:23", part361); - - var part362 = match("MESSAGE#213:00009:24/0", "nwparser.payload", "Web has been enabled on interface %{interface->} by admin %{administrator->} via %{p0}"); - - var part363 = match("MESSAGE#213:00009:24/1_0", "nwparser.p0", "%{logon_type->} %{space}(%{p0}"); - - var part364 = match("MESSAGE#213:00009:24/1_1", "nwparser.p0", "%{logon_type}. (%{p0}"); - - var select82 = linear_select([ - part363, - part364, - ]); - - var part365 = match("MESSAGE#213:00009:24/2", "nwparser.p0", ")%{fld1}"); - - var all69 = all_match({ - processors: [ - part362, - select82, - part365, - ], - on_success: processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg215 = msg("00009:24", all69); - - var part366 = match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on interface %{interface->} by %{username->} via %{logon_type}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg216 = msg("00009:25", part366); - - var part367 = match("MESSAGE#215:00009:26/0", "nwparser.payload", "%{protocol->} has been %{disposition->} on interface %{interface->} by %{username->} via NSRP Peer . %{p0}"); - - var all70 = all_match({ - processors: [ - part367, - dup333, - ], - on_success: processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg217 = msg("00009:26", all70); - - var select83 = linear_select([ - msg192, - msg193, - msg194, - msg195, - msg196, - msg197, - msg198, - msg199, - msg200, - msg201, - msg202, - msg203, - msg204, - msg205, - msg206, - msg207, - msg208, - msg209, - msg210, - msg211, - msg212, - msg213, - msg214, - msg215, - msg216, - msg217, - ]); - - var part368 = match("MESSAGE#216:00010/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} %{p0}"); - - var part369 = match("MESSAGE#216:00010/1_0", "nwparser.p0", "using protocol %{p0}"); - - var part370 = match("MESSAGE#216:00010/1_1", "nwparser.p0", "proto %{p0}"); - - var select84 = linear_select([ - part369, - part370, - ]); - - var part371 = match("MESSAGE#216:00010/2", "nwparser.p0", "%{protocol->} %{p0}"); - - var part372 = match("MESSAGE#216:00010/3_0", "nwparser.p0", "( zone %{zone}, int %{interface}) %{p0}"); - - var part373 = match("MESSAGE#216:00010/3_1", "nwparser.p0", "zone %{zone->} int %{interface}) %{p0}"); - - var select85 = linear_select([ - part372, - part373, - dup126, - ]); - - var part374 = match("MESSAGE#216:00010/4", "nwparser.p0", ".%{space}The attack occurred %{dclass_counter1->} times%{p0}"); - - var all71 = all_match({ - processors: [ - part368, - select84, - part371, - select85, - part374, - dup351, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup5, - dup9, - dup3, - dup61, - ]), - }); - - var msg218 = msg("00010", all71); - - var part375 = match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg219 = msg("00010:01", part375); - - var part376 = match("MESSAGE#218:00010:02", "nwparser.payload", "Mapped IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg220 = msg("00010:02", part376); - - var all72 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup9, - dup3, - dup60, - ]), - }); - - var msg221 = msg("00010:03", all72); - - var select86 = linear_select([ - msg218, - msg219, - msg220, - msg221, - ]); - - var part377 = match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg222 = msg("00011", part377); - - var part378 = match("MESSAGE#221:00011:01/0", "nwparser.payload", "Route to %{daddr}/%{fld2->} [ %{p0}"); - - var select87 = linear_select([ - dup57, - dup56, - ]); - - var part379 = match("MESSAGE#221:00011:01/2", "nwparser.p0", "%{} %{interface->} gateway %{fld3->} ] has been %{disposition}"); - - var all73 = all_match({ - processors: [ - part378, - select87, - part379, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg223 = msg("00011:01", all73); - - var part380 = match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} to %{daddr->} protocol %{protocol->} (%{fld2})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg224 = msg("00011:02", part380); - - var part381 = match("MESSAGE#223:00011:03/0", "nwparser.payload", "An %{p0}"); - - var part382 = match("MESSAGE#223:00011:03/1_0", "nwparser.p0", "import %{p0}"); - - var part383 = match("MESSAGE#223:00011:03/1_1", "nwparser.p0", "export %{p0}"); - - var select88 = linear_select([ - part382, - part383, - ]); - - var part384 = match("MESSAGE#223:00011:03/2", "nwparser.p0", "rule in virtual router %{node->} to virtual router %{fld4->} with %{p0}"); - - var part385 = match("MESSAGE#223:00011:03/3_0", "nwparser.p0", "route-map %{fld3->} and protocol %{protocol->} has been %{p0}"); - - var part386 = match("MESSAGE#223:00011:03/3_1", "nwparser.p0", "IP-prefix %{hostip}/%{interface->} has been %{p0}"); - - var select89 = linear_select([ - part385, - part386, - ]); - - var all74 = all_match({ - processors: [ - part381, - select88, - part384, - select89, - dup36, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg225 = msg("00011:03", all74); - - var part387 = match("MESSAGE#224:00011:04/0", "nwparser.payload", "A route in virtual router %{node->} that has IP address %{hostip}/%{fld2->} through %{p0}"); - - var part388 = match("MESSAGE#224:00011:04/2", "nwparser.p0", "%{interface->} and gateway %{fld3->} with metric %{fld4->} has been %{disposition}"); - - var all75 = all_match({ - processors: [ - part387, - dup352, - part388, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg226 = msg("00011:04", all75); - - var part389 = match("MESSAGE#225:00011:05/1_0", "nwparser.p0", "sharable virtual router using name%{p0}"); - - var part390 = match("MESSAGE#225:00011:05/1_1", "nwparser.p0", "virtual router with name%{p0}"); - - var select90 = linear_select([ - part389, - part390, - ]); - - var part391 = match("MESSAGE#225:00011:05/2", "nwparser.p0", "%{} %{node->} and id %{fld2->} has been %{disposition}"); - - var all76 = all_match({ - processors: [ - dup79, - select90, - part391, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg227 = msg("00011:05", all76); - - var part392 = match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup59, - dup3, - dup60, - ])); - - var msg228 = msg("00011:07", part392); - - var part393 = match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{node->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg229 = msg("00011:08", part393); - - var part394 = match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg230 = msg("00011:09", part394); - - var part395 = match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes that can be created in virtual router %{node->} is %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg231 = msg("00011:10", part395); - - var part396 = match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg232 = msg("00011:11", part396); - - var part397 = match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual router %{node->} used by OSPF BGP routing instances id has been uninitialized", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg233 = msg("00011:12", part397); - - var part398 = match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be used by OSPF BGP routing instances in virtual router %{node->} has been set to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg234 = msg("00011:13", part398); - - var part399 = match("MESSAGE#233:00011:14/0", "nwparser.payload", "The routing preference for protocol %{protocol->} in virtual router %{node->} has been %{p0}"); - - var part400 = match("MESSAGE#233:00011:14/1_1", "nwparser.p0", "reset%{}"); - - var select91 = linear_select([ - dup134, - part400, - ]); - - var all77 = all_match({ - processors: [ - part399, - select91, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg235 = msg("00011:14", all77); - - var part401 = match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg236 = msg("00011:15", part401); - - var part402 = match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route through virtual router %{node->} has been added in virtual router %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg237 = msg("00011:16", part402); - - var part403 = match("MESSAGE#236:00011:17/0", "nwparser.payload", "The virtual router %{node->} has been made %{p0}"); - - var part404 = match("MESSAGE#236:00011:17/1_0", "nwparser.p0", "sharable%{}"); - - var part405 = match("MESSAGE#236:00011:17/1_1", "nwparser.p0", "unsharable%{}"); - - var part406 = match("MESSAGE#236:00011:17/1_2", "nwparser.p0", "default virtual router for virtual system %{fld2}"); - - var select92 = linear_select([ - part404, - part405, - part406, - ]); - - var all78 = all_match({ - processors: [ - part403, - select92, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg238 = msg("00011:17", all78); - - var part407 = match("MESSAGE#237:00011:18/0_0", "nwparser.payload", "Source route(s) %{p0}"); - - var part408 = match("MESSAGE#237:00011:18/0_1", "nwparser.payload", "A source route %{p0}"); - - var select93 = linear_select([ - part407, - part408, - ]); - - var part409 = match("MESSAGE#237:00011:18/1", "nwparser.p0", "in virtual router %{node->} %{p0}"); - - var part410 = match("MESSAGE#237:00011:18/2_0", "nwparser.p0", "with route addresses of %{p0}"); - - var part411 = match("MESSAGE#237:00011:18/2_1", "nwparser.p0", "that has IP address %{p0}"); - - var select94 = linear_select([ - part410, - part411, - ]); - - var part412 = match("MESSAGE#237:00011:18/3", "nwparser.p0", "%{hostip}/%{fld2->} through interface %{interface->} and %{p0}"); - - var part413 = match("MESSAGE#237:00011:18/4_0", "nwparser.p0", "a default gateway address %{p0}"); - - var select95 = linear_select([ - part413, - dup135, - ]); - - var part414 = match("MESSAGE#237:00011:18/5", "nwparser.p0", "%{fld3->} with metric %{fld4->} %{p0}"); - - var all79 = all_match({ - processors: [ - select93, - part409, - select94, - part412, - select95, - part414, - dup350, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg239 = msg("00011:18", all79); - - var part415 = match("MESSAGE#238:00011:19/0", "nwparser.payload", "Source Route(s) in virtual router %{node->} with %{p0}"); - - var part416 = match("MESSAGE#238:00011:19/1_0", "nwparser.p0", "route addresses of %{p0}"); - - var part417 = match("MESSAGE#238:00011:19/1_1", "nwparser.p0", "an IP address %{p0}"); - - var select96 = linear_select([ - part416, - part417, - ]); - - var part418 = match("MESSAGE#238:00011:19/2", "nwparser.p0", "%{hostip}/%{fld3->} and %{p0}"); - - var part419 = match("MESSAGE#238:00011:19/3_0", "nwparser.p0", "a default gateway address of %{p0}"); - - var select97 = linear_select([ - part419, - dup135, - ]); - - var part420 = match("MESSAGE#238:00011:19/4", "nwparser.p0", "%{fld4->} %{p0}"); - - var part421 = match("MESSAGE#238:00011:19/5_1", "nwparser.p0", "has been%{p0}"); - - var select98 = linear_select([ - dup107, - part421, - ]); - - var all80 = all_match({ - processors: [ - part415, - select96, - part418, - select97, - part420, - select98, - dup136, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg240 = msg("00011:19", all80); - - var part422 = match("MESSAGE#239:00011:20/0_0", "nwparser.payload", "%{fld2}: A %{p0}"); - - var select99 = linear_select([ - part422, - dup79, - ]); - - var part423 = match("MESSAGE#239:00011:20/1", "nwparser.p0", "route has been created in virtual router \"%{node}\"%{space}with an IP address %{hostip->} and next-hop as virtual router \"%{fld3}\""); - - var all81 = all_match({ - processors: [ - select99, - part423, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg241 = msg("00011:20", all81); - - var part424 = match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual router %{node->} for interface %{interface->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg242 = msg("00011:21", part424); - - var part425 = match("MESSAGE#241:00011:22", "nwparser.payload", "SIBR route in virtual router %{node->} for interface %{interface->} that has IP address %{hostip->} through interface %{fld3->} and gateway %{fld4->} with metric %{fld5->} was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg243 = msg("00011:22", part425); - - var all82 = all_match({ - processors: [ - dup132, - dup343, - dup131, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("saddr"), - field("daddr"), - ], - }), - ]), - }); - - var msg244 = msg("00011:23", all82); - - var part426 = match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{node}\" that has IP address %{hostip->} through interface %{interface->} and gateway %{fld2->} with metric %{fld3->} %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg245 = msg("00011:24", part426); - - var part427 = match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \"%{node}\" with an IP address %{hostip}/%{fld2->} and gateway %{fld3->} %{disposition}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg246 = msg("00011:25", part427); - - var part428 = match("MESSAGE#245:00011:26", "nwparser.payload", "Route in virtual router \"%{node}\" with IP address %{hostip}/%{fld2->} and next-hop as virtual router \"%{fld3}\" created. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg247 = msg("00011:26", part428); - - var select100 = linear_select([ - msg222, - msg223, - msg224, - msg225, - msg226, - msg227, - msg228, - msg229, - msg230, - msg231, - msg232, - msg233, - msg234, - msg235, - msg236, - msg237, - msg238, - msg239, - msg240, - msg241, - msg242, - msg243, - msg244, - msg245, - msg246, - msg247, - ]); - - var part429 = match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comments have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg248 = msg("00012:02", part429); - - var part430 = match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} %{change_attribute->} has been changed to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg249 = msg("00012:03", part430); - - var part431 = match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{group->} has %{disposition->} member %{username->} from host %{saddr}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg250 = msg("00012:04", part431); - - var part432 = match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2}) (%{fld3})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg251 = msg("00012:05", part432); - - var part433 = match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg252 = msg("00012:06", part433); - - var part434 = match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - dup59, - ])); - - var msg253 = msg("00012:07", part434); - - var part435 = match("MESSAGE#252:00012:08", "nwparser.payload", "%{fld2}: Service %{service->} has been %{disposition->} from host %{saddr->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg254 = msg("00012:08", part435); - - var all83 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg255 = msg("00012:09", all83); - - var all84 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg256 = msg("00012:10", all84); - - var part436 = match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup9, - dup61, - ])); - - var msg257 = msg("00012:11", part436); - - var part437 = match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{zone}) %{info->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg258 = msg("00012:12", part437); - - var part438 = match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg259 = msg("00012", part438); - - var part439 = match("MESSAGE#258:00012:01", "nwparser.payload", "Service %{service->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg260 = msg("00012:01", part439); - - var select101 = linear_select([ - msg248, - msg249, - msg250, - msg251, - msg252, - msg253, - msg254, - msg255, - msg256, - msg257, - msg258, - msg259, - msg260, - ]); - - var part440 = match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding bytes has been detected%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg261 = msg("00013", part440); - - var part441 = match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to connect to the NetScreen-Global Manager port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - setc("signame","An Attempt to connect to NetScreen-Global Manager Port."), - ])); - - var msg262 = msg("00013:01", part441); - - var part442 = match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has been changed to %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg263 = msg("00013:02", part442); - - var part443 = match("MESSAGE#262:00013:03", "nwparser.payload", "Web Filtering has been %{disposition->} (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg264 = msg("00013:03", part443); - - var select102 = linear_select([ - msg261, - msg262, - msg263, - msg264, - ]); - - var part444 = match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes has changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg265 = msg("00014", part444); - - var part445 = match("MESSAGE#264:00014:01/0", "nwparser.payload", "The group member %{username->} has been %{disposition->} %{p0}"); - - var part446 = match("MESSAGE#264:00014:01/1_0", "nwparser.p0", "to a group%{}"); - - var part447 = match("MESSAGE#264:00014:01/1_1", "nwparser.p0", "from a group%{}"); - - var select103 = linear_select([ - part446, - part447, - ]); - - var all85 = all_match({ - processors: [ - part445, - select103, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg266 = msg("00014:01", all85); - - var part448 = match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has been %{disposition->} by %{username}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg267 = msg("00014:02", part448); - - var part449 = match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has been %{disposition->} by %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg268 = msg("00014:03", part449); - - var part450 = match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{hostname->} server { %{hostip->} }: SrvErr (%{fld2}), SockErr (%{fld3}), Valid (%{fld4}),Connected (%{fld5})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg269 = msg("00014:04", part450); - - var part451 = match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations have been %{disposition->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg270 = msg("00014:05", part451); - - var part452 = match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition->} manually.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg271 = msg("00014:06", part452); - - var part453 = match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{disposition->} by %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg272 = msg("00014:07", part453); - - var part454 = match("MESSAGE#271:00014:08", "nwparser.payload", "Communication error with %{hostname->} server[%{hostip}]: SrvErr(%{fld2}),SockErr(%{fld3}),Valid(%{fld4}),Connected(%{fld5}) (%{fld1})", processor_chain([ - dup27, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg273 = msg("00014:08", part454); - - var select104 = linear_select([ - msg265, - msg266, - msg267, - msg268, - msg269, - msg270, - msg271, - msg272, - msg273, - ]); - - var part455 = match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been changed to %{authmethod}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg274 = msg("00015", part455); - - var part456 = match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has %{disposition}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg275 = msg("00015:01", part456); - - var part457 = match("MESSAGE#274:00015:02/0", "nwparser.payload", "LDAP %{p0}"); - - var part458 = match("MESSAGE#274:00015:02/1_0", "nwparser.p0", "server name %{p0}"); - - var part459 = match("MESSAGE#274:00015:02/1_2", "nwparser.p0", "distinguished name %{p0}"); - - var part460 = match("MESSAGE#274:00015:02/1_3", "nwparser.p0", "common name %{p0}"); - - var select105 = linear_select([ - part458, - dup137, - part459, - part460, - ]); - - var all86 = all_match({ - processors: [ - part457, - select105, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg276 = msg("00015:02", all86); - - var part461 = match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg277 = msg("00015:03", part461); - - var part462 = match("MESSAGE#276:00015:04/0", "nwparser.payload", "RADIUS server %{p0}"); - - var part463 = match("MESSAGE#276:00015:04/1_2", "nwparser.p0", "secret %{p0}"); - - var select106 = linear_select([ - dup139, - dup140, - part463, - ]); - - var all87 = all_match({ - processors: [ - part462, - select106, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg278 = msg("00015:04", all87); - - var part464 = match("MESSAGE#277:00015:05/0", "nwparser.payload", "SecurID %{p0}"); - - var part465 = match("MESSAGE#277:00015:05/1_0", "nwparser.p0", "authentication port %{p0}"); - - var part466 = match("MESSAGE#277:00015:05/1_1", "nwparser.p0", "duress mode %{p0}"); - - var part467 = match("MESSAGE#277:00015:05/1_3", "nwparser.p0", "number of retries value %{p0}"); - - var select107 = linear_select([ - part465, - part466, - dup76, - part467, - ]); - - var all88 = all_match({ - processors: [ - part464, - select107, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg279 = msg("00015:05", all88); - - var part468 = match("MESSAGE#278:00015:06/0_0", "nwparser.payload", "Master %{p0}"); - - var part469 = match("MESSAGE#278:00015:06/0_1", "nwparser.payload", "Backup %{p0}"); - - var select108 = linear_select([ - part468, - part469, - ]); - - var part470 = match("MESSAGE#278:00015:06/1", "nwparser.p0", "SecurID server IP address has been %{disposition}"); - - var all89 = all_match({ - processors: [ - select108, - part470, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg280 = msg("00015:06", all89); - - var part471 = match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg281 = msg("00015:07", part471); - - var part472 = match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration between master and slave%{}", processor_chain([ - dup141, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg282 = msg("00015:08", part472); - - var part473 = match("MESSAGE#281:00015:09/0_0", "nwparser.payload", "configuration %{p0}"); - - var part474 = match("MESSAGE#281:00015:09/0_1", "nwparser.payload", "Configuration %{p0}"); - - var select109 = linear_select([ - part473, - part474, - ]); - - var part475 = match("MESSAGE#281:00015:09/1", "nwparser.p0", "out of sync between local unit and remote unit%{}"); - - var all90 = all_match({ - processors: [ - select109, - part475, - ], - on_success: processor_chain([ - dup141, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg283 = msg("00015:09", all90); - - var part476 = match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg284 = msg("00015:10", part476); - - var part477 = match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg285 = msg("00015:11", part477); - - var part478 = match("MESSAGE#284:00015:12/1_0", "nwparser.p0", "control %{p0}"); - - var part479 = match("MESSAGE#284:00015:12/1_1", "nwparser.p0", "data %{p0}"); - - var select110 = linear_select([ - part478, - part479, - ]); - - var part480 = match("MESSAGE#284:00015:12/2", "nwparser.p0", "channel moved from link %{p0}"); - - var part481 = match("MESSAGE#284:00015:12/6", "nwparser.p0", "(%{interface})"); - - var all91 = all_match({ - processors: [ - dup87, - select110, - part480, - dup353, - dup103, - dup353, - part481, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg286 = msg("00015:12", all91); - - var part482 = match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg287 = msg("00015:13", part482); - - var part483 = match("MESSAGE#286:00015:14/0", "nwparser.payload", "NSRP link %{p0}"); - - var all92 = all_match({ - processors: [ - part483, - dup353, - dup116, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg288 = msg("00015:14", all92); - - var part484 = match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel available (%{fld3->} used by other channel)", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg289 = msg("00015:15", part484); - - var part485 = match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out of synchronization between the local device and the peer device.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg290 = msg("00015:16", part485); - - var part486 = match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{change_old->} changed to link channel %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg291 = msg("00015:17", part486); - - var part487 = match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on peer device %{fld2->} changed from %{fld3->} to %{fld4->} state.", processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - setc("change_attribute","RTO mirror group"), - ])); - - var msg292 = msg("00015:18", part487); - - var part488 = match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on local device %{fld2}, detected a duplicate direction on the peer device %{fld3}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg293 = msg("00015:19", part488); - - var part489 = match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} changed on the local device from %{fld2->} to up state, it had peer device %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg294 = msg("00015:20", part489); - - var part490 = match("MESSAGE#293:00015:21/0", "nwparser.payload", "Peer device %{fld2->} %{p0}"); - - var part491 = match("MESSAGE#293:00015:21/1_0", "nwparser.p0", "disappeared %{p0}"); - - var part492 = match("MESSAGE#293:00015:21/1_1", "nwparser.p0", "was discovered %{p0}"); - - var select111 = linear_select([ - part491, - part492, - ]); - - var all93 = all_match({ - processors: [ - part490, - select111, - dup116, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg295 = msg("00015:21", all93); - - var part493 = match("MESSAGE#294:00015:22/0_0", "nwparser.payload", "The local %{p0}"); - - var part494 = match("MESSAGE#294:00015:22/0_1", "nwparser.payload", "The peer %{p0}"); - - var part495 = match("MESSAGE#294:00015:22/0_2", "nwparser.payload", "Peer %{p0}"); - - var select112 = linear_select([ - part493, - part494, - part495, - ]); - - var part496 = match("MESSAGE#294:00015:22/1", "nwparser.p0", "device %{fld2->} in the Virtual Security Device group %{group->} changed %{change_attribute->} from %{change_old->} to %{change_new->} %{p0}"); - - var all94 = all_match({ - processors: [ - select112, - part496, - dup354, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg296 = msg("00015:22", all94); - - var part497 = match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg297 = msg("00015:23", part497); - - var part498 = match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authentication server has been changed to %{hostname}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg298 = msg("00015:24", part498); - - var part499 = match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification was successful", processor_chain([ - setc("eventcategory","1613050100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg299 = msg("00015:25", part499); - - var part500 = match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification failed", processor_chain([ - dup97, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg300 = msg("00015:29", part500); - - var part501 = match("MESSAGE#299:00015:26/0", "nwparser.payload", "unit %{fld2->} just dis%{p0}"); - - var part502 = match("MESSAGE#299:00015:26/1_0", "nwparser.p0", "appeared%{}"); - - var part503 = match("MESSAGE#299:00015:26/1_1", "nwparser.p0", "covered%{}"); - - var select113 = linear_select([ - part502, - part503, - ]); - - var all95 = all_match({ - processors: [ - part501, - select113, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg301 = msg("00015:26", all95); - - var part504 = match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change to %{interface}. (%{fld2})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - dup146, - ])); - - var msg302 = msg("00015:33", part504); - - var part505 = match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg303 = msg("00015:27", part505); - - var part506 = match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RADIUS retry timeout has been set to default of %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg304 = msg("00015:28", part506); - - var part507 = match("MESSAGE#303:00015:30/0", "nwparser.payload", "Number of RADIUS retries for auth server %{hostname->} %{p0}"); - - var part508 = match("MESSAGE#303:00015:30/2", "nwparser.p0", "set to %{fld2->} (%{fld1})"); - - var all96 = all_match({ - processors: [ - part507, - dup355, - part508, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg305 = msg("00015:30", all96); - - var part509 = match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth server %{hostname->} is unset to its default value, %{info->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg306 = msg("00015:31", part509); - - var part510 = match("MESSAGE#305:00015:32", "nwparser.payload", "Accounting port of server RADIUS is set to %{network_port}. (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg307 = msg("00015:32", part510); - - var select114 = linear_select([ - msg274, - msg275, - msg276, - msg277, - msg278, - msg279, - msg280, - msg281, - msg282, - msg283, - msg284, - msg285, - msg286, - msg287, - msg288, - msg289, - msg290, - msg291, - msg292, - msg293, - msg294, - msg295, - msg296, - msg297, - msg298, - msg299, - msg300, - msg301, - msg302, - msg303, - msg304, - msg305, - msg306, - msg307, - ]); - - var part511 = match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg308 = msg("00016", part511); - - var part512 = match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg309 = msg("00016:01", part512); - - var part513 = match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disposition}", processor_chain([ - dup1, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg310 = msg("00016:02", part513); - - var part514 = match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2})", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg311 = msg("00016:03", part514); - - var part515 = match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg312 = msg("00016:05", part515); - - var part516 = match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg313 = msg("00016:06", part516); - - var part517 = match("MESSAGE#312:00016:07/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} ( zone %{p0}"); - - var all97 = all_match({ - processors: [ - part517, - dup338, - dup67, - ], - on_success: processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg314 = msg("00016:07", all97); - - var part518 = match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) Modify by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - setc("eventcategory","1001020305"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg315 = msg("00016:08", part518); - - var part519 = match("MESSAGE#314:00016:09", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) New by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - setc("eventcategory","1001030305"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg316 = msg("00016:09", part519); - - var select115 = linear_select([ - msg308, - msg309, - msg310, - msg311, - msg312, - msg313, - msg314, - msg315, - msg316, - ]); - - var part520 = match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ])); - - var msg317 = msg("00017", part520); - - var part521 = match("MESSAGE#316:00017:23/0", "nwparser.payload", "Gateway %{fld2->} at %{fld3->} in %{fld5->} mode with ID %{p0}"); - - var part522 = match("MESSAGE#316:00017:23/1_0", "nwparser.p0", "[%{fld4}] %{p0}"); - - var part523 = match("MESSAGE#316:00017:23/1_1", "nwparser.p0", "%{fld4->} %{p0}"); - - var select116 = linear_select([ - part522, - part523, - ]); - - var part524 = match("MESSAGE#316:00017:23/2", "nwparser.p0", "has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} %{fld}"); - - var all98 = all_match({ - processors: [ - part521, - select116, - part524, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg318 = msg("00017:23", all98); - - var part525 = match("MESSAGE#317:00017:01/0_0", "nwparser.payload", "%{fld1}: Gateway %{p0}"); - - var part526 = match("MESSAGE#317:00017:01/0_1", "nwparser.payload", "Gateway %{p0}"); - - var select117 = linear_select([ - part525, - part526, - ]); - - var part527 = match("MESSAGE#317:00017:01/1", "nwparser.p0", "%{fld2->} at %{fld3->} in %{fld5->} mode with ID%{p0}"); - - var part528 = match("MESSAGE#317:00017:01/3", "nwparser.p0", "%{fld4->} has been %{disposition}"); - - var all99 = all_match({ - processors: [ - select117, - part527, - dup356, - part528, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg319 = msg("00017:01", all99); - - var part529 = match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settings have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg320 = msg("00017:02", part529); - - var part530 = match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg321 = msg("00017:03", part530); - - var part531 = match("MESSAGE#320:00017:04/2", "nwparser.p0", "%{group_object->} with range %{fld2->} has been %{disposition}"); - - var all100 = all_match({ - processors: [ - dup153, - dup357, - part531, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg322 = msg("00017:04", all100); - - var part532 = match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg323 = msg("00017:05", part532); - - var part533 = match("MESSAGE#322:00017:06/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been set to %{p0}"); - - var part534 = match("MESSAGE#322:00017:06/1_0", "nwparser.p0", "clear %{p0}"); - - var part535 = match("MESSAGE#322:00017:06/1_2", "nwparser.p0", "copy %{p0}"); - - var select118 = linear_select([ - part534, - dup101, - part535, - ]); - - var all101 = all_match({ - processors: [ - part533, - select118, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg324 = msg("00017:06", all101); - - var part536 = match("MESSAGE#323:00017:07/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been %{p0}"); - - var part537 = match("MESSAGE#323:00017:07/1_0", "nwparser.p0", "clear%{}"); - - var part538 = match("MESSAGE#323:00017:07/1_1", "nwparser.p0", "cleared%{}"); - - var part539 = match("MESSAGE#323:00017:07/1_3", "nwparser.p0", "copy%{}"); - - var part540 = match("MESSAGE#323:00017:07/1_4", "nwparser.p0", "copied%{}"); - - var select119 = linear_select([ - part537, - part538, - dup98, - part539, - part540, - ]); - - var all102 = all_match({ - processors: [ - part536, - select119, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg325 = msg("00017:07", all102); - - var part541 = match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and SPI %{fld3}/%{fld4->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg326 = msg("00017:08", part541); - - var part542 = match("MESSAGE#325:00017:09/0_0", "nwparser.payload", "%{fld1}: VPN %{p0}"); - - var part543 = match("MESSAGE#325:00017:09/0_1", "nwparser.payload", "VPN %{p0}"); - - var select120 = linear_select([ - part542, - part543, - ]); - - var part544 = match("MESSAGE#325:00017:09/1", "nwparser.p0", "%{group->} with gateway %{fld2->} %{p0}"); - - var part545 = match("MESSAGE#325:00017:09/2_0", "nwparser.p0", "no-rekey %{p0}"); - - var part546 = match("MESSAGE#325:00017:09/2_1", "nwparser.p0", "rekey, %{p0}"); - - var part547 = match("MESSAGE#325:00017:09/2_2", "nwparser.p0", "rekey %{p0}"); - - var select121 = linear_select([ - part545, - part546, - part547, - ]); - - var part548 = match("MESSAGE#325:00017:09/3", "nwparser.p0", "and p2-proposal %{fld3->} has been %{p0}"); - - var part549 = match("MESSAGE#325:00017:09/4_0", "nwparser.p0", "%{disposition->} from peer unit"); - - var part550 = match("MESSAGE#325:00017:09/4_1", "nwparser.p0", "%{disposition->} from host %{saddr}"); - - var select122 = linear_select([ - part549, - part550, - dup36, - ]); - - var all103 = all_match({ - processors: [ - select120, - part544, - select121, - part548, - select122, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg327 = msg("00017:09", all103); - - var part551 = match("MESSAGE#326:00017:10/0", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}. Src IF %{sinterface->} dst IP %{daddr->} with rekeying %{p0}"); - - var all104 = all_match({ - processors: [ - part551, - dup358, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg328 = msg("00017:10", all104); - - var part552 = match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg329 = msg("00017:11", part552); - - var part553 = match("MESSAGE#328:00017:12/0", "nwparser.payload", "VPN monitoring %{p0}"); - - var part554 = match("MESSAGE#328:00017:12/1_2", "nwparser.p0", "frequency %{p0}"); - - var select123 = linear_select([ - dup109, - dup110, - part554, - ]); - - var all105 = all_match({ - processors: [ - part553, - select123, - dup127, - dup359, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg330 = msg("00017:12", all105); - - var part555 = match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been added by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg331 = msg("00017:26", part555); - - var part556 = match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. You cannot allocate an IP address.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg332 = msg("00017:13", part556); - - var part557 = match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail}, DH group %{group}, ESP %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup9, - dup5, - ])); - - var msg333 = msg("00017:14", part557); - - var part558 = match("MESSAGE#332:00017:15/0", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group->} %{p0}"); - - var part559 = match("MESSAGE#332:00017:15/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime (%{fld3}) (%{fld4}) has been %{disposition}."); - - var all106 = all_match({ - processors: [ - part558, - dup360, - part559, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg334 = msg("00017:15", all106); - - var part560 = match("MESSAGE#333:00017:31/0", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail->} DH group %{group->} %{p0}"); - - var part561 = match("MESSAGE#333:00017:31/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime %{fld3->} has been %{disposition}."); - - var all107 = all_match({ - processors: [ - part560, - dup360, - part561, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg335 = msg("00017:31", all107); - - var part562 = match("MESSAGE#334:00017:16/0", "nwparser.payload", "vpnmonitor interval is %{p0}"); - - var all108 = all_match({ - processors: [ - part562, - dup359, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg336 = msg("00017:16", all108); - - var part563 = match("MESSAGE#335:00017:17/0", "nwparser.payload", "vpnmonitor threshold is %{p0}"); - - var select124 = linear_select([ - dup99, - dup93, - ]); - - var all109 = all_match({ - processors: [ - part563, - select124, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg337 = msg("00017:17", all109); - - var part564 = match("MESSAGE#336:00017:18/2", "nwparser.p0", "%{group_object->} with range %{fld2->} was %{disposition}"); - - var all110 = all_match({ - processors: [ - dup153, - dup357, - part564, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg338 = msg("00017:18", all110); - - var part565 = match("MESSAGE#337:00017:19/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at %{p0}"); - - var part566 = match("MESSAGE#337:00017:19/2", "nwparser.p0", "%{} %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all111 = all_match({ - processors: [ - part565, - dup337, - part566, - ], - on_success: processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ]), - }); - - var msg339 = msg("00017:19", all111); - - var all112 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup151, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - ]), - }); - - var msg340 = msg("00017:20", all112); - - var part567 = match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ])); - - var msg341 = msg("00017:21", part567); - - var part568 = match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg342 = msg("00017:22", part568); - - var part569 = match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bound to tunnel interface %{interface}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg343 = msg("00017:24", part569); - - var part570 = match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal standard has been added by admin %{administrator->} via NSRP Peer (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg344 = msg("00017:25", part570); - - var part571 = match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group}, ESP, enc %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg345 = msg("00017:28", part571); - - var part572 = match("MESSAGE#344:00017:29", "nwparser.payload", "L2TP \"%{fld2}\", all-L2TP-users secret \"%{fld3}\" keepalive %{fld4->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg346 = msg("00017:29", part572); - - var select125 = linear_select([ - msg317, - msg318, - msg319, - msg320, - msg321, - msg322, - msg323, - msg324, - msg325, - msg326, - msg327, - msg328, - msg329, - msg330, - msg331, - msg332, - msg333, - msg334, - msg335, - msg336, - msg337, - msg338, - msg339, - msg340, - msg341, - msg342, - msg343, - msg344, - msg345, - msg346, - ]); - - var part573 = match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} and %{fld3->} have been exchanged", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg347 = msg("00018", part573); - - var part574 = match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", processor_chain([ - setc("eventcategory","1502010000"), - dup2, - dup4, - dup5, - dup3, - ])); - - var msg348 = msg("00018:01", part574); - - var part575 = match("MESSAGE#347:00018:02", "nwparser.payload", "Device%{quote}s %{change_attribute->} has been changed from %{change_old->} to %{change_new->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg349 = msg("00018:02", part575); - - var part576 = match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg350 = msg("00018:04", part576); - - var part577 = match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} by admin %{administrator->} via NSRP Peer", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg351 = msg("00018:16", part577); - - var part578 = match("MESSAGE#350:00018:06/0", "nwparser.payload", "%{fld2->} Policy %{policy_id->} has been moved %{p0}"); - - var part579 = match("MESSAGE#350:00018:06/1_0", "nwparser.p0", "before %{p0}"); - - var part580 = match("MESSAGE#350:00018:06/1_1", "nwparser.p0", "after %{p0}"); - - var select126 = linear_select([ - part579, - part580, - ]); - - var part581 = match("MESSAGE#350:00018:06/2", "nwparser.p0", "%{fld3->} by admin %{administrator}"); - - var all113 = all_match({ - processors: [ - part578, - select126, - part581, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg352 = msg("00018:06", all113); - - var part582 = match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} application was modified to %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg353 = msg("00018:08", part582); - - var part583 = match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup3, - dup2, - dup9, - dup4, - dup5, - ])); - - var msg354 = msg("00018:09", part583); - - var part584 = match("MESSAGE#353:00018:10/0", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{p0}"); - - var part585 = match("MESSAGE#353:00018:10/1_0", "nwparser.p0", "%{disposition->} from peer unit by %{p0}"); - - var part586 = match("MESSAGE#353:00018:10/1_1", "nwparser.p0", "%{disposition->} by %{p0}"); - - var select127 = linear_select([ - part585, - part586, - ]); - - var part587 = match("MESSAGE#353:00018:10/2", "nwparser.p0", "%{username->} via %{interface->} from host %{saddr->} (%{fld1})"); - - var all114 = all_match({ - processors: [ - part584, - select127, - part587, - ], - on_success: processor_chain([ - dup17, - dup3, - dup2, - dup9, - dup4, - dup5, - ]), - }); - - var msg355 = msg("00018:10", all114); - - var part588 = match("MESSAGE#354:00018:11/1_0", "nwparser.p0", "Service %{service->} was %{p0}"); - - var part589 = match("MESSAGE#354:00018:11/1_1", "nwparser.p0", "Attack group %{signame->} was %{p0}"); - - var select128 = linear_select([ - part588, - part589, - ]); - - var part590 = match("MESSAGE#354:00018:11/2", "nwparser.p0", "%{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} %{p0}"); - - var part591 = match("MESSAGE#354:00018:11/3_0", "nwparser.p0", "to %{daddr}:%{dport}. %{p0}"); - - var select129 = linear_select([ - part591, - dup16, - ]); - - var all115 = all_match({ - processors: [ - dup160, - select128, - part590, - select129, - dup10, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg356 = msg("00018:11", all115); - - var part592 = match("MESSAGE#355:00018:12/0", "nwparser.payload", "In policy %{policy_id}, the %{p0}"); - - var part593 = match("MESSAGE#355:00018:12/1_0", "nwparser.p0", "application %{p0}"); - - var part594 = match("MESSAGE#355:00018:12/1_1", "nwparser.p0", "attack severity %{p0}"); - - var part595 = match("MESSAGE#355:00018:12/1_2", "nwparser.p0", "DI attack component %{p0}"); - - var select130 = linear_select([ - part593, - part594, - part595, - ]); - - var part596 = match("MESSAGE#355:00018:12/2", "nwparser.p0", "was modified by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all116 = all_match({ - processors: [ - part592, - select130, - part596, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg357 = msg("00018:12", all116); - - var part597 = match("MESSAGE#356:00018:32/1", "nwparser.p0", "%{}address %{dhost}(%{daddr}) was %{disposition->} %{p0}"); - - var all117 = all_match({ - processors: [ - dup361, - part597, - dup362, - dup164, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg358 = msg("00018:32", all117); - - var part598 = match("MESSAGE#357:00018:22/1", "nwparser.p0", "%{}address %{dhost->} was %{disposition->} %{p0}"); - - var all118 = all_match({ - processors: [ - dup361, - part598, - dup362, - dup164, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg359 = msg("00018:22", all118); - - var part599 = match("MESSAGE#358:00018:15/0", "nwparser.payload", "%{agent->} was %{disposition->} from policy %{policy_id->} %{p0}"); - - var select131 = linear_select([ - dup78, - dup77, - ]); - - var part600 = match("MESSAGE#358:00018:15/2", "nwparser.p0", "address by admin %{administrator->} via NSRP Peer"); - - var all119 = all_match({ - processors: [ - part599, - select131, - part600, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg360 = msg("00018:15", all119); - - var part601 = match("MESSAGE#359:00018:14/0", "nwparser.payload", "%{agent->} was %{disposition->} %{p0}"); - - var part602 = match("MESSAGE#359:00018:14/1_0", "nwparser.p0", "to%{p0}"); - - var part603 = match("MESSAGE#359:00018:14/1_1", "nwparser.p0", "from%{p0}"); - - var select132 = linear_select([ - part602, - part603, - ]); - - var part604 = match("MESSAGE#359:00018:14/2", "nwparser.p0", "%{}policy %{policy_id->} %{p0}"); - - var part605 = match("MESSAGE#359:00018:14/3_0", "nwparser.p0", "service %{p0}"); - - var part606 = match("MESSAGE#359:00018:14/3_1", "nwparser.p0", "source address %{p0}"); - - var part607 = match("MESSAGE#359:00018:14/3_2", "nwparser.p0", "destination address %{p0}"); - - var select133 = linear_select([ - part605, - part606, - part607, - ]); - - var part608 = match("MESSAGE#359:00018:14/4", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all120 = all_match({ - processors: [ - part601, - select132, - part604, - select133, - part608, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg361 = msg("00018:14", all120); - - var part609 = match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg362 = msg("00018:29", part609); - - var part610 = match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to policy %{policy_id->} %{rule_group->} by admin %{administrator->} via NSRP Peer %{space->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg363 = msg("00018:07", part610); - - var part611 = match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg364 = msg("00018:18", part611); - - var part612 = match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{disposition->} from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg365 = msg("00018:17", part612); - - var part613 = match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg366 = msg("00018:19", part613); - - var part614 = match("MESSAGE#365:00018:23/0_0", "nwparser.payload", "Destination %{p0}"); - - var part615 = match("MESSAGE#365:00018:23/0_1", "nwparser.payload", "Source %{p0}"); - - var select134 = linear_select([ - part614, - part615, - ]); - - var part616 = match("MESSAGE#365:00018:23/1", "nwparser.p0", "address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} %{p0}"); - - var part617 = match("MESSAGE#365:00018:23/2_0", "nwparser.p0", "from host %{p0}"); - - var select135 = linear_select([ - part617, - dup103, - ]); - - var part618 = match("MESSAGE#365:00018:23/4_0", "nwparser.p0", "%{saddr->} to %{daddr->} %{p0}"); - - var part619 = match("MESSAGE#365:00018:23/4_1", "nwparser.p0", "%{daddr->} %{p0}"); - - var select136 = linear_select([ - part618, - part619, - ]); - - var part620 = match("MESSAGE#365:00018:23/5", "nwparser.p0", "%{dport}:(%{fld1})"); - - var all121 = all_match({ - processors: [ - select134, - part616, - select135, - dup23, - select136, - part620, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg367 = msg("00018:23", all121); - - var part621 = match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg368 = msg("00018:21", part621); - - var part622 = match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{disposition->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg369 = msg("00018:24", part622); - - var part623 = match("MESSAGE#368:00018:25/1", "nwparser.p0", "%{}address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); - - var all122 = all_match({ - processors: [ - dup363, - part623, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg370 = msg("00018:25", all122); - - var part624 = match("MESSAGE#369:00018:30/1", "nwparser.p0", "%{}address %{info->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); - - var all123 = all_match({ - processors: [ - dup363, - part624, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg371 = msg("00018:30", all123); - - var part625 = match("MESSAGE#370:00018:26/0", "nwparser.payload", "In policy %{policy_id}, the application was modified to %{disposition->} by %{p0}"); - - var part626 = match("MESSAGE#370:00018:26/2_1", "nwparser.p0", "%{logon_type->} from host %{saddr}. (%{p0}"); - - var select137 = linear_select([ - dup48, - part626, - ]); - - var all124 = all_match({ - processors: [ - part625, - dup364, - select137, - dup41, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg372 = msg("00018:26", all124); - - var part627 = match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the DI attack component was modified by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg373 = msg("00018:27", part627); - - var part628 = match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the DI attack component was modified by admin %{administrator->} via %{logon_type}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup4, - dup5, - dup9, - setc("info","the DI attack component was modified"), - ])); - - var msg374 = msg("00018:28", part628); - - var part629 = match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition}", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg375 = msg("00018:03", part629); - - var part630 = match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the option %{fld2->} was %{disposition}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg376 = msg("00018:31", part630); - - var select138 = linear_select([ - msg347, - msg348, - msg349, - msg350, - msg351, - msg352, - msg353, - msg354, - msg355, - msg356, - msg357, - msg358, - msg359, - msg360, - msg361, - msg362, - msg363, - msg364, - msg365, - msg366, - msg367, - msg368, - msg369, - msg370, - msg371, - msg372, - msg373, - msg374, - msg375, - msg376, - ]); - - var part631 = match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has %{disposition->} because WebTrends settings have not yet been configured", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg377 = msg("00019", part631); - - var part632 = match("MESSAGE#375:00019:01/2", "nwparser.p0", "has %{disposition->} because syslog settings have not yet been configured"); - - var all125 = all_match({ - processors: [ - dup165, - dup365, - part632, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg378 = msg("00019:01", all125); - - var part633 = match("MESSAGE#376:00019:02/0", "nwparser.payload", "Socket cannot be assigned for %{p0}"); - - var part634 = match("MESSAGE#376:00019:02/1_0", "nwparser.p0", "WebTrends%{}"); - - var part635 = match("MESSAGE#376:00019:02/1_1", "nwparser.p0", "syslog%{}"); - - var select139 = linear_select([ - part634, - part635, - ]); - - var all126 = all_match({ - processors: [ - part633, - select139, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg379 = msg("00019:02", all126); - - var part636 = match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has been %{disposition}", processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg380 = msg("00019:03", part636); - - var select140 = linear_select([ - dup169, - dup78, - ]); - - var select141 = linear_select([ - dup139, - dup170, - dup137, - dup122, - ]); - - var all127 = all_match({ - processors: [ - dup168, - select140, - dup23, - select141, - dup171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg381 = msg("00019:04", all127); - - var part637 = match("MESSAGE#379:00019:05/0", "nwparser.payload", "Syslog message level has been changed to %{p0}"); - - var part638 = match("MESSAGE#379:00019:05/1_0", "nwparser.p0", "debug%{}"); - - var part639 = match("MESSAGE#379:00019:05/1_1", "nwparser.p0", "information%{}"); - - var part640 = match("MESSAGE#379:00019:05/1_2", "nwparser.p0", "notification%{}"); - - var part641 = match("MESSAGE#379:00019:05/1_3", "nwparser.p0", "warning%{}"); - - var part642 = match("MESSAGE#379:00019:05/1_4", "nwparser.p0", "error%{}"); - - var part643 = match("MESSAGE#379:00019:05/1_5", "nwparser.p0", "critical%{}"); - - var part644 = match("MESSAGE#379:00019:05/1_6", "nwparser.p0", "alert%{}"); - - var part645 = match("MESSAGE#379:00019:05/1_7", "nwparser.p0", "emergency%{}"); - - var select142 = linear_select([ - part638, - part639, - part640, - part641, - part642, - part643, - part644, - part645, - ]); - - var all128 = all_match({ - processors: [ - part637, - select142, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg382 = msg("00019:05", all128); - - var part646 = match("MESSAGE#380:00019:06/2", "nwparser.p0", "has been changed to %{p0}"); - - var all129 = all_match({ - processors: [ - dup168, - dup366, - part646, - dup367, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg383 = msg("00019:06", all129); - - var part647 = match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has been %{disposition}", processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg384 = msg("00019:07", part647); - - var part648 = match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg385 = msg("00019:08", part648); - - var part649 = match("MESSAGE#383:00019:09/0", "nwparser.payload", "WebTrends host %{p0}"); - - var select143 = linear_select([ - dup139, - dup170, - dup137, - ]); - - var all130 = all_match({ - processors: [ - part649, - select143, - dup171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg386 = msg("00019:09", all130); - - var part650 = match("MESSAGE#384:00019:10/1_0", "nwparser.p0", "Traffic logging via syslog %{p0}"); - - var part651 = match("MESSAGE#384:00019:10/1_1", "nwparser.p0", "Syslog %{p0}"); - - var select144 = linear_select([ - part650, - part651, - ]); - - var all131 = all_match({ - processors: [ - dup183, - select144, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg387 = msg("00019:10", all131); - - var part652 = match("MESSAGE#385:00019:11/2", "nwparser.p0", "has %{disposition->} because there is no syslog server defined"); - - var all132 = all_match({ - processors: [ - dup165, - dup365, - part652, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg388 = msg("00019:11", all132); - - var part653 = match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg389 = msg("00019:12", part653); - - var part654 = match("MESSAGE#387:00019:13/0", "nwparser.payload", "Syslog server %{hostip->} %{p0}"); - - var select145 = linear_select([ - dup107, - dup106, - ]); - - var part655 = match("MESSAGE#387:00019:13/2", "nwparser.p0", "%{disposition}"); - - var all133 = all_match({ - processors: [ - part654, - select145, - part655, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg390 = msg("00019:13", all133); - - var part656 = match("MESSAGE#388:00019:14/2", "nwparser.p0", "for %{hostip->} has been changed to %{p0}"); - - var all134 = all_match({ - processors: [ - dup168, - dup366, - part656, - dup367, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg391 = msg("00019:14", all134); - - var part657 = match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the TCP server %{hostip}; the connection is closed.", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg392 = msg("00019:15", part657); - - var part658 = match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were removed.%{}", processor_chain([ - setc("eventcategory","1701030000"), - setc("ec_activity","Delete"), - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg393 = msg("00019:16", part658); - - var part659 = match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} host port number has been changed to %{network_port->} %{fld5}", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg394 = msg("00019:17", part659); - - var part660 = match("MESSAGE#392:00019:18/0", "nwparser.payload", "Traffic logging %{p0}"); - - var part661 = match("MESSAGE#392:00019:18/1_0", "nwparser.p0", "via syslog %{p0}"); - - var part662 = match("MESSAGE#392:00019:18/1_1", "nwparser.p0", "for syslog server %{hostip->} %{p0}"); - - var select146 = linear_select([ - part661, - part662, - ]); - - var all135 = all_match({ - processors: [ - part660, - select146, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg395 = msg("00019:18", all135); - - var part663 = match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog server %{hostip->} was changed to udp", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg396 = msg("00019:19", part663); - - var part664 = match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is enabled on backup device by netscreen via web from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg397 = msg("00019:20", part664); - - var select147 = linear_select([ - msg377, - msg378, - msg379, - msg380, - msg381, - msg382, - msg383, - msg384, - msg385, - msg386, - msg387, - msg388, - msg389, - msg390, - msg391, - msg392, - msg393, - msg394, - msg395, - msg396, - msg397, - ]); - - var part665 = match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg398 = msg("00020", part665); - - var part666 = match("MESSAGE#396:00020:01/0", "nwparser.payload", "System memory is low %{p0}"); - - var part667 = match("MESSAGE#396:00020:01/1_1", "nwparser.p0", "( %{p0}"); - - var select148 = linear_select([ - dup152, - part667, - ]); - - var part668 = match("MESSAGE#396:00020:01/2", "nwparser.p0", "%{fld2->} bytes allocated out of %{p0}"); - - var part669 = match("MESSAGE#396:00020:01/3_0", "nwparser.p0", "total %{fld3->} bytes"); - - var part670 = match("MESSAGE#396:00020:01/3_1", "nwparser.p0", "%{fld4->} bytes total"); - - var select149 = linear_select([ - part669, - part670, - ]); - - var all136 = all_match({ - processors: [ - part666, - select148, - part668, - select149, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg399 = msg("00020:01", all136); - - var part671 = match("MESSAGE#397:00020:02", "nwparser.payload", "System memory is low (%{fld2->} allocated out of %{fld3->} ) %{fld4->} times in %{fld5}", processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg400 = msg("00020:02", part671); - - var select150 = linear_select([ - msg398, - msg399, - msg400, - ]); - - var part672 = match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg401 = msg("00021", part672); - - var part673 = match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range %{info->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg402 = msg("00021:01", part673); - - var part674 = match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg403 = msg("00021:02", part674); - - var part675 = match("MESSAGE#401:00021:03", "nwparser.payload", "Connection refused by the DNS server%{}", processor_chain([ - dup185, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg404 = msg("00021:03", part675); - - var part676 = match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg405 = msg("00021:04", part676); - - var part677 = match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg406 = msg("00021:05", part677); - - var part678 = match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - setc("info","DIP port-translation stickiness was modified"), - ])); - - var msg407 = msg("00021:06", part678); - - var select151 = linear_select([ - msg401, - msg402, - msg403, - msg404, - msg405, - msg406, - msg407, - ]); - - var part679 = match("MESSAGE#405:00022/1_0", "nwparser.p0", "power supplies %{p0}"); - - var part680 = match("MESSAGE#405:00022/1_1", "nwparser.p0", "fans %{p0}"); - - var select152 = linear_select([ - part679, - part680, - ]); - - var part681 = match("MESSAGE#405:00022/2", "nwparser.p0", "are %{fld2->} functioning properly"); - - var all137 = all_match({ - processors: [ - dup186, - select152, - part681, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg408 = msg("00022", all137); - - var part682 = match("MESSAGE#406:00022:01/0_0", "nwparser.payload", "At least one power supply %{p0}"); - - var part683 = match("MESSAGE#406:00022:01/0_1", "nwparser.payload", "The power supply %{fld2->} %{p0}"); - - var part684 = match("MESSAGE#406:00022:01/0_2", "nwparser.payload", "At least one fan %{p0}"); - - var select153 = linear_select([ - part682, - part683, - part684, - ]); - - var part685 = match("MESSAGE#406:00022:01/1", "nwparser.p0", "is not functioning properly%{p0}"); - - var all138 = all_match({ - processors: [ - select153, - part685, - dup368, - ], - on_success: processor_chain([ - dup187, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg409 = msg("00022:01", all138); - - var part686 = match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management tunnel has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg410 = msg("00022:02", part686); - - var part687 = match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name has been defined as %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg411 = msg("00022:03", part687); - - var part688 = match("MESSAGE#409:00022:04/0", "nwparser.payload", "Reporting of the %{p0}"); - - var part689 = match("MESSAGE#409:00022:04/1_0", "nwparser.p0", "network activities %{p0}"); - - var part690 = match("MESSAGE#409:00022:04/1_1", "nwparser.p0", "device resources %{p0}"); - - var part691 = match("MESSAGE#409:00022:04/1_2", "nwparser.p0", "event logs %{p0}"); - - var part692 = match("MESSAGE#409:00022:04/1_3", "nwparser.p0", "summary logs %{p0}"); - - var select154 = linear_select([ - part689, - part690, - part691, - part692, - ]); - - var part693 = match("MESSAGE#409:00022:04/2", "nwparser.p0", "to Global Manager has been %{disposition}"); - - var all139 = all_match({ - processors: [ - part688, - select154, - part693, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg412 = msg("00022:04", all139); - - var part694 = match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg413 = msg("00022:05", part694); - - var part695 = match("MESSAGE#411:00022:06/0", "nwparser.payload", "Global Manager %{p0}"); - - var part696 = match("MESSAGE#411:00022:06/1_0", "nwparser.p0", "report %{p0}"); - - var part697 = match("MESSAGE#411:00022:06/1_1", "nwparser.p0", "listen %{p0}"); - - var select155 = linear_select([ - part696, - part697, - ]); - - var part698 = match("MESSAGE#411:00022:06/2", "nwparser.p0", "port has been set to %{interface}"); - - var all140 = all_match({ - processors: [ - part695, - select155, - part698, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg414 = msg("00022:06", all140); - - var part699 = match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive value has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg415 = msg("00022:07", part699); - - var part700 = match("MESSAGE#413:00022:08/0_0", "nwparser.payload", "System temperature %{p0}"); - - var part701 = match("MESSAGE#413:00022:08/0_1", "nwparser.payload", "System's temperature: %{p0}"); - - var part702 = match("MESSAGE#413:00022:08/0_2", "nwparser.payload", "The system temperature %{p0}"); - - var select156 = linear_select([ - part700, - part701, - part702, - ]); - - var part703 = match("MESSAGE#413:00022:08/1", "nwparser.p0", "(%{fld2->} C%{p0}"); - - var part704 = match("MESSAGE#413:00022:08/2_0", "nwparser.p0", "entigrade, %{p0}"); - - var select157 = linear_select([ - part704, - dup96, - ]); - - var part705 = match("MESSAGE#413:00022:08/3", "nwparser.p0", "%{fld3->} F%{p0}"); - - var part706 = match("MESSAGE#413:00022:08/4_0", "nwparser.p0", "ahrenheit %{p0}"); - - var select158 = linear_select([ - part706, - dup96, - ]); - - var part707 = match("MESSAGE#413:00022:08/5", "nwparser.p0", ") is too high%{}"); - - var all141 = all_match({ - processors: [ - select156, - part703, - select157, - part705, - select158, - part707, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg416 = msg("00022:08", all141); - - var part708 = match("MESSAGE#414:00022:09/2", "nwparser.p0", "power supply is no%{p0}"); - - var select159 = linear_select([ - dup191, - dup192, - ]); - - var part709 = match("MESSAGE#414:00022:09/4", "nwparser.p0", "functioning properly%{}"); - - var all142 = all_match({ - processors: [ - dup55, - dup369, - part708, - select159, - part709, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg417 = msg("00022:09", all142); - - var part710 = match("MESSAGE#415:00022:10/0", "nwparser.payload", "The NetScreen device was unable to upgrade the file system%{p0}"); - - var part711 = match("MESSAGE#415:00022:10/1_0", "nwparser.p0", " due to an internal conflict%{}"); - - var part712 = match("MESSAGE#415:00022:10/1_1", "nwparser.p0", ", but the old file system is intact%{}"); - - var select160 = linear_select([ - part711, - part712, - ]); - - var all143 = all_match({ - processors: [ - part710, - select160, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg418 = msg("00022:10", all143); - - var part713 = match("MESSAGE#416:00022:11/0", "nwparser.payload", "The NetScreen device was unable to upgrade %{p0}"); - - var part714 = match("MESSAGE#416:00022:11/1_0", "nwparser.p0", "due to an internal conflict%{}"); - - var part715 = match("MESSAGE#416:00022:11/1_1", "nwparser.p0", "the loader, but the loader is intact%{}"); - - var select161 = linear_select([ - part714, - part715, - ]); - - var all144 = all_match({ - processors: [ - part713, - select161, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg419 = msg("00022:11", all144); - - var part716 = match("MESSAGE#417:00022:12/0", "nwparser.payload", "Battery is no%{p0}"); - - var select162 = linear_select([ - dup192, - dup191, - ]); - - var part717 = match("MESSAGE#417:00022:12/2", "nwparser.p0", "functioning properly.%{}"); - - var all145 = all_match({ - processors: [ - part716, - select162, - part717, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg420 = msg("00022:12", all145); - - var part718 = match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2->} Centigrade, %{fld3->} Fahrenheit) is OK now.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg421 = msg("00022:13", part718); - - var part719 = match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is functioning properly. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg422 = msg("00022:14", part719); - - var select163 = linear_select([ - msg408, - msg409, - msg410, - msg411, - msg412, - msg413, - msg414, - msg415, - msg416, - msg417, - msg418, - msg419, - msg420, - msg421, - msg422, - ]); - - var part720 = match("MESSAGE#420:00023", "nwparser.payload", "VIP server %{hostip->} is not responding", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg423 = msg("00023", part720); - - var part721 = match("MESSAGE#421:00023:01", "nwparser.payload", "VIP/load balance server %{hostip->} cannot be contacted", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg424 = msg("00023:01", part721); - - var part722 = match("MESSAGE#422:00023:02", "nwparser.payload", "VIP server %{hostip->} cannot be contacted", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg425 = msg("00023:02", part722); - - var select164 = linear_select([ - msg423, - msg424, - msg425, - ]); - - var part723 = match("MESSAGE#423:00024/0_0", "nwparser.payload", "The DHCP %{p0}"); - - var part724 = match("MESSAGE#423:00024/0_1", "nwparser.payload", " DHCP %{p0}"); - - var select165 = linear_select([ - part723, - part724, - ]); - - var part725 = match("MESSAGE#423:00024/2_0", "nwparser.p0", "IP address pool has %{p0}"); - - var part726 = match("MESSAGE#423:00024/2_1", "nwparser.p0", "options have been %{p0}"); - - var select166 = linear_select([ - part725, - part726, - ]); - - var all146 = all_match({ - processors: [ - select165, - dup193, - select166, - dup52, - dup368, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg426 = msg("00024", all146); - - var part727 = match("MESSAGE#424:00024:01/0_0", "nwparser.payload", "Traffic log %{p0}"); - - var part728 = match("MESSAGE#424:00024:01/0_1", "nwparser.payload", "Alarm log %{p0}"); - - var part729 = match("MESSAGE#424:00024:01/0_2", "nwparser.payload", "Event log %{p0}"); - - var part730 = match("MESSAGE#424:00024:01/0_3", "nwparser.payload", "Self log %{p0}"); - - var part731 = match("MESSAGE#424:00024:01/0_4", "nwparser.payload", "Asset Recovery log %{p0}"); - - var select167 = linear_select([ - part727, - part728, - part729, - part730, - part731, - ]); - - var part732 = match("MESSAGE#424:00024:01/1", "nwparser.p0", "has overflowed%{}"); - - var all147 = all_match({ - processors: [ - select167, - part732, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg427 = msg("00024:01", all147); - - var part733 = match("MESSAGE#425:00024:02/0", "nwparser.payload", "DHCP relay agent settings on %{fld2->} %{p0}"); - - var part734 = match("MESSAGE#425:00024:02/1_0", "nwparser.p0", "are %{p0}"); - - var part735 = match("MESSAGE#425:00024:02/1_1", "nwparser.p0", "have been %{p0}"); - - var select168 = linear_select([ - part734, - part735, - ]); - - var part736 = match("MESSAGE#425:00024:02/2", "nwparser.p0", "%{disposition->} (%{fld1})"); - - var all148 = all_match({ - processors: [ - part733, - select168, - part736, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg428 = msg("00024:02", all148); - - var part737 = match("MESSAGE#426:00024:03/0", "nwparser.payload", "DHCP server IP address pool %{p0}"); - - var select169 = linear_select([ - dup194, - dup106, - ]); - - var part738 = match("MESSAGE#426:00024:03/2", "nwparser.p0", "changed. (%{fld1})"); - - var all149 = all_match({ - processors: [ - part737, - select169, - part738, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg429 = msg("00024:03", all149); - - var select170 = linear_select([ - msg426, - msg427, - msg428, - msg429, - ]); - - var part739 = match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool has changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg430 = msg("00025", part739); - - var part740 = match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{disposition->} to save the certificate authority configuration.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg431 = msg("00025:01", part740); - - var part741 = match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the X509 request file via e-mail", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg432 = msg("00025:02", part741); - - var part742 = match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the CA configuration", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg433 = msg("00025:03", part742); - - var part743 = match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certificates. The %{result}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg434 = msg("00025:04", part743); - - var select171 = linear_select([ - msg430, - msg431, - msg432, - msg433, - msg434, - ]); - - var part744 = match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg435 = msg("00026", part744); - - var part745 = match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on interface %{interface}", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg436 = msg("00026:13", part745); - - var part746 = match("MESSAGE#434:00026:01/2", "nwparser.p0", "PKA key has been %{p0}"); - - var part747 = match("MESSAGE#434:00026:01/4", "nwparser.p0", "admin user %{administrator}. (Key ID = %{fld2})"); - - var all150 = all_match({ - processors: [ - dup195, - dup370, - part746, - dup371, - part747, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg437 = msg("00026:01", all150); - - var part748 = match("MESSAGE#435:00026:02/1_0", "nwparser.p0", ": SCS %{p0}"); - - var select172 = linear_select([ - part748, - dup96, - ]); - - var part749 = match("MESSAGE#435:00026:02/2", "nwparser.p0", "has been %{disposition->} for %{p0}"); - - var part750 = match("MESSAGE#435:00026:02/3_0", "nwparser.p0", "root system %{p0}"); - - var part751 = match("MESSAGE#435:00026:02/3_1", "nwparser.p0", "%{interface->} %{p0}"); - - var select173 = linear_select([ - part750, - part751, - ]); - - var all151 = all_match({ - processors: [ - dup195, - select172, - part749, - select173, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg438 = msg("00026:02", all151); - - var part752 = match("MESSAGE#436:00026:03/2", "nwparser.p0", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}"); - - var all152 = all_match({ - processors: [ - dup195, - dup370, - part752, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg439 = msg("00026:03", all152); - - var part753 = match("MESSAGE#437:00026:04", "nwparser.payload", "SCS: Connection has been terminated for admin user %{administrator->} at %{hostip}:%{network_port}", processor_chain([ - dup198, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg440 = msg("00026:04", part753); - - var part754 = match("MESSAGE#438:00026:05", "nwparser.payload", "SCS: Host client has requested NO cipher from %{interface}", processor_chain([ - dup198, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg441 = msg("00026:05", part754); - - var part755 = match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using PKA RSA from %{saddr}:%{sport}. (key-ID=%{fld2}", processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg442 = msg("00026:06", part755); - - var part756 = match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using password from %{saddr}:%{sport}.", processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg443 = msg("00026:07", part756); - - var part757 = match("MESSAGE#441:00026:08/0", "nwparser.payload", "SSH user %{username->} has been authenticated using %{p0}"); - - var part758 = match("MESSAGE#441:00026:08/2", "nwparser.p0", "from %{saddr}:%{sport->} [ with key ID %{fld2->} ]"); - - var all153 = all_match({ - processors: [ - part757, - dup372, - part758, - ], - on_success: processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg444 = msg("00026:08", all153); - - var part759 = match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interface->} with tunnel ID %{fld2->} received a packet with a bad SPI.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg445 = msg("00026:09", part759); - - var part760 = match("MESSAGE#443:00026:10/0", "nwparser.payload", "SSH: %{p0}"); - - var part761 = match("MESSAGE#443:00026:10/1_0", "nwparser.p0", "Failed %{p0}"); - - var part762 = match("MESSAGE#443:00026:10/1_1", "nwparser.p0", "Attempt %{p0}"); - - var select174 = linear_select([ - part761, - part762, - ]); - - var part763 = match("MESSAGE#443:00026:10/3_0", "nwparser.p0", "bind duplicate %{p0}"); - - var select175 = linear_select([ - part763, - dup201, - ]); - - var part764 = match("MESSAGE#443:00026:10/6", "nwparser.p0", "admin user '%{administrator}' (Key ID %{fld2})"); - - var all154 = all_match({ - processors: [ - part760, - select174, - dup103, - select175, - dup202, - dup373, - part764, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg446 = msg("00026:10", all154); - - var part765 = match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA keys (%{fld2}) has been bound to user '%{username}' Key not bound. (Key ID %{fld3})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg447 = msg("00026:11", part765); - - var part766 = match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg448 = msg("00026:12", part766); - - var select176 = linear_select([ - msg435, - msg436, - msg437, - msg438, - msg439, - msg440, - msg441, - msg442, - msg443, - msg444, - msg445, - msg446, - msg447, - msg448, - ]); - - var part767 = match("MESSAGE#446:00027/2", "nwparser.p0", "user %{username->} from %{p0}"); - - var part768 = match("MESSAGE#446:00027/3_0", "nwparser.p0", "IP address %{saddr}:%{sport}"); - - var part769 = match("MESSAGE#446:00027/3_1", "nwparser.p0", "%{saddr}:%{sport}"); - - var part770 = match("MESSAGE#446:00027/3_2", "nwparser.p0", "console%{}"); - - var select177 = linear_select([ - part768, - part769, - part770, - ]); - - var all155 = all_match({ - processors: [ - dup204, - dup374, - part767, - select177, - ], - on_success: processor_chain([ - dup206, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg449 = msg("00027", all155); - - var part771 = match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg450 = msg("00027:01", part771); - - var part772 = match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg451 = msg("00027:02", part772); - - var part773 = match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg452 = msg("00027:03", part773); - - var part774 = match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg453 = msg("00027:04", part774); - - var part775 = match("MESSAGE#451:00027:05/0", "nwparser.payload", "ScreenOS %{version->} %{p0}"); - - var part776 = match("MESSAGE#451:00027:05/1_0", "nwparser.p0", "Serial %{p0}"); - - var part777 = match("MESSAGE#451:00027:05/1_1", "nwparser.p0", "serial %{p0}"); - - var select178 = linear_select([ - part776, - part777, - ]); - - var part778 = match("MESSAGE#451:00027:05/2", "nwparser.p0", "# %{fld2}: Asset recovery %{p0}"); - - var part779 = match("MESSAGE#451:00027:05/3_0", "nwparser.p0", "performed %{p0}"); - - var select179 = linear_select([ - part779, - dup127, - ]); - - var select180 = linear_select([ - dup207, - dup208, - ]); - - var all156 = all_match({ - processors: [ - part775, - select178, - part778, - select179, - dup23, - select180, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg454 = msg("00027:05", all156); - - var part780 = match("MESSAGE#452:00027:06/0", "nwparser.payload", "Device Reset (Asset Recovery) has been %{p0}"); - - var select181 = linear_select([ - dup208, - dup207, - ]); - - var all157 = all_match({ - processors: [ - part780, - select181, - ], - on_success: processor_chain([ - setc("eventcategory","1606000000"), - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg455 = msg("00027:06", all157); - - var part781 = match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg456 = msg("00027:07", part781); - - var part782 = match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been erased%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg457 = msg("00027:08", part782); - - var part783 = match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due to expire in %{fld3}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg458 = msg("00027:09", part783); - - var part784 = match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has expired.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg459 = msg("00027:10", part784); - - var part785 = match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired after 30-day grace period.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg460 = msg("00027:11", part785); - - var part786 = match("MESSAGE#458:00027:12/0", "nwparser.payload", "Request to retrieve license key failed to reach %{p0}"); - - var part787 = match("MESSAGE#458:00027:12/1_0", "nwparser.p0", "the server %{p0}"); - - var select182 = linear_select([ - part787, - dup193, - ]); - - var part788 = match("MESSAGE#458:00027:12/2", "nwparser.p0", "by %{fld2}. Server url: %{url}"); - - var all158 = all_match({ - processors: [ - part786, - select182, - part788, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg461 = msg("00027:12", all158); - - var part789 = match("MESSAGE#459:00027:13/2", "nwparser.p0", "user %{username}"); - - var all159 = all_match({ - processors: [ - dup204, - dup374, - part789, - ], - on_success: processor_chain([ - dup206, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg462 = msg("00027:13", all159); - - var part790 = match("MESSAGE#460:00027:14/0", "nwparser.payload", "Configuration Erasure Process %{p0}"); - - var part791 = match("MESSAGE#460:00027:14/1_0", "nwparser.p0", "has been initiated %{p0}"); - - var part792 = match("MESSAGE#460:00027:14/1_1", "nwparser.p0", "aborted %{p0}"); - - var select183 = linear_select([ - part791, - part792, - ]); - - var part793 = match("MESSAGE#460:00027:14/2", "nwparser.p0", ".%{space}(%{fld1})"); - - var all160 = all_match({ - processors: [ - part790, - select183, - part793, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg463 = msg("00027:14", all160); - - var part794 = match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg464 = msg("00027:15", part794); - - var part795 = match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{policy_id->} name \"%{fld2->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg465 = msg("00027:16", part795); - - var part796 = match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locked and will be unlocked after %{duration->} minutes (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg466 = msg("00027:17", part796); - - var part797 = match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{username->} from %{saddr->} is refused as this account is locked (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg467 = msg("00027:18", part797); - - var part798 = match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg468 = msg("00027:19", part798); - - var select184 = linear_select([ - msg449, - msg450, - msg451, - msg452, - msg453, - msg454, - msg455, - msg456, - msg457, - msg458, - msg459, - msg460, - msg461, - msg462, - msg463, - msg464, - msg465, - msg466, - msg467, - msg468, - ]); - - var part799 = match("MESSAGE#462:00028/0_0", "nwparser.payload", "An Intruder%{p0}"); - - var part800 = match("MESSAGE#462:00028/0_1", "nwparser.payload", "Intruder%{p0}"); - - var part801 = match("MESSAGE#462:00028/0_2", "nwparser.payload", "An intruter%{p0}"); - - var select185 = linear_select([ - part799, - part800, - part801, - ]); - - var part802 = match("MESSAGE#462:00028/1", "nwparser.p0", "%{}has attempted to connect to the NetScreen-Global PRO port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all161 = all_match({ - processors: [ - select185, - part802, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - setc("signame","Attempt to Connect to the NetScreen-Global Port"), - ]), - }); - - var msg469 = msg("00028", all161); - - var part803 = match("MESSAGE#463:00029", "nwparser.payload", "DNS has been refreshed%{}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg470 = msg("00029", part803); - - var part804 = match("MESSAGE#464:00029:01", "nwparser.payload", "DHCP file write: out of memory.%{}", processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg471 = msg("00029:01", part804); - - var part805 = match("MESSAGE#465:00029:02/0", "nwparser.payload", "The DHCP process cannot open file %{fld2->} to %{p0}"); - - var part806 = match("MESSAGE#465:00029:02/1_0", "nwparser.p0", "read %{p0}"); - - var part807 = match("MESSAGE#465:00029:02/1_1", "nwparser.p0", "write %{p0}"); - - var select186 = linear_select([ - part806, - part807, - ]); - - var part808 = match("MESSAGE#465:00029:02/2", "nwparser.p0", "data.%{}"); - - var all162 = all_match({ - processors: [ - part805, - select186, - part808, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg472 = msg("00029:02", all162); - - var part809 = match("MESSAGE#466:00029:03/2", "nwparser.p0", "%{} %{interface->} is full. Unable to %{p0}"); - - var part810 = match("MESSAGE#466:00029:03/3_0", "nwparser.p0", "commit %{p0}"); - - var part811 = match("MESSAGE#466:00029:03/3_1", "nwparser.p0", "offer %{p0}"); - - var select187 = linear_select([ - part810, - part811, - ]); - - var part812 = match("MESSAGE#466:00029:03/4", "nwparser.p0", "IP address to client at %{fld2}"); - - var all163 = all_match({ - processors: [ - dup210, - dup337, - part809, - select187, - part812, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg473 = msg("00029:03", all163); - - var part813 = match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{interface->} (another server found on %{hostip}).", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg474 = msg("00029:04", part813); - - var select188 = linear_select([ - msg470, - msg471, - msg472, - msg473, - msg474, - ]); - - var part814 = match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg475 = msg("00030", part814); - - var part815 = match("MESSAGE#469:00030:01/0", "nwparser.payload", "DSS checking of CRLs has been changed from %{p0}"); - - var part816 = match("MESSAGE#469:00030:01/1_0", "nwparser.p0", "0 to 1%{}"); - - var part817 = match("MESSAGE#469:00030:01/1_1", "nwparser.p0", "1 to 0%{}"); - - var select189 = linear_select([ - part816, - part817, - ]); - - var all164 = all_match({ - processors: [ - part815, - select189, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg476 = msg("00030:01", all164); - - var part818 = match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg477 = msg("00030:05", part818); - - var part819 = match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate request the %{fld2->} field has been changed from %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg478 = msg("00030:06", part819); - - var part820 = match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be loaded%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg479 = msg("00030:07", part820); - - var part821 = match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate cannot be generated%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg480 = msg("00030:10", part821); - - var part822 = match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS image has successfully been updated%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg481 = msg("00030:12", part822); - - var part823 = match("MESSAGE#475:00030:13/0", "nwparser.payload", "The public key used for ScreenOS image authentication cannot be %{p0}"); - - var part824 = match("MESSAGE#475:00030:13/1_0", "nwparser.p0", "decoded%{}"); - - var part825 = match("MESSAGE#475:00030:13/1_1", "nwparser.p0", "loaded%{}"); - - var select190 = linear_select([ - part824, - part825, - ]); - - var all165 = all_match({ - processors: [ - part823, - select190, - ], - on_success: processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg482 = msg("00030:13", all165); - - var part826 = match("MESSAGE#476:00030:14/1_0", "nwparser.p0", "CA IDENT %{p0}"); - - var part827 = match("MESSAGE#476:00030:14/1_1", "nwparser.p0", "Challenge password %{p0}"); - - var part828 = match("MESSAGE#476:00030:14/1_2", "nwparser.p0", "CA CGI URL %{p0}"); - - var part829 = match("MESSAGE#476:00030:14/1_3", "nwparser.p0", "RA CGI URL %{p0}"); - - var select191 = linear_select([ - part826, - part827, - part828, - part829, - ]); - - var part830 = match("MESSAGE#476:00030:14/2", "nwparser.p0", "for SCEP %{p0}"); - - var part831 = match("MESSAGE#476:00030:14/3_0", "nwparser.p0", "requests %{p0}"); - - var select192 = linear_select([ - part831, - dup16, - ]); - - var part832 = match("MESSAGE#476:00030:14/4", "nwparser.p0", "has been changed from %{change_old->} to %{change_new}"); - - var all166 = all_match({ - processors: [ - dup55, - select191, - part830, - select192, - part832, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg483 = msg("00030:14", all166); - - var msg484 = msg("00030:02", dup375); - - var part833 = match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS image authentication is invalid%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg485 = msg("00030:15", part833); - - var part834 = match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been deleted%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg486 = msg("00030:16", part834); - - var part835 = match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accept per config DN %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg487 = msg("00030:18", part835); - - var part836 = match("MESSAGE#481:00030:19/0", "nwparser.payload", "PKI: A configurable item %{change_attribute->} %{p0}"); - - var part837 = match("MESSAGE#481:00030:19/1_0", "nwparser.p0", "mode %{p0}"); - - var part838 = match("MESSAGE#481:00030:19/1_1", "nwparser.p0", "field%{p0}"); - - var select193 = linear_select([ - part837, - part838, - ]); - - var part839 = match("MESSAGE#481:00030:19/2", "nwparser.p0", "%{}has changed from %{change_old->} to %{change_new}"); - - var all167 = all_match({ - processors: [ - part836, - select193, - part839, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg488 = msg("00030:19", all167); - - var part840 = match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for total of %{fld2->} items.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg489 = msg("00030:30", part840); - - var part841 = match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} out of order expect %{fld3->} of %{fld4}.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg490 = msg("00030:31", part841); - - var part842 = match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} without first item.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg491 = msg("00030:32", part842); - - var part843 = match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received normal item during cold sync.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg492 = msg("00030:33", part843); - - var part844 = match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} is deleted.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg493 = msg("00030:34", part844); - - var part845 = match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availability synchronization %{fld2->} failed.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg494 = msg("00030:35", part845); - - var part846 = match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute->} has changed from %{change_old->} to %{change_new}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg495 = msg("00030:36", part846); - - var part847 = match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate for the ScreenOS image authentication is invalid.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg496 = msg("00030:37", part847); - - var part848 = match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certificate cannot be sync to vsd member.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg497 = msg("00030:38", part848); - - var part849 = match("MESSAGE#491:00030:39/0", "nwparser.payload", "PKI: The X.509 certificate %{p0}"); - - var part850 = match("MESSAGE#491:00030:39/1_0", "nwparser.p0", "revocation list %{p0}"); - - var select194 = linear_select([ - part850, - dup16, - ]); - - var part851 = match("MESSAGE#491:00030:39/2", "nwparser.p0", "cannot be loaded during NSRP synchronization.%{}"); - - var all168 = all_match({ - processors: [ - part849, - select194, - part851, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg498 = msg("00030:39", all168); - - var part852 = match("MESSAGE#492:00030:17/0", "nwparser.payload", "X509 %{p0}"); - - var part853 = match("MESSAGE#492:00030:17/2", "nwparser.p0", "cannot be loaded%{}"); - - var all169 = all_match({ - processors: [ - part852, - dup376, - part853, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg499 = msg("00030:17", all169); - - var part854 = match("MESSAGE#493:00030:40/0", "nwparser.payload", "PKI: The certificate %{fld2->} will expire %{p0}"); - - var part855 = match("MESSAGE#493:00030:40/1_1", "nwparser.p0", "please %{p0}"); - - var select195 = linear_select([ - dup214, - part855, - ]); - - var part856 = match("MESSAGE#493:00030:40/2", "nwparser.p0", "renew.%{}"); - - var all170 = all_match({ - processors: [ - part854, - select195, - part856, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg500 = msg("00030:40", all170); - - var part857 = match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocation list has expired issued by certificate authority %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg501 = msg("00030:41", part857); - - var part858 = match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration content of certificate authority %{fld2->} is not valid.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg502 = msg("00030:42", part858); - - var part859 = match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot allocate this object id number %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg503 = msg("00030:43", part859); - - var part860 = match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg504 = msg("00030:44", part860); - - var part861 = match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find the PKI object %{fld2->} during cold sync.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg505 = msg("00030:45", part861); - - var part862 = match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X.509 certificate onto the device certificate %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg506 = msg("00030:46", part862); - - var part863 = match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a certificate pending SCEP completion.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg507 = msg("00030:47", part863); - - var part864 = match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load an X.509 certificate revocation list (CRL).%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg508 = msg("00030:48", part864); - - var part865 = match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load the CA certificate received through SCEP.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg509 = msg("00030:49", part865); - - var part866 = match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg510 = msg("00030:50", part866); - - var part867 = match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load the X.509 local certificate received through SCEP.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg511 = msg("00030:51", part867); - - var part868 = match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load the X.509 %{product->} during boot.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg512 = msg("00030:52", part868); - - var part869 = match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load the X.509 certificate file.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg513 = msg("00030:53", part869); - - var part870 = match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the coldsync of the PKI object at %{fld2->} attempt.", processor_chain([ - dup44, - dup211, - dup31, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg514 = msg("00030:54", part870); - - var part871 = match("MESSAGE#508:00030:55/0", "nwparser.payload", "PKI: The device could not generate %{p0}"); - - var all171 = all_match({ - processors: [ - part871, - dup377, - dup217, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg515 = msg("00030:55", all171); - - var part872 = match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an invalid RSA key.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg516 = msg("00030:56", part872); - - var part873 = match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an invalid digital signature algorithm (DSA) key.%{}", processor_chain([ - dup35, - dup218, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg517 = msg("00030:57", part873); - - var part874 = match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to coldsync the PKI object at %{fld2->} attempt.", processor_chain([ - dup86, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg518 = msg("00030:58", part874); - - var part875 = match("MESSAGE#512:00030:59", "nwparser.payload", "PKI: The device failed to decode the public key of the image%{quote}s signer certificate.", processor_chain([ - dup35, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg519 = msg("00030:59", part875); - - var part876 = match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to install the RSA key.%{}", processor_chain([ - dup35, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg520 = msg("00030:60", part876); - - var part877 = match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to retrieve the pending certificate %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg521 = msg("00030:61", part877); - - var part878 = match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to save the certificate authority related configuration.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg522 = msg("00030:62", part878); - - var part879 = match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to store the authority configuration.%{}", processor_chain([ - dup18, - dup219, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg523 = msg("00030:63", part879); - - var part880 = match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg524 = msg("00030:64", part880); - - var part881 = match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg525 = msg("00030:65", part881); - - var part882 = match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected an invalid X.509 object attribute %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg526 = msg("00030:66", part882); - - var part883 = match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected invalid X.509 object content.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg527 = msg("00030:67", part883); - - var part884 = match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to load an invalid X.509 object.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg528 = msg("00030:68", part884); - - var part885 = match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading the version 0 PKI data.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg529 = msg("00030:69", part885); - - var part886 = match("MESSAGE#523:00030:70/0", "nwparser.payload", "PKI: The device successfully generated a new %{p0}"); - - var all172 = all_match({ - processors: [ - part886, - dup377, - dup217, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg530 = msg("00030:70", all172); - - var part887 = match("MESSAGE#524:00030:71", "nwparser.payload", "PKI: The public key of image%{quote}s signer has been loaded successfully, for future image authentication.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg531 = msg("00030:71", part887); - - var part888 = match("MESSAGE#525:00030:72", "nwparser.payload", "PKI: The signature of the image%{quote}s signer certificate cannot be verified.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg532 = msg("00030:72", part888); - - var part889 = match("MESSAGE#526:00030:73/0", "nwparser.payload", "PKI: The %{p0}"); - - var part890 = match("MESSAGE#526:00030:73/1_0", "nwparser.p0", "file name %{p0}"); - - var part891 = match("MESSAGE#526:00030:73/1_1", "nwparser.p0", "friendly name of a certificate %{p0}"); - - var part892 = match("MESSAGE#526:00030:73/1_2", "nwparser.p0", "vsys name %{p0}"); - - var select196 = linear_select([ - part890, - part891, - part892, - ]); - - var part893 = match("MESSAGE#526:00030:73/2", "nwparser.p0", "is too long %{fld2->} to do NSRP synchronization allowed %{fld3}."); - - var all173 = all_match({ - processors: [ - part889, - select196, - part893, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg533 = msg("00030:73", all173); - - var part894 = match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier version save to file.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg534 = msg("00030:74", part894); - - var part895 = match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has been deleted distinguished name %{username}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg535 = msg("00030:75", part895); - - var part896 = match("MESSAGE#529:00030:76/0", "nwparser.payload", "PKI: X.509 %{p0}"); - - var part897 = match("MESSAGE#529:00030:76/2", "nwparser.p0", "file has been loaded successfully filename %{fld2}."); - - var all174 = all_match({ - processors: [ - part896, - dup376, - part897, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg536 = msg("00030:76", all174); - - var part898 = match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA key.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg537 = msg("00030:77", part898); - - var part899 = match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when requesting certificate.%{}", processor_chain([ - dup35, - dup211, - dup220, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg538 = msg("00030:78", part899); - - var part900 = match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check per config DN %{username}.", processor_chain([ - dup35, - dup211, - dup220, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg539 = msg("00030:79", part900); - - var part901 = match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 objects.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg540 = msg("00030:80", part901); - - var part902 = match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject name %{fld2->} is deleted.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg541 = msg("00030:81", part902); - - var part903 = match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg542 = msg("00030:82", part903); - - var part904 = match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire authcfg for this CA cert %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg543 = msg("00030:83", part904); - - var part905 = match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg from global.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg544 = msg("00030:84", part905); - - var part906 = match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is high (%{fld2->} alarm threshold: %{trigger_val}) %{info}", processor_chain([ - setc("eventcategory","1603080000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg545 = msg("00030:85", part906); - - var part907 = match("MESSAGE#539:00030:86/2", "nwparser.p0", "Pair-wise invoked by started after key generation. (%{fld1})"); - - var all175 = all_match({ - processors: [ - dup221, - dup378, - part907, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg546 = msg("00030:86", all175); - - var part908 = match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is high (%{fld2->} > %{fld3->} ) %{fld4->} times in %{fld5->} minute (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg547 = msg("00030:87", part908); - - var part909 = match("MESSAGE#1217:00030:88/2", "nwparser.p0", "Pair-wise invoked by passed. (%{fld1})\u003c\u003c%{fld6}>"); - - var all176 = all_match({ - processors: [ - dup221, - dup378, - part909, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg548 = msg("00030:88", all176); - - var select197 = linear_select([ - msg475, - msg476, - msg477, - msg478, - msg479, - msg480, - msg481, - msg482, - msg483, - msg484, - msg485, - msg486, - msg487, - msg488, - msg489, - msg490, - msg491, - msg492, - msg493, - msg494, - msg495, - msg496, - msg497, - msg498, - msg499, - msg500, - msg501, - msg502, - msg503, - msg504, - msg505, - msg506, - msg507, - msg508, - msg509, - msg510, - msg511, - msg512, - msg513, - msg514, - msg515, - msg516, - msg517, - msg518, - msg519, - msg520, - msg521, - msg522, - msg523, - msg524, - msg525, - msg526, - msg527, - msg528, - msg529, - msg530, - msg531, - msg532, - msg533, - msg534, - msg535, - msg536, - msg537, - msg538, - msg539, - msg540, - msg541, - msg542, - msg543, - msg544, - msg545, - msg546, - msg547, - msg548, - ]); - - var part910 = match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP address %{hostip->} changed from %{sinterface->} to interface %{dinterface->} (%{fld1})", processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg549 = msg("00031:13", part910); - - var part911 = match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg550 = msg("00031", part911); - - var part912 = match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg551 = msg("00031:01", part912); - - var part913 = match("MESSAGE#543:00031:02/0", "nwparser.payload", "SNMP community %{fld2->} attributes-write access %{p0}"); - - var part914 = match("MESSAGE#543:00031:02/2", "nwparser.p0", "; receive traps %{p0}"); - - var part915 = match("MESSAGE#543:00031:02/4", "nwparser.p0", "; receive traffic alarms %{p0}"); - - var part916 = match("MESSAGE#543:00031:02/6", "nwparser.p0", "-have been modified%{}"); - - var all177 = all_match({ - processors: [ - part913, - dup379, - part914, - dup379, - part915, - dup379, - part916, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg552 = msg("00031:02", all177); - - var part917 = match("MESSAGE#544:00031:03/0", "nwparser.payload", "%{fld2->} SNMP host %{hostip->} has been %{p0}"); - - var select198 = linear_select([ - dup130, - dup129, - ]); - - var part918 = match("MESSAGE#544:00031:03/2", "nwparser.p0", "SNMP community %{fld3}"); - - var all178 = all_match({ - processors: [ - part917, - select198, - part918, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg553 = msg("00031:03", all178); - - var part919 = match("MESSAGE#545:00031:04/0", "nwparser.payload", "SNMP %{p0}"); - - var part920 = match("MESSAGE#545:00031:04/1_0", "nwparser.p0", "contact %{p0}"); - - var select199 = linear_select([ - part920, - dup226, - ]); - - var part921 = match("MESSAGE#545:00031:04/2", "nwparser.p0", "description has been modified%{}"); - - var all179 = all_match({ - processors: [ - part919, - select199, - part921, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg554 = msg("00031:04", all179); - - var part922 = match("MESSAGE#546:00031:11/0", "nwparser.payload", "SNMP system %{p0}"); - - var select200 = linear_select([ - dup226, - dup25, - ]); - - var part923 = match("MESSAGE#546:00031:11/2", "nwparser.p0", "has been changed to %{fld2}. (%{fld1})"); - - var all180 = all_match({ - processors: [ - part922, - select200, - part923, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg555 = msg("00031:11", all180); - - var part924 = match("MESSAGE#547:00031:08/0", "nwparser.payload", "%{fld2}: SNMP community name \"%{fld3}\" %{p0}"); - - var part925 = match("MESSAGE#547:00031:08/1_0", "nwparser.p0", "attributes -- %{p0}"); - - var part926 = match("MESSAGE#547:00031:08/1_1", "nwparser.p0", "-- %{p0}"); - - var select201 = linear_select([ - part925, - part926, - ]); - - var part927 = match("MESSAGE#547:00031:08/2", "nwparser.p0", "write access, %{p0}"); - - var part928 = match("MESSAGE#547:00031:08/4", "nwparser.p0", "; receive traps, %{p0}"); - - var part929 = match("MESSAGE#547:00031:08/6", "nwparser.p0", "; receive traffic alarms, %{p0}"); - - var part930 = match("MESSAGE#547:00031:08/8", "nwparser.p0", "-%{p0}"); - - var part931 = match("MESSAGE#547:00031:08/9_0", "nwparser.p0", "- %{p0}"); - - var select202 = linear_select([ - part931, - dup96, - ]); - - var part932 = match("MESSAGE#547:00031:08/10", "nwparser.p0", "have been modified%{}"); - - var all181 = all_match({ - processors: [ - part924, - select201, - part927, - dup379, - part928, - dup379, - part929, - dup379, - part930, - select202, - part932, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg556 = msg("00031:08", all181); - - var part933 = match("MESSAGE#548:00031:05/0", "nwparser.payload", "Detect IP conflict (%{fld2}) on %{p0}"); - - var all182 = all_match({ - processors: [ - part933, - dup337, - dup227, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg557 = msg("00031:05", all182); - - var part934 = match("MESSAGE#549:00031:06/1_0", "nwparser.p0", "q, %{p0}"); - - var select203 = linear_select([ - part934, - dup229, - dup230, - ]); - - var part935 = match("MESSAGE#549:00031:06/2", "nwparser.p0", "detect IP conflict ( %{hostip->} )%{p0}"); - - var select204 = linear_select([ - dup105, - dup96, - ]); - - var part936 = match("MESSAGE#549:00031:06/4", "nwparser.p0", "mac%{p0}"); - - var part937 = match("MESSAGE#549:00031:06/6", "nwparser.p0", "%{macaddr->} on %{p0}"); - - var all183 = all_match({ - processors: [ - dup228, - select203, - part935, - select204, - part936, - dup356, - part937, - dup352, - dup23, - dup380, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg558 = msg("00031:06", all183); - - var part938 = match("MESSAGE#550:00031:07/2", "nwparser.p0", "detects a duplicate virtual security device group master IP address %{hostip}, MAC address %{macaddr->} on %{p0}"); - - var all184 = all_match({ - processors: [ - dup228, - dup381, - part938, - dup337, - dup227, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg559 = msg("00031:07", all184); - - var part939 = match("MESSAGE#551:00031:09/2", "nwparser.p0", "detected an IP conflict (IP %{hostip}, MAC %{macaddr}) on interface %{p0}"); - - var all185 = all_match({ - processors: [ - dup228, - dup381, - part939, - dup380, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg560 = msg("00031:09", all185); - - var part940 = match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{fld3}\" has been moved. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg561 = msg("00031:10", part940); - - var part941 = match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has been changed to %{fld3}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg562 = msg("00031:12", part941); - - var select205 = linear_select([ - msg549, - msg550, - msg551, - msg552, - msg553, - msg554, - msg555, - msg556, - msg557, - msg558, - msg559, - msg560, - msg561, - msg562, - ]); - - var part942 = match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup232, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg563 = msg("00032", part942); - - var part943 = match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg564 = msg("00032:01", part943); - - var part944 = match("MESSAGE#556:00032:03/0", "nwparser.payload", "Vsys %{fld2->} has been %{p0}"); - - var part945 = match("MESSAGE#556:00032:03/1_0", "nwparser.p0", "changed to %{fld3}"); - - var part946 = match("MESSAGE#556:00032:03/1_1", "nwparser.p0", "created%{}"); - - var part947 = match("MESSAGE#556:00032:03/1_2", "nwparser.p0", "deleted%{}"); - - var part948 = match("MESSAGE#556:00032:03/1_3", "nwparser.p0", "removed%{}"); - - var select206 = linear_select([ - part945, - part946, - part947, - part948, - ]); - - var all186 = all_match({ - processors: [ - part944, - select206, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg565 = msg("00032:03", all186); - - var part949 = match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg566 = msg("00032:04", part949); - - var part950 = match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsys %{fld2->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg567 = msg("00032:05", part950); - - var msg568 = msg("00032:02", dup375); - - var select207 = linear_select([ - msg563, - msg564, - msg565, - msg566, - msg567, - msg568, - ]); - - var part951 = match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("agent","NSM"), - ])); - - var msg569 = msg("00033:25", part951); - - var part952 = match("MESSAGE#561:00033/1", "nwparser.p0", "timeout value has been %{p0}"); - - var part953 = match("MESSAGE#561:00033/2_1", "nwparser.p0", "returned%{p0}"); - - var select208 = linear_select([ - dup52, - part953, - ]); - - var part954 = match("MESSAGE#561:00033/3", "nwparser.p0", "%{}to %{fld2}"); - - var all187 = all_match({ - processors: [ - dup382, - part952, - select208, - part954, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg570 = msg("00033", all187); - - var part955 = match("MESSAGE#562:00033:03/1_0", "nwparser.p0", "Global PRO %{p0}"); - - var part956 = match("MESSAGE#562:00033:03/1_1", "nwparser.p0", "%{fld3->} %{p0}"); - - var select209 = linear_select([ - part955, - part956, - ]); - - var part957 = match("MESSAGE#562:00033:03/4", "nwparser.p0", "host has been set to %{fld4}"); - - var all188 = all_match({ - processors: [ - dup160, - select209, - dup23, - dup369, - part957, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg571 = msg("00033:03", all188); - - var part958 = match("MESSAGE#563:00033:02/3", "nwparser.p0", "host has been %{disposition}"); - - var all189 = all_match({ - processors: [ - dup382, - dup23, - dup369, - part958, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg572 = msg("00033:02", all189); - - var part959 = match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg573 = msg("00033:04", part959); - - var part960 = match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg574 = msg("00033:05", part960); - - var part961 = match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The attack occurred %{dclass_counter1->} times", processor_chain([ - dup27, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg575 = msg("00033:06", part961); - - var part962 = match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The threshold was exceeded %{dclass_counter1->} times", processor_chain([ - dup27, - dup2, - dup3, - setc("dclass_counter1_string","Number of times the threshold was exceeded"), - dup4, - dup5, - dup61, - ])); - - var msg576 = msg("00033:01", part962); - - var part963 = match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{service->} has been %{disposition->} from %{fld2->} distribution", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg577 = msg("00033:07", part963); - - var part964 = match("MESSAGE#569:00033:08/2", "nwparser.p0", "?s CA certificate field has not been specified.%{}"); - - var all190 = all_match({ - processors: [ - dup235, - dup383, - part964, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg578 = msg("00033:08", all190); - - var part965 = match("MESSAGE#570:00033:09/2", "nwparser.p0", "?s Cert-Subject field has not been specified.%{}"); - - var all191 = all_match({ - processors: [ - dup235, - dup383, - part965, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg579 = msg("00033:09", all191); - - var part966 = match("MESSAGE#571:00033:10/2", "nwparser.p0", "?s host field has been %{p0}"); - - var part967 = match("MESSAGE#571:00033:10/3_0", "nwparser.p0", "set to %{fld2->} %{p0}"); - - var select210 = linear_select([ - part967, - dup238, - ]); - - var all192 = all_match({ - processors: [ - dup235, - dup383, - part966, - select210, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg580 = msg("00033:10", all192); - - var part968 = match("MESSAGE#572:00033:11/2", "nwparser.p0", "?s outgoing interface used to report NACN to Policy Manager %{p0}"); - - var part969 = match("MESSAGE#572:00033:11/4", "nwparser.p0", "has not been specified.%{}"); - - var all193 = all_match({ - processors: [ - dup235, - dup383, - part968, - dup383, - part969, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg581 = msg("00033:11", all193); - - var part970 = match("MESSAGE#573:00033:12/2", "nwparser.p0", "?s password field has been %{p0}"); - - var select211 = linear_select([ - dup101, - dup238, - ]); - - var all194 = all_match({ - processors: [ - dup235, - dup383, - part970, - select211, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg582 = msg("00033:12", all194); - - var part971 = match("MESSAGE#574:00033:13/2", "nwparser.p0", "?s policy-domain field has been %{p0}"); - - var part972 = match("MESSAGE#574:00033:13/3_0", "nwparser.p0", "unset .%{}"); - - var part973 = match("MESSAGE#574:00033:13/3_1", "nwparser.p0", "set to %{domain}."); - - var select212 = linear_select([ - part972, - part973, - ]); - - var all195 = all_match({ - processors: [ - dup235, - dup383, - part971, - select212, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg583 = msg("00033:13", all195); - - var part974 = match("MESSAGE#575:00033:14/2", "nwparser.p0", "?s CA certificate field has been set to %{fld2}."); - - var all196 = all_match({ - processors: [ - dup235, - dup383, - part974, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg584 = msg("00033:14", all196); - - var part975 = match("MESSAGE#576:00033:15/2", "nwparser.p0", "?s Cert-Subject field has been set to %{fld2}."); - - var all197 = all_match({ - processors: [ - dup235, - dup383, - part975, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg585 = msg("00033:15", all197); - - var part976 = match("MESSAGE#577:00033:16/2", "nwparser.p0", "?s outgoing-interface field has been set to %{interface}."); - - var all198 = all_match({ - processors: [ - dup235, - dup383, - part976, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg586 = msg("00033:16", all198); - - var part977 = match("MESSAGE#578:00033:17/2", "nwparser.p0", "?s port field has been %{p0}"); - - var part978 = match("MESSAGE#578:00033:17/3_0", "nwparser.p0", "set to %{network_port->} %{p0}"); - - var part979 = match("MESSAGE#578:00033:17/3_1", "nwparser.p0", "reset to the default value %{p0}"); - - var select213 = linear_select([ - part978, - part979, - ]); - - var all199 = all_match({ - processors: [ - dup235, - dup383, - part977, - select213, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg587 = msg("00033:17", all199); - - var part980 = match("MESSAGE#579:00033:19/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); - - var part981 = match("MESSAGE#579:00033:19/4", "nwparser.p0", "%{fld99}arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time."); - - var all200 = all_match({ - processors: [ - part980, - dup339, - dup70, - dup340, - part981, - ], - on_success: processor_chain([ - dup27, - dup2, - dup4, - dup5, - dup3, - dup59, - dup61, - ]), - }); - - var msg588 = msg("00033:19", all200); - - var part982 = match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time.", processor_chain([ - dup27, - dup2, - dup4, - dup5, - dup3, - dup59, - dup60, - ])); - - var msg589 = msg("00033:20", part982); - - var all201 = all_match({ - processors: [ - dup239, - dup343, - dup83, - ], - on_success: processor_chain([ - dup27, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg590 = msg("00033:21", all201); - - var part983 = match("MESSAGE#582:00033:22/0", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var all202 = all_match({ - processors: [ - part983, - dup343, - dup83, - ], - on_success: processor_chain([ - dup27, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg591 = msg("00033:22", all202); - - var part984 = match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name %{hostname->} was set: addr %{hostip}, port %{network_port}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg592 = msg("00033:23", part984); - - var part985 = match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{info}. (%{fld1})", processor_chain([ - setc("eventcategory","1001030500"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg593 = msg("00033:24", part985); - - var select214 = linear_select([ - msg569, - msg570, - msg571, - msg572, - msg573, - msg574, - msg575, - msg576, - msg577, - msg578, - msg579, - msg580, - msg581, - msg582, - msg583, - msg584, - msg585, - msg586, - msg587, - msg588, - msg589, - msg590, - msg591, - msg592, - msg593, - ]); - - var part986 = match("MESSAGE#585:00034/0_0", "nwparser.payload", "SCS: Failed %{p0}"); - - var part987 = match("MESSAGE#585:00034/0_1", "nwparser.payload", "Failed %{p0}"); - - var select215 = linear_select([ - part986, - part987, - ]); - - var part988 = match("MESSAGE#585:00034/2_0", "nwparser.p0", "bind %{p0}"); - - var part989 = match("MESSAGE#585:00034/2_2", "nwparser.p0", "retrieve %{p0}"); - - var select216 = linear_select([ - part988, - dup201, - part989, - ]); - - var select217 = linear_select([ - dup196, - dup103, - dup163, - ]); - - var part990 = match("MESSAGE#585:00034/5", "nwparser.p0", "SSH user %{username}. (Key ID=%{fld2})"); - - var all203 = all_match({ - processors: [ - select215, - dup103, - select216, - dup202, - select217, - part990, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg594 = msg("00034", all203); - - var part991 = match("MESSAGE#586:00034:01/0_0", "nwparser.payload", "SCS: Incompatible %{p0}"); - - var part992 = match("MESSAGE#586:00034:01/0_1", "nwparser.payload", "Incompatible %{p0}"); - - var select218 = linear_select([ - part991, - part992, - ]); - - var part993 = match("MESSAGE#586:00034:01/1", "nwparser.p0", "SSH version %{version->} has been received from %{p0}"); - - var part994 = match("MESSAGE#586:00034:01/2_0", "nwparser.p0", "the SSH %{p0}"); - - var select219 = linear_select([ - part994, - dup241, - ]); - - var part995 = match("MESSAGE#586:00034:01/3", "nwparser.p0", "client at %{saddr}:%{sport}"); - - var all204 = all_match({ - processors: [ - select218, - part993, - select219, - part995, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg595 = msg("00034:01", all204); - - var part996 = match("MESSAGE#587:00034:02", "nwparser.payload", "Maximum number of SCS sessions %{fld2->} has been reached. Connection request from SSH user %{username->} at %{saddr}:%{sport->} has been %{disposition}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg596 = msg("00034:02", part996); - - var part997 = match("MESSAGE#588:00034:03/1", "nwparser.p0", "device failed to authenticate the SSH client at %{saddr}:%{sport}"); - - var all205 = all_match({ - processors: [ - dup384, - part997, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg597 = msg("00034:03", all205); - - var part998 = match("MESSAGE#589:00034:04", "nwparser.payload", "SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user %{username->} at %{saddr}:%{sport}. (Key ID=%{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg598 = msg("00034:04", part998); - - var part999 = match("MESSAGE#590:00034:05", "nwparser.payload", "NetScreen device failed to generate a PKA RSA challenge for SSH user %{username}. (Key ID=%{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg599 = msg("00034:05", part999); - - var part1000 = match("MESSAGE#591:00034:06/1", "nwparser.p0", "device failed to %{p0}"); - - var part1001 = match("MESSAGE#591:00034:06/2_0", "nwparser.p0", "identify itself %{p0}"); - - var part1002 = match("MESSAGE#591:00034:06/2_1", "nwparser.p0", "send the identification string %{p0}"); - - var select220 = linear_select([ - part1001, - part1002, - ]); - - var part1003 = match("MESSAGE#591:00034:06/3", "nwparser.p0", "to the SSH client at %{saddr}:%{sport}"); - - var all206 = all_match({ - processors: [ - dup384, - part1000, - select220, - part1003, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg600 = msg("00034:06", all206); - - var part1004 = match("MESSAGE#592:00034:07", "nwparser.payload", "SCS connection has been terminated for admin user %{username->} at %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg601 = msg("00034:07", part1004); - - var part1005 = match("MESSAGE#593:00034:08", "nwparser.payload", "SCS: SCS has been %{disposition->} for %{username->} with %{fld2->} existing PKA keys already bound to %{fld3->} SSH users.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg602 = msg("00034:08", part1005); - - var part1006 = match("MESSAGE#594:00034:09", "nwparser.payload", "SCS has been %{disposition->} for %{username->} with %{fld2->} PKA keys already bound to %{fld3->} SSH users", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg603 = msg("00034:09", part1006); - - var part1007 = match("MESSAGE#595:00034:10/2", "nwparser.p0", "%{}client at %{saddr->} has attempted to make an SCS connection to %{p0}"); - - var part1008 = match("MESSAGE#595:00034:10/4", "nwparser.p0", "%{interface->} %{p0}"); - - var part1009 = match("MESSAGE#595:00034:10/5_0", "nwparser.p0", "with%{p0}"); - - var part1010 = match("MESSAGE#595:00034:10/5_1", "nwparser.p0", "at%{p0}"); - - var select221 = linear_select([ - part1009, - part1010, - ]); - - var part1011 = match("MESSAGE#595:00034:10/6", "nwparser.p0", "%{}IP %{hostip->} but %{disposition->} because %{result}"); - - var all207 = all_match({ - processors: [ - dup244, - dup385, - part1007, - dup352, - part1008, - select221, - part1011, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg604 = msg("00034:10", all207); - - var part1012 = match("MESSAGE#596:00034:12/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has attempted to make an SCS connection to %{p0}"); - - var part1013 = match("MESSAGE#596:00034:12/4", "nwparser.p0", "but %{disposition->} because %{result}"); - - var all208 = all_match({ - processors: [ - dup244, - dup385, - part1012, - dup386, - part1013, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg605 = msg("00034:12", all208); - - var part1014 = match("MESSAGE#597:00034:11/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to %{p0}"); - - var part1015 = match("MESSAGE#597:00034:11/4", "nwparser.p0", "because %{result}"); - - var all209 = all_match({ - processors: [ - dup244, - dup385, - part1014, - dup386, - part1015, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg606 = msg("00034:11", all209); - - var part1016 = match("MESSAGE#598:00034:15", "nwparser.payload", "SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection because %{result}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg607 = msg("00034:15", part1016); - - var part1017 = match("MESSAGE#599:00034:18/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} cannot log in via SCS to %{service->} using the shared %{interface->} interface because %{result}"); - - var all210 = all_match({ - processors: [ - dup244, - dup387, - part1017, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg608 = msg("00034:18", all210); - - var part1018 = match("MESSAGE#600:00034:20/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has %{disposition->} the PKA RSA challenge"); - - var all211 = all_match({ - processors: [ - dup244, - dup387, - part1018, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg609 = msg("00034:20", all211); - - var part1019 = match("MESSAGE#601:00034:21/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has requested %{p0}"); - - var part1020 = match("MESSAGE#601:00034:21/4", "nwparser.p0", "authentication which is not %{p0}"); - - var part1021 = match("MESSAGE#601:00034:21/5_0", "nwparser.p0", "supported %{p0}"); - - var select222 = linear_select([ - part1021, - dup156, - ]); - - var part1022 = match("MESSAGE#601:00034:21/6", "nwparser.p0", "for that %{p0}"); - - var part1023 = match("MESSAGE#601:00034:21/7_0", "nwparser.p0", "client%{}"); - - var part1024 = match("MESSAGE#601:00034:21/7_1", "nwparser.p0", "user%{}"); - - var select223 = linear_select([ - part1023, - part1024, - ]); - - var all212 = all_match({ - processors: [ - dup244, - dup387, - part1019, - dup372, - part1020, - select222, - part1022, - select223, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg610 = msg("00034:21", all212); - - var part1025 = match("MESSAGE#602:00034:22", "nwparser.payload", "SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to vsys %{fld2->} using the shared untrusted interface", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg611 = msg("00034:22", part1025); - - var part1026 = match("MESSAGE#603:00034:23/1_0", "nwparser.p0", "SCS: Unable %{p0}"); - - var part1027 = match("MESSAGE#603:00034:23/1_1", "nwparser.p0", "Unable %{p0}"); - - var select224 = linear_select([ - part1026, - part1027, - ]); - - var part1028 = match("MESSAGE#603:00034:23/2", "nwparser.p0", "to validate cookie from the SSH client at %{saddr}:%{sport}"); - - var all213 = all_match({ - processors: [ - dup160, - select224, - part1028, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg612 = msg("00034:23", all213); - - var part1029 = match("MESSAGE#604:00034:24", "nwparser.payload", "AC %{username->} is advertising URL %{fld2}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg613 = msg("00034:24", part1029); - - var part1030 = match("MESSAGE#605:00034:25", "nwparser.payload", "Message from AC %{username}: %{fld2}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg614 = msg("00034:25", part1030); - - var part1031 = match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg615 = msg("00034:26", part1031); - - var part1032 = match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on %{interface->} interface", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg616 = msg("00034:27", part1032); - - var part1033 = match("MESSAGE#608:00034:28", "nwparser.payload", "PPPoE%{quote}s session closed by AC", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg617 = msg("00034:28", part1033); - - var part1034 = match("MESSAGE#609:00034:29", "nwparser.payload", "SCS: Disabled for %{username}. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg618 = msg("00034:29", part1034); - - var part1035 = match("MESSAGE#610:00034:30", "nwparser.payload", "SCS: %{disposition->} to remove PKA key removed.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg619 = msg("00034:30", part1035); - - var part1036 = match("MESSAGE#611:00034:31", "nwparser.payload", "SCS: %{disposition->} to retrieve host key", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg620 = msg("00034:31", part1036); - - var part1037 = match("MESSAGE#612:00034:32", "nwparser.payload", "SCS: %{disposition->} to send identification string to client host at %{saddr}:%{sport}.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg621 = msg("00034:32", part1037); - - var part1038 = match("MESSAGE#613:00034:33", "nwparser.payload", "SCS: Max %{fld2->} sessions reached unabel to accept connection : %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg622 = msg("00034:33", part1038); - - var part1039 = match("MESSAGE#614:00034:34", "nwparser.payload", "SCS: Maximum number for SCS sessions %{fld2->} has been reached. Connection request from SSH user at %{saddr}:%{sport->} has been %{disposition}.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg623 = msg("00034:34", part1039); - - var part1040 = match("MESSAGE#615:00034:35", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to %{service->} using the shared untrusted interface because SCS is disabled on that interface.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg624 = msg("00034:35", part1040); - - var part1041 = match("MESSAGE#616:00034:36", "nwparser.payload", "SCS: Unsupported cipher type %{fld2->} requested from: %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg625 = msg("00034:36", part1041); - - var part1042 = match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg626 = msg("00034:37", part1042); - - var part1043 = match("MESSAGE#618:00034:38", "nwparser.payload", "SSH: %{disposition->} to retreive PKA key bound to SSH user %{username->} (Key ID %{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg627 = msg("00034:38", part1043); - - var part1044 = match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet from host %{saddr->} (Code %{fld2})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg628 = msg("00034:39", part1044); - - var part1045 = match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send initialization string to client at %{saddr}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg629 = msg("00034:40", part1045); - - var part1046 = match("MESSAGE#621:00034:41/0", "nwparser.payload", "SCP: Admin user '%{administrator}' attempted to transfer file %{p0}"); - - var part1047 = match("MESSAGE#621:00034:41/2", "nwparser.p0", "the device with insufficient privilege.%{}"); - - var all214 = all_match({ - processors: [ - part1046, - dup373, - part1047, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg630 = msg("00034:41", all214); - - var part1048 = match("MESSAGE#622:00034:42", "nwparser.payload", "SSH: Maximum number of SSH sessions (%{fld2}) exceeded. Connection request from SSH user %{username->} at %{saddr->} denied.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg631 = msg("00034:42", part1048); - - var part1049 = match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx bd (port %{network_port})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg632 = msg("00034:43", part1049); - - var part1050 = match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack detected on SSH connection initiated from %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg633 = msg("00034:44", part1050); - - var select225 = linear_select([ - msg594, - msg595, - msg596, - msg597, - msg598, - msg599, - msg600, - msg601, - msg602, - msg603, - msg604, - msg605, - msg606, - msg607, - msg608, - msg609, - msg610, - msg611, - msg612, - msg613, - msg614, - msg615, - msg616, - msg617, - msg618, - msg619, - msg620, - msg621, - msg622, - msg623, - msg624, - msg625, - msg626, - msg627, - msg628, - msg629, - msg630, - msg631, - msg632, - msg633, - ]); - - var part1051 = match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}:%{result}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg634 = msg("00035", part1051); - - var part1052 = match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in incoming mail - %{fld2}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg635 = msg("00035:01", part1052); - - var part1053 = match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} is not allowed in export or firewall only system", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg636 = msg("00035:02", part1053); - - var part1054 = match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg637 = msg("00035:03", part1054); - - var part1055 = match("MESSAGE#628:00035:04/0", "nwparser.payload", "SSL Error when retrieve local c%{p0}"); - - var part1056 = match("MESSAGE#628:00035:04/1_0", "nwparser.p0", "a(verify) %{p0}"); - - var part1057 = match("MESSAGE#628:00035:04/1_1", "nwparser.p0", "ert(verify) %{p0}"); - - var part1058 = match("MESSAGE#628:00035:04/1_2", "nwparser.p0", "ert(all) %{p0}"); - - var select226 = linear_select([ - part1056, - part1057, - part1058, - ]); - - var part1059 = match("MESSAGE#628:00035:04/2", "nwparser.p0", ": %{fld2}"); - - var all215 = all_match({ - processors: [ - part1055, - select226, - part1059, - ], - on_success: processor_chain([ - dup117, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg638 = msg("00035:04", all215); - - var part1060 = match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready for connections.%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg639 = msg("00035:05", part1060); - - var part1061 = match("MESSAGE#630:00035:06/0", "nwparser.payload", "SSL c%{p0}"); - - var part1062 = match("MESSAGE#630:00035:06/2", "nwparser.p0", "changed to none%{}"); - - var all216 = all_match({ - processors: [ - part1061, - dup388, - part1062, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg640 = msg("00035:06", all216); - - var part1063 = match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{fld2->} recieved %{fld3->} is expected", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg641 = msg("00035:07", part1063); - - var part1064 = match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg642 = msg("00035:08", part1064); - - var part1065 = match("MESSAGE#633:00035:09/1_0", "nwparser.p0", "enabled%{}"); - - var select227 = linear_select([ - part1065, - dup92, - ]); - - var all217 = all_match({ - processors: [ - dup253, - select227, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg643 = msg("00035:09", all217); - - var part1066 = match("MESSAGE#634:00035:10/0", "nwparser.payload", "SSL memory allocation fails in process_c%{p0}"); - - var part1067 = match("MESSAGE#634:00035:10/1_0", "nwparser.p0", "a()%{}"); - - var part1068 = match("MESSAGE#634:00035:10/1_1", "nwparser.p0", "ert()%{}"); - - var select228 = linear_select([ - part1067, - part1068, - ]); - - var all218 = all_match({ - processors: [ - part1066, - select228, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg644 = msg("00035:10", all218); - - var part1069 = match("MESSAGE#635:00035:11/0", "nwparser.payload", "SSL no ssl c%{p0}"); - - var part1070 = match("MESSAGE#635:00035:11/1_0", "nwparser.p0", "a%{}"); - - var part1071 = match("MESSAGE#635:00035:11/1_1", "nwparser.p0", "ert%{}"); - - var select229 = linear_select([ - part1070, - part1071, - ]); - - var all219 = all_match({ - processors: [ - part1069, - select229, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg645 = msg("00035:11", all219); - - var part1072 = match("MESSAGE#636:00035:12/0", "nwparser.payload", "SSL set c%{p0}"); - - var part1073 = match("MESSAGE#636:00035:12/2", "nwparser.p0", "id is invalid %{fld2}"); - - var all220 = all_match({ - processors: [ - part1072, - dup388, - part1073, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg646 = msg("00035:12", all220); - - var part1074 = match("MESSAGE#637:00035:13/1_1", "nwparser.p0", "verify %{p0}"); - - var select230 = linear_select([ - dup101, - part1074, - ]); - - var part1075 = match("MESSAGE#637:00035:13/2", "nwparser.p0", "cert failed. Key type is not RSA%{}"); - - var all221 = all_match({ - processors: [ - dup253, - select230, - part1075, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg647 = msg("00035:13", all221); - - var part1076 = match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg648 = msg("00035:14", part1076); - - var part1077 = match("MESSAGE#639:00035:15/0", "nwparser.payload", "%{change_attribute->} has been changed %{p0}"); - - var part1078 = match("MESSAGE#639:00035:15/1_0", "nwparser.p0", "from %{change_old->} to %{change_new}"); - - var part1079 = match("MESSAGE#639:00035:15/1_1", "nwparser.p0", "to %{fld2}"); - - var select231 = linear_select([ - part1078, - part1079, - ]); - - var all222 = all_match({ - processors: [ - part1077, - select231, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg649 = msg("00035:15", all222); - - var part1080 = match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed to by %{username->} via web from host %{saddr->} to %{daddr}:%{dport->} %{fld5}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg650 = msg("00035:16", part1080); - - var select232 = linear_select([ - msg634, - msg635, - msg636, - msg637, - msg638, - msg639, - msg640, - msg641, - msg642, - msg643, - msg644, - msg645, - msg646, - msg647, - msg648, - msg649, - msg650, - ]); - - var part1081 = match("MESSAGE#641:00036", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key%{}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg651 = msg("00036", part1081); - - var part1082 = match("MESSAGE#642:00036:01/0", "nwparser.payload", "%{fld2->} license keys were updated successfully by %{p0}"); - - var part1083 = match("MESSAGE#642:00036:01/1_1", "nwparser.p0", "manual %{p0}"); - - var select233 = linear_select([ - dup214, - part1083, - ]); - - var part1084 = match("MESSAGE#642:00036:01/2", "nwparser.p0", "retrieval%{}"); - - var all223 = all_match({ - processors: [ - part1082, - select233, - part1084, - ], - on_success: processor_chain([ - dup254, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg652 = msg("00036:01", all223); - - var select234 = linear_select([ - msg651, - msg652, - ]); - - var part1085 = match("MESSAGE#643:00037/0", "nwparser.payload", "Intra-zone block for zone %{zone->} was set to o%{p0}"); - - var part1086 = match("MESSAGE#643:00037/1_0", "nwparser.p0", "n%{}"); - - var part1087 = match("MESSAGE#643:00037/1_1", "nwparser.p0", "ff%{}"); - - var select235 = linear_select([ - part1086, - part1087, - ]); - - var all224 = all_match({ - processors: [ - part1085, - select235, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg653 = msg("00037", all224); - - var part1088 = match("MESSAGE#644:00037:01/0", "nwparser.payload", "New zone %{zone->} ( %{p0}"); - - var select236 = linear_select([ - dup255, - dup256, - ]); - - var part1089 = match("MESSAGE#644:00037:01/2", "nwparser.p0", "%{fld2}) was created.%{p0}"); - - var all225 = all_match({ - processors: [ - part1088, - select236, - part1089, - dup351, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg654 = msg("00037:01", all225); - - var part1090 = match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was bound to out zone %{dst_zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg655 = msg("00037:02", part1090); - - var part1091 = match("MESSAGE#646:00037:03/1_0", "nwparser.p0", "was was %{p0}"); - - var part1092 = match("MESSAGE#646:00037:03/1_1", "nwparser.p0", "%{zone->} was %{p0}"); - - var select237 = linear_select([ - part1091, - part1092, - ]); - - var part1093 = match("MESSAGE#646:00037:03/3", "nwparser.p0", "virtual router %{p0}"); - - var part1094 = match("MESSAGE#646:00037:03/4_0", "nwparser.p0", "%{node->} (%{fld1})"); - - var part1095 = match("MESSAGE#646:00037:03/4_1", "nwparser.p0", "%{node}."); - - var select238 = linear_select([ - part1094, - part1095, - ]); - - var all226 = all_match({ - processors: [ - dup113, - select237, - dup371, - part1093, - select238, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg656 = msg("00037:03", all226); - - var part1096 = match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to non-shared.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg657 = msg("00037:04", part1096); - - var part1097 = match("MESSAGE#648:00037:05/0", "nwparser.payload", "Zone %{zone->} ( %{p0}"); - - var select239 = linear_select([ - dup256, - dup255, - ]); - - var part1098 = match("MESSAGE#648:00037:05/2", "nwparser.p0", "%{fld2}) was deleted. %{p0}"); - - var part1099 = match_copy("MESSAGE#648:00037:05/3_1", "nwparser.p0", "space"); - - var select240 = linear_select([ - dup10, - part1099, - ]); - - var all227 = all_match({ - processors: [ - part1097, - select239, - part1098, - select240, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg658 = msg("00037:05", all227); - - var part1100 = match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was %{disposition->} on zone %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg659 = msg("00037:06", part1100); - - var select241 = linear_select([ - msg653, - msg654, - msg655, - msg656, - msg657, - msg658, - msg659, - ]); - - var part1101 = match("MESSAGE#650:00038/0", "nwparser.payload", "OSPF routing instance in vrouter %{p0}"); - - var part1102 = match("MESSAGE#650:00038/1_0", "nwparser.p0", "%{node->} is %{p0}"); - - var part1103 = match("MESSAGE#650:00038/1_1", "nwparser.p0", "%{node->} %{p0}"); - - var select242 = linear_select([ - part1102, - part1103, - ]); - - var all228 = all_match({ - processors: [ - part1101, - select242, - dup36, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg660 = msg("00038", all228); - - var part1104 = match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr %{node}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg661 = msg("00039", part1104); - - var part1105 = match("MESSAGE#652:00040/0_0", "nwparser.payload", "Low watermark%{p0}"); - - var part1106 = match("MESSAGE#652:00040/0_1", "nwparser.payload", "High watermark%{p0}"); - - var select243 = linear_select([ - part1105, - part1106, - ]); - - var part1107 = match("MESSAGE#652:00040/1", "nwparser.p0", "%{}for early aging has been changed to the default %{fld2}"); - - var all229 = all_match({ - processors: [ - select243, - part1107, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg662 = msg("00040", all229); - - var part1108 = match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg663 = msg("00040:01", part1108); - - var select244 = linear_select([ - msg662, - msg663, - ]); - - var part1109 = match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual router %{node->} has been removed", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg664 = msg("00041", part1109); - - var part1110 = match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg665 = msg("00041:01", part1110); - - var select245 = linear_select([ - msg664, - msg665, - ]); - - var part1111 = match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec tunnel on %{interface->} with tunnel ID %{fld2}! From %{saddr->} to %{daddr}/%{dport}, %{info->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg666 = msg("00042", part1111); - - var part1112 = match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup9, - dup4, - dup5, - dup60, - ])); - - var msg667 = msg("00042:01", part1112); - - var select246 = linear_select([ - msg666, - msg667, - ]); - - var part1113 = match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp tunnel (%{fld2}-%{fld3}), Result code %{resultcode->} (%{result}). (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg668 = msg("00043", part1113); - - var part1114 = match("MESSAGE#659:00044/0", "nwparser.payload", "access list %{listnum->} sequence number %{fld3->} %{p0}"); - - var part1115 = match("MESSAGE#659:00044/1_1", "nwparser.p0", "deny %{p0}"); - - var select247 = linear_select([ - dup257, - part1115, - ]); - - var part1116 = match("MESSAGE#659:00044/2", "nwparser.p0", "ip %{hostip}/%{mask->} %{disposition->} in vrouter %{node}"); - - var all230 = all_match({ - processors: [ - part1114, - select247, - part1116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg669 = msg("00044", all230); - - var part1117 = match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{disposition->} in vrouter %{node}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg670 = msg("00044:01", part1117); - - var select248 = linear_select([ - msg669, - msg670, - ]); - - var part1118 = match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router %{node->} was %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg671 = msg("00045", part1118); - - var part1119 = match("MESSAGE#662:00047/1_0", "nwparser.p0", "remove %{p0}"); - - var part1120 = match("MESSAGE#662:00047/1_1", "nwparser.p0", "add %{p0}"); - - var select249 = linear_select([ - part1119, - part1120, - ]); - - var part1121 = match("MESSAGE#662:00047/2", "nwparser.p0", "multicast policy from %{src_zone->} %{fld4->} to %{dst_zone->} %{fld3->} (%{fld1})"); - - var all231 = all_match({ - processors: [ - dup183, - select249, - part1121, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg672 = msg("00047", all231); - - var part1122 = match("MESSAGE#663:00048/0", "nwparser.payload", "Access list entry %{listnum->} with %{p0}"); - - var part1123 = match("MESSAGE#663:00048/1_0", "nwparser.p0", "a sequence %{p0}"); - - var part1124 = match("MESSAGE#663:00048/1_1", "nwparser.p0", "sequence %{p0}"); - - var select250 = linear_select([ - part1123, - part1124, - ]); - - var part1125 = match("MESSAGE#663:00048/2", "nwparser.p0", "number %{fld2->} %{p0}"); - - var part1126 = match("MESSAGE#663:00048/3_0", "nwparser.p0", "with an action of %{p0}"); - - var select251 = linear_select([ - part1126, - dup112, - ]); - - var part1127 = match("MESSAGE#663:00048/5_0", "nwparser.p0", "with an IP %{p0}"); - - var select252 = linear_select([ - part1127, - dup139, - ]); - - var part1128 = match("MESSAGE#663:00048/6", "nwparser.p0", "address %{p0}"); - - var part1129 = match("MESSAGE#663:00048/7_0", "nwparser.p0", "and subnetwork mask of %{p0}"); - - var select253 = linear_select([ - part1129, - dup16, - ]); - - var part1130 = match("MESSAGE#663:00048/8", "nwparser.p0", "%{} %{fld3}was %{p0}"); - - var part1131 = match("MESSAGE#663:00048/9_0", "nwparser.p0", "created on %{p0}"); - - var select254 = linear_select([ - part1131, - dup129, - ]); - - var part1132 = match("MESSAGE#663:00048/10", "nwparser.p0", "virtual router %{node->} (%{fld1})"); - - var all232 = all_match({ - processors: [ - part1122, - select250, - part1125, - select251, - dup257, - select252, - part1128, - select253, - part1130, - select254, - part1132, - ], - on_success: processor_chain([ - setc("eventcategory","1501000000"), - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg673 = msg("00048", all232); - - var part1133 = match("MESSAGE#664:00048:01/0", "nwparser.payload", "Route %{p0}"); - - var part1134 = match("MESSAGE#664:00048:01/1_0", "nwparser.p0", "map entry %{p0}"); - - var part1135 = match("MESSAGE#664:00048:01/1_1", "nwparser.p0", "entry %{p0}"); - - var select255 = linear_select([ - part1134, - part1135, - ]); - - var part1136 = match("MESSAGE#664:00048:01/2", "nwparser.p0", "with sequence number %{fld2->} in route map binck-ospf%{p0}"); - - var part1137 = match("MESSAGE#664:00048:01/3_0", "nwparser.p0", " in %{p0}"); - - var select256 = linear_select([ - part1137, - dup105, - ]); - - var part1138 = match("MESSAGE#664:00048:01/4", "nwparser.p0", "virtual router %{node->} was %{disposition->} (%{fld1})"); - - var all233 = all_match({ - processors: [ - part1133, - select255, - part1136, - select256, - part1138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg674 = msg("00048:01", all233); - - var part1139 = match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface %{interface->} (%{fld1})", processor_chain([ - dup209, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg675 = msg("00048:02", part1139); - - var select257 = linear_select([ - msg673, - msg674, - msg675, - ]); - - var part1140 = match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed to %{fld8->} (%{fld2}) => %{fld3->} (%{fld4}) => %{fld5->} (%{fld6}) in virtual router (%{node})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg676 = msg("00049", part1140); - - var part1141 = match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} in virtual router %{node}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg677 = msg("00049:01", part1141); - - var part1142 = match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{node->} and ID %{fld2->} has been removed", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg678 = msg("00049:02", part1142); - - var part1143 = match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual router \"%{node}\" used by OSPF, BGP routing instances id has been uninitialized. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg679 = msg("00049:03", part1143); - - var part1144 = match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route through virtual router \"%{node}\" has been added in virtual router \"%{fld4}\" (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg680 = msg("00049:04", part1144); - - var part1145 = match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking for interfaces in virtual router (%{node}) has been enabled. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg681 = msg("00049:05", part1145); - - var select258 = linear_select([ - msg676, - msg677, - msg678, - msg679, - msg680, - msg681, - ]); - - var part1146 = match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg682 = msg("00050", part1146); - - var part1147 = match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached %{fld2}, which is %{fld3->} of the system capacity!", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg683 = msg("00051", part1147); - - var part1148 = match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:%{sport}->%{daddr}:%{dport->} used %{fld2->} percent of AV resources, which exceeded the max of %{fld3->} percent.", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg684 = msg("00052", part1148); - - var part1149 = match("MESSAGE#675:00055/1_1", "nwparser.p0", "router %{p0}"); - - var select259 = linear_select([ - dup169, - part1149, - ]); - - var part1150 = match("MESSAGE#675:00055/2", "nwparser.p0", "instance was %{disposition->} on interface %{interface}."); - - var all234 = all_match({ - processors: [ - dup258, - select259, - part1150, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg685 = msg("00055", all234); - - var part1151 = match("MESSAGE#676:00055:01/1_0", "nwparser.p0", "proxy %{p0}"); - - var part1152 = match("MESSAGE#676:00055:01/1_1", "nwparser.p0", "function %{p0}"); - - var select260 = linear_select([ - part1151, - part1152, - ]); - - var part1153 = match("MESSAGE#676:00055:01/2", "nwparser.p0", "was %{disposition->} on interface %{interface}."); - - var all235 = all_match({ - processors: [ - dup258, - select260, - part1153, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg686 = msg("00055:01", all235); - - var part1154 = match("MESSAGE#677:00055:02/2", "nwparser.p0", "same subnet check on interface %{interface}."); - - var all236 = all_match({ - processors: [ - dup259, - dup389, - part1154, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg687 = msg("00055:02", all236); - - var part1155 = match("MESSAGE#678:00055:03/2", "nwparser.p0", "router alert IP option check on interface %{interface}."); - - var all237 = all_match({ - processors: [ - dup259, - dup389, - part1155, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg688 = msg("00055:03", all237); - - var part1156 = match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to %{version->} on interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg689 = msg("00055:04", part1156); - - var part1157 = match("MESSAGE#680:00055:05/0", "nwparser.payload", "IGMP query %{p0}"); - - var part1158 = match("MESSAGE#680:00055:05/1_1", "nwparser.p0", "max response time %{p0}"); - - var select261 = linear_select([ - dup110, - part1158, - ]); - - var part1159 = match("MESSAGE#680:00055:05/2", "nwparser.p0", "was changed to %{fld2->} on interface %{interface}"); - - var all238 = all_match({ - processors: [ - part1157, - select261, - part1159, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg690 = msg("00055:05", all238); - - var part1160 = match("MESSAGE#681:00055:06/0", "nwparser.payload", "IGMP l%{p0}"); - - var part1161 = match("MESSAGE#681:00055:06/1_0", "nwparser.p0", "eave %{p0}"); - - var part1162 = match("MESSAGE#681:00055:06/1_1", "nwparser.p0", "ast member query %{p0}"); - - var select262 = linear_select([ - part1161, - part1162, - ]); - - var part1163 = match("MESSAGE#681:00055:06/2", "nwparser.p0", "interval was changed to %{fld2->} on interface %{interface}."); - - var all239 = all_match({ - processors: [ - part1160, - select262, - part1163, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg691 = msg("00055:06", all239); - - var part1164 = match("MESSAGE#682:00055:07/1_0", "nwparser.p0", "routers %{p0}"); - - var part1165 = match("MESSAGE#682:00055:07/1_1", "nwparser.p0", "hosts %{p0}"); - - var part1166 = match("MESSAGE#682:00055:07/1_2", "nwparser.p0", "groups %{p0}"); - - var select263 = linear_select([ - part1164, - part1165, - part1166, - ]); - - var part1167 = match("MESSAGE#682:00055:07/2", "nwparser.p0", "accept list ID was changed to %{fld2->} on interface %{interface}."); - - var all240 = all_match({ - processors: [ - dup258, - select263, - part1167, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg692 = msg("00055:07", all240); - - var part1168 = match("MESSAGE#683:00055:08/1_0", "nwparser.p0", "all groups %{p0}"); - - var part1169 = match("MESSAGE#683:00055:08/1_1", "nwparser.p0", "group %{p0}"); - - var select264 = linear_select([ - part1168, - part1169, - ]); - - var part1170 = match("MESSAGE#683:00055:08/2", "nwparser.p0", "%{group->} static flag was %{disposition->} on interface %{interface}."); - - var all241 = all_match({ - processors: [ - dup258, - select264, - part1170, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg693 = msg("00055:08", all241); - - var part1171 = match("MESSAGE#684:00055:09", "nwparser.payload", "IGMP static group %{group->} was added on interface %{interface}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg694 = msg("00055:09", part1171); - - var part1172 = match("MESSAGE#685:00055:10", "nwparser.payload", "IGMP proxy always is %{disposition->} on interface %{interface}.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg695 = msg("00055:10", part1172); - - var select265 = linear_select([ - msg685, - msg686, - msg687, - msg688, - msg689, - msg690, - msg691, - msg692, - msg693, - msg694, - msg695, - ]); - - var part1173 = match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{src_zone->} %{saddr->} to %{dst_zone->} %{daddr}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg696 = msg("00056", part1173); - - var part1174 = match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route src=%{saddr}, grp=%{group->} input ifp = %{sinterface->} output ifp = %{dinterface->} added", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg697 = msg("00057", part1174); - - var part1175 = match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on interface %{interface}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg698 = msg("00058", part1175); - - var part1176 = match("MESSAGE#689:00059/0", "nwparser.payload", "DDNS module is %{p0}"); - - var part1177 = match("MESSAGE#689:00059/1_0", "nwparser.p0", "initialized %{p0}"); - - var select266 = linear_select([ - part1177, - dup262, - dup157, - dup156, - ]); - - var all242 = all_match({ - processors: [ - part1176, - select266, - dup116, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg699 = msg("00059", all242); - - var part1178 = match("MESSAGE#690:00059:02/0", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with server type \"%{fld3}\" name \"%{hostname}\" refresh-interval %{fld5->} hours minimum update interval %{fld6->} minutes with %{p0}"); - - var part1179 = match("MESSAGE#690:00059:02/1_0", "nwparser.p0", "secure %{p0}"); - - var part1180 = match("MESSAGE#690:00059:02/1_1", "nwparser.p0", "clear-text %{p0}"); - - var select267 = linear_select([ - part1179, - part1180, - ]); - - var part1181 = match("MESSAGE#690:00059:02/2", "nwparser.p0", "secure connection.%{}"); - - var all243 = all_match({ - processors: [ - part1178, - select267, - part1181, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg700 = msg("00059:02", all243); - - var part1182 = match("MESSAGE#691:00059:03", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with user name \"%{username}\" agent \"%{fld3}\"", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg701 = msg("00059:03", part1182); - - var part1183 = match("MESSAGE#692:00059:04", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with interface \"%{interface}\" host-name \"%{hostname}\"", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg702 = msg("00059:04", part1183); - - var part1184 = match("MESSAGE#693:00059:05/0_0", "nwparser.payload", "Hostname %{p0}"); - - var part1185 = match("MESSAGE#693:00059:05/0_1", "nwparser.payload", "Source interface %{p0}"); - - var part1186 = match("MESSAGE#693:00059:05/0_2", "nwparser.payload", "Username and password %{p0}"); - - var part1187 = match("MESSAGE#693:00059:05/0_3", "nwparser.payload", "Server %{p0}"); - - var select268 = linear_select([ - part1184, - part1185, - part1186, - part1187, - ]); - - var part1188 = match("MESSAGE#693:00059:05/1", "nwparser.p0", "of DDNS entry with id %{fld2->} is cleared."); - - var all244 = all_match({ - processors: [ - select268, - part1188, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg703 = msg("00059:05", all244); - - var part1189 = match("MESSAGE#694:00059:06", "nwparser.payload", "Agent of DDNS entry with id %{fld2->} is reset to its default value.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg704 = msg("00059:06", part1189); - - var part1190 = match("MESSAGE#695:00059:07", "nwparser.payload", "Updates for DDNS entry with id %{fld2->} are set to be sent in secure (%{protocol}) mode.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg705 = msg("00059:07", part1190); - - var part1191 = match("MESSAGE#696:00059:08/0_0", "nwparser.payload", "Refresh %{p0}"); - - var part1192 = match("MESSAGE#696:00059:08/0_1", "nwparser.payload", "Minimum update %{p0}"); - - var select269 = linear_select([ - part1191, - part1192, - ]); - - var part1193 = match("MESSAGE#696:00059:08/1", "nwparser.p0", "interval of DDNS entry with id %{fld2->} is set to default value (%{fld3})."); - - var all245 = all_match({ - processors: [ - select269, - part1193, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg706 = msg("00059:08", all245); - - var part1194 = match("MESSAGE#697:00059:09/1_0", "nwparser.p0", "No-Change %{p0}"); - - var part1195 = match("MESSAGE#697:00059:09/1_1", "nwparser.p0", "Error %{p0}"); - - var select270 = linear_select([ - part1194, - part1195, - ]); - - var part1196 = match("MESSAGE#697:00059:09/2", "nwparser.p0", "response received for DDNS entry update for id %{fld2->} user \"%{username}\" domain \"%{domain}\" server type \" d%{p0}"); - - var part1197 = match("MESSAGE#697:00059:09/3_1", "nwparser.p0", "yndns %{p0}"); - - var select271 = linear_select([ - dup261, - part1197, - ]); - - var part1198 = match("MESSAGE#697:00059:09/4", "nwparser.p0", "\", server name \"%{hostname}\""); - - var all246 = all_match({ - processors: [ - dup160, - select270, - part1196, - select271, - part1198, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg707 = msg("00059:09", all246); - - var part1199 = match("MESSAGE#698:00059:01", "nwparser.payload", "DDNS entry with id %{fld2->} is %{disposition}.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg708 = msg("00059:01", part1199); - - var select272 = linear_select([ - msg699, - msg700, - msg701, - msg702, - msg703, - msg704, - msg705, - msg706, - msg707, - msg708, - ]); - - var part1200 = match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip->} failed. (%{event_time_string})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP failed"), - ])); - - var msg709 = msg("00062:01", part1200); - - var part1201 = match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached threshold. (%{event_time_string})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP failure reached threshold"), - ])); - - var msg710 = msg("00062:02", part1201); - - var part1202 = match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip->} succeeded. (%{event_time_string})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP succeeded"), - ])); - - var msg711 = msg("00062:03", part1202); - - var part1203 = match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg712 = msg("00062", part1203); - - var select273 = linear_select([ - msg709, - msg710, - msg711, - msg712, - ]); - - var part1204 = match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{disposition}!", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg713 = msg("00063", part1204); - - var part1205 = match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg714 = msg("00064", part1205); - - var part1206 = match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches threshold system may fail over!%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg715 = msg("00064:01", part1206); - - var part1207 = match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from policy ID %{policy_id}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg716 = msg("00064:02", part1207); - - var select274 = linear_select([ - msg714, - msg715, - msg716, - ]); - - var msg717 = msg("00070", dup411); - - var part1208 = match("MESSAGE#708:00070:01/2", "nwparser.p0", "%{}Device group %{group->} changed state from %{fld3->} to %{p0}"); - - var part1209 = match("MESSAGE#708:00070:01/3_0", "nwparser.p0", "Init%{}"); - - var part1210 = match("MESSAGE#708:00070:01/3_1", "nwparser.p0", "init. (%{fld1})"); - - var select275 = linear_select([ - part1209, - part1210, - ]); - - var all247 = all_match({ - processors: [ - dup267, - dup391, - part1208, - select275, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg718 = msg("00070:01", all247); - - var part1211 = match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg719 = msg("00070:02", part1211); - - var select276 = linear_select([ - msg717, - msg718, - msg719, - ]); - - var msg720 = msg("00071", dup411); - - var part1212 = match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in the Virtual Security Device group %{group->} changed state", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg721 = msg("00071:01", part1212); - - var select277 = linear_select([ - msg720, - msg721, - ]); - - var msg722 = msg("00072", dup411); - - var msg723 = msg("00072:01", dup412); - - var select278 = linear_select([ - msg722, - msg723, - ]); - - var msg724 = msg("00073", dup411); - - var msg725 = msg("00073:01", dup412); - - var select279 = linear_select([ - msg724, - msg725, - ]); - - var msg726 = msg("00074", dup392); - - var all248 = all_match({ - processors: [ - dup263, - dup390, - dup271, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg727 = msg("00075", all248); - - var part1213 = match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} changed state from %{event_state->} to inoperable. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","local device in the Virtual Security Device group changed state to inoperable"), - ])); - - var msg728 = msg("00075:02", part1213); - - var part1214 = match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg729 = msg("00075:01", part1214); - - var select280 = linear_select([ - msg727, - msg728, - msg729, - ]); - - var msg730 = msg("00076", dup392); - - var part1215 = match("MESSAGE#721:00076:01/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} send 2nd path request to unit=%{fld3}"); - - var all249 = all_match({ - processors: [ - dup263, - dup390, - part1215, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg731 = msg("00076:01", all249); - - var select281 = linear_select([ - msg730, - msg731, - ]); - - var part1216 = match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use second path of HA%{}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg732 = msg("00077", part1216); - - var all250 = all_match({ - processors: [ - dup263, - dup390, - dup271, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg733 = msg("00077:01", all250); - - var part1217 = match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group}", processor_chain([ - setc("eventcategory","1607000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg734 = msg("00077:02", part1217); - - var select282 = linear_select([ - msg732, - msg733, - msg734, - ]); - - var part1218 = match("MESSAGE#725:00084", "nwparser.payload", "RTSYNC: NSRP route synchronization is %{disposition}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg735 = msg("00084", part1218); - - var part1219 = match("MESSAGE#726:00090/0_0", "nwparser.payload", "Failover %{p0}"); - - var part1220 = match("MESSAGE#726:00090/0_1", "nwparser.payload", "Recovery %{p0}"); - - var select283 = linear_select([ - part1219, - part1220, - ]); - - var part1221 = match("MESSAGE#726:00090/3", "nwparser.p0", "untrust interface occurred.%{}"); - - var all251 = all_match({ - processors: [ - select283, - dup103, - dup369, - part1221, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg736 = msg("00090", all251); - - var part1222 = match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to the device because the maximum number of system route entries %{fld2->} has been exceeded", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg737 = msg("00200", part1222); - - var part1223 = match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cannot be added to the virtual router %{node->} because the number of route entries in the virtual router exceeds the maximum number of routes %{fld3->} allowed", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg738 = msg("00201", part1223); - - var part1224 = match("MESSAGE#729:00202", "nwparser.payload", "%{fld2->} hello-packet flood from neighbor (ip = %{hostip->} router-id = %{fld3}) on interface %{interface->} packet is dropped", processor_chain([ - dup272, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg739 = msg("00202", part1224); - - var part1225 = match("MESSAGE#730:00203", "nwparser.payload", "%{fld2->} lsa flood on interface %{interface->} has dropped a packet.", processor_chain([ - dup272, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg740 = msg("00203", part1225); - - var part1226 = match("MESSAGE#731:00206/0", "nwparser.payload", "The total number of redistributed routes into %{p0}"); - - var part1227 = match("MESSAGE#731:00206/1_0", "nwparser.p0", "BGP %{p0}"); - - var part1228 = match("MESSAGE#731:00206/1_1", "nwparser.p0", "OSPF %{p0}"); - - var select284 = linear_select([ - part1227, - part1228, - ]); - - var part1229 = match("MESSAGE#731:00206/2", "nwparser.p0", "in vrouter %{node->} exceeded system limit (%{fld2})"); - - var all252 = all_match({ - processors: [ - part1226, - select284, - part1229, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg741 = msg("00206", all252); - - var part1230 = match("MESSAGE#732:00206:01/0", "nwparser.payload", "LSA flood in OSPF with router-id %{fld2->} on %{p0}"); - - var part1231 = match("MESSAGE#732:00206:01/2", "nwparser.p0", "%{interface->} forced the interface to drop a packet."); - - var all253 = all_match({ - processors: [ - part1230, - dup352, - part1231, - ], - on_success: processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg742 = msg("00206:01", all253); - - var part1232 = match("MESSAGE#733:00206:02/0", "nwparser.payload", "OSPF instance with router-id %{fld3->} received a Hello packet flood from neighbor (IP address %{hostip}, router ID %{fld2}) on %{p0}"); - - var part1233 = match("MESSAGE#733:00206:02/2", "nwparser.p0", "%{interface->} forcing the interface to drop the packet."); - - var all254 = all_match({ - processors: [ - part1232, - dup352, - part1233, - ], - on_success: processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg743 = msg("00206:02", all254); - - var part1234 = match("MESSAGE#734:00206:03", "nwparser.payload", "Link State Advertisement Id %{fld2}, router ID %{fld3}, type %{fld4->} cannot be deleted from the real-time database in area %{fld5}", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg744 = msg("00206:03", part1234); - - var part1235 = match("MESSAGE#735:00206:04", "nwparser.payload", "Reject second OSPF neighbor (%{fld2}) on interface (%{interface}) since it_s configured as point-to-point interface", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg745 = msg("00206:04", part1235); - - var select285 = linear_select([ - msg741, - msg742, - msg743, - msg744, - msg745, - ]); - - var part1236 = match("MESSAGE#736:00207", "nwparser.payload", "System wide RIP route limit exceeded, RIP route dropped.%{}", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg746 = msg("00207", part1236); - - var part1237 = match("MESSAGE#737:00207:01", "nwparser.payload", "%{fld2->} RIP routes dropped from last system wide RIP route limit exceed.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg747 = msg("00207:01", part1237); - - var part1238 = match("MESSAGE#738:00207:02", "nwparser.payload", "RIP database size limit exceeded for %{fld2}, RIP route dropped.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg748 = msg("00207:02", part1238); - - var part1239 = match("MESSAGE#739:00207:03", "nwparser.payload", "%{fld2->} RIP routes dropped from the last database size exceed in vr %{fld3}.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg749 = msg("00207:03", part1239); - - var select286 = linear_select([ - msg746, - msg747, - msg748, - msg749, - ]); - - var part1240 = match("MESSAGE#740:00257", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - dup278, - ])); - - var msg750 = msg("00257", part1240); - - var part1241 = match("MESSAGE#741:00257:14", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup279, - dup276, - dup277, - dup280, - ])); - - var msg751 = msg("00257:14", part1241); - - var part1242 = match("MESSAGE#742:00257:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - dup278, - ])); - - var msg752 = msg("00257:01", part1242); - - var part1243 = match("MESSAGE#743:00257:15", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup279, - dup282, - dup280, - ])); - - var msg753 = msg("00257:15", part1243); - - var part1244 = match("MESSAGE#744:00257:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ])); - - var msg754 = msg("00257:02", part1244); - - var part1245 = match("MESSAGE#745:00257:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg755 = msg("00257:03", part1245); - - var part1246 = match("MESSAGE#746:00257:04", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ])); - - var msg756 = msg("00257:04", part1246); - - var part1247 = match("MESSAGE#747:00257:05", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid->} reason=%{result}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg757 = msg("00257:05", part1247); - - var part1248 = match("MESSAGE#748:00257:19/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} icmp code=%{icmpcode->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid->} reason=%{result}"); - - var all255 = all_match({ - processors: [ - dup283, - dup393, - part1248, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg758 = msg("00257:19", all255); - - var part1249 = match("MESSAGE#749:00257:16/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid}"); - - var all256 = all_match({ - processors: [ - dup283, - dup393, - part1249, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg759 = msg("00257:16", all256); - - var part1250 = match("MESSAGE#750:00257:17/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid}"); - - var all257 = all_match({ - processors: [ - dup283, - dup393, - part1250, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ]), - }); - - var msg760 = msg("00257:17", all257); - - var part1251 = match("MESSAGE#751:00257:18/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} session_id=%{sessionid}"); - - var all258 = all_match({ - processors: [ - dup283, - dup393, - part1251, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ]), - }); - - var msg761 = msg("00257:18", all258); - - var part1252 = match("MESSAGE#752:00257:06/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{p0}"); - - var part1253 = match("MESSAGE#752:00257:06/1_0", "nwparser.p0", "%{dport->} session_id=%{sessionid}"); - - var part1254 = match_copy("MESSAGE#752:00257:06/1_1", "nwparser.p0", "dport"); - - var select287 = linear_select([ - part1253, - part1254, - ]); - - var all259 = all_match({ - processors: [ - part1252, - select287, - ], - on_success: processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ]), - }); - - var msg762 = msg("00257:06", all259); - - var part1255 = match("MESSAGE#753:00257:07", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg763 = msg("00257:07", part1255); - - var part1256 = match("MESSAGE#754:00257:08", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} tcp=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup276, - dup277, - ])); - - var msg764 = msg("00257:08", part1256); - - var part1257 = match("MESSAGE#755:00257:09/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{p0}"); - - var part1258 = match("MESSAGE#755:00257:09/1_0", "nwparser.p0", "%{icmptype->} icmp code=%{icmpcode->} session_id=%{sessionid->} reason=%{result}"); - - var part1259 = match("MESSAGE#755:00257:09/1_1", "nwparser.p0", "%{icmptype->} session_id=%{sessionid}"); - - var part1260 = match_copy("MESSAGE#755:00257:09/1_2", "nwparser.p0", "icmptype"); - - var select288 = linear_select([ - part1258, - part1259, - part1260, - ]); - - var all260 = all_match({ - processors: [ - part1257, - select288, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg765 = msg("00257:09", all260); - - var part1261 = match("MESSAGE#756:00257:10/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); - - var part1262 = match("MESSAGE#756:00257:10/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid}"); - - var select289 = linear_select([ - part1262, - dup286, - ]); - - var all261 = all_match({ - processors: [ - part1261, - select289, - ], - on_success: processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup276, - dup277, - ]), - }); - - var msg766 = msg("00257:10", all261); - - var part1263 = match("MESSAGE#757:00257:11/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); - - var part1264 = match("MESSAGE#757:00257:11/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid->} reason=%{result}"); - - var select290 = linear_select([ - part1264, - dup286, - ]); - - var all262 = all_match({ - processors: [ - part1263, - select290, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg767 = msg("00257:11", all262); - - var part1265 = match("MESSAGE#758:00257:12", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} type=%{fld3}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ])); - - var msg768 = msg("00257:12", part1265); - - var part1266 = match("MESSAGE#759:00257:13", "nwparser.payload", "start_time=\"%{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup274, - dup4, - dup5, - ])); - - var msg769 = msg("00257:13", part1266); - - var select291 = linear_select([ - msg750, - msg751, - msg752, - msg753, - msg754, - msg755, - msg756, - msg757, - msg758, - msg759, - msg760, - msg761, - msg762, - msg763, - msg764, - msg765, - msg766, - msg767, - msg768, - msg769, - ]); - - var part1267 = match("MESSAGE#760:00259/1", "nwparser.p0", "user %{username->} has logged on via %{p0}"); - - var part1268 = match("MESSAGE#760:00259/2_0", "nwparser.p0", "the console %{p0}"); - - var select292 = linear_select([ - part1268, - dup289, - dup241, - ]); - - var part1269 = match("MESSAGE#760:00259/3", "nwparser.p0", "from %{saddr}:%{sport}"); - - var all263 = all_match({ - processors: [ - dup394, - part1267, - select292, - part1269, - ], - on_success: processor_chain([ - dup28, - dup29, - dup30, - dup31, - dup32, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg770 = msg("00259", all263); - - var part1270 = match("MESSAGE#761:00259:07/1", "nwparser.p0", "user %{administrator->} has logged out via %{logon_type->} from %{saddr}:%{sport}"); - - var all264 = all_match({ - processors: [ - dup394, - part1270, - ], - on_success: processor_chain([ - dup33, - dup29, - dup34, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg771 = msg("00259:07", all264); - - var part1271 = match("MESSAGE#762:00259:01", "nwparser.payload", "Management session via %{logon_type->} from %{saddr}:%{sport->} for [vsys] admin %{administrator->} has timed out", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg772 = msg("00259:01", part1271); - - var part1272 = match("MESSAGE#763:00259:02", "nwparser.payload", "Management session via %{logon_type->} for [ vsys ] admin %{administrator->} has timed out", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg773 = msg("00259:02", part1272); - - var part1273 = match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by admin %{administrator->} via the %{logon_type->} has failed", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg774 = msg("00259:03", part1273); - - var part1274 = match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{logon_type->} from %{saddr}:%{sport->} has failed", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg775 = msg("00259:04", part1274); - - var part1275 = match("MESSAGE#766:00259:05/0", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the %{p0}"); - - var part1276 = match("MESSAGE#766:00259:05/1_2", "nwparser.p0", "Web %{p0}"); - - var select293 = linear_select([ - dup241, - dup289, - part1276, - ]); - - var part1277 = match("MESSAGE#766:00259:05/2", "nwparser.p0", "session on host %{daddr}:%{dport}"); - - var all265 = all_match({ - processors: [ - part1275, - select293, - part1277, - ], - on_success: processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg776 = msg("00259:05", all265); - - var part1278 = match("MESSAGE#767:00259:06", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the serial console session.", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg777 = msg("00259:06", part1278); - - var select294 = linear_select([ - msg770, - msg771, - msg772, - msg773, - msg774, - msg775, - msg776, - msg777, - ]); - - var part1279 = match("MESSAGE#768:00262", "nwparser.payload", "Admin user %{administrator->} has been rejected via the %{logon_type->} server at %{hostip}", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg778 = msg("00262", part1279); - - var part1280 = match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} has been accepted via the %{logon_type->} server at %{hostip}", processor_chain([ - setc("eventcategory","1401050100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg779 = msg("00263", part1280); - - var part1281 = match("MESSAGE#770:00400/0_0", "nwparser.payload", "ActiveX control %{p0}"); - - var part1282 = match("MESSAGE#770:00400/0_1", "nwparser.payload", "JAVA applet %{p0}"); - - var part1283 = match("MESSAGE#770:00400/0_2", "nwparser.payload", "EXE file %{p0}"); - - var part1284 = match("MESSAGE#770:00400/0_3", "nwparser.payload", "ZIP file %{p0}"); - - var select295 = linear_select([ - part1281, - part1282, - part1283, - part1284, - ]); - - var part1285 = match("MESSAGE#770:00400/1", "nwparser.p0", "has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{dinterface->} in zone %{dst_zone}. %{info}"); - - var all266 = all_match({ - processors: [ - select295, - part1285, - ], - on_success: processor_chain([ - setc("eventcategory","1003000000"), - dup2, - dup4, - dup5, - dup3, - dup61, - ]), - }); - - var msg780 = msg("00400", all266); - - var part1286 = match("MESSAGE#771:00401", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg781 = msg("00401", part1286); - - var part1287 = match("MESSAGE#772:00402", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup292, - ])); - - var msg782 = msg("00402", part1287); - - var part1288 = match("MESSAGE#773:00402:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at %{p0}"); - - var part1289 = match("MESSAGE#773:00402:01/2", "nwparser.p0", "%{} %{interface->} in zone %{zone}. %{info}"); - - var all267 = all_match({ - processors: [ - part1288, - dup337, - part1289, - ], - on_success: processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup292, - ]), - }); - - var msg783 = msg("00402:01", all267); - - var select296 = linear_select([ - msg782, - msg783, - ]); - - var part1290 = match("MESSAGE#774:00403", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg784 = msg("00403", part1290); - - var part1291 = match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup4, - dup5, - dup3, - dup292, - ])); - - var msg785 = msg("00404", part1291); - - var part1292 = match("MESSAGE#776:00405", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup147, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg786 = msg("00405", part1292); - - var msg787 = msg("00406", dup413); - - var msg788 = msg("00407", dup413); - - var msg789 = msg("00408", dup413); - - var all268 = all_match({ - processors: [ - dup132, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg790 = msg("00409", all268); - - var msg791 = msg("00410", dup413); - - var part1293 = match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup60, - ])); - - var msg792 = msg("00410:01", part1293); - - var select297 = linear_select([ - msg791, - msg792, - ]); - - var part1294 = match("MESSAGE#783:00411/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto TCP (zone %{zone->} %{p0}"); - - var all269 = all_match({ - processors: [ - part1294, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg793 = msg("00411", all269); - - var part1295 = match("MESSAGE#784:00413/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at %{p0}"); - - var part1296 = match("MESSAGE#784:00413/2", "nwparser.p0", "%{} %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all270 = all_match({ - processors: [ - part1295, - dup337, - part1296, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg794 = msg("00413", all270); - - var part1297 = match("MESSAGE#785:00413:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}(zone %{group->} %{p0}"); - - var all271 = all_match({ - processors: [ - part1297, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup61, - ]), - }); - - var msg795 = msg("00413:01", all271); - - var part1298 = match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup9, - ])); - - var msg796 = msg("00413:02", part1298); - - var select298 = linear_select([ - msg794, - msg795, - msg796, - ]); - - var part1299 = match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg797 = msg("00414", part1299); - - var part1300 = match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup9, - ])); - - var msg798 = msg("00414:01", part1300); - - var select299 = linear_select([ - msg797, - msg798, - ]); - - var part1301 = match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg799 = msg("00415", part1301); - - var all272 = all_match({ - processors: [ - dup132, - dup343, - dup294, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg800 = msg("00423", all272); - - var all273 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup60, - ]), - }); - - var msg801 = msg("00429", all273); - - var all274 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup60, - ]), - }); - - var msg802 = msg("00429:01", all274); - - var select300 = linear_select([ - msg801, - msg802, - ]); - - var all275 = all_match({ - processors: [ - dup80, - dup343, - dup295, - dup351, - ], - on_success: processor_chain([ - dup85, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ]), - }); - - var msg803 = msg("00430", all275); - - var all276 = all_match({ - processors: [ - dup132, - dup343, - dup295, - dup351, - ], - on_success: processor_chain([ - dup85, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup60, - ]), - }); - - var msg804 = msg("00430:01", all276); - - var select301 = linear_select([ - msg803, - msg804, - ]); - - var msg805 = msg("00431", dup414); - - var msg806 = msg("00432", dup414); - - var msg807 = msg("00433", dup415); - - var msg808 = msg("00434", dup415); - - var msg809 = msg("00435", dup395); - - var all277 = all_match({ - processors: [ - dup132, - dup343, - dup294, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup5, - dup3, - dup60, - ]), - }); - - var msg810 = msg("00435:01", all277); - - var select302 = linear_select([ - msg809, - msg810, - ]); - - var msg811 = msg("00436", dup395); - - var all278 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup4, - dup5, - dup3, - dup60, - ]), - }); - - var msg812 = msg("00436:01", all278); - - var select303 = linear_select([ - msg811, - msg812, - ]); - - var part1302 = match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg813 = msg("00437", part1302); - - var all279 = all_match({ - processors: [ - dup299, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - dup9, - ]), - }); - - var msg814 = msg("00437:01", all279); - - var part1303 = match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - dup9, - ])); - - var msg815 = msg("00437:02", part1303); - - var select304 = linear_select([ - msg813, - msg814, - msg815, - ]); - - var part1304 = match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg816 = msg("00438", part1304); - - var part1305 = match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg817 = msg("00438:01", part1305); - - var all280 = all_match({ - processors: [ - dup299, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup61, - ]), - }); - - var msg818 = msg("00438:02", all280); - - var select305 = linear_select([ - msg816, - msg817, - msg818, - ]); - - var part1306 = match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ])); - - var msg819 = msg("00440", part1306); - - var part1307 = match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg820 = msg("00440:02", part1307); - - var all281 = all_match({ - processors: [ - dup239, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup9, - dup61, - ]), - }); - - var msg821 = msg("00440:01", all281); - - var part1308 = match("MESSAGE#812:00440:03/0", "nwparser.payload", "Fragmented traffic! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{group->} %{p0}"); - - var all282 = all_match({ - processors: [ - part1308, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup9, - dup60, - ]), - }); - - var msg822 = msg("00440:03", all282); - - var select306 = linear_select([ - msg819, - msg820, - msg821, - msg822, - ]); - - var part1309 = match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var msg823 = msg("00441", part1309); - - var msg824 = msg("00442", dup396); - - var msg825 = msg("00443", dup396); - - var part1310 = match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued command %{fld2->} to redirect output.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg826 = msg("00511", part1310); - - var part1311 = match("MESSAGE#817:00511:01/0", "nwparser.payload", "All System Config saved by admin %{p0}"); - - var all283 = all_match({ - processors: [ - part1311, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg827 = msg("00511:01", all283); - - var part1312 = match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms are cleared by admin %{administrator}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg828 = msg("00511:02", part1312); - - var part1313 = match("MESSAGE#819:00511:03/0", "nwparser.payload", "Get new software from flash to slot (file: %{fld2}) by admin %{p0}"); - - var all284 = all_match({ - processors: [ - part1313, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg829 = msg("00511:03", all284); - - var part1314 = match("MESSAGE#820:00511:04/0", "nwparser.payload", "Get new software from %{hostip->} (file: %{fld2}) to slot (file: %{fld3}) by admin %{p0}"); - - var all285 = all_match({ - processors: [ - part1314, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg830 = msg("00511:04", all285); - - var part1315 = match("MESSAGE#821:00511:05/0", "nwparser.payload", "Get new software to %{hostip->} (file: %{fld2}) by admin %{p0}"); - - var all286 = all_match({ - processors: [ - part1315, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg831 = msg("00511:05", all286); - - var part1316 = match("MESSAGE#822:00511:06/0", "nwparser.payload", "Log setting is modified by admin %{p0}"); - - var all287 = all_match({ - processors: [ - part1316, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg832 = msg("00511:06", all287); - - var part1317 = match("MESSAGE#823:00511:07/0", "nwparser.payload", "Save configuration to %{hostip->} (file: %{fld2}) by admin %{p0}"); - - var all288 = all_match({ - processors: [ - part1317, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg833 = msg("00511:07", all288); - - var part1318 = match("MESSAGE#824:00511:08/0", "nwparser.payload", "Save new software from slot (file: %{fld2}) to flash by admin %{p0}"); - - var all289 = all_match({ - processors: [ - part1318, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg834 = msg("00511:08", all289); - - var part1319 = match("MESSAGE#825:00511:09/0", "nwparser.payload", "Save new software from %{hostip->} (file: %{result}) to flash by admin %{p0}"); - - var all290 = all_match({ - processors: [ - part1319, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg835 = msg("00511:09", all290); - - var part1320 = match("MESSAGE#826:00511:10/0", "nwparser.payload", "System Config from flash to slot - %{fld2->} by admin %{p0}"); - - var all291 = all_match({ - processors: [ - part1320, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg836 = msg("00511:10", all291); - - var part1321 = match("MESSAGE#827:00511:11/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) to slot - %{fld3->} by admin %{p0}"); - - var all292 = all_match({ - processors: [ - part1321, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg837 = msg("00511:11", all292); - - var part1322 = match("MESSAGE#828:00511:12/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) by admin %{p0}"); - - var all293 = all_match({ - processors: [ - part1322, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg838 = msg("00511:12", all293); - - var part1323 = match("MESSAGE#829:00511:13/0", "nwparser.payload", "The system configuration was loaded from the slot by admin %{p0}"); - - var all294 = all_match({ - processors: [ - part1323, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg839 = msg("00511:13", all294); - - var part1324 = match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS shared secret with invalid length %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg840 = msg("00511:14", part1324); - - var select307 = linear_select([ - msg826, - msg827, - msg828, - msg829, - msg830, - msg831, - msg832, - msg833, - msg834, - msg835, - msg836, - msg837, - msg838, - msg839, - msg840, - ]); - - var part1325 = match("MESSAGE#831:00513/0", "nwparser.payload", "The physical state of %{p0}"); - - var part1326 = match("MESSAGE#831:00513/1_1", "nwparser.p0", "the Interface %{p0}"); - - var select308 = linear_select([ - dup123, - part1326, - dup122, - ]); - - var part1327 = match("MESSAGE#831:00513/2", "nwparser.p0", "%{interface->} has changed to %{p0}"); - - var part1328 = match("MESSAGE#831:00513/3_0", "nwparser.p0", "%{result}. (%{fld1})"); - - var part1329 = match_copy("MESSAGE#831:00513/3_1", "nwparser.p0", "result"); - - var select309 = linear_select([ - part1328, - part1329, - ]); - - var all295 = all_match({ - processors: [ - part1325, - select308, - part1327, - select309, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg841 = msg("00513", all295); - - var part1330 = match("MESSAGE#832:00515/0_0", "nwparser.payload", "Vsys Admin %{p0}"); - - var select310 = linear_select([ - part1330, - dup287, - ]); - - var part1331 = match("MESSAGE#832:00515/1", "nwparser.p0", "%{administrator->} has logged on via the %{logon_type->} ( HTTP%{p0}"); - - var part1332 = match("MESSAGE#832:00515/2_1", "nwparser.p0", "S%{p0}"); - - var select311 = linear_select([ - dup96, - part1332, - ]); - - var part1333 = match("MESSAGE#832:00515/3", "nwparser.p0", "%{}) to port %{interface->} from %{saddr}:%{sport}"); - - var all296 = all_match({ - processors: [ - select310, - part1331, - select311, - part1333, - ], - on_success: processor_chain([ - dup301, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg842 = msg("00515", all296); - - var part1334 = match("MESSAGE#833:00515:01/0", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{p0}"); - - var part1335 = match("MESSAGE#833:00515:01/1_0", "nwparser.p0", "the %{logon_type->} has failed %{p0}"); - - var part1336 = match("MESSAGE#833:00515:01/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} has failed %{p0}"); - - var select312 = linear_select([ - part1335, - part1336, - ]); - - var part1337 = match_copy("MESSAGE#833:00515:01/2", "nwparser.p0", "fld2"); - - var all297 = all_match({ - processors: [ - part1334, - select312, - part1337, - ], - on_success: processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup4, - dup5, - dup302, - dup3, - ]), - }); - - var msg843 = msg("00515:01", all297); - - var part1338 = match("MESSAGE#834:00515:02/0", "nwparser.payload", "Management session via %{p0}"); - - var part1339 = match("MESSAGE#834:00515:02/1_0", "nwparser.p0", "the %{logon_type->} for %{p0}"); - - var part1340 = match("MESSAGE#834:00515:02/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} for %{p0}"); - - var select313 = linear_select([ - part1339, - part1340, - ]); - - var part1341 = match("MESSAGE#834:00515:02/2_0", "nwparser.p0", "[vsys] admin %{p0}"); - - var part1342 = match("MESSAGE#834:00515:02/2_1", "nwparser.p0", "vsys admin %{p0}"); - - var select314 = linear_select([ - part1341, - part1342, - dup15, - ]); - - var part1343 = match("MESSAGE#834:00515:02/3", "nwparser.p0", "%{administrator->} has timed out"); - - var all298 = all_match({ - processors: [ - part1338, - select313, - select314, - part1343, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg844 = msg("00515:02", all298); - - var part1344 = match("MESSAGE#835:00515:04/0_0", "nwparser.payload", "[Vsys] %{p0}"); - - var part1345 = match("MESSAGE#835:00515:04/0_1", "nwparser.payload", "Vsys %{p0}"); - - var select315 = linear_select([ - part1344, - part1345, - ]); - - var part1346 = match("MESSAGE#835:00515:04/1", "nwparser.p0", "Admin %{administrator->} has logged o%{p0}"); - - var part1347 = match_copy("MESSAGE#835:00515:04/4_1", "nwparser.p0", "logon_type"); - - var select316 = linear_select([ - dup304, - part1347, - ]); - - var all299 = all_match({ - processors: [ - select315, - part1346, - dup398, - dup40, - select316, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg845 = msg("00515:04", all299); - - var part1348 = match("MESSAGE#836:00515:06", "nwparser.payload", "Admin User %{administrator->} has logged on via %{logon_type->} from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg846 = msg("00515:06", part1348); - - var part1349 = match("MESSAGE#837:00515:05/0", "nwparser.payload", "%{}Admin %{p0}"); - - var select317 = linear_select([ - dup305, - dup16, - ]); - - var part1350 = match("MESSAGE#837:00515:05/2", "nwparser.p0", "%{administrator->} has logged o%{p0}"); - - var part1351 = match("MESSAGE#837:00515:05/5_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{fld2})"); - - var select318 = linear_select([ - dup306, - part1351, - dup304, - ]); - - var all300 = all_match({ - processors: [ - part1349, - select317, - part1350, - dup398, - dup40, - select318, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg847 = msg("00515:05", all300); - - var part1352 = match("MESSAGE#838:00515:07", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(http) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg848 = msg("00515:07", part1352); - - var part1353 = match("MESSAGE#839:00515:08/0", "nwparser.payload", "%{fld2->} Admin User \"%{administrator}\" logged in for %{logon_type}(http%{p0}"); - - var part1354 = match("MESSAGE#839:00515:08/1_0", "nwparser.p0", ") %{p0}"); - - var part1355 = match("MESSAGE#839:00515:08/1_1", "nwparser.p0", "s) %{p0}"); - - var select319 = linear_select([ - part1354, - part1355, - ]); - - var part1356 = match("MESSAGE#839:00515:08/2", "nwparser.p0", "management (port %{network_port}) from %{saddr}:%{sport}"); - - var all301 = all_match({ - processors: [ - part1353, - select319, - part1356, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg849 = msg("00515:08", all301); - - var part1357 = match("MESSAGE#840:00515:09", "nwparser.payload", "User %{username->} telnet management session from (%{saddr}:%{sport}) timed out", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg850 = msg("00515:09", part1357); - - var part1358 = match("MESSAGE#841:00515:10", "nwparser.payload", "User %{username->} logged out of telnet session from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg851 = msg("00515:10", part1358); - - var part1359 = match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on zone %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg852 = msg("00515:11", part1359); - - var part1360 = match("MESSAGE#843:00515:12/0", "nwparser.payload", "[ Vsys ] Admin User \"%{administrator}\" logged in for Web( http%{p0}"); - - var part1361 = match("MESSAGE#843:00515:12/2", "nwparser.p0", ") management (port %{network_port})"); - - var all302 = all_match({ - processors: [ - part1360, - dup399, - part1361, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg853 = msg("00515:12", all302); - - var select320 = linear_select([ - dup288, - dup287, - ]); - - var part1362 = match("MESSAGE#844:00515:13/1", "nwparser.p0", "user %{administrator->} has logged o%{p0}"); - - var select321 = linear_select([ - dup306, - dup304, - ]); - - var all303 = all_match({ - processors: [ - select320, - part1362, - dup398, - dup40, - select321, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg854 = msg("00515:13", all303); - - var part1363 = match("MESSAGE#845:00515:14/0_0", "nwparser.payload", "Admin user %{administrator->} has been forced to log o%{p0}"); - - var part1364 = match("MESSAGE#845:00515:14/0_1", "nwparser.payload", "%{username->} %{fld1->} has been forced to log o%{p0}"); - - var select322 = linear_select([ - part1363, - part1364, - ]); - - var part1365 = match("MESSAGE#845:00515:14/2", "nwparser.p0", "of the %{p0}"); - - var part1366 = match("MESSAGE#845:00515:14/3_0", "nwparser.p0", "serial %{logon_type->} session."); - - var part1367 = match("MESSAGE#845:00515:14/3_1", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port->} (%{event_time})"); - - var part1368 = match("MESSAGE#845:00515:14/3_2", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port}"); - - var select323 = linear_select([ - part1366, - part1367, - part1368, - ]); - - var all304 = all_match({ - processors: [ - select322, - dup398, - part1365, - select323, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg855 = msg("00515:14", all304); - - var part1369 = match("MESSAGE#846:00515:15/0", "nwparser.payload", "%{fld2}: Admin User %{administrator->} has logged o%{p0}"); - - var part1370 = match("MESSAGE#846:00515:15/3_0", "nwparser.p0", "the %{logon_type->} (%{p0}"); - - var part1371 = match("MESSAGE#846:00515:15/3_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{p0}"); - - var select324 = linear_select([ - part1370, - part1371, - ]); - - var all305 = all_match({ - processors: [ - part1369, - dup398, - dup40, - select324, - dup41, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg856 = msg("00515:15", all305); - - var part1372 = match("MESSAGE#847:00515:16/0_0", "nwparser.payload", "%{fld2}: Admin %{p0}"); - - var select325 = linear_select([ - part1372, - dup287, - ]); - - var part1373 = match("MESSAGE#847:00515:16/1", "nwparser.p0", "user %{administrator->} attempt access to %{url->} illegal from %{logon_type}( http%{p0}"); - - var part1374 = match("MESSAGE#847:00515:16/3", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}. (%{fld1})"); - - var all306 = all_match({ - processors: [ - select325, - part1373, - dup399, - part1374, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg857 = msg("00515:16", all306); - - var part1375 = match("MESSAGE#848:00515:17/0", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{p0}"); - - var part1376 = match("MESSAGE#848:00515:17/1_0", "nwparser.p0", "https %{p0}"); - - var part1377 = match("MESSAGE#848:00515:17/1_1", "nwparser.p0", " http %{p0}"); - - var select326 = linear_select([ - part1376, - part1377, - ]); - - var part1378 = match("MESSAGE#848:00515:17/2", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}"); - - var all307 = all_match({ - processors: [ - part1375, - select326, - part1378, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg858 = msg("00515:17", all307); - - var part1379 = match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(https) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg859 = msg("00515:18", part1379); - - var part1380 = match("MESSAGE#850:00515:19/0", "nwparser.payload", "Vsys admin user %{administrator->} logged on via %{p0}"); - - var part1381 = match("MESSAGE#850:00515:19/1_0", "nwparser.p0", "%{logon_type->} from remote IP address %{saddr->} using port %{sport}. (%{p0}"); - - var part1382 = match("MESSAGE#850:00515:19/1_1", "nwparser.p0", "the console. (%{p0}"); - - var select327 = linear_select([ - part1381, - part1382, - ]); - - var all308 = all_match({ - processors: [ - part1380, - select327, - dup41, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg860 = msg("00515:19", all308); - - var part1383 = match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session via SCS from %{saddr}:%{sport->} for admin netscreen has timed out (%{fld1})", processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg861 = msg("00515:20", part1383); - - var select328 = linear_select([ - msg842, - msg843, - msg844, - msg845, - msg846, - msg847, - msg848, - msg849, - msg850, - msg851, - msg852, - msg853, - msg854, - msg855, - msg856, - msg857, - msg858, - msg859, - msg860, - msg861, - ]); - - var part1384 = match("MESSAGE#852:00518", "nwparser.payload", "Admin user %{administrator->} %{fld1}at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg862 = msg("00518", part1384); - - var part1385 = match("MESSAGE#853:00518:17", "nwparser.payload", "Admin user %{administrator->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg863 = msg("00518:17", part1385); - - var part1386 = match("MESSAGE#854:00518:01", "nwparser.payload", "Local authentication for WebAuth user %{username->} was %{disposition}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg864 = msg("00518:01", part1386); - - var part1387 = match("MESSAGE#855:00518:02", "nwparser.payload", "Local authentication for user %{username->} was %{disposition}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg865 = msg("00518:02", part1387); - - var part1388 = match("MESSAGE#856:00518:03", "nwparser.payload", "User %{username->} at %{saddr->} must enter \"Next Code\" for SecurID %{hostip}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg866 = msg("00518:03", part1388); - - var part1389 = match("MESSAGE#857:00518:04", "nwparser.payload", "WebAuth user %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg867 = msg("00518:04", part1389); - - var part1390 = match("MESSAGE#858:00518:05", "nwparser.payload", "User %{username->} at %{saddr->} has been challenged via the %{authmethod->} server at %{hostip->} (Rejected since challenge is not supported for %{logon_type})", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg868 = msg("00518:05", part1390); - - var part1391 = match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for WebAuth user %{username}", processor_chain([ - dup35, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg869 = msg("00518:06", part1391); - - var part1392 = match("MESSAGE#860:00518:07/0", "nwparser.payload", "Authentication for user %{username->} was denied (long %{p0}"); - - var part1393 = match("MESSAGE#860:00518:07/1_1", "nwparser.p0", "username %{p0}"); - - var select329 = linear_select([ - dup24, - part1393, - ]); - - var part1394 = match("MESSAGE#860:00518:07/2", "nwparser.p0", ")%{}"); - - var all309 = all_match({ - processors: [ - part1392, - select329, - part1394, - ], - on_success: processor_chain([ - dup53, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg870 = msg("00518:07", all309); - - var part1395 = match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr->} %{authmethod->} authentication attempt has timed out", processor_chain([ - dup35, - dup29, - dup31, - dup39, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg871 = msg("00518:08", part1395); - - var part1396 = match("MESSAGE#862:00518:09", "nwparser.payload", "User %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg872 = msg("00518:09", part1396); - - var part1397 = match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed due to %{result}. (%{fld1})", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup4, - dup9, - dup5, - dup3, - dup302, - ])); - - var msg873 = msg("00518:10", part1397); - - var part1398 = match("MESSAGE#864:00518:11/0", "nwparser.payload", "ADM: Local admin authentication failed for login name %{p0}"); - - var part1399 = match("MESSAGE#864:00518:11/1_0", "nwparser.p0", "'%{username}': %{p0}"); - - var part1400 = match("MESSAGE#864:00518:11/1_1", "nwparser.p0", "%{username}: %{p0}"); - - var select330 = linear_select([ - part1399, - part1400, - ]); - - var part1401 = match("MESSAGE#864:00518:11/2", "nwparser.p0", "%{result->} (%{fld1})"); - - var all310 = all_match({ - processors: [ - part1398, - select330, - part1401, - ], - on_success: processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup9, - dup4, - dup5, - dup3, - ]), - }); - - var msg874 = msg("00518:11", all310); - - var part1402 = match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup9, - dup5, - dup3, - ])); - - var msg875 = msg("00518:12", part1402); - - var part1403 = match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr->} is rejected by the Radius server at %{hostip}. (%{fld1})", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup9, - dup5, - ])); - - var msg876 = msg("00518:13", part1403); - - var part1404 = match("MESSAGE#867:00518:14", "nwparser.payload", "%{fld2}: Admin user has been rejected via the Radius server at %{hostip->} (%{fld1})", processor_chain([ - dup290, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg877 = msg("00518:14", part1404); - - var select331 = linear_select([ - msg862, - msg863, - msg864, - msg865, - msg866, - msg867, - msg868, - msg869, - msg870, - msg871, - msg872, - msg873, - msg874, - msg875, - msg876, - msg877, - ]); - - var part1405 = match("MESSAGE#868:00519/0", "nwparser.payload", "Admin user %{administrator->} %{p0}"); - - var part1406 = match("MESSAGE#868:00519/1_1", "nwparser.p0", "of group %{group->} at %{saddr->} has %{p0}"); - - var part1407 = match("MESSAGE#868:00519/1_2", "nwparser.p0", "%{group->} at %{saddr->} has %{p0}"); - - var select332 = linear_select([ - dup194, - part1406, - part1407, - ]); - - var part1408 = match("MESSAGE#868:00519/2", "nwparser.p0", "been %{disposition->} via the %{logon_type->} server %{p0}"); - - var part1409 = match("MESSAGE#868:00519/3_0", "nwparser.p0", "at %{p0}"); - - var select333 = linear_select([ - part1409, - dup16, - ]); - - var part1410 = match("MESSAGE#868:00519/4", "nwparser.p0", "%{hostip}"); - - var all311 = all_match({ - processors: [ - part1405, - select332, - part1408, - select333, - part1410, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg878 = msg("00519", all311); - - var part1411 = match("MESSAGE#869:00519:01/0", "nwparser.payload", "Local authentication for %{p0}"); - - var select334 = linear_select([ - dup307, - dup305, - ]); - - var part1412 = match("MESSAGE#869:00519:01/2", "nwparser.p0", "%{username->} was %{disposition}"); - - var all312 = all_match({ - processors: [ - part1411, - select334, - part1412, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg879 = msg("00519:01", all312); - - var part1413 = match("MESSAGE#870:00519:02/1_1", "nwparser.p0", "User %{p0}"); - - var select335 = linear_select([ - dup307, - part1413, - ]); - - var part1414 = match("MESSAGE#870:00519:02/2", "nwparser.p0", "%{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}"); - - var all313 = all_match({ - processors: [ - dup160, - select335, - part1414, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg880 = msg("00519:02", all313); - - var part1415 = match("MESSAGE#871:00519:03", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{fld4}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg881 = msg("00519:03", part1415); - - var part1416 = match("MESSAGE#872:00519:04", "nwparser.payload", "ADM: Local admin authentication successful for login name %{username->} (%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg882 = msg("00519:04", part1416); - - var part1417 = match("MESSAGE#873:00519:05", "nwparser.payload", "%{fld2}Admin user %{administrator->} has been accepted via the Radius server at %{hostip}(%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg883 = msg("00519:05", part1417); - - var select336 = linear_select([ - msg878, - msg879, - msg880, - msg881, - msg882, - msg883, - ]); - - var part1418 = match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authentication attempt has timed out", processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg884 = msg("00520", part1418); - - var part1419 = match("MESSAGE#875:00520:01/0", "nwparser.payload", "User %{username->} at %{hostip->} %{p0}"); - - var part1420 = match("MESSAGE#875:00520:01/1_0", "nwparser.p0", "RADIUS %{p0}"); - - var part1421 = match("MESSAGE#875:00520:01/1_1", "nwparser.p0", "SecurID %{p0}"); - - var part1422 = match("MESSAGE#875:00520:01/1_2", "nwparser.p0", "LDAP %{p0}"); - - var part1423 = match("MESSAGE#875:00520:01/1_3", "nwparser.p0", "Local %{p0}"); - - var select337 = linear_select([ - part1420, - part1421, - part1422, - part1423, - ]); - - var part1424 = match("MESSAGE#875:00520:01/2", "nwparser.p0", "authentication attempt has timed out%{}"); - - var all314 = all_match({ - processors: [ - part1419, - select337, - part1424, - ], - on_success: processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg885 = msg("00520:01", all314); - - var part1425 = match("MESSAGE#876:00520:02/0", "nwparser.payload", "Trying %{p0}"); - - var part1426 = match("MESSAGE#876:00520:02/2", "nwparser.p0", "server %{fld2}"); - - var all315 = all_match({ - processors: [ - part1425, - dup400, - part1426, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg886 = msg("00520:02", all315); - - var part1427 = match("MESSAGE#877:00520:03/1_0", "nwparser.p0", "Primary %{p0}"); - - var part1428 = match("MESSAGE#877:00520:03/1_1", "nwparser.p0", "Backup1 %{p0}"); - - var part1429 = match("MESSAGE#877:00520:03/1_2", "nwparser.p0", "Backup2 %{p0}"); - - var select338 = linear_select([ - part1427, - part1428, - part1429, - ]); - - var part1430 = match("MESSAGE#877:00520:03/2", "nwparser.p0", "%{fld2}, %{p0}"); - - var part1431 = match("MESSAGE#877:00520:03/4", "nwparser.p0", "%{fld3}, and %{p0}"); - - var part1432 = match("MESSAGE#877:00520:03/6", "nwparser.p0", "%{fld4->} servers failed"); - - var all316 = all_match({ - processors: [ - dup160, - select338, - part1430, - dup400, - part1431, - dup400, - part1432, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg887 = msg("00520:03", all316); - - var part1433 = match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hostip->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg888 = msg("00520:04", part1433); - - var part1434 = match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: New requests for %{fld31->} server will try %{fld32->} from now on. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg889 = msg("00520:05", part1434); - - var select339 = linear_select([ - msg884, - msg885, - msg886, - msg887, - msg888, - msg889, - ]); - - var part1435 = match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg890 = msg("00521", part1435); - - var part1436 = match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg891 = msg("00522", part1436); - - var part1437 = match("MESSAGE#881:00523", "nwparser.payload", "URL filtering received an error from %{fld2->} (error %{resultcode}).", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg892 = msg("00523", part1437); - - var part1438 = match("MESSAGE#882:00524", "nwparser.payload", "NetScreen device at %{hostip}:%{network_port->} has responded successfully to SNMP request from %{saddr}:%{sport}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg893 = msg("00524", part1438); - - var part1439 = match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown SNMP community public at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg894 = msg("00524:02", part1439); - - var part1440 = match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has responded successfully to the SNMP request from %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg895 = msg("00524:03", part1440); - - var part1441 = match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown SNMP community admin at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg896 = msg("00524:04", part1441); - - var part1442 = match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg897 = msg("00524:05", part1442); - - var part1443 = match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been received from an unknown host in SNMP community %{fld2->} at %{hostip}:%{network_port}. (%{fld1})", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg898 = msg("00524:06", part1443); - - var part1444 = match("MESSAGE#888:00524:12", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{saddr}:%{sport->} to %{daddr}:%{dport->} has been received", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg899 = msg("00524:12", part1444); - - var part1445 = match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{sport->} has been received, but the SNMP version type is incorrect. (%{fld1})", processor_chain([ - dup19, - dup2, - dup4, - setc("result","the SNMP version type is incorrect"), - dup5, - dup9, - ])); - - var msg900 = msg("00524:14", part1445); - - var part1446 = match("MESSAGE#890:00524:13/0", "nwparser.payload", "SNMP request has been received%{p0}"); - - var part1447 = match("MESSAGE#890:00524:13/2", "nwparser.p0", "%{}but %{result}"); - - var all317 = all_match({ - processors: [ - part1446, - dup401, - part1447, - ], - on_success: processor_chain([ - dup18, - dup2, - dup4, - dup5, - ]), - }); - - var msg901 = msg("00524:13", all317); - - var part1448 = match("MESSAGE#891:00524:07", "nwparser.payload", "Response to SNMP request from %{saddr}:%{sport->} to %{daddr}:%{dport->} has %{disposition->} due to %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg902 = msg("00524:07", part1448); - - var part1449 = match("MESSAGE#892:00524:08", "nwparser.payload", "SNMP community %{fld2->} cannot be added because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg903 = msg("00524:08", part1449); - - var part1450 = match("MESSAGE#893:00524:09", "nwparser.payload", "SNMP host %{hostip->} cannot be added to community %{fld2->} because of %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg904 = msg("00524:09", part1450); - - var part1451 = match("MESSAGE#894:00524:10", "nwparser.payload", "SNMP host %{hostip->} cannot be added because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg905 = msg("00524:10", part1451); - - var part1452 = match("MESSAGE#895:00524:11", "nwparser.payload", "SNMP host %{hostip->} cannot be removed from community %{fld2->} because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg906 = msg("00524:11", part1452); - - var part1453 = match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34->} doesn't exist. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg907 = msg("00524:16", part1453); - - var select340 = linear_select([ - msg893, - msg894, - msg895, - msg896, - msg897, - msg898, - msg899, - msg900, - msg901, - msg902, - msg903, - msg904, - msg905, - msg906, - msg907, - ]); - - var part1454 = match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username->} at %{hostip->} has been %{disposition->} by SecurID %{fld2}", processor_chain([ - dup203, - setc("ec_subject","Password"), - dup38, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg908 = msg("00525", part1454); - - var part1455 = match("MESSAGE#897:00525:01", "nwparser.payload", "User %{username->} at %{hostip->} has selected a system-generated PIN for authentication with SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg909 = msg("00525:01", part1455); - - var part1456 = match("MESSAGE#898:00525:02", "nwparser.payload", "User %{username->} at %{hostip->} must enter the \"new PIN\" for SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg910 = msg("00525:02", part1456); - - var part1457 = match("MESSAGE#899:00525:03", "nwparser.payload", "User %{username->} at %{hostip->} must make a \"New PIN\" choice for SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg911 = msg("00525:03", part1457); - - var select341 = linear_select([ - msg908, - msg909, - msg910, - msg911, - ]); - - var part1458 = match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded and %{hostip->} cannot be added", processor_chain([ - dup37, - dup219, - dup38, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg912 = msg("00526", part1458); - - var part1459 = match("MESSAGE#901:00527/0", "nwparser.payload", "A DHCP-%{p0}"); - - var part1460 = match("MESSAGE#901:00527/1_1", "nwparser.p0", " assigned %{p0}"); - - var select342 = linear_select([ - dup311, - part1460, - ]); - - var part1461 = match("MESSAGE#901:00527/2", "nwparser.p0", "IP address %{hostip->} has been %{p0}"); - - var part1462 = match("MESSAGE#901:00527/3_1", "nwparser.p0", "freed from %{p0}"); - - var part1463 = match("MESSAGE#901:00527/3_2", "nwparser.p0", "freed %{p0}"); - - var select343 = linear_select([ - dup312, - part1462, - part1463, - ]); - - var all318 = all_match({ - processors: [ - part1459, - select342, - part1461, - select343, - dup108, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg913 = msg("00527", all318); - - var part1464 = match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address has been manually released%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg914 = msg("00527:01", part1464); - - var part1465 = match("MESSAGE#903:00527:02/0", "nwparser.payload", "DHCP server has %{p0}"); - - var part1466 = match("MESSAGE#903:00527:02/1_1", "nwparser.p0", "released %{p0}"); - - var part1467 = match("MESSAGE#903:00527:02/1_2", "nwparser.p0", "assigned or released %{p0}"); - - var select344 = linear_select([ - dup311, - part1466, - part1467, - ]); - - var part1468 = match("MESSAGE#903:00527:02/2", "nwparser.p0", "an IP address%{}"); - - var all319 = all_match({ - processors: [ - part1465, - select344, - part1468, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg915 = msg("00527:02", all319); - - var part1469 = match("MESSAGE#904:00527:03", "nwparser.payload", "MAC address %{macaddr->} has detected an IP conflict and has declined address %{hostip}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg916 = msg("00527:03", part1469); - - var part1470 = match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP addresses have been manually released.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg917 = msg("00527:04", part1470); - - var part1471 = match("MESSAGE#906:00527:05/2", "nwparser.p0", "%{} %{interface->} is more than %{fld2->} allocated."); - - var all320 = all_match({ - processors: [ - dup210, - dup337, - part1471, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg918 = msg("00527:05", all320); - - var part1472 = match("MESSAGE#907:00527:06/0", "nwparser.payload", "IP address %{hostip->} %{p0}"); - - var select345 = linear_select([ - dup106, - dup127, - ]); - - var part1473 = match("MESSAGE#907:00527:06/3_1", "nwparser.p0", "released from %{p0}"); - - var select346 = linear_select([ - dup312, - part1473, - ]); - - var part1474 = match("MESSAGE#907:00527:06/4", "nwparser.p0", "%{fld2->} (%{fld1})"); - - var all321 = all_match({ - processors: [ - part1472, - select345, - dup23, - select346, - part1474, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg919 = msg("00527:06", all321); - - var part1475 = match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have expired. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg920 = msg("00527:07", part1475); - - var part1476 = match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{interface->} received %{protocol_detail->} from %{smacaddr->} requesting out-of-scope IP address %{hostip}/%{mask->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg921 = msg("00527:08", part1476); - - var part1477 = match("MESSAGE#910:00527:09/0", "nwparser.payload", "MAC address %{macaddr->} has %{disposition->} %{p0}"); - - var part1478 = match("MESSAGE#910:00527:09/1_0", "nwparser.p0", "address %{hostip->} (%{p0}"); - - var part1479 = match("MESSAGE#910:00527:09/1_1", "nwparser.p0", "%{hostip->} (%{p0}"); - - var select347 = linear_select([ - part1478, - part1479, - ]); - - var all322 = all_match({ - processors: [ - part1477, - select347, - dup41, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg922 = msg("00527:09", all322); - - var part1480 = match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are expired. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg923 = msg("00527:10", part1480); - - var select348 = linear_select([ - msg913, - msg914, - msg915, - msg916, - msg917, - msg918, - msg919, - msg920, - msg921, - msg922, - msg923, - ]); - - var part1481 = match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenticated using password :", processor_chain([ - setc("eventcategory","1302010000"), - dup29, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg924 = msg("00528", part1481); - - var part1482 = match("MESSAGE#913:00528:01", "nwparser.payload", "SCS: Connection terminated for user %{username->} from", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg925 = msg("00528:01", part1482); - - var part1483 = match("MESSAGE#914:00528:02", "nwparser.payload", "SCS: Disabled for all root/vsys on device. Client host attempting connection to interface '%{interface}' with address %{hostip->} from %{saddr}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg926 = msg("00528:02", part1483); - - var part1484 = match("MESSAGE#915:00528:03", "nwparser.payload", "SSH: NetScreen device %{disposition->} to identify itself to the SSH client at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg927 = msg("00528:03", part1484); - - var part1485 = match("MESSAGE#916:00528:04", "nwparser.payload", "SSH: Incompatible SSH version string has been received from SSH client at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg928 = msg("00528:04", part1485); - - var part1486 = match("MESSAGE#917:00528:05", "nwparser.payload", "SSH: %{disposition->} to send identification string to client host at %{hostip}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg929 = msg("00528:05", part1486); - - var part1487 = match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} attempted to connect with invalid version string.", processor_chain([ - dup313, - dup2, - dup3, - dup4, - dup5, - setc("result","invalid version string"), - ])); - - var msg930 = msg("00528:06", part1487); - - var part1488 = match("MESSAGE#919:00528:07/0", "nwparser.payload", "SSH: %{disposition->} to negotiate %{p0}"); - - var part1489 = match("MESSAGE#919:00528:07/1_1", "nwparser.p0", "MAC %{p0}"); - - var part1490 = match("MESSAGE#919:00528:07/1_2", "nwparser.p0", "key exchange %{p0}"); - - var part1491 = match("MESSAGE#919:00528:07/1_3", "nwparser.p0", "host key %{p0}"); - - var select349 = linear_select([ - dup88, - part1489, - part1490, - part1491, - ]); - - var part1492 = match("MESSAGE#919:00528:07/2", "nwparser.p0", "algorithm with host %{hostip}"); - - var all323 = all_match({ - processors: [ - part1488, - select349, - part1492, - ], - on_success: processor_chain([ - dup314, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg931 = msg("00528:07", all323); - - var part1493 = match("MESSAGE#920:00528:08", "nwparser.payload", "SSH: Unsupported cipher type %{fld2->} requested from %{saddr}", processor_chain([ - dup314, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg932 = msg("00528:08", part1493); - - var part1494 = match("MESSAGE#921:00528:09", "nwparser.payload", "SSH: Host client has requested NO cipher from %{saddr}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg933 = msg("00528:09", part1494); - - var part1495 = match("MESSAGE#922:00528:10", "nwparser.payload", "SSH: Disabled for '%{vsys}'. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg934 = msg("00528:10", part1495); - - var part1496 = match("MESSAGE#923:00528:11", "nwparser.payload", "SSH: Disabled for %{fld2->} Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg935 = msg("00528:11", part1496); - - var part1497 = match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} at %{saddr->} tried unsuccessfully to log in to %{vsys->} using the shared untrusted interface. SSH disabled on that interface.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("disposition","disabled"), - ])); - - var msg936 = msg("00528:12", part1497); - - var part1498 = match("MESSAGE#925:00528:13/0", "nwparser.payload", "SSH: SSH client at %{saddr->} tried unsuccessfully to %{p0}"); - - var part1499 = match("MESSAGE#925:00528:13/1_0", "nwparser.p0", "make %{p0}"); - - var part1500 = match("MESSAGE#925:00528:13/1_1", "nwparser.p0", "establish %{p0}"); - - var select350 = linear_select([ - part1499, - part1500, - ]); - - var part1501 = match("MESSAGE#925:00528:13/2", "nwparser.p0", "an SSH connection to %{p0}"); - - var part1502 = match("MESSAGE#925:00528:13/4", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} SSH %{p0}"); - - var part1503 = match("MESSAGE#925:00528:13/5_0", "nwparser.p0", "not enabled %{p0}"); - - var select351 = linear_select([ - part1503, - dup157, - ]); - - var part1504 = match("MESSAGE#925:00528:13/6", "nwparser.p0", "on that interface.%{}"); - - var all324 = all_match({ - processors: [ - part1498, - select350, - part1501, - dup337, - part1502, - select351, - part1504, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg937 = msg("00528:13", all324); - - var part1505 = match("MESSAGE#926:00528:14", "nwparser.payload", "SSH: SSH client %{saddr->} unsuccessfully attempted to make an SSH connection to %{vsys->} SSH was not completely initialized for that system.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg938 = msg("00528:14", part1505); - - var part1506 = match("MESSAGE#927:00528:15/0", "nwparser.payload", "SSH: Admin user %{p0}"); - - var part1507 = match("MESSAGE#927:00528:15/1_1", "nwparser.p0", "%{administrator->} %{p0}"); - - var select352 = linear_select([ - dup315, - part1507, - ]); - - var part1508 = match("MESSAGE#927:00528:15/2", "nwparser.p0", "at host %{saddr->} requested unsupported %{p0}"); - - var part1509 = match("MESSAGE#927:00528:15/3_0", "nwparser.p0", "PKA algorithm %{p0}"); - - var part1510 = match("MESSAGE#927:00528:15/3_1", "nwparser.p0", "authentication method %{p0}"); - - var select353 = linear_select([ - part1509, - part1510, - ]); - - var all325 = all_match({ - processors: [ - part1506, - select352, - part1508, - select353, - dup108, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg939 = msg("00528:15", all325); - - var part1511 = match("MESSAGE#928:00528:16", "nwparser.payload", "SCP: Admin '%{administrator}' at host %{saddr->} executed invalid scp command: '%{fld2}'", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg940 = msg("00528:16", part1511); - - var part1512 = match("MESSAGE#929:00528:17", "nwparser.payload", "SCP: Disabled for '%{username}'. Attempted file transfer failed from host %{saddr}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg941 = msg("00528:17", part1512); - - var part1513 = match("MESSAGE#930:00528:18/2", "nwparser.p0", "authentication successful for admin user %{p0}"); - - var all326 = all_match({ - processors: [ - dup316, - dup402, - part1513, - dup403, - dup320, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("disposition","successful"), - setc("event_description","authentication successful for admin user"), - ]), - }); - - var msg942 = msg("00528:18", all326); - - var part1514 = match("MESSAGE#931:00528:26/2", "nwparser.p0", "authentication failed for admin user %{p0}"); - - var all327 = all_match({ - processors: [ - dup316, - dup402, - part1514, - dup403, - dup320, - ], - on_success: processor_chain([ - dup206, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup302, - dup3, - setc("event_description","authentication failed for admin user"), - ]), - }); - - var msg943 = msg("00528:26", all327); - - var part1515 = match("MESSAGE#932:00528:19/2", "nwparser.p0", ": SSH user %{username->} has been %{disposition->} using password from %{saddr}:%{sport}"); - - var all328 = all_match({ - processors: [ - dup321, - dup404, - part1515, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg944 = msg("00528:19", all328); - - var part1516 = match("MESSAGE#933:00528:20/2", "nwparser.p0", ": Connection has been %{disposition->} for admin user %{administrator->} at %{saddr}:%{sport}"); - - var all329 = all_match({ - processors: [ - dup321, - dup404, - part1516, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg945 = msg("00528:20", all329); - - var part1517 = match("MESSAGE#934:00528:21", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has requested PKA RSA authentication, which is not supported for that client.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg946 = msg("00528:21", part1517); - - var part1518 = match("MESSAGE#935:00528:22/0", "nwparser.payload", "SCS: SSH client at %{saddr->} has attempted to make an SCS connection to %{p0}"); - - var part1519 = match("MESSAGE#935:00528:22/2", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} but %{disposition->} because SCS is not enabled for that interface."); - - var all330 = all_match({ - processors: [ - part1518, - dup337, - part1519, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("result","SCS is not enabled for that interface"), - ]), - }); - - var msg947 = msg("00528:22", all330); - - var part1520 = match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to vsys %{vsys->} because SCS cannot generate the host and server keys before timing out.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("result","SCS cannot generate the host and server keys before timing out"), - ])); - - var msg948 = msg("00528:23", part1520); - - var part1521 = match("MESSAGE#937:00528:24", "nwparser.payload", "SSH: %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg949 = msg("00528:24", part1521); - - var part1522 = match("MESSAGE#938:00528:25/0", "nwparser.payload", "SSH: Admin %{p0}"); - - var part1523 = match("MESSAGE#938:00528:25/2", "nwparser.p0", "at host %{saddr->} attempted to be authenticated with no authentication methods enabled."); - - var all331 = all_match({ - processors: [ - part1522, - dup403, - part1523, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg950 = msg("00528:25", all331); - - var select354 = linear_select([ - msg924, - msg925, - msg926, - msg927, - msg928, - msg929, - msg930, - msg931, - msg932, - msg933, - msg934, - msg935, - msg936, - msg937, - msg938, - msg939, - msg940, - msg941, - msg942, - msg943, - msg944, - msg945, - msg946, - msg947, - msg948, - msg949, - msg950, - ]); - - var part1524 = match("MESSAGE#939:00529/1_0", "nwparser.p0", "manually %{p0}"); - - var part1525 = match("MESSAGE#939:00529/1_1", "nwparser.p0", "automatically %{p0}"); - - var select355 = linear_select([ - part1524, - part1525, - ]); - - var part1526 = match("MESSAGE#939:00529/2", "nwparser.p0", "refreshed%{}"); - - var all332 = all_match({ - processors: [ - dup63, - select355, - part1526, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg951 = msg("00529", all332); - - var part1527 = match("MESSAGE#940:00529:01/0", "nwparser.payload", "DNS entries have been refreshed by %{p0}"); - - var part1528 = match("MESSAGE#940:00529:01/1_0", "nwparser.p0", "state change%{}"); - - var part1529 = match("MESSAGE#940:00529:01/1_1", "nwparser.p0", "HA%{}"); - - var select356 = linear_select([ - part1528, - part1529, - ]); - - var all333 = all_match({ - processors: [ - part1527, - select356, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg952 = msg("00529:01", all333); - - var select357 = linear_select([ - msg951, - msg952, - ]); - - var part1530 = match("MESSAGE#941:00530", "nwparser.payload", "An IP conflict has been detected and the DHCP client has declined address %{hostip}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg953 = msg("00530", part1530); - - var part1531 = match("MESSAGE#942:00530:01/0", "nwparser.payload", "DHCP client IP %{hostip->} for the %{p0}"); - - var part1532 = match("MESSAGE#942:00530:01/2", "nwparser.p0", "%{} %{interface->} has been manually released"); - - var all334 = all_match({ - processors: [ - part1531, - dup337, - part1532, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg954 = msg("00530:01", all334); - - var part1533 = match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get an IP address for the %{interface->} interface", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg955 = msg("00530:02", part1533); - - var part1534 = match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hostip->} has expired", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg956 = msg("00530:03", part1534); - - var part1535 = match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has assigned the untrust Interface %{interface->} with lease %{fld2}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg957 = msg("00530:04", part1535); - - var part1536 = match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has assigned the %{interface->} interface %{fld2->} with lease %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg958 = msg("00530:05", part1536); - - var part1537 = match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get IP address for the untrust interface.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg959 = msg("00530:06", part1537); - - var select358 = linear_select([ - msg953, - msg954, - msg955, - msg956, - msg957, - msg958, - msg959, - ]); - - var part1538 = match("MESSAGE#948:00531/0", "nwparser.payload", "System clock configurations have been changed by admin %{p0}"); - - var all335 = all_match({ - processors: [ - part1538, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg960 = msg("00531", all335); - - var part1539 = match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg961 = msg("00531:01", part1539); - - var part1540 = match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been updated through NTP.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg962 = msg("00531:02", part1540); - - var part1541 = match("MESSAGE#951:00531:03/0", "nwparser.payload", "The system clock was updated from %{type->} NTP server type %{hostname->} with a%{p0}"); - - var part1542 = match("MESSAGE#951:00531:03/1_0", "nwparser.p0", " ms %{p0}"); - - var select359 = linear_select([ - part1542, - dup115, - ]); - - var part1543 = match("MESSAGE#951:00531:03/2", "nwparser.p0", "adjustment of %{fld3}. Authentication was %{fld4}. Update mode was %{p0}"); - - var part1544 = match("MESSAGE#951:00531:03/3_0", "nwparser.p0", "%{fld5}(%{fld2})"); - - var part1545 = match_copy("MESSAGE#951:00531:03/3_1", "nwparser.p0", "fld5"); - - var select360 = linear_select([ - part1544, - part1545, - ]); - - var all336 = all_match({ - processors: [ - part1541, - select359, - part1543, - select360, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup146, - ]), - }); - - var msg963 = msg("00531:03", all336); - - var part1546 = match("MESSAGE#952:00531:04/0", "nwparser.payload", "The NetScreen device is attempting to contact the %{p0}"); - - var part1547 = match("MESSAGE#952:00531:04/1_0", "nwparser.p0", "primary backup %{p0}"); - - var part1548 = match("MESSAGE#952:00531:04/1_1", "nwparser.p0", "secondary backup %{p0}"); - - var select361 = linear_select([ - part1547, - part1548, - dup189, - ]); - - var part1549 = match("MESSAGE#952:00531:04/2", "nwparser.p0", "NTP server %{hostname}"); - - var all337 = all_match({ - processors: [ - part1546, - select361, - part1549, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg964 = msg("00531:04", all337); - - var part1550 = match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contacted. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg965 = msg("00531:05", part1550); - - var part1551 = match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustment of %{fld2->} from NTP server %{hostname->} exceeds the allowed adjustment of %{fld3}. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg966 = msg("00531:06", part1551); - - var part1552 = match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be obtained from any NTP server. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg967 = msg("00531:07", part1552); - - var part1553 = match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator->} changed the %{change_attribute->} from %{change_old->} to %{change_new->} (by %{fld3->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}) (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg968 = msg("00531:08", part1553); - - var part1554 = match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol settings changed. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg969 = msg("00531:09", part1554); - - var part1555 = match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition->} on interface %{interface->} (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg970 = msg("00531:10", part1555); - - var part1556 = match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be changed from %{change_old->} to %{change_new->} received from primary NTP server %{hostip->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","system clock changed based on receive from primary NTP server"), - ])); - - var msg971 = msg("00531:11", part1556); - - var part1557 = match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{saddr->} could not be contacted. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg972 = msg("00531:12", part1557); - - var select362 = linear_select([ - msg960, - msg961, - msg962, - msg963, - msg964, - msg965, - msg966, - msg967, - msg968, - msg969, - msg970, - msg971, - msg972, - ]); - - var part1558 = match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now responding", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg973 = msg("00533", part1558); - - var part1559 = match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg974 = msg("00534", part1559); - - var part1560 = match("MESSAGE#962:00535", "nwparser.payload", "Cannot find the CA certificate with distinguished name %{fld2}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg975 = msg("00535", part1560); - - var part1561 = match("MESSAGE#963:00535:01", "nwparser.payload", "Distinguished name %{dn->} in the X509 certificate request is %{disposition}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg976 = msg("00535:01", part1561); - - var part1562 = match("MESSAGE#964:00535:02", "nwparser.payload", "Local certificate with distinguished name %{dn->} is %{disposition}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg977 = msg("00535:02", part1562); - - var part1563 = match("MESSAGE#965:00535:03", "nwparser.payload", "PKCS #7 data cannot be decapsulated%{}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg978 = msg("00535:03", part1563); - - var part1564 = match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been received from the CA%{}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - setc("result","SCEP_FAILURE message"), - ])); - - var msg979 = msg("00535:04", part1564); - - var part1565 = match("MESSAGE#967:00535:05", "nwparser.payload", "PKI error message has been received: %{result}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg980 = msg("00535:05", part1565); - - var part1566 = match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration (CA cert subject name %{dn}). (%{event_time_string})", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Saved CA configuration - cert subject name"), - ])); - - var msg981 = msg("00535:06", part1566); - - var select363 = linear_select([ - msg975, - msg976, - msg977, - msg978, - msg979, - msg980, - msg981, - ]); - - var part1567 = match("MESSAGE#969:00536:49/0", "nwparser.payload", "IKE %{hostip->} %{p0}"); - - var part1568 = match("MESSAGE#969:00536:49/1_0", "nwparser.p0", "Phase 2 msg ID %{sessionid}: %{disposition}. %{p0}"); - - var part1569 = match("MESSAGE#969:00536:49/1_1", "nwparser.p0", "Phase 1: %{disposition->} %{p0}"); - - var part1570 = match("MESSAGE#969:00536:49/1_2", "nwparser.p0", "phase 2:%{disposition}. %{p0}"); - - var part1571 = match("MESSAGE#969:00536:49/1_3", "nwparser.p0", "phase 1:%{disposition}. %{p0}"); - - var select364 = linear_select([ - part1568, - part1569, - part1570, - part1571, - ]); - - var all338 = all_match({ - processors: [ - part1567, - select364, - dup10, - ], - on_success: processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg982 = msg("00536:49", all338); - - var part1572 = match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received from %{saddr}/%{sport->} at interface %{interface->} at %{daddr}/%{dport}", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg983 = msg("00536", part1572); - - var part1573 = match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2}) without IP address at both end points! Check outgoing interface.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg984 = msg("00536:01", part1573); - - var part1574 = match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip->} in %{fld4->} mode with ID: %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg985 = msg("00536:02", part1574); - - var part1575 = match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has been %{disposition}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg986 = msg("00536:03", part1575); - - var part1576 = match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{group->} has deactivated the SA with ID %{fld2}.", processor_chain([ - setc("eventcategory","1801010100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg987 = msg("00536:04", part1576); - - var part1577 = match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assigned%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg988 = msg("00536:05", part1577); - - var part1578 = match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has changed to %{fld2}. VPNs cannot terminate at an interface with IP %{hostip}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg989 = msg("00536:06", part1578); - - var part1579 = match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has changed from %{change_old->} to another setting", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg990 = msg("00536:07", part1579); - - var part1580 = match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification message", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg991 = msg("00536:08", part1580); - - var part1581 = match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg992 = msg("00536:09", part1581); - - var part1582 = match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a packet with a bad SPI after rebooting", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg993 = msg("00536:10", part1582); - - var part1583 = match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase 2 SAs after receiving a notification message", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg994 = msg("00536:11", part1583); - - var part1584 = match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first Phase 1 packet from an unrecognized source", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg995 = msg("00536:12", part1584); - - var part1585 = match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an initial Phase 1 packet from an unrecognized peer gateway", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg996 = msg("00536:13", part1585); - - var part1586 = match("MESSAGE#984:00536:14/0", "nwparser.payload", "IKE %{hostip}: Received initial contact notification and removed Phase %{p0}"); - - var part1587 = match("MESSAGE#984:00536:14/2", "nwparser.p0", "SAs%{}"); - - var all339 = all_match({ - processors: [ - part1586, - dup383, - part1587, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg997 = msg("00536:14", all339); - - var part1588 = match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a notification message for %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg998 = msg("00536:50", part1588); - - var part1589 = match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incorrect ID payload: IP address %{fld2->} instead of IP address %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg999 = msg("00536:15", part1589); - - var part1590 = match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negotiation request is already in the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1000 = msg("00536:16", part1590); - - var part1591 = match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats have been lost %{fld2->} times", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1001 = msg("00536:17", part1591); - - var part1592 = match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer packet because no policy uses the peer configuration", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1002 = msg("00536:18", part1592); - - var part1593 = match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1003 = msg("00536:19", part1593); - - var part1594 = match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the initial contact task to the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1004 = msg("00536:20", part1594); - - var part1595 = match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 session tasks to the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1005 = msg("00536:21", part1595); - - var part1596 = match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{disposition->} proposals from peer. Negotiations failed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("result","Negotiations failed"), - ])); - - var msg1006 = msg("00536:22", part1596); - - var part1597 = match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Aborted negotiations because the time limit has elapsed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("result","The time limit has elapsed"), - setc("disposition","Aborted"), - ])); - - var msg1007 = msg("00536:23", part1597); - - var part1598 = match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1008 = msg("00536:24", part1598); - - var part1599 = match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Received DH group %{fld2->} instead of expected group %{fld3->} for PFS", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1009 = msg("00536:25", part1599); - - var part1600 = match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No policy exists for the proxy ID received: local ID %{fld2->} remote ID %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1010 = msg("00536:26", part1600); - - var part1601 = match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA private key is needed to sign packets", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1011 = msg("00536:27", part1601); - - var part1602 = match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggressive mode negotiations have %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1012 = msg("00536:28", part1602); - - var part1603 = match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Vendor ID payload indicates that the peer does not support NAT-T", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1013 = msg("00536:29", part1603); - - var part1604 = match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Retransmission limit has been reached", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1014 = msg("00536:30", part1604); - - var part1605 = match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an invalid RSA signature", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1015 = msg("00536:31", part1605); - - var part1606 = match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an incorrect public key authentication method", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1016 = msg("00536:32", part1606); - - var part1607 = match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No private key exists to sign packets", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1017 = msg("00536:33", part1607); - - var part1608 = match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1018 = msg("00536:34", part1608); - - var part1609 = match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE initiator has detected NAT in front of the local device", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1019 = msg("00536:35", part1609); - - var part1610 = match("MESSAGE#1007:00536:36/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Discarded a second initial packet%{p0}"); - - var part1611 = match("MESSAGE#1007:00536:36/2", "nwparser.p0", "%{}which arrived within %{fld2->} after the first"); - - var all340 = all_match({ - processors: [ - part1610, - dup401, - part1611, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1020 = msg("00536:36", all340); - - var part1612 = match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Completed Aggressive mode negotiations with a %{fld2->} lifetime", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1021 = msg("00536:37", part1612); - - var part1613 = match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a subject name that does not match the ID payload", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1022 = msg("00536:38", part1613); - - var part1614 = match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a different IP address %{fld2->} than expected", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1023 = msg("00536:39", part1614); - - var part1615 = match("MESSAGE#1011:00536:40", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot use a preshared key because the peer%{quote}s gateway has a dynamic IP address and negotiations are in Main mode", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1024 = msg("00536:40", part1615); - - var part1616 = match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated negotiations in Aggressive mode", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1025 = msg("00536:47", part1616); - - var part1617 = match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot verify RSA signature", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1026 = msg("00536:41", part1617); - - var part1618 = match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated Main mode negotiations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1027 = msg("00536:42", part1618); - - var part1619 = match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Initiated negotiations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1028 = msg("00536:43", part1619); - - var part1620 = match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heartbeat interval to %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1029 = msg("00536:44", part1620); - - var part1621 = match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats have been %{disposition->} because %{result}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1030 = msg("00536:45", part1621); - - var part1622 = match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{interface->} from %{saddr}:%{sport->} to %{daddr}:%{dport}/%{fld1}. Cookies: %{ike_cookie1}, %{ike_cookie2}. (%{event_time_string})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Received an IKE packet on interface"), - ])); - - var msg1031 = msg("00536:48", part1622); - - var part1623 = match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a bad SPI", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1032 = msg("00536:46", part1623); - - var select365 = linear_select([ - msg982, - msg983, - msg984, - msg985, - msg986, - msg987, - msg988, - msg989, - msg990, - msg991, - msg992, - msg993, - msg994, - msg995, - msg996, - msg997, - msg998, - msg999, - msg1000, - msg1001, - msg1002, - msg1003, - msg1004, - msg1005, - msg1006, - msg1007, - msg1008, - msg1009, - msg1010, - msg1011, - msg1012, - msg1013, - msg1014, - msg1015, - msg1016, - msg1017, - msg1018, - msg1019, - msg1020, - msg1021, - msg1022, - msg1023, - msg1024, - msg1025, - msg1026, - msg1027, - msg1028, - msg1029, - msg1030, - msg1031, - msg1032, - ]); - - var part1624 = match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to establish a session: %{info}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg1033 = msg("00537", part1624); - - var part1625 = match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{result}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1034 = msg("00537:01", part1625); - - var part1626 = match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: %{result}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1035 = msg("00537:02", part1626); - - var part1627 = match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successfully established%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1036 = msg("00537:03", part1627); - - var select366 = linear_select([ - msg1033, - msg1034, - msg1035, - msg1036, - ]); - - var part1628 = match("MESSAGE#1024:00538/0", "nwparser.payload", "NACN failed to register to Policy Manager %{fld2->} because %{p0}"); - - var select367 = linear_select([ - dup111, - dup119, - ]); - - var part1629 = match("MESSAGE#1024:00538/2", "nwparser.p0", "%{result}"); - - var all341 = all_match({ - processors: [ - part1628, - select367, - part1629, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1037 = msg("00538", all341); - - var part1630 = match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered to Policy Manager %{fld2}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1038 = msg("00538:01", part1630); - - var part1631 = match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has started for Policy Manager %{fld2->} on hostname %{hostname->} IP address %{hostip->} port %{network_port}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1039 = msg("00538:02", part1631); - - var part1632 = match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server at %{hostip->} (%{fld2->} connect attempt(s)) %{fld3}", processor_chain([ - dup19, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg1040 = msg("00538:03", part1632); - - var part1633 = match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Global PRO data collector at %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1041 = msg("00538:04", part1633); - - var part1634 = match("MESSAGE#1029:00538:05/0", "nwparser.payload", "Lost %{p0}"); - - var part1635 = match("MESSAGE#1029:00538:05/1_0", "nwparser.p0", "socket connection%{p0}"); - - var part1636 = match("MESSAGE#1029:00538:05/1_1", "nwparser.p0", "connection%{p0}"); - - var select368 = linear_select([ - part1635, - part1636, - ]); - - var part1637 = match("MESSAGE#1029:00538:05/2", "nwparser.p0", "%{}to Global PRO data collector at %{hostip}"); - - var all342 = all_match({ - processors: [ - part1634, - select368, - part1637, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1042 = msg("00538:05", all342); - - var part1638 = match("MESSAGE#1030:00538:06/0", "nwparser.payload", "Device has connected to the Global PRO%{p0}"); - - var part1639 = match("MESSAGE#1030:00538:06/1_0", "nwparser.p0", " %{fld2->} primary data collector at %{p0}"); - - var part1640 = match("MESSAGE#1030:00538:06/1_1", "nwparser.p0", " primary data collector at %{p0}"); - - var select369 = linear_select([ - part1639, - part1640, - ]); - - var part1641 = match_copy("MESSAGE#1030:00538:06/2", "nwparser.p0", "hostip"); - - var all343 = all_match({ - processors: [ - part1638, - select369, - part1641, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1043 = msg("00538:06", all343); - - var part1642 = match("MESSAGE#1031:00538:07/0", "nwparser.payload", "Connection to Global PRO data collector at %{hostip->} has%{p0}"); - - var part1643 = match("MESSAGE#1031:00538:07/1_0", "nwparser.p0", " been%{p0}"); - - var select370 = linear_select([ - part1643, - dup16, - ]); - - var all344 = all_match({ - processors: [ - part1642, - select370, - dup136, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1044 = msg("00538:07", all344); - - var part1644 = match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO data collector at %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1045 = msg("00538:08", part1644); - - var part1645 = match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server at %{hostip->} (%{info}) (%{fld1})", processor_chain([ - dup301, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Connected to NSM server"), - ])); - - var msg1046 = msg("00538:09", part1645); - - var part1646 = match("MESSAGE#1034:00538:10/0", "nwparser.payload", "NSM: Connection to NSM server at %{hostip->} is down. Reason: %{resultcode}, %{result->} (%{p0}"); - - var part1647 = match("MESSAGE#1034:00538:10/1_0", "nwparser.p0", "%{info}) (%{fld1})"); - - var select371 = linear_select([ - part1647, - dup41, - ]); - - var all345 = all_match({ - processors: [ - part1646, - select371, - ], - on_success: processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Connection to NSM server is down"), - ]), - }); - - var msg1047 = msg("00538:10", all345); - - var part1648 = match("MESSAGE#1035:00538:11", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld2->} connect attempt(s)) (%{fld1})", processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - dup323, - ])); - - var msg1048 = msg("00538:11", part1648); - - var part1649 = match("MESSAGE#1036:00538:12", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld1})", processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - dup323, - ])); - - var msg1049 = msg("00538:12", part1649); - - var part1650 = match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Sent 2B message"), - ])); - - var msg1050 = msg("00538:13", part1650); - - var select372 = linear_select([ - msg1037, - msg1038, - msg1039, - msg1040, - msg1041, - msg1042, - msg1043, - msg1044, - msg1045, - msg1046, - msg1047, - msg1048, - msg1049, - msg1050, - ]); - - var part1651 = match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1051 = msg("00539", part1651); - - var part1652 = match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1052 = msg("00539:01", part1652); - - var part1653 = match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from Pool %{group_object->} for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1053 = msg("00539:02", part1653); - - var part1654 = match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to establish a session: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1054 = msg("00539:03", part1654); - - var part1655 = match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has successfully established.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1055 = msg("00539:04", part1655); - - var part1656 = match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned. You cannot allocate an IP address%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1056 = msg("00539:05", part1656); - - var part1657 = match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1057 = msg("00539:06", part1657); - - var select373 = linear_select([ - msg1051, - msg1052, - msg1053, - msg1054, - msg1055, - msg1056, - msg1057, - ]); - - var part1658 = match("MESSAGE#1045:00541", "nwparser.payload", "ScreenOS %{fld2->} serial # %{serial_number}: Asset recovery has been %{disposition}", processor_chain([ - dup324, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1058 = msg("00541", part1658); - - var part1659 = match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2->} IP address - %{hostip->} changed its state to %{change_new}. (%{fld1})", processor_chain([ - dup273, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1059 = msg("00541:01", part1659); - - var part1660 = match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from %{change_old->} to %{change_new->} state, (neighbor router-id 1%{fld2}, ip-address %{hostip}). (%{fld1})", processor_chain([ - dup273, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1060 = msg("00541:02", part1660); - - var part1661 = match("MESSAGE#1219:00541:03/0", "nwparser.payload", "LSA in following area aged out: LSA area ID %{fld3}, LSA ID %{fld4}, router ID %{fld2}, type %{fld7->} in OSPF. (%{fld1})%{p0}"); - - var part1662 = match("MESSAGE#1219:00541:03/1_0", "nwparser.p0", "\u003c\u003c%{fld16}>"); - - var select374 = linear_select([ - part1662, - dup21, - ]); - - var all346 = all_match({ - processors: [ - part1661, - select374, - ], - on_success: processor_chain([ - dup44, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1061 = msg("00541:03", all346); - - var select375 = linear_select([ - msg1058, - msg1059, - msg1060, - msg1061, - ]); - - var part1663 = match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix adding: %{fld2}, ribin overflow %{fld3->} times (max rib-in %{fld4})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1062 = msg("00542", part1663); - - var part1664 = match("MESSAGE#1047:00543/0", "nwparser.payload", "Access for %{p0}"); - - var part1665 = match("MESSAGE#1047:00543/1_0", "nwparser.p0", "WebAuth firewall %{p0}"); - - var part1666 = match("MESSAGE#1047:00543/1_1", "nwparser.p0", "firewall %{p0}"); - - var select376 = linear_select([ - part1665, - part1666, - ]); - - var part1667 = match("MESSAGE#1047:00543/2", "nwparser.p0", "user %{username->} %{space}at %{hostip->} (accepted at %{fld2->} for duration %{duration->} via the %{logon_type}) %{p0}"); - - var part1668 = match("MESSAGE#1047:00543/3_0", "nwparser.p0", "by policy id %{policy_id->} is %{p0}"); - - var select377 = linear_select([ - part1668, - dup106, - ]); - - var part1669 = match("MESSAGE#1047:00543/4", "nwparser.p0", "now over (%{fld1})"); - - var all347 = all_match({ - processors: [ - part1664, - select376, - part1667, - select377, - part1669, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup9, - dup3, - ]), - }); - - var msg1063 = msg("00543", all347); - - var part1670 = match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group %{group->} ] at %{hostip->} has been challenged by the RADIUS server at %{daddr}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup60, - setc("action","RADIUS server challenge"), - ])); - - var msg1064 = msg("00544", part1670); - - var part1671 = match("MESSAGE#1049:00546", "nwparser.payload", "delete-route-> trust-vr: %{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1065 = msg("00546", part1671); - - var part1672 = match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned because max content size was exceeded.", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg1066 = msg("00547", part1672); - - var part1673 = match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned due to a scan engine error or constraint.", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg1067 = msg("00547:01", part1673); - - var part1674 = match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1068 = msg("00547:02", part1674); - - var part1675 = match("MESSAGE#1053:00547:03/0", "nwparser.payload", "AV: Content from %{location_desc}, http url: %{url}, is passed %{p0}"); - - var part1676 = match("MESSAGE#1053:00547:03/1_0", "nwparser.p0", "due to %{p0}"); - - var part1677 = match("MESSAGE#1053:00547:03/1_1", "nwparser.p0", "because %{p0}"); - - var select378 = linear_select([ - part1676, - part1677, - ]); - - var part1678 = match("MESSAGE#1053:00547:03/2", "nwparser.p0", "%{result}. (%{event_time_string})"); - - var all348 = all_match({ - processors: [ - part1675, - select378, - part1678, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Content is bypassed for connection"), - ]), - }); - - var msg1069 = msg("00547:03", all348); - - var select379 = linear_select([ - msg1066, - msg1067, - msg1068, - msg1069, - ]); - - var part1679 = match("MESSAGE#1054:00549", "nwparser.payload", "add-route-> untrust-vr: %{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1070 = msg("00549", part1679); - - var part1680 = match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred during configlet file processing.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1071 = msg("00551", part1680); - - var part1681 = match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurred, causing failure to establish secure management with Management System.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1072 = msg("00551:01", part1681); - - var part1682 = match("MESSAGE#1057:00551:02/0", "nwparser.payload", "Configlet file %{p0}"); - - var part1683 = match("MESSAGE#1057:00551:02/1_0", "nwparser.p0", "decryption %{p0}"); - - var select380 = linear_select([ - part1683, - dup89, - ]); - - var all349 = all_match({ - processors: [ - part1682, - select380, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1073 = msg("00551:02", all349); - - var part1684 = match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot start because gateway has undergone configuration changes. (%{fld1})", processor_chain([ - dup18, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1074 = msg("00551:03", part1684); - - var part1685 = match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management established successfully with remote server. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1075 = msg("00551:04", part1685); - - var select381 = linear_select([ - msg1071, - msg1072, - msg1073, - msg1074, - msg1075, - ]); - - var part1686 = match("MESSAGE#1060:00553/0", "nwparser.payload", "SCAN-MGR: Failed to get %{p0}"); - - var part1687 = match("MESSAGE#1060:00553/1_0", "nwparser.p0", "AltServer %{p0}"); - - var part1688 = match("MESSAGE#1060:00553/1_1", "nwparser.p0", "Version %{p0}"); - - var part1689 = match("MESSAGE#1060:00553/1_2", "nwparser.p0", "Path_GateLockCE %{p0}"); - - var select382 = linear_select([ - part1687, - part1688, - part1689, - ]); - - var all350 = all_match({ - processors: [ - part1686, - select382, - dup325, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1076 = msg("00553", all350); - - var part1690 = match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size from server.ini.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1077 = msg("00553:01", part1690); - - var part1691 = match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from server.ini is too large: %{bytes->} (bytes).", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1078 = msg("00553:02", part1691); - - var part1692 = match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from server.ini is too long: %{fld2}; max is %{fld3}.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1079 = msg("00553:03", part1692); - - var part1693 = match("MESSAGE#1064:00553:04/0", "nwparser.payload", "SCAN-MGR: Failed to retrieve %{p0}"); - - var select383 = linear_select([ - dup326, - dup327, - ]); - - var part1694 = match("MESSAGE#1064:00553:04/2", "nwparser.p0", "file: %{fld2}; http status code: %{resultcode}."); - - var all351 = all_match({ - processors: [ - part1693, - select383, - part1694, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1080 = msg("00553:04", all351); - - var part1695 = match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pattern into a RAM file.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1081 = msg("00553:05", part1695); - - var part1696 = match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File failed: code from VSAPI: %{resultcode}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1082 = msg("00553:06", part1696); - - var part1697 = match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pattern into flash.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1083 = msg("00553:07", part1697); - - var part1698 = match("MESSAGE#1068:00553:08/0", "nwparser.payload", "SCAN-MGR: Internal error while setting up for retrieving %{p0}"); - - var select384 = linear_select([ - dup327, - dup326, - ]); - - var all352 = all_match({ - processors: [ - part1698, - select384, - dup328, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1084 = msg("00553:08", all352); - - var part1699 = match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{disposition}: Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1085 = msg("00553:09", part1699); - - var part1700 = match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{disposition->} due to %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1086 = msg("00553:10", part1700); - - var part1701 = match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern Creation Date(%{fld2}) is after AV Key Expiration date(%{fld3}).", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1087 = msg("00553:11", part1701); - - var part1702 = match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompressLayer %{disposition}: Layer: %{fld2}, Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1088 = msg("00553:12", part1702); - - var part1703 = match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFileSizeLimit %{disposition}: Limit: %{fld2}, Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1089 = msg("00553:13", part1703); - - var part1704 = match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{disposition}: ret: %{fld2}; cpapiErrCode: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1090 = msg("00553:14", part1704); - - var part1705 = match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usage error. Left usage: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1091 = msg("00553:15", part1705); - - var part1706 = match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress layer to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1092 = msg("00553:16", part1706); - - var part1707 = match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum content size to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1093 = msg("00553:17", part1707); - - var part1708 = match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number of concurrent messages to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1094 = msg("00553:18", part1708); - - var part1709 = match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1095 = msg("00553:19", part1709); - - var part1710 = match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to %{fld2}; update interval is %{fld3}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1096 = msg("00553:20", part1710); - - var part1711 = match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1097 = msg("00553:21", part1711); - - var part1712 = match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern updated: version: %{version}, size: %{bytes->} (bytes).", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1098 = msg("00553:22", part1712); - - var select385 = linear_select([ - msg1076, - msg1077, - msg1078, - msg1079, - msg1080, - msg1081, - msg1082, - msg1083, - msg1084, - msg1085, - msg1086, - msg1087, - msg1088, - msg1089, - msg1090, - msg1091, - msg1092, - msg1093, - msg1094, - msg1095, - msg1096, - msg1097, - msg1098, - ]); - - var part1713 = match("MESSAGE#1083:00554/0", "nwparser.payload", "SCAN-MGR: Cannot get %{p0}"); - - var part1714 = match("MESSAGE#1083:00554/1_0", "nwparser.p0", "AltServer info %{p0}"); - - var part1715 = match("MESSAGE#1083:00554/1_1", "nwparser.p0", "Version number %{p0}"); - - var part1716 = match("MESSAGE#1083:00554/1_2", "nwparser.p0", "Path_GateLockCE info %{p0}"); - - var select386 = linear_select([ - part1714, - part1715, - part1716, - ]); - - var all353 = all_match({ - processors: [ - part1713, - select386, - dup325, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1099 = msg("00554", all353); - - var part1717 = match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini file, the AV pattern file size is zero.%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1100 = msg("00554:01", part1717); - - var part1718 = match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file size is too large (%{bytes->} bytes).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1101 = msg("00554:02", part1718); - - var part1719 = match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV pattern file server URL is too long: %{bytes->} bytes. Max: %{fld2->} bytes.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1102 = msg("00554:03", part1719); - - var part1720 = match("MESSAGE#1087:00554:04/0", "nwparser.payload", "SCAN-MGR: Cannot retrieve %{p0}"); - - var part1721 = match("MESSAGE#1087:00554:04/2", "nwparser.p0", "file from %{hostip}:%{network_port}. HTTP status code: %{fld2}."); - - var all354 = all_match({ - processors: [ - part1720, - dup405, - part1721, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1103 = msg("00554:04", all354); - - var part1722 = match("MESSAGE#1088:00554:05/0", "nwparser.payload", "SCAN-MGR: Cannot write AV pattern file to %{p0}"); - - var part1723 = match("MESSAGE#1088:00554:05/1_0", "nwparser.p0", "RAM %{p0}"); - - var part1724 = match("MESSAGE#1088:00554:05/1_1", "nwparser.p0", "flash %{p0}"); - - var select387 = linear_select([ - part1723, - part1724, - ]); - - var all355 = all_match({ - processors: [ - part1722, - select387, - dup116, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1104 = msg("00554:05", all355); - - var part1725 = match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pattern file. VSAPI code: %{fld2}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1105 = msg("00554:06", part1725); - - var part1726 = match("MESSAGE#1090:00554:07/0", "nwparser.payload", "SCAN-MGR: Internal error occurred while retrieving %{p0}"); - - var all356 = all_match({ - processors: [ - part1726, - dup405, - dup328, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1106 = msg("00554:07", all356); - - var part1727 = match("MESSAGE#1091:00554:08/0", "nwparser.payload", "SCAN-MGR: Internal error occurred when calling this function: %{fld2}. %{fld3->} %{p0}"); - - var part1728 = match("MESSAGE#1091:00554:08/1_0", "nwparser.p0", "Error: %{resultcode->} %{p0}"); - - var part1729 = match("MESSAGE#1091:00554:08/1_1", "nwparser.p0", "Returned a NULL VSC handler %{p0}"); - - var part1730 = match("MESSAGE#1091:00554:08/1_2", "nwparser.p0", "cpapiErrCode: %{resultcode->} %{p0}"); - - var select388 = linear_select([ - part1728, - part1729, - part1730, - ]); - - var all357 = all_match({ - processors: [ - part1727, - select388, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1107 = msg("00554:08", all357); - - var part1731 = match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompression layers has been set to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1108 = msg("00554:09", part1731); - - var part1732 = match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content size has been set to %{fld2->} KB.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1109 = msg("00554:10", part1732); - - var part1733 = match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of concurrent messages has been set to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1110 = msg("00554:11", part1733); - - var part1734 = match("MESSAGE#1095:00554:12/0", "nwparser.payload", "SCAN-MGR: Fail mode has been set to %{p0}"); - - var part1735 = match("MESSAGE#1095:00554:12/1_0", "nwparser.p0", "drop %{p0}"); - - var part1736 = match("MESSAGE#1095:00554:12/1_1", "nwparser.p0", "pass %{p0}"); - - var select389 = linear_select([ - part1735, - part1736, - ]); - - var part1737 = match("MESSAGE#1095:00554:12/2", "nwparser.p0", "unexamined traffic if %{p0}"); - - var part1738 = match("MESSAGE#1095:00554:12/3_0", "nwparser.p0", "content size %{p0}"); - - var part1739 = match("MESSAGE#1095:00554:12/3_1", "nwparser.p0", "number of concurrent messages %{p0}"); - - var select390 = linear_select([ - part1738, - part1739, - ]); - - var part1740 = match("MESSAGE#1095:00554:12/4", "nwparser.p0", "exceeds max.%{}"); - - var all358 = all_match({ - processors: [ - part1734, - select389, - part1737, - select390, - part1740, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1111 = msg("00554:12", all358); - - var part1741 = match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been set to %{fld2}, and the update interval to %{fld3->} minutes.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1112 = msg("00554:13", part1741); - - var part1742 = match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1113 = msg("00554:14", part1742); - - var part1743 = match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern file has been updated. Version: %{version}; size: %{bytes->} bytes.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1114 = msg("00554:15", part1743); - - var part1744 = match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1115 = msg("00554:16", part1744); - - var part1745 = match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load AV pattern file created %{fld2->} after the AV subscription expired. (Exp: %{fld3})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1116 = msg("00554:17", part1745); - - var select391 = linear_select([ - msg1099, - msg1100, - msg1101, - msg1102, - msg1103, - msg1104, - msg1105, - msg1106, - msg1107, - msg1108, - msg1109, - msg1110, - msg1111, - msg1112, - msg1113, - msg1114, - msg1115, - msg1116, - ]); - - var part1746 = match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot process non-multicast address %{hostip}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1117 = msg("00555", part1746); - - var part1747 = match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a request. Reason: %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1118 = msg("00556", part1747); - - var part1748 = match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a transaction. Reason: %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1119 = msg("00556:01", part1748); - - var part1749 = match("MESSAGE#1104:00556:02/0", "nwparser.payload", "UF-MGR: UF %{p0}"); - - var part1750 = match("MESSAGE#1104:00556:02/1_0", "nwparser.p0", "K%{p0}"); - - var part1751 = match("MESSAGE#1104:00556:02/1_1", "nwparser.p0", "k%{p0}"); - - var select392 = linear_select([ - part1750, - part1751, - ]); - - var part1752 = match("MESSAGE#1104:00556:02/2", "nwparser.p0", "ey %{p0}"); - - var part1753 = match("MESSAGE#1104:00556:02/3_0", "nwparser.p0", "Expired%{p0}"); - - var part1754 = match("MESSAGE#1104:00556:02/3_1", "nwparser.p0", "expired%{p0}"); - - var select393 = linear_select([ - part1753, - part1754, - ]); - - var part1755 = match("MESSAGE#1104:00556:02/4", "nwparser.p0", "%{}(expiration date: %{fld2}; current date: %{fld3})."); - - var all359 = all_match({ - processors: [ - part1749, - select392, - part1752, - select393, - part1755, - ], - on_success: processor_chain([ - dup254, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1120 = msg("00556:02", all359); - - var part1756 = match("MESSAGE#1105:00556:03/0", "nwparser.payload", "UF-MGR: Failed to %{p0}"); - - var part1757 = match("MESSAGE#1105:00556:03/1_0", "nwparser.p0", "enable %{p0}"); - - var part1758 = match("MESSAGE#1105:00556:03/1_1", "nwparser.p0", "disable %{p0}"); - - var select394 = linear_select([ - part1757, - part1758, - ]); - - var part1759 = match("MESSAGE#1105:00556:03/2", "nwparser.p0", "cache.%{}"); - - var all360 = all_match({ - processors: [ - part1756, - select394, - part1759, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1121 = msg("00556:03", all360); - - var part1760 = match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{resultcode}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1122 = msg("00556:04", part1760); - - var part1761 = match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed to %{fld2}(K).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1123 = msg("00556:05", part1761); - - var part1762 = match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout changes to %{fld2->} (hours).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1124 = msg("00556:06", part1762); - - var part1763 = match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update interval changed to %{fld2->} (weeks).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1125 = msg("00556:07", part1763); - - var part1764 = match("MESSAGE#1110:00556:08/0", "nwparser.payload", "UF-MGR: Cache %{p0}"); - - var all361 = all_match({ - processors: [ - part1764, - dup358, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1126 = msg("00556:08", all361); - - var part1765 = match("MESSAGE#1111:00556:09", "nwparser.payload", "UF-MGR: URL BLOCKED: ip_addr (%{fld2}) -> ip_addr (%{fld3}), %{fld4->} action: %{disposition}, category: %{fld5}, reason %{result}", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - dup282, - ])); - - var msg1127 = msg("00556:09", part1765); - - var part1766 = match("MESSAGE#1112:00556:10", "nwparser.payload", "UF-MGR: URL FILTER ERR: ip_addr (%{fld2}) -> ip_addr (%{fld3}), host: %{fld5->} page: %{fld4->} code: %{resultcode->} reason: %{result}.", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1128 = msg("00556:10", part1766); - - var part1767 = match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server changed to %{fld2}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1129 = msg("00556:11", part1767); - - var part1768 = match("MESSAGE#1114:00556:12/0", "nwparser.payload", "UF-MGR: %{fld2->} CPA server %{p0}"); - - var select395 = linear_select([ - dup140, - dup169, - ]); - - var part1769 = match("MESSAGE#1114:00556:12/2", "nwparser.p0", "changed to %{fld3}."); - - var all362 = all_match({ - processors: [ - part1768, - select395, - part1769, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1130 = msg("00556:12", all362); - - var part1770 = match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filtering %{disposition}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1131 = msg("00556:13", part1770); - - var part1771 = match("MESSAGE#1116:00556:14/0", "nwparser.payload", "UF-MGR: The url %{url->} was %{p0}"); - - var part1772 = match("MESSAGE#1116:00556:14/2", "nwparser.p0", "category %{fld2}."); - - var all363 = all_match({ - processors: [ - part1771, - dup406, - part1772, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1132 = msg("00556:14", all363); - - var part1773 = match("MESSAGE#1117:00556:15/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was %{p0}"); - - var part1774 = match("MESSAGE#1117:00556:15/2", "nwparser.p0", "profile %{fld3->} with action %{disposition}."); - - var all364 = all_match({ - processors: [ - part1773, - dup406, - part1774, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - dup282, - ]), - }); - - var msg1133 = msg("00556:15", all364); - - var part1775 = match("MESSAGE#1118:00556:16/0", "nwparser.payload", "UF-MGR: The %{p0}"); - - var part1776 = match("MESSAGE#1118:00556:16/1_0", "nwparser.p0", "profile %{p0}"); - - var part1777 = match("MESSAGE#1118:00556:16/1_1", "nwparser.p0", "category %{p0}"); - - var select396 = linear_select([ - part1776, - part1777, - ]); - - var part1778 = match("MESSAGE#1118:00556:16/2", "nwparser.p0", "%{fld2->} was %{p0}"); - - var select397 = linear_select([ - dup104, - dup120, - ]); - - var all365 = all_match({ - processors: [ - part1775, - select396, - part1778, - select397, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1134 = msg("00556:16", all365); - - var part1779 = match("MESSAGE#1119:00556:17/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was set in profile %{profile->} as the %{p0}"); - - var part1780 = match("MESSAGE#1119:00556:17/1_0", "nwparser.p0", "black %{p0}"); - - var part1781 = match("MESSAGE#1119:00556:17/1_1", "nwparser.p0", "white %{p0}"); - - var select398 = linear_select([ - part1780, - part1781, - ]); - - var part1782 = match("MESSAGE#1119:00556:17/2", "nwparser.p0", "list.%{}"); - - var all366 = all_match({ - processors: [ - part1779, - select398, - part1782, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1135 = msg("00556:17", all366); - - var part1783 = match("MESSAGE#1120:00556:18/0", "nwparser.payload", "UF-MGR: The action for %{fld2->} in profile %{profile->} was %{p0}"); - - var part1784 = match("MESSAGE#1120:00556:18/1_1", "nwparser.p0", "changed %{p0}"); - - var select399 = linear_select([ - dup101, - part1784, - ]); - - var part1785 = match("MESSAGE#1120:00556:18/2", "nwparser.p0", "to %{fld3}."); - - var all367 = all_match({ - processors: [ - part1783, - select399, - part1785, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1136 = msg("00556:18", all367); - - var part1786 = match("MESSAGE#1121:00556:20/0", "nwparser.payload", "UF-MGR: The category list from the CPA server %{p0}"); - - var part1787 = match("MESSAGE#1121:00556:20/2", "nwparser.p0", "updated on%{p0}"); - - var select400 = linear_select([ - dup103, - dup96, - ]); - - var part1788 = match("MESSAGE#1121:00556:20/4", "nwparser.p0", "the device.%{}"); - - var all368 = all_match({ - processors: [ - part1786, - dup355, - part1787, - select400, - part1788, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1137 = msg("00556:20", all368); - - var part1789 = match("MESSAGE#1122:00556:21", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} action: %{disposition}, category: %{category}, reason: %{result->} (%{fld1})", processor_chain([ - dup232, - dup2, - dup3, - dup9, - dup4, - dup5, - dup282, - ])); - - var msg1138 = msg("00556:21", part1789); - - var part1790 = match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} (%{fld1})", processor_chain([ - dup232, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1139 = msg("00556:22", part1790); - - var select401 = linear_select([ - msg1118, - msg1119, - msg1120, - msg1121, - msg1122, - msg1123, - msg1124, - msg1125, - msg1126, - msg1127, - msg1128, - msg1129, - msg1130, - msg1131, - msg1132, - msg1133, - msg1134, - msg1135, - msg1136, - msg1137, - msg1138, - msg1139, - ]); - - var part1791 = match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interface->} is %{fld2}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1140 = msg("00572", part1791); - - var part1792 = match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on interface %{interface}: %{result}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1141 = msg("00572:01", part1792); - - var part1793 = match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface->} is %{disposition->} by receiving Terminate-Request. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1142 = msg("00572:03", part1793); - - var select402 = linear_select([ - msg1140, - msg1141, - msg1142, - ]); - - var part1794 = match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" rebuilding lookup tree for virtual router \"%{node}\". (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1143 = msg("00615", part1794); - - var part1795 = match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" lookup tree rebuilt successfully in virtual router \"%{node}\". (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1144 = msg("00615:01", part1795); - - var select403 = linear_select([ - msg1143, - msg1144, - ]); - - var part1796 = match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}, through policy %{policyname}. Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ])); - - var msg1145 = msg("00601", part1796); - - var part1797 = match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detected from %{saddr}/%{sport->} to %{daddr}/%{dport->} through policy %{policyname->} %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ])); - - var msg1146 = msg("00601:01", part1797); - - var part1798 = match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multicast.%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1147 = msg("00601:18", part1798); - - var select404 = linear_select([ - msg1145, - msg1146, - msg1147, - ]); - - var part1799 = match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing interface state change%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1148 = msg("00602", part1799); - - var part1800 = match("MESSAGE#1133:00612/0", "nwparser.payload", "Switch event: the status of ethernet port %{fld2->} changed to link %{p0}"); - - var part1801 = match("MESSAGE#1133:00612/2", "nwparser.p0", ", duplex %{p0}"); - - var part1802 = match("MESSAGE#1133:00612/3_0", "nwparser.p0", "full %{p0}"); - - var part1803 = match("MESSAGE#1133:00612/3_1", "nwparser.p0", "half %{p0}"); - - var select405 = linear_select([ - part1802, - part1803, - ]); - - var part1804 = match("MESSAGE#1133:00612/4", "nwparser.p0", ", speed 10%{p0}"); - - var part1805 = match("MESSAGE#1133:00612/5_0", "nwparser.p0", "0 %{p0}"); - - var select406 = linear_select([ - part1805, - dup96, - ]); - - var part1806 = match("MESSAGE#1133:00612/6", "nwparser.p0", "M. (%{fld1})"); - - var all369 = all_match({ - processors: [ - part1800, - dup353, - part1801, - select405, - part1804, - select406, - part1806, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1149 = msg("00612", all369); - - var part1807 = match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send all the DRP routes to backup device. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1150 = msg("00620", part1807); - - var part1808 = match("MESSAGE#1135:00620:01/0", "nwparser.payload", "RTSYNC: %{p0}"); - - var part1809 = match("MESSAGE#1135:00620:01/1_0", "nwparser.p0", "Serviced%{p0}"); - - var part1810 = match("MESSAGE#1135:00620:01/1_1", "nwparser.p0", "Recieved%{p0}"); - - var select407 = linear_select([ - part1809, - part1810, - ]); - - var part1811 = match("MESSAGE#1135:00620:01/2", "nwparser.p0", "%{}coldstart request for route synchronization from NSRP peer. (%{fld1})"); - - var all370 = all_match({ - processors: [ - part1808, - select407, - part1811, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1151 = msg("00620:01", all370); - - var part1812 = match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to purge all the DRP backup routes - %{fld2->} (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1152 = msg("00620:02", part1812); - - var part1813 = match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purge backup routes in all vrouters. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1153 = msg("00620:03", part1813); - - var part1814 = match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the DRP backup routes is stopped. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1154 = msg("00620:04", part1814); - - var select408 = linear_select([ - msg1150, - msg1151, - msg1152, - msg1153, - msg1154, - ]); - - var part1815 = match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual router %{node->} is created. (%{fld1})", processor_chain([ - dup273, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1155 = msg("00622", part1815); - - var part1816 = match("MESSAGE#1140:00625/0", "nwparser.payload", "Session (id %{sessionid->} src-ip %{saddr->} dst-ip %{daddr->} dst port %{dport}) route is %{p0}"); - - var part1817 = match("MESSAGE#1140:00625/1_0", "nwparser.p0", "invalid%{p0}"); - - var part1818 = match("MESSAGE#1140:00625/1_1", "nwparser.p0", "valid%{p0}"); - - var select409 = linear_select([ - part1817, - part1818, - ]); - - var all371 = all_match({ - processors: [ - part1816, - select409, - dup49, - ], - on_success: processor_chain([ - dup273, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1156 = msg("00625", all371); - - var part1819 = match("MESSAGE#1141:00628/0", "nwparser.payload", "audit log queue %{p0}"); - - var part1820 = match("MESSAGE#1141:00628/1_0", "nwparser.p0", "Traffic Log %{p0}"); - - var part1821 = match("MESSAGE#1141:00628/1_1", "nwparser.p0", "Event Alarm Log %{p0}"); - - var part1822 = match("MESSAGE#1141:00628/1_2", "nwparser.p0", "Event Log %{p0}"); - - var select410 = linear_select([ - part1820, - part1821, - part1822, - ]); - - var part1823 = match("MESSAGE#1141:00628/2", "nwparser.p0", "is overwritten (%{fld1})"); - - var all372 = all_match({ - processors: [ - part1819, - select410, - part1823, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1157 = msg("00628", all372); - - var part1824 = match("MESSAGE#1142:00767:50", "nwparser.payload", "Log setting was modified to %{disposition->} %{fld2->} level by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - dup282, - ])); - - var msg1158 = msg("00767:50", part1824); - - var part1825 = match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1159 = msg("00767:51", part1825); - - var part1826 = match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1160 = msg("00767:52", part1826); - - var part1827 = match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is added to attack group %{group->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1161 = msg("00767:53", part1827); - - var part1828 = match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID server%{}", processor_chain([ - dup27, - setc("ec_theme","Communication"), - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1162 = msg("00767", part1828); - - var part1829 = match("MESSAGE#1147:00767:01/0", "nwparser.payload", "System auto-config of file %{fld2->} from TFTP server %{hostip->} has %{p0}"); - - var part1830 = match("MESSAGE#1147:00767:01/1_0", "nwparser.p0", "been loaded successfully%{}"); - - var part1831 = match("MESSAGE#1147:00767:01/1_1", "nwparser.p0", "failed%{}"); - - var select411 = linear_select([ - part1830, - part1831, - ]); - - var all373 = all_match({ - processors: [ - part1829, - select411, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1163 = msg("00767:01", all373); - - var part1832 = match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config saved from host %{saddr}", processor_chain([ - setc("eventcategory","1702000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1164 = msg("00767:02", part1832); - - var part1833 = match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filename %{filename}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1165 = msg("00767:03", part1833); - - var part1834 = match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1166 = msg("00767:04", part1834); - - var part1835 = match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact the SecurID server%{}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1167 = msg("00767:05", part1835); - - var part1836 = match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data to the SecurID server%{}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1168 = msg("00767:06", part1836); - - var part1837 = match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was saved from peer unit by admin%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1169 = msg("00767:07", part1837); - - var part1838 = match("MESSAGE#1154:00767:08/0", "nwparser.payload", "The system configuration was saved by admin %{p0}"); - - var all374 = all_match({ - processors: [ - part1838, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1170 = msg("00767:08", all374); - - var part1839 = match("MESSAGE#1155:00767:09/0", "nwparser.payload", "traffic shaping is turned O%{p0}"); - - var part1840 = match("MESSAGE#1155:00767:09/1_0", "nwparser.p0", "N%{}"); - - var part1841 = match("MESSAGE#1155:00767:09/1_1", "nwparser.p0", "FF%{}"); - - var select412 = linear_select([ - part1840, - part1841, - ]); - - var all375 = all_match({ - processors: [ - part1839, - select412, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1171 = msg("00767:09", all375); - - var part1842 = match("MESSAGE#1156:00767:10/0", "nwparser.payload", "The system configuration was saved from host %{saddr->} by admin %{p0}"); - - var all376 = all_match({ - processors: [ - part1842, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1172 = msg("00767:10", all376); - - var part1843 = match("MESSAGE#1157:00767:11/0", "nwparser.payload", "Fatal error. The NetScreen device was unable to upgrade the %{p0}"); - - var part1844 = match("MESSAGE#1157:00767:11/1_1", "nwparser.p0", "file system %{p0}"); - - var select413 = linear_select([ - dup331, - part1844, - ]); - - var part1845 = match("MESSAGE#1157:00767:11/2", "nwparser.p0", ", and the %{p0}"); - - var part1846 = match("MESSAGE#1157:00767:11/3_1", "nwparser.p0", "old file system %{p0}"); - - var select414 = linear_select([ - dup331, - part1846, - ]); - - var part1847 = match("MESSAGE#1157:00767:11/4", "nwparser.p0", "is damaged.%{}"); - - var all377 = all_match({ - processors: [ - part1843, - select413, - part1845, - select414, - part1847, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1173 = msg("00767:11", all377); - - var part1848 = match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1174 = msg("00767:12", part1848); - - var part1849 = match("MESSAGE#1159:00767:13/0", "nwparser.payload", "%{fld2}Environment variable %{fld3->} is changed to %{fld4->} by admin %{p0}"); - - var all378 = all_match({ - processors: [ - part1849, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1175 = msg("00767:13", all378); - - var part1850 = match("MESSAGE#1160:00767:14/0", "nwparser.payload", "System was %{p0}"); - - var part1851 = match("MESSAGE#1160:00767:14/1_0", "nwparser.p0", "reset %{p0}"); - - var select415 = linear_select([ - part1851, - dup262, - ]); - - var part1852 = match("MESSAGE#1160:00767:14/2", "nwparser.p0", "at %{fld2->} by %{p0}"); - - var part1853 = match("MESSAGE#1160:00767:14/3_0", "nwparser.p0", "admin %{administrator}"); - - var part1854 = match_copy("MESSAGE#1160:00767:14/3_1", "nwparser.p0", "username"); - - var select416 = linear_select([ - part1853, - part1854, - ]); - - var all379 = all_match({ - processors: [ - part1850, - select415, - part1852, - select416, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1176 = msg("00767:14", all379); - - var part1855 = match("MESSAGE#1161:00767:15/1_0", "nwparser.p0", "System %{p0}"); - - var part1856 = match("MESSAGE#1161:00767:15/1_1", "nwparser.p0", "Event %{p0}"); - - var part1857 = match("MESSAGE#1161:00767:15/1_2", "nwparser.p0", "Traffic %{p0}"); - - var select417 = linear_select([ - part1855, - part1856, - part1857, - ]); - - var part1858 = match("MESSAGE#1161:00767:15/2", "nwparser.p0", "log was reviewed by %{p0}"); - - var part1859 = match("MESSAGE#1161:00767:15/4", "nwparser.p0", "%{} %{username}."); - - var all380 = all_match({ - processors: [ - dup183, - select417, - part1858, - dup336, - part1859, - ], - on_success: processor_chain([ - dup223, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1177 = msg("00767:15", all380); - - var part1860 = match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administrator->} issued command %{info->} to redirect output.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1178 = msg("00767:16", part1860); - - var part1861 = match("MESSAGE#1163:00767:17/0", "nwparser.payload", "%{fld2->} Save new software from %{fld3->} to flash by admin %{p0}"); - - var all381 = all_match({ - processors: [ - part1861, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1179 = msg("00767:17", all381); - - var part1862 = match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{version->} has been %{fld2->} saved to flash.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1180 = msg("00767:18", part1862); - - var part1863 = match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{version->} was rejected because the authentication check failed.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1181 = msg("00767:19", part1863); - - var part1864 = match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version of the RADIUS server %{hostname->} does not match %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1182 = msg("00767:20", part1864); - - var part1865 = match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, %{fld4}) cleared %{fld5}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1183 = msg("00767:21", part1865); - - var part1866 = match("MESSAGE#1168:00767:22/0", "nwparser.payload", "The system configuration was not saved %{p0}"); - - var part1867 = match("MESSAGE#1168:00767:22/1_0", "nwparser.p0", "%{fld2->} by admin %{administrator->} via NSRP Peer %{p0}"); - - var part1868 = match("MESSAGE#1168:00767:22/1_1", "nwparser.p0", "%{fld2->} %{p0}"); - - var select418 = linear_select([ - part1867, - part1868, - ]); - - var part1869 = match("MESSAGE#1168:00767:22/2", "nwparser.p0", "by administrator %{fld3}. %{p0}"); - - var part1870 = match("MESSAGE#1168:00767:22/3_0", "nwparser.p0", "It was locked %{p0}"); - - var part1871 = match("MESSAGE#1168:00767:22/3_1", "nwparser.p0", "Locked %{p0}"); - - var select419 = linear_select([ - part1870, - part1871, - ]); - - var part1872 = match("MESSAGE#1168:00767:22/4", "nwparser.p0", "by administrator %{fld4->} %{p0}"); - - var all382 = all_match({ - processors: [ - part1866, - select418, - part1869, - select419, - part1872, - dup354, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1184 = msg("00767:22", all382); - - var part1873 = match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot filename %{filename->} to flash memory by administrator %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1185 = msg("00767:23", part1873); - - var part1874 = match("MESSAGE#1170:00767:25/0", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from %{p0}"); - - var select420 = linear_select([ - dup169, - dup16, - ]); - - var part1875 = match("MESSAGE#1170:00767:25/3_0", "nwparser.p0", "%{saddr}:%{sport->} by %{p0}"); - - var part1876 = match("MESSAGE#1170:00767:25/3_1", "nwparser.p0", "%{saddr->} by %{p0}"); - - var select421 = linear_select([ - part1875, - part1876, - ]); - - var all383 = all_match({ - processors: [ - part1874, - select420, - dup23, - select421, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1186 = msg("00767:25", all383); - - var part1877 = match("MESSAGE#1171:00767:26/0", "nwparser.payload", "Lock configuration %{p0}"); - - var part1878 = match("MESSAGE#1171:00767:26/1_0", "nwparser.p0", "started%{p0}"); - - var part1879 = match("MESSAGE#1171:00767:26/1_1", "nwparser.p0", "ended%{p0}"); - - var select422 = linear_select([ - part1878, - part1879, - ]); - - var part1880 = match("MESSAGE#1171:00767:26/2", "nwparser.p0", "%{}by task %{p0}"); - - var part1881 = match("MESSAGE#1171:00767:26/3_0", "nwparser.p0", "%{fld3}, with a timeout value of %{fld2}"); - - var part1882 = match("MESSAGE#1171:00767:26/3_1", "nwparser.p0", "%{fld2->} (%{fld1})"); - - var select423 = linear_select([ - part1881, - part1882, - ]); - - var all384 = all_match({ - processors: [ - part1877, - select422, - part1880, - select423, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1187 = msg("00767:26", all384); - - var part1883 = match("MESSAGE#1172:00767:27/0", "nwparser.payload", "Environment variable %{fld2->} changed to %{p0}"); - - var part1884 = match("MESSAGE#1172:00767:27/1_0", "nwparser.p0", "%{fld3->} by %{username->} (%{fld1})"); - - var part1885 = match_copy("MESSAGE#1172:00767:27/1_1", "nwparser.p0", "fld3"); - - var select424 = linear_select([ - part1884, - part1885, - ]); - - var all385 = all_match({ - processors: [ - part1883, - select424, - ], - on_success: processor_chain([ - dup223, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1188 = msg("00767:27", all385); - - var part1886 = match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was loaded from IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1189 = msg("00767:28", part1886); - - var part1887 = match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1190 = msg("00767:29", part1887); - - var part1888 = match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configuration was saved from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1191 = msg("00767:30", part1888); - - var part1889 = match("MESSAGE#1176:00767:31/1_0", "nwparser.p0", "logged events or alarms %{p0}"); - - var part1890 = match("MESSAGE#1176:00767:31/1_1", "nwparser.p0", "traffic logs %{p0}"); - - var select425 = linear_select([ - part1889, - part1890, - ]); - - var part1891 = match("MESSAGE#1176:00767:31/2", "nwparser.p0", "were cleared by admin %{p0}"); - - var all386 = all_match({ - processors: [ - dup186, - select425, - part1891, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1192 = msg("00767:31", all386); - - var part1892 = match("MESSAGE#1177:00767:32/0", "nwparser.payload", "SIP parser error %{p0}"); - - var part1893 = match("MESSAGE#1177:00767:32/1_0", "nwparser.p0", "SIP-field%{p0}"); - - var part1894 = match("MESSAGE#1177:00767:32/1_1", "nwparser.p0", "Message%{p0}"); - - var select426 = linear_select([ - part1893, - part1894, - ]); - - var part1895 = match("MESSAGE#1177:00767:32/2", "nwparser.p0", ": %{result}(%{fld1})"); - - var all387 = all_match({ - processors: [ - part1892, - select426, - part1895, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1193 = msg("00767:32", all387); - - var part1896 = match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has started. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1194 = msg("00767:33", part1896); - - var part1897 = match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not support multiple IP addresses %{hostip->} or ports %{network_port->} in SIP headers RESPONSE (%{fld1})", processor_chain([ - dup313, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1195 = msg("00767:34", part1897); - - var part1898 = match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2->} set to %{fld3->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1196 = msg("00767:35", part1898); - - var part1899 = match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved from %{fld2->} by %{username->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1197 = msg("00767:36", part1899); - - var part1900 = match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to download to enable advanced features. %{space->} To find out, please visit %{url->} (%{fld1})", processor_chain([ - dup254, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1198 = msg("00767:37", part1900); - - var part1901 = match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and remaining messages were sent to external destination. %{fld2->} packets were dropped. (%{fld1})", processor_chain([ - setc("eventcategory","1602000000"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1199 = msg("00767:38", part1901); - - var part1902 = match("MESSAGE#1184:00767:39/0", "nwparser.payload", "Cannot %{p0}"); - - var part1903 = match("MESSAGE#1184:00767:39/1_0", "nwparser.p0", "download %{p0}"); - - var part1904 = match("MESSAGE#1184:00767:39/1_1", "nwparser.p0", "parse %{p0}"); - - var select427 = linear_select([ - part1903, - part1904, - ]); - - var part1905 = match("MESSAGE#1184:00767:39/2", "nwparser.p0", "attack database %{p0}"); - - var part1906 = match("MESSAGE#1184:00767:39/3_0", "nwparser.p0", "from %{url->} (%{result}). %{p0}"); - - var part1907 = match("MESSAGE#1184:00767:39/3_1", "nwparser.p0", "%{fld2->} %{p0}"); - - var select428 = linear_select([ - part1906, - part1907, - ]); - - var all388 = all_match({ - processors: [ - part1902, - select427, - part1905, - select428, - dup10, - ], - on_success: processor_chain([ - dup324, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1200 = msg("00767:39", all388); - - var part1908 = match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key is %{disposition}. (%{fld1})", processor_chain([ - dup62, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1201 = msg("00767:40", part1908); - - var part1909 = match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1202 = msg("00767:42", part1909); - - var part1910 = match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1203 = msg("00767:43", part1910); - - var part1911 = match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind by %{fld2->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1204 = msg("00767:44", part1911); - - var part1912 = match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{version->} is saved to flash. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1205 = msg("00767:45", part1912); - - var part1913 = match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved by netscreen via %{logon_type->} by netscreen. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1206 = msg("00767:46", part1913); - - var part1914 = match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs to a different group in the RADIUS server than that allowed in the device. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg1207 = msg("00767:47", part1914); - - var part1915 = match("MESSAGE#1192:00767:24/0", "nwparser.payload", "System configuration saved by %{p0}"); - - var part1916 = match("MESSAGE#1192:00767:24/2", "nwparser.p0", "%{logon_type->} by %{fld2->} (%{fld1})"); - - var all389 = all_match({ - processors: [ - part1915, - dup364, - part1916, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1208 = msg("00767:24", all389); - - var part1917 = match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1209 = msg("00767:48", part1917); - - var part1918 = match("MESSAGE#1194:00767:49/0", "nwparser.payload", "%{fld2->} turn o%{p0}"); - - var part1919 = match("MESSAGE#1194:00767:49/1_0", "nwparser.p0", "n%{p0}"); - - var part1920 = match("MESSAGE#1194:00767:49/1_1", "nwparser.p0", "ff%{p0}"); - - var select429 = linear_select([ - part1919, - part1920, - ]); - - var part1921 = match("MESSAGE#1194:00767:49/2", "nwparser.p0", "%{}debug switch for %{fld3->} (%{fld1})"); - - var all390 = all_match({ - processors: [ - part1918, - select429, - part1921, - ], - on_success: processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1210 = msg("00767:49", all390); - - var select430 = linear_select([ - msg1158, - msg1159, - msg1160, - msg1161, - msg1162, - msg1163, - msg1164, - msg1165, - msg1166, - msg1167, - msg1168, - msg1169, - msg1170, - msg1171, - msg1172, - msg1173, - msg1174, - msg1175, - msg1176, - msg1177, - msg1178, - msg1179, - msg1180, - msg1181, - msg1182, - msg1183, - msg1184, - msg1185, - msg1186, - msg1187, - msg1188, - msg1189, - msg1190, - msg1191, - msg1192, - msg1193, - msg1194, - msg1195, - msg1196, - msg1197, - msg1198, - msg1199, - msg1200, - msg1201, - msg1202, - msg1203, - msg1204, - msg1205, - msg1206, - msg1207, - msg1208, - msg1209, - msg1210, - ]); - - var part1922 = match("MESSAGE#1195:01269", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup277, - dup3, - dup275, - dup60, - ])); - - var msg1211 = msg("01269", part1922); - - var msg1212 = msg("01269:01", dup407); - - var msg1213 = msg("01269:02", dup408); - - var msg1214 = msg("01269:03", dup409); - - var select431 = linear_select([ - msg1211, - msg1212, - msg1213, - msg1214, - ]); - - var part1923 = match("MESSAGE#1199:17852", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup276, - dup277, - dup275, - dup332, - ])); - - var msg1215 = msg("17852", part1923); - - var part1924 = match("MESSAGE#1200:17852:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1216 = msg("17852:01", part1924); - - var part1925 = match("MESSAGE#1201:17852:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var msg1217 = msg("17852:02", part1925); - - var part1926 = match("MESSAGE#1202:17852:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1218 = msg("17852:03", part1926); - - var select432 = linear_select([ - msg1215, - msg1216, - msg1217, - msg1218, - ]); - - var msg1219 = msg("23184", dup410); - - var part1927 = match("MESSAGE#1204:23184:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup61, - dup282, - ])); - - var msg1220 = msg("23184:01", part1927); - - var part1928 = match("MESSAGE#1205:23184:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup276, - dup277, - dup275, - dup61, - ])); - - var msg1221 = msg("23184:02", part1928); - - var part1929 = match("MESSAGE#1206:23184:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1222 = msg("23184:03", part1929); - - var select433 = linear_select([ - msg1219, - msg1220, - msg1221, - msg1222, - ]); - - var msg1223 = msg("27052", dup410); - - var part1930 = match("MESSAGE#1208:27052:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol}direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup61, - dup282, - ])); - - var msg1224 = msg("27052:01", part1930); - - var select434 = linear_select([ - msg1223, - msg1224, - ]); - - var part1931 = match("MESSAGE#1209:39568", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup277, - dup5, - dup274, - dup3, - dup275, - dup276, - dup60, - ])); - - var msg1225 = msg("39568", part1931); - - var msg1226 = msg("39568:01", dup407); - - var msg1227 = msg("39568:02", dup408); - - var msg1228 = msg("39568:03", dup409); - - var select435 = linear_select([ - msg1225, - msg1226, - msg1227, - msg1228, - ]); - - var chain1 = processor_chain([ - select2, - msgid_select({ - "00001": select6, - "00002": select29, - "00003": select31, - "00004": select33, - "00005": select39, - "00006": select40, - "00007": select63, - "00008": select66, - "00009": select83, - "00010": select86, - "00011": select100, - "00012": select101, - "00013": select102, - "00014": select104, - "00015": select114, - "00016": select115, - "00017": select125, - "00018": select138, - "00019": select147, - "00020": select150, - "00021": select151, - "00022": select163, - "00023": select164, - "00024": select170, - "00025": select171, - "00026": select176, - "00027": select184, - "00028": msg469, - "00029": select188, - "00030": select197, - "00031": select205, - "00032": select207, - "00033": select214, - "00034": select225, - "00035": select232, - "00036": select234, - "00037": select241, - "00038": msg660, - "00039": msg661, - "00040": select244, - "00041": select245, - "00042": select246, - "00043": msg668, - "00044": select248, - "00045": msg671, - "00047": msg672, - "00048": select257, - "00049": select258, - "00050": msg682, - "00051": msg683, - "00052": msg684, - "00055": select265, - "00056": msg696, - "00057": msg697, - "00058": msg698, - "00059": select272, - "00062": select273, - "00063": msg713, - "00064": select274, - "00070": select276, - "00071": select277, - "00072": select278, - "00073": select279, - "00074": msg726, - "00075": select280, - "00076": select281, - "00077": select282, - "00084": msg735, - "00090": msg736, - "00200": msg737, - "00201": msg738, - "00202": msg739, - "00203": msg740, - "00206": select285, - "00207": select286, - "00257": select291, - "00259": select294, - "00262": msg778, - "00263": msg779, - "00400": msg780, - "00401": msg781, - "00402": select296, - "00403": msg784, - "00404": msg785, - "00405": msg786, - "00406": msg787, - "00407": msg788, - "00408": msg789, - "00409": msg790, - "00410": select297, - "00411": msg793, - "00413": select298, - "00414": select299, - "00415": msg799, - "00423": msg800, - "00429": select300, - "00430": select301, - "00431": msg805, - "00432": msg806, - "00433": msg807, - "00434": msg808, - "00435": select302, - "00436": select303, - "00437": select304, - "00438": select305, - "00440": select306, - "00441": msg823, - "00442": msg824, - "00443": msg825, - "00511": select307, - "00513": msg841, - "00515": select328, - "00518": select331, - "00519": select336, - "00520": select339, - "00521": msg890, - "00522": msg891, - "00523": msg892, - "00524": select340, - "00525": select341, - "00526": msg912, - "00527": select348, - "00528": select354, - "00529": select357, - "00530": select358, - "00531": select362, - "00533": msg973, - "00534": msg974, - "00535": select363, - "00536": select365, - "00537": select366, - "00538": select372, - "00539": select373, - "00541": select375, - "00542": msg1062, - "00543": msg1063, - "00544": msg1064, - "00546": msg1065, - "00547": select379, - "00549": msg1070, - "00551": select381, - "00553": select385, - "00554": select391, - "00555": msg1117, - "00556": select401, - "00572": select402, - "00601": select404, - "00602": msg1148, - "00612": msg1149, - "00615": select403, - "00620": select408, - "00622": msg1155, - "00625": msg1156, - "00628": msg1157, - "00767": select430, - "01269": select431, - "17852": select432, - "23184": select433, - "27052": select434, - "39568": select435, - }), - ]); - - var part1932 = match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); - - var part1933 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); - - var part1934 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); - - var part1935 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); - - var part1936 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); - - var part1937 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); - - var part1938 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); - - var part1939 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); - - var part1940 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); - - var part1941 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); - - var part1942 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); - - var part1943 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); - - var part1944 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); - - var part1945 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); - - var part1946 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); - - var part1947 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); - - var part1948 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); - - var part1949 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); - - var part1950 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); - - var part1951 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); - - var part1952 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); - - var part1953 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); - - var part1954 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); - - var part1955 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); - - var part1956 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); - - var part1957 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); - - var part1958 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); - - var part1959 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); - - var part1960 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); - - var part1961 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); - - var part1962 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); - - var part1963 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); - - var part1964 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part1965 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); - - var part1966 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); - - var part1967 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); - - var part1968 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); - - var part1969 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); - - var part1970 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); - - var part1971 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); - - var part1972 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); - - var part1973 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); - - var part1974 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); - - var part1975 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); - - var part1976 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); - - var part1977 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part1978 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); - - var part1979 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); - - var part1980 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part1981 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); - - var part1982 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); - - var part1983 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); - - var part1984 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); - - var part1985 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); - - var part1986 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); - - var part1987 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); - - var part1988 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); - - var part1989 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); - - var part1990 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); - - var part1991 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); - - var part1992 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); - - var part1993 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); - - var part1994 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); - - var part1995 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); - - var part1996 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); - - var part1997 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); - - var part1998 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); - - var part1999 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); - - var part2000 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); - - var part2001 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); - - var part2002 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); - - var part2003 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); - - var part2004 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); - - var part2005 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); - - var part2006 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); - - var part2007 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); - - var part2008 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); - - var part2009 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); - - var part2010 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); - - var part2011 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); - - var part2012 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); - - var part2013 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); - - var part2014 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); - - var part2015 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); - - var part2016 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); - - var part2017 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); - - var part2018 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); - - var part2019 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); - - var part2020 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); - - var part2021 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part2022 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2023 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); - - var part2024 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); - - var part2025 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); - - var part2026 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); - - var part2027 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); - - var part2028 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); - - var part2029 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); - - var part2030 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); - - var part2031 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); - - var part2032 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); - - var part2033 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); - - var part2034 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); - - var part2035 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); - - var part2036 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); - - var part2037 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); - - var part2038 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); - - var part2039 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); - - var part2040 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); - - var part2041 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); - - var part2042 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); - - var part2043 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); - - var part2044 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); - - var part2045 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); - - var part2046 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); - - var part2047 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); - - var part2048 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); - - var part2049 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); - - var part2050 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); - - var part2051 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); - - var part2052 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); - - var part2053 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); - - var part2054 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); - - var part2055 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); - - var part2056 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); - - var part2057 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); - - var part2058 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); - - var part2059 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); - - var part2060 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); - - var part2061 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); - - var part2062 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); - - var part2063 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); - - var part2064 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); - - var part2065 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); - - var part2066 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); - - var part2067 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); - - var part2068 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); - - var part2069 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); - - var part2070 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); - - var part2071 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); - - var part2072 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); - - var part2073 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); - - var part2074 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); - - var part2075 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); - - var part2076 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); - - var part2077 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); - - var part2078 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); - - var part2079 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); - - var part2080 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); - - var part2081 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); - - var part2082 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); - - var part2083 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); - - var part2084 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); - - var part2085 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); - - var part2086 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); - - var part2087 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); - - var part2088 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); - - var part2089 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); - - var part2090 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); - - var part2091 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); - - var part2092 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); - - var part2093 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); - - var part2094 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); - - var part2095 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); - - var part2096 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); - - var part2097 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); - - var part2098 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); - - var part2099 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); - - var part2100 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); - - var part2101 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); - - var part2102 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); - - var part2103 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); - - var part2104 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); - - var part2105 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); - - var part2106 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2107 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); - - var part2108 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); - - var part2109 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); - - var part2110 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); - - var part2111 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); - - var part2112 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); - - var part2113 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); - - var part2114 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); - - var part2115 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); - - var part2116 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); - - var part2117 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); - - var part2118 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); - - var part2119 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); - - var part2120 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); - - var part2121 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); - - var part2122 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); - - var part2123 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); - - var part2124 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); - - var part2125 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); - - var part2126 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); - - var part2127 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); - - var part2128 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); - - var part2129 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); - - var part2130 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); - - var part2131 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var part2132 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); - - var part2133 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); - - var part2134 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); - - var part2135 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); - - var part2136 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var part2137 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); - - var part2138 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); - - var part2139 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); - - var part2140 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); - - var part2141 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); - - var part2142 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); - - var part2143 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); - - var part2144 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); - - var part2145 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); - - var part2146 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); - - var part2147 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2148 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2149 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var part2150 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); - - var part2151 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); - - var part2152 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); - - var part2153 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); - - var part2154 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); - - var part2155 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); - - var part2156 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); - - var part2157 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); - - var part2158 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); - - var part2159 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); - - var part2160 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); - - var part2161 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); - - var part2162 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); - - var part2163 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); - - var part2164 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); - - var part2165 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); - - var part2166 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); - - var part2167 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); - - var part2168 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); - - var part2169 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); - - var part2170 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); - - var part2171 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); - - var part2172 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); - - var part2173 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); - - var part2174 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - - var part2175 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); - - var select436 = linear_select([ - dup10, - dup11, - ]); - - var part2176 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select437 = linear_select([ - dup13, - dup14, - ]); - - var select438 = linear_select([ - dup15, - dup16, - ]); - - var select439 = linear_select([ - dup56, - dup57, - ]); - - var select440 = linear_select([ - dup65, - dup66, - ]); - - var select441 = linear_select([ - dup68, - dup69, - ]); - - var select442 = linear_select([ - dup71, - dup72, - ]); - - var part2177 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var select443 = linear_select([ - dup74, - dup75, - ]); - - var select444 = linear_select([ - dup81, - dup82, - ]); - - var select445 = linear_select([ - dup24, - dup90, - ]); - - var select446 = linear_select([ - dup94, - dup95, - ]); - - var select447 = linear_select([ - dup98, - dup99, - ]); - - var select448 = linear_select([ - dup100, - dup101, - dup102, - ]); - - var select449 = linear_select([ - dup113, - dup114, - ]); - - var select450 = linear_select([ - dup111, - dup16, - ]); - - var select451 = linear_select([ - dup127, - dup107, - ]); - - var select452 = linear_select([ - dup8, - dup21, - ]); - - var select453 = linear_select([ - dup122, - dup133, - ]); - - var select454 = linear_select([ - dup142, - dup143, - ]); - - var select455 = linear_select([ - dup145, - dup21, - ]); - - var select456 = linear_select([ - dup127, - dup106, - ]); - - var select457 = linear_select([ - dup152, - dup96, - ]); - - var select458 = linear_select([ - dup154, - dup155, - ]); - - var select459 = linear_select([ - dup156, - dup157, - ]); - - var select460 = linear_select([ - dup99, - dup134, - ]); - - var select461 = linear_select([ - dup158, - dup159, - ]); - - var select462 = linear_select([ - dup161, - dup162, - ]); - - var select463 = linear_select([ - dup163, - dup103, - ]); - - var select464 = linear_select([ - dup162, - dup161, - ]); - - var select465 = linear_select([ - dup46, - dup47, - ]); - - var select466 = linear_select([ - dup166, - dup167, - ]); - - var select467 = linear_select([ - dup172, - dup173, - ]); - - var select468 = linear_select([ - dup174, - dup175, - dup176, - dup177, - dup178, - dup179, - dup180, - dup181, - dup182, - ]); - - var select469 = linear_select([ - dup49, - dup21, - ]); - - var select470 = linear_select([ - dup189, - dup190, - ]); - - var select471 = linear_select([ - dup96, - dup152, - ]); - - var select472 = linear_select([ - dup196, - dup197, - ]); - - var select473 = linear_select([ - dup24, - dup200, - ]); - - var select474 = linear_select([ - dup103, - dup163, - ]); - - var select475 = linear_select([ - dup205, - dup118, - ]); - - var part2178 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select476 = linear_select([ - dup212, - dup213, - ]); - - var select477 = linear_select([ - dup215, - dup216, - ]); - - var select478 = linear_select([ - dup222, - dup215, - ]); - - var select479 = linear_select([ - dup224, - dup225, - ]); - - var select480 = linear_select([ - dup231, - dup124, - ]); - - var select481 = linear_select([ - dup229, - dup230, - ]); - - var select482 = linear_select([ - dup233, - dup234, - ]); - - var select483 = linear_select([ - dup236, - dup237, - ]); - - var select484 = linear_select([ - dup242, - dup243, - ]); - - var select485 = linear_select([ - dup245, - dup246, - ]); - - var select486 = linear_select([ - dup247, - dup248, - ]); - - var select487 = linear_select([ - dup249, - dup250, - ]); - - var select488 = linear_select([ - dup251, - dup252, - ]); - - var select489 = linear_select([ - dup260, - dup261, - ]); - - var select490 = linear_select([ - dup264, - dup265, - ]); - - var select491 = linear_select([ - dup268, - dup269, - ]); - - var part2179 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select492 = linear_select([ - dup284, - dup285, - ]); - - var select493 = linear_select([ - dup287, - dup288, - ]); - - var part2180 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup60, - ])); - - var part2181 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var select494 = linear_select([ - dup300, - dup26, - ]); - - var select495 = linear_select([ - dup115, - dup303, - ]); - - var select496 = linear_select([ - dup125, - dup96, - ]); - - var select497 = linear_select([ - dup189, - dup308, - dup309, - ]); - - var select498 = linear_select([ - dup310, - dup16, - ]); - - var select499 = linear_select([ - dup317, - dup318, - ]); - - var select500 = linear_select([ - dup319, - dup315, - ]); - - var select501 = linear_select([ - dup322, - dup250, - ]); - - var select502 = linear_select([ - dup327, - dup329, - ]); - - var select503 = linear_select([ - dup330, - dup129, - ]); - - var part2182 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var part2183 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup60, - ])); - - var part2184 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var part2185 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var all391 = all_match({ - processors: [ - dup263, - dup390, - dup266, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var all392 = all_match({ - processors: [ - dup267, - dup391, - dup270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var all393 = all_match({ - processors: [ - dup80, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var all394 = all_match({ - processors: [ - dup296, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var all395 = all_match({ - processors: [ - dup298, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/udp.yml.hbs b/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/udp.yml.hbs deleted file mode 100755 index 63a0c266a8..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,26354 +0,0 @@ -udp: -host: "{{udp_host}}:{{udp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Juniper" - product: "Netscreen" - type: "Firewall" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} for %{p0}"); - - var dup7 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); - - var dup8 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); - - var dup9 = date_time({ - dest: "event_time", - args: ["fld1"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup10 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); - - var dup11 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); - - var dup12 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); - - var dup13 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); - - var dup14 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); - - var dup15 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); - - var dup16 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); - - var dup17 = setc("eventcategory","1502000000"); - - var dup18 = setc("eventcategory","1703000000"); - - var dup19 = setc("eventcategory","1603000000"); - - var dup20 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); - - var dup21 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); - - var dup22 = setc("eventcategory","1502050000"); - - var dup23 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); - - var dup24 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); - - var dup25 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); - - var dup26 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); - - var dup27 = setc("eventcategory","1801010000"); - - var dup28 = setc("eventcategory","1401060000"); - - var dup29 = setc("ec_subject","User"); - - var dup30 = setc("ec_activity","Logon"); - - var dup31 = setc("ec_theme","Authentication"); - - var dup32 = setc("ec_outcome","Success"); - - var dup33 = setc("eventcategory","1401070000"); - - var dup34 = setc("ec_activity","Logoff"); - - var dup35 = setc("eventcategory","1303000000"); - - var dup36 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); - - var dup37 = setc("eventcategory","1402020200"); - - var dup38 = setc("ec_theme","UserGroup"); - - var dup39 = setc("ec_outcome","Error"); - - var dup40 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); - - var dup41 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); - - var dup42 = setc("eventcategory","1402020300"); - - var dup43 = setc("ec_activity","Modify"); - - var dup44 = setc("eventcategory","1605000000"); - - var dup45 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); - - var dup46 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); - - var dup47 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); - - var dup48 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); - - var dup49 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); - - var dup50 = setc("eventcategory","1701020000"); - - var dup51 = setc("ec_theme","Configuration"); - - var dup52 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); - - var dup53 = setc("eventcategory","1301000000"); - - var dup54 = setc("ec_outcome","Failure"); - - var dup55 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); - - var dup56 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); - - var dup57 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); - - var dup58 = setc("eventcategory","1001000000"); - - var dup59 = setc("dclass_counter1_string","Number of times the attack occurred"); - - var dup60 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("saddr"), - field("daddr"), - ], - }); - - var dup61 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("saddr"), - field("daddr"), - field("sport"), - field("dport"), - ], - }); - - var dup62 = setc("eventcategory","1608010000"); - - var dup63 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); - - var dup64 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); - - var dup65 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); - - var dup66 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); - - var dup67 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup68 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); - - var dup69 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); - - var dup70 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); - - var dup71 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); - - var dup72 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); - - var dup73 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); - - var dup74 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); - - var dup75 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); - - var dup76 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); - - var dup77 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); - - var dup78 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); - - var dup79 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); - - var dup80 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup81 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); - - var dup82 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); - - var dup83 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup84 = setc("eventcategory","1002020000"); - - var dup85 = setc("eventcategory","1002000000"); - - var dup86 = setc("eventcategory","1603110000"); - - var dup87 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); - - var dup88 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); - - var dup89 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); - - var dup90 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); - - var dup91 = setc("eventcategory","1613040200"); - - var dup92 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); - - var dup93 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); - - var dup94 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); - - var dup95 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); - - var dup96 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); - - var dup97 = setc("eventcategory","1613050200"); - - var dup98 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); - - var dup99 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); - - var dup100 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); - - var dup101 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); - - var dup102 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); - - var dup103 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); - - var dup104 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); - - var dup105 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); - - var dup106 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); - - var dup107 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); - - var dup108 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); - - var dup109 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); - - var dup110 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); - - var dup111 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); - - var dup112 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); - - var dup113 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); - - var dup114 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); - - var dup115 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); - - var dup116 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); - - var dup117 = setc("eventcategory","1603090000"); - - var dup118 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); - - var dup119 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); - - var dup120 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); - - var dup121 = setc("eventcategory","1603030000"); - - var dup122 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); - - var dup123 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); - - var dup124 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); - - var dup125 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); - - var dup126 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); - - var dup127 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); - - var dup128 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); - - var dup129 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); - - var dup130 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); - - var dup131 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); - - var dup132 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup133 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); - - var dup134 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); - - var dup135 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); - - var dup136 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); - - var dup137 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); - - var dup138 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); - - var dup139 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); - - var dup140 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); - - var dup141 = setc("eventcategory","1702030000"); - - var dup142 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); - - var dup143 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); - - var dup144 = setc("eventcategory","1601000000"); - - var dup145 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); - - var dup146 = date_time({ - dest: "event_time", - args: ["fld2"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup147 = setc("eventcategory","1103000000"); - - var dup148 = setc("ec_subject","NetworkComm"); - - var dup149 = setc("ec_activity","Scan"); - - var dup150 = setc("ec_theme","TEV"); - - var dup151 = setc("eventcategory","1103010000"); - - var dup152 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); - - var dup153 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); - - var dup154 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); - - var dup155 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); - - var dup156 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); - - var dup157 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); - - var dup158 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); - - var dup159 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); - - var dup160 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); - - var dup161 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); - - var dup162 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); - - var dup163 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); - - var dup164 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); - - var dup165 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); - - var dup166 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); - - var dup167 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); - - var dup168 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); - - var dup169 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); - - var dup170 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); - - var dup171 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); - - var dup172 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); - - var dup173 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); - - var dup174 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); - - var dup175 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); - - var dup176 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); - - var dup177 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); - - var dup178 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); - - var dup179 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); - - var dup180 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); - - var dup181 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); - - var dup182 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); - - var dup183 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); - - var dup184 = setc("eventcategory","1603020000"); - - var dup185 = setc("eventcategory","1803000000"); - - var dup186 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); - - var dup187 = setc("eventcategory","1603010000"); - - var dup188 = setc("eventcategory","1603100000"); - - var dup189 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); - - var dup190 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); - - var dup191 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); - - var dup192 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); - - var dup193 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); - - var dup194 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); - - var dup195 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); - - var dup196 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); - - var dup197 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); - - var dup198 = setc("eventcategory","1801030000"); - - var dup199 = setc("eventcategory","1302010200"); - - var dup200 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); - - var dup201 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); - - var dup202 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); - - var dup203 = setc("eventcategory","1304000000"); - - var dup204 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); - - var dup205 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); - - var dup206 = setc("eventcategory","1401030000"); - - var dup207 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); - - var dup208 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); - - var dup209 = setc("eventcategory","1605020000"); - - var dup210 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); - - var dup211 = setc("ec_subject","Certificate"); - - var dup212 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); - - var dup213 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); - - var dup214 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); - - var dup215 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); - - var dup216 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); - - var dup217 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); - - var dup218 = setc("ec_subject","CryptoKey"); - - var dup219 = setc("ec_subject","Configuration"); - - var dup220 = setc("ec_activity","Request"); - - var dup221 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); - - var dup222 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); - - var dup223 = setc("eventcategory","1612000000"); - - var dup224 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); - - var dup225 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); - - var dup226 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); - - var dup227 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); - - var dup228 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); - - var dup229 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); - - var dup230 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); - - var dup231 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); - - var dup232 = setc("eventcategory","1201000000"); - - var dup233 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); - - var dup234 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); - - var dup235 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); - - var dup236 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); - - var dup237 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); - - var dup238 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); - - var dup239 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup240 = setc("eventcategory","1401000000"); - - var dup241 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); - - var dup242 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); - - var dup243 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); - - var dup244 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); - - var dup245 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); - - var dup246 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); - - var dup247 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); - - var dup248 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); - - var dup249 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); - - var dup250 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); - - var dup251 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); - - var dup252 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); - - var dup253 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); - - var dup254 = setc("eventcategory","1608000000"); - - var dup255 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); - - var dup256 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); - - var dup257 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); - - var dup258 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); - - var dup259 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); - - var dup260 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); - - var dup261 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); - - var dup262 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); - - var dup263 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); - - var dup264 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); - - var dup265 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); - - var dup266 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var dup267 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); - - var dup268 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); - - var dup269 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); - - var dup270 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); - - var dup271 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var dup272 = setc("eventcategory","1805010000"); - - var dup273 = setc("eventcategory","1805000000"); - - var dup274 = date_time({ - dest: "starttime", - args: ["fld2"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], - ], - }); - - var dup275 = call({ - dest: "nwparser.bytes", - fn: CALC, - args: [ - field("sbytes"), - constant("+"), - field("rbytes"), - ], - }); - - var dup276 = setc("action","Deny"); - - var dup277 = setc("disposition","Deny"); - - var dup278 = setc("direction","outgoing"); - - var dup279 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("saddr"), - field("daddr"), - field("sport"), - field("dport"), - ], - }); - - var dup280 = setc("direction","incoming"); - - var dup281 = setc("eventcategory","1801000000"); - - var dup282 = setf("action","disposition"); - - var dup283 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); - - var dup284 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); - - var dup285 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); - - var dup286 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); - - var dup287 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); - - var dup288 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); - - var dup289 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); - - var dup290 = setc("eventcategory","1401050200"); - - var dup291 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("daddr"), - field("saddr"), - ], - }); - - var dup292 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("daddr"), - field("saddr"), - field("dport"), - field("sport"), - ], - }); - - var dup293 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); - - var dup294 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); - - var dup295 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); - - var dup296 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup297 = setc("eventcategory","1204000000"); - - var dup298 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var dup299 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var dup300 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); - - var dup301 = setc("eventcategory","1801020000"); - - var dup302 = setc("disposition","failed"); - - var dup303 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); - - var dup304 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); - - var dup305 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); - - var dup306 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); - - var dup307 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); - - var dup308 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); - - var dup309 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); - - var dup310 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); - - var dup311 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); - - var dup312 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); - - var dup313 = setc("eventcategory","1803020000"); - - var dup314 = setc("eventcategory","1613030000"); - - var dup315 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); - - var dup316 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); - - var dup317 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); - - var dup318 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); - - var dup319 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); - - var dup320 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); - - var dup321 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); - - var dup322 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); - - var dup323 = setc("event_description","Cannot connect to NSM server"); - - var dup324 = setc("eventcategory","1603040000"); - - var dup325 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); - - var dup326 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); - - var dup327 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); - - var dup328 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); - - var dup329 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); - - var dup330 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - - var dup331 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); - - var dup332 = call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$OUT"), - field("daddr"), - field("saddr"), - field("dport"), - field("sport"), - ], - }); - - var dup333 = linear_select([ - dup10, - dup11, - ]); - - var dup334 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup335 = linear_select([ - dup13, - dup14, - ]); - - var dup336 = linear_select([ - dup15, - dup16, - ]); - - var dup337 = linear_select([ - dup56, - dup57, - ]); - - var dup338 = linear_select([ - dup65, - dup66, - ]); - - var dup339 = linear_select([ - dup68, - dup69, - ]); - - var dup340 = linear_select([ - dup71, - dup72, - ]); - - var dup341 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var dup342 = linear_select([ - dup74, - dup75, - ]); - - var dup343 = linear_select([ - dup81, - dup82, - ]); - - var dup344 = linear_select([ - dup24, - dup90, - ]); - - var dup345 = linear_select([ - dup94, - dup95, - ]); - - var dup346 = linear_select([ - dup98, - dup99, - ]); - - var dup347 = linear_select([ - dup100, - dup101, - dup102, - ]); - - var dup348 = linear_select([ - dup113, - dup114, - ]); - - var dup349 = linear_select([ - dup111, - dup16, - ]); - - var dup350 = linear_select([ - dup127, - dup107, - ]); - - var dup351 = linear_select([ - dup8, - dup21, - ]); - - var dup352 = linear_select([ - dup122, - dup133, - ]); - - var dup353 = linear_select([ - dup142, - dup143, - ]); - - var dup354 = linear_select([ - dup145, - dup21, - ]); - - var dup355 = linear_select([ - dup127, - dup106, - ]); - - var dup356 = linear_select([ - dup152, - dup96, - ]); - - var dup357 = linear_select([ - dup154, - dup155, - ]); - - var dup358 = linear_select([ - dup156, - dup157, - ]); - - var dup359 = linear_select([ - dup99, - dup134, - ]); - - var dup360 = linear_select([ - dup158, - dup159, - ]); - - var dup361 = linear_select([ - dup161, - dup162, - ]); - - var dup362 = linear_select([ - dup163, - dup103, - ]); - - var dup363 = linear_select([ - dup162, - dup161, - ]); - - var dup364 = linear_select([ - dup46, - dup47, - ]); - - var dup365 = linear_select([ - dup166, - dup167, - ]); - - var dup366 = linear_select([ - dup172, - dup173, - ]); - - var dup367 = linear_select([ - dup174, - dup175, - dup176, - dup177, - dup178, - dup179, - dup180, - dup181, - dup182, - ]); - - var dup368 = linear_select([ - dup49, - dup21, - ]); - - var dup369 = linear_select([ - dup189, - dup190, - ]); - - var dup370 = linear_select([ - dup96, - dup152, - ]); - - var dup371 = linear_select([ - dup196, - dup197, - ]); - - var dup372 = linear_select([ - dup24, - dup200, - ]); - - var dup373 = linear_select([ - dup103, - dup163, - ]); - - var dup374 = linear_select([ - dup205, - dup118, - ]); - - var dup375 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup376 = linear_select([ - dup212, - dup213, - ]); - - var dup377 = linear_select([ - dup215, - dup216, - ]); - - var dup378 = linear_select([ - dup222, - dup215, - ]); - - var dup379 = linear_select([ - dup224, - dup225, - ]); - - var dup380 = linear_select([ - dup231, - dup124, - ]); - - var dup381 = linear_select([ - dup229, - dup230, - ]); - - var dup382 = linear_select([ - dup233, - dup234, - ]); - - var dup383 = linear_select([ - dup236, - dup237, - ]); - - var dup384 = linear_select([ - dup242, - dup243, - ]); - - var dup385 = linear_select([ - dup245, - dup246, - ]); - - var dup386 = linear_select([ - dup247, - dup248, - ]); - - var dup387 = linear_select([ - dup249, - dup250, - ]); - - var dup388 = linear_select([ - dup251, - dup252, - ]); - - var dup389 = linear_select([ - dup260, - dup261, - ]); - - var dup390 = linear_select([ - dup264, - dup265, - ]); - - var dup391 = linear_select([ - dup268, - dup269, - ]); - - var dup392 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var dup393 = linear_select([ - dup284, - dup285, - ]); - - var dup394 = linear_select([ - dup287, - dup288, - ]); - - var dup395 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup60, - ])); - - var dup396 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var dup397 = linear_select([ - dup300, - dup26, - ]); - - var dup398 = linear_select([ - dup115, - dup303, - ]); - - var dup399 = linear_select([ - dup125, - dup96, - ]); - - var dup400 = linear_select([ - dup189, - dup308, - dup309, - ]); - - var dup401 = linear_select([ - dup310, - dup16, - ]); - - var dup402 = linear_select([ - dup317, - dup318, - ]); - - var dup403 = linear_select([ - dup319, - dup315, - ]); - - var dup404 = linear_select([ - dup322, - dup250, - ]); - - var dup405 = linear_select([ - dup327, - dup329, - ]); - - var dup406 = linear_select([ - dup330, - dup129, - ]); - - var dup407 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var dup408 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup60, - ])); - - var dup409 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var dup410 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var dup411 = all_match({ - processors: [ - dup263, - dup390, - dup266, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var dup412 = all_match({ - processors: [ - dup267, - dup391, - dup270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var dup413 = all_match({ - processors: [ - dup80, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var dup414 = all_match({ - processors: [ - dup296, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var dup415 = all_match({ - processors: [ - dup298, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var hdr1 = match("HEADER#0:0001", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [No Name]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0001"), - ])); - - var hdr2 = match("HEADER#1:0003", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [%{hvsys}]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0003"), - ])); - - var hdr3 = match("HEADER#2:0004", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ - setc("header_id","0004"), - ])); - - var hdr4 = match("HEADER#3:0002/0", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} %{p0}"); - - var part1 = match("HEADER#3:0002/1_0", "nwparser.p0", "[No Name]system%{p0}"); - - var part2 = match("HEADER#3:0002/1_1", "nwparser.p0", "[%{hvsys}]system%{p0}"); - - var part3 = match("HEADER#3:0002/1_2", "nwparser.p0", "system%{p0}"); - - var select1 = linear_select([ - part1, - part2, - part3, - ]); - - var part4 = match("HEADER#3:0002/2", "nwparser.p0", "-%{hseverity}-%{messageid}: %{payload}"); - - var all1 = all_match({ - processors: [ - hdr4, - select1, - part4, - ], - on_success: processor_chain([ - setc("header_id","0002"), - ]), - }); - - var select2 = linear_select([ - hdr1, - hdr2, - hdr3, - all1, - ]); - - var part5 = match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} with ip address %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1 = msg("00001", part5); - - var part6 = match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface->} with domain name %{domain->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg2 = msg("00001:01", part6); - - var part7 = match("MESSAGE#2:00001:02/1_0", "nwparser.p0", "ip address %{hostip->} in zone %{p0}"); - - var select3 = linear_select([ - part7, - dup7, - ]); - - var part8 = match("MESSAGE#2:00001:02/2", "nwparser.p0", "%{zone->} has been %{disposition}"); - - var all2 = all_match({ - processors: [ - dup6, - select3, - part8, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg3 = msg("00001:02", all2); - - var part9 = match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface changed!", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg4 = msg("00001:03", part9); - - var part10 = match("MESSAGE#4:00001:04/1_0", "nwparser.p0", "IP address %{hostip->} in zone %{p0}"); - - var select4 = linear_select([ - part10, - dup7, - ]); - - var part11 = match("MESSAGE#4:00001:04/2", "nwparser.p0", "%{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} session%{p0}"); - - var part12 = match("MESSAGE#4:00001:04/3_1", "nwparser.p0", ".%{fld1}"); - - var select5 = linear_select([ - dup8, - part12, - ]); - - var all3 = all_match({ - processors: [ - dup6, - select4, - part11, - select5, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg5 = msg("00001:04", all3); - - var part13 = match("MESSAGE#5:00001:05/0", "nwparser.payload", "%{fld2}: Address %{group_object->} for ip address %{hostip->} in zone %{zone->} has been %{disposition->} from host %{saddr->} session %{p0}"); - - var all4 = all_match({ - processors: [ - part13, - dup333, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg6 = msg("00001:05", all4); - - var part14 = match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg7 = msg("00001:06", part14); - - var msg8 = msg("00001:07", dup334); - - var part15 = match("MESSAGE#8:00001:08/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{p0}"); - - var part16 = match("MESSAGE#8:00001:08/4", "nwparser.p0", "%{} %{username}via NSRP Peer session. (%{fld1})"); - - var all5 = all_match({ - processors: [ - dup12, - dup335, - part15, - dup336, - part16, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg9 = msg("00001:08", all5); - - var part17 = match("MESSAGE#9:00001:09/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} session. (%{fld1})"); - - var all6 = all_match({ - processors: [ - dup12, - dup335, - part17, - ], - on_success: processor_chain([ - dup1, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg10 = msg("00001:09", all6); - - var select6 = linear_select([ - msg1, - msg2, - msg3, - msg4, - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - ]); - - var part18 = match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg11 = msg("00002:03", part18); - - var part19 = match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg12 = msg("00002:04", part19); - - var part20 = match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg13 = msg("00002:05", part20); - - var part21 = match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with e-mail notification of event alarms has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg14 = msg("00002:06", part21); - - var part22 = match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action->} and the LCD control keys have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg15 = msg("00002:07", part22); - - var part23 = match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{fld2->} is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg16 = msg("00002:55", part23); - - var part24 = match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg17 = msg("00002:08", part24); - - var part25 = match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg18 = msg("00002:09", part25); - - var part26 = match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg19 = msg("00002:10", part26); - - var part27 = match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg20 = msg("00002:11", part27); - - var part28 = match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg21 = msg("00002:12", part28); - - var part29 = match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been %{disposition}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg22 = msg("00002:15", part29); - - var msg23 = msg("00002:17", dup334); - - var part30 = match("MESSAGE#23:00002:18/0", "nwparser.payload", "Unexpected error from e%{p0}"); - - var part31 = match("MESSAGE#23:00002:18/1_0", "nwparser.p0", "-mail %{p0}"); - - var part32 = match("MESSAGE#23:00002:18/1_1", "nwparser.p0", "mail %{p0}"); - - var select7 = linear_select([ - part31, - part32, - ]); - - var part33 = match("MESSAGE#23:00002:18/2", "nwparser.p0", "server(%{fld2}):"); - - var all7 = all_match({ - processors: [ - part30, - select7, - part33, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg24 = msg("00002:18", all7); - - var part34 = match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute->} value has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg25 = msg("00002:19", part34); - - var part35 = match("MESSAGE#25:00002:20/0", "nwparser.payload", "Root admin password restriction of minimum %{fld2->} characters has been %{disposition->} by admin %{administrator->} %{p0}"); - - var part36 = match("MESSAGE#25:00002:20/1_0", "nwparser.p0", "from Console %{}"); - - var select8 = linear_select([ - part36, - dup20, - dup21, - ]); - - var all8 = all_match({ - processors: [ - part35, - select8, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg26 = msg("00002:20", all8); - - var part37 = match("MESSAGE#26:00002:21/0_0", "nwparser.payload", "Root admin %{p0}"); - - var part38 = match("MESSAGE#26:00002:21/0_1", "nwparser.payload", "%{fld2->} admin %{p0}"); - - var select9 = linear_select([ - part37, - part38, - ]); - - var select10 = linear_select([ - dup24, - dup25, - ]); - - var part39 = match("MESSAGE#26:00002:21/3", "nwparser.p0", "has been changed by admin %{administrator}"); - - var all9 = all_match({ - processors: [ - select9, - dup23, - select10, - part39, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg27 = msg("00002:21", all9); - - var part40 = match("MESSAGE#27:00002:22/0", "nwparser.payload", "%{change_attribute->} from %{protocol->} before administrative session disconnects has been changed from %{change_old->} to %{change_new->} by admin %{p0}"); - - var part41 = match("MESSAGE#27:00002:22/1_0", "nwparser.p0", "%{administrator->} from Console"); - - var part42 = match("MESSAGE#27:00002:22/1_1", "nwparser.p0", "%{administrator->} from host %{saddr}"); - - var select11 = linear_select([ - part41, - part42, - dup26, - ]); - - var all10 = all_match({ - processors: [ - part40, - select11, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg28 = msg("00002:22", all10); - - var part43 = match("MESSAGE#28:00002:23/0", "nwparser.payload", "Root admin access restriction through console only has been %{disposition->} by admin %{administrator->} %{p0}"); - - var part44 = match("MESSAGE#28:00002:23/1_1", "nwparser.p0", "from Console%{}"); - - var select12 = linear_select([ - dup20, - part44, - dup21, - ]); - - var all11 = all_match({ - processors: [ - part43, - select12, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg29 = msg("00002:23", all11); - - var part45 = match("MESSAGE#29:00002:24/0", "nwparser.payload", "Admin access restriction of %{protocol->} administration through tunnel only has been %{disposition->} by admin %{administrator->} from %{p0}"); - - var part46 = match("MESSAGE#29:00002:24/1_0", "nwparser.p0", "host %{saddr}"); - - var part47 = match("MESSAGE#29:00002:24/1_1", "nwparser.p0", "Console%{}"); - - var select13 = linear_select([ - part46, - part47, - ]); - - var all12 = all_match({ - processors: [ - part45, - select13, - ], - on_success: processor_chain([ - dup22, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg30 = msg("00002:24", all12); - - var part48 = match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of an %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - setc("eventcategory","1402000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg31 = msg("00002:25", part48); - - var part49 = match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail server %{hostip}.", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg32 = msg("00002:26", part49); - - var part50 = match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg33 = msg("00002:27", part50); - - var part51 = match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not configured.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg34 = msg("00002:28", part51); - - var part52 = match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restriction for read-write administrators has been %{disposition->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg35 = msg("00002:29", part52); - - var part53 = match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ - dup28, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg36 = msg("00002:30", part53); - - var part54 = match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ - dup33, - dup29, - dup34, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg37 = msg("00002:41", part54); - - var part55 = match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} %{space->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup35, - dup29, - dup30, - dup31, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg38 = msg("00002:31", part55); - - var part56 = match("MESSAGE#38:00002:32/0_0", "nwparser.payload", "E-mail notification %{p0}"); - - var part57 = match("MESSAGE#38:00002:32/0_1", "nwparser.payload", "Transparent virutal %{p0}"); - - var select14 = linear_select([ - part56, - part57, - ]); - - var part58 = match("MESSAGE#38:00002:32/1", "nwparser.p0", "wire mode has been %{disposition}"); - - var all13 = all_match({ - processors: [ - select14, - part58, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg39 = msg("00002:32", all13); - - var part59 = match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has been %{disposition->} for zone %{zone}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg40 = msg("00002:35", part59); - - var part60 = match("MESSAGE#40:00002:36/0", "nwparser.payload", "Bypass%{p0}"); - - var part61 = match("MESSAGE#40:00002:36/1_0", "nwparser.p0", "-others-IPSec %{p0}"); - - var part62 = match("MESSAGE#40:00002:36/1_1", "nwparser.p0", " non-IP traffic %{p0}"); - - var select15 = linear_select([ - part61, - part62, - ]); - - var part63 = match("MESSAGE#40:00002:36/2", "nwparser.p0", "option has been %{disposition}"); - - var all14 = all_match({ - processors: [ - part60, - select15, - part63, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg41 = msg("00002:36", all14); - - var part64 = match("MESSAGE#41:00002:37/0", "nwparser.payload", "Logging of %{p0}"); - - var part65 = match("MESSAGE#41:00002:37/1_0", "nwparser.p0", "dropped %{p0}"); - - var part66 = match("MESSAGE#41:00002:37/1_1", "nwparser.p0", "IKE %{p0}"); - - var part67 = match("MESSAGE#41:00002:37/1_2", "nwparser.p0", "SNMP %{p0}"); - - var part68 = match("MESSAGE#41:00002:37/1_3", "nwparser.p0", "ICMP %{p0}"); - - var select16 = linear_select([ - part65, - part66, - part67, - part68, - ]); - - var part69 = match("MESSAGE#41:00002:37/2", "nwparser.p0", "traffic to self has been %{disposition}"); - - var all15 = all_match({ - processors: [ - part64, - select16, - part69, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg42 = msg("00002:37", all15); - - var part70 = match("MESSAGE#42:00002:38/0", "nwparser.payload", "Logging of dropped traffic to self (excluding multicast) has been %{p0}"); - - var part71 = match("MESSAGE#42:00002:38/1_0", "nwparser.p0", "%{disposition->} on %{zone}"); - - var select17 = linear_select([ - part71, - dup36, - ]); - - var all16 = all_match({ - processors: [ - part70, - select17, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg43 = msg("00002:38", all16); - - var part72 = match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg44 = msg("00002:39", part72); - - var part73 = match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{username}' by %{administrator->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ - dup37, - dup29, - setc("ec_activity","Create"), - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg45 = msg("00002:40", part73); - - var part74 = match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requested for unknown user %{username}. Possible HA syncronization problem.", processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg46 = msg("00002:44", part74); - - var part75 = match("MESSAGE#46:00002:42/0", "nwparser.payload", "%{change_attribute->} for account '%{change_old}' has been %{disposition->} to '%{change_new}' %{p0}"); - - var part76 = match("MESSAGE#46:00002:42/1_0", "nwparser.p0", "by %{administrator->} via %{p0}"); - - var select18 = linear_select([ - part76, - dup40, - ]); - - var part77 = match("MESSAGE#46:00002:42/2", "nwparser.p0", "%{logon_type->} from host %{p0}"); - - var part78 = match("MESSAGE#46:00002:42/3_0", "nwparser.p0", "%{saddr->} to %{daddr}:%{dport->} (%{p0}"); - - var part79 = match("MESSAGE#46:00002:42/3_1", "nwparser.p0", "%{saddr}:%{sport->} (%{p0}"); - - var select19 = linear_select([ - part78, - part79, - ]); - - var all17 = all_match({ - processors: [ - part75, - select18, - part77, - select19, - dup41, - ], - on_success: processor_chain([ - dup42, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg47 = msg("00002:42", all17); - - var part80 = match("MESSAGE#47:00002:43/0", "nwparser.payload", "Admin account %{disposition->} for %{p0}"); - - var part81 = match("MESSAGE#47:00002:43/1_0", "nwparser.p0", "'%{username}'%{p0}"); - - var part82 = match("MESSAGE#47:00002:43/1_1", "nwparser.p0", "\"%{username}\"%{p0}"); - - var select20 = linear_select([ - part81, - part82, - ]); - - var part83 = match("MESSAGE#47:00002:43/2", "nwparser.p0", "%{}by %{administrator->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all18 = all_match({ - processors: [ - part80, - select20, - part83, - ], - on_success: processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg48 = msg("00002:43", all18); - - var part84 = match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg49 = msg("00002:50", part84); - - var part85 = match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} %{fld2->} via %{logon_type->} (%{fld1})", processor_chain([ - dup42, - dup29, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg50 = msg("00002:51", part85); - - var part86 = match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg51 = msg("00002:45", part86); - - var part87 = match("MESSAGE#51:00002:47/0_0", "nwparser.payload", "Ping of Death attack protection %{p0}"); - - var part88 = match("MESSAGE#51:00002:47/0_1", "nwparser.payload", "Src Route IP option filtering %{p0}"); - - var part89 = match("MESSAGE#51:00002:47/0_2", "nwparser.payload", "Teardrop attack protection %{p0}"); - - var part90 = match("MESSAGE#51:00002:47/0_3", "nwparser.payload", "Land attack protection %{p0}"); - - var part91 = match("MESSAGE#51:00002:47/0_4", "nwparser.payload", "SYN flood protection %{p0}"); - - var select21 = linear_select([ - part87, - part88, - part89, - part90, - part91, - ]); - - var part92 = match("MESSAGE#51:00002:47/1", "nwparser.p0", "is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})"); - - var all19 = all_match({ - processors: [ - select21, - part92, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg52 = msg("00002:47", all19); - - var part93 = match("MESSAGE#52:00002:48/0", "nwparser.payload", "Dropping pkts if not %{p0}"); - - var part94 = match("MESSAGE#52:00002:48/1_0", "nwparser.p0", "exactly same with incoming if %{p0}"); - - var part95 = match("MESSAGE#52:00002:48/1_1", "nwparser.p0", "in route table %{p0}"); - - var select22 = linear_select([ - part94, - part95, - ]); - - var part96 = match("MESSAGE#52:00002:48/2", "nwparser.p0", "(IP spoof protection) is %{disposition->} on zone %{zone->} by %{username->} via %{p0}"); - - var part97 = match("MESSAGE#52:00002:48/3_0", "nwparser.p0", "NSRP Peer. (%{p0}"); - - var select23 = linear_select([ - part97, - dup45, - ]); - - var all20 = all_match({ - processors: [ - part93, - select22, - part96, - select23, - dup41, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg53 = msg("00002:48", all20); - - var part98 = match("MESSAGE#53:00002:52/0", "nwparser.payload", "%{signame->} %{p0}"); - - var part99 = match("MESSAGE#53:00002:52/1_0", "nwparser.p0", "protection%{p0}"); - - var part100 = match("MESSAGE#53:00002:52/1_1", "nwparser.p0", "limiting%{p0}"); - - var part101 = match("MESSAGE#53:00002:52/1_2", "nwparser.p0", "detection%{p0}"); - - var part102 = match("MESSAGE#53:00002:52/1_3", "nwparser.p0", "filtering %{p0}"); - - var select24 = linear_select([ - part99, - part100, - part101, - part102, - ]); - - var part103 = match("MESSAGE#53:00002:52/2", "nwparser.p0", "%{}is %{disposition->} on zone %{zone->} by %{p0}"); - - var part104 = match("MESSAGE#53:00002:52/3_1", "nwparser.p0", "admin via %{p0}"); - - var select25 = linear_select([ - dup46, - part104, - dup47, - ]); - - var select26 = linear_select([ - dup48, - dup45, - ]); - - var all21 = all_match({ - processors: [ - part98, - select24, - part103, - select25, - select26, - dup41, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg54 = msg("00002:52", all21); - - var part105 = match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"%{username}\" has been %{disposition->} by %{administrator->} via %{logon_type->} (%{fld1})", processor_chain([ - dup42, - dup43, - dup38, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg55 = msg("00002:53", part105); - - var part106 = match("MESSAGE#55:00002:54/0", "nwparser.payload", "Traffic shaping clearing DSCP selector is turned O%{p0}"); - - var part107 = match("MESSAGE#55:00002:54/1_0", "nwparser.p0", "FF%{p0}"); - - var part108 = match("MESSAGE#55:00002:54/1_1", "nwparser.p0", "N%{p0}"); - - var select27 = linear_select([ - part107, - part108, - ]); - - var all22 = all_match({ - processors: [ - part106, - select27, - dup49, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg56 = msg("00002:54", all22); - - var part109 = match("MESSAGE#56:00002/0", "nwparser.payload", "%{change_attribute->} %{p0}"); - - var part110 = match("MESSAGE#56:00002/1_0", "nwparser.p0", "has been changed%{p0}"); - - var select28 = linear_select([ - part110, - dup52, - ]); - - var part111 = match("MESSAGE#56:00002/2", "nwparser.p0", "%{}from %{change_old->} to %{change_new}"); - - var all23 = all_match({ - processors: [ - part109, - select28, - part111, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg57 = msg("00002", all23); - - var part112 = match("MESSAGE#1215:00002:56", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed. (%{fld1})", processor_chain([ - dup53, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg58 = msg("00002:56", part112); - - var select29 = linear_select([ - msg11, - msg12, - msg13, - msg14, - msg15, - msg16, - msg17, - msg18, - msg19, - msg20, - msg21, - msg22, - msg23, - msg24, - msg25, - msg26, - msg27, - msg28, - msg29, - msg30, - msg31, - msg32, - msg33, - msg34, - msg35, - msg36, - msg37, - msg38, - msg39, - msg40, - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - msg50, - msg51, - msg52, - msg53, - msg54, - msg55, - msg56, - msg57, - msg58, - ]); - - var part113 = match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup53, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg59 = msg("00003", part113); - - var part114 = match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failures have been detected!%{}", processor_chain([ - dup53, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg60 = msg("00003:01", part114); - - var part115 = match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg61 = msg("00003:02", part115); - - var part116 = match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed from %{change_old->} to %{change_new}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg62 = msg("00003:03", part116); - - var part117 = match("MESSAGE#61:00003:05/1_0", "nwparser.p0", "serial%{p0}"); - - var part118 = match("MESSAGE#61:00003:05/1_1", "nwparser.p0", "local%{p0}"); - - var select30 = linear_select([ - part117, - part118, - ]); - - var part119 = match("MESSAGE#61:00003:05/2", "nwparser.p0", "%{}console has been %{disposition->} by admin %{administrator}."); - - var all24 = all_match({ - processors: [ - dup55, - select30, - part119, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg63 = msg("00003:05", all24); - - var select31 = linear_select([ - msg59, - msg60, - msg61, - msg62, - msg63, - ]); - - var part120 = match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been changed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg64 = msg("00004", part120); - - var part121 = match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg65 = msg("00004:01", part121); - - var part122 = match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg66 = msg("00004:02", part122); - - var part123 = match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg67 = msg("00004:03", part123); - - var part124 = match("MESSAGE#66:00004:04/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on %{p0}"); - - var part125 = match("MESSAGE#66:00004:04/2", "nwparser.p0", "%{} %{interface->} %{space}The attack occurred %{dclass_counter1->} times"); - - var all25 = all_match({ - processors: [ - part124, - dup337, - part125, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup59, - dup3, - dup60, - ]), - }); - - var msg68 = msg("00004:04", all25); - - var part126 = match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol}", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg69 = msg("00004:05", part126); - - var part127 = match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been changed to start at %{fld2}:%{fld3->} with an interval of %{fld4}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg70 = msg("00004:06", part127); - - var part128 = match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have been refreshed as result of external event.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg71 = msg("00004:07", part128); - - var part129 = match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg72 = msg("00004:08", part129); - - var part130 = match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more concurrent client requests than allowed.%{}", processor_chain([ - dup62, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg73 = msg("00004:09", part130); - - var part131 = match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table entries exceeded maximum limit.%{}", processor_chain([ - dup62, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg74 = msg("00004:10", part131); - - var part132 = match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table added with domain %{domain}, interface %{interface}, primary-ip %{fld2}, secondary-ip %{fld3}, tertiary-ip %{fld4}, failover %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg75 = msg("00004:11", part132); - - var part133 = match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table entry %{disposition->} with domain %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg76 = msg("00004:12", part133); - - var part134 = match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} returned incorrect ip %{fld2}, local-ip should be %{fld3}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg77 = msg("00004:13", part134); - - var part135 = match("MESSAGE#76:00004:14/1_0", "nwparser.p0", "automatically refreshed %{p0}"); - - var part136 = match("MESSAGE#76:00004:14/1_1", "nwparser.p0", "refreshed by HA %{p0}"); - - var select32 = linear_select([ - part135, - part136, - ]); - - var all26 = all_match({ - processors: [ - dup63, - select32, - dup49, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg78 = msg("00004:14", all26); - - var part137 = match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshed as result of DNS server address change. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg79 = msg("00004:15", part137); - - var part138 = match("MESSAGE#78:00004:16", "nwparser.payload", "DNS entries have been manually refreshed. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg80 = msg("00004:16", part138); - - var all27 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup9, - dup5, - dup3, - dup60, - ]), - }); - - var msg81 = msg("00004:17", all27); - - var select33 = linear_select([ - msg64, - msg65, - msg66, - msg67, - msg68, - msg69, - msg70, - msg71, - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - ]); - - var part139 = match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from the same source has been changed to %{trigger_val}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg82 = msg("00005", part139); - - var part140 = match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic to self has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg83 = msg("00005:01", part140); - - var part141 = match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been changed to %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg84 = msg("00005:02", part141); - - var part142 = match("MESSAGE#83:00005:03/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); - - var part143 = match("MESSAGE#83:00005:03/4", "nwparser.p0", "%{fld99}interface %{interface->} %{p0}"); - - var part144 = match("MESSAGE#83:00005:03/5_0", "nwparser.p0", "in zone %{zone}. %{p0}"); - - var select34 = linear_select([ - part144, - dup73, - ]); - - var part145 = match("MESSAGE#83:00005:03/6", "nwparser.p0", "%{space}The attack occurred %{dclass_counter1->} times"); - - var all28 = all_match({ - processors: [ - part142, - dup339, - dup70, - dup340, - part143, - select34, - part145, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ]), - }); - - var msg85 = msg("00005:03", all28); - - var msg86 = msg("00005:04", dup341); - - var part146 = match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2->} mode when receiving unknown dst mac has been %{disposition->} on %{zone}.", processor_chain([ - setc("eventcategory","1001020100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg87 = msg("00005:05", part146); - - var part147 = match("MESSAGE#86:00005:06/1", "nwparser.p0", "flood timeout has been set to %{trigger_val->} on %{zone}."); - - var all29 = all_match({ - processors: [ - dup342, - part147, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg88 = msg("00005:06", all29); - - var part148 = match("MESSAGE#87:00005:07/0", "nwparser.payload", "SYN flood %{p0}"); - - var part149 = match("MESSAGE#87:00005:07/1_0", "nwparser.p0", "alarm threshold %{p0}"); - - var part150 = match("MESSAGE#87:00005:07/1_1", "nwparser.p0", "packet queue size %{p0}"); - - var part151 = match("MESSAGE#87:00005:07/1_3", "nwparser.p0", "attack threshold %{p0}"); - - var part152 = match("MESSAGE#87:00005:07/1_4", "nwparser.p0", "same source IP threshold %{p0}"); - - var select35 = linear_select([ - part149, - part150, - dup76, - part151, - part152, - ]); - - var part153 = match("MESSAGE#87:00005:07/2", "nwparser.p0", "is set to %{trigger_val}."); - - var all30 = all_match({ - processors: [ - part148, - select35, - part153, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg89 = msg("00005:07", all30); - - var part154 = match("MESSAGE#88:00005:08/1", "nwparser.p0", "flood same %{p0}"); - - var select36 = linear_select([ - dup77, - dup78, - ]); - - var part155 = match("MESSAGE#88:00005:08/3", "nwparser.p0", "ip threshold has been set to %{trigger_val->} on %{zone}."); - - var all31 = all_match({ - processors: [ - dup342, - part154, - select36, - part155, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg90 = msg("00005:08", all31); - - var part156 = match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is %{disposition->} on interface %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg91 = msg("00005:09", part156); - - var part157 = match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is %{disposition->} on %{zone}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg92 = msg("00005:10", part157); - - var part158 = match("MESSAGE#91:00005:11/0", "nwparser.payload", "The SYN flood %{p0}"); - - var part159 = match("MESSAGE#91:00005:11/1_0", "nwparser.p0", "alarm threshold%{}"); - - var part160 = match("MESSAGE#91:00005:11/1_1", "nwparser.p0", "packet queue size%{}"); - - var part161 = match("MESSAGE#91:00005:11/1_2", "nwparser.p0", "timeout value%{}"); - - var part162 = match("MESSAGE#91:00005:11/1_3", "nwparser.p0", "attack threshold%{}"); - - var part163 = match("MESSAGE#91:00005:11/1_4", "nwparser.p0", "same source IP%{}"); - - var select37 = linear_select([ - part159, - part160, - part161, - part162, - part163, - ]); - - var all32 = all_match({ - processors: [ - part158, - select37, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg93 = msg("00005:11", all32); - - var part164 = match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshold value has been set to %{trigger_val->} on %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg94 = msg("00005:12", part164); - - var part165 = match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg95 = msg("00005:13", part165); - - var part166 = match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unknown mac!%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg96 = msg("00005:14", part166); - - var part167 = match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold has been changed to %{trigger_val}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg97 = msg("00005:15", part167); - - var part168 = match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg98 = msg("00005:16", part168); - - var part169 = match("MESSAGE#97:00005:17/1_0", "nwparser.p0", "destination-based %{p0}"); - - var part170 = match("MESSAGE#97:00005:17/1_1", "nwparser.p0", "source-based %{p0}"); - - var select38 = linear_select([ - part169, - part170, - ]); - - var part171 = match("MESSAGE#97:00005:17/2", "nwparser.p0", "session-limit threshold has been set at %{trigger_val->} in zone %{zone}."); - - var all33 = all_match({ - processors: [ - dup79, - select38, - part171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg99 = msg("00005:17", all33); - - var all34 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg100 = msg("00005:18", all34); - - var part172 = match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup84, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg101 = msg("00005:19", part172); - - var part173 = match("MESSAGE#100:00005:20", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} int %{interface}).%{space->} Occurred %{fld2->} times. (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup84, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg102 = msg("00005:20", part173); - - var select39 = linear_select([ - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - msg88, - msg89, - msg90, - msg91, - msg92, - msg93, - msg94, - msg95, - msg96, - msg97, - msg98, - msg99, - msg100, - msg101, - msg102, - ]); - - var part174 = match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg103 = msg("00006", part174); - - var part175 = match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname}\"", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg104 = msg("00006:01", part175); - - var part176 = match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg105 = msg("00006:02", part176); - - var part177 = match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg106 = msg("00006:03", part177); - - var part178 = match("MESSAGE#105:00006:04/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var all35 = all_match({ - processors: [ - part178, - dup338, - dup67, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg107 = msg("00006:04", all35); - - var all36 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup84, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg108 = msg("00006:05", all36); - - var select40 = linear_select([ - msg103, - msg104, - msg105, - msg106, - msg107, - msg108, - ]); - - var part179 = match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg109 = msg("00007", part179); - - var part180 = match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the local NetScreen device has changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg110 = msg("00007:01", part180); - - var part181 = match("MESSAGE#109:00007:02/0", "nwparser.payload", "HA state of the local device has changed to backup because a device with a %{p0}"); - - var part182 = match("MESSAGE#109:00007:02/1_0", "nwparser.p0", "higher priority has been detected%{}"); - - var part183 = match("MESSAGE#109:00007:02/1_1", "nwparser.p0", "lower MAC value has been detected%{}"); - - var select41 = linear_select([ - part182, - part183, - ]); - - var all37 = all_match({ - processors: [ - part181, - select41, - ], - on_success: processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg111 = msg("00007:02", all37); - - var part184 = match("MESSAGE#110:00007:03", "nwparser.payload", "HA state of the local device has changed to init because IP tracking has failed%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg112 = msg("00007:03", part184); - - var select42 = linear_select([ - dup88, - dup89, - ]); - - var part185 = match("MESSAGE#111:00007:04/4", "nwparser.p0", "has been changed%{}"); - - var all38 = all_match({ - processors: [ - dup87, - select42, - dup23, - dup344, - part185, - ], - on_success: processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg113 = msg("00007:04", all38); - - var part186 = match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device has been elected backup because a master already exists%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg114 = msg("00007:05", part186); - - var part187 = match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg115 = msg("00007:06", part187); - - var part188 = match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg116 = msg("00007:07", part188); - - var part189 = match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been elected master because no other master exists%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg117 = msg("00007:08", part189); - - var part190 = match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg118 = msg("00007:09", part190); - - var part191 = match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promoted the local NetScreen device to master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg119 = msg("00007:10", part191); - - var part192 = match("MESSAGE#118:00007:11/0", "nwparser.payload", "IP tracking device failover threshold has been %{p0}"); - - var select43 = linear_select([ - dup92, - dup93, - ]); - - var all39 = all_match({ - processors: [ - part192, - select43, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg120 = msg("00007:11", all39); - - var part193 = match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg121 = msg("00007:12", part193); - - var part194 = match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} with interval %{fld2->} threshold %{trigger_val->} weight %{fld4->} interface %{interface->} method %{fld5->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg122 = msg("00007:13", part194); - - var part195 = match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup60, - ])); - - var msg123 = msg("00007:14", part195); - - var part196 = match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been changed to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg124 = msg("00007:15", part196); - - var part197 = match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration and status changes to NetScreen-Global Manager has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg125 = msg("00007:16", part197); - - var part198 = match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg126 = msg("00007:17", part198); - - var part199 = match("MESSAGE#125:00007:18/0", "nwparser.payload", "Tracked IP %{hostip->} options have been changed from int %{fld2->} thr %{fld3->} wgt %{fld4->} inf %{fld5->} %{p0}"); - - var part200 = match("MESSAGE#125:00007:18/1_0", "nwparser.p0", "ping %{p0}"); - - var part201 = match("MESSAGE#125:00007:18/1_1", "nwparser.p0", "ARP %{p0}"); - - var select44 = linear_select([ - part200, - part201, - ]); - - var part202 = match("MESSAGE#125:00007:18/2", "nwparser.p0", "to %{fld6->} %{p0}"); - - var part203 = match("MESSAGE#125:00007:18/3_0", "nwparser.p0", "ping%{}"); - - var part204 = match("MESSAGE#125:00007:18/3_1", "nwparser.p0", "ARP%{}"); - - var select45 = linear_select([ - part203, - part204, - ]); - - var all40 = all_match({ - processors: [ - part199, - select44, - part202, - select45, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg127 = msg("00007:18", all40); - - var part205 = match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} path from %{change_old->} to %{change_new}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg128 = msg("00007:20", part205); - - var part206 = match("MESSAGE#127:00007:21/0", "nwparser.payload", "HA Slave is %{p0}"); - - var all41 = all_match({ - processors: [ - part206, - dup345, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg129 = msg("00007:21", all41); - - var part207 = match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{groupid}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg130 = msg("00007:22", part207); - - var part208 = match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg131 = msg("00007:23", part208); - - var part209 = match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg132 = msg("00007:24", part209); - - var part210 = match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial state.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg133 = msg("00007:25", part210); - - var part211 = match("MESSAGE#132:00007:26/0", "nwparser.payload", "HA: Change state to slave for %{p0}"); - - var part212 = match("MESSAGE#132:00007:26/1_0", "nwparser.p0", "tracking ip failed%{}"); - - var part213 = match("MESSAGE#132:00007:26/1_1", "nwparser.p0", "linkdown%{}"); - - var select46 = linear_select([ - part212, - part213, - ]); - - var all42 = all_match({ - processors: [ - part211, - select46, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg134 = msg("00007:26", all42); - - var part214 = match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command issued from original master to change state%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg135 = msg("00007:27", part214); - - var part215 = match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg136 = msg("00007:28", part215); - - var part216 = match("MESSAGE#135:00007:29/0", "nwparser.payload", "HA: Elected slave %{p0}"); - - var part217 = match("MESSAGE#135:00007:29/1_0", "nwparser.p0", "lower priority%{}"); - - var part218 = match("MESSAGE#135:00007:29/1_1", "nwparser.p0", "MAC value is larger%{}"); - - var part219 = match("MESSAGE#135:00007:29/1_2", "nwparser.p0", "master already exists%{}"); - - var part220 = match("MESSAGE#135:00007:29/1_3", "nwparser.p0", "detect new master with higher priority%{}"); - - var part221 = match("MESSAGE#135:00007:29/1_4", "nwparser.p0", "detect new master with smaller MAC value%{}"); - - var select47 = linear_select([ - part217, - part218, - part219, - part220, - part221, - ]); - - var all43 = all_match({ - processors: [ - part216, - select47, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg137 = msg("00007:29", all43); - - var part222 = match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command issued from original master to change state%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg138 = msg("00007:30", part222); - - var part223 = match("MESSAGE#137:00007:31/0", "nwparser.payload", "HA: ha link %{p0}"); - - var all44 = all_match({ - processors: [ - part223, - dup345, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg139 = msg("00007:31", all44); - - var part224 = match("MESSAGE#138:00007:32/0", "nwparser.payload", "NSRP %{fld2->} %{p0}"); - - var select48 = linear_select([ - dup89, - dup88, - ]); - - var part225 = match("MESSAGE#138:00007:32/4", "nwparser.p0", "changed.%{}"); - - var all45 = all_match({ - processors: [ - part224, - select48, - dup23, - dup344, - part225, - ], - on_success: processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg140 = msg("00007:32", all45); - - var part226 = match("MESSAGE#139:00007:33/0_0", "nwparser.payload", "NSRP: VSD %{p0}"); - - var part227 = match("MESSAGE#139:00007:33/0_1", "nwparser.payload", "Virtual Security Device group %{p0}"); - - var select49 = linear_select([ - part226, - part227, - ]); - - var part228 = match("MESSAGE#139:00007:33/1", "nwparser.p0", "%{fld2->} change%{p0}"); - - var part229 = match("MESSAGE#139:00007:33/2_0", "nwparser.p0", "d %{p0}"); - - var select50 = linear_select([ - part229, - dup96, - ]); - - var part230 = match("MESSAGE#139:00007:33/3", "nwparser.p0", "to %{fld3->} mode."); - - var all46 = all_match({ - processors: [ - select49, - part228, - select50, - part230, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg141 = msg("00007:33", all46); - - var part231 = match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropped: invalid encryption password.", processor_chain([ - dup97, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg142 = msg("00007:34", part231); - - var part232 = match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change to %{interface}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg143 = msg("00007:35", part232); - - var part233 = match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} local unit=%{fld3->} duplicate from unit=%{fld4}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg144 = msg("00007:36", part233); - - var part234 = match("MESSAGE#143:00007:37/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} is %{p0}"); - - var all47 = all_match({ - processors: [ - part234, - dup346, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg145 = msg("00007:37", all47); - - var part235 = match("MESSAGE#144:00007:38/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} peer=%{fld3->} from %{p0}"); - - var part236 = match("MESSAGE#144:00007:38/4", "nwparser.p0", "state %{p0}"); - - var part237 = match("MESSAGE#144:00007:38/5_0", "nwparser.p0", "missed heartbeat%{}"); - - var part238 = match("MESSAGE#144:00007:38/5_1", "nwparser.p0", "group detached%{}"); - - var select51 = linear_select([ - part237, - part238, - ]); - - var all48 = all_match({ - processors: [ - part235, - dup347, - dup103, - dup347, - part236, - select51, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg146 = msg("00007:38", all48); - - var part239 = match("MESSAGE#145:00007:39/0", "nwparser.payload", "RTO mirror group id=%{groupid->} is %{p0}"); - - var all49 = all_match({ - processors: [ - part239, - dup346, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg147 = msg("00007:39", all49); - - var part240 = match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (ifnum=%{fld3}) as secondary HA path", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg148 = msg("00007:40", part240); - - var part241 = match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg149 = msg("00007:41", part241); - - var part242 = match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fld2->} (ifnum=%{fld3})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg150 = msg("00007:42", part242); - - var part243 = match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg151 = msg("00007:43", part243); - - var part244 = match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is %{disposition->} total number=%{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg152 = msg("00007:44", part244); - - var part245 = match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local unit %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg153 = msg("00007:45", part245); - - var part246 = match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup85, - dup2, - dup3, - dup4, - dup59, - dup5, - dup60, - ])); - - var msg154 = msg("00007:46", part246); - - var part247 = match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg155 = msg("00007:47", part247); - - var part248 = match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped because it contained an invalid encryption password.", processor_chain([ - dup97, - dup2, - dup3, - dup4, - setc("disposition","dropped"), - setc("result","Invalid encryption Password"), - ])); - - var msg156 = msg("00007:48", part248); - - var part249 = match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of all Virtual Security Device groups changed from %{change_old->} to %{change_new}", processor_chain([ - setc("eventcategory","1604000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg157 = msg("00007:49", part249); - - var part250 = match("MESSAGE#156:00007:50/0", "nwparser.payload", "Device %{fld2->} %{p0}"); - - var part251 = match("MESSAGE#156:00007:50/1_0", "nwparser.p0", "has joined %{p0}"); - - var part252 = match("MESSAGE#156:00007:50/1_1", "nwparser.p0", "quit current %{p0}"); - - var select52 = linear_select([ - part251, - part252, - ]); - - var part253 = match("MESSAGE#156:00007:50/2", "nwparser.p0", "NSRP cluster %{fld3}"); - - var all50 = all_match({ - processors: [ - part250, - select52, - part253, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg158 = msg("00007:50", all50); - - var part254 = match("MESSAGE#157:00007:51/0", "nwparser.payload", "Virtual Security Device group %{group->} was %{p0}"); - - var part255 = match("MESSAGE#157:00007:51/1_1", "nwparser.p0", "deleted %{p0}"); - - var select53 = linear_select([ - dup104, - part255, - ]); - - var select54 = linear_select([ - dup105, - dup73, - ]); - - var part256 = match("MESSAGE#157:00007:51/4", "nwparser.p0", "The total number of members in the group %{p0}"); - - var select55 = linear_select([ - dup106, - dup107, - ]); - - var all51 = all_match({ - processors: [ - part254, - select53, - dup23, - select54, - part256, - select55, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg159 = msg("00007:51", all51); - - var part257 = match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group %{group->} %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg160 = msg("00007:52", part257); - - var part258 = match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the devices was set to interface %{interface->} with ifnum %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg161 = msg("00007:53", part258); - - var part259 = match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of the devices changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg162 = msg("00007:54", part259); - - var part260 = match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} with ifnum %{fld2->} was removed from the secondary HA path of the devices.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg163 = msg("00007:55", part260); - - var part261 = match("MESSAGE#162:00007:56", "nwparser.payload", "The probe that detects the status of High Availability link %{fld2->} was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg164 = msg("00007:56", part261); - - var select56 = linear_select([ - dup109, - dup110, - ]); - - var select57 = linear_select([ - dup111, - dup112, - ]); - - var part262 = match("MESSAGE#163:00007:57/4", "nwparser.p0", "the probe detecting the status of High Availability link %{fld2->} was set to %{fld3}"); - - var all52 = all_match({ - processors: [ - dup55, - select56, - dup23, - select57, - part262, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg165 = msg("00007:57", all52); - - var part263 = match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} for session synchronization(s) was accepted.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg166 = msg("00007:58", part263); - - var part264 = match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchronization by device %{fld2->} completed.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg167 = msg("00007:59", part264); - - var part265 = match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group %{group->} direction was set to %{direction}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg168 = msg("00007:60", part265); - - var part266 = match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group %{group->} was set.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg169 = msg("00007:61", part266); - - var part267 = match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group %{group->} with direction %{direction->} was unset.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg170 = msg("00007:62", part267); - - var part268 = match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} was unset.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg171 = msg("00007:63", part268); - - var part269 = match("MESSAGE#170:00007:64/1", "nwparser.p0", "%{fld2->} was removed from the monitoring list %{p0}"); - - var part270 = match("MESSAGE#170:00007:64/3", "nwparser.p0", "%{fld3}"); - - var all53 = all_match({ - processors: [ - dup348, - part269, - dup349, - part270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg172 = msg("00007:64", all53); - - var part271 = match("MESSAGE#171:00007:65/1", "nwparser.p0", "%{fld2->} with weight %{fld3->} was added%{p0}"); - - var part272 = match("MESSAGE#171:00007:65/2_0", "nwparser.p0", " to or updated on %{p0}"); - - var part273 = match("MESSAGE#171:00007:65/2_1", "nwparser.p0", "/updated to %{p0}"); - - var select58 = linear_select([ - part272, - part273, - ]); - - var part274 = match("MESSAGE#171:00007:65/3", "nwparser.p0", "the monitoring list %{p0}"); - - var part275 = match("MESSAGE#171:00007:65/5", "nwparser.p0", "%{fld4}"); - - var all54 = all_match({ - processors: [ - dup348, - part271, - select58, - part274, - dup349, - part275, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg173 = msg("00007:65", all54); - - var part276 = match("MESSAGE#172:00007:66/0_0", "nwparser.payload", "The monitoring %{p0}"); - - var part277 = match("MESSAGE#172:00007:66/0_1", "nwparser.payload", "Monitoring %{p0}"); - - var select59 = linear_select([ - part276, - part277, - ]); - - var part278 = match("MESSAGE#172:00007:66/1", "nwparser.p0", "threshold was modified to %{trigger_val->} o%{p0}"); - - var part279 = match("MESSAGE#172:00007:66/2_0", "nwparser.p0", "f %{p0}"); - - var select60 = linear_select([ - part279, - dup115, - ]); - - var all55 = all_match({ - processors: [ - select59, - part278, - select60, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg174 = msg("00007:66", all55); - - var part280 = match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg175 = msg("00007:67", part280); - - var part281 = match("MESSAGE#174:00007:68/0", "nwparser.payload", "NSRP b%{p0}"); - - var part282 = match("MESSAGE#174:00007:68/1_0", "nwparser.p0", "lack %{p0}"); - - var part283 = match("MESSAGE#174:00007:68/1_1", "nwparser.p0", "ack %{p0}"); - - var select61 = linear_select([ - part282, - part283, - ]); - - var part284 = match("MESSAGE#174:00007:68/2", "nwparser.p0", "hole prevention %{disposition}. Master(s) of Virtual Security Device groups %{p0}"); - - var part285 = match("MESSAGE#174:00007:68/3_0", "nwparser.p0", "may not exist %{p0}"); - - var part286 = match("MESSAGE#174:00007:68/3_1", "nwparser.p0", "always exists %{p0}"); - - var select62 = linear_select([ - part285, - part286, - ]); - - var all56 = all_match({ - processors: [ - part281, - select61, - part284, - select62, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg176 = msg("00007:68", all56); - - var part287 = match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchronization between devices was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg177 = msg("00007:69", part287); - - var part288 = match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was changed.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg178 = msg("00007:70", part288); - - var part289 = match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Active mode was %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg179 = msg("00007:71", part289); - - var part290 = match("MESSAGE#178:00007:72", "nwparser.payload", "NSRP: nsrp link probe enable on %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg180 = msg("00007:72", part290); - - var select63 = linear_select([ - msg109, - msg110, - msg111, - msg112, - msg113, - msg114, - msg115, - msg116, - msg117, - msg118, - msg119, - msg120, - msg121, - msg122, - msg123, - msg124, - msg125, - msg126, - msg127, - msg128, - msg129, - msg130, - msg131, - msg132, - msg133, - msg134, - msg135, - msg136, - msg137, - msg138, - msg139, - msg140, - msg141, - msg142, - msg143, - msg144, - msg145, - msg146, - msg147, - msg148, - msg149, - msg150, - msg151, - msg152, - msg153, - msg154, - msg155, - msg156, - msg157, - msg158, - msg159, - msg160, - msg161, - msg162, - msg163, - msg164, - msg165, - msg166, - msg167, - msg168, - msg169, - msg170, - msg171, - msg172, - msg173, - msg174, - msg175, - msg176, - msg177, - msg178, - msg179, - msg180, - ]); - - var part291 = match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg181 = msg("00008", part291); - - var msg182 = msg("00008:01", dup341); - - var part292 = match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg183 = msg("00008:02", part292); - - var part293 = match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been updated through NTP%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg184 = msg("00008:03", part293); - - var part294 = match("MESSAGE#183:00008:04/0", "nwparser.payload", "System clock %{p0}"); - - var part295 = match("MESSAGE#183:00008:04/1_0", "nwparser.p0", "configurations have been%{p0}"); - - var part296 = match("MESSAGE#183:00008:04/1_1", "nwparser.p0", "was%{p0}"); - - var part297 = match("MESSAGE#183:00008:04/1_2", "nwparser.p0", "is%{p0}"); - - var select64 = linear_select([ - part295, - part296, - part297, - ]); - - var part298 = match("MESSAGE#183:00008:04/2", "nwparser.p0", "%{}changed%{p0}"); - - var part299 = match("MESSAGE#183:00008:04/3_0", "nwparser.p0", " by admin %{administrator}"); - - var part300 = match("MESSAGE#183:00008:04/3_1", "nwparser.p0", " by %{username->} (%{fld1})"); - - var part301 = match("MESSAGE#183:00008:04/3_2", "nwparser.p0", " by %{username}"); - - var part302 = match("MESSAGE#183:00008:04/3_3", "nwparser.p0", " manually.%{}"); - - var part303 = match("MESSAGE#183:00008:04/3_4", "nwparser.p0", " manually%{}"); - - var select65 = linear_select([ - part299, - part300, - part301, - part302, - part303, - dup21, - ]); - - var all57 = all_match({ - processors: [ - part294, - select64, - part298, - select65, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg185 = msg("00008:04", all57); - - var part304 = match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg186 = msg("00008:05", part304); - - var part305 = match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg187 = msg("00008:06", part305); - - var part306 = match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup60, - ])); - - var msg188 = msg("00008:07", part306); - - var part307 = match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup60, - ])); - - var msg189 = msg("00008:08", part307); - - var part308 = match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manually%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg190 = msg("00008:09", part308); - - var part309 = match("MESSAGE#189:00008:10/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol}(zone %{p0}"); - - var all58 = all_match({ - processors: [ - part309, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ]), - }); - - var msg191 = msg("00008:10", all58); - - var select66 = linear_select([ - msg181, - msg182, - msg183, - msg184, - msg185, - msg186, - msg187, - msg188, - msg189, - msg190, - msg191, - ]); - - var part310 = match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg192 = msg("00009", part310); - - var part311 = match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg193 = msg("00009:01", part311); - - var part312 = match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg194 = msg("00009:02", part312); - - var part313 = match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for interface %{interface->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg195 = msg("00009:03", part313); - - var part314 = match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg196 = msg("00009:05", part314); - - var part315 = match("MESSAGE#195:00009:06/0_0", "nwparser.payload", "%{fld2}: The 802.1Q tag %{p0}"); - - var part316 = match("MESSAGE#195:00009:06/0_1", "nwparser.payload", "The 802.1Q tag %{p0}"); - - var select67 = linear_select([ - part315, - part316, - ]); - - var select68 = linear_select([ - dup119, - dup16, - ]); - - var part317 = match("MESSAGE#195:00009:06/3", "nwparser.p0", "interface %{interface->} has been %{p0}"); - - var part318 = match("MESSAGE#195:00009:06/4_1", "nwparser.p0", "changed to %{p0}"); - - var select69 = linear_select([ - dup120, - part318, - ]); - - var part319 = match("MESSAGE#195:00009:06/6_0", "nwparser.p0", "%{info->} from host %{saddr}"); - - var part320 = match_copy("MESSAGE#195:00009:06/6_1", "nwparser.p0", "info"); - - var select70 = linear_select([ - part319, - part320, - ]); - - var all59 = all_match({ - processors: [ - select67, - dup118, - select68, - part317, - select69, - dup23, - select70, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg197 = msg("00009:06", all59); - - var part321 = match("MESSAGE#196:00009:07/0", "nwparser.payload", "Maximum bandwidth %{fld2->} on %{p0}"); - - var part322 = match("MESSAGE#196:00009:07/2", "nwparser.p0", "%{} %{interface->} is less than t%{p0}"); - - var part323 = match("MESSAGE#196:00009:07/3_0", "nwparser.p0", "he total %{p0}"); - - var part324 = match("MESSAGE#196:00009:07/3_1", "nwparser.p0", "otal %{p0}"); - - var select71 = linear_select([ - part323, - part324, - ]); - - var part325 = match("MESSAGE#196:00009:07/4", "nwparser.p0", "guaranteed bandwidth %{fld3}"); - - var all60 = all_match({ - processors: [ - part321, - dup337, - part322, - select71, - part325, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg198 = msg("00009:07", all60); - - var part326 = match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth setting on the interface %{interface->} has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg199 = msg("00009:09", part326); - - var part327 = match("MESSAGE#198:00009:10/0", "nwparser.payload", "The operational mode for the interface %{interface->} has been changed to %{p0}"); - - var part328 = match("MESSAGE#198:00009:10/1_0", "nwparser.p0", "Route%{}"); - - var part329 = match("MESSAGE#198:00009:10/1_1", "nwparser.p0", "NAT%{}"); - - var select72 = linear_select([ - part328, - part329, - ]); - - var all61 = all_match({ - processors: [ - part327, - select72, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg200 = msg("00009:10", all61); - - var part330 = match("MESSAGE#199:00009:11/0_0", "nwparser.payload", "%{fld1}: VLAN %{p0}"); - - var part331 = match("MESSAGE#199:00009:11/0_1", "nwparser.payload", "VLAN %{p0}"); - - var select73 = linear_select([ - part330, - part331, - ]); - - var part332 = match("MESSAGE#199:00009:11/1", "nwparser.p0", "tag %{fld2->} has been %{disposition}"); - - var all62 = all_match({ - processors: [ - select73, - part332, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg201 = msg("00009:11", all62); - - var part333 = match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{disposition->} on interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg202 = msg("00009:12", part333); - - var part334 = match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on %{interface->} have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg203 = msg("00009:13", part334); - - var part335 = match("MESSAGE#202:00009:14/0_0", "nwparser.payload", "Global-PRO has been %{p0}"); - - var part336 = match("MESSAGE#202:00009:14/0_1", "nwparser.payload", "Global PRO has been %{p0}"); - - var part337 = match("MESSAGE#202:00009:14/0_2", "nwparser.payload", "DNS proxy was %{p0}"); - - var select74 = linear_select([ - part335, - part336, - part337, - ]); - - var part338 = match("MESSAGE#202:00009:14/1", "nwparser.p0", "%{disposition->} on %{p0}"); - - var select75 = linear_select([ - dup122, - dup123, - ]); - - var part339 = match("MESSAGE#202:00009:14/4_0", "nwparser.p0", "%{interface->} (%{fld2})"); - - var select76 = linear_select([ - part339, - dup124, - ]); - - var all63 = all_match({ - processors: [ - select74, - part338, - select75, - dup23, - select76, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg204 = msg("00009:14", all63); - - var part340 = match("MESSAGE#203:00009:15/0", "nwparser.payload", "Route between secondary IP%{p0}"); - - var part341 = match("MESSAGE#203:00009:15/1_0", "nwparser.p0", " addresses %{p0}"); - - var select77 = linear_select([ - part341, - dup125, - ]); - - var all64 = all_match({ - processors: [ - part340, - select77, - dup126, - dup350, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg205 = msg("00009:15", all64); - - var part342 = match("MESSAGE#204:00009:16/0", "nwparser.payload", "Secondary IP address %{hostip}/%{mask->} %{p0}"); - - var part343 = match("MESSAGE#204:00009:16/3_2", "nwparser.p0", "deleted from %{p0}"); - - var select78 = linear_select([ - dup129, - dup130, - part343, - ]); - - var part344 = match("MESSAGE#204:00009:16/4", "nwparser.p0", "interface %{interface}."); - - var all65 = all_match({ - processors: [ - part342, - dup350, - dup23, - select78, - part344, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg206 = msg("00009:16", all65); - - var part345 = match("MESSAGE#205:00009:17/0", "nwparser.payload", "Secondary IP address %{p0}"); - - var part346 = match("MESSAGE#205:00009:17/1_0", "nwparser.p0", "%{hostip}/%{mask->} was added to interface %{p0}"); - - var part347 = match("MESSAGE#205:00009:17/1_1", "nwparser.p0", "%{hostip->} was added to interface %{p0}"); - - var select79 = linear_select([ - part346, - part347, - ]); - - var part348 = match("MESSAGE#205:00009:17/2", "nwparser.p0", "%{interface}."); - - var all66 = all_match({ - processors: [ - part345, - select79, - part348, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg207 = msg("00009:17", all66); - - var part349 = match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on the interface %{interface->} has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg208 = msg("00009:18", part349); - - var part350 = match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg209 = msg("00009:19", part350); - - var part351 = match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg210 = msg("00009:27", part351); - - var part352 = match("MESSAGE#209:00009:20/0_0", "nwparser.payload", "%{fld2}: %{service->} has been %{p0}"); - - var part353 = match("MESSAGE#209:00009:20/0_1", "nwparser.payload", "%{service->} has been %{p0}"); - - var select80 = linear_select([ - part352, - part353, - ]); - - var part354 = match("MESSAGE#209:00009:20/1", "nwparser.p0", "%{disposition->} on interface %{interface->} %{p0}"); - - var part355 = match("MESSAGE#209:00009:20/2_0", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}"); - - var part356 = match("MESSAGE#209:00009:20/2_1", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}:%{sport}"); - - var part357 = match("MESSAGE#209:00009:20/2_2", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}"); - - var part358 = match("MESSAGE#209:00009:20/2_3", "nwparser.p0", "from host %{saddr->} (%{fld1})"); - - var select81 = linear_select([ - part355, - part356, - part357, - part358, - ]); - - var all67 = all_match({ - processors: [ - select80, - part354, - select81, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg211 = msg("00009:20", all67); - - var part359 = match("MESSAGE#210:00009:21/0", "nwparser.payload", "Source Route IP option! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var all68 = all_match({ - processors: [ - part359, - dup343, - dup131, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ]), - }); - - var msg212 = msg("00009:21", all68); - - var part360 = match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface->} has been changed to %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg213 = msg("00009:22", part360); - - var part361 = match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip->} has been added to interface %{interface->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg214 = msg("00009:23", part361); - - var part362 = match("MESSAGE#213:00009:24/0", "nwparser.payload", "Web has been enabled on interface %{interface->} by admin %{administrator->} via %{p0}"); - - var part363 = match("MESSAGE#213:00009:24/1_0", "nwparser.p0", "%{logon_type->} %{space}(%{p0}"); - - var part364 = match("MESSAGE#213:00009:24/1_1", "nwparser.p0", "%{logon_type}. (%{p0}"); - - var select82 = linear_select([ - part363, - part364, - ]); - - var part365 = match("MESSAGE#213:00009:24/2", "nwparser.p0", ")%{fld1}"); - - var all69 = all_match({ - processors: [ - part362, - select82, - part365, - ], - on_success: processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg215 = msg("00009:24", all69); - - var part366 = match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on interface %{interface->} by %{username->} via %{logon_type}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg216 = msg("00009:25", part366); - - var part367 = match("MESSAGE#215:00009:26/0", "nwparser.payload", "%{protocol->} has been %{disposition->} on interface %{interface->} by %{username->} via NSRP Peer . %{p0}"); - - var all70 = all_match({ - processors: [ - part367, - dup333, - ], - on_success: processor_chain([ - dup1, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg217 = msg("00009:26", all70); - - var select83 = linear_select([ - msg192, - msg193, - msg194, - msg195, - msg196, - msg197, - msg198, - msg199, - msg200, - msg201, - msg202, - msg203, - msg204, - msg205, - msg206, - msg207, - msg208, - msg209, - msg210, - msg211, - msg212, - msg213, - msg214, - msg215, - msg216, - msg217, - ]); - - var part368 = match("MESSAGE#216:00010/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} %{p0}"); - - var part369 = match("MESSAGE#216:00010/1_0", "nwparser.p0", "using protocol %{p0}"); - - var part370 = match("MESSAGE#216:00010/1_1", "nwparser.p0", "proto %{p0}"); - - var select84 = linear_select([ - part369, - part370, - ]); - - var part371 = match("MESSAGE#216:00010/2", "nwparser.p0", "%{protocol->} %{p0}"); - - var part372 = match("MESSAGE#216:00010/3_0", "nwparser.p0", "( zone %{zone}, int %{interface}) %{p0}"); - - var part373 = match("MESSAGE#216:00010/3_1", "nwparser.p0", "zone %{zone->} int %{interface}) %{p0}"); - - var select85 = linear_select([ - part372, - part373, - dup126, - ]); - - var part374 = match("MESSAGE#216:00010/4", "nwparser.p0", ".%{space}The attack occurred %{dclass_counter1->} times%{p0}"); - - var all71 = all_match({ - processors: [ - part368, - select84, - part371, - select85, - part374, - dup351, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup5, - dup9, - dup3, - dup61, - ]), - }); - - var msg218 = msg("00010", all71); - - var part375 = match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg219 = msg("00010:01", part375); - - var part376 = match("MESSAGE#218:00010:02", "nwparser.payload", "Mapped IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg220 = msg("00010:02", part376); - - var all72 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup9, - dup3, - dup60, - ]), - }); - - var msg221 = msg("00010:03", all72); - - var select86 = linear_select([ - msg218, - msg219, - msg220, - msg221, - ]); - - var part377 = match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg222 = msg("00011", part377); - - var part378 = match("MESSAGE#221:00011:01/0", "nwparser.payload", "Route to %{daddr}/%{fld2->} [ %{p0}"); - - var select87 = linear_select([ - dup57, - dup56, - ]); - - var part379 = match("MESSAGE#221:00011:01/2", "nwparser.p0", "%{} %{interface->} gateway %{fld3->} ] has been %{disposition}"); - - var all73 = all_match({ - processors: [ - part378, - select87, - part379, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg223 = msg("00011:01", all73); - - var part380 = match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} to %{daddr->} protocol %{protocol->} (%{fld2})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg224 = msg("00011:02", part380); - - var part381 = match("MESSAGE#223:00011:03/0", "nwparser.payload", "An %{p0}"); - - var part382 = match("MESSAGE#223:00011:03/1_0", "nwparser.p0", "import %{p0}"); - - var part383 = match("MESSAGE#223:00011:03/1_1", "nwparser.p0", "export %{p0}"); - - var select88 = linear_select([ - part382, - part383, - ]); - - var part384 = match("MESSAGE#223:00011:03/2", "nwparser.p0", "rule in virtual router %{node->} to virtual router %{fld4->} with %{p0}"); - - var part385 = match("MESSAGE#223:00011:03/3_0", "nwparser.p0", "route-map %{fld3->} and protocol %{protocol->} has been %{p0}"); - - var part386 = match("MESSAGE#223:00011:03/3_1", "nwparser.p0", "IP-prefix %{hostip}/%{interface->} has been %{p0}"); - - var select89 = linear_select([ - part385, - part386, - ]); - - var all74 = all_match({ - processors: [ - part381, - select88, - part384, - select89, - dup36, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg225 = msg("00011:03", all74); - - var part387 = match("MESSAGE#224:00011:04/0", "nwparser.payload", "A route in virtual router %{node->} that has IP address %{hostip}/%{fld2->} through %{p0}"); - - var part388 = match("MESSAGE#224:00011:04/2", "nwparser.p0", "%{interface->} and gateway %{fld3->} with metric %{fld4->} has been %{disposition}"); - - var all75 = all_match({ - processors: [ - part387, - dup352, - part388, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg226 = msg("00011:04", all75); - - var part389 = match("MESSAGE#225:00011:05/1_0", "nwparser.p0", "sharable virtual router using name%{p0}"); - - var part390 = match("MESSAGE#225:00011:05/1_1", "nwparser.p0", "virtual router with name%{p0}"); - - var select90 = linear_select([ - part389, - part390, - ]); - - var part391 = match("MESSAGE#225:00011:05/2", "nwparser.p0", "%{} %{node->} and id %{fld2->} has been %{disposition}"); - - var all76 = all_match({ - processors: [ - dup79, - select90, - part391, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg227 = msg("00011:05", all76); - - var part392 = match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup59, - dup3, - dup60, - ])); - - var msg228 = msg("00011:07", part392); - - var part393 = match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{node->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg229 = msg("00011:08", part393); - - var part394 = match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg230 = msg("00011:09", part394); - - var part395 = match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes that can be created in virtual router %{node->} is %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg231 = msg("00011:10", part395); - - var part396 = match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg232 = msg("00011:11", part396); - - var part397 = match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual router %{node->} used by OSPF BGP routing instances id has been uninitialized", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg233 = msg("00011:12", part397); - - var part398 = match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be used by OSPF BGP routing instances in virtual router %{node->} has been set to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg234 = msg("00011:13", part398); - - var part399 = match("MESSAGE#233:00011:14/0", "nwparser.payload", "The routing preference for protocol %{protocol->} in virtual router %{node->} has been %{p0}"); - - var part400 = match("MESSAGE#233:00011:14/1_1", "nwparser.p0", "reset%{}"); - - var select91 = linear_select([ - dup134, - part400, - ]); - - var all77 = all_match({ - processors: [ - part399, - select91, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg235 = msg("00011:14", all77); - - var part401 = match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in virtual router %{node->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg236 = msg("00011:15", part401); - - var part402 = match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route through virtual router %{node->} has been added in virtual router %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg237 = msg("00011:16", part402); - - var part403 = match("MESSAGE#236:00011:17/0", "nwparser.payload", "The virtual router %{node->} has been made %{p0}"); - - var part404 = match("MESSAGE#236:00011:17/1_0", "nwparser.p0", "sharable%{}"); - - var part405 = match("MESSAGE#236:00011:17/1_1", "nwparser.p0", "unsharable%{}"); - - var part406 = match("MESSAGE#236:00011:17/1_2", "nwparser.p0", "default virtual router for virtual system %{fld2}"); - - var select92 = linear_select([ - part404, - part405, - part406, - ]); - - var all78 = all_match({ - processors: [ - part403, - select92, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg238 = msg("00011:17", all78); - - var part407 = match("MESSAGE#237:00011:18/0_0", "nwparser.payload", "Source route(s) %{p0}"); - - var part408 = match("MESSAGE#237:00011:18/0_1", "nwparser.payload", "A source route %{p0}"); - - var select93 = linear_select([ - part407, - part408, - ]); - - var part409 = match("MESSAGE#237:00011:18/1", "nwparser.p0", "in virtual router %{node->} %{p0}"); - - var part410 = match("MESSAGE#237:00011:18/2_0", "nwparser.p0", "with route addresses of %{p0}"); - - var part411 = match("MESSAGE#237:00011:18/2_1", "nwparser.p0", "that has IP address %{p0}"); - - var select94 = linear_select([ - part410, - part411, - ]); - - var part412 = match("MESSAGE#237:00011:18/3", "nwparser.p0", "%{hostip}/%{fld2->} through interface %{interface->} and %{p0}"); - - var part413 = match("MESSAGE#237:00011:18/4_0", "nwparser.p0", "a default gateway address %{p0}"); - - var select95 = linear_select([ - part413, - dup135, - ]); - - var part414 = match("MESSAGE#237:00011:18/5", "nwparser.p0", "%{fld3->} with metric %{fld4->} %{p0}"); - - var all79 = all_match({ - processors: [ - select93, - part409, - select94, - part412, - select95, - part414, - dup350, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg239 = msg("00011:18", all79); - - var part415 = match("MESSAGE#238:00011:19/0", "nwparser.payload", "Source Route(s) in virtual router %{node->} with %{p0}"); - - var part416 = match("MESSAGE#238:00011:19/1_0", "nwparser.p0", "route addresses of %{p0}"); - - var part417 = match("MESSAGE#238:00011:19/1_1", "nwparser.p0", "an IP address %{p0}"); - - var select96 = linear_select([ - part416, - part417, - ]); - - var part418 = match("MESSAGE#238:00011:19/2", "nwparser.p0", "%{hostip}/%{fld3->} and %{p0}"); - - var part419 = match("MESSAGE#238:00011:19/3_0", "nwparser.p0", "a default gateway address of %{p0}"); - - var select97 = linear_select([ - part419, - dup135, - ]); - - var part420 = match("MESSAGE#238:00011:19/4", "nwparser.p0", "%{fld4->} %{p0}"); - - var part421 = match("MESSAGE#238:00011:19/5_1", "nwparser.p0", "has been%{p0}"); - - var select98 = linear_select([ - dup107, - part421, - ]); - - var all80 = all_match({ - processors: [ - part415, - select96, - part418, - select97, - part420, - select98, - dup136, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg240 = msg("00011:19", all80); - - var part422 = match("MESSAGE#239:00011:20/0_0", "nwparser.payload", "%{fld2}: A %{p0}"); - - var select99 = linear_select([ - part422, - dup79, - ]); - - var part423 = match("MESSAGE#239:00011:20/1", "nwparser.p0", "route has been created in virtual router \"%{node}\"%{space}with an IP address %{hostip->} and next-hop as virtual router \"%{fld3}\""); - - var all81 = all_match({ - processors: [ - select99, - part423, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg241 = msg("00011:20", all81); - - var part424 = match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual router %{node->} for interface %{interface->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg242 = msg("00011:21", part424); - - var part425 = match("MESSAGE#241:00011:22", "nwparser.payload", "SIBR route in virtual router %{node->} for interface %{interface->} that has IP address %{hostip->} through interface %{fld3->} and gateway %{fld4->} with metric %{fld5->} was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg243 = msg("00011:22", part425); - - var all82 = all_match({ - processors: [ - dup132, - dup343, - dup131, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - call({ - dest: "nwparser.inout", - fn: DIRCHK, - args: [ - field("$IN"), - field("saddr"), - field("daddr"), - ], - }), - ]), - }); - - var msg244 = msg("00011:23", all82); - - var part426 = match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{node}\" that has IP address %{hostip->} through interface %{interface->} and gateway %{fld2->} with metric %{fld3->} %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg245 = msg("00011:24", part426); - - var part427 = match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \"%{node}\" with an IP address %{hostip}/%{fld2->} and gateway %{fld3->} %{disposition}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg246 = msg("00011:25", part427); - - var part428 = match("MESSAGE#245:00011:26", "nwparser.payload", "Route in virtual router \"%{node}\" with IP address %{hostip}/%{fld2->} and next-hop as virtual router \"%{fld3}\" created. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg247 = msg("00011:26", part428); - - var select100 = linear_select([ - msg222, - msg223, - msg224, - msg225, - msg226, - msg227, - msg228, - msg229, - msg230, - msg231, - msg232, - msg233, - msg234, - msg235, - msg236, - msg237, - msg238, - msg239, - msg240, - msg241, - msg242, - msg243, - msg244, - msg245, - msg246, - msg247, - ]); - - var part429 = match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comments have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg248 = msg("00012:02", part429); - - var part430 = match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} %{change_attribute->} has been changed to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg249 = msg("00012:03", part430); - - var part431 = match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{group->} has %{disposition->} member %{username->} from host %{saddr}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg250 = msg("00012:04", part431); - - var part432 = match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2}) (%{fld3})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg251 = msg("00012:05", part432); - - var part433 = match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup59, - dup61, - ])); - - var msg252 = msg("00012:06", part433); - - var part434 = match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - dup59, - ])); - - var msg253 = msg("00012:07", part434); - - var part435 = match("MESSAGE#252:00012:08", "nwparser.payload", "%{fld2}: Service %{service->} has been %{disposition->} from host %{saddr->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg254 = msg("00012:08", part435); - - var all83 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg255 = msg("00012:09", all83); - - var all84 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg256 = msg("00012:10", all84); - - var part436 = match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup9, - dup61, - ])); - - var msg257 = msg("00012:11", part436); - - var part437 = match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{zone}) %{info->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg258 = msg("00012:12", part437); - - var part438 = match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg259 = msg("00012", part438); - - var part439 = match("MESSAGE#258:00012:01", "nwparser.payload", "Service %{service->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg260 = msg("00012:01", part439); - - var select101 = linear_select([ - msg248, - msg249, - msg250, - msg251, - msg252, - msg253, - msg254, - msg255, - msg256, - msg257, - msg258, - msg259, - msg260, - ]); - - var part440 = match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding bytes has been detected%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg261 = msg("00013", part440); - - var part441 = match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to connect to the NetScreen-Global Manager port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - setc("signame","An Attempt to connect to NetScreen-Global Manager Port."), - ])); - - var msg262 = msg("00013:01", part441); - - var part442 = match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has been changed to %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg263 = msg("00013:02", part442); - - var part443 = match("MESSAGE#262:00013:03", "nwparser.payload", "Web Filtering has been %{disposition->} (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg264 = msg("00013:03", part443); - - var select102 = linear_select([ - msg261, - msg262, - msg263, - msg264, - ]); - - var part444 = match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes has changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg265 = msg("00014", part444); - - var part445 = match("MESSAGE#264:00014:01/0", "nwparser.payload", "The group member %{username->} has been %{disposition->} %{p0}"); - - var part446 = match("MESSAGE#264:00014:01/1_0", "nwparser.p0", "to a group%{}"); - - var part447 = match("MESSAGE#264:00014:01/1_1", "nwparser.p0", "from a group%{}"); - - var select103 = linear_select([ - part446, - part447, - ]); - - var all85 = all_match({ - processors: [ - part445, - select103, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg266 = msg("00014:01", all85); - - var part448 = match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has been %{disposition->} by %{username}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg267 = msg("00014:02", part448); - - var part449 = match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has been %{disposition->} by %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg268 = msg("00014:03", part449); - - var part450 = match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{hostname->} server { %{hostip->} }: SrvErr (%{fld2}), SockErr (%{fld3}), Valid (%{fld4}),Connected (%{fld5})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg269 = msg("00014:04", part450); - - var part451 = match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations have been %{disposition->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg270 = msg("00014:05", part451); - - var part452 = match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition->} manually.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg271 = msg("00014:06", part452); - - var part453 = match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{disposition->} by %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg272 = msg("00014:07", part453); - - var part454 = match("MESSAGE#271:00014:08", "nwparser.payload", "Communication error with %{hostname->} server[%{hostip}]: SrvErr(%{fld2}),SockErr(%{fld3}),Valid(%{fld4}),Connected(%{fld5}) (%{fld1})", processor_chain([ - dup27, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg273 = msg("00014:08", part454); - - var select104 = linear_select([ - msg265, - msg266, - msg267, - msg268, - msg269, - msg270, - msg271, - msg272, - msg273, - ]); - - var part455 = match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been changed to %{authmethod}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg274 = msg("00015", part455); - - var part456 = match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has %{disposition}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg275 = msg("00015:01", part456); - - var part457 = match("MESSAGE#274:00015:02/0", "nwparser.payload", "LDAP %{p0}"); - - var part458 = match("MESSAGE#274:00015:02/1_0", "nwparser.p0", "server name %{p0}"); - - var part459 = match("MESSAGE#274:00015:02/1_2", "nwparser.p0", "distinguished name %{p0}"); - - var part460 = match("MESSAGE#274:00015:02/1_3", "nwparser.p0", "common name %{p0}"); - - var select105 = linear_select([ - part458, - dup137, - part459, - part460, - ]); - - var all86 = all_match({ - processors: [ - part457, - select105, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg276 = msg("00015:02", all86); - - var part461 = match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg277 = msg("00015:03", part461); - - var part462 = match("MESSAGE#276:00015:04/0", "nwparser.payload", "RADIUS server %{p0}"); - - var part463 = match("MESSAGE#276:00015:04/1_2", "nwparser.p0", "secret %{p0}"); - - var select106 = linear_select([ - dup139, - dup140, - part463, - ]); - - var all87 = all_match({ - processors: [ - part462, - select106, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg278 = msg("00015:04", all87); - - var part464 = match("MESSAGE#277:00015:05/0", "nwparser.payload", "SecurID %{p0}"); - - var part465 = match("MESSAGE#277:00015:05/1_0", "nwparser.p0", "authentication port %{p0}"); - - var part466 = match("MESSAGE#277:00015:05/1_1", "nwparser.p0", "duress mode %{p0}"); - - var part467 = match("MESSAGE#277:00015:05/1_3", "nwparser.p0", "number of retries value %{p0}"); - - var select107 = linear_select([ - part465, - part466, - dup76, - part467, - ]); - - var all88 = all_match({ - processors: [ - part464, - select107, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg279 = msg("00015:05", all88); - - var part468 = match("MESSAGE#278:00015:06/0_0", "nwparser.payload", "Master %{p0}"); - - var part469 = match("MESSAGE#278:00015:06/0_1", "nwparser.payload", "Backup %{p0}"); - - var select108 = linear_select([ - part468, - part469, - ]); - - var part470 = match("MESSAGE#278:00015:06/1", "nwparser.p0", "SecurID server IP address has been %{disposition}"); - - var all89 = all_match({ - processors: [ - select108, - part470, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg280 = msg("00015:06", all89); - - var part471 = match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to master%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg281 = msg("00015:07", part471); - - var part472 = match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration between master and slave%{}", processor_chain([ - dup141, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg282 = msg("00015:08", part472); - - var part473 = match("MESSAGE#281:00015:09/0_0", "nwparser.payload", "configuration %{p0}"); - - var part474 = match("MESSAGE#281:00015:09/0_1", "nwparser.payload", "Configuration %{p0}"); - - var select109 = linear_select([ - part473, - part474, - ]); - - var part475 = match("MESSAGE#281:00015:09/1", "nwparser.p0", "out of sync between local unit and remote unit%{}"); - - var all90 = all_match({ - processors: [ - select109, - part475, - ], - on_success: processor_chain([ - dup141, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg283 = msg("00015:09", all90); - - var part476 = match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg284 = msg("00015:10", part476); - - var part477 = match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg285 = msg("00015:11", part477); - - var part478 = match("MESSAGE#284:00015:12/1_0", "nwparser.p0", "control %{p0}"); - - var part479 = match("MESSAGE#284:00015:12/1_1", "nwparser.p0", "data %{p0}"); - - var select110 = linear_select([ - part478, - part479, - ]); - - var part480 = match("MESSAGE#284:00015:12/2", "nwparser.p0", "channel moved from link %{p0}"); - - var part481 = match("MESSAGE#284:00015:12/6", "nwparser.p0", "(%{interface})"); - - var all91 = all_match({ - processors: [ - dup87, - select110, - part480, - dup353, - dup103, - dup353, - part481, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg286 = msg("00015:12", all91); - - var part482 = match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg287 = msg("00015:13", part482); - - var part483 = match("MESSAGE#286:00015:14/0", "nwparser.payload", "NSRP link %{p0}"); - - var all92 = all_match({ - processors: [ - part483, - dup353, - dup116, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg288 = msg("00015:14", all92); - - var part484 = match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel available (%{fld3->} used by other channel)", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg289 = msg("00015:15", part484); - - var part485 = match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out of synchronization between the local device and the peer device.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg290 = msg("00015:16", part485); - - var part486 = match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{change_old->} changed to link channel %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg291 = msg("00015:17", part486); - - var part487 = match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on peer device %{fld2->} changed from %{fld3->} to %{fld4->} state.", processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - setc("change_attribute","RTO mirror group"), - ])); - - var msg292 = msg("00015:18", part487); - - var part488 = match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on local device %{fld2}, detected a duplicate direction on the peer device %{fld3}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg293 = msg("00015:19", part488); - - var part489 = match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} changed on the local device from %{fld2->} to up state, it had peer device %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg294 = msg("00015:20", part489); - - var part490 = match("MESSAGE#293:00015:21/0", "nwparser.payload", "Peer device %{fld2->} %{p0}"); - - var part491 = match("MESSAGE#293:00015:21/1_0", "nwparser.p0", "disappeared %{p0}"); - - var part492 = match("MESSAGE#293:00015:21/1_1", "nwparser.p0", "was discovered %{p0}"); - - var select111 = linear_select([ - part491, - part492, - ]); - - var all93 = all_match({ - processors: [ - part490, - select111, - dup116, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg295 = msg("00015:21", all93); - - var part493 = match("MESSAGE#294:00015:22/0_0", "nwparser.payload", "The local %{p0}"); - - var part494 = match("MESSAGE#294:00015:22/0_1", "nwparser.payload", "The peer %{p0}"); - - var part495 = match("MESSAGE#294:00015:22/0_2", "nwparser.payload", "Peer %{p0}"); - - var select112 = linear_select([ - part493, - part494, - part495, - ]); - - var part496 = match("MESSAGE#294:00015:22/1", "nwparser.p0", "device %{fld2->} in the Virtual Security Device group %{group->} changed %{change_attribute->} from %{change_old->} to %{change_new->} %{p0}"); - - var all94 = all_match({ - processors: [ - select112, - part496, - dup354, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg296 = msg("00015:22", all94); - - var part497 = match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg297 = msg("00015:23", part497); - - var part498 = match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authentication server has been changed to %{hostname}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg298 = msg("00015:24", part498); - - var part499 = match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification was successful", processor_chain([ - setc("eventcategory","1613050100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg299 = msg("00015:25", part499); - - var part500 = match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification failed", processor_chain([ - dup97, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg300 = msg("00015:29", part500); - - var part501 = match("MESSAGE#299:00015:26/0", "nwparser.payload", "unit %{fld2->} just dis%{p0}"); - - var part502 = match("MESSAGE#299:00015:26/1_0", "nwparser.p0", "appeared%{}"); - - var part503 = match("MESSAGE#299:00015:26/1_1", "nwparser.p0", "covered%{}"); - - var select113 = linear_select([ - part502, - part503, - ]); - - var all95 = all_match({ - processors: [ - part501, - select113, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg301 = msg("00015:26", all95); - - var part504 = match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change to %{interface}. (%{fld2})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - dup146, - ])); - - var msg302 = msg("00015:33", part504); - - var part505 = match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg303 = msg("00015:27", part505); - - var part506 = match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RADIUS retry timeout has been set to default of %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg304 = msg("00015:28", part506); - - var part507 = match("MESSAGE#303:00015:30/0", "nwparser.payload", "Number of RADIUS retries for auth server %{hostname->} %{p0}"); - - var part508 = match("MESSAGE#303:00015:30/2", "nwparser.p0", "set to %{fld2->} (%{fld1})"); - - var all96 = all_match({ - processors: [ - part507, - dup355, - part508, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg305 = msg("00015:30", all96); - - var part509 = match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth server %{hostname->} is unset to its default value, %{info->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg306 = msg("00015:31", part509); - - var part510 = match("MESSAGE#305:00015:32", "nwparser.payload", "Accounting port of server RADIUS is set to %{network_port}. (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg307 = msg("00015:32", part510); - - var select114 = linear_select([ - msg274, - msg275, - msg276, - msg277, - msg278, - msg279, - msg280, - msg281, - msg282, - msg283, - msg284, - msg285, - msg286, - msg287, - msg288, - msg289, - msg290, - msg291, - msg292, - msg293, - msg294, - msg295, - msg296, - msg297, - msg298, - msg299, - msg300, - msg301, - msg302, - msg303, - msg304, - msg305, - msg306, - msg307, - ]); - - var part511 = match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg308 = msg("00016", part511); - - var part512 = match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg309 = msg("00016:01", part512); - - var part513 = match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disposition}", processor_chain([ - dup1, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg310 = msg("00016:02", part513); - - var part514 = match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2})", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg311 = msg("00016:03", part514); - - var part515 = match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg312 = msg("00016:05", part515); - - var part516 = match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg313 = msg("00016:06", part516); - - var part517 = match("MESSAGE#312:00016:07/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} ( zone %{p0}"); - - var all97 = all_match({ - processors: [ - part517, - dup338, - dup67, - ], - on_success: processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg314 = msg("00016:07", all97); - - var part518 = match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) Modify by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - setc("eventcategory","1001020305"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg315 = msg("00016:08", part518); - - var part519 = match("MESSAGE#314:00016:09", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) New by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - setc("eventcategory","1001030305"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg316 = msg("00016:09", part519); - - var select115 = linear_select([ - msg308, - msg309, - msg310, - msg311, - msg312, - msg313, - msg314, - msg315, - msg316, - ]); - - var part520 = match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ])); - - var msg317 = msg("00017", part520); - - var part521 = match("MESSAGE#316:00017:23/0", "nwparser.payload", "Gateway %{fld2->} at %{fld3->} in %{fld5->} mode with ID %{p0}"); - - var part522 = match("MESSAGE#316:00017:23/1_0", "nwparser.p0", "[%{fld4}] %{p0}"); - - var part523 = match("MESSAGE#316:00017:23/1_1", "nwparser.p0", "%{fld4->} %{p0}"); - - var select116 = linear_select([ - part522, - part523, - ]); - - var part524 = match("MESSAGE#316:00017:23/2", "nwparser.p0", "has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} %{fld}"); - - var all98 = all_match({ - processors: [ - part521, - select116, - part524, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg318 = msg("00017:23", all98); - - var part525 = match("MESSAGE#317:00017:01/0_0", "nwparser.payload", "%{fld1}: Gateway %{p0}"); - - var part526 = match("MESSAGE#317:00017:01/0_1", "nwparser.payload", "Gateway %{p0}"); - - var select117 = linear_select([ - part525, - part526, - ]); - - var part527 = match("MESSAGE#317:00017:01/1", "nwparser.p0", "%{fld2->} at %{fld3->} in %{fld5->} mode with ID%{p0}"); - - var part528 = match("MESSAGE#317:00017:01/3", "nwparser.p0", "%{fld4->} has been %{disposition}"); - - var all99 = all_match({ - processors: [ - select117, - part527, - dup356, - part528, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg319 = msg("00017:01", all99); - - var part529 = match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settings have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg320 = msg("00017:02", part529); - - var part530 = match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg321 = msg("00017:03", part530); - - var part531 = match("MESSAGE#320:00017:04/2", "nwparser.p0", "%{group_object->} with range %{fld2->} has been %{disposition}"); - - var all100 = all_match({ - processors: [ - dup153, - dup357, - part531, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg322 = msg("00017:04", all100); - - var part532 = match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg323 = msg("00017:05", part532); - - var part533 = match("MESSAGE#322:00017:06/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been set to %{p0}"); - - var part534 = match("MESSAGE#322:00017:06/1_0", "nwparser.p0", "clear %{p0}"); - - var part535 = match("MESSAGE#322:00017:06/1_2", "nwparser.p0", "copy %{p0}"); - - var select118 = linear_select([ - part534, - dup101, - part535, - ]); - - var all101 = all_match({ - processors: [ - part533, - select118, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg324 = msg("00017:06", all101); - - var part536 = match("MESSAGE#323:00017:07/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been %{p0}"); - - var part537 = match("MESSAGE#323:00017:07/1_0", "nwparser.p0", "clear%{}"); - - var part538 = match("MESSAGE#323:00017:07/1_1", "nwparser.p0", "cleared%{}"); - - var part539 = match("MESSAGE#323:00017:07/1_3", "nwparser.p0", "copy%{}"); - - var part540 = match("MESSAGE#323:00017:07/1_4", "nwparser.p0", "copied%{}"); - - var select119 = linear_select([ - part537, - part538, - dup98, - part539, - part540, - ]); - - var all102 = all_match({ - processors: [ - part536, - select119, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg325 = msg("00017:07", all102); - - var part541 = match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and SPI %{fld3}/%{fld4->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg326 = msg("00017:08", part541); - - var part542 = match("MESSAGE#325:00017:09/0_0", "nwparser.payload", "%{fld1}: VPN %{p0}"); - - var part543 = match("MESSAGE#325:00017:09/0_1", "nwparser.payload", "VPN %{p0}"); - - var select120 = linear_select([ - part542, - part543, - ]); - - var part544 = match("MESSAGE#325:00017:09/1", "nwparser.p0", "%{group->} with gateway %{fld2->} %{p0}"); - - var part545 = match("MESSAGE#325:00017:09/2_0", "nwparser.p0", "no-rekey %{p0}"); - - var part546 = match("MESSAGE#325:00017:09/2_1", "nwparser.p0", "rekey, %{p0}"); - - var part547 = match("MESSAGE#325:00017:09/2_2", "nwparser.p0", "rekey %{p0}"); - - var select121 = linear_select([ - part545, - part546, - part547, - ]); - - var part548 = match("MESSAGE#325:00017:09/3", "nwparser.p0", "and p2-proposal %{fld3->} has been %{p0}"); - - var part549 = match("MESSAGE#325:00017:09/4_0", "nwparser.p0", "%{disposition->} from peer unit"); - - var part550 = match("MESSAGE#325:00017:09/4_1", "nwparser.p0", "%{disposition->} from host %{saddr}"); - - var select122 = linear_select([ - part549, - part550, - dup36, - ]); - - var all103 = all_match({ - processors: [ - select120, - part544, - select121, - part548, - select122, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg327 = msg("00017:09", all103); - - var part551 = match("MESSAGE#326:00017:10/0", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}. Src IF %{sinterface->} dst IP %{daddr->} with rekeying %{p0}"); - - var all104 = all_match({ - processors: [ - part551, - dup358, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg328 = msg("00017:10", all104); - - var part552 = match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg329 = msg("00017:11", part552); - - var part553 = match("MESSAGE#328:00017:12/0", "nwparser.payload", "VPN monitoring %{p0}"); - - var part554 = match("MESSAGE#328:00017:12/1_2", "nwparser.p0", "frequency %{p0}"); - - var select123 = linear_select([ - dup109, - dup110, - part554, - ]); - - var all105 = all_match({ - processors: [ - part553, - select123, - dup127, - dup359, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg330 = msg("00017:12", all105); - - var part555 = match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been added by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg331 = msg("00017:26", part555); - - var part556 = match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. You cannot allocate an IP address.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg332 = msg("00017:13", part556); - - var part557 = match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail}, DH group %{group}, ESP %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup9, - dup5, - ])); - - var msg333 = msg("00017:14", part557); - - var part558 = match("MESSAGE#332:00017:15/0", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group->} %{p0}"); - - var part559 = match("MESSAGE#332:00017:15/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime (%{fld3}) (%{fld4}) has been %{disposition}."); - - var all106 = all_match({ - processors: [ - part558, - dup360, - part559, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg334 = msg("00017:15", all106); - - var part560 = match("MESSAGE#333:00017:31/0", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail->} DH group %{group->} %{p0}"); - - var part561 = match("MESSAGE#333:00017:31/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime %{fld3->} has been %{disposition}."); - - var all107 = all_match({ - processors: [ - part560, - dup360, - part561, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg335 = msg("00017:31", all107); - - var part562 = match("MESSAGE#334:00017:16/0", "nwparser.payload", "vpnmonitor interval is %{p0}"); - - var all108 = all_match({ - processors: [ - part562, - dup359, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg336 = msg("00017:16", all108); - - var part563 = match("MESSAGE#335:00017:17/0", "nwparser.payload", "vpnmonitor threshold is %{p0}"); - - var select124 = linear_select([ - dup99, - dup93, - ]); - - var all109 = all_match({ - processors: [ - part563, - select124, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg337 = msg("00017:17", all109); - - var part564 = match("MESSAGE#336:00017:18/2", "nwparser.p0", "%{group_object->} with range %{fld2->} was %{disposition}"); - - var all110 = all_match({ - processors: [ - dup153, - dup357, - part564, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg338 = msg("00017:18", all110); - - var part565 = match("MESSAGE#337:00017:19/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at %{p0}"); - - var part566 = match("MESSAGE#337:00017:19/2", "nwparser.p0", "%{} %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all111 = all_match({ - processors: [ - part565, - dup337, - part566, - ], - on_success: processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ]), - }); - - var msg339 = msg("00017:19", all111); - - var all112 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup151, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - ]), - }); - - var msg340 = msg("00017:20", all112); - - var part567 = match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup151, - dup2, - dup3, - dup59, - dup4, - dup5, - ])); - - var msg341 = msg("00017:21", part567); - - var part568 = match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg342 = msg("00017:22", part568); - - var part569 = match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bound to tunnel interface %{interface}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg343 = msg("00017:24", part569); - - var part570 = match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal standard has been added by admin %{administrator->} via NSRP Peer (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg344 = msg("00017:25", part570); - - var part571 = match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group}, ESP, enc %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg345 = msg("00017:28", part571); - - var part572 = match("MESSAGE#344:00017:29", "nwparser.payload", "L2TP \"%{fld2}\", all-L2TP-users secret \"%{fld3}\" keepalive %{fld4->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg346 = msg("00017:29", part572); - - var select125 = linear_select([ - msg317, - msg318, - msg319, - msg320, - msg321, - msg322, - msg323, - msg324, - msg325, - msg326, - msg327, - msg328, - msg329, - msg330, - msg331, - msg332, - msg333, - msg334, - msg335, - msg336, - msg337, - msg338, - msg339, - msg340, - msg341, - msg342, - msg343, - msg344, - msg345, - msg346, - ]); - - var part573 = match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} and %{fld3->} have been exchanged", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg347 = msg("00018", part573); - - var part574 = match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", processor_chain([ - setc("eventcategory","1502010000"), - dup2, - dup4, - dup5, - dup3, - ])); - - var msg348 = msg("00018:01", part574); - - var part575 = match("MESSAGE#347:00018:02", "nwparser.payload", "Device%{quote}s %{change_attribute->} has been changed from %{change_old->} to %{change_new->} by admin %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg349 = msg("00018:02", part575); - - var part576 = match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg350 = msg("00018:04", part576); - - var part577 = match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} by admin %{administrator->} via NSRP Peer", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg351 = msg("00018:16", part577); - - var part578 = match("MESSAGE#350:00018:06/0", "nwparser.payload", "%{fld2->} Policy %{policy_id->} has been moved %{p0}"); - - var part579 = match("MESSAGE#350:00018:06/1_0", "nwparser.p0", "before %{p0}"); - - var part580 = match("MESSAGE#350:00018:06/1_1", "nwparser.p0", "after %{p0}"); - - var select126 = linear_select([ - part579, - part580, - ]); - - var part581 = match("MESSAGE#350:00018:06/2", "nwparser.p0", "%{fld3->} by admin %{administrator}"); - - var all113 = all_match({ - processors: [ - part578, - select126, - part581, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg352 = msg("00018:06", all113); - - var part582 = match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} application was modified to %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg353 = msg("00018:08", part582); - - var part583 = match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup3, - dup2, - dup9, - dup4, - dup5, - ])); - - var msg354 = msg("00018:09", part583); - - var part584 = match("MESSAGE#353:00018:10/0", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{p0}"); - - var part585 = match("MESSAGE#353:00018:10/1_0", "nwparser.p0", "%{disposition->} from peer unit by %{p0}"); - - var part586 = match("MESSAGE#353:00018:10/1_1", "nwparser.p0", "%{disposition->} by %{p0}"); - - var select127 = linear_select([ - part585, - part586, - ]); - - var part587 = match("MESSAGE#353:00018:10/2", "nwparser.p0", "%{username->} via %{interface->} from host %{saddr->} (%{fld1})"); - - var all114 = all_match({ - processors: [ - part584, - select127, - part587, - ], - on_success: processor_chain([ - dup17, - dup3, - dup2, - dup9, - dup4, - dup5, - ]), - }); - - var msg355 = msg("00018:10", all114); - - var part588 = match("MESSAGE#354:00018:11/1_0", "nwparser.p0", "Service %{service->} was %{p0}"); - - var part589 = match("MESSAGE#354:00018:11/1_1", "nwparser.p0", "Attack group %{signame->} was %{p0}"); - - var select128 = linear_select([ - part588, - part589, - ]); - - var part590 = match("MESSAGE#354:00018:11/2", "nwparser.p0", "%{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} %{p0}"); - - var part591 = match("MESSAGE#354:00018:11/3_0", "nwparser.p0", "to %{daddr}:%{dport}. %{p0}"); - - var select129 = linear_select([ - part591, - dup16, - ]); - - var all115 = all_match({ - processors: [ - dup160, - select128, - part590, - select129, - dup10, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg356 = msg("00018:11", all115); - - var part592 = match("MESSAGE#355:00018:12/0", "nwparser.payload", "In policy %{policy_id}, the %{p0}"); - - var part593 = match("MESSAGE#355:00018:12/1_0", "nwparser.p0", "application %{p0}"); - - var part594 = match("MESSAGE#355:00018:12/1_1", "nwparser.p0", "attack severity %{p0}"); - - var part595 = match("MESSAGE#355:00018:12/1_2", "nwparser.p0", "DI attack component %{p0}"); - - var select130 = linear_select([ - part593, - part594, - part595, - ]); - - var part596 = match("MESSAGE#355:00018:12/2", "nwparser.p0", "was modified by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all116 = all_match({ - processors: [ - part592, - select130, - part596, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg357 = msg("00018:12", all116); - - var part597 = match("MESSAGE#356:00018:32/1", "nwparser.p0", "%{}address %{dhost}(%{daddr}) was %{disposition->} %{p0}"); - - var all117 = all_match({ - processors: [ - dup361, - part597, - dup362, - dup164, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg358 = msg("00018:32", all117); - - var part598 = match("MESSAGE#357:00018:22/1", "nwparser.p0", "%{}address %{dhost->} was %{disposition->} %{p0}"); - - var all118 = all_match({ - processors: [ - dup361, - part598, - dup362, - dup164, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg359 = msg("00018:22", all118); - - var part599 = match("MESSAGE#358:00018:15/0", "nwparser.payload", "%{agent->} was %{disposition->} from policy %{policy_id->} %{p0}"); - - var select131 = linear_select([ - dup78, - dup77, - ]); - - var part600 = match("MESSAGE#358:00018:15/2", "nwparser.p0", "address by admin %{administrator->} via NSRP Peer"); - - var all119 = all_match({ - processors: [ - part599, - select131, - part600, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg360 = msg("00018:15", all119); - - var part601 = match("MESSAGE#359:00018:14/0", "nwparser.payload", "%{agent->} was %{disposition->} %{p0}"); - - var part602 = match("MESSAGE#359:00018:14/1_0", "nwparser.p0", "to%{p0}"); - - var part603 = match("MESSAGE#359:00018:14/1_1", "nwparser.p0", "from%{p0}"); - - var select132 = linear_select([ - part602, - part603, - ]); - - var part604 = match("MESSAGE#359:00018:14/2", "nwparser.p0", "%{}policy %{policy_id->} %{p0}"); - - var part605 = match("MESSAGE#359:00018:14/3_0", "nwparser.p0", "service %{p0}"); - - var part606 = match("MESSAGE#359:00018:14/3_1", "nwparser.p0", "source address %{p0}"); - - var part607 = match("MESSAGE#359:00018:14/3_2", "nwparser.p0", "destination address %{p0}"); - - var select133 = linear_select([ - part605, - part606, - part607, - ]); - - var part608 = match("MESSAGE#359:00018:14/4", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); - - var all120 = all_match({ - processors: [ - part601, - select132, - part604, - select133, - part608, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg361 = msg("00018:14", all120); - - var part609 = match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg362 = msg("00018:29", part609); - - var part610 = match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to policy %{policy_id->} %{rule_group->} by admin %{administrator->} via NSRP Peer %{space->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg363 = msg("00018:07", part610); - - var part611 = match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg364 = msg("00018:18", part611); - - var part612 = match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{disposition->} from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg365 = msg("00018:17", part612); - - var part613 = match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg366 = msg("00018:19", part613); - - var part614 = match("MESSAGE#365:00018:23/0_0", "nwparser.payload", "Destination %{p0}"); - - var part615 = match("MESSAGE#365:00018:23/0_1", "nwparser.payload", "Source %{p0}"); - - var select134 = linear_select([ - part614, - part615, - ]); - - var part616 = match("MESSAGE#365:00018:23/1", "nwparser.p0", "address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} %{p0}"); - - var part617 = match("MESSAGE#365:00018:23/2_0", "nwparser.p0", "from host %{p0}"); - - var select135 = linear_select([ - part617, - dup103, - ]); - - var part618 = match("MESSAGE#365:00018:23/4_0", "nwparser.p0", "%{saddr->} to %{daddr->} %{p0}"); - - var part619 = match("MESSAGE#365:00018:23/4_1", "nwparser.p0", "%{daddr->} %{p0}"); - - var select136 = linear_select([ - part618, - part619, - ]); - - var part620 = match("MESSAGE#365:00018:23/5", "nwparser.p0", "%{dport}:(%{fld1})"); - - var all121 = all_match({ - processors: [ - select134, - part616, - select135, - dup23, - select136, - part620, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg367 = msg("00018:23", all121); - - var part621 = match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg368 = msg("00018:21", part621); - - var part622 = match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{disposition->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg369 = msg("00018:24", part622); - - var part623 = match("MESSAGE#368:00018:25/1", "nwparser.p0", "%{}address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); - - var all122 = all_match({ - processors: [ - dup363, - part623, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg370 = msg("00018:25", all122); - - var part624 = match("MESSAGE#369:00018:30/1", "nwparser.p0", "%{}address %{info->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); - - var all123 = all_match({ - processors: [ - dup363, - part624, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg371 = msg("00018:30", all123); - - var part625 = match("MESSAGE#370:00018:26/0", "nwparser.payload", "In policy %{policy_id}, the application was modified to %{disposition->} by %{p0}"); - - var part626 = match("MESSAGE#370:00018:26/2_1", "nwparser.p0", "%{logon_type->} from host %{saddr}. (%{p0}"); - - var select137 = linear_select([ - dup48, - part626, - ]); - - var all124 = all_match({ - processors: [ - part625, - dup364, - select137, - dup41, - ], - on_success: processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg372 = msg("00018:26", all124); - - var part627 = match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the DI attack component was modified by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg373 = msg("00018:27", part627); - - var part628 = match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the DI attack component was modified by admin %{administrator->} via %{logon_type}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup4, - dup5, - dup9, - setc("info","the DI attack component was modified"), - ])); - - var msg374 = msg("00018:28", part628); - - var part629 = match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition}", processor_chain([ - dup17, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg375 = msg("00018:03", part629); - - var part630 = match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the option %{fld2->} was %{disposition}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg376 = msg("00018:31", part630); - - var select138 = linear_select([ - msg347, - msg348, - msg349, - msg350, - msg351, - msg352, - msg353, - msg354, - msg355, - msg356, - msg357, - msg358, - msg359, - msg360, - msg361, - msg362, - msg363, - msg364, - msg365, - msg366, - msg367, - msg368, - msg369, - msg370, - msg371, - msg372, - msg373, - msg374, - msg375, - msg376, - ]); - - var part631 = match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has %{disposition->} because WebTrends settings have not yet been configured", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg377 = msg("00019", part631); - - var part632 = match("MESSAGE#375:00019:01/2", "nwparser.p0", "has %{disposition->} because syslog settings have not yet been configured"); - - var all125 = all_match({ - processors: [ - dup165, - dup365, - part632, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg378 = msg("00019:01", all125); - - var part633 = match("MESSAGE#376:00019:02/0", "nwparser.payload", "Socket cannot be assigned for %{p0}"); - - var part634 = match("MESSAGE#376:00019:02/1_0", "nwparser.p0", "WebTrends%{}"); - - var part635 = match("MESSAGE#376:00019:02/1_1", "nwparser.p0", "syslog%{}"); - - var select139 = linear_select([ - part634, - part635, - ]); - - var all126 = all_match({ - processors: [ - part633, - select139, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg379 = msg("00019:02", all126); - - var part636 = match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has been %{disposition}", processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg380 = msg("00019:03", part636); - - var select140 = linear_select([ - dup169, - dup78, - ]); - - var select141 = linear_select([ - dup139, - dup170, - dup137, - dup122, - ]); - - var all127 = all_match({ - processors: [ - dup168, - select140, - dup23, - select141, - dup171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg381 = msg("00019:04", all127); - - var part637 = match("MESSAGE#379:00019:05/0", "nwparser.payload", "Syslog message level has been changed to %{p0}"); - - var part638 = match("MESSAGE#379:00019:05/1_0", "nwparser.p0", "debug%{}"); - - var part639 = match("MESSAGE#379:00019:05/1_1", "nwparser.p0", "information%{}"); - - var part640 = match("MESSAGE#379:00019:05/1_2", "nwparser.p0", "notification%{}"); - - var part641 = match("MESSAGE#379:00019:05/1_3", "nwparser.p0", "warning%{}"); - - var part642 = match("MESSAGE#379:00019:05/1_4", "nwparser.p0", "error%{}"); - - var part643 = match("MESSAGE#379:00019:05/1_5", "nwparser.p0", "critical%{}"); - - var part644 = match("MESSAGE#379:00019:05/1_6", "nwparser.p0", "alert%{}"); - - var part645 = match("MESSAGE#379:00019:05/1_7", "nwparser.p0", "emergency%{}"); - - var select142 = linear_select([ - part638, - part639, - part640, - part641, - part642, - part643, - part644, - part645, - ]); - - var all128 = all_match({ - processors: [ - part637, - select142, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg382 = msg("00019:05", all128); - - var part646 = match("MESSAGE#380:00019:06/2", "nwparser.p0", "has been changed to %{p0}"); - - var all129 = all_match({ - processors: [ - dup168, - dup366, - part646, - dup367, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg383 = msg("00019:06", all129); - - var part647 = match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has been %{disposition}", processor_chain([ - dup91, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg384 = msg("00019:07", part647); - - var part648 = match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg385 = msg("00019:08", part648); - - var part649 = match("MESSAGE#383:00019:09/0", "nwparser.payload", "WebTrends host %{p0}"); - - var select143 = linear_select([ - dup139, - dup170, - dup137, - ]); - - var all130 = all_match({ - processors: [ - part649, - select143, - dup171, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg386 = msg("00019:09", all130); - - var part650 = match("MESSAGE#384:00019:10/1_0", "nwparser.p0", "Traffic logging via syslog %{p0}"); - - var part651 = match("MESSAGE#384:00019:10/1_1", "nwparser.p0", "Syslog %{p0}"); - - var select144 = linear_select([ - part650, - part651, - ]); - - var all131 = all_match({ - processors: [ - dup183, - select144, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg387 = msg("00019:10", all131); - - var part652 = match("MESSAGE#385:00019:11/2", "nwparser.p0", "has %{disposition->} because there is no syslog server defined"); - - var all132 = all_match({ - processors: [ - dup165, - dup365, - part652, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg388 = msg("00019:11", all132); - - var part653 = match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg389 = msg("00019:12", part653); - - var part654 = match("MESSAGE#387:00019:13/0", "nwparser.payload", "Syslog server %{hostip->} %{p0}"); - - var select145 = linear_select([ - dup107, - dup106, - ]); - - var part655 = match("MESSAGE#387:00019:13/2", "nwparser.p0", "%{disposition}"); - - var all133 = all_match({ - processors: [ - part654, - select145, - part655, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg390 = msg("00019:13", all133); - - var part656 = match("MESSAGE#388:00019:14/2", "nwparser.p0", "for %{hostip->} has been changed to %{p0}"); - - var all134 = all_match({ - processors: [ - dup168, - dup366, - part656, - dup367, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg391 = msg("00019:14", all134); - - var part657 = match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the TCP server %{hostip}; the connection is closed.", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg392 = msg("00019:15", part657); - - var part658 = match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were removed.%{}", processor_chain([ - setc("eventcategory","1701030000"), - setc("ec_activity","Delete"), - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg393 = msg("00019:16", part658); - - var part659 = match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} host port number has been changed to %{network_port->} %{fld5}", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg394 = msg("00019:17", part659); - - var part660 = match("MESSAGE#392:00019:18/0", "nwparser.payload", "Traffic logging %{p0}"); - - var part661 = match("MESSAGE#392:00019:18/1_0", "nwparser.p0", "via syslog %{p0}"); - - var part662 = match("MESSAGE#392:00019:18/1_1", "nwparser.p0", "for syslog server %{hostip->} %{p0}"); - - var select146 = linear_select([ - part661, - part662, - ]); - - var all135 = all_match({ - processors: [ - part660, - select146, - dup138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg395 = msg("00019:18", all135); - - var part663 = match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog server %{hostip->} was changed to udp", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg396 = msg("00019:19", part663); - - var part664 = match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is enabled on backup device by netscreen via web from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg397 = msg("00019:20", part664); - - var select147 = linear_select([ - msg377, - msg378, - msg379, - msg380, - msg381, - msg382, - msg383, - msg384, - msg385, - msg386, - msg387, - msg388, - msg389, - msg390, - msg391, - msg392, - msg393, - msg394, - msg395, - msg396, - msg397, - ]); - - var part665 = match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg398 = msg("00020", part665); - - var part666 = match("MESSAGE#396:00020:01/0", "nwparser.payload", "System memory is low %{p0}"); - - var part667 = match("MESSAGE#396:00020:01/1_1", "nwparser.p0", "( %{p0}"); - - var select148 = linear_select([ - dup152, - part667, - ]); - - var part668 = match("MESSAGE#396:00020:01/2", "nwparser.p0", "%{fld2->} bytes allocated out of %{p0}"); - - var part669 = match("MESSAGE#396:00020:01/3_0", "nwparser.p0", "total %{fld3->} bytes"); - - var part670 = match("MESSAGE#396:00020:01/3_1", "nwparser.p0", "%{fld4->} bytes total"); - - var select149 = linear_select([ - part669, - part670, - ]); - - var all136 = all_match({ - processors: [ - part666, - select148, - part668, - select149, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg399 = msg("00020:01", all136); - - var part671 = match("MESSAGE#397:00020:02", "nwparser.payload", "System memory is low (%{fld2->} allocated out of %{fld3->} ) %{fld4->} times in %{fld5}", processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg400 = msg("00020:02", part671); - - var select150 = linear_select([ - msg398, - msg399, - msg400, - ]); - - var part672 = match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg401 = msg("00021", part672); - - var part673 = match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range %{info->} has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg402 = msg("00021:01", part673); - - var part674 = match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg403 = msg("00021:02", part674); - - var part675 = match("MESSAGE#401:00021:03", "nwparser.payload", "Connection refused by the DNS server%{}", processor_chain([ - dup185, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg404 = msg("00021:03", part675); - - var part676 = match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg405 = msg("00021:04", part676); - - var part677 = match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg406 = msg("00021:05", part677); - - var part678 = match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - setc("info","DIP port-translation stickiness was modified"), - ])); - - var msg407 = msg("00021:06", part678); - - var select151 = linear_select([ - msg401, - msg402, - msg403, - msg404, - msg405, - msg406, - msg407, - ]); - - var part679 = match("MESSAGE#405:00022/1_0", "nwparser.p0", "power supplies %{p0}"); - - var part680 = match("MESSAGE#405:00022/1_1", "nwparser.p0", "fans %{p0}"); - - var select152 = linear_select([ - part679, - part680, - ]); - - var part681 = match("MESSAGE#405:00022/2", "nwparser.p0", "are %{fld2->} functioning properly"); - - var all137 = all_match({ - processors: [ - dup186, - select152, - part681, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg408 = msg("00022", all137); - - var part682 = match("MESSAGE#406:00022:01/0_0", "nwparser.payload", "At least one power supply %{p0}"); - - var part683 = match("MESSAGE#406:00022:01/0_1", "nwparser.payload", "The power supply %{fld2->} %{p0}"); - - var part684 = match("MESSAGE#406:00022:01/0_2", "nwparser.payload", "At least one fan %{p0}"); - - var select153 = linear_select([ - part682, - part683, - part684, - ]); - - var part685 = match("MESSAGE#406:00022:01/1", "nwparser.p0", "is not functioning properly%{p0}"); - - var all138 = all_match({ - processors: [ - select153, - part685, - dup368, - ], - on_success: processor_chain([ - dup187, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg409 = msg("00022:01", all138); - - var part686 = match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management tunnel has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg410 = msg("00022:02", part686); - - var part687 = match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name has been defined as %{domain}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg411 = msg("00022:03", part687); - - var part688 = match("MESSAGE#409:00022:04/0", "nwparser.payload", "Reporting of the %{p0}"); - - var part689 = match("MESSAGE#409:00022:04/1_0", "nwparser.p0", "network activities %{p0}"); - - var part690 = match("MESSAGE#409:00022:04/1_1", "nwparser.p0", "device resources %{p0}"); - - var part691 = match("MESSAGE#409:00022:04/1_2", "nwparser.p0", "event logs %{p0}"); - - var part692 = match("MESSAGE#409:00022:04/1_3", "nwparser.p0", "summary logs %{p0}"); - - var select154 = linear_select([ - part689, - part690, - part691, - part692, - ]); - - var part693 = match("MESSAGE#409:00022:04/2", "nwparser.p0", "to Global Manager has been %{disposition}"); - - var all139 = all_match({ - processors: [ - part688, - select154, - part693, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg412 = msg("00022:04", all139); - - var part694 = match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg413 = msg("00022:05", part694); - - var part695 = match("MESSAGE#411:00022:06/0", "nwparser.payload", "Global Manager %{p0}"); - - var part696 = match("MESSAGE#411:00022:06/1_0", "nwparser.p0", "report %{p0}"); - - var part697 = match("MESSAGE#411:00022:06/1_1", "nwparser.p0", "listen %{p0}"); - - var select155 = linear_select([ - part696, - part697, - ]); - - var part698 = match("MESSAGE#411:00022:06/2", "nwparser.p0", "port has been set to %{interface}"); - - var all140 = all_match({ - processors: [ - part695, - select155, - part698, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg414 = msg("00022:06", all140); - - var part699 = match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive value has been changed to %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg415 = msg("00022:07", part699); - - var part700 = match("MESSAGE#413:00022:08/0_0", "nwparser.payload", "System temperature %{p0}"); - - var part701 = match("MESSAGE#413:00022:08/0_1", "nwparser.payload", "System's temperature: %{p0}"); - - var part702 = match("MESSAGE#413:00022:08/0_2", "nwparser.payload", "The system temperature %{p0}"); - - var select156 = linear_select([ - part700, - part701, - part702, - ]); - - var part703 = match("MESSAGE#413:00022:08/1", "nwparser.p0", "(%{fld2->} C%{p0}"); - - var part704 = match("MESSAGE#413:00022:08/2_0", "nwparser.p0", "entigrade, %{p0}"); - - var select157 = linear_select([ - part704, - dup96, - ]); - - var part705 = match("MESSAGE#413:00022:08/3", "nwparser.p0", "%{fld3->} F%{p0}"); - - var part706 = match("MESSAGE#413:00022:08/4_0", "nwparser.p0", "ahrenheit %{p0}"); - - var select158 = linear_select([ - part706, - dup96, - ]); - - var part707 = match("MESSAGE#413:00022:08/5", "nwparser.p0", ") is too high%{}"); - - var all141 = all_match({ - processors: [ - select156, - part703, - select157, - part705, - select158, - part707, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg416 = msg("00022:08", all141); - - var part708 = match("MESSAGE#414:00022:09/2", "nwparser.p0", "power supply is no%{p0}"); - - var select159 = linear_select([ - dup191, - dup192, - ]); - - var part709 = match("MESSAGE#414:00022:09/4", "nwparser.p0", "functioning properly%{}"); - - var all142 = all_match({ - processors: [ - dup55, - dup369, - part708, - select159, - part709, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg417 = msg("00022:09", all142); - - var part710 = match("MESSAGE#415:00022:10/0", "nwparser.payload", "The NetScreen device was unable to upgrade the file system%{p0}"); - - var part711 = match("MESSAGE#415:00022:10/1_0", "nwparser.p0", " due to an internal conflict%{}"); - - var part712 = match("MESSAGE#415:00022:10/1_1", "nwparser.p0", ", but the old file system is intact%{}"); - - var select160 = linear_select([ - part711, - part712, - ]); - - var all143 = all_match({ - processors: [ - part710, - select160, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg418 = msg("00022:10", all143); - - var part713 = match("MESSAGE#416:00022:11/0", "nwparser.payload", "The NetScreen device was unable to upgrade %{p0}"); - - var part714 = match("MESSAGE#416:00022:11/1_0", "nwparser.p0", "due to an internal conflict%{}"); - - var part715 = match("MESSAGE#416:00022:11/1_1", "nwparser.p0", "the loader, but the loader is intact%{}"); - - var select161 = linear_select([ - part714, - part715, - ]); - - var all144 = all_match({ - processors: [ - part713, - select161, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg419 = msg("00022:11", all144); - - var part716 = match("MESSAGE#417:00022:12/0", "nwparser.payload", "Battery is no%{p0}"); - - var select162 = linear_select([ - dup192, - dup191, - ]); - - var part717 = match("MESSAGE#417:00022:12/2", "nwparser.p0", "functioning properly.%{}"); - - var all145 = all_match({ - processors: [ - part716, - select162, - part717, - ], - on_success: processor_chain([ - dup188, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg420 = msg("00022:12", all145); - - var part718 = match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2->} Centigrade, %{fld3->} Fahrenheit) is OK now.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg421 = msg("00022:13", part718); - - var part719 = match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is functioning properly. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg422 = msg("00022:14", part719); - - var select163 = linear_select([ - msg408, - msg409, - msg410, - msg411, - msg412, - msg413, - msg414, - msg415, - msg416, - msg417, - msg418, - msg419, - msg420, - msg421, - msg422, - ]); - - var part720 = match("MESSAGE#420:00023", "nwparser.payload", "VIP server %{hostip->} is not responding", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg423 = msg("00023", part720); - - var part721 = match("MESSAGE#421:00023:01", "nwparser.payload", "VIP/load balance server %{hostip->} cannot be contacted", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg424 = msg("00023:01", part721); - - var part722 = match("MESSAGE#422:00023:02", "nwparser.payload", "VIP server %{hostip->} cannot be contacted", processor_chain([ - dup187, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg425 = msg("00023:02", part722); - - var select164 = linear_select([ - msg423, - msg424, - msg425, - ]); - - var part723 = match("MESSAGE#423:00024/0_0", "nwparser.payload", "The DHCP %{p0}"); - - var part724 = match("MESSAGE#423:00024/0_1", "nwparser.payload", " DHCP %{p0}"); - - var select165 = linear_select([ - part723, - part724, - ]); - - var part725 = match("MESSAGE#423:00024/2_0", "nwparser.p0", "IP address pool has %{p0}"); - - var part726 = match("MESSAGE#423:00024/2_1", "nwparser.p0", "options have been %{p0}"); - - var select166 = linear_select([ - part725, - part726, - ]); - - var all146 = all_match({ - processors: [ - select165, - dup193, - select166, - dup52, - dup368, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg426 = msg("00024", all146); - - var part727 = match("MESSAGE#424:00024:01/0_0", "nwparser.payload", "Traffic log %{p0}"); - - var part728 = match("MESSAGE#424:00024:01/0_1", "nwparser.payload", "Alarm log %{p0}"); - - var part729 = match("MESSAGE#424:00024:01/0_2", "nwparser.payload", "Event log %{p0}"); - - var part730 = match("MESSAGE#424:00024:01/0_3", "nwparser.payload", "Self log %{p0}"); - - var part731 = match("MESSAGE#424:00024:01/0_4", "nwparser.payload", "Asset Recovery log %{p0}"); - - var select167 = linear_select([ - part727, - part728, - part729, - part730, - part731, - ]); - - var part732 = match("MESSAGE#424:00024:01/1", "nwparser.p0", "has overflowed%{}"); - - var all147 = all_match({ - processors: [ - select167, - part732, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg427 = msg("00024:01", all147); - - var part733 = match("MESSAGE#425:00024:02/0", "nwparser.payload", "DHCP relay agent settings on %{fld2->} %{p0}"); - - var part734 = match("MESSAGE#425:00024:02/1_0", "nwparser.p0", "are %{p0}"); - - var part735 = match("MESSAGE#425:00024:02/1_1", "nwparser.p0", "have been %{p0}"); - - var select168 = linear_select([ - part734, - part735, - ]); - - var part736 = match("MESSAGE#425:00024:02/2", "nwparser.p0", "%{disposition->} (%{fld1})"); - - var all148 = all_match({ - processors: [ - part733, - select168, - part736, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg428 = msg("00024:02", all148); - - var part737 = match("MESSAGE#426:00024:03/0", "nwparser.payload", "DHCP server IP address pool %{p0}"); - - var select169 = linear_select([ - dup194, - dup106, - ]); - - var part738 = match("MESSAGE#426:00024:03/2", "nwparser.p0", "changed. (%{fld1})"); - - var all149 = all_match({ - processors: [ - part737, - select169, - part738, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg429 = msg("00024:03", all149); - - var select170 = linear_select([ - msg426, - msg427, - msg428, - msg429, - ]); - - var part739 = match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool has changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg430 = msg("00025", part739); - - var part740 = match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{disposition->} to save the certificate authority configuration.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg431 = msg("00025:01", part740); - - var part741 = match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the X509 request file via e-mail", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg432 = msg("00025:02", part741); - - var part742 = match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the CA configuration", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg433 = msg("00025:03", part742); - - var part743 = match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certificates. The %{result}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg434 = msg("00025:04", part743); - - var select171 = linear_select([ - msg430, - msg431, - msg432, - msg433, - msg434, - ]); - - var part744 = match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg435 = msg("00026", part744); - - var part745 = match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on interface %{interface}", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg436 = msg("00026:13", part745); - - var part746 = match("MESSAGE#434:00026:01/2", "nwparser.p0", "PKA key has been %{p0}"); - - var part747 = match("MESSAGE#434:00026:01/4", "nwparser.p0", "admin user %{administrator}. (Key ID = %{fld2})"); - - var all150 = all_match({ - processors: [ - dup195, - dup370, - part746, - dup371, - part747, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg437 = msg("00026:01", all150); - - var part748 = match("MESSAGE#435:00026:02/1_0", "nwparser.p0", ": SCS %{p0}"); - - var select172 = linear_select([ - part748, - dup96, - ]); - - var part749 = match("MESSAGE#435:00026:02/2", "nwparser.p0", "has been %{disposition->} for %{p0}"); - - var part750 = match("MESSAGE#435:00026:02/3_0", "nwparser.p0", "root system %{p0}"); - - var part751 = match("MESSAGE#435:00026:02/3_1", "nwparser.p0", "%{interface->} %{p0}"); - - var select173 = linear_select([ - part750, - part751, - ]); - - var all151 = all_match({ - processors: [ - dup195, - select172, - part749, - select173, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg438 = msg("00026:02", all151); - - var part752 = match("MESSAGE#436:00026:03/2", "nwparser.p0", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}"); - - var all152 = all_match({ - processors: [ - dup195, - dup370, - part752, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg439 = msg("00026:03", all152); - - var part753 = match("MESSAGE#437:00026:04", "nwparser.payload", "SCS: Connection has been terminated for admin user %{administrator->} at %{hostip}:%{network_port}", processor_chain([ - dup198, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg440 = msg("00026:04", part753); - - var part754 = match("MESSAGE#438:00026:05", "nwparser.payload", "SCS: Host client has requested NO cipher from %{interface}", processor_chain([ - dup198, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg441 = msg("00026:05", part754); - - var part755 = match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using PKA RSA from %{saddr}:%{sport}. (key-ID=%{fld2}", processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg442 = msg("00026:06", part755); - - var part756 = match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using password from %{saddr}:%{sport}.", processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg443 = msg("00026:07", part756); - - var part757 = match("MESSAGE#441:00026:08/0", "nwparser.payload", "SSH user %{username->} has been authenticated using %{p0}"); - - var part758 = match("MESSAGE#441:00026:08/2", "nwparser.p0", "from %{saddr}:%{sport->} [ with key ID %{fld2->} ]"); - - var all153 = all_match({ - processors: [ - part757, - dup372, - part758, - ], - on_success: processor_chain([ - dup199, - dup29, - dup30, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg444 = msg("00026:08", all153); - - var part759 = match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interface->} with tunnel ID %{fld2->} received a packet with a bad SPI.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg445 = msg("00026:09", part759); - - var part760 = match("MESSAGE#443:00026:10/0", "nwparser.payload", "SSH: %{p0}"); - - var part761 = match("MESSAGE#443:00026:10/1_0", "nwparser.p0", "Failed %{p0}"); - - var part762 = match("MESSAGE#443:00026:10/1_1", "nwparser.p0", "Attempt %{p0}"); - - var select174 = linear_select([ - part761, - part762, - ]); - - var part763 = match("MESSAGE#443:00026:10/3_0", "nwparser.p0", "bind duplicate %{p0}"); - - var select175 = linear_select([ - part763, - dup201, - ]); - - var part764 = match("MESSAGE#443:00026:10/6", "nwparser.p0", "admin user '%{administrator}' (Key ID %{fld2})"); - - var all154 = all_match({ - processors: [ - part760, - select174, - dup103, - select175, - dup202, - dup373, - part764, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg446 = msg("00026:10", all154); - - var part765 = match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA keys (%{fld2}) has been bound to user '%{username}' Key not bound. (Key ID %{fld3})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg447 = msg("00026:11", part765); - - var part766 = match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg448 = msg("00026:12", part766); - - var select176 = linear_select([ - msg435, - msg436, - msg437, - msg438, - msg439, - msg440, - msg441, - msg442, - msg443, - msg444, - msg445, - msg446, - msg447, - msg448, - ]); - - var part767 = match("MESSAGE#446:00027/2", "nwparser.p0", "user %{username->} from %{p0}"); - - var part768 = match("MESSAGE#446:00027/3_0", "nwparser.p0", "IP address %{saddr}:%{sport}"); - - var part769 = match("MESSAGE#446:00027/3_1", "nwparser.p0", "%{saddr}:%{sport}"); - - var part770 = match("MESSAGE#446:00027/3_2", "nwparser.p0", "console%{}"); - - var select177 = linear_select([ - part768, - part769, - part770, - ]); - - var all155 = all_match({ - processors: [ - dup204, - dup374, - part767, - select177, - ], - on_success: processor_chain([ - dup206, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg449 = msg("00027", all155); - - var part771 = match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg450 = msg("00027:01", part771); - - var part772 = match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg451 = msg("00027:02", part772); - - var part773 = match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg452 = msg("00027:03", part773); - - var part774 = match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg453 = msg("00027:04", part774); - - var part775 = match("MESSAGE#451:00027:05/0", "nwparser.payload", "ScreenOS %{version->} %{p0}"); - - var part776 = match("MESSAGE#451:00027:05/1_0", "nwparser.p0", "Serial %{p0}"); - - var part777 = match("MESSAGE#451:00027:05/1_1", "nwparser.p0", "serial %{p0}"); - - var select178 = linear_select([ - part776, - part777, - ]); - - var part778 = match("MESSAGE#451:00027:05/2", "nwparser.p0", "# %{fld2}: Asset recovery %{p0}"); - - var part779 = match("MESSAGE#451:00027:05/3_0", "nwparser.p0", "performed %{p0}"); - - var select179 = linear_select([ - part779, - dup127, - ]); - - var select180 = linear_select([ - dup207, - dup208, - ]); - - var all156 = all_match({ - processors: [ - part775, - select178, - part778, - select179, - dup23, - select180, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg454 = msg("00027:05", all156); - - var part780 = match("MESSAGE#452:00027:06/0", "nwparser.payload", "Device Reset (Asset Recovery) has been %{p0}"); - - var select181 = linear_select([ - dup208, - dup207, - ]); - - var all157 = all_match({ - processors: [ - part780, - select181, - ], - on_success: processor_chain([ - setc("eventcategory","1606000000"), - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg455 = msg("00027:06", all157); - - var part781 = match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg456 = msg("00027:07", part781); - - var part782 = match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been erased%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg457 = msg("00027:08", part782); - - var part783 = match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due to expire in %{fld3}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg458 = msg("00027:09", part783); - - var part784 = match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has expired.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg459 = msg("00027:10", part784); - - var part785 = match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired after 30-day grace period.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg460 = msg("00027:11", part785); - - var part786 = match("MESSAGE#458:00027:12/0", "nwparser.payload", "Request to retrieve license key failed to reach %{p0}"); - - var part787 = match("MESSAGE#458:00027:12/1_0", "nwparser.p0", "the server %{p0}"); - - var select182 = linear_select([ - part787, - dup193, - ]); - - var part788 = match("MESSAGE#458:00027:12/2", "nwparser.p0", "by %{fld2}. Server url: %{url}"); - - var all158 = all_match({ - processors: [ - part786, - select182, - part788, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg461 = msg("00027:12", all158); - - var part789 = match("MESSAGE#459:00027:13/2", "nwparser.p0", "user %{username}"); - - var all159 = all_match({ - processors: [ - dup204, - dup374, - part789, - ], - on_success: processor_chain([ - dup206, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg462 = msg("00027:13", all159); - - var part790 = match("MESSAGE#460:00027:14/0", "nwparser.payload", "Configuration Erasure Process %{p0}"); - - var part791 = match("MESSAGE#460:00027:14/1_0", "nwparser.p0", "has been initiated %{p0}"); - - var part792 = match("MESSAGE#460:00027:14/1_1", "nwparser.p0", "aborted %{p0}"); - - var select183 = linear_select([ - part791, - part792, - ]); - - var part793 = match("MESSAGE#460:00027:14/2", "nwparser.p0", ".%{space}(%{fld1})"); - - var all160 = all_match({ - processors: [ - part790, - select183, - part793, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg463 = msg("00027:14", all160); - - var part794 = match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg464 = msg("00027:15", part794); - - var part795 = match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{policy_id->} name \"%{fld2->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg465 = msg("00027:16", part795); - - var part796 = match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locked and will be unlocked after %{duration->} minutes (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg466 = msg("00027:17", part796); - - var part797 = match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{username->} from %{saddr->} is refused as this account is locked (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg467 = msg("00027:18", part797); - - var part798 = match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg468 = msg("00027:19", part798); - - var select184 = linear_select([ - msg449, - msg450, - msg451, - msg452, - msg453, - msg454, - msg455, - msg456, - msg457, - msg458, - msg459, - msg460, - msg461, - msg462, - msg463, - msg464, - msg465, - msg466, - msg467, - msg468, - ]); - - var part799 = match("MESSAGE#462:00028/0_0", "nwparser.payload", "An Intruder%{p0}"); - - var part800 = match("MESSAGE#462:00028/0_1", "nwparser.payload", "Intruder%{p0}"); - - var part801 = match("MESSAGE#462:00028/0_2", "nwparser.payload", "An intruter%{p0}"); - - var select185 = linear_select([ - part799, - part800, - part801, - ]); - - var part802 = match("MESSAGE#462:00028/1", "nwparser.p0", "%{}has attempted to connect to the NetScreen-Global PRO port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all161 = all_match({ - processors: [ - select185, - part802, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - setc("signame","Attempt to Connect to the NetScreen-Global Port"), - ]), - }); - - var msg469 = msg("00028", all161); - - var part803 = match("MESSAGE#463:00029", "nwparser.payload", "DNS has been refreshed%{}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg470 = msg("00029", part803); - - var part804 = match("MESSAGE#464:00029:01", "nwparser.payload", "DHCP file write: out of memory.%{}", processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg471 = msg("00029:01", part804); - - var part805 = match("MESSAGE#465:00029:02/0", "nwparser.payload", "The DHCP process cannot open file %{fld2->} to %{p0}"); - - var part806 = match("MESSAGE#465:00029:02/1_0", "nwparser.p0", "read %{p0}"); - - var part807 = match("MESSAGE#465:00029:02/1_1", "nwparser.p0", "write %{p0}"); - - var select186 = linear_select([ - part806, - part807, - ]); - - var part808 = match("MESSAGE#465:00029:02/2", "nwparser.p0", "data.%{}"); - - var all162 = all_match({ - processors: [ - part805, - select186, - part808, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg472 = msg("00029:02", all162); - - var part809 = match("MESSAGE#466:00029:03/2", "nwparser.p0", "%{} %{interface->} is full. Unable to %{p0}"); - - var part810 = match("MESSAGE#466:00029:03/3_0", "nwparser.p0", "commit %{p0}"); - - var part811 = match("MESSAGE#466:00029:03/3_1", "nwparser.p0", "offer %{p0}"); - - var select187 = linear_select([ - part810, - part811, - ]); - - var part812 = match("MESSAGE#466:00029:03/4", "nwparser.p0", "IP address to client at %{fld2}"); - - var all163 = all_match({ - processors: [ - dup210, - dup337, - part809, - select187, - part812, - ], - on_success: processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg473 = msg("00029:03", all163); - - var part813 = match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{interface->} (another server found on %{hostip}).", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg474 = msg("00029:04", part813); - - var select188 = linear_select([ - msg470, - msg471, - msg472, - msg473, - msg474, - ]); - - var part814 = match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg475 = msg("00030", part814); - - var part815 = match("MESSAGE#469:00030:01/0", "nwparser.payload", "DSS checking of CRLs has been changed from %{p0}"); - - var part816 = match("MESSAGE#469:00030:01/1_0", "nwparser.p0", "0 to 1%{}"); - - var part817 = match("MESSAGE#469:00030:01/1_1", "nwparser.p0", "1 to 0%{}"); - - var select189 = linear_select([ - part816, - part817, - ]); - - var all164 = all_match({ - processors: [ - part815, - select189, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg476 = msg("00030:01", all164); - - var part818 = match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg477 = msg("00030:05", part818); - - var part819 = match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate request the %{fld2->} field has been changed from %{fld3}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg478 = msg("00030:06", part819); - - var part820 = match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be loaded%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg479 = msg("00030:07", part820); - - var part821 = match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate cannot be generated%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg480 = msg("00030:10", part821); - - var part822 = match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS image has successfully been updated%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg481 = msg("00030:12", part822); - - var part823 = match("MESSAGE#475:00030:13/0", "nwparser.payload", "The public key used for ScreenOS image authentication cannot be %{p0}"); - - var part824 = match("MESSAGE#475:00030:13/1_0", "nwparser.p0", "decoded%{}"); - - var part825 = match("MESSAGE#475:00030:13/1_1", "nwparser.p0", "loaded%{}"); - - var select190 = linear_select([ - part824, - part825, - ]); - - var all165 = all_match({ - processors: [ - part823, - select190, - ], - on_success: processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg482 = msg("00030:13", all165); - - var part826 = match("MESSAGE#476:00030:14/1_0", "nwparser.p0", "CA IDENT %{p0}"); - - var part827 = match("MESSAGE#476:00030:14/1_1", "nwparser.p0", "Challenge password %{p0}"); - - var part828 = match("MESSAGE#476:00030:14/1_2", "nwparser.p0", "CA CGI URL %{p0}"); - - var part829 = match("MESSAGE#476:00030:14/1_3", "nwparser.p0", "RA CGI URL %{p0}"); - - var select191 = linear_select([ - part826, - part827, - part828, - part829, - ]); - - var part830 = match("MESSAGE#476:00030:14/2", "nwparser.p0", "for SCEP %{p0}"); - - var part831 = match("MESSAGE#476:00030:14/3_0", "nwparser.p0", "requests %{p0}"); - - var select192 = linear_select([ - part831, - dup16, - ]); - - var part832 = match("MESSAGE#476:00030:14/4", "nwparser.p0", "has been changed from %{change_old->} to %{change_new}"); - - var all166 = all_match({ - processors: [ - dup55, - select191, - part830, - select192, - part832, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg483 = msg("00030:14", all166); - - var msg484 = msg("00030:02", dup375); - - var part833 = match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS image authentication is invalid%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg485 = msg("00030:15", part833); - - var part834 = match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been deleted%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg486 = msg("00030:16", part834); - - var part835 = match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accept per config DN %{interface}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg487 = msg("00030:18", part835); - - var part836 = match("MESSAGE#481:00030:19/0", "nwparser.payload", "PKI: A configurable item %{change_attribute->} %{p0}"); - - var part837 = match("MESSAGE#481:00030:19/1_0", "nwparser.p0", "mode %{p0}"); - - var part838 = match("MESSAGE#481:00030:19/1_1", "nwparser.p0", "field%{p0}"); - - var select193 = linear_select([ - part837, - part838, - ]); - - var part839 = match("MESSAGE#481:00030:19/2", "nwparser.p0", "%{}has changed from %{change_old->} to %{change_new}"); - - var all167 = all_match({ - processors: [ - part836, - select193, - part839, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg488 = msg("00030:19", all167); - - var part840 = match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for total of %{fld2->} items.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg489 = msg("00030:30", part840); - - var part841 = match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} out of order expect %{fld3->} of %{fld4}.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg490 = msg("00030:31", part841); - - var part842 = match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} without first item.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg491 = msg("00030:32", part842); - - var part843 = match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received normal item during cold sync.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg492 = msg("00030:33", part843); - - var part844 = match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} is deleted.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg493 = msg("00030:34", part844); - - var part845 = match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availability synchronization %{fld2->} failed.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg494 = msg("00030:35", part845); - - var part846 = match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute->} has changed from %{change_old->} to %{change_new}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg495 = msg("00030:36", part846); - - var part847 = match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate for the ScreenOS image authentication is invalid.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg496 = msg("00030:37", part847); - - var part848 = match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certificate cannot be sync to vsd member.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg497 = msg("00030:38", part848); - - var part849 = match("MESSAGE#491:00030:39/0", "nwparser.payload", "PKI: The X.509 certificate %{p0}"); - - var part850 = match("MESSAGE#491:00030:39/1_0", "nwparser.p0", "revocation list %{p0}"); - - var select194 = linear_select([ - part850, - dup16, - ]); - - var part851 = match("MESSAGE#491:00030:39/2", "nwparser.p0", "cannot be loaded during NSRP synchronization.%{}"); - - var all168 = all_match({ - processors: [ - part849, - select194, - part851, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg498 = msg("00030:39", all168); - - var part852 = match("MESSAGE#492:00030:17/0", "nwparser.payload", "X509 %{p0}"); - - var part853 = match("MESSAGE#492:00030:17/2", "nwparser.p0", "cannot be loaded%{}"); - - var all169 = all_match({ - processors: [ - part852, - dup376, - part853, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg499 = msg("00030:17", all169); - - var part854 = match("MESSAGE#493:00030:40/0", "nwparser.payload", "PKI: The certificate %{fld2->} will expire %{p0}"); - - var part855 = match("MESSAGE#493:00030:40/1_1", "nwparser.p0", "please %{p0}"); - - var select195 = linear_select([ - dup214, - part855, - ]); - - var part856 = match("MESSAGE#493:00030:40/2", "nwparser.p0", "renew.%{}"); - - var all170 = all_match({ - processors: [ - part854, - select195, - part856, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg500 = msg("00030:40", all170); - - var part857 = match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocation list has expired issued by certificate authority %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg501 = msg("00030:41", part857); - - var part858 = match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration content of certificate authority %{fld2->} is not valid.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg502 = msg("00030:42", part858); - - var part859 = match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot allocate this object id number %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg503 = msg("00030:43", part859); - - var part860 = match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg504 = msg("00030:44", part860); - - var part861 = match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find the PKI object %{fld2->} during cold sync.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg505 = msg("00030:45", part861); - - var part862 = match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X.509 certificate onto the device certificate %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg506 = msg("00030:46", part862); - - var part863 = match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a certificate pending SCEP completion.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg507 = msg("00030:47", part863); - - var part864 = match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load an X.509 certificate revocation list (CRL).%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg508 = msg("00030:48", part864); - - var part865 = match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load the CA certificate received through SCEP.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg509 = msg("00030:49", part865); - - var part866 = match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg510 = msg("00030:50", part866); - - var part867 = match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load the X.509 local certificate received through SCEP.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg511 = msg("00030:51", part867); - - var part868 = match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load the X.509 %{product->} during boot.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg512 = msg("00030:52", part868); - - var part869 = match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load the X.509 certificate file.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg513 = msg("00030:53", part869); - - var part870 = match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the coldsync of the PKI object at %{fld2->} attempt.", processor_chain([ - dup44, - dup211, - dup31, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg514 = msg("00030:54", part870); - - var part871 = match("MESSAGE#508:00030:55/0", "nwparser.payload", "PKI: The device could not generate %{p0}"); - - var all171 = all_match({ - processors: [ - part871, - dup377, - dup217, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg515 = msg("00030:55", all171); - - var part872 = match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an invalid RSA key.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg516 = msg("00030:56", part872); - - var part873 = match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an invalid digital signature algorithm (DSA) key.%{}", processor_chain([ - dup35, - dup218, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg517 = msg("00030:57", part873); - - var part874 = match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to coldsync the PKI object at %{fld2->} attempt.", processor_chain([ - dup86, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg518 = msg("00030:58", part874); - - var part875 = match("MESSAGE#512:00030:59", "nwparser.payload", "PKI: The device failed to decode the public key of the image%{quote}s signer certificate.", processor_chain([ - dup35, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg519 = msg("00030:59", part875); - - var part876 = match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to install the RSA key.%{}", processor_chain([ - dup35, - dup218, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg520 = msg("00030:60", part876); - - var part877 = match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to retrieve the pending certificate %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg521 = msg("00030:61", part877); - - var part878 = match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to save the certificate authority related configuration.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg522 = msg("00030:62", part878); - - var part879 = match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to store the authority configuration.%{}", processor_chain([ - dup18, - dup219, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg523 = msg("00030:63", part879); - - var part880 = match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg524 = msg("00030:64", part880); - - var part881 = match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg525 = msg("00030:65", part881); - - var part882 = match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected an invalid X.509 object attribute %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg526 = msg("00030:66", part882); - - var part883 = match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected invalid X.509 object content.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg527 = msg("00030:67", part883); - - var part884 = match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to load an invalid X.509 object.%{}", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg528 = msg("00030:68", part884); - - var part885 = match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading the version 0 PKI data.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg529 = msg("00030:69", part885); - - var part886 = match("MESSAGE#523:00030:70/0", "nwparser.payload", "PKI: The device successfully generated a new %{p0}"); - - var all172 = all_match({ - processors: [ - part886, - dup377, - dup217, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg530 = msg("00030:70", all172); - - var part887 = match("MESSAGE#524:00030:71", "nwparser.payload", "PKI: The public key of image%{quote}s signer has been loaded successfully, for future image authentication.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg531 = msg("00030:71", part887); - - var part888 = match("MESSAGE#525:00030:72", "nwparser.payload", "PKI: The signature of the image%{quote}s signer certificate cannot be verified.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg532 = msg("00030:72", part888); - - var part889 = match("MESSAGE#526:00030:73/0", "nwparser.payload", "PKI: The %{p0}"); - - var part890 = match("MESSAGE#526:00030:73/1_0", "nwparser.p0", "file name %{p0}"); - - var part891 = match("MESSAGE#526:00030:73/1_1", "nwparser.p0", "friendly name of a certificate %{p0}"); - - var part892 = match("MESSAGE#526:00030:73/1_2", "nwparser.p0", "vsys name %{p0}"); - - var select196 = linear_select([ - part890, - part891, - part892, - ]); - - var part893 = match("MESSAGE#526:00030:73/2", "nwparser.p0", "is too long %{fld2->} to do NSRP synchronization allowed %{fld3}."); - - var all173 = all_match({ - processors: [ - part889, - select196, - part893, - ], - on_success: processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg533 = msg("00030:73", all173); - - var part894 = match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier version save to file.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg534 = msg("00030:74", part894); - - var part895 = match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has been deleted distinguished name %{username}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg535 = msg("00030:75", part895); - - var part896 = match("MESSAGE#529:00030:76/0", "nwparser.payload", "PKI: X.509 %{p0}"); - - var part897 = match("MESSAGE#529:00030:76/2", "nwparser.p0", "file has been loaded successfully filename %{fld2}."); - - var all174 = all_match({ - processors: [ - part896, - dup376, - part897, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg536 = msg("00030:76", all174); - - var part898 = match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA key.%{}", processor_chain([ - dup18, - dup218, - dup51, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg537 = msg("00030:77", part898); - - var part899 = match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when requesting certificate.%{}", processor_chain([ - dup35, - dup211, - dup220, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg538 = msg("00030:78", part899); - - var part900 = match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check per config DN %{username}.", processor_chain([ - dup35, - dup211, - dup220, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg539 = msg("00030:79", part900); - - var part901 = match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 objects.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg540 = msg("00030:80", part901); - - var part902 = match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject name %{fld2->} is deleted.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg541 = msg("00030:81", part902); - - var part903 = match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg542 = msg("00030:82", part903); - - var part904 = match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire authcfg for this CA cert %{fld2}.", processor_chain([ - dup35, - dup211, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg543 = msg("00030:83", part904); - - var part905 = match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg from global.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg544 = msg("00030:84", part905); - - var part906 = match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is high (%{fld2->} alarm threshold: %{trigger_val}) %{info}", processor_chain([ - setc("eventcategory","1603080000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg545 = msg("00030:85", part906); - - var part907 = match("MESSAGE#539:00030:86/2", "nwparser.p0", "Pair-wise invoked by started after key generation. (%{fld1})"); - - var all175 = all_match({ - processors: [ - dup221, - dup378, - part907, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg546 = msg("00030:86", all175); - - var part908 = match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is high (%{fld2->} > %{fld3->} ) %{fld4->} times in %{fld5->} minute (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg547 = msg("00030:87", part908); - - var part909 = match("MESSAGE#1217:00030:88/2", "nwparser.p0", "Pair-wise invoked by passed. (%{fld1})\u003c\u003c%{fld6}>"); - - var all176 = all_match({ - processors: [ - dup221, - dup378, - part909, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg548 = msg("00030:88", all176); - - var select197 = linear_select([ - msg475, - msg476, - msg477, - msg478, - msg479, - msg480, - msg481, - msg482, - msg483, - msg484, - msg485, - msg486, - msg487, - msg488, - msg489, - msg490, - msg491, - msg492, - msg493, - msg494, - msg495, - msg496, - msg497, - msg498, - msg499, - msg500, - msg501, - msg502, - msg503, - msg504, - msg505, - msg506, - msg507, - msg508, - msg509, - msg510, - msg511, - msg512, - msg513, - msg514, - msg515, - msg516, - msg517, - msg518, - msg519, - msg520, - msg521, - msg522, - msg523, - msg524, - msg525, - msg526, - msg527, - msg528, - msg529, - msg530, - msg531, - msg532, - msg533, - msg534, - msg535, - msg536, - msg537, - msg538, - msg539, - msg540, - msg541, - msg542, - msg543, - msg544, - msg545, - msg546, - msg547, - msg548, - ]); - - var part910 = match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP address %{hostip->} changed from %{sinterface->} to interface %{dinterface->} (%{fld1})", processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg549 = msg("00031:13", part910); - - var part911 = match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg550 = msg("00031", part911); - - var part912 = match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg551 = msg("00031:01", part912); - - var part913 = match("MESSAGE#543:00031:02/0", "nwparser.payload", "SNMP community %{fld2->} attributes-write access %{p0}"); - - var part914 = match("MESSAGE#543:00031:02/2", "nwparser.p0", "; receive traps %{p0}"); - - var part915 = match("MESSAGE#543:00031:02/4", "nwparser.p0", "; receive traffic alarms %{p0}"); - - var part916 = match("MESSAGE#543:00031:02/6", "nwparser.p0", "-have been modified%{}"); - - var all177 = all_match({ - processors: [ - part913, - dup379, - part914, - dup379, - part915, - dup379, - part916, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg552 = msg("00031:02", all177); - - var part917 = match("MESSAGE#544:00031:03/0", "nwparser.payload", "%{fld2->} SNMP host %{hostip->} has been %{p0}"); - - var select198 = linear_select([ - dup130, - dup129, - ]); - - var part918 = match("MESSAGE#544:00031:03/2", "nwparser.p0", "SNMP community %{fld3}"); - - var all178 = all_match({ - processors: [ - part917, - select198, - part918, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg553 = msg("00031:03", all178); - - var part919 = match("MESSAGE#545:00031:04/0", "nwparser.payload", "SNMP %{p0}"); - - var part920 = match("MESSAGE#545:00031:04/1_0", "nwparser.p0", "contact %{p0}"); - - var select199 = linear_select([ - part920, - dup226, - ]); - - var part921 = match("MESSAGE#545:00031:04/2", "nwparser.p0", "description has been modified%{}"); - - var all179 = all_match({ - processors: [ - part919, - select199, - part921, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg554 = msg("00031:04", all179); - - var part922 = match("MESSAGE#546:00031:11/0", "nwparser.payload", "SNMP system %{p0}"); - - var select200 = linear_select([ - dup226, - dup25, - ]); - - var part923 = match("MESSAGE#546:00031:11/2", "nwparser.p0", "has been changed to %{fld2}. (%{fld1})"); - - var all180 = all_match({ - processors: [ - part922, - select200, - part923, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg555 = msg("00031:11", all180); - - var part924 = match("MESSAGE#547:00031:08/0", "nwparser.payload", "%{fld2}: SNMP community name \"%{fld3}\" %{p0}"); - - var part925 = match("MESSAGE#547:00031:08/1_0", "nwparser.p0", "attributes -- %{p0}"); - - var part926 = match("MESSAGE#547:00031:08/1_1", "nwparser.p0", "-- %{p0}"); - - var select201 = linear_select([ - part925, - part926, - ]); - - var part927 = match("MESSAGE#547:00031:08/2", "nwparser.p0", "write access, %{p0}"); - - var part928 = match("MESSAGE#547:00031:08/4", "nwparser.p0", "; receive traps, %{p0}"); - - var part929 = match("MESSAGE#547:00031:08/6", "nwparser.p0", "; receive traffic alarms, %{p0}"); - - var part930 = match("MESSAGE#547:00031:08/8", "nwparser.p0", "-%{p0}"); - - var part931 = match("MESSAGE#547:00031:08/9_0", "nwparser.p0", "- %{p0}"); - - var select202 = linear_select([ - part931, - dup96, - ]); - - var part932 = match("MESSAGE#547:00031:08/10", "nwparser.p0", "have been modified%{}"); - - var all181 = all_match({ - processors: [ - part924, - select201, - part927, - dup379, - part928, - dup379, - part929, - dup379, - part930, - select202, - part932, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg556 = msg("00031:08", all181); - - var part933 = match("MESSAGE#548:00031:05/0", "nwparser.payload", "Detect IP conflict (%{fld2}) on %{p0}"); - - var all182 = all_match({ - processors: [ - part933, - dup337, - dup227, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg557 = msg("00031:05", all182); - - var part934 = match("MESSAGE#549:00031:06/1_0", "nwparser.p0", "q, %{p0}"); - - var select203 = linear_select([ - part934, - dup229, - dup230, - ]); - - var part935 = match("MESSAGE#549:00031:06/2", "nwparser.p0", "detect IP conflict ( %{hostip->} )%{p0}"); - - var select204 = linear_select([ - dup105, - dup96, - ]); - - var part936 = match("MESSAGE#549:00031:06/4", "nwparser.p0", "mac%{p0}"); - - var part937 = match("MESSAGE#549:00031:06/6", "nwparser.p0", "%{macaddr->} on %{p0}"); - - var all183 = all_match({ - processors: [ - dup228, - select203, - part935, - select204, - part936, - dup356, - part937, - dup352, - dup23, - dup380, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg558 = msg("00031:06", all183); - - var part938 = match("MESSAGE#550:00031:07/2", "nwparser.p0", "detects a duplicate virtual security device group master IP address %{hostip}, MAC address %{macaddr->} on %{p0}"); - - var all184 = all_match({ - processors: [ - dup228, - dup381, - part938, - dup337, - dup227, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg559 = msg("00031:07", all184); - - var part939 = match("MESSAGE#551:00031:09/2", "nwparser.p0", "detected an IP conflict (IP %{hostip}, MAC %{macaddr}) on interface %{p0}"); - - var all185 = all_match({ - processors: [ - dup228, - dup381, - part939, - dup380, - ], - on_success: processor_chain([ - dup121, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg560 = msg("00031:09", all185); - - var part940 = match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{fld3}\" has been moved. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg561 = msg("00031:10", part940); - - var part941 = match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has been changed to %{fld3}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg562 = msg("00031:12", part941); - - var select205 = linear_select([ - msg549, - msg550, - msg551, - msg552, - msg553, - msg554, - msg555, - msg556, - msg557, - msg558, - msg559, - msg560, - msg561, - msg562, - ]); - - var part942 = match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup232, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg563 = msg("00032", part942); - - var part943 = match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg564 = msg("00032:01", part943); - - var part944 = match("MESSAGE#556:00032:03/0", "nwparser.payload", "Vsys %{fld2->} has been %{p0}"); - - var part945 = match("MESSAGE#556:00032:03/1_0", "nwparser.p0", "changed to %{fld3}"); - - var part946 = match("MESSAGE#556:00032:03/1_1", "nwparser.p0", "created%{}"); - - var part947 = match("MESSAGE#556:00032:03/1_2", "nwparser.p0", "deleted%{}"); - - var part948 = match("MESSAGE#556:00032:03/1_3", "nwparser.p0", "removed%{}"); - - var select206 = linear_select([ - part945, - part946, - part947, - part948, - ]); - - var all186 = all_match({ - processors: [ - part944, - select206, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg565 = msg("00032:03", all186); - - var part949 = match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup59, - dup5, - dup61, - ])); - - var msg566 = msg("00032:04", part949); - - var part950 = match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsys %{fld2->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg567 = msg("00032:05", part950); - - var msg568 = msg("00032:02", dup375); - - var select207 = linear_select([ - msg563, - msg564, - msg565, - msg566, - msg567, - msg568, - ]); - - var part951 = match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("agent","NSM"), - ])); - - var msg569 = msg("00033:25", part951); - - var part952 = match("MESSAGE#561:00033/1", "nwparser.p0", "timeout value has been %{p0}"); - - var part953 = match("MESSAGE#561:00033/2_1", "nwparser.p0", "returned%{p0}"); - - var select208 = linear_select([ - dup52, - part953, - ]); - - var part954 = match("MESSAGE#561:00033/3", "nwparser.p0", "%{}to %{fld2}"); - - var all187 = all_match({ - processors: [ - dup382, - part952, - select208, - part954, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg570 = msg("00033", all187); - - var part955 = match("MESSAGE#562:00033:03/1_0", "nwparser.p0", "Global PRO %{p0}"); - - var part956 = match("MESSAGE#562:00033:03/1_1", "nwparser.p0", "%{fld3->} %{p0}"); - - var select209 = linear_select([ - part955, - part956, - ]); - - var part957 = match("MESSAGE#562:00033:03/4", "nwparser.p0", "host has been set to %{fld4}"); - - var all188 = all_match({ - processors: [ - dup160, - select209, - dup23, - dup369, - part957, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg571 = msg("00033:03", all188); - - var part958 = match("MESSAGE#563:00033:02/3", "nwparser.p0", "host has been %{disposition}"); - - var all189 = all_match({ - processors: [ - dup382, - dup23, - dup369, - part958, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg572 = msg("00033:02", all189); - - var part959 = match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg573 = msg("00033:04", part959); - - var part960 = match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg574 = msg("00033:05", part960); - - var part961 = match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The attack occurred %{dclass_counter1->} times", processor_chain([ - dup27, - dup2, - dup3, - dup59, - dup4, - dup5, - dup61, - ])); - - var msg575 = msg("00033:06", part961); - - var part962 = match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The threshold was exceeded %{dclass_counter1->} times", processor_chain([ - dup27, - dup2, - dup3, - setc("dclass_counter1_string","Number of times the threshold was exceeded"), - dup4, - dup5, - dup61, - ])); - - var msg576 = msg("00033:01", part962); - - var part963 = match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{service->} has been %{disposition->} from %{fld2->} distribution", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg577 = msg("00033:07", part963); - - var part964 = match("MESSAGE#569:00033:08/2", "nwparser.p0", "?s CA certificate field has not been specified.%{}"); - - var all190 = all_match({ - processors: [ - dup235, - dup383, - part964, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg578 = msg("00033:08", all190); - - var part965 = match("MESSAGE#570:00033:09/2", "nwparser.p0", "?s Cert-Subject field has not been specified.%{}"); - - var all191 = all_match({ - processors: [ - dup235, - dup383, - part965, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg579 = msg("00033:09", all191); - - var part966 = match("MESSAGE#571:00033:10/2", "nwparser.p0", "?s host field has been %{p0}"); - - var part967 = match("MESSAGE#571:00033:10/3_0", "nwparser.p0", "set to %{fld2->} %{p0}"); - - var select210 = linear_select([ - part967, - dup238, - ]); - - var all192 = all_match({ - processors: [ - dup235, - dup383, - part966, - select210, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg580 = msg("00033:10", all192); - - var part968 = match("MESSAGE#572:00033:11/2", "nwparser.p0", "?s outgoing interface used to report NACN to Policy Manager %{p0}"); - - var part969 = match("MESSAGE#572:00033:11/4", "nwparser.p0", "has not been specified.%{}"); - - var all193 = all_match({ - processors: [ - dup235, - dup383, - part968, - dup383, - part969, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg581 = msg("00033:11", all193); - - var part970 = match("MESSAGE#573:00033:12/2", "nwparser.p0", "?s password field has been %{p0}"); - - var select211 = linear_select([ - dup101, - dup238, - ]); - - var all194 = all_match({ - processors: [ - dup235, - dup383, - part970, - select211, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg582 = msg("00033:12", all194); - - var part971 = match("MESSAGE#574:00033:13/2", "nwparser.p0", "?s policy-domain field has been %{p0}"); - - var part972 = match("MESSAGE#574:00033:13/3_0", "nwparser.p0", "unset .%{}"); - - var part973 = match("MESSAGE#574:00033:13/3_1", "nwparser.p0", "set to %{domain}."); - - var select212 = linear_select([ - part972, - part973, - ]); - - var all195 = all_match({ - processors: [ - dup235, - dup383, - part971, - select212, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg583 = msg("00033:13", all195); - - var part974 = match("MESSAGE#575:00033:14/2", "nwparser.p0", "?s CA certificate field has been set to %{fld2}."); - - var all196 = all_match({ - processors: [ - dup235, - dup383, - part974, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg584 = msg("00033:14", all196); - - var part975 = match("MESSAGE#576:00033:15/2", "nwparser.p0", "?s Cert-Subject field has been set to %{fld2}."); - - var all197 = all_match({ - processors: [ - dup235, - dup383, - part975, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg585 = msg("00033:15", all197); - - var part976 = match("MESSAGE#577:00033:16/2", "nwparser.p0", "?s outgoing-interface field has been set to %{interface}."); - - var all198 = all_match({ - processors: [ - dup235, - dup383, - part976, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg586 = msg("00033:16", all198); - - var part977 = match("MESSAGE#578:00033:17/2", "nwparser.p0", "?s port field has been %{p0}"); - - var part978 = match("MESSAGE#578:00033:17/3_0", "nwparser.p0", "set to %{network_port->} %{p0}"); - - var part979 = match("MESSAGE#578:00033:17/3_1", "nwparser.p0", "reset to the default value %{p0}"); - - var select213 = linear_select([ - part978, - part979, - ]); - - var all199 = all_match({ - processors: [ - dup235, - dup383, - part977, - select213, - dup116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg587 = msg("00033:17", all199); - - var part980 = match("MESSAGE#579:00033:19/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); - - var part981 = match("MESSAGE#579:00033:19/4", "nwparser.p0", "%{fld99}arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time."); - - var all200 = all_match({ - processors: [ - part980, - dup339, - dup70, - dup340, - part981, - ], - on_success: processor_chain([ - dup27, - dup2, - dup4, - dup5, - dup3, - dup59, - dup61, - ]), - }); - - var msg588 = msg("00033:19", all200); - - var part982 = match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time.", processor_chain([ - dup27, - dup2, - dup4, - dup5, - dup3, - dup59, - dup60, - ])); - - var msg589 = msg("00033:20", part982); - - var all201 = all_match({ - processors: [ - dup239, - dup343, - dup83, - ], - on_success: processor_chain([ - dup27, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg590 = msg("00033:21", all201); - - var part983 = match("MESSAGE#582:00033:22/0", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var all202 = all_match({ - processors: [ - part983, - dup343, - dup83, - ], - on_success: processor_chain([ - dup27, - dup2, - dup9, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg591 = msg("00033:22", all202); - - var part984 = match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name %{hostname->} was set: addr %{hostip}, port %{network_port}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg592 = msg("00033:23", part984); - - var part985 = match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{info}. (%{fld1})", processor_chain([ - setc("eventcategory","1001030500"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg593 = msg("00033:24", part985); - - var select214 = linear_select([ - msg569, - msg570, - msg571, - msg572, - msg573, - msg574, - msg575, - msg576, - msg577, - msg578, - msg579, - msg580, - msg581, - msg582, - msg583, - msg584, - msg585, - msg586, - msg587, - msg588, - msg589, - msg590, - msg591, - msg592, - msg593, - ]); - - var part986 = match("MESSAGE#585:00034/0_0", "nwparser.payload", "SCS: Failed %{p0}"); - - var part987 = match("MESSAGE#585:00034/0_1", "nwparser.payload", "Failed %{p0}"); - - var select215 = linear_select([ - part986, - part987, - ]); - - var part988 = match("MESSAGE#585:00034/2_0", "nwparser.p0", "bind %{p0}"); - - var part989 = match("MESSAGE#585:00034/2_2", "nwparser.p0", "retrieve %{p0}"); - - var select216 = linear_select([ - part988, - dup201, - part989, - ]); - - var select217 = linear_select([ - dup196, - dup103, - dup163, - ]); - - var part990 = match("MESSAGE#585:00034/5", "nwparser.p0", "SSH user %{username}. (Key ID=%{fld2})"); - - var all203 = all_match({ - processors: [ - select215, - dup103, - select216, - dup202, - select217, - part990, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg594 = msg("00034", all203); - - var part991 = match("MESSAGE#586:00034:01/0_0", "nwparser.payload", "SCS: Incompatible %{p0}"); - - var part992 = match("MESSAGE#586:00034:01/0_1", "nwparser.payload", "Incompatible %{p0}"); - - var select218 = linear_select([ - part991, - part992, - ]); - - var part993 = match("MESSAGE#586:00034:01/1", "nwparser.p0", "SSH version %{version->} has been received from %{p0}"); - - var part994 = match("MESSAGE#586:00034:01/2_0", "nwparser.p0", "the SSH %{p0}"); - - var select219 = linear_select([ - part994, - dup241, - ]); - - var part995 = match("MESSAGE#586:00034:01/3", "nwparser.p0", "client at %{saddr}:%{sport}"); - - var all204 = all_match({ - processors: [ - select218, - part993, - select219, - part995, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg595 = msg("00034:01", all204); - - var part996 = match("MESSAGE#587:00034:02", "nwparser.payload", "Maximum number of SCS sessions %{fld2->} has been reached. Connection request from SSH user %{username->} at %{saddr}:%{sport->} has been %{disposition}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg596 = msg("00034:02", part996); - - var part997 = match("MESSAGE#588:00034:03/1", "nwparser.p0", "device failed to authenticate the SSH client at %{saddr}:%{sport}"); - - var all205 = all_match({ - processors: [ - dup384, - part997, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg597 = msg("00034:03", all205); - - var part998 = match("MESSAGE#589:00034:04", "nwparser.payload", "SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user %{username->} at %{saddr}:%{sport}. (Key ID=%{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg598 = msg("00034:04", part998); - - var part999 = match("MESSAGE#590:00034:05", "nwparser.payload", "NetScreen device failed to generate a PKA RSA challenge for SSH user %{username}. (Key ID=%{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg599 = msg("00034:05", part999); - - var part1000 = match("MESSAGE#591:00034:06/1", "nwparser.p0", "device failed to %{p0}"); - - var part1001 = match("MESSAGE#591:00034:06/2_0", "nwparser.p0", "identify itself %{p0}"); - - var part1002 = match("MESSAGE#591:00034:06/2_1", "nwparser.p0", "send the identification string %{p0}"); - - var select220 = linear_select([ - part1001, - part1002, - ]); - - var part1003 = match("MESSAGE#591:00034:06/3", "nwparser.p0", "to the SSH client at %{saddr}:%{sport}"); - - var all206 = all_match({ - processors: [ - dup384, - part1000, - select220, - part1003, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg600 = msg("00034:06", all206); - - var part1004 = match("MESSAGE#592:00034:07", "nwparser.payload", "SCS connection has been terminated for admin user %{username->} at %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg601 = msg("00034:07", part1004); - - var part1005 = match("MESSAGE#593:00034:08", "nwparser.payload", "SCS: SCS has been %{disposition->} for %{username->} with %{fld2->} existing PKA keys already bound to %{fld3->} SSH users.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg602 = msg("00034:08", part1005); - - var part1006 = match("MESSAGE#594:00034:09", "nwparser.payload", "SCS has been %{disposition->} for %{username->} with %{fld2->} PKA keys already bound to %{fld3->} SSH users", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg603 = msg("00034:09", part1006); - - var part1007 = match("MESSAGE#595:00034:10/2", "nwparser.p0", "%{}client at %{saddr->} has attempted to make an SCS connection to %{p0}"); - - var part1008 = match("MESSAGE#595:00034:10/4", "nwparser.p0", "%{interface->} %{p0}"); - - var part1009 = match("MESSAGE#595:00034:10/5_0", "nwparser.p0", "with%{p0}"); - - var part1010 = match("MESSAGE#595:00034:10/5_1", "nwparser.p0", "at%{p0}"); - - var select221 = linear_select([ - part1009, - part1010, - ]); - - var part1011 = match("MESSAGE#595:00034:10/6", "nwparser.p0", "%{}IP %{hostip->} but %{disposition->} because %{result}"); - - var all207 = all_match({ - processors: [ - dup244, - dup385, - part1007, - dup352, - part1008, - select221, - part1011, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg604 = msg("00034:10", all207); - - var part1012 = match("MESSAGE#596:00034:12/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has attempted to make an SCS connection to %{p0}"); - - var part1013 = match("MESSAGE#596:00034:12/4", "nwparser.p0", "but %{disposition->} because %{result}"); - - var all208 = all_match({ - processors: [ - dup244, - dup385, - part1012, - dup386, - part1013, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg605 = msg("00034:12", all208); - - var part1014 = match("MESSAGE#597:00034:11/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to %{p0}"); - - var part1015 = match("MESSAGE#597:00034:11/4", "nwparser.p0", "because %{result}"); - - var all209 = all_match({ - processors: [ - dup244, - dup385, - part1014, - dup386, - part1015, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg606 = msg("00034:11", all209); - - var part1016 = match("MESSAGE#598:00034:15", "nwparser.payload", "SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection because %{result}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg607 = msg("00034:15", part1016); - - var part1017 = match("MESSAGE#599:00034:18/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} cannot log in via SCS to %{service->} using the shared %{interface->} interface because %{result}"); - - var all210 = all_match({ - processors: [ - dup244, - dup387, - part1017, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg608 = msg("00034:18", all210); - - var part1018 = match("MESSAGE#600:00034:20/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has %{disposition->} the PKA RSA challenge"); - - var all211 = all_match({ - processors: [ - dup244, - dup387, - part1018, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg609 = msg("00034:20", all211); - - var part1019 = match("MESSAGE#601:00034:21/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has requested %{p0}"); - - var part1020 = match("MESSAGE#601:00034:21/4", "nwparser.p0", "authentication which is not %{p0}"); - - var part1021 = match("MESSAGE#601:00034:21/5_0", "nwparser.p0", "supported %{p0}"); - - var select222 = linear_select([ - part1021, - dup156, - ]); - - var part1022 = match("MESSAGE#601:00034:21/6", "nwparser.p0", "for that %{p0}"); - - var part1023 = match("MESSAGE#601:00034:21/7_0", "nwparser.p0", "client%{}"); - - var part1024 = match("MESSAGE#601:00034:21/7_1", "nwparser.p0", "user%{}"); - - var select223 = linear_select([ - part1023, - part1024, - ]); - - var all212 = all_match({ - processors: [ - dup244, - dup387, - part1019, - dup372, - part1020, - select222, - part1022, - select223, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg610 = msg("00034:21", all212); - - var part1025 = match("MESSAGE#602:00034:22", "nwparser.payload", "SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to vsys %{fld2->} using the shared untrusted interface", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg611 = msg("00034:22", part1025); - - var part1026 = match("MESSAGE#603:00034:23/1_0", "nwparser.p0", "SCS: Unable %{p0}"); - - var part1027 = match("MESSAGE#603:00034:23/1_1", "nwparser.p0", "Unable %{p0}"); - - var select224 = linear_select([ - part1026, - part1027, - ]); - - var part1028 = match("MESSAGE#603:00034:23/2", "nwparser.p0", "to validate cookie from the SSH client at %{saddr}:%{sport}"); - - var all213 = all_match({ - processors: [ - dup160, - select224, - part1028, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg612 = msg("00034:23", all213); - - var part1029 = match("MESSAGE#604:00034:24", "nwparser.payload", "AC %{username->} is advertising URL %{fld2}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg613 = msg("00034:24", part1029); - - var part1030 = match("MESSAGE#605:00034:25", "nwparser.payload", "Message from AC %{username}: %{fld2}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg614 = msg("00034:25", part1030); - - var part1031 = match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg615 = msg("00034:26", part1031); - - var part1032 = match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on %{interface->} interface", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg616 = msg("00034:27", part1032); - - var part1033 = match("MESSAGE#608:00034:28", "nwparser.payload", "PPPoE%{quote}s session closed by AC", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg617 = msg("00034:28", part1033); - - var part1034 = match("MESSAGE#609:00034:29", "nwparser.payload", "SCS: Disabled for %{username}. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg618 = msg("00034:29", part1034); - - var part1035 = match("MESSAGE#610:00034:30", "nwparser.payload", "SCS: %{disposition->} to remove PKA key removed.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg619 = msg("00034:30", part1035); - - var part1036 = match("MESSAGE#611:00034:31", "nwparser.payload", "SCS: %{disposition->} to retrieve host key", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg620 = msg("00034:31", part1036); - - var part1037 = match("MESSAGE#612:00034:32", "nwparser.payload", "SCS: %{disposition->} to send identification string to client host at %{saddr}:%{sport}.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg621 = msg("00034:32", part1037); - - var part1038 = match("MESSAGE#613:00034:33", "nwparser.payload", "SCS: Max %{fld2->} sessions reached unabel to accept connection : %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg622 = msg("00034:33", part1038); - - var part1039 = match("MESSAGE#614:00034:34", "nwparser.payload", "SCS: Maximum number for SCS sessions %{fld2->} has been reached. Connection request from SSH user at %{saddr}:%{sport->} has been %{disposition}.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg623 = msg("00034:34", part1039); - - var part1040 = match("MESSAGE#615:00034:35", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to %{service->} using the shared untrusted interface because SCS is disabled on that interface.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg624 = msg("00034:35", part1040); - - var part1041 = match("MESSAGE#616:00034:36", "nwparser.payload", "SCS: Unsupported cipher type %{fld2->} requested from: %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg625 = msg("00034:36", part1041); - - var part1042 = match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg626 = msg("00034:37", part1042); - - var part1043 = match("MESSAGE#618:00034:38", "nwparser.payload", "SSH: %{disposition->} to retreive PKA key bound to SSH user %{username->} (Key ID %{fld2})", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg627 = msg("00034:38", part1043); - - var part1044 = match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet from host %{saddr->} (Code %{fld2})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg628 = msg("00034:39", part1044); - - var part1045 = match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send initialization string to client at %{saddr}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg629 = msg("00034:40", part1045); - - var part1046 = match("MESSAGE#621:00034:41/0", "nwparser.payload", "SCP: Admin user '%{administrator}' attempted to transfer file %{p0}"); - - var part1047 = match("MESSAGE#621:00034:41/2", "nwparser.p0", "the device with insufficient privilege.%{}"); - - var all214 = all_match({ - processors: [ - part1046, - dup373, - part1047, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg630 = msg("00034:41", all214); - - var part1048 = match("MESSAGE#622:00034:42", "nwparser.payload", "SSH: Maximum number of SSH sessions (%{fld2}) exceeded. Connection request from SSH user %{username->} at %{saddr->} denied.", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg631 = msg("00034:42", part1048); - - var part1049 = match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx bd (port %{network_port})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg632 = msg("00034:43", part1049); - - var part1050 = match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack detected on SSH connection initiated from %{saddr}:%{sport->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg633 = msg("00034:44", part1050); - - var select225 = linear_select([ - msg594, - msg595, - msg596, - msg597, - msg598, - msg599, - msg600, - msg601, - msg602, - msg603, - msg604, - msg605, - msg606, - msg607, - msg608, - msg609, - msg610, - msg611, - msg612, - msg613, - msg614, - msg615, - msg616, - msg617, - msg618, - msg619, - msg620, - msg621, - msg622, - msg623, - msg624, - msg625, - msg626, - msg627, - msg628, - msg629, - msg630, - msg631, - msg632, - msg633, - ]); - - var part1051 = match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}:%{result}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg634 = msg("00035", part1051); - - var part1052 = match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in incoming mail - %{fld2}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg635 = msg("00035:01", part1052); - - var part1053 = match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} is not allowed in export or firewall only system", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg636 = msg("00035:02", part1053); - - var part1054 = match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg637 = msg("00035:03", part1054); - - var part1055 = match("MESSAGE#628:00035:04/0", "nwparser.payload", "SSL Error when retrieve local c%{p0}"); - - var part1056 = match("MESSAGE#628:00035:04/1_0", "nwparser.p0", "a(verify) %{p0}"); - - var part1057 = match("MESSAGE#628:00035:04/1_1", "nwparser.p0", "ert(verify) %{p0}"); - - var part1058 = match("MESSAGE#628:00035:04/1_2", "nwparser.p0", "ert(all) %{p0}"); - - var select226 = linear_select([ - part1056, - part1057, - part1058, - ]); - - var part1059 = match("MESSAGE#628:00035:04/2", "nwparser.p0", ": %{fld2}"); - - var all215 = all_match({ - processors: [ - part1055, - select226, - part1059, - ], - on_success: processor_chain([ - dup117, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg638 = msg("00035:04", all215); - - var part1060 = match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready for connections.%{}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg639 = msg("00035:05", part1060); - - var part1061 = match("MESSAGE#630:00035:06/0", "nwparser.payload", "SSL c%{p0}"); - - var part1062 = match("MESSAGE#630:00035:06/2", "nwparser.p0", "changed to none%{}"); - - var all216 = all_match({ - processors: [ - part1061, - dup388, - part1062, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg640 = msg("00035:06", all216); - - var part1063 = match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{fld2->} recieved %{fld3->} is expected", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg641 = msg("00035:07", part1063); - - var part1064 = match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg642 = msg("00035:08", part1064); - - var part1065 = match("MESSAGE#633:00035:09/1_0", "nwparser.p0", "enabled%{}"); - - var select227 = linear_select([ - part1065, - dup92, - ]); - - var all217 = all_match({ - processors: [ - dup253, - select227, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg643 = msg("00035:09", all217); - - var part1066 = match("MESSAGE#634:00035:10/0", "nwparser.payload", "SSL memory allocation fails in process_c%{p0}"); - - var part1067 = match("MESSAGE#634:00035:10/1_0", "nwparser.p0", "a()%{}"); - - var part1068 = match("MESSAGE#634:00035:10/1_1", "nwparser.p0", "ert()%{}"); - - var select228 = linear_select([ - part1067, - part1068, - ]); - - var all218 = all_match({ - processors: [ - part1066, - select228, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg644 = msg("00035:10", all218); - - var part1069 = match("MESSAGE#635:00035:11/0", "nwparser.payload", "SSL no ssl c%{p0}"); - - var part1070 = match("MESSAGE#635:00035:11/1_0", "nwparser.p0", "a%{}"); - - var part1071 = match("MESSAGE#635:00035:11/1_1", "nwparser.p0", "ert%{}"); - - var select229 = linear_select([ - part1070, - part1071, - ]); - - var all219 = all_match({ - processors: [ - part1069, - select229, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg645 = msg("00035:11", all219); - - var part1072 = match("MESSAGE#636:00035:12/0", "nwparser.payload", "SSL set c%{p0}"); - - var part1073 = match("MESSAGE#636:00035:12/2", "nwparser.p0", "id is invalid %{fld2}"); - - var all220 = all_match({ - processors: [ - part1072, - dup388, - part1073, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg646 = msg("00035:12", all220); - - var part1074 = match("MESSAGE#637:00035:13/1_1", "nwparser.p0", "verify %{p0}"); - - var select230 = linear_select([ - dup101, - part1074, - ]); - - var part1075 = match("MESSAGE#637:00035:13/2", "nwparser.p0", "cert failed. Key type is not RSA%{}"); - - var all221 = all_match({ - processors: [ - dup253, - select230, - part1075, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg647 = msg("00035:13", all221); - - var part1076 = match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg648 = msg("00035:14", part1076); - - var part1077 = match("MESSAGE#639:00035:15/0", "nwparser.payload", "%{change_attribute->} has been changed %{p0}"); - - var part1078 = match("MESSAGE#639:00035:15/1_0", "nwparser.p0", "from %{change_old->} to %{change_new}"); - - var part1079 = match("MESSAGE#639:00035:15/1_1", "nwparser.p0", "to %{fld2}"); - - var select231 = linear_select([ - part1078, - part1079, - ]); - - var all222 = all_match({ - processors: [ - part1077, - select231, - ], - on_success: processor_chain([ - dup184, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg649 = msg("00035:15", all222); - - var part1080 = match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed to by %{username->} via web from host %{saddr->} to %{daddr}:%{dport->} %{fld5}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg650 = msg("00035:16", part1080); - - var select232 = linear_select([ - msg634, - msg635, - msg636, - msg637, - msg638, - msg639, - msg640, - msg641, - msg642, - msg643, - msg644, - msg645, - msg646, - msg647, - msg648, - msg649, - msg650, - ]); - - var part1081 = match("MESSAGE#641:00036", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key%{}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg651 = msg("00036", part1081); - - var part1082 = match("MESSAGE#642:00036:01/0", "nwparser.payload", "%{fld2->} license keys were updated successfully by %{p0}"); - - var part1083 = match("MESSAGE#642:00036:01/1_1", "nwparser.p0", "manual %{p0}"); - - var select233 = linear_select([ - dup214, - part1083, - ]); - - var part1084 = match("MESSAGE#642:00036:01/2", "nwparser.p0", "retrieval%{}"); - - var all223 = all_match({ - processors: [ - part1082, - select233, - part1084, - ], - on_success: processor_chain([ - dup254, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg652 = msg("00036:01", all223); - - var select234 = linear_select([ - msg651, - msg652, - ]); - - var part1085 = match("MESSAGE#643:00037/0", "nwparser.payload", "Intra-zone block for zone %{zone->} was set to o%{p0}"); - - var part1086 = match("MESSAGE#643:00037/1_0", "nwparser.p0", "n%{}"); - - var part1087 = match("MESSAGE#643:00037/1_1", "nwparser.p0", "ff%{}"); - - var select235 = linear_select([ - part1086, - part1087, - ]); - - var all224 = all_match({ - processors: [ - part1085, - select235, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg653 = msg("00037", all224); - - var part1088 = match("MESSAGE#644:00037:01/0", "nwparser.payload", "New zone %{zone->} ( %{p0}"); - - var select236 = linear_select([ - dup255, - dup256, - ]); - - var part1089 = match("MESSAGE#644:00037:01/2", "nwparser.p0", "%{fld2}) was created.%{p0}"); - - var all225 = all_match({ - processors: [ - part1088, - select236, - part1089, - dup351, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg654 = msg("00037:01", all225); - - var part1090 = match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was bound to out zone %{dst_zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg655 = msg("00037:02", part1090); - - var part1091 = match("MESSAGE#646:00037:03/1_0", "nwparser.p0", "was was %{p0}"); - - var part1092 = match("MESSAGE#646:00037:03/1_1", "nwparser.p0", "%{zone->} was %{p0}"); - - var select237 = linear_select([ - part1091, - part1092, - ]); - - var part1093 = match("MESSAGE#646:00037:03/3", "nwparser.p0", "virtual router %{p0}"); - - var part1094 = match("MESSAGE#646:00037:03/4_0", "nwparser.p0", "%{node->} (%{fld1})"); - - var part1095 = match("MESSAGE#646:00037:03/4_1", "nwparser.p0", "%{node}."); - - var select238 = linear_select([ - part1094, - part1095, - ]); - - var all226 = all_match({ - processors: [ - dup113, - select237, - dup371, - part1093, - select238, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg656 = msg("00037:03", all226); - - var part1096 = match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to non-shared.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg657 = msg("00037:04", part1096); - - var part1097 = match("MESSAGE#648:00037:05/0", "nwparser.payload", "Zone %{zone->} ( %{p0}"); - - var select239 = linear_select([ - dup256, - dup255, - ]); - - var part1098 = match("MESSAGE#648:00037:05/2", "nwparser.p0", "%{fld2}) was deleted. %{p0}"); - - var part1099 = match_copy("MESSAGE#648:00037:05/3_1", "nwparser.p0", "space"); - - var select240 = linear_select([ - dup10, - part1099, - ]); - - var all227 = all_match({ - processors: [ - part1097, - select239, - part1098, - select240, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg658 = msg("00037:05", all227); - - var part1100 = match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was %{disposition->} on zone %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg659 = msg("00037:06", part1100); - - var select241 = linear_select([ - msg653, - msg654, - msg655, - msg656, - msg657, - msg658, - msg659, - ]); - - var part1101 = match("MESSAGE#650:00038/0", "nwparser.payload", "OSPF routing instance in vrouter %{p0}"); - - var part1102 = match("MESSAGE#650:00038/1_0", "nwparser.p0", "%{node->} is %{p0}"); - - var part1103 = match("MESSAGE#650:00038/1_1", "nwparser.p0", "%{node->} %{p0}"); - - var select242 = linear_select([ - part1102, - part1103, - ]); - - var all228 = all_match({ - processors: [ - part1101, - select242, - dup36, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg660 = msg("00038", all228); - - var part1104 = match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr %{node}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg661 = msg("00039", part1104); - - var part1105 = match("MESSAGE#652:00040/0_0", "nwparser.payload", "Low watermark%{p0}"); - - var part1106 = match("MESSAGE#652:00040/0_1", "nwparser.payload", "High watermark%{p0}"); - - var select243 = linear_select([ - part1105, - part1106, - ]); - - var part1107 = match("MESSAGE#652:00040/1", "nwparser.p0", "%{}for early aging has been changed to the default %{fld2}"); - - var all229 = all_match({ - processors: [ - select243, - part1107, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg662 = msg("00040", all229); - - var part1108 = match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg663 = msg("00040:01", part1108); - - var select244 = linear_select([ - msg662, - msg663, - ]); - - var part1109 = match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual router %{node->} has been removed", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg664 = msg("00041", part1109); - - var part1110 = match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg665 = msg("00041:01", part1110); - - var select245 = linear_select([ - msg664, - msg665, - ]); - - var part1111 = match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec tunnel on %{interface->} with tunnel ID %{fld2}! From %{saddr->} to %{daddr}/%{dport}, %{info->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg666 = msg("00042", part1111); - - var part1112 = match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup9, - dup4, - dup5, - dup60, - ])); - - var msg667 = msg("00042:01", part1112); - - var select246 = linear_select([ - msg666, - msg667, - ]); - - var part1113 = match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp tunnel (%{fld2}-%{fld3}), Result code %{resultcode->} (%{result}). (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg668 = msg("00043", part1113); - - var part1114 = match("MESSAGE#659:00044/0", "nwparser.payload", "access list %{listnum->} sequence number %{fld3->} %{p0}"); - - var part1115 = match("MESSAGE#659:00044/1_1", "nwparser.p0", "deny %{p0}"); - - var select247 = linear_select([ - dup257, - part1115, - ]); - - var part1116 = match("MESSAGE#659:00044/2", "nwparser.p0", "ip %{hostip}/%{mask->} %{disposition->} in vrouter %{node}"); - - var all230 = all_match({ - processors: [ - part1114, - select247, - part1116, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg669 = msg("00044", all230); - - var part1117 = match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{disposition->} in vrouter %{node}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg670 = msg("00044:01", part1117); - - var select248 = linear_select([ - msg669, - msg670, - ]); - - var part1118 = match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router %{node->} was %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg671 = msg("00045", part1118); - - var part1119 = match("MESSAGE#662:00047/1_0", "nwparser.p0", "remove %{p0}"); - - var part1120 = match("MESSAGE#662:00047/1_1", "nwparser.p0", "add %{p0}"); - - var select249 = linear_select([ - part1119, - part1120, - ]); - - var part1121 = match("MESSAGE#662:00047/2", "nwparser.p0", "multicast policy from %{src_zone->} %{fld4->} to %{dst_zone->} %{fld3->} (%{fld1})"); - - var all231 = all_match({ - processors: [ - dup183, - select249, - part1121, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg672 = msg("00047", all231); - - var part1122 = match("MESSAGE#663:00048/0", "nwparser.payload", "Access list entry %{listnum->} with %{p0}"); - - var part1123 = match("MESSAGE#663:00048/1_0", "nwparser.p0", "a sequence %{p0}"); - - var part1124 = match("MESSAGE#663:00048/1_1", "nwparser.p0", "sequence %{p0}"); - - var select250 = linear_select([ - part1123, - part1124, - ]); - - var part1125 = match("MESSAGE#663:00048/2", "nwparser.p0", "number %{fld2->} %{p0}"); - - var part1126 = match("MESSAGE#663:00048/3_0", "nwparser.p0", "with an action of %{p0}"); - - var select251 = linear_select([ - part1126, - dup112, - ]); - - var part1127 = match("MESSAGE#663:00048/5_0", "nwparser.p0", "with an IP %{p0}"); - - var select252 = linear_select([ - part1127, - dup139, - ]); - - var part1128 = match("MESSAGE#663:00048/6", "nwparser.p0", "address %{p0}"); - - var part1129 = match("MESSAGE#663:00048/7_0", "nwparser.p0", "and subnetwork mask of %{p0}"); - - var select253 = linear_select([ - part1129, - dup16, - ]); - - var part1130 = match("MESSAGE#663:00048/8", "nwparser.p0", "%{} %{fld3}was %{p0}"); - - var part1131 = match("MESSAGE#663:00048/9_0", "nwparser.p0", "created on %{p0}"); - - var select254 = linear_select([ - part1131, - dup129, - ]); - - var part1132 = match("MESSAGE#663:00048/10", "nwparser.p0", "virtual router %{node->} (%{fld1})"); - - var all232 = all_match({ - processors: [ - part1122, - select250, - part1125, - select251, - dup257, - select252, - part1128, - select253, - part1130, - select254, - part1132, - ], - on_success: processor_chain([ - setc("eventcategory","1501000000"), - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg673 = msg("00048", all232); - - var part1133 = match("MESSAGE#664:00048:01/0", "nwparser.payload", "Route %{p0}"); - - var part1134 = match("MESSAGE#664:00048:01/1_0", "nwparser.p0", "map entry %{p0}"); - - var part1135 = match("MESSAGE#664:00048:01/1_1", "nwparser.p0", "entry %{p0}"); - - var select255 = linear_select([ - part1134, - part1135, - ]); - - var part1136 = match("MESSAGE#664:00048:01/2", "nwparser.p0", "with sequence number %{fld2->} in route map binck-ospf%{p0}"); - - var part1137 = match("MESSAGE#664:00048:01/3_0", "nwparser.p0", " in %{p0}"); - - var select256 = linear_select([ - part1137, - dup105, - ]); - - var part1138 = match("MESSAGE#664:00048:01/4", "nwparser.p0", "virtual router %{node->} was %{disposition->} (%{fld1})"); - - var all233 = all_match({ - processors: [ - part1133, - select255, - part1136, - select256, - part1138, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg674 = msg("00048:01", all233); - - var part1139 = match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface %{interface->} (%{fld1})", processor_chain([ - dup209, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg675 = msg("00048:02", part1139); - - var select257 = linear_select([ - msg673, - msg674, - msg675, - ]); - - var part1140 = match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed to %{fld8->} (%{fld2}) => %{fld3->} (%{fld4}) => %{fld5->} (%{fld6}) in virtual router (%{node})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg676 = msg("00049", part1140); - - var part1141 = match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} in virtual router %{node}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg677 = msg("00049:01", part1141); - - var part1142 = match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{node->} and ID %{fld2->} has been removed", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg678 = msg("00049:02", part1142); - - var part1143 = match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual router \"%{node}\" used by OSPF, BGP routing instances id has been uninitialized. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg679 = msg("00049:03", part1143); - - var part1144 = match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route through virtual router \"%{node}\" has been added in virtual router \"%{fld4}\" (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg680 = msg("00049:04", part1144); - - var part1145 = match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking for interfaces in virtual router (%{node}) has been enabled. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg681 = msg("00049:05", part1145); - - var select258 = linear_select([ - msg676, - msg677, - msg678, - msg679, - msg680, - msg681, - ]); - - var part1146 = match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg682 = msg("00050", part1146); - - var part1147 = match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached %{fld2}, which is %{fld3->} of the system capacity!", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg683 = msg("00051", part1147); - - var part1148 = match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:%{sport}->%{daddr}:%{dport->} used %{fld2->} percent of AV resources, which exceeded the max of %{fld3->} percent.", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg684 = msg("00052", part1148); - - var part1149 = match("MESSAGE#675:00055/1_1", "nwparser.p0", "router %{p0}"); - - var select259 = linear_select([ - dup169, - part1149, - ]); - - var part1150 = match("MESSAGE#675:00055/2", "nwparser.p0", "instance was %{disposition->} on interface %{interface}."); - - var all234 = all_match({ - processors: [ - dup258, - select259, - part1150, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg685 = msg("00055", all234); - - var part1151 = match("MESSAGE#676:00055:01/1_0", "nwparser.p0", "proxy %{p0}"); - - var part1152 = match("MESSAGE#676:00055:01/1_1", "nwparser.p0", "function %{p0}"); - - var select260 = linear_select([ - part1151, - part1152, - ]); - - var part1153 = match("MESSAGE#676:00055:01/2", "nwparser.p0", "was %{disposition->} on interface %{interface}."); - - var all235 = all_match({ - processors: [ - dup258, - select260, - part1153, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg686 = msg("00055:01", all235); - - var part1154 = match("MESSAGE#677:00055:02/2", "nwparser.p0", "same subnet check on interface %{interface}."); - - var all236 = all_match({ - processors: [ - dup259, - dup389, - part1154, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg687 = msg("00055:02", all236); - - var part1155 = match("MESSAGE#678:00055:03/2", "nwparser.p0", "router alert IP option check on interface %{interface}."); - - var all237 = all_match({ - processors: [ - dup259, - dup389, - part1155, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg688 = msg("00055:03", all237); - - var part1156 = match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to %{version->} on interface %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg689 = msg("00055:04", part1156); - - var part1157 = match("MESSAGE#680:00055:05/0", "nwparser.payload", "IGMP query %{p0}"); - - var part1158 = match("MESSAGE#680:00055:05/1_1", "nwparser.p0", "max response time %{p0}"); - - var select261 = linear_select([ - dup110, - part1158, - ]); - - var part1159 = match("MESSAGE#680:00055:05/2", "nwparser.p0", "was changed to %{fld2->} on interface %{interface}"); - - var all238 = all_match({ - processors: [ - part1157, - select261, - part1159, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg690 = msg("00055:05", all238); - - var part1160 = match("MESSAGE#681:00055:06/0", "nwparser.payload", "IGMP l%{p0}"); - - var part1161 = match("MESSAGE#681:00055:06/1_0", "nwparser.p0", "eave %{p0}"); - - var part1162 = match("MESSAGE#681:00055:06/1_1", "nwparser.p0", "ast member query %{p0}"); - - var select262 = linear_select([ - part1161, - part1162, - ]); - - var part1163 = match("MESSAGE#681:00055:06/2", "nwparser.p0", "interval was changed to %{fld2->} on interface %{interface}."); - - var all239 = all_match({ - processors: [ - part1160, - select262, - part1163, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg691 = msg("00055:06", all239); - - var part1164 = match("MESSAGE#682:00055:07/1_0", "nwparser.p0", "routers %{p0}"); - - var part1165 = match("MESSAGE#682:00055:07/1_1", "nwparser.p0", "hosts %{p0}"); - - var part1166 = match("MESSAGE#682:00055:07/1_2", "nwparser.p0", "groups %{p0}"); - - var select263 = linear_select([ - part1164, - part1165, - part1166, - ]); - - var part1167 = match("MESSAGE#682:00055:07/2", "nwparser.p0", "accept list ID was changed to %{fld2->} on interface %{interface}."); - - var all240 = all_match({ - processors: [ - dup258, - select263, - part1167, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg692 = msg("00055:07", all240); - - var part1168 = match("MESSAGE#683:00055:08/1_0", "nwparser.p0", "all groups %{p0}"); - - var part1169 = match("MESSAGE#683:00055:08/1_1", "nwparser.p0", "group %{p0}"); - - var select264 = linear_select([ - part1168, - part1169, - ]); - - var part1170 = match("MESSAGE#683:00055:08/2", "nwparser.p0", "%{group->} static flag was %{disposition->} on interface %{interface}."); - - var all241 = all_match({ - processors: [ - dup258, - select264, - part1170, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg693 = msg("00055:08", all241); - - var part1171 = match("MESSAGE#684:00055:09", "nwparser.payload", "IGMP static group %{group->} was added on interface %{interface}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg694 = msg("00055:09", part1171); - - var part1172 = match("MESSAGE#685:00055:10", "nwparser.payload", "IGMP proxy always is %{disposition->} on interface %{interface}.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg695 = msg("00055:10", part1172); - - var select265 = linear_select([ - msg685, - msg686, - msg687, - msg688, - msg689, - msg690, - msg691, - msg692, - msg693, - msg694, - msg695, - ]); - - var part1173 = match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{src_zone->} %{saddr->} to %{dst_zone->} %{daddr}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg696 = msg("00056", part1173); - - var part1174 = match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route src=%{saddr}, grp=%{group->} input ifp = %{sinterface->} output ifp = %{dinterface->} added", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg697 = msg("00057", part1174); - - var part1175 = match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on interface %{interface}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg698 = msg("00058", part1175); - - var part1176 = match("MESSAGE#689:00059/0", "nwparser.payload", "DDNS module is %{p0}"); - - var part1177 = match("MESSAGE#689:00059/1_0", "nwparser.p0", "initialized %{p0}"); - - var select266 = linear_select([ - part1177, - dup262, - dup157, - dup156, - ]); - - var all242 = all_match({ - processors: [ - part1176, - select266, - dup116, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg699 = msg("00059", all242); - - var part1178 = match("MESSAGE#690:00059:02/0", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with server type \"%{fld3}\" name \"%{hostname}\" refresh-interval %{fld5->} hours minimum update interval %{fld6->} minutes with %{p0}"); - - var part1179 = match("MESSAGE#690:00059:02/1_0", "nwparser.p0", "secure %{p0}"); - - var part1180 = match("MESSAGE#690:00059:02/1_1", "nwparser.p0", "clear-text %{p0}"); - - var select267 = linear_select([ - part1179, - part1180, - ]); - - var part1181 = match("MESSAGE#690:00059:02/2", "nwparser.p0", "secure connection.%{}"); - - var all243 = all_match({ - processors: [ - part1178, - select267, - part1181, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg700 = msg("00059:02", all243); - - var part1182 = match("MESSAGE#691:00059:03", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with user name \"%{username}\" agent \"%{fld3}\"", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg701 = msg("00059:03", part1182); - - var part1183 = match("MESSAGE#692:00059:04", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with interface \"%{interface}\" host-name \"%{hostname}\"", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg702 = msg("00059:04", part1183); - - var part1184 = match("MESSAGE#693:00059:05/0_0", "nwparser.payload", "Hostname %{p0}"); - - var part1185 = match("MESSAGE#693:00059:05/0_1", "nwparser.payload", "Source interface %{p0}"); - - var part1186 = match("MESSAGE#693:00059:05/0_2", "nwparser.payload", "Username and password %{p0}"); - - var part1187 = match("MESSAGE#693:00059:05/0_3", "nwparser.payload", "Server %{p0}"); - - var select268 = linear_select([ - part1184, - part1185, - part1186, - part1187, - ]); - - var part1188 = match("MESSAGE#693:00059:05/1", "nwparser.p0", "of DDNS entry with id %{fld2->} is cleared."); - - var all244 = all_match({ - processors: [ - select268, - part1188, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg703 = msg("00059:05", all244); - - var part1189 = match("MESSAGE#694:00059:06", "nwparser.payload", "Agent of DDNS entry with id %{fld2->} is reset to its default value.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg704 = msg("00059:06", part1189); - - var part1190 = match("MESSAGE#695:00059:07", "nwparser.payload", "Updates for DDNS entry with id %{fld2->} are set to be sent in secure (%{protocol}) mode.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg705 = msg("00059:07", part1190); - - var part1191 = match("MESSAGE#696:00059:08/0_0", "nwparser.payload", "Refresh %{p0}"); - - var part1192 = match("MESSAGE#696:00059:08/0_1", "nwparser.payload", "Minimum update %{p0}"); - - var select269 = linear_select([ - part1191, - part1192, - ]); - - var part1193 = match("MESSAGE#696:00059:08/1", "nwparser.p0", "interval of DDNS entry with id %{fld2->} is set to default value (%{fld3})."); - - var all245 = all_match({ - processors: [ - select269, - part1193, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg706 = msg("00059:08", all245); - - var part1194 = match("MESSAGE#697:00059:09/1_0", "nwparser.p0", "No-Change %{p0}"); - - var part1195 = match("MESSAGE#697:00059:09/1_1", "nwparser.p0", "Error %{p0}"); - - var select270 = linear_select([ - part1194, - part1195, - ]); - - var part1196 = match("MESSAGE#697:00059:09/2", "nwparser.p0", "response received for DDNS entry update for id %{fld2->} user \"%{username}\" domain \"%{domain}\" server type \" d%{p0}"); - - var part1197 = match("MESSAGE#697:00059:09/3_1", "nwparser.p0", "yndns %{p0}"); - - var select271 = linear_select([ - dup261, - part1197, - ]); - - var part1198 = match("MESSAGE#697:00059:09/4", "nwparser.p0", "\", server name \"%{hostname}\""); - - var all246 = all_match({ - processors: [ - dup160, - select270, - part1196, - select271, - part1198, - ], - on_success: processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg707 = msg("00059:09", all246); - - var part1199 = match("MESSAGE#698:00059:01", "nwparser.payload", "DDNS entry with id %{fld2->} is %{disposition}.", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg708 = msg("00059:01", part1199); - - var select272 = linear_select([ - msg699, - msg700, - msg701, - msg702, - msg703, - msg704, - msg705, - msg706, - msg707, - msg708, - ]); - - var part1200 = match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip->} failed. (%{event_time_string})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP failed"), - ])); - - var msg709 = msg("00062:01", part1200); - - var part1201 = match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached threshold. (%{event_time_string})", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP failure reached threshold"), - ])); - - var msg710 = msg("00062:02", part1201); - - var part1202 = match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip->} succeeded. (%{event_time_string})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Track IP succeeded"), - ])); - - var msg711 = msg("00062:03", part1202); - - var part1203 = match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg712 = msg("00062", part1203); - - var select273 = linear_select([ - msg709, - msg710, - msg711, - msg712, - ]); - - var part1204 = match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{disposition}!", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg713 = msg("00063", part1204); - - var part1205 = match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg714 = msg("00064", part1205); - - var part1206 = match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches threshold system may fail over!%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg715 = msg("00064:01", part1206); - - var part1207 = match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from policy ID %{policy_id}. (%{fld1})", processor_chain([ - dup17, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg716 = msg("00064:02", part1207); - - var select274 = linear_select([ - msg714, - msg715, - msg716, - ]); - - var msg717 = msg("00070", dup411); - - var part1208 = match("MESSAGE#708:00070:01/2", "nwparser.p0", "%{}Device group %{group->} changed state from %{fld3->} to %{p0}"); - - var part1209 = match("MESSAGE#708:00070:01/3_0", "nwparser.p0", "Init%{}"); - - var part1210 = match("MESSAGE#708:00070:01/3_1", "nwparser.p0", "init. (%{fld1})"); - - var select275 = linear_select([ - part1209, - part1210, - ]); - - var all247 = all_match({ - processors: [ - dup267, - dup391, - part1208, - select275, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg718 = msg("00070:01", all247); - - var part1211 = match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel change to %{interface}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg719 = msg("00070:02", part1211); - - var select276 = linear_select([ - msg717, - msg718, - msg719, - ]); - - var msg720 = msg("00071", dup411); - - var part1212 = match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in the Virtual Security Device group %{group->} changed state", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg721 = msg("00071:01", part1212); - - var select277 = linear_select([ - msg720, - msg721, - ]); - - var msg722 = msg("00072", dup411); - - var msg723 = msg("00072:01", dup412); - - var select278 = linear_select([ - msg722, - msg723, - ]); - - var msg724 = msg("00073", dup411); - - var msg725 = msg("00073:01", dup412); - - var select279 = linear_select([ - msg724, - msg725, - ]); - - var msg726 = msg("00074", dup392); - - var all248 = all_match({ - processors: [ - dup263, - dup390, - dup271, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg727 = msg("00075", all248); - - var part1213 = match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} changed state from %{event_state->} to inoperable. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","local device in the Virtual Security Device group changed state to inoperable"), - ])); - - var msg728 = msg("00075:02", part1213); - - var part1214 = match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg729 = msg("00075:01", part1214); - - var select280 = linear_select([ - msg727, - msg728, - msg729, - ]); - - var msg730 = msg("00076", dup392); - - var part1215 = match("MESSAGE#721:00076:01/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} send 2nd path request to unit=%{fld3}"); - - var all249 = all_match({ - processors: [ - dup263, - dup390, - part1215, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg731 = msg("00076:01", all249); - - var select281 = linear_select([ - msg730, - msg731, - ]); - - var part1216 = match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use second path of HA%{}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg732 = msg("00077", part1216); - - var all250 = all_match({ - processors: [ - dup263, - dup390, - dup271, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg733 = msg("00077:01", all250); - - var part1217 = match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group}", processor_chain([ - setc("eventcategory","1607000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg734 = msg("00077:02", part1217); - - var select282 = linear_select([ - msg732, - msg733, - msg734, - ]); - - var part1218 = match("MESSAGE#725:00084", "nwparser.payload", "RTSYNC: NSRP route synchronization is %{disposition}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg735 = msg("00084", part1218); - - var part1219 = match("MESSAGE#726:00090/0_0", "nwparser.payload", "Failover %{p0}"); - - var part1220 = match("MESSAGE#726:00090/0_1", "nwparser.payload", "Recovery %{p0}"); - - var select283 = linear_select([ - part1219, - part1220, - ]); - - var part1221 = match("MESSAGE#726:00090/3", "nwparser.p0", "untrust interface occurred.%{}"); - - var all251 = all_match({ - processors: [ - select283, - dup103, - dup369, - part1221, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg736 = msg("00090", all251); - - var part1222 = match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to the device because the maximum number of system route entries %{fld2->} has been exceeded", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg737 = msg("00200", part1222); - - var part1223 = match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cannot be added to the virtual router %{node->} because the number of route entries in the virtual router exceeds the maximum number of routes %{fld3->} allowed", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg738 = msg("00201", part1223); - - var part1224 = match("MESSAGE#729:00202", "nwparser.payload", "%{fld2->} hello-packet flood from neighbor (ip = %{hostip->} router-id = %{fld3}) on interface %{interface->} packet is dropped", processor_chain([ - dup272, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg739 = msg("00202", part1224); - - var part1225 = match("MESSAGE#730:00203", "nwparser.payload", "%{fld2->} lsa flood on interface %{interface->} has dropped a packet.", processor_chain([ - dup272, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg740 = msg("00203", part1225); - - var part1226 = match("MESSAGE#731:00206/0", "nwparser.payload", "The total number of redistributed routes into %{p0}"); - - var part1227 = match("MESSAGE#731:00206/1_0", "nwparser.p0", "BGP %{p0}"); - - var part1228 = match("MESSAGE#731:00206/1_1", "nwparser.p0", "OSPF %{p0}"); - - var select284 = linear_select([ - part1227, - part1228, - ]); - - var part1229 = match("MESSAGE#731:00206/2", "nwparser.p0", "in vrouter %{node->} exceeded system limit (%{fld2})"); - - var all252 = all_match({ - processors: [ - part1226, - select284, - part1229, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg741 = msg("00206", all252); - - var part1230 = match("MESSAGE#732:00206:01/0", "nwparser.payload", "LSA flood in OSPF with router-id %{fld2->} on %{p0}"); - - var part1231 = match("MESSAGE#732:00206:01/2", "nwparser.p0", "%{interface->} forced the interface to drop a packet."); - - var all253 = all_match({ - processors: [ - part1230, - dup352, - part1231, - ], - on_success: processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg742 = msg("00206:01", all253); - - var part1232 = match("MESSAGE#733:00206:02/0", "nwparser.payload", "OSPF instance with router-id %{fld3->} received a Hello packet flood from neighbor (IP address %{hostip}, router ID %{fld2}) on %{p0}"); - - var part1233 = match("MESSAGE#733:00206:02/2", "nwparser.p0", "%{interface->} forcing the interface to drop the packet."); - - var all254 = all_match({ - processors: [ - part1232, - dup352, - part1233, - ], - on_success: processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg743 = msg("00206:02", all254); - - var part1234 = match("MESSAGE#734:00206:03", "nwparser.payload", "Link State Advertisement Id %{fld2}, router ID %{fld3}, type %{fld4->} cannot be deleted from the real-time database in area %{fld5}", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg744 = msg("00206:03", part1234); - - var part1235 = match("MESSAGE#735:00206:04", "nwparser.payload", "Reject second OSPF neighbor (%{fld2}) on interface (%{interface}) since it_s configured as point-to-point interface", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg745 = msg("00206:04", part1235); - - var select285 = linear_select([ - msg741, - msg742, - msg743, - msg744, - msg745, - ]); - - var part1236 = match("MESSAGE#736:00207", "nwparser.payload", "System wide RIP route limit exceeded, RIP route dropped.%{}", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg746 = msg("00207", part1236); - - var part1237 = match("MESSAGE#737:00207:01", "nwparser.payload", "%{fld2->} RIP routes dropped from last system wide RIP route limit exceed.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg747 = msg("00207:01", part1237); - - var part1238 = match("MESSAGE#738:00207:02", "nwparser.payload", "RIP database size limit exceeded for %{fld2}, RIP route dropped.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg748 = msg("00207:02", part1238); - - var part1239 = match("MESSAGE#739:00207:03", "nwparser.payload", "%{fld2->} RIP routes dropped from the last database size exceed in vr %{fld3}.", processor_chain([ - dup273, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg749 = msg("00207:03", part1239); - - var select286 = linear_select([ - msg746, - msg747, - msg748, - msg749, - ]); - - var part1240 = match("MESSAGE#740:00257", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - dup278, - ])); - - var msg750 = msg("00257", part1240); - - var part1241 = match("MESSAGE#741:00257:14", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup279, - dup276, - dup277, - dup280, - ])); - - var msg751 = msg("00257:14", part1241); - - var part1242 = match("MESSAGE#742:00257:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - dup278, - ])); - - var msg752 = msg("00257:01", part1242); - - var part1243 = match("MESSAGE#743:00257:15", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup279, - dup282, - dup280, - ])); - - var msg753 = msg("00257:15", part1243); - - var part1244 = match("MESSAGE#744:00257:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ])); - - var msg754 = msg("00257:02", part1244); - - var part1245 = match("MESSAGE#745:00257:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg755 = msg("00257:03", part1245); - - var part1246 = match("MESSAGE#746:00257:04", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ])); - - var msg756 = msg("00257:04", part1246); - - var part1247 = match("MESSAGE#747:00257:05", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid->} reason=%{result}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg757 = msg("00257:05", part1247); - - var part1248 = match("MESSAGE#748:00257:19/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} icmp code=%{icmpcode->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid->} reason=%{result}"); - - var all255 = all_match({ - processors: [ - dup283, - dup393, - part1248, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg758 = msg("00257:19", all255); - - var part1249 = match("MESSAGE#749:00257:16/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid}"); - - var all256 = all_match({ - processors: [ - dup283, - dup393, - part1249, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg759 = msg("00257:16", all256); - - var part1250 = match("MESSAGE#750:00257:17/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid}"); - - var all257 = all_match({ - processors: [ - dup283, - dup393, - part1250, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ]), - }); - - var msg760 = msg("00257:17", all257); - - var part1251 = match("MESSAGE#751:00257:18/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} session_id=%{sessionid}"); - - var all258 = all_match({ - processors: [ - dup283, - dup393, - part1251, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ]), - }); - - var msg761 = msg("00257:18", all258); - - var part1252 = match("MESSAGE#752:00257:06/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{p0}"); - - var part1253 = match("MESSAGE#752:00257:06/1_0", "nwparser.p0", "%{dport->} session_id=%{sessionid}"); - - var part1254 = match_copy("MESSAGE#752:00257:06/1_1", "nwparser.p0", "dport"); - - var select287 = linear_select([ - part1253, - part1254, - ]); - - var all259 = all_match({ - processors: [ - part1252, - select287, - ], - on_success: processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup276, - dup277, - ]), - }); - - var msg762 = msg("00257:06", all259); - - var part1255 = match("MESSAGE#753:00257:07", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup61, - dup282, - ])); - - var msg763 = msg("00257:07", part1255); - - var part1256 = match("MESSAGE#754:00257:08", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} tcp=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup276, - dup277, - ])); - - var msg764 = msg("00257:08", part1256); - - var part1257 = match("MESSAGE#755:00257:09/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{p0}"); - - var part1258 = match("MESSAGE#755:00257:09/1_0", "nwparser.p0", "%{icmptype->} icmp code=%{icmpcode->} session_id=%{sessionid->} reason=%{result}"); - - var part1259 = match("MESSAGE#755:00257:09/1_1", "nwparser.p0", "%{icmptype->} session_id=%{sessionid}"); - - var part1260 = match_copy("MESSAGE#755:00257:09/1_2", "nwparser.p0", "icmptype"); - - var select288 = linear_select([ - part1258, - part1259, - part1260, - ]); - - var all260 = all_match({ - processors: [ - part1257, - select288, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg765 = msg("00257:09", all260); - - var part1261 = match("MESSAGE#756:00257:10/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); - - var part1262 = match("MESSAGE#756:00257:10/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid}"); - - var select289 = linear_select([ - part1262, - dup286, - ]); - - var all261 = all_match({ - processors: [ - part1261, - select289, - ], - on_success: processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup276, - dup277, - ]), - }); - - var msg766 = msg("00257:10", all261); - - var part1263 = match("MESSAGE#757:00257:11/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); - - var part1264 = match("MESSAGE#757:00257:11/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid->} reason=%{result}"); - - var select290 = linear_select([ - part1264, - dup286, - ]); - - var all262 = all_match({ - processors: [ - part1263, - select290, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ]), - }); - - var msg767 = msg("00257:11", all262); - - var part1265 = match("MESSAGE#758:00257:12", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} type=%{fld3}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup274, - dup275, - dup60, - dup282, - ])); - - var msg768 = msg("00257:12", part1265); - - var part1266 = match("MESSAGE#759:00257:13", "nwparser.payload", "start_time=\"%{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup274, - dup4, - dup5, - ])); - - var msg769 = msg("00257:13", part1266); - - var select291 = linear_select([ - msg750, - msg751, - msg752, - msg753, - msg754, - msg755, - msg756, - msg757, - msg758, - msg759, - msg760, - msg761, - msg762, - msg763, - msg764, - msg765, - msg766, - msg767, - msg768, - msg769, - ]); - - var part1267 = match("MESSAGE#760:00259/1", "nwparser.p0", "user %{username->} has logged on via %{p0}"); - - var part1268 = match("MESSAGE#760:00259/2_0", "nwparser.p0", "the console %{p0}"); - - var select292 = linear_select([ - part1268, - dup289, - dup241, - ]); - - var part1269 = match("MESSAGE#760:00259/3", "nwparser.p0", "from %{saddr}:%{sport}"); - - var all263 = all_match({ - processors: [ - dup394, - part1267, - select292, - part1269, - ], - on_success: processor_chain([ - dup28, - dup29, - dup30, - dup31, - dup32, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg770 = msg("00259", all263); - - var part1270 = match("MESSAGE#761:00259:07/1", "nwparser.p0", "user %{administrator->} has logged out via %{logon_type->} from %{saddr}:%{sport}"); - - var all264 = all_match({ - processors: [ - dup394, - part1270, - ], - on_success: processor_chain([ - dup33, - dup29, - dup34, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg771 = msg("00259:07", all264); - - var part1271 = match("MESSAGE#762:00259:01", "nwparser.payload", "Management session via %{logon_type->} from %{saddr}:%{sport->} for [vsys] admin %{administrator->} has timed out", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg772 = msg("00259:01", part1271); - - var part1272 = match("MESSAGE#763:00259:02", "nwparser.payload", "Management session via %{logon_type->} for [ vsys ] admin %{administrator->} has timed out", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg773 = msg("00259:02", part1272); - - var part1273 = match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by admin %{administrator->} via the %{logon_type->} has failed", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg774 = msg("00259:03", part1273); - - var part1274 = match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{logon_type->} from %{saddr}:%{sport->} has failed", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg775 = msg("00259:04", part1274); - - var part1275 = match("MESSAGE#766:00259:05/0", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the %{p0}"); - - var part1276 = match("MESSAGE#766:00259:05/1_2", "nwparser.p0", "Web %{p0}"); - - var select293 = linear_select([ - dup241, - dup289, - part1276, - ]); - - var part1277 = match("MESSAGE#766:00259:05/2", "nwparser.p0", "session on host %{daddr}:%{dport}"); - - var all265 = all_match({ - processors: [ - part1275, - select293, - part1277, - ], - on_success: processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg776 = msg("00259:05", all265); - - var part1278 = match("MESSAGE#767:00259:06", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the serial console session.", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg777 = msg("00259:06", part1278); - - var select294 = linear_select([ - msg770, - msg771, - msg772, - msg773, - msg774, - msg775, - msg776, - msg777, - ]); - - var part1279 = match("MESSAGE#768:00262", "nwparser.payload", "Admin user %{administrator->} has been rejected via the %{logon_type->} server at %{hostip}", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg778 = msg("00262", part1279); - - var part1280 = match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} has been accepted via the %{logon_type->} server at %{hostip}", processor_chain([ - setc("eventcategory","1401050100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg779 = msg("00263", part1280); - - var part1281 = match("MESSAGE#770:00400/0_0", "nwparser.payload", "ActiveX control %{p0}"); - - var part1282 = match("MESSAGE#770:00400/0_1", "nwparser.payload", "JAVA applet %{p0}"); - - var part1283 = match("MESSAGE#770:00400/0_2", "nwparser.payload", "EXE file %{p0}"); - - var part1284 = match("MESSAGE#770:00400/0_3", "nwparser.payload", "ZIP file %{p0}"); - - var select295 = linear_select([ - part1281, - part1282, - part1283, - part1284, - ]); - - var part1285 = match("MESSAGE#770:00400/1", "nwparser.p0", "has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{dinterface->} in zone %{dst_zone}. %{info}"); - - var all266 = all_match({ - processors: [ - select295, - part1285, - ], - on_success: processor_chain([ - setc("eventcategory","1003000000"), - dup2, - dup4, - dup5, - dup3, - dup61, - ]), - }); - - var msg780 = msg("00400", all266); - - var part1286 = match("MESSAGE#771:00401", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg781 = msg("00401", part1286); - - var part1287 = match("MESSAGE#772:00402", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup292, - ])); - - var msg782 = msg("00402", part1287); - - var part1288 = match("MESSAGE#773:00402:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at %{p0}"); - - var part1289 = match("MESSAGE#773:00402:01/2", "nwparser.p0", "%{} %{interface->} in zone %{zone}. %{info}"); - - var all267 = all_match({ - processors: [ - part1288, - dup337, - part1289, - ], - on_success: processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup292, - ]), - }); - - var msg783 = msg("00402:01", all267); - - var select296 = linear_select([ - msg782, - msg783, - ]); - - var part1290 = match("MESSAGE#774:00403", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup85, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg784 = msg("00403", part1290); - - var part1291 = match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup147, - dup148, - dup149, - dup150, - dup2, - dup4, - dup5, - dup3, - dup292, - ])); - - var msg785 = msg("00404", part1291); - - var part1292 = match("MESSAGE#776:00405", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ - dup147, - dup2, - dup4, - dup5, - dup3, - dup291, - ])); - - var msg786 = msg("00405", part1292); - - var msg787 = msg("00406", dup413); - - var msg788 = msg("00407", dup413); - - var msg789 = msg("00408", dup413); - - var all268 = all_match({ - processors: [ - dup132, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg790 = msg("00409", all268); - - var msg791 = msg("00410", dup413); - - var part1293 = match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup60, - ])); - - var msg792 = msg("00410:01", part1293); - - var select297 = linear_select([ - msg791, - msg792, - ]); - - var part1294 = match("MESSAGE#783:00411/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto TCP (zone %{zone->} %{p0}"); - - var all269 = all_match({ - processors: [ - part1294, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg793 = msg("00411", all269); - - var part1295 = match("MESSAGE#784:00413/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at %{p0}"); - - var part1296 = match("MESSAGE#784:00413/2", "nwparser.p0", "%{} %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); - - var all270 = all_match({ - processors: [ - part1295, - dup337, - part1296, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var msg794 = msg("00413", all270); - - var part1297 = match("MESSAGE#785:00413:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}(zone %{group->} %{p0}"); - - var all271 = all_match({ - processors: [ - part1297, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup61, - ]), - }); - - var msg795 = msg("00413:01", all271); - - var part1298 = match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup59, - dup5, - dup9, - ])); - - var msg796 = msg("00413:02", part1298); - - var select298 = linear_select([ - msg794, - msg795, - msg796, - ]); - - var part1299 = match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg797 = msg("00414", part1299); - - var part1300 = match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup3, - dup59, - dup4, - dup5, - dup9, - ])); - - var msg798 = msg("00414:01", part1300); - - var select299 = linear_select([ - msg797, - msg798, - ]); - - var part1301 = match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg799 = msg("00415", part1301); - - var all272 = all_match({ - processors: [ - dup132, - dup343, - dup294, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup60, - ]), - }); - - var msg800 = msg("00423", all272); - - var all273 = all_match({ - processors: [ - dup80, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup60, - ]), - }); - - var msg801 = msg("00429", all273); - - var all274 = all_match({ - processors: [ - dup132, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup60, - ]), - }); - - var msg802 = msg("00429:01", all274); - - var select300 = linear_select([ - msg801, - msg802, - ]); - - var all275 = all_match({ - processors: [ - dup80, - dup343, - dup295, - dup351, - ], - on_success: processor_chain([ - dup85, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ]), - }); - - var msg803 = msg("00430", all275); - - var all276 = all_match({ - processors: [ - dup132, - dup343, - dup295, - dup351, - ], - on_success: processor_chain([ - dup85, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup60, - ]), - }); - - var msg804 = msg("00430:01", all276); - - var select301 = linear_select([ - msg803, - msg804, - ]); - - var msg805 = msg("00431", dup414); - - var msg806 = msg("00432", dup414); - - var msg807 = msg("00433", dup415); - - var msg808 = msg("00434", dup415); - - var msg809 = msg("00435", dup395); - - var all277 = all_match({ - processors: [ - dup132, - dup343, - dup294, - ], - on_success: processor_chain([ - dup58, - dup2, - dup4, - dup59, - dup5, - dup3, - dup60, - ]), - }); - - var msg810 = msg("00435:01", all277); - - var select302 = linear_select([ - msg809, - msg810, - ]); - - var msg811 = msg("00436", dup395); - - var all278 = all_match({ - processors: [ - dup64, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup9, - dup4, - dup5, - dup3, - dup60, - ]), - }); - - var msg812 = msg("00436:01", all278); - - var select303 = linear_select([ - msg811, - msg812, - ]); - - var part1302 = match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg813 = msg("00437", part1302); - - var all279 = all_match({ - processors: [ - dup299, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - dup9, - ]), - }); - - var msg814 = msg("00437:01", all279); - - var part1303 = match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - dup9, - ])); - - var msg815 = msg("00437:02", part1303); - - var select304 = linear_select([ - msg813, - msg814, - msg815, - ]); - - var part1304 = match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg816 = msg("00438", part1304); - - var part1305 = match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ])); - - var msg817 = msg("00438:01", part1305); - - var all280 = all_match({ - processors: [ - dup299, - dup338, - dup67, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup61, - ]), - }); - - var msg818 = msg("00438:02", all280); - - var select305 = linear_select([ - msg816, - msg817, - msg818, - ]); - - var part1306 = match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup9, - dup60, - ])); - - var msg819 = msg("00440", part1306); - - var part1307 = match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg820 = msg("00440:02", part1307); - - var all281 = all_match({ - processors: [ - dup239, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup9, - dup61, - ]), - }); - - var msg821 = msg("00440:01", all281); - - var part1308 = match("MESSAGE#812:00440:03/0", "nwparser.payload", "Fragmented traffic! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{group->} %{p0}"); - - var all282 = all_match({ - processors: [ - part1308, - dup343, - dup83, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup9, - dup60, - ]), - }); - - var msg822 = msg("00440:03", all282); - - var select306 = linear_select([ - msg819, - msg820, - msg821, - msg822, - ]); - - var part1309 = match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var msg823 = msg("00441", part1309); - - var msg824 = msg("00442", dup396); - - var msg825 = msg("00443", dup396); - - var part1310 = match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued command %{fld2->} to redirect output.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg826 = msg("00511", part1310); - - var part1311 = match("MESSAGE#817:00511:01/0", "nwparser.payload", "All System Config saved by admin %{p0}"); - - var all283 = all_match({ - processors: [ - part1311, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg827 = msg("00511:01", all283); - - var part1312 = match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms are cleared by admin %{administrator}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg828 = msg("00511:02", part1312); - - var part1313 = match("MESSAGE#819:00511:03/0", "nwparser.payload", "Get new software from flash to slot (file: %{fld2}) by admin %{p0}"); - - var all284 = all_match({ - processors: [ - part1313, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg829 = msg("00511:03", all284); - - var part1314 = match("MESSAGE#820:00511:04/0", "nwparser.payload", "Get new software from %{hostip->} (file: %{fld2}) to slot (file: %{fld3}) by admin %{p0}"); - - var all285 = all_match({ - processors: [ - part1314, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg830 = msg("00511:04", all285); - - var part1315 = match("MESSAGE#821:00511:05/0", "nwparser.payload", "Get new software to %{hostip->} (file: %{fld2}) by admin %{p0}"); - - var all286 = all_match({ - processors: [ - part1315, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg831 = msg("00511:05", all286); - - var part1316 = match("MESSAGE#822:00511:06/0", "nwparser.payload", "Log setting is modified by admin %{p0}"); - - var all287 = all_match({ - processors: [ - part1316, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg832 = msg("00511:06", all287); - - var part1317 = match("MESSAGE#823:00511:07/0", "nwparser.payload", "Save configuration to %{hostip->} (file: %{fld2}) by admin %{p0}"); - - var all288 = all_match({ - processors: [ - part1317, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg833 = msg("00511:07", all288); - - var part1318 = match("MESSAGE#824:00511:08/0", "nwparser.payload", "Save new software from slot (file: %{fld2}) to flash by admin %{p0}"); - - var all289 = all_match({ - processors: [ - part1318, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg834 = msg("00511:08", all289); - - var part1319 = match("MESSAGE#825:00511:09/0", "nwparser.payload", "Save new software from %{hostip->} (file: %{result}) to flash by admin %{p0}"); - - var all290 = all_match({ - processors: [ - part1319, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg835 = msg("00511:09", all290); - - var part1320 = match("MESSAGE#826:00511:10/0", "nwparser.payload", "System Config from flash to slot - %{fld2->} by admin %{p0}"); - - var all291 = all_match({ - processors: [ - part1320, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg836 = msg("00511:10", all291); - - var part1321 = match("MESSAGE#827:00511:11/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) to slot - %{fld3->} by admin %{p0}"); - - var all292 = all_match({ - processors: [ - part1321, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg837 = msg("00511:11", all292); - - var part1322 = match("MESSAGE#828:00511:12/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) by admin %{p0}"); - - var all293 = all_match({ - processors: [ - part1322, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg838 = msg("00511:12", all293); - - var part1323 = match("MESSAGE#829:00511:13/0", "nwparser.payload", "The system configuration was loaded from the slot by admin %{p0}"); - - var all294 = all_match({ - processors: [ - part1323, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg839 = msg("00511:13", all294); - - var part1324 = match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS shared secret with invalid length %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg840 = msg("00511:14", part1324); - - var select307 = linear_select([ - msg826, - msg827, - msg828, - msg829, - msg830, - msg831, - msg832, - msg833, - msg834, - msg835, - msg836, - msg837, - msg838, - msg839, - msg840, - ]); - - var part1325 = match("MESSAGE#831:00513/0", "nwparser.payload", "The physical state of %{p0}"); - - var part1326 = match("MESSAGE#831:00513/1_1", "nwparser.p0", "the Interface %{p0}"); - - var select308 = linear_select([ - dup123, - part1326, - dup122, - ]); - - var part1327 = match("MESSAGE#831:00513/2", "nwparser.p0", "%{interface->} has changed to %{p0}"); - - var part1328 = match("MESSAGE#831:00513/3_0", "nwparser.p0", "%{result}. (%{fld1})"); - - var part1329 = match_copy("MESSAGE#831:00513/3_1", "nwparser.p0", "result"); - - var select309 = linear_select([ - part1328, - part1329, - ]); - - var all295 = all_match({ - processors: [ - part1325, - select308, - part1327, - select309, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - dup9, - ]), - }); - - var msg841 = msg("00513", all295); - - var part1330 = match("MESSAGE#832:00515/0_0", "nwparser.payload", "Vsys Admin %{p0}"); - - var select310 = linear_select([ - part1330, - dup287, - ]); - - var part1331 = match("MESSAGE#832:00515/1", "nwparser.p0", "%{administrator->} has logged on via the %{logon_type->} ( HTTP%{p0}"); - - var part1332 = match("MESSAGE#832:00515/2_1", "nwparser.p0", "S%{p0}"); - - var select311 = linear_select([ - dup96, - part1332, - ]); - - var part1333 = match("MESSAGE#832:00515/3", "nwparser.p0", "%{}) to port %{interface->} from %{saddr}:%{sport}"); - - var all296 = all_match({ - processors: [ - select310, - part1331, - select311, - part1333, - ], - on_success: processor_chain([ - dup301, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg842 = msg("00515", all296); - - var part1334 = match("MESSAGE#833:00515:01/0", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{p0}"); - - var part1335 = match("MESSAGE#833:00515:01/1_0", "nwparser.p0", "the %{logon_type->} has failed %{p0}"); - - var part1336 = match("MESSAGE#833:00515:01/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} has failed %{p0}"); - - var select312 = linear_select([ - part1335, - part1336, - ]); - - var part1337 = match_copy("MESSAGE#833:00515:01/2", "nwparser.p0", "fld2"); - - var all297 = all_match({ - processors: [ - part1334, - select312, - part1337, - ], - on_success: processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup4, - dup5, - dup302, - dup3, - ]), - }); - - var msg843 = msg("00515:01", all297); - - var part1338 = match("MESSAGE#834:00515:02/0", "nwparser.payload", "Management session via %{p0}"); - - var part1339 = match("MESSAGE#834:00515:02/1_0", "nwparser.p0", "the %{logon_type->} for %{p0}"); - - var part1340 = match("MESSAGE#834:00515:02/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} for %{p0}"); - - var select313 = linear_select([ - part1339, - part1340, - ]); - - var part1341 = match("MESSAGE#834:00515:02/2_0", "nwparser.p0", "[vsys] admin %{p0}"); - - var part1342 = match("MESSAGE#834:00515:02/2_1", "nwparser.p0", "vsys admin %{p0}"); - - var select314 = linear_select([ - part1341, - part1342, - dup15, - ]); - - var part1343 = match("MESSAGE#834:00515:02/3", "nwparser.p0", "%{administrator->} has timed out"); - - var all298 = all_match({ - processors: [ - part1338, - select313, - select314, - part1343, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg844 = msg("00515:02", all298); - - var part1344 = match("MESSAGE#835:00515:04/0_0", "nwparser.payload", "[Vsys] %{p0}"); - - var part1345 = match("MESSAGE#835:00515:04/0_1", "nwparser.payload", "Vsys %{p0}"); - - var select315 = linear_select([ - part1344, - part1345, - ]); - - var part1346 = match("MESSAGE#835:00515:04/1", "nwparser.p0", "Admin %{administrator->} has logged o%{p0}"); - - var part1347 = match_copy("MESSAGE#835:00515:04/4_1", "nwparser.p0", "logon_type"); - - var select316 = linear_select([ - dup304, - part1347, - ]); - - var all299 = all_match({ - processors: [ - select315, - part1346, - dup398, - dup40, - select316, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg845 = msg("00515:04", all299); - - var part1348 = match("MESSAGE#836:00515:06", "nwparser.payload", "Admin User %{administrator->} has logged on via %{logon_type->} from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg846 = msg("00515:06", part1348); - - var part1349 = match("MESSAGE#837:00515:05/0", "nwparser.payload", "%{}Admin %{p0}"); - - var select317 = linear_select([ - dup305, - dup16, - ]); - - var part1350 = match("MESSAGE#837:00515:05/2", "nwparser.p0", "%{administrator->} has logged o%{p0}"); - - var part1351 = match("MESSAGE#837:00515:05/5_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{fld2})"); - - var select318 = linear_select([ - dup306, - part1351, - dup304, - ]); - - var all300 = all_match({ - processors: [ - part1349, - select317, - part1350, - dup398, - dup40, - select318, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg847 = msg("00515:05", all300); - - var part1352 = match("MESSAGE#838:00515:07", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(http) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg848 = msg("00515:07", part1352); - - var part1353 = match("MESSAGE#839:00515:08/0", "nwparser.payload", "%{fld2->} Admin User \"%{administrator}\" logged in for %{logon_type}(http%{p0}"); - - var part1354 = match("MESSAGE#839:00515:08/1_0", "nwparser.p0", ") %{p0}"); - - var part1355 = match("MESSAGE#839:00515:08/1_1", "nwparser.p0", "s) %{p0}"); - - var select319 = linear_select([ - part1354, - part1355, - ]); - - var part1356 = match("MESSAGE#839:00515:08/2", "nwparser.p0", "management (port %{network_port}) from %{saddr}:%{sport}"); - - var all301 = all_match({ - processors: [ - part1353, - select319, - part1356, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg849 = msg("00515:08", all301); - - var part1357 = match("MESSAGE#840:00515:09", "nwparser.payload", "User %{username->} telnet management session from (%{saddr}:%{sport}) timed out", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg850 = msg("00515:09", part1357); - - var part1358 = match("MESSAGE#841:00515:10", "nwparser.payload", "User %{username->} logged out of telnet session from %{saddr}:%{sport}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg851 = msg("00515:10", part1358); - - var part1359 = match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on zone %{zone}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg852 = msg("00515:11", part1359); - - var part1360 = match("MESSAGE#843:00515:12/0", "nwparser.payload", "[ Vsys ] Admin User \"%{administrator}\" logged in for Web( http%{p0}"); - - var part1361 = match("MESSAGE#843:00515:12/2", "nwparser.p0", ") management (port %{network_port})"); - - var all302 = all_match({ - processors: [ - part1360, - dup399, - part1361, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg853 = msg("00515:12", all302); - - var select320 = linear_select([ - dup288, - dup287, - ]); - - var part1362 = match("MESSAGE#844:00515:13/1", "nwparser.p0", "user %{administrator->} has logged o%{p0}"); - - var select321 = linear_select([ - dup306, - dup304, - ]); - - var all303 = all_match({ - processors: [ - select320, - part1362, - dup398, - dup40, - select321, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg854 = msg("00515:13", all303); - - var part1363 = match("MESSAGE#845:00515:14/0_0", "nwparser.payload", "Admin user %{administrator->} has been forced to log o%{p0}"); - - var part1364 = match("MESSAGE#845:00515:14/0_1", "nwparser.payload", "%{username->} %{fld1->} has been forced to log o%{p0}"); - - var select322 = linear_select([ - part1363, - part1364, - ]); - - var part1365 = match("MESSAGE#845:00515:14/2", "nwparser.p0", "of the %{p0}"); - - var part1366 = match("MESSAGE#845:00515:14/3_0", "nwparser.p0", "serial %{logon_type->} session."); - - var part1367 = match("MESSAGE#845:00515:14/3_1", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port->} (%{event_time})"); - - var part1368 = match("MESSAGE#845:00515:14/3_2", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port}"); - - var select323 = linear_select([ - part1366, - part1367, - part1368, - ]); - - var all304 = all_match({ - processors: [ - select322, - dup398, - part1365, - select323, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg855 = msg("00515:14", all304); - - var part1369 = match("MESSAGE#846:00515:15/0", "nwparser.payload", "%{fld2}: Admin User %{administrator->} has logged o%{p0}"); - - var part1370 = match("MESSAGE#846:00515:15/3_0", "nwparser.p0", "the %{logon_type->} (%{p0}"); - - var part1371 = match("MESSAGE#846:00515:15/3_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{p0}"); - - var select324 = linear_select([ - part1370, - part1371, - ]); - - var all305 = all_match({ - processors: [ - part1369, - dup398, - dup40, - select324, - dup41, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg856 = msg("00515:15", all305); - - var part1372 = match("MESSAGE#847:00515:16/0_0", "nwparser.payload", "%{fld2}: Admin %{p0}"); - - var select325 = linear_select([ - part1372, - dup287, - ]); - - var part1373 = match("MESSAGE#847:00515:16/1", "nwparser.p0", "user %{administrator->} attempt access to %{url->} illegal from %{logon_type}( http%{p0}"); - - var part1374 = match("MESSAGE#847:00515:16/3", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}. (%{fld1})"); - - var all306 = all_match({ - processors: [ - select325, - part1373, - dup399, - part1374, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg857 = msg("00515:16", all306); - - var part1375 = match("MESSAGE#848:00515:17/0", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{p0}"); - - var part1376 = match("MESSAGE#848:00515:17/1_0", "nwparser.p0", "https %{p0}"); - - var part1377 = match("MESSAGE#848:00515:17/1_1", "nwparser.p0", " http %{p0}"); - - var select326 = linear_select([ - part1376, - part1377, - ]); - - var part1378 = match("MESSAGE#848:00515:17/2", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}"); - - var all307 = all_match({ - processors: [ - part1375, - select326, - part1378, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg858 = msg("00515:17", all307); - - var part1379 = match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(https) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg859 = msg("00515:18", part1379); - - var part1380 = match("MESSAGE#850:00515:19/0", "nwparser.payload", "Vsys admin user %{administrator->} logged on via %{p0}"); - - var part1381 = match("MESSAGE#850:00515:19/1_0", "nwparser.p0", "%{logon_type->} from remote IP address %{saddr->} using port %{sport}. (%{p0}"); - - var part1382 = match("MESSAGE#850:00515:19/1_1", "nwparser.p0", "the console. (%{p0}"); - - var select327 = linear_select([ - part1381, - part1382, - ]); - - var all308 = all_match({ - processors: [ - part1380, - select327, - dup41, - ], - on_success: processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg860 = msg("00515:19", all308); - - var part1383 = match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session via SCS from %{saddr}:%{sport->} for admin netscreen has timed out (%{fld1})", processor_chain([ - dup240, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg861 = msg("00515:20", part1383); - - var select328 = linear_select([ - msg842, - msg843, - msg844, - msg845, - msg846, - msg847, - msg848, - msg849, - msg850, - msg851, - msg852, - msg853, - msg854, - msg855, - msg856, - msg857, - msg858, - msg859, - msg860, - msg861, - ]); - - var part1384 = match("MESSAGE#852:00518", "nwparser.payload", "Admin user %{administrator->} %{fld1}at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg862 = msg("00518", part1384); - - var part1385 = match("MESSAGE#853:00518:17", "nwparser.payload", "Admin user %{administrator->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg863 = msg("00518:17", part1385); - - var part1386 = match("MESSAGE#854:00518:01", "nwparser.payload", "Local authentication for WebAuth user %{username->} was %{disposition}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg864 = msg("00518:01", part1386); - - var part1387 = match("MESSAGE#855:00518:02", "nwparser.payload", "Local authentication for user %{username->} was %{disposition}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg865 = msg("00518:02", part1387); - - var part1388 = match("MESSAGE#856:00518:03", "nwparser.payload", "User %{username->} at %{saddr->} must enter \"Next Code\" for SecurID %{hostip}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg866 = msg("00518:03", part1388); - - var part1389 = match("MESSAGE#857:00518:04", "nwparser.payload", "WebAuth user %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg867 = msg("00518:04", part1389); - - var part1390 = match("MESSAGE#858:00518:05", "nwparser.payload", "User %{username->} at %{saddr->} has been challenged via the %{authmethod->} server at %{hostip->} (Rejected since challenge is not supported for %{logon_type})", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg868 = msg("00518:05", part1390); - - var part1391 = match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for WebAuth user %{username}", processor_chain([ - dup35, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg869 = msg("00518:06", part1391); - - var part1392 = match("MESSAGE#860:00518:07/0", "nwparser.payload", "Authentication for user %{username->} was denied (long %{p0}"); - - var part1393 = match("MESSAGE#860:00518:07/1_1", "nwparser.p0", "username %{p0}"); - - var select329 = linear_select([ - dup24, - part1393, - ]); - - var part1394 = match("MESSAGE#860:00518:07/2", "nwparser.p0", ")%{}"); - - var all309 = all_match({ - processors: [ - part1392, - select329, - part1394, - ], - on_success: processor_chain([ - dup53, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg870 = msg("00518:07", all309); - - var part1395 = match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr->} %{authmethod->} authentication attempt has timed out", processor_chain([ - dup35, - dup29, - dup31, - dup39, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg871 = msg("00518:08", part1395); - - var part1396 = match("MESSAGE#862:00518:09", "nwparser.payload", "User %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg872 = msg("00518:09", part1396); - - var part1397 = match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed due to %{result}. (%{fld1})", processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup4, - dup9, - dup5, - dup3, - dup302, - ])); - - var msg873 = msg("00518:10", part1397); - - var part1398 = match("MESSAGE#864:00518:11/0", "nwparser.payload", "ADM: Local admin authentication failed for login name %{p0}"); - - var part1399 = match("MESSAGE#864:00518:11/1_0", "nwparser.p0", "'%{username}': %{p0}"); - - var part1400 = match("MESSAGE#864:00518:11/1_1", "nwparser.p0", "%{username}: %{p0}"); - - var select330 = linear_select([ - part1399, - part1400, - ]); - - var part1401 = match("MESSAGE#864:00518:11/2", "nwparser.p0", "%{result->} (%{fld1})"); - - var all310 = all_match({ - processors: [ - part1398, - select330, - part1401, - ], - on_success: processor_chain([ - dup206, - dup29, - dup30, - dup31, - dup54, - dup2, - dup9, - dup4, - dup5, - dup3, - ]), - }); - - var msg874 = msg("00518:11", all310); - - var part1402 = match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup9, - dup5, - dup3, - ])); - - var msg875 = msg("00518:12", part1402); - - var part1403 = match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr->} is rejected by the Radius server at %{hostip}. (%{fld1})", processor_chain([ - dup290, - dup2, - dup3, - dup4, - dup9, - dup5, - ])); - - var msg876 = msg("00518:13", part1403); - - var part1404 = match("MESSAGE#867:00518:14", "nwparser.payload", "%{fld2}: Admin user has been rejected via the Radius server at %{hostip->} (%{fld1})", processor_chain([ - dup290, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg877 = msg("00518:14", part1404); - - var select331 = linear_select([ - msg862, - msg863, - msg864, - msg865, - msg866, - msg867, - msg868, - msg869, - msg870, - msg871, - msg872, - msg873, - msg874, - msg875, - msg876, - msg877, - ]); - - var part1405 = match("MESSAGE#868:00519/0", "nwparser.payload", "Admin user %{administrator->} %{p0}"); - - var part1406 = match("MESSAGE#868:00519/1_1", "nwparser.p0", "of group %{group->} at %{saddr->} has %{p0}"); - - var part1407 = match("MESSAGE#868:00519/1_2", "nwparser.p0", "%{group->} at %{saddr->} has %{p0}"); - - var select332 = linear_select([ - dup194, - part1406, - part1407, - ]); - - var part1408 = match("MESSAGE#868:00519/2", "nwparser.p0", "been %{disposition->} via the %{logon_type->} server %{p0}"); - - var part1409 = match("MESSAGE#868:00519/3_0", "nwparser.p0", "at %{p0}"); - - var select333 = linear_select([ - part1409, - dup16, - ]); - - var part1410 = match("MESSAGE#868:00519/4", "nwparser.p0", "%{hostip}"); - - var all311 = all_match({ - processors: [ - part1405, - select332, - part1408, - select333, - part1410, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg878 = msg("00519", all311); - - var part1411 = match("MESSAGE#869:00519:01/0", "nwparser.payload", "Local authentication for %{p0}"); - - var select334 = linear_select([ - dup307, - dup305, - ]); - - var part1412 = match("MESSAGE#869:00519:01/2", "nwparser.p0", "%{username->} was %{disposition}"); - - var all312 = all_match({ - processors: [ - part1411, - select334, - part1412, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg879 = msg("00519:01", all312); - - var part1413 = match("MESSAGE#870:00519:02/1_1", "nwparser.p0", "User %{p0}"); - - var select335 = linear_select([ - dup307, - part1413, - ]); - - var part1414 = match("MESSAGE#870:00519:02/2", "nwparser.p0", "%{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}"); - - var all313 = all_match({ - processors: [ - dup160, - select335, - part1414, - ], - on_success: processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg880 = msg("00519:02", all313); - - var part1415 = match("MESSAGE#871:00519:03", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{fld4}", processor_chain([ - dup240, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg881 = msg("00519:03", part1415); - - var part1416 = match("MESSAGE#872:00519:04", "nwparser.payload", "ADM: Local admin authentication successful for login name %{username->} (%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg882 = msg("00519:04", part1416); - - var part1417 = match("MESSAGE#873:00519:05", "nwparser.payload", "%{fld2}Admin user %{administrator->} has been accepted via the Radius server at %{hostip}(%{fld1})", processor_chain([ - dup240, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg883 = msg("00519:05", part1417); - - var select336 = linear_select([ - msg878, - msg879, - msg880, - msg881, - msg882, - msg883, - ]); - - var part1418 = match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authentication attempt has timed out", processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg884 = msg("00520", part1418); - - var part1419 = match("MESSAGE#875:00520:01/0", "nwparser.payload", "User %{username->} at %{hostip->} %{p0}"); - - var part1420 = match("MESSAGE#875:00520:01/1_0", "nwparser.p0", "RADIUS %{p0}"); - - var part1421 = match("MESSAGE#875:00520:01/1_1", "nwparser.p0", "SecurID %{p0}"); - - var part1422 = match("MESSAGE#875:00520:01/1_2", "nwparser.p0", "LDAP %{p0}"); - - var part1423 = match("MESSAGE#875:00520:01/1_3", "nwparser.p0", "Local %{p0}"); - - var select337 = linear_select([ - part1420, - part1421, - part1422, - part1423, - ]); - - var part1424 = match("MESSAGE#875:00520:01/2", "nwparser.p0", "authentication attempt has timed out%{}"); - - var all314 = all_match({ - processors: [ - part1419, - select337, - part1424, - ], - on_success: processor_chain([ - dup35, - dup31, - dup39, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg885 = msg("00520:01", all314); - - var part1425 = match("MESSAGE#876:00520:02/0", "nwparser.payload", "Trying %{p0}"); - - var part1426 = match("MESSAGE#876:00520:02/2", "nwparser.p0", "server %{fld2}"); - - var all315 = all_match({ - processors: [ - part1425, - dup400, - part1426, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg886 = msg("00520:02", all315); - - var part1427 = match("MESSAGE#877:00520:03/1_0", "nwparser.p0", "Primary %{p0}"); - - var part1428 = match("MESSAGE#877:00520:03/1_1", "nwparser.p0", "Backup1 %{p0}"); - - var part1429 = match("MESSAGE#877:00520:03/1_2", "nwparser.p0", "Backup2 %{p0}"); - - var select338 = linear_select([ - part1427, - part1428, - part1429, - ]); - - var part1430 = match("MESSAGE#877:00520:03/2", "nwparser.p0", "%{fld2}, %{p0}"); - - var part1431 = match("MESSAGE#877:00520:03/4", "nwparser.p0", "%{fld3}, and %{p0}"); - - var part1432 = match("MESSAGE#877:00520:03/6", "nwparser.p0", "%{fld4->} servers failed"); - - var all316 = all_match({ - processors: [ - dup160, - select338, - part1430, - dup400, - part1431, - dup400, - part1432, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg887 = msg("00520:03", all316); - - var part1433 = match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hostip->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg888 = msg("00520:04", part1433); - - var part1434 = match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: New requests for %{fld31->} server will try %{fld32->} from now on. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg889 = msg("00520:05", part1434); - - var select339 = linear_select([ - msg884, - msg885, - msg886, - msg887, - msg888, - msg889, - ]); - - var part1435 = match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg890 = msg("00521", part1435); - - var part1436 = match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg891 = msg("00522", part1436); - - var part1437 = match("MESSAGE#881:00523", "nwparser.payload", "URL filtering received an error from %{fld2->} (error %{resultcode}).", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg892 = msg("00523", part1437); - - var part1438 = match("MESSAGE#882:00524", "nwparser.payload", "NetScreen device at %{hostip}:%{network_port->} has responded successfully to SNMP request from %{saddr}:%{sport}", processor_chain([ - dup209, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg893 = msg("00524", part1438); - - var part1439 = match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown SNMP community public at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg894 = msg("00524:02", part1439); - - var part1440 = match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has responded successfully to the SNMP request from %{saddr}:%{sport}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg895 = msg("00524:03", part1440); - - var part1441 = match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown SNMP community admin at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg896 = msg("00524:04", part1441); - - var part1442 = match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg897 = msg("00524:05", part1442); - - var part1443 = match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been received from an unknown host in SNMP community %{fld2->} at %{hostip}:%{network_port}. (%{fld1})", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg898 = msg("00524:06", part1443); - - var part1444 = match("MESSAGE#888:00524:12", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{saddr}:%{sport->} to %{daddr}:%{dport->} has been received", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg899 = msg("00524:12", part1444); - - var part1445 = match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{sport->} has been received, but the SNMP version type is incorrect. (%{fld1})", processor_chain([ - dup19, - dup2, - dup4, - setc("result","the SNMP version type is incorrect"), - dup5, - dup9, - ])); - - var msg900 = msg("00524:14", part1445); - - var part1446 = match("MESSAGE#890:00524:13/0", "nwparser.payload", "SNMP request has been received%{p0}"); - - var part1447 = match("MESSAGE#890:00524:13/2", "nwparser.p0", "%{}but %{result}"); - - var all317 = all_match({ - processors: [ - part1446, - dup401, - part1447, - ], - on_success: processor_chain([ - dup18, - dup2, - dup4, - dup5, - ]), - }); - - var msg901 = msg("00524:13", all317); - - var part1448 = match("MESSAGE#891:00524:07", "nwparser.payload", "Response to SNMP request from %{saddr}:%{sport->} to %{daddr}:%{dport->} has %{disposition->} due to %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg902 = msg("00524:07", part1448); - - var part1449 = match("MESSAGE#892:00524:08", "nwparser.payload", "SNMP community %{fld2->} cannot be added because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg903 = msg("00524:08", part1449); - - var part1450 = match("MESSAGE#893:00524:09", "nwparser.payload", "SNMP host %{hostip->} cannot be added to community %{fld2->} because of %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg904 = msg("00524:09", part1450); - - var part1451 = match("MESSAGE#894:00524:10", "nwparser.payload", "SNMP host %{hostip->} cannot be added because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg905 = msg("00524:10", part1451); - - var part1452 = match("MESSAGE#895:00524:11", "nwparser.payload", "SNMP host %{hostip->} cannot be removed from community %{fld2->} because %{result}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - ])); - - var msg906 = msg("00524:11", part1452); - - var part1453 = match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34->} doesn't exist. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg907 = msg("00524:16", part1453); - - var select340 = linear_select([ - msg893, - msg894, - msg895, - msg896, - msg897, - msg898, - msg899, - msg900, - msg901, - msg902, - msg903, - msg904, - msg905, - msg906, - msg907, - ]); - - var part1454 = match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username->} at %{hostip->} has been %{disposition->} by SecurID %{fld2}", processor_chain([ - dup203, - setc("ec_subject","Password"), - dup38, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg908 = msg("00525", part1454); - - var part1455 = match("MESSAGE#897:00525:01", "nwparser.payload", "User %{username->} at %{hostip->} has selected a system-generated PIN for authentication with SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg909 = msg("00525:01", part1455); - - var part1456 = match("MESSAGE#898:00525:02", "nwparser.payload", "User %{username->} at %{hostip->} must enter the \"new PIN\" for SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg910 = msg("00525:02", part1456); - - var part1457 = match("MESSAGE#899:00525:03", "nwparser.payload", "User %{username->} at %{hostip->} must make a \"New PIN\" choice for SecurID %{fld2}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg911 = msg("00525:03", part1457); - - var select341 = linear_select([ - msg908, - msg909, - msg910, - msg911, - ]); - - var part1458 = match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded and %{hostip->} cannot be added", processor_chain([ - dup37, - dup219, - dup38, - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg912 = msg("00526", part1458); - - var part1459 = match("MESSAGE#901:00527/0", "nwparser.payload", "A DHCP-%{p0}"); - - var part1460 = match("MESSAGE#901:00527/1_1", "nwparser.p0", " assigned %{p0}"); - - var select342 = linear_select([ - dup311, - part1460, - ]); - - var part1461 = match("MESSAGE#901:00527/2", "nwparser.p0", "IP address %{hostip->} has been %{p0}"); - - var part1462 = match("MESSAGE#901:00527/3_1", "nwparser.p0", "freed from %{p0}"); - - var part1463 = match("MESSAGE#901:00527/3_2", "nwparser.p0", "freed %{p0}"); - - var select343 = linear_select([ - dup312, - part1462, - part1463, - ]); - - var all318 = all_match({ - processors: [ - part1459, - select342, - part1461, - select343, - dup108, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg913 = msg("00527", all318); - - var part1464 = match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address has been manually released%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg914 = msg("00527:01", part1464); - - var part1465 = match("MESSAGE#903:00527:02/0", "nwparser.payload", "DHCP server has %{p0}"); - - var part1466 = match("MESSAGE#903:00527:02/1_1", "nwparser.p0", "released %{p0}"); - - var part1467 = match("MESSAGE#903:00527:02/1_2", "nwparser.p0", "assigned or released %{p0}"); - - var select344 = linear_select([ - dup311, - part1466, - part1467, - ]); - - var part1468 = match("MESSAGE#903:00527:02/2", "nwparser.p0", "an IP address%{}"); - - var all319 = all_match({ - processors: [ - part1465, - select344, - part1468, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg915 = msg("00527:02", all319); - - var part1469 = match("MESSAGE#904:00527:03", "nwparser.payload", "MAC address %{macaddr->} has detected an IP conflict and has declined address %{hostip}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg916 = msg("00527:03", part1469); - - var part1470 = match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP addresses have been manually released.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg917 = msg("00527:04", part1470); - - var part1471 = match("MESSAGE#906:00527:05/2", "nwparser.p0", "%{} %{interface->} is more than %{fld2->} allocated."); - - var all320 = all_match({ - processors: [ - dup210, - dup337, - part1471, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg918 = msg("00527:05", all320); - - var part1472 = match("MESSAGE#907:00527:06/0", "nwparser.payload", "IP address %{hostip->} %{p0}"); - - var select345 = linear_select([ - dup106, - dup127, - ]); - - var part1473 = match("MESSAGE#907:00527:06/3_1", "nwparser.p0", "released from %{p0}"); - - var select346 = linear_select([ - dup312, - part1473, - ]); - - var part1474 = match("MESSAGE#907:00527:06/4", "nwparser.p0", "%{fld2->} (%{fld1})"); - - var all321 = all_match({ - processors: [ - part1472, - select345, - dup23, - select346, - part1474, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg919 = msg("00527:06", all321); - - var part1475 = match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have expired. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg920 = msg("00527:07", part1475); - - var part1476 = match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{interface->} received %{protocol_detail->} from %{smacaddr->} requesting out-of-scope IP address %{hostip}/%{mask->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg921 = msg("00527:08", part1476); - - var part1477 = match("MESSAGE#910:00527:09/0", "nwparser.payload", "MAC address %{macaddr->} has %{disposition->} %{p0}"); - - var part1478 = match("MESSAGE#910:00527:09/1_0", "nwparser.p0", "address %{hostip->} (%{p0}"); - - var part1479 = match("MESSAGE#910:00527:09/1_1", "nwparser.p0", "%{hostip->} (%{p0}"); - - var select347 = linear_select([ - part1478, - part1479, - ]); - - var all322 = all_match({ - processors: [ - part1477, - select347, - dup41, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg922 = msg("00527:09", all322); - - var part1480 = match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are expired. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg923 = msg("00527:10", part1480); - - var select348 = linear_select([ - msg913, - msg914, - msg915, - msg916, - msg917, - msg918, - msg919, - msg920, - msg921, - msg922, - msg923, - ]); - - var part1481 = match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenticated using password :", processor_chain([ - setc("eventcategory","1302010000"), - dup29, - dup31, - dup32, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg924 = msg("00528", part1481); - - var part1482 = match("MESSAGE#913:00528:01", "nwparser.payload", "SCS: Connection terminated for user %{username->} from", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg925 = msg("00528:01", part1482); - - var part1483 = match("MESSAGE#914:00528:02", "nwparser.payload", "SCS: Disabled for all root/vsys on device. Client host attempting connection to interface '%{interface}' with address %{hostip->} from %{saddr}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg926 = msg("00528:02", part1483); - - var part1484 = match("MESSAGE#915:00528:03", "nwparser.payload", "SSH: NetScreen device %{disposition->} to identify itself to the SSH client at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg927 = msg("00528:03", part1484); - - var part1485 = match("MESSAGE#916:00528:04", "nwparser.payload", "SSH: Incompatible SSH version string has been received from SSH client at %{hostip}", processor_chain([ - dup203, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg928 = msg("00528:04", part1485); - - var part1486 = match("MESSAGE#917:00528:05", "nwparser.payload", "SSH: %{disposition->} to send identification string to client host at %{hostip}", processor_chain([ - dup203, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg929 = msg("00528:05", part1486); - - var part1487 = match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} attempted to connect with invalid version string.", processor_chain([ - dup313, - dup2, - dup3, - dup4, - dup5, - setc("result","invalid version string"), - ])); - - var msg930 = msg("00528:06", part1487); - - var part1488 = match("MESSAGE#919:00528:07/0", "nwparser.payload", "SSH: %{disposition->} to negotiate %{p0}"); - - var part1489 = match("MESSAGE#919:00528:07/1_1", "nwparser.p0", "MAC %{p0}"); - - var part1490 = match("MESSAGE#919:00528:07/1_2", "nwparser.p0", "key exchange %{p0}"); - - var part1491 = match("MESSAGE#919:00528:07/1_3", "nwparser.p0", "host key %{p0}"); - - var select349 = linear_select([ - dup88, - part1489, - part1490, - part1491, - ]); - - var part1492 = match("MESSAGE#919:00528:07/2", "nwparser.p0", "algorithm with host %{hostip}"); - - var all323 = all_match({ - processors: [ - part1488, - select349, - part1492, - ], - on_success: processor_chain([ - dup314, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg931 = msg("00528:07", all323); - - var part1493 = match("MESSAGE#920:00528:08", "nwparser.payload", "SSH: Unsupported cipher type %{fld2->} requested from %{saddr}", processor_chain([ - dup314, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg932 = msg("00528:08", part1493); - - var part1494 = match("MESSAGE#921:00528:09", "nwparser.payload", "SSH: Host client has requested NO cipher from %{saddr}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg933 = msg("00528:09", part1494); - - var part1495 = match("MESSAGE#922:00528:10", "nwparser.payload", "SSH: Disabled for '%{vsys}'. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg934 = msg("00528:10", part1495); - - var part1496 = match("MESSAGE#923:00528:11", "nwparser.payload", "SSH: Disabled for %{fld2->} Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg935 = msg("00528:11", part1496); - - var part1497 = match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} at %{saddr->} tried unsuccessfully to log in to %{vsys->} using the shared untrusted interface. SSH disabled on that interface.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("disposition","disabled"), - ])); - - var msg936 = msg("00528:12", part1497); - - var part1498 = match("MESSAGE#925:00528:13/0", "nwparser.payload", "SSH: SSH client at %{saddr->} tried unsuccessfully to %{p0}"); - - var part1499 = match("MESSAGE#925:00528:13/1_0", "nwparser.p0", "make %{p0}"); - - var part1500 = match("MESSAGE#925:00528:13/1_1", "nwparser.p0", "establish %{p0}"); - - var select350 = linear_select([ - part1499, - part1500, - ]); - - var part1501 = match("MESSAGE#925:00528:13/2", "nwparser.p0", "an SSH connection to %{p0}"); - - var part1502 = match("MESSAGE#925:00528:13/4", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} SSH %{p0}"); - - var part1503 = match("MESSAGE#925:00528:13/5_0", "nwparser.p0", "not enabled %{p0}"); - - var select351 = linear_select([ - part1503, - dup157, - ]); - - var part1504 = match("MESSAGE#925:00528:13/6", "nwparser.p0", "on that interface.%{}"); - - var all324 = all_match({ - processors: [ - part1498, - select350, - part1501, - dup337, - part1502, - select351, - part1504, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg937 = msg("00528:13", all324); - - var part1505 = match("MESSAGE#926:00528:14", "nwparser.payload", "SSH: SSH client %{saddr->} unsuccessfully attempted to make an SSH connection to %{vsys->} SSH was not completely initialized for that system.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg938 = msg("00528:14", part1505); - - var part1506 = match("MESSAGE#927:00528:15/0", "nwparser.payload", "SSH: Admin user %{p0}"); - - var part1507 = match("MESSAGE#927:00528:15/1_1", "nwparser.p0", "%{administrator->} %{p0}"); - - var select352 = linear_select([ - dup315, - part1507, - ]); - - var part1508 = match("MESSAGE#927:00528:15/2", "nwparser.p0", "at host %{saddr->} requested unsupported %{p0}"); - - var part1509 = match("MESSAGE#927:00528:15/3_0", "nwparser.p0", "PKA algorithm %{p0}"); - - var part1510 = match("MESSAGE#927:00528:15/3_1", "nwparser.p0", "authentication method %{p0}"); - - var select353 = linear_select([ - part1509, - part1510, - ]); - - var all325 = all_match({ - processors: [ - part1506, - select352, - part1508, - select353, - dup108, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg939 = msg("00528:15", all325); - - var part1511 = match("MESSAGE#928:00528:16", "nwparser.payload", "SCP: Admin '%{administrator}' at host %{saddr->} executed invalid scp command: '%{fld2}'", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg940 = msg("00528:16", part1511); - - var part1512 = match("MESSAGE#929:00528:17", "nwparser.payload", "SCP: Disabled for '%{username}'. Attempted file transfer failed from host %{saddr}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg941 = msg("00528:17", part1512); - - var part1513 = match("MESSAGE#930:00528:18/2", "nwparser.p0", "authentication successful for admin user %{p0}"); - - var all326 = all_match({ - processors: [ - dup316, - dup402, - part1513, - dup403, - dup320, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("disposition","successful"), - setc("event_description","authentication successful for admin user"), - ]), - }); - - var msg942 = msg("00528:18", all326); - - var part1514 = match("MESSAGE#931:00528:26/2", "nwparser.p0", "authentication failed for admin user %{p0}"); - - var all327 = all_match({ - processors: [ - dup316, - dup402, - part1514, - dup403, - dup320, - ], - on_success: processor_chain([ - dup206, - dup29, - dup31, - dup54, - dup2, - dup4, - dup5, - dup302, - dup3, - setc("event_description","authentication failed for admin user"), - ]), - }); - - var msg943 = msg("00528:26", all327); - - var part1515 = match("MESSAGE#932:00528:19/2", "nwparser.p0", ": SSH user %{username->} has been %{disposition->} using password from %{saddr}:%{sport}"); - - var all328 = all_match({ - processors: [ - dup321, - dup404, - part1515, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg944 = msg("00528:19", all328); - - var part1516 = match("MESSAGE#933:00528:20/2", "nwparser.p0", ": Connection has been %{disposition->} for admin user %{administrator->} at %{saddr}:%{sport}"); - - var all329 = all_match({ - processors: [ - dup321, - dup404, - part1516, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg945 = msg("00528:20", all329); - - var part1517 = match("MESSAGE#934:00528:21", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has requested PKA RSA authentication, which is not supported for that client.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg946 = msg("00528:21", part1517); - - var part1518 = match("MESSAGE#935:00528:22/0", "nwparser.payload", "SCS: SSH client at %{saddr->} has attempted to make an SCS connection to %{p0}"); - - var part1519 = match("MESSAGE#935:00528:22/2", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} but %{disposition->} because SCS is not enabled for that interface."); - - var all330 = all_match({ - processors: [ - part1518, - dup337, - part1519, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("result","SCS is not enabled for that interface"), - ]), - }); - - var msg947 = msg("00528:22", all330); - - var part1520 = match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to vsys %{vsys->} because SCS cannot generate the host and server keys before timing out.", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - setc("result","SCS cannot generate the host and server keys before timing out"), - ])); - - var msg948 = msg("00528:23", part1520); - - var part1521 = match("MESSAGE#937:00528:24", "nwparser.payload", "SSH: %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg949 = msg("00528:24", part1521); - - var part1522 = match("MESSAGE#938:00528:25/0", "nwparser.payload", "SSH: Admin %{p0}"); - - var part1523 = match("MESSAGE#938:00528:25/2", "nwparser.p0", "at host %{saddr->} attempted to be authenticated with no authentication methods enabled."); - - var all331 = all_match({ - processors: [ - part1522, - dup403, - part1523, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - ]), - }); - - var msg950 = msg("00528:25", all331); - - var select354 = linear_select([ - msg924, - msg925, - msg926, - msg927, - msg928, - msg929, - msg930, - msg931, - msg932, - msg933, - msg934, - msg935, - msg936, - msg937, - msg938, - msg939, - msg940, - msg941, - msg942, - msg943, - msg944, - msg945, - msg946, - msg947, - msg948, - msg949, - msg950, - ]); - - var part1524 = match("MESSAGE#939:00529/1_0", "nwparser.p0", "manually %{p0}"); - - var part1525 = match("MESSAGE#939:00529/1_1", "nwparser.p0", "automatically %{p0}"); - - var select355 = linear_select([ - part1524, - part1525, - ]); - - var part1526 = match("MESSAGE#939:00529/2", "nwparser.p0", "refreshed%{}"); - - var all332 = all_match({ - processors: [ - dup63, - select355, - part1526, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg951 = msg("00529", all332); - - var part1527 = match("MESSAGE#940:00529:01/0", "nwparser.payload", "DNS entries have been refreshed by %{p0}"); - - var part1528 = match("MESSAGE#940:00529:01/1_0", "nwparser.p0", "state change%{}"); - - var part1529 = match("MESSAGE#940:00529:01/1_1", "nwparser.p0", "HA%{}"); - - var select356 = linear_select([ - part1528, - part1529, - ]); - - var all333 = all_match({ - processors: [ - part1527, - select356, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg952 = msg("00529:01", all333); - - var select357 = linear_select([ - msg951, - msg952, - ]); - - var part1530 = match("MESSAGE#941:00530", "nwparser.payload", "An IP conflict has been detected and the DHCP client has declined address %{hostip}", processor_chain([ - dup272, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg953 = msg("00530", part1530); - - var part1531 = match("MESSAGE#942:00530:01/0", "nwparser.payload", "DHCP client IP %{hostip->} for the %{p0}"); - - var part1532 = match("MESSAGE#942:00530:01/2", "nwparser.p0", "%{} %{interface->} has been manually released"); - - var all334 = all_match({ - processors: [ - part1531, - dup337, - part1532, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg954 = msg("00530:01", all334); - - var part1533 = match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get an IP address for the %{interface->} interface", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg955 = msg("00530:02", part1533); - - var part1534 = match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hostip->} has expired", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg956 = msg("00530:03", part1534); - - var part1535 = match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has assigned the untrust Interface %{interface->} with lease %{fld2}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg957 = msg("00530:04", part1535); - - var part1536 = match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has assigned the %{interface->} interface %{fld2->} with lease %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg958 = msg("00530:05", part1536); - - var part1537 = match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get IP address for the untrust interface.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg959 = msg("00530:06", part1537); - - var select358 = linear_select([ - msg953, - msg954, - msg955, - msg956, - msg957, - msg958, - msg959, - ]); - - var part1538 = match("MESSAGE#948:00531/0", "nwparser.payload", "System clock configurations have been changed by admin %{p0}"); - - var all335 = all_match({ - processors: [ - part1538, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg960 = msg("00531", all335); - - var part1539 = match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg961 = msg("00531:01", part1539); - - var part1540 = match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been updated through NTP.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg962 = msg("00531:02", part1540); - - var part1541 = match("MESSAGE#951:00531:03/0", "nwparser.payload", "The system clock was updated from %{type->} NTP server type %{hostname->} with a%{p0}"); - - var part1542 = match("MESSAGE#951:00531:03/1_0", "nwparser.p0", " ms %{p0}"); - - var select359 = linear_select([ - part1542, - dup115, - ]); - - var part1543 = match("MESSAGE#951:00531:03/2", "nwparser.p0", "adjustment of %{fld3}. Authentication was %{fld4}. Update mode was %{p0}"); - - var part1544 = match("MESSAGE#951:00531:03/3_0", "nwparser.p0", "%{fld5}(%{fld2})"); - - var part1545 = match_copy("MESSAGE#951:00531:03/3_1", "nwparser.p0", "fld5"); - - var select360 = linear_select([ - part1544, - part1545, - ]); - - var all336 = all_match({ - processors: [ - part1541, - select359, - part1543, - select360, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup146, - ]), - }); - - var msg963 = msg("00531:03", all336); - - var part1546 = match("MESSAGE#952:00531:04/0", "nwparser.payload", "The NetScreen device is attempting to contact the %{p0}"); - - var part1547 = match("MESSAGE#952:00531:04/1_0", "nwparser.p0", "primary backup %{p0}"); - - var part1548 = match("MESSAGE#952:00531:04/1_1", "nwparser.p0", "secondary backup %{p0}"); - - var select361 = linear_select([ - part1547, - part1548, - dup189, - ]); - - var part1549 = match("MESSAGE#952:00531:04/2", "nwparser.p0", "NTP server %{hostname}"); - - var all337 = all_match({ - processors: [ - part1546, - select361, - part1549, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg964 = msg("00531:04", all337); - - var part1550 = match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contacted. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg965 = msg("00531:05", part1550); - - var part1551 = match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustment of %{fld2->} from NTP server %{hostname->} exceeds the allowed adjustment of %{fld3}. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg966 = msg("00531:06", part1551); - - var part1552 = match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be obtained from any NTP server. (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg967 = msg("00531:07", part1552); - - var part1553 = match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator->} changed the %{change_attribute->} from %{change_old->} to %{change_new->} (by %{fld3->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}) (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg968 = msg("00531:08", part1553); - - var part1554 = match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol settings changed. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg969 = msg("00531:09", part1554); - - var part1555 = match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition->} on interface %{interface->} (%{fld1})", processor_chain([ - dup86, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg970 = msg("00531:10", part1555); - - var part1556 = match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be changed from %{change_old->} to %{change_new->} received from primary NTP server %{hostip->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","system clock changed based on receive from primary NTP server"), - ])); - - var msg971 = msg("00531:11", part1556); - - var part1557 = match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{saddr->} could not be contacted. (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg972 = msg("00531:12", part1557); - - var select362 = linear_select([ - msg960, - msg961, - msg962, - msg963, - msg964, - msg965, - msg966, - msg967, - msg968, - msg969, - msg970, - msg971, - msg972, - ]); - - var part1558 = match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now responding", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg973 = msg("00533", part1558); - - var part1559 = match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg974 = msg("00534", part1559); - - var part1560 = match("MESSAGE#962:00535", "nwparser.payload", "Cannot find the CA certificate with distinguished name %{fld2}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg975 = msg("00535", part1560); - - var part1561 = match("MESSAGE#963:00535:01", "nwparser.payload", "Distinguished name %{dn->} in the X509 certificate request is %{disposition}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg976 = msg("00535:01", part1561); - - var part1562 = match("MESSAGE#964:00535:02", "nwparser.payload", "Local certificate with distinguished name %{dn->} is %{disposition}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg977 = msg("00535:02", part1562); - - var part1563 = match("MESSAGE#965:00535:03", "nwparser.payload", "PKCS #7 data cannot be decapsulated%{}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg978 = msg("00535:03", part1563); - - var part1564 = match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been received from the CA%{}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - setc("result","SCEP_FAILURE message"), - ])); - - var msg979 = msg("00535:04", part1564); - - var part1565 = match("MESSAGE#967:00535:05", "nwparser.payload", "PKI error message has been received: %{result}", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg980 = msg("00535:05", part1565); - - var part1566 = match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration (CA cert subject name %{dn}). (%{event_time_string})", processor_chain([ - dup314, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Saved CA configuration - cert subject name"), - ])); - - var msg981 = msg("00535:06", part1566); - - var select363 = linear_select([ - msg975, - msg976, - msg977, - msg978, - msg979, - msg980, - msg981, - ]); - - var part1567 = match("MESSAGE#969:00536:49/0", "nwparser.payload", "IKE %{hostip->} %{p0}"); - - var part1568 = match("MESSAGE#969:00536:49/1_0", "nwparser.p0", "Phase 2 msg ID %{sessionid}: %{disposition}. %{p0}"); - - var part1569 = match("MESSAGE#969:00536:49/1_1", "nwparser.p0", "Phase 1: %{disposition->} %{p0}"); - - var part1570 = match("MESSAGE#969:00536:49/1_2", "nwparser.p0", "phase 2:%{disposition}. %{p0}"); - - var part1571 = match("MESSAGE#969:00536:49/1_3", "nwparser.p0", "phase 1:%{disposition}. %{p0}"); - - var select364 = linear_select([ - part1568, - part1569, - part1570, - part1571, - ]); - - var all338 = all_match({ - processors: [ - part1567, - select364, - dup10, - ], - on_success: processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ]), - }); - - var msg982 = msg("00536:49", all338); - - var part1572 = match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received from %{saddr}/%{sport->} at interface %{interface->} at %{daddr}/%{dport}", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg983 = msg("00536", part1572); - - var part1573 = match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2}) without IP address at both end points! Check outgoing interface.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg984 = msg("00536:01", part1573); - - var part1574 = match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip->} in %{fld4->} mode with ID: %{fld3->} has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg985 = msg("00536:02", part1574); - - var part1575 = match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has been %{disposition}. %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg986 = msg("00536:03", part1575); - - var part1576 = match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{group->} has deactivated the SA with ID %{fld2}.", processor_chain([ - setc("eventcategory","1801010100"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg987 = msg("00536:04", part1576); - - var part1577 = match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assigned%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg988 = msg("00536:05", part1577); - - var part1578 = match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has changed to %{fld2}. VPNs cannot terminate at an interface with IP %{hostip}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg989 = msg("00536:06", part1578); - - var part1579 = match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has changed from %{change_old->} to another setting", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg990 = msg("00536:07", part1579); - - var part1580 = match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification message", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg991 = msg("00536:08", part1580); - - var part1581 = match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg992 = msg("00536:09", part1581); - - var part1582 = match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a packet with a bad SPI after rebooting", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg993 = msg("00536:10", part1582); - - var part1583 = match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase 2 SAs after receiving a notification message", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg994 = msg("00536:11", part1583); - - var part1584 = match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first Phase 1 packet from an unrecognized source", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg995 = msg("00536:12", part1584); - - var part1585 = match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an initial Phase 1 packet from an unrecognized peer gateway", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg996 = msg("00536:13", part1585); - - var part1586 = match("MESSAGE#984:00536:14/0", "nwparser.payload", "IKE %{hostip}: Received initial contact notification and removed Phase %{p0}"); - - var part1587 = match("MESSAGE#984:00536:14/2", "nwparser.p0", "SAs%{}"); - - var all339 = all_match({ - processors: [ - part1586, - dup383, - part1587, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg997 = msg("00536:14", all339); - - var part1588 = match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a notification message for %{disposition}. (%{fld1})", processor_chain([ - dup44, - dup2, - dup9, - dup3, - dup4, - dup5, - ])); - - var msg998 = msg("00536:50", part1588); - - var part1589 = match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incorrect ID payload: IP address %{fld2->} instead of IP address %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg999 = msg("00536:15", part1589); - - var part1590 = match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negotiation request is already in the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1000 = msg("00536:16", part1590); - - var part1591 = match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats have been lost %{fld2->} times", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1001 = msg("00536:17", part1591); - - var part1592 = match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer packet because no policy uses the peer configuration", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1002 = msg("00536:18", part1592); - - var part1593 = match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1003 = msg("00536:19", part1593); - - var part1594 = match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the initial contact task to the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1004 = msg("00536:20", part1594); - - var part1595 = match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 session tasks to the task list", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1005 = msg("00536:21", part1595); - - var part1596 = match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{disposition->} proposals from peer. Negotiations failed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("result","Negotiations failed"), - ])); - - var msg1006 = msg("00536:22", part1596); - - var part1597 = match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Aborted negotiations because the time limit has elapsed", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("result","The time limit has elapsed"), - setc("disposition","Aborted"), - ])); - - var msg1007 = msg("00536:23", part1597); - - var part1598 = match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1008 = msg("00536:24", part1598); - - var part1599 = match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Received DH group %{fld2->} instead of expected group %{fld3->} for PFS", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1009 = msg("00536:25", part1599); - - var part1600 = match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No policy exists for the proxy ID received: local ID %{fld2->} remote ID %{fld3}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1010 = msg("00536:26", part1600); - - var part1601 = match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA private key is needed to sign packets", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1011 = msg("00536:27", part1601); - - var part1602 = match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggressive mode negotiations have %{disposition}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1012 = msg("00536:28", part1602); - - var part1603 = match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Vendor ID payload indicates that the peer does not support NAT-T", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1013 = msg("00536:29", part1603); - - var part1604 = match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Retransmission limit has been reached", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1014 = msg("00536:30", part1604); - - var part1605 = match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an invalid RSA signature", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1015 = msg("00536:31", part1605); - - var part1606 = match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an incorrect public key authentication method", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1016 = msg("00536:32", part1606); - - var part1607 = match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No private key exists to sign packets", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1017 = msg("00536:33", part1607); - - var part1608 = match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1018 = msg("00536:34", part1608); - - var part1609 = match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE initiator has detected NAT in front of the local device", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1019 = msg("00536:35", part1609); - - var part1610 = match("MESSAGE#1007:00536:36/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Discarded a second initial packet%{p0}"); - - var part1611 = match("MESSAGE#1007:00536:36/2", "nwparser.p0", "%{}which arrived within %{fld2->} after the first"); - - var all340 = all_match({ - processors: [ - part1610, - dup401, - part1611, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1020 = msg("00536:36", all340); - - var part1612 = match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Completed Aggressive mode negotiations with a %{fld2->} lifetime", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1021 = msg("00536:37", part1612); - - var part1613 = match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a subject name that does not match the ID payload", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1022 = msg("00536:38", part1613); - - var part1614 = match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a different IP address %{fld2->} than expected", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1023 = msg("00536:39", part1614); - - var part1615 = match("MESSAGE#1011:00536:40", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot use a preshared key because the peer%{quote}s gateway has a dynamic IP address and negotiations are in Main mode", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1024 = msg("00536:40", part1615); - - var part1616 = match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated negotiations in Aggressive mode", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1025 = msg("00536:47", part1616); - - var part1617 = match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot verify RSA signature", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1026 = msg("00536:41", part1617); - - var part1618 = match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated Main mode negotiations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1027 = msg("00536:42", part1618); - - var part1619 = match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Initiated negotiations", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1028 = msg("00536:43", part1619); - - var part1620 = match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heartbeat interval to %{fld2}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1029 = msg("00536:44", part1620); - - var part1621 = match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats have been %{disposition->} because %{result}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1030 = msg("00536:45", part1621); - - var part1622 = match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{interface->} from %{saddr}:%{sport->} to %{daddr}:%{dport}/%{fld1}. Cookies: %{ike_cookie1}, %{ike_cookie2}. (%{event_time_string})", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Received an IKE packet on interface"), - ])); - - var msg1031 = msg("00536:48", part1622); - - var part1623 = match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a bad SPI", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1032 = msg("00536:46", part1623); - - var select365 = linear_select([ - msg982, - msg983, - msg984, - msg985, - msg986, - msg987, - msg988, - msg989, - msg990, - msg991, - msg992, - msg993, - msg994, - msg995, - msg996, - msg997, - msg998, - msg999, - msg1000, - msg1001, - msg1002, - msg1003, - msg1004, - msg1005, - msg1006, - msg1007, - msg1008, - msg1009, - msg1010, - msg1011, - msg1012, - msg1013, - msg1014, - msg1015, - msg1016, - msg1017, - msg1018, - msg1019, - msg1020, - msg1021, - msg1022, - msg1023, - msg1024, - msg1025, - msg1026, - msg1027, - msg1028, - msg1029, - msg1030, - msg1031, - msg1032, - ]); - - var part1624 = match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to establish a session: %{info}", processor_chain([ - dup18, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg1033 = msg("00537", part1624); - - var part1625 = match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{result}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1034 = msg("00537:01", part1625); - - var part1626 = match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: %{result}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1035 = msg("00537:02", part1626); - - var part1627 = match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successfully established%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1036 = msg("00537:03", part1627); - - var select366 = linear_select([ - msg1033, - msg1034, - msg1035, - msg1036, - ]); - - var part1628 = match("MESSAGE#1024:00538/0", "nwparser.payload", "NACN failed to register to Policy Manager %{fld2->} because %{p0}"); - - var select367 = linear_select([ - dup111, - dup119, - ]); - - var part1629 = match("MESSAGE#1024:00538/2", "nwparser.p0", "%{result}"); - - var all341 = all_match({ - processors: [ - part1628, - select367, - part1629, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1037 = msg("00538", all341); - - var part1630 = match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered to Policy Manager %{fld2}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1038 = msg("00538:01", part1630); - - var part1631 = match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has started for Policy Manager %{fld2->} on hostname %{hostname->} IP address %{hostip->} port %{network_port}.", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1039 = msg("00538:02", part1631); - - var part1632 = match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server at %{hostip->} (%{fld2->} connect attempt(s)) %{fld3}", processor_chain([ - dup19, - dup2, - dup4, - dup5, - dup3, - ])); - - var msg1040 = msg("00538:03", part1632); - - var part1633 = match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Global PRO data collector at %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1041 = msg("00538:04", part1633); - - var part1634 = match("MESSAGE#1029:00538:05/0", "nwparser.payload", "Lost %{p0}"); - - var part1635 = match("MESSAGE#1029:00538:05/1_0", "nwparser.p0", "socket connection%{p0}"); - - var part1636 = match("MESSAGE#1029:00538:05/1_1", "nwparser.p0", "connection%{p0}"); - - var select368 = linear_select([ - part1635, - part1636, - ]); - - var part1637 = match("MESSAGE#1029:00538:05/2", "nwparser.p0", "%{}to Global PRO data collector at %{hostip}"); - - var all342 = all_match({ - processors: [ - part1634, - select368, - part1637, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1042 = msg("00538:05", all342); - - var part1638 = match("MESSAGE#1030:00538:06/0", "nwparser.payload", "Device has connected to the Global PRO%{p0}"); - - var part1639 = match("MESSAGE#1030:00538:06/1_0", "nwparser.p0", " %{fld2->} primary data collector at %{p0}"); - - var part1640 = match("MESSAGE#1030:00538:06/1_1", "nwparser.p0", " primary data collector at %{p0}"); - - var select369 = linear_select([ - part1639, - part1640, - ]); - - var part1641 = match_copy("MESSAGE#1030:00538:06/2", "nwparser.p0", "hostip"); - - var all343 = all_match({ - processors: [ - part1638, - select369, - part1641, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1043 = msg("00538:06", all343); - - var part1642 = match("MESSAGE#1031:00538:07/0", "nwparser.payload", "Connection to Global PRO data collector at %{hostip->} has%{p0}"); - - var part1643 = match("MESSAGE#1031:00538:07/1_0", "nwparser.p0", " been%{p0}"); - - var select370 = linear_select([ - part1643, - dup16, - ]); - - var all344 = all_match({ - processors: [ - part1642, - select370, - dup136, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1044 = msg("00538:07", all344); - - var part1644 = match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO data collector at %{hostip}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1045 = msg("00538:08", part1644); - - var part1645 = match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server at %{hostip->} (%{info}) (%{fld1})", processor_chain([ - dup301, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Connected to NSM server"), - ])); - - var msg1046 = msg("00538:09", part1645); - - var part1646 = match("MESSAGE#1034:00538:10/0", "nwparser.payload", "NSM: Connection to NSM server at %{hostip->} is down. Reason: %{resultcode}, %{result->} (%{p0}"); - - var part1647 = match("MESSAGE#1034:00538:10/1_0", "nwparser.p0", "%{info}) (%{fld1})"); - - var select371 = linear_select([ - part1647, - dup41, - ]); - - var all345 = all_match({ - processors: [ - part1646, - select371, - ], - on_success: processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Connection to NSM server is down"), - ]), - }); - - var msg1047 = msg("00538:10", all345); - - var part1648 = match("MESSAGE#1035:00538:11", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld2->} connect attempt(s)) (%{fld1})", processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - dup323, - ])); - - var msg1048 = msg("00538:11", part1648); - - var part1649 = match("MESSAGE#1036:00538:12", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld1})", processor_chain([ - dup198, - dup2, - dup3, - dup9, - dup4, - dup5, - dup323, - ])); - - var msg1049 = msg("00538:12", part1649); - - var part1650 = match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - setc("event_description","Sent 2B message"), - ])); - - var msg1050 = msg("00538:13", part1650); - - var select372 = linear_select([ - msg1037, - msg1038, - msg1039, - msg1040, - msg1041, - msg1042, - msg1043, - msg1044, - msg1045, - msg1046, - msg1047, - msg1048, - msg1049, - msg1050, - ]); - - var part1651 = match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1051 = msg("00539", part1651); - - var part1652 = match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1052 = msg("00539:01", part1652); - - var part1653 = match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from Pool %{group_object->} for user %{username}", processor_chain([ - dup117, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1053 = msg("00539:02", part1653); - - var part1654 = match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to establish a session: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1054 = msg("00539:03", part1654); - - var part1655 = match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has successfully established.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1055 = msg("00539:04", part1655); - - var part1656 = match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned. You cannot allocate an IP address%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1056 = msg("00539:05", part1656); - - var part1657 = match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1057 = msg("00539:06", part1657); - - var select373 = linear_select([ - msg1051, - msg1052, - msg1053, - msg1054, - msg1055, - msg1056, - msg1057, - ]); - - var part1658 = match("MESSAGE#1045:00541", "nwparser.payload", "ScreenOS %{fld2->} serial # %{serial_number}: Asset recovery has been %{disposition}", processor_chain([ - dup324, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1058 = msg("00541", part1658); - - var part1659 = match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2->} IP address - %{hostip->} changed its state to %{change_new}. (%{fld1})", processor_chain([ - dup273, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1059 = msg("00541:01", part1659); - - var part1660 = match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from %{change_old->} to %{change_new->} state, (neighbor router-id 1%{fld2}, ip-address %{hostip}). (%{fld1})", processor_chain([ - dup273, - dup9, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1060 = msg("00541:02", part1660); - - var part1661 = match("MESSAGE#1219:00541:03/0", "nwparser.payload", "LSA in following area aged out: LSA area ID %{fld3}, LSA ID %{fld4}, router ID %{fld2}, type %{fld7->} in OSPF. (%{fld1})%{p0}"); - - var part1662 = match("MESSAGE#1219:00541:03/1_0", "nwparser.p0", "\u003c\u003c%{fld16}>"); - - var select374 = linear_select([ - part1662, - dup21, - ]); - - var all346 = all_match({ - processors: [ - part1661, - select374, - ], - on_success: processor_chain([ - dup44, - dup9, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1061 = msg("00541:03", all346); - - var select375 = linear_select([ - msg1058, - msg1059, - msg1060, - msg1061, - ]); - - var part1663 = match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix adding: %{fld2}, ribin overflow %{fld3->} times (max rib-in %{fld4})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1062 = msg("00542", part1663); - - var part1664 = match("MESSAGE#1047:00543/0", "nwparser.payload", "Access for %{p0}"); - - var part1665 = match("MESSAGE#1047:00543/1_0", "nwparser.p0", "WebAuth firewall %{p0}"); - - var part1666 = match("MESSAGE#1047:00543/1_1", "nwparser.p0", "firewall %{p0}"); - - var select376 = linear_select([ - part1665, - part1666, - ]); - - var part1667 = match("MESSAGE#1047:00543/2", "nwparser.p0", "user %{username->} %{space}at %{hostip->} (accepted at %{fld2->} for duration %{duration->} via the %{logon_type}) %{p0}"); - - var part1668 = match("MESSAGE#1047:00543/3_0", "nwparser.p0", "by policy id %{policy_id->} is %{p0}"); - - var select377 = linear_select([ - part1668, - dup106, - ]); - - var part1669 = match("MESSAGE#1047:00543/4", "nwparser.p0", "now over (%{fld1})"); - - var all347 = all_match({ - processors: [ - part1664, - select376, - part1667, - select377, - part1669, - ], - on_success: processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup9, - dup3, - ]), - }); - - var msg1063 = msg("00543", all347); - - var part1670 = match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group %{group->} ] at %{hostip->} has been challenged by the RADIUS server at %{daddr}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup3, - dup60, - setc("action","RADIUS server challenge"), - ])); - - var msg1064 = msg("00544", part1670); - - var part1671 = match("MESSAGE#1049:00546", "nwparser.payload", "delete-route-> trust-vr: %{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1065 = msg("00546", part1671); - - var part1672 = match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned because max content size was exceeded.", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg1066 = msg("00547", part1672); - - var part1673 = match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned due to a scan engine error or constraint.", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup3, - dup61, - ])); - - var msg1067 = msg("00547:01", part1673); - - var part1674 = match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has been %{disposition}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1068 = msg("00547:02", part1674); - - var part1675 = match("MESSAGE#1053:00547:03/0", "nwparser.payload", "AV: Content from %{location_desc}, http url: %{url}, is passed %{p0}"); - - var part1676 = match("MESSAGE#1053:00547:03/1_0", "nwparser.p0", "due to %{p0}"); - - var part1677 = match("MESSAGE#1053:00547:03/1_1", "nwparser.p0", "because %{p0}"); - - var select378 = linear_select([ - part1676, - part1677, - ]); - - var part1678 = match("MESSAGE#1053:00547:03/2", "nwparser.p0", "%{result}. (%{event_time_string})"); - - var all348 = all_match({ - processors: [ - part1675, - select378, - part1678, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - setc("event_description","Content is bypassed for connection"), - ]), - }); - - var msg1069 = msg("00547:03", all348); - - var select379 = linear_select([ - msg1066, - msg1067, - msg1068, - msg1069, - ]); - - var part1679 = match("MESSAGE#1054:00549", "nwparser.payload", "add-route-> untrust-vr: %{fld2}", processor_chain([ - dup281, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1070 = msg("00549", part1679); - - var part1680 = match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred during configlet file processing.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1071 = msg("00551", part1680); - - var part1681 = match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurred, causing failure to establish secure management with Management System.", processor_chain([ - dup86, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1072 = msg("00551:01", part1681); - - var part1682 = match("MESSAGE#1057:00551:02/0", "nwparser.payload", "Configlet file %{p0}"); - - var part1683 = match("MESSAGE#1057:00551:02/1_0", "nwparser.p0", "decryption %{p0}"); - - var select380 = linear_select([ - part1683, - dup89, - ]); - - var all349 = all_match({ - processors: [ - part1682, - select380, - dup128, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1073 = msg("00551:02", all349); - - var part1684 = match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot start because gateway has undergone configuration changes. (%{fld1})", processor_chain([ - dup18, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1074 = msg("00551:03", part1684); - - var part1685 = match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management established successfully with remote server. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1075 = msg("00551:04", part1685); - - var select381 = linear_select([ - msg1071, - msg1072, - msg1073, - msg1074, - msg1075, - ]); - - var part1686 = match("MESSAGE#1060:00553/0", "nwparser.payload", "SCAN-MGR: Failed to get %{p0}"); - - var part1687 = match("MESSAGE#1060:00553/1_0", "nwparser.p0", "AltServer %{p0}"); - - var part1688 = match("MESSAGE#1060:00553/1_1", "nwparser.p0", "Version %{p0}"); - - var part1689 = match("MESSAGE#1060:00553/1_2", "nwparser.p0", "Path_GateLockCE %{p0}"); - - var select382 = linear_select([ - part1687, - part1688, - part1689, - ]); - - var all350 = all_match({ - processors: [ - part1686, - select382, - dup325, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1076 = msg("00553", all350); - - var part1690 = match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size from server.ini.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1077 = msg("00553:01", part1690); - - var part1691 = match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from server.ini is too large: %{bytes->} (bytes).", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1078 = msg("00553:02", part1691); - - var part1692 = match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from server.ini is too long: %{fld2}; max is %{fld3}.", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1079 = msg("00553:03", part1692); - - var part1693 = match("MESSAGE#1064:00553:04/0", "nwparser.payload", "SCAN-MGR: Failed to retrieve %{p0}"); - - var select383 = linear_select([ - dup326, - dup327, - ]); - - var part1694 = match("MESSAGE#1064:00553:04/2", "nwparser.p0", "file: %{fld2}; http status code: %{resultcode}."); - - var all351 = all_match({ - processors: [ - part1693, - select383, - part1694, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1080 = msg("00553:04", all351); - - var part1695 = match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pattern into a RAM file.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1081 = msg("00553:05", part1695); - - var part1696 = match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File failed: code from VSAPI: %{resultcode}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1082 = msg("00553:06", part1696); - - var part1697 = match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pattern into flash.%{}", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1083 = msg("00553:07", part1697); - - var part1698 = match("MESSAGE#1068:00553:08/0", "nwparser.payload", "SCAN-MGR: Internal error while setting up for retrieving %{p0}"); - - var select384 = linear_select([ - dup327, - dup326, - ]); - - var all352 = all_match({ - processors: [ - part1698, - select384, - dup328, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1084 = msg("00553:08", all352); - - var part1699 = match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{disposition}: Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1085 = msg("00553:09", part1699); - - var part1700 = match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{disposition->} due to %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1086 = msg("00553:10", part1700); - - var part1701 = match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern Creation Date(%{fld2}) is after AV Key Expiration date(%{fld3}).", processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1087 = msg("00553:11", part1701); - - var part1702 = match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompressLayer %{disposition}: Layer: %{fld2}, Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1088 = msg("00553:12", part1702); - - var part1703 = match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFileSizeLimit %{disposition}: Limit: %{fld2}, Err: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1089 = msg("00553:13", part1703); - - var part1704 = match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{disposition}: ret: %{fld2}; cpapiErrCode: %{resultcode}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1090 = msg("00553:14", part1704); - - var part1705 = match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usage error. Left usage: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1091 = msg("00553:15", part1705); - - var part1706 = match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress layer to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1092 = msg("00553:16", part1706); - - var part1707 = match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum content size to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1093 = msg("00553:17", part1707); - - var part1708 = match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number of concurrent messages to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1094 = msg("00553:18", part1708); - - var part1709 = match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1095 = msg("00553:19", part1709); - - var part1710 = match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to %{fld2}; update interval is %{fld3}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1096 = msg("00553:20", part1710); - - var part1711 = match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1097 = msg("00553:21", part1711); - - var part1712 = match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern updated: version: %{version}, size: %{bytes->} (bytes).", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1098 = msg("00553:22", part1712); - - var select385 = linear_select([ - msg1076, - msg1077, - msg1078, - msg1079, - msg1080, - msg1081, - msg1082, - msg1083, - msg1084, - msg1085, - msg1086, - msg1087, - msg1088, - msg1089, - msg1090, - msg1091, - msg1092, - msg1093, - msg1094, - msg1095, - msg1096, - msg1097, - msg1098, - ]); - - var part1713 = match("MESSAGE#1083:00554/0", "nwparser.payload", "SCAN-MGR: Cannot get %{p0}"); - - var part1714 = match("MESSAGE#1083:00554/1_0", "nwparser.p0", "AltServer info %{p0}"); - - var part1715 = match("MESSAGE#1083:00554/1_1", "nwparser.p0", "Version number %{p0}"); - - var part1716 = match("MESSAGE#1083:00554/1_2", "nwparser.p0", "Path_GateLockCE info %{p0}"); - - var select386 = linear_select([ - part1714, - part1715, - part1716, - ]); - - var all353 = all_match({ - processors: [ - part1713, - select386, - dup325, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1099 = msg("00554", all353); - - var part1717 = match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini file, the AV pattern file size is zero.%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1100 = msg("00554:01", part1717); - - var part1718 = match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file size is too large (%{bytes->} bytes).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1101 = msg("00554:02", part1718); - - var part1719 = match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV pattern file server URL is too long: %{bytes->} bytes. Max: %{fld2->} bytes.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1102 = msg("00554:03", part1719); - - var part1720 = match("MESSAGE#1087:00554:04/0", "nwparser.payload", "SCAN-MGR: Cannot retrieve %{p0}"); - - var part1721 = match("MESSAGE#1087:00554:04/2", "nwparser.p0", "file from %{hostip}:%{network_port}. HTTP status code: %{fld2}."); - - var all354 = all_match({ - processors: [ - part1720, - dup405, - part1721, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1103 = msg("00554:04", all354); - - var part1722 = match("MESSAGE#1088:00554:05/0", "nwparser.payload", "SCAN-MGR: Cannot write AV pattern file to %{p0}"); - - var part1723 = match("MESSAGE#1088:00554:05/1_0", "nwparser.p0", "RAM %{p0}"); - - var part1724 = match("MESSAGE#1088:00554:05/1_1", "nwparser.p0", "flash %{p0}"); - - var select387 = linear_select([ - part1723, - part1724, - ]); - - var all355 = all_match({ - processors: [ - part1722, - select387, - dup116, - ], - on_success: processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1104 = msg("00554:05", all355); - - var part1725 = match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pattern file. VSAPI code: %{fld2}", processor_chain([ - dup144, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1105 = msg("00554:06", part1725); - - var part1726 = match("MESSAGE#1090:00554:07/0", "nwparser.payload", "SCAN-MGR: Internal error occurred while retrieving %{p0}"); - - var all356 = all_match({ - processors: [ - part1726, - dup405, - dup328, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1106 = msg("00554:07", all356); - - var part1727 = match("MESSAGE#1091:00554:08/0", "nwparser.payload", "SCAN-MGR: Internal error occurred when calling this function: %{fld2}. %{fld3->} %{p0}"); - - var part1728 = match("MESSAGE#1091:00554:08/1_0", "nwparser.p0", "Error: %{resultcode->} %{p0}"); - - var part1729 = match("MESSAGE#1091:00554:08/1_1", "nwparser.p0", "Returned a NULL VSC handler %{p0}"); - - var part1730 = match("MESSAGE#1091:00554:08/1_2", "nwparser.p0", "cpapiErrCode: %{resultcode->} %{p0}"); - - var select388 = linear_select([ - part1728, - part1729, - part1730, - ]); - - var all357 = all_match({ - processors: [ - part1727, - select388, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1107 = msg("00554:08", all357); - - var part1731 = match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompression layers has been set to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1108 = msg("00554:09", part1731); - - var part1732 = match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content size has been set to %{fld2->} KB.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1109 = msg("00554:10", part1732); - - var part1733 = match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of concurrent messages has been set to %{fld2}.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1110 = msg("00554:11", part1733); - - var part1734 = match("MESSAGE#1095:00554:12/0", "nwparser.payload", "SCAN-MGR: Fail mode has been set to %{p0}"); - - var part1735 = match("MESSAGE#1095:00554:12/1_0", "nwparser.p0", "drop %{p0}"); - - var part1736 = match("MESSAGE#1095:00554:12/1_1", "nwparser.p0", "pass %{p0}"); - - var select389 = linear_select([ - part1735, - part1736, - ]); - - var part1737 = match("MESSAGE#1095:00554:12/2", "nwparser.p0", "unexamined traffic if %{p0}"); - - var part1738 = match("MESSAGE#1095:00554:12/3_0", "nwparser.p0", "content size %{p0}"); - - var part1739 = match("MESSAGE#1095:00554:12/3_1", "nwparser.p0", "number of concurrent messages %{p0}"); - - var select390 = linear_select([ - part1738, - part1739, - ]); - - var part1740 = match("MESSAGE#1095:00554:12/4", "nwparser.p0", "exceeds max.%{}"); - - var all358 = all_match({ - processors: [ - part1734, - select389, - part1737, - select390, - part1740, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1111 = msg("00554:12", all358); - - var part1741 = match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been set to %{fld2}, and the update interval to %{fld3->} minutes.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1112 = msg("00554:13", part1741); - - var part1742 = match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1113 = msg("00554:14", part1742); - - var part1743 = match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern file has been updated. Version: %{version}; size: %{bytes->} bytes.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1114 = msg("00554:15", part1743); - - var part1744 = match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: %{fld2}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1115 = msg("00554:16", part1744); - - var part1745 = match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load AV pattern file created %{fld2->} after the AV subscription expired. (Exp: %{fld3})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1116 = msg("00554:17", part1745); - - var select391 = linear_select([ - msg1099, - msg1100, - msg1101, - msg1102, - msg1103, - msg1104, - msg1105, - msg1106, - msg1107, - msg1108, - msg1109, - msg1110, - msg1111, - msg1112, - msg1113, - msg1114, - msg1115, - msg1116, - ]); - - var part1746 = match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot process non-multicast address %{hostip}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1117 = msg("00555", part1746); - - var part1747 = match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a request. Reason: %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1118 = msg("00556", part1747); - - var part1748 = match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a transaction. Reason: %{result}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1119 = msg("00556:01", part1748); - - var part1749 = match("MESSAGE#1104:00556:02/0", "nwparser.payload", "UF-MGR: UF %{p0}"); - - var part1750 = match("MESSAGE#1104:00556:02/1_0", "nwparser.p0", "K%{p0}"); - - var part1751 = match("MESSAGE#1104:00556:02/1_1", "nwparser.p0", "k%{p0}"); - - var select392 = linear_select([ - part1750, - part1751, - ]); - - var part1752 = match("MESSAGE#1104:00556:02/2", "nwparser.p0", "ey %{p0}"); - - var part1753 = match("MESSAGE#1104:00556:02/3_0", "nwparser.p0", "Expired%{p0}"); - - var part1754 = match("MESSAGE#1104:00556:02/3_1", "nwparser.p0", "expired%{p0}"); - - var select393 = linear_select([ - part1753, - part1754, - ]); - - var part1755 = match("MESSAGE#1104:00556:02/4", "nwparser.p0", "%{}(expiration date: %{fld2}; current date: %{fld3})."); - - var all359 = all_match({ - processors: [ - part1749, - select392, - part1752, - select393, - part1755, - ], - on_success: processor_chain([ - dup254, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1120 = msg("00556:02", all359); - - var part1756 = match("MESSAGE#1105:00556:03/0", "nwparser.payload", "UF-MGR: Failed to %{p0}"); - - var part1757 = match("MESSAGE#1105:00556:03/1_0", "nwparser.p0", "enable %{p0}"); - - var part1758 = match("MESSAGE#1105:00556:03/1_1", "nwparser.p0", "disable %{p0}"); - - var select394 = linear_select([ - part1757, - part1758, - ]); - - var part1759 = match("MESSAGE#1105:00556:03/2", "nwparser.p0", "cache.%{}"); - - var all360 = all_match({ - processors: [ - part1756, - select394, - part1759, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1121 = msg("00556:03", all360); - - var part1760 = match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{resultcode}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1122 = msg("00556:04", part1760); - - var part1761 = match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed to %{fld2}(K).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1123 = msg("00556:05", part1761); - - var part1762 = match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout changes to %{fld2->} (hours).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1124 = msg("00556:06", part1762); - - var part1763 = match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update interval changed to %{fld2->} (weeks).", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1125 = msg("00556:07", part1763); - - var part1764 = match("MESSAGE#1110:00556:08/0", "nwparser.payload", "UF-MGR: Cache %{p0}"); - - var all361 = all_match({ - processors: [ - part1764, - dup358, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1126 = msg("00556:08", all361); - - var part1765 = match("MESSAGE#1111:00556:09", "nwparser.payload", "UF-MGR: URL BLOCKED: ip_addr (%{fld2}) -> ip_addr (%{fld3}), %{fld4->} action: %{disposition}, category: %{fld5}, reason %{result}", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - dup282, - ])); - - var msg1127 = msg("00556:09", part1765); - - var part1766 = match("MESSAGE#1112:00556:10", "nwparser.payload", "UF-MGR: URL FILTER ERR: ip_addr (%{fld2}) -> ip_addr (%{fld3}), host: %{fld5->} page: %{fld4->} code: %{resultcode->} reason: %{result}.", processor_chain([ - dup232, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1128 = msg("00556:10", part1766); - - var part1767 = match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server changed to %{fld2}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1129 = msg("00556:11", part1767); - - var part1768 = match("MESSAGE#1114:00556:12/0", "nwparser.payload", "UF-MGR: %{fld2->} CPA server %{p0}"); - - var select395 = linear_select([ - dup140, - dup169, - ]); - - var part1769 = match("MESSAGE#1114:00556:12/2", "nwparser.p0", "changed to %{fld3}."); - - var all362 = all_match({ - processors: [ - part1768, - select395, - part1769, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1130 = msg("00556:12", all362); - - var part1770 = match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filtering %{disposition}.", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1131 = msg("00556:13", part1770); - - var part1771 = match("MESSAGE#1116:00556:14/0", "nwparser.payload", "UF-MGR: The url %{url->} was %{p0}"); - - var part1772 = match("MESSAGE#1116:00556:14/2", "nwparser.p0", "category %{fld2}."); - - var all363 = all_match({ - processors: [ - part1771, - dup406, - part1772, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1132 = msg("00556:14", all363); - - var part1773 = match("MESSAGE#1117:00556:15/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was %{p0}"); - - var part1774 = match("MESSAGE#1117:00556:15/2", "nwparser.p0", "profile %{fld3->} with action %{disposition}."); - - var all364 = all_match({ - processors: [ - part1773, - dup406, - part1774, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - dup282, - ]), - }); - - var msg1133 = msg("00556:15", all364); - - var part1775 = match("MESSAGE#1118:00556:16/0", "nwparser.payload", "UF-MGR: The %{p0}"); - - var part1776 = match("MESSAGE#1118:00556:16/1_0", "nwparser.p0", "profile %{p0}"); - - var part1777 = match("MESSAGE#1118:00556:16/1_1", "nwparser.p0", "category %{p0}"); - - var select396 = linear_select([ - part1776, - part1777, - ]); - - var part1778 = match("MESSAGE#1118:00556:16/2", "nwparser.p0", "%{fld2->} was %{p0}"); - - var select397 = linear_select([ - dup104, - dup120, - ]); - - var all365 = all_match({ - processors: [ - part1775, - select396, - part1778, - select397, - dup116, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1134 = msg("00556:16", all365); - - var part1779 = match("MESSAGE#1119:00556:17/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was set in profile %{profile->} as the %{p0}"); - - var part1780 = match("MESSAGE#1119:00556:17/1_0", "nwparser.p0", "black %{p0}"); - - var part1781 = match("MESSAGE#1119:00556:17/1_1", "nwparser.p0", "white %{p0}"); - - var select398 = linear_select([ - part1780, - part1781, - ]); - - var part1782 = match("MESSAGE#1119:00556:17/2", "nwparser.p0", "list.%{}"); - - var all366 = all_match({ - processors: [ - part1779, - select398, - part1782, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1135 = msg("00556:17", all366); - - var part1783 = match("MESSAGE#1120:00556:18/0", "nwparser.payload", "UF-MGR: The action for %{fld2->} in profile %{profile->} was %{p0}"); - - var part1784 = match("MESSAGE#1120:00556:18/1_1", "nwparser.p0", "changed %{p0}"); - - var select399 = linear_select([ - dup101, - part1784, - ]); - - var part1785 = match("MESSAGE#1120:00556:18/2", "nwparser.p0", "to %{fld3}."); - - var all367 = all_match({ - processors: [ - part1783, - select399, - part1785, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1136 = msg("00556:18", all367); - - var part1786 = match("MESSAGE#1121:00556:20/0", "nwparser.payload", "UF-MGR: The category list from the CPA server %{p0}"); - - var part1787 = match("MESSAGE#1121:00556:20/2", "nwparser.p0", "updated on%{p0}"); - - var select400 = linear_select([ - dup103, - dup96, - ]); - - var part1788 = match("MESSAGE#1121:00556:20/4", "nwparser.p0", "the device.%{}"); - - var all368 = all_match({ - processors: [ - part1786, - dup355, - part1787, - select400, - part1788, - ], - on_success: processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1137 = msg("00556:20", all368); - - var part1789 = match("MESSAGE#1122:00556:21", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} action: %{disposition}, category: %{category}, reason: %{result->} (%{fld1})", processor_chain([ - dup232, - dup2, - dup3, - dup9, - dup4, - dup5, - dup282, - ])); - - var msg1138 = msg("00556:21", part1789); - - var part1790 = match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} (%{fld1})", processor_chain([ - dup232, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1139 = msg("00556:22", part1790); - - var select401 = linear_select([ - msg1118, - msg1119, - msg1120, - msg1121, - msg1122, - msg1123, - msg1124, - msg1125, - msg1126, - msg1127, - msg1128, - msg1129, - msg1130, - msg1131, - msg1132, - msg1133, - msg1134, - msg1135, - msg1136, - msg1137, - msg1138, - msg1139, - ]); - - var part1791 = match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interface->} is %{fld2}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1140 = msg("00572", part1791); - - var part1792 = match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on interface %{interface}: %{result}. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1141 = msg("00572:01", part1792); - - var part1793 = match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface->} is %{disposition->} by receiving Terminate-Request. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1142 = msg("00572:03", part1793); - - var select402 = linear_select([ - msg1140, - msg1141, - msg1142, - ]); - - var part1794 = match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" rebuilding lookup tree for virtual router \"%{node}\". (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1143 = msg("00615", part1794); - - var part1795 = match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" lookup tree rebuilt successfully in virtual router \"%{node}\". (%{fld1})", processor_chain([ - dup44, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1144 = msg("00615:01", part1795); - - var select403 = linear_select([ - msg1143, - msg1144, - ]); - - var part1796 = match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}, through policy %{policyname}. Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ])); - - var msg1145 = msg("00601", part1796); - - var part1797 = match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detected from %{saddr}/%{sport->} to %{daddr}/%{dport->} through policy %{policyname->} %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup9, - dup4, - dup5, - dup61, - ])); - - var msg1146 = msg("00601:01", part1797); - - var part1798 = match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multicast.%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1147 = msg("00601:18", part1798); - - var select404 = linear_select([ - msg1145, - msg1146, - msg1147, - ]); - - var part1799 = match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing interface state change%{}", processor_chain([ - dup19, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1148 = msg("00602", part1799); - - var part1800 = match("MESSAGE#1133:00612/0", "nwparser.payload", "Switch event: the status of ethernet port %{fld2->} changed to link %{p0}"); - - var part1801 = match("MESSAGE#1133:00612/2", "nwparser.p0", ", duplex %{p0}"); - - var part1802 = match("MESSAGE#1133:00612/3_0", "nwparser.p0", "full %{p0}"); - - var part1803 = match("MESSAGE#1133:00612/3_1", "nwparser.p0", "half %{p0}"); - - var select405 = linear_select([ - part1802, - part1803, - ]); - - var part1804 = match("MESSAGE#1133:00612/4", "nwparser.p0", ", speed 10%{p0}"); - - var part1805 = match("MESSAGE#1133:00612/5_0", "nwparser.p0", "0 %{p0}"); - - var select406 = linear_select([ - part1805, - dup96, - ]); - - var part1806 = match("MESSAGE#1133:00612/6", "nwparser.p0", "M. (%{fld1})"); - - var all369 = all_match({ - processors: [ - part1800, - dup353, - part1801, - select405, - part1804, - select406, - part1806, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1149 = msg("00612", all369); - - var part1807 = match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send all the DRP routes to backup device. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1150 = msg("00620", part1807); - - var part1808 = match("MESSAGE#1135:00620:01/0", "nwparser.payload", "RTSYNC: %{p0}"); - - var part1809 = match("MESSAGE#1135:00620:01/1_0", "nwparser.p0", "Serviced%{p0}"); - - var part1810 = match("MESSAGE#1135:00620:01/1_1", "nwparser.p0", "Recieved%{p0}"); - - var select407 = linear_select([ - part1809, - part1810, - ]); - - var part1811 = match("MESSAGE#1135:00620:01/2", "nwparser.p0", "%{}coldstart request for route synchronization from NSRP peer. (%{fld1})"); - - var all370 = all_match({ - processors: [ - part1808, - select407, - part1811, - ], - on_success: processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1151 = msg("00620:01", all370); - - var part1812 = match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to purge all the DRP backup routes - %{fld2->} (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1152 = msg("00620:02", part1812); - - var part1813 = match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purge backup routes in all vrouters. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1153 = msg("00620:03", part1813); - - var part1814 = match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the DRP backup routes is stopped. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1154 = msg("00620:04", part1814); - - var select408 = linear_select([ - msg1150, - msg1151, - msg1152, - msg1153, - msg1154, - ]); - - var part1815 = match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual router %{node->} is created. (%{fld1})", processor_chain([ - dup273, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1155 = msg("00622", part1815); - - var part1816 = match("MESSAGE#1140:00625/0", "nwparser.payload", "Session (id %{sessionid->} src-ip %{saddr->} dst-ip %{daddr->} dst port %{dport}) route is %{p0}"); - - var part1817 = match("MESSAGE#1140:00625/1_0", "nwparser.p0", "invalid%{p0}"); - - var part1818 = match("MESSAGE#1140:00625/1_1", "nwparser.p0", "valid%{p0}"); - - var select409 = linear_select([ - part1817, - part1818, - ]); - - var all371 = all_match({ - processors: [ - part1816, - select409, - dup49, - ], - on_success: processor_chain([ - dup273, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1156 = msg("00625", all371); - - var part1819 = match("MESSAGE#1141:00628/0", "nwparser.payload", "audit log queue %{p0}"); - - var part1820 = match("MESSAGE#1141:00628/1_0", "nwparser.p0", "Traffic Log %{p0}"); - - var part1821 = match("MESSAGE#1141:00628/1_1", "nwparser.p0", "Event Alarm Log %{p0}"); - - var part1822 = match("MESSAGE#1141:00628/1_2", "nwparser.p0", "Event Log %{p0}"); - - var select410 = linear_select([ - part1820, - part1821, - part1822, - ]); - - var part1823 = match("MESSAGE#1141:00628/2", "nwparser.p0", "is overwritten (%{fld1})"); - - var all372 = all_match({ - processors: [ - part1819, - select410, - part1823, - ], - on_success: processor_chain([ - dup223, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1157 = msg("00628", all372); - - var part1824 = match("MESSAGE#1142:00767:50", "nwparser.payload", "Log setting was modified to %{disposition->} %{fld2->} level by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - dup282, - ])); - - var msg1158 = msg("00767:50", part1824); - - var part1825 = match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1159 = msg("00767:51", part1825); - - var part1826 = match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1160 = msg("00767:52", part1826); - - var part1827 = match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is added to attack group %{group->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup58, - dup2, - dup4, - dup5, - dup9, - ])); - - var msg1161 = msg("00767:53", part1827); - - var part1828 = match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID server%{}", processor_chain([ - dup27, - setc("ec_theme","Communication"), - dup39, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1162 = msg("00767", part1828); - - var part1829 = match("MESSAGE#1147:00767:01/0", "nwparser.payload", "System auto-config of file %{fld2->} from TFTP server %{hostip->} has %{p0}"); - - var part1830 = match("MESSAGE#1147:00767:01/1_0", "nwparser.p0", "been loaded successfully%{}"); - - var part1831 = match("MESSAGE#1147:00767:01/1_1", "nwparser.p0", "failed%{}"); - - var select411 = linear_select([ - part1830, - part1831, - ]); - - var all373 = all_match({ - processors: [ - part1829, - select411, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1163 = msg("00767:01", all373); - - var part1832 = match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config saved from host %{saddr}", processor_chain([ - setc("eventcategory","1702000000"), - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1164 = msg("00767:02", part1832); - - var part1833 = match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filename %{filename}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1165 = msg("00767:03", part1833); - - var part1834 = match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1166 = msg("00767:04", part1834); - - var part1835 = match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact the SecurID server%{}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1167 = msg("00767:05", part1835); - - var part1836 = match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data to the SecurID server%{}", processor_chain([ - dup27, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1168 = msg("00767:06", part1836); - - var part1837 = match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was saved from peer unit by admin%{}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1169 = msg("00767:07", part1837); - - var part1838 = match("MESSAGE#1154:00767:08/0", "nwparser.payload", "The system configuration was saved by admin %{p0}"); - - var all374 = all_match({ - processors: [ - part1838, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1170 = msg("00767:08", all374); - - var part1839 = match("MESSAGE#1155:00767:09/0", "nwparser.payload", "traffic shaping is turned O%{p0}"); - - var part1840 = match("MESSAGE#1155:00767:09/1_0", "nwparser.p0", "N%{}"); - - var part1841 = match("MESSAGE#1155:00767:09/1_1", "nwparser.p0", "FF%{}"); - - var select412 = linear_select([ - part1840, - part1841, - ]); - - var all375 = all_match({ - processors: [ - part1839, - select412, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1171 = msg("00767:09", all375); - - var part1842 = match("MESSAGE#1156:00767:10/0", "nwparser.payload", "The system configuration was saved from host %{saddr->} by admin %{p0}"); - - var all376 = all_match({ - processors: [ - part1842, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1172 = msg("00767:10", all376); - - var part1843 = match("MESSAGE#1157:00767:11/0", "nwparser.payload", "Fatal error. The NetScreen device was unable to upgrade the %{p0}"); - - var part1844 = match("MESSAGE#1157:00767:11/1_1", "nwparser.p0", "file system %{p0}"); - - var select413 = linear_select([ - dup331, - part1844, - ]); - - var part1845 = match("MESSAGE#1157:00767:11/2", "nwparser.p0", ", and the %{p0}"); - - var part1846 = match("MESSAGE#1157:00767:11/3_1", "nwparser.p0", "old file system %{p0}"); - - var select414 = linear_select([ - dup331, - part1846, - ]); - - var part1847 = match("MESSAGE#1157:00767:11/4", "nwparser.p0", "is damaged.%{}"); - - var all377 = all_match({ - processors: [ - part1843, - select413, - part1845, - select414, - part1847, - ], - on_success: processor_chain([ - dup18, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1173 = msg("00767:11", all377); - - var part1848 = match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1174 = msg("00767:12", part1848); - - var part1849 = match("MESSAGE#1159:00767:13/0", "nwparser.payload", "%{fld2}Environment variable %{fld3->} is changed to %{fld4->} by admin %{p0}"); - - var all378 = all_match({ - processors: [ - part1849, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1175 = msg("00767:13", all378); - - var part1850 = match("MESSAGE#1160:00767:14/0", "nwparser.payload", "System was %{p0}"); - - var part1851 = match("MESSAGE#1160:00767:14/1_0", "nwparser.p0", "reset %{p0}"); - - var select415 = linear_select([ - part1851, - dup262, - ]); - - var part1852 = match("MESSAGE#1160:00767:14/2", "nwparser.p0", "at %{fld2->} by %{p0}"); - - var part1853 = match("MESSAGE#1160:00767:14/3_0", "nwparser.p0", "admin %{administrator}"); - - var part1854 = match_copy("MESSAGE#1160:00767:14/3_1", "nwparser.p0", "username"); - - var select416 = linear_select([ - part1853, - part1854, - ]); - - var all379 = all_match({ - processors: [ - part1850, - select415, - part1852, - select416, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1176 = msg("00767:14", all379); - - var part1855 = match("MESSAGE#1161:00767:15/1_0", "nwparser.p0", "System %{p0}"); - - var part1856 = match("MESSAGE#1161:00767:15/1_1", "nwparser.p0", "Event %{p0}"); - - var part1857 = match("MESSAGE#1161:00767:15/1_2", "nwparser.p0", "Traffic %{p0}"); - - var select417 = linear_select([ - part1855, - part1856, - part1857, - ]); - - var part1858 = match("MESSAGE#1161:00767:15/2", "nwparser.p0", "log was reviewed by %{p0}"); - - var part1859 = match("MESSAGE#1161:00767:15/4", "nwparser.p0", "%{} %{username}."); - - var all380 = all_match({ - processors: [ - dup183, - select417, - part1858, - dup336, - part1859, - ], - on_success: processor_chain([ - dup223, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1177 = msg("00767:15", all380); - - var part1860 = match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administrator->} issued command %{info->} to redirect output.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1178 = msg("00767:16", part1860); - - var part1861 = match("MESSAGE#1163:00767:17/0", "nwparser.payload", "%{fld2->} Save new software from %{fld3->} to flash by admin %{p0}"); - - var all381 = all_match({ - processors: [ - part1861, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1179 = msg("00767:17", all381); - - var part1862 = match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{version->} has been %{fld2->} saved to flash.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1180 = msg("00767:18", part1862); - - var part1863 = match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{version->} was rejected because the authentication check failed.", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1181 = msg("00767:19", part1863); - - var part1864 = match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version of the RADIUS server %{hostname->} does not match %{fld2}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1182 = msg("00767:20", part1864); - - var part1865 = match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, %{fld4}) cleared %{fld5}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1183 = msg("00767:21", part1865); - - var part1866 = match("MESSAGE#1168:00767:22/0", "nwparser.payload", "The system configuration was not saved %{p0}"); - - var part1867 = match("MESSAGE#1168:00767:22/1_0", "nwparser.p0", "%{fld2->} by admin %{administrator->} via NSRP Peer %{p0}"); - - var part1868 = match("MESSAGE#1168:00767:22/1_1", "nwparser.p0", "%{fld2->} %{p0}"); - - var select418 = linear_select([ - part1867, - part1868, - ]); - - var part1869 = match("MESSAGE#1168:00767:22/2", "nwparser.p0", "by administrator %{fld3}. %{p0}"); - - var part1870 = match("MESSAGE#1168:00767:22/3_0", "nwparser.p0", "It was locked %{p0}"); - - var part1871 = match("MESSAGE#1168:00767:22/3_1", "nwparser.p0", "Locked %{p0}"); - - var select419 = linear_select([ - part1870, - part1871, - ]); - - var part1872 = match("MESSAGE#1168:00767:22/4", "nwparser.p0", "by administrator %{fld4->} %{p0}"); - - var all382 = all_match({ - processors: [ - part1866, - select418, - part1869, - select419, - part1872, - dup354, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1184 = msg("00767:22", all382); - - var part1873 = match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot filename %{filename->} to flash memory by administrator %{administrator}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var msg1185 = msg("00767:23", part1873); - - var part1874 = match("MESSAGE#1170:00767:25/0", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from %{p0}"); - - var select420 = linear_select([ - dup169, - dup16, - ]); - - var part1875 = match("MESSAGE#1170:00767:25/3_0", "nwparser.p0", "%{saddr}:%{sport->} by %{p0}"); - - var part1876 = match("MESSAGE#1170:00767:25/3_1", "nwparser.p0", "%{saddr->} by %{p0}"); - - var select421 = linear_select([ - part1875, - part1876, - ]); - - var all383 = all_match({ - processors: [ - part1874, - select420, - dup23, - select421, - dup108, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var msg1186 = msg("00767:25", all383); - - var part1877 = match("MESSAGE#1171:00767:26/0", "nwparser.payload", "Lock configuration %{p0}"); - - var part1878 = match("MESSAGE#1171:00767:26/1_0", "nwparser.p0", "started%{p0}"); - - var part1879 = match("MESSAGE#1171:00767:26/1_1", "nwparser.p0", "ended%{p0}"); - - var select422 = linear_select([ - part1878, - part1879, - ]); - - var part1880 = match("MESSAGE#1171:00767:26/2", "nwparser.p0", "%{}by task %{p0}"); - - var part1881 = match("MESSAGE#1171:00767:26/3_0", "nwparser.p0", "%{fld3}, with a timeout value of %{fld2}"); - - var part1882 = match("MESSAGE#1171:00767:26/3_1", "nwparser.p0", "%{fld2->} (%{fld1})"); - - var select423 = linear_select([ - part1881, - part1882, - ]); - - var all384 = all_match({ - processors: [ - part1877, - select422, - part1880, - select423, - ], - on_success: processor_chain([ - dup50, - dup43, - dup51, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1187 = msg("00767:26", all384); - - var part1883 = match("MESSAGE#1172:00767:27/0", "nwparser.payload", "Environment variable %{fld2->} changed to %{p0}"); - - var part1884 = match("MESSAGE#1172:00767:27/1_0", "nwparser.p0", "%{fld3->} by %{username->} (%{fld1})"); - - var part1885 = match_copy("MESSAGE#1172:00767:27/1_1", "nwparser.p0", "fld3"); - - var select424 = linear_select([ - part1884, - part1885, - ]); - - var all385 = all_match({ - processors: [ - part1883, - select424, - ], - on_success: processor_chain([ - dup223, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1188 = msg("00767:27", all385); - - var part1886 = match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was loaded from IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1189 = msg("00767:28", part1886); - - var part1887 = match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1190 = msg("00767:29", part1887); - - var part1888 = match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configuration was saved from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1191 = msg("00767:30", part1888); - - var part1889 = match("MESSAGE#1176:00767:31/1_0", "nwparser.p0", "logged events or alarms %{p0}"); - - var part1890 = match("MESSAGE#1176:00767:31/1_1", "nwparser.p0", "traffic logs %{p0}"); - - var select425 = linear_select([ - part1889, - part1890, - ]); - - var part1891 = match("MESSAGE#1176:00767:31/2", "nwparser.p0", "were cleared by admin %{p0}"); - - var all386 = all_match({ - processors: [ - dup186, - select425, - part1891, - dup397, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1192 = msg("00767:31", all386); - - var part1892 = match("MESSAGE#1177:00767:32/0", "nwparser.payload", "SIP parser error %{p0}"); - - var part1893 = match("MESSAGE#1177:00767:32/1_0", "nwparser.p0", "SIP-field%{p0}"); - - var part1894 = match("MESSAGE#1177:00767:32/1_1", "nwparser.p0", "Message%{p0}"); - - var select426 = linear_select([ - part1893, - part1894, - ]); - - var part1895 = match("MESSAGE#1177:00767:32/2", "nwparser.p0", ": %{result}(%{fld1})"); - - var all387 = all_match({ - processors: [ - part1892, - select426, - part1895, - ], - on_success: processor_chain([ - dup27, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1193 = msg("00767:32", all387); - - var part1896 = match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has started. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1194 = msg("00767:33", part1896); - - var part1897 = match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not support multiple IP addresses %{hostip->} or ports %{network_port->} in SIP headers RESPONSE (%{fld1})", processor_chain([ - dup313, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1195 = msg("00767:34", part1897); - - var part1898 = match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2->} set to %{fld3->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1196 = msg("00767:35", part1898); - - var part1899 = match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved from %{fld2->} by %{username->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1197 = msg("00767:36", part1899); - - var part1900 = match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to download to enable advanced features. %{space->} To find out, please visit %{url->} (%{fld1})", processor_chain([ - dup254, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1198 = msg("00767:37", part1900); - - var part1901 = match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and remaining messages were sent to external destination. %{fld2->} packets were dropped. (%{fld1})", processor_chain([ - setc("eventcategory","1602000000"), - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1199 = msg("00767:38", part1901); - - var part1902 = match("MESSAGE#1184:00767:39/0", "nwparser.payload", "Cannot %{p0}"); - - var part1903 = match("MESSAGE#1184:00767:39/1_0", "nwparser.p0", "download %{p0}"); - - var part1904 = match("MESSAGE#1184:00767:39/1_1", "nwparser.p0", "parse %{p0}"); - - var select427 = linear_select([ - part1903, - part1904, - ]); - - var part1905 = match("MESSAGE#1184:00767:39/2", "nwparser.p0", "attack database %{p0}"); - - var part1906 = match("MESSAGE#1184:00767:39/3_0", "nwparser.p0", "from %{url->} (%{result}). %{p0}"); - - var part1907 = match("MESSAGE#1184:00767:39/3_1", "nwparser.p0", "%{fld2->} %{p0}"); - - var select428 = linear_select([ - part1906, - part1907, - ]); - - var all388 = all_match({ - processors: [ - part1902, - select427, - part1905, - select428, - dup10, - ], - on_success: processor_chain([ - dup324, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1200 = msg("00767:39", all388); - - var part1908 = match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key is %{disposition}. (%{fld1})", processor_chain([ - dup62, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1201 = msg("00767:40", part1908); - - var part1909 = match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1202 = msg("00767:42", part1909); - - var part1910 = match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1203 = msg("00767:43", part1910); - - var part1911 = match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind by %{fld2->} (%{fld1})", processor_chain([ - dup44, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1204 = msg("00767:44", part1911); - - var part1912 = match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{version->} is saved to flash. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1205 = msg("00767:45", part1912); - - var part1913 = match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved by netscreen via %{logon_type->} by netscreen. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1206 = msg("00767:46", part1913); - - var part1914 = match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs to a different group in the RADIUS server than that allowed in the device. (%{fld1})", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - dup9, - ])); - - var msg1207 = msg("00767:47", part1914); - - var part1915 = match("MESSAGE#1192:00767:24/0", "nwparser.payload", "System configuration saved by %{p0}"); - - var part1916 = match("MESSAGE#1192:00767:24/2", "nwparser.p0", "%{logon_type->} by %{fld2->} (%{fld1})"); - - var all389 = all_match({ - processors: [ - part1915, - dup364, - part1916, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup9, - dup4, - dup5, - ]), - }); - - var msg1208 = msg("00767:24", all389); - - var part1917 = match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. (%{fld1})", processor_chain([ - dup272, - dup2, - dup3, - dup9, - dup4, - dup5, - ])); - - var msg1209 = msg("00767:48", part1917); - - var part1918 = match("MESSAGE#1194:00767:49/0", "nwparser.payload", "%{fld2->} turn o%{p0}"); - - var part1919 = match("MESSAGE#1194:00767:49/1_0", "nwparser.p0", "n%{p0}"); - - var part1920 = match("MESSAGE#1194:00767:49/1_1", "nwparser.p0", "ff%{p0}"); - - var select429 = linear_select([ - part1919, - part1920, - ]); - - var part1921 = match("MESSAGE#1194:00767:49/2", "nwparser.p0", "%{}debug switch for %{fld3->} (%{fld1})"); - - var all390 = all_match({ - processors: [ - part1918, - select429, - part1921, - ], - on_success: processor_chain([ - dup1, - dup2, - dup4, - dup5, - dup9, - ]), - }); - - var msg1210 = msg("00767:49", all390); - - var select430 = linear_select([ - msg1158, - msg1159, - msg1160, - msg1161, - msg1162, - msg1163, - msg1164, - msg1165, - msg1166, - msg1167, - msg1168, - msg1169, - msg1170, - msg1171, - msg1172, - msg1173, - msg1174, - msg1175, - msg1176, - msg1177, - msg1178, - msg1179, - msg1180, - msg1181, - msg1182, - msg1183, - msg1184, - msg1185, - msg1186, - msg1187, - msg1188, - msg1189, - msg1190, - msg1191, - msg1192, - msg1193, - msg1194, - msg1195, - msg1196, - msg1197, - msg1198, - msg1199, - msg1200, - msg1201, - msg1202, - msg1203, - msg1204, - msg1205, - msg1206, - msg1207, - msg1208, - msg1209, - msg1210, - ]); - - var part1922 = match("MESSAGE#1195:01269", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup277, - dup3, - dup275, - dup60, - ])); - - var msg1211 = msg("01269", part1922); - - var msg1212 = msg("01269:01", dup407); - - var msg1213 = msg("01269:02", dup408); - - var msg1214 = msg("01269:03", dup409); - - var select431 = linear_select([ - msg1211, - msg1212, - msg1213, - msg1214, - ]); - - var part1923 = match("MESSAGE#1199:17852", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup276, - dup277, - dup275, - dup332, - ])); - - var msg1215 = msg("17852", part1923); - - var part1924 = match("MESSAGE#1200:17852:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1216 = msg("17852:01", part1924); - - var part1925 = match("MESSAGE#1201:17852:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var msg1217 = msg("17852:02", part1925); - - var part1926 = match("MESSAGE#1202:17852:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1218 = msg("17852:03", part1926); - - var select432 = linear_select([ - msg1215, - msg1216, - msg1217, - msg1218, - ]); - - var msg1219 = msg("23184", dup410); - - var part1927 = match("MESSAGE#1204:23184:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup61, - dup282, - ])); - - var msg1220 = msg("23184:01", part1927); - - var part1928 = match("MESSAGE#1205:23184:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup276, - dup277, - dup275, - dup61, - ])); - - var msg1221 = msg("23184:02", part1928); - - var part1929 = match("MESSAGE#1206:23184:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup332, - dup282, - ])); - - var msg1222 = msg("23184:03", part1929); - - var select433 = linear_select([ - msg1219, - msg1220, - msg1221, - msg1222, - ]); - - var msg1223 = msg("27052", dup410); - - var part1930 = match("MESSAGE#1208:27052:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol}direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup61, - dup282, - ])); - - var msg1224 = msg("27052:01", part1930); - - var select434 = linear_select([ - msg1223, - msg1224, - ]); - - var part1931 = match("MESSAGE#1209:39568", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup277, - dup5, - dup274, - dup3, - dup275, - dup276, - dup60, - ])); - - var msg1225 = msg("39568", part1931); - - var msg1226 = msg("39568:01", dup407); - - var msg1227 = msg("39568:02", dup408); - - var msg1228 = msg("39568:03", dup409); - - var select435 = linear_select([ - msg1225, - msg1226, - msg1227, - msg1228, - ]); - - var chain1 = processor_chain([ - select2, - msgid_select({ - "00001": select6, - "00002": select29, - "00003": select31, - "00004": select33, - "00005": select39, - "00006": select40, - "00007": select63, - "00008": select66, - "00009": select83, - "00010": select86, - "00011": select100, - "00012": select101, - "00013": select102, - "00014": select104, - "00015": select114, - "00016": select115, - "00017": select125, - "00018": select138, - "00019": select147, - "00020": select150, - "00021": select151, - "00022": select163, - "00023": select164, - "00024": select170, - "00025": select171, - "00026": select176, - "00027": select184, - "00028": msg469, - "00029": select188, - "00030": select197, - "00031": select205, - "00032": select207, - "00033": select214, - "00034": select225, - "00035": select232, - "00036": select234, - "00037": select241, - "00038": msg660, - "00039": msg661, - "00040": select244, - "00041": select245, - "00042": select246, - "00043": msg668, - "00044": select248, - "00045": msg671, - "00047": msg672, - "00048": select257, - "00049": select258, - "00050": msg682, - "00051": msg683, - "00052": msg684, - "00055": select265, - "00056": msg696, - "00057": msg697, - "00058": msg698, - "00059": select272, - "00062": select273, - "00063": msg713, - "00064": select274, - "00070": select276, - "00071": select277, - "00072": select278, - "00073": select279, - "00074": msg726, - "00075": select280, - "00076": select281, - "00077": select282, - "00084": msg735, - "00090": msg736, - "00200": msg737, - "00201": msg738, - "00202": msg739, - "00203": msg740, - "00206": select285, - "00207": select286, - "00257": select291, - "00259": select294, - "00262": msg778, - "00263": msg779, - "00400": msg780, - "00401": msg781, - "00402": select296, - "00403": msg784, - "00404": msg785, - "00405": msg786, - "00406": msg787, - "00407": msg788, - "00408": msg789, - "00409": msg790, - "00410": select297, - "00411": msg793, - "00413": select298, - "00414": select299, - "00415": msg799, - "00423": msg800, - "00429": select300, - "00430": select301, - "00431": msg805, - "00432": msg806, - "00433": msg807, - "00434": msg808, - "00435": select302, - "00436": select303, - "00437": select304, - "00438": select305, - "00440": select306, - "00441": msg823, - "00442": msg824, - "00443": msg825, - "00511": select307, - "00513": msg841, - "00515": select328, - "00518": select331, - "00519": select336, - "00520": select339, - "00521": msg890, - "00522": msg891, - "00523": msg892, - "00524": select340, - "00525": select341, - "00526": msg912, - "00527": select348, - "00528": select354, - "00529": select357, - "00530": select358, - "00531": select362, - "00533": msg973, - "00534": msg974, - "00535": select363, - "00536": select365, - "00537": select366, - "00538": select372, - "00539": select373, - "00541": select375, - "00542": msg1062, - "00543": msg1063, - "00544": msg1064, - "00546": msg1065, - "00547": select379, - "00549": msg1070, - "00551": select381, - "00553": select385, - "00554": select391, - "00555": msg1117, - "00556": select401, - "00572": select402, - "00601": select404, - "00602": msg1148, - "00612": msg1149, - "00615": select403, - "00620": select408, - "00622": msg1155, - "00625": msg1156, - "00628": msg1157, - "00767": select430, - "01269": select431, - "17852": select432, - "23184": select433, - "27052": select434, - "39568": select435, - }), - ]); - - var part1932 = match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); - - var part1933 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); - - var part1934 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); - - var part1935 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); - - var part1936 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); - - var part1937 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); - - var part1938 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); - - var part1939 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); - - var part1940 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); - - var part1941 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); - - var part1942 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); - - var part1943 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); - - var part1944 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); - - var part1945 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); - - var part1946 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); - - var part1947 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); - - var part1948 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); - - var part1949 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); - - var part1950 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); - - var part1951 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); - - var part1952 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); - - var part1953 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); - - var part1954 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); - - var part1955 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); - - var part1956 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); - - var part1957 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); - - var part1958 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); - - var part1959 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); - - var part1960 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); - - var part1961 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); - - var part1962 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); - - var part1963 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); - - var part1964 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part1965 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); - - var part1966 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); - - var part1967 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); - - var part1968 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); - - var part1969 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); - - var part1970 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); - - var part1971 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); - - var part1972 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); - - var part1973 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); - - var part1974 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); - - var part1975 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); - - var part1976 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); - - var part1977 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part1978 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); - - var part1979 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); - - var part1980 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part1981 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); - - var part1982 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); - - var part1983 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); - - var part1984 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); - - var part1985 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); - - var part1986 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); - - var part1987 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); - - var part1988 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); - - var part1989 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); - - var part1990 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); - - var part1991 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); - - var part1992 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); - - var part1993 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); - - var part1994 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); - - var part1995 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); - - var part1996 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); - - var part1997 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); - - var part1998 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); - - var part1999 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); - - var part2000 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); - - var part2001 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); - - var part2002 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); - - var part2003 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); - - var part2004 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); - - var part2005 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); - - var part2006 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); - - var part2007 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); - - var part2008 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); - - var part2009 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); - - var part2010 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); - - var part2011 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); - - var part2012 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); - - var part2013 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); - - var part2014 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); - - var part2015 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); - - var part2016 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); - - var part2017 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); - - var part2018 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); - - var part2019 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); - - var part2020 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); - - var part2021 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); - - var part2022 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2023 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); - - var part2024 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); - - var part2025 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); - - var part2026 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); - - var part2027 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); - - var part2028 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); - - var part2029 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); - - var part2030 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); - - var part2031 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); - - var part2032 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); - - var part2033 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); - - var part2034 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); - - var part2035 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); - - var part2036 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); - - var part2037 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); - - var part2038 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); - - var part2039 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); - - var part2040 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); - - var part2041 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); - - var part2042 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); - - var part2043 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); - - var part2044 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); - - var part2045 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); - - var part2046 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); - - var part2047 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); - - var part2048 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); - - var part2049 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); - - var part2050 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); - - var part2051 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); - - var part2052 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); - - var part2053 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); - - var part2054 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); - - var part2055 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); - - var part2056 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); - - var part2057 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); - - var part2058 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); - - var part2059 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); - - var part2060 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); - - var part2061 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); - - var part2062 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); - - var part2063 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); - - var part2064 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); - - var part2065 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); - - var part2066 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); - - var part2067 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); - - var part2068 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); - - var part2069 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); - - var part2070 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); - - var part2071 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); - - var part2072 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); - - var part2073 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); - - var part2074 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); - - var part2075 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); - - var part2076 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); - - var part2077 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); - - var part2078 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); - - var part2079 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); - - var part2080 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); - - var part2081 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); - - var part2082 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); - - var part2083 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); - - var part2084 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); - - var part2085 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); - - var part2086 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); - - var part2087 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); - - var part2088 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); - - var part2089 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); - - var part2090 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); - - var part2091 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); - - var part2092 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); - - var part2093 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); - - var part2094 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); - - var part2095 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); - - var part2096 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); - - var part2097 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); - - var part2098 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); - - var part2099 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); - - var part2100 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); - - var part2101 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); - - var part2102 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); - - var part2103 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); - - var part2104 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); - - var part2105 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); - - var part2106 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2107 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); - - var part2108 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); - - var part2109 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); - - var part2110 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); - - var part2111 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); - - var part2112 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); - - var part2113 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); - - var part2114 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); - - var part2115 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); - - var part2116 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); - - var part2117 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); - - var part2118 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); - - var part2119 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); - - var part2120 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); - - var part2121 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); - - var part2122 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); - - var part2123 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); - - var part2124 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); - - var part2125 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); - - var part2126 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); - - var part2127 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); - - var part2128 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); - - var part2129 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); - - var part2130 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); - - var part2131 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var part2132 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); - - var part2133 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); - - var part2134 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); - - var part2135 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); - - var part2136 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); - - var part2137 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); - - var part2138 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); - - var part2139 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); - - var part2140 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); - - var part2141 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); - - var part2142 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); - - var part2143 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); - - var part2144 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); - - var part2145 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); - - var part2146 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); - - var part2147 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2148 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); - - var part2149 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); - - var part2150 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); - - var part2151 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); - - var part2152 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); - - var part2153 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); - - var part2154 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); - - var part2155 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); - - var part2156 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); - - var part2157 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); - - var part2158 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); - - var part2159 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); - - var part2160 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); - - var part2161 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); - - var part2162 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); - - var part2163 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); - - var part2164 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); - - var part2165 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); - - var part2166 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); - - var part2167 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); - - var part2168 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); - - var part2169 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); - - var part2170 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); - - var part2171 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); - - var part2172 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); - - var part2173 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); - - var part2174 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - - var part2175 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); - - var select436 = linear_select([ - dup10, - dup11, - ]); - - var part2176 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select437 = linear_select([ - dup13, - dup14, - ]); - - var select438 = linear_select([ - dup15, - dup16, - ]); - - var select439 = linear_select([ - dup56, - dup57, - ]); - - var select440 = linear_select([ - dup65, - dup66, - ]); - - var select441 = linear_select([ - dup68, - dup69, - ]); - - var select442 = linear_select([ - dup71, - dup72, - ]); - - var part2177 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ - dup58, - dup2, - dup3, - dup4, - dup5, - dup61, - ])); - - var select443 = linear_select([ - dup74, - dup75, - ]); - - var select444 = linear_select([ - dup81, - dup82, - ]); - - var select445 = linear_select([ - dup24, - dup90, - ]); - - var select446 = linear_select([ - dup94, - dup95, - ]); - - var select447 = linear_select([ - dup98, - dup99, - ]); - - var select448 = linear_select([ - dup100, - dup101, - dup102, - ]); - - var select449 = linear_select([ - dup113, - dup114, - ]); - - var select450 = linear_select([ - dup111, - dup16, - ]); - - var select451 = linear_select([ - dup127, - dup107, - ]); - - var select452 = linear_select([ - dup8, - dup21, - ]); - - var select453 = linear_select([ - dup122, - dup133, - ]); - - var select454 = linear_select([ - dup142, - dup143, - ]); - - var select455 = linear_select([ - dup145, - dup21, - ]); - - var select456 = linear_select([ - dup127, - dup106, - ]); - - var select457 = linear_select([ - dup152, - dup96, - ]); - - var select458 = linear_select([ - dup154, - dup155, - ]); - - var select459 = linear_select([ - dup156, - dup157, - ]); - - var select460 = linear_select([ - dup99, - dup134, - ]); - - var select461 = linear_select([ - dup158, - dup159, - ]); - - var select462 = linear_select([ - dup161, - dup162, - ]); - - var select463 = linear_select([ - dup163, - dup103, - ]); - - var select464 = linear_select([ - dup162, - dup161, - ]); - - var select465 = linear_select([ - dup46, - dup47, - ]); - - var select466 = linear_select([ - dup166, - dup167, - ]); - - var select467 = linear_select([ - dup172, - dup173, - ]); - - var select468 = linear_select([ - dup174, - dup175, - dup176, - dup177, - dup178, - dup179, - dup180, - dup181, - dup182, - ]); - - var select469 = linear_select([ - dup49, - dup21, - ]); - - var select470 = linear_select([ - dup189, - dup190, - ]); - - var select471 = linear_select([ - dup96, - dup152, - ]); - - var select472 = linear_select([ - dup196, - dup197, - ]); - - var select473 = linear_select([ - dup24, - dup200, - ]); - - var select474 = linear_select([ - dup103, - dup163, - ]); - - var select475 = linear_select([ - dup205, - dup118, - ]); - - var part2178 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select476 = linear_select([ - dup212, - dup213, - ]); - - var select477 = linear_select([ - dup215, - dup216, - ]); - - var select478 = linear_select([ - dup222, - dup215, - ]); - - var select479 = linear_select([ - dup224, - dup225, - ]); - - var select480 = linear_select([ - dup231, - dup124, - ]); - - var select481 = linear_select([ - dup229, - dup230, - ]); - - var select482 = linear_select([ - dup233, - dup234, - ]); - - var select483 = linear_select([ - dup236, - dup237, - ]); - - var select484 = linear_select([ - dup242, - dup243, - ]); - - var select485 = linear_select([ - dup245, - dup246, - ]); - - var select486 = linear_select([ - dup247, - dup248, - ]); - - var select487 = linear_select([ - dup249, - dup250, - ]); - - var select488 = linear_select([ - dup251, - dup252, - ]); - - var select489 = linear_select([ - dup260, - dup261, - ]); - - var select490 = linear_select([ - dup264, - dup265, - ]); - - var select491 = linear_select([ - dup268, - dup269, - ]); - - var part2179 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ])); - - var select492 = linear_select([ - dup284, - dup285, - ]); - - var select493 = linear_select([ - dup287, - dup288, - ]); - - var part2180 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ - dup58, - dup2, - dup59, - dup4, - dup5, - dup3, - dup60, - ])); - - var part2181 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ - dup58, - dup4, - dup59, - dup5, - dup9, - dup2, - dup3, - dup60, - ])); - - var select494 = linear_select([ - dup300, - dup26, - ]); - - var select495 = linear_select([ - dup115, - dup303, - ]); - - var select496 = linear_select([ - dup125, - dup96, - ]); - - var select497 = linear_select([ - dup189, - dup308, - dup309, - ]); - - var select498 = linear_select([ - dup310, - dup16, - ]); - - var select499 = linear_select([ - dup317, - dup318, - ]); - - var select500 = linear_select([ - dup319, - dup315, - ]); - - var select501 = linear_select([ - dup322, - dup250, - ]); - - var select502 = linear_select([ - dup327, - dup329, - ]); - - var select503 = linear_select([ - dup330, - dup129, - ]); - - var part2182 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var part2183 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup60, - ])); - - var part2184 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup281, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup60, - dup282, - ])); - - var part2185 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup185, - dup2, - dup4, - dup5, - dup274, - dup3, - dup275, - dup276, - dup277, - dup61, - ])); - - var all391 = all_match({ - processors: [ - dup263, - dup390, - dup266, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var all392 = all_match({ - processors: [ - dup267, - dup391, - dup270, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), - }); - - var all393 = all_match({ - processors: [ - dup80, - dup343, - dup293, - ], - on_success: processor_chain([ - dup58, - dup2, - dup59, - dup3, - dup4, - dup5, - dup61, - ]), - }); - - var all394 = all_match({ - processors: [ - dup296, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - - var all395 = all_match({ - processors: [ - dup298, - dup343, - dup131, - ], - on_success: processor_chain([ - dup297, - dup2, - dup3, - dup9, - dup59, - dup4, - dup5, - dup61, - ]), - }); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/netscreen/elasticsearch/ingest_pipeline/default.yml b/packages/juniper/1.1.0/data_stream/netscreen/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index c21920bdee..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- -description: Pipeline for Netscreen - -processors: - # ECS event.ingested - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - - set: - field: ecs.version - value: '8.0.0' - # User agent - - user_agent: - field: user_agent.original - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - append: - field: related.hosts - value: '{{host.name}}' - allow_duplicates: false - if: ctx.host?.name != null && ctx.host?.name != '' - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - append: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/juniper/1.1.0/data_stream/netscreen/fields/agent.yml b/packages/juniper/1.1.0/data_stream/netscreen/fields/agent.yml deleted file mode 100755 index da4e652c53..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/fields/agent.yml +++ /dev/null @@ -1,198 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - diff --git a/packages/juniper/1.1.0/data_stream/netscreen/fields/base-fields.yml b/packages/juniper/1.1.0/data_stream/netscreen/fields/base-fields.yml deleted file mode 100755 index db5ff9a4da..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/fields/base-fields.yml +++ /dev/null @@ -1,46 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: juniper -- name: event.dataset - type: constant_keyword - description: Event dataset - value: juniper.netscreen -- name: '@timestamp' - type: date - description: Event timestamp. -- name: container.id - description: Unique container id. - ignore_above: 1024 - type: keyword -- name: input.type - description: Type of Filebeat input. - type: keyword -- name: log.file.path - description: Full path to the log file this event came from. - example: /var/log/fun-times.log - ignore_above: 1024 - type: keyword -- name: log.source.address - description: Source address from which the log event was read / sent from. - type: keyword -- name: log.flags - description: Flags for the log file. - type: keyword -- name: log.offset - description: Offset of the entry in the log file. - type: long -- name: tags - description: List of keywords used to tag each event. - example: '["production", "env2"]' - ignore_above: 1024 - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/netscreen/fields/ecs.yml b/packages/juniper/1.1.0/data_stream/netscreen/fields/ecs.yml deleted file mode 100755 index 83d707fc6b..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/fields/ecs.yml +++ /dev/null @@ -1,506 +0,0 @@ -- description: |- - Date/time when the event originated. - This is the date/time extracted from the event, typically representing when the event was generated by the source. - If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. - Required field for all events. - name: '@timestamp' - type: date -- description: |- - The domain name of the client system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: client.domain - type: keyword -- description: |- - The highest registered client domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: client.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: client.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: client.top_level_domain - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - MAC address of the destination. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: destination.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - The highest registered destination domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: destination.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: destination.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: destination.top_level_domain - type: keyword -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: The type of data contained in this resource record. - name: dns.answers.type - type: keyword -- description: |- - The highest registered domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: dns.question.registered_domain - type: keyword -- description: |- - The subdomain is all of the labels under the registered_domain. - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: dns.question.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: dns.question.top_level_domain - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Error message. - name: error.message - type: match_only_text -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - name: event.original - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. - Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - name: event.timezone - type: keyword -- description: |- - Array of file attributes. - Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. - name: file.attributes - type: keyword -- description: Directory where the file is located. It should include the drive letter, when appropriate. - name: file.directory - type: keyword -- description: |- - File extension, excluding the leading dot. - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: file.extension - type: keyword -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - name: file.path - type: keyword -- description: |- - File size in bytes. - Only relevant when `file.type` is "file". - name: file.size - type: long -- description: File type (file, dir, or symlink). - name: file.type - type: keyword -- description: City name. - name: geo.city_name - type: keyword -- description: Country name. - name: geo.country_name - type: keyword -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: geo.name - type: keyword -- description: Region name. - name: geo.region_name - type: keyword -- description: Unique identifier for the group on the system/platform. - name: group.id - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Host MAC addresses. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: host.mac - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: |- - Original log level of the log event. - If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). - Some examples are `warn`, `err`, `i`, `informational`. - name: log.level - type: keyword -- description: |- - The Syslog numeric facility of the log event, if available. - According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. - name: log.syslog.facility.code - type: long -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - The Syslog numeric severity of the log event, if available. - If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. - name: log.syslog.severity.code - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: Host IP address when the source IP address is the proxy. - name: network.forwarded_ip - type: ip -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: The product name of the observer. - name: observer.product - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.name - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.parent.name - type: keyword -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.parent.title - type: keyword -- description: Process id. - name: process.pid - type: long -- description: Process id. - name: process.parent.pid - type: long -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.title - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: |- - The highest registered server domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: server.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: server.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: server.top_level_domain - type: keyword -- description: |- - Name of the service data is collected from. - The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. - In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - name: service.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - MAC address of the source. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: source.mac - type: keyword -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Port of the source. - name: source.port - type: long -- description: |- - The highest registered source domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: source.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: source.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: source.top_level_domain - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - The highest registered url domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: url.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: url.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword -- description: User's full name, if available. - name: user.full_name - type: keyword -- description: Unique identifier of the user. - name: user.id - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/netscreen/fields/fields.yml b/packages/juniper/1.1.0/data_stream/netscreen/fields/fields.yml deleted file mode 100755 index ea69cd79e3..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/fields/fields.yml +++ /dev/null @@ -1,1754 +0,0 @@ -- name: rsa - type: group - fields: - - name: internal - type: group - fields: - - name: msg - type: keyword - description: This key is used to capture the raw message that comes into the Log Decoder - - name: messageid - type: keyword - - name: event_desc - type: keyword - - name: message - type: keyword - description: This key captures the contents of instant messages - - name: time - type: date - description: This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - - name: level - type: long - description: Deprecated key defined only in table map. - - name: msg_id - type: keyword - description: This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: msg_vid - type: keyword - description: This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: data - type: keyword - description: Deprecated key defined only in table map. - - name: obj_server - type: keyword - description: Deprecated key defined only in table map. - - name: obj_val - type: keyword - description: Deprecated key defined only in table map. - - name: resource - type: keyword - description: Deprecated key defined only in table map. - - name: obj_id - type: keyword - description: Deprecated key defined only in table map. - - name: statement - type: keyword - description: Deprecated key defined only in table map. - - name: audit_class - type: keyword - description: Deprecated key defined only in table map. - - name: entry - type: keyword - description: Deprecated key defined only in table map. - - name: hcode - type: keyword - description: Deprecated key defined only in table map. - - name: inode - type: long - description: Deprecated key defined only in table map. - - name: resource_class - type: keyword - description: Deprecated key defined only in table map. - - name: dead - type: long - description: Deprecated key defined only in table map. - - name: feed_desc - type: keyword - description: This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: feed_name - type: keyword - description: This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: cid - type: keyword - description: This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_class - type: keyword - description: This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_group - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_host - type: keyword - description: This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ip - type: ip - description: This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ipv6 - type: ip - description: This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type - type: keyword - description: This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type_id - type: long - description: Deprecated key defined only in table map. - - name: did - type: keyword - description: This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: entropy_req - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: entropy_res - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: event_name - type: keyword - description: Deprecated key defined only in table map. - - name: feed_category - type: keyword - description: This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: forward_ip - type: ip - description: This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - - name: forward_ipv6 - type: ip - description: This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: header_id - type: keyword - description: This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_cid - type: keyword - description: This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_ctime - type: date - description: This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: mcb_req - type: long - description: This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most - - name: mcb_res - type: long - description: This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most - - name: mcbc_req - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: mcbc_res - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: medium - type: long - description: "This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session" - - name: node_name - type: keyword - description: Deprecated key defined only in table map. - - name: nwe_callback_id - type: keyword - description: This key denotes that event is endpoint related - - name: parse_error - type: keyword - description: This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: payload_req - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: payload_res - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: process_vid_dst - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - - name: process_vid_src - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. - - name: rid - type: long - description: This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: session_split - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: site - type: keyword - description: Deprecated key defined only in table map. - - name: size - type: long - description: This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: sourcefile - type: keyword - description: This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: ubc_req - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: ubc_res - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: word - type: keyword - description: This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log - - name: time - type: group - fields: - - name: event_time - type: date - description: This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - - name: duration_time - type: double - description: This key is used to capture the normalized duration/lifetime in seconds. - - name: event_time_str - type: keyword - description: This key is used to capture the incomplete time mentioned in a session as a string - - name: starttime - type: date - description: This key is used to capture the Start time mentioned in a session in a standard form - - name: month - type: keyword - - name: day - type: keyword - - name: endtime - type: date - description: This key is used to capture the End time mentioned in a session in a standard form - - name: timezone - type: keyword - description: This key is used to capture the timezone of the Event Time - - name: duration_str - type: keyword - description: A text string version of the duration - - name: date - type: keyword - - name: year - type: keyword - - name: recorded_time - type: date - description: The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - - name: datetime - type: keyword - - name: effective_time - type: date - description: This key is the effective time referenced by an individual event in a Standard Timestamp format - - name: expire_time - type: date - description: This key is the timestamp that explicitly refers to an expiration. - - name: process_time - type: keyword - description: Deprecated, use duration.time - - name: hour - type: keyword - - name: min - type: keyword - - name: timestamp - type: keyword - - name: event_queue_time - type: date - description: This key is the Time that the event was queued. - - name: p_time1 - type: keyword - - name: tzone - type: keyword - - name: eventtime - type: keyword - - name: gmtdate - type: keyword - - name: gmttime - type: keyword - - name: p_date - type: keyword - - name: p_month - type: keyword - - name: p_time - type: keyword - - name: p_time2 - type: keyword - - name: p_year - type: keyword - - name: expire_time_str - type: keyword - description: This key is used to capture incomplete timestamp that explicitly refers to an expiration. - - name: stamp - type: date - description: Deprecated key defined only in table map. - - name: misc - type: group - fields: - - name: action - type: keyword - - name: result - type: keyword - description: This key is used to capture the outcome/result string value of an action in a session. - - name: severity - type: keyword - description: This key is used to capture the severity given the session - - name: event_type - type: keyword - description: This key captures the event category type as specified by the event source. - - name: reference_id - type: keyword - description: This key is used to capture an event id from the session directly - - name: version - type: keyword - description: This key captures Version of the application or OS which is generating the event. - - name: disposition - type: keyword - description: This key captures the The end state of an action. - - name: result_code - type: keyword - description: This key is used to capture the outcome/result numeric value of an action in a session - - name: category - type: keyword - description: This key is used to capture the category of an event given by the vendor in the session - - name: obj_name - type: keyword - description: This is used to capture name of object - - name: obj_type - type: keyword - description: This is used to capture type of object - - name: event_source - type: keyword - description: "This key captures Source of the event that’s not a hostname" - - name: log_session_id - type: keyword - description: This key is used to capture a sessionid from the session directly - - name: group - type: keyword - description: This key captures the Group Name value - - name: policy_name - type: keyword - description: This key is used to capture the Policy Name only. - - name: rule_name - type: keyword - description: This key captures the Rule Name - - name: context - type: keyword - description: This key captures Information which adds additional context to the event. - - name: change_new - type: keyword - description: "This key is used to capture the new values of the attribute that’s changing in a session" - - name: space - type: keyword - - name: client - type: keyword - description: This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - - name: msgIdPart1 - type: keyword - - name: msgIdPart2 - type: keyword - - name: change_old - type: keyword - description: "This key is used to capture the old value of the attribute that’s changing in a session" - - name: operation_id - type: keyword - description: An alert number or operation number. The values should be unique and non-repeating. - - name: event_state - type: keyword - description: This key captures the current state of the object/item referenced within the event. Describing an on-going event. - - name: group_object - type: keyword - description: This key captures a collection/grouping of entities. Specific usage - - name: node - type: keyword - description: Common use case is the node name within a cluster. The cluster name is reflected by the host name. - - name: rule - type: keyword - description: This key captures the Rule number - - name: device_name - type: keyword - description: 'This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc' - - name: param - type: keyword - description: This key is the parameters passed as part of a command or application, etc. - - name: change_attrib - type: keyword - description: "This key is used to capture the name of the attribute that’s changing in a session" - - name: event_computer - type: keyword - description: This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - - name: reference_id1 - type: keyword - description: This key is for Linked ID to be used as an addition to "reference.id" - - name: event_log - type: keyword - description: This key captures the Name of the event log - - name: OS - type: keyword - description: This key captures the Name of the Operating System - - name: terminal - type: keyword - description: This key captures the Terminal Names only - - name: msgIdPart3 - type: keyword - - name: filter - type: keyword - description: This key captures Filter used to reduce result set - - name: serial_number - type: keyword - description: This key is the Serial number associated with a physical asset. - - name: checksum - type: keyword - description: This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - - name: event_user - type: keyword - description: This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - - name: virusname - type: keyword - description: This key captures the name of the virus - - name: content_type - type: keyword - description: This key is used to capture Content Type only. - - name: group_id - type: keyword - description: This key captures Group ID Number (related to the group name) - - name: policy_id - type: keyword - description: This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - - name: vsys - type: keyword - description: This key captures Virtual System Name - - name: connection_id - type: keyword - description: This key captures the Connection ID - - name: reference_id2 - type: keyword - description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - - name: sensor - type: keyword - description: This key captures Name of the sensor. Typically used in IDS/IPS based devices - - name: sig_id - type: long - description: This key captures IDS/IPS Int Signature ID - - name: port_name - type: keyword - description: 'This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name).' - - name: rule_group - type: keyword - description: This key captures the Rule group name - - name: risk_num - type: double - description: This key captures a Numeric Risk value - - name: trigger_val - type: keyword - description: This key captures the Value of the trigger or threshold condition. - - name: log_session_id1 - type: keyword - description: This key is used to capture a Linked (Related) Session ID from the session directly - - name: comp_version - type: keyword - description: This key captures the Version level of a sub-component of a product. - - name: content_version - type: keyword - description: This key captures Version level of a signature or database content. - - name: hardware_id - type: keyword - description: This key is used to capture unique identifier for a device or system (NOT a Mac address) - - name: risk - type: keyword - description: This key captures the non-numeric risk value - - name: event_id - type: keyword - - name: reason - type: keyword - - name: status - type: keyword - - name: mail_id - type: keyword - description: This key is used to capture the mailbox id/name - - name: rule_uid - type: keyword - description: This key is the Unique Identifier for a rule. - - name: trigger_desc - type: keyword - description: This key captures the Description of the trigger or threshold condition. - - name: inout - type: keyword - - name: p_msgid - type: keyword - - name: data_type - type: keyword - - name: msgIdPart4 - type: keyword - - name: error - type: keyword - description: This key captures All non successful Error codes or responses - - name: index - type: keyword - - name: listnum - type: keyword - description: This key is used to capture listname or listnumber, primarily for collecting access-list - - name: ntype - type: keyword - - name: observed_val - type: keyword - description: This key captures the Value observed (from the perspective of the device generating the log). - - name: policy_value - type: keyword - description: This key captures the contents of the policy. This contains details about the policy - - name: pool_name - type: keyword - description: This key captures the name of a resource pool - - name: rule_template - type: keyword - description: A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - - name: count - type: keyword - - name: number - type: keyword - - name: sigcat - type: keyword - - name: type - type: keyword - - name: comments - type: keyword - description: Comment information provided in the log message - - name: doc_number - type: long - description: This key captures File Identification number - - name: expected_val - type: keyword - description: This key captures the Value expected (from the perspective of the device generating the log). - - name: job_num - type: keyword - description: This key captures the Job Number - - name: spi_dst - type: keyword - description: Destination SPI Index - - name: spi_src - type: keyword - description: Source SPI Index - - name: code - type: keyword - - name: agent_id - type: keyword - description: This key is used to capture agent id - - name: message_body - type: keyword - description: This key captures the The contents of the message body. - - name: phone - type: keyword - - name: sig_id_str - type: keyword - description: This key captures a string object of the sigid variable. - - name: cmd - type: keyword - - name: misc - type: keyword - - name: name - type: keyword - - name: cpu - type: long - description: This key is the CPU time used in the execution of the event being recorded. - - name: event_desc - type: keyword - description: This key is used to capture a description of an event available directly or inferred - - name: sig_id1 - type: long - description: This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - - name: im_buddyid - type: keyword - - name: im_client - type: keyword - - name: im_userid - type: keyword - - name: pid - type: keyword - - name: priority - type: keyword - - name: context_subject - type: keyword - description: This key is to be used in an audit context where the subject is the object being identified - - name: context_target - type: keyword - - name: cve - type: keyword - description: This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - - name: fcatnum - type: keyword - description: This key captures Filter Category Number. Legacy Usage - - name: library - type: keyword - description: This key is used to capture library information in mainframe devices - - name: parent_node - type: keyword - description: This key captures the Parent Node Name. Must be related to node variable. - - name: risk_info - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: tcp_flags - type: long - description: This key is captures the TCP flags set in any packet of session - - name: tos - type: long - description: This key describes the type of service - - name: vm_target - type: keyword - description: VMWare Target **VMWARE** only varaible. - - name: workspace - type: keyword - description: This key captures Workspace Description - - name: command - type: keyword - - name: event_category - type: keyword - - name: facilityname - type: keyword - - name: forensic_info - type: keyword - - name: jobname - type: keyword - - name: mode - type: keyword - - name: policy - type: keyword - - name: policy_waiver - type: keyword - - name: second - type: keyword - - name: space1 - type: keyword - - name: subcategory - type: keyword - - name: tbdstr2 - type: keyword - - name: alert_id - type: keyword - description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: checksum_dst - type: keyword - description: This key is used to capture the checksum or hash of the the target entity such as a process or file. - - name: checksum_src - type: keyword - description: This key is used to capture the checksum or hash of the source entity such as a file or process. - - name: fresult - type: long - description: This key captures the Filter Result - - name: payload_dst - type: keyword - description: This key is used to capture destination payload - - name: payload_src - type: keyword - description: This key is used to capture source payload - - name: pool_id - type: keyword - description: This key captures the identifier (typically numeric field) of a resource pool - - name: process_id_val - type: keyword - description: This key is a failure key for Process ID when it is not an integer value - - name: risk_num_comm - type: double - description: This key captures Risk Number Community - - name: risk_num_next - type: double - description: This key captures Risk Number NextGen - - name: risk_num_sand - type: double - description: This key captures Risk Number SandBox - - name: risk_num_static - type: double - description: This key captures Risk Number Static - - name: risk_suspicious - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: risk_warning - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: snmp_oid - type: keyword - description: SNMP Object Identifier - - name: sql - type: keyword - description: This key captures the SQL query - - name: vuln_ref - type: keyword - description: This key captures the Vulnerability Reference details - - name: acl_id - type: keyword - - name: acl_op - type: keyword - - name: acl_pos - type: keyword - - name: acl_table - type: keyword - - name: admin - type: keyword - - name: alarm_id - type: keyword - - name: alarmname - type: keyword - - name: app_id - type: keyword - - name: audit - type: keyword - - name: audit_object - type: keyword - - name: auditdata - type: keyword - - name: benchmark - type: keyword - - name: bypass - type: keyword - - name: cache - type: keyword - - name: cache_hit - type: keyword - - name: cefversion - type: keyword - - name: cfg_attr - type: keyword - - name: cfg_obj - type: keyword - - name: cfg_path - type: keyword - - name: changes - type: keyword - - name: client_ip - type: keyword - - name: clustermembers - type: keyword - - name: cn_acttimeout - type: keyword - - name: cn_asn_src - type: keyword - - name: cn_bgpv4nxthop - type: keyword - - name: cn_ctr_dst_code - type: keyword - - name: cn_dst_tos - type: keyword - - name: cn_dst_vlan - type: keyword - - name: cn_engine_id - type: keyword - - name: cn_engine_type - type: keyword - - name: cn_f_switch - type: keyword - - name: cn_flowsampid - type: keyword - - name: cn_flowsampintv - type: keyword - - name: cn_flowsampmode - type: keyword - - name: cn_inacttimeout - type: keyword - - name: cn_inpermbyts - type: keyword - - name: cn_inpermpckts - type: keyword - - name: cn_invalid - type: keyword - - name: cn_ip_proto_ver - type: keyword - - name: cn_ipv4_ident - type: keyword - - name: cn_l_switch - type: keyword - - name: cn_log_did - type: keyword - - name: cn_log_rid - type: keyword - - name: cn_max_ttl - type: keyword - - name: cn_maxpcktlen - type: keyword - - name: cn_min_ttl - type: keyword - - name: cn_minpcktlen - type: keyword - - name: cn_mpls_lbl_1 - type: keyword - - name: cn_mpls_lbl_10 - type: keyword - - name: cn_mpls_lbl_2 - type: keyword - - name: cn_mpls_lbl_3 - type: keyword - - name: cn_mpls_lbl_4 - type: keyword - - name: cn_mpls_lbl_5 - type: keyword - - name: cn_mpls_lbl_6 - type: keyword - - name: cn_mpls_lbl_7 - type: keyword - - name: cn_mpls_lbl_8 - type: keyword - - name: cn_mpls_lbl_9 - type: keyword - - name: cn_mplstoplabel - type: keyword - - name: cn_mplstoplabip - type: keyword - - name: cn_mul_dst_byt - type: keyword - - name: cn_mul_dst_pks - type: keyword - - name: cn_muligmptype - type: keyword - - name: cn_sampalgo - type: keyword - - name: cn_sampint - type: keyword - - name: cn_seqctr - type: keyword - - name: cn_spackets - type: keyword - - name: cn_src_tos - type: keyword - - name: cn_src_vlan - type: keyword - - name: cn_sysuptime - type: keyword - - name: cn_template_id - type: keyword - - name: cn_totbytsexp - type: keyword - - name: cn_totflowexp - type: keyword - - name: cn_totpcktsexp - type: keyword - - name: cn_unixnanosecs - type: keyword - - name: cn_v6flowlabel - type: keyword - - name: cn_v6optheaders - type: keyword - - name: comp_class - type: keyword - - name: comp_name - type: keyword - - name: comp_rbytes - type: keyword - - name: comp_sbytes - type: keyword - - name: cpu_data - type: keyword - - name: criticality - type: keyword - - name: cs_agency_dst - type: keyword - - name: cs_analyzedby - type: keyword - - name: cs_av_other - type: keyword - - name: cs_av_primary - type: keyword - - name: cs_av_secondary - type: keyword - - name: cs_bgpv6nxthop - type: keyword - - name: cs_bit9status - type: keyword - - name: cs_context - type: keyword - - name: cs_control - type: keyword - - name: cs_data - type: keyword - - name: cs_datecret - type: keyword - - name: cs_dst_tld - type: keyword - - name: cs_eth_dst_ven - type: keyword - - name: cs_eth_src_ven - type: keyword - - name: cs_event_uuid - type: keyword - - name: cs_filetype - type: keyword - - name: cs_fld - type: keyword - - name: cs_if_desc - type: keyword - - name: cs_if_name - type: keyword - - name: cs_ip_next_hop - type: keyword - - name: cs_ipv4dstpre - type: keyword - - name: cs_ipv4srcpre - type: keyword - - name: cs_lifetime - type: keyword - - name: cs_log_medium - type: keyword - - name: cs_loginname - type: keyword - - name: cs_modulescore - type: keyword - - name: cs_modulesign - type: keyword - - name: cs_opswatresult - type: keyword - - name: cs_payload - type: keyword - - name: cs_registrant - type: keyword - - name: cs_registrar - type: keyword - - name: cs_represult - type: keyword - - name: cs_rpayload - type: keyword - - name: cs_sampler_name - type: keyword - - name: cs_sourcemodule - type: keyword - - name: cs_streams - type: keyword - - name: cs_targetmodule - type: keyword - - name: cs_v6nxthop - type: keyword - - name: cs_whois_server - type: keyword - - name: cs_yararesult - type: keyword - - name: description - type: keyword - - name: devvendor - type: keyword - - name: distance - type: keyword - - name: dstburb - type: keyword - - name: edomain - type: keyword - - name: edomaub - type: keyword - - name: euid - type: keyword - - name: facility - type: keyword - - name: finterface - type: keyword - - name: flags - type: keyword - - name: gaddr - type: keyword - - name: id3 - type: keyword - - name: im_buddyname - type: keyword - - name: im_croomid - type: keyword - - name: im_croomtype - type: keyword - - name: im_members - type: keyword - - name: im_username - type: keyword - - name: ipkt - type: keyword - - name: ipscat - type: keyword - - name: ipspri - type: keyword - - name: latitude - type: keyword - - name: linenum - type: keyword - - name: list_name - type: keyword - - name: load_data - type: keyword - - name: location_floor - type: keyword - - name: location_mark - type: keyword - - name: log_id - type: keyword - - name: log_type - type: keyword - - name: logid - type: keyword - - name: logip - type: keyword - - name: logname - type: keyword - - name: longitude - type: keyword - - name: lport - type: keyword - - name: mbug_data - type: keyword - - name: misc_name - type: keyword - - name: msg_type - type: keyword - - name: msgid - type: keyword - - name: netsessid - type: keyword - - name: num - type: keyword - - name: number1 - type: keyword - - name: number2 - type: keyword - - name: nwwn - type: keyword - - name: object - type: keyword - - name: operation - type: keyword - - name: opkt - type: keyword - - name: orig_from - type: keyword - - name: owner_id - type: keyword - - name: p_action - type: keyword - - name: p_filter - type: keyword - - name: p_group_object - type: keyword - - name: p_id - type: keyword - - name: p_msgid1 - type: keyword - - name: p_msgid2 - type: keyword - - name: p_result1 - type: keyword - - name: password_chg - type: keyword - - name: password_expire - type: keyword - - name: permgranted - type: keyword - - name: permwanted - type: keyword - - name: pgid - type: keyword - - name: policyUUID - type: keyword - - name: prog_asp_num - type: keyword - - name: program - type: keyword - - name: real_data - type: keyword - - name: rec_asp_device - type: keyword - - name: rec_asp_num - type: keyword - - name: rec_library - type: keyword - - name: recordnum - type: keyword - - name: ruid - type: keyword - - name: sburb - type: keyword - - name: sdomain_fld - type: keyword - - name: sec - type: keyword - - name: sensorname - type: keyword - - name: seqnum - type: keyword - - name: session - type: keyword - - name: sessiontype - type: keyword - - name: sigUUID - type: keyword - - name: spi - type: keyword - - name: srcburb - type: keyword - - name: srcdom - type: keyword - - name: srcservice - type: keyword - - name: state - type: keyword - - name: status1 - type: keyword - - name: svcno - type: keyword - - name: system - type: keyword - - name: tbdstr1 - type: keyword - - name: tgtdom - type: keyword - - name: tgtdomain - type: keyword - - name: threshold - type: keyword - - name: type1 - type: keyword - - name: udb_class - type: keyword - - name: url_fld - type: keyword - - name: user_div - type: keyword - - name: userid - type: keyword - - name: username_fld - type: keyword - - name: utcstamp - type: keyword - - name: v_instafname - type: keyword - - name: virt_data - type: keyword - - name: vpnid - type: keyword - - name: autorun_type - type: keyword - description: This is used to capture Auto Run type - - name: cc_number - type: long - description: Valid Credit Card Numbers only - - name: content - type: keyword - description: This key captures the content type from protocol headers - - name: ein_number - type: long - description: Employee Identification Numbers only - - name: found - type: keyword - description: This is used to capture the results of regex match - - name: language - type: keyword - description: This is used to capture list of languages the client support and what it prefers - - name: lifetime - type: long - description: This key is used to capture the session lifetime in seconds. - - name: link - type: keyword - description: This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: match - type: keyword - description: This key is for regex match name from search.ini - - name: param_dst - type: keyword - description: This key captures the command line/launch argument of the target process or file - - name: param_src - type: keyword - description: This key captures source parameter - - name: search_text - type: keyword - description: This key captures the Search Text used - - name: sig_name - type: keyword - description: This key is used to capture the Signature Name only. - - name: snmp_value - type: keyword - description: SNMP set request value - - name: streams - type: long - description: This key captures number of streams in session - - name: db - type: group - fields: - - name: index - type: keyword - description: This key captures IndexID of the index. - - name: instance - type: keyword - description: This key is used to capture the database server instance name - - name: database - type: keyword - description: This key is used to capture the name of a database or an instance as seen in a session - - name: transact_id - type: keyword - description: This key captures the SQL transantion ID of the current session - - name: permissions - type: keyword - description: This key captures permission or privilege level assigned to a resource. - - name: table_name - type: keyword - description: This key is used to capture the table name - - name: db_id - type: keyword - description: This key is used to capture the unique identifier for a database - - name: db_pid - type: long - description: This key captures the process id of a connection with database server - - name: lread - type: long - description: This key is used for the number of logical reads - - name: lwrite - type: long - description: This key is used for the number of logical writes - - name: pread - type: long - description: This key is used for the number of physical writes - - name: network - type: group - fields: - - name: alias_host - type: keyword - description: This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - - name: domain - type: keyword - - name: host_dst - type: keyword - description: "This key should only be used when it’s a Destination Hostname" - - name: network_service - type: keyword - description: This is used to capture layer 7 protocols/service names - - name: interface - type: keyword - description: This key should be used when the source or destination context of an interface is not clear - - name: network_port - type: long - description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' - - name: eth_host - type: keyword - description: Deprecated, use alias.mac - - name: sinterface - type: keyword - description: "This key should only be used when it’s a Source Interface" - - name: dinterface - type: keyword - description: "This key should only be used when it’s a Destination Interface" - - name: vlan - type: long - description: This key should only be used to capture the ID of the Virtual LAN - - name: zone_src - type: keyword - description: "This key should only be used when it’s a Source Zone." - - name: zone - type: keyword - description: This key should be used when the source or destination context of a Zone is not clear - - name: zone_dst - type: keyword - description: "This key should only be used when it’s a Destination Zone." - - name: gateway - type: keyword - description: This key is used to capture the IP Address of the gateway - - name: icmp_type - type: long - description: This key is used to capture the ICMP type only - - name: mask - type: keyword - description: This key is used to capture the device network IPmask. - - name: icmp_code - type: long - description: This key is used to capture the ICMP code only - - name: protocol_detail - type: keyword - description: This key should be used to capture additional protocol information - - name: dmask - type: keyword - description: This key is used for Destionation Device network mask - - name: port - type: long - description: This key should only be used to capture a Network Port when the directionality is not clear - - name: smask - type: keyword - description: This key is used for capturing source Network Mask - - name: netname - type: keyword - description: This key is used to capture the network name associated with an IP range. This is configured by the end user. - - name: paddr - type: ip - description: Deprecated - - name: faddr - type: keyword - - name: lhost - type: keyword - - name: origin - type: keyword - - name: remote_domain_id - type: keyword - - name: addr - type: keyword - - name: dns_a_record - type: keyword - - name: dns_ptr_record - type: keyword - - name: fhost - type: keyword - - name: fport - type: keyword - - name: laddr - type: keyword - - name: linterface - type: keyword - - name: phost - type: keyword - - name: ad_computer_dst - type: keyword - description: Deprecated, use host.dst - - name: eth_type - type: long - description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - - name: ip_proto - type: long - description: This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - - name: dns_cname_record - type: keyword - - name: dns_id - type: keyword - - name: dns_opcode - type: keyword - - name: dns_resp - type: keyword - - name: dns_type - type: keyword - - name: domain1 - type: keyword - - name: host_type - type: keyword - - name: packet_length - type: keyword - - name: host_orig - type: keyword - description: This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - - name: rpayload - type: keyword - description: This key is used to capture the total number of payload bytes seen in the retransmitted packets. - - name: vlan_name - type: keyword - description: This key should only be used to capture the name of the Virtual LAN - - name: investigations - type: group - fields: - - name: ec_activity - type: keyword - description: This key captures the particular event activity(Ex:Logoff) - - name: ec_theme - type: keyword - description: This key captures the Theme of a particular Event(Ex:Authentication) - - name: ec_subject - type: keyword - description: This key captures the Subject of a particular Event(Ex:User) - - name: ec_outcome - type: keyword - description: This key captures the outcome of a particular Event(Ex:Success) - - name: event_cat - type: long - description: This key captures the Event category number - - name: event_cat_name - type: keyword - description: This key captures the event category name corresponding to the event cat code - - name: event_vcat - type: keyword - description: This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - - name: analysis_file - type: keyword - description: This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - - name: analysis_service - type: keyword - description: This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - - name: analysis_session - type: keyword - description: This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - - name: boc - type: keyword - description: This is used to capture behaviour of compromise - - name: eoc - type: keyword - description: This is used to capture Enablers of Compromise - - name: inv_category - type: keyword - description: This used to capture investigation category - - name: inv_context - type: keyword - description: This used to capture investigation context - - name: ioc - type: keyword - description: This is key capture indicator of compromise - - name: counters - type: group - fields: - - name: dclass_c1 - type: long - description: This is a generic counter key that should be used with the label dclass.c1.str only - - name: dclass_c2 - type: long - description: This is a generic counter key that should be used with the label dclass.c2.str only - - name: event_counter - type: long - description: This is used to capture the number of times an event repeated - - name: dclass_r1 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r1.str only - - name: dclass_c3 - type: long - description: This is a generic counter key that should be used with the label dclass.c3.str only - - name: dclass_c1_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c1 only - - name: dclass_c2_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c2 only - - name: dclass_r1_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r1 only - - name: dclass_r2 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r2.str only - - name: dclass_c3_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c3 only - - name: dclass_r3 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r3.str only - - name: dclass_r2_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r2 only - - name: dclass_r3_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r3 only - - name: identity - type: group - fields: - - name: auth_method - type: keyword - description: This key is used to capture authentication methods used only - - name: user_role - type: keyword - description: This key is used to capture the Role of a user only - - name: dn - type: keyword - description: X.500 (LDAP) Distinguished Name - - name: logon_type - type: keyword - description: This key is used to capture the type of logon method used. - - name: profile - type: keyword - description: This key is used to capture the user profile - - name: accesses - type: keyword - description: This key is used to capture actual privileges used in accessing an object - - name: realm - type: keyword - description: Radius realm or similar grouping of accounts - - name: user_sid_dst - type: keyword - description: This key captures Destination User Session ID - - name: dn_src - type: keyword - description: An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - - name: org - type: keyword - description: This key captures the User organization - - name: dn_dst - type: keyword - description: An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - - name: firstname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: lastname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: user_dept - type: keyword - description: User's Department Names only - - name: user_sid_src - type: keyword - description: This key captures Source User Session ID - - name: federated_sp - type: keyword - description: This key is the Federated Service Provider. This is the application requesting authentication. - - name: federated_idp - type: keyword - description: This key is the federated Identity Provider. This is the server providing the authentication. - - name: logon_type_desc - type: keyword - description: This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - - name: middlename - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: password - type: keyword - description: This key is for Passwords seen in any session, plain text or encrypted - - name: host_role - type: keyword - description: This key should only be used to capture the role of a Host Machine - - name: ldap - type: keyword - description: "This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context" - - name: ldap_query - type: keyword - description: This key is the Search criteria from an LDAP search - - name: ldap_response - type: keyword - description: This key is to capture Results from an LDAP search - - name: owner - type: keyword - description: This is used to capture username the process or service is running as, the author of the task - - name: service_account - type: keyword - description: This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - - name: email - type: group - fields: - - name: email_dst - type: keyword - description: This key is used to capture the Destination email address only, when the destination context is not clear use email - - name: email_src - type: keyword - description: This key is used to capture the source email address only, when the source context is not clear use email - - name: subject - type: keyword - description: This key is used to capture the subject string from an Email only. - - name: email - type: keyword - description: This key is used to capture a generic email address where the source or destination context is not clear - - name: trans_from - type: keyword - description: Deprecated key defined only in table map. - - name: trans_to - type: keyword - description: Deprecated key defined only in table map. - - name: file - type: group - fields: - - name: privilege - type: keyword - description: Deprecated, use permissions - - name: attachment - type: keyword - description: This key captures the attachment file name - - name: filesystem - type: keyword - - name: binary - type: keyword - description: Deprecated key defined only in table map. - - name: filename_dst - type: keyword - description: This is used to capture name of the file targeted by the action - - name: filename_src - type: keyword - description: This is used to capture name of the parent filename, the file which performed the action - - name: filename_tmp - type: keyword - - name: directory_dst - type: keyword - description: This key is used to capture the directory of the target process or file - - name: directory_src - type: keyword - description: This key is used to capture the directory of the source process or file - - name: file_entropy - type: double - description: This is used to capture entropy vale of a file - - name: file_vendor - type: keyword - description: This is used to capture Company name of file located in version_info - - name: task_name - type: keyword - description: This is used to capture name of the task - - name: web - type: group - fields: - - name: fqdn - type: keyword - description: Fully Qualified Domain Names - - name: web_cookie - type: keyword - description: This key is used to capture the Web cookies specifically. - - name: alias_host - type: keyword - - name: reputation_num - type: double - description: Reputation Number of an entity. Typically used for Web Domains - - name: web_ref_domain - type: keyword - description: Web referer's domain - - name: web_ref_query - type: keyword - description: This key captures Web referer's query portion of the URL - - name: remote_domain - type: keyword - - name: web_ref_page - type: keyword - description: This key captures Web referer's page information - - name: web_ref_root - type: keyword - description: Web referer's root URL path - - name: cn_asn_dst - type: keyword - - name: cn_rpackets - type: keyword - - name: urlpage - type: keyword - - name: urlroot - type: keyword - - name: p_url - type: keyword - - name: p_user_agent - type: keyword - - name: p_web_cookie - type: keyword - - name: p_web_method - type: keyword - - name: p_web_referer - type: keyword - - name: web_extension_tmp - type: keyword - - name: web_page - type: keyword - - name: threat - type: group - fields: - - name: threat_category - type: keyword - description: This key captures Threat Name/Threat Category/Categorization of alert - - name: threat_desc - type: keyword - description: This key is used to capture the threat description from the session directly or inferred - - name: alert - type: keyword - description: This key is used to capture name of the alert - - name: threat_source - type: keyword - description: This key is used to capture source of the threat - - name: crypto - type: group - fields: - - name: crypto - type: keyword - description: This key is used to capture the Encryption Type or Encryption Key only - - name: cipher_src - type: keyword - description: This key is for Source (Client) Cipher - - name: cert_subject - type: keyword - description: This key is used to capture the Certificate organization only - - name: peer - type: keyword - description: This key is for Encryption peer's IP Address - - name: cipher_size_src - type: long - description: This key captures Source (Client) Cipher Size - - name: ike - type: keyword - description: IKE negotiation phase. - - name: scheme - type: keyword - description: This key captures the Encryption scheme used - - name: peer_id - type: keyword - description: "This key is for Encryption peer’s identity" - - name: sig_type - type: keyword - description: This key captures the Signature Type - - name: cert_issuer - type: keyword - - name: cert_host_name - type: keyword - description: Deprecated key defined only in table map. - - name: cert_error - type: keyword - description: This key captures the Certificate Error String - - name: cipher_dst - type: keyword - description: This key is for Destination (Server) Cipher - - name: cipher_size_dst - type: long - description: This key captures Destination (Server) Cipher Size - - name: ssl_ver_src - type: keyword - description: Deprecated, use version - - name: d_certauth - type: keyword - - name: s_certauth - type: keyword - - name: ike_cookie1 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase One" - - name: ike_cookie2 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase Two" - - name: cert_checksum - type: keyword - - name: cert_host_cat - type: keyword - description: This key is used for the hostname category value of a certificate - - name: cert_serial - type: keyword - description: This key is used to capture the Certificate serial number only - - name: cert_status - type: keyword - description: This key captures Certificate validation status - - name: ssl_ver_dst - type: keyword - description: Deprecated, use version - - name: cert_keysize - type: keyword - - name: cert_username - type: keyword - - name: https_insact - type: keyword - - name: https_valid - type: keyword - - name: cert_ca - type: keyword - description: This key is used to capture the Certificate signing authority only - - name: cert_common - type: keyword - description: This key is used to capture the Certificate common name only - - name: wireless - type: group - fields: - - name: wlan_ssid - type: keyword - description: This key is used to capture the ssid of a Wireless Session - - name: access_point - type: keyword - description: This key is used to capture the access point name. - - name: wlan_channel - type: long - description: This is used to capture the channel names - - name: wlan_name - type: keyword - description: This key captures either WLAN number/name - - name: storage - type: group - fields: - - name: disk_volume - type: keyword - description: A unique name assigned to logical units (volumes) within a physical disk - - name: lun - type: keyword - description: Logical Unit Number.This key is a very useful concept in Storage. - - name: pwwn - type: keyword - description: This uniquely identifies a port on a HBA. - - name: physical - type: group - fields: - - name: org_dst - type: keyword - description: This is used to capture the destination organization based on the GEOPIP Maxmind database. - - name: org_src - type: keyword - description: This is used to capture the source organization based on the GEOPIP Maxmind database. - - name: healthcare - type: group - fields: - - name: patient_fname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_id - type: keyword - description: This key captures the unique ID for a patient - - name: patient_lname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_mname - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: endpoint - type: group - fields: - - name: host_state - type: keyword - description: This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - - name: registry_key - type: keyword - description: This key captures the path to the registry key - - name: registry_value - type: keyword - description: This key captures values or decorators used within a registry entry -- name: dns.question.domain - type: keyword - ignore_above: 1024 - description: Server domain. -- name: network.interface.name - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/netscreen/manifest.yml b/packages/juniper/1.1.0/data_stream/netscreen/manifest.yml deleted file mode 100755 index c091c6e06e..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/manifest.yml +++ /dev/null @@ -1,205 +0,0 @@ -title: Netscreen logs -release: experimental -type: logs -streams: - - input: udp - title: Netscreen logs - description: Collect Netscreen logs - template_path: udp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-netscreen - - forwarded - - name: udp_host - type: text - title: UDP host to listen on - multi: false - required: true - show_user: true - default: localhost - - name: udp_port - type: integer - title: UDP port to listen on - multi: false - required: true - show_user: true - default: 9523 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: tcp - title: Netscreen logs - description: Collect Netscreen logs - template_path: tcp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-netscreen - - forwarded - - name: tcp_host - type: text - title: TCP host to listen on - multi: false - required: true - show_user: true - default: localhost - - name: tcp_port - type: integer - title: TCP port to listen on - multi: false - required: true - show_user: true - default: 9523 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: logfile - enabled: false - title: Netscreen logs - description: Collect Netscreen logs from file - template_path: logfile.yml.hbs - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/juniper-netscreen.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-netscreen - - forwarded - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/juniper/1.1.0/data_stream/netscreen/sample_event.json b/packages/juniper/1.1.0/data_stream/netscreen/sample_event.json deleted file mode 100755 index 09fd125dac..0000000000 --- a/packages/juniper/1.1.0/data_stream/netscreen/sample_event.json +++ /dev/null @@ -1,61 +0,0 @@ -{ - "@timestamp": "2016-01-29T06:09:59.000Z", - "agent": { - "ephemeral_id": "7fac277a-278c-4dfd-baba-dd447e01094c", - "hostname": "docker-fleet-agent", - "id": "0a0be70a-90aa-494d-8be3-b06a8a05e08c", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "juniper.netscreen", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "1.12.0" - }, - "elastic_agent": { - "id": "0a0be70a-90aa-494d-8be3-b06a8a05e08c", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "code": "00628", - "dataset": "juniper.netscreen", - "ingested": "2022-01-25T08:50:17Z", - "timezone": "+00:00" - }, - "input": { - "type": "udp" - }, - "log": { - "level": "low", - "source": { - "address": "172.19.0.4:42674" - } - }, - "observer": { - "product": "Netscreen", - "type": "Firewall", - "vendor": "Juniper" - }, - "rsa": { - "internal": { - "messageid": "00628" - }, - "misc": { - "hardware_id": "olab", - "severity": "low" - }, - "time": { - "event_time": "2016-01-29T06:09:59.000Z" - } - }, - "tags": [ - "juniper-netscreen", - "forwarded" - ] -} \ No newline at end of file diff --git a/packages/juniper/1.1.0/data_stream/srx/agent/stream/logfile.yml.hbs b/packages/juniper/1.1.0/data_stream/srx/agent/stream/logfile.yml.hbs deleted file mode 100755 index 9fd98fa47e..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/agent/stream/logfile.yml.hbs +++ /dev/null @@ -1,20 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/srx/agent/stream/tcp.yml.hbs b/packages/juniper/1.1.0/data_stream/srx/agent/stream/tcp.yml.hbs deleted file mode 100755 index 0696ac9d89..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,16 +0,0 @@ -host: "{{syslog_host}}:{{syslog_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/srx/agent/stream/udp.yml.hbs b/packages/juniper/1.1.0/data_stream/srx/agent/stream/udp.yml.hbs deleted file mode 100755 index 0696ac9d89..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,16 +0,0 @@ -host: "{{syslog_host}}:{{syslog_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- add_locale: ~ diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/atp.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/atp.yml deleted file mode 100755 index 44d01d3639..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/atp.yml +++ /dev/null @@ -1,364 +0,0 @@ ---- -description: Pipeline for parsing junipersrx firewall logs (atp pipeline) -processors: -####################### -## ECS Event Mapping ## -####################### -- set: - field: event.kind - value: event -- set: - field: event.outcome - value: success - if: "ctx.juniper?.srx?.tag != null" -- append: - field: event.category - value: network -- set: - field: event.kind - value: alert - if: '["SRX_AAMW_ACTION_LOG", "AAMW_MALWARE_EVENT_LOG", "AAMW_HOST_INFECTED_EVENT_LOG", "AAMW_ACTION_LOG"].contains(ctx.juniper?.srx?.tag) && ctx.juniper?.srx?.action != "PERMIT"' -- append: - field: event.category - value: malware - if: '["SRX_AAMW_ACTION_LOG", "AAMW_MALWARE_EVENT_LOG", "AAMW_HOST_INFECTED_EVENT_LOG", "AAMW_ACTION_LOG"].contains(ctx.juniper?.srx?.tag) && ctx.juniper?.srx?.action != "PERMIT"' -- append: - field: event.type - value: - - info - - denied - - connection - if: "ctx.juniper?.srx?.action == 'BLOCK' || ctx.juniper?.srx?.tag == 'AAMW_MALWARE_EVENT_LOG'" -- append: - field: event.type - value: - - allowed - - connection - if: "ctx.juniper?.srx?.action != 'BLOCK' && ctx.juniper?.srx?.tag != 'AAMW_MALWARE_EVENT_LOG'" -- set: - field: event.action - value: malware_detected - if: "ctx.juniper?.srx?.action == 'BLOCK' || ctx.juniper?.srx?.tag == 'AAMW_MALWARE_EVENT_LOG'" - - -#################################### -## ECS Server/Destination Mapping ## -#################################### -- rename: - field: juniper.srx.destination_address - target_field: destination.ip - ignore_missing: true - if: "ctx.juniper?.srx?.destination_address != null" -- set: - field: server.ip - value: '{{destination.ip}}' - if: "ctx.destination?.ip != null" -- rename: - field: juniper.srx.nat_destination_address - target_field: destination.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_address != null" -- convert: - field: juniper.srx.destination_port - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.destination_port != null" -- set: - field: server.port - value: '{{destination.port}}' - if: "ctx.destination?.port != null" -- convert: - field: server.port - target_field: server.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.port != null" -- convert: - field: juniper.srx.nat_destination_port - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_port != null" -- set: - field: server.nat.port - value: '{{destination.nat.port}}' - if: "ctx.destination?.nat?.port != null" -- convert: - field: server.nat.port - target_field: server.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_server - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_server != null" -- set: - field: server.bytes - value: '{{destination.bytes}}' - if: "ctx.destination?.bytes != null" -- convert: - field: server.bytes - target_field: server.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.bytes != null" -- convert: - field: juniper.srx.packets_from_server - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_server != null" -- set: - field: server.packets - value: '{{destination.packets}}' - if: "ctx.destination?.packets != null" -- convert: - field: server.packets - target_field: server.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.packets != null" - -############################### -## ECS Client/Source Mapping ## -############################### -- rename: - field: juniper.srx.source_address - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.source_address != null" -- set: - field: client.ip - value: '{{source.ip}}' - if: "ctx.source?.ip != null" -- rename: - field: juniper.srx.nat_source_address - target_field: source.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_address != null" -- rename: - field: juniper.srx.sourceip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.sourceip != null" -- convert: - field: juniper.srx.source_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.source_port != null" -- set: - field: client.port - value: '{{source.port}}' - if: "ctx.source?.port != null" -- convert: - field: client.port - target_field: client.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.port != null" -- convert: - field: juniper.srx.nat_source_port - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_port != null" -- set: - field: client.nat.port - value: '{{source.nat.port}}' - if: "ctx.source?.nat?.port != null" -- convert: - field: client.nat.port - target_field: client.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_client - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_client != null" -- set: - field: client.bytes - value: '{{source.bytes}}' - if: "ctx.source?.bytes != null" -- convert: - field: client.bytes - target_field: client.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.bytes != null" -- convert: - field: juniper.srx.packets_from_client - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_client != null" -- set: - field: client.packets - value: '{{source.packets}}' - if: "ctx.source?.packets != null" -- convert: - field: client.packets - target_field: client.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.packets != null" -- rename: - field: juniper.srx.username - target_field: source.user.name - ignore_missing: true - if: "ctx.juniper?.srx?.username != null" -- rename: - field: juniper.srx.hostname - target_field: source.domain - ignore_missing: true - if: "ctx.juniper?.srx?.hostname != null" -- rename: - field: juniper.srx.client_ip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.client_ip != null" - -###################### -## ECS URL Mapping ## -###################### -- rename: - field: juniper.srx.http_host - target_field: url.domain - ignore_missing: true - if: "ctx.juniper?.srx?.http_host != null" - -############################# -## ECS Network/Geo Mapping ## -############################# -- rename: - field: juniper.srx.protocol_id - target_field: network.iana_number - ignore_missing: true - if: "ctx.juniper?.srx?.protocol_id != null" -- geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - field: source.nat.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.nat.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.nat.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.source?.as == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.nat.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.destination?.as == null" -- rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true -- rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true -- rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true -- rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true -############### -## Timestamp ## -############### -- date: - if: 'ctx.juniper.srx?.timestamp != null' - field: juniper.srx.timestamp - target_field: juniper.srx.timestamp - formats: - - 'EEE MMM dd HH:mm:ss yyyy' - - 'EEE MMM d HH:mm:ss yyyy' - on_failure: - - remove: - field: - - juniper.srx.timestamp - -############# -## Cleanup ## -############# -- remove: - field: - - juniper.srx.destination_port - - juniper.srx.nat_destination_port - - juniper.srx.bytes_from_client - - juniper.srx.packets_from_client - - juniper.srx.source_port - - juniper.srx.nat_source_port - - juniper.srx.bytes_from_server - - juniper.srx.packets_from_server - ignore_missing: true - -on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/default.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 891dd4c68f..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,298 +0,0 @@ ---- -# This module only supports syslog messages in the format "structured-data + brief" -# https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/structured-data-edit-system.html -description: Pipeline for parsing junipersrx firewall logs -processors: - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - grok: - field: event.original - patterns: - - '^<%{POSINT:syslog_pri}>(\d{1,3}\s)?(?:%{TIMESTAMP_ISO8601:_temp_.raw_date})\s%{SYSLOGHOST:syslog_hostname}\s%{PROG:syslog_program}\s(?:%{POSINT:syslog_pid}|-)?\s%{WORD:log_type}\s\[.+?\s%{GREEDYDATA:_temp_.original}\]$' - -# split Juniper-SRX fields - - kv: - field: _temp_.original - field_split: " (?=[a-z0-9\\_\\-]+=)" - value_split: "=" - prefix: "juniper.srx." - ignore_missing: true - ignore_failure: false - trim_value: "\"" - -# Converts all kebab-case key names to snake_case - - script: - lang: painless - source: >- - ctx.juniper.srx = ctx?.juniper?.srx.entrySet().stream().collect(Collectors.toMap(e -> e.getKey().replace('-', '_'), e -> e.getValue())); - -# -# Parse the date -# - - date: - if: "ctx?.event?.timezone == null" - field: _temp_.raw_date - target_field: "@timestamp" - formats: - - yyyy-MM-dd HH:mm:ss - - yyyy-MM-dd HH:mm:ss z - - yyyy-MM-dd HH:mm:ss Z - - ISO8601 - - date: - if: "ctx?.event?.timezone != null" - timezone: "{{ event.timezone }}" - field: _temp_.raw_date - target_field: "@timestamp" - formats: - - yyyy-MM-dd HH:mm:ss - - yyyy-MM-dd HH:mm:ss z - - yyyy-MM-dd HH:mm:ss Z - - ISO8601 - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - -# Can possibly be omitted if there is a solution for the equal signs and the calculation of the start time. -# -> juniper.srx.elapsed_time - - rename: - field: juniper.srx.elapsed_time - target_field: juniper.srx.duration - if: "ctx?.juniper?.srx?.elapsed_time != null" - -# Sets starts, end and duration when start and duration is known - - script: - lang: painless - if: ctx?.juniper?.srx?.duration != null - source: >- - ctx.event.duration = Integer.parseInt(ctx.juniper.srx.duration) * 1000000000L; - ctx.event.start = ctx['@timestamp']; - ZonedDateTime start = ZonedDateTime.parse(ctx.event.start); - ctx.event.end = start.plus(ctx.event.duration, ChronoUnit.NANOS); - -# Removes all empty fields - - script: - lang: painless - params: - values: - - "None" - - "UNKNOWN" - - "N/A" - - "-" - source: >- - ctx?.juniper?.srx.entrySet().removeIf(entry -> params.values.contains(entry.getValue())); - -####################### -## ECS Event Mapping ## -####################### - - convert: - field: syslog_pri - type: long - target_field: event.severity - ignore_failure: true - -##################### -## ECS Log Mapping ## -##################### -# https://www.juniper.net/documentation/en_US/junos/topics/reference/general/syslog-interpreting-msg-generated-structured-data-format.html#fac_sev_codes - - set: - field: "log.level" - if: '["0", "8", "16", "24", "32", "40", "48", "56", "64", "72", "80", "88", "96", "104", "112", "128", "136", "144", "152", "160", "168", "176", "184"].contains(ctx.syslog_pri)' - value: emergency - - set: - field: "log.level" - if: '["1", "9", "17", "25", "33", "41", "49", "57", "65", "73", "81", "89", "97", "105", "113", "129", "137", "145", "153", "161", "169", "177", "185"].contains(ctx.syslog_pri)' - value: alert - - set: - field: "log.level" - if: '["2", "10", "18", "26", "34", "42", "50", "58", "66", "74", "82", "90", "98", "106", "114", "130", "138", "146", "154", "162", "170", "178", "186"].contains(ctx.syslog_pri)' - value: critical - - set: - field: "log.level" - if: '["3", "11", "19", "27", "35", "43", "51", "59", "67", "75", "83", "91", "99", "107", "115", "131", "139", "147", "155", "163", "171", "179", "187"].contains(ctx.syslog_pri)' - value: error - - set: - field: "log.level" - if: '["4", "12", "20", "28", "36", "44", "52", "60", "68", "76", "84", "92", "100", "108", "116", "132", "140", "148", "156", "164", "172", "180", "188"].contains(ctx.syslog_pri)' - value: warning - - set: - field: "log.level" - if: '["5", "13", "21", "29", "37", "45", "53", "61", "69", "77", "85", "93", "101", "109", "117", "133", "141", "149", "157", "165", "173", "181", "189"].contains(ctx.syslog_pri)' - value: notification - - set: - field: "log.level" - if: '["6", "14", "22", "30", "38", "46", "54", "62", "70", "78", "86", "94", "102", "110", "118", "134", "142", "150", "158", "166", "174", "182", "190"].contains(ctx.syslog_pri)' - value: informational - - set: - field: "log.level" - if: '["7", "15", "23", "31", "39", "47", "55", "63", "71", "79", "87", "95", "103", "111", "119", "135", "143", "151", "159", "167", "175", "183", "191"].contains(ctx.syslog_pri)' - value: debug - -########################## -## ECS Observer Mapping ## -########################## - - set: - field: observer.vendor - value: Juniper - - set: - field: observer.product - value: SRX - - set: - field: observer.type - value: firewall - - rename: - field: syslog_hostname - target_field: observer.name - ignore_missing: true - - rename: - field: juniper.srx.packet_incoming_interface - target_field: observer.ingress.interface.name - ignore_missing: true - - rename: - field: juniper.srx.destination_interface_name - target_field: observer.egress.interface.name - ignore_missing: true - - rename: - field: juniper.srx.source_interface_name - target_field: observer.ingress.interface.name - ignore_missing: true - - rename: - field: juniper.srx.interface_name - target_field: observer.ingress.interface.name - ignore_missing: true - - rename: - field: juniper.srx.source_zone_name - target_field: observer.ingress.zone - ignore_missing: true - - rename: - field: juniper.srx.source_zone - target_field: observer.ingress.zone - ignore_missing: true - - rename: - field: juniper.srx.destination_zone_name - target_field: observer.egress.zone - ignore_missing: true - - rename: - field: juniper.srx.destination_zone - target_field: observer.egress.zone - ignore_missing: true - - rename: - field: syslog_program - target_field: juniper.srx.process - ignore_missing: true - - rename: - field: log_type - target_field: juniper.srx.tag - ignore_missing: true - - -############# -## Cleanup ## -############# - - remove: - field: - - message - - _temp_ - - juniper.srx.duration - - juniper.srx.dir_disp - - juniper.srx.srczone - - juniper.srx.dstzone - - juniper.srx.duration - - syslog_pri - ignore_missing: true - -################################ -## Product Specific Pipelines ## -################################ - - pipeline: - name: '{{ IngestPipeline "flow" }}' - if: "ctx.juniper?.srx?.process == 'RT_FLOW'" - - pipeline: - name: '{{ IngestPipeline "utm" }}' - if: "ctx.juniper?.srx?.process == 'RT_UTM'" - - pipeline: - name: '{{ IngestPipeline "idp" }}' - if: "ctx.juniper?.srx?.process == 'RT_IDP'" - - pipeline: - name: '{{ IngestPipeline "ids" }}' - if: "ctx.juniper?.srx?.process == 'RT_IDS'" - - pipeline: - name: '{{ IngestPipeline "atp" }}' - if: "ctx.juniper?.srx?.process == 'RT_AAMW'" - - pipeline: - name: '{{ IngestPipeline "secintel" }}' - if: "ctx.juniper?.srx?.process == 'RT_SECINTEL'" - -######################### -## ECS Related Mapping ## -######################### - - append: - if: 'ctx.source?.ip != null' - field: related.ip - value: '{{source.ip}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx.destination?.ip != null' - field: related.ip - value: '{{destination.ip}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx.source?.nat?.ip != null' - field: related.ip - value: '{{source.nat.ip}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx?.destination?.nat?.ip != null' - field: related.ip - value: '{{destination.nat.ip}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx.url?.domain != null' - field: related.hosts - value: '{{url.domain}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx.source?.domain != null' - field: related.hosts - value: '{{source.domain}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx.destination?.domain != null' - field: related.hosts - value: '{{destination.domain}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx?.source?.user?.name != null' - field: related.user - value: '{{source.user.name}}' - ignore_failure: true - allow_duplicates: false - - append: - if: 'ctx?.destination?.user?.name != null' - field: related.user - value: '{{destination.user.name}}' - ignore_failure: true - allow_duplicates: false - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/flow.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/flow.yml deleted file mode 100755 index bf9fcbeb05..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/flow.yml +++ /dev/null @@ -1,363 +0,0 @@ ---- -description: Pipeline for parsing junipersrx firewall logs (flow pipeline) -processors: -####################### -## ECS Event Mapping ## -####################### -- set: - field: event.kind - value: event -- set: - field: event.outcome - value: success - if: "ctx.juniper?.srx?.tag != null" -- append: - field: event.category - value: network -- convert: - field: juniper.srx.application_risk - type: float - target_field: event.risk_score - ignore_missing: true - ignore_failure: true -- append: - field: event.type - value: - - start - - allowed - - connection - if: "ctx.juniper?.srx?.tag.endsWith('CREATE') || ctx.juniper?.srx?.tag.endsWith('UPDATE') || ctx.juniper?.srx?.tag.endsWith('CREATE_LS') || ctx.juniper?.srx?.tag.endsWith('UPDATE_LS')" -- append: - field: event.type - value: - - end - - allowed - - connection - if: "ctx.juniper?.srx?.tag.endsWith('CLOSE') || ctx.juniper?.srx?.tag.endsWith('CLOSE_LS')" -- append: - field: event.type - value: - - denied - - connection - if: "ctx.juniper?.srx?.tag.endsWith('DENY') || ctx.juniper?.srx?.tag.endsWith('DENY_LS')" -- set: - field: event.action - value: flow_started - if: "ctx.juniper?.srx?.tag.endsWith('CREATE') || ctx.juniper?.srx?.tag.endsWith('UPDATE') || ctx.juniper?.srx?.tag.endsWith('CREATE_LS') || ctx.juniper?.srx?.tag.endsWith('UPDATE_LS')" -- set: - field: event.action - value: flow_close - if: "ctx.juniper?.srx?.tag.endsWith('CLOSE') || ctx.juniper?.srx?.tag.endsWith('CLOSE_LS')" -- set: - field: event.action - value: flow_deny - if: "ctx.juniper?.srx?.tag.endsWith('DENY') || ctx.juniper?.srx?.tag.endsWith('DENY_LS')" - -#################################### -## ECS Server/Destination Mapping ## -#################################### -- rename: - field: juniper.srx.destination_address - target_field: destination.ip - ignore_missing: true - if: "ctx.juniper?.srx?.destination_address != null" -- set: - field: server.ip - value: '{{destination.ip}}' - if: "ctx.destination?.ip != null" -- rename: - field: juniper.srx.nat_destination_address - target_field: destination.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_address != null" -- convert: - field: juniper.srx.destination_port - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.destination_port != null" -- set: - field: server.port - value: '{{destination.port}}' - if: "ctx?.destination?.port != null" -- convert: - field: server.port - target_field: server.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.port != null" -- convert: - field: juniper.srx.nat_destination_port - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_port != null" -- set: - field: server.nat.port - value: '{{destination.nat.port}}' - if: "ctx.destination?.nat?.port != null" -- convert: - field: server.nat.port - target_field: server.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_server - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_server != null" -- set: - field: server.bytes - value: '{{destination.bytes}}' - if: "ctx.destination?.bytes != null" -- convert: - field: server.bytes - target_field: server.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.bytes != null" -- convert: - field: juniper.srx.packets_from_server - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_server != null" -- set: - field: server.packets - value: '{{destination.packets}}' - if: "ctx.destination?.packets != null" -- convert: - field: server.packets - target_field: server.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.packets != null" - -############################### -## ECS Client/Source Mapping ## -############################### -- rename: - field: juniper.srx.source_address - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.source_address != null" -- set: - field: client.ip - value: '{{source.ip}}' - if: "ctx.source?.ip != null" -- rename: - field: juniper.srx.nat_source_address - target_field: source.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_address != null" -- rename: - field: juniper.srx.sourceip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.sourceip != null" -- convert: - field: juniper.srx.source_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.source_port != null" -- set: - field: client.port - value: '{{source.port}}' - if: "ctx.source?.port != null" -- convert: - field: client.port - target_field: client.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.port != null" -- convert: - field: juniper.srx.nat_source_port - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_port != null" -- set: - field: client.nat.port - value: '{{source.nat.port}}' - if: "ctx.source?.nat?.port != null" -- convert: - field: client.nat.port - target_field: client.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_client - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_client != null" -- set: - field: client.bytes - value: '{{source.bytes}}' - if: "ctx.source?.bytes != null" -- convert: - field: client.bytes - target_field: client.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.bytes != null" -- convert: - field: juniper.srx.packets_from_client - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_client != null" -- set: - field: client.packets - value: '{{source.packets}}' - if: "ctx.source?.packets != null" -- convert: - field: client.packets - target_field: client.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.packets != null" -- rename: - field: juniper.srx.username - target_field: source.user.name - ignore_missing: true - if: "ctx.juniper?.srx?.username != null" - -###################### -## ECS Rule Mapping ## -###################### -- rename: - field: juniper.srx.policy_name - target_field: rule.name - ignore_missing: true - if: "ctx.juniper?.srx?.policy_name != null" - -############################# -## ECS Network/Geo Mapping ## -############################# -- rename: - field: juniper.srx.protocol_id - target_field: network.iana_number - ignore_missing: true - if: "ctx.juniper?.srx?.protocol_id != null" -- geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - field: source.nat.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.nat.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.nat.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.source?.as == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.nat.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.destination?.as == null" -- rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true -- rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true -- rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true -- rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true -- script: - lang: painless - source: "ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes" - if: "ctx?.source?.bytes != null && ctx?.destination?.bytes != null" - ignore_failure: true -- script: - lang: painless - source: "ctx.network.packets = ctx.client.packets + ctx.server.packets" - if: "ctx?.client?.packets != null && ctx?.server?.packets != null" - ignore_failure: true - -############# -## Cleanup ## -############# -- remove: - field: - - juniper.srx.application_risk - - juniper.srx.destination_port - - juniper.srx.nat_destination_port - - juniper.srx.bytes_from_client - - juniper.srx.packets_from_client - - juniper.srx.source_port - - juniper.srx.nat_source_port - - juniper.srx.bytes_from_server - - juniper.srx.packets_from_server - ignore_missing: true - -on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/idp.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/idp.yml deleted file mode 100755 index 0b26118a9f..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/idp.yml +++ /dev/null @@ -1,288 +0,0 @@ ---- -description: Pipeline for parsing junipersrx firewall logs (idp pipeline) -processors: -####################### -## ECS Event Mapping ## -####################### -- set: - field: event.kind - value: event -- set: - field: event.outcome - value: success - if: "ctx.juniper?.srx?.tag != null" -- append: - field: event.category - value: network -- set: - field: event.kind - value: alert - if: '["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.category - value: intrusion_detection - if: '["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.type - value: - - info - - denied - - connection - if: '["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.type - value: - - allowed - - connection - if: '!["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: application_ddos - if: '["IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: security_threat - if: '["IDP_ATTACK_LOG_EVENT", "IDP_ATTACK_LOG_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' - - -#################################### -## ECS Server/Destination Mapping ## -#################################### -- rename: - field: juniper.srx.destination_address - target_field: destination.ip - ignore_missing: true - if: "ctx.juniper?.srx?.destination_address != null" -- set: - field: server.ip - value: '{{destination.ip}}' - if: "ctx.destination?.ip != null" -- rename: - field: juniper.srx.nat_destination_address - target_field: destination.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_address != null" -- convert: - field: juniper.srx.destination_port - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.destination_port != null" -- set: - field: server.port - value: '{{destination.port}}' - if: "ctx.destination?.port != null" -- convert: - field: server.port - target_field: server.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.port != null" -- convert: - field: juniper.srx.nat_destination_port - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx['nat_destination_port'] != null" -- set: - field: server.nat.port - value: '{{destination.nat.port}}' - if: "ctx.destination?.nat?.port != null" -- convert: - field: server.nat.port - target_field: server.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.nat?.port != null" -- convert: - field: juniper.srx.inbound_bytes - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.inbound_bytes != null" -- set: - field: server.bytes - value: '{{destination.bytes}}' - if: "ctx.destination?.bytes != null" -- convert: - field: server.bytes - target_field: server.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.bytes != null" -- convert: - field: juniper.srx.inbound_packets - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.inbound_packets !=null" -- set: - field: server.packets - value: '{{destination.packets}}' - if: "ctx.destination?.packets != null" -- convert: - field: server.packets - target_field: server.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.packets != null" - -############################### -## ECS Client/Source Mapping ## -############################### -- rename: - field: juniper.srx.source_address - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.source_address != null" -- set: - field: client.ip - value: '{{source.ip}}' - if: "ctx.source?.ip != null" -- rename: - field: juniper.srx.nat_source_address - target_field: source.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_address != null" -- rename: - field: juniper.srx.sourceip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.sourceip != null" -- convert: - field: juniper.srx.source_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.source_port != null" -- set: - field: client.port - value: '{{source.port}}' - if: "ctx.source?.port != null" -- convert: - field: client.port - target_field: client.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.port != null" -- convert: - field: juniper.srx.nat_source_port - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_port != null" -- set: - field: client.nat.port - value: '{{source.nat.port}}' - if: "ctx.source?.nat?.port != null" -- convert: - field: client.nat.port - target_field: client.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.nat?.port != null" -- convert: - field: juniper.srx.outbound_bytes - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.outbound_bytes != null" -- set: - field: client.bytes - value: '{{source.bytes}}' - if: "ctx.source?.bytes != null" -- convert: - field: client.bytes - target_field: client.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.bytes != null" -- convert: - field: juniper.srx.outbound_packets - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.outbound_packets != null" -- set: - field: client.packets - value: '{{source.packets}}' - if: "ctx.source?.packets != null" -- convert: - field: client.packets - target_field: client.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.packets != null" -- rename: - field: juniper.srx.username - target_field: source.user.name - ignore_missing: true - if: "ctx.juniper?.srx?.username != null" - -###################### -## ECS Rule Mapping ## -###################### -- rename: - field: juniper.srx.rulebase_name - target_field: rule.name - ignore_missing: true - if: "ctx.juniper?.srx?.rulebase_name != null" -- rename: - field: juniper.srx.rule_name - target_field: rule.id - ignore_missing: true - if: "ctx.juniper?.srx?.rule_name != null" - -######################### -## ECS Network Mapping ## -######################### -- rename: - field: juniper.srx.protocol_name - target_field: network.protocol - ignore_missing: true - if: "ctx.juniper?.srx?.protocol_name != null" - -######################### -## ECS message Mapping ## -######################### -- rename: - field: juniper.srx.message - target_field: message - ignore_missing: true - if: "ctx.juniper?.srx?.message != null" - -############# -## Cleanup ## -############# -- remove: - field: - - juniper.srx.destination_port - - juniper.srx.nat_destination_port - - juniper.srx.outbound_bytes - - juniper.srx.outbound_packets - - juniper.srx.source_port - - juniper.srx.nat_source_port - - juniper.srx.inbound_bytes - - juniper.srx.inbound_packets - ignore_missing: true - -on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/ids.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/ids.yml deleted file mode 100755 index 9b39206834..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/ids.yml +++ /dev/null @@ -1,364 +0,0 @@ ---- -description: Pipeline for parsing junipersrx firewall logs (ids pipeline) -processors: -####################### -## ECS Event Mapping ## -####################### -- set: - field: event.kind - value: event -- set: - field: event.outcome - value: success - if: "ctx.juniper?.srx?.tag != null" -- append: - field: event.category - value: network -- set: - field: event.kind - value: alert - if: '["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.category - value: intrusion_detection - if: '["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.type - value: - - info - - denied - - connection - if: '["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.type - value: - - allowed - - connection - if: '!["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: flood_detected - if: '["ICMP flood!", "UDP flood!", "SYN flood!", "SYN flood Src-IP based!", "SYN flood Dst-IP based!"].contains(ctx.juniper?.srx?.attack_name)' -- set: - field: event.action - value: scan_detected - if: "ctx.juniper?.srx?.attack_name == 'TCP port scan!'" -- set: - field: event.action - value: sweep_detected - if: '["TCP sweep!", "IP sweep!", "UDP sweep!", "Address sweep!"].contains(ctx.juniper?.srx?.attack_name)' -- set: - field: event.action - value: fragment_detected - if: '["ICMP fragment!", "SYN fragment!"].contains(ctx.juniper?.srx?.attack_name)' -- set: - field: event.action - value: spoofing_detected - if: "ctx.juniper?.srx?.attack_name == 'IP spoofing!'" -- set: - field: event.action - value: session_limit_detected - if: '["Src IP session limit!", "Dst IP session limit!"].contains(ctx.juniper?.srx?.attack_name)' -- set: - field: event.action - value: attack_detected - if: '["Land attack!", "WinNuke attack!"].contains(ctx.juniper?.srx?.attack_name)' -- set: - field: event.action - value: illegal_tcp_flag_detected - if: '["No TCP flag!", "SYN and FIN bits!", "FIN but no ACK bit!"].contains(ctx.juniper?.srx?.attack_name)' -- set: - field: event.action - value: tunneling_screen - if: "ctx.juniper?.srx?.attack_name.startsWith('Tunnel')" - - -#################################### -## ECS Server/Destination Mapping ## -#################################### -- rename: - field: juniper.srx.destination_address - target_field: destination.ip - ignore_missing: true - if: "ctx.juniper?.srx?.destination_address != null" -- set: - field: server.ip - value: '{{destination.ip}}' - if: "ctx.destination?.ip != null" -- rename: - field: juniper.srx.nat_destination_address - target_field: destination.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_address != null" -- convert: - field: juniper.srx.destination_port - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.destination_port != null" -- set: - field: server.port - value: '{{destination.port}}' - if: "ctx.destination?.port != null" -- convert: - field: server.port - target_field: server.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.port != null" -- convert: - field: juniper.srx.nat_destination_port - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_port != null" -- set: - field: server.nat.port - value: '{{destination.nat.port}}' - if: "ctx.destination?.nat?.port != null" -- convert: - field: server.nat.port - target_field: server.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_server - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_server != null" -- set: - field: server.bytes - value: '{{destination.bytes}}' - if: "ctx.destination?.bytes != null" -- convert: - field: server.bytes - target_field: server.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.bytes != null" -- convert: - field: juniper.srx.packets_from_server - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_server !=null" -- set: - field: server.packets - value: '{{destination.packets}}' - if: "ctx.destination?.packets != null" -- convert: - field: server.packets - target_field: server.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.packets != null" - -############################### -## ECS Client/Source Mapping ## -############################### -- rename: - field: juniper.srx.source_address - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.source_address != null" -- set: - field: client.ip - value: '{{source.ip}}' - if: "ctx.source?.ip != null" -- rename: - field: juniper.srx.nat_source_address - target_field: source.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_address != null" -- rename: - field: juniper.srx.sourceip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.sourceip != null" -- convert: - field: juniper.srx.source_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.source_port != null" -- set: - field: client.port - value: '{{source.port}}' - if: "ctx.source?.port != null" -- convert: - field: client.port - target_field: client.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.port != null" -- convert: - field: juniper.srx.nat_source_port - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_port != null" -- set: - field: client.nat.port - value: '{{source.nat.port}}' - if: "ctx.source?.nat?.port != null" -- convert: - field: client.nat.port - target_field: client.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_client - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_client != null" -- set: - field: client.bytes - value: '{{source.bytes}}' - if: "ctx.source?.bytes != null" -- convert: - field: client.bytes - target_field: client.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.bytes != null" -- convert: - field: juniper.srx.packets_from_client - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_client != null" -- set: - field: client.packets - value: '{{source.packets}}' - if: "ctx.source?.packets != null" -- convert: - field: client.packets - target_field: client.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.packets != null" -- rename: - field: juniper.srx.username - target_field: source.user.name - ignore_missing: true - if: "ctx.juniper?.srx?.username != null" - -############################# -## ECS Network/Geo Mapping ## -############################# -- rename: - field: juniper.srx.protocol_id - target_field: network.iana_number - ignore_missing: true - if: "ctx.juniper?.srx?.protocol_id != null" -- geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - field: source.nat.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.nat.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.nat.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.source?.as == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.nat.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.destination?.as == null" -- rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true -- rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true -- rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true -- rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - -############# -## Cleanup ## -############# -- remove: - field: - - juniper.srx.destination_port - - juniper.srx.nat_destination_port - - juniper.srx.bytes_from_client - - juniper.srx.packets_from_client - - juniper.srx.source_port - - juniper.srx.nat_source_port - - juniper.srx.bytes_from_server - - juniper.srx.packets_from_server - ignore_missing: true - -on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/secintel.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/secintel.yml deleted file mode 100755 index 790a8aa9cb..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/secintel.yml +++ /dev/null @@ -1,350 +0,0 @@ ---- -description: Pipeline for parsing junipersrx firewall logs (secintel pipeline) -processors: -####################### -## ECS Event Mapping ## -####################### -- set: - field: event.kind - value: event -- set: - field: event.outcome - value: success - if: "ctx.juniper?.srx?.tag != null" -- append: - field: event.category - value: network -- set: - field: event.kind - value: alert - if: 'ctx.juniper?.srx?.tag == "SECINTEL_ACTION_LOG" && ctx.juniper?.srx?.action != "PERMIT"' -- append: - field: event.category - value: malware - if: 'ctx.juniper?.srx?.tag == "SECINTEL_ACTION_LOG" && ctx.juniper?.srx?.action != "PERMIT"' -- append: - field: event.type - value: - - info - - denied - - connection - if: "ctx.juniper?.srx?.action == 'BLOCK'" -- append: - field: event.type - value: - - allowed - - connection - if: "ctx.juniper?.srx?.action != 'BLOCK'" -- set: - field: event.action - value: malware_detected - if: "ctx.juniper?.srx?.action == 'BLOCK'" - - -#################################### -## ECS Server/Destination Mapping ## -#################################### -- rename: - field: juniper.srx.destination_address - target_field: destination.ip - ignore_missing: true - if: "ctx.juniper?.srx?.destination_address != null" -- set: - field: server.ip - value: '{{destination.ip}}' - if: "ctx.destination?.ip != null" -- rename: - field: juniper.srx.nat_destination_address - target_field: destination.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_address != null" -- convert: - field: juniper.srx.destination_port - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.destination_port != null" -- set: - field: server.port - value: '{{destination.port}}' - if: "ctx.destination?.port != null" -- convert: - field: server.port - target_field: server.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.port != null" -- convert: - field: juniper.srx.nat_destination_port - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_port != null" -- set: - field: server.nat.port - value: '{{destination.nat.port}}' - if: "ctx.destination?.nat?.port != null" -- convert: - field: server.nat.port - target_field: server.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_server - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_server != null" -- set: - field: server.bytes - value: '{{destination.bytes}}' - if: "ctx.destination?.bytes != null" -- convert: - field: server.bytes - target_field: server.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.bytes != null" -- convert: - field: juniper.srx.packets_from_server - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_server !=null" -- set: - field: server.packets - value: '{{destination.packets}}' - if: "ctx.destination?.packets != null" -- convert: - field: server.packets - target_field: server.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.packets != null" - -############################### -## ECS Client/Source Mapping ## -############################### -- rename: - field: juniper.srx.source_address - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.source_address != null" -- set: - field: client.ip - value: '{{source.ip}}' - if: "ctx.source?.ip != null" -- rename: - field: juniper.srx.nat_source_address - target_field: source.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_address != null" -- rename: - field: juniper.srx.sourceip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.sourceip != null" -- convert: - field: juniper.srx.source_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.source_port != null" -- set: - field: client.port - value: '{{source.port}}' - if: "ctx.source?.port != null" -- convert: - field: client.port - target_field: client.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.port != null" -- convert: - field: juniper.srx.nat_source_port - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_port != null" -- set: - field: client.nat.port - value: '{{source.nat.port}}' - if: "ctx.source?.nat?.port != null" -- convert: - field: client.nat.port - target_field: client.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_client - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_client != null" -- set: - field: client.bytes - value: '{{source.bytes}}' - if: "ctx.source?.bytes != null" -- convert: - field: client.bytes - target_field: client.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.bytes != null" -- convert: - field: juniper.srx.packets_from_client - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_client != null" -- set: - field: client.packets - value: '{{source.packets}}' - if: "ctx.source?.packets != null" -- convert: - field: client.packets - target_field: client.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.packets != null" -- rename: - field: juniper.srx.username - target_field: source.user.name - ignore_missing: true - if: "ctx.juniper?.srx?.username != null" -- rename: - field: juniper.srx.hostname - target_field: source.address - ignore_missing: true - if: "ctx.juniper?.srx?.hostname != null" -- rename: - field: juniper.srx.client_ip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.client_ip != null" - -###################### -## ECS URL Mapping ## -###################### -- rename: - field: juniper.srx.http_host - target_field: url.domain - ignore_missing: true - if: "ctx.juniper?.srx?.http_host != null" - -############################# -## ECS Network/Geo Mapping ## -############################# -- rename: - field: juniper.srx.protocol_id - target_field: network.iana_number - ignore_missing: true - if: "ctx.juniper?.srx?.protocol_id != null" -- geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - field: source.nat.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.nat.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.nat.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.source?.as == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.nat.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.destination?.as == null" -- rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true -- rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true -- rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true -- rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - -############# -## Cleanup ## -############# -- remove: - field: - - juniper.srx.destination_port - - juniper.srx.nat_destination_port - - juniper.srx.bytes_from_client - - juniper.srx.packets_from_client - - juniper.srx.source_port - - juniper.srx.nat_source_port - - juniper.srx.bytes_from_server - - juniper.srx.packets_from_server - ignore_missing: true - -on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/utm.yml b/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/utm.yml deleted file mode 100755 index 056f23dbe1..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/elasticsearch/ingest_pipeline/utm.yml +++ /dev/null @@ -1,391 +0,0 @@ ---- -description: Pipeline for parsing junipersrx firewall logs (utm pipeline) -processors: -####################### -## ECS Event Mapping ## -####################### -- set: - field: event.kind - value: event -- set: - field: event.outcome - value: success - if: "ctx.juniper?.srx?.tag != null" -- append: - field: event.category - value: network -- convert: - field: juniper.srx.urlcategory_risk - type: float - target_field: event.risk_score - ignore_missing: true - ignore_failure: true -- set: - field: event.kind - value: alert - if: '["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.category - value: malware - if: '["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.type - value: - - info - - denied - - connection - if: '["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' -- append: - field: event.type - value: - - allowed - - connection - if: '!["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: web_filter - if: '["WEBFILTER_URL_BLOCKED", "WEBFILTER_URL_BLOCKED_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: content_filter - if: '["CONTENT_FILTERING_BLOCKED_MT", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: antispam_filter - if: '["ANTISPAM_SPAM_DETECTED_MT", "ANTISPAM_SPAM_DETECTED_MT_LS"].contains(ctx.juniper?.srx?.tag)' -- set: - field: event.action - value: virus_detected - if: '["AV_VIRUS_DETECTED_MT", "AV_VIRUS_DETECTED_MT_LS"].contains(ctx.juniper?.srx?.tag)' - - -#################################### -## ECS Server/Destination Mapping ## -#################################### -- rename: - field: juniper.srx.destination_address - target_field: destination.ip - ignore_missing: true - if: "ctx.juniper?.srx?.destination_address != null" -- set: - field: server.ip - value: '{{destination.ip}}' - if: "ctx.destination?.ip != null" -- rename: - field: juniper.srx.nat_destination_address - target_field: destination.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_address != null" -- convert: - field: juniper.srx.destination_port - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.destination_port != null" -- set: - field: server.port - value: '{{destination.port}}' - if: "ctx.destination?.port != null" -- convert: - field: server.port - target_field: server.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.port != null" -- convert: - field: juniper.srx.nat_destination_port - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_destination_port != null" -- set: - field: server.nat.port - value: '{{destination.nat.port}}' - if: "ctx.destination?.nat?.port != null" -- convert: - field: server.nat.port - target_field: server.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_server - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_server != null" -- set: - field: server.bytes - value: '{{destination.bytes}}' - if: "ctx.destination?.bytes != null" -- convert: - field: server.bytes - target_field: server.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.bytes != null" -- convert: - field: juniper.srx.packets_from_server - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_server !=null" -- set: - field: server.packets - value: '{{destination.packets}}' - if: "ctx.destination?.packets != null" -- convert: - field: server.packets - target_field: server.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.server?.packets != null" - -############################### -## ECS Client/Source Mapping ## -############################### -- rename: - field: juniper.srx.source_address - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.source_address != null" -- set: - field: client.ip - value: '{{source.ip}}' - if: "ctx.source?.ip != null" -- rename: - field: juniper.srx.nat_source_address - target_field: source.nat.ip - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_address != null" -- rename: - field: juniper.srx.sourceip - target_field: source.ip - ignore_missing: true - if: "ctx.juniper?.srx?.sourceip != null" -- convert: - field: juniper.srx.source_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.source_port != null" -- set: - field: client.port - value: '{{source.port}}' - if: "ctx.source?.port != null" -- convert: - field: client.port - target_field: client.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.port != null" -- convert: - field: juniper.srx.nat_source_port - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.nat_source_port != null" -- set: - field: client.nat.port - value: '{{source.nat.port}}' - if: "ctx.source?.nat?.port != null" -- convert: - field: client.nat.port - target_field: client.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.nat?.port != null" -- convert: - field: juniper.srx.bytes_from_client - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.bytes_from_client != null" -- set: - field: client.bytes - value: '{{source.bytes}}' - if: "ctx.source?.bytes != null" -- convert: - field: client.bytes - target_field: client.bytes - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.bytes != null" -- convert: - field: juniper.srx.packets_from_client - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.juniper?.srx?.packets_from_client != null" -- set: - field: client.packets - value: '{{source.packets}}' - if: "ctx.source?.packets != null" -- convert: - field: client.packets - target_field: client.packets - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.client?.packets != null" -- rename: - field: juniper.srx.username - target_field: source.user.name - ignore_missing: true - if: "ctx.juniper?.srx?.username != null" - -###################### -## ECS Rule Mapping ## -###################### -- rename: - field: juniper.srx.policy_name - target_field: rule.name - ignore_missing: true - if: "ctx.juniper?.srx?.policy_name != null" - -##################### -## ECS URL Mapping ## -##################### -- rename: - field: juniper.srx.url - target_field: url.domain - ignore_missing: true - if: "ctx.juniper?.srx?.url != null" -- rename: - field: juniper.srx.obj - target_field: url.path - ignore_missing: true - if: "ctx.juniper?.srx?.obj != null" - -###################### -## ECS File Mapping ## -###################### -- rename: - field: juniper.srx.filename - target_field: file.name - ignore_missing: true - if: "ctx.juniper?.srx?.filename != null" - -######################### -## ECS Network Mapping ## -######################### -- rename: - field: juniper.srx.protocol - target_field: network.protocol - ignore_missing: true - if: "ctx.juniper?.srx?.protocol != null" - -############################# -## ECS Network/Geo Mapping ## -############################# -- rename: - field: juniper.srx.protocol_id - target_field: network.iana_number - ignore_missing: true - if: "ctx.juniper?.srx?.protocol_id != null" -- geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true -- geoip: - field: source.nat.ip - target_field: source.geo - ignore_missing: true - if: "ctx.source?.geo == null" -- geoip: - field: destination.nat.ip - target_field: destination.geo - ignore_missing: true - if: "ctx.destination?.geo == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: source.nat.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.source?.as == null" -- geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.nat.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - if: "ctx.destination?.as == null" -- rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true -- rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true -- rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true -- rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - -############# -## Cleanup ## -############# -- remove: - field: - - juniper.srx.destination_port - - juniper.srx.nat_destination_port - - juniper.srx.bytes_from_client - - juniper.srx.packets_from_client - - juniper.srx.source_port - - juniper.srx.nat_source_port - - juniper.srx.bytes_from_server - - juniper.srx.packets_from_server - - juniper.srx.urlcategory_risk - ignore_missing: true - -on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/juniper/1.1.0/data_stream/srx/fields/agent.yml b/packages/juniper/1.1.0/data_stream/srx/fields/agent.yml deleted file mode 100755 index c5d5959b5a..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/fields/agent.yml +++ /dev/null @@ -1,207 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type. -- name: log.offset - type: long - description: Byte offset of the log line within its file. -- name: log.source.address - type: keyword - description: Source address of the syslog message. diff --git a/packages/juniper/1.1.0/data_stream/srx/fields/base-fields.yml b/packages/juniper/1.1.0/data_stream/srx/fields/base-fields.yml deleted file mode 100755 index 2b9703542a..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: juniper -- name: event.dataset - type: constant_keyword - description: Event dataset - value: juniper.srx -- name: '@timestamp' - type: date - description: Event timestamp. diff --git a/packages/juniper/1.1.0/data_stream/srx/fields/ecs.yml b/packages/juniper/1.1.0/data_stream/srx/fields/ecs.yml deleted file mode 100755 index eb7ef4054f..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/fields/ecs.yml +++ /dev/null @@ -1,2452 +0,0 @@ -- description: |- - Date/time when the event originated. - This is the date/time extracted from the event, typically representing when the event was generated by the source. - If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. - Required field for all events. - name: '@timestamp' - type: date -- description: |- - Extended build information for the agent. - This field is intended to contain any build information that a data source may provide, no specific formatting is required. - name: agent.build.original - type: keyword -- description: |- - Ephemeral identifier of this agent (if one exists). - This id normally changes across restarts, but `agent.id` does not. - name: agent.ephemeral_id - type: keyword -- description: |- - Unique identifier of this agent (if one exists). - Example: For Beats this would be beat.id. - name: agent.id - type: keyword -- description: |- - Custom name of the agent. - This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. - If no name is given, the name is often left empty. - name: agent.name - type: keyword -- description: |- - Type of the agent. - The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. - name: agent.type - type: keyword -- description: Version of the agent. - name: agent.version - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: as.number - type: long -- description: Organization name. - name: as.organization.name - type: keyword -- description: |- - Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: client.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: client.as.number - type: long -- description: Organization name. - name: client.as.organization.name - type: keyword -- description: Bytes sent from the client to the server. - name: client.bytes - type: long -- description: |- - The domain name of the client system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: client.domain - type: keyword -- description: City name. - name: client.geo.city_name - type: keyword -- description: Name of the continent. - name: client.geo.continent_name - type: keyword -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Country name. - name: client.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: client.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: client.geo.name - type: keyword -- description: Region ISO code. - name: client.geo.region_iso_code - type: keyword -- description: Region name. - name: client.geo.region_name - type: keyword -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - MAC address of the client. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: client.mac - type: keyword -- description: |- - Translated IP of source based NAT sessions (e.g. internal client to internet). - Typically connections traversing load balancers, firewalls, or routers. - name: client.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions (e.g. internal client to internet). - Typically connections traversing load balancers, firewalls, or routers. - name: client.nat.port - type: long -- description: Packets sent from the client to the server. - name: client.packets - type: long -- description: Port of the client. - name: client.port - type: long -- description: |- - The highest registered client domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: client.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: client.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: client.user.domain - type: keyword -- description: User email address. - name: client.user.email - type: keyword -- description: User's full name, if available. - name: client.user.full_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: client.user.group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: client.user.group.id - type: keyword -- description: Name of the group. - name: client.user.group.name - type: keyword -- description: |- - Unique user hash to correlate information for a user in anonymized form. - Useful if `user.id` or `user.name` contain confidential information and cannot be used. - name: client.user.hash - type: keyword -- description: Unique identifier of the user. - name: client.user.id - type: keyword -- description: Short name or login of the user. - name: client.user.name - type: keyword -- description: Array of user roles at the time of the event. - name: client.user.roles - type: keyword -- description: |- - The cloud account or organization id used to identify different entities in a multi-tenant environment. - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. - name: cloud.account.id - type: keyword -- description: |- - The cloud account name or alias used to identify different entities in a multi-tenant environment. - Examples: AWS account name, Google Cloud ORG display name. - name: cloud.account.name - type: keyword -- description: Availability zone in which this host, resource, or service is located. - name: cloud.availability_zone - type: keyword -- description: Instance ID of the host machine. - name: cloud.instance.id - type: keyword -- description: Instance name of the host machine. - name: cloud.instance.name - type: keyword -- description: Machine type of the host machine. - name: cloud.machine.type - type: keyword -- description: |- - The cloud project identifier. - Examples: Google Cloud Project id, Azure Project id. - name: cloud.project.id - type: keyword -- description: |- - The cloud project name. - Examples: Google Cloud Project name, Azure Project name. - name: cloud.project.name - type: keyword -- description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - name: cloud.provider - type: keyword -- description: Region in which this host, resource, or service is located. - name: cloud.region - type: keyword -- description: Boolean to capture if a signature is present. - name: code_signature.exists - type: boolean -- description: |- - Additional information about the certificate status. - This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - name: code_signature.status - type: keyword -- description: Subject name of the code signer - name: code_signature.subject_name - type: keyword -- description: |- - Stores the trust status of the certificate chain. - Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - name: code_signature.trusted - type: boolean -- description: |- - Boolean to capture if the digital signature is verified against the binary content. - Leave unpopulated if a certificate was unchecked. - name: code_signature.valid - type: boolean -- description: Unique container id. - name: container.id - type: keyword -- description: Name of the image the container was built on. - name: container.image.name - type: keyword -- description: Container image tags. - name: container.image.tag - type: keyword -- description: Image labels. - name: container.labels - type: object -- description: Container name. - name: container.name - type: keyword -- description: Runtime managing this container. - name: container.runtime - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: destination.geo.name - type: keyword -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - MAC address of the destination. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: destination.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Packets sent from the destination to the source. - name: destination.packets - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - The highest registered destination domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: destination.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: destination.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: destination.user.domain - type: keyword -- description: User email address. - name: destination.user.email - type: keyword -- description: User's full name, if available. - name: destination.user.full_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: destination.user.group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: destination.user.group.id - type: keyword -- description: Name of the group. - name: destination.user.group.name - type: keyword -- description: |- - Unique user hash to correlate information for a user in anonymized form. - Useful if `user.id` or `user.name` contain confidential information and cannot be used. - name: destination.user.hash - type: keyword -- description: Unique identifier of the user. - name: destination.user.id - type: keyword -- description: Short name or login of the user. - name: destination.user.name - type: keyword -- description: Array of user roles at the time of the event. - name: destination.user.roles - type: keyword -- description: Boolean to capture if a signature is present. - name: dll.code_signature.exists - type: boolean -- description: |- - Additional information about the certificate status. - This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - name: dll.code_signature.status - type: keyword -- description: Subject name of the code signer - name: dll.code_signature.subject_name - type: keyword -- description: |- - Stores the trust status of the certificate chain. - Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - name: dll.code_signature.trusted - type: boolean -- description: |- - Boolean to capture if the digital signature is verified against the binary content. - Leave unpopulated if a certificate was unchecked. - name: dll.code_signature.valid - type: boolean -- description: MD5 hash. - name: dll.hash.md5 - type: keyword -- description: SHA1 hash. - name: dll.hash.sha1 - type: keyword -- description: SHA256 hash. - name: dll.hash.sha256 - type: keyword -- description: SHA512 hash. - name: dll.hash.sha512 - type: keyword -- description: |- - Name of the library. - This generally maps to the name of the file on disk. - name: dll.name - type: keyword -- description: Full file path of the library. - name: dll.path - type: keyword -- description: CPU architecture target for the file. - name: dll.pe.architecture - type: keyword -- description: Internal company name of the file, provided at compile-time. - name: dll.pe.company - type: keyword -- description: Internal description of the file, provided at compile-time. - name: dll.pe.description - type: keyword -- description: Internal version of the file, provided at compile-time. - name: dll.pe.file_version - type: keyword -- description: |- - A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. - Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - name: dll.pe.imphash - type: keyword -- description: Internal name of the file, provided at compile-time. - name: dll.pe.original_file_name - type: keyword -- description: Internal product name of the file, provided at compile-time. - name: dll.pe.product - type: keyword -- description: |- - An array containing an object for each answer section returned by the server. - The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. - Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. - name: dns.answers - type: object -- description: The class of DNS data contained in this resource record. - name: dns.answers.class - type: keyword -- description: |- - The data describing the resource. - The meaning of this data depends on the type and class of the resource record. - name: dns.answers.data - type: keyword -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. - name: dns.answers.ttl - type: long -- description: The type of data contained in this resource record. - name: dns.answers.type - type: keyword -- description: |- - Array of 2 letter DNS header flags. - Expected values are: AA, TC, RD, RA, AD, CD, DO. - name: dns.header_flags - type: keyword -- description: The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. - name: dns.id - type: keyword -- description: The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. - name: dns.op_code - type: keyword -- description: The class of records being queried. - name: dns.question.class - type: keyword -- description: |- - The name being queried. - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - name: dns.question.name - type: keyword -- description: |- - The highest registered domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: dns.question.registered_domain - type: keyword -- description: |- - The subdomain is all of the labels under the registered_domain. - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: dns.question.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: dns.question.top_level_domain - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - Array containing all IPs seen in `answers.data`. - The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. - name: dns.resolved_ip - type: ip -- description: The DNS response code. - name: dns.response_code - type: keyword -- description: |- - The type of DNS event captured, query or answer. - If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. - If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. - name: dns.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Error code describing the error. - name: error.code - type: keyword -- description: Unique identifier for the error. - name: error.id - type: keyword -- description: Error message. - name: error.message - type: match_only_text -- description: The stack trace of this error in plain text. - name: error.stack_trace - type: wildcard -- description: The type of the error, for example the class name of the exception. - name: error.type - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. - `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. - This field is an array. This will allow proper categorization of some events that fall in multiple categories. - name: event.category - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: |- - Duration of the event in nanoseconds. - If event.start and event.end are known this value should be the difference between the end and start time. - name: event.duration - type: long -- description: event.end contains the date when the event ended or when the activity was last observed. - name: event.end - type: date -- description: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. - name: event.hash - type: keyword -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - name: event.original - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Source of the event. - Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). - name: event.provider - type: keyword -- description: |- - Reason why this event happened, according to the source. - This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - name: event.reason - type: keyword -- description: |- - Reference URL linking to additional information about this event. - This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. - name: event.reference - type: keyword -- description: Risk score or priority of the event (e.g. security solutions). Use your system's original value here. - name: event.risk_score - type: float -- description: |- - Normalized risk score or priority of the event, on a scale of 0 to 100. - This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. - name: event.risk_score_norm - type: float -- description: |- - Sequence number of the event. - The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. - name: event.sequence - type: long -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long -- description: event.start contains the date when the event started or when the activity was first observed. - name: event.start - type: date -- description: |- - This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. - Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - name: event.timezone - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. - `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. - This field is an array. This will allow proper categorization of some events that fall in multiple event types. - name: event.type - type: keyword -- description: |- - URL linking to an external system to continue investigation of this event. - This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. - name: event.url - type: keyword -- description: |- - Last time the file was accessed. - Note that not all filesystems keep track of access time. - name: file.accessed - type: date -- description: |- - Array of file attributes. - Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. - name: file.attributes - type: keyword -- description: Boolean to capture if a signature is present. - name: file.code_signature.exists - type: boolean -- description: |- - Additional information about the certificate status. - This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - name: file.code_signature.status - type: keyword -- description: Subject name of the code signer - name: file.code_signature.subject_name - type: keyword -- description: |- - Stores the trust status of the certificate chain. - Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - name: file.code_signature.trusted - type: boolean -- description: |- - Boolean to capture if the digital signature is verified against the binary content. - Leave unpopulated if a certificate was unchecked. - name: file.code_signature.valid - type: boolean -- description: |- - File creation time. - Note that not all filesystems store the creation time. - name: file.created - type: date -- description: |- - Last time the file attributes or metadata changed. - Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. - name: file.ctime - type: date -- description: Device that is the source of the file. - name: file.device - type: keyword -- description: Directory where the file is located. It should include the drive letter, when appropriate. - name: file.directory - type: keyword -- description: |- - Drive letter where the file is located. This field is only relevant on Windows. - The value should be uppercase, and not include the colon. - name: file.drive_letter - type: keyword -- description: |- - File extension, excluding the leading dot. - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: file.extension - type: keyword -- description: Primary group ID (GID) of the file. - name: file.gid - type: keyword -- description: Primary group name of the file. - name: file.group - type: keyword -- description: MD5 hash. - name: file.hash.md5 - type: keyword -- description: SHA1 hash. - name: file.hash.sha1 - type: keyword -- description: SHA256 hash. - name: file.hash.sha256 - type: keyword -- description: SHA512 hash. - name: file.hash.sha512 - type: keyword -- description: Inode representing the file in the filesystem. - name: file.inode - type: keyword -- description: MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. - name: file.mime_type - type: keyword -- description: Mode of the file in octal representation. - name: file.mode - type: keyword -- description: Last time the file content was modified. - name: file.mtime - type: date -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: File owner's username. - name: file.owner - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - name: file.path - type: keyword -- description: CPU architecture target for the file. - name: file.pe.architecture - type: keyword -- description: Internal company name of the file, provided at compile-time. - name: file.pe.company - type: keyword -- description: Internal description of the file, provided at compile-time. - name: file.pe.description - type: keyword -- description: Internal version of the file, provided at compile-time. - name: file.pe.file_version - type: keyword -- description: |- - A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. - Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - name: file.pe.imphash - type: keyword -- description: Internal name of the file, provided at compile-time. - name: file.pe.original_file_name - type: keyword -- description: Internal product name of the file, provided at compile-time. - name: file.pe.product - type: keyword -- description: |- - File size in bytes. - Only relevant when `file.type` is "file". - name: file.size - type: long -- description: Target path for symlinks. - name: file.target_path - type: keyword -- description: File type (file, dir, or symlink). - name: file.type - type: keyword -- description: The user ID (UID) or security identifier (SID) of the file owner. - name: file.uid - type: keyword -- description: List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. - name: file.x509.alternative_names - type: keyword -- description: List of common name (CN) of issuing certificate authority. - name: file.x509.issuer.common_name - type: keyword -- description: List of country (C) codes - name: file.x509.issuer.country - type: keyword -- description: Distinguished name (DN) of issuing certificate authority. - name: file.x509.issuer.distinguished_name - type: keyword -- description: List of locality names (L) - name: file.x509.issuer.locality - type: keyword -- description: List of organizations (O) of issuing certificate authority. - name: file.x509.issuer.organization - type: keyword -- description: List of organizational units (OU) of issuing certificate authority. - name: file.x509.issuer.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: file.x509.issuer.state_or_province - type: keyword -- description: Time at which the certificate is no longer considered valid. - name: file.x509.not_after - type: date -- description: Time at which the certificate is first considered valid. - name: file.x509.not_before - type: date -- description: Algorithm used to generate the public key. - name: file.x509.public_key_algorithm - type: keyword -- description: The curve used by the elliptic curve public key algorithm. This is algorithm specific. - name: file.x509.public_key_curve - type: keyword -- description: Exponent used to derive the public key. This is algorithm specific. - name: file.x509.public_key_exponent - type: long -- description: The size of the public key space in bits. - name: file.x509.public_key_size - type: long -- description: Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. - name: file.x509.serial_number - type: keyword -- description: Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. - name: file.x509.signature_algorithm - type: keyword -- description: List of common names (CN) of subject. - name: file.x509.subject.common_name - type: keyword -- description: List of country (C) code - name: file.x509.subject.country - type: keyword -- description: Distinguished name (DN) of the certificate subject entity. - name: file.x509.subject.distinguished_name - type: keyword -- description: List of locality names (L) - name: file.x509.subject.locality - type: keyword -- description: List of organizations (O) of subject. - name: file.x509.subject.organization - type: keyword -- description: List of organizational units (OU) of subject. - name: file.x509.subject.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: file.x509.subject.state_or_province - type: keyword -- description: Version of x509 format. - name: file.x509.version_number - type: keyword -- description: City name. - name: geo.city_name - type: keyword -- description: Name of the continent. - name: geo.continent_name - type: keyword -- description: Country ISO code. - name: geo.country_iso_code - type: keyword -- description: Country name. - name: geo.country_name - type: keyword -- description: Longitude and latitude. - name: geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: geo.name - type: keyword -- description: Region ISO code. - name: geo.region_iso_code - type: keyword -- description: Region name. - name: geo.region_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: group.id - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: MD5 hash. - name: hash.md5 - type: keyword -- description: SHA1 hash. - name: hash.sha1 - type: keyword -- description: SHA256 hash. - name: hash.sha256 - type: keyword -- description: SHA512 hash. - name: hash.sha512 - type: keyword -- description: Operating system architecture. - name: host.architecture - type: keyword -- description: |- - Name of the domain of which the host is a member. - For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. - name: host.domain - type: keyword -- description: City name. - name: host.geo.city_name - type: keyword -- description: Name of the continent. - name: host.geo.continent_name - type: keyword -- description: Country ISO code. - name: host.geo.country_iso_code - type: keyword -- description: Country name. - name: host.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: host.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: host.geo.name - type: keyword -- description: Region ISO code. - name: host.geo.region_iso_code - type: keyword -- description: Region name. - name: host.geo.region_name - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - Unique host id. - As hostname is not always unique, use values that are meaningful in your environment. - Example: The current usage of `beat.name`. - name: host.id - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Host MAC addresses. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: host.mac - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: host.os.family - type: keyword -- description: Operating system name, including the version or code name. - name: host.os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: host.os.kernel - type: keyword -- description: Operating system name, without the version. - name: host.os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: host.os.platform - type: keyword -- description: Operating system version as a raw string. - name: host.os.version - type: keyword -- description: |- - Type of host. - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. - name: host.type - type: keyword -- description: Seconds the host has been up. - name: host.uptime - type: long -- description: Size in bytes of the request body. - name: http.request.body.bytes - type: long -- description: The full HTTP request body. - name: http.request.body.content - type: wildcard -- description: Total size in bytes of the request (body and headers). - name: http.request.bytes - type: long -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: Size in bytes of the response body. - name: http.response.body.bytes - type: long -- description: The full HTTP response body. - name: http.response.body.content - type: wildcard -- description: Total size in bytes of the response (body and headers). - name: http.response.bytes - type: long -- description: HTTP response status code. - name: http.response.status_code - type: long -- description: HTTP version. - name: http.version - type: keyword -- description: Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. - name: interface.alias - type: keyword -- description: Interface ID as reported by an observer (typically SNMP interface ID). - name: interface.id - type: keyword -- description: Interface name as reported by the system. - name: interface.name - type: keyword -- description: |- - Custom key/value pairs. - Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. - Example: `docker` and `k8s` labels. - name: labels - type: object -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: |- - Original log level of the log event. - If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). - Some examples are `warn`, `err`, `i`, `informational`. - name: log.level - type: keyword -- description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - name: log.logger - type: keyword -- description: The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164. - name: log.syslog - type: object -- description: |- - The Syslog numeric facility of the log event, if available. - According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. - name: log.syslog.facility.code - type: long -- description: The Syslog text-based facility of the log event, if available. - name: log.syslog.facility.name - type: keyword -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - The Syslog numeric severity of the log event, if available. - If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. - name: log.syslog.severity.code - type: long -- description: |- - The Syslog numeric severity of the log event, if available. - If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. - name: log.syslog.severity.name - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: Host IP address when the source IP address is the proxy. - name: network.forwarded_ip - type: ip -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) - name: network.inner - type: object -- description: VLAN ID as reported by the observer. - name: network.inner.vlan.id - type: keyword -- description: Optional VLAN name as reported by the observer. - name: network.inner.vlan.name - type: keyword -- description: Name given by operators to sections of their network. - name: network.name - type: keyword -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: VLAN ID as reported by the observer. - name: network.vlan.id - type: keyword -- description: Optional VLAN name as reported by the observer. - name: network.vlan.name - type: keyword -- description: Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. - name: observer.egress - type: object -- description: Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. - name: observer.egress.interface.alias - type: keyword -- description: Interface ID as reported by an observer (typically SNMP interface ID). - name: observer.egress.interface.id - type: keyword -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: VLAN ID as reported by the observer. - name: observer.egress.vlan.id - type: keyword -- description: Optional VLAN name as reported by the observer. - name: observer.egress.vlan.name - type: keyword -- description: Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. - name: observer.egress.zone - type: keyword -- description: City name. - name: observer.geo.city_name - type: keyword -- description: Name of the continent. - name: observer.geo.continent_name - type: keyword -- description: Country ISO code. - name: observer.geo.country_iso_code - type: keyword -- description: Country name. - name: observer.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: observer.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: observer.geo.name - type: keyword -- description: Region ISO code. - name: observer.geo.region_iso_code - type: keyword -- description: Region name. - name: observer.geo.region_name - type: keyword -- description: Hostname of the observer. - name: observer.hostname - type: keyword -- description: Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. - name: observer.ingress - type: object -- description: Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. - name: observer.ingress.interface.alias - type: keyword -- description: Interface ID as reported by an observer (typically SNMP interface ID). - name: observer.ingress.interface.id - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: VLAN ID as reported by the observer. - name: observer.ingress.vlan.id - type: keyword -- description: Optional VLAN name as reported by the observer. - name: observer.ingress.vlan.name - type: keyword -- description: Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. - name: observer.ingress.zone - type: keyword -- description: IP addresses of the observer. - name: observer.ip - type: ip -- description: |- - MAC addresses of the observer. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: observer.mac - type: keyword -- description: |- - Custom name of the observer. - This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. - If no custom name is needed, the field can be left empty. - name: observer.name - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: observer.os.family - type: keyword -- description: Operating system name, including the version or code name. - name: observer.os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: observer.os.kernel - type: keyword -- description: Operating system name, without the version. - name: observer.os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: observer.os.platform - type: keyword -- description: Operating system version as a raw string. - name: observer.os.version - type: keyword -- description: The product name of the observer. - name: observer.product - type: keyword -- description: Observer serial number. - name: observer.serial_number - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: Unique identifier for the organization. - name: organization.id - type: keyword -- description: Organization name. - name: organization.name - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: os.family - type: keyword -- description: Operating system name, including the version or code name. - name: os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: os.kernel - type: keyword -- description: Operating system name, without the version. - name: os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: os.platform - type: keyword -- description: Operating system version as a raw string. - name: os.version - type: keyword -- description: Package architecture. - name: package.architecture - type: keyword -- description: |- - Additional information about the build version of the installed package. - For example use the commit SHA of a non-released package. - name: package.build_version - type: keyword -- description: Checksum of the installed package for verification. - name: package.checksum - type: keyword -- description: Description of the package. - name: package.description - type: keyword -- description: Indicating how the package was installed, e.g. user-local, global. - name: package.install_scope - type: keyword -- description: Time when package was installed. - name: package.installed - type: date -- description: |- - License under which the package was released. - Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). - name: package.license - type: keyword -- description: Package name - name: package.name - type: keyword -- description: Path where the package is installed. - name: package.path - type: keyword -- description: Home page or reference URL of the software in this package, if available. - name: package.reference - type: keyword -- description: Package size in bytes. - name: package.size - type: long -- description: |- - Type of package. - This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. - name: package.type - type: keyword -- description: Package version - name: package.version - type: keyword -- description: CPU architecture target for the file. - name: pe.architecture - type: keyword -- description: Internal company name of the file, provided at compile-time. - name: pe.company - type: keyword -- description: Internal description of the file, provided at compile-time. - name: pe.description - type: keyword -- description: Internal version of the file, provided at compile-time. - name: pe.file_version - type: keyword -- description: |- - A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. - Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - name: pe.imphash - type: keyword -- description: Internal name of the file, provided at compile-time. - name: pe.original_file_name - type: keyword -- description: Internal product name of the file, provided at compile-time. - name: pe.product - type: keyword -- description: |- - Array of process arguments, starting with the absolute path to the executable. - May be filtered to protect sensitive information. - name: process.args - type: keyword -- description: |- - Length of the process.args array. - This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. - name: process.args_count - type: long -- description: Boolean to capture if a signature is present. - name: process.code_signature.exists - type: boolean -- description: |- - Additional information about the certificate status. - This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - name: process.code_signature.status - type: keyword -- description: Subject name of the code signer - name: process.code_signature.subject_name - type: keyword -- description: |- - Stores the trust status of the certificate chain. - Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - name: process.code_signature.trusted - type: boolean -- description: |- - Boolean to capture if the digital signature is verified against the binary content. - Leave unpopulated if a certificate was unchecked. - name: process.code_signature.valid - type: boolean -- description: |- - Full command line that started the process, including the absolute path to the executable, and all arguments. - Some arguments may be filtered to protect sensitive information. - name: process.command_line - type: wildcard -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.entity_id - type: keyword -- description: Absolute path to the process executable. - name: process.executable - type: keyword -- description: |- - The exit code of the process, if this is a termination event. - The field should be absent if there is no exit code for the event (e.g. process start). - name: process.exit_code - type: long -- description: MD5 hash. - name: process.hash.md5 - type: keyword -- description: SHA1 hash. - name: process.hash.sha1 - type: keyword -- description: SHA256 hash. - name: process.hash.sha256 - type: keyword -- description: SHA512 hash. - name: process.hash.sha512 - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.name - type: keyword -- description: |- - Array of process arguments, starting with the absolute path to the executable. - May be filtered to protect sensitive information. - name: process.parent.args - type: keyword -- description: |- - Length of the process.args array. - This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. - name: process.parent.args_count - type: long -- description: Boolean to capture if a signature is present. - name: process.parent.code_signature.exists - type: boolean -- description: |- - Additional information about the certificate status. - This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - name: process.parent.code_signature.status - type: keyword -- description: Subject name of the code signer - name: process.parent.code_signature.subject_name - type: keyword -- description: |- - Stores the trust status of the certificate chain. - Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - name: process.parent.code_signature.trusted - type: boolean -- description: |- - Boolean to capture if the digital signature is verified against the binary content. - Leave unpopulated if a certificate was unchecked. - name: process.parent.code_signature.valid - type: boolean -- description: |- - Full command line that started the process, including the absolute path to the executable, and all arguments. - Some arguments may be filtered to protect sensitive information. - name: process.parent.command_line - type: wildcard -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.parent.entity_id - type: keyword -- description: Absolute path to the process executable. - name: process.parent.executable - type: keyword -- description: |- - The exit code of the process, if this is a termination event. - The field should be absent if there is no exit code for the event (e.g. process start). - name: process.parent.exit_code - type: long -- description: MD5 hash. - name: process.parent.hash.md5 - type: keyword -- description: SHA1 hash. - name: process.parent.hash.sha1 - type: keyword -- description: SHA256 hash. - name: process.parent.hash.sha256 - type: keyword -- description: SHA512 hash. - name: process.parent.hash.sha512 - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.parent.name - type: keyword -- description: CPU architecture target for the file. - name: process.parent.pe.architecture - type: keyword -- description: Internal company name of the file, provided at compile-time. - name: process.parent.pe.company - type: keyword -- description: Internal description of the file, provided at compile-time. - name: process.parent.pe.description - type: keyword -- description: Internal version of the file, provided at compile-time. - name: process.parent.pe.file_version - type: keyword -- description: |- - A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. - Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - name: process.parent.pe.imphash - type: keyword -- description: Internal name of the file, provided at compile-time. - name: process.parent.pe.original_file_name - type: keyword -- description: Internal product name of the file, provided at compile-time. - name: process.parent.pe.product - type: keyword -- description: Identifier of the group of processes the process belongs to. - name: process.parent.pgid - type: long -- description: Process id. - name: process.parent.pid - type: long -- description: The time the process started. - name: process.parent.start - type: date -- description: Thread ID. - name: process.parent.thread.id - type: long -- description: Thread name. - name: process.parent.thread.name - type: keyword -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.parent.title - type: keyword -- description: Seconds the process has been up. - name: process.parent.uptime - type: long -- description: The working directory of the process. - name: process.parent.working_directory - type: keyword -- description: CPU architecture target for the file. - name: process.pe.architecture - type: keyword -- description: Internal company name of the file, provided at compile-time. - name: process.pe.company - type: keyword -- description: Internal description of the file, provided at compile-time. - name: process.pe.description - type: keyword -- description: Internal version of the file, provided at compile-time. - name: process.pe.file_version - type: keyword -- description: |- - A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. - Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - name: process.pe.imphash - type: keyword -- description: Internal name of the file, provided at compile-time. - name: process.pe.original_file_name - type: keyword -- description: Internal product name of the file, provided at compile-time. - name: process.pe.product - type: keyword -- description: Identifier of the group of processes the process belongs to. - name: process.pgid - type: long -- description: Process id. - name: process.pid - type: long -- description: The time the process started. - name: process.start - type: date -- description: Thread ID. - name: process.thread.id - type: long -- description: Thread name. - name: process.thread.name - type: keyword -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.title - type: keyword -- description: Seconds the process has been up. - name: process.uptime - type: long -- description: The working directory of the process. - name: process.working_directory - type: keyword -- description: |- - Original bytes written with base64 encoding. - For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. - name: registry.data.bytes - type: keyword -- description: |- - Content when writing string types. - Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). - name: registry.data.strings - type: wildcard -- description: Standard registry type for encoding contents - name: registry.data.type - type: keyword -- description: Abbreviated name for the hive. - name: registry.hive - type: keyword -- description: Hive-relative path of keys. - name: registry.key - type: keyword -- description: Full path, including hive, key and value - name: registry.path - type: keyword -- description: Name of the value written. - name: registry.value - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. - name: rule.author - type: keyword -- description: A categorization value keyword used by the entity using the rule for detection of this event. - name: rule.category - type: keyword -- description: The description of the rule generating the event. - name: rule.description - type: keyword -- description: A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. - name: rule.id - type: keyword -- description: Name of the license under which the rule used to generate this event is made available. - name: rule.license - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - Reference URL to additional information about the rule used to generate this event. - The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. - name: rule.reference - type: keyword -- description: Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. - name: rule.ruleset - type: keyword -- description: A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. - name: rule.uuid - type: keyword -- description: The version / revision of the rule being used for analysis. - name: rule.version - type: keyword -- description: |- - Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: server.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: server.as.number - type: long -- description: Organization name. - name: server.as.organization.name - type: keyword -- description: Bytes sent from the server to the client. - name: server.bytes - type: long -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: City name. - name: server.geo.city_name - type: keyword -- description: Name of the continent. - name: server.geo.continent_name - type: keyword -- description: Country ISO code. - name: server.geo.country_iso_code - type: keyword -- description: Country name. - name: server.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: server.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: server.geo.name - type: keyword -- description: Region ISO code. - name: server.geo.region_iso_code - type: keyword -- description: Region name. - name: server.geo.region_name - type: keyword -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: |- - MAC address of the server. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: server.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: server.nat.ip - type: ip -- description: |- - Translated port of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: server.nat.port - type: long -- description: Packets sent from the server to the client. - name: server.packets - type: long -- description: Port of the server. - name: server.port - type: long -- description: |- - The highest registered server domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: server.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: server.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: server.user.domain - type: keyword -- description: User email address. - name: server.user.email - type: keyword -- description: User's full name, if available. - name: server.user.full_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: server.user.group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: server.user.group.id - type: keyword -- description: Name of the group. - name: server.user.group.name - type: keyword -- description: |- - Unique user hash to correlate information for a user in anonymized form. - Useful if `user.id` or `user.name` contain confidential information and cannot be used. - name: server.user.hash - type: keyword -- description: Unique identifier of the user. - name: server.user.id - type: keyword -- description: Short name or login of the user. - name: server.user.name - type: keyword -- description: Array of user roles at the time of the event. - name: server.user.roles - type: keyword -- description: |- - Ephemeral identifier of this service (if one exists). - This id normally changes across restarts, but `service.id` does not. - name: service.ephemeral_id - type: keyword -- description: |- - Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. - This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. - Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. - name: service.id - type: keyword -- description: |- - Name of the service data is collected from. - The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. - In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - name: service.name - type: keyword -- description: |- - Name of a service node. - This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. - In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. - name: service.node.name - type: keyword -- description: Current state of the service. - name: service.state - type: keyword -- description: |- - The type of the service data is collected from. - The type can be used to group and correlate logs and metrics from one service type. - Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. - name: service.type - type: keyword -- description: |- - Version of the service the data was collected from. - This allows to look at a data set only for a specific version of a service. - name: service.version - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - MAC address of the source. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: source.mac - type: keyword -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: |- - The highest registered source domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: source.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: source.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: source.user.domain - type: keyword -- description: User email address. - name: source.user.email - type: keyword -- description: User's full name, if available. - name: source.user.full_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: source.user.group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: source.user.group.id - type: keyword -- description: Name of the group. - name: source.user.group.name - type: keyword -- description: |- - Unique user hash to correlate information for a user in anonymized form. - Useful if `user.id` or `user.name` contain confidential information and cannot be used. - name: source.user.hash - type: keyword -- description: Unique identifier of the user. - name: source.user.id - type: keyword -- description: Short name or login of the user. - name: source.user.name - type: keyword -- description: Array of user roles at the time of the event. - name: source.user.roles - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. - name: threat.framework - type: keyword -- description: The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) - name: threat.tactic.id - type: keyword -- description: Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) - name: threat.tactic.name - type: keyword -- description: The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) - name: threat.tactic.reference - type: keyword -- description: The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) - name: threat.technique.id - type: keyword -- description: The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) - name: threat.technique.name - type: keyword -- description: The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) - name: threat.technique.reference - type: keyword -- description: String indicating the cipher used during the current connection. - name: tls.cipher - type: keyword -- description: PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. - name: tls.client.certificate - type: keyword -- description: Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. - name: tls.client.certificate_chain - type: keyword -- description: Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. - name: tls.client.hash.md5 - type: keyword -- description: Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. - name: tls.client.hash.sha1 - type: keyword -- description: Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. - name: tls.client.hash.sha256 - type: keyword -- description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. - name: tls.client.issuer - type: keyword -- description: A hash that identifies clients based on how they perform an SSL/TLS handshake. - name: tls.client.ja3 - type: keyword -- description: Date/Time indicating when client certificate is no longer considered valid. - name: tls.client.not_after - type: date -- description: Date/Time indicating when client certificate is first considered valid. - name: tls.client.not_before - type: date -- description: Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. - name: tls.client.server_name - type: keyword -- description: Distinguished name of subject of the x.509 certificate presented by the client. - name: tls.client.subject - type: keyword -- description: Array of ciphers offered by the client during the client hello. - name: tls.client.supported_ciphers - type: keyword -- description: List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. - name: tls.client.x509.alternative_names - type: keyword -- description: List of common name (CN) of issuing certificate authority. - name: tls.client.x509.issuer.common_name - type: keyword -- description: List of country (C) codes - name: tls.client.x509.issuer.country - type: keyword -- description: Distinguished name (DN) of issuing certificate authority. - name: tls.client.x509.issuer.distinguished_name - type: keyword -- description: List of locality names (L) - name: tls.client.x509.issuer.locality - type: keyword -- description: List of organizations (O) of issuing certificate authority. - name: tls.client.x509.issuer.organization - type: keyword -- description: List of organizational units (OU) of issuing certificate authority. - name: tls.client.x509.issuer.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: tls.client.x509.issuer.state_or_province - type: keyword -- description: Time at which the certificate is no longer considered valid. - name: tls.client.x509.not_after - type: date -- description: Time at which the certificate is first considered valid. - name: tls.client.x509.not_before - type: date -- description: Algorithm used to generate the public key. - name: tls.client.x509.public_key_algorithm - type: keyword -- description: The curve used by the elliptic curve public key algorithm. This is algorithm specific. - name: tls.client.x509.public_key_curve - type: keyword -- description: Exponent used to derive the public key. This is algorithm specific. - name: tls.client.x509.public_key_exponent - type: long -- description: The size of the public key space in bits. - name: tls.client.x509.public_key_size - type: long -- description: Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. - name: tls.client.x509.serial_number - type: keyword -- description: Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. - name: tls.client.x509.signature_algorithm - type: keyword -- description: List of common names (CN) of subject. - name: tls.client.x509.subject.common_name - type: keyword -- description: List of country (C) code - name: tls.client.x509.subject.country - type: keyword -- description: Distinguished name (DN) of the certificate subject entity. - name: tls.client.x509.subject.distinguished_name - type: keyword -- description: List of locality names (L) - name: tls.client.x509.subject.locality - type: keyword -- description: List of organizations (O) of subject. - name: tls.client.x509.subject.organization - type: keyword -- description: List of organizational units (OU) of subject. - name: tls.client.x509.subject.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: tls.client.x509.subject.state_or_province - type: keyword -- description: Version of x509 format. - name: tls.client.x509.version_number - type: keyword -- description: String indicating the curve used for the given cipher, when applicable. - name: tls.curve - type: keyword -- description: Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. - name: tls.established - type: boolean -- description: String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. - name: tls.next_protocol - type: keyword -- description: Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. - name: tls.resumed - type: boolean -- description: PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. - name: tls.server.certificate - type: keyword -- description: Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. - name: tls.server.certificate_chain - type: keyword -- description: Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. - name: tls.server.hash.md5 - type: keyword -- description: Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. - name: tls.server.hash.sha1 - type: keyword -- description: Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. - name: tls.server.hash.sha256 - type: keyword -- description: Subject of the issuer of the x.509 certificate presented by the server. - name: tls.server.issuer - type: keyword -- description: A hash that identifies servers based on how they perform an SSL/TLS handshake. - name: tls.server.ja3s - type: keyword -- description: Timestamp indicating when server certificate is no longer considered valid. - name: tls.server.not_after - type: date -- description: Timestamp indicating when server certificate is first considered valid. - name: tls.server.not_before - type: date -- description: Subject of the x.509 certificate presented by the server. - name: tls.server.subject - type: keyword -- description: List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. - name: tls.server.x509.alternative_names - type: keyword -- description: List of common name (CN) of issuing certificate authority. - name: tls.server.x509.issuer.common_name - type: keyword -- description: List of country (C) codes - name: tls.server.x509.issuer.country - type: keyword -- description: Distinguished name (DN) of issuing certificate authority. - name: tls.server.x509.issuer.distinguished_name - type: keyword -- description: List of locality names (L) - name: tls.server.x509.issuer.locality - type: keyword -- description: List of organizations (O) of issuing certificate authority. - name: tls.server.x509.issuer.organization - type: keyword -- description: List of organizational units (OU) of issuing certificate authority. - name: tls.server.x509.issuer.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: tls.server.x509.issuer.state_or_province - type: keyword -- description: Time at which the certificate is no longer considered valid. - name: tls.server.x509.not_after - type: date -- description: Time at which the certificate is first considered valid. - name: tls.server.x509.not_before - type: date -- description: Algorithm used to generate the public key. - name: tls.server.x509.public_key_algorithm - type: keyword -- description: The curve used by the elliptic curve public key algorithm. This is algorithm specific. - name: tls.server.x509.public_key_curve - type: keyword -- description: Exponent used to derive the public key. This is algorithm specific. - name: tls.server.x509.public_key_exponent - type: long -- description: The size of the public key space in bits. - name: tls.server.x509.public_key_size - type: long -- description: Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. - name: tls.server.x509.serial_number - type: keyword -- description: Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. - name: tls.server.x509.signature_algorithm - type: keyword -- description: List of common names (CN) of subject. - name: tls.server.x509.subject.common_name - type: keyword -- description: List of country (C) code - name: tls.server.x509.subject.country - type: keyword -- description: Distinguished name (DN) of the certificate subject entity. - name: tls.server.x509.subject.distinguished_name - type: keyword -- description: List of locality names (L) - name: tls.server.x509.subject.locality - type: keyword -- description: List of organizations (O) of subject. - name: tls.server.x509.subject.organization - type: keyword -- description: List of organizational units (OU) of subject. - name: tls.server.x509.subject.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: tls.server.x509.subject.state_or_province - type: keyword -- description: Version of x509 format. - name: tls.server.x509.version_number - type: keyword -- description: Numeric part of the version parsed from the original string. - name: tls.version - type: keyword -- description: Normalized lowercase protocol name parsed from original string. - name: tls.version_protocol - type: keyword -- description: |- - Unique identifier of the span within the scope of its trace. - A span represents an operation within a transaction, such as a request to another service, or a database query. - name: span.id - type: keyword -- description: |- - Unique identifier of the trace. - A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services. - name: trace.id - type: keyword -- description: |- - Unique identifier of the transaction within the scope of its trace. - A transaction is the highest level of work measured within a service, such as a request to a server. - name: transaction.id - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - The field contains the file extension from the original request url, excluding the leading dot. - The file extension is only set if it exists, as not every url has a file extension. - The leading period must not be included. For example, the value must be "png", not ".png". - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: url.extension - type: keyword -- description: |- - Portion of the url after the `#`, such as "top". - The `#` is not part of the fragment. - name: url.fragment - type: keyword -- description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. - name: url.full - type: wildcard -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Password of the request. - name: url.password - type: keyword -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: Port of the request, such as 443. - name: url.port - type: long -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - The highest registered url domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: url.registered_domain - type: keyword -- description: |- - Scheme of the request, such as "https". - Note: The `:` is not part of the scheme. - name: url.scheme - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: url.top_level_domain - type: keyword -- description: Username of the request. - name: url.username - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: User's full name, if available. - name: user.full_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: user.group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: user.group.id - type: keyword -- description: Name of the group. - name: user.group.name - type: keyword -- description: |- - Unique user hash to correlate information for a user in anonymized form. - Useful if `user.id` or `user.name` contain confidential information and cannot be used. - name: user.hash - type: keyword -- description: Unique identifier of the user. - name: user.id - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: Array of user roles at the time of the event. - name: user.roles - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: user_agent.os.family - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: user_agent.os.kernel - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: user_agent.os.platform - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword -- description: VLAN ID as reported by the observer. - name: vlan.id - type: keyword -- description: Optional VLAN name as reported by the observer. - name: vlan.name - type: keyword -- description: |- - The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) - This field must be an array. - name: vulnerability.category - type: keyword -- description: The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) - name: vulnerability.classification - type: keyword -- description: The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) - name: vulnerability.description - type: keyword -- description: The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) - name: vulnerability.enumeration - type: keyword -- description: The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] - name: vulnerability.id - type: keyword -- description: A resource that provides additional information, context, and mitigations for the identified vulnerability. - name: vulnerability.reference - type: keyword -- description: The report or scan identification number. - name: vulnerability.report_id - type: keyword -- description: The name of the vulnerability scanner vendor. - name: vulnerability.scanner.vendor - type: keyword -- description: |- - Scores can range from 0.0 to 10.0, with 10.0 being the most severe. - Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) - name: vulnerability.score.base - type: float -- description: |- - Scores can range from 0.0 to 10.0, with 10.0 being the most severe. - Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document) - name: vulnerability.score.environmental - type: float -- description: |- - Scores can range from 0.0 to 10.0, with 10.0 being the most severe. - Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document) - name: vulnerability.score.temporal - type: float -- description: |- - The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. - CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) - name: vulnerability.score.version - type: keyword -- description: The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) - name: vulnerability.severity - type: keyword -- description: List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. - name: x509.alternative_names - type: keyword -- description: List of common name (CN) of issuing certificate authority. - name: x509.issuer.common_name - type: keyword -- description: List of country (C) codes - name: x509.issuer.country - type: keyword -- description: Distinguished name (DN) of issuing certificate authority. - name: x509.issuer.distinguished_name - type: keyword -- description: List of locality names (L) - name: x509.issuer.locality - type: keyword -- description: List of organizations (O) of issuing certificate authority. - name: x509.issuer.organization - type: keyword -- description: List of organizational units (OU) of issuing certificate authority. - name: x509.issuer.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: x509.issuer.state_or_province - type: keyword -- description: Time at which the certificate is no longer considered valid. - name: x509.not_after - type: date -- description: Time at which the certificate is first considered valid. - name: x509.not_before - type: date -- description: Algorithm used to generate the public key. - name: x509.public_key_algorithm - type: keyword -- description: The curve used by the elliptic curve public key algorithm. This is algorithm specific. - name: x509.public_key_curve - type: keyword -- description: Exponent used to derive the public key. This is algorithm specific. - name: x509.public_key_exponent - type: long -- description: The size of the public key space in bits. - name: x509.public_key_size - type: long -- description: Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. - name: x509.serial_number - type: keyword -- description: Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. - name: x509.signature_algorithm - type: keyword -- description: List of common names (CN) of subject. - name: x509.subject.common_name - type: keyword -- description: List of country (C) code - name: x509.subject.country - type: keyword -- description: Distinguished name (DN) of the certificate subject entity. - name: x509.subject.distinguished_name - type: keyword -- description: List of locality names (L) - name: x509.subject.locality - type: keyword -- description: List of organizations (O) of subject. - name: x509.subject.organization - type: keyword -- description: List of organizational units (OU) of subject. - name: x509.subject.organizational_unit - type: keyword -- description: List of state or province names (ST, S, or P) - name: x509.subject.state_or_province - type: keyword -- description: Version of x509 format. - name: x509.version_number - type: keyword diff --git a/packages/juniper/1.1.0/data_stream/srx/fields/fields.yml b/packages/juniper/1.1.0/data_stream/srx/fields/fields.yml deleted file mode 100755 index f1c609ea12..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/fields/fields.yml +++ /dev/null @@ -1,388 +0,0 @@ -- name: juniper.srx - type: group - release: ga - fields: - - name: reason - type: keyword - description: | - reason - - name: connection_tag - type: keyword - description: | - connection tag - - name: service_name - type: keyword - description: | - service name - - name: nat_connection_tag - type: keyword - description: | - nat connection tag - - name: src_nat_rule_type - type: keyword - description: | - src nat rule type - - name: src_nat_rule_name - type: keyword - description: | - src nat rule name - - name: dst_nat_rule_type - type: keyword - description: | - dst nat rule type - - name: dst_nat_rule_name - type: keyword - description: | - dst nat rule name - - name: protocol_id - type: keyword - description: | - protocol id - - name: policy_name - type: keyword - description: | - policy name - - name: session_id_32 - type: keyword - description: | - session id 32 - - name: session_id - type: keyword - description: | - session id - - name: outbound_packets - type: integer - description: | - packets from client - - name: outbound_bytes - type: integer - description: | - bytes from client - - name: inbound_packets - type: integer - description: | - packets from server - - name: inbound_bytes - type: integer - description: | - bytes from server - - name: elapsed_time - type: date - description: | - elapsed time - - name: application - type: keyword - description: | - application - - name: nested_application - type: keyword - description: | - nested application - - name: username - type: keyword - description: | - username - - name: roles - type: keyword - description: | - roles - - name: encrypted - type: keyword - description: | - encrypted - - name: application_category - type: keyword - description: | - application category - - name: application_sub_category - type: keyword - description: | - application sub category - - name: application_characteristics - type: keyword - description: | - application characteristics - - name: secure_web_proxy_session_type - type: keyword - description: | - secure web proxy session type - - name: peer_session_id - type: keyword - description: | - peer session id - - name: peer_source_address - type: ip - description: | - peer source address - - name: peer_source_port - type: integer - description: | - peer source port - - name: peer_destination_address - type: ip - description: | - peer destination address - - name: peer_destination_port - type: integer - description: | - peer destination port - - name: hostname - type: keyword - description: | - hostname - - name: src_vrf_grp - type: keyword - description: | - src_vrf_grp - - name: dst_vrf_grp - type: keyword - description: | - dst_vrf_grp - - name: icmp_type - type: integer - description: | - icmp type - - name: process - type: keyword - description: | - process that generated the message - - name: apbr_rule_type - type: keyword - description: | - apbr rule type - - name: dscp_value - type: integer - description: | - apbr rule type - - name: logical_system_name - type: keyword - description: | - logical system name - - name: profile_name - type: keyword - description: | - profile name - - name: routing_instance - type: keyword - description: | - routing instance - - name: rule_name - type: keyword - description: | - rule name - - name: uplink_tx_bytes - type: integer - description: | - uplink tx bytes - - name: uplink_rx_bytes - type: integer - description: | - uplink rx bytes - - name: obj - type: keyword - description: | - url path - - name: url - type: keyword - description: | - url domain - - name: profile - type: keyword - description: | - filter profile - - name: category - type: keyword - description: | - filter category - - name: filename - type: keyword - description: | - filename - - name: temporary_filename - type: keyword - description: | - temporary_filename - - name: name - type: keyword - description: | - name - - name: error_message - type: keyword - description: | - error_message - - name: error_code - type: keyword - description: | - error_code - - name: action - type: keyword - description: | - action - - name: protocol - type: keyword - description: | - protocol - - name: protocol_name - type: keyword - description: | - protocol name - - name: type - type: keyword - description: | - type - - name: repeat_count - type: integer - description: | - repeat count - - name: alert - type: keyword - description: | - repeat alert - - name: message_type - type: keyword - description: | - message type - - name: threat_severity - type: keyword - description: | - threat severity - - name: application_name - type: keyword - description: | - application name - - name: attack_name - type: keyword - description: | - attack name - - name: index - type: keyword - description: | - index - - name: message - type: keyword - description: | - mesagge - - name: epoch_time - type: date - description: | - epoch time - - name: packet_log_id - type: integer - description: | - packet log id - - name: export_id - type: integer - description: | - packet log id - - name: ddos_application_name - type: keyword - description: | - ddos application name - - name: connection_hit_rate - type: integer - description: | - connection hit rate - - name: time_scope - type: keyword - description: | - time scope - - name: context_hit_rate - type: integer - description: | - context hit rate - - name: context_value_hit_rate - type: integer - description: | - context value hit rate - - name: time_count - type: integer - description: | - time count - - name: time_period - type: integer - description: | - time period - - name: context_value - type: keyword - description: | - context value - - name: context_name - type: keyword - description: | - context name - - name: ruleebase_name - type: keyword - description: | - ruleebase name - - name: verdict_source - type: keyword - description: | - verdict source - - name: verdict_number - type: integer - description: | - verdict number - - name: file_category - type: keyword - description: | - file category - - name: sample_sha256 - type: keyword - description: | - sample sha256 - - name: malware_info - type: keyword - description: | - malware info - - name: client_ip - type: ip - description: | - client ip - - name: tenant_id - type: keyword - description: | - tenant id - - name: timestamp - type: date - description: | - timestamp - - name: th - type: keyword - description: | - th - - name: status - type: keyword - description: | - status - - name: state - type: keyword - description: | - state - - name: file_hash_lookup - type: keyword - description: | - file hash lookup - - name: file_name - type: keyword - description: | - file name - - name: action_detail - type: keyword - description: | - action detail - - name: sub_category - type: keyword - description: | - sub category - - name: feed_name - type: keyword - description: | - feed name - - name: occur_count - type: integer - description: | - occur count - - name: tag - type: keyword - description: |- - system log message tag, which uniquely identifies the message. diff --git a/packages/juniper/1.1.0/data_stream/srx/manifest.yml b/packages/juniper/1.1.0/data_stream/srx/manifest.yml deleted file mode 100755 index 8e21c3258d..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/manifest.yml +++ /dev/null @@ -1,133 +0,0 @@ -type: logs -title: Juniper SRX logs -streams: - - input: tcp - vars: - - name: syslog_host - type: text - title: Syslog Host - multi: false - required: true - show_user: true - default: localhost - - name: syslog_port - type: integer - title: Syslog Port - multi: false - required: true - show_user: true - default: 9006 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-srx - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: tcp.yml.hbs - title: Juniper SRX logs - description: Collect Juniper SRX logs via TCP - - input: udp - vars: - - name: syslog_host - type: text - title: Syslog Host - multi: false - required: true - show_user: true - default: localhost - - name: syslog_port - type: integer - title: Syslog Port - multi: false - required: true - show_user: true - default: 9006 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-srx - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: udp.yml.hbs - title: Juniper SRX logs - description: Collect Juniper SRX logs via UDP - - input: logfile - enabled: false - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/juniper-srx.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - juniper-srx - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: logfile.yml.hbs - title: Juniper SRX logs - description: Read Juniper SRX logs from a file diff --git a/packages/juniper/1.1.0/data_stream/srx/sample_event.json b/packages/juniper/1.1.0/data_stream/srx/sample_event.json deleted file mode 100755 index ae69f86328..0000000000 --- a/packages/juniper/1.1.0/data_stream/srx/sample_event.json +++ /dev/null @@ -1,106 +0,0 @@ -{ - "@timestamp": "2016-02-18T01:32:50.391Z", - "agent": { - "ephemeral_id": "2876d482-8245-456b-833a-6aff7be73223", - "id": "ea40d449-2727-40b0-90ad-be273a35f475", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0" - }, - "client": { - "ip": "192.168.1.100", - "port": 58071 - }, - "data_stream": { - "dataset": "juniper.srx", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "103.235.46.39", - "port": 80 - }, - "ecs": { - "version": "1.12.0" - }, - "elastic_agent": { - "id": "ea40d449-2727-40b0-90ad-be273a35f475", - "snapshot": true, - "version": "8.0.0" - }, - "event": { - "action": "web_filter", - "agent_id_status": "verified", - "category": [ - "network", - "malware" - ], - "dataset": "juniper.srx", - "ingested": "2021-12-06T12:33:40Z", - "kind": "alert", - "outcome": "success", - "severity": 12, - "timezone": "+00:00", - "type": [ - "info", - "denied", - "connection" - ] - }, - "input": { - "type": "log" - }, - "juniper": { - "srx": { - "category": "cat1", - "process": "RT_UTM", - "profile": "uf1", - "reason": "BY_BLACK_LIST", - "tag": "WEBFILTER_URL_BLOCKED" - } - }, - "log": { - "file": { - "path": "/tmp/service_logs/juniper-srx.log" - }, - "level": "warning", - "offset": 0 - }, - "observer": { - "name": "utm-srx550-b", - "product": "SRX", - "type": "firewall", - "vendor": "Juniper" - }, - "related": { - "hosts": [ - "www.baidu.com" - ], - "ip": [ - "192.168.1.100", - "103.235.46.39" - ], - "user": [ - "user01" - ] - }, - "server": { - "ip": "103.235.46.39", - "port": 80 - }, - "source": { - "ip": "192.168.1.100", - "port": 58071, - "user": { - "name": "user01" - } - }, - "tags": [ - "juniper-srx", - "forwarded" - ], - "url": { - "domain": "www.baidu.com", - "path": "/" - } -} \ No newline at end of file diff --git a/packages/juniper/1.1.0/docs/README.md b/packages/juniper/1.1.0/docs/README.md deleted file mode 100755 index 9f7fb5c930..0000000000 --- a/packages/juniper/1.1.0/docs/README.md +++ /dev/null @@ -1,2455 +0,0 @@ -# Juniper integration - -This is an integration for ingesting data from the different Juniper products. -Currently it supports these datasets: -- `srx` fileset: Supports Juniper SRX logs -- `junos` dataset: supports Juniper JUNOS logs. -- `netscreen` dataset: supports Netscreen logs. - -### SRX - -The SRX integration only supports syslog messages in the format "structured-data + brief". See the [JunOS Documentation on structured-data.](https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/structured-data-edit-system.html) - -To configure a remote syslog destination, please reference the [SRX Getting Started - Configure System Logging.](https://kb.juniper.net/InfoCenter/index?page=content&id=kb16502) -The syslog format choosen should be `Default`. - -The following processes and tags are supported: - -| JunOS processes | JunOS tags | -|-----------------|-------------------------------------------| -| RT_FLOW | RT_FLOW_SESSION_CREATE | -| | RT_FLOW_SESSION_CLOSE | -| | RT_FLOW_SESSION_DENY | -| | APPTRACK_SESSION_CREATE | -| | APPTRACK_SESSION_CLOSE | -| | APPTRACK_SESSION_VOL_UPDATE | -| RT_IDS | RT_SCREEN_TCP | -| | RT_SCREEN_UDP | -| | RT_SCREEN_ICMP | -| | RT_SCREEN_IP | -| | RT_SCREEN_TCP_DST_IP | -| | RT_SCREEN_TCP_SRC_IP | -| RT_UTM | WEBFILTER_URL_PERMITTED | -| | WEBFILTER_URL_BLOCKED | -| | AV_VIRUS_DETECTED_MT | -| | CONTENT_FILTERING_BLOCKED_MT | -| | ANTISPAM_SPAM_DETECTED_MT | -| RT_IDP | IDP_ATTACK_LOG_EVENT | -| | IDP_APPDDOS_APP_STATE_EVENT | -| RT_AAMW | SRX_AAMW_ACTION_LOG | -| | AAMW_MALWARE_EVENT_LOG | -| | AAMW_HOST_INFECTED_EVENT_LOG | -| | AAMW_ACTION_LOG | -| RT_SECINTEL | SECINTEL_ACTION_LOG | - - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | -| agent.build.original | Extended build information for the agent. This field is intended to contain any build information that a data source may provide, no specific formatting is required. | keyword | -| agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty. | keyword | -| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | -| agent.version | Version of the agent. | keyword | -| as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| as.organization.name | Organization name. | keyword | -| client.address | Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| client.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| client.as.organization.name | Organization name. | keyword | -| client.bytes | Bytes sent from the client to the server. | long | -| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| client.geo.city_name | City name. | keyword | -| client.geo.continent_name | Name of the continent. | keyword | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.country_name | Country name. | keyword | -| client.geo.location | Longitude and latitude. | geo_point | -| client.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| client.geo.region_iso_code | Region ISO code. | keyword | -| client.geo.region_name | Region name. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.mac | MAC address of the client. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| client.nat.ip | Translated IP of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | ip | -| client.nat.port | Translated port of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | long | -| client.packets | Packets sent from the client to the server. | long | -| client.port | Port of the client. | long | -| client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| client.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| client.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| client.user.email | User email address. | keyword | -| client.user.full_name | User's full name, if available. | keyword | -| client.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| client.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| client.user.group.name | Name of the group. | keyword | -| client.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| client.user.id | Unique identifier of the user. | keyword | -| client.user.name | Short name or login of the user. | keyword | -| client.user.roles | Array of user roles at the time of the event. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.project.name | The cloud project name. Examples: Google Cloud Project name, Azure Project name. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| code_signature.exists | Boolean to capture if a signature is present. | boolean | -| code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| code_signature.subject_name | Subject name of the code signer | keyword | -| code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.image.tag | Container image tags. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.packets | Packets sent from the destination to the source. | long | -| destination.port | Port of the destination. | long | -| destination.registered_domain | The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| destination.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| destination.user.email | User email address. | keyword | -| destination.user.full_name | User's full name, if available. | keyword | -| destination.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| destination.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| destination.user.group.name | Name of the group. | keyword | -| destination.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| destination.user.id | Unique identifier of the user. | keyword | -| destination.user.name | Short name or login of the user. | keyword | -| destination.user.roles | Array of user roles at the time of the event. | keyword | -| dll.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| dll.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| dll.code_signature.subject_name | Subject name of the code signer | keyword | -| dll.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| dll.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| dll.hash.md5 | MD5 hash. | keyword | -| dll.hash.sha1 | SHA1 hash. | keyword | -| dll.hash.sha256 | SHA256 hash. | keyword | -| dll.hash.sha512 | SHA512 hash. | keyword | -| dll.name | Name of the library. This generally maps to the name of the file on disk. | keyword | -| dll.path | Full file path of the library. | keyword | -| dll.pe.architecture | CPU architecture target for the file. | keyword | -| dll.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| dll.pe.description | Internal description of the file, provided at compile-time. | keyword | -| dll.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| dll.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| dll.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| dll.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| dns.answers | An array containing an object for each answer section returned by the server. The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. | object | -| dns.answers.class | The class of DNS data contained in this resource record. | keyword | -| dns.answers.data | The data describing the resource. The meaning of this data depends on the type and class of the resource record. | keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.header_flags | Array of 2 letter DNS header flags. Expected values are: AA, TC, RD, RA, AD, CD, DO. | keyword | -| dns.id | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | -| dns.op_code | The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. | keyword | -| dns.question.class | The class of records being queried. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.resolved_ip | Array containing all IPs seen in `answers.data`. The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ip | -| dns.response_code | The DNS response code. | keyword | -| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.code | Error code describing the error. | keyword | -| error.id | Unique identifier for the error. | keyword | -| error.message | Error message. | match_only_text | -| error.stack_trace | The stack trace of this error in plain text. | wildcard | -| error.type | The type of the error, for example the class name of the exception. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.hash | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | -| event.risk_score_norm | Normalized risk score or priority of the event, on a scale of 0 to 100. This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. | float | -| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| file.accessed | Last time the file was accessed. Note that not all filesystems keep track of access time. | date | -| file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | -| file.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| file.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| file.code_signature.subject_name | Subject name of the code signer | keyword | -| file.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| file.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| file.created | File creation time. Note that not all filesystems store the creation time. | date | -| file.ctime | Last time the file attributes or metadata changed. Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | date | -| file.device | Device that is the source of the file. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.drive_letter | Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| file.gid | Primary group ID (GID) of the file. | keyword | -| file.group | Primary group name of the file. | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha1 | SHA1 hash. | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.hash.sha512 | SHA512 hash. | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | -| file.mode | Mode of the file in octal representation. | keyword | -| file.mtime | Last time the file content was modified. | date | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.owner | File owner's username. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.pe.architecture | CPU architecture target for the file. | keyword | -| file.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| file.pe.description | Internal description of the file, provided at compile-time. | keyword | -| file.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| file.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| file.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| file.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.target_path | Target path for symlinks. | keyword | -| file.type | File type (file, dir, or symlink). | keyword | -| file.uid | The user ID (UID) or security identifier (SID) of the file owner. | keyword | -| file.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| file.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| file.x509.issuer.country | List of country (C) codes | keyword | -| file.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| file.x509.issuer.locality | List of locality names (L) | keyword | -| file.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| file.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| file.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| file.x509.not_after | Time at which the certificate is no longer considered valid. | date | -| file.x509.not_before | Time at which the certificate is first considered valid. | date | -| file.x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| file.x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| file.x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| file.x509.public_key_size | The size of the public key space in bits. | long | -| file.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| file.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| file.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| file.x509.subject.country | List of country (C) code | keyword | -| file.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| file.x509.subject.locality | List of locality names (L) | keyword | -| file.x509.subject.organization | List of organizations (O) of subject. | keyword | -| file.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| file.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| file.x509.version_number | Version of x509 format. | keyword | -| geo.city_name | City name. | keyword | -| geo.continent_name | Name of the continent. | keyword | -| geo.country_iso_code | Country ISO code. | keyword | -| geo.country_name | Country name. | keyword | -| geo.location | Longitude and latitude. | geo_point | -| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| geo.region_iso_code | Region ISO code. | keyword | -| geo.region_name | Region name. | keyword | -| group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| group.name | Name of the group. | keyword | -| hash.md5 | MD5 hash. | keyword | -| hash.sha1 | SHA1 hash. | keyword | -| hash.sha256 | SHA256 hash. | keyword | -| hash.sha512 | SHA512 hash. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.geo.city_name | City name. | keyword | -| host.geo.continent_name | Name of the continent. | keyword | -| host.geo.country_iso_code | Country ISO code. | keyword | -| host.geo.country_name | Country name. | keyword | -| host.geo.location | Longitude and latitude. | geo_point | -| host.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| host.geo.region_iso_code | Region ISO code. | keyword | -| host.geo.region_name | Region name. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.full | Operating system name, including the version or code name. | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| host.uptime | Seconds the host has been up. | long | -| http.request.body.bytes | Size in bytes of the request body. | long | -| http.request.body.content | The full HTTP request body. | wildcard | -| http.request.bytes | Total size in bytes of the request (body and headers). | long | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| http.response.body.bytes | Size in bytes of the response body. | long | -| http.response.body.content | The full HTTP response body. | wildcard | -| http.response.bytes | Total size in bytes of the response (body and headers). | long | -| http.response.status_code | HTTP response status code. | long | -| http.version | HTTP version. | keyword | -| input.type | Input type. | keyword | -| interface.alias | Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. | keyword | -| interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | -| interface.name | Interface name as reported by the system. | keyword | -| juniper.srx.action | action | keyword | -| juniper.srx.action_detail | action detail | keyword | -| juniper.srx.alert | repeat alert | keyword | -| juniper.srx.apbr_rule_type | apbr rule type | keyword | -| juniper.srx.application | application | keyword | -| juniper.srx.application_category | application category | keyword | -| juniper.srx.application_characteristics | application characteristics | keyword | -| juniper.srx.application_name | application name | keyword | -| juniper.srx.application_sub_category | application sub category | keyword | -| juniper.srx.attack_name | attack name | keyword | -| juniper.srx.category | filter category | keyword | -| juniper.srx.client_ip | client ip | ip | -| juniper.srx.connection_hit_rate | connection hit rate | integer | -| juniper.srx.connection_tag | connection tag | keyword | -| juniper.srx.context_hit_rate | context hit rate | integer | -| juniper.srx.context_name | context name | keyword | -| juniper.srx.context_value | context value | keyword | -| juniper.srx.context_value_hit_rate | context value hit rate | integer | -| juniper.srx.ddos_application_name | ddos application name | keyword | -| juniper.srx.dscp_value | apbr rule type | integer | -| juniper.srx.dst_nat_rule_name | dst nat rule name | keyword | -| juniper.srx.dst_nat_rule_type | dst nat rule type | keyword | -| juniper.srx.dst_vrf_grp | dst_vrf_grp | keyword | -| juniper.srx.elapsed_time | elapsed time | date | -| juniper.srx.encrypted | encrypted | keyword | -| juniper.srx.epoch_time | epoch time | date | -| juniper.srx.error_code | error_code | keyword | -| juniper.srx.error_message | error_message | keyword | -| juniper.srx.export_id | packet log id | integer | -| juniper.srx.feed_name | feed name | keyword | -| juniper.srx.file_category | file category | keyword | -| juniper.srx.file_hash_lookup | file hash lookup | keyword | -| juniper.srx.file_name | file name | keyword | -| juniper.srx.filename | filename | keyword | -| juniper.srx.hostname | hostname | keyword | -| juniper.srx.icmp_type | icmp type | integer | -| juniper.srx.inbound_bytes | bytes from server | integer | -| juniper.srx.inbound_packets | packets from server | integer | -| juniper.srx.index | index | keyword | -| juniper.srx.logical_system_name | logical system name | keyword | -| juniper.srx.malware_info | malware info | keyword | -| juniper.srx.message | mesagge | keyword | -| juniper.srx.message_type | message type | keyword | -| juniper.srx.name | name | keyword | -| juniper.srx.nat_connection_tag | nat connection tag | keyword | -| juniper.srx.nested_application | nested application | keyword | -| juniper.srx.obj | url path | keyword | -| juniper.srx.occur_count | occur count | integer | -| juniper.srx.outbound_bytes | bytes from client | integer | -| juniper.srx.outbound_packets | packets from client | integer | -| juniper.srx.packet_log_id | packet log id | integer | -| juniper.srx.peer_destination_address | peer destination address | ip | -| juniper.srx.peer_destination_port | peer destination port | integer | -| juniper.srx.peer_session_id | peer session id | keyword | -| juniper.srx.peer_source_address | peer source address | ip | -| juniper.srx.peer_source_port | peer source port | integer | -| juniper.srx.policy_name | policy name | keyword | -| juniper.srx.process | process that generated the message | keyword | -| juniper.srx.profile | filter profile | keyword | -| juniper.srx.profile_name | profile name | keyword | -| juniper.srx.protocol | protocol | keyword | -| juniper.srx.protocol_id | protocol id | keyword | -| juniper.srx.protocol_name | protocol name | keyword | -| juniper.srx.reason | reason | keyword | -| juniper.srx.repeat_count | repeat count | integer | -| juniper.srx.roles | roles | keyword | -| juniper.srx.routing_instance | routing instance | keyword | -| juniper.srx.rule_name | rule name | keyword | -| juniper.srx.ruleebase_name | ruleebase name | keyword | -| juniper.srx.sample_sha256 | sample sha256 | keyword | -| juniper.srx.secure_web_proxy_session_type | secure web proxy session type | keyword | -| juniper.srx.service_name | service name | keyword | -| juniper.srx.session_id | session id | keyword | -| juniper.srx.session_id_32 | session id 32 | keyword | -| juniper.srx.src_nat_rule_name | src nat rule name | keyword | -| juniper.srx.src_nat_rule_type | src nat rule type | keyword | -| juniper.srx.src_vrf_grp | src_vrf_grp | keyword | -| juniper.srx.state | state | keyword | -| juniper.srx.status | status | keyword | -| juniper.srx.sub_category | sub category | keyword | -| juniper.srx.tag | system log message tag, which uniquely identifies the message. | keyword | -| juniper.srx.temporary_filename | temporary_filename | keyword | -| juniper.srx.tenant_id | tenant id | keyword | -| juniper.srx.th | th | keyword | -| juniper.srx.threat_severity | threat severity | keyword | -| juniper.srx.time_count | time count | integer | -| juniper.srx.time_period | time period | integer | -| juniper.srx.time_scope | time scope | keyword | -| juniper.srx.timestamp | timestamp | date | -| juniper.srx.type | type | keyword | -| juniper.srx.uplink_rx_bytes | uplink rx bytes | integer | -| juniper.srx.uplink_tx_bytes | uplink tx bytes | integer | -| juniper.srx.url | url domain | keyword | -| juniper.srx.username | username | keyword | -| juniper.srx.verdict_number | verdict number | integer | -| juniper.srx.verdict_source | verdict source | keyword | -| labels | Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels. | object | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Byte offset of the log line within its file. | long | -| log.source.address | Source address of the syslog message. | keyword | -| log.syslog | The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164. | object | -| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | -| log.syslog.facility.name | The Syslog text-based facility of the log event, if available. | keyword | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | -| log.syslog.severity.name | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. | keyword | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.inner | Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) | object | -| network.inner.vlan.id | VLAN ID as reported by the observer. | keyword | -| network.inner.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| network.vlan.id | VLAN ID as reported by the observer. | keyword | -| network.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| observer.egress | Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. | object | -| observer.egress.interface.alias | Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. | keyword | -| observer.egress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.egress.vlan.id | VLAN ID as reported by the observer. | keyword | -| observer.egress.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.geo.city_name | City name. | keyword | -| observer.geo.continent_name | Name of the continent. | keyword | -| observer.geo.country_iso_code | Country ISO code. | keyword | -| observer.geo.country_name | Country name. | keyword | -| observer.geo.location | Longitude and latitude. | geo_point | -| observer.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| observer.geo.region_iso_code | Region ISO code. | keyword | -| observer.geo.region_name | Region name. | keyword | -| observer.hostname | Hostname of the observer. | keyword | -| observer.ingress | Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. | object | -| observer.ingress.interface.alias | Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. | keyword | -| observer.ingress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.vlan.id | VLAN ID as reported by the observer. | keyword | -| observer.ingress.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.mac | MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | -| observer.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| observer.os.full | Operating system name, including the version or code name. | keyword | -| observer.os.kernel | Operating system kernel version as a raw string. | keyword | -| observer.os.name | Operating system name, without the version. | keyword | -| observer.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| observer.os.version | Operating system version as a raw string. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.serial_number | Observer serial number. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| organization.id | Unique identifier for the organization. | keyword | -| organization.name | Organization name. | keyword | -| os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| os.full | Operating system name, including the version or code name. | keyword | -| os.kernel | Operating system kernel version as a raw string. | keyword | -| os.name | Operating system name, without the version. | keyword | -| os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| os.version | Operating system version as a raw string. | keyword | -| package.architecture | Package architecture. | keyword | -| package.build_version | Additional information about the build version of the installed package. For example use the commit SHA of a non-released package. | keyword | -| package.checksum | Checksum of the installed package for verification. | keyword | -| package.description | Description of the package. | keyword | -| package.install_scope | Indicating how the package was installed, e.g. user-local, global. | keyword | -| package.installed | Time when package was installed. | date | -| package.license | License under which the package was released. Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). | keyword | -| package.name | Package name | keyword | -| package.path | Path where the package is installed. | keyword | -| package.reference | Home page or reference URL of the software in this package, if available. | keyword | -| package.size | Package size in bytes. | long | -| package.type | Type of package. This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. | keyword | -| package.version | Package version | keyword | -| pe.architecture | CPU architecture target for the file. | keyword | -| pe.company | Internal company name of the file, provided at compile-time. | keyword | -| pe.description | Internal description of the file, provided at compile-time. | keyword | -| pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| pe.product | Internal product name of the file, provided at compile-time. | keyword | -| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | -| process.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| process.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| process.code_signature.subject_name | Subject name of the code signer | keyword | -| process.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| process.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | -| process.hash.md5 | MD5 hash. | keyword | -| process.hash.sha1 | SHA1 hash. | keyword | -| process.hash.sha256 | SHA256 hash. | keyword | -| process.hash.sha512 | SHA512 hash. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.parent.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | -| process.parent.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| process.parent.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| process.parent.code_signature.subject_name | Subject name of the code signer | keyword | -| process.parent.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| process.parent.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.parent.executable | Absolute path to the process executable. | keyword | -| process.parent.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | -| process.parent.hash.md5 | MD5 hash. | keyword | -| process.parent.hash.sha1 | SHA1 hash. | keyword | -| process.parent.hash.sha256 | SHA256 hash. | keyword | -| process.parent.hash.sha512 | SHA512 hash. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.pe.architecture | CPU architecture target for the file. | keyword | -| process.parent.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| process.parent.pe.description | Internal description of the file, provided at compile-time. | keyword | -| process.parent.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| process.parent.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| process.parent.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| process.parent.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| process.parent.pgid | Identifier of the group of processes the process belongs to. | long | -| process.parent.pid | Process id. | long | -| process.parent.start | The time the process started. | date | -| process.parent.thread.id | Thread ID. | long | -| process.parent.thread.name | Thread name. | keyword | -| process.parent.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.parent.uptime | Seconds the process has been up. | long | -| process.parent.working_directory | The working directory of the process. | keyword | -| process.pe.architecture | CPU architecture target for the file. | keyword | -| process.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| process.pe.description | Internal description of the file, provided at compile-time. | keyword | -| process.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| process.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| process.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| process.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| process.pgid | Identifier of the group of processes the process belongs to. | long | -| process.pid | Process id. | long | -| process.start | The time the process started. | date | -| process.thread.id | Thread ID. | long | -| process.thread.name | Thread name. | keyword | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.uptime | Seconds the process has been up. | long | -| process.working_directory | The working directory of the process. | keyword | -| registry.data.bytes | Original bytes written with base64 encoding. For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | keyword | -| registry.data.strings | Content when writing string types. Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | wildcard | -| registry.data.type | Standard registry type for encoding contents | keyword | -| registry.hive | Abbreviated name for the hive. | keyword | -| registry.key | Hive-relative path of keys. | keyword | -| registry.path | Full path, including hive, key and value | keyword | -| registry.value | Name of the value written. | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.description | The description of the rule generating the event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.license | Name of the license under which the rule used to generate this event is made available. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.reference | Reference URL to additional information about the rule used to generate this event. The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | -| rule.version | The version / revision of the rule being used for analysis. | keyword | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| server.as.organization.name | Organization name. | keyword | -| server.bytes | Bytes sent from the server to the client. | long | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.geo.city_name | City name. | keyword | -| server.geo.continent_name | Name of the continent. | keyword | -| server.geo.country_iso_code | Country ISO code. | keyword | -| server.geo.country_name | Country name. | keyword | -| server.geo.location | Longitude and latitude. | geo_point | -| server.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| server.geo.region_iso_code | Region ISO code. | keyword | -| server.geo.region_name | Region name. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| server.mac | MAC address of the server. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| server.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| server.nat.port | Translated port of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | long | -| server.packets | Packets sent from the server to the client. | long | -| server.port | Port of the server. | long | -| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| server.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| server.user.email | User email address. | keyword | -| server.user.full_name | User's full name, if available. | keyword | -| server.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| server.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| server.user.group.name | Name of the group. | keyword | -| server.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| server.user.id | Unique identifier of the user. | keyword | -| server.user.name | Short name or login of the user. | keyword | -| server.user.roles | Array of user roles at the time of the event. | keyword | -| service.ephemeral_id | Ephemeral identifier of this service (if one exists). This id normally changes across restarts, but `service.id` does not. | keyword | -| service.id | Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| service.node.name | Name of a service node. This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. | keyword | -| service.state | Current state of the service. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| service.version | Version of the service the data was collected from. This allows to look at a data set only for a specific version of a service. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| source.registered_domain | The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| source.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| source.user.email | User email address. | keyword | -| source.user.full_name | User's full name, if available. | keyword | -| source.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| source.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| source.user.group.name | Name of the group. | keyword | -| source.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| source.user.id | Unique identifier of the user. | keyword | -| source.user.name | Short name or login of the user. | keyword | -| source.user.roles | Array of user roles at the time of the event. | keyword | -| span.id | Unique identifier of the span within the scope of its trace. A span represents an operation within a transaction, such as a request to another service, or a database query. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | -| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | -| threat.tactic.reference | The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.reference | The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| tls.cipher | String indicating the cipher used during the current connection. | keyword | -| tls.client.certificate | PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. | keyword | -| tls.client.certificate_chain | Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. | keyword | -| tls.client.hash.md5 | Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.client.hash.sha1 | Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.client.hash.sha256 | Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.client.issuer | Distinguished name of subject of the issuer of the x.509 certificate presented by the client. | keyword | -| tls.client.ja3 | A hash that identifies clients based on how they perform an SSL/TLS handshake. | keyword | -| tls.client.not_after | Date/Time indicating when client certificate is no longer considered valid. | date | -| tls.client.not_before | Date/Time indicating when client certificate is first considered valid. | date | -| tls.client.server_name | Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. | keyword | -| tls.client.subject | Distinguished name of subject of the x.509 certificate presented by the client. | keyword | -| tls.client.supported_ciphers | Array of ciphers offered by the client during the client hello. | keyword | -| tls.client.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| tls.client.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.country | List of country (C) codes | keyword | -| tls.client.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.locality | List of locality names (L) | keyword | -| tls.client.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.client.x509.not_after | Time at which the certificate is no longer considered valid. | date | -| tls.client.x509.not_before | Time at which the certificate is first considered valid. | date | -| tls.client.x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| tls.client.x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| tls.client.x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| tls.client.x509.public_key_size | The size of the public key space in bits. | long | -| tls.client.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| tls.client.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| tls.client.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.client.x509.subject.country | List of country (C) code | keyword | -| tls.client.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| tls.client.x509.subject.locality | List of locality names (L) | keyword | -| tls.client.x509.subject.organization | List of organizations (O) of subject. | keyword | -| tls.client.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| tls.client.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.client.x509.version_number | Version of x509 format. | keyword | -| tls.curve | String indicating the curve used for the given cipher, when applicable. | keyword | -| tls.established | Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. | boolean | -| tls.next_protocol | String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. | keyword | -| tls.resumed | Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. | boolean | -| tls.server.certificate | PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. | keyword | -| tls.server.certificate_chain | Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. | keyword | -| tls.server.hash.md5 | Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.server.hash.sha1 | Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.server.hash.sha256 | Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.server.issuer | Subject of the issuer of the x.509 certificate presented by the server. | keyword | -| tls.server.ja3s | A hash that identifies servers based on how they perform an SSL/TLS handshake. | keyword | -| tls.server.not_after | Timestamp indicating when server certificate is no longer considered valid. | date | -| tls.server.not_before | Timestamp indicating when server certificate is first considered valid. | date | -| tls.server.subject | Subject of the x.509 certificate presented by the server. | keyword | -| tls.server.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| tls.server.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.country | List of country (C) codes | keyword | -| tls.server.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.locality | List of locality names (L) | keyword | -| tls.server.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.server.x509.not_after | Time at which the certificate is no longer considered valid. | date | -| tls.server.x509.not_before | Time at which the certificate is first considered valid. | date | -| tls.server.x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| tls.server.x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| tls.server.x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| tls.server.x509.public_key_size | The size of the public key space in bits. | long | -| tls.server.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| tls.server.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| tls.server.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.server.x509.subject.country | List of country (C) code | keyword | -| tls.server.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| tls.server.x509.subject.locality | List of locality names (L) | keyword | -| tls.server.x509.subject.organization | List of organizations (O) of subject. | keyword | -| tls.server.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| tls.server.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.server.x509.version_number | Version of x509 format. | keyword | -| tls.version | Numeric part of the version parsed from the original string. | keyword | -| tls.version_protocol | Normalized lowercase protocol name parsed from original string. | keyword | -| trace.id | Unique identifier of the trace. A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services. | keyword | -| transaction.id | Unique identifier of the transaction within the scope of its trace. A transaction is the highest level of work measured within a service, such as a request to a server. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | -| url.full | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | wildcard | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.password | Password of the request. | keyword | -| url.path | Path of the request, such as "/search". | wildcard | -| url.port | Port of the request, such as 443. | long | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| url.username | Username of the request. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.group.id | Unique identifier for the group on the system/platform. | keyword | -| user.group.name | Name of the group. | keyword | -| user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.roles | Array of user roles at the time of the event. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.kernel | Operating system kernel version as a raw string. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | -| vlan.id | VLAN ID as reported by the observer. | keyword | -| vlan.name | Optional VLAN name as reported by the observer. | keyword | -| vulnerability.category | The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) This field must be an array. | keyword | -| vulnerability.classification | The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) | keyword | -| vulnerability.description | The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) | keyword | -| vulnerability.enumeration | The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) | keyword | -| vulnerability.id | The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] | keyword | -| vulnerability.reference | A resource that provides additional information, context, and mitigations for the identified vulnerability. | keyword | -| vulnerability.report_id | The report or scan identification number. | keyword | -| vulnerability.scanner.vendor | The name of the vulnerability scanner vendor. | keyword | -| vulnerability.score.base | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.score.environmental | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.score.temporal | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.score.version | The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | -| vulnerability.severity | The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | -| x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| x509.issuer.country | List of country (C) codes | keyword | -| x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| x509.issuer.locality | List of locality names (L) | keyword | -| x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| x509.not_after | Time at which the certificate is no longer considered valid. | date | -| x509.not_before | Time at which the certificate is first considered valid. | date | -| x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| x509.public_key_size | The size of the public key space in bits. | long | -| x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| x509.subject.common_name | List of common names (CN) of subject. | keyword | -| x509.subject.country | List of country (C) code | keyword | -| x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| x509.subject.locality | List of locality names (L) | keyword | -| x509.subject.organization | List of organizations (O) of subject. | keyword | -| x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| x509.version_number | Version of x509 format. | keyword | - - -### Junos - -The `junos` dataset collects Juniper JUNOS logs. - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | -| agent.build.original | Extended build information for the agent. This field is intended to contain any build information that a data source may provide, no specific formatting is required. | keyword | -| agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty. | keyword | -| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | -| agent.version | Version of the agent. | keyword | -| as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| as.organization.name | Organization name. | keyword | -| client.address | Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| client.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| client.as.organization.name | Organization name. | keyword | -| client.bytes | Bytes sent from the client to the server. | long | -| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| client.geo.city_name | City name. | keyword | -| client.geo.continent_name | Name of the continent. | keyword | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.country_name | Country name. | keyword | -| client.geo.location | Longitude and latitude. | geo_point | -| client.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| client.geo.region_iso_code | Region ISO code. | keyword | -| client.geo.region_name | Region name. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.mac | MAC address of the client. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| client.nat.ip | Translated IP of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | ip | -| client.nat.port | Translated port of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | long | -| client.packets | Packets sent from the client to the server. | long | -| client.port | Port of the client. | long | -| client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| client.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| client.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| client.user.email | User email address. | keyword | -| client.user.full_name | User's full name, if available. | keyword | -| client.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| client.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| client.user.group.name | Name of the group. | keyword | -| client.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| client.user.id | Unique identifier of the user. | keyword | -| client.user.name | Short name or login of the user. | keyword | -| client.user.roles | Array of user roles at the time of the event. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.project.name | The cloud project name. Examples: Google Cloud Project name, Azure Project name. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| code_signature.exists | Boolean to capture if a signature is present. | boolean | -| code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| code_signature.subject_name | Subject name of the code signer | keyword | -| code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.image.tag | Container image tags. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.packets | Packets sent from the destination to the source. | long | -| destination.port | Port of the destination. | long | -| destination.registered_domain | The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| destination.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| destination.user.email | User email address. | keyword | -| destination.user.full_name | User's full name, if available. | keyword | -| destination.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| destination.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| destination.user.group.name | Name of the group. | keyword | -| destination.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| destination.user.id | Unique identifier of the user. | keyword | -| destination.user.name | Short name or login of the user. | keyword | -| destination.user.roles | Array of user roles at the time of the event. | keyword | -| dll.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| dll.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| dll.code_signature.subject_name | Subject name of the code signer | keyword | -| dll.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| dll.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| dll.hash.md5 | MD5 hash. | keyword | -| dll.hash.sha1 | SHA1 hash. | keyword | -| dll.hash.sha256 | SHA256 hash. | keyword | -| dll.hash.sha512 | SHA512 hash. | keyword | -| dll.name | Name of the library. This generally maps to the name of the file on disk. | keyword | -| dll.path | Full file path of the library. | keyword | -| dll.pe.architecture | CPU architecture target for the file. | keyword | -| dll.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| dll.pe.description | Internal description of the file, provided at compile-time. | keyword | -| dll.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| dll.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| dll.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| dll.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| dns.answers | An array containing an object for each answer section returned by the server. The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. | object | -| dns.answers.class | The class of DNS data contained in this resource record. | keyword | -| dns.answers.data | The data describing the resource. The meaning of this data depends on the type and class of the resource record. | keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.header_flags | Array of 2 letter DNS header flags. Expected values are: AA, TC, RD, RA, AD, CD, DO. | keyword | -| dns.id | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | -| dns.op_code | The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. | keyword | -| dns.question.class | The class of records being queried. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.resolved_ip | Array containing all IPs seen in `answers.data`. The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ip | -| dns.response_code | The DNS response code. | keyword | -| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.code | Error code describing the error. | keyword | -| error.id | Unique identifier for the error. | keyword | -| error.message | Error message. | match_only_text | -| error.stack_trace | The stack trace of this error in plain text. | wildcard | -| error.type | The type of the error, for example the class name of the exception. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.hash | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | -| event.risk_score_norm | Normalized risk score or priority of the event, on a scale of 0 to 100. This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. | float | -| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| file.accessed | Last time the file was accessed. Note that not all filesystems keep track of access time. | date | -| file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | -| file.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| file.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| file.code_signature.subject_name | Subject name of the code signer | keyword | -| file.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| file.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| file.created | File creation time. Note that not all filesystems store the creation time. | date | -| file.ctime | Last time the file attributes or metadata changed. Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | date | -| file.device | Device that is the source of the file. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.drive_letter | Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| file.gid | Primary group ID (GID) of the file. | keyword | -| file.group | Primary group name of the file. | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha1 | SHA1 hash. | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.hash.sha512 | SHA512 hash. | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | -| file.mode | Mode of the file in octal representation. | keyword | -| file.mtime | Last time the file content was modified. | date | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.owner | File owner's username. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.pe.architecture | CPU architecture target for the file. | keyword | -| file.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| file.pe.description | Internal description of the file, provided at compile-time. | keyword | -| file.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| file.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| file.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| file.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.target_path | Target path for symlinks. | keyword | -| file.type | File type (file, dir, or symlink). | keyword | -| file.uid | The user ID (UID) or security identifier (SID) of the file owner. | keyword | -| file.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| file.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| file.x509.issuer.country | List of country (C) codes | keyword | -| file.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| file.x509.issuer.locality | List of locality names (L) | keyword | -| file.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| file.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| file.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| file.x509.not_after | Time at which the certificate is no longer considered valid. | date | -| file.x509.not_before | Time at which the certificate is first considered valid. | date | -| file.x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| file.x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| file.x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| file.x509.public_key_size | The size of the public key space in bits. | long | -| file.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| file.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| file.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| file.x509.subject.country | List of country (C) code | keyword | -| file.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| file.x509.subject.locality | List of locality names (L) | keyword | -| file.x509.subject.organization | List of organizations (O) of subject. | keyword | -| file.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| file.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| file.x509.version_number | Version of x509 format. | keyword | -| geo.city_name | City name. | keyword | -| geo.continent_name | Name of the continent. | keyword | -| geo.country_iso_code | Country ISO code. | keyword | -| geo.country_name | Country name. | keyword | -| geo.location | Longitude and latitude. | geo_point | -| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| geo.region_iso_code | Region ISO code. | keyword | -| geo.region_name | Region name. | keyword | -| group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| group.name | Name of the group. | keyword | -| hash.md5 | MD5 hash. | keyword | -| hash.sha1 | SHA1 hash. | keyword | -| hash.sha256 | SHA256 hash. | keyword | -| hash.sha512 | SHA512 hash. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.geo.city_name | City name. | keyword | -| host.geo.continent_name | Name of the continent. | keyword | -| host.geo.country_iso_code | Country ISO code. | keyword | -| host.geo.country_name | Country name. | keyword | -| host.geo.location | Longitude and latitude. | geo_point | -| host.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| host.geo.region_iso_code | Region ISO code. | keyword | -| host.geo.region_name | Region name. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.full | Operating system name, including the version or code name. | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| host.uptime | Seconds the host has been up. | long | -| http.request.body.bytes | Size in bytes of the request body. | long | -| http.request.body.content | The full HTTP request body. | wildcard | -| http.request.bytes | Total size in bytes of the request (body and headers). | long | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| http.response.body.bytes | Size in bytes of the response body. | long | -| http.response.body.content | The full HTTP response body. | wildcard | -| http.response.bytes | Total size in bytes of the response (body and headers). | long | -| http.response.status_code | HTTP response status code. | long | -| http.version | HTTP version. | keyword | -| input.type | Input type. | keyword | -| interface.alias | Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. | keyword | -| interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | -| interface.name | Interface name as reported by the system. | keyword | -| juniper.srx.action | action | keyword | -| juniper.srx.action_detail | action detail | keyword | -| juniper.srx.alert | repeat alert | keyword | -| juniper.srx.apbr_rule_type | apbr rule type | keyword | -| juniper.srx.application | application | keyword | -| juniper.srx.application_category | application category | keyword | -| juniper.srx.application_characteristics | application characteristics | keyword | -| juniper.srx.application_name | application name | keyword | -| juniper.srx.application_sub_category | application sub category | keyword | -| juniper.srx.attack_name | attack name | keyword | -| juniper.srx.category | filter category | keyword | -| juniper.srx.client_ip | client ip | ip | -| juniper.srx.connection_hit_rate | connection hit rate | integer | -| juniper.srx.connection_tag | connection tag | keyword | -| juniper.srx.context_hit_rate | context hit rate | integer | -| juniper.srx.context_name | context name | keyword | -| juniper.srx.context_value | context value | keyword | -| juniper.srx.context_value_hit_rate | context value hit rate | integer | -| juniper.srx.ddos_application_name | ddos application name | keyword | -| juniper.srx.dscp_value | apbr rule type | integer | -| juniper.srx.dst_nat_rule_name | dst nat rule name | keyword | -| juniper.srx.dst_nat_rule_type | dst nat rule type | keyword | -| juniper.srx.dst_vrf_grp | dst_vrf_grp | keyword | -| juniper.srx.elapsed_time | elapsed time | date | -| juniper.srx.encrypted | encrypted | keyword | -| juniper.srx.epoch_time | epoch time | date | -| juniper.srx.error_code | error_code | keyword | -| juniper.srx.error_message | error_message | keyword | -| juniper.srx.export_id | packet log id | integer | -| juniper.srx.feed_name | feed name | keyword | -| juniper.srx.file_category | file category | keyword | -| juniper.srx.file_hash_lookup | file hash lookup | keyword | -| juniper.srx.file_name | file name | keyword | -| juniper.srx.filename | filename | keyword | -| juniper.srx.hostname | hostname | keyword | -| juniper.srx.icmp_type | icmp type | integer | -| juniper.srx.inbound_bytes | bytes from server | integer | -| juniper.srx.inbound_packets | packets from server | integer | -| juniper.srx.index | index | keyword | -| juniper.srx.logical_system_name | logical system name | keyword | -| juniper.srx.malware_info | malware info | keyword | -| juniper.srx.message | mesagge | keyword | -| juniper.srx.message_type | message type | keyword | -| juniper.srx.name | name | keyword | -| juniper.srx.nat_connection_tag | nat connection tag | keyword | -| juniper.srx.nested_application | nested application | keyword | -| juniper.srx.obj | url path | keyword | -| juniper.srx.occur_count | occur count | integer | -| juniper.srx.outbound_bytes | bytes from client | integer | -| juniper.srx.outbound_packets | packets from client | integer | -| juniper.srx.packet_log_id | packet log id | integer | -| juniper.srx.peer_destination_address | peer destination address | ip | -| juniper.srx.peer_destination_port | peer destination port | integer | -| juniper.srx.peer_session_id | peer session id | keyword | -| juniper.srx.peer_source_address | peer source address | ip | -| juniper.srx.peer_source_port | peer source port | integer | -| juniper.srx.policy_name | policy name | keyword | -| juniper.srx.process | process that generated the message | keyword | -| juniper.srx.profile | filter profile | keyword | -| juniper.srx.profile_name | profile name | keyword | -| juniper.srx.protocol | protocol | keyword | -| juniper.srx.protocol_id | protocol id | keyword | -| juniper.srx.protocol_name | protocol name | keyword | -| juniper.srx.reason | reason | keyword | -| juniper.srx.repeat_count | repeat count | integer | -| juniper.srx.roles | roles | keyword | -| juniper.srx.routing_instance | routing instance | keyword | -| juniper.srx.rule_name | rule name | keyword | -| juniper.srx.ruleebase_name | ruleebase name | keyword | -| juniper.srx.sample_sha256 | sample sha256 | keyword | -| juniper.srx.secure_web_proxy_session_type | secure web proxy session type | keyword | -| juniper.srx.service_name | service name | keyword | -| juniper.srx.session_id | session id | keyword | -| juniper.srx.session_id_32 | session id 32 | keyword | -| juniper.srx.src_nat_rule_name | src nat rule name | keyword | -| juniper.srx.src_nat_rule_type | src nat rule type | keyword | -| juniper.srx.src_vrf_grp | src_vrf_grp | keyword | -| juniper.srx.state | state | keyword | -| juniper.srx.status | status | keyword | -| juniper.srx.sub_category | sub category | keyword | -| juniper.srx.tag | system log message tag, which uniquely identifies the message. | keyword | -| juniper.srx.temporary_filename | temporary_filename | keyword | -| juniper.srx.tenant_id | tenant id | keyword | -| juniper.srx.th | th | keyword | -| juniper.srx.threat_severity | threat severity | keyword | -| juniper.srx.time_count | time count | integer | -| juniper.srx.time_period | time period | integer | -| juniper.srx.time_scope | time scope | keyword | -| juniper.srx.timestamp | timestamp | date | -| juniper.srx.type | type | keyword | -| juniper.srx.uplink_rx_bytes | uplink rx bytes | integer | -| juniper.srx.uplink_tx_bytes | uplink tx bytes | integer | -| juniper.srx.url | url domain | keyword | -| juniper.srx.username | username | keyword | -| juniper.srx.verdict_number | verdict number | integer | -| juniper.srx.verdict_source | verdict source | keyword | -| labels | Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels. | object | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | -| log.offset | Byte offset of the log line within its file. | long | -| log.source.address | Source address of the syslog message. | keyword | -| log.syslog | The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164. | object | -| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | -| log.syslog.facility.name | The Syslog text-based facility of the log event, if available. | keyword | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | -| log.syslog.severity.name | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. | keyword | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.inner | Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) | object | -| network.inner.vlan.id | VLAN ID as reported by the observer. | keyword | -| network.inner.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| network.vlan.id | VLAN ID as reported by the observer. | keyword | -| network.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| observer.egress | Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. | object | -| observer.egress.interface.alias | Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. | keyword | -| observer.egress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.egress.vlan.id | VLAN ID as reported by the observer. | keyword | -| observer.egress.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.geo.city_name | City name. | keyword | -| observer.geo.continent_name | Name of the continent. | keyword | -| observer.geo.country_iso_code | Country ISO code. | keyword | -| observer.geo.country_name | Country name. | keyword | -| observer.geo.location | Longitude and latitude. | geo_point | -| observer.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| observer.geo.region_iso_code | Region ISO code. | keyword | -| observer.geo.region_name | Region name. | keyword | -| observer.hostname | Hostname of the observer. | keyword | -| observer.ingress | Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. | object | -| observer.ingress.interface.alias | Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. | keyword | -| observer.ingress.interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.vlan.id | VLAN ID as reported by the observer. | keyword | -| observer.ingress.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.mac | MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | -| observer.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| observer.os.full | Operating system name, including the version or code name. | keyword | -| observer.os.kernel | Operating system kernel version as a raw string. | keyword | -| observer.os.name | Operating system name, without the version. | keyword | -| observer.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| observer.os.version | Operating system version as a raw string. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.serial_number | Observer serial number. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| organization.id | Unique identifier for the organization. | keyword | -| organization.name | Organization name. | keyword | -| os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| os.full | Operating system name, including the version or code name. | keyword | -| os.kernel | Operating system kernel version as a raw string. | keyword | -| os.name | Operating system name, without the version. | keyword | -| os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| os.version | Operating system version as a raw string. | keyword | -| package.architecture | Package architecture. | keyword | -| package.build_version | Additional information about the build version of the installed package. For example use the commit SHA of a non-released package. | keyword | -| package.checksum | Checksum of the installed package for verification. | keyword | -| package.description | Description of the package. | keyword | -| package.install_scope | Indicating how the package was installed, e.g. user-local, global. | keyword | -| package.installed | Time when package was installed. | date | -| package.license | License under which the package was released. Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). | keyword | -| package.name | Package name | keyword | -| package.path | Path where the package is installed. | keyword | -| package.reference | Home page or reference URL of the software in this package, if available. | keyword | -| package.size | Package size in bytes. | long | -| package.type | Type of package. This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. | keyword | -| package.version | Package version | keyword | -| pe.architecture | CPU architecture target for the file. | keyword | -| pe.company | Internal company name of the file, provided at compile-time. | keyword | -| pe.description | Internal description of the file, provided at compile-time. | keyword | -| pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| pe.product | Internal product name of the file, provided at compile-time. | keyword | -| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | -| process.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| process.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| process.code_signature.subject_name | Subject name of the code signer | keyword | -| process.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| process.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | -| process.hash.md5 | MD5 hash. | keyword | -| process.hash.sha1 | SHA1 hash. | keyword | -| process.hash.sha256 | SHA256 hash. | keyword | -| process.hash.sha512 | SHA512 hash. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.parent.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | -| process.parent.code_signature.exists | Boolean to capture if a signature is present. | boolean | -| process.parent.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | -| process.parent.code_signature.subject_name | Subject name of the code signer | keyword | -| process.parent.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | -| process.parent.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean | -| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.parent.executable | Absolute path to the process executable. | keyword | -| process.parent.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | -| process.parent.hash.md5 | MD5 hash. | keyword | -| process.parent.hash.sha1 | SHA1 hash. | keyword | -| process.parent.hash.sha256 | SHA256 hash. | keyword | -| process.parent.hash.sha512 | SHA512 hash. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.pe.architecture | CPU architecture target for the file. | keyword | -| process.parent.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| process.parent.pe.description | Internal description of the file, provided at compile-time. | keyword | -| process.parent.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| process.parent.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| process.parent.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| process.parent.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| process.parent.pgid | Identifier of the group of processes the process belongs to. | long | -| process.parent.pid | Process id. | long | -| process.parent.start | The time the process started. | date | -| process.parent.thread.id | Thread ID. | long | -| process.parent.thread.name | Thread name. | keyword | -| process.parent.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.parent.uptime | Seconds the process has been up. | long | -| process.parent.working_directory | The working directory of the process. | keyword | -| process.pe.architecture | CPU architecture target for the file. | keyword | -| process.pe.company | Internal company name of the file, provided at compile-time. | keyword | -| process.pe.description | Internal description of the file, provided at compile-time. | keyword | -| process.pe.file_version | Internal version of the file, provided at compile-time. | keyword | -| process.pe.imphash | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | keyword | -| process.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | -| process.pe.product | Internal product name of the file, provided at compile-time. | keyword | -| process.pgid | Identifier of the group of processes the process belongs to. | long | -| process.pid | Process id. | long | -| process.start | The time the process started. | date | -| process.thread.id | Thread ID. | long | -| process.thread.name | Thread name. | keyword | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.uptime | Seconds the process has been up. | long | -| process.working_directory | The working directory of the process. | keyword | -| registry.data.bytes | Original bytes written with base64 encoding. For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | keyword | -| registry.data.strings | Content when writing string types. Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | wildcard | -| registry.data.type | Standard registry type for encoding contents | keyword | -| registry.hive | Abbreviated name for the hive. | keyword | -| registry.key | Hive-relative path of keys. | keyword | -| registry.path | Full path, including hive, key and value | keyword | -| registry.value | Name of the value written. | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.description | The description of the rule generating the event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.license | Name of the license under which the rule used to generate this event is made available. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.reference | Reference URL to additional information about the rule used to generate this event. The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | -| rule.version | The version / revision of the rule being used for analysis. | keyword | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| server.as.organization.name | Organization name. | keyword | -| server.bytes | Bytes sent from the server to the client. | long | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.geo.city_name | City name. | keyword | -| server.geo.continent_name | Name of the continent. | keyword | -| server.geo.country_iso_code | Country ISO code. | keyword | -| server.geo.country_name | Country name. | keyword | -| server.geo.location | Longitude and latitude. | geo_point | -| server.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| server.geo.region_iso_code | Region ISO code. | keyword | -| server.geo.region_name | Region name. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| server.mac | MAC address of the server. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| server.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| server.nat.port | Translated port of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | long | -| server.packets | Packets sent from the server to the client. | long | -| server.port | Port of the server. | long | -| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| server.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| server.user.email | User email address. | keyword | -| server.user.full_name | User's full name, if available. | keyword | -| server.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| server.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| server.user.group.name | Name of the group. | keyword | -| server.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| server.user.id | Unique identifier of the user. | keyword | -| server.user.name | Short name or login of the user. | keyword | -| server.user.roles | Array of user roles at the time of the event. | keyword | -| service.ephemeral_id | Ephemeral identifier of this service (if one exists). This id normally changes across restarts, but `service.id` does not. | keyword | -| service.id | Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| service.node.name | Name of a service node. This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. | keyword | -| service.state | Current state of the service. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| service.version | Version of the service the data was collected from. This allows to look at a data set only for a specific version of a service. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| source.registered_domain | The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| source.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| source.user.email | User email address. | keyword | -| source.user.full_name | User's full name, if available. | keyword | -| source.user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| source.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| source.user.group.name | Name of the group. | keyword | -| source.user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| source.user.id | Unique identifier of the user. | keyword | -| source.user.name | Short name or login of the user. | keyword | -| source.user.roles | Array of user roles at the time of the event. | keyword | -| span.id | Unique identifier of the span within the scope of its trace. A span represents an operation within a transaction, such as a request to another service, or a database query. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | -| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | -| threat.tactic.reference | The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.reference | The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| tls.cipher | String indicating the cipher used during the current connection. | keyword | -| tls.client.certificate | PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. | keyword | -| tls.client.certificate_chain | Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. | keyword | -| tls.client.hash.md5 | Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.client.hash.sha1 | Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.client.hash.sha256 | Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.client.issuer | Distinguished name of subject of the issuer of the x.509 certificate presented by the client. | keyword | -| tls.client.ja3 | A hash that identifies clients based on how they perform an SSL/TLS handshake. | keyword | -| tls.client.not_after | Date/Time indicating when client certificate is no longer considered valid. | date | -| tls.client.not_before | Date/Time indicating when client certificate is first considered valid. | date | -| tls.client.server_name | Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. | keyword | -| tls.client.subject | Distinguished name of subject of the x.509 certificate presented by the client. | keyword | -| tls.client.supported_ciphers | Array of ciphers offered by the client during the client hello. | keyword | -| tls.client.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| tls.client.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.country | List of country (C) codes | keyword | -| tls.client.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.locality | List of locality names (L) | keyword | -| tls.client.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| tls.client.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.client.x509.not_after | Time at which the certificate is no longer considered valid. | date | -| tls.client.x509.not_before | Time at which the certificate is first considered valid. | date | -| tls.client.x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| tls.client.x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| tls.client.x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| tls.client.x509.public_key_size | The size of the public key space in bits. | long | -| tls.client.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| tls.client.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| tls.client.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.client.x509.subject.country | List of country (C) code | keyword | -| tls.client.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| tls.client.x509.subject.locality | List of locality names (L) | keyword | -| tls.client.x509.subject.organization | List of organizations (O) of subject. | keyword | -| tls.client.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| tls.client.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.client.x509.version_number | Version of x509 format. | keyword | -| tls.curve | String indicating the curve used for the given cipher, when applicable. | keyword | -| tls.established | Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. | boolean | -| tls.next_protocol | String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. | keyword | -| tls.resumed | Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. | boolean | -| tls.server.certificate | PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. | keyword | -| tls.server.certificate_chain | Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. | keyword | -| tls.server.hash.md5 | Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.server.hash.sha1 | Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.server.hash.sha256 | Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | keyword | -| tls.server.issuer | Subject of the issuer of the x.509 certificate presented by the server. | keyword | -| tls.server.ja3s | A hash that identifies servers based on how they perform an SSL/TLS handshake. | keyword | -| tls.server.not_after | Timestamp indicating when server certificate is no longer considered valid. | date | -| tls.server.not_before | Timestamp indicating when server certificate is first considered valid. | date | -| tls.server.subject | Subject of the x.509 certificate presented by the server. | keyword | -| tls.server.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| tls.server.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.country | List of country (C) codes | keyword | -| tls.server.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.locality | List of locality names (L) | keyword | -| tls.server.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.server.x509.not_after | Time at which the certificate is no longer considered valid. | date | -| tls.server.x509.not_before | Time at which the certificate is first considered valid. | date | -| tls.server.x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| tls.server.x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| tls.server.x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| tls.server.x509.public_key_size | The size of the public key space in bits. | long | -| tls.server.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| tls.server.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| tls.server.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.server.x509.subject.country | List of country (C) code | keyword | -| tls.server.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| tls.server.x509.subject.locality | List of locality names (L) | keyword | -| tls.server.x509.subject.organization | List of organizations (O) of subject. | keyword | -| tls.server.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| tls.server.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| tls.server.x509.version_number | Version of x509 format. | keyword | -| tls.version | Numeric part of the version parsed from the original string. | keyword | -| tls.version_protocol | Normalized lowercase protocol name parsed from original string. | keyword | -| trace.id | Unique identifier of the trace. A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services. | keyword | -| transaction.id | Unique identifier of the transaction within the scope of its trace. A transaction is the highest level of work measured within a service, such as a request to a server. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | -| url.full | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | wildcard | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.password | Password of the request. | keyword | -| url.path | Path of the request, such as "/search". | wildcard | -| url.port | Port of the request, such as 443. | long | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| url.username | Username of the request. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.group.id | Unique identifier for the group on the system/platform. | keyword | -| user.group.name | Name of the group. | keyword | -| user.hash | Unique user hash to correlate information for a user in anonymized form. Useful if `user.id` or `user.name` contain confidential information and cannot be used. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.roles | Array of user roles at the time of the event. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.kernel | Operating system kernel version as a raw string. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | -| vlan.id | VLAN ID as reported by the observer. | keyword | -| vlan.name | Optional VLAN name as reported by the observer. | keyword | -| vulnerability.category | The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) This field must be an array. | keyword | -| vulnerability.classification | The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) | keyword | -| vulnerability.description | The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) | keyword | -| vulnerability.enumeration | The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) | keyword | -| vulnerability.id | The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] | keyword | -| vulnerability.reference | A resource that provides additional information, context, and mitigations for the identified vulnerability. | keyword | -| vulnerability.report_id | The report or scan identification number. | keyword | -| vulnerability.scanner.vendor | The name of the vulnerability scanner vendor. | keyword | -| vulnerability.score.base | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.score.environmental | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.score.temporal | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.score.version | The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | -| vulnerability.severity | The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | -| x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| x509.issuer.country | List of country (C) codes | keyword | -| x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| x509.issuer.locality | List of locality names (L) | keyword | -| x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | -| x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | -| x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | -| x509.not_after | Time at which the certificate is no longer considered valid. | date | -| x509.not_before | Time at which the certificate is first considered valid. | date | -| x509.public_key_algorithm | Algorithm used to generate the public key. | keyword | -| x509.public_key_curve | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | keyword | -| x509.public_key_exponent | Exponent used to derive the public key. This is algorithm specific. | long | -| x509.public_key_size | The size of the public key space in bits. | long | -| x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | -| x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | -| x509.subject.common_name | List of common names (CN) of subject. | keyword | -| x509.subject.country | List of country (C) code | keyword | -| x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | -| x509.subject.locality | List of locality names (L) | keyword | -| x509.subject.organization | List of organizations (O) of subject. | keyword | -| x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | -| x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | -| x509.version_number | Version of x509 format. | keyword | - - -### Netscreen - -The `netscreen` dataset collects Netscreen logs. - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| client.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| client.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.port | Port of the destination. | long | -| destination.registered_domain | The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| destination.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| destination.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.question.domain | Server domain. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| geo.city_name | City name. | keyword | -| geo.country_name | Country name. | keyword | -| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| geo.region_name | Region name. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| group.name | Name of the group. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| input.type | Type of Filebeat input. | keyword | -| log.file.path | Full path to the log file this event came from. | keyword | -| log.flags | Flags for the log file. | keyword | -| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | -| network.interface.name | | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.pid | Process id. | long | -| process.parent.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.pid | Process id. | long | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rsa.counters.dclass_c1 | This is a generic counter key that should be used with the label dclass.c1.str only | long | -| rsa.counters.dclass_c1_str | This is a generic counter string key that should be used with the label dclass.c1 only | keyword | -| rsa.counters.dclass_c2 | This is a generic counter key that should be used with the label dclass.c2.str only | long | -| rsa.counters.dclass_c2_str | This is a generic counter string key that should be used with the label dclass.c2 only | keyword | -| rsa.counters.dclass_c3 | This is a generic counter key that should be used with the label dclass.c3.str only | long | -| rsa.counters.dclass_c3_str | This is a generic counter string key that should be used with the label dclass.c3 only | keyword | -| rsa.counters.dclass_r1 | This is a generic ratio key that should be used with the label dclass.r1.str only | keyword | -| rsa.counters.dclass_r1_str | This is a generic ratio string key that should be used with the label dclass.r1 only | keyword | -| rsa.counters.dclass_r2 | This is a generic ratio key that should be used with the label dclass.r2.str only | keyword | -| rsa.counters.dclass_r2_str | This is a generic ratio string key that should be used with the label dclass.r2 only | keyword | -| rsa.counters.dclass_r3 | This is a generic ratio key that should be used with the label dclass.r3.str only | keyword | -| rsa.counters.dclass_r3_str | This is a generic ratio string key that should be used with the label dclass.r3 only | keyword | -| rsa.counters.event_counter | This is used to capture the number of times an event repeated | long | -| rsa.crypto.cert_ca | This key is used to capture the Certificate signing authority only | keyword | -| rsa.crypto.cert_checksum | | keyword | -| rsa.crypto.cert_common | This key is used to capture the Certificate common name only | keyword | -| rsa.crypto.cert_error | This key captures the Certificate Error String | keyword | -| rsa.crypto.cert_host_cat | This key is used for the hostname category value of a certificate | keyword | -| rsa.crypto.cert_host_name | Deprecated key defined only in table map. | keyword | -| rsa.crypto.cert_issuer | | keyword | -| rsa.crypto.cert_keysize | | keyword | -| rsa.crypto.cert_serial | This key is used to capture the Certificate serial number only | keyword | -| rsa.crypto.cert_status | This key captures Certificate validation status | keyword | -| rsa.crypto.cert_subject | This key is used to capture the Certificate organization only | keyword | -| rsa.crypto.cert_username | | keyword | -| rsa.crypto.cipher_dst | This key is for Destination (Server) Cipher | keyword | -| rsa.crypto.cipher_size_dst | This key captures Destination (Server) Cipher Size | long | -| rsa.crypto.cipher_size_src | This key captures Source (Client) Cipher Size | long | -| rsa.crypto.cipher_src | This key is for Source (Client) Cipher | keyword | -| rsa.crypto.crypto | This key is used to capture the Encryption Type or Encryption Key only | keyword | -| rsa.crypto.d_certauth | | keyword | -| rsa.crypto.https_insact | | keyword | -| rsa.crypto.https_valid | | keyword | -| rsa.crypto.ike | IKE negotiation phase. | keyword | -| rsa.crypto.ike_cookie1 | ID of the negotiation — sent for ISAKMP Phase One | keyword | -| rsa.crypto.ike_cookie2 | ID of the negotiation — sent for ISAKMP Phase Two | keyword | -| rsa.crypto.peer | This key is for Encryption peer's IP Address | keyword | -| rsa.crypto.peer_id | This key is for Encryption peer’s identity | keyword | -| rsa.crypto.s_certauth | | keyword | -| rsa.crypto.scheme | This key captures the Encryption scheme used | keyword | -| rsa.crypto.sig_type | This key captures the Signature Type | keyword | -| rsa.crypto.ssl_ver_dst | Deprecated, use version | keyword | -| rsa.crypto.ssl_ver_src | Deprecated, use version | keyword | -| rsa.db.database | This key is used to capture the name of a database or an instance as seen in a session | keyword | -| rsa.db.db_id | This key is used to capture the unique identifier for a database | keyword | -| rsa.db.db_pid | This key captures the process id of a connection with database server | long | -| rsa.db.index | This key captures IndexID of the index. | keyword | -| rsa.db.instance | This key is used to capture the database server instance name | keyword | -| rsa.db.lread | This key is used for the number of logical reads | long | -| rsa.db.lwrite | This key is used for the number of logical writes | long | -| rsa.db.permissions | This key captures permission or privilege level assigned to a resource. | keyword | -| rsa.db.pread | This key is used for the number of physical writes | long | -| rsa.db.table_name | This key is used to capture the table name | keyword | -| rsa.db.transact_id | This key captures the SQL transantion ID of the current session | keyword | -| rsa.email.email | This key is used to capture a generic email address where the source or destination context is not clear | keyword | -| rsa.email.email_dst | This key is used to capture the Destination email address only, when the destination context is not clear use email | keyword | -| rsa.email.email_src | This key is used to capture the source email address only, when the source context is not clear use email | keyword | -| rsa.email.subject | This key is used to capture the subject string from an Email only. | keyword | -| rsa.email.trans_from | Deprecated key defined only in table map. | keyword | -| rsa.email.trans_to | Deprecated key defined only in table map. | keyword | -| rsa.endpoint.host_state | This key is used to capture the current state of the machine, such as \blacklisted\, \infected\, \firewall disabled\ and so on | keyword | -| rsa.endpoint.registry_key | This key captures the path to the registry key | keyword | -| rsa.endpoint.registry_value | This key captures values or decorators used within a registry entry | keyword | -| rsa.file.attachment | This key captures the attachment file name | keyword | -| rsa.file.binary | Deprecated key defined only in table map. | keyword | -| rsa.file.directory_dst | \This key is used to capture the directory of the target process or file\ | keyword | -| rsa.file.directory_src | This key is used to capture the directory of the source process or file | keyword | -| rsa.file.file_entropy | This is used to capture entropy vale of a file | double | -| rsa.file.file_vendor | This is used to capture Company name of file located in version_info | keyword | -| rsa.file.filename_dst | This is used to capture name of the file targeted by the action | keyword | -| rsa.file.filename_src | This is used to capture name of the parent filename, the file which performed the action | keyword | -| rsa.file.filename_tmp | | keyword | -| rsa.file.filesystem | | keyword | -| rsa.file.privilege | Deprecated, use permissions | keyword | -| rsa.file.task_name | This is used to capture name of the task | keyword | -| rsa.healthcare.patient_fname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_id | This key captures the unique ID for a patient | keyword | -| rsa.healthcare.patient_lname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_mname | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.accesses | This key is used to capture actual privileges used in accessing an object | keyword | -| rsa.identity.auth_method | This key is used to capture authentication methods used only | keyword | -| rsa.identity.dn | X.500 (LDAP) Distinguished Name | keyword | -| rsa.identity.dn_dst | An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn | keyword | -| rsa.identity.dn_src | An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn | keyword | -| rsa.identity.federated_idp | This key is the federated Identity Provider. This is the server providing the authentication. | keyword | -| rsa.identity.federated_sp | This key is the Federated Service Provider. This is the application requesting authentication. | keyword | -| rsa.identity.firstname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.host_role | This key should only be used to capture the role of a Host Machine | keyword | -| rsa.identity.lastname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.ldap | This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context | keyword | -| rsa.identity.ldap_query | This key is the Search criteria from an LDAP search | keyword | -| rsa.identity.ldap_response | This key is to capture Results from an LDAP search | keyword | -| rsa.identity.logon_type | This key is used to capture the type of logon method used. | keyword | -| rsa.identity.logon_type_desc | This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. | keyword | -| rsa.identity.middlename | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.org | This key captures the User organization | keyword | -| rsa.identity.owner | This is used to capture username the process or service is running as, the author of the task | keyword | -| rsa.identity.password | This key is for Passwords seen in any session, plain text or encrypted | keyword | -| rsa.identity.profile | This key is used to capture the user profile | keyword | -| rsa.identity.realm | Radius realm or similar grouping of accounts | keyword | -| rsa.identity.service_account | This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage | keyword | -| rsa.identity.user_dept | User's Department Names only | keyword | -| rsa.identity.user_role | This key is used to capture the Role of a user only | keyword | -| rsa.identity.user_sid_dst | This key captures Destination User Session ID | keyword | -| rsa.identity.user_sid_src | This key captures Source User Session ID | keyword | -| rsa.internal.audit_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.cid | This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.data | Deprecated key defined only in table map. | keyword | -| rsa.internal.dead | Deprecated key defined only in table map. | long | -| rsa.internal.device_class | This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_group | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_host | This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_ip | This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_ipv6 | This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_type | This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_type_id | Deprecated key defined only in table map. | long | -| rsa.internal.did | This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.entropy_req | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entropy_res | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entry | Deprecated key defined only in table map. | keyword | -| rsa.internal.event_desc | | keyword | -| rsa.internal.event_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.feed_category | This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_desc | This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_name | This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.forward_ip | This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. | ip | -| rsa.internal.forward_ipv6 | This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.hcode | Deprecated key defined only in table map. | keyword | -| rsa.internal.header_id | This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.inode | Deprecated key defined only in table map. | long | -| rsa.internal.lc_cid | This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.lc_ctime | This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | date | -| rsa.internal.level | Deprecated key defined only in table map. | long | -| rsa.internal.mcb_req | This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcb_res | This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcbc_req | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.mcbc_res | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.medium | This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session | long | -| rsa.internal.message | This key captures the contents of instant messages | keyword | -| rsa.internal.messageid | | keyword | -| rsa.internal.msg | This key is used to capture the raw message that comes into the Log Decoder | keyword | -| rsa.internal.msg_id | This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.msg_vid | This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.node_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.nwe_callback_id | This key denotes that event is endpoint related | keyword | -| rsa.internal.obj_id | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_server | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_val | Deprecated key defined only in table map. | keyword | -| rsa.internal.parse_error | This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.payload_req | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.payload_res | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.process_vid_dst | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. | keyword | -| rsa.internal.process_vid_src | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. | keyword | -| rsa.internal.resource | Deprecated key defined only in table map. | keyword | -| rsa.internal.resource_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.rid | This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.session_split | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.site | Deprecated key defined only in table map. | keyword | -| rsa.internal.size | This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.sourcefile | This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.statement | Deprecated key defined only in table map. | keyword | -| rsa.internal.time | This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. | date | -| rsa.internal.ubc_req | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.ubc_res | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.word | This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log | keyword | -| rsa.investigations.analysis_file | This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file | keyword | -| rsa.investigations.analysis_service | This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service | keyword | -| rsa.investigations.analysis_session | This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session | keyword | -| rsa.investigations.boc | This is used to capture behaviour of compromise | keyword | -| rsa.investigations.ec_activity | This key captures the particular event activity(Ex:Logoff) | keyword | -| rsa.investigations.ec_outcome | This key captures the outcome of a particular Event(Ex:Success) | keyword | -| rsa.investigations.ec_subject | This key captures the Subject of a particular Event(Ex:User) | keyword | -| rsa.investigations.ec_theme | This key captures the Theme of a particular Event(Ex:Authentication) | keyword | -| rsa.investigations.eoc | This is used to capture Enablers of Compromise | keyword | -| rsa.investigations.event_cat | This key captures the Event category number | long | -| rsa.investigations.event_cat_name | This key captures the event category name corresponding to the event cat code | keyword | -| rsa.investigations.event_vcat | This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. | keyword | -| rsa.investigations.inv_category | This used to capture investigation category | keyword | -| rsa.investigations.inv_context | This used to capture investigation context | keyword | -| rsa.investigations.ioc | This is key capture indicator of compromise | keyword | -| rsa.misc.OS | This key captures the Name of the Operating System | keyword | -| rsa.misc.acl_id | | keyword | -| rsa.misc.acl_op | | keyword | -| rsa.misc.acl_pos | | keyword | -| rsa.misc.acl_table | | keyword | -| rsa.misc.action | | keyword | -| rsa.misc.admin | | keyword | -| rsa.misc.agent_id | This key is used to capture agent id | keyword | -| rsa.misc.alarm_id | | keyword | -| rsa.misc.alarmname | | keyword | -| rsa.misc.alert_id | Deprecated, New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.app_id | | keyword | -| rsa.misc.audit | | keyword | -| rsa.misc.audit_object | | keyword | -| rsa.misc.auditdata | | keyword | -| rsa.misc.autorun_type | This is used to capture Auto Run type | keyword | -| rsa.misc.benchmark | | keyword | -| rsa.misc.bypass | | keyword | -| rsa.misc.cache | | keyword | -| rsa.misc.cache_hit | | keyword | -| rsa.misc.category | This key is used to capture the category of an event given by the vendor in the session | keyword | -| rsa.misc.cc_number | Valid Credit Card Numbers only | long | -| rsa.misc.cefversion | | keyword | -| rsa.misc.cfg_attr | | keyword | -| rsa.misc.cfg_obj | | keyword | -| rsa.misc.cfg_path | | keyword | -| rsa.misc.change_attrib | This key is used to capture the name of the attribute that’s changing in a session | keyword | -| rsa.misc.change_new | This key is used to capture the new values of the attribute that’s changing in a session | keyword | -| rsa.misc.change_old | This key is used to capture the old value of the attribute that’s changing in a session | keyword | -| rsa.misc.changes | | keyword | -| rsa.misc.checksum | This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. | keyword | -| rsa.misc.checksum_dst | This key is used to capture the checksum or hash of the the target entity such as a process or file. | keyword | -| rsa.misc.checksum_src | This key is used to capture the checksum or hash of the source entity such as a file or process. | keyword | -| rsa.misc.client | This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. | keyword | -| rsa.misc.client_ip | | keyword | -| rsa.misc.clustermembers | | keyword | -| rsa.misc.cmd | | keyword | -| rsa.misc.cn_acttimeout | | keyword | -| rsa.misc.cn_asn_src | | keyword | -| rsa.misc.cn_bgpv4nxthop | | keyword | -| rsa.misc.cn_ctr_dst_code | | keyword | -| rsa.misc.cn_dst_tos | | keyword | -| rsa.misc.cn_dst_vlan | | keyword | -| rsa.misc.cn_engine_id | | keyword | -| rsa.misc.cn_engine_type | | keyword | -| rsa.misc.cn_f_switch | | keyword | -| rsa.misc.cn_flowsampid | | keyword | -| rsa.misc.cn_flowsampintv | | keyword | -| rsa.misc.cn_flowsampmode | | keyword | -| rsa.misc.cn_inacttimeout | | keyword | -| rsa.misc.cn_inpermbyts | | keyword | -| rsa.misc.cn_inpermpckts | | keyword | -| rsa.misc.cn_invalid | | keyword | -| rsa.misc.cn_ip_proto_ver | | keyword | -| rsa.misc.cn_ipv4_ident | | keyword | -| rsa.misc.cn_l_switch | | keyword | -| rsa.misc.cn_log_did | | keyword | -| rsa.misc.cn_log_rid | | keyword | -| rsa.misc.cn_max_ttl | | keyword | -| rsa.misc.cn_maxpcktlen | | keyword | -| rsa.misc.cn_min_ttl | | keyword | -| rsa.misc.cn_minpcktlen | | keyword | -| rsa.misc.cn_mpls_lbl_1 | | keyword | -| rsa.misc.cn_mpls_lbl_10 | | keyword | -| rsa.misc.cn_mpls_lbl_2 | | keyword | -| rsa.misc.cn_mpls_lbl_3 | | keyword | -| rsa.misc.cn_mpls_lbl_4 | | keyword | -| rsa.misc.cn_mpls_lbl_5 | | keyword | -| rsa.misc.cn_mpls_lbl_6 | | keyword | -| rsa.misc.cn_mpls_lbl_7 | | keyword | -| rsa.misc.cn_mpls_lbl_8 | | keyword | -| rsa.misc.cn_mpls_lbl_9 | | keyword | -| rsa.misc.cn_mplstoplabel | | keyword | -| rsa.misc.cn_mplstoplabip | | keyword | -| rsa.misc.cn_mul_dst_byt | | keyword | -| rsa.misc.cn_mul_dst_pks | | keyword | -| rsa.misc.cn_muligmptype | | keyword | -| rsa.misc.cn_sampalgo | | keyword | -| rsa.misc.cn_sampint | | keyword | -| rsa.misc.cn_seqctr | | keyword | -| rsa.misc.cn_spackets | | keyword | -| rsa.misc.cn_src_tos | | keyword | -| rsa.misc.cn_src_vlan | | keyword | -| rsa.misc.cn_sysuptime | | keyword | -| rsa.misc.cn_template_id | | keyword | -| rsa.misc.cn_totbytsexp | | keyword | -| rsa.misc.cn_totflowexp | | keyword | -| rsa.misc.cn_totpcktsexp | | keyword | -| rsa.misc.cn_unixnanosecs | | keyword | -| rsa.misc.cn_v6flowlabel | | keyword | -| rsa.misc.cn_v6optheaders | | keyword | -| rsa.misc.code | | keyword | -| rsa.misc.command | | keyword | -| rsa.misc.comments | Comment information provided in the log message | keyword | -| rsa.misc.comp_class | | keyword | -| rsa.misc.comp_name | | keyword | -| rsa.misc.comp_rbytes | | keyword | -| rsa.misc.comp_sbytes | | keyword | -| rsa.misc.comp_version | This key captures the Version level of a sub-component of a product. | keyword | -| rsa.misc.connection_id | This key captures the Connection ID | keyword | -| rsa.misc.content | This key captures the content type from protocol headers | keyword | -| rsa.misc.content_type | This key is used to capture Content Type only. | keyword | -| rsa.misc.content_version | This key captures Version level of a signature or database content. | keyword | -| rsa.misc.context | This key captures Information which adds additional context to the event. | keyword | -| rsa.misc.context_subject | This key is to be used in an audit context where the subject is the object being identified | keyword | -| rsa.misc.context_target | | keyword | -| rsa.misc.count | | keyword | -| rsa.misc.cpu | This key is the CPU time used in the execution of the event being recorded. | long | -| rsa.misc.cpu_data | | keyword | -| rsa.misc.criticality | | keyword | -| rsa.misc.cs_agency_dst | | keyword | -| rsa.misc.cs_analyzedby | | keyword | -| rsa.misc.cs_av_other | | keyword | -| rsa.misc.cs_av_primary | | keyword | -| rsa.misc.cs_av_secondary | | keyword | -| rsa.misc.cs_bgpv6nxthop | | keyword | -| rsa.misc.cs_bit9status | | keyword | -| rsa.misc.cs_context | | keyword | -| rsa.misc.cs_control | | keyword | -| rsa.misc.cs_data | | keyword | -| rsa.misc.cs_datecret | | keyword | -| rsa.misc.cs_dst_tld | | keyword | -| rsa.misc.cs_eth_dst_ven | | keyword | -| rsa.misc.cs_eth_src_ven | | keyword | -| rsa.misc.cs_event_uuid | | keyword | -| rsa.misc.cs_filetype | | keyword | -| rsa.misc.cs_fld | | keyword | -| rsa.misc.cs_if_desc | | keyword | -| rsa.misc.cs_if_name | | keyword | -| rsa.misc.cs_ip_next_hop | | keyword | -| rsa.misc.cs_ipv4dstpre | | keyword | -| rsa.misc.cs_ipv4srcpre | | keyword | -| rsa.misc.cs_lifetime | | keyword | -| rsa.misc.cs_log_medium | | keyword | -| rsa.misc.cs_loginname | | keyword | -| rsa.misc.cs_modulescore | | keyword | -| rsa.misc.cs_modulesign | | keyword | -| rsa.misc.cs_opswatresult | | keyword | -| rsa.misc.cs_payload | | keyword | -| rsa.misc.cs_registrant | | keyword | -| rsa.misc.cs_registrar | | keyword | -| rsa.misc.cs_represult | | keyword | -| rsa.misc.cs_rpayload | | keyword | -| rsa.misc.cs_sampler_name | | keyword | -| rsa.misc.cs_sourcemodule | | keyword | -| rsa.misc.cs_streams | | keyword | -| rsa.misc.cs_targetmodule | | keyword | -| rsa.misc.cs_v6nxthop | | keyword | -| rsa.misc.cs_whois_server | | keyword | -| rsa.misc.cs_yararesult | | keyword | -| rsa.misc.cve | This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. | keyword | -| rsa.misc.data_type | | keyword | -| rsa.misc.description | | keyword | -| rsa.misc.device_name | This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc | keyword | -| rsa.misc.devvendor | | keyword | -| rsa.misc.disposition | This key captures the The end state of an action. | keyword | -| rsa.misc.distance | | keyword | -| rsa.misc.doc_number | This key captures File Identification number | long | -| rsa.misc.dstburb | | keyword | -| rsa.misc.edomain | | keyword | -| rsa.misc.edomaub | | keyword | -| rsa.misc.ein_number | Employee Identification Numbers only | long | -| rsa.misc.error | This key captures All non successful Error codes or responses | keyword | -| rsa.misc.euid | | keyword | -| rsa.misc.event_category | | keyword | -| rsa.misc.event_computer | This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. | keyword | -| rsa.misc.event_desc | This key is used to capture a description of an event available directly or inferred | keyword | -| rsa.misc.event_id | | keyword | -| rsa.misc.event_log | This key captures the Name of the event log | keyword | -| rsa.misc.event_source | This key captures Source of the event that’s not a hostname | keyword | -| rsa.misc.event_state | This key captures the current state of the object/item referenced within the event. Describing an on-going event. | keyword | -| rsa.misc.event_type | This key captures the event category type as specified by the event source. | keyword | -| rsa.misc.event_user | This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. | keyword | -| rsa.misc.expected_val | This key captures the Value expected (from the perspective of the device generating the log). | keyword | -| rsa.misc.facility | | keyword | -| rsa.misc.facilityname | | keyword | -| rsa.misc.fcatnum | This key captures Filter Category Number. Legacy Usage | keyword | -| rsa.misc.filter | This key captures Filter used to reduce result set | keyword | -| rsa.misc.finterface | | keyword | -| rsa.misc.flags | | keyword | -| rsa.misc.forensic_info | | keyword | -| rsa.misc.found | This is used to capture the results of regex match | keyword | -| rsa.misc.fresult | This key captures the Filter Result | long | -| rsa.misc.gaddr | | keyword | -| rsa.misc.group | This key captures the Group Name value | keyword | -| rsa.misc.group_id | This key captures Group ID Number (related to the group name) | keyword | -| rsa.misc.group_object | This key captures a collection/grouping of entities. Specific usage | keyword | -| rsa.misc.hardware_id | This key is used to capture unique identifier for a device or system (NOT a Mac address) | keyword | -| rsa.misc.id3 | | keyword | -| rsa.misc.im_buddyid | | keyword | -| rsa.misc.im_buddyname | | keyword | -| rsa.misc.im_client | | keyword | -| rsa.misc.im_croomid | | keyword | -| rsa.misc.im_croomtype | | keyword | -| rsa.misc.im_members | | keyword | -| rsa.misc.im_userid | | keyword | -| rsa.misc.im_username | | keyword | -| rsa.misc.index | | keyword | -| rsa.misc.inout | | keyword | -| rsa.misc.ipkt | | keyword | -| rsa.misc.ipscat | | keyword | -| rsa.misc.ipspri | | keyword | -| rsa.misc.job_num | This key captures the Job Number | keyword | -| rsa.misc.jobname | | keyword | -| rsa.misc.language | This is used to capture list of languages the client support and what it prefers | keyword | -| rsa.misc.latitude | | keyword | -| rsa.misc.library | This key is used to capture library information in mainframe devices | keyword | -| rsa.misc.lifetime | This key is used to capture the session lifetime in seconds. | long | -| rsa.misc.linenum | | keyword | -| rsa.misc.link | This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.misc.list_name | | keyword | -| rsa.misc.listnum | This key is used to capture listname or listnumber, primarily for collecting access-list | keyword | -| rsa.misc.load_data | | keyword | -| rsa.misc.location_floor | | keyword | -| rsa.misc.location_mark | | keyword | -| rsa.misc.log_id | | keyword | -| rsa.misc.log_session_id | This key is used to capture a sessionid from the session directly | keyword | -| rsa.misc.log_session_id1 | This key is used to capture a Linked (Related) Session ID from the session directly | keyword | -| rsa.misc.log_type | | keyword | -| rsa.misc.logid | | keyword | -| rsa.misc.logip | | keyword | -| rsa.misc.logname | | keyword | -| rsa.misc.longitude | | keyword | -| rsa.misc.lport | | keyword | -| rsa.misc.mail_id | This key is used to capture the mailbox id/name | keyword | -| rsa.misc.match | This key is for regex match name from search.ini | keyword | -| rsa.misc.mbug_data | | keyword | -| rsa.misc.message_body | This key captures the The contents of the message body. | keyword | -| rsa.misc.misc | | keyword | -| rsa.misc.misc_name | | keyword | -| rsa.misc.mode | | keyword | -| rsa.misc.msgIdPart1 | | keyword | -| rsa.misc.msgIdPart2 | | keyword | -| rsa.misc.msgIdPart3 | | keyword | -| rsa.misc.msgIdPart4 | | keyword | -| rsa.misc.msg_type | | keyword | -| rsa.misc.msgid | | keyword | -| rsa.misc.name | | keyword | -| rsa.misc.netsessid | | keyword | -| rsa.misc.node | Common use case is the node name within a cluster. The cluster name is reflected by the host name. | keyword | -| rsa.misc.ntype | | keyword | -| rsa.misc.num | | keyword | -| rsa.misc.number | | keyword | -| rsa.misc.number1 | | keyword | -| rsa.misc.number2 | | keyword | -| rsa.misc.nwwn | | keyword | -| rsa.misc.obj_name | This is used to capture name of object | keyword | -| rsa.misc.obj_type | This is used to capture type of object | keyword | -| rsa.misc.object | | keyword | -| rsa.misc.observed_val | This key captures the Value observed (from the perspective of the device generating the log). | keyword | -| rsa.misc.operation | | keyword | -| rsa.misc.operation_id | An alert number or operation number. The values should be unique and non-repeating. | keyword | -| rsa.misc.opkt | | keyword | -| rsa.misc.orig_from | | keyword | -| rsa.misc.owner_id | | keyword | -| rsa.misc.p_action | | keyword | -| rsa.misc.p_filter | | keyword | -| rsa.misc.p_group_object | | keyword | -| rsa.misc.p_id | | keyword | -| rsa.misc.p_msgid | | keyword | -| rsa.misc.p_msgid1 | | keyword | -| rsa.misc.p_msgid2 | | keyword | -| rsa.misc.p_result1 | | keyword | -| rsa.misc.param | This key is the parameters passed as part of a command or application, etc. | keyword | -| rsa.misc.param_dst | This key captures the command line/launch argument of the target process or file | keyword | -| rsa.misc.param_src | This key captures source parameter | keyword | -| rsa.misc.parent_node | This key captures the Parent Node Name. Must be related to node variable. | keyword | -| rsa.misc.password_chg | | keyword | -| rsa.misc.password_expire | | keyword | -| rsa.misc.payload_dst | This key is used to capture destination payload | keyword | -| rsa.misc.payload_src | This key is used to capture source payload | keyword | -| rsa.misc.permgranted | | keyword | -| rsa.misc.permwanted | | keyword | -| rsa.misc.pgid | | keyword | -| rsa.misc.phone | | keyword | -| rsa.misc.pid | | keyword | -| rsa.misc.policy | | keyword | -| rsa.misc.policyUUID | | keyword | -| rsa.misc.policy_id | This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise | keyword | -| rsa.misc.policy_name | This key is used to capture the Policy Name only. | keyword | -| rsa.misc.policy_value | This key captures the contents of the policy. This contains details about the policy | keyword | -| rsa.misc.policy_waiver | | keyword | -| rsa.misc.pool_id | This key captures the identifier (typically numeric field) of a resource pool | keyword | -| rsa.misc.pool_name | This key captures the name of a resource pool | keyword | -| rsa.misc.port_name | This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). | keyword | -| rsa.misc.priority | | keyword | -| rsa.misc.process_id_val | This key is a failure key for Process ID when it is not an integer value | keyword | -| rsa.misc.prog_asp_num | | keyword | -| rsa.misc.program | | keyword | -| rsa.misc.real_data | | keyword | -| rsa.misc.reason | | keyword | -| rsa.misc.rec_asp_device | | keyword | -| rsa.misc.rec_asp_num | | keyword | -| rsa.misc.rec_library | | keyword | -| rsa.misc.recordnum | | keyword | -| rsa.misc.reference_id | This key is used to capture an event id from the session directly | keyword | -| rsa.misc.reference_id1 | This key is for Linked ID to be used as an addition to "reference.id" | keyword | -| rsa.misc.reference_id2 | This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. | keyword | -| rsa.misc.result | This key is used to capture the outcome/result string value of an action in a session. | keyword | -| rsa.misc.result_code | This key is used to capture the outcome/result numeric value of an action in a session | keyword | -| rsa.misc.risk | This key captures the non-numeric risk value | keyword | -| rsa.misc.risk_info | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.risk_num | This key captures a Numeric Risk value | double | -| rsa.misc.risk_num_comm | This key captures Risk Number Community | double | -| rsa.misc.risk_num_next | This key captures Risk Number NextGen | double | -| rsa.misc.risk_num_sand | This key captures Risk Number SandBox | double | -| rsa.misc.risk_num_static | This key captures Risk Number Static | double | -| rsa.misc.risk_suspicious | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.risk_warning | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.ruid | | keyword | -| rsa.misc.rule | This key captures the Rule number | keyword | -| rsa.misc.rule_group | This key captures the Rule group name | keyword | -| rsa.misc.rule_name | This key captures the Rule Name | keyword | -| rsa.misc.rule_template | A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template | keyword | -| rsa.misc.rule_uid | This key is the Unique Identifier for a rule. | keyword | -| rsa.misc.sburb | | keyword | -| rsa.misc.sdomain_fld | | keyword | -| rsa.misc.search_text | This key captures the Search Text used | keyword | -| rsa.misc.sec | | keyword | -| rsa.misc.second | | keyword | -| rsa.misc.sensor | This key captures Name of the sensor. Typically used in IDS/IPS based devices | keyword | -| rsa.misc.sensorname | | keyword | -| rsa.misc.seqnum | | keyword | -| rsa.misc.serial_number | This key is the Serial number associated with a physical asset. | keyword | -| rsa.misc.session | | keyword | -| rsa.misc.sessiontype | | keyword | -| rsa.misc.severity | This key is used to capture the severity given the session | keyword | -| rsa.misc.sigUUID | | keyword | -| rsa.misc.sig_id | This key captures IDS/IPS Int Signature ID | long | -| rsa.misc.sig_id1 | This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id | long | -| rsa.misc.sig_id_str | This key captures a string object of the sigid variable. | keyword | -| rsa.misc.sig_name | This key is used to capture the Signature Name only. | keyword | -| rsa.misc.sigcat | | keyword | -| rsa.misc.snmp_oid | SNMP Object Identifier | keyword | -| rsa.misc.snmp_value | SNMP set request value | keyword | -| rsa.misc.space | | keyword | -| rsa.misc.space1 | | keyword | -| rsa.misc.spi | | keyword | -| rsa.misc.spi_dst | Destination SPI Index | keyword | -| rsa.misc.spi_src | Source SPI Index | keyword | -| rsa.misc.sql | This key captures the SQL query | keyword | -| rsa.misc.srcburb | | keyword | -| rsa.misc.srcdom | | keyword | -| rsa.misc.srcservice | | keyword | -| rsa.misc.state | | keyword | -| rsa.misc.status | | keyword | -| rsa.misc.status1 | | keyword | -| rsa.misc.streams | This key captures number of streams in session | long | -| rsa.misc.subcategory | | keyword | -| rsa.misc.svcno | | keyword | -| rsa.misc.system | | keyword | -| rsa.misc.tbdstr1 | | keyword | -| rsa.misc.tbdstr2 | | keyword | -| rsa.misc.tcp_flags | This key is captures the TCP flags set in any packet of session | long | -| rsa.misc.terminal | This key captures the Terminal Names only | keyword | -| rsa.misc.tgtdom | | keyword | -| rsa.misc.tgtdomain | | keyword | -| rsa.misc.threshold | | keyword | -| rsa.misc.tos | This key describes the type of service | long | -| rsa.misc.trigger_desc | This key captures the Description of the trigger or threshold condition. | keyword | -| rsa.misc.trigger_val | This key captures the Value of the trigger or threshold condition. | keyword | -| rsa.misc.type | | keyword | -| rsa.misc.type1 | | keyword | -| rsa.misc.udb_class | | keyword | -| rsa.misc.url_fld | | keyword | -| rsa.misc.user_div | | keyword | -| rsa.misc.userid | | keyword | -| rsa.misc.username_fld | | keyword | -| rsa.misc.utcstamp | | keyword | -| rsa.misc.v_instafname | | keyword | -| rsa.misc.version | This key captures Version of the application or OS which is generating the event. | keyword | -| rsa.misc.virt_data | | keyword | -| rsa.misc.virusname | This key captures the name of the virus | keyword | -| rsa.misc.vm_target | VMWare Target \*\*VMWARE\*\* only varaible. | keyword | -| rsa.misc.vpnid | | keyword | -| rsa.misc.vsys | This key captures Virtual System Name | keyword | -| rsa.misc.vuln_ref | This key captures the Vulnerability Reference details | keyword | -| rsa.misc.workspace | This key captures Workspace Description | keyword | -| rsa.network.ad_computer_dst | Deprecated, use host.dst | keyword | -| rsa.network.addr | | keyword | -| rsa.network.alias_host | This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. | keyword | -| rsa.network.dinterface | This key should only be used when it’s a Destination Interface | keyword | -| rsa.network.dmask | This key is used for Destionation Device network mask | keyword | -| rsa.network.dns_a_record | | keyword | -| rsa.network.dns_cname_record | | keyword | -| rsa.network.dns_id | | keyword | -| rsa.network.dns_opcode | | keyword | -| rsa.network.dns_ptr_record | | keyword | -| rsa.network.dns_resp | | keyword | -| rsa.network.dns_type | | keyword | -| rsa.network.domain | | keyword | -| rsa.network.domain1 | | keyword | -| rsa.network.eth_host | Deprecated, use alias.mac | keyword | -| rsa.network.eth_type | This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only | long | -| rsa.network.faddr | | keyword | -| rsa.network.fhost | | keyword | -| rsa.network.fport | | keyword | -| rsa.network.gateway | This key is used to capture the IP Address of the gateway | keyword | -| rsa.network.host_dst | This key should only be used when it’s a Destination Hostname | keyword | -| rsa.network.host_orig | This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. | keyword | -| rsa.network.host_type | | keyword | -| rsa.network.icmp_code | This key is used to capture the ICMP code only | long | -| rsa.network.icmp_type | This key is used to capture the ICMP type only | long | -| rsa.network.interface | This key should be used when the source or destination context of an interface is not clear | keyword | -| rsa.network.ip_proto | This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI | long | -| rsa.network.laddr | | keyword | -| rsa.network.lhost | | keyword | -| rsa.network.linterface | | keyword | -| rsa.network.mask | This key is used to capture the device network IPmask. | keyword | -| rsa.network.netname | This key is used to capture the network name associated with an IP range. This is configured by the end user. | keyword | -| rsa.network.network_port | Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) | long | -| rsa.network.network_service | This is used to capture layer 7 protocols/service names | keyword | -| rsa.network.origin | | keyword | -| rsa.network.packet_length | | keyword | -| rsa.network.paddr | Deprecated | ip | -| rsa.network.phost | | keyword | -| rsa.network.port | This key should only be used to capture a Network Port when the directionality is not clear | long | -| rsa.network.protocol_detail | This key should be used to capture additional protocol information | keyword | -| rsa.network.remote_domain_id | | keyword | -| rsa.network.rpayload | This key is used to capture the total number of payload bytes seen in the retransmitted packets. | keyword | -| rsa.network.sinterface | This key should only be used when it’s a Source Interface | keyword | -| rsa.network.smask | This key is used for capturing source Network Mask | keyword | -| rsa.network.vlan | This key should only be used to capture the ID of the Virtual LAN | long | -| rsa.network.vlan_name | This key should only be used to capture the name of the Virtual LAN | keyword | -| rsa.network.zone | This key should be used when the source or destination context of a Zone is not clear | keyword | -| rsa.network.zone_dst | This key should only be used when it’s a Destination Zone. | keyword | -| rsa.network.zone_src | This key should only be used when it’s a Source Zone. | keyword | -| rsa.physical.org_dst | This is used to capture the destination organization based on the GEOPIP Maxmind database. | keyword | -| rsa.physical.org_src | This is used to capture the source organization based on the GEOPIP Maxmind database. | keyword | -| rsa.storage.disk_volume | A unique name assigned to logical units (volumes) within a physical disk | keyword | -| rsa.storage.lun | Logical Unit Number.This key is a very useful concept in Storage. | keyword | -| rsa.storage.pwwn | This uniquely identifies a port on a HBA. | keyword | -| rsa.threat.alert | This key is used to capture name of the alert | keyword | -| rsa.threat.threat_category | This key captures Threat Name/Threat Category/Categorization of alert | keyword | -| rsa.threat.threat_desc | This key is used to capture the threat description from the session directly or inferred | keyword | -| rsa.threat.threat_source | This key is used to capture source of the threat | keyword | -| rsa.time.date | | keyword | -| rsa.time.datetime | | keyword | -| rsa.time.day | | keyword | -| rsa.time.duration_str | A text string version of the duration | keyword | -| rsa.time.duration_time | This key is used to capture the normalized duration/lifetime in seconds. | double | -| rsa.time.effective_time | This key is the effective time referenced by an individual event in a Standard Timestamp format | date | -| rsa.time.endtime | This key is used to capture the End time mentioned in a session in a standard form | date | -| rsa.time.event_queue_time | This key is the Time that the event was queued. | date | -| rsa.time.event_time | This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form | date | -| rsa.time.event_time_str | This key is used to capture the incomplete time mentioned in a session as a string | keyword | -| rsa.time.eventtime | | keyword | -| rsa.time.expire_time | This key is the timestamp that explicitly refers to an expiration. | date | -| rsa.time.expire_time_str | This key is used to capture incomplete timestamp that explicitly refers to an expiration. | keyword | -| rsa.time.gmtdate | | keyword | -| rsa.time.gmttime | | keyword | -| rsa.time.hour | | keyword | -| rsa.time.min | | keyword | -| rsa.time.month | | keyword | -| rsa.time.p_date | | keyword | -| rsa.time.p_month | | keyword | -| rsa.time.p_time | | keyword | -| rsa.time.p_time1 | | keyword | -| rsa.time.p_time2 | | keyword | -| rsa.time.p_year | | keyword | -| rsa.time.process_time | Deprecated, use duration.time | keyword | -| rsa.time.recorded_time | The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. | date | -| rsa.time.stamp | Deprecated key defined only in table map. | date | -| rsa.time.starttime | This key is used to capture the Start time mentioned in a session in a standard form | date | -| rsa.time.timestamp | | keyword | -| rsa.time.timezone | This key is used to capture the timezone of the Event Time | keyword | -| rsa.time.tzone | | keyword | -| rsa.time.year | | keyword | -| rsa.web.alias_host | | keyword | -| rsa.web.cn_asn_dst | | keyword | -| rsa.web.cn_rpackets | | keyword | -| rsa.web.fqdn | Fully Qualified Domain Names | keyword | -| rsa.web.p_url | | keyword | -| rsa.web.p_user_agent | | keyword | -| rsa.web.p_web_cookie | | keyword | -| rsa.web.p_web_method | | keyword | -| rsa.web.p_web_referer | | keyword | -| rsa.web.remote_domain | | keyword | -| rsa.web.reputation_num | Reputation Number of an entity. Typically used for Web Domains | double | -| rsa.web.urlpage | | keyword | -| rsa.web.urlroot | | keyword | -| rsa.web.web_cookie | This key is used to capture the Web cookies specifically. | keyword | -| rsa.web.web_extension_tmp | | keyword | -| rsa.web.web_page | | keyword | -| rsa.web.web_ref_domain | Web referer's domain | keyword | -| rsa.web.web_ref_page | This key captures Web referer's page information | keyword | -| rsa.web.web_ref_query | This key captures Web referer's query portion of the URL | keyword | -| rsa.web.web_ref_root | Web referer's root URL path | keyword | -| rsa.wireless.access_point | This key is used to capture the access point name. | keyword | -| rsa.wireless.wlan_channel | This is used to capture the channel names | long | -| rsa.wireless.wlan_name | This key captures either WLAN number/name | keyword | -| rsa.wireless.wlan_ssid | This key is used to capture the ssid of a Wireless Session | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.port | Port of the source. | long | -| source.registered_domain | The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| source.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| source.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.path | Path of the request, such as "/search". | wildcard | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | - diff --git a/packages/juniper/1.1.0/img/logo.svg b/packages/juniper/1.1.0/img/logo.svg deleted file mode 100755 index 8802414a5a..0000000000 --- a/packages/juniper/1.1.0/img/logo.svg +++ /dev/null @@ -1,72 +0,0 @@ - -image/svg+xml \ No newline at end of file diff --git a/packages/juniper/1.1.0/manifest.yml b/packages/juniper/1.1.0/manifest.yml deleted file mode 100755 index 6bad747028..0000000000 --- a/packages/juniper/1.1.0/manifest.yml +++ /dev/null @@ -1,32 +0,0 @@ -format_version: 1.0.0 -name: juniper -title: Juniper Logs -version: 1.1.0 -description: Deprecated. Use a specific Juniper package instead. -categories: ["network", "security"] -release: ga -license: basic -type: integration -conditions: - kibana.version: "^8.0.0" -policy_templates: - - name: juniper - title: Juniper logs - description: Collect Juniper logs from syslog or a file. - inputs: - - type: udp - title: Collect logs from Juniper via UDP - description: Collecting syslog from Juniper via UDP. - - type: tcp - title: Collect logs from Juniper via TCP - description: Collecting syslog from Juniper via TCP. - - type: logfile - title: Collect logs from Juniper via file - description: Collecting syslog from Juniper via file. -icons: - - src: /img/logo.svg - title: Juniper logo - size: 32x32 - type: image/svg+xml -owner: - github: elastic/security-external-integrations diff --git a/packages/o365/1.4.1/changelog.yml b/packages/o365/1.4.1/changelog.yml deleted file mode 100755 index e92e2b4f07..0000000000 --- a/packages/o365/1.4.1/changelog.yml +++ /dev/null @@ -1,132 +0,0 @@ -# newer versions go on top -- version: "1.4.1" - changes: - - description: Fix grok parsing errors due to invalid IP addresses. - type: bugfix - link: https://github.com/elastic/integrations/pull/2669 -- version: "1.4.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2427 -- version: "1.3.2" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.3.1" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.3.0" - changes: - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2252 -- version: "1.2.4" - changes: - - description: Uniform with guidelines - type: enhancement - link: https://github.com/elastic/integrations/pull/2096 -- version: "1.2.3" - changes: - - description: Fix processors configuration - type: bugfix - link: https://github.com/elastic/integrations/pull/2113 -- version: "1.2.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1976 -- version: "1.2.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1837 -- version: "1.2.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1670 -- version: "1.1.4" - changes: - - description: additional type assertions in painless scripts - type: bugfix - link: https://github.com/elastic/integrations/pull/1642 -- version: "1.1.3" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1493 -- version: '1.1.2' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1402 -- version: "1.1.1" - changes: - - description: Escape special characters in docs - type: enhancement - link: https://github.com/elastic/integrations/pull/1405 -- version: "1.1.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "1.0.0" - changes: - - description: make GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1219 - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1219 -- version: "0.6.2" - changes: - - description: Use `wildcard` field type for the relevant ECS fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/1180 -- version: "0.6.1" - changes: - - description: small pipeline fix for parameters when they are string instead of objects - type: enhancement - link: https://github.com/elastic/integrations/pull/1136 -- version: "0.6.0" - changes: - - description: add system tests - type: enhancement - link: https://github.com/elastic/integrations/pull/1119 - - description: fixes o365audit config file - type: enhancement - link: https://github.com/elastic/integrations/pull/1119 -- version: "0.5.0" - changes: - - description: update to ECS 1.10.0 and adding event.original options - type: enhancement - link: https://github.com/elastic/integrations/pull/1117 -- version: "0.4.0" - changes: - - description: moving edge processing to ingest pipelines - type: enhancement - link: https://github.com/elastic/integrations/pull/983 -- version: "0.3.2" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/860 -- version: "0.3.1" - changes: - - description: Change kibana.version constraint to be more conservative. - type: bugfix - link: https://github.com/elastic/integrations/pull/749 -- version: "0.3.0" - changes: - - description: Add changes to use ECS 1.8 fields. - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/716 -- version: "0.1.0" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/230 diff --git a/packages/o365/1.4.1/data_stream/audit/agent/stream/o365audit.yml.hbs b/packages/o365/1.4.1/data_stream/audit/agent/stream/o365audit.yml.hbs deleted file mode 100755 index 8656c87842..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/agent/stream/o365audit.yml.hbs +++ /dev/null @@ -1,39 +0,0 @@ -{{#if application_id}}application_id: {{application_id}}{{/if}} -tenant_id: -{{#each tenants}} - - "{{this}}" -{{/each}} -{{#if certificate}}certificate: {{certificate}}{{/if}} -{{#if key}}key: {{key}}{{/if}} -{{#if key_passphrase}}key_passphrase: {{key_passphrase}}{{/if}} -{{#if client_secret}}client_secret: {{client_secret}}{{/if}} -content_type: -{{#each content_type}} - - "{{this}}" -{{/each}} -{{#if api}} -api: - {{api}} -{{/if}} -tags: -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#if preserve_original_event}} - - preserve_original_event -api.preserve_original_event: true -{{/if}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- add_fields: - target: "_conf" - fields: - tenants: - {{#each tenant_names}} - {{this}} - {{/each}} -{{#if processors}} -{{processors}} -{{/if}} diff --git a/packages/o365/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/o365/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 2ad3797c4e..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,1041 +0,0 @@ ---- -description: Pipeline for Office 365 Audit logs - -processors: - - set: - field: ecs.version - value: '8.0.0' - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - append: - field: event.category - value: web - # General Schema - - date: - field: o365audit.CreationTime - formats: - - ISO8601 - - rename: - field: o365audit.Id - target_field: event.id - ignore_missing: true - - rename: - field: o365audit.ClientIPAddress - target_field: client._temp - ignore_missing: true - - rename: - field: o365audit.ClientIP - target_field: client._temp - ignore_missing: true - if: ctx.client?._temp == null - - rename: - field: o365audit.ActorIpAddress - target_field: client._temp - ignore_missing: true - if: ctx.client?._temp == null - - convert: - field: o365audit.UserId - target_field: user.id - type: string - ignore_missing: true - - rename: - field: o365audit.Workload - target_field: event.provider - ignore_missing: true - - rename: - field: o365audit.Operation - target_field: event.action - ignore_missing: true - - rename: - field: o365audit.OrganizationId - target_field: organization.id - ignore_missing: true - - rename: - field: o365audit.UserAgent - target_field: user_agent.original - ignore_missing: true - - script: - if: ctx.o365audit?.RecordType != null - lang: painless - params: - "1": "ExchangeAdmin" - "2": "ExchangeItem" - "3": "ExchangeItemGroup" - "4": "SharePoint" - "6": "SharePointFileOperation" - "8": "AzureActiveDirectory" - "9": "AzureActiveDirectoryAccountLogon" - "10": "DataCenterSecurityCmdlet" - "11": "ComplianceDLPSharePoint" - "12": "Sway" - "13": "ComplianceDLPExchange" - "14": "SharePointSharingOperation" - "15": "AzureActiveDirectoryStsLogon" - "18": "SecurityComplianceCenterEOPCmdlet" - "20": "PowerBIAudit" - "21": "CRM" - "22": "Yammer" - "23": "SkypeForBusinessCmdlets" - "24": "Discovery" - "25": "MicrosoftTeams" - "28": "ThreatIntelligence" - "30": "MicrosoftFlow" - "31": "AeD" - "32": "MicrosoftStream" - "33": "ComplianceDLPSharePointClassification" - "35": "Project" - "36": "SharePointListOperation" - "38": "DataGovernance" - "40": "SecurityComplianceAlerts" - "41": "ThreatIntelligenceUrl" - "42": "SecurityComplianceInsights" - "44": "WorkplaceAnalytics" - "45": "PowerAppsApp" - "47": "ThreatIntelligenceAtpContent" - "49": "TeamsHealthcare" - "52": "DataInsightsRestApiAudit" - "54": "SharePointListItemOperation" - "55": "SharePointContentTypeOperation" - "56": "SharePointFieldOperation" - "64": "AirInvestigation" - "66": "MicrosoftForms" - source: > - def schemaId = ctx.o365audit.RecordType.toString(); - def schema = params[schemaId]; - if (schema != null) { - if (ctx.event == null) { - ctx.event = new HashMap(); - } - ctx.event.code = schema; - } - - set: - field: event.outcome - value: success - if: 'ctx.o365audit?.ResultStatus != null && ["succeeded", "success", "partiallysucceeded", "true"].contains(ctx.o365audit?.ResultStatus.toLowerCase())' - - set: - field: event.outcome - value: failure - if: 'ctx.o365audit?.ResultStatus != null && ["failed", "false"].contains(ctx.o365audit?.ResultStatus.toLowerCase())' - - set: - field: event.outcome - value: success - if: ctx.event?.outcome == null - - script: - lang: painless - if: 'ctx.o365audit?.Parameters != null && ctx.o365audit?.Parameters instanceof List' - source: > - def newparams = new HashMap(); - def oldparams = ctx.o365audit.Parameters; - for (int i = 0; i < oldparams.length; ++i) { - if (oldparams[i]["Value"] != null) { - newparams[oldparams[i]["Name"]] = oldparams[i]["Value"]; - } - } - ctx.o365audit.Parameters = newparams; - - rename: - field: o365audit.Parameters - target_field: o365audit.Parameters._raw - if: 'ctx.o365audit?.Parameters != null && ctx.o365audit?.Parameters instanceof String' - - script: - lang: painless - if: 'ctx.o365audit?.ExtendedProperties != null && ctx.o365audit?.ExtendedProperties instanceof List' - source: > - def newparams = new HashMap(); - def oldparams = ctx.o365audit.ExtendedProperties; - for (int i = 0; i < oldparams.length; ++i) { - if (oldparams[i]["Value"] != null) { - newparams[oldparams[i]["Name"]] = oldparams[i]["Value"]; - } - } - ctx.o365audit.ExtendedProperties = newparams; - - rename: - field: o365audit.ExtendedProperties - target_field: o365audit.ExtendedProperties._raw - if: 'ctx.o365audit?.ExtendedProperties != null && ctx.o365audit?.ExtendedProperties instanceof String' - - script: - lang: painless - if: 'ctx.o365audit?.ModifiedProperties != null && ctx.o365audit?.ModifiedProperties instanceof List' - source: > - def newparams = new HashMap(); - def oldparams = ctx.o365audit.ModifiedProperties; - for (int i = 0; i < oldparams.length; ++i) { - if (oldparams[i]["OldValue"] != null && oldparams[i]["NewValue"] != null) { - def validname = oldparams[i]["Name"].replace(" ","_").replace(".","_"); - newparams[validname] = new HashMap(); - newparams[validname]["NewValue"] = oldparams[i]["NewValue"]; - newparams[validname]["OldValue"] = oldparams[i]["OldValue"]; - } - } - if (newparams == null) { - ctx.o365audit.remove("ModifiedProperties"); - return; - } - ctx.o365audit.ModifiedProperties = newparams; - - rename: - field: o365audit.ModifiedProperties - target_field: o365audit.ModifiedProperties._raw - if: 'ctx.o365audit?.ModifiedProperties != null && ctx.o365audit?.ModifiedProperties instanceof String' - - script: - lang: painless - if: 'ctx.o365audit?.AlertLinks != null && ctx.o365audit?.AlertLinks instanceof List' - source: > - def list = ctx.o365audit.AlertLinks; - def links = new ArrayList(); - for (int i = 0; i < list.length; ++i) { - if (list[i] instanceof Map && list[i].containsKey("AlertLinkHref") && list[i]["AlertLinkHref"] != null && list[i]["AlertLinkHref"] instanceof String) { - links.add(list[i]["AlertLinkHref"]); - } - } - if (links.length == 0) { - ctx.o365audit.remove("AlertLinks"); - return; - } - ctx.o365audit.AlertLinks = links; - - set: - field: event.severity - value: 1 - if: ctx.o365audit?.Severity == "informational" - - set: - field: event.severity - value: 2 - if: ctx.o365audit?.Severity == "low" - - set: - field: event.severity - value: 3 - if: ctx.o365audit?.Severity == "medium" - - set: - field: event.severity - value: 4 - if: ctx.o365audit?.Severity == "high" - # ExchangeAdmin Schema - - rename: - field: o365audit.OrganizationName - target_field: organization.name - ignore_missing: true - if: ctx.event?.code == "ExchangeAdmin" - - rename: - field: o365audit.OriginatingServer - target_field: server._temp - ignore_missing: true - if: ctx.event?.code == "ExchangeAdmin" - # ExchangeItem Schema - - rename: - field: o365audit.MailboxOwnerUPN - target_field: user.email - ignore_missing: true - if: ctx.event?.code == "ExchangeItem" - - convert: - field: o365audit.LogonUserSid - target_field: user.id - type: string - ignore_missing: true - if: 'ctx.user?.id == null && ctx.o365audit?.LogonUserSid != null && ctx.event?.code == "ExchangeItem"' - - rename: - field: o365audit.LogonUserDisplayName - target_field: user.full_name - ignore_missing: true - if: ctx.event?.code == "ExchangeItem" - - rename: - field: o365audit.OrganizationName - target_field: organization.name - ignore_missing: true - if: ctx.event?.code == "ExchangeItem" - - rename: - field: o365audit.OriginatingServer - target_field: server._temp - ignore_missing: true - if: ctx.event?.code == "ExchangeItem" - - rename: - field: o365audit.ClientIPAddress - target_field: client._temp - ignore_missing: true - if: ctx.event?.code == "ExchangeItem" - - rename: - field: o365audit.ClientProcessName - target_field: process.name - ignore_missing: true - if: ctx.event?.code == "ExchangeItem" - # AzureActiveDirectory Schema - - set: - field: user.target.id - copy_from: o365audit.ObjectId - if: ctx.event?.code == "AzureActiveDirectory" - ## AzureActiveDirectory Schema new user - - set: - field: event.action - value: added-user-account - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "Add user."' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "added-user-account"' - - append: - field: event.type - value: user - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "added-user-account"' - - append: - field: event.type - value: creation - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "added-user-account"' - ## AzureActiveDirectory Schema update user - - set: - field: event.action - value: modified-user-account - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "Update user."' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "modified-user-account"' - - append: - field: event.type - value: user - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "modified-user-account"' - - append: - field: event.type - value: change - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "modified-user-account"' - ## AzureActiveDirectory Schema delete user - - set: - field: event.action - value: deleted-user-account - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "Delete user."' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "deleted-user-account"' - - append: - field: event.type - value: user - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "deleted-user-account"' - - append: - field: event.type - value: deletion - if: 'ctx.event?.code == "AzureActiveDirectory" && ctx.event?.action == "deleted-user-account"' - # AzureActiveDirectoryStsLogon Schema - - append: - field: event.category - value: authentication - if: ctx.event?.code == "AzureActiveDirectoryStsLogon" - - append: - field: event.type - value: start - if: ctx.event?.code == "AzureActiveDirectoryStsLogon" - - append: - field: event.type - value: "authentication_{{event.outcome}}" - if: 'ctx.event?.code == "AzureActiveDirectoryStsLogon" && ctx.event?.outcome != null && ctx.event?.outcome != "unknown"' - # SharePointFileOperation Schema - - rename: - field: o365audit.ObjectId - target_field: url.original - ignore_missing: true - if: ctx.event?.code == "SharePointFileOperation" - - rename: - field: o365audit.SourceRelativeUrl - target_field: file.directory - ignore_missing: true - if: ctx.event?.code == "SharePointFileOperation" - - rename: - field: o365audit.SourceFileName - target_field: file.name - ignore_missing: true - if: ctx.event?.code == "SharePointFileOperation" - - rename: - field: o365audit.SourceFileExtension - target_field: file.extension - ignore_missing: true - if: ctx.event?.code == "SharePointFileOperation" - - append: - field: event.category - value: file - if: 'ctx.event?.action != null && ["FileAccessed", "FileDeleted", "FileDownloaded", "FileModified", "FileMoved", "FileRenamed", "FileRestored", "FileUploaded", "FolderCopied", "FolderCreated", "FolderDeleted", "FolderModified", "FolderMoved", "FolderRenamed", "FolderRestored"].contains(ctx.event?.action)' - - append: - field: event.category - value: configuration - if: ctx.event?.action == "ComplianceSettingChanged" - - append: - field: event.type - value: access - if: 'ctx.event?.action != null && ["FileAccessed", "FileDownloaded"].contains(ctx.event?.action)' - - append: - field: event.type - value: change - if: 'ctx.event?.action != null && ["ComplianceSettingChanged", "FileModified", "FileMoved", "FileRenamed", "FileRestored", "FolderModified", "FolderMoved", "FolderRenamed", "FolderRestored"].contains(ctx.event?.action)' - - append: - field: event.type - value: deletion - if: 'ctx.event?.action != null && ["FileDeleted", "FolderDeleted"].contains(ctx.event?.action)' - - append: - field: event.type - value: creation - if: 'ctx.event?.action != null && ["FileUploaded", "FolderCopied", "FolderCreated"].contains(ctx.event?.action)' - # SecurityComplianceAlerts Schema - - rename: - field: o365audit.Comments - target_field: message - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - rename: - field: o365audit.Name - target_field: rule.name - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - rename: - field: o365audit.PolicyId - target_field: rule.id - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - rename: - field: o365audit.Category - target_field: rule.category - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - rename: - field: o365audit.EntityType - target_field: rule.ruleset - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - rename: - field: o365audit.AlertEntityId - target_field: rule.description - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - rename: - field: o365audit.AlertLinks - target_field: rule.reference - ignore_missing: true - if: ctx.event?.code == "SecurityComplianceAlerts" - - set: - field: event.kind - value: alert - if: ctx.event?.code == "SecurityComplianceAlerts" - - append: - field: event.category - value: authentication - if: 'ctx.event?.code == "SecurityComplianceAlerts" && ctx.o365audit?.Category == "AccessGovernance"' - - append: - field: event.category - value: file - if: 'ctx.event?.code == "SecurityComplianceAlerts" && ctx.o365audit?.Category != null && ["DataGovernance", "DataLossPrevention"].contains(ctx.o365audit?.Category)' - - append: - field: event.category - value: malware - if: 'ctx.event?.code == "SecurityComplianceAlerts" && ctx.o365audit?.Category == "ThreatManagement"' - - append: - field: event.category - value: authentication - allow_duplicates: false - if: 'ctx.event?.code == "SecurityComplianceAlerts" && ctx.o365audit?.Category != null && !["DataGovernance", "DataLossPrevention", "ThreatManagement", "AccessGovernance"].contains(ctx.o365audit?.Category)' - - append: - field: event.category - value: web - allow_duplicates: false - if: ctx.event?.code == "SecurityComplianceAlerts" - - append: - field: event.type - value: info - allow_duplicates: false - if: ctx.event?.code == "SecurityComplianceAlerts" - - convert: - field: o365audit.AlertEntityId - target_field: user.id - type: string - ignore_missing: true - if: 'ctx.user?.id == null && ctx.event?.code == "SecurityComplianceAlerts" && ctx.rule?.ruleset == "User"' - - rename: - field: o365audit.AlertEntityId - target_field: user.email - ignore_missing: true - if: 'ctx.event?.code == "SecurityComplianceAlerts" && ctx.rule?.ruleset != null && ["Recipients", "Sender"].contains(ctx.rule?.ruleset)' - - rename: - field: o365audit.AlertEntityId - target_field: threat.technique.id - ignore_missing: true - if: 'ctx.event?.code == "SecurityComplianceAlerts" && ctx.rule?.ruleset == "MalwareFamily"' - # DLP Schema - - set: - field: event.kind - value: alert - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - append: - field: event.category - value: file - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - append: - field: event.type - value: access - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.SharePointMetaData.From - target_field: user.id - ignore_missing: true - if: 'ctx.user?.id == null && ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.SharePointMetaData.FileName - target_field: file.name - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.SharePointMetaData.FilePathUrl - target_field: url.original - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.SharePointMetaData.UniqueId - target_field: file.inode - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.SharePointMetaData.UniqueID - target_field: file.inode - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.SharePointMetaData.FileOwner - target_field: file.owner - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.ExchangeMetaData.From - target_field: source.user.email - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.ExchangeMetaData.Subject - target_field: message - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.PolicyId - target_field: rule.id - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - rename: - field: o365audit.PolicyName - target_field: rule.name - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - - date: - field: o365audit.SharePointMetaData.LastModifiedTime - target_field: file.mtime - formats: - - ISO8601 - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code) && ctx.o365audit?.SharePointMetaData?.LastModifiedTime != null' - - script: - lang: painless - if: 'ctx.event?.code != null && ctx.o365audit?.ExchangeMetaData!= null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code)' - source: > - def fields = new def[] {"To", "CC", "BCC"}; - if (ctx.destination == null) { - ctx.destination = new HashMap(); - } - if (ctx.destination.user == null) { - ctx.destination.user = new HashMap(); - } - ctx.destination.user.email = new ArrayList(); - for (int i = 0; i < fields.length; ++i) { - if (ctx.o365audit.ExchangeMetaData instanceof Map && ctx.o365audit.ExchangeMetaData.containsKey(fields[i])) { - def emails = ctx.o365audit.ExchangeMetaData[fields[i]]; - if (emails instanceof List){ - for (int e = 0; e < emails.length; ++e) { - ctx.destination.user.email.add(emails[e]); - } - } - if (emails instanceof String){ - ctx.destination.user.email.add(emails); - } - } - } - - rename: - field: o365audit.ExceptionInfo - target_field: o365audit.ExceptionInfo.Reason - ignore_missing: true - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code) && ctx.o365audit?.ExceptionInfo != null && ctx.o365audit?.ExceptionInfo instanceof String' - - script: - lang: painless - if: 'ctx.event?.code != null && ["ComplianceDLPSharePoint", "ComplianceDLPExchange"].contains(ctx.event?.code) && ctx.o365audit?.PolicyDetails != null' - source: > - int severityToCode(def x) { - if (x.toLowerCase() == "informational") { - return 1; - } - if (x.toLowerCase() == "low") { - return 2; - } - if (x.toLowerCase() == "medium") { - return 3; - } - if (x.toLowerCase() == "high") { - return 4; - } - return 0; - } - def policies = ctx.o365audit.PolicyDetails; - if (policies == null) { - return; - } - if (ctx.rule == null) { - ctx.rule = new HashMap(); - } - if (ctx.rule.id == null) { - ctx.rule.id = new ArrayList(); - } - if (ctx.rule.name == null) { - ctx.rule.name = new ArrayList(); - } - def maxSeverity = 0; - def allowed = true; - for (int i = 0; i < policies.length && policies instanceof List; ++i) { - def rules = policies[i].Rules; - if (rules == null) { - continue; - } - for (int j = 0; j < rules.length; ++j) { - def rule = rules[j]; - def id = rule.RuleId; - def name = rule.RuleName; - def sev = severityToCode(rule.Severity); - if (id != null && name != null) { - ctx.rule.id.add(id); - ctx.rule.name.add(name); - } - if (sev > maxSeverity) { - maxSeverity = sev; - } - if (allowed) { - if (rule.Actions != null && rule.Actions.contains("BlockAccess")) { - allowed = false; - } - } - } - } - if (maxSeverity > -1) { - ctx.event.severity = maxSeverity; - } - if (allowed) { - ctx.event.outcome = "success"; - return; - } - if (ctx.event?.action == "DlpRuleUndo") { - ctx.event.outcome = "success"; - return; - } - if (ctx.event?.action == "DlpInfo") { - ctx.event.outcome = "failure"; - return; - } - if (ctx.o365audit?.ExceptionInfo != null && !ctx.o365audit?.ExceptionInfo.isEmpty()) { - ctx.event.outcome = "success"; - return; - } - ctx.event.outcome = "failure"; - # Yammer Schema - - rename: - field: o365audit.ActorUserId - target_field: user.email - ignore_missing: true - if: ctx.event?.code == "Yammer" - - convert: - field: o365audit.ActorYammerUserId - target_field: user.id - type: string - ignore_missing: true - if: 'ctx.user?.id == null && ctx.event?.code == "Yammer"' - - rename: - field: o365audit.FileId - target_field: file.inode - ignore_missing: true - if: ctx.event?.code == "Yammer" - - rename: - field: o365audit.FileName - target_field: file.name - ignore_missing: true - if: ctx.event?.code == "Yammer" - - rename: - field: o365audit.GroupName - target_field: group.name - ignore_missing: true - if: ctx.event?.code == "Yammer" - - rename: - field: o365audit.TargetUserId - target_field: destination.user.email - ignore_missing: true - if: ctx.event?.code == "Yammer" - - rename: - field: o365audit.TargetYammerUserId - target_field: destination.user.id - ignore_missing: true - if: ctx.event?.code == "Yammer" - - append: - field: event.category - value: configuration - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["NetworkConfigurationUpdated", "NetworkSecurityConfigurationUpdated", "SoftDeleteSettingsUpdated", "ProcessProfileFields", "SupervisorAdminToggled"].contains(ctx.event?.action)' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["NetworkSecurityConfigurationUpdated", "GroupCreation", "GroupDeletion", "NetworkUserSuspended", "UserSuspension"].contains(ctx.event?.action)' - - append: - field: event.category - value: file - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["FileCreated", "FileDownloaded", "FileShared", "FileUpdateDescription", "FileUpdateName", "FileVisited"].contains(ctx.event?.action)' - - append: - field: event.type - value: change - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["NetworkConfigurationUpdated", "NetworkSecurityConfigurationUpdated", "SoftDeleteSettingsUpdated", "ProcessProfileFields", "SupervisorAdminToggled"].contains(ctx.event?.action)' - - append: - field: event.type - value: admin - if: 'ctx.event?.code == "Yammer" && ctx.event?.action == "NetworkSecurityConfigurationUpdated"' - - append: - field: event.type - value: creation - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["FileCreated", "GroupCreation", "FileUpdateName"].contains(ctx.event?.action)' - - append: - field: event.type - value: deletion - if: 'ctx.event?.code == "Yammer" && ctx.event?.action == "GroupDeletion"' - - append: - field: event.type - value: access - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["FileDownloaded", "FileShared", "FileUpdateDescription", "FileVisited"].contains(ctx.event?.action)' - - append: - field: event.type - value: group - if: 'ctx.event?.code == "Yammer" && ctx.event?.action != null && ["GroupCreation", "GroupDeletion"].contains(ctx.event?.action)' - # Teams Schema - - set: - field: event.action - value: added-group-account-to - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "TeamCreated"' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "added-group-account-to"' - - append: - field: event.type - value: group - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "added-group-account-to"' - - append: - field: event.type - value: creation - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "added-group-account-to"' - - rename: - field: o365audit.TeamName - target_field: group.name - ignore_missing: true - if: ctx.event?.code == "MicrosoftTeams" - - set: - field: event.action - value: added-users-to-group - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "MemberAdded"' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "added-users-to-group"' - - append: - field: event.type - value: group - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "added-users-to-group"' - - append: - field: event.type - value: change - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "added-users-to-group"' - - set: - field: event.action - value: deleted-user-account - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "Delete user."' - - append: - field: event.category - value: iam - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "deleted-user-account"' - - append: - field: event.type - value: user - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "deleted-user-account"' - - append: - field: event.type - value: deletion - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "deleted-user-account"' - - rename: - field: o365audit.ObjectId - target_field: user.target.id - ignore_missing: true - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.event?.action == "deleted-user-account"' - - script: - lang: painless - if: 'ctx.event?.code == "MicrosoftTeams" && ctx.o365audit?.Members != null && ctx.o365audit.Members instanceof List' - source: > - def members = ctx.o365audit?.Members; - if (ctx.related == null) { - ctx.related = new HashMap(); - } - if (ctx.related.user == null) { - ctx.related.user = new ArrayList(); - } - for (int i = 0; i < members.length; ++i) { - if (members[i] instanceof Map && members[i].containsKey("UPN") && !members[i]["UPN"].isEmpty()) { - ctx.related.user.add(members[i]["UPN"]); - } - } - - gsub: - field: client._temp - pattern: '::ffff:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)' - replacement: '$1' - ignore_missing: true - - grok: - field: client._temp - patterns: - - '%{IPANDPORTBRACKETS}' - - '^%{IP:client.address}$' - - '^\[%{IP:client.address}\]$' - - '%{IPANDPORT}' - - '^%{NOTSPACE:client.domain}$' - - '%{HOSTNAMEANDPORTBRACKETS}' - - '%{HOSTNAMEANDPORT}' - - '^\[%{HOSTNAMEANDIP}\]$' - - '^%{HOSTNAMEANDIP}$' - - '%{GREEDYDATA:client.address}' - pattern_definitions: - IPANDPORTBRACKETS: '^\[%{IP:client.address}\]:%{POSINT:client._port}' - IPANDPORT: '^%{IP:client.address}:%{POSINT:client._port}' - HOSTNAMEANDPORTBRACKETS: '^\[%{NOTSPACE:client.domain}\]:%{POSINT:client._port}' - HOSTNAMEANDPORT: '^%{NOTSPACE:client.domain}:%{POSINT:client._port}' - NOTCLOSINGPARENS: '[^)]*' - HOSTNAMEANDIP: '%{NOTSPACE:client.domain} \(%{NOTCLOSINGPARENS:client.address}\)' - if: 'ctx.client?._temp != null && !ctx.client?._temp.isEmpty()' - - gsub: - field: server._temp - pattern: "[\n\r]" - replacement: "" - ignore_missing: true - - grok: - field: server._temp - patterns: - - '^\[%{HOSTNAMEANDIP}\]$' - - '%{HOSTNAMEANDIP}' - - '%{GREEDYDATA:server.address}' - pattern_definitions: - NOTCLOSINGPARENS: '[^)]*' - HOSTNAMEANDIP: '%{NOTSPACE:server.domain} \(%{NOTCLOSINGPARENS:server.address}\)' - if: 'ctx.server?._temp != null && !ctx.server?._temp.isEmpty()' - ignore_failure: true - - convert: - field: client.address - target_field: client.ip - type: ip - ignore_failure: true - - convert: - field: client._port - target_field: client.port - type: long - ignore_missing: true - - convert: - field: server.address - target_field: server.ip - type: ip - ignore_failure: true - - remove: - field: - - client._port - - client._temp - - server._temp - ignore_missing: true - - set: - field: source.ip - copy_from: client.ip - if: ctx.client?.ip != null - - set: - field: source.port - copy_from: client.port - if: ctx.client?.port != null - - set: - field: destination.ip - copy_from: server.ip - if: ctx.server?.ip != null - - script: - lang: painless - if: 'ctx.user?.id != null && ctx.user?.id.contains("@")' - source: > - String[] splitmail = ctx.user.id.splitOnToken("@"); - if (splitmail.length != 2) { - return; - } - ctx.user.email = ctx.user.id; - ctx.user.domain = splitmail[1]; - ctx.user.name = splitmail[0]; - - script: - lang: painless - if: 'ctx.user?.target?.id != null && ctx.user?.target?.id.contains("@")' - source: > - String[] splitmail = ctx.user.target.id.splitOnToken("@"); - if (splitmail.length != 2) { - return; - } - ctx.user.target.email = ctx.user.target.id; - ctx.user.target.domain = splitmail[1]; - ctx.user.target.name = splitmail[0]; - - script: - lang: painless - if: 'ctx.source?.user?.id != null && ctx.source?.user?.id.contains("@")' - source: > - String[] splitmail = ctx.source.user.id.splitOnToken("@"); - if (splitmail.length != 2) { - return; - } - ctx.source.user.email = ctx.source.user.id; - ctx.source.user.domain = splitmail[1]; - ctx.source.user.name = splitmail[0]; - - script: - lang: painless - if: 'ctx.destination?.user?.id != null && ctx.destination?.user?.id.contains("@")' - source: > - String[] splitmail = ctx.destination.user.id.splitOnToken("@"); - if (splitmail.length != 2) { - return; - } - ctx.destination.user.email = ctx.destination.user.id; - ctx.destination.user.domain = splitmail[1]; - ctx.destination.user.name = splitmail[0]; - - set: - field: network.type - value: ipv6 - if: 'ctx.client?.ip != null && ctx.client?.ip.contains(":")' - - set: - field: network.type - value: ipv4 - if: 'ctx.network?.type == null && ctx.client?.ip != null' - - append: - field: related.ip - value: "{{client.ip}}" - allow_duplicates: false - if: ctx.client?.ip != null - - append: - field: related.ip - value: "{{server.ip}}" - allow_duplicates: false - if: ctx.server?.ip != null - - append: - field: related.user - value: "{{user.name}}" - allow_duplicates: false - if: ctx.user?.name != null - - append: - field: related.user - value: "{{user.target.name}}" - allow_duplicates: false - if: ctx.user?.target?.name != null - - append: - field: related.user - value: "{{file.owner}}" - allow_duplicates: false - if: ctx.file?.owner != null - - rename: - field: o365audit.ExtendedProperties.UserAgent - target_field: user_agent.original - ignore_missing: true - if: ctx.o365audit?.ExtendedProperties?.UserAgent != null - # Add Host and Organization fields - - lowercase: - field: organization.id - ignore_missing: true - - set: - field: host.id - copy_from: organization.id - if: ctx.organization?.id != null - - script: - lang: painless - if: 'ctx.organization?.id != null && ctx._conf?.tenants != null' - source: > - def conftenants = ctx._conf.tenants; - def orgid = ctx.organization.id; - if (conftenants instanceof Map && conftenants.containsKey(orgid)) { - ctx.organization.name = conftenants[orgid]; - ctx.host.name = conftenants[orgid]; - } - - set: - field: host.name - copy_from: organization.name - if: ctx.organization?.name != null && ctx.host?.name == null - - set: - field: host.name - copy_from: user.domain - if: ctx.user?.domain != null && ctx.host?.name == null - # Convert field values - - convert: - field: o365audit.AzureActiveDirectoryEventType - type: string - ignore_missing: true - - convert: - field: o365audit.RecordType - type: string - ignore_missing: true - - convert: - field: o365audit.UserType - type: string - ignore_missing: true - - convert: - field: o365audit.Version - type: string - ignore_missing: true - - convert: - field: o365audit.InternalLogonType - type: string - ignore_missing: true - - convert: - field: o365audit.LogonType - type: string - ignore_missing: true - - convert: - field: o365audit.ActorYammerUserId - type: string - ignore_missing: true - - convert: - field: o365audit.YammerNetworkId - type: string - ignore_missing: true - - rename: - field: o365audit - target_field: o365.audit - ignore_missing: true - - user_agent: - field: user_agent.original - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - remove: - field: - - _conf - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: '{{ _ingest.on_failure_message }}' diff --git a/packages/o365/1.4.1/data_stream/audit/fields/agent.yml b/packages/o365/1.4.1/data_stream/audit/fields/agent.yml deleted file mode 100755 index da4e652c53..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/fields/agent.yml +++ /dev/null @@ -1,198 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - diff --git a/packages/o365/1.4.1/data_stream/audit/fields/base-fields.yml b/packages/o365/1.4.1/data_stream/audit/fields/base-fields.yml deleted file mode 100755 index f43cebe668..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset name. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: o365 -- name: event.dataset - type: constant_keyword - description: Event dataset - value: o365.audit -- name: "@timestamp" - type: date - description: Event timestamp. diff --git a/packages/o365/1.4.1/data_stream/audit/fields/beats.yml b/packages/o365/1.4.1/data_stream/audit/fields/beats.yml deleted file mode 100755 index cb44bb2944..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/fields/beats.yml +++ /dev/null @@ -1,12 +0,0 @@ -- name: input.type - type: keyword - description: Type of Filebeat input. -- name: log.flags - type: keyword - description: Flags for the log file. -- name: log.offset - type: long - description: Offset of the entry in the log file. -- name: log.file.path - type: keyword - description: Path to the log file. diff --git a/packages/o365/1.4.1/data_stream/audit/fields/ecs.yml b/packages/o365/1.4.1/data_stream/audit/fields/ecs.yml deleted file mode 100755 index 86eae982d2..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/fields/ecs.yml +++ /dev/null @@ -1,305 +0,0 @@ -- description: |- - Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: client.address - type: keyword -- description: |- - The domain name of the client system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: client.domain - type: keyword -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: Port of the client. - name: client.port - type: long -- description: Unique container id. - name: container.id - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: User email address. - name: destination.user.email - type: keyword -- description: Unique identifier of the user. - name: destination.user.id - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. - `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. - This field is an array. This will allow proper categorization of some events that fall in multiple categories. - name: event.category - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Source of the event. - Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). - name: event.provider - type: keyword -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long -- description: |- - This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. - `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. - This field is an array. This will allow proper categorization of some events that fall in multiple event types. - name: event.type - type: keyword -- description: Directory where the file is located. It should include the drive letter, when appropriate. - name: file.directory - type: keyword -- description: |- - File extension, excluding the leading dot. - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: file.extension - type: keyword -- description: Inode representing the file in the filesystem. - name: file.inode - type: keyword -- description: Last time the file content was modified. - name: file.mtime - type: date -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: File owner's username. - name: file.owner - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: |- - Unique host id. - As hostname is not always unique, use values that are meaningful in your environment. - Example: The current usage of `beat.name`. - name: host.id - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: Unique identifier for the organization. - name: organization.id - type: keyword -- description: Organization name. - name: organization.name - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.name - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: A categorization value keyword used by the entity using the rule for detection of this event. - name: rule.category - type: keyword -- description: The description of the rule generating the event. - name: rule.description - type: keyword -- description: A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. - name: rule.id - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - Reference URL to additional information about the rule used to generate this event. - The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. - name: rule.reference - type: keyword -- description: Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. - name: rule.ruleset - type: keyword -- description: |- - Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: server.address - type: keyword -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Port of the source. - name: source.port - type: long -- description: User email address. - name: source.user.email - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) - name: threat.technique.id - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: User's full name, if available. - name: user.full_name - type: keyword -- description: Unique identifier of the user. - name: user.id - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.target.domain - type: keyword -- description: User email address. - name: user.target.email - type: keyword -- description: User's full name, if available. - name: user.target.full_name - type: keyword -- description: |- - Name of the directory the group is a member of. - For example, an LDAP or Active Directory domain name. - name: user.target.group.domain - type: keyword -- description: Unique identifier for the group on the system/platform. - name: user.target.group.id - type: keyword -- description: Name of the group. - name: user.target.group.name - type: keyword -- description: Unique identifier of the user. - name: user.target.id - type: keyword -- description: Short name or login of the user. - name: user.target.name - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/o365/1.4.1/data_stream/audit/fields/fields.yml b/packages/o365/1.4.1/data_stream/audit/fields/fields.yml deleted file mode 100755 index ca908de5ae..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/fields/fields.yml +++ /dev/null @@ -1,199 +0,0 @@ -- name: o365.audit - type: group - fields: - - name: Actor - type: array - fields: - - name: ID - type: keyword - - name: Type - type: keyword - - name: ActorContextId - type: keyword - - name: ActorIpAddress - type: keyword - - name: ActorUserId - type: keyword - - name: ActorYammerUserId - type: keyword - - name: AlertEntityId - type: keyword - - name: AlertId - type: keyword - - name: AlertLinks - type: array - - name: AlertType - type: keyword - - name: AppId - type: keyword - - name: ApplicationDisplayName - type: keyword - - name: ApplicationId - type: keyword - - name: AzureActiveDirectoryEventType - type: keyword - - name: ExchangeMetaData.* - type: object - - name: Category - type: keyword - - name: ClientAppId - type: keyword - - name: ClientInfoString - type: keyword - - name: ClientIP - type: keyword - - name: ClientIPAddress - type: keyword - - name: Comments - type: text - - name: CorrelationId - type: keyword - - name: CreationTime - type: keyword - - name: CustomUniqueId - type: boolean - - name: Data - type: keyword - - name: DataType - type: keyword - - name: EntityType - type: keyword - - name: ErrorNumber - type: keyword - - name: EventData - type: keyword - - name: EventSource - type: keyword - - name: ExceptionInfo.* - type: object - - name: ExtendedProperties.* - type: object - - name: ExternalAccess - type: boolean - - name: GroupName - type: keyword - - name: Id - type: keyword - - name: ImplicitShare - type: keyword - - name: IncidentId - type: keyword - - name: InternalLogonType - type: keyword - - name: InterSystemsId - type: keyword - - name: IntraSystemId - type: keyword - - name: Item.* - type: object - - name: Item.*.* - type: object - - name: ItemName - type: keyword - - name: ItemType - type: keyword - - name: ListId - type: keyword - - name: ListItemUniqueId - type: keyword - - name: LogonError - type: keyword - - name: LogonType - type: keyword - - name: LogonUserSid - type: keyword - - name: MailboxGuid - type: keyword - - name: MailboxOwnerMasterAccountSid - type: keyword - - name: MailboxOwnerSid - type: keyword - - name: MailboxOwnerUPN - type: keyword - - name: Members - type: array - - name: Members.* - type: object - - name: ModifiedProperties.*.* - type: object - - name: Name - type: keyword - - name: ObjectId - type: keyword - - name: Operation - type: keyword - - name: OrganizationId - type: keyword - - name: OrganizationName - type: keyword - - name: OriginatingServer - type: keyword - - name: Parameters.* - type: object - - name: PolicyDetails - type: array - - name: PolicyId - type: keyword - - name: RecordType - type: keyword - - name: ResultStatus - type: keyword - - name: SensitiveInfoDetectionIsIncluded - type: boolean - - name: SharePointMetaData.* - type: object - - name: SessionId - type: keyword - - name: Severity - type: keyword - - name: Site - type: keyword - - name: SiteUrl - type: keyword - - name: Source - type: keyword - - name: SourceFileExtension - type: keyword - - name: SourceFileName - type: keyword - - name: SourceRelativeUrl - type: keyword - - name: Status - type: keyword - - name: SupportTicketId - type: keyword - - name: Target - type: array - fields: - - name: ID - type: keyword - - name: Type - type: keyword - - name: TargetContextId - type: keyword - - name: TargetUserOrGroupName - type: keyword - - name: TargetUserOrGroupType - type: keyword - - name: TeamName - type: keyword - - name: TeamGuid - type: keyword - - name: UniqueSharingId - type: keyword - - name: UserAgent - type: keyword - - name: UserId - type: keyword - - name: UserKey - type: keyword - - name: UserType - type: keyword - - name: Version - type: keyword - - name: WebId - type: keyword - - name: Workload - type: keyword - - name: YammerNetworkId - type: keyword diff --git a/packages/o365/1.4.1/data_stream/audit/manifest.yml b/packages/o365/1.4.1/data_stream/audit/manifest.yml deleted file mode 100755 index 2c1315f9c1..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/manifest.yml +++ /dev/null @@ -1,103 +0,0 @@ -type: logs -title: Office 365 audit logs -streams: - - input: o365audit - title: "Collect Office 365 audit logs" - description: "Collect audit logs from Office 365 via the Management Activity API" - vars: - - name: application_id - type: text - title: Application (client) ID - multi: false - required: true - show_user: true - - name: client_secret - title: Client secret (API key) - type: password - multi: false - required: false - show_user: true - - name: certificate - type: text - title: Path to certificate file - multi: false - required: false - show_user: true - - name: key - type: text - title: Path to private key file - multi: false - required: false - show_user: true - - name: key_passphrase - type: text - title: Private key passphrase - multi: false - required: false - show_user: true - - name: tenants - type: text - multi: true - title: Directory (tenant) IDs - required: true - show_user: true - default: - - tenant-id - - name: tenant_names - type: text - multi: true - title: Directory (tenant) domains mapping - required: true - show_user: true - default: - - "tenant-id: domain-name" - - name: content_type - type: text - title: Content types - multi: true - default: - - "Audit.AzureActiveDirectory" - - "Audit.Exchange" - - "Audit.SharePoint" - - "Audit.General" - - "DLP.All" - required: true - show_user: true - - name: api - type: yaml - title: Advanced API settings - multi: false - required: false - show_user: false - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - o365-audit - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - default: |- - #- add_fields: - # target: foo - # fields: - # bar: baz - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: o365audit.yml.hbs diff --git a/packages/o365/1.4.1/data_stream/audit/sample_event.json b/packages/o365/1.4.1/data_stream/audit/sample_event.json deleted file mode 100755 index e5cd6aba50..0000000000 --- a/packages/o365/1.4.1/data_stream/audit/sample_event.json +++ /dev/null @@ -1,111 +0,0 @@ -{ - "@timestamp": "2020-02-07T16:43:53.000Z", - "agent": { - "ephemeral_id": "14ad310a-30bb-45d4-9dd4-20f22267fbd5", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "client": { - "address": "213.97.47.133", - "ip": "213.97.47.133" - }, - "data_stream": { - "dataset": "o365.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "PageViewed", - "agent_id_status": "verified", - "category": [ - "web" - ], - "code": "SharePoint", - "dataset": "o365.audit", - "id": "99d005e6-a4c6-46fd-117c-08d7abeceab5", - "ingested": "2022-01-02T03:51:15Z", - "kind": "event", - "original": "{\"ListItemUniqueId\": \"59a8433d-9bb8-cfef-6edc-4c0fc8b86875\", \"ItemType\": \"Page\", \"Workload\": \"OneDrive\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"UserId\": \"asr@testsiem.onmicrosoft.com\", \"CreationTime\": \"2020-02-07T16:43:53\", \"Site\": \"d5180cfc-3479-44d6-b410-8c985ac894e3\", \"ClientIP\": \"213.97.47.133\", \"WebId\": \"8c5c94bb-8396-470c-87d7-8999f440cd30\", \"UserType\": 0, \"Version\": 1, \"EventSource\": \"SharePoint\", \"UserAgent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0\", \"UserKey\": \"i:0h.f|membership|1003200096971f55@live.com\", \"CustomUniqueId\": true, \"Operation\": \"PageViewed\", \"ObjectId\": \"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx\", \"Id\": \"99d005e6-a4c6-46fd-117c-08d7abeceab5\", \"CorrelationId\": \"622b339f-4000-a000-f25f-92b3478c7a25\", \"RecordType\": 4}", - "outcome": "success", - "provider": "OneDrive", - "type": [ - "info" - ] - }, - "host": { - "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", - "name": "testsiem.onmicrosoft.com" - }, - "input": { - "type": "o365audit" - }, - "network": { - "type": "ipv4" - }, - "o365": { - "audit": { - "CorrelationId": "622b339f-4000-a000-f25f-92b3478c7a25", - "CreationTime": "2020-02-07T16:43:53", - "CustomUniqueId": true, - "EventSource": "SharePoint", - "ItemType": "Page", - "ListItemUniqueId": "59a8433d-9bb8-cfef-6edc-4c0fc8b86875", - "ObjectId": "https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx", - "RecordType": "4", - "Site": "d5180cfc-3479-44d6-b410-8c985ac894e3", - "UserId": "asr@testsiem.onmicrosoft.com", - "UserKey": "i:0h.f|membership|1003200096971f55@live.com", - "UserType": "0", - "Version": "1", - "WebId": "8c5c94bb-8396-470c-87d7-8999f440cd30" - } - }, - "organization": { - "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd" - }, - "related": { - "ip": [ - "213.97.47.133" - ], - "user": [ - "asr" - ] - }, - "source": { - "ip": "213.97.47.133" - }, - "tags": [ - "forwarded", - "o365-audit", - "preserve_original_event" - ], - "user": { - "domain": "testsiem.onmicrosoft.com", - "email": "asr@testsiem.onmicrosoft.com", - "id": "asr@testsiem.onmicrosoft.com", - "name": "asr" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Firefox", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0", - "os": { - "full": "Mac OS X 10.14", - "name": "Mac OS X", - "version": "10.14" - }, - "version": "72.0." - } -} \ No newline at end of file diff --git a/packages/o365/1.4.1/docs/README.md b/packages/o365/1.4.1/docs/README.md deleted file mode 100755 index c0fec85c7d..0000000000 --- a/packages/o365/1.4.1/docs/README.md +++ /dev/null @@ -1,361 +0,0 @@ -# Microsoft Office 365 Integration - -This integration is for Microsoft Office 365. It currently supports user, admin, system, and policy actions and events from Office 365 and Azure AD activity logs exposed by the Office 365 Management Activity API. - -## Configuration - -To use this package you need to enable _Audit Log Search_ and register an application in Azure AD. - -Once this application is registered note the _Application (client) ID_ and the _Directory (tenant) ID._ Then configure the authentication in the _Certificates & Secrets_ section. - -To use client-secret authentication, add you secret to the _Client Secret (API key)_ field. - -To use certificate-based authentication, set the paths to the certificate and private key files. If the key file is protected with a passphrase, set this passphrase in the _Private key passphrase_ field. Paths must be absolute and files must exist in the host where _Elastic Agent_ is running. - - -Add your tenant ID(s) to the _Directory (tenant) IDs_ field, then add the hostname that this tenant identifies to the _Directory (tenant) domains_ field. For example: -- Directory IDs: `my-id-a` `my-id-b` -- Directory domains: `a.onmicrosoft.com` `b.onmicrosoft.com` - -## Compatibility - -The `ingest-geoip` and `ingest-user_agent` Elasticsearch plugins are required to run this module. - -## Logs - -### Audit - -Uses the Office 365 Management Activity API to retrieve audit messages from Office 365 and Azure AD activity logs. These are the same logs that are available under Audit Log Search in the Security and Compliance Center. - -An example event for `audit` looks as following: - -```json -{ - "@timestamp": "2020-02-07T16:43:53.000Z", - "agent": { - "ephemeral_id": "14ad310a-30bb-45d4-9dd4-20f22267fbd5", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "client": { - "address": "213.97.47.133", - "ip": "213.97.47.133" - }, - "data_stream": { - "dataset": "o365.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "action": "PageViewed", - "agent_id_status": "verified", - "category": [ - "web" - ], - "code": "SharePoint", - "dataset": "o365.audit", - "id": "99d005e6-a4c6-46fd-117c-08d7abeceab5", - "ingested": "2022-01-02T03:51:15Z", - "kind": "event", - "original": "{\"ListItemUniqueId\": \"59a8433d-9bb8-cfef-6edc-4c0fc8b86875\", \"ItemType\": \"Page\", \"Workload\": \"OneDrive\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"UserId\": \"asr@testsiem.onmicrosoft.com\", \"CreationTime\": \"2020-02-07T16:43:53\", \"Site\": \"d5180cfc-3479-44d6-b410-8c985ac894e3\", \"ClientIP\": \"213.97.47.133\", \"WebId\": \"8c5c94bb-8396-470c-87d7-8999f440cd30\", \"UserType\": 0, \"Version\": 1, \"EventSource\": \"SharePoint\", \"UserAgent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0\", \"UserKey\": \"i:0h.f|membership|1003200096971f55@live.com\", \"CustomUniqueId\": true, \"Operation\": \"PageViewed\", \"ObjectId\": \"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx\", \"Id\": \"99d005e6-a4c6-46fd-117c-08d7abeceab5\", \"CorrelationId\": \"622b339f-4000-a000-f25f-92b3478c7a25\", \"RecordType\": 4}", - "outcome": "success", - "provider": "OneDrive", - "type": [ - "info" - ] - }, - "host": { - "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", - "name": "testsiem.onmicrosoft.com" - }, - "input": { - "type": "o365audit" - }, - "network": { - "type": "ipv4" - }, - "o365": { - "audit": { - "CorrelationId": "622b339f-4000-a000-f25f-92b3478c7a25", - "CreationTime": "2020-02-07T16:43:53", - "CustomUniqueId": true, - "EventSource": "SharePoint", - "ItemType": "Page", - "ListItemUniqueId": "59a8433d-9bb8-cfef-6edc-4c0fc8b86875", - "ObjectId": "https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx", - "RecordType": "4", - "Site": "d5180cfc-3479-44d6-b410-8c985ac894e3", - "UserId": "asr@testsiem.onmicrosoft.com", - "UserKey": "i:0h.f|membership|1003200096971f55@live.com", - "UserType": "0", - "Version": "1", - "WebId": "8c5c94bb-8396-470c-87d7-8999f440cd30" - } - }, - "organization": { - "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd" - }, - "related": { - "ip": [ - "213.97.47.133" - ], - "user": [ - "asr" - ] - }, - "source": { - "ip": "213.97.47.133" - }, - "tags": [ - "forwarded", - "o365-audit", - "preserve_original_event" - ], - "user": { - "domain": "testsiem.onmicrosoft.com", - "email": "asr@testsiem.onmicrosoft.com", - "id": "asr@testsiem.onmicrosoft.com", - "name": "asr" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Firefox", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0", - "os": { - "full": "Mac OS X 10.14", - "name": "Mac OS X", - "version": "10.14" - }, - "version": "72.0." - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.address | Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.port | Port of the client. | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.user.email | User email address. | keyword | -| destination.user.id | Unique identifier of the user. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.mtime | Last time the file content was modified. | date | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.owner | File owner's username. | keyword | -| group.name | Name of the group. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Type of Filebeat input. | keyword | -| log.file.path | Path to the log file. | keyword | -| log.flags | Flags for the log file. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| o365.audit.Actor.ID | | keyword | -| o365.audit.Actor.Type | | keyword | -| o365.audit.ActorContextId | | keyword | -| o365.audit.ActorIpAddress | | keyword | -| o365.audit.ActorUserId | | keyword | -| o365.audit.ActorYammerUserId | | keyword | -| o365.audit.AlertEntityId | | keyword | -| o365.audit.AlertId | | keyword | -| o365.audit.AlertLinks | | array | -| o365.audit.AlertType | | keyword | -| o365.audit.AppId | | keyword | -| o365.audit.ApplicationDisplayName | | keyword | -| o365.audit.ApplicationId | | keyword | -| o365.audit.AzureActiveDirectoryEventType | | keyword | -| o365.audit.Category | | keyword | -| o365.audit.ClientAppId | | keyword | -| o365.audit.ClientIP | | keyword | -| o365.audit.ClientIPAddress | | keyword | -| o365.audit.ClientInfoString | | keyword | -| o365.audit.Comments | | text | -| o365.audit.CorrelationId | | keyword | -| o365.audit.CreationTime | | keyword | -| o365.audit.CustomUniqueId | | boolean | -| o365.audit.Data | | keyword | -| o365.audit.DataType | | keyword | -| o365.audit.EntityType | | keyword | -| o365.audit.ErrorNumber | | keyword | -| o365.audit.EventData | | keyword | -| o365.audit.EventSource | | keyword | -| o365.audit.ExceptionInfo.\* | | object | -| o365.audit.ExchangeMetaData.\* | | object | -| o365.audit.ExtendedProperties.\* | | object | -| o365.audit.ExternalAccess | | boolean | -| o365.audit.GroupName | | keyword | -| o365.audit.Id | | keyword | -| o365.audit.ImplicitShare | | keyword | -| o365.audit.IncidentId | | keyword | -| o365.audit.InterSystemsId | | keyword | -| o365.audit.InternalLogonType | | keyword | -| o365.audit.IntraSystemId | | keyword | -| o365.audit.Item.\* | | object | -| o365.audit.Item.\*.\* | | object | -| o365.audit.ItemName | | keyword | -| o365.audit.ItemType | | keyword | -| o365.audit.ListId | | keyword | -| o365.audit.ListItemUniqueId | | keyword | -| o365.audit.LogonError | | keyword | -| o365.audit.LogonType | | keyword | -| o365.audit.LogonUserSid | | keyword | -| o365.audit.MailboxGuid | | keyword | -| o365.audit.MailboxOwnerMasterAccountSid | | keyword | -| o365.audit.MailboxOwnerSid | | keyword | -| o365.audit.MailboxOwnerUPN | | keyword | -| o365.audit.Members | | array | -| o365.audit.Members.\* | | object | -| o365.audit.ModifiedProperties.\*.\* | | object | -| o365.audit.Name | | keyword | -| o365.audit.ObjectId | | keyword | -| o365.audit.Operation | | keyword | -| o365.audit.OrganizationId | | keyword | -| o365.audit.OrganizationName | | keyword | -| o365.audit.OriginatingServer | | keyword | -| o365.audit.Parameters.\* | | object | -| o365.audit.PolicyDetails | | array | -| o365.audit.PolicyId | | keyword | -| o365.audit.RecordType | | keyword | -| o365.audit.ResultStatus | | keyword | -| o365.audit.SensitiveInfoDetectionIsIncluded | | boolean | -| o365.audit.SessionId | | keyword | -| o365.audit.Severity | | keyword | -| o365.audit.SharePointMetaData.\* | | object | -| o365.audit.Site | | keyword | -| o365.audit.SiteUrl | | keyword | -| o365.audit.Source | | keyword | -| o365.audit.SourceFileExtension | | keyword | -| o365.audit.SourceFileName | | keyword | -| o365.audit.SourceRelativeUrl | | keyword | -| o365.audit.Status | | keyword | -| o365.audit.SupportTicketId | | keyword | -| o365.audit.Target.ID | | keyword | -| o365.audit.Target.Type | | keyword | -| o365.audit.TargetContextId | | keyword | -| o365.audit.TargetUserOrGroupName | | keyword | -| o365.audit.TargetUserOrGroupType | | keyword | -| o365.audit.TeamGuid | | keyword | -| o365.audit.TeamName | | keyword | -| o365.audit.UniqueSharingId | | keyword | -| o365.audit.UserAgent | | keyword | -| o365.audit.UserId | | keyword | -| o365.audit.UserKey | | keyword | -| o365.audit.UserType | | keyword | -| o365.audit.Version | | keyword | -| o365.audit.WebId | | keyword | -| o365.audit.Workload | | keyword | -| o365.audit.YammerNetworkId | | keyword | -| organization.id | Unique identifier for the organization. | keyword | -| organization.name | Organization name. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.description | The description of the rule generating the event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.reference | Reference URL to additional information about the rule used to generate this event. The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.port | Port of the source. | long | -| source.user.email | User email address. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.target.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.target.email | User email address. | keyword | -| user.target.full_name | User's full name, if available. | keyword | -| user.target.group.domain | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.target.group.id | Unique identifier for the group on the system/platform. | keyword | -| user.target.group.name | Name of the group. | keyword | -| user.target.id | Unique identifier of the user. | keyword | -| user.target.name | Short name or login of the user. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | - diff --git a/packages/o365/1.4.1/img/filebeat-o365-audit.png b/packages/o365/1.4.1/img/filebeat-o365-audit.png deleted file mode 100755 index a2413e7b909bc7d98052b6cdd6b21022e8db12a5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 432036 zcmeFZXHZnz)-K$FKuZS6k`yIKmYfk3HXvDYPLgxZARtIm0YN2+2uRL3H%ZB$Ri354E)e5& zcOFU;sbx8Tp{n8@R>(%l$=RD@tD|VIuEhJ4gmPATR!ylh5PlN)I3bYy`IEpV4u-WFEaF0vl z;ria^wA=r+8;4dd7>lwZ8__{=l-n7{b*Wwf0{wU%df0a_OJ8Aad|;cLD6!jL(XS$A#0hH;~_-~B?b91 z_&=2(4E;XgU7wKcbzcM!H~igBQBVvIv0#G7HkZ@4Wmj1`B2R}$#>ra3Idk)~u_{k| zBUZ20*2ozz_aaG>nBl$B^S4oQU%Wj%mlYHQ8XAk8S#($z*Ca_b17F-_79>$t9#E6- z`dHo4asvzNDN+mTa~YBv!g%S0JvzFZYN2n_SatZ`Xog78)AK0mwQ}d{#PzqAJe1gB z?Ut$Wgak`ViLN`H)GKRiAB$9*J!e)#ySwfLTklMHQ-K#eUR=9@P~dYo&TDES-TEeM zX}wN(u>z^8^_He1k4#w4frR|w$w6_7^QF1DqvR4L$(~>9v^)N|qes+bFFFZ5`9AAecI>33Gx0~w?$(w}(3NJIurJ~MEw*pP#eDuv)?E+k{C1fK zGaAEZXT?1{J)08`?)}+H&7&)Sm*q=V^2~PhZLu!&7TDpRAYoOd)*`DP+S*W=@85@& zcB_)e^UZAQEax$@vs<@a20Mqk7^vO9y9!7@V* zlu?G`Na>8Hm7#2Q#^HD2-4vaIv4AKeHDzw0eePNq^kcR6}DaoZbkSug9jsR%|Y3z zyOkD!OviEigcNlDM=j3ml^S7qpYik!4spANFj`bQ`cC$W>A z(<>miPt~dCb8vvx+ZXe9`iG~{ugzaCBh+?KbSVx|1?!#MU|Dcyu&6izsX!Iy~l*Q0yw940Gpf?{NOf?c74 z5xXg|cKvnN#G&m5=nF4}9OSz%BO!hmi<;{tcYQj%fK9e{7o(70Kj#Ue(3WR8#!M^e zN`jYM(y>H-$Mv-H=?~W7+%*aZxI6w;-?+toblha{3df;ev(e@D-rlR=1wX^OFLI{C z6yGq$8HGwA*kLzNgqiJM+6a&a6%=`cCf=;XTn_^Yl=J4-ypk~%n^Ex}<|Ge-1iRxi zqx(@)kY|{Sxw$VcsA}+*n*)&(t;#*|MyM{0KAD+DFNRKFyGWoICR&h3e3f4VgSB63 zJ-)+Z7c2B4K#Y<^DEq#Mp!iz%zsxQ7SFnF7U52Zu&CnQIJ^nFBhyiK)tm8r` zxb)*!*(c10S~`GmS%MZB!G5d_n8cbfH4&Ftk{|DgIq(tJ96H@-Yar+*mK5YtuMn5I zW&@IHNzKQApf?N5`h-E8taikPf3gt){bE7NQKR~2|J><|&rgJh2agMjjK>V2y7*Lx zF*Q2+5W5TFf*f|uizW4vW8^sGHr;&KzkgIac`ed%1=Vd(G`w!df+c8t3#JakGbxdt z=zDd;dz1#jPuvoeYdw`~x?Hhf#YGN<|M>nAc#%(^42GxjyI$sOqn!z+{E*r8A|LXI zNXF&^Z(Bh@5P``xV-fyTbc{}RnVlmQa5`#6nk?8b;BBC{=3b*8xLP7U#VMhDQ|-EK z?3%jk|K_g4y4mSDj@f$4Z3rY?<;{aa!N=rf*eIgR_T%QBg>8oLBZJu6{xe%92+5ny zlkrR}Tr!1YW=f}zmw8VPX@5>geJ_#L%@bNscpV7GcjYIJf2|x2fF(c%7h=me3#R*( z4GsY1p6QQ=&oYiBfK)FixDu;4Z`R;lV0I0wLm?3)2~K-VT}TZ8J3D86kdW|BGTyI- z0O5Rscpu|;8&8bi6~0df_P``QJvJ`2CM&;wYK1mjP+YtRtwZK)*k+c_CK;`)U1`2C zj5@4cWkLZcV*rm&p7vM(r$L3-4I{`hOCYKF_)+gIdlH~8rf6N0u*LS;6J@;h@CFKF z@nhv>=STz0bN4bQa)H?5Y+-(Vn=eohU^oV3dV0E3Jy)v#i1K<)jCgOZ`+Xsad0mUB z59Tj*SLVQqRUt004yv?Y%3`b*zce9 z4hRH2HfyRSdW5hR%Ly0$6Pkw;_fXl;3yxV+;Ksy;kzpp6kYbv+fBl-v1auT4ZKlqf zdyXH#WoC^9!!TQHToiDM_E8BbFa6n)VMS^hJRFJ)W|d=H4k+4{!~X7%7rtEj__*(y zyyEq;;X~q*q5?Ge8AV8jw3|w6Y#Akq2eXyHn|2`=$wgR@`}g5!QWTv*-8Zpy+pF@&+y1>H-7GmBz~z?q##+6LkQPQLysH~nT&4t?c(YiWr6w~~hq2^MtOD8| z6pfoIrlhinWJ2&E&YwOl0%fhFWa_l?=3|(qg9-_He=aH*S@Q}x5($qW9vTR|-*WYW z5V9Rw#uKf@T8Iw;+*=xOo2)E#hnWudG^!W4eaW0e$qw8}IeUA1-QRfU(Hskc6h_=4 zq!VG=%LI%T?8b~Y4W^gBqMUya?~Q*bZdFYUA@H}ASq=zByFE*ZI8B<_Lm3B8CTJ28bEKi+D1V?)CN zLmAAR5r5L;(X?S3+sy+4g1B!51?@jH*VPR#XhX{Rs{wYe*upU(6x>Ff_3K?-L#~&v zXp{#Amg?`UD+|W+x4P^XtccvkSe$p?89X-&)h+l^QbO+*;TmKVT6Ne6tYETX;FN*U zVCX%P_VDV>({%=CDTmtjm)*En5d*&|DK0AM`M?|4mr*@*Hw ztMh=5Wv<(jPr7oYvo~)J-|jY!*|>EU!6Uet>>58FXK*4zUMA;uk+9AkcNe*wH|dT{ z`Whf$ik}{M8RjDKX#T}@xa4f?9vexj7fKQhjs_E^qq!2HE_zx_G^t_^PB^-R;ms@q zZLfxTMwsMPZehGwpY?5+s3(y*)!E7W9zJ ziGJw{ILJlTJi$8=F%k$RS=sEb;&pJC71%FUKka)?7VN~5fot~w ziUQ;c0o2i4cS>xbiX7?;B?tp!#+t^*sQOulmJ$EP&CW7OYUvCO>nXR?BkuM`MP<9* zV3fT36kh-{xd;XzY-z*fF0pY-#d=V4fGtNCXA*(}WAXevm;1Mr=KgEKm z)%mtrpF8YZ+YgNan?PQezqGvO?ooLKH2X(I^>*zfK3ZLXukLgNaB1FD`(|p}F+O+g zMVdsg9)4Sdcif-D=I@P>p=D>1WEA8UlTdE3_6O89RzofENI?6Lz7km`x>N4F9O*`< z&_S;8vw4ig&O6;Cu-i=lS6bYduz@q)dd4%bu8c|XX{hqip7XJf~WirpHeN_ z7Y47L6Q_K@24C@?`0lTB;?}Se2We;!q|ckWi?!81$c`XM1PnyCg5wYKwM&QcU547d zq$-ha`!7^Qw;mh9FH<=1WC8=jbPJ{ePi<~;=smb{aAq{rJkYOb4k0!@=IWTeW0sUp zJd4Zp(In|O_M#;Cj&X@$^Ps~W$lDJ|xb-rkCuPOby3nx!JslmQwg5(P+g@*T#wNET z(L|RM?df!HQs^CgBOrVXz$I}%Tl1FymJeK#{Aqlki#r3`M}JY46JFq3!%)bPr9ZYC z8vJ;P_X1mc``8DtVa@BRKrtxf)$y{kBdoRCz$AGCs*enh(%J9uNEX7rdxnA)RZ&9? z*r_>_uqQS>5?1Ht=FstGiD6t>8H<|6Zw$AHQ8uf;=C~$bJ;+8eYz4gyMSgLWih5vN z`b+!c&D_M_mDsbJ^G&tVKI<=*D^_C+nTaVd#@jw~LP93P`OC#Cr6&hF%onET=R;Yr zB;bG!S#+~KJexf{dkQX@1&ue_UOMN8773Ln18cAiCDdK+%c!YOb86&G8Cm{8&lC0tOY2%GqBVa487oB>LwwB9oub-oFLyq#1 z*yz}en4RK|tx98*luSfIt6fU?6EAieXgW{rLbWCP;)gd{6kMR%{Cu#M_8NFXSBN*%_@S$t}DLALLX1bjHP|Hlji74*cdp@(c^IyM`d@6(pP5)r4qeFc~+nv{Y_ zPff=;El&WUKmzdFWnn|FiKCFXL;tQzbAZIOZi2`|lAO}s@@piu>y?>2#-f&ehuYx| z)>7gq+J7XM@?t;rJc?7pDr&D7OLdjnCUKe@>;!arq18bG1bG8jAGa|f9LChRT5UA< z=Ne*Oej&Yy?O4uET;k~PRLik)%+YVTU%D=LO#t8=4A{`lOz_Q#5_uSie8812H8m=a zBDW^s{q6aDl%2kw7R#{@DkDa|g21e+OKHLdq`ASVF{dHM1lP&t6D5wel0rXWT_vtEGPU-_%6fk~ENCTuee zgZSjugi=OIG?QU4{!9c2>p*@YI@IN<)q5W!LORJ%kgm6TI@KFwHsEt}oHg~F0YqHJ4a|~4u#48340d-w%W%&?AnUr-kAFP;WA5Y2Y0w-qlR2v|!*P z%aN2KgwXfUveMwU8%yuACR4B@YHL83{vx|B7^D>xMAiYEA&CsROH3;4ZWq{Z?QCV{NY|CLkSNV3*BygcZ}{Bh zX3=ESu7A8<^9%0Y?UC7nauiJ;NE;b9&>RuOZEOrPN?qq0g}Rt)JcL-N9j{LQSULv^ z!7ENK$Npm09|AF-*%rKD9mM0fnbcfQLV`8K%^c+zAf)*qUSnWj;C3G_7|qpb*7J@Z zhO8NX4gj0%o-^k4;kmiE;ekc8vpF_H>yV?OqH&x5D1JE|(A~)vcLv~da62g}rBagI zuiSPlS0sBAs}hsan3LO+fpqtG4a@u8{rz#a?$Ges#nyI7PaeeF0-z1T6SqM_XG<=^tU<0!V9TrFJ|R zGSVuA-yRs?Oz`!RkK0d9dRqe=V&EVaA%g^)@c~E=bY7lI;;fbEICC4fa5+r?XC+`S z^if=Bb@ly{AaIY9)$5;6yRa6i=Nb`Fx&tr&N^`oXeRXwDo$yb1UND0!_v@Uj2oawM zjZw|O*wB3!BJR9cLTv2$V0-tQ2H9obsEn6$@i!(z5-}D@u0?Rk>$?-b{j}YmntPJk zzImPT4w`;jGB%hc6bYd%lAa`)o)JSXS&86dAGoj6;A1Df*HOTbkk2m&iW?snjM+{F zse@Um922XGA?3$XvEkV(A!lNSs?OIz~+iKAfF$lka zKx(YEah*-Q&u;O+-5sc3^Zb_QjgaYS(a4OB3?PHb}~=hdXt)Cd-y z80G!U%4+{j>Fpq)v$g?Tk4r13x(S>yS+Le;=hK8>rutua#$b=0@8t7LJwf?PT&A#e zUhlFtX>=MMv(#0SgYZ?wSCH`i-rGyDgW{|x%?-!~2G5#$uI%FGbuxX7AdY)uq>GWul{KnPGFsKIs}eXu5#~vkp6sy1vRn zs<&eNlGQ53_Q1HTzrnyF*OV$Pe8w!P6z98s$@1r_1&~;$mdlZN{}@W@v$U?M|5;2> zLxyil0dh-kY0+w?NdsAiGk&vQacIR`ESMwnn$~fpL4QW^))py2joax!&gU{P8RN`;1ZvSQX z!5-k&`O&X!U3x42*l6z@a}Fsy$^5giq2Fx(&s(e+#lP42UH>_Ajb7yc%q18b78d*e z9{z`T|3_eyn2Ufcj+AgslmT}6Cg$PD+?>RR2^Zr2pEu%&j?KqBDjjBIFm{nyul!GcN01^KgUvZy_si=AyAcccn7+1kn*M2;U} zF8(g?YbtS;v2efh$v|v)G&k#CFXx<|9#{C+@ThOy;(OVj}e_R4Kq|DQr|okXysnNDM}rnXQ~1sREBcex+pn=0tax zdUE%Z@ob2xCyDkftMu$o{T~f|Q}3Dk3`cfSly%9~qm*5{z6VWN9_hJ~;}sYTv@nQi z8tcyHHUA7L>sN z_h>|sBDm00fC$l^!1}1@D8PzhD;S|cuC}1w=KngiY1tR;0}uH2IaYa4b&RO$Fq{9{ z>wk=}4=%Rd>SPJsUlQqkE_dy9ACJyCvw41~*Ysq9q?TD+2o-c;ZdTP5xTRkO1`-ac zr4sr(t@R4S(Q=JNgUc;XZm#6FQOk zMb;inF=BYq9L(22^^q~V4q^BVzh3}-Quv#-LRa2GQaXK1(JE|?=3_GONDP-0udg7O_(RAe&fmJ9cZn`#>o8C0b%cRyYL5+42SO7e|`NWTc5NpJficZ=!KIW?L)Xt zr_~H;=5nTNY&IR;t?*3k>ZKtAr)8ZObEK+$Lb;^AD8|`F`lAb8eu7qgvan#i%xLiJ z#-Y*hRs&MOR9xmuH2TK<11$9=QL{{wbNOYWZH;HWTm}Y+@&o!cll~4J6vM*A4c^nA zxgLgtB_8KtRY(m<%ZJs%G`cQ2ifp8~v6p8aR`j1W}=-s!390~Zj;PqKD-+=_RU-xBdM^MH@5>N4^N$COQ%TtEiij121`@zmCJzJ>} zr|WMmfoR0@9p3F+Z}vX<#F z-_F#z3-a6{6Ez;@?rHnR@zd$AU0C3Fe-~V<3PCt~VF7Q?1Op((jQ`9q#FruGkTgPA z?g5t|a@+0ixZ%Pv(6#PCyx(~ zr&p2%9_MN-1AWhvdIq3pA?0cWjS)Vs9J#c8-7&T6T!*XHLF!8ZjpT7OXe*87e5K+{ zYcwbJJx~j7rr~xDo*3Tpi{HHTs&aKN4MAnfChWgXl+U@^e)asq%qV(b*H4OFM!_m8 ztqLfv{OSN09~#Y3v3)h!&^o9A4VN;eW%rd2P!UHf_GPWH449CLLRj5UZJs+w?JaRr zCdd8_?dd$yDWIS`2;Dg`n9<6?)ksavbcF)dHFT>)#M7=p(fg1djKyHx_t4fD-!A}b zWb(ZCpo_tCZ*hV6uIu+HUOG`ko4F`O(xZW;RFbzbbJz(X{d{u0^7DP4ohFuZzE;+M z%>PKVnfL3Radx#|n~g}I_cYtvC zf9C^IF6pGuOo?D>bbpQByby?=LBOgYM@U3weG^8_O>-*qo2qHYHaN=FzjR)u{Z zY{F`AVXEkUOvDHpM2Ep90(0es{@RSY>tf@;I~sF`qXwmPopFi9XTtwQIlI>W5``Py zd_30^eBm==d4@>tdVN_*4!!nLNLx97-ZBE}0g=u_ZQK-!eSfU$)O>Ep|Czs@a$bbi zq@Sv5e>y$L2%5cJiKHmUuXwC?2aa}n5)7tV1FdZnPC5zQ`mHrhFAuj+^m zOI=n>n^yfBMr?fmTN?af+qs6Us$RMdgwP-z?%i#6Lzsn_V*DC7Gr%`2{s~f%n2RXx zdFfmYi=}rQz^KjOGrl^lL1IMPY3^_CYErKUD+g*5A!PM{@kR9(mQU^#@x4J~BtW}a zHe2bk1}K<(Ux`HZKNg?TN;e?3XiA|Gy+!<92lGw(3AnfXWLzmGaFY&tJ=1M)3RuT| zvR_N%m3|j}=g(6^k?$k5z~EFh5}3SarLKaN7*Yo@Fb3J5X;&5ftsj6JAppa;2w#$W zG$17 zhTjX4zKzhRT{IA&2baQTVcN6hELnU0`rxSnZg_ADBkpz0K82HHfiHJ!|KF%*em)Rq zWE}EQqanKgXYsbM$LUQ_y*778T`d$zpPEjyUwFNC9h`18`54kl_hU=v$A%V3#A%m| zg&H%E6qwVmLz-eyAeNvtO018)x+?n6tkMXIk9tvDlvC%OM)Y3z@4~+nS-4DFyy+q z0vd7#TpujeB+JqNJKFdsOpJOLY68P#3cX>$wh25oOP5gu3t3g}}-+vyJs%G)axm*8QIC7+a6Uj?2Qv|w^?O{1Ex6MHF=guH~C;4uwe zRl0R+gEhJNn)r&l<@rVvrS9j%2n6_|aj03=UixYFi(%BWztZ}1%`vu6B*=EWP?AeU zXNExXNMyMTlEwi2+q5+lH`PYKy;BD%3Qoqp_x?0F9}CGcQH9>aRd3ZMwLApiY<8=+d=wUb)VVF4{FJ zDb3*hZypdR{RtkR!oB91U@(cxeCfF8@3Mis<$woA_e-`DxnHK!V}k~;zpfX&_g4aN z_gEky>w0`)MJw(>YdvHlXQg%2D2xyJFDOsau=@e3VXdlE|1FPvU+Vw9xJmpzl;`hp zRuZB5|MphT?>MkkE$2TQ2SU$);TfUVHTs&)FX~0p{cXY6xnPFOViiE&a=A9F3ln*~ zt^>(hoh%qRF3j?UJP1VKRaHcO4F4Hs6IGs{V=;_ch&m219T?h0f79b3$7l$QwN;Na z##v=`DY!_L?$9*xc!Cv}$Np()%$Hr<2x@5KH*$fvuz8&SY|wd-NA=Llpx)53!Z~(u zxnx-y)2w(fq!fViPURb^5a~qGF5h=*4)p}ZgXdKZ_~Ay+ugv}(&1#(g92t|uGiMY( zy#&Fw=pijg(2r4n9@*MYeNcXSkbKxq^e8_u78a~WMG&X$EI{^xap%i#BBg)NU^Fwn zwJwdh=oLo@F!I{U>=1|8Qo~vw{^e{F8>XKg8m#;8cr{5QWdgkU zVX2?Rk*q?HlRQub(URip7X3<1dub*A_0KpdhjWvo^R`|KJF54H*MtcEqb!?h!{FH^ z=zm@+2eq&A!-mODCLgQV{NsPh|Hoz8FwV~AQXeiPwA@LZ;l~fhL16__{-4&xf@#(( z{o&8rL-(a&+WIkgw3Pv1M`Q-jW=yj`>!?T6mR%+mFERZ^keVVJogWCr@x%YDYNK}x z3Ii!RrG1d7$80$s8$YB!JR*MaXN!&e_7~y)e@y}*N(_L{i*vd83)sXYk0a?*E7?fd znQK5du6w4*USsZdL`PxF`aBOS6d606ILb#H1_aX)hXv!ST=8HmHd$-ASW!d8oD3SV zv7QdS+h?Ry#Z?-f9TohxuA!wF`SQzpSdj96cCSE6FXDjY>!>yH(@f?3af)ksP4?4>sR zAAI=ag+ubLoHF_6%|`ORoieb_oVCo z!b(1#PudB{U+*@4WIkbH;_EZ_SH;Wx=ujH3^48(!c**1GU3^+$AKI;rn;tgL;QRA6 zRW(e!XB6@DVqu_*V|bH*qSn#Q_URK#4*E6mAnudSPoGpcoeGxwC4a^_e{$Tr7Dlk` zy_oert*gl}kuPl(ad$g#S^DMsq=z}HW#sTAN8+SkTZ*n8F<6D1a=)LKJJZ}$d)&mG z!`Ak6om7KvKtSy3 zj>I%;Zow-l;=?op%>MItnUNMLyuJ&rRdihKgLFf})~>K&R^(%Ketd*F_sqMln@LGx z64pzxcMYB9d_%UkP9KX&{u@3wBTJeyu`cb@@w*vz&P(Fb<}2rFJpP5#M+>v;&y|>qLoXBVXLkK~J}wWH@;So>ls|Cz zL~$4tgFq1uU0&M%{T`Z%ny;hAte4pw-oKZ5Z-JIP(02#Aienttq}ak!QGbA%x=!E0r2QL6pIxUka!AOXRy4PGePU!Au9H5`IB&7| z(G@f#xJe$*@)=xu9Jb&A-CXV-pb9UVi3O{Kfo3vhRTRDbgmd{h*J02Qy7lH4m2+eA z$=Eo`?WjTjcMzC=nxy-Px&QG+i!EZ~$?zvNaOsKM$Dv0%wt2EYU)LXC+()l1Zd?%6 ziu|304MV%4wBIk#n6W7KsB?9hNU|+XUf}fDk#!a>EnNGBdY%6HlAVeGuKhFwA}T8+ z?hSYU)?ARQ0%@B)c(b23V2cp{N{+E;+rvN@#JJP{dmtmeo$dm}YO%yNMKua_`_^R(Wsj1MraiRN9@h zqiExS{fpn*{CG+p9V$1C@cHe_;)V|ds+@2g`)2-AlP1e-4O-*JGNn%!7H=mYhe-s| z^?}NinUCpv*ocnIkGwv^OIDbUd94JRDV_wFKRm=<{zC%PF?AcAVt!7St*jM`Wr3RY zXq%~FLjdL*`cJ+DC<2ruZ*v9X_!1{(iLc?N8}`a#2><&3j+LFe0I zZ)kGbr+6f&cV}7$ND-m?RzWKgfD>V_3yu}s9Lt+^psIR?r^9)?{k{BWohzT58|e7b z)}56EReqq|;+z54%~^N=`xYbv_+QG(3^=uV%~61klqZ`?7EeP?JD(>a)p$^gOuUvL z>ru4%>)0PObE!OQ87sY{BM9I14WetlVxAD5@rmO$YQ6==IwEjhSQJrl8*-fE^FQDG z9!Tk6>lg`2`RJ4Y(4xm44)@#udTnkg@25w_saDjr!eP?;XPa~v`ug)=mk3g86k5v6 zcLVc%jX*R1YpuuIS!0`7KkpFN1agB#30KtCeI?r#a_ZWi_S+z+35JUg`ae7#&}VcQ zLKJJ}aib4IG+ki0-ib)XA*2;|I^jD78dpy~V7_6`$&Y38>2XFt6*61TE3gf`~E)orIq=bBo0L7%b zoV)FN3WT_>e)e*n@jwDp=V4kqRIl0^8YC#OPP%+zmbmlzX)dcNss5`vh7 zn!N;cfF>E#qLmfhM87TDp$0cSo5qd|hxw1j2F*>RSdo7akBkf^AV7T#HoXUq3pEQP zK@A_AV~XwrM^d_z%Zw-xKS7tFZlf_x213jQA54O8cN;Xfw8hWi-0#af?}ycb>i?)x0U~z${9iPSQ=0wB`6{{*nXec=WE=iPB3Gr9Or=aeyXdvRVd+7*Ww1 z=oFJ!nPwqq%3z+ff`sf;FuUr3{FIG{(Na0S(cEO_ zF)8rB@U&imACxA|=|jTXT8XEXZM~`8(e1aeJU6!Xrtm!lW7dzO+<{N!p}1AFN<2#i>Rt~5C0(>>TR zMSN99^7(3fAKat(QM-5dfrRELKvyCc@Offvzb^5N*!A^h9VtnlZ^XY%K@q-X!`QU7 zi}O*bRB4_4^2&oNsD-h2r$vZCM>ba@hI}8`!Q_bK9&Ni$;xXex_t`3A4S+tgf+?xxX%7` zN(eZIShm@->-FBZdIhxR0>CAcy$eoiO*WsDS*D^+81xBVV^7NgudkryzIQ=h{(J}Y zVRr!TV&i1n0aO%p=%-9cLakn)utS03yt|o65T^`C&1+7x#<%a&?Ma~%zs6J3S#;H? zBG~%v&o|U1fdzp>D(EAS3x)a|w=R#cmzxSod)d1(SHWS@U@=Ox0s?~IvasO#gSI-m z+sERvyEsA6YgghXFeGqb>BsNi(GP)ZpKZNXs|Yxm|HnxeJ?8LF0;St&6wumgdt$04 ztOE+H6Lzv1a%kS%U5q>D{(0DYmG7d;> zNvnjNr(f*JaeLF55?zaR^7&MzV7PVdp_PbewO#v zBU)`v+$_nDk3R6=@)Qc(5v?D+WG9+;=xH!df7Hhf7wRO#gp{mm$7JzCs=R1i4xOmY zGk(F4fxXTUJ>f!z>Gbk^3?` zYeb==_`3Wqd9ZGZxflGEASZB?u-lok&Q#~2W%H(K_LCZb&ao|@--hD3&*5GjIseQO zqLRk~pc-`?pD{$ynw}5yac0;ckO)QY-(K%Lf<-knp7aNg3ooO5(WYfT;Ygy??H9z` zzIUeV@6Uc&qHv~dw&H-;jaE{;tHb*45;-E~nBAOxJKxs3vpzUcV{`!=rvV#J1Lt41 z(u?RK9mXM~j|40`aTV_(#iIMaRaDSWj5>IE1SsLyM5v~vmtW5t3607EPDu_Xqt3ebw_l6Ko|-~>%(jMuMu zO#?NM&+xzdrxc9e@l%whOi5Bq#>>u($OPf0!rF5$K%|85Imm$EL6Yn~LhXCQ0N4$l z`57E`?PBs;XT(N0a8{{7{DaFJH(_V0F`bTt^pfDT4%@9MI$s>x`m5tQ#~$M!DbSr} z>v6Q5)P(QC06xTAdjXjN(66H)d0-q2*jP%*JefS7!RR~by4srgluy%szyPF$E--Gtu>?JI zkyZmsekaIANXRS6OH)RNFmI4Vu+OAsap!milc5q{wv3nU*>z^*ps!sd*t3#=4Q$*u zd>!>v!w&oKRf#cE5F%QxD;MoRjNjjBB|yjFPR2JhM)&SMEY!RNyC&{cZIvj z&@g&o&1L1R#DcrH5lI8ZV+hbkdBX#XY`MtxoT+xcH1$}SIbR6w2U$!1dK1>(mhDe=q zy__G`^g2JDdj?!4Ar=fc3p7zf6QXQ7PU^aQoesi|3T7Ua#8iR;wWi=K7tm|8=K}cM z&p`2y^GoFl70y?QGC+aE*?gGwfp|_ov?YKeE4VTX{h<)4uD3W3G{DGJ@Rp1<|xy;KL1bVx^ zCLlxeI=hA3i5|omeGb&lkL82lx_IG^)dxi@5vSs~F9K5u&r6)JVev>wj728zUYEm?vr*pT zE3<#<0x*1W;=SGU{>X0P+In&}+mp_ax>79xPa9jup6c&DX#IUALo>=(L6Z9R1r1c_ zhcEQ7)hwGB zws+gk19jn+K=Tv5r!xFs6lTU(-4zCBBvmq-@3+XqD47mlanXv5--g12k;As3E_vFK z2b3kzh?f$G7|?=i@><#k$!MewU5jdpS+XR<*;0Fk{Tx8Qj)^kQ(P_|~bN}hCnDOn_NJHU&5 zkiG3U?d*tlJA)Pinw49V?~ zXMnPRju8R3zPRjBCyBzyXE_v7i4B_O7t-#d?>Nx4S`(bkC{)n5&@yCuUUl%vTn{}% zQ$QHVa|s$>-g*p`N(HsfJ??`|_;?0u{v0JgG^6y~o;MgbG^jrj+34U}TXz?YF{F_Y z>|Z9UXsL@&NRBAwRjrh8ACx)5-?R>LTwdEt9te=S_uKb5^#BQGuB6Auq{oHN=dWKWQ?S8+u^1B4p5d;6I zMbvzSW34Z)19%FI=zib-So~?=6~)$meKrxjs{gUwD}0j>a0d*!}yGf<5ZXNh1%W*vC&11z(0x#anRr*40Iy`@UP+1xF}3{h0n3 zqCXY2IpCQ@HoDDz;OeDVIX~Jnn|~%=?wv(o1LTscZjfg-f>!5~2r@#?Cm4D(u`! z38Z`uRwbn?Y+nglX@j3+I@je|>{BOvJ)D)nHZ#$g33Ji9W~yko?ii(tfLq~vQH(hd z*HDU9aX->V-Fve!ANC}trGL1%k?0>+vS(F;rpCp0V`9hJH*PmvFTBf;R2^yGSf2Lh z(XI(-%wWm09U|ft_22(A%2(-epb~JF7t6&9(l{%2CYD8nw4w$6M5IT^k=wfxRE6I= zSXMa9iP67Y1%Z51RK{7XqHPS4yr+N7&!s(%agzE=)@x2XW|$R=v-w-Kb>`Ly-ry%^ z=8ULd6y-T)isA5({1f~2F-xNEI>V3MUg0i*7bW=b31Ho<{ANqfjapp|@`jAx221<9 z>ppr__(s(0C-?ye&!a8ngFk*nt0;>FtV~p#;@F}F0~<)ajlv>hk52K&CbL58J6)i%dHs&gGT-Z?h_g0S6tXc)a)_AZ^2oif&4fit5qj3s zGlV_mTy>nk>#b;Hbx16D<6k{5msj2B;aeZ$J=LtXrF58AUH;ZdUfA;Ueckpa5&ux2 ztZSZMzqUM|aJnn%GJHuX-2$&bTT^lT-`Zrn^gTG)3r>lB?6a_-?uSIai%<Sxy=iICK77kl9-KJ*OJ( zI8OAAcXhry-Jhs`h+NA5Dxt@bOf=2-a*oK@>vzrL1H zh7)@%71QwLw&a7v4zuZKgn(tFKf0RaJ#CS629dT$9K zuArb&lqxkMy(_(j1*H>^8hWG!Lx%vN=QmfMzV*G&``tg3BzNY{occXy&dlxi#avdT zp=VQQ^UE7I?b>8VjKN5ftPsnwape^qm+NzT7>-VyP0^`Zy`ZZ5jze#2gNKh}zUgJ6 zorSY+z)DcNuzG}PV-KoRF(0}s@_zJ1r0%4Whq14bw#AIVU%6?s~@!l!qOGlt586?x9<87v(1@K+we`3sG@U;T+sb3`yQn< zp*_t4vEvp@3d z$|{HIV2sDyx-7{pon6+eZ4U!yCJ!93v$sq&VlZL?a)z3!?(P&Q_|5PKn#?U-@fifrKI4v%dSmEq{Ai^Uo1FIW|PY zUcBpd*VYNtM1+fb9|?#U7#x2M(&qIt^@R7ifTSDx^bMUCVhNoVb_dndoS)6b)kC7e zNl~|f@$Dz)rVzTo*3|kl9PA5=b#>AEdr3EhfR`f6G?cCH=YN$7p={>vB>5s>xg>=2 z!IL&(G1K%FHyDMMO+g*l{mZMXr?82|x5p5E+2@K037J*}E!BR{fbp#z#kk|A>ZT3? zR1ADkHAu{A@!|MPHDQm6@GL16H|K)P&l7zSGtTJ3L&IL5hnJ-c=keRmRx#~v4ZHVwOw-AwvoYK zVX&5{{P#B_Bn0JBh67xHh0Wg*Z5_SfT+`BBscOV86q8tRztm*z0Dm(UT@!P$F>{6( zWMZq{DfH^1ng5!x;8oeHgPHyPHZ+D3U!-CvmPW=YsW)wjg$i00w~dqY|Ew(AbE~r! zcrTzR-oD4GHlDK}_uDtwyp8cj3TIsqc3)^~_5NClO+m3RXr|lLMAUws*dW`OxaYD}sr#>6sLddk98*3T<)ec9CN^u2vPgNs zLz}+LxyZa+zrd5<(`%BMhPgsI*Rz~cgGQA};uP~@wq7zz&b-7Mc@|i$4~iTqS-eds z4w}CPnD$`yZghg-rruEW0VZcV@u9Fs%* zE~1SNc(cR^$JlA5IkJ;_0ku=zL;rnLmrS~Qc#+;$kIRMcZ{8@lpM;Eh=#N?LyLN15 zoRV3%wvp2(g5@&3;VDY9yCa6VZ9@6@$9LOsQrik4+=2^OL8MycY*b>JW`849=WrlW zt^wUP!?@*-FKcKn3|3kIg-33!q9yG*9tfVWNCkw?HAMfV#9H~6x94`7q|sggzvA(l zlp?~g#I6b1HmurnIbY3E{4@rh1k|$-xIL-hl!|QouK_OCR@zrpJ6;bO9_%Nan(_B? zA&%sCHG}bCmA4XFj`lZj(S94;{KVtrGVNaxOQ= zXRh?mk8fv<@2ra{>VnO^Jx>}ZSd`Z6LpfM8`Wab0U+i?V=DsChE`90$)iOUYp${a?_W>w!vtI{@P(FC|i9t6!K+qZ&~T?%6qaS`^5 zu!S}W0>$#!_d(6sIxHXAhBG+bVi{RJPW9PGgeE|F@MwUGRRiVy;cxdmQUXD?GHt^K z3PwexNgp7>9C$A9yTE_GE?Gu?!W=kH@u#AS=b*Nfc%v*M%cFmSDgW~{Cp#S zxPV7%|1qLDB*W6V9&OzW?Cbt`lL_+O{K|MS$1o*|J2aUU*+-OI-_Wtk3I5KEysp%(p)kkxjyQ0R&$!GVm zv^`=}^?120(?Vp|Y3qN%y+3tvfYX4Sk7B{Wn$nexZy7ZNqYCST=d}4~$2a6ZJ&$`Tf&O-nAWQv|nNt z%0x!jao}lg`@n`>vC!z$ysIk?xn|Vxa}IO=Bvn^6U4ub_SyF>=cK@f;llNKzwQ0lp zU}4W+_gfc^DGzr2kp+r`W41{af^V|-$xa#(!+9s9wV51Gf3OY!oLq*JuwD%Qj-~y( z$nP}$bF8I|fZIi8g%K2JNEom^x~!(1%R%@`M8CD+Xe#Z#-=_&_)fkQ(it;JRbplyh zM!h`@7S(Sp?9I19Sir4lM1I9M=h86m)^6EYww@=m&Q=Nb@CObIYjk%E*sqW z^-@Is-zgmn3T8KN_M$oubWpGm2x9ZVdyv;zenFBmnlG;BY7tb(a4d0 zuQBy~yZT$-;&3_CmQy9&!o_*; zh#htMG=`&eqhyCr*O&X_jtz!U63X9knngk3J-tYak$AtHxfcS>f5{(mf4_-Cb5 z_1XzG{`d0wUsnjBw&Uf8SaQCN$Qqk_FmJD)>Vg?NpNlO39VjUZnxte zoi2(>OwRA?V0&mi+iF)VfH&Xnu2(u27^!=wKf~;O-hioE&m;*JgShU}3OMsI78=fu%c8EWNDvl zChL3T(e*rEFC#}Uz!rUua|^}FcilL76g+oK3+qsAC9+Dga(8p!3_{z&Th#~PV6AW0 z+xwEf^kL*h5HXoL))<_Xd+|W{3VfHT`17Md{N7RyY5A!(wPowRQG;$~mt^>9A>mv} z!_;Q2%~qSEtiJLI0^uQ8pg#^$w@C(w=GueTZT8(az=vyQdWaw?Wbr#yLxrQ5TH5#|C5_iDyj*;6g6 zm-=>vzuWn5P3+zc(KXa1?5DyVs|q}FYa5o;%7^>ydp*I^JZdTLa;B7x3(m43(mutG zvrqUbC|xrVs?A!NmqNS--|7(=dl@s)bNGg^`PixOOP4=poR@dDKj>CivFCTW%GkwR@+m$x+DFC6Cu|L0> z;MLTUS!4CMWh0k`*9TT@$Mzk3N|el9)i?_)rbTIBesP&}6S3`@eid}R-g{nWC)4$VT=c8ULA~jH z4%JHALRwI&fg;0efW*|LB>H8tX~l+(b$y0~zU*(X3SaM<3ik;CM(@YPKd?YOfyW+n zPu(KXl$wCkKI?Me|^4^FbB+#;9vC=eXO}})G`NAB~rfIP{6U#J)CkdYl zC#KHCPP@SA8YW;$-NGvD1BDG?_D&A(%paU-u@>&Bd&-Uj>=*E8b}TjXQ-&ryAx75u zBtIF^59A0Xz5Yrr(4uGIP0+>xC*6+;QGI5XsD>g1JuKMWWV-2f^@U*$BBB3WU~j$` z6g&oxc~84kNr3U~d)$mFT4N)S_om+5-N%iJ6JRzYY#aeAIh<%Hyy)b?h}C6wk)`<+ zAFhu}XNLH1tu0XERsvIO+WVSf!Uz9>sUiKCX!?)@CgTL1%+ zX3%oOGWs6+vH5~YhGyNUTe2yrIG|qK>Hcgn@JZh%&Nk=|NI{M|rOgfZIyhGE zK};_BGRO_sKQk>4P5NaRY_no?S6BN@z{)IZL9{FnX+mDu-jiXemRRL4cTpV(Z~Ot8 z$Oqm0f!u>tmbv`VV3|_?b4XO7YQ?O9tnHUmRhKZiU!r4Y>b@lUzL*7nNlyH|e_WVU z$IC82c7Fv48C|A^?a&f;Ft-+Lqhj=Ev35d$%dEcPdbrhnMU21Ds(wCQ1IpO*2Bccy zF&6w&4O3U#8T{kpEdKkEK}$9H?*mr*50rr(;XWso&+jo!FJ4Y{u5Hl)q8>Wtt?eC| zpYfT!T(M~w9Ui3krFskc7VAD+&A7VCh-%rgX^UICd;b0-pfmI!sr~IAUKB8Q)e3m@B z7vpc*RlEi$*2Y#0!@Fn#s!MEqJ_KolHs&R1i*_PNn6&PFjh=|FlT8^!5QhwG*{%f_itJX+qj?fJ?J7_Fjqu!RkCP6dT18-M}_H_!m-ycwv_{ zbh3dibNAB3ctQbU{~EBD@LD$Z1(&J^Sns*%0NSC2Xjqv=h+G~e(LH0daKBDmi->Nj z)IMZ(`)*p4>A^T&cRnE!qExPCE5AiEaX<~aSBuLIi=S!wr&pfI?N^qm(4g0hlTxiWgV)Ss^_c(tI4Y{B!U5_D(0<$KcS(S4 zNR<3g?x#QEBWQeY{Yu4Xnj6gwN8a9Z9K)DEvCTpKH3)}%5mJJ6a2LRrq$lNzgQ-%BPtHJ?pKP382_OkS2#&tN@!p7E(8vWP*1*uN6Pv|{4d8ZP zgC$vIuKt6jbC0!;PGtAa@`LGw7w*p8{PN;Qei|C+_5A(`+q^vwg*Gl-QtuETd$Ml+k1=rm_N%^j z#4G6df)>@EsS`e=y+u9c=f9B`@liPrv;@iT0XBe)%>8?{tGtRdtj>EQCz9IQh5M#v zH<2dpbfu9EA`U}i`F`>Pxikv{=6iUYJ8n*TIm~_sBYi$ zo@;$+2#`vw$EW{ZT|CO9V16q2=arSM-;bEm^kR@2SpL0Qcl!w4 z7%GaFPxUWw7CkZXhEO9+OV|IekA4#Z&vAz@{JiY!^w-CIikSmL>F;!6%jbc&e)00< z{I1gne^5<_2h^tvk6r(H z_37n)1w4S!{EGqeY^=@)rx+z8o%qtedWLEGZa*zzlEX5|{YnLcZp0M!K110I6aPp& zJ`cZ#THpH6nN)Wh?;Q}FrB#*m>Yal<#$krGL33MjqT#6qd`sj5W?7|JXnw=Kv57<9 z($W%%Kl5{{cGeJqA~`^ixI}-eY(~CDiN&FFbbII8pVe;IM9Ivab|o$Ko*4mG_`Y0q z+lWz-N96&-XDvRh#I>DOeZI`zY}nxv-5@Qqi)zZ0%mCvuyZn-p*tU+2KB&#X-i`cG zFVAYv`7$Ak=aKC*Im^{ouWMeMa#kK%V<*fjYnq=DGOf^Cny;UJpIz#O7eItbnac}V zVD1p?jf{-!hH^^5;|khF9yxSX=Nc4tbN)VjnU`=AiI3(_kV3{l&&#^jy@53Rx2VMF zk0YieSpr|aOF$!kF4$q;H?3gv@9gi4*gD20fxB>)NQ3ACZz+(wYzh>1$st)dxwzn&M8GjMc^aD z4^`3;Z|4heas6P2JX{bgo%$ZkE8<*$ORIS;JRJ;du9qyJnV_WMYFMZiLB}TZ2va}4 zAv}gnA&+jKhzGR8eC^dHFloLdZ+_*o%Uu zC3*qW^!;N9GIoSj!Y7N+ktD2EDY9AUB!`&k6yL2o9v-(!{hhC0$8ZD&(Xty6>~(_P zLE~f(@qmTPCuxBm?gRwU8v6VDKkZ7Fb{g$_TYt^-OVG`H8jEzyKJ}xnab(fR3D4Q3 zT6J`4C=TSqH*JU4jaU>ORLIiJ&dk_;{*n?e=a_MkNbI#SX8-VQu(Iy6^TQjg5pAe( zNsf8ksgHfAKeGl3@zbJb(Q=-~;DNZ{*H#{rpDqLH>Ddnyh&z);d{316f8>3-K9?Fq ze=0gUIz2Q2V+cqX7rW}SaFot&;$8aOi1XtMsdU6`5>xzXsT8rHN8kf5iv z>OzkJjJrf!wC~;DU5yyWNMV!3yQbt!g<|PA!}`HUB*5eyN6M~MR#p;l;b@uc)lB3?+n7KpdgTqm8SE6$v1p{(*J)*?HcPjy9p0i7y z!Ztgb3Vo$`yuwbY515=fi%WohvXfqTv2ie2*!;qeqcO?6;^CfGL_G5Da#z)PA}iy+}VX8XS(%27*rvARJgC&d=0FU%pIy?u(R_9RRt5HX+?1F265-D?{dOOldJ?Z_kf}iRK9G z?J+li%k{KeB3rRZTGtd6yLU7zI3HY9^j+&?W4IXSoW-ijTMin@do39NgM*0^8{0Et z4)^@jBI+i?#sag9fG7p{%oDBXnZ4Q-^p0LYR@MlyxddtuaJd`R-0uiUg-0iPz^DXc z+aHDn85LUCkMBK&?01>Nm^slsTl59X$NW`4_MY7Ei_2Q)92L-7bO|{S!B!(?fZ1Bz zSskI@^B@rfA-e|l2=ztsY4b!Q$0ey-+hYq`tc&9c&jF($fd)E|Bn*7pF$--WZw4jA zQqA!bC!*2l!hqL7r`g$4p=m31B}(G_78YT2F=OUgqE>v6_(Bs&)XJ3en0p7FJ3rZ| z!4W>f99ReR$_tSqt0I`Fb#?YADJ6$fLR14RLlI;6=uHvrBkI?uHG!Fy2b54mkmES`c+?`cM-d`xubv!e zA0=&970uqUI-Rt#@j&g4n_E#cDO(zF$Pa#L=RG6|t(Llq)RtPwkrV)Kfb1a@ z4tgdF%*8EWk-FmtyZ1x>1|G1x&sH2VL+rBfjw$cc=R8~d9BYufT5-F&L-V{p+%lt% z=6#0EdM*dH*AEi!ukCEG5^i%vvj<*-Z|DF!RC>WLnnU5H2>x-Q14F@rSQDcL5V@%J zP3*L8rd9$OE7Lf$IO3hd76?v;2Pp{W(e>J0&87F3t57g=@1^nHI3S$d`60SaUi%u} zkRAf)pdR5HKWkP^o;%q0F{}2!#w28V$Ii|;uGx5q%hc2~FOe-5%%*o7x!a$)Y-l$$ zw|Lp;d2mg(kkYlg5liFM%d3flx!x9P(XiMUjvF9--^L!;jtCRl_hVsa*InXT@Q{OC zSg%c|T`xh9aMv+$t!|xEAR1-;;K9uZ_{New215&cw4h04_=D&){ajqsxxi3H;|O2= z#ZAtm^XqZNAUmG)E%F6jBV_0Nu)%jpW^w2wthFw1_%~FW-*7v%8!YuI zu!d6zSQBX4u|j4808X}n!&Jdh6c@>}H|hWc`&!PqMTDe%x9%YH`0<5@{;EyD=E?Q~ zL-meA@5Iele#d;%+~&di5DyS5ou3f#^gK{Alqm*nbl@= z!8h+fYy!i>#_#9*4z*DOvnP(KzW}M7-?gdT5b4fPod%iX9Wr9MHOgBHl_UbA8L%en z75hM+v8e?yg?F=mJ2d8eSJ-^=z@Z7?VGdQXTA$Uc5heCyb9bt{<^HL%=IA()- zy2U>M#2*3g>A^Y+(j#2-E(Ub+2pA2wO4EqZ%zX)POqZ;E0f=Mng*DZqc8a$%+**~l zZm(O0&lfI;b)oA%Ga+~4R8!BPEg#jmVjj+Wk+9ZNp>sU}E^zoW0Ec#vk}ZDRRUXaS ziR(Tg04hd&T-}^?PVA|gx2QsxIt{J4kTiEds3IN|)Dyn(H~njnht1Z_#QwIs^*r)L zH5{uj+*y&7md4k=GsdVx>NNcJv*I(AYiNu`9KIN6ZF6^q${EF2mej8xR*6W9>eCBX zt|*%Q+S8TU#I=WwB0g*y0-6gC=}&D6F$4f%yFy)Q`RwUINsqxxB*X}cEe|rF<<*tl?wKf#psk=hX-zW^jgN0L!+SLvWP< zzGl6B`}ZD)Ri4oP@PnwhxNPv%n^;OMg%c|dKYjYN&*-d>8LS%^h>N}$|CkPDj7gar z%HQoqUFw;M+zwn5-v7(2=$hgBFJNHq0fYGmwd@-xt%LU(_DOW}{)Kr}x1Btg}9Nzfud)!(eM8G4Tbb)x-YjRdunT` zF6G}4m*twL6b)|O<1=l;_3P8Q%z?;}T*E>S;IU$^m=yqM#xE{jj9HEt0;r+Xr`4_T z6I*s^D&m(8#Av+dMz7&JEizX0=W}L8w%hx%-GSI&xUi-Mb^GJ$8_kJSmJub!8RVH7 zaz9t=Vh(&B+`=bHbL!u2#64GwdIDi<8}D(kDnv3?C?0>xm3Xxh?=CDDs{AH6*zb=3 zk)L-nN|pmM9N@Oa&%j;KyiF>It;HAHFDg8g8DoXMmJ1MKx8YywkvrgqbN}N}pmsor z+@(SPcYh_QZ(wB9mxjjumrnZ9G<}5<<{&8hh>hlGxyojEkwmEi%8)OuDconS}crUz@dk#JB z#}#klDMqtv^m}wnvOb|}w$mc#i~tUzoKDgwu3JASeEm8$Uyc=^7q@R?o#X$nv5o@H zAmveU4Tkxo&)n0_!^Oht5V5=k&OYjS{fPeB1v1fMw(9{H!3Fex_IxhzRAh3T>Y>;Y z8;huIMbPez>hV~Q|IL~LNBu@MTo1vis9Z`D+CZws>hg^ z4EMPp(YSdZn(+7Q-7|b-BwuN+`}+Y38Ra|JFMC&8D>-ku+HkhgRA|UyyA;mqD`k>z zjzZ2xg2njohRv&)Ym1)l@sAKGy}6=yzxCz)kKy*c(g;?#YfU30cz*3I4kzu@AieW$ z`HOK)bM!38u7FxxL9?>q`S!GojLQ?2@3y;M#^mXN>KI83J$MVD9w@QA1?r9m$R=Jn zSy?wDqRr8D@tT zO|62p9rN0@2v9l<3c14nDixCV+KU2K5LDAT)4kW<7^}k0!9Zzzm#uIwD2NSZ!3UjS zDr^DO%_imGZ5E}h!AAp5dA!LY;*$o-HOwk}K$@l?3L8_XoRYe}w>=`NFn2retRNk^0@FioWDeAb*%UJa z)MJ4p%J!MuA5RE=?J#TFXDt2zt9661c4*Y%C>s9+q#Kl_wr2M36vi}|Ycp2ZSi?&-W$BfG^G}MHFIz9W*z{><2V12xjd-DD8#M>bK0ae}Zg!m3u zA%+`2}?qp0lOU3?vyXpmV&qKkl;{N=JJ4J!8#^N8hCySC1N@lgGK~+;=KB( zBoB{bG>}P%_w!|D@Xdv%T4-5eP{clvPcfemsEcfb-2_2&G?Zk!3Rqdnf4>&IZjc`g zj6+eY2W#Tp2g<&iG~c{yH!M(#APC;gcuQaXXe3P0xJ1SjFl(&BwR#ktUuebP#0#aI z83W!k{*$8ZBcg-1jh=@`04uDgqLOj^1UsnJCoWXJe27^d+1BU-I!bypoCC6rsY`Rg zCy%qs4eZS(lrOb({qe{=RvW*ETN8vc$zj-hIu zNzMoS+rEvc?X*}RqH`E}_p?w150I;b*d+PoMcX_L1K=DZtt6eT8rw=CgT}wCaU;M5 zRQnK+mlSDYJAiaId$LlW7h4$WY;LRz|dtuez!Oa*lFY^wsH;1|1)^Z4y|Qu zd-~%tb_s`1K3J3Yw@7EN^x`5j0M^M;NYISfbq@q(<8q*21Eum7_bLxir6lV0tberzHM=^w%I)eC#|hLC?!C&kO#}rc>8iD zfYj92*aE>19o%K1QclAe!j!YdOI>BaTE9FSG~XI&6OpEfK#9NtwwppncAUnn_4%kL ztk=L=38N?t>pvWxWR1CEFd5F!32gNWT*$O$QuILGS#`2@m-}Jy%zSFtn8f`)99Wky zDYUQ=ke64D@c0sR?f9b+<#H!{e#`BoVlck ziRvZxz2gz+uWgRyAkVw@oB}i404m&BTj{Vqk;;GR(&zPaqz>JiAWv-wY-0w9qp&Cd z(a}4rdA=o1%F4>okQub7>ohPP)<^=+fHeOlCSb-z=Ayn5O_xQ5DSH5{9~?uVcl-8R zQ0*(Zi+wbnk8p-e-{s4;>V8qs{uJ5ptFR> zR)rV}q_ZyUZ@m2N#dAeoU^R|T(HMh@xBVS@NExBw2J2YZH+-^M$XXkO|GGlWEFdCyZ*$({DDzB3w-rx zY!1juwzYnU*_8yedHVDr%33J4eM&=O^z@HffSZm}h|pej9H5YieNJm0AF<5yp7{Y^D6F<>q>3^BW z|G#00w0~)gMcfzN_JWYYe~&N=&Iv+Pe7>XnW*0&$0V&Jv4LKTZQ1PI6Z7192CQLI)sl3eT88p6&KlC2V(<0oE5^3lc_PtR{mN~U0 zV89{j(9cn}?j5iMP=ZZO%W^(f5@5$>2u}le_ubC_b0Yn%Tz(>J-)b~L9YrI|C##Dx ztc|9WqA#T0hb)#IR{w!s$oA|iJqJH1E(Zr1_tm$2T;BVEfWLFnPUeR>(s4B83wRIo z1FGS4iRA!Z!LDym?Zw?<<TBvB`b6LQ_nwl_Ja5DzU3PY{1(t)LBpdiDgyN`Lb zk_-IzgR()FU~2~#K#Fs~6Ck_2-$QT%ygB!>;NrvlvG7l-YT))i(;dq8jH{7$KB6?$ zP#AaNCpmS9Zs;cBYVvFK!NK;AQ;OWtyAlPMW%FW?;P?|PTWuhv{S0d98lXsW39Tv1 zp-Y^}VGR(`H}LoW%b;LK3s@=1W?ko#%nEm63r%yEgWhf(rI!TO%??iiSoJjJON#c= zHCNXU{xZz@pwKo439BM+-9c;~yq%o9j~-=8beu&o z2D=|GD=DQITg|$PQf(}DawQZtCUa4dc`g8feqI!?;Cop3hAY$#FyU4W&Le}okIpfdX=@Gxj4ck_U&s>FnBcZGu8rCJ~0 zYBGR4tYiCR+uGoQYQq(_37ee3Jsm?Q`U)u`izA%b0A~7Dz8SOvxYht_3w~mex?i(h z`sq_M6d=IK=d#k<4Fq6ye^0s69%oNC0%#C;Ijw!4fhl|MrP1C`t-bvq@M`3cT@s~1 zDcZ*0zaMT3pd^cu+mk;yd2I0qHzB|U@c1YjRvJL0uOC&h?Q9^30>}-DOsZTytnO1P z=k{nOAeikMDAKP2pj*6%YkZgLE#R|(lnk`5hZv)1|XtFOu<+ZrA41@HuT%R=WMqxK__#51Sw%R}(%?aL!mquj+D+gbfX=Mw9_As%_lkNWg@_J`w3Z@a!(<=_4E+D<@ z*B+EqfuBF8Sn;TRRMmO~qzS^T@yk-s4&mZiA@zuN^qkS)YkdAlp6`hm2rBGdSxSAS ztJ@3hCxk%#z+&}=PO}q-l`B{@++A(tdjx_q4hzKEdK?tWNllsL<0~2!H1fc{Eik?y zPKptN%-+X@JlYN(^2*%87PoY0C(BA&(7dXrX1U$q`kPo=up4Mz%AvdD93CLo!LQ@6 zd{P%f0oXe0_Y4pkY&6O$W$Xo*7DRQVEmk2+r*%8jbLGHNUHR-M7?R+Zf4~ONHn0Pg z#;^pC-#<>=&@XlR9~2%BtAF-FjC!Ky&Yhl%YD_}rufd!Fr-|)#PvNEnpmKx_wlLX@ zAbQTYfR!Y9^2JJ6XAkpB9x{zUC4I{X2tlD}cA7(fcZ1W~91n;qv7HbX0Zors?U{fr z%)eVXz!qqz>L8-}P_4>$J`6C3pwrNF^NJc+TZ#d0%fP5tRmH#-JBaQKicmfSk$@Z_Ur;#TL;`K^@jmhVNTq4kzxB+09!c0&DZx; z>VK$sMQI(*%4Krk;EZ{==#n|eJDfWgml1Kacw-*cVMU8vmr(--$_-{*RMW+<3AUnw z-4)mY^G5}O_6*uumDR-!BH!4|9wv3?z@;Ykuf zgdS+w1lKXYFlO@>EH>*;bk&_V0L3>@e0MoDx3^W-W{cKx%{H>Z8m@Snj#bor#A~6O zC_a1U6yg>nbeUJO)PYmhH#J=#?OKc}SA!kyET`qvQTz8F1Lm&mxB*zC4~GGGQiCaQ z8bjFcHwnu5PnLktAb*3kJPX`!ZlSdJ5dM@rC5&E&&vwWCqR$==aR%%bn9sA{fK%40 zJ`?)6uvo$yyUcY4`s(%jH&}2o#gsTwE1;y*1bjJ%*;Gt``}C_cdbPx zdHq~3J6#si;}>l88AQmzc^XPwY)D)EoBDz5rqXM`i{gKvy7%KJ6i`53MWWnR0+z>)*;oCEVwSCR``W z7g<&|Xd5K-XdBLci*Ay+T~V?z1@Or=5%=>QA?} z-?FU&pXL8G+J016!$OU8cFM`hDpHdH<4U6Q+s`1!RU;Xa%S8f}2Ty@8g37e5dQOB+ z4smJ)@sysOLtyGr%+#Ti^_|z7SNnE&=L1}=+im6(3QX)BcBWTKCp9P7U9J1eHcrki ziqiDn7Ns$P!YoE#x__->6yf$U%=$L^$g3{>MrW$e8 zig>ujyzbDfh|?1^*1f}8+}LE~nFRgo`g?!c*x=rq?<(GB;NWJW9IF5aI)9WI?CF{7 z`|t_Ra?asmCYuXj6l)Q^l-)SWW$vzA()a|w#j3Q=LjS;kY+`f&UR|QU#iSI&q0ssz zn}tg>^2HHx%03R33}yEqtiQ(guXt4A)e^b!k#F+LnAu7Tp2H~3A=yfXX?2G&3@fX& za}bwdRZZ?^CfWw8=}DN;BMIZI{`lX5ird=8WoScZg{LbW#ybx`+Epa66BqkW?tnXn zf3wK#B_2iQw?1&Qqq8m^vMdP=8J74mfAn~Rx-;tZI4bbd7)pdD@+7t8iEqT}s{hxr zkX3(gCeKZEts6bb`xWlwgGbu4!0ITd2pvS)r`uS|(uPv@NW%|j+hyIyC$>9h%vsi% z+1Zo88C?NG4qihwDs6GQa+x-X%qtt`>k5mEy4ebhU$z?_f7@?-Un)Rk$m%~Qe|_5N z`^+lC#2IyYFHxIW%InpqFw%9|)HVz`NKNToU9h%OE7Ob6yg?0YM?cGptn%c4m6qtOQ*0k)8EN2T?H*RieM6t-G zb_avq+gF!nrbNUzvX$~O^py-f**;F$z~H^6t_;k zS#)taarSB0R|VRJ2jR+tPoS`~#r>Pqfvm&pYEhc-*Dop4HHL-lu0rHL0C^g~sUxq8 zgiq#jTP23&Vf=e7C0NYl_*5C;;|&bVwA6sfBSZ!V7&s#$EG$eb77NN0Z|tyjftC~N zR)gJEwHyMHqv$xeZ32pT?pW>sJ&!O&o^YYm< zmDtW^2Pt_4=f0i0dB(+-gQT;~703Ly*0YCrNF1$xHBH)0k&`yu$%p=5rpR{138w6_ z%Ks5zh5;Kz=?u^;UbQ&Ct>p`Q5inMO|^SMlZ4E+Fi}f2s2YH)-k#QMXle zqIBY!hAG~y^LEI*_5fZg1*CykUY5Mm6HY0I5LK5)ha2?mClqamUzx*tm?glyPfVYK zzJb_JM|6Qy!T;O!s9!ir}o^6GLUE-_RSMCIbkS5FsC=T&C_r#RAE~;|B!bIhz zmF|MqqtanU>|dZmUpRvlGwooJJLesG8#Vk1lhSi3j0tHvdkZ{NZ%gwJ=_LHYkoQ9Q zQ&oPJ-|U`n+OKvBnwTY!SMeUME2mD=80LEp`I*-WarRUSn^%c_UA42HPlSip?aA3( zCvn&^#2h<*YyBi!x7R3;!mdbg!ptx{P{rZudw%NY2>L_sujB9O(;6F(q+5!B?If&I zWG??%rS|$0f=on-_9!*5LK^HPBYBtL~#Up7hOOXqCM(GiK@fE+YAKsgl>A zI}lMsGF#vV{LtJStLr6F$>~51bBxO1+}*x@>35ivRzhWc4s#R+eu(Pxqf#1!#AJJu5)41B<2M5VT-;$`W^N7_0+RO%b4fXa;^=$)(B%3zXxd%?-uo@T` z2=zJG7iFexkww%K`v;G)HfqSeK=@PY6Qc^GWewIxPviu4<7uj5ZDHpFG3ES$ ziVZeJyHb;I*f4XT;+IJn5}}nWH>KBdt4l_7(mf7qo!RMmaewPoShbCF&PS`WOfb&X zy`!WqSYZ;}`DN@g`uQy|!ex^a4aSbbN`1zJ)NZ?!7o$%SN87V_SQheUAXVPQ>R zgRKhOW7vHBlCti2d>a}4agh03X*bX88VhV_qS9&HP3Z9R#3892!$3K3yLofnW*dFnw!Z@5ayJKwap69(hz9Ik3 zM*k%E^O8C0Akn*Q#-&sCBl-D`J*6)5fA2_+Rrsn7>+93L4+HokEWKU72N$Y|epVZK ziAsSV{=0I)r}iF0pPjtJvNpnh0$>%~-z}1WrFz`38*W-OpIdrEqv4hBdYVSKtSM~+ zhs!D&136ndE2}^6z0&AB!&25XqrBD7*iIL2Zp>sAcL!fc{=U^35dfHs6 z!X396<2`9VD@d!{#%T+HPX#iQ;S}=FdGcC)(W_|i+V7^+cYK4z(r4^SsX;rb^6DDD zbSgE(<_H+E5ZFaCFt~n9O!+TX>18Uafg8>5-c7Q{D@k&jmY(&EEu6rUV$LtGNm9k! ztC16NP(nFsT@hyU zP+kF-!rlDLnBxE=M7wzQ?f%G=k z8p?Mwd#y-iwZPDD-8~b)UQMq~xskeq6l}nKIuE}19IWZH2i^%$_Z>;6?)hFw9yOo) zfuxh`oQ2%vXkeA4gA=R2{~qA7K6v@GY2A^+)yVWCJd2C$z~uY}IHtsg@<&u@I%=*H{#KLf#OwS|jc zzeW`-H#@4m_r2w}IGH}t(%IS=l`YQrL5`)g)H66_I2fRB$l$7^G6LD9i7!4(#UNuP zbca4eqdAU6gjKaCoL(;W;E4#;-r79d#ifHoR9t}Hz}xp+Cw`0K&!^zT$&e2W19tplI@>Q#lIoq(|UK>%oTUB$5hubuqcdx;b2m5)YJ82p{7Ef`Xvt zD8zQfgM)_;o!OGxan4n}&Ej#lKp}F*N2_59Z}^Y{2u-Raij%MQ?o5 zJer36ZaYvivq1^K6z3vZn!hE?f4Yf_Zc@}Qtwf@ibIzYS{m9AbFRe^~oF@+g-YIpB z#J!;f(C!Ys%jv-U)TR28TR_@gWBgawI1|dao*7YHx_tTRt=n(sNgEvjwsFvC)`!DA zH+mHP7Ry7*=o$c>@6cywZ&Ss+{X0_|8_@aiEmtC-k6bts90y+TI$7G;k_Om(ZY1(+ zi|FCQ)b)=fhVsOyAMe>q-`26L>_>0JbWcKOkrln?bJF86 zH>#Xq&%uhJ)tr^TL}(CS8&Ph8Hijv~&W0kd%F4V#628o?_!I}QQJ#f~-{L(5l!>k@ zHaTvlZ#9e^rnvBioq-tyL<1(;v`r3DR;xWOnFmgZwdIc`0jeP9Q(GGT2d%1Nr5lON ze!|XeZ=2NzqanLl#;!J4#(fOHD&;dDItj8z!23vE2{=w>rgAy#->t9{eDLI9xt?oF zpfFkBUDD z!K0S;_t77e3II>cqIs(5J=!(qxvnVT9__h})PeW!Xt<6X6d$?rK?!&x;DvxZM%7$e zBr9~@`yPL39WmX-cYf8@)~2^UD(E$Lw_9{oD4|YVAmZVZ-(_t&>EVg7>4k~LGXhJt z&d#0>LUc(k9;qIw-GNEZTeaBR5j`cANU(9}zj6EP7JV{EoZMd)WZ)Ng`xy~G+IYm5+&BFK2r4ENFh(7CP+x=R;YM-ec&hV6r zzP@;s>jVWu4#BZw3E#|kFbpp*bG3Jga7d2$UFW~aG%PKj#x|Ed|Fupu^4Kgl?->T= z3q28IEBrI_tf#&dx;IW5!7?67XUuJB={Z?klATSu(PgFo);g}OwkN~Z*#OLRzvE~s z2d5jN%zoKZ_tPz<|8O-t>~)_vR1_=A(r!k|wMigLok<39(i9FpR`eeg+pSho|1RWt zM)yTYg|B}IdtEpTEK!{G=c2thA{hNbEK8X_AKUm>m#;6g5dbq6>p#5YH^1Ll^zoxP z+u#Wg6d^z9IW7!jW`Lkb`B)@V3$)=rQ-nx9rFB3V^$FyM<* z2dqXk;(8l*+=JA6(!Lq)hcY?71!gKTl6-+dnjVt)){ez_m_$EV;pa4KyuAkhT)H3% z*@&If40(g6KRq-pqEjGKm|SIz8C}^J)s-UJ@SuiORQq+1hHTPf+ilXuhnO@hWl^!X(mykTRu7@BQ zDR?w`K&N6qx8?vFouXi!p4!4Q0DPDqK@K25Oo*2MY2ZkN-Z&e(ZMuEB(RU>Znt3IQ zMo=DRVi*9+^!AD&=Zx9}_?6*^I5y;>yv&W`cug<4C39?-9q(#Ql*UTC#s!ofBBqQhU6YM5yOP zseSn_3R?|GrLdiiUhE3S;5Knej^IID+#$1_ey|%*nmsa?U+SWDc4GXcSL!_ZA*bMV z%fg2nxs7a>J$_@BpSra50{pw~tQ{;TPj8gB^B7Wp<(qe}lm1Q?Jz&pDv5@-P3=7$y z9mz=zTo@Y;&`nn~F;OoKad2>uOPq$*&dXd;;l0Cl)s_j&JyG{;zMXe(VhCq*hh$iz zyighIvH?&_0ffQbuMH>-zn1C*9sN|RD=Tble08&wc2OO>n>+L~1Np4B>`%CKErvV^l6STtZPkp+4Bf{7-o8ofJo8)Az zDL!C6LF>+Xl0;4p4n{?-Dw?F*Cc08fr}c34ZwX0Q`3z<}-UEbMuc>Hq9Hmenxitw3 zV>5SX2zMy4wN9&j&#se+?wpNmyaUPq9%fwBsMCkCTHjmdX2|0+=hEGrH}WkEzANV0s&BZaC+Q;Wy_WJrL<;n}5|a7^0m^x|UNHwNa~41D(IiK!$!cEA$ZAuk98dPaBg^TxQ&b#( z8q(F-`Q*8DYjlb9r>^z-?$@8mZ*~aDNpfSz0NLQXyc!uppwft5PE`arnas`isU^$YyucWy+v=0e@}%M82O+yll2V4|0(f8RZe zOE9Do8>#ruXSnLRjj+sW%>VuIW-`vz;eqSyQVh$@u?h}u$t&IP%hyO~V#W8i?`~7D z22-n_?v-%LgFX5Ta`7soFRsZ~=GhOF9@xLewsvQoCr|Kr-Kg(RH_(NZj@+ODxFyek zkecLRRdbVQ1lI}^bW4f#O-7Q-=frVGNwZZ`6$915;q10_ z7QfU-7zHhB+F3G^iWSL#Ko#%Hs^{iLeW|(QQDEhxeehM>xu%{&@xr`|C3SAs$)5Bw z1w{WQf7WU4Ha?VM@AmvLXkp_V4Ycpnp<4$bl|qD&v%f6SZr0%Q6*%GT*AgS0*ic)+ zLvZ^iig!T5WRR`w{JuD1=%3#9r!Zr;-j~>X=^YjiDJ~YPvb*`(DUBnK$yuci zAgA?Co~xRg7%F|!%t9@BA6QL}EwW+9G< zQMg8q>xAmn#ik+iL-W$I0H!O)>+$fRx^Y1dlz37Qux!WYJb(=a=DzV{cZ~`JaNq<~HqIQ>WUzlI9yzaVX zWL9P|vAQW068`)-{C9ZY`^%MLz<8~lt;3IpmzHu{M>P;O^k9o`U$3W8|)IV5p@R3_4Tmqo|dB-cK?ZuS5zD=)+hIukA z(>&BKf2#_r!AWK#9s5&|#VbL-=?;BLf+VG+$ZESEKnn=PCkfxQXvjLi5c|k+T8xbX z*d&f&e*GGt{X>^SazN?3?o`hfOlaJ=Q6vYz3*97ZuVrC9K7s`}Dfxk;6K;z_(BvSD zaKcES7lAi05mai6iD3bKz|irVA((I&U?p)F>oI6*Y9@@+fRtg(&JFW%knElDg>vjf z=5;i~T%9)J2Ua}A$dG_tO`15kmcXJ=({c)3sB-=xZ{tUl>UPItyEIDK$?V2?6?d~4 zHE5Xwf94rj&{6pZ%1}}OWZrt7ZeiXL;vibO*>ud#&W0ruy=(dUy-FjBz3=g|0-S!p ze6YT?i*@?c-YsiWQ@_iqD?OfUW*(;i6t;H3jsjQ-MGpnpVO>0bg>zgd(4`5$0yGs= z`~+hE_LzZaxCa?pmcWiZ(hmA9XqbjhStt4~42P=_NOl4`;B(r&hYBFK8Vd}KkKFb- z0A-TUm{<6)7GM`52*`Oguscx!2T~+FiL=(#gCG!Yl$meeX1dT&2GPRY_K<^Ovs+-x2=OAy4)_r)dI~0n`!mtnmtTn; zh7E{e;$AJI1Qw5glx4frP9N3$$7v}X*iIMiK1tm%?PiGnB1JfVvF&Nz7M$U$+(-!W zmSOIUJWS`^mj1wqy}0*dxVL>O?i8Ab0-niJU$^;IiW&OJ+$S*(=?m;II?$QzG_?T` zZncMNNav;yd<&ui4jmkWY-;+vPYJ4kd26+E;^IatR5NFe&2@hmuCKdPY-4WpW`>fwF9JrkP+=g_*vIgN06!dW1 z?=nJnHL__%pV~HQ3*sM$H>auxL4ieHICIy9w_ZtsM~rX{$V12wVC=xR(11FbMJ3IM zc=%+nsaNRpA;{?+7wUm$?{Sc8YY9E>HBfFzVA}=?1BH|H!O~oGrej`p%o}l*@00nq z-04ldTy*i=5L~z33IL{x+2-V=@~R}D)1-(&>98HFHb_n1UFww($W)fU6_}4kE@31S zjTW8{&Yg9*3{_I_t)gM@>+4dcvT-+}y+vd7YtviPFCt2-L9~s+oPV5bT&>DYtey(8 z*tw_N3G8Vnu3WnE065#1_E$tiB(gw*Atd7?urmBX;ISM7q9OqlygRy9tmJWu`Y8;d zL1>Q!8s?#(^`Nhz_D+N8)te5%_A^lCOc|s&&J%X{$EB0@m_ciJS)&%~GTi-#OjHF1 z6}Q#MP{{?i=VEm> zJ~kkMLXX>XH5pv*7E>RXlZ%T2QCOmGf+6Kh465>f`Xs_fM*;lk-|{EMnA-n`s?v$@O~MS{^XFH6jS-(b`?`>zlV zK@#__ot&BRVN>S-CynH%BE{NW?3y#rEWSw&tcLz8Mhh@@bdeh391X(r`k2c5OEU zPXm+KJrW3IX=!sZz6+3`AV!1s6IW6~dC7W@lF)#^?D)*3^3_r+qnZ@_YoMl~h~+6a zC}}uS9%eNV@`i*wKYhMb009C%N6AaGVwbnHseG!AZr_Ijd$n(T;G3_(zM43Rp((Yb zg#ZL{N4L8klm%|pU8=)-@VT`34?||W{MNCOQXZaE2-W(N_rh1iUd3hfd^xvG=$s_e zt*;KO{G2G*F}LNfl6`#Bee%g{0B}F8oz3c!WTUJ z=L5S7F@nmymhDnRxaZI?>UJ0A3v5Gp-ZF5`A&l%P%a&6QbwZtEAS3z`46OtmhP8b1 zIl4uC&cA8ht_AQow4>-Tz^TvZH>h^w5|)|f$0ZQT&Y5wp#fGm&&xG7sdW)KNRBd)> zP{ail1`zwb+0-w=8G*ptd?CfOYUj>g`1GhqA^z%SR{d?C9*a3Fzsa9yNq|9F=rVPm6Ot4;HxaHk zTmencw~jYokX8+lfIhl^nHSt1oNs)Y|HB}bLc*?I?g)(#`J@IYgsRCxa<0MP!9m?Z z-b_I~77FI(n5RwbX6ELsozwEg#RXE>;SST!a#CsVGZ6JwHcPOp%w)dh`iGmj2XCU7 zQg5((Jiim8U3kcMfi8btWl$7GBoH0ZVvcVUw>?#-N*%8Jl$=#Jrn!Bv4XD(ale_N!0j z_=3|QV}PKkdOk%C3=hsKkq=P`Cwt@9(0bgxYiTzn;wmO4#=NTr62$Q!g>mdFR(oBZ zRJnoo-V^4(Yb=9_kyzHJK(rl?9v#u1I~I{D#X|Pe5rMYyL6roEam=5hP(WX>jB}9o z&t{ta?#16NBWVB2?`-QQ&O)1YX!d(M{_<1(Wx)9V<>f#Gyb++NWHRJf<{Y(XI(bTv zmio!siuR@CjtW!3Cu@Qd4-2Kp|F7enBGmVF{;3Z{QGla?vu`@M8%TVfssr~95BJH7eAX`&lf`3Lj z0t#;ym=Z>YV8^;;$FV+8uK-ckJ$*7dGtPe_p31L{%ors+jwkHC&F2%NRs|fA3h12z zQ_x?AE)L7n=0GQu9i8Y-EkKzsWQm6GIV7*U2@miMELcIm5cLb6TSI3uzN2O7$4{EKJptAI*9yM%qBokIQKUhDZ70JCxf&C49XP`0wX9Pym=u(iM$bSbaeTlwQM(T_b0b0WkxO*T+?EW{4LZSC#|j3jQkq ztQr|7ZiwYvR@GOOJp*rULmBlbH$KAF$O}>=XnjzbAcchi;Sm5BF{D4h4)a*MvvzA7 zK-373K5lm+s44^2K&L?_?K#K%x#e8x+!LToz?90CuWG@~-Xd;7%iH$>uE5>AQd9wn z!**=u{GKu!21EoTPR$%pSk{UO+$EU$4t#TJFnw0<*Q?ned&RdLxmhI!9y^?KgKS04ck@;X zl2$XpxyORQ)<#_wt;LR7nwWQ8?`D)BKcPrH)=O6@ojfwDii?O>lZs0+M}VImqC#s| zCq@{wVc_5kE4L0Jaq;no(afw3MXAu}dkB2iwc7;Vz~tY3BSm0NE|?#51Hxl5bcfc>RhSTzgno~yVqBG2=q6W z#eDQc3nKl02YagiEz8Gk{ObeO*9jz=&dE4ie~~$9^NS&XZ{eL=|6_iDFHZLMhC2^M zL9c=-2i`teQn)4~IvT>uzkE*f;YyK+H8;QU)MZ#;s6wH5UZteyjvm7w+{yc3JGgZk zJENR^u%ffJsj2?_x9DT7U29hzn+I;dF91qH6^>v9ZjaMYE64zb0g_pkOYE=-q*nA= z&AyGLrFMV}VfxV>YJmy$192wqv4)8qi*2CQ;ylDh*m0#hY(pIo~) zRVL#cYe_){#;BESz#_)R)Ufp~aGO?lC3P^sQ(V%0eyLfnK--wn4||r?4<{}$kq~G@ zCBQL@zM|sh@i4Dh0*EE6tHFr($?GP=--hCWVmyDi>d?A7X6N0EUcw~k z5^5bhLMsh4iDVOwj^p6C2UVzl8Gzr;eI!ow&B*y+P&N`Uw7fW|($d=dFf8mEy24?z zzsbymh55f6z#>al6oMe&sg{8O90XNyAbtUHfO50!zIHk+*1bke;pka8S zaLb{lh?~)OycaJVpH=`vyXuOT_r(j-T)}=Z-MnKquK=vX>6<9hB6lV|6N&GU> zqokiF5fUks%r=YO!-@b|q#Qm3OcOp(sEj770O1mLhz2t~E~1fr$JhQeEXt&hX_HQ) zpXn;0Dq3bLXb5(Ml>%6dlLPg*jf1-=KuBn=>HSp!hSkyS>IvFf#GJClj#RM1_1Mxb zUN2$86AH(O$VY`xy!hjf-+17R5H0oaP}nOE*@enu0xjA%CO$30WI|b|+(H<;<*crr zyJC{n6I4^f1u`n->#Wq&VwH&_;Sr_hwX_OX96-MU3*uRi8SpLG7w|5(O|DGL%rGo5 zt#01e6G5j)k`87%=7_YfW-5K>_Cuo^K4=X9>J$CrXQitYM;vb^G@7HeqdKVF{i}#X z`Yu0-q9ak@s)txx0((5l6ubfqnc@rvnd+ve&LyVyDBq%_?sC`Rlb_+CW*Gf&5sW z+%+06c`O%X!Yc(4%Uw%w0k5i*3b=@~uHN`Ue)IG+A1_vLm-7zwnb;l4VLJh|A)$;7 z-bnhthJUcM>Nzw_unxz!q;-h8TR}L6f9re_quVd5!jAmcrj(ys>i|F3T?ZTJDuLAn zCC*DBJzmYP!mFD0Kl(qbCT0{gprk(zj0HACuoIKK?>hdkn*k{K`WE}lr8OB1YrZ$? zCf=Iya*7dmF7LC42J+%3r%Brxm|YzRCP=wZr!q9=U)>L&XeDk=_z#(NbH)=ySX286 zI%t)66fj{&F?S>0UuOSUsXDp+>pEOb>;KaWulHDy-TY+h%67HU1AB z?N?3Tv@pDjB_x3YH9T1SUq@>7S$-ujcs)R5nU2#hS!`-KTQmJdK`_VOHi3__#Yq9i z>`ne*vTp}T{v#jh`U$3!*u>eykdOThCwacR}}LJM(&qWq0U#=e`)YZ z3!BA3guv8obwUmMHoKTnxp8*A`Nm)~;woFM`AGRDO-d|W8 zA^QLqhQD)ZP-Nv``5Nb*hi~Nwyja>0)o6;{(Gn2gp*L#g2m(@YotR5a>OAL&DGk5{ z&>hfFjH-wuwbf*Li7lppO6rQA!rp|M(1rO&1S0Q!GaQc0b!=R7I@b7kxwE(bFqPinSb`69@6 z{AQ#K;yr-*n1~{I5N6Q)1*jkK{>hsfQ|FI?>I|CKi18%1gtMw2DdPy-TT+tq_(Jvr zEbAMTf-M6M0B)tt-#B*`R;i1uB=Ub5~2pJNKHf zSb;y6+UH-5D50iXZD)WCtR))bvLu3Y3j~~xQw)=C*4%%DLOTPZ1n+6;3$zpu%YZZt zm7X_klQ@WLF$*|HjlepN@*FTFCK#c4ZeY}0gXR+zls0gX@bH^Z1ug5_XaG++n;?Ty z5{Sa*ZA|?di-1I;4jh22S%*(e0>%0(A5egcGB)rw15%f9RRPN* zz!*F*NX$g{8F-Bu;rnLj9HBE^rQ4r_T>ecAe#P!q41-^kRxd@S75ChL*C~(rzH0aF z5;Fl=HLI#!x#REVb8{Tn%&s5sxyc`(0cN;)vrX~aaAq7tkH5|2H2vF{Nw%W(&Sx?q zLO^a&;Tr^0zE_upL(mKYdE<%S?RO@3WT3DD-AV`|e)t(`Q-Hy-omjXEA$LIS#sLHr zR+JxsI~K*~;8Fr3wM^d&JT&(M{y|ev+#cHu6mHLi#Q2r#mw~H`!?cMC4E1u57h#1$ zG3#m5GW1t`Odf==j2d_08vIa60)NyY1X`}7U=5&#m{c*AX*3L;MK@0JVk*HWIx9VKw=hvmU4S zxANbTz&^ccYi)fDML$qIk62d!zg1Gus#SMNjpWN0kHE&*+6A^?D4BUH#Gi*+;{lVe z)nFq(k>_~`<`{5!d%OF&ix*Dp>_a(;IB*d62VqC8a;_I&p;;lf=W-D5s0fJyDU5NNo$>bTOiXHp$)K)zk8K zlZl=2KQi*s$S|koNjiyR^D)!PRp~eO}D1wZRT4&nl z6GPb%)&Z^p@w2e&KvFbryX8XP3?Q?mioP@~|4 zWx5bB!wZjtCMq;d-9S>&#JCK2ZS^JHVKA0pr{2u&xU*g&gFjEKZ%;_?ZCQGEPDQwu zq;NP|g0enel^?jFk?qL{>t57}UymVK+AIA{X3ylvEyAJh*^{C+qDrnaX64LDomS;r z!F$>iu$gz;hy&(t6$Jp=Je-7Nqd(7}5N+G?B^* zX%%Sl?VX(f0Z{=SJRZ=UfEtaV4WgGMtEX@NMax?_;0(pEQS&@dPp+J-wP>njn-Mb- zBMRitQ#UymqTv6rm!{~W#kon0>;8ky-$uW>X?duf;q~Wx-D1Qcf0bKOFN78nXxq))ThKUe_p2qCGj7>l}1 z!BmVsE0k+Me+L&f6l$*A9zB=drG&+$$$jW3Ow>^9j#g#GUVA37uD-m!=@A6L(8PDM z3E=~~XmmyhNGp(qbz6RjRjraw?0A1%40$vT)^|QriYv{cI1nkP>gfDqYc)jf_-4@I zd@d$vcL(3A7S>b+-cQpvaot?RjIlRvR;YVB!>&WpFMaS-)#CMWMF|zy`YSFc(YRe( zKmh${nH*=JSf&>mb9^966x%8UQ9Y~i@lg3co8$K3$Ez+D@Ma36OUfG*FXtxWdatdK zK^H80aShanfRI9q>xc2E#ye1|BAsM{tg~iNe5D{r#S(Z5Au~ng6&v8~VNLlNdrGiRG@1&6ip+VWFKQ#J0 z#jI*sTRnV}2fH}jm6>23h=RNQYE>>pOYIjE|B}|<-apbQ!kLxA@XEMDj;vh1vj)zB z>$s(m`<^zzdiwP)4N9E-NI zz+XdCtKxZUU6OYLl3gYLReIrYVubTZi%i~WRsy^fd;z6^edw)C?T1ZZR)j3m$WvLU zUeooP9c%xY=)c9c1h0FB%FD0JQg}_Q0{HKs*JkjW@84r&=N2(s-Lw?FH$(E|_1Ex+ zR}!5T#p&t)nT3Ej02JG28t4&Mra>n>v_ep(VMSCi{Gw$p&p#vi-}Q%FetJKDyT!eh z_}X>W^n)HX4_`J~ML8)c9oqH07S!7ta-~!uRc*wph>Oi;GbP>Aii1O?Ymi(L28FxJ z%BXoa$kSg9Gd=8d=FD${d&Ad8#{*ZmcD4+R#t_v8 zs7R0OZIA<;9z~-KUX+vBt29ClEBco^r5@{XA%(YpC<)?BLI#gY}Ro+tqyO9 ztW;ZbnOO=?CL%ishGKOD4N;~3sq%I6+;J_Y-&$LJc0LgDdks-l)mT#JlyI6k+ z&);uoI6-0tXZ;%fgQVzKS{Uq z+RdpIyfuDrQc{?Zg*8ijAGwMQOE;etsVgyGYUbV*zZCJ}Cu5Sp^Bqz`@?EBdI~C3w z^(?6}iO1l_w}?J3mF3`wurZ++d(i^xUXW>jhTva6tbm_RPcic8PWprSdq+waijSZ~ zB-CDZRb-bI#_yzGQISW4@%c7aAiiZhG1i{@42DrL0HE zP>o~#vL`^VnX2ZhbG5|?d0OJRun=k=wA)l{y@!Kd=fc1iA#y=){z@-*G5J>J-DMi& z+}y^YR&3Qs+9U1puu?6Kw{PI_N}f6~i-(b2GJ=jlNM!nLowrRtYtoiJ3pMx$B>DN= zBGp!ky>GtC#6EL8aX88_xA2F18cD?(r}+4(%UsWnh+%p$p-=M|(Wm}&B}QRjlzV+K zF_tpZl?O_TizYFn(=e&mF6_W=nSdi5U;*s^T+l?yy96T~dp0T%U9DNZV{hM&NzV0i zSHaQ(Vg6WS8+5vPZi}Fe6cjq!EA&k<;=Hd*6B895m#lF+&Nl1l==h?)>bW;4hQ7w$)A-VZ1db|M(sm9L#uFs zU~UGD=YO&KzDwA^L~ZYJvY$?QxQz4C5%BUz@&)^dIE3)-r`Nqz*?51abJgGS%nt48|KPf6TC+l21CAFgJ(}y%# zH*PRdT3nSmk9kv0k53tml;hz05%AYB9X&`9HjU*FKUDG3RF)=X`nrR8qU;cUo-B9W*exJQKG;=0I*RSlV1JGU)055j#Koq)j;FTZh50 z+g`I5_X7O4H$_G6bsLxiLX<5U_e>~uRnw~*y5_5FvE`h8ewK<)xelzdGHOdaOGksZ z{L!BPXn(V?9IPOgF~;THpH3ipjx6rldWY;2nzd1GoseL#|93{hXn>VkV^Q6LipyVdfV`!bZ`*Rj(}>esd?7V??gJkN&jP z*J5-WS-~Hg6xbnPhH3~!$Z~byHT3GWA+g`V!@a(}v79t0P8rJWGR#sD87!_N5tzPz z^4z~3vcz+_YKxH8E2Y+Jm%;a9z5haNX-(X^kt8zh@z7&uEdRC_?3BIO;XQ-kJFi78 zt{y?SJ``0`xNa;_BXERXLS7`cto&$-Hnop+$qpHuiA4v6wy$1(=vRC3+j`r(TQ?WO zTBY%}4?_=X#omcM+Cld%<}Y7#AJ=}9h9eDKjOssy508Klij=KNf2tbaRop1e&^YBg zCT=r`eEYUgZ}q_1qj)uU%8Pu6HR2Sl`i16QDR?*KtwI*`lU|(CdNgwU%5drKrpPwB zUI@%N-ewLrvAM5T(fe8M-eQ{0sTwW|y`J=8=lk$2_kGEpV{%_31PSi`rKlwe9X|5N z=z2%a0(}JdmC4k*QtBMRMQ%vnVO$7ML zRw%t$P*39&jl5L|4R7tXp4Sc|yyVTwDLQBCz+T9bS2f+X*RIxma7qQtLlge6?cBv~ z=^yTdbC^4G+xU)|v=fIamT_qxhxVF8@=Cd9C{RETbF6IFtF#wl~` z5(_0W*Z#S*+Xsy-*WxH7Y$Q7GgcLBR=HPJqcF9hT`d+;5o+-pZ;987>P%s}3`7AKr zFBbCb!(COkEt%O_!uh*)6jTK`A*|Ajt9Aswl*BR*zBY6zc+4-qrLw((P!w=!_a#~$ zosqnq+gMQGnpC{Q6p4DihT@Me?nu*|Q~gMJgzDk;wyeJtw-5{}LQws^C1#Hyji@3m zuFatgPTAOj<3xy_)!)Wyo0})g#qMlxWc3s4`<8ou`V=v29L>$0%rt=Anlf7q>mG02 z+Kr>jYjw#}l8L&^HDSD~r%w@Tk}pm)SYKb;8_ZACD$jP*0uF!{19@|zf>F29W&6Q z8Y4U{cejW8$2hH_)@_m_KE%}2oK7c^IyVh($JbWv*pqnF14S;}Qe-c4=`wBIR5jNw zF|kfb_gZEZY^wNM-(oBlV9|Y+II{g5%Iw+@ih7pX||0Ycad|2SNyAd6`_%n z51w36N2j>o^N&A1E_}#5m@LE?Y9~z&s}KrMy3xhVnmzqEt2dRZQG@PfVduD9WNjyp9r(g_VgE)=J|wC-n+YT+Oq zmOL8IUC6v1^*r7S(C{y9VEgc zBc(H)266iGY|X#@F^KKx5Pfxz7#}}G$0JW({`6=QTM_pAMZCKlPeWapVRMDw6#8b- z_lQjyPs-`i^c2_!mW(rBUhPpEUV1YNlEDW`%3!TunC#cDsOXaK5R?v1nJKzudI5Z~okx}jSHxxIV)xj#Q z>IzorC3_|*SE}Z~OK}~-=U}@}yj~Qwn>+BnX`$AvQ2~)7G=LrcG|ZI%%-nW+`FQ9A zEH4SAbXxfJV#qBmXNNswq`0X@QoYJ#-|9n70?so{dKK6`4L(zGA)#zlqCX~932e2Vyh zessM%+bvc{{z|tS(Lmc6+en46?SmDJQ~2=soh`!QuRY62sXKhb)|13W4A9G{R@P-b z5Em)Mq!?ilvVX8If+ZMYmY$b`gq~{Y5pkv`+~$Z(BvE@%x!weH`@P`JN}w&3(ivI` z-8kLScAb-hA@^4qpsuEc&VrHiu9cMxG?Bn^3d+f8;7h+%cu*mGv6T~J7Tb&k2?6@db=iINekzH3PhbhESqCUo zl;4)GnK=(5S8h(Y7eb(71jB`L%*lNq4aJKn<$M9=C*@K1OvFAn&dss(c`Z<6-D$3^ zU{%Li$4dH!7pK@gKRUb2Eq3psUk^7BEtm}XV%)@-SvOA?#=iAlW3 z$jEAgz+ySeWsA*f_K-b$O@b?l#`<&85hR;Z(w?6c?!Hcw>r-=c8{~M?e%&N9K2Def)M{r2FD zsG66S#-g5P+#`uCO2UJrH=vs(M8wJjCrm@qXw-^VRaYkutoHGC3G^qekglCA|3sbK zlGfHk8d!bi$FX?Jxq*fU*w1Gjn^Q@214rr;XV#XF!P$RG3WLQFhY}*lK}(x?GI;yU zn;+-tA?|5f`u00s*>Sug;fTqBRa4b90`U@p*~G*;$%8mq+lwFib4UqBo-VsCeZC;E z_E06byLcQ~am77Fb7<{2OQzP{?PE2kh`cWL?Mt)jfO-j1_Oko?2}7RROOTGA)|R{J zka{R&z=6(h6n%-y1=l}!!dT@vvA?ekWX2gs`vNkUB-pV&^|xgqUC7Fc=;xHK4pJ)+ zSD0B#AB~lO2lRm$7@Q}&Zs5rdw@!X<8T@)rZFi{-jPX2#R$qRiT!Kfi`a`b<~pH-|zl%yGnXG$ZBgLsd~-1jZ7Qxt9(h-=;e zdk{{-p=qzaBhv9}YrZh;Xo&SL2cz(n_wOG?L_qvtANOQIg5X`=(2!;V*y<5hw5iBl z*}X9*HZrmoPFr89Z-dyFLLP#A*Pvj@Yuv3xhv%iewtFh{WJcx4KU$vliZzPkCGxlK zJ?&`%YmQQHue}>@&-=l!dAW3|oQg{G)8zwfx&sV|tDBqu_BgN59hvTD=rj}AsK60h z!QcGmgiH7>E-)n*`theL=|r2G3Z^f8(^;9SRzKgwHZ;( zA1`t=3KD<61oZZwtJPE#?xim6ij1Sf<2Lq}ebz}z(n`?Jj^4aQ9w(8%_ur`?XQOrdqmqAXD?dw`pN5{WG3_+q!0%;1)?Zn9Sv5XCPW?C{>;(gX!3OFv z2xIwG5dL*s83zY?u_j*UhiuAzqQVMuvKP7?7Z>kyCiV$N@z%1P(nBxOx)0)kn99%9 z{54?yv8*0{dI2gBn|Yc0I!AJXt13TOy{zu~EtsJP+@VIjFj6Oc0|fY$^VXc?X}!V+ z$D8%yl9Msjit}Rs4-eMFCK2=R#j$@>U&D_d`!CeM{D1suL{Dp=N3(jNyLOuB@IPSC z{?TP;&Tgp4%ac?H!##GGXX>ACx*icy)#?-z!$8@R_qUCrhV9g|XM6H+hKEJve+}OL zPe)qJXAd3i8+cNe{Kk=UXw9*xvt(gqs6`ZhtNP!+g?n>Mh}}gOXYEQ;CS(0FvFfX? zACr~wwxINK9p8IY6ZN*YLWbS>`-zV{D=P-QEoO`hX>VKG{AD=xDRK<|l}z96>KdC9 zKKOorq4`}}YrbG}72Sd5H@ON}{$j#1T&&N7s4~Jd*8Y!vgz71Ii_L{GvpcITR z40Vfh>w9Z@Ap(p-R7rK4Ket%uHltcftMewGDIT21_U{?I9pA>F7+jw7rj5bB|B7`w zJ)|)6F6+3@GvT7pcUU@+_c3|TPgd1q^0W5GxP_B=37YOHfE$;`QVBy$-2pn)*L%HP z{Bf=2uD|a>!rL}Zt7M%-x#9A76pUH~29?)_kRsm8w4Sx0@h6A3;8-0<72kEvAA@}K zH}I|nmbmB1R!Uo|GFsOfP10gT~XlKltE~VRqru*NY#Ex?= z7zm6)Uz9b_Yi@$#7tj?nUCH?kgMp&2gE%2vq1-UD`!!>ipJmPRc&FV+4qG(* z9~pLofIdo-+*#-+$dr;eu#6kQeov7Jk}raMNNgHjn(v}Kyv6+@RU=p_BK=KnSD(mW zloLvL;Wtr^*AW>!Y#tsyPYKlcfpl8MZWSjVT?$T-7e%L^&!ixKgm!kb#+; zovq$3GX{e*-K&T+!n2?_Kw9!vC zYCU+17e5tv0HB-;S1!u6H|anYfvVkGz%N5l9Q+t*3a9ze$6l|(K0~t&KT*TW>Y!X~ zNWOb}@p@&O!2crRv6a^2WQ0SXjaB^nn=Z(7n+nR#&iVtcYWdJ52h@RE9So6fRAi`X zP^qZG;feJG^!sr@Jy50_z;CO-nanfJJVo%zO9bq0001)YDjiAFZtwx>;OA$BASr;Z z;fdDu4%^ODodlf0GNxsX|0>*r5x#r4zLb5pOa4T$d)3W4O-o!rk^uwsAp+y4^`}U@ z_-U}@6H>y>@<#^5zm^8)s$K41#RK^9Sop9hlQPSR*oS9Hz+bOH+Mho#)yoS6qGKDxKwK4l~y+VxBCy2DJg`2!3h@WnLCr!v0WV6QVgtnW0SA`m%WXc zg1|7;-DF43l+*DkC#e7y9;|_Gk1^N;!;YV<`()0a52w4XSK>~Je47-j(jY;EygCmc z=+=oYL;(52br%3oR?k}YQa!LleK2MC4YnNl^UEyj?j42#mnj zwhC^n9nZqf)WYHb^6vFna`+H~ObrAvn9d!JSoetERT!c6&A5DJ_i*rWX%kBuQG&hb zY=iFEXysC(2XQ_yX22k90I?wyd*&QIUYdlyL%AOrvXdKr1`Oda8#)MQF;M)FN)?=fQtwW|M30zVG}Y|$&(Lt6Cy(T z;atax#9=8lb73-4 zvAbh+Ps5rrwX~EgymFijiNMTlXvyw)u(i)f65_*>ZAJ*R?F>o$`$nQoew z^nM9&SnXpOjT#h59R*+B{$UXoH6XB}G9@f&QW)(_Cod}R5(qpu%g|GUNT1aU8lopP zKXE>3T0GzlcfBUF9_K-k!&4GD%NhVYy}Ik#wdR1W^|Myw5P&S5o|Nb$`c@m#!!fw+ zc&K;9*mfz_RH9{Siixbka`S~jE|^Y;Wj@qoj(qqwO?raI?ZF3u?dk?~q_fl>FM;8r zVp#R~HZF}}_8m?JDWSLd3Dh{tG@RU9!rr0q8e0V}2)K%1GEFX}x<^T1z)fI4j~;9m z#`FuBe7c*mK4U}Cc{jMys+Pu&Roe3*)a`BQf;*d2G!kSkOb`^gZ!o|h<<9?sqtP6k zu91Ldfuxj=4`Dma757oXx%TF_79u5>#dHXP6{``XJDeb56}Kh6#LEinB_!xj1pnQ~ z>3Jdk8xJ5%0j>21no+Z%L$ln#cBv#9pJPt~bt9nJ!^{GWHH#(0KjAPrKyYV>r|`NWAt57(A`q^m z+LxQDPeMToGW0(d?S6)al$ri1o72iD56=2lk$Rw&YX|&&eP!NlQei%**1~JLR1Ubt zXK@jhd``0B;ydl_?PQF8;^N}`(l)QwU!7O-0XkUwB=Ip||1h%Hvah%7&=3q_S{A0Z zzFiQ)8|XI>ulD%>32{aJaTVBj84x1M7L@hBGo@)aemYdapIHhCB(23W#>o8tXp8U<8F(&keEr9|5WQP%zPwh2Wqp*&F*~t8O zA`1Co?HJ42ih;657@S@hUYc44X%d)~Ps18CcQ0y)iMQNTGZb-^zQwy?E=aH1uWcam zxqzHS%8(=Mz<;dou;lS(rKcIZ2M@ZD5AFK;$4EsVRK6!emvQ<$b~S4JQ#cq`N3KWI z2S{sutg4L_PCviXx{H%ywy*v3U8``S5y5>4}|Z? z2TP`=ozqa||JpWMxjjW`~I%*1k7sN?>qz>J0r=ZLNTY>bn7rWURvN z49WyZCw0XfNd>NAtFKO-=c`A;l?!_!m*htd{a+pjw7xXm1_EUJ*d6X`k7GzS@}sw0 zh%gze=1$FQr`UD4IEg>rd%AR@Wr#1?G94HB%q%VVUdCCU>2%T;112tpaXP>celQ!zx3e3w^Z=$HwWSlD{sDQE=ESbi!=@uxs ztaBpiOJ*VKLPXF^#H-HP@bC*9L>PsN*RwF4ewnp=6}ji+uT|`Gf`5-Q*DLV+JPRW? zXk;xF-@c^?!8-NyGfJ2|&H>u)SGL1Lx`=nea@ISa49luJ{+x*tfd(&4nf@zFf`ufD z&3$&06m~Srisl|$-yOm4(q6$b4qAczCZ#mK3*ENHM03&>@96xt{D*u#GBvv|%Krea z`djD*69oT3=+sL9_M>(=aySsu%WQ?s9^5NtegJ*`VIy>z<>f3S^O8!o@a}152D!5zeQ&x5JG zosC3e{#f*K2^Dk{Js*8;5`0TLJ2kK4wWN@hkIj#px(bmO%>FNnhU%9r%;NpVcOg>R zQ}I&EVdzM^)*hG4`s`-;j^bRQ7UG@uDa@AIZ!4Wfc#TeCBP&?xp^rp6?`!Fa+%!Eg zR`^1Nl_gm2C$58+gvcK~`-|ZVs$SP+CLYr{-}J-IFCY%jQDKg+$%?Nx7#& zA$SIHyeqqkRR!#|YlR{+16UzCKb^$5KWaH;ghp-=BXPMh;-`J#AqKR%Z@qT1BH7Zy zD2%^m)GOMN{$wR{IAEd6Dct zf=Lfu_Urf>eGH$OqLi1@a;FYjPk3@PKJVQTAVMh1@GJJOF%>R@qQ_I`g%b!HROxyh z3ivU(%1{*v2*&ufep0W?kM#$HjH-dev`3^K#N8m@=z&7iODIKvtoSrmF93cFXye9> z8#o9GfmAQhJyyCDip@X(XqIg*5Fu-J5s)x|F6=SraE-jw<8VzfID*8^6*d6yH!GT58fgDYd_z+q~avr8+l1vsvsyB1dfYDzfyHi(Iakq zQKHgE+)R$*ptu2DS_!&bIL`WGOiuM998`~*%lA2IwUV684^!eGh3RGd2P(FFlcF%9 zMu34pxeZ1|V;Xv2D0zaEui7^@mU=aB?>oDoK@?h}wVa)p z%gU8d7DPqb*;xOX?}&5S?;22hY`7*6oUykfB^N#31Df50$$b2hpkn*r5i z0h2~*?AdD+WKa!svwApBenHBG0gi-#X(&ohqttU#zxpU>Iie~b{1GADdQ=(CcZq;M zw)9)hYJ+4f3gQM0&p|jYggwt?dhY2Kdfp>CJ=Zk*2_dSwNyI7Wl0Im;O`4?4PdOq* zq^L`J9@1A(Mdi1Lr|m?E%+<+DzvP0o5k^W`>#fbGCJg{%j-&Rt$kx6v0N?-dEYbGF zvh|0$68hkP=~OT@lm?>Z zR*@eIVEBr5cG=riWR9S|`)iT(osOcXGVHf3-&Rb{yn7t@JJ>vKjd{}x^>bQt9zZTY z{vaHs_wrR4U+a4SbLbZ-jsu6(vQAq2X`~R9G2KS#Pk2qzZSsjT|FUS(2E3>gKp3! z;DQ{Cz90#<&4{!O$vHj)D(&S;AB&3l@vCw@MZ5tYzdMty!;U}m&Z5?aAL~E~Oat_H z&JS5w5mnVLDmY%DgA%EDw?P&4A!~43;LbySSQUpkcP3A9j z4`I!6T-L(eyQ9Yg*|YT)xidO_mL}SGE=R(qrn%gj1W$a%gf2&nJnvW-JD5(NDV zcd%2f{nr9=puV7>kg0>-?;K#az>J>L%`S_IVpza>fa?NgC)uq&EUwNd-<3R;Z?TN= z2TWvb*UN7DFFidcck=;Apcc#~_8`ux-YZT&b7k@Vbmw6dL*upxP&ZF|hxApc%MF%S zjdz$wh)FCCpl%v=dY|*FLK4G`&D{NXr<3TYSylgfQVS zc6dA(1x$Cw&z0lG)KBg%C*6OQz1qei<@;BP^jHIq_2l_uxT*^+VI&PB1M$=V{FFVs za{BO7_t3FdK%6%K-sRfn0X7De5Z<7pLr3iC+TCat8ML?+pDo<<^1;)$0>=^6+&nDD z`u1k7&I97=ltfGtbFs>R7I0RZ&%ZV|EL`stxv`i&|9P?h^D;iJfaJp$xy|L6X#}YH zv6g~o0wwM5ItgeFAjEoKZn(H@j6jP1OxQ~Xq5eNq^;h4oEc$|z!RWGhKS6L!aaV`fdeHC=Vs|HqV@yXMn?jJWvdVtz;5H3LcP+U{gM z99NB8pag{m=_(QQH(b5C>Da&f57ZtUY+?dcB~8S|+WPsAKw&Nm_xl7ZHyepF21YTcf}4Akz@MeY#6=+KImDEM zXQH2x2oI!oaw9PS4g?gSi})9IPu#cPCpwt0x?OVoEKp&n=|xs+4KQu)?z}m)myzZ{ zi0pRR9#{3h%VMDHN8}hke*6H8hfKgOmnKl~v$6b8&B57qblk}8yL6~o!Ub>(FEz56 zSKKcGA`X)j87;pzNxhs6S2guRM0}dH+nNqG=Va4*5xZyl+(#x#=W@%_YAxv-l;FsQ z@aA*+OB{KLK)(X#^xpe;6Y*RMyLEY9Z3kMGb`IDLl|zSTZC40Q?e6voYK0?k&W?%- z@S^}5i259w;QK41nt%(1=!kwNRkv45k~>FPtiMHi@A9pE(**~Yg>xW>b{6-Q0z?OJ zv$@C;b>4T6T?FLu`&Hc*a~mDnm|eX6Y!z z?pL5Efm;3EOHFnhXj6UU5XB)wQL{`GMWD-n@}WJ0k&eYI8SCo`K-nRD3U)JokZ@Et ze>!Z~7@Hk>%b?Bg=VtnXaLfLzFWp9FU8$>C1=t3f{4G76DY>>g{j*YZ!Ems#3?zl& zbOAPTN10ve6B8k8Q7NB5k_DLOul@aDphz0q1~CMJ=fb`ze)o0 zFc{4=JDGQAikB*B0{|c-rxd8Nb8(Ry)mUEJJwzi8CpE1{NN(;j6Va8QDfs75Cai z3UBm_izL~JB149@htN{Qn>pW8Ak74nA(WrApwc0+16@A?^}T?jJx$?yqCK<^@9wAc znv@c4yr2;!r|g$!vOmwv7h-1dgvsdhd$BjPYYKvlDuzbBZMi75^^<<*;1=u zg0pnh>{hMd(8aLh1J^)fbL?2sgB?SI2ss^pPF%xtt&Ib@y`!dd(i%)0^8E`~W!bI34=*5ApUE+r@+*53L#J8Efi` znRCC7VVYYR$p}4#hH1#R9YRFBuV!6YE|K5om2^!hE5rBe>SDh{ZsJxI)k&Z1usx&@ zT-40M0|k8a4UJv;D=VVK-p@SicX4sD-I}j%H{iuZwJmbjdxMwyY)a_iCAk#2gh@PdVMkxy0WYK7Sc=s z?F6cuYPWA2HEchZ04^9(tGbQ5A`7*xk|nN5+3(-eIRcqS6OeQJMy1qP?2_e=nX-8nHpVtXCZVv8wl1--yRvI zC6DkMhoez^cc>6^Fzh~H*kF-yG^&2msw*VttRwY0lhjdEW4YrY+01?u%q{nmdltc? zi!kTp(6hSwHv~iz$l`%72*_GshL?d;JSe{jzw?iM$W2`ez5IhRGoxoZG<@s{5k_I2l?G zi1vP&63YXMhS5-exgL+-QFo6`cNE_;o}_Q@D+1AXuRKTJG?F`gYPuz#ew9%Eare*Kj^GVN zi8W7kX8(+{1nNsMxM?(ln@6D3#zb*inlN9={&b1jV z4uFCiO0{Q@4qsPKbXjfh-v&AdL~773D$n{B^iF-x7MM};-GRXH;{zN6p`1;`mJ}|i zqc-N}^1Tmf1K<^)w;r>oNNYt%7DV=hLR?4puPD$5gg2GLq1aOQ)pxZ;wTq?BpBm^T zL1Lf=eO$OS-bv{msBKb_es6RwiL4Ex-sGuw(BG_$br!vbRb3Vy< z`J%(+Gw1jXgP=48JUpV^`j74zbsq9apsr1e>=HoUb{wQs2#x|;T@c{Hv)-cMJM9fL z6w^xn(d}pfS$o?{Ys06ejjoXsTTuO))1Rxu1E|kyi=N@# zRUmUAp$C0B>MF2$aJdblTZVf2gJpq?@zqTV{Fq4gnM>yYRJaIP8tek@4iLM;mR-lo^o_ZRkou$leRJK;|9QC>B*wiRK=!4jrcy!eTH(9NUFnPM zK|%RgWF1xy#5#f;g5diAYKAr*%;v)UK#)dNVu1WrldlxU4C2rIfyj0KrRZdkA&!VW{v@d9M{iEdlxB@e`#VZL1(dv=`Z71G&J*1!;Vg z4tqMhD)6>1cc7WzFd|BJ7|knwxG`UL1yL#Y7ZKy7?C1WkU!#E|rH{A>I*CV~KX_nA zBdUR`m7Jq20AGlC|2(-bvw!u&XDz2HCjAmLV|i(X1HoM7IqXPW-ODd%NXLNW6F;Av zqR=*$_yvGwTG|C6zW=`S|G%OTsJC1BRQFuW7XM%)R%BF9?t-ii_2Fr{?wA8;r^BE1 z7}xDkP*#1Y!OEX)(bB4;0c0p|_>QaL%3> z9be|&Ghd$m7GxPnZ0y;B(z?Vhz^Gh0gNu#5eV2(Ie4R6_nT{NDC3?y%sx}$J;!&$Mq{l~Zy?eJ;9^9l z0JR@>v&jj*l34o%2+ck+j#w@re@Gp8-uQ0?!us>NHh%qFgvEaTT(8WO@y=vXS-37) z(bMIWhU+;y3&*fZwGzSg0OnVMtw3XGVUU3jmkCwa+Shg?rv!Z=C{&zZRb<(QWAH#!3do5!Ffb#*^4Y`jF_+GGu5@n4=#!}x z=MTQ&R`37Gi$;G9yghfe*qK9=e^ymU;(u{B8p|bpqbwQ1B9X%s~$XP#Z`;3Rn7jGoqeL~ zhm5=Dl?&1Jf0)Pr4CcR@yM~yB@hq$sqbgZZ4KeB;0SsA={sgE|-S+Ci^B`7o51j;j zXc^84x%bh;^(~8anMwi7x#$07V(>m$dHR<``O;DNPs{u|>Y@7C zSQk@aC~AFGD52HT$_h7TT8NbBsKl(A(YC^Zf@F?*e-GLqtKGYAY`6&`6KjYmGa;nS|O~43faMBNzCN_>>@`?^F{KAzevvi z^pwXqvuBQ8f6veI=2ta!&`9o0qUw`2&<7{J$PJ0xA%w4tGdNW$TXJ|5N-br6*%mMS zsAG`ey{XbKd)3*Y!4?gv{C`X8h0uwrRUr=^z=b@-bU{k~OIIVAlxcqsSFb)k($7H$1#HP2hC7Rw!7Td%D4G%JD^ex@N9GtZpn6WO$2DMT z7kSll6q3q(a5m+&PlMg6Nb-Dkw?J&L;r1rdu0dt_lc@>|64$?qtOpD zba>2B=izg{tsRIq(o*bfGk+of;7eoO$h!PC$xGd`4P|)DS9|;{h^y5Qq0-(zw-`+_ z8CR)J+YI8bkmSBCEvYt>6Wc2e*p-pMzD|GFg;`3Pk?r!oy{NC7w=6nKe{{tJdRev? zVa@LRT^dCntuE^Pa0q{qb&f`RNLHucXnJO*F`7F?W|3V*Na!EWXX1u$(lJd^t}HXM z(!MlOwBuIKG6%o1KR`#(ro$#~(F$ah1~2NH71dE-%6walPM`9nq$&S7C@8qy$QEpE zT$^QvlBDn863-Gy{y7_K?*MB57g)E>9SeTyG!IX%JlBOLhd6BHnWz)e|M^Nt`M!4^ zD>4c<6EZZ46Bi+kXLQ%y-@fxr6+k!tkAGz7v8X#F+mmmwrSBRajz*IpYKnbj#eS6~ z2$j~}8E1Rv&E`JWgLq2!2r$Gk;O8PfDnw&1q}*wKHE1V6Rb0Qc9qD`fhhB7)nQYWGEdi z&c8TsK)Jc)b>i4RU3Lr9V0)*|K`wxL$=k-XN8fv_hx9|Jy$a1_H@_~+W$W@#Ay_o1 zPEm+F5b|rl4a>}AK0}Kl9uPSIiwa>1ne9;%ui+5(5hs7Nvd?_WVY^6k_2@inG#-VAk$xEL6f0-b=g?e#@z~O-idRNIJ79I$tj;*_Q zlaco1tMBVru*a=dm zI#8+3Pnq>EK&zVx2(5v_B{MGbm}LS*qvDAFB$ODhX{t2T6BVc4q$8BN8MhWYDB97~ zPa)j1BXmE~#3%yod>49tW$F~&5=J0_Te;ysHLj2ZEFBix0y-{NQ&bx$xRRrPv=Ojb z1Ojr(0&-rxIZnD^FNd?2_Hy zWi1IlN8QuvM=Ci)+YYo0)ST3y1wM#^M@16C;3#x0i1WR%mOhKIHtogFJdWh=96|)# z_bP8R(oXY_LbDx|)SxSX?k<6iBxSPVo8ssAjcY*T4tDqj?%uxbF(!qFH##(A)Iw_T0BF|79y44}e?I^Q6zcTfT5e!qZW|O616>QJ zPJ5sbsRv}Nmo7^Oz+yv6kF*Q^RvIAPsi-geGF?PM4xBz{TN=gunkZ$rp6z=)0HCPA z5pVpZWZKKk!OM1u3YVBMw?#1&;XXs6j);7aeHVwh;f+K!>9ykQS>@)VO07M)O-MAA4Po` zfW!%|L=JeVnWB-6f3u={8Q4wa=}|XlR<1(zdK}Y>i*DaJMqJIoVTLRQWaFqWgM){l zOooOvXby3p%!BJBpe4G?rU&l>T_8rW9+fksuRAlz{$QxDj}+DysMELU=}0rV2lV>B ztT42oe%o+p&kf3oNWK8?0BUTIy!oqG#-hKdYj}=UlDjbim8N+>`C8S}Tw- zffRyXgdn@int~r+`Vl0M>PeKLQ3~CGrha3`%Qldl9XR1Hy}h9T5P+l`u>|N401g-_ z>!M55W$>~Ud?;iN4bBA+7_s65*Bt?4cIpF=XPhZLk(m$QDI`e8+TrJtW=gz$~FY z$lk%(E|);s+E{F_Ymn&$+Hn9XawWUqSskRdDDLr-RztRrXq4cGt*-3AzF=$@tKXN5BX`iHim zcL?&@9^+iA!%rekE zb$Mr7xOy^Snt$^`vC>&o#-@ib38M@jwk$iF8Mo0JM?gp-r!>7iUeqh@ku2}NVjnQg zf5BCa3H5TuOpwZZ^WD;>_AvI|l5jg}j=GwioeN%>z|8quX=^psyXd=}d*`pd1&L=i zIt1GvKjN_Od8n#=1A_z}Z|9JSn6NT@&>?8k;|bIy$R{&rZIRzkvs!)`-AMlNy<6kq z$omxIl*Jow`Ws|rWFqh1mrL_=TcIsCzZ+3MRpH9ZUpLp-81iYEzd}$*C_FUuXuByn zIr;Y)52ApNBR}mkXc>jizhj7R7bp)3%3)@}TCmO;>wx)^5}A-wRUZfsTFR)Ce-CbRqo^+YEv7U6O@6s#>j43{>y*`nHXG&A+=pMj+CEBT!X|3M zYF#Zab}yFkbru8HZP#QnH-6qVfeGnhhw<)htjA@4 zMiMfq9)^r$ri+uvH~F0oK|&50$xWU>3tr@H_os3{T3lGDmhT}Y*Rp$a z6;9c%jj%nVM!qL7$bRG&tCUynz6Btwfs_PrT78_ZF5JZvt1Kbq#~*kgHe@%s5clTx zY@S!~V1K@X(CqI=0TVL%&-XS1mAJ#vGl>0qkBKxrpd|>((Tt;=0(IG}t#Z(9cuv*2 zzu#TBd-~N>Jy(+{4de0pkMcb($SZms{A(;2-5UfA9Ipw2><#1}-hN}xLQ%bSLpS;`G8af1B+4)$HpvWi~4t~%iOS70mFN+;|MV94$tzJ-h=e(mw!O7Vi?48G8 zJ(gOx_RP;7%&+2Kmae3E^VtFR3jUK(MxC?sy6k)N$mvl|X5=)=v%-8M#l`acPj?G# z%o1)2HuHD~B|MN#zjPC!$&gZyWa(4J=**hFBCjDdW3q1O{vy}OyRY9u_U8URnc%~l zCu4fCtGiOrnYgl^v2UC)Qd$Jvt}YTgWwAjy6bE0CF?}Vzq;+a#?)u_sKfT)PNsX<4 z&kXtUT(X(w0h{WlVhhsyV%|?ddyFM z{k1!UksVnan&L}QTJkb`f9J~u>*=RkucyrfZed(i8 z7+K0C|BESW9~ho_ueFlu&}WjRzL|Nm%7M+F=4Xi-2-zZ%`B)uA&2FO1RiKwxcFN@; zky#vT)BwSGDdx%+829J*2{d1IhZ~KADr=MLhDQ{~x0MI-$k1pQcl6VTb%hP((vk<> z6t6$KJ-Yy#0%H+u+4T?0k|ZHA>4r@z3NFSPaghf#E{-2KDc#R|XI+@u-K!{Mfb9$6 z=z?!z&AFZz3%=V&W^g|19Jfs#zs>aW|J3ic+?!nGQPAVPjyaWBz zK!ho`^bRGZ<~xzdNSs54=1Y|0)_q5#e}W|Oqm$p66OFHp>=gPA*tMN#2j~7T-o=%H zsyZt;D97$5D?^XeH3F;P;N|ZFT1~4{qa6Ia!fb5A)VgIyWMz9!-?=p_ST3!9!S=Xi zko~7ucxgnVPZW-c1PclXguEOfE5GZ*E7kQgk2WanGXXBE+=tpKg%Xa#v!|epy9NI~ zwfXKUMkbG4A6vjF*lg7I6DQ(CZ0j&4ITR4?23jh371}z`3-Kf)sD5*5b8eiAhLUPm3KU zW$rwHdhqnhZL>wV$m!Lkest*iIvjD8I{tNX78%e<>&taH*FzKI#WzPA1Q?{XLUMB* zP#<2^G&rme965RFjS1xU6LZ^?o;#;e4y@K_Qq=d^*@mtsjGGHdvL=Pz(s1Ur;&>(u z?&+)JmsGBh^LjPUL`0}xRBzKy>k4=xb)A6vg;>Prtc|p6@Qx#kI31HhVkX*aqXAJ= ztXfNn-vOv&_u}+*EP=Po=*2*}uS@TB=aQ7eExWR;V&J$7wJgVyZ zt>i)We(8EE4is1{id4PO;|?4>v?W7Tec>}vf&69zZ>Jh{HFq>q4`UaSi7dwL_`?Ag z;ZadxzOLzcgdbO_$GYJ}C(db<|1^JXQ#ISDh1^Hh5amm9yRQx&ZZi(iNNYQYn&RI) zOnR5;XwBA2`r3N@~ylEpYdhcvZBJ=s`Z81gq)3*7r z&AUe#1}c0}Q@Yi*se+b|4VZX)CAj^5ps5Mj{2)lyCJ~ONH4t4*EL8p~)mH`HZ&C!J z9r*W1@EL14Wb4P^%e0|1bq-wkwZuZAonvi^<0h;s3nE|J7h-Kn#)k~;+UOpuBbiY7 zdG5eO-hkHJv?@PT=;b>Qxj$l$B(XRs(}9hnK7fUv7TevWVkyBVF>Q()J}RqxMUC2b z{q6c$IH(Z+1K6*JR)*PQiLK~%-fX?&6b$~my9ZQMRBnC@PD;j(-8lV}9bWTz;%y0C zkj%r32kNC9K!Kr*uku%3Y>z)-BH`(^jY2gLs+qu_5Lygg%mVDGz_9wK&u(3JwY_nb zt-@7%f^T;VTjh%}81-UOC#O|zNO)gXRA|sFf>%a8TZm_XH?FMo1!#;N?5CzC)l636 z?uX@=DifV|1!YXHryk1}1AiSxesqLlbZJ!dWM#$kwS=@K!Vb7e# zR&80p{j5b2JW4@199}^JHzoSlzvs$Bdnp_IN_Zq)paVEOQzzfZBu(I}j4FgjbsPtA*&n$p&q zmW7E_J#qKb3TgM`0N5+#T4p~VWf(&^$!$xy@na6~g zWv%xkt@e1iwDN^~roD`Recvk4;{P;IP6!Ot)rB4(uytW1cN4 zd|zocsWv!~AWe{RjoG_^pgXGyr&0!czk@F@iix`x@l`#Wx2+>pPcRvmN>POB*ET#C zqT`j(|0xQ#Gv2qRzquLZN44V(TXw})dd`ux+}Y!;B?CAw=#@&p>TO~@DH6c3>jrC2>KN=RH7_wcCHTyYRWOU^dkV7tjWCkDR+ zCD-tXdXW7_O|Y%UPWQ26q4ld+%~uoSmKC0gLL};x)#_>n)fLiJmlG<+^p94|w~tMH zG;h-INz)c$g4~Xr$RxQJF;ya}>aSkCsg9*&3k%)743XEx{lQ~ibN@jMm*(Q(;T@-{ zR1?#1*^V4UT;`WAUkDP_f@u^_L~FRBP_DOckB`gl(z-;=p3Tr4YtF80=yH?o&pC5o zn1A~SWF(`FxiN_2i66Tj9JB<%0y}JBe9O{OXLIYzmmK?x);5FWqYkSau^ST%=anp| zpX=+v(X^w;O4V;}is9i0lS%opMlx~3ib!ntdY71M6ODowe_~ut7;!PIIFJIoeXc-7 z4ACeWQ-QowM_Sui5s}D&L&1q$fvp{7f`a&WBk-s{@gd&h(4hd=ZUx6rBqpA=L#6Bn z(O$PN2xod7^C}?2Q;Ca0d^f3#ULd@I_fk7sEywFizVVjIh?V+G-Lbwb_MqU<5Sq8@ zYv$Y|=be*rN(y!bJ7ek>_KVJbSd(tS5;9x9vXR(jXIYA*WoH+g*AwH#6iie9v2sf> z?7;))_-nF_!|F9k=e(L49JpDH_Et`mB7uXsVT;+1EFz^)H6kg6=@MFF+WkQeKU6$I zl92Zz!9w~|dMRV<$H^O!vg}Wd%O6%@*OFiY4uhv{tY$-!MI?(E-7SmdAsPjbi!2ozOd4b2VpP>G zHq79(G%wszNN?=BRv~aq7EAL0era@iW3l_@XhT@gHaj(C+`$h|W*~;1;tGt3?g(nW zkPW_wQZ}24uOGY2j0;bVYei*HSEB;G&fx=M0@;!V>%iB$F1xKk0w}mQ;QX^8FutIf zLJSkCqqo;Q)`BKVb-aj+i9fJ{^$VfN`Cs|!tLb?t6#28Il^0vVFB0BGXC;mGnGT^j z*pfa#1SJnznteDcR^=T(F;nhmjM#b>BtNia;B@{7*j-`0Y{M9-LlOKJAfNc{VMgPZ zHCYYvIs19X+mBVs4xP0XDxEBxn~&j)p{75QGo7YhVy3@f=gvo`zR=2Z+fY4DNXd5E z!z^CdT*-@#CzwY8zGAXRl$suFw z$}OX|vh(J4?*`1|T~=!?-Tq+gSFMS-qEdsyZRS9|De7!WAW7MS;HO6Mc+G--hYkRo zBD0xf{FGzMEVS$?W2BObNJ+|D(WDC13z2_2Q&OVQc+)=*1THgF-u-pTAn*8F$<1_2 zDV{(^s9H~4;P5zeNlg2~XgBgMQG`szy+8 zC9B?wj*)p3q$4VPf%wKEC1w=`MrB;c`!pLW-obfOkEJN4 z0I4&FPX}_=*AJ{z8YIMVKaX3N#0;K84|%pR+uw!>0govv$~BO;%V~V$)m{CE6XS3D zV#g{Ynj$%aNlVP)X~_c@_gR;8yD+{Cb1>r(HoMXqJ>7e4*(yGbaFqUG zYjk$p^SQw>4=@}7p1?C-AWvNdh%bqQL4Re}x3D}Z$7&##PfgQn`nte{$~~;hWP4eQ z6>B+cgy9iX9o}v}noH*TqAAFJvBMM7qHMZM+wKkz5h)6#a4_lMIsR5NYIyrJ`QpVU z%JRw_g%wNBx*+@E)#>j(di;0r5{#?q_aC}@tSxA%xcz&qgQkr#RjYFIn=o5ib#0eI z@@&GdxAvbqHQLFRwynRxC3)E(HapgvA#T!Y0CTq2L6&`xx4GqIySuj$V2}&te#5-0 zD?e5^+TEePO)o72e;tEkc{@Kq{>`THq(?!;So0_vw~XI3J!w8?zFZDIH}v0d~^wI<&~BGC{Y$;`?TZ6lrCM z%W9wxTFQ^%95{!*e`@)L10S|re#Jqv);bV?gT2BVpg=I&zkVP7+zR>f6m|95kp}p) zSFu#c6!u492uDi;s!GkIJm0u2L@5i=5{;t7HWwoWHFOCj&G`Z#8!0i{N@)9bifwvJ zgH=jEEc}?mokvZSAp^yft-RTcvNMcS)$0(~v|L<9ha#Pu1h?)1`nFe6@(`H>T#Udk zi{?=8=#_6rCICSNVD$EWHBOlF-HmUdL!$QP@`z5cTUvPM!jZ63TN<+K>fvn6E zIKHE$ro!vOIFj7#8W50HcuvM{w<0X8ISr1(`vw;exoSQ4jv;i zVV2mGHI)9OhM|bw+eaIp%{sk<%07)utXQHMRfLYg#%?$@f8qLFk#Bd8t*ofuQgu%5 zXftEAmW3^FKlK!*r8!@IS@-F0Uy#caxOU}@e*H2Fw}ue^?{C6Z8@P63GS(yBo7Ca& z#|hTc1Cv-gGA4W795F5B0;}2X%QBIUy;l&3OfpiIy4sGpyTr`s`IXP1_2b}tyse3! zW9&GheBE{SUfsfx)u52Kmv=n3yoK-gtm+VGyoAM6z{go6gKzJD*ko%KjIprOa@3|} z&_5CRklJhrEzOoR!5@_K@n)b(*7=?Mi$M3L1;D2YruiCe7VvcYNg@I^LE(s$GKPRa z|4(1Kr;v3WBPlgw5cbMbT!rX@1VqFLg8<+5g3bIm04MlH^v5Fy;m&KjR8 z)$hFzGmPO`gcxjuR%RQXpl^ui2&V`!{_ zoG0<~1b^UPes|A+A^0Ld(jR;Nw=efc^4Cw{OCkOJL0xwr+Uc>e$f%E9LRXs~8&n_A z!fS{POxeS;FHPiQ-;nvPl`@_yIS8?{+H_@2-+tx?uVkC&;-+!z2*$25FJWx4(q*P* ze*QJ@pN!zoNc4VB!ta6o+n2~b{pUD4tRW{;BH2}*yx_v5Y$ED7ZI*1R?EcO&IesNh zUMHV$2Lt(AJ5sa4Smku+^PACNvNJ<^SeXL5<+Xwi`eCz55;^fk9W$!D>Tx z^M&4J2z?`pJ4<@1Yx0w_B6;hJDvD}Uj*JMUWIpLZ)Wgq)weR1$x6{_FF9l4`)vn1; z&@BjF_&mP5|4G)Ui~{nV`w_EA2z5ish>g3lVIQm?)(q9~ZG(uK*O0S#V}ivvu1iu{tts z{Ql(F1}*ZPqt*tv30}y#zK>KrSt!yhuAm?ZRAwmK_Wd{|MYyEwKz_L{iO@uFGUU_b z^#4BO*50*YZ4Z36D&2<bb&dmZk)+14P&8w zVw^m+Irj&#-V<5gmBtlrKfQ^`l2a?pyE+8w_*L#LY6kol_U1!s;rA!VRKa)1dtT_` z1}EdvC_ct?82a`u2;{jgHf%Ke9v{4AYi-Sd(TdsnhjmHf+s~_G2IO1J;Nr1kXC)mf$Vwh;6F*)puG;^^ zs<;jLMCGPa!LG}oG)ePKC+9(F07k{c0uk6MZ)xYK1p=P{t}BqCc|}BaLK4U=un+yx z;C^YxCe!BpAS<8mD-Go2i#X5JLLA3RdY)8ihBIC!^)$K>_Xqw5-Xgj8JuAoHjC?VC zT*x6*r)CFSftZy0EP$}cd!-grpqA#gh%zFyM*0`ESVUxw1OzCc?!n#2a7R0-__l8y zAV!;OBiDYG&({IA1~r4j_>>LmL;sLWMr?M&o91q$bi33O{m|si2}wbxrJ5)cG0zM# zQ`5!mrvP2&is;>E_9Ilf=J3w`#1Md{NRcUGeFZ_H7Ia?!gp`E|yWxHYadF}44l)|V znDwd)4)bTD_>#cYICD#uOV3{L4gSNZ0aMbd)hYYw1z#X@Mvn1IH5HW+s6dshz0V=9 ziW$yCp?gWw^2MY)@vxMfr~4D^yqX_- z$LM9s4Rjeo>Y`J@cN}A@O(dJ}S!Di)$Vz{&qe;R*jMuk!GkH@cHqu&(bwnNC=XOCA z%*-gvB5W!P?|2*@37b-->r+{=Rfxehy7hWR6c$RWPm6c;^k>=FG#4>QUkg8$dq;z* z%6F9yCgJM#W_;&#t8-E=#<)0-r_oJi+9_6ZyTw@sr)w%im&+kcFYeJ0*pM~&w)%%l zC=9IUMe(7UPmj;E0d;^Y`7W-$b-J-uc-O!tbW;*y%MF;BL`(ud9FY&5dG<8m=L z2|)&55q9mKzEtlSukg&7_F1LJkD`yp8{B`Z+Vr;AZ0BwQ)_Tg%)@PSGt$9R030L>d zBr7&sX`+v2bQq#uWA6qxf`I*o8j%tT79Be%>vzJ}ttR#GNxNpU-JLCJGG`B zu7Ch|=T7L44g+EgnEnA2{7I+)8mY>0_$op6TI;)ac+NOdB72p3+5C*P?nCt3&ozUw zgc#~t;E9BsW#wSYX1`!3JAEH@R0%nn&=Nt*-lI>r5h+*gr>c%M4tr%CfGs5(D z3-LU*ICD=)97n-5T&ywN_VebHrCz_t3eV_np3u7LPGXfz-rg-6^65Q3OyKvKd5pwD zZthtm5KY)kzq5ZYn88&cGn#Akm|Gi_ zH8c#@*=)4=MC$DDQ9?o@>_Ti*$0Az4FU$mZ?@%#Fdr+aSx^CfR4Q4os4Hw0-Z)LT- zQ0O5`cu=`3_oB@H$bKHtF_dc9d-3^meHiQ2jS2BS$xq%dPKnwXxGLk|13q`PQ6*31RB~;jBYRNec6}P5L8M$}V*~yke)i(@d_?q%Xuzz(K;VYiQFmen_lKjC=EFt7@gxN*RNmrxvV0`AWKm5$jaQvTV8g6T{woV zo4xu@xTn;I6qW&yAmQ>_7$wOxVuDfMw!^rG%~1XQPvAdus!@V9qZWdWL76t6;wl?@ z63~gg__?;LB0|ELgrVEo%y%z;@*+sE0bdJ1?C3Bxzo8t|!g?n`_(bQt{QpYvn^9ZY$-{;sG7?(-f~S@VFC{@ zuNIeHBkq|@Gi$2xs@-z=hl?a$@Dukzk+rBaLc%t=wS{cYMcKDCKU`Az^J+dFFR1ju zH7GggyO|7UA3@zKFf3{8^J-l1?$?i;DC09urywB)-WyqyoA&N{{RQd$jSD`(xo38F zsC!yocw4Itn7EZ@%>3{rN>tFuyrMpo5NQYEFv3+> zm8qoHL&gSMe5Q5@j+15K6*CUzVp!{oSviHOTVFS5ytWm={O>YJ%grXZzU`zF5~=Xl z;;fu!lTFy->})nqBQi0>tZ|0}RzoJEt@q#vvoGNr$HRJ=B-{$@19}8@!@2ZHyuavy zCxu&;fv}f%e0awT>UMD?j1F_z4QjYcG-ZD}aUH}zKke)W4)t^b4m*A=VNKbW>~R5P zN3lPiH$Z5p8+mlXu1^AXDJX)2lHkBDq#g-FcgP9^!o&`g=pRB6goW2s;1^c6X$Y>f zn{H&g4|d(JIie`<>ACIjqvc43m)jBv3QPbT4`c))Y0WnU9zM|6m?#+>eQhyi0)?b~ z6X&Wiw*TDOv-gq6z&Ed{=X)$+48smltgkQ4cC~1#zjyLdCATQsh5?#&DHOP1QzW&33Vdr3bb=9pr>PN;8f%wB(T$6*Bgp^T3JrZ_GMe$WX8T z)${F)U$32=Z=#{^MA@mTdWn4LvXvK3)L8`mzuu&$HhW9t8>$b*W*);w!TcYmtX^xQ zLt@%1lQ*sMJwxs-bMu1h>qHjDq>XOk+v3g9`P<=zZJHfhSPL65^H>02=bEG+F1>X> zU38lT{58}luG7OS6)hR-%YqQeFY4TWVgH6oc|TAkQEZ20PPg3lbNFdkKlHPQE;7IQ zLwHhaBVDu2l^=^|yDD+&(_Z0)qdm`=R+*U;Gt^IH4LMG1(v~&fOKQa`yKR{To7uz1 zv|tOaz+pdu>{7MNk|csmnXEO6M&)qbgf+%IfJWpDqO1Uw4!^QS|ztz>Y(0 zpJk9hC5N$ZFv8A*Fs#WcXsPOS@=}tQ>&?q@G9=QT_gE9RhrD$O)YUiaw=*Qex`uC+ zsuZ{_Ca6$c0uzah?Gi!U;7ZvcnrtJCdWlL5M1c1D4w-7fZzJ>-95YWIG!9ft0eAC5b21^ zo3ZX#FM8bEZAa8!x@G-yb3$ceGKs=>V`Z&hysS-UTSYjr%@5x9l!SuLn|jD% zLR9-geX6KfAd$l-Ny-z)#SAyMAOYm_TmXS_!p%aV{5?N0{JPKBTH2y?J4|pdie!$8 zl@YgW_J*HIC|A9_BVFIOft&G;$`xVI@95~uY%EZ#Q$-@j^l?!5heLW9#!GU}~rsxn?8A6zH4C0w>T zZz&$VSn9OM3V~<&?Lz!gk8{x-ZOr3DFB19O$sJ?5#U^R40gKOF&b_7{FB^Jyy1RC> zwXALml*=lx$cU5cdXXN2d!L#bI;K@!r@Px%*oV#Mg}d6fIgkniY^JeJ|JgKfHkgBGdVTWwU$@|y!e+#!9% zH#T(#W2Qy;rLE>GtgWq8G*zC35dh=%TuD99v8M~WA{dX0cJydBcVfL4P&j+u|Dg_!-hb$=Q~6TprRxyvhjSbcLpGSZ*gdY{ zTO=cLW7DcP*@-%ri_2(pcDUB2ESHr}6>1z*W3y~%;o|Q5igzWH=St+ANsW}J_#buK zYMI=+b@1{XuSbufC+$lOXw}wg8XyKJKtQ~xbgYLg?m?ng>h2MHllCJS4<9ONZ|Jv= zr-d~mR&pqy=F6;7u8SARt)am~ry*Q2h-rSeubk&qT2VzjE#2`jNKum;(#llJ@*<=% zGL>MmB_zsTX;~pVH0`rNj-=tb4psH%g{q=;9E|pOLIF7lg^>87WcP7&+(IQzHe9(T zv%eG8a|l__S>diBWIc6E|60#(S*zOi7>giCyI7@X?{)SQw%p#UKOoBgOa0LcOP@gc z4CCf(Vr@-avc(BwaQNh8T@e@0ud27bNek+htIi8-V0>pm2^^+v%PMjwt!8V|;vDYe zpitJrLm&HYSZJhF-xU3KQf8tS}~argRN{- zK0TSQ^KPmFN1J8K9$Rx|ph#crk%?WYb*|KqWrh|%8ccDw{*-~DNE!HKuMF&s zj`O>I8u7Ea5IvR#Ai92&@;o;wzCP5v6196uiV6ZW{nL$%$nO0u_1M$TVXZ72a_y&k zTPl8kOAU!kau1u%sRH>aszYw`9Q`Fk2eRF>lUtB`UC3Jc#gWo_B&U2XV`&pKiqYsZ zE%G`N<=IO=V+@!g9xS{wCJSwJ0?j7sw2~&DtWrw*Eoqd7_X%Qt71T zR~7$y(OapyoKGv>++Ef1Ong^* z+*v;HHH))~i|ESWBaAlVwGSY2+Uw!j`*6QLCCI)m;tJ?i5Tz0zH}Kgthm`A^TM!d; zoIX0I+RuKucRMZ;kb0)JGG_J?slHjWS!?whpwrZ*JYE51$X-w4-iLz`4TPhJxZ&!DT7KC48nnp7pE=3>w}tAdfXwO%#}G&E-Wui(TLyB z!W5vmFDY|B*SXl(h<>Z#_g?$-7x&j>S)c)gm-^UPHoLgk*4nT;;Enpw7($51nEnrU zZ{Zi!*X@rFAT2G8qyo}{bP6I02$IqvDIh7`!VuCRT}mS@(mj;4G)N994H851+oR9D zpXa&vd;ftSFJK1FnRE7Dd*yqrwGYT2LZoJ^!eH94v#2i>wTp|2azoNnXgU|EZgz0j zo?5El^|`2~Ci#%>IG}9rzrXHSg8IRm%dpdtAHbb6Vhd-Q1bYKnHHaKsh;OJ}`!Z`` zc@Ab*d!p#xW&u94he>kHD-@#Xw*Q>C91gO;0={k3s*Y9mu_q?g6|2rYxSWZJ8USOk zp&MBuv*Vk5P$9LhQKf#X{|Y)FTRvZKc=DQs5%a%_>ybswDxVH?7%mUF9pQ@b9*f%w z5zum10GR68aU9O@1@VC}?@R7`S)LdIP`~!yQ+VRvWs(@q^?;N7dS@5ajh75Ik7&Gj z82M`5qp2gF5fq0v%JIZRz5dUSF#TD2uvQWF2|UO;`kcE`)1!=;qSiv7su?ICo*c^k z6UKX4l>c2aj=ZCP7ZdP$L6yfMvR-WCEbQ6P)PQsnShUvTF5W+G1KgSubI&yEOD<~r z&&PJ$Y>cs3e}TH2@gGy+)`CTi;*@^}Um4krV+<)MEbJU=`3_hRCY|&os0s~)wFDMc zQSQ0)N?cK02b+3e{xa6SBzw4uEBSxPHDIfgjt?GeC_6FV9x~sEH=J6-0PKrig9;Rc z>u|);xr(}`xYW+F1iKuH)PDl(Y}4Fb~p8!x8MK%1{kgGL2*oI zHx*TCg+UAs2!MgcG2OlT9(fjyQ~d?y`~WVO^6SZyx3g@QqPAOH zAmBxT7(A*1z@AjIPuTwD$ZzYZIL|wvkAyaPKAYtO2*{!{oLiZe4|C?5QSRB!aB^I5 z7EVJT@$#HvWK|CA09XT4jIL&Xb#%F#Az^%%7|BgBhzi2BHs8!_KFi^s3-@{tce}xO znO9V1#D|BRF-mG!QbWu^rV+Uqm2sN+?LS@3_JNf_hIC+=evJGK0$6~}Oa%e(hOi$b z1C6Fd9mjYlE_G?t7+`e(ZnXKJEO*mN7?~j!_Tpfp)@_xnI>+3^X$fCl(kmQ*Sje|I z=G$^W2g6RcGQ{M54qj=MJ?jJ%AD*!|Z-;}`N)z{`44rW?QS%bPr;`jYUd5uFnD|%j zWR&vTG^qOYyuh$u+<#yb@$sG*SZ!eQy%g9&!km})0Ukp_=E4#7h)!#W>oWV{JH!g2m6XeQVdhlYz4 zmUsHD@ebNUKQCQHjI#Ax0jRS~L@mv%I0#FCop7vLc zK(GS=63_j5Li_X;Vg|8XVAp!0Ux#GNhLaUs3!T(_PGNDm(>btYQ+G1)Bc8Gs&j25c zD6SR__?QBdf17KP%aM!4nC16Zw^+K=yR9Z{*v#~ceM~SU={0Zy;SmxZ1-EZ%y26V3 zK<-oRq0b0*_}SNzvk(NXbTV%^uyMmJlkBP}NgtjcniS3BA%kiFtKrkI-N8|IKO#dS z%ySt5UoN5ozdizB-a$_?(qETYb%XB9v&V)8dc$|Q4=5lU)i}>?o)Q5!B zRmbxFzJy7L-)TuhUjIetXs%{A01}~aD`$}-g4>^0U>Yh6V$)Zc&YDBFs`&}P66A3> z^_dON58oGa)lhHb5j%8LjV#D3o&gBq|2gNM$=)wnc?UWTY_G99n0M~r7(2c3Iy~_% zN(`^o#Il>qKx^_*XZ29NcA?duvxD-g(#QIC$H{rW%6eozqq(q(k>xNa0d(uP<=Ts$2=aoK{6Q7S;ktz z?}t?a=8pgBLnL048N%xKHwBfFo+WS}3Apk{Wne*>jo7pYpyg-0U2>6`4)ugwBCbS` za)TJQk8ysrMtUUamd7>|+gEb-fLg;QMOjNKdXCtwV<3C(MFZj<;oS(m?G6djteHssvUv;KKs)851WLnC1?rw0q;SDIRDYwsIskG{Tfzqe~&Pbgscn%eLGn$*PG z`5?fiV&3z&fUZqzG=b2k4WvfLhAO;zVS#1X=(y$0KqG!AJ>{kO7K~$TTyW9$m`Q!M zJ{aJ&1?pB}KIf>Nxrs4p*Vn3@y+q>|(n5R$5c~CcneQuk3Zh8izVP9+Zzh!BuL4_d zlTuJ=qC!@-UL-zlcBz#AHrs#bb80dw5$mtei~3q(jNuNM43eg#MXQaFB$ z&xz)~tLoAL4GAvEv+r6gtc&C8;bhQ#U4D|P6LKFG&h z5M&T`xnHg6cQiF%?j?-b(1>~HP^|wdK$)~v$F^uABTJV9)(l>}N|LVt-AI1UK+`Pn zILQUj71*s|$I8aw@-vRthi0E5o@Vo8KG^V#$wvw(rzO%QlPI)DRVx+8w?&M@FosDh>|NIQ6M zUq}l804=dh1C>Xg(L=^2T(2N#b zWI119-i|;J)GG_X=NiqhZ^~2)^NV%mw*E9=hG=0OE=m&px9Jv*h>Buzn6U-?QXKKT zEuz=cZTdGA2yflAbfcC=`ZR}59s!5n@>}eS?$*Wf@oqef?19WTk8}Vi0$*T@2Yc)d zZ|;ehI3|k}(^Q-_Bv{CT-H}q4HH!FwO&!f(cHN|-_u%tB}CvQNa&`vp{TgdZ-3jk7oM{EN+H3Pt-98m)PqEx(Yzo@p-$<_TE3n&y?T3(2?XZFa z@QBDg?7!+8`Fo|z<}S6XCxadcdtyf%hg;Zf)$2{v1#pe4T<)}sQHO`H8jT4$gFX!Z zpYja-h+BVr%0It;%T-54G*tcRhCx;$mz;sPF=0tKg66an5O>d@`8HkEqDUMSQQHl*m}iNuFb9#70DggqUa6ps{^( zCNO?d5};{uXP)3RL+T&8UH48@IMk3K+hrk&==-3{4g^rqAdX@;bNoynsqif3$Okro z16OIMc;~^SZY7R^q3$+68<25LltKFR$%@78E{AuB2gCbcFnftO!SQz<+4}~q|3P2D z$UpQINNfhrREKG|t$|JvoE8)JlYK?)2B0Z3Vyt#pgFaFjhmz=r-^Xs++mX^CEX!9nDNN(AtWIc-%+S+@nlWNKs$D^bbt-pt=LuZbO(D&3OE4n+&$508P0m z8m0bB%`crVC|$(Y7#4&4aB`AC1E=8-r{Vg}|NG+o+kY+&$+6h(0x$x60m#{$Dh664 zu5ll6tB%a|wF4N1d3ElGGuRB8?b+O3n?wV7@0$4<*DwgiGt~^H| zWsor{%b%BjCt8ves3RojqAa1i8*n{`Iub>-U>5#g1C_%w`O)I3U*nbTx*9utKK!tm z<=?pq`CcMA`7SkL3y_yVkedhY6XSvQ?%Z|qr#ZNZ*S#RHc29qC;LIX?ADEThUh_o# z54PmFy&RT&4Wx?{mSI{%C_r~Q36^Lga!JEe63N%ig<;5{#EF4Tg^EsmfTn{P%4vHp zFaPiBa66n#)#~EHPqz~Hxj(R~ER`8Lb{7ADg!=EjRpQEc`)3CO^2HLF1;s zrUl{rDM$N%3O`V;m`@mNnq$7o7s+|6kpnchQ9K!FY;&X*eRB-+Y`svBJ^T+X8dqhq zjPepIO2&>NK-11oHCM)4EwP3rCL~1cQ*$A%d_2BR)Bi(54i$sdx&R(**|UfQ%p1_L z9D4RbIh#M^8ui2fQl;QTElI0D9nlXAxj}zUega1KSIq!ff(nW>vk)S~`9EJVEnl5& z#OQI1BY-(!(g9{5CgD|?eg02Cq2DJHsUbfdp zMpC~INX}x<^SEwDS$?ii#cH?^Z__VBxeh7Q{znmyR5;trmf^xx0yctrs7l&4D%(`6 z-*(fHd71J**HshaA6--$e+v+uTv ziAk2RL9-*NLSl*3#u+YtFnS|*ARtwAl_x<0m##k`2#<)!2XbyI23$Pybk1t0N!#zz z?FTE*n=FOELrkXP>!^{R?OziDTj4+;o13&UWK@wPEXpW6=_>5Fcyd-h@zcb089#ng zxc*HlKV(RV6Pi;pQ_f-`nNX$`8VAjX@*SjUV}O2iY1#@hhXdUoV@Jf0=w_4ratU7p z${=v-{NmuCAacO9cagUO&uyx2@C>?qNyw?VJYw=i_>1UKt@K1)2`3a;`cig@@kHJjY|W>=%$(@0TUAw8gQ9lp-Di%o`2`I-TXJC&N)3g z>=g1^Nh%LdexLbYwE#3Xp4T@^T5Z^H1ZU!2THT@juYHyLME_MMU&IAHvRsL_Li3vv zt)vg54gnq>ci?*R%|*ik=Hpz|&-Lg2`?c;@+y=j2iFv8BE4Cw5h4U~qbf?v;ZmMca zKruOQTig=`0ywsKu&8bp9a5qh26X7NM?2hx&F`$-b+2z$Hc;sm8+1y@@;cM{i)|YE z&e!9OVIG%zXE$L;hFI$Camx@Q073wBoHTRr|c zzm-^3nU~0UgYCB=PrYVlM0*n%uJ2-aXd=)pd`v5PcFgPLyz2awEiQ4T&QhD$*G&){t2Vw{1^nnS`rbfwkh^?7Q}HzP%e0f_N1P)H&# z-{n#86VMskTViGUG*ciAQPmcy3$AhN$^Gn`@^ z@P#$Ler7}7pN`@kHj(XM;L#O)xPBWMO*i5P|uUhzxW7X#8zrhURi=?&x=N$?i$V^_<#^3lxvypl)n?NM&+$ikaWd%N z@Cx@ke24e*koez{Vq71S5)4VZM#yBRLa_b5N9QWdnB61B_F64+U8<+P#-<@} z{WT>NdG~^_&FCeKAoSwZXU}WCAzC)~@Np|=;TaNa0ro&iwu6xIsa3 zj_0Kf`Q+Z-XjsAROWymPnT>iANlJ_{&+ZY2KKbWmfDskO4}nQ~Z>;|rN4I1%reD+u zFtdvtQlM2NK#p-H^xZ?Bl@eMp0Q zmt7Z?@cINTDx?fMMjh1Xk&wjwx#lvt?+0?<-@K)bn^w2+)}_r_GCL6j5>=dzMJ>MN zujwzxM!^;!v$j!FC#n~%yY>)2EG_5>85#^#eW2z?*>G{Fis|%;N0Y37`Hva|otx2& zMcMe~lT-UO8v?%<-w(m{Qx30n{p|~{^sxygobsq4F56o*H>b9P)`sW3J1+~zX3is@ z#L8Ep!a$X2SNtpeh}4t$ltT}CLcex+M_1R=wmqHCpvhUC(`ASaBhdFc%y6l--$UepTbu@^E)^suOMJu3=vv??F(iQXsJqvQLxjXLHf9e`X^ukGc`DYA&;F1s6gRA_Flnb^_33F9XkTFTD&R|iA}kSDE; zB!py;uaH~U2YjBq`0No&~uE< z4g@`x{#FH%2CO&8&nPvO;dJSlfD;&Y?8-o&h8O<2g5uIgVBKTtXTodmyI8kc9Z>qY zIX+bJ!5{YI;=0@33k5&EbADGyj| zF3~~|r$)ZNrfX-12FnfK_)oC{e~oc4((9qo7msgtOlDjo);l_XO)i}34=x?N@U$ak z&~EPBG;I9MR@(TXZ058|beGK6?)7Wca5A5@X&JX0Ww{RMwwoB&QpmU>W(|SknSA^Qcs@Y z3zsEwNm4XF;5%Oy-Gj48UM0Ip7?hEd=Wzq_pB7Z{S=2jyl4Xn`EQ>)~@W3)W+e}9a zyF<4=0wUEZRjcJojtZMzZ`m`v=FgXSBSEiMTy_^fIEm|IN3xmSR^WT&y?Ze^nk9Zb zkjrzyve1P@-5d87H@XY3f&Sx1RP0!RB%y&6-si9=AI7IA^WH;Okm`WGZBNaUrb93j z=6vyKli|09msUzIj6R)u^IjMrww;E;d__e?6P;*9=UM{KVS+nN8j3P=Ra+jn0v=az zS`5AmGx-b&44XRy5^9YdXtBQLu&Qxso)DL>6y{q)inaGBFYbRR$a|`lA%6CFemt#m zkvKftCUiHqd@h%iW8`x?I+siJCzp3Ucgb(WA3m(xsU-^|Ma;WO>GhLu9)b2E*w*pV zH5x%k*wN(NzVhpP8uy6XvZK6T*-T!~G=~Fzg$R(h&e=wtN_0lXdrP2xA{^WT>BJ!~AqtLqG5RGtOub2_x zi(SkfLInKFAtb#U0r?p|0+?7pKYXw^e`n)0v)6LnwfE%5VUO|-@hFS3VdK5`!8S>o z#~xrN_KUg%p{*|L-*{3vYj?s7NoPFwyfL37(MxGDL?DtY#n1f9LH-dbuP!%lclvNg z$vX?Wz#TL%U0Lt^oJdGN_wX@(xZY@cvGmHRl#=+l)i^O0n%BLO{kfZ|Zb|=OTA$kz zEp!maW^3I&l&9IxXTuq0(E`V=MdvCFe3xC9u2RkF(oVo`K}*)Ivk^nyKABqUT7DUw z%?*(KE<0cD`K{6hc&7c*O5xjelshfHvWzNXC+RGmnLF3p16tY|D1KO<%Yb=t@FLlT zi_RUoQknFjz@%Hu5fPoQN&R{J(tJElhr4S~;Hq8k{=)zw<<^Rfh_DobMXp9q_`NW_ z*15t1M0MRJrgEFM8jLYh7?7{NWH?ZHTk8swx8oBoe76Ifn!Fjk6q)1DZxWVK(R~vX znZvH%vfe>zpTY>KGwa6EQT69ktiNH;=Bo|Vw8gxjv_Fl8O%&n?bG~+|1 zL!K~_Rs}ryl5d30z~YrfgNgU|@aZRh#_m`Bjy^|{mJ>O)IN%fU#V!~yh~%20k`i3-=0F7Lwdj;6Z8BHI z|8!Pl`Jdj$4ks#%v-wmR+$m>dd{-*z-|zW%1UV&)^on6OU_4_F!MlGO)4z@@k)Rms z04(TPP9zbE@qZ2*`ImDF7S`yJB=TK27S{g~Z{otyCsIjdH()vJ5J8E z!mUxA5gTUsdj{qepSb5UoJC)a94MJZ)>uY26ZD9ReuZ}rw_Dt^lamM*qNAu$`|YA` zT^ZK-weZ`XvbeWbOlL!)cCk*cwdAr(Yq8+7`KXnXqZOU&tt!JF_!w_6Tw|j}^w=@# zJso%Vc*LG7dHd_a@7{&VJvDD%YF{7{Qg!$ENY~^KMf>AF2or@pyP}{EC9ZhZ>AhyI zrC3@uf2@j&U=vC+SmP;#mx(r5c;0YOux+IplLkL@e$yhFhrc)_7KY$DJWN)VsL}Se z@G)Q6oJ*x7m(x^em^j+fIXVviw7yMyi(NuD1c;X2-QDAr-}3LI-$_h&sxo&zf@H~ zunW_qFVlVa&B^;Vl_$Q|4>^IkzDrol*p=M;^uX;v!Apawe)FCgl~8XVACk^9)N%!! z7SCi%SbUmt^zrK#xiO7~Jv*yU-+EbTX6h}GLruH75KSXr50iXsGFmJ?;`qxSKOs5t zuDiDM-wSj0TwR|lloBGtQ6DorPD2xHfZ|bJ$+kil9T^k_?hNmiPxD=9x2eD?-!Gb{ zTtw^k$*rAwmW=A2o`0}8ttcJ&bkR?LJ`@4_G%ha?RoKBtzFyALz}n+E)6aaAMp-;_ zzz&7I_avo>95|pxE#6IEP+niOH}+mfaG+!04$^vBRZxa2R@VwnqMI_4`KCPZiDDA$ z!b5}2iC<0C+_*IU-n2e#Pu*Mmfy-@-$nXYDXL7E}lD3U+=rY7k`>Qj@rEdiyW%L#y zVAwOu0Ly4-ZWnIa@z-gM8T5*W&JY$d?MA_N={H_O}l)F%tM@VEScn*em8?RmjO@1EBC?b5417}x=Ps(*R*F_CKR^YeLu8{BJAfyc<8v$e$;P`cSz9?D@o;yxNs_~9 za|cKB6;36htbfZ8C73bv#c_V3@%uWiilD3G=X^34u}gT@%VCo@=)BwbO`Am^n8f5p z>jA+KL&w9|#+&I;GM@?&sw$q$FYDZ^VbNc=>F)g(> ztsZmxLfcwtx=)1`gXIgQLk^$MH%q%bymYNjW;C^`Y8U?s4}P967aea-6gF#M+xcu* z$K5UdMv2xiI&V**Npf7o`Q3vUu>s4^G+nBct2`q7j6%BcIbo#&u;Ot}n+_o{U60H& zZ89}cuNs&4j0SXJvP{0=!-^?m4_=rpI2B$*&!$L-^+{&qrqNjXVK;%!v+o%X_1X=r%Ps7`mU3%{ytyG zYqq_iv6SPtJX$XSg8}AJtg=)7tA`;X1XvfBGsa&&5($r|$?+4YwX@-OuW5S;8D5M< ztpGcS2B+_qs{GWy`RFxpB958*alLh5)^qgASwXvjkrh+;C)F~Pp{>j{*@iH>%BNqEDS6)J;{Lv7o zpnS8yWil^rx(>I{LX+|5eor*DTQDqY>0q`gLV1LXBa@zz{s7!RG$8`toEK5w=1wx0 zK@0Ot)DGvbO(+=J={O+p*gU6MwS8|xKi+D@n>>4Mi$yr^ykp^7jBT^e$8(z8=&M`u z*EC@N;-GI#W4W4sX5M`Wg-DeFzo97qg1+0y4+-+GPKI&0sX2TVAwJ1TM>| zB4TUuHBZj8f2AMm-Xh=hnDk%@pRo;?v$5T@eCv2vKUROVv&qCipQBRBUKgw$Cz4X= zXrjxf6_P;vGQnjq9Vbw&$E{})I@lJfQfN9q9zIFCaMF)E_gnGXo{q^bXG!xx07nG$ zmysRzbpE-g9K1Z~KBXvo)nMCO_VImqk8xU^W%Ml_{FA8ma)Sj{>j1TS2VbpD_&!G% z0Xb_nWwPSn9*_#JjjWo@gLyu;Mug&^wSOyy%ii>>of#5BW~52>8$^YjktO9selP5Z z&l}u&Xv&`82+e|hgN*rI^e1po4*^h;zQ)f!B0<#~J{l1SbaA^RH z4R}Do{=;v*@FU*f7!8U0Rg3(hm=O^HuzqQCQ{%Gbu4s)joZC9-D_75K@u+LUhfJ(C z$aARQqHxHoqzu}aY@Gv z-~M6a0M{G&&ap2(taW^PyBLLhEEjMmQEDIk#KSB0`&Zrz_c@g^8tAWmOM3Y}zD}JE zymrcV_9h6fIWV~?NLe8CHBEqyvR{EZ+PKt7JQSEfgNbhX;+$QJ|II-kISOQtWAHU% z#?I&_Msg{=bNcOnFgy+3nlF~Ho;jXSq23!)dnP*Oo{~LHbQnXV|EN`bScP8tkF-D;*E5G`eVZA-dnCt2Q>+Xr>8|M=jHx82Ol2?0OG>w|=93w{=+9 zCsK9jMY$<&o%n1L7JL{*Oj3aLJhYi_>gt3V`Exqnd5C;2O$z3}o7T><;fJgVn`CVibVV?T%O8V>;#(F|Ixc++FE#afeX%Mm zLj$_)(w2g7e)E0<9)=`S-UqIehVc)6JV;mGuL}+SJ;*n;9mVkZAfjfqxurYt=CP^u zos#I@-K>Ow*?!;~OwJTru*rp`lBzWrjEuVsn+nB^?6D+~Cua%@)^(#aU!t4P*Nk=+9m%$5>JrLd@=Xn_ECfC;o!xV7{NZqL8pQjJ@ecDR>5@yS(3?VFvIxa3O?b{;2((gzpWR0`Tb0gB9tdtTN}Ra!Tk z-GKjfNwI7u;@le%w`upp;}8~A#Q&22V>H;=C%X`n%_T2@ug&EB&iO*E;viJj|JhL6 z?elB(PHq@YI{VGzsw8U^KY0gnSMs=-ZlD!_{|Tl8R03||Z~ghgW~)jRxFd}zWzsQ5 z&&*@nH1e7!_&7w;duAwbuVoi@4-UQs3cb}I`HMWC=Zp7Bs=r33Y89twyWQh3RoutXP`LTC$06hvijjNxOg&oq(ZqDRYjP=EauuaqAn-$8_n z{$cl?(_}%AMy_bmVV#PUo1VutyeYcVO zV=i~m@5h3DwsdjOa56eho9m4IISRGI-6}NQt%yBf zjXls>OM-1V+*=w>L%hgWo0*9Y510;-*$aI=O$>t`WU-2l9YS_}17^qB%Oq<-9g4d6$+zB^g z4hbkpHaA(GN0jEfDz(*kztcF!W~@7#wUSD55dO)i@$Qk<<@{JGN|OvbbjvG4Ysokq z#&K1rZk;)Uovq1&qYF%`}>&oF{+m7wv|{~5$r0b3thKE*@q2mfiRZD zQ=b@0rzk-NxW)LhL_SHy`y_aoERza=OvCgolv0~RpVS&RLt2fTmvsre=m0!VjG#NE z4U%JyQOaL*@Z9g^o^PFOxhCAbK5utBTV3!o_5#_f?wXdXoL_QuXM(5RK53$Yfx&dw zC>-Xvv7ti5!-Px2gt4I%OBEE&H&-&JU4qR4@XrUgk0NC9$Cp225-foqn6YaJ&*@~# zxwy}D<)q&`s`Wv<4|~T`*~;*A*GQOoRU5f{>te)G7GPO-K9SR_zCmI%w} zK5Y`N+?`m6u@MOlDBA@U_ARzN6!d??34>KsxO5dwphycteE=0 z%;Mg?JXOc=;-cJIP*$x|Wo;x)=o2YU*q)%8g3{nlT9o7u6APF;4d7sYfNtO3XhqQ8 z4n62Cvdb#6=H6}GGNyQ;d8-z0)}b4%_WGQAu`u5!Tqf8jsA12C0)@*Dv2cT>ukU$) zByZii0W3`N`aY^Z-sLr74|#!!M_Y`9N*%Cg%*)Z7?B&*z1GTFOWlQj2U;3vPy{qiM zHh+edmNuOZM;Q!$O?h?2a%eZ7%+EofW6p`fKb+~S6e&ex&vH#H9DB_W0zYoq6o#P*D@=N#Bx^>2*RD31;k^*1tJ zT-f(qLXZ7)Ei$qt>l&u~6q5N6eKlE?=>ak@c8NN6y0Ew~(_ka1p2D zvpV&U@hb9`%W>ThmQf-1-!%30CrjVq%Zxb@vf0n_)d1`CeSDT5+c>&$DJ4WJ%a+_a z@$M*SQiQ zw|(?-_$_n1TY;i;<2GLfEW2Z{CjYAzpz4>TAlsQx-ME_b6ouMQEYDm%rmAelidbe*YfOLaYiFU9~rNL0mzr+R- zj|SgH(Xfv`2L9BdgHEmlr(2q4xj|wQv+3MgcfkizeOw;BBG#EckvC*NHmgRHW`Eks z($nC5<*}M!i5=Toev2qCuXFNc9#h=`K}$*~&iuLPj(OQA{*}k_$aD<#vNV6CvZ;VD zYafNKcr&bUYzwZ$-t_X#n=lpUPfO5QO&8&f3lj#V%?D27A275}56940CWk;+kmvk3 zDT(3^8!cAL$xq#9`J--Y$(f6znb$NRy$U3oxB|=YP%ysZV$b)x%q(V0l~F7(fB-%Z6S7~#?l7rn zl+qHi1&cQ4Dj7bsd&W3>O}G}0T!j2DQ&Uq5qBt^f0|duNvMW>A@Fo9naw#yrQd2q$ z*&f)!urSMIVP&UE1}fxt%D$#WroyACTT-<||3XVY@zU#AE)ty1?z_|2>u{=OlBH?l zdeLH{N(jCau*1JSkByUv69oMj641NJtU*p)8>0W~ai6pbY$Y7n?O-9p?y*#T0f!$V zLbuDxwTkJh42nc(ex(i7s_C&-ZNs&F^nUZK(m7Rh@n2YO&mO4;oLArFcv8pxkzzF? zL^dZw;8pQEkqFC|KaY0Omw+V)K5y5!7X~_agTE;wMiUn~mhYaYWQX(Q98OesfT>uJ z8}pTu0O2)K>&wx3;|xh$j5bOMC5PfSzk7p^R6-{+a^=<4k=)(~)U|uf-O=**84}Bo zYKTiejWo)0>4_k%$1fuldauP+lBp(7$+Uh96gWOmB3`D|mk)bh^L$!YT$VEL*>Rk7 zaZ(gF2LAjK>`Wn=yN7y0GB<&g_1l4x=9<=Ms_@{C4@Z+2z!GrrOBHBO1}gZ&93vw9 z>?=`?yGaP5XJ&s&Hh&-=^ie)a`eL}*7x~1>Ivy?X5bqPLwFQpw15E8a4KJqvd@aQB z)J@+-Z>08Njww&$QXej~2)#YqO2TXlXo0UdYSl{Cxt@gNpHBQ#&!02b3D16z(yFP( zFB@fW7o{?G#fWu&{RLs)N)WGlADHg(nJxB4Bb~Qw<|fbwk$w8D*J|jvQzg6TXpdV| z^`6hc-ih2l9;;)_RejDQ+dQVs0)`!?#ZL)i%b(qKT`i^;TYScUVP|$2?Fpqsp@FIn0%h|Yn?*SGRorhy` zYSAR%R$!`%YP&oyaN`T-08Gy%u#YR+c4wVg zyU!>xpNew ztjn6v4KIGy*dHw2CL=c!@~$VZuv9E&@Y z^?B`jh8&MzL&#a3Y?|;K(yF>`4M?s+;Oe~oha}{GY%kDQ)hKY1?xCy}yIY1W7ew1X zo%sfj!eP{kMnP6suElb^xnYrm@sjw$9Oh{f!-+K*rhK(zSEE=I98+eMOJfJ~K~HcD z**>dJ1mj+cy#ymKRvmqoN&MC2-AnWPyme$;_t|QvCj%)H@A{M}gcEaNK+)-GZg&!f zGGk#0#^nUXo1((*sWuc+(bFs?rL`@rJHyNb+jA!6y>)&y=g1(^NSks+^%HftgirHr|%%*?kgK<;*@!Ml%1l=aVu_;>An$ zHW{6=-dLIqxSl6oL=7%;;nt;RG=mvCaw6$n6(;%iTkCe@*&c|!7R=8^SiuCDt@)DP zd@egnSII+{xQzxFc1_Mg>&MEz=T2_Bb&2*nRW*zI@Th2cW&oQLVFy>(EudQnVyj*H zI`uY`YFyz~K+j5S6X`ATfVP1~W}6Xf_}5hUp@@?oNDBPU2vdAJfC3wya$!}J(qep$ z$KC@n4mmDrxl%$M50@5!dTZTtc<(U1_$}G^hlao@@QIf_F*7?O1b5m?ttG>#?S2OD z-Sr|9U&rW`m^gSNJ~*f|-0(|k;kWtEUojfK8ZT?rdGrPYX5B;m%NIf3O0ADZLZ_fv zpm4HVX3?u$SCK%|_`_SrD>{e{5f<*-SG}5xE>rjHaJ8xIPMdhBZ|~RB@K`#RCo2LZ zz?eT7i&)TKyV~th@Jl{hMU4i;n5Y$IQJ`$^H5JE*4xcl|`cX;UV=Em6!t!X$SEpMm z+m7zuKR>9zKpay~<TLm-v2D7SQB*X%yoFQJ3zP7@jG#AG@#rc+? z07!JSR?rlaSw}7(2x%n@xDS|DwcEP3T2(R7;4o4~F%X5($1AoPySCao(Nl%CT2(OB zw&j;9F)v}=LM_)Rwx7BS+%=;sA1zKz;BiyDr9G9wb_)=@ZBP;H@K`~rmW1;OrZ11- z^;CN;jgZUA?aTSKIf%}Sg=Z*8%^9~m`m$`Sg(GZ4^{1Q4?%F}go1CpCc)FtPt3=!Y z>n3JB1~YT%(qtUSRMB)OAe zNlc%%V{ktc)zcCR6{~cbSzjL&FPjn8>({{|bD76+9+;KQYRU2Vem@aG_~VO|R{5wE zbVliAQa{L`%C)Y;A6Jax=PF|7+MxSH;fD7Oe|vyAGb}2bFu{JeGVB3o$)Xai#$nh; z-xM?BLgGan04b12MWspZ9a?QjW~=TT3JwKTn^!_aBQ+qRv7v5tYVObDLu5bQr{@SI zS7aziCn^?UOcD%cs0?bm#rUj)F+{E%d_U{>N)yFM6t>b#hRc+^erzhnCPIYEM2pQp zhRsNe7uvn#OD4rORKLO(-4#rq^37W&yxiHh&- z&8n4e%tSjLCe;ZAt95%CKcu)vhkIBz;`mZkg2gqHGH}53%f&_UjKWa8W=|eUKwR*5 zN0Km7P#1!lJS$&%2V?T}i(1-|va)vDhizNmVCxQkCVIjuFx}7PkU+ur!*8Xu{9v~N z@5hdn$0~xr#Y!+9HxTO2*YOZ&KEnOFwuiQ-;!18b0$Q9;fAvyazI6$vAZm=WYkXta z^YS$N!Cj@n6bIXkC_>t3&xZy3ub=gVNY!e8Djy?Q?G($yHd5F4=}tSa4deW_$juc! z!AiQe7jdJWC zoLj!e%eNT#mF)V-t_SLqOpfNL+*6oMjSihD!Cw%Tg&$Ia#3X=V+ueN_^fp7e>-Nze z7oizXY`uT2jUA^%P}v5FQ{r|{{aymlSGw>%lz}f)I>%JSPniH-I-yPlz|x<3FF%Kw zMSef&QS1u!h`*Cm%wxrpsQ`ufBt&Ux*Bnv`m>=o2S(-7Ro_)93%83@J!@^lVY)CxY z%8r!)uvEO#7ImrHy(dz&p?YBhY*pW2ijx@bqg8TGTymfc=xo($sr|>|KndhWT!!H{&&iW<(bFYyWb!Z2& z(`>*)J^(KbCJN&<=+G}{JJvTRzah%Y&a z-Q5lD+AUnEwoGTlwwK}QVk1UA7v(UYo!nk5?v*13nj--Q>3po3Tp|us0j1qr9zQ=( zSa0MvF3gHL>`Wk_Ew?`9k?~5G*qv`80M+J?$M8`;oSNjrLQSX8G z!R$UDr!)(!Sap zD!rp1US|396;2>Y#WRh=^QY`&ID~|@#F;S%FE_qwo_oF@RB>Czt>Y8_g1-pzY3-F9 zjm8ph>DCFXcnP1$%`MLop5N;HEYZx?=aCBs~kS_EyY(jvj|L#C%h zcSZc9jI#5b)FYmvhp7GIgMHZdbU))V6z_N=VW~S$e`NwV2qvyB{Hp+i2 zw$EqF!zG#~z{kNXK4#_oeD7+d&4LXTrcCQ)-fcoB+7hIe81XBkGRt*1RH6=W=Tk-M zbUdgvN}xgn8S^1C>ujT~96d;l~hjl(E3F-|`)Wnhl&ApF7_GRgPX4}abquex zGi9H>tXY$s;x@#pii#|bRwz zZutq|7O>1;>%Ooh4e7`ftG8FG)Tt0;^oF5 zZKk1De5pk>S*did?mRfa1r0V#uka?j$JvRAd{C#;CqemsvGYekF3pC0mYnDMRVz2{ zMgB!T_k%&g{IvsLzJg7a&)ffxsN(eQ+|S9E?6+HYSXAnTFk{3p-f%7&Cs| zpU}Dz9NNqe3&Q~Cz+8uiW+l{oR*8x2MhNEl&aqpaVJWm(UCi@Dq3L&~n_!ypb6<_3 z_XD59d+gr#y@ihsmNXDuv`IV!0eC1>jQsznC+(<9ae6O~c&AfJcRaz=S)wS>?a8 z0YGFyziSKyDRd-wqo>7Rr$2vu<=n-gk9sdZBaiw* zi1H(YHyQ4mLmp1CbHn;n@5*Roi{eH$JSb~d$Fx;EH|+F8`gIk*!YGAs2~ukgKc{*N z@)nn=CuzC5`Pl1bXjQ%Tj;rW5fcp7UP9&$f2M5x=>CvNROz#2|AcpB?DSx%Q&_VzdafAfX_fy~f<~^mo-HEC z$z@6e=HP0p>k}gOJs68$F7|AFC|2O3doXJw?g18@=Afn0u?^lqYmW-C)ur^zDyEw| zb=%YMsfJW_V=cUM8!_FuvZDLl-m8C69=Q* zVO*0O&62XrQMLScl7v-Nq8+k(+W@i>&woVYGdcY;XnBbs1`FfaL1K)_Z1ryo$i=(4 za`D44iSmAf&*nN-X6@KLEtGccjAF^SkP*(UroLKUz7!f7S)k(aP3=|2uP-Yyef&VV z0)_g|e~IOUv2MqIgqnU?$d;r5dKe&Lm=a(gV8ZHV!s{O9I|r>o(>Gg8yqtsDYe%~( zm68o}k{GYdz`$~{qQ^=UkcD&~c)hm;VnibdUN`#o?G%v6gbHK;e9|Nh4;APbqZ0=R z#j>mKM^|CXtDy_7@To76@{QP^balo9X6hnPIE9bJWh#2N29-{R=EgdA6_#u1f;=Ez zB6Wm#GeTY>^2i(w?$4PMdjv4}vGDc@2b!sZ&mdP)n-7=S+~{C$9i0P1|3j zyfms(5pz?t+GQDqAIPO9(RLNnG6~r;qF#%prKt`m#*V*uniQ!o0qE|7jPpY{)P@9OZ-WS2`l;^2_Oaxi+V_qQSeFB@+xf9C34U%Y^prc zysZ0M?f33ZfSq7rUR4nofM^Tb;i_HEIy`rEl|ns^k1%*6#a;{*v2W3LT~aRGvU zS8{SjJ+*uAG6+!4;T4~EK7aGIa(y3ew^Juhs3^_&@MT?+lM zk<(^9upF;itG$LXIJ~JNO8lF6RLlVHZBWK(fmE-QOK=SQ>9@>2wW0^~FAT>o)@5&BEX7nRmCqS*F>3Vk+OPyf2RjyP0FO#`o9Jb1e~nauEmu= z#tRy%CIYaXskeBAo#C)Q^>^BGF4Y*|3>6@fC;B8V8w(qv7~>tq>MU;G3|wZUC@pho-BEsvJBy2(@p9zTx998WRD;HuRz`qW68r_mdkL*%({0 zFiQ_V%AcHS6j`Z1m5V<+k8iG63;0fhVdIoPKLkxUDr554lM6XvQgXn2MPP~|v5LI! zf#I7H@`MrhXyhiOJ1>UF<&Jk}SQXK`y0LI62;SBZ4I47KN zKVMpu9~c#I`O+khu6zb7Zvldh`w8Fx_$#=`1sp`HGf$y&yr^adODyJHPu4_S-(T1W z#)#*ZtO{~X#uaY~F9!I7V-yR-h$a7DwoU|I7n16NNs^S$;N~rKV_0PY7#vZHsHpy0 z5%C?6tUEkGR@8^Pcq^;)Jrk;ZpHMsv-L6Gj@&p3h8X`0{fpkADK=3olPTmUpxoYvc zToWmmbV_NOr*)FnV1vV&K>LW5+(1d^)-6B)a1kG)F{vZup>Hq-6ti)fX*RO} z016Ka>CwD$==*?2#VRMMa&%qIeT*LzAONU@n;jg9_#V$x5DA>bI5b?Zo!Q2V=}~myqKCDaP+!L z$qz~!hQgz;>PRg@1nR9kby|=o>go1p6O*0~ZEYva|Eu8gwtS?=0(MndS+}Oge%*Km^^E8L*ETp0%9w=s~{) z)IC?CPZa2{2foXOwi!<=xUO9o zYo2%t;+NLq2zwG|)EvDbVIDfL_RIr>1U4+@`zL0)y$XSA)WH34ObMkJn@OJHk5{YJ zOY;XPTBPbSoct?V+~1a~6o#v1@N+p^Rp(=NTohfqFP%1ikU6>GN6qitNAFa1Qp{L{ zJnlfjrNAIe=t`E>%GHirZ$8r01ps8y zLjrKTGO$XhGK*WH8Bpf4^_3>vYGF{PfsoDBrO{y zNdBy_9k>Z)nC3X4g+C4Z&u#X+^2rsodh*UGlLH+=YZwclYscENVWE#;bp^0A{U+6-71)hTGrv{t$cPy_c9tlueJ7K*2xnC<s#6P~1ZFE3r^ zHXsTuzFbMGI&-YhO*`ZE6PGr&dW*wtrV_N4!^`V|ud@&Y{82K-izy1?dCJ0hbI3VF z&%c! zI^^NOjg-vo)~Ho*Fz(hn+VelxTz50~^N|ne{h*r1myfuy30nDOPE{b+s^)ddwu@B@ zS0LfzB0Hq(zPt5VU0C)f1sE$qsk%@Ao`1*l`pBIrcoT=3k+DyW|CV;f{Mt_%)pZVD zLD%M)v@|6exXw}MFxYQ-WEFy4aP`bcUV+FrM{M?qQaYiegXnOwka5{qm-Fv#AR*oP z9_B6qP}W_7mD!#UW_9ku{{Y%}-2u7T(eRbfQ4BF*)N!eNHcH&3+GL0Ytlz%|aDVXx zkLyCKDK;qSH%;EXv7CFNgiDMkXV}aDQX_yk0kM$e|N|MZlZEVxXabPiSo znmKOK%|bYySzF|uM6Ip+lsp2Izg=(ZRDqIm$E3*cQyXEN2WuEA`UNAX%J|}(&r7gj z=~;29Rzuvt(9c>y(U6;S`(LshqgrxJiKDib1DlSAGO@}%x?1`8sxK*AzF9H21LC#$ zO1q){jhZBGF56)W2GbGjbZ6$k(IDVp2v*z>uIP6>a3Ggpy4|EO^&EZzZC+#n2OkYE z{aw%MjCBiKm5S;u0O}SXY`qeSZ=QSc&TH>Q$TH}`+E9g5=JGtB6eV+buA2Z;|?p~Id!VN^C)?Rn@lJ+sMR@x8Nvv9 zY$H@!QlZ^%V;3qx_(9^xWc`%F`;xUCl0tMD4P<1tg(rfmzVH|tP<_sxfvio zJg)2_G%$DUnd*qHW^0W*Fh0JQ>c^I>>NuDH)5`yU~_ z;;=t(yd?IpvB6?euS8C=vyO}y0tIgLA1njlFA`)vUk46YRrU4l&BK7<%Om|UkP7<% z3ohB$quC$O*qE>5$_5@8 zNv(M);G5+{2wzg?TPtImFVo@fHJL)#+i@Rd6ivJ>E&1)o-leTmHTr+F0G3qG1=7_y zjw{8=6lFr7C%k~CUpr>#RxpC=<`BZ%011ch(X}k1o9TvHIE@Mq9eE&g$Q#f2EE*uJ zHn$kNHv2DGK{=ts7J-j)V?c0z!rvQLEO` z`Hqz&My|-PcVM+0kl%j{Ap!)S(lb1g;y9qXKhp9F(%>`k3Mfd|g>JS4;?NVblx_7I8G);h1t?mtj@TM#d?p092^4Z^-hHHHvguP#TdM&qE) zLyir^k3ZcLPKBS#pRNQ6NMC6TEC4T6bR_FS~qUR+Y>M{pmcO~$r;a2D)Z)?0s~70B$INr z7AlD~iSVxz?yp^BEDD9G&IrrI>9gJ(j-lh1wKi8K=$~lPy!tzqI61M=#zGBrsWo1$ zk=_rL2uykBy6^9TO*KAt_nFFz!2s)8wZErGkiHV>IG&wI&un=G2Fc!Cbh6UpA)PF) zDgTo%9Io2Ogf376QAnYi*|qs!S<_xa0BT>V4>hSLt7I@^9-CnC71iW^@{SmVYO;Uy zpE4|l;t~(rUzz=$x8KHNt5Qr-oC*8~6(CGf50I%QmlnDLE z6hVWwLgh}AG|bKseQ(2O-bRkPP=yKfHT51Fn+lSFi&Mtp>bJYEp}iCaT~|47(N(v- zdG|Dw#DQiv=l|Rm!{)9JQrapWSgJGKExFmA1I*(ivPXhu-+Lb5-Lf%IxGMu~9Nv-L zBSbh}Ak;j3bwV<`!$xWJJ;uhmnf3gpJPAmcT3f)R0M>|sw1Xk$ws3Cmu9USIGX62$ znEhGAEg2gq$;_Vc6c-vikDE-k^zb4E0~Q5j9NQEW2(%C6u3}k2S*rR&8pSV6dA|^2eAVWCRLXvLY%Jt_&}ml=;q6+fAXx)8wXm6L z!#781K}oEo%#-79s!zK>au*>7om4){*9<>aace5w05=8#`UWuh)XfkNBw@!j$jj&bJWQY+hb=YX4qix}B^ zVS=SgcJW-_M}tkMsslEkYSyALFMh+ZE-lecZVRkEzIsuN-$-)xZ2hB;;0+({our9H8Yr zZ&|va-!GP|awI15tIi)iczDzJITC+oL3Tq|H(YgzxWYRBdxYm8cB@_Tqww~QE4w^M z@<0XBRYG=J-EsTrXnK}WsIv~omT5_*GYHRw`i=nHvC(mW8f!e{(j8!nRU+GOKi7Gn znjN(iJT zn9Sw9TNxV6i>)gP_qrSkh8+~3Yk{wpAJ75b(v%Qf$xiMHGeP^6=yd+DcC#*xIxr}i zp(|gomh*amw$u#R&ZvWL7f`a=Fut61W(1nuz7bifKM69S4cP~}@an`R4T9#d6Zr3~ zFVZvb`8s6lZd*6)aY1R@fsbTK$~2-Yj8#Ird9y;oA7!ZT)8nrW*3icCOBofJ_V$(z zejE#p2Y~0Bb59PcIWMbr1;l`E$w4=(`dC!U}(2`VZ^U z?w?~eN>(tQFCK&TTXy6(zxxZAW1labr(gIy{Bo|}dWrAJSPAMtt1}&KM39Zl{p37u zWkibU2ja%VsIMK61)z3?WqU7=CtkAseaT@RrTkvvc09-qtY4^e8|%DbhdiG&BTH;h*P_2&kFFN=9|H7>1NN z{xe@Dea0rLjSg?RwdEGN2Md1qe)=E~zeRbUD&%0-;Jk3>{)X=V#>{M?O!pYMbSgYYae0)+HLymKM-O06;@Oz}!Y37>C z*ZO~UmH$}K1H7Y5KehzLd023K^wAzDxvV&$oh|kL3zXNao`JX4C28%n3L>gNQN| z%3KxXW6;E;SWUp!i5DsZaph5 zHqc|X1N74NtzQPbYA<|Ww|CwI-B!$FJI*scS*Yd-oft$L+I~R4qToVAIADA?o4c$_ zAGW4TV~3psyw1Gar#DVOM}a%i?Kzs_bJP8RC|Um1roRX7QFxT=a7hLrK`Pr{1|X#5 znB~b*5jELm_T+`()0b53$nzrsabhqfD=bGE++Z>!Kyzw1;ZWUD`@R>>-v3Wk5rNFa z`ar42^GSh?KEkx}$6o}gzJY#q@mQD5B%mTVmYaP$7zh4?2Wwvl11O_PTyV!KA0svf z(2d>2^e2!L=K>p@?xDrF%gzTlZwKy_?~jIjE_*4;=>Jzj`s9bF?@7SuYCdOfPtWo# zMC^Tj=64fELnE!c>v@-p$j)0QQ}F8p9S^q{;=Om05<;{23@X| z(o>#|$uIvt_FOdt8;=SH!CH0~{|KQlIR!JmQsHYBBqq(le8{03n`tnR4-^%!Ec88ZFP5tE4++XwlkdC5!NwGM@sD}ga8q42baj`V$b?ZMF5A=3i z7Dcq<-E~NQ!&QCeGNQvv-qn&L<0I6pXQn!Q;eQ46V9}Y6^lBFlL;D(SLL6|kV$DPS zU%WnbS2xN~hG{sdy>>PR^axpeIM`|Eu<-JyCBe{O=3Vlz>Iql)lJ)zs&*9!K4BMYx z^YZh)Ss$n8Q#b!Hd%>m@G5Q7y1rEr2v$@BlO=jky=QZaLE*ev9%!Eb z<^J&bgebqnhkB{KM||e#`#*QU>9xdfpbiA#;j7d%G6^+@DyHdeQ5kBUhUSJ5{CjO^t+5)Q)>wmfX1%dI&+I(>C04)eb>dSraH@SM>hSH85oa_+yPD<+f9n|Mu_aLbgbpQ> zvA5yE=2|e2`k@GAyGtCCG=r;YErao!VB1G!LLIC>|{02rj_j-P-zfKAC-w4La`_r85 z^!{zP26}}J^2!T}TUs*mDD*!j0zRjaCzY`ny+3HPNc~FnDb<#YFessC`uBPH6h}I1 zhLGC7`1;}P(9!URR>Piyih)DQy7jwAVJ8AzXGvzjKr|Vl;5y!^UR*>6 z-gkP^k=n~RJq}yE+)kW9ziBTEFf+*)%tL~eZF0U&^P8DdU>Tt6RU&bQ33qj=SE8*| z94Ca0w~?EgpK zfsPoWWZtdq*{Vj^Hg-7*DO8z-D^6?lVLViHJ2LO6?lC8PrV6Thr zz<)ZCz2l_k+!DaT3w(Bt>ksorLp)AhXG}P{%m!PP{tD5I1Fi|7<10VJ|E0GxypW(k zxDOX{g3c6FvPg9Hid^7lPwLq}$^z)CFQeJ&`yvT;x^qmqpS)#+#H4Y<^%s7hXHQSt z?Na`nyA0bFZ=*!e?+%^gXNiD}SakH5ih8Vu zb>MEGxt2|^eV{Wb*{WW;bV!)&&ovQ_lH!LKnr7zq-Yl|^3rS4=dM#u2-5jS*z7q>1 z^)#&7hYZB;ih)?z0T~d&e9W$mc7dGy;cy5+jqkFgKV{nv)fNMesP~`w5#;%=Qjp-` zpwm4(eR%Ngb-S*T?B$6Ts%+*yD!O#=A#=YNc3bX#t|c9*&DD0yl*U|Y#r_}p>dHd{ z66Wg&hB7kmHkeq7(q`g;h_#-$p(E8ePRJi2ZXb9;8fM;eYq@Sqhu%C2_T2+Rt~Nal zC69oXtpUG2}7xAy*Ca z%3y?EWLP--9VP^-c;rp6mJ! zY2K%rg-VGSldEI)WRt1-_ua@)eojg8ej)33C=Rf%OY@N+_j(dz9Zx<%9_oeb`qA`f`abq+cof;!vSGE94v=OHI;@ z;-n}|(E}=~F)sLar&z0oe>jjeFpt&0$yXckTbj^0Aqt?K?Aj#>yo6U9R{`ZHz^NU;;qeEsR zeW%T&C1%SfBBZf3F+_&tid@(ZFnIl>L7KD(qE$XxEqFne_yp zU3W-j1yD6~7!vEP@t18J(@D)A^c^#M@G2=6gYB(1%=M!<@6FsxAZ+~|H81*?-=Ryw zJ%YcJAQa3%G4wIweWCURmI#QV0vcw!jPDX-6TRkah1l$nJ^+Jmp7?J%dic5}fd0}- zaefYV_3J5XEpE8>bNJZV7NvDG9_@2Py}7KyEf5#rxVQMBNse5 z7ERo(ZI+(Hs^hz1xxF@=5N8*5*uP2`>UA3%3HwXKmXY;rYkP*hsjd=eM)q+BKH3=>&B}qE>5{;GI|Cvp7io z{ukzRj=Fh2W9~F1!N;t#ka}6TLbD`qY3WYnS$!ubx19<%(Ng8z-~CnpK$q5CFW4to zXw4W+6GLS#Z&i&es^H2btAU}4JUeDK{^q|k*n$lj(D4yH`}hHphgIx4@S zk|I#0gd2Gie6hr)I=cr25S<>odW5rRkAql`gV1v~5ji)3E}-47N>;IC;_28$Zns=V z;Zs^mktExU3cJ~IeerVdCI&Xi*@H8dwR2WVqOhtLIL8ERxq42Z#y5}(PSmhHEZostEQU3dbvIKcqQpH z+4#?q*_U5dzkdR?XeO0}f6PR+rJtrXMhH|8E?myfY@G*_c%k=xi4`5~-H)`TQZc*j z=Xx{8-7_xGU8uL`_UqE&=Gp7K*COqamE^~#Zz@lN^R>Bd?SJq0d5fJ}HqP=n2es!? z`(*5ZsD!wOM$6?o?KkIy5;O^(8KQ z=;PQ5UD$*5?S+l5%J*+PH`JgS?qgZW;37e|6RCt%;ajoGEBZ)so5q4G>zUdwJ*6|m z$<0d@81tylP|;RZeBo#-13w6YPu52R>gPK^0MGsY;O=@96>@iL-xPE&7@?Fq$(o(FXO z;+f0$%)6VF&)?>ry(@b4_5Lo`90kL~gL~Ade=99W!~VLy_v^1DI^#iaMOEMRiO>wm zpQZV}?eU-R{Z&7lISXRKc{f?O$K2*8@CbMG8wK&?kH#RY{30;rDzC2?9v>wd84-jQ zj|C8gt{ir60La5}*Qz(-Uv-)FEK%z)prHGPXRU^zZ#bk#Y4T+FV6I$$wnBf_MNE9s zwwd1BcTv+9kju20V@k`wFoG4I%L|-db?ZdAH^hM{<8hJd4Zi9ist^DEfRLPI!WWYz z7LR&7ID=EIBm%c5_(cX*kG}_lkfwYI_ZI_FPX_+^CttmEGE&J`NEe&0G~O`>B~LPI zD5S?s*@wMAzr%)<2mRVKsVi;)GcFL2LfS?xRY%2ekw$eenz~sw*ajU;K!qV^o0@&` zF+>`q+oXTKIbC`7w2^#|k>@LzgY5-lw0M=DEH*B;-<@Q^s+|z3ZgnC!z&~s`$UQu@ z9aenrvYy1_ODJC(f;b$(NT+%hB?CGQprW5YNAl=pCH6%Nsb0p~o&SzgNYCZuN+}y= zo^H*_HN~WgGwpBrSo#MaIcTgrYu8{E=uDZBGI?y9M-C67Ij4dPfgHGDwkqP}2xK+FZptrx|H;u_Otaj>r)~;Yl^I!|# zJN^*R*0*?{Pttx!B^xiCVUcvRSi$@zpNL4gb3b7$Hyz5^3chNK!?VKscZm$kjS}ZC zybV%`8%yH;@+F3Q;qU5|XMC%(7c2uxUC65U@<($Auk1SnTdT5?$E`5@`!W^zFIyz9 zP}6^wkg9Ou`^(`_8x#|%APxaT=r^pRgh{HCK(jBYYhHqqEJHznh9tO?N+u5&2~nmA zSy5Jv_>5`z<`fA$(N2>VKF!;C=l+W*|7WPnK-6U$>bf0-83m5V#E2>tN{>?n+p|P@ z3PwrCzbJ_6p)TBa=lai=cI^o6X_8RrqL!VaPr381>-60Hd&xyO|%X z62*P63|wUC97Wq*mD|+)T^iFJ`Wvlv|8e_JJmdx%5A1E>p0!D%f}txI@g*2az|tpz zZ*?#S6X@~q-BPPU^4}d*EgX%fneXrvDpgFuQCB*UArgr5+Kz(nG_UnE3nLXmj0Lvg zGO(cpN}%rVDSKReOUU=46$hUOmQ|Cr_mVR}*5poTEauA5pkC(Ewj8os__2ijd=hOj z{dbPQ3`+rA6x}i5$2t}T&YN6&HYz~^$3)Ay$$#|}f8nzUnkM52 z$@w%WG9XE^As{J)Rh*Bh%EQk3V-QR#RF3>pUNUjlGW52Ao4n$;CWtJ}1vd=qKAuQr@ zsWf<3QzBz%iaqiIH3G9-(T4GLIzO6cYu=41g7B&MVPVg?P1Ue&sX{JiPR||h?`^D$ zON6L56Tp@FWf$u^ZkF!0b$9dY4MfX++ddG)`ZKE99S~$&;mBz9UUgwzm{E;%N$;922rt>u%a z7WI4|ixvkWp!^CokaeO{VNk_{#(mR4AepU^%q$QVczD<&^z5a|jQ^trK$AremPMD5 zMR!!)3SGwO99{VMb2Rbbf&`Rk3x6N1s1RHm4^33WQSMo>1}?0|j1ME)*+{_0)pBa4g^m`GJyT(B)0$c_9@D_h{Ln?RdjKiN(J+ z=jZ#(4?c!fw+-jv7wl>@dk1>{KQ@vg9rXzV*8V0G-onCO|N8gklVVf9KLWT^;q(-H zv-!P3^ASNolRBO>W1M=A?asZ;(8k-&hQ+%guU*%@r|sVFST%FL7<_A2~XDWpz9qdLj1dWj+1P1q?cVK}TMM>j_*@LS-Q35v$lM}Jf0wJ4- zg&vQY{9&+=6EIVsu#$fzk^6nXiTP@>^Ld!ut!MXVru@$>vD%NUM0v!4S5V@P$QI4U_hLvLV(w!WM;XTCxS(l!+bP8D!_UBjLUug(D>{Y;Lcz^My( z$m5q*lFV{rSKaS{3qoydaQRyCTTLW~uRZkNOVh-bzEB|A>F@N@cfQMR1}wm7r@2*Y zyWBig(y@en#FP)BuGeLrvt!4v+pLEjqyM%rW-cZf5w}&K^8{vMtz}HW*LD%zUm;PF$6~vC&vhN)1yft^f8zu zxL9CZEE0WOYz##dHUgYbPi*wt5-nqab%3OC7?1WAucMkqRHDTXIFBDXTNX&I&n z;(RggWAp*I;|-_@N?g55sO~S8m{uRk1-Fhn?2gkMCV98-XXVTPFZTXdH5@&oLOg`$ z5jI%oaXV9X)2<$_Rq}6r(CFMpDn3|!3gY~ojorQ<;|W(99S=;4gS|IN^F!wODlfG$ z!4FDsohr!-x zr?AJpfk8nc_0n*U(+oX5^n|SMoyrm)x`e11G8A~pw+D~fo$qs-l_!BiLDjEsXYm?) z;6T;Jg`0n8{PZ*>z}=#A%cVWn`0|@c>-+%|p6zdm1cH4{KwG9D9`-IAtjXES0a&ds ziwPEybvC?T7`)1h$rsTiX=j>@P>)q4m|=5$rEwg{YBlB^E>&@nwg$95 z=PyMpZayd-pC-HN9TEw>0_CY|s)WY85IyKKLV2q8$=}%;9E@;|h7<7F*`}XT4qyL% zLg#{w0)5p z@1FvW14#G1VGdlgCmDupuhIs2pQjG=vSJ9t%%WLEtIm-S@62Hx!Juf+-4}1q`OwxuZw)xgR-LZ> zFNfEA*WE-(dE@0xbB+@T){Z&W#B?{qtF1F6;17}yo3GOl`wCafeP5#}&W~BcV~j|< z3%rJ5A;veDwnfnpLEeidD!W*^+=yi6E~b7=jHOXv6JPS;_F$GKMDjM;2v$+ zEKghQYEPVf+ndP#*fseBUETk<<{V+4F4DBgHuLqmWn!u7!Vs%6JHu!c;2 z2^Wx0_f4DFhQV6YEb} zCk&xHzRtP=ZU!sXFQ2{MVb1}(Q>H@=k7cr9zd1<5J%aallbniDChx?V;K?>HUo7(m z&u_lJR)i{4kr{gGzaRgb_?m(T4DqirJ69Q>Q${D#@=v|>xKd)?{9dzV8L@JDLzS$x zUei`RJ>%u2Y7wZPI=Kt+IUAX;!c?6D|1wJWKwQKduDy3qY|UUT7m^oUo$j%9|+ z>~pIOo8BHL*Z8I-UQvKQ1ZFa@vZ{j^cn(<lrr6jxiZMpk|e>e#v#B{5Cwb_DBbV5>=!vLvLun_Vv4DiHQ4kOxsE4O5hY8NU?& z4?F}|67&T&*wP*7rw=Qk!t7W*I9N!~lLM#*|E?XQlOW=OVthG{o(!SK(NPG_bz_I^ zDT0_jAzp!GLtd)T>?k`vmC+eC8Okw$Mu{rZh#<4e7FT_Kv59|3J$Rh5t>j$3P!-ArZ{dwYT^vQ-#v zsos`ccKfV5wEEfDC1^Des(o+D@&YaZ_*I>(*>~UVn)NRh8Hd!LgeAPt0Sb|&XXDv9 z*>y}=nllNysn6M+ltdfHKHAT@q}0if*Oe@D+J)03Yf)-u5BbkK3)PR)Jk^rO@9Ik$ zaCB7)<7Vrj{|F)KKS)q$Cdf7bP_R;ATx5B+11X~R9TzOwx{VLcE+02SVffNL{!4-@ zxTlTB8%qo?ENWNwC^Fh7H-3_yjZ`Iq`RT^Uyq0@-4>u`QWojIO@XnyA*&! zjWEL~cwl*~FxVowi|89Ys88M(ueDLZG9&emB5`H=B4X`p$g2XUYF)_UGkM^aw({6O z$>?{wu)+QJJ=T$3LSRE|#*)^z0)uw7Z~tt#f=StmvLe~TMT&o~5RekFFqW7+Z2#$* zSxF^MAe#!uq$%E2$zD!CvydXg;Vwtvk~sOi&Sf+9`aeKMx1+-8ICZl;Mq2t5= zg#Bu-T)}X|TA=7nH26=9krR9_G6}KuxiPtd&A~H+A(DB$A;EahI-c zU@+#b2Nj>>ItYC6W71UE*%^4fUJJ6~xy)tyIlT6?dC%q6gzKNM#`#d3P*eJ|09-Tx z=aVQk>pKbRj91~>KyYmYK8$||F1rNfa*n_BjIx>Szn#8xMCu?)+WEQcbH1)O7+05i z+_c*_KO?V0L=RH>J!Hl!Z^k;7_$PI3mY;cka0cGh_=+2rFhe54$iB$++P0JfhFkv< zS*R-xfqtX5V?K0dNP08bzno0c%)0!K<~62gpDpy6&_$y0J7`=cfh#2f-U6&a_bbo@ zuu}nu+x8(@<%R-T)GC{2T(gQ4rs8epwn`5~p<$dAeVZuHwO40TYGBU#tGkObI zJ9hemqk2Hnd_3c|!&&|k4wcRDNeo+7R@zJO;`|B@?r17uJ?Gr3jZKM>cqG@HE_;?c z9aN&tMWxosDfY>OfX7ex8$2iV)scQmt?BKt1bf)^^HnPUxLw;6RPEz95)28PJQ1s= z6vEZdYsyN|EKi>5aUXq6y?j$O!?li?lAyl%R#62+O_vikxGz1`@iIHV^5}V?w6@MV z`LEX-1#qaoCZihN5*wV%y&pGU1&@=R^a*b?ed)i)9$wtp4swp*A1r;}*R;`vhnHX5 zLUqj|zx-PHG9TFj(!ZYNlN4v=w0!pih7N`&|$2FxCNlFB4~%C{r?>lnqmkm!D34 zE6%>{`9OGUdtehV$Flt&9~nvdiOK%+uo5&DJ$TNEE=>`3yH1$&d@ludKII18{@)- z65Q^4?tj!%-Ba?LT`T0g>_<}pA$KgUJtlU5AE3+JH&a0m_LaYqo6L~$+32R{nT5F; zgcJwWtV=94OmAyXNOl3>(QkZ6wic%rCycHDCd^%GgvW{Xx&`kWn1hBRnUtjGW0z<& zGNu1%^irK%ts&zFOO=)FowAC1Ag7TL`?aF3>Nv~D11klR2VfQh;^*JOP!X(}Y>vs` z_)~Szd2Kx$1>XfF-C4c&?|MMv@E zU#Z2fk`qL-G&v~Muf3>WldpG>W8VOnur~lQ%o1`)V|dd2Cl@2lY)v}Q>HNa4DVy+f z=7L;v*J_bd2u__9nTHU%1WiOXL7{Q{>gS=Edk#e~?mX&9&Em)YH0d`iPH`2bDA{uM z16zu6mka^Pn)uf~w5xVBjV9%tR5R~Y%HAt;U=3>0U>iSAS7;WvdIBRZf)?1OKsne& z)sSmeDbTp*-0DA|3Tx5S`mFxA($T2Bk1*P=udah#{GwX|*LQYYc4M-mX5dgW?57|g z&b@*|TlioJ)5QOKbH+71o@k*!(0Q|Hm8eS>6PEM9=G3@gD$6B=y8{ZdsSf-w27~7y z{^lqfQ`h6WR}~Qz&#$x0D-M~WiT0V2vkoj3S)|v==MDzm} z){~pNmmDhQIJ6@rOttYb56OuWl2G?!3RQ zg5+%^s=8YBjWU@m7rf~D$ZB+d{XIFnMT2hX;N2=vk%?yFT8XNPFEPU=RFe9qDRrCp zB8r}q{>}fc5#7cUa4CuV`exc8ke?gsXd?h|x0&mE0Szb6#5=vS(S+qu^o@(D*`mMXW(kM0T9ygZ!= zGmSHgF)ZE$D3&krIMG?j{P_igeO5{m?|^YRL3#9L1} zUHeV@f0(A;oW-0}f?|^4Nl4t6?v{g$B6qFru&O!RB~QhSl-PVq3Qh!vG`Ze*VJ3X0LgIvkgXRtcRrnnh0aTE z^UI?c=&=xQI|7$UlgksDko% z;bc#Wpe-D)oOH!sIB>#u>fx{5vp!x#a3PIp-?9Xl^f259hJ#!yDFRKgXRcJqJ#Sz=fe)3&D2RT(AH-_Qf5XG2_hDB%-(RCNGko z9q7)^u+)At;8qwVZMTnIvwU+T(C6X14H5koaVqpKpFn7i{uliJBkC=HqWr%9aYdxN zk?!seLFw-9MjC0P1eWe@5F`YpQ@W8B>1Js~T43q_<^7rO??1Dn)dnCJ+C+!i_I14B&b}%$WbgaP$Z=tMsqA!nIxIs9Zk?KdT#_Zt zz$C=gur8MTdSy@k1s;mE>u>Adp>FIS?Wf>YA2j`M4Ifcw72pul^z!V7!xWg}tAh^l zS=mL^P4`aBVDt}@-j4zp%%cDNzSd-a%Qoi0E#K96+wmzq+fQG4+<4sSQ}#OIq>t<2 zKv$ox$@g&Gt}`5yz~3=GxAWrC2Jw_%|I(zbykY(xth5x~(NWgob%?5#O0+$Lp)rgu z_<61BRxRh}-+c>-^C{aIyPS{+1Y(l>zL}XOr0-Wk%EI=bo_Vrq0Cls4Jxp^|5t@o8 z%Z#lnj_bk{v7D3)>pP~~R2~&oM<~m-cCE)!0aEY(s_f$%`_o`4X&z|zgxMA_&x4@`3e{-|eit4P`!K5!-N}q`sz7aNcPVTK! zLhuXt^P-(eihRRxmbwbSMJ)xhHW)09sFr`XpeidMmP~? zEBgw7PlS$eSMe&EbUh4D?2*g2NMvwl}AkEqV^J ztm$3vUXr>+&8rMEE|al)ZKk0@BcvjYlOm0OpNx<`BdDmgSAs z4*{A+q7MdtJvzo$GMvef7#XOiuNluW za65tP0pt{l(7Q92t5T)(H$;)h*Tgbd@gw zxQaaomwKpatyHg%U)sP$vt^ZE-+mb{cz!2%)+)?-=uP_G*~d6303^=O{2y-4djC9B zuuVGGN^S}PiPis)7&i&4Ra-zH#L&^36)$9cOS@Sln^VhWGV%D}QI#8g#l5wJ z16f-AkT52*k@WD?%I+R~N^2G(fimc3Oj-JO!v{2_Dbixcm-7OeKf}&56p-fYTtxpS z23TV4?}_QvM8m9lBXgFK@#=?0S=AVyvS)b-k29b8zXs9K12wkqr?4rk&TDY|{GBou zebs@QVvf5*onSBYarMyJ|9X_8$N*c7?e8ap1!=L-&GQ1k=NQXk7KKjRsZyrZQ6;1i zwsa&F)|!fLzC4b#?^LhOQ(w`w?PSA3D zVK)HZ7C-^^P{GT|+rl3aNqvKA+cWoHN)qDpu@;vz`CBtm5I}W*-6BV|qJmPEf*zvn z%n>GkZ&Dl9f**+|rht0wcgHi7QSzlRc6nq&hAKBT+saiLNpTnrzc+NDW&ZI&>CWZ` zy z%GgV=Ox~x=s0w&ljV)ogu*Vfn92k2fw>C=NaucbCf0-k9_BS)qqIq|G(9oqXhFNKK z5-k!JQK8f<+iI#)qVa7x8xpzW1vsD`dYyQLzO%06KPie$W;j5xP?s4dZ}d$kiBZz4BSV3elI+q)o2A z6mn-x;7SScwM8g*L>_j;?$S?9c%H?cD{1sP=sn6cS`=kfcj?Gl zUbnebZE7WDKKs_5JGDdf0;3@4czG0sxS1by9760l-#!$_*iMUT55)@^`!)Lu_>_q7rLCFSn?W}2&yb6 zxCEiQQF92L@A5~bxVyfBReJ{pR|j4w!XCOFc--`#vy4u|ZXYkSNkwD6O86kAX^;lp zu8YUqca$;i83%Nbr=y}(;B!>qi&x+aR9KG!^MP#Vz9jvzBro=$J?1e<_@%WdH?tW$ zp~f(q6%Phu9eMdSJvj2W>&RmhFu~}A2S2Yq$OFeFjwU57;#(jH=<8YL)VX+x{NxMJBqp_jQYy)*KBYJLwbcp+`IVT&%(VE0ZV zJd8=S$Rn73#Og$1YTu_-FPd&Tns59|?U^V%i`@Q~sT7>K_*cJeB&sQ?U%}zM{D3xAOA1jU?)y-}?zQTVT_2BD>{ybo;n|x#XvuROB*WgrLBM69 zb}|yNK&JD#bn!eaQ1F3!UP8yKB0t(LTcsm z0mC34QRZ(4{0h1al{Je`(CetfXF|583dAa%A3II*%>T~|u+FLgN*^L>A=m)5zXf*6 zoQLsX)venC>JAh)df~*no5gB#G=MD2s)6hWv@0Fg^Sxqc%D{LYUihUI(P!VtEEJvB zb`V_Y8aLwlOEl->k<2FR?h$MFerlZ+DFVb29D-b8$7}bN+Pq#%_gB5dng-sRbwPTzpE$SRfL8Y~0m1Nw7C3oUJ3ARe+y$dp7Gvq`(}a+v$(a zGo4WTy*A`2s0H6eVzKY~`d`*RqT5Up{jQ%D|Y1U^ee!ISLVUVbU=1EMt$y#QxXJ^G3CP8e(Zh+LB+?%CUq>nNh zp#ihvVkJ%KU3JxhE1(TI;MQ|a?*WvjrQ6_t9Fat!T6UpCO9xh9J4w%i7ZxV}eM{G$ zo>d`Kv8Db@Qj>w>vXu7+h*K%(S5sh;~YYPU4+0R>V6Cz4NV)3EL9*{%HaB@yAeg$Q#|6z{X2d+E7IME zm-}Ve_|!$93WGF}C%q_Xe*d2{1SQbc6sM%lK|Diw$$j_mtijp>T-0 z-Enz%gKTz@S=;~{fHTPP#vQiP4zczoIP$@E8IN?$rz*M7CN?|twDO3PwI>c+Tzz)- zTMH=j3Lsgju_M~DL`-KZOz0=vIBkEz>Ej4GrC+<>5PS|I;_s+ujRyP1)IL_{Sz5-)Zo(s3*Ub*NpDC!j#k(HZw%tT4(m4OMdbZ!4 z#lWsP)_SW0?|Is9{$#wrzwrZWXgWg8Jn(6{atq9b;5PByp#!gtg3G%?62t>BuSpSw z8bkfXAgW@%6ympwIgA90rTZIB1wUs$q#JLW?CjFD=mJME!!#z54oeYarB{*-XVhWrbg_glq@3rq99#8_kgNVCG40?lBjr)&}*rDE% ziavWsaBIW{j^nE@@0{NuceQ;Dw0-)k>l?cR{;`-(wD{|l?u#iWf0z{o_+TP~I!mk7 zh$M7z@?%Iml6jT6hyg0}T87F|F<%48w5nn1zSOvK^DS)}HQZIPlQ0wT)bJ`=izq^d zmt%0GwBgoQQ%)mh;l);H%L~wjbYcCYmlzO>adSgy(zd9$HmbBX8RVy7wq z%+fQBA4ht-UeD*mxeFh1=<=Uv0#TK#s9T}Gm}XW!IEDvpi7?6Me`^*_-&y_9C`Kli zqRpRe$Lye`I}50$m`9azcD-tAmQ;q-Z{kLuAW7f(Xne`Q1bgeWULQH83Qe#imMsXu zqBP`InD{(i=`~BQs;x9Utp?BQe0IyZB!GO%Z?-d4n=~`Mza;fpU_UR1G}}lKQTtxx z%1y|>Ek`0zq)v9oBDn1Hy?f91oXN1KRp15436XEhIZS^fUigKrp+K4Vgnb@xl>C?e zY~FYoq|eA}cwbuS8Kz?Xydj5xxChY#py`M-s7zedpz3Vj)!7Wx*p}4U2Tw8A{n5|s z6V%yDPttTvLT20J?1y9A)*?#6klQaWbk*2~)JHCDL*A7zN+kDUg;C1u-p5Mw_d!cC zIwQ-z)(d_qJ>^*UBkRLF`lLsY$noA)Fb=k|_ki#|$w5DUPt@_oiZP4mObA11EL3kS z)F@t3j1ZE$M8{O@E@s6|dL~3}Hvn|i%P-YmJ!h;=Dpyk+5P;%4`W9&94ota!O;E}v z=)?V_6|r-L^%1;rdijWz!fL{w+^k_m_*zKw5Z88nq~k%(IZ6n{w_8`2;o!D&f|X4E zjlQS=BMQ)=J=k=zwokuCw%FZ9J#Cu=D6a1c-)kdm+T8jC~K4_*2(L&;OD`3-w@7L{m-QZKY;;VM(xHcwtJD5JA z?CuS|cTF6;>UuPe6(yDE?58qB>f37EJbpMjmt$h(zu~O4A7!9sKYFWjSb^hH&x9ff zC^_m{Wc4K}?%H4v`xjvisO71#l+`m1cLvl7DK#byNIrG;13$&G8U~P-)e~DF zpc=uWmuPw0G!kX0(V~uaC5a)x))s~~!CTy1b#e6tO$@Ksjv0bjt4^g66v`U{tWshqxuuBGwryp5O$% zuVrh0e1{wKYPI|JbI!%%kydYXf2BtiOI%S?g!QH2hn<{BUO{x`K@>f5eh4K~ME4zyn zgPs}HtJ_xoXU-U8?0vt?Kdnyen(v{&PE#WR!A7MSo=P{>rC7xZQlvH}cGIz#vIU0} z{9r3b%wsM+T;Irc&yT0d1?Iz|tvdQAj&Or81{TI_uoM-)bQaV>*)xJiX~T>}rvMws zg{T$5ljKC0vi1%To?dDcv75xR?-d(l!3}Lp{lJq53>v*U|BXk!Qt-}@WbO-3PmRmW zoxpqI+AKs}rF<}G(=dUcSytrn_S-BUg#gRKISXf)m0s`mx>wh&-JBusy6)kA#4|i@ zYtf%9nGMOpyMeWldKIw+W07Xt+@wa&(~0EYKF;w9?afYjQ#hAWS~D*oC${c)naajU9m4_5k%p!`|l7jg_3TVCC z!24AuR|gL`FBQ&+tGUSjHFR>-@*o2H@?`WEV$gD#Y6hg4qR`_bzUm#;W4;C|P1?GXQ5wm(o*M6TM08Ha_T)b3 z-u7+-alLPM5Uv8Byd-y_`G7L1o1avRPHO~5W0;XVVRdM}^TwJM7h9`fpr)-koFm}+ z)h;2udF|2GMbHC(_|d9VXa8Hm=qu~TYTsle*ExD*R(TSveso$~k{>@vzU=a!u(ri% z@UP4^DI`ON5^QR1T|=BwpivTqMkY6OkhUlsXST4CRy=2ha6h^T5rqvIY*vAo4KMDN zy#I;i4hx`aS7S7I8^(!UCL4CrPab;uAJX(`!0!)5ry&34`#xwOtWa9SdD76;b|QqN z9z?%Wx2z_DKW};81w$LCaoEMw296LDn&01_swj&2v>QLJM5ubbzXva5&pfpyB$BaZwp9SMi{lBjWcma1}93 zX&T6!)wQMGYcFdECC^30r5E*YmLEIv(2qW&2;p=WnB=E)*6~s$7a) zP0P%B(t3sr%Rlrl|3_{j>i$tJ84@Rb-sEI@f&CD{e_ha>U#?;B+ z=Y3Q*l6f`lV)|0Uf>eWgv9{D(;6<(_{YzY%v*SjJ@-qY>>whvC`k1Xd<-)bwS1ic; zG`;{%KyaipEw4Wyz#B87D#jL9KmLx5)b~TMEahD@ROHWV183Kj2RER2ECx~rz*)8y zppb5EeFiYBD1TWk*$?wy*@G?wbbyobqEGlFMPGgAsM24=6Jy>Ha+Oct!(`oZ4VMM! zBRDY~jr#E64p2bvd6E_!Udvqr-`rl0-|Z5`p7ZZUEONf&gEqRAcJjR>$Cv-B;t_HN z|2=lJ?rKF-V~k*vYUyc>u+|BQ;|(CGEIns91RIJD6N8x*1z5s-5f#4c4Ot`jCKnFl zh$*tI;9>XT3y^w|nFIhnW@XQ$JHzCGVqwXs|1Dpz+i<*_^k9KFj7ID{tE>0%{?Y%H zc;I=&k6qegcauzN$MyIgV0IujB)t_QOq~&{<3r9}mZ5WaD@5{!D@S;ie{%9$1M42} z2(pXcE0F{kp->R^@-eNjLP(?>KNC6AL?obWI=^eqUHTAT_4w}5V0c4E0`|^>6TkNr zKQn|0FIoriDk$b1+5Ai0<{Cp5fKq{(;3ar}CR#_gwCXF9L2i5R0s{Rd$gPJ(sl`Kol-SIB5=NUU`1`CGbsFwaL4*(4ZPN(wOCW9Gt-?E`99Aj zN@G{eFs7T(lrFTYe2KK|?%!0Ksig6LB}?~A#`DrUTrgS|y1ZGN6I1%&zPv@r052NI z`=V{fUb@W$p33yi6F{vN525qhoOzL*qVp0wZYbp~9WaKmZi$#kPhkJ0^NVZ$RYm&5 zZ@%szh2KeF#~OvGvi4$)OOB=1LPyOEm4jU@Q8Q~w&CO9b2T)GR_o~4ErcesGRtwoZ z9xeYv9g-X!(X92~3he${s3_Q^tb+C6EZV@Y^EZxEN_>ARJ+{Q7cV*qfY%Qfp_sv&c z2cb(ZL`c<7wLO3)Lr zSmFm_pM>hw zb+TeW6>nlxj1ne|FByS|4gIoeZwcrW$O%M+I+wVr$TubSlJ&bH3i;b>kV)0Bk{#%l zIdKYo_N2t4iY5P&RtPDQFx_(8N8r z)}l!y6}?uB>$WD6@tX<9o)T^)F^}_j)_eE4*c={uP``U^@5Ukv*baL;k0)BMm~cM5 z)jQ)a0F_Ud_o=QD>7Q?ckNj*%Yy59(6)FEOUvZ31*hxdM7f@~eCXCrt(>)*7_@*zws% zm8kcQPJcI{p~JW|%((9{5@djt+N(-h$&MZe%^t9V=5dUfJe+!U49ggwlnwBe^zioK zXr&vNij~Rc6N6l({lzD&y)I8g8-7o|p_oYS`Yx(8)yI3@s+OL643oGw+BG}B@EAW> zLvvI*^!M@U{L0ox>LhBqYi@h4tdDvrxmbE$k~Ta~6XYGbcyk75P}bVMi{lGQGJnLhK8HH7jl8AZ6#dV+tPG%G>e_UIZIh40U^W9X;Z|to%xnoK$KglZX6yvE z(71gr@%kC=dbKzmT<^(W>$Y@l%wgkS(ks8D9}4;q3|(M8d;~&gz>hizVRZmDc{To` z|Ff)i3Z|@qMhDaW!Cmgyq_xysp!aat47<af1aW}X% z5RC&ln)t=WS_SG;P-Qi5%!LpO>?yYh+4jci(}-p9ZEO+uGVsv8^q?si<82pL{3W@b z%LCm7pon0MmfL4I-tQ|r_yjYn@z5u-!Wn_HiR{~zgGE81gwHcXLhAQ8wcC-&`cnq$ zT0^)Q4AJH3I2SiEIH1tWrjApMN#W?mW80WKkY8D%`&~3XHP;xK@Jk*=yyX#|ddMtD zHX;I(zHps~GVgB{duDgCLBA1i#r5%Koh!aQ5`$($XrQK{7^{Kw*n-^B9(pyLyIeSz z+^?7RtMjiyjU@FB&S$i(-xV0mwaz~CZTwE*Mhwdy%%LWAA=ZonF`$aacJjj{3 z>a-fbI{JSA2J|ra)MN3V*)P3QsiYwtfH~t?icpCzVQfHcu%>U#IipzJ1{BttX>`AR zl(*vQpcw2MrzCem_dksv2lQ$hY3!gJA3ka( zB24YPUE#pO1NzM*)8j{jQ$R5V8hApaY@59YC}k_W`lgVH>u(sz|In^1P}vnU9+`^3 zt@S7o=OtU~QIFL2=#5+pI%JQ$rA$h$JrsZBJ1Pt|swbQ3v)-GQZ~4oN#$CU%Q|P-91Dc4|^D>Wyae?H(tq;&UY98Uwh{C=-Fz}?dXFboKn9IO1gy+P z%;VNEmIbU-iLPTK_`~Z9&W^UZHZpdl_{rvW3_!Jf9gs$bN;0j;SCA_}>ACzZj5nN% zkCEY8!qA-mj>_LpFd=6e1KS_41%jVz^957|%lKR+36=(NIQhQ>q>zsxT&=|Yp`IM2 zp4h1c+8q9VBa;=GbJ75j#!P`lJBA!g^=N*ehLjy#gbr*;w9tn-J+U|^zCz59u>RBM zA+j>u-JRPS8+&*w^TV9*s-4d--&+YCZ3PinzW5->(8KAKRW zZ{wcU3~w}~mI2f9=etWY;_n=eWIE4hH%IxGL+7GDxW5NF->N(sevw8@*f->8OOy|e zf?(ScJ@FG+L@nW8I4TpU!ocn{;HeNx(C^*rnrKis^-pDD(O)l;3}+?lnlyDd7ybWR z?4~qT5UNsR^bB%`Fau9sw_h%O{cq#BtY71Mv?}8%h;sXi3yMXG2c5{?ZHYg;=sX>N zj9TwJXVLr1-vX0Zzx1u97h^_#{u%RWJWKYv16a0)Y0xCY!DN)t$DjaR`)R+r`eVai z*tZCaJ*`0f|7m#x=j@QZu@Gj+OQqji;ON%;K#+3F3Y6uioV#!Htk1!Ob2!&#xu4dZ z$mHC@gXfJs$*~L=S1~s&jZ3A}WH-S|O4vI$Cjt9{Rw@Cr0#@=!m)At?`&yh0L9n&g zWY;Q(RO>_Jip^}~8zBS>d%#s+f;`^W#@eeBG69(!&PxeYKqn1;^jMl1%cF{uVJ z0c9Geg&KGk3`nq*CLEC%(c%10w!r>d#DAjyJ5}sPR4YEdYJ40}4OcCIMHRzUrLVn;`o$jQK|wqL#Y zc3-UR@z;8nH|3Lk=!y4L>*$Z9G~CFrKG&t(NO-w8_g8dJn>KVfGiqh1pgDHZF26*$ zB*6LNnm8w<&2L+O%W+2%ulSd*To!Be4!nXjau`m8(prSpV64_4Jl&pD=Z{Z%>1xaj zl%>{06W5}1#{nji+j_C$*|T?RApj7g5wby$%X#F1Z}g20)jy?YUq>C9J5z45R4JSV z@PR-1NucBUf<-VR+zVHV4o8nJN{>!T?}0{tsV}-12R&7R#}oi!*5(|oaLb(A0LoEy z%c<*h!jK3MSmVqs3I-tYJ;lL&#lgDM(kV`VSRuGtNTygkO?^(4(v+`%ro7!-I>04( z88fjP@M{$Dw;74~sv-~;pXB}pxIkVeGlon_Uj2$L3dOV zE;C>L*w`;OzEPIXt2C8speu;!z-p>$x4VG?itM#q0&K;!o??ZQ!5G&XU(pLJbDfLkPbgrA5a`+cVM$A)|d1Co1D@jE@`~K*u^3GuW{!7mT zC*9~!-^*@&zW!&7E%O#rePXOfrj_Tv`i^WLgPhC;LcDHzGC6A{Hf(%U)~SW=<8v95 zEWGfD!KAbVQ$OI~oZbE<4@KbePsJTLRu}%Z#mfz&r7|L6D3fRzC5Wnn_1y}nS6<4X z0e2lB_Ciq1pYs3<2ZDy5w?#o;aVI^*GIPQ5#D@V4Xr%~GCo^y%0DlshTs^HduAe=H zC))3Gu?V}+k9LxzJTjf^kmWf{&=_zC%-1o zM#^SWX)mi&YyYTNuI2d?%|Q}H~a>g|AYt;1SGJ#|G2A`$e2uWQc@$vkGN0?bqz zkuFK#uh7R{GfCdqMg{z`p2f?%y@p8eW3(~lnZ{YHT@{Ga^_~N{uvUxso5Zg@#YGf< zI3d~D3B%{*@G4Aw6T2LDulO2Nt6p=xz1>&t^4euVDhMre-J^S7g&`Zmyne6+8eR&(rke5DrDig;n zjCcwT8!||`kUysuFg+&!5K^%?_$p}x-KCB$aV;bPHKb~1xszsbAA~HWCaQz~G(y(_ zYl2?;lxk8c(vUagaHa(Cs;~O3^pVbs#bRUHiS)gTf@Y(ugvjPsCFXN6?!W59eiPwh zKMP^F!1iTB{m6hG!a?Kary#E(qx!X1b{=z1CZUo7umLlaunxb#mp z^C=ed(=!RYLMv(Z1uO_J>EGK+Ye;%P*40!of;n`csI^BNIKF(%(hXciFW6Ro#cTGevXNLY>0eXjfG0`-=Nu~ZyBmFs3G&r#Eq4DFB7^jJ z`lt}v4;6;atWOkEKcSx6h8m1AmeWDl3|4P;=^U`)MvSBxcAiRTMSl)WZek|5r75hGKhZ*9hUez zwz=wNzpw0v0#+zk3R^tKW+NWo3~kp8bq^YecXEgK!cwTtSuMYtgoR7$7ab9tK5UUX zAD6pERt}FWg}rBpphjI~`hz=9yuKt#voxy>`ZiyOc#K(5q_)E=4mK&MDjv29{%Nlf zJZdQ~T$DxM4ciPoCoMy{jOS7P;a4rukix*V?~$ZVd}7Tp=ls0MiIXuiRKIPO(G#}r zWX!=07cN;_EMLkQ=^O3v>@P%b>5g)>*OP~)F?CN8eD$0SY9#H86$_JVg%4whDf2b= z*`odW7KBy~3)hboeejDt6n|W^<}&MOZZ~J!%qs7p%va%{<5O`OMqn){gDERN_g9JM)WJ~scSppQ1J zANdz~|26AiYS}@7yh}gx_!p@{Bjy&|-dkxF0gDzdY=4hOz<@J-1~S*qvkYaVy)(LE zp0En6e2wrC3BhNbjGvI0!x&~&87R9W7X35Ua+8_GMy zSGw0|;oHa_&I6|sLTU9gY2h@<5$uV5im0^qDn}EPiHsH#nG!=fq=4y@YlVo}!EII0 zN(@t5vEyj3a42r<3^4MFQOBj_D{0rYa}xH%H3~XA<6JwUZP(b#>wHd{|F-Q8E+w>~ z`FZ2+Ds_gwj^G{+FO!CR!i!AQQEZYqH{ScF+NEH)-z}1#HdoxIkwhmY3@k8CLSK|r zDzu%9!JI!+(4|jbuaWmkxZZ+(uL9W-w7Tb68a3 z+fSlG(z_FzX<>}izcqwr1F=KT;CGen_Fo9K*AYomszaDExBdy!3Q9YzddWbQDDmjj zUCZLM6r_k5tt)WF=PLqey-EwuQLN_BoX%ZW1?Bl%k5lT2`L7Ef zp%q7Le=WcGgFbT!pJq@*x5S5)#sc6)7&Z!W7axuns(IR!A%1U~aIe2UR!Z`-L1{6t zs!~WUfoh@c6z9&~GVv zDcXl=IgmVfK8+1qpdKqU@>~_qu`okR+82@JOt6KS!}Oi)-E_Hi@k=xWU5 z-uza2W4}&JWd7M4?c#hQjMb6OAT9lA)xZAspTW`@p2=;7vhs>(Xl_%c=z#2NIh|jw z;^^xgYQ_F#=2?1cosVY{k{P`;H3h9)*ZB>)bbD_!QbzvHAHTWIp0{W4`xY z;>*wZajKYB{VIp@e|5O8aF$!F7R{1ybibOAJeUjyx!%S}Md~^`P3qg%0HFn%mlIW= zL2X#8RTTPS>~ya|C$#_ySI8gi%oW4u4yT~Ibt`Dd-owf0FwPf!aOjJ3`_fnX!^~2b zBX@jf{;9jV7l4Ai@m^`Yana;e94IYf#QvFBYZPRlvm#`&}FBcgvH)_|$AP4eTYZm*-QEw- z%jT1u$J?% z7JKRSI^^b3RYIy4wt=|JZUkTYzXCj%#VbLEryi-^TL0 z=quCbS+r7+LuUQLPGadb(t2*gPI7~tTCsL-f*bO(1hA-9+(&NWD(KPPkq%VQMY&c) z+6AB-r)f$drbxr5NZ)xx2eT;Hn{k)pe4u6B9c9YNP}=tEi-rdY2a;k%rm7qcjU_O{ zNa}HtEmlh#;24ws^v?u3HdfSdz_h5a;NgTX0nJqquUO zc9nUy(XrajFeQlWy=iQsP+xc)=`Zb|*}}{WY5VIQGdLPdCuFcxa0)MT6MO3D&;gk^ z-&XWe&RD;_iD%9j^J+g||`~vGh6`rT0sw)*EdWBu#D;DfC!i9#&q-{*V(h6+YkY?X5S7wx3x$_!3;4!a7N zC4AI(yZ`(`K)9vn;^L3f6V!7Tf7vbs>Wtbb$ZYh&hq$MobqH_;OG4hhEtNR2M1W3=_B92z+F|q1^tCyJ?tHC^mN@>-qq}h zz_unkDS}{0;@z{S6k2qrE{{DyVkddxH!0%%UDwTB@v3(h_qojly{`$4k;-_&UPuV0 zO&lYc^SM(x{VVQIkdLDHoI{S59_Bh(gl#;1A&X?%^&a=?akwut6A#e({l!>U0e{W^ z{X?Ja=&Z6s|3DB&WYlQk+7~sYtlHRdJ1wnib&{IhlN!B96KczwWDhwB-Zy(uNijy( ze)eoUq_C4@M=kX=Czk(0sGw@fJH3B3BPqcNY?~!vjIlkUE46T1Yf609^;~igIXZh4 z!Ug%ozft&RNV}(?o?A1BGhfRbyl5oK)IvtV)E|oE4xUf9@bRUJUZy61{#TWTzrk=H z#G{{~eciB>(MK{WLLDZL&*dNo1t}67o;~xWls}V@%50?7^3w0?cRm+VhTr(g)gPK# zHfalf)0tTQDd*2lm|T0A0JpBDSNl%EVq6JiquI=3g`&vMjA>9-ej-ZG5rf&zrhL zL3zl{!KnI=mF?CcfZOYfFaK#=3maam2x?0S>eHswjSc_lXQ?}~xNskIt8kO{?R}9# zT|RN|2Q|nr1MeTVC_U7?Pf*Navlq##Lv3!2rn@^WblU9f*JKUNM0n3f_ z8Ky1!TAG?7+5S!_4OfBL+7UlFQlVa$6u7wVKPwvKq=?_8zCy!1gSyYs`wGlU{ru{g zyN>#Fa!$RY^8di(Pw;;EoxRJsGnElBNtpyJRgp(iX0-E?sI>EBPn*i|dd{@xU%&3@ z@cN@MkP{GLV<`pQ2?(7rU$?}&=c`|bKi=IwKGz)z`gq)R>*>F>l!1W+t-jlKhb45~ z<~#*=0dSmE#hV&YedE8zvYbYQxbo|YQbNkK&5^c)>##7)G&YA?e#A^EbA$`55a~63 z_8X2|_LM;q54iC4ht>{3&k>(JTkQzlKO%#F2D^Ly^xWxKy?C`lUUOOFz6rO5*=#%% zT|h>lgNV>~R6mofJQ1S(d-(k@H zc;-cG972;kR40TSKxt^)C1CR9A*f`~b?5#~k>0%%y>^I*&W8Wvk?opX5n^k<$gQ=n zIoYd{@bidjuV7@Dkc%WuR9L7}!O_HqvY8C_7xJ=I3vO3ZVe^fa)ps_7@Qnh7uU!ts z5MSaBRQxljr5)X4q@H0eNGMhWl>sOVAj#6-7P(v0^RYgk@i!Cvwfpk-(KYopV1#d& z=tYN&>9lRaa;d|d7N6hXH>xl*{TZFLW-ea<8e02VpHN{f@eo89xg=udboS@rWMhV9wx8M0*sEuMDck<3bakL0IJDPKTfNspZEDz`e3b`vUIL^ansnjYhAIN z+g^B$o-U%slYGi(m4h6AjZy#7AtX4u$U~qkA4yjH?`;=rupu=;U{j>BECMJt%x%wp z-qeHe1W-VfkGLw`vZa=wFE{Bf$hvnf=A2ej#`-L{fQ>Sj6=0rT2Ss%NDEIG#?nbSM z0MZD5Loo4<9H5R#Wa2L!-|bWVs#B%7N#LXyAMJ(0nO-L?PT$};J176bj-ltqwwTWE z(SA#07>}0q$y3Py3>Wz&EHkp_agD70^)R(^Q*=7IVaf;vsxRr(6|mwJ84gE8kvBNk zO0;No_j5AypG<5VlEcWax4>*dFpkx0o6%c|*H`B9d1U`J=YQd&C}!G?t19-gxy<(> z0vy=6X$gT3p|E@L8xGj%Ny_Z}B`Wlm{GL+mUpY&Q@WTs`7PZ;4u{!;(jtV6NGdReZ zAZ1$S04i*Z-hoGEDohS?l8)JTz>dbc{8Pk5YACg$l%F<*Y2}dtQy1v9hW-!Fj&2wF z_~!ABGBpal*CKR{I}>_wCf@!Xv(U==I9EV}ofUss@!rI|Fn9P<{Yy`*N!&&& zH$nTHKQDw}UM1#ph;Fl2yq%zCgv-b0bd{1LK&upwFddWXE{<070W*%JS+k~noR|#a zgpX6|u=XQA@gcao4xqG**n+O}CrEiyH(Q4S5T@D(c_%Z~_K#)seXbeexGDr(6-pLw z(!W&QcEky$j}>1w(&dJNAJkYo%2dMFNm@0Yg0!ivSl1fw%$4+G&W?vRi z;#$A$YPsa8SA&P&%g4HCgrWM-r+U(#q6!_F?0}R7-MFRM6vu*Ht-%p=bCCcQe>ig4 zENJcO*t=MjfFT|SkRAK2-<||VJaVjD?IWIwJnp&tuOj5A4opA4)NI+IMutYCRmmcu zYMX~}!v~8#%b(FD=oO2N_6KyLx!Gd$n(qtYQu}HuQ7)!$2lb7p=I9^x(24Y#z-az3 zb!@wX;(o;Z8ChybTA_WHS5YWt0#^Q_ES*G4))bhaLoxm>SZ?L{;uOwR@s|x>OPmf3 zf>jHGqo2b9bBFmBf4Mn7GxR#?b=I4TsxZ(GmI?)(*dz8ng#O-{;F)s8vTM56kU1_O z<*q!jobm_+<>R~gn+RqX1gP7G0GIY>=j#NIC1I7a<_O_9{e?rM2Erz`o3I!Dk%L3_^3pFVo z6IJh?gDl}v)sH2gQ8AP;ml4LIV8z4qRV`#JZJ=vHrn^`U-o@HD$IC4i0bnD?>|m-l zzuqj<_<|^G`7XbNtAtnUJi3wRi9^NemAJpxtYewjT6fZ5{vF||j#BKeU`zZcpi~s8 zytXAi>KW8he73?@A$nu-86Wq+fNZ=&{LlvmK_0B%apbw@v&u0n#K3hM&u7>p`+&%9+-OLa?ei3HK4h}T7&?{7^W0lW0ECNPJ zsUqf(9VBz{C+5P@m$QAhdm|eE^|_1(ihT@LXW$mSbNgy=erMt9>Y%3@X@KKUnPzoW zB$C9%dt-2!j5C{+p{h;ulf+~@b|{MuTD1^o-3}9~ISv`C7JSqSyCSr&DAcw=eeB)m z2vl=p()w0G{9aPE7__Pqa+_ud+8MkXX3Q8bg$VlYtxoF8(nTGD$A z>g_111RUu!&aY459z6Ns3faTV>X4FNqthGrqPk;`5l8vY-njb&3d6ayBWZF*sMR3_ z^J`aX13v zU)t3MJU$L-KX%pXBAe&8^lFPo`5JhT=%Zo3@m}aQJk#WyuiHwMC?uWqzcyNv4yMC&Z~~&XOpo36i+2JgUQ2Le(F@)bywF3mH(y#uQl(E1rqe0+ou^z zrR01F#XLCVhh{Ly5!6VXtk3d!KXN4@Zdq`I&yy1A)qZm6iCpeovi}bd&bzFLs*%8+ zYLrh^uHMIH7w3&gP%z5mh9DNa*UV=;_amDi|FfLdjzi}E`sDCuqxknZjpQjr)G5eXRq0Rb5V1S!wv{l5QP=Remqj_~jdkM3CO-uJrK zTJNh7nZ2cl`_z2!s~0mYeO=>K5?*W3YTui_eid~*xj9Lpn7Z&S7L+OG+%^KvMhIVi z3r~GO`0O&%)!;~DI(#BV6;G_1+{1kg@YIxt9-~LU)EI$>uR}4m-MSf&Bf)fwIl}1T z8C*rU<=A^ne!L%|5L*8lLfNTuizNG`S?bkJJhI9?wjVPxNP?O(e=Wcb}b|%>*e{r|=33n66(jzl4=|sf(4PRY^xKFF^rrIyib^+j=;@u|M93H_bG3I-}KREedTb+VvP(H`fa_imo-tX@o=wk=Vk%kHAOc zy;E`T?dcIVn9hkcPSndhgGli?p49VD1^qY$#I=pXY8<$Of?SA`T>-uImV}Cq-zXaV zmNPZnLvqANE(nT=M`sULD*cILlf3D2N9|U`Wef3Io7kmcqj3&xVf5ne=GAb#b{nt2 zw)<1|$LZw)Wek5vHWLM&KC2N6WR~9d^iV4vsuGRh5gP8h8I&SV;tK=TaYh@Zo4N$C~aZ1-YT z=z!$%nKwvSz`y2?mGZ=C)L{8?CqF2KXg}qGJs(Sh7Yn2vcE<$ zhOTR-6t2B6uA(_y-rxbZCR^fSJr7`?u*frKH$luCFyp3zm3@Dj--hbc#1fgmKDN&W z%n!Xha!*vj5IuFa-zw8W^nD_B&dL33^*r}89x8o4ahbSUes%JO!5^ni(9vtq@UmkNKp z4!~t<#FW$RP0&9!u>G;O01NP&9!w;W5;M^;$@OdFvv5W}e=D3w>_OfB{&r*fA>%7H z<9Mu2t$IklW?J#kIV=^vntm&0CZoHky~x6d?PUU z_;2HQ_SkEVI7hK+?7mC+dPRa%`%2>WmcFohp?HZsD`>Biu2SpaC5U(JZOsbgJ|7so z6zkoyXf!i?82o&o*2}rcNFls#*LYT$*`SkYzFwO~)ER@4DtvY~*>mumgg9%5SQ=-2o$k`xBd`_ zFH~%hB)^}@*=&;0@3K?&vfN9OZUlXY1zMa9W~#x<)V-jyB=y`vklmhe`#?HD>n(|O zKByH$;N-W`8Ao86$sg3c-7p?`6Tt|p4b>sJ4h)ig*q!p^1Xz){(9utyJs%%uSUX+oI(mI*h6K=9YOy)6B+&U%2xMx|1G>8)3kI#Mpzl5(&fRg@k z;>`J>wT@ z@V%KEqf%HLqd&*H43((NbC=*X!4Or)XqBN}ouYB=Ev8masYqW74g2|pZJVp%j9?Lt zd5VV$x%eJW0nVFi;unlzNUk2pd;eFJ?Gv6cRKD(e43APyc?uKznHMfDolDXpYR+N_ zjp|wR6UrK$8C^Q$Tla5Sw~typD|&WaMUsZl5F9As9ko`XF+03FtcFiX<}kX433E!#Z`K9LQ>72VRKfUm)*K@u!ZUix zAmt4L4>~&d-rpve8~8-KTKw=cc8WgQ*(}AP{Mq1K913WM8+kHBFZhi#h)YLwf?$Ay zpO-3xg)^#}RDlVYkEaDuD=#h%BtYy{9RaHb~FO-_t2aFtc zTeO!eME%`R!>~5ngRIXB1)bG}Deu}$=O&~T6}@y@*$QSTYzIk-WL$d}(+p1PG%R;9 zd8#;O{62;Q+gm_VG364ko|$-`=9xUrC0*I)ldsR7yDvwW=yl75!`^QN#g3cb+u{>7 zN3H+*ny)!34BCe1)o)xW09V?ETThL!h(~>F%fv^C;oIhqByrT}lvn7GQ7e4nf2+p4T#L78ll@Konm_p$`)X>mtvQ=Lhzt5?nL1zZl zBo<(JtZSd|QgYA9SB`)mjxZ!WljRz-LT@R}<6`gPk|AuxDVo+7&BStQtV-zS@y1$AO0%S(0md2kE!m{<041?(WGPI ztvodE4M0`DTQNYeBafen6pL zJRok3rlg*B$x(hGT+OyUK^O&dVd3RTQFhi@W$;Xm-F*GmN8G>jeAE5Wtgm@lV@bUh z%_=cWy4Z<~2wPZgvN70z8gxbL^5TdxhsH7>LG}zois(fgS25yw7@Dvs@HbD$Ua+DX zZ=s7u?|;Ho3#BM8+7N6qM2IS>oY@_@IFb!>tAw}}+9#bQ;bRF6FPLO1etkAU%Ejsrjt|m9VSB=o^s&1dn*UP`w z``iy+PN1+D@D5)bh%VY!!g8=F(2LiFPQTJ6wDEzyqV_Z4?SZ0*Gfu>qTuzrUBC%H=eEcf@; ztJ2)Ka<4bt$&%AG{oCt0$^G3ni(%g5zb$W4zy-C4Csfdb zIQvFf!lb*^A;+6a=*_!mc9jOb*bqmkn-GDmyo??lbY-$!`OSmHz5#yt0WC$h2=q4@ zl>aDAVKVX(G&bRdR|aUJR*}Q)_^A7#SD!@BMM12}0c|#~Y$zz08PUrlkV>k3>`F_& zu2ehEmLBVUgI>UA8@_Xk^Sn7fJ-(dz&gCCj{--eZB;>+xeyV-w2 zd7`{>;=bQ5>OX%Zt%7SQ4*iJl+`0L4*noK2A@TNq-B#CA*!fJM>?xkD@qL&nGnW1j zFv6b35R%3v3AK}~A9|t~g`mYW1g(64xmIpO-phAm>Hb34 zRugZ`_u;dX1YF<-%g$SLk|trluOZ9&S44-#97+F^@O@{8Y&SN2SyhO)svuRPY~re3@i)Vz&ud%@C1jwrZxZ=xVcW4j?<{>?g{WjwEIR~K+CoDi>0HYD&cDLdo z^Q^vDju97Rv$0>Hj{JdR7s{l`l$Ivds z4?lEuW6pIZz_T%Jll(t3BP|5$D%x3p64hj}jblwG!wTmbV@~jVAqPvPu1 z7Xreh`>AqlyX0hJ(Uf4OlAhlEC&wHup9bs}tosci&*Wc=jfO);T94m<>mJoTF_>s^ z(Ff8Dh2N*%{uuJ}SULk(zjOO3Mc-jI8k@GiZSq((o9#JW_au2wL2JNH=9nJSP@AIp z`2Nr5zjIZl=2eCA-opX~;LsaRV3(Tcrx)zm@)Mxs_(P7JU=b>}aE#0&=+DzzY4`J0 z!e_BSoV&SQP;F>KZEkOP?hXmhpOY=alV?nli=zeKC;)Kz6X|+)*#iJ+94KRAGpV-m zotI}GMBjfNH`*z)dz${QukdCDJb~!BG_+uvss<*V$__KF@Q-LDRC)t>B}DMxp&p$) z&mTLtsYsxzieB8`F&8ZfR*IRCBt;a$IC^OOzy;gD>7-lDRfk*-Wje$*LhiwZ0W|`H zBaWQ9hJ*}p>3~imRj|S-?nn||#Kf$xcuW^UH{bARX2#oJHdK(t2_8?&lKaYW@y@hr zL`A}n=&3wW8M=7Zb??PfCX=1-#S_mf8@Gd4ymb@shOM_n=5=`b9JF9Rb?&8bv!!sC zT91FdpQ8s;re2T$Kt>lHrJaz{& zSPG_;ID))f_WAu~;w1!=AA}e7CAP%a+!&%CE4Qv4Dhocv7HSwZY!VI1xanWpfc|f4 z^`g?n9_~Ft@Bfx->%h_86X_GE(am$hHeRA_65GU4-}l3%0UYbz#qq;@F$?1_7@p{Y z{vYY`xswnKWqT$!SA3NIGH1cXX6AZ&@wsd zdxz~m;?5ZNrH6(TaVqA%x_?ebJ$t=xe084d+I5kh?X|J0u%n|lD#r2l_wpRQTi}l+ znxl={MfAyn>+RRJqRS@eSY|Aws^R8 zcHrgN+5t|!z%UaZYo4HOfmAY!;xR_psS}q$w>uDwfhY8#=ZUV+>a+G?W^k_-xJC^m zeKn@|df)MClWP%uTs-&+Nyf~kgZ2DyCBn)R;j8$9jKNOAE|=Wm1`>90<=SR(fMQbONFfp+K6(2k#yj=7Iz)&8 zX-tiX2(;J2E^xvdZQUW|1|C)U+wUY&W||iwJbw-#wl7jnH0dw~`Qg~S6}*v^?MP)u zVd&#@!Uhw3UwQ61w;zd`K-s8MLy;mw{;+rQPP|aam2OSqXX1)alTEJ(SE>spSPXsQ zFz~C>j&YmR3_Sa10w%V73JIWYV&>AG%C&fbavCZll{aDBL1CqpKT8ab(E*sxn620e z>E-QEHkRLP?f4&mNR(BRbmIZCRS;tr#yJLhyq(OZKxg?R0B&;m5`nB%)sP-&cZbI} zYm1MY-$plyX|cgiBjh?5=`8Z&A5`f=bNKDLqj)rdrg2X?ku(5DGZ+52f>%KRpdvk% zNRkjV#d$ieLcGwwt><3fu9MdzS+3YU0*Im3eUa@%JPj5v?j(o&s6BsgG8o?&a@srh zR5!hQ83dh~Ok_5_9BOKhde>ce+Hft8e@#i3!$Y0>@r4s+OfeBcRk zaQO1uKT?H%ewwn5Mz6#4I#A~p{c!qBmdw&Zpj<#@zu^Yb{U;gTM(~9H6GAHD| z?=PMns{}Q+3w#M#bNhWxC<7WXBl!ikm>bE+2Y+@iP zIb_o|@Y=R6JIYJ{8#{ToJG;*^cg8Q9FmKGWm19=sYlPI%dL&R`P%0Qf!Y>T1$72+) zoJl{_v1SP>Rk#1Qh;H^#6X@PB;=A?OJ#z(|Qm9f=aQ{=o$^1?GM-n&R5^v7gY6cd%OG8E5%U zKB!qd#cKY=Bj{gil>50o-N|$ndhIP`r}L*BtGTl9>DQ@5Tx1A4HuzuBep#AzCkPMLsx=TM)dd-UA)DQ5q*DwtqlWF=hB76>PBBC#^KY4WR{}Efj^fVIh zmQTY?|62WsPLB$eu-WXvv0G&FLGueDSdl_w{}ZkxjxQwpn|;kc0i~_-QxG$V*HVQD z<(qOB;9=2HfBgEfa4N(7+^tm|qIgO$D$33g_Alj*NrT+Wqd1p3Pjcv0z2`sD#(^*j z&;Hd&6<+g1(t!oBh_mqZjli3~*(6km;=jj(h_dh_qN|UJipeSg41+<()XdlMp6l_+ zp#;_!zn^<;&oE`Y#+JL-`L>?_?fk9|C&91&Gw2Di4y$z^W?~Wq<+>P#9l!LNYXH<) zwf?tfdmeI^Um#WT>LW>bbnsy)kYC+M00RLWPL&*;+mbmSoJL0l^4v}0Z_g9Gd;Q{r z_|+QG-MbuwCwev^4)}c93=)n+Pb|LW644NM`4d_4QN9}}cg z;53Z6_1;Fe0X04Xy3ON9A*c@c;d`mWAQ+`1ne12bQaXR>9{g`GklLq{D~$KO8u;;j{^Ttyf8*{kBvdX)0E$-{LuXrrA~ z5cz{hT9$k>%?!Ol|2qay;=6yy)kZQKtuBhd`ie8`W=aZeVtr|4 z2Kg4H=Q<>RCKvns+b&F;d~93cauF0wABeFyB0jrrkNjp z2o~8&@S*bg1j`NK5n;7)omZz7L@4jcJ@~Opnp%*Z8@=mPzSk3X|8HWreazerT1~0_ z91n6{vRu8p&o5Nx8+LdbYKe4JnrbIq6N;=R{ow_AbKizh9LW&5ZZ{91{6Ldm#0Dvn zdq{-2exbZ^4#7#_@wJ1O~%ib*f7psr}=%Iy4`y4b={;e}1>|&xuk?IWK>MyuVTktxeo#~<%g!qd-wOgaZsqqSz)tafuJT>A+E+dc6b&+69` zZ;bood*V8|*mp>4kYb)g;5m`5lD7|KJF?N)ugAA7lDh-Oi{KA|?Ws3RIsoJp>ET#& zLRa|e-QSFA?O_<^sR&?-0B<9vr1(EH3tXr4TGh1x&oU6oXb(g8t_obr*Z#Y*V5uT( zxLpcMHZmV&swhGJLcNnw?odidLCJgv&-Hpv~GA#^S3IBKR{D;&Haq;EKB4FNfYgHh8?bLn$u36Nb z7apq-lB*`>0ZSb~O11u~+bDdV& zo&2ZoH{VH9ASP2@9tY!sy)SPO|Mf8eN+)0<6Z8q=B>0~o%vWQ`B44B{1tLlwW@-ht zn~{idQS?c0!_bw=!!yC1u_9zqUxt1EJz>)R3%w&W2v8-o+s0>;;EX| zS-r_i&G=*gIpskoeC*}^&TvmWH{6BD)&nhF0J-QZ=qxi6zN;7_kTKkg4ElQcM9I-B zROM9!W~#<%saMCD$bVY2viDfj39|nh97=Z;pcK=Oq+cCSarBu(6#rgVmWcJv$qL6Q z-t1JOx5IBtG#r1M@-31M+~|?$1PFmw+U`CxlubiP)JB`YK=QJ(kd-cPf?Fqa=J5w+PK{V> z{DzUQf$}X5W-R{u!GzSFVgZ6mJu>UMB9l8gn%(%A9D*Ijc^4dD5vvy&H}&KQKwWQ? z8S0v!fm7S|84;ycZz{-5;uZ&zW1BMP-b#6WF9BC`4){hKDCmCB^}nF66oOh64ICuZ zbN(G1jytk%$zqU|AYHMd@0wtPPnf?{z7(C3QxBMt`28Ut@eSmakm90QUE1@6f==5N8Jp zDYeeYo^jQ{=LWBDk;eKIQlehMT zeqKO7#Rfn7Oq#^R6XlvZJb`E1fQvbUKPbnoP$ql9DN64Qt;Fokpl-HdNB%4<9VuHV zXIqM*K#Yr3IJisgQ}5+&J>rA>?JL0h=#-uy^6=e4K?iguE${ciV=bGRln2>4s>yI{ zimfnf35s^u$CRg`oI9QxM9&iQ*R(-FBM;igq)U}PMK_F}^~%Y3Vdo<(H-@)3?pOD= zQV2S-cyy8ZpMp4!tk0ONsb%)#j}qT}XCnjuT`DFCq+%S$Gjwei;X)1aP)Ss&TAW9d z_pFC+%{R+Gl-Yl02>CNMh11 z3O;oQq=Rj*kqU3-xH3s7v-QpI&XR>ZuUUDL@6&shvCdkiX4(H44Xco&`WjN^!W``U z)$zFyn`F3D@=pcxyhns{ruDc`|gsUsU~ee#0i%Nuqpv=pd=dtD+O$K9P1s*ZSltqsH_ zjFvDekJ&1ue69MoS9q9Hj|m%=gz>IVSx$fHA7r z76sw7IXYx*=4yK8a`VD*I7cNJJ|=)Xq7xCsznhF}zLzFeUT&n32?>-Za!u#^WMu%3 z=>>{ELviw@IAtY^GSz{&mcfU=QM0+D9KM87moo$mRm8N%J<=rm7nadm z5-wDn@7YL`Y+vZ&n50A{^01n7BMy9&+0zhD#W#Mf_BNRoeo1>aqFzMoqEY z&0meyafEBRzg%V*x_V6+!Fo$?l-n`yTHvwe60^nOHwR)cnB(UhD5w~409@&&DUtGC z91=}i=lS0D3=TLJQf-rcK*!Y~e_Z~I>Dg7q=CWx?;POVe)-;YwS=gyrZuJ%=}yvcX5z zjibEoP|V*McTh-(m8bpYV;eXU5n;@CK|Q@=DO~ET7Xxx?!2HkMuOFS}!S=wX3e;yE z3l8D&_+1{D+&R*lo+iH^cF0*AvMnD$DHVmkQeg1L_etEc7_XnM>zr7n^5HA8P+)oL zo``^eWFUu(>5mb(_)ATfJ0UM(Pn4AARS76%fp~yI9^_0&q}oT_60F=jA5I?(xm0tg zw#km#l~0%UaAzlj%)B9Uk<<+X-ZWc#|M=sWDm9AVe*yDxFAfWHyHwIMFVRYxu2_2v zw{IV$ZrWft3-s6Wj!$2rI62>sNAW)vg)DVMH0{zqloHS@`B7M7(TyIv}@(6kyE z5pI5K@`l5F?!154VdZV6e6G}gdUdIe*T&6vsaXiJr46o3qz9Oe5vS7xB~g(U=TBXKauO#JB&Ki<*)`F=H+sXG`im} z7}6sPm;MsDN|S(i642{;)nF+LlXP>%c*#ZD2@+{btB1vK9O8aq+usT>UL)X~48Hjt z4Cs~5zk@fWjs>*owJn>e~pdlDoI!`D=g?^-^K>NRhkUf0GTKqTV$p!#F!BN za}qdzpE}Y86C7(w=!ZqpVaZ^X*E<>sQ6Ib&F4ekojGl$!Qz?OX>yVnDl}e?i=O)PR z8+Gg~)>3HCv*0C;AO7${mOjp)LWX9yM;}4ww&JhxM)!>gkmpVz7(nE0nw^>$1~q0Q zXWK3G=Vkis;!}4i?=iY37aoln#$H;PEZ7jEk)ZOekUikGJ%YnP8Y-f3lrlVQcHK*E z#%{sqq&w0i?8Z#E;M$_R=RvwDmH~^$8CvAtF{4as+ z4o+J8Rvn1t)K4}Nc_rq!48RpF6Sa-Kv0ue$0niAHeD3LTJYxdT1BAP6L~@#1KpHT} zXJTjzs^f3)UCVxqXy30l`TuSFL~=x`>F<}flFDE>I^%W31G4A`!!NnM@xdn?!xFUQ zXsNnIT2P}8yR*FhrD2C^JDmvT-)emh%p_!-7j_CBmDp>=5toolMQN>2PChRg(j6#Z zeYhX0uQBjZq+De?0l%>I*-DXdnX^^Qnj^(U)`uPI7MmviNOj4A+uzN5WMlCIJZMPYq+p;V050qgZQjZ4AGj9$ znquRt>-TfR2~fx~?G3w&`sF&w{872UT#H6Jk88A zRHWgsCj>z$;IC?(kTV#8p!^1CgbNIHl;F0VOFKxU$pumJzI*WUu!PuET8bCKEucSq z1%>jS9-2ciu*~J{ae0Mjyx#zpr#R8TXjF+mmzrcD?UG-rWZWuk_AhD#3TzhM+oZ#B={IWrgEwLuq0e-V-#cm0Y`-iqqk<0QSer_tzdfz+Sa$d-JYIWsd z-{U(>HOfitVs7kywijvo#k!DV2^Fl_pMvUz>(}sW1&4GI73I5MraxmI;`Uof^FIdP zN!LpX-~E@0DNG*~-5aLjQV$3an1fd%Ty^^iseFIP`D(+xS%%avN87h6{*fbwwptpq zH0}M>zb+dXj-pkuK8nih8gtuGt9DV3%g6E}P<^55P;UK;y!o`?=qGHQ*qL?8c^7Bh z01;7!-xy73bCQh!m;^Mo9~%ql%W z?9uV55N}(W+R4O5Bv1O#R~AY9`%L)1&L4t)B?OjV!|o>%D(FD?h>C!a6=YT!)G7aA`Q z(|M1%{tiTtsG}d!@erUUnW25X0ca0spE>^Q?nWgwf(m#!OfPvO0~JtqWKFyq#@|+i z#pG6AKv2Ohcv3Gt*F0vW0RZ1&{pj2K=`8U^*@I=?n4UlQ^40F}~0LM*o+Us6g=D$nm&UKu*)V~kv00L3Yf3Bv( z8q~QUJomu~!Nvqi5P%mp$Q7eO0g_k?+BL6I&oO*!{;8#oqp_A9^Jcri5zVjcKK2&h zC*F$R8Q@p>D(GBuy~GE<$Au5rxB-4xmw}M$fQ8T$b(Q-c@u>MEMkyQrH4rhml_09X zB91Ab`^P?O(XA<(Dz*|@It$j-{w({X^wG9{B}-H+z4AC&qiC9;3OWAheB^ zDFiJlc`{m4w8unb`$0__!nmidTnsTGR_Jl(Cu`fsqSZZxZ(u-od22iTTrSIzFzMX) zO!wfcDtTGuO%KSbD-xM$E`>S&*g8x_q6BDgq?mRrMa#NEvs>NM-(}DBI*hMZV2+pz z-X>juyDavXGX;Z8{F-=Q@%U51Bz!?-zsYqvcfVvpg?Ny`Z`)-Bs&IVRnf+&j9p#f6 zC0q~vz(l|GclA%M3ZY(p;codcJup7S>jn7=E#=MN-b0Z@9^#UTr-^17&%|EL)gd&Z8%dY z$l?mb<{&CK|IU;nS?_;f*C5@zG`iNJhmS8$t359ZKRlN6Nf77OUR3ZL-a&6hgfdeR zDG5G$(^^Q>y7mP4!V$!qB+#Vj4vP-s*r0@ z#V?{PrsP6B&Xzj`Z6&%6ZYMvK@+V_wG#S7p8_hnOsgRxQzr)7xq12cm!{}j?C=*8r z$%p!4Xy2pmoeg$49=r_kh#Dc;T8^@>;sP?hccxvajW5L1_Mxq=+bfz6DX~*ism(4W zJb3A4d@iT8{si@X(d}4#v|eS*P_=mTfR!{aK63(XA#=AK7Rk&>GJYTPckUM9qz4X- z(&5hyX4QjVInCKVi2O_*51gzE$R(S3W35ojQ4hYKrbWiQvCIk-|EGMcPbyE8l|MPn zC}l>{wd|mSAs&crjKc0>g<63MS0G#7G{K4X$H^SGM2dC>kol`gMG`F4g{aeo;8&9u z9_(Y%ApR1r>gP-`kHT8+*Zd((Vo~TM072CP1!z#N+y@;ko4KFR!b~M`@d%~irz4_H z+n;=M=!>JKoMQCkV{$d|;2~tD@)+>zfu2yk$?dVtFN8h4T{$3Cxwfo0#QFI}CmSpW zVoMIDM0&s39NK4q4`w92jr8%31!>g?X_ZUddt)px(nukaQtKb;gDWIiqXa(^D45b8 zw-GbY_rI8vaeFZFmg)l?7nre&t(%{wyUo5-0QokQmb6CVw(Sw1IOswcFL5a#>WO8% zFZu*cMkXHWv)v8##53miogzk`02*tHft=-b&gaXgF@2v%eG!t(j*cF%RSXsVd(oK zwA4xV4qh0%-SnJ=cVPoh7xw-bIE85@1dZT^uRUXz&Gn;8Xc%l@Xm^85aC0-tUgk4? z)_n8Ml=iy|PY>OSK<(w*no#{1objPu29@yQCa8T;5vjeC!93bsopn=;Qq+hrARgOr zqtzzBdw7rKl|cn;DEORH{HM6gNx-oPJ7Z+v6P%F(W)M&ScKf#UsI`FWT+ zsdI+IFz0!FE%Vyoyz2BSLH(7kSnGZI6VHpQ`9#O=&<&s0e};Zu2Pk?v{Fuj+uIsob z5P3|8Z@0WQ+s-I({hU@zA}sVzKG-{*BS^IOKF#Ml-G2amfoX2JA>c@mOsM;5CbI7a znn0KoIZHSGX>`9xAzUbQ$G_-@yxvjmp1>#f{vtjQi_FH-E*y8rfek=b z2?gJ_in80=^0V6uGw7temO7NsQ&nE~jUL`09JUj^mtQ*T_>scSYbg>Pyh3C>;S>q6 zWrOFFv%xh}q!qkLVbX=~?kNedQtHA=o<|PCAjcU>UYmElHlZh)*M20naSWCpiT(7x z&dI#>JmG}xr7#z!OZw@`&hdGd>HkzN{zQ@_hm{1fOMF1(x&>QE+ar42x4cn{v&5XR zoCng3gvOU`B9xTh@h;dDjHcIHaXZhhWu6(BHZDko5T1@Icw$qzC#4~ypZ$H8NL#G0 zw5L~U49kwN`fDNA9QJwYO~l$nu<u;Hh5UDX|K>u6Nv=BbUbRc7{XbW`t=A8FiATha^3f zqF+mf6r4T~m&22Ey#qGwyxIL8It$_6uAQg$%1~pE^8r)o*a7CdMn0!`+aL|@;u5Z* z0wb~>{J-a^xfmwhnxgCkjq&3g$+U~c>5>tB6piLyY^3Cq9Eb!oTL+u{pUEVI0pV|l2CG%3r8^5H^zI2 zL3ZUFPJ`#bu;PHivaI_=kBsLnOu3eQxX5?7HEk11Ma(cSqZZs;@>p7b>UM<6Db+7| z4rcHxDsHcV9*aV2(q)02JK`4tVtL8<9WsvaUlZR@P2_-*QHZ{FsQn;{5i!@dUmot+ zpG?u;ONp2cD)_4X_{2jvFnwJ&A30SV^&nd%rr^d+KizWnOgJ!Q=Dp24gKekjy0;A3 z?-!}DaAM0$#M7yGq40VV##6k0pNhSfHh|`HtDy zpr*RVHvY#_1ziky=g5&w_q_VXN6(PU)9UPAa$$!H1Z?m)QV*?IQck7s=c7vaD4U!o zCXloL@z_}xNWP<&_cyTY-$!?Ni_MS#0_gJUuEmQ5BI(O__j5i_pZH>Rp(Y&M3O<&Q-j){fA4jca%#@~q-t@FOi$XZUISx zoWn}!nXcU+g~&#|jvm_CWX+ekFiwzswXBGB+2^>rjbTL+lp|-V^FtupUL+Tc?XWN0 zeE1W?|93=HcnC}<5I`%O!O z4}Th;GOpvM>t~O2g$4TmTUWAlQ|9TT0rmETBbuH|k|QX3C+no~4Wy}(hYl5Fu3v?C zNP#2m$V4;KO29<4ShvZVsnwy=sng|_m1u$>_|KA|nJtl>WT(=f_nj5DM`Av$29u#3%!E1F(JY3G(w%PJ!^&_MTjjv) zr9eT9JZvN32bl&nc->a^N#3-L-?YWs5@C5iOd$mFr-zt?KCRi~|FBJ@B-NyP$h-OQ zz4N0F;N|!f-z?*|*+n;uxEw}3c7>r8#jiCc2VQo&jQl9ZlN)~UE}vz}99DD3IfFTJ zJUVQA9nBz5`&p(k$87)GWA@(*AS#3v$wVwr zO%yduRGZQQ_w2;UG10?#_Lvk33UeC5;KF$16I?%`aP9JWutN~M(7p_g52=^Ksh72M z2#=H4ej7bmq=c>Vax9rOWZ{1%wc(U-;CBrJ`b2CN%&o@*-pq!6Cn4B5K?%M4JvBew zFGB?ZrRqA#nF6Pu#|JZ*`kp}4J1G&7Jzt6(!O0Q}v1X<}FWouWwUSWorlXpk9i=~SD7*u(1X?NVuySEB$GIHJf&h3mW-BoJxYk5y+^LbZ z$vp3`+NIvyXWQ?0A|8BU_+djlARJYKG$Tx$u?zI0zIlM4Ucg z0(l|Sf1?~MlQe^K*SieWbWYf(;^!CA`Au3<66~M3RiGw*YCqD*eE2S3_Be5tDSCDb zY+p%xc@Zg5@w>ZqeJJ~Ti~_F|guXrrCb@oIx-`jd4~p_cKYdz?vcF&Ve@`G%IS^<9 zOMDx5S{ZQk>FV%M3UMUzaD&=UUlw`q=#BpOT0Gk#(XN_sv`+x~4;=ki9^RP-8X8kTPLR7W5|QbHSBkon7PgJjn%8N3LOy=(u@ zOULNfO7(M$Q%k3Oaf{V78wS{S;~S6m{2n?~nOb^GN{lExB}&;7#VA4MMBdM-^C*z< zmwoa?@4NZ8p1WeLK7Rhq$ax>~Y|8+A0RgU~1J7_0_d++ysrbOl4-@U%f`eD|7NI{S z--_PvJ9%Gxl;~*@Vz!J9~ z%Fn1)PzD)mwrO!!NsX*U-&mNz5mQG!no%>*#-Ao@zl};>E~AvZvS3-i&JhmkAEe9M05o zTunpn>Uh{g>ylnp5`V0Mt@C049Q+KHbKg;Y5spoxo*>QjMMl|F&;%8o|I30S!eks+ zVKsAHiaXE#t!frfRC#-k#x~#)%jW?EzH-kVa?*MEmjbj+2lJS__tnueCJTUCH^P4{V z^%1u~X&Ep4{?#L}pH|TQ!AGlyYmpWMu~OeINWpB2+*=s>MLdkcD|uM69+f?_{(Gv? zOaM-B-{?I@fqd{?6RQ^#MScUYkly>{ci5`gV!}-uT)vAFxpfLd2J!BzMmA#q=J^CpI5d zf3^4N#((}Tn0|Kf{K-M{wsi=RP~XW#QU?+{0tb9RhU*7X{@_9J2LeC~B^5Bsn$TIO zL(~Co)C7->GQme_gE{}tG{Zu7Q$8951~PC2N|iESKOy0xFYiFvf8m+_q#OvPi?N+) zsy&PDKn`Y9zdiGebPk^KGp*B2&3y4tS~+-@{KwPXjgg${qdnh;rqjpmhi}0B8~KAE zSU|^%lfD+Xqy429w%L>L;Hmht+1u2T3XW%B{70kWnS-y|P)k0|t;5v>kVeTr;ZCz@Rk4wYYl=0XrVV5pIu-iDif$#l&bU~P2 z$F$B!SVSZ~D=Yo{xVP9uaggTS$`feF->t==9Y~1*?<*~Kbm8F&{PHlIG1JFo8z#-9 z9wAyrn_fy=s3am2WoMLNXAu!H-|x8`ROwC%cIzj6-I3%4KBTLkdg+ym_>Q`D@*C8K zX|jqqmJ?Sc4<8X(-v2|^UqD6qeqZ3I^w2{$2nb4dcc-*~fHa6mcjr*j3er+i(%oIs zCDJ8Q0y0SVefWI;zyG~!-L=NGW{LB@>U-uq=j^lhKDZIHAL1IsADi1F0_hi|{qx@m z3!nExuKclS)-;1B$ii35?Jos!C}bgXuOT}wS1oMOk6?sS!qaMz$G-DO2QpHpW&kO* z2_DuA@6v>IeZK1cd^P#}Ea&Y2`oLEddwNtOr~}ZickRwU``fa^tLArSVq2Di*QU+n zCsi!96p0X{gz00Qx%4S9po~%dZ_VWI@Zq!mblzm&1i6l3JXB|BC zZc8v^#rl=~aMkLyGx1gr-7HEv-uK9t@Ofniwr)}28(KS;$&vCTm8Q+OnWp>eRt;w2 z1`e3EI3fM!i<>2lbCcx+tsIJgN_^r##F?Mhw*kxVJebhx5YWdKDUgF?&(*dfW+nkYotF zeh;nDX1y*R`S+NrQ<2f}MMyxiyUqaiCZ*(p&LmFjJYT&CEkq2mm zOO-#P;dm>le*mB}_?{Y~Zz#|N63-cXKL6WtV(G8$(_6*wDy(E4FE`kS0&##Sd7Ow8cP@e(VTGCu(QlhW&ED zpv=BCq^L&Dl7!gl&ky^io4*l_X|$P=T+9nPh>p*~F$vi$-_T+Zv}WE4+8R65=Pl$p z!j-RmP$DWU-}4gQ5%C@h<<2N~_U`|wFP9e&9 z@gn*uRtTW#p;Zk*Mqf7#bK=Y_#@OJz{PUt|nDd&5_H+oT&L|mtNqr_o4v}4lLp&0x zcaXn{m9G{2x;S{g^H?4uJP815 zD@eAWGvBE-AbD|v*FP3m)!L2%D4xsOXN0yYzh|;q2pt{phd;EIGO+fg`j>u!ZP7~->!MMYEqHE-_z|{6{m@K9e z+EcBHZk<7*XXH!|l0^l6k4m=Zp}S{p!PYY%s7q1QA{;J|X4`aSLr;>v6&qT&Vk%ob z zppC27PnOwnK@&*K!oW%9-*omF4SqT^k)JRDR%Ha`y;$}ukzpm5E71=cvI+K*_t<6m6&cQG#s#KdI6YJS_Kh;%N%;II2cx=!xl&ID zK%`Yk!Z?}8R+2zF7t(he)jqtwVg;EIgS`jl3X))u*YE@Fb6@CRGBi>GYa_~%cqpo_ z%7zXzcFWbm$P{XS{bE#b1w&&C2K(m8h3khgoc% z^iEr%Juu#wS;iNX#&iFj{2PxxSRDaZo{oC)u^QfBLId~8(X}BL|C=?r>q-*rw9JL( zS|xbrbr_2aA1*!mH9NN!s{0-$`>p4F;O&!Z@8_V+DjR=d9Jnb{wICf6_i}S~Znc-C zvLjm0*q@}b^NNeu1qBN`b~8TEk0j79Yr9-PLQ+A2W7TILN$@~T*rF~~p+vuHkS42_ zWJefmoj4var0KRhp-W<>>(D@q=81W{4%Hh<&=#&^4E*-KgVN^0VH!Kfh6N!+JhR`?xBwn?a;JA{fr3%fRjx} z9oZY(8G&`IuoKJ|M6Sh2DuS-t^nN=c0-GOL9Qv+Ks9r@G4JgnAXzrVgS)YK5LgNR) zMUCSzNrWF`%m3mI>%ZRfVztO?JBnSy<$T@(qWTmo^=H_oPEjq-R- zHrTtLpSo4-fDap87=`~#m?TJq-|k@EzAvcS@pbEsDwkI;X;{vll0{3Frh_AzpB^7B zF#8fAFpJyO;yAYdhsU{0Z)Wbs(l1V)j**UNg+tORZS&lxrv`TorI=p{G-VM3U>=j6 zO;fzrZE{a3J+batfsuqcSvqJu7o<@Z%u$ZR00R?n@eq4nz0P3KP2hNyF!~v9Bnhhe zdA&&aI|)m%j&91{n=+lMCdIcOKC8$jVR{SS)apofNCv8P=twb}$OB9BM^US$q+7o} zF~+GN2=BbKM{wxe24RY@y-b?Fy<=HLIK|2#GRy@Q?~=2RKeQAM-YMI`0#?@=uCGjS zho@+h@%|^W}|CmKZk@eYIFj0N`oMu9!z@yJ#eyP~8HylrgS`5Uo^wb73uehsHo%WA=HTy~MD=)7lt_UqU^ z3_d3C0NMJp!`*T{39>nfVcPc{mzT6Kl8;>A+*H&ZF^ISmKjriW%m@vZAF0}7-8r+p zWdc36>4Q0@gtlQV8=H*0xcn!gfY9)DdJ2JuTM(hWLHtvC1{G+2hIaq20j8{jex7Ky zp)CV(rbi^*DH;?|f?M{Q!>8YYv(SDwGgVV`{iY3i^_s1sGNjPUtHSc4Zg3ynMnog?Z zuUOSNc=ts_~CBHzmCK z(QVw?Oa;aj_vuh;?uFEJ{LRJpM_phQs0AUW+_LwMjG+4;{@*pPlcK$oR8UA`tsmR< z(#m^pe_EsOxmxVfjIVOQxeY_2-?cb)TCgfIIvk#vEM>{DppTxS6GBVL1yWVTy>9iIL0lRhi5XUC)4_RCQXcj5OF9gNMH2&G0n(pbe5d>j!mRh5GYUi+hv)}3X+}}8!MgC}f9GJh|k5E~^qIw0$ zUvA`Y?0e+dv-Gu{yT0JmHO92Pkr)_dk8Ow7UH zZ3`jbWcIq+;@O96Ac9hjIhotoXOGSA?%(^Tl%xpJ{k;GHJYMz9Hg|T$qw#mcS-Tn^ z`~G$2a%*N{^AS|WXeNKSomgAZfJ8{s`rYl%{UYhSq{6tOoM+t#-)~5W0sr^3;0a_1 zH|?Lg(P4n0CE{NQaB>3N2r0mZFaoAW?r_qcb}R>^$Ln_&rd~l&T8oiJ(=anL z4(hfCYE}(?)zRk-eD`MbV)trS+nZw=cwfu26pM}JH2%@i)ube*-)uHm!IeMUcOwZs z=#LR!wv9+%{*q%HE%dgmeFTs}!w5fcd)4xkUt)qepJhBPBm#7dN-|32#NX_5NoFpJ}2m8F}6;bS$q zYjY&!VTK^nQ@z*%IEH{9$SKJAVbwugcyS(}haoE>LE|3$g8tHga|-;y9>2%mk5*Fd zvkCHNpz10YZJ7)2n7|wlt%e4gj(O9DLS^q?l{$(|GvfT55}upUEtf95`bi)Xx|$Dd zSj?<{@bvwo=R>YP4&@iW-6YR83dDby=zL)IQx|nxm%hAFH;(SSE$!@DGdZtcv{-Aq zLcX7Ce4y^!^CHCU2zY+K%@P=E@+I(p48$LN=jl{!{3v{f+^)j5}@+=V{fyLtO zv8w~|SDdx~F7dE`3RrXi-evGBfpO1tTE(YOoab}|V$MY-pI}2O>Z{GX(Q|*+ZZ7=y zmMLN#ADXmd)N=8&VJobmb0xucx=qRuy%${K55LvDHtW~&KWfdyGZ0DcUocm*&{IjRmXN?TpI(EG~I0WJ;nEvgEfa~>??ERNDKZV4hYO-P?G`)olPH7mN8V1i^ zeL#$tIMF&>Q@{H|)E2P4>4WXN!abGpu(I~+ghGwVYiRc^yJ$$~)v(FtKz6nP1MFdc z?w%*$-}Xv<;6rcYJ$2*Vzt;aJ^Hr086?(Lk>XXv?-<*R=F@lRQf=eMGMOXmg_TS9{ zF!@iE?XOf+`POwGP9use>lEYTGSI6_ng1R?g6#0PtxeoPGg^UjD}Vo33`0-AS_i9MZCu?Vt3~oD zboJ)^&CyL@5)1N=Xn=7G)#KnqA8MRGG^B1P#>ge)0H*41gBVG{KQXDhqsECP;v-8h z>m#)kgK9dlx8_NimB_yGq(C<6a5`@eIVPQtS(%TOuB+!?c-xMw=$oHayG3-a>t=-8hYy>c*q z)tJ4a>DRy`hEAd}%JJi?6BunRIru(FF$uu#IF8+iuZOBjmuTc`v0FG-hoI5;;ji7F zU)UPCjvYRl+H?`=EklZWD-i*E2z^%*-UfPmxHiAuThN_lzo%XQ`9!T{`i#Xm$ z>2<+-`5j9zwze>+KrhOFa{Fy=uvf~9KTY&SR8xP=%{@$99&Mt+0bR!K zTXembU6@{CsaYR`0MD>UJ@Pkg8*yt=m?ai~@5NN9%L)N@yVHb^i8491PCdMT5gG#7 zc!RNF#~z{Z<(A6t-t@3qkvHz~{jVs?Hv|49Sbs0?&*~4>Ly3DHZbTjk=CbZdZg&d| z_0Ts0FMqCWUPn~)L?09#XPhe>AKh<01eXS$+W$AM(VQ!efU>8I>|=m4xPlRO*G>9$ zv0gfrR&ZX z7BwIVi*g^XBLG2;4>();f1aVbDUp^gd`F!a7|ha&)IKEg!`p%cmP5x$kAD#0h7LN& zFfitskWlsQLZbuTaD^!Zo<9}8yTmH4BAd!V2WK-)qu&E67N#%fk+Y+)@&6a7wDC3q zoFhQ)`k9^&o&ACApmUGGeJ!xh9Ci}r-^Tx1k?xZ+Eq)wbvg)fFWDufOk1uA+Qmv*) zY4P|Vi69M5*$WJIqSA@vM5Urcd_ zJaM~7ax3+M5IP{s_q0uR9w5>{7rSfilo-k0Xr&}8&8H+PF8n5iyCX^wA~t$A0hMsj z(DZ4&Hex4rM}2H~qlg|EgL5K}Y7R?QtY+EZdvV%Keu_5s=YX?ep4*knhDizcnlxdH zQj^OlvYOO1x7I=|(3yoh^J37!Jeh!{!!v5{f1ZjOBmX?jXrmva^EO!H%|N>r>P@y6 zp)dM|sK)~iSmm>cucVty{wQSkHL}76Rc)wp!2uoLHFk*G2kK-GEe7sh>GB~YAp8{T_MTujn#vFiW z(4^*%WS&jVf2@pSWFb4Onm;dJPGhS&Zv&j2=S*d7-5C>;(w$RFd1RWxdXAg-Tu6cj z*S-=CwzroMU-~aOrf!3JZ$i=Cl913y3sWwdpt;dLkCDOQdQE(D*Y~yD>}|r!QH>V%r!VafTof-6p!KNIiGjNRC_S& z&uk0E#>Y~Nhqz-*CBm9_FMb>J(cua62&PEUW_(lHC>Z=)6aJo6Y15Cmz^~!liz!>K zL=tmdi#EbM03pnXJZzDBcSnWgi^~2?%_SolvXD%xsfu;;9oE`33+e%PcI*Ws4vDa_HP zF?-H&mE9@ysBWtIHelsYuKF*)FAU(@OsmY3gMWk;@&L**BNXy};pI`2HRJD-zlLPL z4^8D=zSHz%t8apIN*6PT6&8POE{-AFC12l+l}>lbzvd=`5N+N2sNPuJseI@N(aE~Hr& zK`k2!c*?KH77`{fn~SNOw`epni+oXw+#D^s`=uBdrTW)8JAT(^%Q5grD@zA|$d-}V zc2Hmt4#Oyr4%5oVCsSBB+j804yvrmmsE8 z2toND84(KD;2pL3y`OB}ThZc|O`IL9cae^w($gW(0A0&;)NXD$oy&Z#xf#&$n+9<# z&bVyHGM=7cB&bo2t8Vy(e@R`Q!0)l+P79<1yZa1;-I_!oHheEFpHXjATd=5puAB;0Y;53%#eAH(zZTK;xS@1A^ui~9M0 z19kU!ABb7~lr}*R;624cabTOTXemLZ=nZCPHBTNTXj=b~+*0fE-1~wsrP;*yQ}X>a zkOKV>7Not`8s!=^!X-L_&ZV%y4>m(IqJQEc2{V=hHcbe_SrFSvFg<2a5yXfNCbRy& z2WmtA{{I1cj(`{Pbs-8sdZ=3WsOAnvOSZ`wtu}$<MclV_~4}z zS;|k;vy}=7^+OG~I-SrM($~as1>nkhW2aBZUzW^NX`w!Oq4{VR*+}zYSi{fS%SIFN zaKGsoE?30-ZNke%!9^=V)HApK(1MA_6^~?;XxSn)W)f3*wM0qV?yzSZwD0esVUd&; zJr1{5!SzfyO~1!TEoqwCI)Z>xU3<1V-zmvy)Ll25B=~%jjXDe86Gs zEYI_2*timlu>8&xfAQcBCCd1@@-c!d#*tghraFn7;EZq#4-h8kmO>rtaekF^pdAl* z)2@ng^ktBs!Uwz&Rz)SMJ_w9s!neZ^+PsY;!Q11XDWRvnhGBxP&ZKV*B94oq>Dp$v z;&4;71(#U*!7Ub1&vr?(6n4H6wb!zrDz~%1oSb5z#5VN2=@6J}wfhYO#2lb?#CCW~ zJ%xGqhU|aiR;(tG1+*od0 z>Uh~8h;gv9_OVLB?s>1C2HV3#w&9&|Y=%)b9t3tc^CnB5duQ?2d=id5J1lfXQGWFD z826~_YGN(S-#9#)M7+?io8Wmi)9)9zCeT-p> zF@JI>Eljmy<*J&8$bg+l>_O-w0-t!mk-I27U&Lu-Y%X7s3;vxUXA!`j)zxG}UTr(D z*tg63`(u5Y{aBEE3D88U0@fV#v=#<$eFKVO9w;svU~fDgt=+=LDeTWS*K5#n=h)Th zz)(cdK9Mg|O_rkTnjFCJyU6xYU{=8bL;0ieGVfnfHy~Vo0=kcr z5C)G>p~EK@%OMST^yBE;@OPb**;Rd)L0nN6t&DKB9l_N-=!W_s{iXKJi~Aq!J!uVi znazSR67|@dqy4$ey{~oyXC|;WRhJ;(r{6j}k&oOW|NGccdKX%Zl3x%0=1hPPxbh^w zIkLqv;&vSpYc)kXH^=o?V8&R4_49XwDH3hlv#_~O|M7YUKgC`*P+QfMAh)T#ePjLg z2rxW6i$~JlD2IQbt&3lvLbr8C-Ko2CEyq-}PY$SH)A3>r^xQ<2K^&n{J66CrkXqty z2={oA=1YH@88MM^h_W3a#t>9Z!ij_WZsA?s7vQKnN2#?zhV|_fI;sije<3Rq{N^lx zRaVC>-ee>@(E~eV@EV`v?mh*o?&P$8(b=jC5t*PRO7G=S7mLBnzDpzSQ9@$w5ZBSN z)}ga_(aMqcYp2U0vmbjdTlPn()WSU%2)l$LQFpQPT2MsUy#~dS26)b9A<*|;Wg}5+8pq+sJo5^cV8Is}ngqE_> z@pqqK3JMzDn0U3`uL3Lo?~RHa_1h3y1n}_#;fNVV zSNL|TScf^aQTS(pR>=>m<*{clT=M^7Frb=(tWAtI6M&UlU^kQgA9^E#p6*#`uVI|+ zuh{nVjCDAFoTYNQ-x{Ha?1~ck^9Saq-|MuvQut}zi9){+wuJdUaf~nhW?ZiTa;HdRa@-JtTCZ`%(J6< zVYC_%;Kf-b4;lQ!4oms!l<#N`g}_$mC#TX#Z<}YOH;O;0$*We;` zAMn46VH)}4`rVt0tx>mQ;K)P3&yW&Daqn>3td-lVU26&mVT3+XsXm1^49UMjWuqO30Un={A0o-HpkFd4bWG$ z%Ouf;ls6G4j}Oy+`3zLPy_;?h@9p~61s|h=rz5uN9~Sq9(CQ_Z-s_CjFbGuiu7WEG3{Bm_|ezNxNxR|;4S+9IN z1>;sAQA@=x?Tpspjp;B(0P@-Qaj$^YAkc6Ue>@Ie&R9WDUh+ zAigXG-ax5ogh0(123Q38FM<@iaA{4D#XU(AB{x+z9g*>RL+S5=E|GHRNd^i!O{ zWc9z2Uw6>h5)KxIDeojGztzLs=qr#;9WO3Wk&pNcrfJdQ)f8egYMey}rZKN4#m%Kl zHR4@Gi8|I_z{wQiYVDZB_dc!LWh2wn_FXpV#l-u*J=UDS691dltspkTyQ0lI3o_o= z`sV8EYcW=?@pGkJtLlQw82UjHaCRT-*bx1h5;sS*7)9Jpq5}6hjaoS+1^i}jvCltC z8DaIMVO37-EfrX+<%ABWFR>7Vt9SqiBCqin%>I z#gacOA5~@qbk9$CSntcjs@(fo9eVzv)BK_!hFLYRgbI8VB$TTddxQ<=qp&SC^|eD~%s@27(yv8+?rw^AqOS z?T4ClZvX5w8=Mp@xn`=dRq(zE8d-jR+)!J$WM~CU!E8E4=Gksf5lu(%V8HnkYx#v@ zn4X`!jiXf}K_awp;O$iJdUstE9Q&#bU=mz{oT%}=2+>n*M=ti2AWTd%d3gOO(YnET z>PF6e?7)CIBuJ>m&_X6k>Ww01F z0r}SS4DytKB|&9|I}tFMl`Fy*Or-;}q2OS(G#8pLL#XmW<{V8t7l>sfikHkc5x+V}=7OQ@^yPwf=UURHK6m(} z2)LmvxWScQd9wcND-FAKrh8s)eKo~?Hg~8gq?6n$#%zG25LZPR7mgT7J&9ePGqI$@ zkPk%k00%cop)u54Y>-jg=n>u;QL=vTUu9T^O@n0S3SvW#dIbB+?8v0||H}S!JPT0v zyJdvi`1uYp2FC^92F8Uvm!_IK}Kg-%czp9q+{pFHYZ+oj0%4nM{yaI#VkCOBaM zTLmy+sPtJitClX;n5$Rk-f-%%!gbL9+?LpM-~mo3W*9E_{}H1{s^{*zfnPwfk-j#! zu$mQUMaU@eKoG?cQ_pt>`txAb^Q^7lSp>hi&}@_ZbS9sSDQvG z2kMVY>70QbKNRsDCOC?E@I*7q`ggtBU(Fm|r@rDlEby=(W(|N)Ga4&F2a9%8ADNd`8M?X zVQC<5lZ;!#_T}xLIUpny8r9Lzn5Q@iweGA=V~a#S?^L&^!?$g5F`HVyA91N?iINTZ z`=-g*`dZ4`na1k7hv@QwENZ;nq@zeSEx{Sc6F(zIndVOaRz? zJ`T9eg@{Q=JXym$Szu_qD*t%32zo@Vpp+Qxscf}6J!V?rc5=10-=6rs7n z4#WJZG1!a(y!Ktlp}9)-Hss5JE;Y`f88#NJHO$O9;Y+#@=A+poQ&_S4Tsb%!LT+O3dg^K%jz@ovqSvzjcC#h*#B((I7 z`N!#4ZbKjrwhU(RL{hXv7B80t!Rx6nhg6vW{V$15?B?D9p7P@EK|tbamNJ!vhkllq z?D))2T!Od^LGfQr#MSVVZ#?bc;A2jJLEu9+ZB4&CsCAQ0AlCt=@<0&ZjGc38= zpN1&twbSC+&GDJpszux{JpCg#>b1>Un$6PAE;5g8qzKbWJ-g1sXWSrUCFn`Ir~6Su zOWFLuNe`dI=vS;p6|Wb5%hV;5_DVF742xT{tjl|2TXQgHg+4t0>1^SMO$SV~W*_WKos&((rn9_mH~hcj}YlDw-A)Y}<;4 zoK}k`?tFkC{)^=BQ?qs?3Vt2GXIEoyTJDy7c_u>kO!N>Jf=>(T)Z#KiyL_nrceJqs z$|n1j^#=F+`jUUOtpdQ=ma^jZCvx*wry6!feE%e_oCqaCf7nCwjN!jRNS#q!{Y15GhXpTI-E!DD3XcP9@r3A`nxAe`CpgxhdD~PRjkO`Ac~X ztKwWOzfe6ay<6x9&S<`aDMBn6*|Mm$v?c46bD9cb zk6dU4a@20!$JNFH(=Vsy>|Og7$dQs1T`Rr8>I}IVo(p$Bs!s8pS1OD!6qjkTsJ6PuB-tWq^ zCUkf+_Kj}7&_3MUIQ)L0|IqPw%MS-GDM2RG?4{`IMGx7~7($$@W!3nNAonz=noU5s zvTzXn0+!jB_hbMHV%$6AgJG;0Xxu+Ih`nBWO*-mhy6ud&+_0?n95DjUQML7sR$M7I z8f2?7dD{)czPW@qn6<9O&5I$0^2SP)JTl?}i-xUF@sxAtY%~m4(n~$)GYQSSOy9T1 z3PhV~!5TiRA&btbS;Lh{c@66LJh}a=y!|VE)!h ztEr#_$>HW)&x{T_9HlH2T8K(*X}%Dbebc5U5{@=7sXq~{RXFPZe4tkr;%ES&c&XcV zxp?y=NWG&asPHGwlP<8&8n?Dz_x~rZ=viO_bYXM!u-?SWMX*1?h_FYRCA~=1CXF}W zdpUC38EHNrl{e02iZf5@E)um~=A@WPBj4HyXZFrk=b}VorBwQ5CC026Ptzh#Y^m5x z({y>?7CQ>NCzDfwVVZAS%iHkR4SM}$OO@k_rhK*$+nN%2QoWIk^r6@`)B-u)%im+( z4a4|z-8CU^hm9*4VXaB4A2Bw{{?m=k`}11+s58gzcP@~o8{U>Rj-(ybA-JD=(`Zcz zO*(IU`)WQD8NpH;;lR5a>Y6bke>D7YO5}%$Hy^W<@&om}E&udU>{#Ud*>pZe&Kv3{ zCS*Z6G+p!3d*}7HwvLpXmktDbb+_Q9C-69#? z9>34L`zIrM4!^s+Umnc4bJ4)uN#JcP6B+;+#{)^=Ig(1$+Mz6FM*L?+an-bcQ^%a2 za+fp)yMHv9DpYPV4kE8NT-cS{xjzfC6a^IfVQ4%ZSv;YrJj13UgL!ixhd2#Va!jZ) zV}f!YNn^ELb3wcU&r&p-g8&)FvbyL8OV-TB0J{aje}kETJscRQkQf!KmVt7B%3j7u z&x(pfs3q5*bh8Qp0lxeDjF$Smcc&)bJBsk{J~dr(0Avo?qZWOW{*z7d`$5SgNKe2- z!;v=Q=iKTqNF|B}b+}-wEy#DrUWkwRPP&>h<$b#I_RI++jNWVGhlDAofikzlqo)a@ zR0uM`6}K0Qv_7{5D>E!5CB}md!|XT@x*ZADYSMA$TMfguoe9zhV{OO~ z^T~h2vgSB=A)LvO|G*i~_b|n&N2)ERN|k$=O`2mWd zEgLA-OZnuySns>2r*fI-Lo)_n+N2FzLNLqMBTryef+mpG&&e_DjId~>jWM8}3`2*l z$Tfc0!(3*yQbrP9e!u3#dN-9&X&KP9pLuT09m4ZVAood@Mo3(Aw4xc;ZWBh7jg_)y zft_!E{+Q*myTmzZU1^H+GWxbotrbo05dz83@Lm4kz+-HABqo&;uO3sLaSK~kO!AloMFU9Z0lUmRHr zUh^TlUO=A=V0y8luDV@q*ihm80R>+*4zpqFhV{2ANtWHNtH{%I{QTUw(A5fB(z*hY z=_{~^F7MM^M1o^9fdoCmqz=AM76Qf<@5d38JD@gzVFL*0nx z#vEnIjS%KXZaYhPz>oF}U+62okoBx9B%(K`gs@l#UxyhzU0I4<8+aZd7xkhGC(EW6 za*CCQ$g)O&m$g)c7b{MhDtd`*u$Sm(G6j5}b_AXoTQI2?q#R!s#;>N-ib70OBrWlB z8=JG8-tTf)4_WEz|Gq9r{wK9#y8rrEm)V{zi*t|oh^Wn5YkspTxAU#nSjQT2&rwv> zTI}jy+R>8F7gg*G+*~t7{`G$>KnBf?aB`QS5SO^2KTs1e7Cghv^g0u}z01x{v0MH> zp&ny{Ata*bmRC|x?zFy+n6Qlei!vj{=4bOZFKEIBVKw~%I9cnSXFH? z)cQY#JffLU`=6)j1qi&6WI}C=@h;O0_yu}YT`}I|9`VrXNT{0@QmZ|Ja4h~_l2tR7 zno#Z+yzU(?dOYl;yKsA^r4@yFbKV1C+A_n*B!4WAj|&F))`UD(G%^fTX)%Hw+(D(< z0jHy!R)q@NBd#mGBdUFS8pIuiD273JU5h;~_tZ2@^e>-6nK8d`2ayNU`1NngIT5!m zz?_1Hdbs!8glH*oTN0-IA`*V_To%yqv_T4hrxSZYYedDjGpDVNpO?( zg^%Qvv*jF$PX5%@xQ-s(#C)4L{l@4*(4QTR{LdmDx?SMFycQh-uJzj=HnzXJGgIV@ zlo{oVCTIBc(_@+xpMWR>3y?xG96QhgvT1Za;Pv2&o$87HgV!n+y*oX_3GV+Ut@oD3 zhB+*{^QS3L_nX!(X}%dljeeE9*%gd7)qRBWQWJ#U0l$bt+p*fgiZ68S?uKMi2ZQ(J z#^v#x%f8>gq1UOZ#0N{BBKl>_ygwSbM>Lr-#qZX<;N5S7+{o=be7idwTK3q15B*pC z_m~@AsZ1-!ZxU2~+t~kk5m1mzpLPU_JawP6^Ar5b?_wEtZ>Z_0p z$rmV#&E9UuH+pa6c?3H54l5N<2Om#vCCH8fFEPt&YbXByYiCtiiF)>vdsxsnBsp7D zAvcJLG0>kp)4cRy-XHsGrZQC>S9OC?$`N@C!mR65$)`lkp7<^Y4RDFkhYyl6EpvX8 zyNe{o?ls`WdZ#Jzbx2d7Nh9gjiab2keP4mNagcfjgzDRKJ_pGY7y{cT`8tfT(Ntt& zQ17ir+BLgOi7FX;RE>t=G*kFBV`eE&aMNZccV`gwsQk}gFMR_O zW8)NkEF%W@=4Lp2D+s=$Pg!Dq^EoFKT3~=uiQksmOTp8Sr?}>mkRFI%HV^i$d54hvOJJ}Buag^TVL$ZkP z(!(eA6<*D1ik|%#QDpeUnZ`O_yYs}M8A2z+;UyC za@`17(eU5G+^{*}3jY-uo8nDLPTI0aVs@3+>5mXJkkfLI+b(UmFQ$l*pnGvmiXeI* zd1@~iS7OCQL_yippsR5}Li!)b#i@w_0Mde=ggrQoosm$F?O}Ny>G==*xkTmCmS(VXI+9Gb-{yEYtYCDbB*N9GTu?oU?obQ1fwHK0B@=#-=CZesG|CZB!AU6CJKe zRU12cPD(a2uoM_Q8KaxaFe5SF@&d+VVZsa(N&dnY2G?SG^aXRWul-CoK2cHY zy#+@JgQN6E_GexGo(bGI^t=z(E;42%>_I0QmFH9IxE1~4d(N@D=YW=#DJN8K>?Xw?}REf1doJ1pvLZ5QdSk7yI zRIgF_0dIOXpP98Ya!V+uYRxl^k zGX|p&9)`qjrT2s3g9V2Ak_w4-!&zTH&7mcKY%Z)xi`o5sVXyQ%{EnKJ@1H4a0pW5E z^nPz}M9^vd#TUO{D6kNzukXn9DtLqXzk%vYL6o?6Gd{a(qc{F(nrcYlJJFL-mdle* z93d0?2+^-l(sZJDU(%;3u21G#c>QgjODx>Wgo?Xvs~CB%(E8mkH0HefRt$A;+z&D? ziZCuhds&bWqoC{}>c{R|aq4Muq49c6;;Jm^zlbOt2(x*=*9Y$cY#atvA2HAk2w&Z; z*Lm3gIcdWqqr`p0%;D@|k1nX+6>+S^>)cYAyBG8k6!Pviqe&_3Pmivyr~1#x2UG32 zmVV^ElQwx8YKX#U&Dx{tQ8oXWjD^SJOP}Ubm{F5s%(2AoJ`b%|I8ex&G#C+j(2vwTtIyb=EQCO;%3Z1 zoVfs_I>B+Np_4*I{{0T|usABpkR2PkA=Ar-CFjpo*$$QILJG!Ti~{1^d>c7f8kL42 zX4MWzfv$#6WL#BL?s)7GbqNHK0U~c)p~^KEqvBh8R0lEsFyhd^+Xb!b&FdjeyBee#%9=7}G$#By4&5pcGB_{#(h1~N_8uQ?8ARyh|bOvj)S#8 zQXZZ^dD4O-E1nYJI^3Ed8#9of=2aAyn=^j)@We5d64N_(hC-5+S$~JF*bN-iVG!hN z@2;QaRup1uZ%Q{E=vGlQO^#RkWtS&0X}Z><%<84P*73XB6)%!LB4bDYb81|SO16ai z6u=k3daCCzBq%fXZc?l3zdA`s^kIx0(b6PiP2NkJq1(9_{@`Xw41t&2uiFlsspc)P zVmEzwr~ore57<9p5I{O5YP7rxY63js(K~XW-H{mbGn8KfuF-d~ZLx4XHnu)- zJjHi?N{mOBRg-f)JaPGZ6IZI}7VPTP1DCD4y?b|Z+)Sx4+)x=0whtBW8k_bziP$YM z56#J-HR5L7-cMWS7=@C8{b;PfhePNG{$xU2sBTY)t0uouiXnru zFV+G9T=sTzZb?DLPo9QInR5ZXo}8jsA$>@X`Aeo) zIT&~J98zuv)X1TMm|3kkKw#hLDtP5*k~*1MS(!pd!C``?aR<#C(-MbzJY zq`zw%*NI0yE1QrO@}4jSBM&l^hx<%ho?o5R1urq3%cIZLhHNtXBbw^Ru`0emLH5Md z!ld`LDr6XMxvLI_4P=QR4B@;<>{h)QBUt-!O??@J~M&KMLBQ;sBU3;;3qjp2BpV67W>dI1rswvs-*`%S_{Ot$DvJ~7_ z@>jv%-y%A-rQmkExo<1Iu)ZP2{#v(b@ZQ>rFF^9rXELqGgyv_$LvtG)E!P(!s=#CQ zm9%S|(BEY*7WrmOQk+{Hng~@RMfd<#z1<<@OnJ?g*gx^3TfssMWs-OO zTkN9+EOI!h*tsE-IAFhXK-$~f2yKbslfK;jP3>%%Y0HL`I0=KpWN`oB;aJ3zHVJR7 zaR+PVbm>8a9!l=AQ(NZ_4lQZ?)F&x9hg-R0YY9gCJ*FArp>4P8gcKrf6dZbly?uz` zjJcVwIia>}FbrbOz@BfNlqT9?u?#ZgA>{`l+ zHy@cJ@lczR(+Ea&oX|atNhnh!ja-;-_e&nEKt1^Xvm~C;HYX66l;NDCQsxfRF6kkhkD+T+>3R;7nGx%!mdx&hSs1tbkIenBx2Br$5Q z#=Bd?)Fp(1WPb#EbcSZr%A+!CgWaumyBDcVLb)T8a!i1}5=U5+)UYdH-UDdlxi16X z(@p)C_BgKG>hN3SG0I%L5U)IK?e>T7{0&)?ahq`O0tg)VKes$|oby-QcCRkBYN}Sb@1L3m+zQAIDNQpNbkQ*0?Ag2Cisda8*P9%iCg$3Fqd?TsNnkICDbiOYZlAY~j3@DLg zoq)Hz0mP=>7=G82V1bhNF1DZ?9VsmR=`JyGZ2vG#`7cXTCbo0BJ9A&IouiUezjy=m zSVmk-M9A1ebWqPXLnbJ-gTld*KziQ(93=1vnIlCYaZQey~CsiXw`sqR)R6Y2;{ zjsP{9T`Q0i4tt6LwiB{m$Hf1$CbzZrDLB5A^*#guiU#V=2p4vo_PX8BRv-+m#;8qU zU=nF}%n%+(q{Zk>O2V}a-mvx)jh^6%q!A5a~SUD7u-*EFVHDyPH3=69I8&*t)bw(La8YrdU3j&7WP{_a}NXN9FEQ zdAh#=Bf`-)2W{k;KAy;DHHjM9UT6n*Ywtym`(?fsHAFbJiG}x3`;kaI+){okyANC9 zyz{r{i(2l&UXrs`z$hld2f?20U!M5WX;2&sK?Z0E;5_(*(wD6@8h3~6TW9`)#O?LK zab#si@$zkJ0(*S-SmAtfmED;u7vcIn+|S+=EB;*j$Nll!tF|XokxTydHPkUMc2u@j zsQxi7K)L1W-jB*oT^LmD87SyOP--3V4Es0b_4^)ux>nG?bvSRL1SB3xVF@{2Hi6oA z%Z0h=5iaiaBI}=Xy!Tntu-U(QDp9IZoH21ckbXswQTv@fH4!{wTJ*ZG zP*FoAjZxOtV6i$}^rDtw()BO+0%@8TJXs;WTu*!#5upOgC?#Mf){j*4vnKx@-QQ%c zR*kjxNZcQ>#wiiP`5;~_w)pO8Q=e#;P2ctg7m3w{N$Qo;?P!hHBcDL8m1I6sX-;k4 zA#FuW>`3_Qko&nzkd@=Fb752Me7@Hlojy)GknO$vd65)P+end-t7tg6a zUa~BDo)DyvmC;d!x9^p|$8ZZLy+%^)u)z9G`q%bX?OxRvr{Be&!`@m_DIzDPF8VCxS> zzYDQ)G&^5nz|1V>7L~5HOUku*XZ|pNPEs@+g?68=GIn0Ci9523jj{)R#yHUms#5V9ub`(=!jnPs){W}aiMLnA~Y*m!#wkgP}*5@%Q{z|=4+Tk~9ldc_tM2ZR3Z>#&v zWV8V?;}e}yuCaUO;@~G~tElAQyTq7^_ioQ#t*M;-_ZZK!3w}DL|@XXV_dCN)fF(NcE)Nf+( z_-f2D@jYSEI2|`(*c;j^E;XyAJ#)Kk%miM9rY!gJ`H|)VRn(P||Js-@Nr+lLiZqwF zRFbe#@y%Q19B1{R(!+e}zP29A{8{A+2mKvx=wF85MBa$^pJi(oP!%8cPR$X30Z8b$i-rS=X62`Q9rWPt8a`rSZqha7$T)?_WX? z^?f*pJgH2#uYM)G9ur)RksOE$Hl|asb5R(mL{{#YIecr&*M$bPL*2U-1=~DaT;Mq; z$8YO!)D?81e{*J}%q^rn7+IT5Xm?$~xK$$b6|7`-6nZFeKDWYO$)=xC=PCu<^sthM z@{w_-^0$8+3fds@$GoI%%KcuPe(7n5qjZ&=gKt8g?rDh#YW3w{CU9DzShM1E3XwK{ zqy;JWKk{R5{5yJEMd;KFTZB#sH}u@iOci93m96AehK=TZlU5;n2pDw zJ%~RbF)@3_gc;#tJ7zYA!@LhUaI<3kQHXN0cLf60X^4(H-m$&MZZ645H=Q{Yeq4ru zUWAZV>j3fxNwzQGLP_y6A_KI-q`@{`t$GfuICPUe?7en zE3tGei}x{pCrBEwP&S*qCLlUSArVFQs1|BGhKo8)mpX8Kc71D5j+|A)qsz;-e&fIw zg7k%wYsl`$4rn5arDjKb-53lAcJnNEM9OAy{wb%aW~&;bVI0-a2_ROow>^LVHSbgj zv4!)}7^_>ll`yd)S;fZoFU!r+u3@_a4>++Y#r4;X+hUw2fK7!2kWba#jax1*Y##=$ zEC0{m_fp5zz7Qu$cI~6Ipdk&kN=wl6+j0IY+TqXfofJj6lISkoFCemd)fmr~QA>no zk%+2Qlc(jH-V8KKV+iI9*PgtExIGvvuFO>a?syeujZ(HK0dMUcP)_f z_jF1TF-W?bPKyE0ts7shyHkn5Lgr;pa7@HgdR%gOwrtsyT3S^h$v(?0b8`l|IqgwS zqGM1%MI=gu#xX|LsuzOnGd?_$=tFTuQkV3~Tp*PjH1q^uMHYbvfRs*O?6>BmWIGKw z>Y?EYtFxG?+w?=ayjo>;jbKAjSyg5Z##~h|5Dd-kYx4L6+94Wo)iqD@)+-RU>pq^W z^C?vNY`3Sv6st0J+cdw#g@|Cb`TNW=vrZCN3;_P;O#RSzZae-inW}A)ZFuDCii^;) z+e}t+Di}=OUo&LDRWd>ev9FM=2HQ^=pBe~x?@Fuv7uu1^T2Oq%x=5&#p*jp*yAfnQ zVlv=7nDdPYG$AfnSAxuWjV}m2s#=+C`V1|k}II5vK>iip+VQh3d>d`?uot3W~l5kG-l^`85i?Zw%O-Dv0Psi)8<4sZoCDGA} zk~Q|Xd5h@k{f;MBkP|swgPw3HgSS>02I1d=^*OyCwTedeVIP&{Bpzh+%hXzR5dq_0 zq6&~X`KyfZS6-3M7h?Gfh-2?>?KVmPNym)w>b4D$fQBW`*+9|shBCi?1=lcWT8+JBA#%*ZoiaQxXD zrDBcDiz461k84avW#4O(d=UOxs0+L+xv@+7mG>!4NT~xMfI~na)Z#U4%aQ`?M0>3> zjLkxo26S<&+1uKu@HeJ2)n^O_NUn9?49E{F7xt~U693Olvx36;Tg{)n&~iG7)G2Ki z*m`M%>jz6{d63j#$ckHNizMbr9@b&^i^J|(gpMYv%AKRUC)zma^Yk6zT|gM`L?m*8byn{Z(SLL&pTu9LPEYH z#lHc}+Jmtj(s|l?FMD#wZ3$lX$S}5D8K!JIm0aK~zT0?NG+|dg*NPoJ@yNkQ0Pvhh z0?Sl|lpq)ajw?xjtTZW<{s$6hktt==M)ADHn7)oz}h1Am(OQtb9h~% z?SS7~jq4O6h4S~bTmQ1h40gUs=uynT2QJ5-f4Rp+0s%c^^=A^O;}-9X>q|e-Kjs3s zePUpTJsBqgxkW?$`}pw2+MuH9NmM7u#_EXM%~-Hi->0_4T)a-93mh%q5g3f0?SH~UQ( zoONh!Wh5&a-~`{yj#FRle{!+BE07te_8SM=v4rD?mVH4d^_;Z0z{W2Z%QhYkl#0(~ ztGz-aYs9U=ny8osiB_5-#x{C?4lg~8b%0$Jsoz0E#B zR^z82rhD0dM;lRJHMNK2loKDdOlIhUjVZmMa9)zYxybgS3eD>7pm2V5eEytrGr#g< zA?t-KLUeRoB)E&uD`Rgf^ViB4zm@SH^!ox8MRoocvI1 z6EEzaN`$8vWSH0yX3i?*D?aE+Pi_s$urM;eYwSo`K_ zX?=#30~NS~kh#X}lJW$W{N9~PpqW>#A6MjCftwt#7z2lsU*7_LUihO=s)?yU+avHf zd||ei3u-gN1%yMYT!5kfSMx8GlViayEyxZNV1$C@O8HT`UVGo_tsO3F8h+OgIl+$) zV?(GbX`%^lAJWxVT$%}MLmR;^6?Z_2GC0J+&5T5Ho7hj_Zqk)3x{9ID~X)=nCQ+p zvIFeV5OlY~7HZI6m)mkQ1^SZDPT=)Qm0>6);{kxObt0bl1o%Rh&(SsJ#$hRjoQ5}f zTbhmGtq)#>Vm8}&IgJSzqap8l#uS(AabEL1=2w2Qm5e6&&3cejL`=l1`OcxQ(NFTL zYr?s!l`;uwF*mnFJ^2UWq%&leJf-39RxSrVg(C=nT(8Q$^r8u$GZLpw5i2_$O4Bvj zKOhE&dXv z)#0p{o*b<%K{4@ZBXDTJQ7}kvvmnCJSyji(-;06{8&{RM~21*O4 zd*r%FN?3If0(L9b8$mEzRbH&5vwwU_yv-r_Y1$MgU@eww`S4To>9$iWZ{SHKyi+p+ zn{X`~baI=YB@97MlN}wf6B*3VNFm$VBH-T$AkgD3W`Mc0z)s}Kf0{hvGE!<}Ij0-i z47aqF`nZ+PD=5U7Sn99g&qTyffwYn9x1l_;ApXpnAm{5Gju#XD_$jScwFsrQ$- zo`sqz=ntIA%msoRR`9`M9?uw+=`Evha8` ziV(l*D`^CJ#ir;dd1{Am zM~8VwbDTXGJ+%5(J$bD=UQEYzgh`Vcvp`$O!LXfvEO-~_`WLo?aU^knTatI*kV-$s zSiGEL$5DIQvCX@>6?DSr%5j^aoW#(&>!WgN*k7~J0?Y}2dI z7*C#lOP-?nAT0qkl-S)r_Cv8JR)&?oDpMf#dqmmn`_*a#CsGy%6WOfl_sW^4l%^uM z-hilzo_m@(jgq1ipv3q&q;JKo0T&ZlN|T^7o4c4u#HzsBjK@eylNAv`s{Zx9^t^*? zCobacZ~e8K<9^Nwb$mLID#!8p zO}U@zFUy~kY!O(had$q|g!5SB;1=Vkgy0-E42fr)@umu$2l?az|FSG|8#Y+4m??wr zw6)Oz7lLsAsJE}+4Udsz{+Fz;1hUd-veK+y1{i+u!?tY+k*^i9CTzg}3-BX=smrCu zM~aA4qr;63D$s%mr;%(?cXZeL3neln_v!LgC8ZG1#sh|g(X38{TUZz^bp)$O_Hl(l zg2+X;xu!}4MwZ?Pt?DE&&j170@=+ttxCBDo+>^qt(20owOADT@$Shm*qPGb2^!Owc zBmvWFkHMz_{!i#N31vF;CCflWw9rGSoYq&Jsw^!uS6g{~U z>yjG-g9|_=2s)wT5mM&kb@HpqeB&))f!gthdj6jm;7P{}FRif-I=h&1H+$DR^CYg< zah>E=PjQXyInoD#bopcV%~I{fe=FNc<6IM+Sk@=Wi`}ECnrV6FMuGEqfQK4w`>!dw>76Vl^dPmawpx% z53KNe5#j)|do5i@(!l%U`S-+_eO+Ms45T(h&7A;`cBKb?*6Tg(A;ggR9NKG57lL?K!0L?N5hCjiR z`~Gw59jU-WzEdg!WzO`*jd_VUAWLy%fC;(=bE{=|Gc#NAV;BM@nRzth4%}Lb$jCiG zk3(9Z1kThQxTOi7QT_dE2mzcu$J(^1-Ql&}Lp$8uLhexiq;A0tv8?SLyFQKcr;fmS zLepL?%A2a+xZ%Atv8on8F{p4{+5_{~5aN}9|C9#zDIM<9gxjQTBL0Tr<&omH3Gw5(spnS_bcKMg7m_tHn3!a;(wiZe9yzbbf74h4yJOsQNTT9;5WIlp%qTT z$Q=YDu*EMawq40UBqsH`pz4M@fm*zg8Mo`WVObN2!JOIg~|gRkkp7Ns4IjkH5c~Ess0=j zS;S!FYYZl+SN{L;e2XO?C!uHr;uXY>ZkEWL#0({7d>1ULUe2bU(5doZ;*RUIW1e@Y z71qDBKE$!4r%;f16vhhx{E*o9{^eC^LDPQ#5T~}Y2Tg)g-BXJBLlVV7A3z8=XhLA2 zAJ!*hnnh1Xc+mM@JX~=arr5<4c)!%%H~s`kaSl=|U7U8wB^bhq3QivWw7`GUO3*DW zUcVRrOGc22(-G~!oVOlqf+^qi1POd3%esNOzzQCAmSQ-DUxb)bM*?#-BbUHg|E*NkPAm5|SBnM#>02V+^tEDp1>vUy(aYDTH zz1>#7SSuS#>jYX9E#AP&$rUap6tdhNZ9w2GnqoZTXl0k)`Skchv`IKXM9N4UPHBQi$e>j?7I^cI>@k>$5hQW9{TM1k+k7?^4BD$T(GU%NRx1ogU-7wd=#zN3 z62c2bbZEOHxxd{^Ty}2E`n5$9&w_&mGviI^Sa$>V%FePjW7vSrrzL91l!BwZ25P6d z_t?wvv3`A-nciq{KX1YKBwvV_7gpA{zo;44Cqpm0Ere)qFWMeJ`PFy0x8d_xP039; z$y4B7GCl{xMF=^d@5{vX;}Qa>52bc?ny9?mwf1GeDG>S^Cm*Nt6)T5!>dFxe2eT&( zb;SmkHcemHGaV3vm|XeV`|`oV@fJn5BYve-{ny{amI>b;4(8{$tNoV&HSsGYQKMQo z31nOi#d@5@6GP5Z$AD(Ub-2w;y&5HgwYnBPwhWr9cf59A2*sB0Cf;njL)aYi39ycq zfE8wXQb-sJqO?s%dDOcK#D0&bf3b7cbRL{Lg7fs6?VG71(OLC34lpykLOh*93@fhN!CojBF6vw6AvRN2osOlH3) zOVSw6VU8lv{#4+u#0i)sl48rio}A_-j3yEtJ#CMqA$>|u1&_g&p6VOV@WVksrp3kB z^mOJFCmt=v=bW*kYrOO*b+;pe7Mx4lMlpi(r5q%CVu@! zA^MIE_a!x~o1{rR;0Jc#AOz50QF)`nT_wQ$eJd{U^P3O|$%20O%-!ZZI=Yk{UDy&B zO$(1xa(L+ySvQ3R1<}EWh?)q{`~L_>U?Ga^+;d*(B|qq1GV!B+S?F|sI|c%N)~j(k zpyx2g3VNQBHlMB69%V8(d|}$!*P* zyWWtM&NA?QHT0*4(-eO2!>u;JeDle;04mKBIe=ycz%i@*6qV>D4QQ|Vc`&YOG|JLh z8Wntw>h5`jcfseE43LLAzh1ktmf#I5EHEzuhiIebC17I8TCb^q?ZPmnK^C6~-x@t!s*8(r6N=s5LWOdV_sJO9y^d;}4X-~Lojcko zlXzopj#*L?i8R)BGP)ypbZgqN&QFJToE<0aQFB}m0&k}x4?@OXdW8|IY>>Fh5PKQH zLfSjGK0gj;kJ~NH`tcvk3WeQaprGMeN8EKNeOYx&&pXqF@Ue0FF&M%b9n)~;w@DZm zL&eEKKQa(!e31V8ewq^FYWZ6`$59Qp;H})4Kq5H`4gL_$c~gh&j=aok5nupcu6$+o z&)zTHB>nsHjJL78sqFpKmku$u4TCAvgtqelbP|aG$*&ZjHf12lvE?5-lLQ*F>v(+} z7aRm`eI-Cq!U}}tB57<>hHcXN3&;YLxN{Pe7*{TCK&FuV<7;w+9vdl2ywb*0G_))E zEJ>wWlIBtLT#!!Kc3JYC8EK?E5UkDkQ<92nRDPB3x*do1nU^OO1E6nsa+?`~>~bUi z;qPnEbJYSe^V(xOzwW60PMwx2njTjjRPXr?Y!!nxR<_2?20;LqgaExqD{6La62nI_~nkNVzPAe*&Dj~%t&o55Ju#!_g zYrxs4cI(KRNLV+dS$4{)$iN8B_pnU%??VD^9KE$E=Ab=(i>_D=R_o=ntBN;ICEuY+ z=3r-mdvHYgjjoDPMHQ8Yr}5nSeI3{(4<0){D(Cl!O92I};{-4dj!#|(9}&1(FNpwb zvCjBNh%Ir;p_R;Gl%ljk{cwpWu;8j+I_6lLc3M(5k5bkbWa?LB#T)(s8I)#hctg6( z;C4m7+qJv$q-PB-Jrx#y&sgr#)-xY&F}L|6kB(R=guCOu``tIRb-dwT?*$H}Z33Gx zQ1s`gic6x?MC@K%P8vQHz1=N}d6v9HGz>p%z-&?MO>aKp1 zfNG`=HchE1I#*&>scsLX^^u7#LKy>m&(v$Lyplq`NeEre|Hroklb8tDJFJT z7Du?&`h8acu&ND@8L9Y_i{eL%)-OUPiNbNqE}kw!u-ko0%jI-EjG3qN&(20U^{H31 z$`dg6GoR+X8l+Iqu08w^3)D6QGgf*G+IksQ)i-gw^dWg=7-LEQ9F&=U(m-`nT#L|`+WkKG#88hQv)m8d>yk(fEPlmg&!43{?O zLS3=1T?E-cG{(|H82Al09q%v-OfLFE^ez4dxGd9_1v$DQ2l@Y&^z66;; zFMwsMpUAOfigakx3up^6G^_7EkVR(2LBrzSE7jFPkyW9i$4FOV0 z0S;EM)8Vqr*_OLF)L?X>!| z`Fhayb_LrV5QUjiZ1J+{V;ZHx9WyfoaD&&FghX_%!hik3lz5RWl$Sm>J``M2d|l8D6rb%%m#ecofYcCnM{gOM_zA{AdA zhezW?&Pet3d>liQVt!6SzWq3QNS+Os^D1(}({n>U$OKf+$|AHmvQj*~&f?P6>+_6y za64cIS}m)7fP|$1Q(#qf^e~}lAG}oLG^mh;W4pNK{oYL!Uyl5Tr^L@*2NDjQIS}W7 z9=H!1%~yz#{~Qx(m>&`QFu#9T`x7AkiU-10L|x0Za*kj|kF*L29kH;ORvW3N>_Lp9QBA z+UqtUdik7(jR!{ zfD!6MZ=ISDNgA+{ap{q;7W>w-Lm5+hySBhKd29<*%jufpDXRAV+to9LrZgd}yLS@y zgyVJIw%BI>^DFz^pD2UY(U;S0t(~nt!EkTkYJTEkFYuXtg8%nGyn6Dz=hL@uxgdTJ ztX8ntq_EzI3JM~FOCK%ahQQTw`T`7i*fUQ4$Ri9r)hJTc%OLgl$t2L9nAf@4x(aW@N7 zT527aD>^~3B6S_1$U*gKx3mN%xO zGC^@R;-^5L%KynknnxAd(ldL{2s*E{0JQs9sk{A}35L;q=+?i|{GMyUF}O2mwE1}I z_fe@nvST3*=S4IDB0_fapKzFt>kDR|Nky?AtmIpHwHnBMu&gy+pt))cXbcR^_H_9I zB7dsJm|?l+PZC7mlE6L=6d^0a5+;n;W4*qE?e=vea!aq?S)#h;<=tm;B4vb&Z{Axt z$rBPow#BExt<&QkldR{q`NpXQ5xfgTPp#5h1$0iMxPYOmozvKS&ZZGZq>g)i-a<{A8pnCqmG+}2)z#H6tJB}{bOtZ zAw`91USLOZ@gO0va^>T`w&l0i#qPB){eZH`eL8XBv9^J7wEWl4A$^qC^mtJ~6_tSR^zUV9z1EaRAu4tvQTpgs0IE@M2u2P7U`k#cjj;ZY;9xzS=2DVH_DW{&Goj}4}BMsGgE)bKE_XhFN?i`qB&Wva3u4bKE>RTcn zQ5mhx2IRhBqCNl4#>MBx4jel`E%~l?pH_#g*RsFNnrwGb0ee(X{TOqMFS>3ZO#R&) zX9BtzfPO!EQsxmq%LG$(f+DAWU1^Zo3wr*so%cGx_qf^P1K$pE@j7}Xl-Z;mU%lDC z@ctGL9NkZD&KIz%2GT^LeXh3~jIE9anoj^f+>!1s9@uo?OYzw64Hy9C+6WRi1^C4~ zoOda+064*8J$^EI_z$DBpsIzd>z9v|ZN?*!7KTNg8DhGZtKojRb?%y|lR9{YB~8HQQ9*drJZXcY0tTkzLWoo=l;pCV1K;^_EB|C{7$WSQZc^!=XvGKV16-P7h`PKcg1Be#FK-d zgMDB*gVgU+&A(Deglqzi5q@R)v#hloIy?_tHYPc`N*`w>R^3vs-=In;R}CddFWBbr zg837BP4J=ogIa2bWtFsrg>T;Htpo|KA1LFDRk_x^D7D?u?Aj3=CS$cvu_Tc7`;QHj zrZG=~h!pmNXLnKjq=P)&us!)0r@7SkhmUGWFq_}%}?UYVXD+1|y8f-R2dN?{^ebn#wIy&=PMt51AXc)Dl=%?6+6Th{V zhZCme2fw?=To2I?F!hI}pv$ua(5?AlCi>s|eW_6^^AGM^Cim127>*CqktDa%Z9F3z z^s7fS@ezDJFnZj1&mA97eff~tauMa6t8#L8QMORU7d$k&ztH04KDM}Ulj`C&mQKl3 z6Zw=0laDDm;^~Z)3ODAP_BY(N?TFYDkL~dzoO<`uTt4cDq5r>0=r)Kd+^Mg}&m?RpjE=e*hbK*HtyP z-&dGPWes)V_J1iDvYMl`J9{Py?Nro=!!J~O-F?32*WGe)`)0Fb6%YJ}5LeAuG-e%T7%^qWoaHn_)LLU9U-BZpD-V%GmDkruooQwBDlv z2atqxQB-1~3e*chlp+~D+D#WLbFswbE}JemXw1n!XR{yKgmr>+>s@o3RGam{80n!P z{#yFIdzK?&rQ&wl$E_{b>C@(k>AMQsqwR{1Td?W)H$o=~D^BLFNk}D1>2G|I+k!vo za7by(pm>)eTF_u<7wYF&|2>TwWOWVuA)*)h>#@n-q;H#(EEW?s%Oxh;pMT{wl#_3Q0Gzl4n6axViY+`|>w63GIC4h9x zCVu{m0v8Q(YOG^A9hj@2zWQeXls^*RkTneG%=LQ^{qiGEhlNA@A0wMpn71->o)#aUUT;lX4tVvGi9NqqiT=FaaUV>q#VQsz} ze_=A8FokW z^CQ(5pg#9+q-jNClL#`NL9Ih(lFdCH3yG@ZFn34~g_c-|`}5kI4m$y)qQMz&=^2Hfq=Aaul0K6sR%GL8#B@oBxVqYu(oOHdjMu zD(r_95vMM8cB>^S(cIrW)VGmNm8}bjGJa!kwC4Eag`tq*D9CyQd9?BK$P5N*#3aSy z#q0d+8fH*fgBQz6-ejKVgaL;6 z9SNCBfyBPGq{O~AEK&EjYP&6e$-IvblgZVNaWr_!o~T8Laz57D$1>L z#zl*of~d40sJfP7S+;zu$b#Aw891~aFufCwo~&UU$Nhk8Eyu|RUB0-I6k$mk(K9G< zOB#6r9tO`|c!-%G=01%CXE!YK-w18bp1?sl{5;mx`n{|+JoTj;)-&TIDtsvj zJuJ3Fw4%P?+rSPEL`Cwh61U@MdNMh-#T)ooR=O(sMhAL0|Am7m1&QAfR&+pp=1rzc z;kjr>jKa!)tlzpfm(nyPJ9wMdYLrY7`C;#{>7VZf)$GSh`aN_T&>7dn6!HmYii1Xj zlt&csEOeiUW4c(ojARi{-k)68l%uNsN7Uo|kPG*3*kU6cx`$~*tfOjNM>n~k->bqQEkAor0ZkWiJLIlz3n@=-jSvXbEL1zSIk{Z)| z0nN>9)oL@Ez2**TOyv2^#jRv#IO?cUuT)~T*Z1e!#NZKp@z~D>-IT%t zdZ?|w*R{XEMbB)_H>hNXgBDEt&7ntMV6T1gduhkL-{sTAtLdG?DGA4aFOWY}Q*Bzy zp*nWLQmK0i9~wx#${LZWZ~Ig|HciXIF;?)~T2bIH`CTuOuSpAzj)=s#A5_hpR~eOG zC7{sagm8Bdn>lMCN6$TJP(d0MbnkF!4X({DYNZr?AwkswiUdKssj!3sP8IYX$RrlO zfZIrv@0qZ*LNQay3ue42)j43*4niw^q?C-{UHYhHLFQ}OdtjX6O2abpekGMj4j#Z_ zP85q9bY}q!2h#cq62Qv{##CF$&Z#L3abA;eX5*p-L#|I5?dKZFvER={GH1?&m$iyM z8I&?(!}|m#^4Quw1rtBz>=&B}u|*FB;qe`-i82O4!dZwPEpbj)`+gzvymtR9H+s8S zoyBx1aryflhtqRR8oYRoCwE<7p6%eKO4odF9-s{gp2bm`|WXUJm%r)*wNw5Ek6j2J9 zFt|DhZK;93YY!dwd!#npKQgW%hUK&y7W}!*RyGr`?CM`884TMQpW#y55wfj;l}nJ_ zi6_cx{>4yLKNsWMRGhAcO(oh(5T#Ht4;;jlDS8)IhbA3!G;|R#c%oNsC8dNSWV|-@ zT2ga{N6mXd7Lq95`y}3zq{W&0yG)B}JJ^(k;B1$*fn66jX4P+&-YxzdMDl@7S zACC_Ky6VW=eoqO!mGY$J?DwQbwW&%DzkxhjsmSX3?l}k@f_vZHR~#!fSxRjb)QCoK+8Qtb(uzEuXTsFjGp;9Ax;=H)M?2r^<^X zsRq99GNM6RolkAeQ{xJdtpAe44joJ53hcrU{6!hKKpDu4(*YW{(i&@;U{no67zsFb z(N8Y~HKUv_caDf0Z9Fs*!Pj=#{hi}#v-cTS#l<(f!;x#04b+u%L9Z^i=5q;`!ygZq zNG5kTrhTx(WYy^9_3wV6iDmbUYVYTJU#dxM@r#4tJtWu^0{3<(UE428a1_a!f)rp2&Y4K_qSy1v^Sfl zUt`&IS{kV$ySkrdSJxAHV^M=kMm78CK11rK-t)qHNedlRYEciwovDSeF>#TAyPG8$ zwNWeY^WSKQL9~C?<7vUJciZ!%O5`M5Nw1UWZTwINryArLD3DbrXR5ay>}Mb%CVqE8 z9&u*M$|x`F>(h&3jHmIU8N6@yqT#x!Sr?eSYcxp^DT%qZ+(Ccz^&}(Xv1}(T3*k4L z$aTG~56HWVcX(4Ja}lenY|z{T5qC~vfq964L(?8Dg@iA93G*7^sh zc_oFelg+7`7KuLhc7(OBI#UagQW1w)!_)6R>)0N57{6TlE40C(hPU6q4zHo`uHqno965fXNWWBh8Ufu(Mu&&vHdl&%y^{)k^k5z4%Xwz_4C3e$0Uh{sOt+qz27bL%EtG`8;%m9eTVm zT`rD#1y8Ww2kYerzA78K7LP%tN)5ix$c|f#<)r19m^^tWCm`Dcc@o|5IO!|VtjclD z^N^=RR>{gE>R|4WU8t<|%wH_2cjw>{bPjXc+N#EJBOMm3`G9?H^5N;?T^%{(coyZ~ z>b;gI?Ybg&U+z>Dak?)^zhodox?NFsOlF310qkNbJ1KL}@;9X(rxkLNd$}y(5T-!x z2LRB~fS*He(?c!VQn4QmC)Bj{n)veM;ljwfW?j+S{SP?{AsaNv7i97>Y%gnWtZf3RAkgGK@l2N{R_Ib~Wz8hcKBmD%)jP2{XvrdA5q$sVivq|AXU{2sW zNUsnYwd-2NM;7)XWnuCNEjAeoACw4r46No8G_V#am0)Cg-=7-Q?zWdoh(>F$K+{Ds zdp1UllCN{KX*ySMfPaCewB_85<F#U1JG(Y8J?YA}Py--mN}lXP7;@zTD5r)KH5Y+!w5Gw#S!N*2yyDQhDx zhR$stg_zZ2e9a+?w+2nzHx?x-G<g`Q2kk^!dYp^!J~l{9#gbSfNzLNUF)ebJyy#&Sdk`UT36L z!@eC?|Dn|mnK`LfBU$gQJZwbfrk;zQdApL6O z=%Fux95k-`yzTM9ab+2C?+@r#@~ETVx9@MjF_R+=f*{<`1sbDP|40y z!*C(8^GktTbPW-$c4oa(;3vtUc}#pe{c|A;Fi{`^tKv&kvB@*T6k%HRqqHxaw7c$n zoBRm|5{^dvhsp0JI1N3#;uRbXqu4jN1YXyiq9P*D#&$ywVaoY4^+#&P^*ZR^MG&() zf}P?~+|*I~T1A5+fh}O5PF!xEvI*=d%A?t~inuZA`_qJN{xJdYmK}BXkp2Unlh4TRxUYj*WlqPSnp%dY8$u*xsOkY0QVoNbVbeHohgF%z0H$Yc}81`T}d zeb`}EZ0bkOna0(gEn{kScRdHWy>u_1+l3F$By}Rkq9rIXGt@K*PfHuIv9WogDpFxP zx!|!=f?eUXmcF$|`bbsta^ZlgecCiV5`BRPSW)?(*TRn-`A>aL8>fuMes@IRkWf+O zk-qFe$&mE*Wp#FbLC;n9HUsDWGP32wSj+YOw`ru{}xb36jcH6ndUHz3s15`jS;Exz8jj$@m5o%7k1>&y2{wl#TtY zoMbqlm-|>LnF4Qu!QP6#T8WTDUW_3}@#`P-q%&dgxB8iY1(<22oFrSjC~NvFEv~9` znVw9cUY8k<6kQ5bha+IY9I99rWSH$Q%Z~<-QOOtFBJg2xTBP<&Pryh1!DH?H^osR> zSt|Nn0%C^pi~zd8ujnlI{FuHIC+!yzn2}tK62cS&d7hq{zo$9faw6n%zo?EWWlnJy zODgK>5B8Zh^@j>mMdt8WiI#sM=TK`RB!l6_{lc8G`5SY--77PvVXTqvd{^pG~GT>{dnfHX*l!l63^k#6a3kOnE~mImqW{w|*9{r%U+x^LFuaQe(#*UX+h zdrYdDvqryz-zKi`Y*|;Pk~={lEL++Y-@G$gA3|MN7r*)wDd6Ba(Z%cY(8XK5W0KnJ z*tg%*2ApbVkF0k`DPmiw6Lv}j|z3W?+3#=3Xf z_iA$Ln%)!!uW`!198lQHQe%8v$?h^0_fcZ-+5xv(WRxx<%h!;E}t%e8lfhYzYnNVfl4qw$$`+XK?{muWaI%hF0Q}; zgy@weFHp}pGrc-Ys`NP10&;>Ti%oi4h$dgv0}2Zv%BjW_;~$HN)Qpz>!6MZzL*`3* zRIIwCJowXybwGc)yZ0^VhslvJqh%=#md#h#tMaonr{`~wNEIS4VOQIZl0Rg}3&dMJ z|1d=IzU~7x`;C78&?5SD*pLxYt29ZulCY|+vqn&^^m-*tk}6k{iZwKb<-w|bF#%P+(0i#19!n_luz$nCBzs1$ff^@~GpnSG ztknDCK%dD+&iP!2z%gp@G2rEpa>u`j?;QGrqJsCr9!3e3gs!c;F$=Z}Hs@s0ioxWN zum62PyZZQ$k{D*BE@>p&OVrpX7(KZ!1=+^$)`BworL#CBVmW|hSB!EKP1?6nFE*=F z3DZln@r^F%Qn*PV(E~d^oGy>Np)iz%=dis{NxPKGnu!@9D0aOFVmNhUC4yH3?0lVr=Alz8k<}~-&Mh?xEqzgdoJccg z&ydR`c%eTS?LQ0lm(YN`0Q|LWbJTMUK~^85Qsie6tRVqmiE3Z&DGGUuNf!wQVhyOYCNh}- zz54Chplxovja*M7m%~E#RhQ}5Qjgi(GWy4?YsPP4A{S45;Eo+5F1`BjMU!{-4? zAR0;-`!6KYR#ZsBaP@+bLt4d^UnMYgXI2PXZe*-NqX+5-(?pppAo z$L95~)aYftRhG%fCwv(zBA#VTb#h>{TcrRn}T3thS&JSXKmOe=wnxdhz@}{ z_=d<*`8$7be%`O|uG*r1N0EAaoeFZ>wEzs|kpjHImZ0OSWqfhQ@7=c-^(GVf&7;%v zFDqrS@H;mx6ue4Yk;8iT$le)%)?|EN)oOnwN_*%|v}5FS*D#)QTk)(AY!v;S zk6y(5ZX!c|YQmz8q?O}h$qa}K=yJdU27-gKZ;2%2#MnjQ;j2=4$5>A8d|12$1jKu8 zRsV$sF?6O_VYQ#3r=#5NY5fKE%J^|Ol0Sm$dUAw8WK8dItAX|*K!^U&=F05x$~HKL zM%Kw!pi@{&6H<+V_|D;emK>1tNHC6N*l_EzbGNb5eJ<%z9}g8a4Ee)njJya`L>}OP zG5M<8UbX7DRL@CgCEJQFK$!~7-rzZo|0-BJB2#!Bl+s%}7=`zn%!K0dBJtc?tGNeG zIGC(_#+G~AWP0zf)H0I0f6qisvkgR59PXeCGJlIvbNSkmNODv->K`G!`BOgcgrv!W z^HEU>!o7v8w{+D%+wK+>!?u&zKZ8*UW#;pNoWF%ngrkg_AAq>+hcZ8ijIS%g0I44; z>D>T_ELFH*M}XN^CbM4*Htm}&gd2uslD>v-o^5H|YHWe)b6mDA&R^}0gltfr$ArONvGIWsJ+w}aixe2ph}ys*3!oS3NGa=oTE+v34sqeax2^-pKk zYfn#jK#90oJKZ!T7Cy&yJ@m!{OCLD+(@5Qx8c6^x30+sO+2PWL8Hn$a{&8Oy0>mhp zld)i$ml-VP*6;}T-*6O8?w0L)zPO=xtRj9XKV$xw5fwQ`s2)=r{uLr8DdrN9 z&-KAiKMqZY&iBzJ#)@2Vff3{6C159sJDQ+=C!AMP)d>y~dpCXSl9$c-JF(MaY;yj+ z-sN50D{nM(i#MNQ@^t2Di9n{7fHO7J#0*HWxe=iG;u()K)#VSY7$K7vgN!5;TVZrr zz2?JA75Z1%L-bp}Zc9UsZDN83)`;YryH&{QSNU2+6Aps-q7nRav4gt3`ezU7F~2lGIzOBZ^-)3!rY%(qBcmt&Gd^-f@S#|?`Pd})d#%f|mG7hu0=BeP5Tczf{~9h6nRd?r(#M=YN~&KN=X z;Nr=<4esnexMQApaMg8m)*&YVN~~fN%A+-)mFIaowa&w%_yUI}@G?>tA*~(EOD2ebQ}>goq|&HnNouf29A zNjMN5?#`StcCjQb9X7yFf~;>%ATpEr2nD=5GGYhnHJ|(b_B;Vw`hNzMt$PVQ)*t&$ z!j{?sQC5PF-!=vzjokEFPnukTfuOGAb7_Z{F~7tw>g(Dk{?}o75TH&OA7Y5+5jdtf zMqxQgvG41IFX`_nSbN7N4MCvBKs?4oRBS&oeMGxua=)*X8C%i{c6j}OnJr(40!ns8 zXu|W<`zK~uN-LtaZJeva+2+>w-?2hg$9L^GQ3f>lsTJN0vGr@0A6};V4Dn*rpfb~c z*;-4;2zI(hp*8aySDBfq%g!!&A@M-zpgN?all&z}QUp~+$xM{LZOH&OL+*vnNRF}2 z`4k@eFw)GnZjY z`(IqCm?%QMkx z7yVyGZ`#ia$A@Ab8sWUM1_bSYQ5iot}bw!$aGaW zO|y;DoBQ&7Y#eKPhiG^H8(Na2{Xi*;KhN(^@r?6I3pZgSG4yXbfZ;g5TY|ohukgdh$&0ay&n{L zXSyxDb65-3i?VX^Rc_Nn(4a)1Us}rPgO=XdfysIbbdBD8^O9kTSY79{Ka|g=WIEM2@kw{;fXR zw{u;{4Gi${%%W^esh3k=zv%|~09Y3RGW62p>uBLyxho&AGQhS<5Rl2_!iEa_v^CmN zNFQ&aX}nSpJGL596uHf-zEdY9(Wpq`%hw4vFM^ZK?*StK+Q9>Hy&a}yDeN;|X62OM z%tpu5JDA*m{IsX0KNhtXhF0ScQ9ORc0Cc#;uX3>oHCzt~0Pta%0MyY?b4qg2YTphU zM^<4Q?g@}+L2~H2wBsx+Yhy#Yjial^mN_KByy?K>ZC?B&Wcqe|MR5uZ(8iowy8J(= z^NrmOPUoX2trU67H>i@zxr4P@yCgh-Hfxn^&-32~v)SlZ4s?V`A_fnJN zDzuZXi{OM?A}51KJ_JIzBo+NE$oR$o7Xp+@s65bGAtw}_swgJ7%O^QGL< zra1H%(7Qtcf9b<=v-|4Qm71njuu4>V_ZJbr^g7@2L=0bt<+STyzZ*nf?~CY))kCB8 z)+!%fomw)4Fr&_L->2p4l(vVD_g!uGaDMJbVt|ZC8CkcC1$E_|5U7PGV8u*WH zM?O)~LzBIUWu=?A?#%Z-Z%fbH@b7Z%B^4m~eHM$)EZZae!qwz*Zby~*+1M1v%g7s# zJDgC%1X=uro<2k+Fd_sl4}vfZxgK&D=SR78Grpr-7@gOTlvRyg5-$F>+_`Jn+NcBP zfZWHc0^b*f9-1Dsoc70&oi^n`Z-Fyk%+W&+SWJRcmQ=&By|dx@`@c>aq%3tt7cQ4M z)us4`Tl+u48m+Py2f`Kd!(16yC^847X1_&eGUJm=7`o_^-~awfreQrX&ckAcDaa^g zJyAqbwXz;VjrvPC@ZPnZ;m#CNv+H6y=H~o7urn8ABqYrDPZgK zrR8)TbnxzqV$g+T=s&%VdOA&qPPmxu*F0(MGBU(}xETv>%B6=Lkl!_CE7^ZR7cLfD z6xN%&<;Gv~9DTfVB%$W@<~_hWze33ZFl-GIUtubpCsp#|GCo#(zUA)1SH|WDsnWua z1)9GSJ{#?Nso)P{b~;D*>n`0NWwz+~58iyT+#{CT`$S9b<8Dc$o5D~29pil~%l~Yo zIiUBfyd}7>u&@E+@(y;k`pDqb@N~_&7Z>z+A<*k&cTS}D>2bJJq>n`90S}@0a^3Ig zJma{JQeb`J@h<48Q=)wFztVFZwQf^j#R9fYKF065SBB}3{|d}_ja@@ZsKr8e_#(bM zFE4d&_j=T|ILbtd%*i+%X` zM%?#fF+5U((m^O%Q_g=;9ax zxlv4IjuS|gO~_-BZ(Xp@tk*}IhLHY^TUNP zMHtiH3g11n@_ys(@p_rk+aruTKp3QIsNVKoqx30nV*1Yoex+>)hN0NN_6)jrP;_)^ zw-*^nSL}MhNk?Db$v_HOUg>i2I|=u#FLx))JoosIGk*7!mqzZ~%%AH8&jg4|=A%V6 z+d`gBM9Mo$qnBm>B`yH#p@vqZIhBh-%7OLBk#SJ|7b=G~@cx1n+8AA5FBayxE90ij zL6UV~NK?=Qv|!_vktNpG{xNjdpVNMTfgT82&_kAwecSeg;8C zW09A2M-lr(0x$X9qwk&ETN=XPuhoXd;Y+l3{i=~GlFy-DV-}_3fp`+Gi2|3n9bM4? z^J-{c-TKW|y5uOGq-;iTMIj1lFx;Jy2kBAE1rohNTVG0f8&stAg#BKbt`iu~ANADx zUDou6b+cd1=S<&;$(iVaOsw>4(jBo5ZWG`8~O`psA zI0Gf6eoXlh={SsOr~GehsQ?I31-=!H=C3@nJ@v`=n(Lz zwK*d*^Sw-``I*t!G24r4OMy`LsLl*L&sSbt!*;eWAu`bFWs(By6cnS5lCIa|VCCkjAak1dn{poZR$C61poh ztKMw6td7}na>OY|K15-a1;BhG-lV1L_hJOz`$$-wG&3TfDMgxL`+Obom2GGF?LE(k zGCKJwv1%OsFd&ZDfzy_xA-{>VpfVHS7hN02RNmM%SrL<-*d9F*wrj? zSr=q&zdvQlFq*0C3j$*EbMh;fMZ32U&Z^`gCqzup#H_D?LEfSWB<+G&`F{_K+7~QX zLss1su2x0+2T$7S589BQzwW*Xxi*6ad=;{#FEec)c9D;~w|xH>V@|P?Ll>lW;>#JZ zyLXOYV>hrh%qR!#woBgU$1?j z#7Z!x&+XFu1ucxhjLk$6D<|;f!LDV>NXTzJQtvuHGF!|Pe0-8me3`l`&dXOAx>B*i zO3O_NwJqslt^Cc{ieizymuee$^~}2XOqN8_ z-AjnYVsPkrlJ*}^)BP^x;H=1Dn)D@8ZHRC7VN>}oUQ(Px;wiopb`{!3tqhuF7}HyJ zbzCipzMXpm)yI<57nIy4hcZop6nfQd*yzeh(t&=fTybUq=r}`bm5FBjv1f#uDliO3 zeyvDof5s5@TX#)uUd2ppxfJt$JY(X$1t*wJbz)UewjA|0>*gIl;WejxU-J1+?C+C) z3SLx$cT92#TC5`_Df!fOXPcgq?O7UMcA^HGA^ixcj{Z2De01dmJr*)}l7bay<89}j3xF{G7iJ{=8;bTUJ&>&|RC|nCCgEGO=;)!6 z-yajXt&=@&(zr7my=>8ILZ4Yo2{5|9d|EZ0^0o0a7AkA=BUxhbdl}vGiRC#_amc)W z^Z(2Q2s6?IR?Fo7tK1G_LOxxD@waN++1Z-!hxtxpe+=_<6Nd8JN%%k1P@nsEW1Y^3 zcMTBt_u(Gswklp!3XJ@jp?T3WR|l8`L8VBT0ik-Lv-6^p5dn zi_2Na+|Md#7rBOIzvdW?*|u`f9H%U(y}J}L^w{CM7UCAXANAQjDwDBV z^&l3wB}Z~r>9WRnZF=;1na}6U^9==W@>$ZNSeA->uL!8VsybD9j=79wlmoVN<;7f5 zYvJh)Kv5>8snxIdB8Rr<1l1c>+{Wm00o$5=-65g>XGkpw0%$7Z~_cp0$KR2C%erMN%p= z|C|$kx)&0WB>w|aQK?_Q#?~sQVsjWsL|pSvs{1HxrU;bN(v-F;=qiyMNQJYNn(wEy^7{RAMcCS7m{i(aD=RNOlwzQ+|aPY&9^1c*) zyq;vfrlo^XR??MphzNvM^eAU}vEOZJ1DIC_In`@-Bs@P{7)J@;$5Z3-r9HiOy(3Z7 z<5e1OtCfKA(6wR#srRS;qg+AVyM#1JqY5;fO>_0J$N zjX;fN@!HRc8(e2^Y_2A|s4ac9P0|T~Fzi2wvOV#m^j`sSAzYrdR6X=E(GHYqOl{nW z6Q)ufgbNm7n8U*XIcsvNMwF9WayeIMuTP5l9TQ)Zx?UnnXEexMUrGr~0J|t5zc;*L zaR2aSdpXb$G~R;3kRAimg!r|5VrO#Ve~D&~tagHFliJ{f(FEhW>3OOAnVohxH;TOn zoe=Ynkb(fjL%2T)OiY7u!?O4WBDtc$vxt2437Ac05u%k-`{z1Mp}*XmPkHiqJZijEu)n< z!}9k@{(!nis5tK$9_5b_iEheX1s37RpzknH+XIIIme*_B(iU@X_I*~PN3G1SADDQ= z+YbUq{zO)k61*rNZYK4CbUh4X>=IiE`MtsFe6Qz8Y52^~!>)l?aVjZ_w8YcRUvm>L zSD1;Bds79+c08l{D@uXSsQzlk;umZ_bgFxOCdwwMwxqA-zu1`0fSM4Mi;f~7oTlLN zrJ$e{BZ7)iW+K6x8Bm#A{Q|gbIQw{%=3}xZ)3ihZK3&_^M^d0Q4WO;6>Y4%ff8-Nz zXR_*w2$&+%why;u05J&s>-7fmN>)5sQsJf(fEzMfd|&VN8Rv)Q#n=s0yf&a?e0zI{ zU)uZ0f*T6PeTh1oeNaa?9d$*H;AaAiEvVp&UKt&rj1Q&^(141o*c_G!ub37yq(wbour21CPH_2Wd;d zVH1FPjESbDNUJu}CsVXl+HJg;fbpWWKCeVD3?NMtt_~Bn4yAX1)?mW6yXvGPw!jDo znJ2W^!98$E0m*&u+1ocOI>BMh*=}mQv|jN|6x`y~d4*m?X36^oVs1bbm6eJIc(T*NDabkyD2AYfa__>-XMTOKi5jrM#?-+g%6N3uI89rY${` z_7!6~bt;Z=YsB*Kn4+aEkuY(j43pPW1xRvS5p%-yWp;}RMyWRgfA{ZeeioLh-tQV;%K^nO-xkceSn_&JgQv`s1@v^<;l0Gt1@i6jd({b4>hl26I=xOuNN zQc}*Ku}i+9oLTRMp}RTXI31JkxQ`Rw@_~+hX4wW}(v|{a%aPMkBTOnaVs^$V$Qo7_ z1?C#m=YZN5!1JH?AlpyK^WU2RfDQ*NHXD&#(}}NFrWde0lP_$2->iR{Pp%moEa~vg z6NMhL2UY}RR|4?!`udj~O0*OE=*NHK2F`JH+hTI)Ow%hvCQLl?dg>4gPpdBKS4A{1MJ`7R78nt@ zT&j);E&w)5q&On@bHF-CtvGP%N3c9~uvpHQcje(M+H~<^?bx|_%hgdYqY&XQ>mA8$ zqL5687-|VS!==#m`p`Q@AGoD&h-;7t_);=9BDaOidI;r$UOJW&8?N3ybxagRkwkYKOE6Hd0B88FJPBMjtPqfSt$3- zDb4rbY}2|W^p0Le^Z1(t3hZqOJ(mgbO2r9Z<_tB8Olel3h53*3GKDu<6B@|n_Oe`G zJFRJs?UD9oWh@7b_&%`yY!<$A;=xt6*VTdR`z7Q+2)b6_&6y$Rh9MEc&qt&%ZK>}M zTi=RW;q$>($juh^xfkZS$KRH}V(ok4?R%g;7}(X%sBL`gUwZPn;6mK|T%6b-TJ)%= zVIH<@8aB(M2_4o6UA{N%Rk$<_I(kHALA77MPkZh}Hi%i3P!9mKp|7T-(J1L3h9l|1 zf1@zCrY1t$wdwDv&ul5`Gx*w_krW`{V>&Zvn@HWBO|n~EE|ovF;eG$!rZ52}vZwv_)eDt zK!3r@0sDV`p;r6R1WPxW5Q%`%Rns88jPOG&XhOwQ5a~QUT6f~fE|%&Z7YP=YoV0+b z_y&X&dM%xQuEf`xM*McW6c83qR9-zzuhUdcjH|)WVA~mVe@|G07+2nmAFgP%qBg1* zcV{P_KRzdZ-Do*rX~5i>ukKE)-cs>_NBCizvAT|5tD~>Mx_!BkE<9PAtAMht7b>tT9cy&r zbPP>T1{_`F1b$=`Y6eCv0T*co>M1-+RJ?D)6RKzk6tS#;9_s2cgd*Iwc7-@KijjR@BU?{SeJWb5nYUH}H=M zl71iwsP`#g{L zd7SXgtzU8vdSyRC=o~`fT(Dd`x?mc97ZMNrCd!;}RFVYIau{Be-eW=6=Er(-nd-HkDOSivqNgtftTFf+$qi)V~Fb zK&{SMPZ2IwfJT!WXxYwP>yPkl6T8#Vgz$(_lZtutOF({S))3z}LI;P!?-4Gm?AEM1bOW8A9wBhlV>H4r);iPTrbnXKUD{km( zEVR{!EA)Tc5V}y^BpBlWjpsEnO8eHu%H;xC?}3{jOm!D*B;`LsxX}K?Udn}xj*FDT zPFg*$W(1p_3~e6Rg6f7DW+qdSj^boZ`6@LdbgYj{vn7(SQ% zWOKQQ>NNf&F7pz6aAlUDOCMf1vc(d~D*o$S6xeu$(jLI%2XP-;2KqrFK*o=}|APd= z4HI?R-`jlt<#I=@If3eH1>p<^kh?`36hf}&Y6=fg^-_{~1tBU(W5ngun7}}LRYP5L z5I7`o30%Z%Vj+TCRXw);>m(rkaC<`Fb-L$Vy4!vgHn2PTXFA}yR0a|f5cU1fQ3gNG zVRRP138{YbIrJHbEL0c#E!e>{{r)NY12g|y&)sh3V3#~9WqgqIf{|&gJ1(p{HQ!d0 zKMVDO7$88A@rza=9H^{^T4Dj30$u=Vsv|S+y8d$`l7$lpF^!`gGqq@6rzEu7j0Onx zzK9+U26r>e2?}9(zFUqKa-j|kz`xO3U3NJNb*hS%g9QmmsdeP>v3;J z?0%MaT~l`}{)_r{<=d}-=qrMVoM5qHuf(Y%xhx2Y?Vy+ac*8yt3ek3#%{LL8ma zrtpilj}?DfO(V>Uh1V3!%p8mQY(m2z*R3VR+~S4d#Aj9@gNB8cWE_D!#-!FtrP9#5 z2@C^PkYBXtvFV8gNlUq}GnukcJ(CrI_s(=5d6{ir$Ai7;;1M_F)u8>@>0cAhHb+P+ zZtZN-CMhxB@e9v^k7GuQ(9ozCoGo{_-;o9!mJjq|?k=ow()pu1HMZ2e8X@~@y&D$x zaWzhiCt!4^7`Jbm2hlT`_D-Q^MJ2>>V_VMqdS?bS^3+j))}1AfJ2PUTQ!f5_FIJ$F z5TE}q*)fqxpu%pk^!j$M8d!e_)c@E+=()2F$e*IO?;nfqK}4<2y8fbN{U{;j<4ZXi zctl@04r<39a9q65bGQ=n``ob$O-C}8UHx8LK6zrfQLmWUR7601=HfzY%R!US!Nw{7 zMnh%RTITIrSn%Td<|ssyj&y}eX*zF_hHD85kYY)f!oS^&1kxnGbUcq$;$i|c6EM$GVGy=F`7_smw3Ql@PL9p!n9peL4A2>S1?U{xmIv<~ zya0u1F>tP#mMgjCoRqS-Xzig70m=yE6lAO39Kf*8)Q^mXg1W;zQ z1Qf-cDK=T!a#8H6-#_iQZh2{5TsAx)`1skUV@p-0=ZJL&!BB8ZN;MfoZ_;w(BbX5-yaCAxqO!HS=i^-`q7#=%D(lbw>9~?4Ztf;n1&X zc#}8b^D4nz9SvjsAswOmW_hKh!5a)7HPQ2Ctq9ryna(ajE2so<4$&DICpx0>tQs&x z@sJ&C%=1w91blF9U)E25*On0aWKQAOn3(Giad@pacB<8v>j+8x6%FYvL}Xjdezu#F zPqwSz3>{eQ`;c~Z*C2DVIZeWu(JH#D(sp*c1e+=>w*G%yfR;M9Hd^SiP$*-0+*XEr zoQSgDpo22O%W~h}J$=h7YwPwgx8pMAsR}DAhxo6UZ8NvKj(&OF;SdBzpDe&4Xz4@n z-}YOPT(MfCtsMt?oE8Rj_w;bE=Tl>Ztsp`x-8%(OHeRf)t*J#ZghC}0r8^asrD<8p zshOG6?SI}Rm+HAy+b)p$zhFC?Iy&otR&>2VGD+@_{!MP|dOLg5t?=GPN=T#6cQdz z!@-f!(P0ur?2**a;C}0gFt&s8$NP+0IqmiZ`76nC4mC|pF@1f(H*czuR|^@Jb7a~g zNPxC&q?5jsj{$akENiSo$mit|;Bj+pM@m50*_WN;ET@mHb5Le!UF69l;)@uc_V{Vz z&ELE0jfn|pXS}!XJ)@)JNzEs;HDu}Imz2a$y9nI2o~c4CExkWspL$kNvufZhH6DDR z$2d1*SmRU3=Hs5kTDpV_zZ6;YzY@LwD&1EkJmT+5W0hvwc%OxPO{!mpVHoW@hpeW( zDC;RN+%L!XQI}-UDos>~JIKi#w1o2?wFKU5I;RJN2MR(6q8-BKSZJPa-myH$Ey|Ai zvyT;r?fmOEV}5o`;&i_2{C9yLg*KV2ZK>yz-epu4@hNY`J*-fbE||_;F4-yKb7p>g zU`i3rnu(3o`s_+#Pi(|M^>5KARFe1nR?Ymh@*Bn>QA`iji9D1FninIEL}$nNXd`}I z{@XKSQdU;>zV?~}dG!%@8@pK_WnM(P%`jsy%8BGo@kXB;jGrM5#?2UHzT}*?2E$>l z7caSv$oDH0|2UAXjum@Cu25=>?Vey1`jT{-l~)oBdd*0wjmffD1swA+NL6yn1Ou*? z_!YakWdP38md`2Cr-wa&SW>!Vd|g5sl0hQ^rh_RNkq zJ5OZ|D8khy_#Sh%nqYF(#|I8*g^grn7k=*smcw=Dei+hfB^z$6W$&Ij)liB(>E_>* zBMEY{O?OR0SGNl+ptJ)qiI&0X^x-E93;hRAB_w;CA9yOC!!ZfBo%d%N*Mq+O^PF0Q zooV;Nw?hxUbcdsHafZELhv?_MWbkl0H}kkGxjd`bk)Iunra1<)hqk=+Rs?9`i}m(u z{?MHN1_E1{?Hc$ZdN5)WWQ5$skPwQkBhKxyA=<{OKbcWr%d8&8;_OE)W$?t8UQl-rsY@Vy8=?3CfxZ`vkiWL}Qe z7`B^vt$bY;DspdFAt;A)7$0yuw6+t>;N|O(fN~#MQ~BRv2lfBwdxBKtjQz%lh@lrI z^dBv*Rdm?rGvA5O73*vo8YoCH*4O$9eckG`tsfnmm-?vD_uU@Qj=M9*7~Qi>m^Jfv zY(gF%35RTrjIBgS_sDJb?$EY$xC7@xTQ25nFrt2p_m4ERuP>0UMQUH3?5^VTdhKFM zBM^qX8VH^B;;pggK``b=+FJbgliA`(eese|7MjZ zLCK)yF^(4M74OvlDD*{0z|C=W?})eI&Le&9l9#OY22JQqZH>Xu>i!3#)9t?q?mIhM zvv-r#-X}}JHF#R8r~T0k%uo%iUD+cSa*nVEs{-h8rg#rjp?w=CJ6i|%3p=iu*lR4j zyS=4PGnD&(8u7_rWtP>&f*t0kpl>4RMq3tPg8CS;82WuCElu)GLr)V5S;XGB!8eTl zs=!=m*}jHG&T(r+=&V6$wBp0DPgS0u(Vgo(u7OuX2Hm)tX3!hL!c zmXnuUFesfNbcP)3@a@F$lOiOz3x+TFmJC<`s~$MVLFgFaA^SLG$!DVpijJ ziH)M-^jA*}g5KYEf{eLKB=GFo0_FZo9cs_5P|W%R?Q59PdV|ZV5bgeag+Us|?3$Jd zezCVwLN|>TxdneU)U?92^15>;*z;9KXBK7NIdUcM1fGAoT6NUVu;9Z-{z;?#nc-lq zvEVQKZ6S*kB)T6rSHIsvv#i~MV`6?%+0$CM)u5H5h@_N9E~)yYIf?otDZpD+`kmZG zMBg7*WXdil>te!ZUt=v#ExWXf&_(sFPh$xESZzN8_OAF?Eug!6uG9`TNxz~QTdr8> zF)GC5pGYkgJ2Ad@jc*vV=soFy!vx}}%T}_JBbvy;E6B>02)$cedpU6VmQko#UwWp2 zI0k)aF{>72XqJ+DGKCsk<>G$@T<4RST)$lm9@KXC-=-Sld!+bMJ2L6c4&bEt$I0j=jzxQ z??o%;%*Ob#q4Ea}%w<342$E=_5cz4z?&-knwy3%$@1UllAN0x=PvI(OV|V4)m7g$4 z1?Ak2;g&kcerV`F-5Ic1QkJ`Z-l)M+XCLSIf7j#;FNEPr% z{GBa7e>&)X*N(ZwcS>k>k#?Ri73+0^^mV5Z$545_YvyS%=SoD@&5Ef_#K|0tTA1NE zTH7-E_~VrmCf2<>Y?c){V}=9-y_mIG0+NN%IOf}OwRpvgfYvgcF2sV3k3W*g)O>t% zfBo=CAkNDO=iucNp$D@~ELM_^fy>1N_L8#=4TK6WIL^A)2G(o>?v!N1$Ft#->)kvo+iEKAY*~h1>ZJ_Ws@?zUbC`se7N}aL2=;m3SwuN5hR)hi}WGjcvh=i9}X>fchIh;Y<~e;~_Xa--7VshoMhC$e6xGi^rE%&3dU zU!ET4%Jr5V|EmOA6=AR0CR}NqM|%8(Vg(I4`CaSW%VQYG+!6NvFwIJf;UN(xq5p3- zI0X_Dvt43>jvGiF8jM}#Mw%;ldsyH{qa+xEdvJq+9*T_SC+Va0LPex5?Y0C)dRO;V zk@d!?Gt2Rwwo%SeQmp3=JNO^0lpIN@9(v5>ee>iNj`Q;36|3r!==kB4?BX3}l54Bf zDKZ(mj(*=^pWDe^e>F~v-+L+ZV;*4n#eN5C-r^kG!6_9O?PRHRP$s(<#WbA20q8Yn zTTF<5vLc}WR08=4P=})eb0s*RPq)Pj2(T(Jr%0a?DpaXH;E&O{gKTmF-QNESQlyb3 zAA8fQpjR9SmZWE@ltwKWWpRzP)&x1~e<^YlywNXcNjRtKM`xz+iD-%vbgQb7Lc_xg z>hfb{c@?ESnZYCH=KVFToo~E5EZz4x;fj#vP!0|!^Sw5}X)aAul+G4+-?I}JXPt)S zB}M}J`p7`N4m*CV+nh?#(9Tg2GBd;V{3?E@dCfInaa|tzM0y>1M0`l+lcgg5yO~s= zAnkWOCU@9yW&$51jUgVN%6FHd)2YW6HL(d=v-{?1b{y0FR=J)}QqOAwZkt)fqZL}| z0@3>3=EIEjDN`=Haa%jfobqOSxxw=vT35H~o;CbapLK_vWwR;#x2w?v#Sg>vGz(XRaoEw#oU}q~-DY42O=;`!-M4>!wsUUJV8P zJhYGAC0kRG+F+2CCdcgB(dL18ai~zZj*laiCubjsH7W2j z;{Bq@ez91+M{&vT3gtU=3-NurQ|gjPfQmrA`Pv78@0sCq`yQy#!xM7Z7+f88Tzj`9 zqqjU<1_Qr8)XM|U0ChcglB98Q1s4oLPHRd*pVz?S?cpwT~fH*cTX8A5hR|gdHx3gF=Jr^rB@)@?(J#b1v5bx z@Uk0P(!p0+?oMFT6hnN{Z5M>P3&jnpioB$s`n(_M`YeCZ7k1{3Gg{Pl#Y_@3%3q)> z6pY7YYD+jMqrGxB`J`6OJRuZf_({}Oor%EWRnJyEh6@B@&6R3yV@@H!K~k&R)T>mg zHazQN=Jq)xVghF3%y_7T63b)3-@Dz&EgcFY*e>#3f_fW|?N&5v#*CQ=2@~lS;gvVS zOCg&iy{#AWt)hX`{+ z#0PHn2aTd9H>onLGUI1j0(+ z`%BJKFC2{sA4kzb)%wX=Q>>H%vj@efR2shSDbTRg_@#9f_owir@j&h#pmn7ta^;+O zwOhP`{X0CxA(y+w#5HWAw>KydYjdnXJNrXG#vM&sWj@C$cL@;)kms0j7T~Y6BD_eL zh10e4pArTspiaW!gixENuYQ0{(WaY?wTYgS4U!H|d#1xPCd|4f00$=>Q|)(nKZ-ZuU9C2r zWBT>q*=PE)@DBUjBiFZh z^L=~kS7{^3>@u@LA&*N$>EWc#1XH9wIXU@beJ&?qeY~ckgw{)N3@aZQXDK7V{~GQB ziDTQ6WRkadpxsJ;CbRP7fSrjbil#G2BMZY!`WdFVS*QVC5eIMh<-}!h7w}lO6$Uo$ zQ%KxSdd--l3P3{1C1c6_9k*q1&l5P5ZAl!qBHE5Tg^uaJ zKl2DvyVww@ZM)EZP%9+nsLhn|gBqH-;0@(F@_=SxaQKaoOViZPH`pT|JstHI?4t)l zg>8YVQSI4rhoTXuHW1iLFLze3Kkr~liGYI1<@sg*Y~9IAw0G{dpk_=M5O)X&g05pu zsCa8ME3}J51Lf_yP>>MDl3czrm%&7e$m_@HOYG55iyyWYO zmOA;iAO3M;3)$;>*A0lAvu-+1EwW%xSsT6^$L`Nt_x6VDaT6LfjU>kfu$4)^lKudH^T^tR4h zJkvRw6bMVU`Mno>TZr3FA+rrf-CiIgYRFeExwleM4eEMd>s(SW7}bX3HPHsA_gJ<@ z_I_5mLp=XNWfui>JE^%`+KnGFpPal%JJkA+>o_5HE(jS2K7yn?W(Gl59FpHIk z+fi{xn!p93@BJx9_qUcokcM(f_>pTXUZ{*y;ae`{m(``Mnrm)b2}Nxceqv+w&tGiR z+Zwnk@vMS{95_RBVd1c@u;k{WqMhD%O)Rzjg{>TVetLGbg%OK3kjhYGUD$4&%qI$f zzwz-|LcYi8OUl$fOh!V7*ja{1qvx!Wl8ejkSYDPS_%op?O&R2)9qYa9yb4GnLsEjC zl)E%4XkSpyhsNi;5y`E6e1I}e=k9VVL8iPH3lXR<Cx$d;Ojgdr(<4YR2AATYE+Rmru}h;q2L17`tSv#FMcBz)TZ6<-{;O9RYWv^C4FGj%Ac)n!BVyw8`2u>3 zhygt&_xlJ3R+mGy4IpS7|uF4i|;${q#2c851P zB6UB0e4>A&KPM%HaJurkyZ+(wH4RhgbEDwCa-&{0yT5%wN$h>j1LUqVMwKXP=POd? zY&_qqJ^EZ7l3jZVQc{uS=5IJ`rN40m?wDsIqKb~skI%Q0fE#R$jdx-!&+XHQuLZYzI_hhxKNJNS*kgp@06-?w|V^pXXqGeZOZbw@er!*VV5+NOL}HHb-e43^>nR2*N@T!oRzw87b!nJwmtk$=oo{h;s8@Jdo}Mfu)_*GD$1u`Vp! z%y)HlHglW)SJtK+3`OR>l)5x3!4~65e<+&{_ZgYIyNOeN!ZAQ9)#czbXUoEEiQNK` z2hkeh8HsF29O6jod!yRd&5RAhUUW$KTL0^TlKiCjQ^51puzk2}RI$2UHoaYbWDB>` z?hhVA?OTQ{-isLy1f{&EOU(0nd+xLeIvY6z;EhMU&FPpmD{P<-MxDGYmetsJYM95o zX6WY)2p+oA0*9`A1-}dO^DAAac2xQYxdzwDlr;4uLDmv~m5>}6#8b#US-H_pD9 z62}|pskaHFXA=HYt~kl5M`>Eo28%cXE@1z-$$s7B|#;0>UL z5!M3z(XHg~nr)q|JerR4L~h0CSB(ejTZxdyJg;+Wkvae~WDI2x@=8#MtL~|BdW88c zzI?ld zQ~QR)$%3olo1?BEH76~B+J(y>)ZZk#5D;P1!f`5R+t-buMFU;{tmz%53k{v2Q)fkl zhq?9^yccAu=MkTG8mGj>RPOER3BO>&gTBwnS##qj29qx{%Jk zE^8qVVaR_oHbe#Hj6b`THVHOdH^;UJYvll8Zf4)_MmVySL-vxQ_R1-p7=`;YG@d z2BDoJS*M>}f|Kon%iKiHEt}8Hn>6^dw%6MGY!nYV_tBKNR>il_w?BDKKj2HIVo=kg1SJ0ZwX`uKW_do1#t-o}2hVoAY&@Z;9f zqws$9oV!tMX~B}TVJfwrd?F!9txhU|J6Wz%2+WsHOeLP5N`MrMjr1Mc4A%$mFXPTp zcRH&xj&da*3YCZIoBB;DIe4M~7zdEKtwF)`vJx+v)josr($k-~-A;%HIG-n$bJbcn zjS~AHeD%dzjA{`vDpY1=wqFmw*#L0OqTq{OObv_XPGGsE=)2-{ff`Unr@pScWL{lcE zMie83lh~UH!vez`BG(hWBr|pP$dXY$q3_}B8~KyvOo3$`jmweX03ZgqU#5t{!TKem zKW^ug9=pw_3EUxrzTU~nDK0Hd91QOQU;Tu_l}}VHZFL@9vGEW9;nb7ASe~;j5AM%1 zhq;=Aw!Mom92imqK$bl@;p28Y{sR3R-POejLTDCDAK+gH<>0((FGqq6e$y%n;seG< zC~gHEuoLR*JD zZo6D7nUv7!Q_?^%@E3}!QaCXjD|0bXG@MfT{d;S>nM;+l&T^(V!R2H%!!$8mQfo4^ zH2By9>9RAM=v~KFMR9Kp$l43<1d>rb_=h(1o9eZyUPnewBdpY)xcIiz-FPT2@ACNN zU%?F>V$}r?vE<^g{oTABaCRMtTluU8F>b0iWOYNjy20CuZ};0?6Y0{1qp!TOoQfE3 z(kNn=fzdF$>5=#8Vi5k8l)N)_J312phW#jSVeS{ryH^nhlUsfM%6AlaPDM1{V$^bb z|CJx-IAf2j-CEE#@nUt zN*_1JEg@pbGwVJ%@reU$2#QErQGt99Xd2NmYGvj$`xPk`MOJyO`Mwf6#v9wzpxs8f z3{`y%?o-w=q>o}0<=qBAoz$;lb(f$&MNMOM>w<^oUD|`28cL&-wR7|g=h&8ExS zz3)c8!<0~YUIurbpZz}RsBbx5)teNa5^Es=$b3CFt$sMa1f%`Arv}%8&mG6h)JbBx zX~Bdn&vE(Gg5O1w=x`AdSYR-=3HY(=8J;!v;B_D>90ypa3Ym{IlF6wlg7BkooK+i{cOOSXpkg^#vpW2J>oON-8S%!+Nr&%iX8#{cY2Zph2&j z4NaM_XY$G--mxt^Iplsz?0>p7t!@#KnZxr(u&L>xUj?`v*JgJ0s!hpNV|bvom@0j9 z)Klg)WTCDWI30%@XOF+PpQ3RxojP}PlViv;d@7?LG zt<1WH4g2RscN|6EKV-QoQz3p1#ra@_JjQysac0QYd!PWSaF5^*)$^i;sj!vW*zKT_ z!m{y0to_lDfKURn_P-&@aer zcqjEDMsF?@Ac^Vx)n5=pe^y{atl0>A0WGMo*(&3P62Vh@E1?a;mh7c0$JUV-H*H{T zNdxvHThB5Zp^K8TP|a$oflcZ4+o^tA>wSY-zHPOI>!Xcok-F+%>5C?_@P_9;t>Yot^vy&gzj<^vLe#4+6vXvArN!=;h!~!oDNE%(N9bM!_MA8 zS29iN`2|F{nO8dF{Xu`HIevP3+z|%{4xEc1o%PWS&{6Tw1n&=I&n&3`Y+Cn|?|OZU zot3|BbsZY=&3NzI4LF$@xkoyrK{aUi zHhco_xTad&%eU32!?o=X24NN6L1wRz!*tcV&14hXghkh~FMA78bst{`)2hqEdou2K zy6#Xs4=S7M@E|)MtiSI?;h7E)#;dXs557o*EBh;>QfSArg4wfUA2YMLT&Rq!)ky7G zTE$bK<~G9T?pP*^KYlEUyF`T_{VvwAasCVt zwCOtlJg;9ga4VUvbZZgP9H6l_q{-F2`rbXCtdmXt*wEg-gGBf0fzijd%1Cd;VG{F+ z2$v3;FC%_6NOx%seL$iV&D+B`7c0T&{IcZREhUW;mMs&e_h2sm>bRcIOyfA`i?KP^ge0ZWn<&BqAK3VfI1P;hf`kB5#SB`98ov; zpL%sB=+cax`Dh3olp889ZLC;loU52i4QW zG&@lFlm<);K%!XRidWWElGJv54X#Uo6{8=Aa9N_gK~d8AC@f+5@_^ypbb`2x78Qt% zpM}kyZPOOT)Vr=j`%woNbd>njZvj7}FGdOFt^EEGjm^2KQtO<8x+fR7sB$T{>?v4+ zbNe;PsWzg&r%8fwak2bC;UlqCkrhOML#W}+EV=FwB@azfRlJu&g$z2(V={V4vBi(# z;&9O8e@)W&iTWrNVsdD+a7#aY z_)OB|_PTxtRCpo6z(uw;TSVhMIUFF7^WW`5YQD^gl51^hG7_$oG!m~2az(A4d7%3X zi}?Q;i6&|u`oK*j!l+_*Hh2YW%HK>Q8niAcN}<=;K~lht_;`0o<#lqyMZ|Z>akbc( zzR>uFjUZGGdBqN)SfYQy)s{lgC;0zFT9>{mf-K}e{z*kSHiZ8y*ZM)cgxn9z4Ijgb z5`m;d?5NhpeDe@Y#*Txx3La5OGdEw>Gz+ad@L<^4*%t>WMByhO^0|Gm3sBG~!~nDa z2`q-Ksqon!W;!hGb%ya7LwfN!IT17xfM5xVg|X>{sM#Nq`N|MNA~0aY3sCDQkn@u+ z&B?D!T6u&-@S>UqeDlljoAHn|Mgk&KrbSjFOg6p%Bm&<^j@Lf3S+*&4!7BYTH%01i zGLiuXUp(olhhgRGDV8eKLD_%78)eG=UTQbCBvkD83t{mQ86qR9j2@YCl?kt$=FnN6 z8fjTIqn|kco+W2ow-Wb z-c3taS3SHZyS4_PYgL9?;pnxLlmSgCC9ME2E%Q8!f$%9};|Zb7F_xxDoPwNPJ5EEtGv8#x$iCySN^o%8KR(8VVqnk zARFlOVHt@M&7P4i`CPs_Xw_Md;&Y|fe(~gSmnr)=Br#@&_bXOD>de7I?W%THrja{Q zujEHs8DlB^iM7%7HKHn8etq zg^GsBXnr(0w0<#mS$ESeMd(Uz0sAV%f=BM z4G|wz;(08PpP2@9jz{Jvx`I$sdAx5Wp+EkdteMsC4+if~doB8&fD8c6;+aJ94xEQwyw+7lgf<0mlbBu)d!|Kl(D{?@WwVnTf<#nKxDj|-?* z2lU~c7|a*aM;DQnmvE)uznYzF4C87a{>xGu^SL!+zIjt zL3U{R>pw~}Qi{dqHOw{pE80ET4q0O!f~mFtsh1yRTb#z)4hbB0(;oZ}R&T}%FUIoE z072xsq)+Coj!TX6RwIU>Q|xO@=nKHB=>3r@%W$cYvfa;shIH3CuyP?Nf$1yX7yOq+ z-QjM2=}9j?0dxSbe5kC&n&jn>;L-MdW2)lAQ7&scj~mX#ymXZy^M7-HY&Eh`x$lmC z@w&Whta@??J#)2r=ud)XMB3UccK%9riP2@0%yS$Q-26fH4>#8!flf;oy!fV>q#v=ZSL_&5Z8*Pe{P+DLIad)*RDao&pU&0?3!T|73D|0k8i{i_ z3GHV|Y5Kez$i}uziJj-?jJtSuzId0#ij>znRh-p>H+uTWlqeou5|cf~NU@mXJ9~uf zM`tSzywcLWq(Y@oDRMb(Y*Gq};Q4t&A~Y(saMY+dc`$`4E`G;SuJuVn!b6MECMor+ z&<9{*x8(J})*Y3(aeqVSw`k}de43u>LwLF2?Psw#k5PruW^^fi9 zv3~%r?rWOINU3Y7c@u|!6K(xYG0|3Mj1e9n;x|DxCKT(0$%%g)(Jx)G&gl}0{>knD7mg7|W(OPQAo#e3fza_>gB>T`ulRtjx)4nn!Z{;M{+?>}2t&NA)SH)& z`+a`%&mi@0`&)BZ`lmbEM`D4;9ryNILlphXOE&txJB`ukg3V{JvHwg72({E(_YY)D zI2a|e6&5}-&pBQ+9_0R9HyB~GZOY9+r#Lo*`)uDB2F(>=WY;R~Kh_;M>p8-T(!5#j zi^O^wN_Ns3Q#m`~-W)zXJlOqN?&CiD$C1TUC&fzhmA3+*9C2B&e;d#-Gx!9Tbk0?1jn=lITiGA-unCF5kjVq4j%**qs;bKYbLwd{uPk zY4kJZ|FAodXdYS0V?kF;{*oR7fw06?Ku$>I`uJyQ`%MJyj)$g2-6&FMx2l^q2B8nS zmZ-6NXVTdCflj$ zmZ}HkDpQNR;ukj4oR;I!;QC+Po5hEFr_wKWbY zNhm+LMc5q-L#=#BKOM7Vt&3I;c!qqOrD>mB!s>ep8A%A>_VxAQ73Dtr^86CDPypKw z2NB*I!$xLZ##_r>&&j>Vca$erqFV^cT&onn1~K}F2KQYY8rm`UPPBzqyH*kH^TuRS zWd^PfCU1Cj4LX;xx5sZs_~3r86Ejwa>{$>wt57(0=6Qo`Kacr$8 z+X()8tJh?wHqbwC7;R$Y+=770uB$P)27D?oI|AP6+^%g|L667!C7x0$1M;tLwtn+e z$~USO`r7DCF!hzR3o3~)xq4MZ%cau_XUuZkodUce{C9F?+82F!_tunl1z5cA?{b|( z`seo1-b&!se*5Jx=PPk@Wk$ilW7~EX)qd~5e&!WLpQLpY=^JFamoI2(XIL3-(h-?> zA=GuIq^eh2vQ-aX9CRA{wolgbZ>nIE0*oG2;0+G2lKW2hkC_m)ygQPYp)*i*W`NRP zPksM{#$OLlxD+{QK}6Pw5Dd7eCA&@K8eLL;Sr7-KPR?+@E7n~VOql9QMD)Zoo@&_yDBQqkuQ}$G;~*z%tZdKaMA4k2T<{)@z&J}Ukf~^eK>kiIA>M-hB)*t z6^yPpj8C%&|5(e}tM+bvY-EK6$r~9(xo6V(T2UAU72I-(-Bl1RT76|NJ4pzv3g5GS zl%qbFBsdGQ@-=PB2@4yLg?4Kr=<={Hh;nb3kcMgfuE6|QrM6sh^T3Pf#o?`b^FQaa zV;{F?-$9w??6Vz`5+dPpy0uDCw{5~eU@yf8^X|r{`oR8Tw4qO0J7Xamd4v-4$qNu= z-n95P;d?2&XWR+8UL|cqZ#Xz({}Jg}x_o4%P7ElCX=LVoWr;(qkf0p!?tXB+rq>)^GlO$ovhT2J86d`V{^-pVOI-G}e>4voG&$5Y^i3$~C$at=6YnV#gw)+k09_Ni^ z`pu8s4m`kN%z-t0+FPikYp=qd;^fu^7B|i>q6%ih=uDmd?LOgqf$FbQd6(i#`}?kQ z()F>j?$R8(2Ma*89^3)tsq(<&Rfm&J{1pyJQ^j{DH*}=WWYquq$a^Eh;=rMoP&P3(3H5&FGq|BEFWF5@U4@N6WYr-*$_nSO1{6z zJRyq^W>d7kQ~G4CS>>--cwc!q`+%hYOKtRY-H?O;;*oI8Zqcq6NGdOKWIqpJ8n-j_ zZT?T;i#tbEol_lGa(T#;AIuLc))Xm+^tS3ZB*NnrXJu?giA2WI8H$k46Gxl@mH5q0 z)6=3hf)7@le^5N#7SBzmnbSjz*jRufgC@dLmHk8Dk;r;3``^FolZMVn)fQjC)~CvB z>6!G3;6;^AArY>)txGMnho`Ee?82IBj!ym+1_SPRL_8hd_2wQ^3d&pxilP_`1|k~f@j!Zl zmvdL4YSxeAP*E$!fbpm1IJ#Qf)KS@MEv;|qny2=T8k8T4>}+?fUfmjwGCJ1Z95)_- z`9{f}AA@l-pKXv`9amD@Evdf|19UDf6a_af?iho zGFYY$Em4E`=jdq*K|1miF8BoxY455Y_vCxR-SLLH&4svWhr$`NPbHO~oqQ>X&*8sV zR|rF5#ZS0mrafBOQ_(*j4L%xE(e98EXFyEN&;&5I?QA1@>k*FUT)uPI+CSmJi*B2V zvP+!i&HnZ3xvj(!m0=^PwI6!+4?gNcv4Q)Jv(IDp3Tu0yWA6c%B&pp)u0Jl)RRwM7 z-w{PYk+>t8ZFLnB-Gv)*wpA#lVsHBO5 z3=-Y6Gl>VUXB`;u=l0J6Z1s6%OW&0w(0v2U^I|i!{(O9T|1!$WCJmgizfgK4hkhxA zJ_u8O{P~1Gg~{>n?(SdorDR}d5}-~+c_~~Hp6P1y$mg|*8btpwVE)7Kg($(|38)Oq zYd)a?oC-&AK%Q=<(n7$K4)qeXq}OHN6pL|gOh)3hK$nKgv9XlAj}2|6*S+A4yG7IK z=}V>Cpo#m-epj7_Yq~fCG7Mn_@);~`h2tUJODiv9?2T>woCDolfwJJ-xth+~Yf4Zz zLbYpR9kyIzk7l|yv`Hvd5{tnVETFc@10LzLTquDrD4a%^xI{b68R^t}B6)#_F* zz5|a5LkUU31roisE`H|Zn?IiKQM}`8oofM?b$v<;Sx0|AeFkv&44<}WWNZ|4GO5w~ zqaJffyAo!LVA4eMsOyk+Ss|CP_=u1N;>AuDW|Ak#{VL(XNqwWjaSwJ}g!{nx{uEx& zdrOsd$amPaJBpE3bjD%jxWU&~`gzqFCz&qwObbkHz-rGH!v*1aK@MwOYDno9Ewnq& zogM4t&~!d?t1qiJ0>gIO%ZvDYHMScu!L`T#=w1^P{HEB6@%ByKU#_ebl9ld|?GAbO zzg&Rp2%`m-{_>Vl<=XzA@3ms`ojz|qp3_Ggxc^*e+nBofxgYO#K=d&-MNLZFV$eU^ zu4YYX;)uL?T)KE5ROd)6%e4!7qAVTNx9`_#F1;+o2J#vJ>uLKed*ztOL8+&u49f(}k@Qd9`=vXyluk8-i*~;}E5UzE2h}u&IP>yjPUbYhLw6hSr=W9cOpW1Kd zsQZ{C3qP&8&ar?kC~P(5Xl)4vH5M?61_x3_dm#i+DgjM?hrcGjGI+iS6Kuo-#^v7Q z+xvz8yM_b1e~4gdwmQE+zv-juOsxYIOCe+cw_oNeB^^0Op>aFhMg>97r0UZ-`rAo# zV2pv5;{!~8Pm|FzP#>X8C6rKpzMUe@gm-A3f2U82h>IKhGp

mQwxvzla}9bMKs8MLvor{x?=-{+bWvhXK6u=tj|1pDhylgzPOnHGHrK-u=+4WyxY53zwP zvbcb_#*uuDiEM?(kvIEqw%8?4mWncau8LQ^TRdCN)=?5{B#{zp1kIc788pP1)&f3A z22bq6+T_&vsGu7_e-r6@V9CD>fH5Wg{FK(8vQ6F@)G$QF;B?9UBd{m{cZC?LNcg)k5p?Q z(;M$^BrQVU0$vMtZp!b)q}abED?+sXyvsxkg%z3bb>ZJ3b@LKhK^+$?p)N_gxRgCl zzdjo@=Gwt(_3by}QevN|X}4q*fh4pQDET$iv!Qu=;=x=AiX1;?T(dtdL@hT~BDXX) zVpui@X5}e2H98Bh-@{+`4U>}Fc7%#%W*;BoFjuG*cRcY1Zoa{TM~HGmm%^mr5J>J ziiCUUg{A0)3*JGfi-b{7_C_Y@M3UxTQLewnIt@U5-HjfCWgzmoBkOueSr*+=65mo1 zfz=9uROLnN=!Hf=w6^F7Z^sCCd$gASTC|4$_9Q>`&&(b|xelMV7+~|H|NUD7DiiXz zol@-n=1_5{$sbl>v1D}8oM8h^F{7v`igwnJG6S*Xk?W00dQxlr{bZ8}u^fDYPz8;l zx}BV1QU}V`2yMOLKdS;U zUmpn}tm@UkIZour4nq-Py;mNM*WoQTKCUEy!dGt(+H-)&g599(qB_(0s;{oQwAgVi zR~=)T^F?A(!2@%%$yuJNZkueyxW=4`tya zO;1yi&ADbGnvWN6nKNDy$t=L$PBD(ux8J^(KhQBH7bS= zC+WitwQOsUE!q*R6*h#{HYjN6Yq4!hShNqq%SxEnLW`kOV<=+I-XWGAt0LUwwyzhw z!i^EIFvI>V2dA5k=ADafAc*dvbdv0S94qr6;P#@IBZePzVETv6zRw;m;)nN+R%n2j z60&9<@1ErtXq24<7<5?U5{meuUGI0v1-BQ{yry_Nwx?g)HFlr|N4=x^fB;QN-npk; zcFw9RLpos49ide{9;|pWjJI#MQO$0xeYKE|I$|Lf!ip;v5U^(Qe71i8ITsAZU|j2v zJAJI&1?pMP)zBfdN6#~i2}Iqs8rOu7xy3+OtXfUr*BIbrm}u9t<>wMczW@%pUhx|l zPXtaT*r?1v5hDp%Pm+c^G3HqsxD;w4Vj+0=pUYR_BTQ3&HZSd2S>L`CSBmb(eiKc% za&@<2@3}f2M1h2YO1E+fzl`Ol>46~0#&^R4q(aE6pmv5C4#nsK;JT}>VQN~8Xsi+LMyEx+e!A~rf%uGrTTP+h1?yDzhA&ny; zkzF=NROhgP3*L*G#JKQ5LP8KKYN&84K~|>qrOx377tnFm+BFI%S5`asq~r(v+CKkH z=&$W6zUxcSMi2j4=d=Uw;22iF#R3r{qenvSKiSHhexJ~TZjzEx8Bg-E&qCD3g(fJ_ zFn56o=oG(xYpMM)S>12oob=quAzPUuj!dYQNE8-}Zr)ATrHbA8N5KzFcODa!8Z&|k zip#UOrQrj%huy$g&hS?oRXGh6FHx%*;!L*%X~7@}*s%c>S?)*lTHo*c?U@JRujF&4U0+A<;+ht?3c0pp-NdJ zgJs|W{CY)_;Se#&A36Rvz${r@l`^K2lEah#i?clOJ_XJlCr8|{m9OtibBJtP%5jCf ze2Hpp^xBG3)$R5RMcwv_Y&{jDkodCz^f|06I{4Kdy8~P#`_7L(~89ZH*r(-BL~sU8L^L` z4?=4icSO#eV7nC!(`w@rao2{>@Y-OtmEGz{{`JORgZuLfi1pGvrHjp6gpjWwqSh$# z*26|0D5(MF z(H^6P7X~u}k>Zw!h9k?Fu1E6iLQ(TR3NUCE`9hh?eQrZPcSEo+p3sv}iLl?lT~@?y zGeSJ~zlds039U(qsa+eHm~9&-*S}ThOsKy5xbQQxta;CnVD{Gn2;L;xdJ(tZdhPMu zuq__;wKu$U+-X5mHeXQ$+r6p%j5w555P|jCc>s!v7*mE{VaP zZnsF?{AXv4c*+8OSmb`AXj^0}DzD0>^__QQauL~Q_yrUOqlj{?ZtM5DOb-QX!8#I{ zA8&JLC7*j}$V-^3T7F8L1{nea)wy`&_XIUfQP8-lpI*+(1N(2;5<+!1-V zoIq}0j_>f7-gHr40~TcO%3Ws2)cJ2Oryw=TXPa-#e!GG{~x71(kxOUi(px_mk-7FyYkb9xNgNd*WPKv{Qz}e% zAQ@3bVzeL5>?&e$vVVHSC- z**gx&K=krTTF3??gI+A}1&G3=RGqrXLy6uWc$`d0h}K#7)YcFkTjw>2R6+(M#<-bn zG|?lZwR{;qa0eTzpdZM9MCvz1ATh`sX&;nmSg_S-LyH9o^a5 zSYLboB5nwazHs>-I71|skSvk^?@eKn-x#sX?Ik5Y@xbN$@BBDGK>x<`NMavwBAtiV z_UIyZpZ?ivS2}5BbT9gDs7*TXI8%{A|6ZYMLtRMRB-~+Wu1PiH{=uMvekFPs*3Tsy zeTrMe?oM<6<{BZ9K|9hB&*t-of)A2c?`bWy(2cW~-=G9^%eF-cJ%!$G5?jwb(j+qZ z;=l*cFhXq?WI9HEAczK#0%emrbcN>3cbSK0uSX}z{-}T$x+B?_G%H0kF@!ZRt zHn_Onh|ljso`bwMb{28P)zu5Bve!Q^j}x$;w17joha3L{H)Md-AdUNx&8;cEj+rYO9;`KosJro9V>d^OjLf*mVDF07Tz<8oC$>2wlyV|)8|Ak$*f=?b! z1N<0=M=TrTWO8mg7H6Y3qFLzKFe9{U`aB(@i$NM7!j)x^4=Fv#~4@;youM3D|j; zy{5lT(JsLLX^57Nci!i9)FS^-f(W zw$A|DnY4WvUd0nF>$~IU@1?>Ww(BwyR(Ha+i?FKh#3iSWcIs)OpUYr;9|sa5&`?x6 z(w`RMH?n^wT*dhekn;0X(bhSP3?d2HxYmtQpFyhUKzo<1+lx4__vMAz?|0OgZlhV7 z>wD&1ha0AN>Lr?dw6-1GDhD6*gaVsH3kdSET!Y)D?OAUObFgap<_mDg>&90k zJl@m_meagQVSw&^Vbrm8%o1M-XdC<^$5Q4-aIawyOiB6em4}cudq5=zTF)2Ar#Itu ziqzZo1z&b2xdPq(kQT^3GlumPVga?qZHo_wNp~!;aV`2Be_}%C69QM|;_Ykm5LMn$ZH*(dp z^;<ytnhtui>5H4QX+wEuF)v+8~zL6%@4)*J*t-Z^ly%jM&ng_(cT<5AzH4(-R& z4*&Ko+h+ztkbW)bkQg*N8q|y%8jYAoC#k@L_Vj)tIZVO_34;=)T*E((%BL+9t9AMM zB-4KNdYIdO6>q*VDKN$y8zZr8wi54TQeEgrbu|`7VqnLLzeG-F?NWv?VA24I!PViX zgX#W|GJ2n<2P8)Q7J?@)u+zO3OybiKh&*lQ;Iz0@=PsUYkj8t#cX=oPe(^q{`b+N* z7y7%(jq;B#riJX+cu$ZOGVWhthN9TizBY`3)AzoBZMnNdfq7~3^i6_{nx6XqW9uz| zs(inwQR(h(4oFIagmfcP0wPFD3ew$m0BH~e=~O|wyAIOQ(hbtx4fo;a|C{;l+&iPr z3o_>b@B8e%_S$Q&-Ep)kPERk&$r#a5_Lcqe{>Bi3iy4505`Ui|5{3&=f^q>suW)M} zh-wU+_!X$9z4u>H)*p>~q1x|Qd(~?4 z^t~*!oSuG<7~7{Dr%}usClt^@zfWfmJuyLU=ipQjdfntp;%GQ`J@qA$y8ol8%VO|O zTOYVaNzwX{Ea8FEzAO+~B~9pC=3%K&lT z7ZJpXGKNK%;8ge+Q_HWdczJuqt}Oz?mD4az$X>ow-agLd{z34;y@9(^Ogrm7EI3oe z|IJ04&jD}A?TL-b@%7Bu>vSiS0fywm>V?c2zp|`)#;tBPSbWeQd}!Ev`;tMlIF?V6 z(zr>fg1xi3N0NJ}?SG9AHNH{3cuQ&?9snbTj`wFt$+PuFXqd}*sfjDKDNxPNTq)6-y8=- zOg$`CTM9&)PeV+#$k|m+W2`bbre%XfAydE2o<3-P2>pc*-Uw11VqY@@N0I*3pc~4R zntY8St|V_QaP5Ucyhgche9Ixsit`{SiEilq;tJnAVdo%2#wOFOYfp@o@fkG6BJ(Cv zJF(1I$^37}NmWn1BC6RJWdLzwGv2@#Ms#I&EG~}?-ADM`#B>w0Ty3BK2>(aZ$J>+onwAy-6l9m)EPXjFeIh)WT;tTU>`H`}! zLYFXP551I7IdyBuRYj|jX?8`PsL}>POpNC0cD{u*v?n~1???3c#I=kjB?#jo4U=1c z3Iz|Wjb4K@0?N4`7Bwdl3J#_GQ~WTD@r8 zmuIy=JXva@lZ5wYQUHXku%y$H5?hI7h86#M$CVL;O^PtUKoFbW#}3`AW!d%RRDf^g zvNW0e#tji+#(h5-ic)6My`ZggUR$=)fl%jugk0OIxb}!e417NzU{i}kgEQ~z_hf$l z4*Z7gZ(Na6QfA7n#)%&bpd`+D2|oPx5G)#_?&#)Ea`gE{MI9Apg$~QG=fL~IWc+9G zTvL)AY|Yttt#3fP+6trPas`q9^%I)=Jn0e+W6|V}-q*~$bm13Y$oa>-y?STx(9XN_>}lk*>E-B%Wyr{KmL((0 zUI60kQ-$k3Q?9HamxqVd2bI@)`C?mAf_`hlhtup%GecFZM0s?*O*}5+=xb@~7aAOO zABjI9<~TG{S1S@xCMI79XLg6(8??`fk#LL&lI=F1EeDCgbZ&6B6lI;u+$r%SxutI5 zWv+yboNyc}F76G!+WMj!?&w1=kpQF*Jh*r7-5I96d9o1wLfI?v}lm13un!hbWTsJ6d?FkG5?dZxe7q3{Wd`V@?NFvSJG>< z&^hA3(XKCU{2nmN&o}lzf(W{)6v>g@NYkyveTyBIH0!DEJWF<63Ili2g^W;_^wJ5i zX)r271AgJdrpZxyaT&8Dw`Jc6Fm)A0C&!#6^hc)^sjCf!H4Bpv+z&)LNL^l=d}c^H zpJ(S&pjK@cek&JTFuo-j`dO;+{mPD2+!&Vzrq%Xr`|7u)u06J|R0fnnp6IFk2e8i! z&$367SESre66dGN9GJ99JurBRiJY0kx8JE~-n*<3r=-pRWplK>AmtEli|?J-j19HGc!!FD2X~<(1RI@RO_Y9sojFIz=*nuFu52oL=0|R_62p1eV#)!B(VUSit#pe{3!MEvU$x*}1 z37cDgbHU-P9#;l_&;HioCm##60|C>l7WLsr4j<=&#eU`=4R^vQsW8wGajtO*ausgl z$#zFBl`DP(D2slrftGyuoCn@lqgYLcu++=7q!ZwXFlk&l!;K&H-cpV78C+&`TpS)S zIs{8L@3DsYqAdBq;){juXeuuVB|dOQoLn7KjiDpO6yqz!xm|z*KV6-ZFcqjBlmszD zj2}@6U!NH{r%nYvd37Siqyizw4+`svreNt%mG^ho7Y@gNIX}tOfBv)R?Sx#~+CueA ztEl7t&X6944@pD)|B`G;BgY{`XtA)WSvbkXC3-Xa!O(WZGq-fK7$;wbT$-gP6u4qN zgc*Sf_D_r#|9q}Go<}fI39c#zd_Ndqs-1LNy}76p{SF6uO+ zULy9F+6wILb#q14pT0v2i;OUO!>jL8$?tp4F0Cy?BR0DMsvFOhe2WvBCcHxd<~lCa*?<&#Ld(2>$S3Kt$STBy^oNa?)CV zL*vB#=WI|`%yK!OzD6|kJ<~`abY{A1RsuT*_eF$jhj5a$fF6!hY;96}UQV`{SP7*W>KKxF{bme5iO1w7CK`RYt4qt)6ZBM^ z5o>KNz%wpsE6FeiN6aCPK|+O0Ko)j^ORV_k5V3A_T!m&*-e1wy! zz5!)2$gitX?u#uZt2f`G&y~!`@_uYQBIs)C3tTguvg{{PzUUY%(4Z=cX|m2kL40Qd zw1H}MVE-&_M?zE84Ojoc0cyX((@!IAS&NWvGtbOX6gX`eezt(s9ehaRcN=B-6f}zB zD^vORer?=DOR~lpZ;ig`8RG2hQ6Pj(`FifGyF+$Cqfh{(G2PnzuENq5tisOlI7>wO zk)9wAA2C4_G8kub6`X+W9Lieuihuy%#|MF5zE)ub6)zodEnTfxEF?c1Q}tW=@|GXA z=W1dKC4hmo5wK}ql5*3R=-`*~30LLG|F^tVH4t}`6wC8DjYy{53sC$n(bnj$uD$WC z{^9><0fq(Yn0Ly_vFxYKGY4J}8MoqnG$I`_IzYgq+?9OFjJP@pYAnxL9i$+qL6|b} z){xSow0lCI8_sVJijb2V+g4)92zi35;n;OJb*YR@k9Qs$|#joDhcSon) zSN@a1bGzzON+&ns<+zB=9DH}_!5Bl$sgz{5r@{*2E+j5=Z$}rqWq96^*XjxS7*2rN z^NT2AZDyxxs~#c!i^4_9ZAL6pC5SiOvTHh%g-4s|i*9jeo}fk~sza2GX} zaRMlp^395XB=F{@0UY)t0ahSGodm;ymSv<8M=kw2$~+okSB-Q!8(-*O)w>B5J}gHDRgE@oUgPVWv9n3NBk93V{*B z(y;}OQJANE(gYK=rI<-ZL1u9-@Hsjjn@@RSTUGy>^DO(#vV3bsKaXv!BYv&IQgGj3 zm_@KC;eo*K$!ji4)V39~*v=o1&CY6i%wSQ(!X!yo8l>D%f^IBz74wY?jp2qmv+)0K2;qv|fAkeO$=+u=^h|936H*wV;>HSITY zVLUwpMKq`QQ1KuV_-~l z?(2zp@NqFhG?TKk{$z4F$2*qQdCKqbY2VM3rPFdQp{C32R`FF>=H$qj@F%b(y?f&( zX0Sqi&9d6l+3jK(eB^-b@B-JIj+wQf zy=5q-Tgds+Yie#a*xr`rVg}kEvm3;Vw#=2oh5%NCe0la*PPK#HOB=>eYx|kzLInnP zBLaxmh>tAl?!#>>C~nj=HQ|n=rM{wtmb)F`J;EP9PKv;OUxt_ZT@_CZ8%%OoEZV!k4m3ib+;gOs6r&XvSL}Yw6`Ioo47Dc+3inGQz>sm)xdiwn2pdr^S9Pe?~H)%;8YVPB_9SxCosIteYqZGffjR)yRUv@bZnp89<5DW z-b485;>kok%re2DpOCbU%{VkBO5FB`&ZmL2uUr~RP0&ghabWuTgq?Hf2-|8!;`3;= zrnD+RalGA$;2hgF8!lLZmYDsnNH`x3IufiuLd6WYyaw+G>LamY@vYhP!^=3De#|`$ zRo^DJX*Oo|5=l3CRrR4~avtut)$kM*_dT6oTy99d^PQ$N_lTqhkhchJ9lXgYh`FO2 z$Qszm6cetK>_c0&t;XqCr;Xg_0GLb}~&kCGd1R#mGvyC{FvquKc zT>f8!e^pT~MkaSvktQawFsh5kfGjbXsjVxC!ZasK`gPsit{|m}qTFPcfv%it&UyQh z)YPljmuI`Ow=Qe^OweR5x^mwlxgfk++waRu?F533e}(fFhC;gcwI))c-w1Z<1o8fO_@yeI5#e-w ziUizs>u`xNF+oj!FY%Uy=5?YDAB1g_LdL5fmY8A}$LT%2*#P`^#W5h1dGkQN2bTVV ziY6AdbMt^oLf)F>mvl}Zjqs0Osu0RUI?7WB;h{7sK~w94D^i>SV!H&cwc%{YK&rS5 z7@6zqx3<60dI9Kwx#mEWs^RT0>4~NK!VD;2UDVJoYes)Njs6DDshW|&La?DCdah-Xg>Y*XoSR60 z^eSaHUgapt4Ux>ePoY)k%}CeRSvTcMDzB!zbC>{SZduNcAaOIh#ZZUY;xTkn@wGsM zV$i@0(4$LzQ?QwgixakSOIbS~z8sp-UA2%FkBj}?fgy*gmIhV-WB^5d%IP9rsMkoR zGd+(c2`q_QerZ~zX{Did>kA8JSQ*Yk$H16r)A_X?& z?vH*#qWHZ4`5ROgLQFNwSar+K%HB-|eQ1j?IP^Dk=<4*ra8W4mQ7As-wqC?t=K&4N z$w<2Kk@2u%^k{yhDE>84LcWGSV$S*0N)*C|wKJjM*++usthiw=$t+%sC|iuMZ=<+L zr5AZI|6tTGvn`wYSuXUmt|}0!`QDXtSM_aOekIV=XJ!P=U+tkc>yifsiEtF?foRvO zciOpe+%fW`K)o`hM!T@;Hs_SA<~^gp*B4f%T|b9Pk#TRWNqLx$((&;Y>ldvFnM@w@UC zD|%N=bkN$06BI=Em@RyS5&Z5ws9q%&Jz~L&g&Rz^4l!I99TEZ89=@NZ=I=)aixerCq5@TWLi{tN60N7}>+m3tZ1~8QPS7s-Gd8MCE@B*|Cp03=TxYuQ3 zPyU{*bp0w-?Y_J=qb>I;F?CNPW@!7gZEIa-f7AQqi+`?Jt}Gf0g=k-X-8$-(yzDa~ zzukZ--@}W`?);;e&L0ke-Y}Si-p@P>xWMBKP1=8>)@XpbGMzsnR zf~4K6g?NB2PRVz&bQ{q!QmiasPGeZAMk{0BN``!ifa)IaClbZ0h01G;h~SHg90HyS zK*j|3n#!rFidVgpzU_iq^1+A6gtSZIp`-WJEi}u1Q7hmh-K6;?@jxpBTXr`z>Mi5* z?Fclmkgz*=0tB(h$RVHygU^MD5T_6xe*B`U)}?*VvD?m^bfAs|6B9y;*_HH+62H5z z*hxS_jT#5}8YO#-ENf(wn=P@6_aYaM`27eM_#~LO4*UOq{!FA)xn`ou8puC(3smB_ z6a2Ejaj;CWgZ-Rj>p@Cjl*G4VWd33ETG2?gbE*0!MlAWB6sh|s!5>>tY+}?H>)c~?Eh5;i zZjQytKoFnVW+YsDD^&^#U4GsJ8jS9I+`(O{*8S)STc8@Il^JsQ?TWE&o$^{;6RXl7 z^YnuC?}-R5499k&QnSX$ z1cfND9m$T%+1wM+9LA*JxU!#E_8~M6684+obXRWaFe29WV-?8Y8Fp=+P)D+m4*6On zt9_h?8cSsQfND-(nqY%K5Biyuui2)xcr4vmKK?D||Fq`mMa z9F5G8PaF?9zdDm4K!+0WTAP5aub3F21Q%k%woqmSm@Nxz-xw-l1>G#L!v}fO;?0aI zW1@<9j1Kbmr9vSz<4I{L_Zpt5G+#^`guXnQ(Erk(yIi? zX7jF!kr7(iz5ByQ^bVlMfT30IJe&9={gBT&R(#K^jQu(N-(~xcox3L_xN0k@DVQB< z%(+AW!+M)H8n+Jogc8i8ZBY~#4m(=pzvx&3eO2mI62nR~3c2~XpcCuZ2}u)lOogVS zXMG_ImbM@L{vM%x5UAh@|LhrbDozCCOud$mh41Ag;y;|?{&{3a@};#nd@&O~U68!- zyVgJ*wZvfz=0=b0`?4^ZA1WodwsQ~4Qi^gUMZP3ID_(ee9lp}L+?W68<%G}>&PrS7 zNOLh{2)j>j%w{c=2X``ywYZ~w-phXDLVOul@#ucNn7P4$WM14*>Lf`#r?d!pM_o(O zU@;t4O%tiBx;^GZ02@tP@vtFD8h}4|YN!M%OKr>$`Ni`p3ge9@+ONpyLWJXCDHUx~ zv$)66izHF+*gaodY3vL5_90D|5pGY<{V|&KXSwm6kec#IB4~=9UG+j&)n$CKLHG{k z?4|fUE-E4{eo#|tYQuq!x0(6F20n!5Exv2j5WBIJVkmRog}WNlc^jWH+IqR*d@m6U zl*3i?TWP*&*l$<5g;LM(zlXXCn-k{1l~U-Cb;dkZv4AbF^nI!olUl!Y){J18+p>og zzKLkRm*o3Xokd#;PaV1!*G+xcVDy}vmLf3+Xu=z|8G&ipV?b!G? z;R_sM0Dg^3%;EWY^SuJyK~!Xf;ruhB_sI=77+@oK=)7h}^G?$SN{!-gykWwvyS(V?_tVFKexTy2xC z1Uh#fQe6c21T5D|G}dIgmY8c16~qq$N-wAoeS*r8BZmv0JMAECxX{fx*r|YHs_;x> zg!bh<$@C-QRyArEZ4UMzve%A}FRvlJlcYh}W(d>Os*jbDD@FMtg>yQwReP`+>ySP< zwC4psa9KWW^4U&7o?RjNa5|xo(SD=YwGvM;nG)d^uBz4})uqOsqQ3Txu_4IQ{8>)&w%`whf z=$CgfLwNiyb+mxv9X_8xRd%b}6CjzkpDlj*KzTO?O8A7x|Ed%}<^S0 z`bI_LPWbJ)&}sommVN)4{?&erVO!8w-5e(uB!Ix3N*n!DQGEvWxv*dgtiG}s=_O&h ztCI%2-ow-H@g`U<>@R!EDuf=U1wg8=&!_{>!u6jyYu9=LruJu0LdP2sW}0J({8Vp> zei{Ub9?!2mFRYIET`!Ef1y8gj2Ja+Ow3rSno~+UzG(ckxW?#UDExd4ypI|!?JkZ4e zm#tV3zeiV6+zpRt_mKBo+dfpbz2}lB)yi%DMgVkkK;`jxHwv3AMhsu&EXYG#(7a*v7Q z`d8L?R#iSZki<9HqJ&(Bs>QyIKK&yF2J+%|myiNcmp#ypL0i4hZZNB?iafx`9!^gA zpG4;A3y{}wQK8)ta$y+j>tpu(ltI;r1Tf82_?OGkcHDD|Cp~M8U>7VHd;*#F5zcdy zaj=M{<$Yv_t)?^9w;X#!sQYaIwOds#3Bw3XF#>A$Tv1hAoYU zt(GfvAW1!02`o!BPOUrRR$tFv)a_~g6Z3)#!D4f8zrly##y`GLF)_H_d`=Et5&W+u zp<@2ux#QoSqCj`2>4*d_ek1#M*INbS+lCVH$KxRv6SLOC*ISEAOoR{gxVzFU?vXcXs3c4+DkC*FCsj)}9a(V2F{zXKo?@#RH_P5=#i)>--`d+afSFBLC zldJ-}4&9xJ+{!Y_>n`lw>3a?yPD9xal12KPtAYIa3oOTnmVk?zrr_*-gQjxF=Ls&w zJ-%D)rXr1a$4%(ob!RqtcUL4SF}G0g4zc%`wfptwxW0stqJ%!~DFMV}?QkQd7FM&9 zU3O*R_LPWqhM*6fZ!QVn*7J;pc%gbQwo-^2Ti&$uJz(*lR07n}JwKGi+#FIuEjbz^ z^j|bIWrgh8dkiyfD3)tQFl(Z-e8QUZ=2?aLF3(jw(a8?`uBQMg?hazjMj`ILJSt=( zFw;zqm6A*)AE(2)9@l6+FCQw1w|8`FF)5<>9=ka7CEnLPogG8-y&H!Tllcuvou<3* z$JWgKX7|s@Hs5G7yU_|PNr}u{dce?~-P^~}r(JV;_yv?n(S$MJ@9_?#ssVRV(_t&1 zChIb@Np$L0?&9B^6uTDFWLY_n$8TSW76pShpvVD(HyAA?4cq1**%=EAHP6S+8p~RE z;T${lzcw5Tgf)dbkhOrO@Hb8VowYY#CZ!n@e?6QFegsGz5i%Emt=q2rpm5YaO}q`gF2*vTFDlnd*Nt*Sg0}Ob@f^2d4S1yyLVRbL%Z$QhwnHxjx^Y%!+eI~iuNPZW8+?W1cYYIf3^h++C ze$nTO#~x{i;Ex6ez%g}HT9+(LnmkC6FQ`ORD7>ke(zG!2_%XnRWi35p2>YQ2a4xGm z9#ttsvTc0cqL(y)pW2Pq_W@z8s^dfTFJHehJ&TX^pa=#-E#PZpb;TqHF?3_^Zq5IS zv?A#|<9BLpZM(~;e(!X91VrTB)L_2AV(D04Pxy{P%*&4Ha_u?pIDd9+5jlmSenf@v zhcaeO!HNgklFTcry~PY^@M6QBw`}{Ftl+LEck?yye#LW#-dPfMy%Vy)`@L<~QQCkl=jV0nY{Dv~ z34cvG1f2|sZ6aFEVB>PxXeaazHtG_)R2L7v+utb5qX}v_gb%Tj_$h7Wx_y6JP)apd(% zOEb1Yz<9R%Wlitn7zpzjU27(+nM0*de0vA9pH?1hClQV^cWs0f-{I79in5K5$19x4 zwAQ-45LMVQSUSl-lFC(sy-#yrFn>-y{AV}>j35EG=j{4yEc}r}=ub}bX6n6SeGptF zfn6J4UqK~Hx)v|`3G1+Ue?==?DF%ou;0{4DQHZ{|3^S8lc6G4ClCtm(uAZp#%Veub zWXtyXn18=1;v^L73j@DUXAYx~>TYA;CEZJZ;i08qM!HJ_^$S^@RRT6q048>**3;sn z#--|q44zYiC}{bG6%(U#$?YQhTRGJmA}p}}TTV-k+o~{icySg7K;Rrn2r%f4OVh#1Vi{E;2%?p5GlIMT0&xU z>TJG4%He`PWy$NlNp3mJ?gtS<7Z}tLBBhj}V%Lbe27U;$3v>Q9cD8M^c17Lc-&Bpq z3auTMf0x$zZt=8;dlSM^lOJiKkdkk!r{$}cYf}z_L{=a5Dv52781nCzZ~=b=&B?|p zZB7epsUS~iZMK`cUQdCr4X|Wf)EsG)u)LD#XW&uj#0PaA$PkayAExN;lzQg11E$bU zBmYUW(8WHK!d5IfH;i3rM>kgQ@IurNwo2>~1Hmuv0wL4gMBu5T{T&TPg;tc`M7y&Q zGllkv@Jh|E^elOXkv#7p>N|IzW~>q*v#`qmvey2qW~dA(7%4?9yOBCtII3O(spCc=3+#$bylM4%B9 zV7{z*Y>)yKWIMnvIC%pVvd1S8v|KAz$O+fqN)0plTZH)55eHFU37I_-!*>lJ^Zt3m z^!;uym+RdpS7+t_qXkIxsS$m<%4$7CX`vo{~6E?@k3=cf@UBM-A zo~0MAL<9ngmwq-6pt0mD1KD-dP#9wAiX-?@ezEj2?S&IswwfShHRB~}Ytm)$(0E)TQpu9%=G)z~3M2e#cU?tZk zpQIMN4W@Xu7BvROyv{i-w`aSuZTEla+7-#0xWXyTBWxCxbR<^q&=!0M zd0LDM?BG6np1C9}Du)&nqb&LyF{sc8!?~Ez14gu`?o?pm-38;H>f#>NY5wfcL#0*n z^u!Ywv8C<|-eJR%%d})8703;UO?neGU?Qq*C)~_dn5hYeG2K?rwH7?BnJepWd+SF> za+8-pP~k{rxc`>X|2VA_FpwuL(Q)?VoTaqGj#+L>Jt$U;s_K@t>9`edbOCDULM5qB ze%pmU+(4&RQHW|~+g92T61$J>eJut3$ZkZ*j;gCD`OHoVk{@6%fg0M0nJs~s?SG^H zLtV01O^O*;s&qsG#6e?jNkLkuy8?BbsIPkkp59GK0muzaW{EiSEhbX+6N}9k%Q(q4^6&RfOl4MxBt(3t zaypd;223>#XE7x+jZ}sl>ZmzCG!91&G);6@aHEiHAqRvO#Jk4Cz_&gj=E}ZnE|R#s2t+BEw`1QtXOfm&fDn@pc?ZL z`8C%NmRmz;(_H$gGy+U0X|h5^eZ~d?YGnJ_c(-<4pKW-6Z{@bfcH(NheVUYq_2mIT53BbYc62sZo`0Jw*i`_PKRi+M{w72jl=>2T`?+ewlS^{~ z;!EiQ0xPLOq2)du=H3^bc=@apBV`9qq2p2Rc4Jz*i}e)p;#Ziu6D87}&6v&)&L5<@ z4(7kvDUqTGoMZKP+m1oYcb=+mf;Al=N=G3-7H!4E;F{UYQLxAy1Z`%sV+XT^r*vp} z@6njF$E~IY7{PyoRgk16Iqv+k0=t`Q6`oOBpFB~xd+a2XO0RlJ$j; z8a+qFEAP6-O0B@nHrw3GhgCmoUG7@k7@mC{jLIHlXc${{_g&-aG69X@kqJ6gddokv ztY{E3Q}Hg>FNEwsly^0*@>ZGj=tPZaVkVT@awWKI|ULB55&{)Y3EM_JvdTex7 zY=)Z0DepUb4f9Da?tRB={0E)r&p2K`r+Pw(Z*LGF?c0>H3{o&g0UiH7LZ5+e@)h@{T$`$?IR+kv7QB1}99oYu-C7r~_6&Au%1FG*-MlKjqCa{nv|P`=Rs!=tczc}GcjPuX>iA1evFSi z%6$F#(228rh4*y1qbAWp*NA}IYSg4*M~l9${r=d6k%n`?Rx_gclG{{wgZ|s~NaPIY$Rx+({9G=ogf} z?sY}^=;@tnYWyx)?qiY(AH@(I_-Uwuzx6a<-f z&=is5XKP&5fajC+AZsu)$Z`_>-PHMhd%ki38!QM?_fU{rG?J>}Ebd1#=|Ne;r@vWP zoN6}V6}vj5D&vsUMqWg;whlB9@*m6e@jv4%m6LZOBQ-%I9l$CZG?;7gMUuzalYYIx z{&%i5qyyz*Wumn;(BYJJiS$*U?@4~f7f^;tXlrXm)I|jaI=xN z`)Z}sEA)^Y)_43OzdNVDLg{?t)mL9}8s6Xc-rqEP(AFy2lf^9>OsK9DAH zr#RFasRY|=_&ocSGXfnLGUuli=DjzlMvRW0;6O!r-&#_Zj0wcSZAO0YOO){gI`idU z8Z!XHz2%f3#kcRi;WNl$yz& z@m@xwe7Ir19eOwuKWwkA{nyw=`$rgIfP%K7fT!*T{dc&n_xXtM<>p<7cH_0I_Fw%p z-2F@VnsVEZ9%l?yZ#Dv-pLOJJb^M^AY_B%t41DtjlC{&`yBd1b@iw!A_5+IbF0#os zim(=U^~WkfyW`Gpib%zd>*~58@);UK%M2JJbWkly=fWe`Qomzz zdagZT#qmbHx0a{Dd>G=_q`t((>K@A79*Bv(S=@{N&Z1X~<8qK8cjsl%zUb)QWoBM7 zC9-p7eSO)lV}}x?#kr3&YjTBVNI~&KSY-5u_%s z70TOt38@KTV#uw>1b14mFtx|t!~MfO=dMs~@;^!3lmE)zGBsQ`Qx!Z|Nq`^suvT#-rM33{VZZor z=cYZ}HfZZAV~0URndW`NLtg?$Zd`WU2eZuik5Fe#_#ZC5oHYZURFuRTqa1`p>ST&; zO;oA4zP``)m}JS5;h?K%4thL2r9bD^^E|*%y-24X@iWH8p7lUt18Gk@pQ5D8rQANhSze&m<%yi1u3pKzmJqgq#a zQi}Q_1Jz1|U8%pJ0ZQp)Xsx&)Mq@{E>{+xdDyROCbYIE?iN$gB>ipuxs^5L-LjaB) z<^OCdfWHy=iP#7efFHL8&$Wg-gY01;x$*1sI8$ImGgfq=s``d!6ZK87%nqf3_g)T!)h4IEPeQIK z+TK}7?qI~%96Y_b{10CSzufzTLDZo_cq;sw-Z4kF+iju5WxtX{7|^AiK`>4u9{)%Cz?` zcRZ0f9(<{u91ey#;l3h5(>c(F9)?chEdNW>|HaVO2bu?p8t=O3(|^p8{r^HKg7R3* z*g0;^L^`y1ON7lt)P3z6-zJ0p@ML;u>Cw}vksDG1{^c_&igKr&!l`-}(S5@QBFM=T zZE2R$(64zF?{?Fek zb3(ffFCtgKLCP(T!^wO>1Ggrgg@trDvnF^qjpA<8?^&dOV(5J`&T>hG&eerKeBA^s zvS#}~_i0*#ZK-c+BF4Vk-YJm5yt*fBPK>F-OYq9Nnqi}s#Q-qev{Xd$qUjS#z9iiR z=28`7>Cch)aFt>y6?3$Y>&Y}v zT;C}_Qrg^R)R>oW8E0DVjAzfKIf)wS()@<;tKhRYi? zE&lx?@K=^7Vj{kX7GmOXGYrT!%m9m+l*dslK61iO9e#`jQ0!rUEsl@b5DmZlcIe$( zdX-hs^8EX89*<}*E;Uo@Vwi9`b^?y5=xm-V)XPv7o~aKS<7epBSa*=RAX0l%sLmnp zBHNM1(P7NJJXkCu_z5!_4fxEb72$){L{@IK^^BIJ%|QC5RYb{JA4SJI^YAi#KC9-tVWBk zgWHF##>8_kAA@W@?NXgA-ibQi5_l4U@PmKmj8Ao?Pib+xj1VyZSFnHG+yzGf|l9XZn1HeKkGDoTb~6dH38wX-80prA@|-Sf|--N}i^=CpjrTW_EEs zf=VG8upNHnEx`!_j>BNVbb_OhW5p##i_&R_S!aMyCbGQ!tH z)%Mf-Cu?fF6D6K-D)I2*-ahC$0;T?6NP<3G5fU8{aKf1=KZkKY}*IvqY#1I&y~HKkhH70RWH;FgBIek8U@XRB~)AC zNpW{#DM7At9OmxBJYa5CjvJWq;^Sfs9(5|BuMPL@3l&tmnL2DbN!})6Jm{SiCJy$H z?s`|2)$&5qe>I@yeh5-}?~BIOrjBL*nZN$t8jHzxK$>a($BQ@%#}N2zOF} zT+!VVi)z9{#(Gm#nE}w9 zq62i<#Q{-HRUNrw*wd{YGIp?4oXic~C}tTlr#)i*r;PNwn1a5RI#!f=@~KV5Fi1v< zkll0lqlIpg!^gkpC>D>2Dc*hKmr$MP0<=ir|E=C8Mn-7HdW~jmv1n*n$lg}NUMe9x zias%nHZvSE>v#7FXTbxZNI5bfQGIvrnl)SN6ii zjNm7HWR^O!y1y!6e^bI<_QwSv-$b2^?Xh*3=KXxfMNPqUxZn+-lOP1IvR<o*S>I{Ry0%|B6{Q(W(4kZ2}AF)}&@reX0dySlzNEsQTj-DmvORDRd< zU)i?lCN2_lBg9}tij3JoTUthWkS2(dq7wO$;U962Pw|f+g=M`q^)A9)sI|t3G=_Y% z5k#tOplCH{@b?iGSnZ)`w6|ZxrW9_%8NGkOm7{A^J;2;^iE-m**PiNCYdmxwRp)Vr zPwGSRwPq|HYTpL5(K)?Ve}--bu+tTZdPkL!r329fMCV;KcSXglg;FCwkJOU1hVO1z z_=-*}v^VSDRZ>qL)TrWb#n4&OgqgyPbvZ_2^5-%i5NmI={h@~0;_WZiqkpSHi7Y1t zpyKeuRT)`GTKXr36x&2W0F4y5$q!) z0%l5qK+gMY$+X*5bbxhn&4=7M$3l5|SItZnPBj&m2Wv`n9=cTXGH$`M^7q_fkto3N z*uuI(&QQyz1#17{?eBlM_Ii!VJ%?E>Px{YNG z-Td-?pDVqoCRArxZ%8_i2bqc+-MG0ulKvo5j+rop?{*JoP>S^}qiOU1yKh)#uU37_ z-%MEYfa$CJY{w@s}C8+rQKWmOAqMW&hKwcnCE$8hsc-FF?Oot2gP3?k1fj>HGkNJ9O6@yoaaohWS(9fylRg~6 zKcA7)lHm(rDRtZnE6Xx)hlZGS>)0$buNf_E9mHZkcjgay`M5Frq05# z(*tH4-E@IFa{BrBUt?bjebVjJ-`tC6xpn6=wMhJ}<3d`QVT#-xG@cLoA1on=BjQFC zv3L=3v6&j=8inM^+JVuB(gNsVgmUS~)S)gRYmsyUsWDv*#8baR0sXm5kZ*`&q4iiwEz4<90teVylHGcKYgU!cYKkx5~DGFs+gsV&0i zjE!zCKqYC7^Il;?x^XV(yi7vnTujt8#9WPbjr^p#Kk7UjY{7+HNh~-AFe`cOwj;(xP-LjYxMhbfa_&2nf>M4T7X} zr=WB<{Lk$Dopb(ku50$SVH^hLeedVab+5JM#T<2MJlo?^0B?wR55v;tfD!LLMa@Ln_)}3v+$!bQ_f}9ig{3BZy1B*l=2V2~(z%quL2<Rmkmpo*@Di^#4?&w7yihxSL)dYPXnuv2bRCiM^_~oKs9oF7=O+#lYlU)AqP+JsJ|UAb!`ATSEI9AmVXnAW zX2zB(Cnt(*NBi~d9j29CmfRbmitTHFcqrKL;}Zx<_r{y`zu7{o=bjFKCO*brPfyp= zz2I3*p4!;7AUPiIH(I?|5>NT5dFOro(ffGH%=>!EY?DZ{>*@QoBk(ez)w4Op2G4z} zJwtLw#U}>uz>cQ!XY|HH!^W|IrZlE7X!t0;t9BFs&^>8y@EmDV1)3Qzznj+Jl96;d zcc6si8jn4tNoEDQNDZNiJ2aMTsI{*Uz=AklJfbzA@kqyF@0N`bW6DDd3Zxy#cLcKa zP;FwvSQPM&*rD{|Twy_edu}NuXk$Ph?y#}xIPVZZ($5@E^|@~Jd? zN6vM%YL!HLS%#p~tzJUDzwX|04#d7uGZ=qTpf73G++=IMBVawygO7TH{O%xYdqyIRLt_171UKu?55Icp&?6$PJH5bN+QWK+^xX+m0raf`|7Vk zPSfs?8K9eH|NE!V>hVN{`LJM3jdN~(K48@(H(YSVEkE=j`BPFSQ!ufX{;`}!z=i1H zc4e4_wInFpbnWEVZ0j~HWv*E1=7WudM{S?gS*^axs{PR#t1Lk9sVH9EJS5nH)lh%jtdjqXoc=r0ge=CB)e~k#Q+!4A z>vdV%bX%Z(n)q`eShvax^=U01*8&q>W-Ac>PUcEcVi#SFe4*by8hUodA?$cX&&?mL7AEH_=_gNX zTd570fPQ`T(Qa|a0*fikXlt+|%WVqoh_K%Sz9kb>Rq7rc?BWM2S^59!fBw;x=0&Kn zi+hFRR*C!J{jVcrovT20D4hr~hi>#x`$ME$q$d5ddQ4)WXuP0o)U`rr_*^G;2^!#- zN3)TmrzE21DkMA?7-sT zQw1hM^Ki`8(9GJ=8qWCKT+qk}RnZ&rG5+ZL+gOw1b%BPHT>;eKZc8gW1qcK~hCQ;b zjuV`iPtc=mKSPw*RHHik_zyJ6r#@Xu+J+aiCn220kh}3>T((i3V9Q0R(S zV%NJ~IoG*L^YV&XWUB*QAiyalw3V}i#OpuJ>a5iNbQNgmv5R!e7?jZUc2&Awd*R;< ze&T+UDVy_$Vdvlw&t86f;hgr)4yEtC#*p?fqi7=A-;?g}O$VW3+t+BX>Zz4q9Ik-2 zjXhb9qTnisoDI#+^aq?v!XGZ|FHZFwKF-N68s4#0Wi14PAySu&yCMUmVWVV-r~PAS zFX9J6pJFD{=)C*}!|x%wv~Xs2@ZTE+nhm=`@DV9^uk-~m(eN*8nq}yMm)}DoKZhB^ zd>=Urfv7|IP{4#VO3l}6kyx-9sK+hww9zo_;YINT%mh8p-htbiWJVQFdxu|2tS5_V z)aZz1WtHw={K%u$*}*_-%j+m})rF*jx-!J_1l$>+714m{5x9msOmAt|1l$WG9rqx1 z-`fr1Bz6xp(_rESH;TSa2zBRL9*;R%ju)s%3j=`Nz1=zom1ne9`*g`$mhBl(UxFTi z$iA>NS8}6h{IO&i4i3)E;@WYc3g1K8ke!@?GR7kI0;Ied_pAx`NK}NljEiKL zm;d2v!wBXy0LMs$m7wVL_-LmJx@Qjges?l zafFs@_aA2!{4Uz0UIpsRZl}>!`1%E`_!m*1KRbKhjf>2FxIpol29XxBaeL?&$-Z!S z8SsULCDEGQ;0C`;zcHkK_)$=89k>l45e;M+pR;2UZ_PdPd zzh+sjNcnv(Gi=V=VWn*N!!qdi@xsqy_1wSTW7m_q0A5%Q*cZL&<;A)deHAQcYpAu9 z0G0=wn-J}3dYrzLWxxY_O;2Yb~!o z@W*Am!-Az*!6oarCAB`h{T< zVz!2Zczl~JbbNPO4t(I-tCQWKqZ`)Q3_}%EYN_Za!(9Y96)wB!?mmY+I~*$Br%N9J z=Nm_lBgYvwIs!QtUYDvcL3NOqsF%79l~J)}^IX{P5W!9JV;)g<&&>vqow1QZM|Y#2 zs}r(BcpkaM?Vb;gIpTz5(o=n7x0}GZiiyP^~t_^CHio6FM8vN#D{JY zVgmFm7{L|QZoLs$934PVR>xDn2aG*{=%_nIhU^D?o0kwuaq%Az?c+WfK!JB9CBsvI z9))0ejn7X6^hRoJtj|b6I5m{;yCCqi=%<5g6+I76E;r)BRTT0h!aS4Etaon0jA+9&4rj)?-UPHP_;Xk^6T>ZxbthXpoWq{J1Ack3z4{o~*v90Y|H*FLo#1-m8G$oCp!p{_NUQPD6^w;j$j%_Vq5)cOm5ll~nWuI+^>GG9mV0>M6ZnDs$8KcLji3zsP zNt$at;e2?sN=QMoH4fAhzv|ZknLr$c_2lybCF~)(_X)oXLzo$AFY)2}qi0lB4BfoV+gEg20b})pEc7MyD0P zh1Ctd#YGRcf4IAJKcA8SZ)-8)9R%`883zX>kR;N}G<o-KcqX9FJ9;@${q;=T1rxw4UJ@6Bg^NZ(bJo@)R>D2w%mw{+l?{+ zx)%O4@`bpBgqZCtFGf0OEjcADW78;XLzbcaoH%9dEQ?wAD;!)?SdvoKM#L0JIVw?4 zb=Y!C#uCztBXt)5g3sN>_J_q0mX7F!#urBC_WDVsL4xjO}s@HOS|r zRo$dW)8MzV#b_zc8mT|O$$D~$i!5d)4AC$y0(CIukz7?ab2I^_KlV*wX3|hZmN*vC zk#cipqvN1fTv}Sp`L5f$`x`K4PBZ}4VZUq6q_08(m;%U{RejOYr|@(RD|v`uR|`i{ zc=)ATQYVSg9k(2+f+s2;jwh;O5AWHz!(1EeeBGRTRruah0X`}!U|s|VwBF=i7Zf1* ziwi5zZu6$Bvz?Rrj_caEc;wy^A7xxW6f9s<2QV42^n_{b(B8b)pb+ORridi|4kGpM zmqRPS>WgRuUZUD`-;VZ0d&Q?UvC%<6blGT&NyEBZXA6UNzkF1F1x8cyUpU1Aq7T{b!IFPy}09Od*KxeT3o&c@Gmm3Hp8 z$N@L6Bo|$S^MX1HTVc}DQ>v(Y86!SouOB<{xeCeqUK9yjm;zch;Vw-BXmaS6oz-7^}DksO!SgbpfNX;8}o5_b8?nfi{c z6CjXadb~cx!dkqFNT9rNb*up^XRUrox=R?gT+FA(SCxr~$O*gd@#W{|zw3=ijt6%N z0VSsM&k10Ay#(bls3PB9?O*QBHaJiV+AgA`i=jrQhb$>>Or{=IxF1_%Mr?8mv(iDc zjd|xW8{SR?-IDdP3_OeUT&X2LFJdq6Us|~431{bYN|Z4$AaHNt|C~HSLx{c>TY*a) z`wFx>fKP;;?_TB0^A?t(Yex4^7d-EQog(^Ojtck-D{OBjwv$dz( zvfX((K@Y6Eawzvlx8Cm8TL!ar`y7Dk0Q4~nyTg+W=VO+dV>{OD0W(YT@egJrn$^qT zNX|{Rw_JBA5w$4C3H~zoQ`>cm!l=8LZi-Z*qHkwS3>)V6~IuE zavfL~5mJD^wy|MG45YQ4Jrac-ho3*;-)K&o^v48U{VkzBzTP&X1?>jk`>jJj2nq<6 z)=bJ6&ZbI)U>>FQ`?IP$SY!a_{pJRl8TPKnqf%~kLm)*4a&kMiyIH3z@C8aSfh~>z zB;QTk8$_fEo7?=`aE96S-JW{;lWEYm>*)+b@VVaySS;xkcL!ZGTgxl_gcvW+^>c$d1Np#n)TUWQ47P{*O$?Xz0p^Y}f1K&qYz& zK2Kea%@V}e-E}82Ee7r3zTX6c|@epQ&rjAXfjtOv=SOx;3c;r^}~g2Mqj875ZQMTRWaX8&RGyG5>ETH#&#a zzV(?y=p*ZpG3Mu5UP3obw|UE#)XdQKyLFTdNf*50;u8Bmx6e?6WyY+}VM*TI!$N!9 z%Pm+F=l1dx55z%`9G2-<=);9z1193G_f@Oyk4u1=HFhK&cVzHqKj0aLWt4~Qe&|e} z$Z7=^y}XZmm1i4IaWzX<2g@I?HmE=Gdat-|_yEo>Z1DSzx^db=snO8_&B$!$99IKM zH?@Le@%YOgetam;%6hO0=7u2ABn}>5EM%{aWR||TwoO|5>T|jDNsZ;R`(f+o@u8Gk zCoey&7xUbl#eLCkvGr3BtPL=fgy6mreR+JU>PLr*`kaMu?I;&#Tx|s(uWQR}3bZ^R zQPIWV;|N`y{o;~F3Ibt)G)=}r0SB8>Gyo8C-d*=&>9@FxoJf8r#sHFhe6St>LgqR6uO%KPNl!*=0<_+n2aLdv%tyM8FznC40Ia6q%0lf&6gKVT;W z;{#5^mZ-~>M+!qOEy46$R!lTGVdovhh{z#_OFQh5tb4(eqv(aLu2AZ%Uhwu~Q*#)i zJE1acat@%|Khnsx4OC5m{!7r`h>-k8K}GPM zVhWJg$^X39kl}G904~j|;(&4E4DN@Z>nIG;G;~#xq!E4jb*Kl@eT8l*cz}}c2qn<| z$`VXt02K(s*C&YN)bd!qEbMSmItXgo@cE%2KUrcDu&bHN>GACE_!8Au@&et z5y!`NL+C-fO#pB}er@rkt>=0T);;uh`^Z?h9 zF6=p#LOwbdYDOqEr^xV_e(K+27pzK5nOt0NNhx?=zXpn0Fd#xmTOWMQhbd4?Avh$< zMiw=Cx#kgbd2B{%m$gBcX4Yu?v22o$z*mCXN`&Ax)9Dm5R?1|yVIXnnt$nk8ypmCp zNki${%b`mtZAm_p>%Fs~Z0*42$}%K_eTmbP^wm1OxKwq*DTEqTSf2Yoo>}}ciu`VD zHi(7N5%R8(hUbP>2qmWiahzc*|3k}ATpE0ZJ8UW@>#4%680902!woyEWjL`E|1QX&h#2c3R3~T1GLQSep6_a zQFz<4$1ex7R)nQXV%1L`Mg@=RspNO(6iM&4sm>%?)eS0QF{680vZ~b4O25v^w!9!U z`mu97DuK7Kuv;Tp=UmhKneR8^=mFNV7b_bw;vPxg|iBO*r#?WImkYXo1uXS#XUlrs@O(r&`>Zoz^w33 z*NR`Pp~iLxmetvT(w`PDT1BLM=qF3y0-izN{RXtc_<7i2+da`xa(Oq1^V&(hZ9a!| zpz95L0#+-%|3S`f*g}rph>wI+0Ma5*Die+b7L3hL03I!@LKOp9Zrl_NKnvGIcXA$p zOO?tF9krLy25gDzy(N_n-GUZe6mpA8XVir znBn($Z&ZPKstw*o6z{Bw4zXqAsN%>z`>AyH(|ZZ{s2`iC@`i58t849zC^}zb_&l<3 z`W#fW%WO`B2@G*mJeCAp?n0AFW-P&O=*3u*GU*J-#z}vDVn1BrRMhPy`uNP05Lf^C zmq2vV+G8zqPkdULlz*|*?&e^z{#xM!#uvpu-4?-2{4c~oqP9aJJsBy{u(0JnH;lHX znfer;o;kKQhUWe6C!$1I1Kvy;0BqXos-smPgxkP{*B^hRp1(-yHRMR12&+ zbP$HNxGiwR+eQ^}mEFGMdMn{T74E6)Q(**F$oThdG@B8kRcE6uKtq&9=_@;X<|~v> zPG#IrYuFeatFP>J3m+vsUxV!ySqnWa{nM0}sH#17ZqL6teKBgZXWVT-^}T{q4DE(% z>_qzkZ}fOg0|1CmhnbusqhUxIFqB0ZFUL>>O?({9_$6P%$8?8Au9c@FYy1)RCt9&8cpgG3a-JKBB8hzKNE8Qmb z-D~zamAOc;f(*0{05$Vei4oX4tcFYGGU~0hajS6M$A+~)o0@NO)OW{b=>0VdGSUy% z*`Y_@-s&CSWYt$XZh5lnR3Qfkn}H}u8q!y05L#*4JH(y-bLWu2A5_@aPAhU%R`sB3 z1;~12O2+9Ve4c5R>Bm;`Y;6P|vHv;zqX1hEinSP@00D5>1Gknq2pd5Ai&(x#UwiJE z0K5hNVCBnh{#W2SUXQVDTS^(M;?lPG2mhm6@(**ZcsqZD0e2G%A)5YGb8pBqEJ1B? zeVx)hLuP9Qi7^qDn!!cx29_wDpd!M?PLd{CL1bfRb<5=DaR!IZ%`anlCnjp!3Izkv z^XftwzR2<ip4nxP~fa3y-{}MbaEXO$@6=9eb34FQ23A&Drn_8}G zz79|Ah}`nNdEnxY1AYOOHkIUSbzS}Fh$_)2>{!|RH@@PeF1oV`DYW7X3Edd+?s84~ z6boMU49~v+S$X^m8vjwVAeHZFyo(3+IWJFaSBd~M4_XKSs`|w{?;j5&VS6orh=s{V zV!hLf52!(6E>Tt{^Jhlm`jXa$4^i3SGe5d{G2w|55HD0OB&`GTl=^BLz^W72lJOc9 zr6ClV2%mNEx)z{_`;S&}!4*v-*NxBCLr+{E-?swFkTn7dml9usB+o8!06+Z_o~Wp& z{h=MFpzSP1qY_+FuKHV@P*4`Fwq8p1gMxQ#ex8ieiwZik3)FZN9M*euD%df?wL@SX zF<=*U;A?6^LdKgGjjQ&|rboy|!t0@DmaDEdN zGXFcDdh|;{ei6Fp)TB*BBUt){H{!jF`<-`1ph74eN`hv2y|jVw6wX%=sg zQN;fzkg4I)inlwnh=X8tw`8hNvKV<-!jAj2@nj@(bzT;#P{62Myq)em}Lay}{zQ+XckL!DtJAE6u&@Pl-KTe2)mSsS zdqo6ZadR6TM#C9#cApvi7QoHje9f_LXTEgkdx!K1+!1?HJ zk^W(HJUfe-4l98??skgxwIADGbrbP{yh4MU7&RCM1DevBhUOP zLw9cn6BfTtZYM6TxmgR>F{@Q1{Jv>YaWCc z-+D^01Z`<$tGahNwhK>*DgGKY`{vF@`=@!SUOfR}|;Zmy% ziWNNCpWOW3l3cEP!eO9$3}fLYpo2#1Vu3rG;L9F~+}swaUu`8?gXNVQ`X@V_P<+av*fD4!y`3anKQh_M^ggjWOmsCtAFiFYyy zWj)I_oit+!kPtXimh`z+rP6IJwcL5~PfgTzgF0WXiLXQnHj*%rAbpoWtqe%7dmlH1 zDA>%(@*QsAXTZSKcgHeShyE0jb|HKisWw&I_^{bjQFL{?yW`wX0P5`IDw7BP+f&qw zAc07f5}=dqZtu((q?C-@oXNmRI%bcWUGee*_j~=NQ)ut!3dydGFuA<=Pz+DP(cjTJ zu$kLDDT%X$I(n1rhSMC_9>}Zvh6nHxMJ0AJ?+l*7gk6^>!hiSGF{}8C#{e}t!p)@N zZ>=E!Cq~we42EPCsRYkx-=EUx*(j`!%2KO|f;zj6?-a>zEPR2?tmy9+7565I7DTGM zJ47=1gXY4R8Q(i+Z74vikG)wz2Z&Yc;PpxzCdAeev{pkAmUfcQE2nBWvqwiA&>5z) zfPy=!gIa$Q&;b__27f&Pz#i( zX1oEM@v2vK=1@%>G|~Q{`3Z$=mi-qN;DtD!H1z0>P5_C92kGctG?BRwRwa)=@DV$& zZ;tdDyla3x%qed)zrqM{_9e~GcRfr*e%h2MiTTGnE)@Zn?5^R>hhR{=7oF$YO$NJ) zB#U^rMh`uoo^5m-+t~2aG7Eo?L4vM7uf`8A=<05sORjK!BIeM893i0A{vRmd#s`0coK!{tQ_Od;%5>l ztNsa^2VQoutzV%Y`lq=4rf;vqb*d#f;oQQS&_v+FR$wgvbG0?}q>T_k;zEQ)qgzU>3qE1{z=8 z35+&lGtZuXP=@sh^&9M26Q;b^d&pqscClatYpd@s;DqoM1c9LeP_}!fRn{NLWd~g{ z@1N%QXbkWb#!T;3{M^@V-|MtGfD_Xn(2_BcuNe?=L#pu$v(nPpF!>MQK3g0M32do? zCVu-(q9sl1bMovh1N{H4{*6Emtoz<@ao16n*U!(UVr@lJtjbG7WTE5)7|pR+DjB}U z6JVGHi9@*5)D%(p>xW4Z-2`#6=B?4b1B)OuW0Jh2sr3;8oZ;j^A1O; zpWm-=Z`gVmA26ecReT4WO3_o7H9O|yW8a{9+TnpVBM@)F zih5PUkahH>0M#R?s!X-P%7SEP)S2sf@JHlf&V^MgGbN_j>yQ+>n1rOt3o5F9D?SKA zRJ+!+GcFlSU;qQ5avUc;G!SSDfyWdj6i`AB5<{016+#yD^#vF{MS^}Vq@dpP&DVg= zzahhl5W8Gs`w3KJcze+d@Hp~lHDQGWVI_x}k&(aQev+w)(yBtuc~4GE_lAZ}qQwxW zhMYrRg;`59$%O7#vp%P#fUdg)m0Bmwq8(0+E!mEiu&)pf{#S0jqpW5k+4xABg!TZ3+4wTfaDM_Azs~`f=|lXTIeYc!2bYoZh+i# zx_lBcBf`;%CL5xfQr1#KoPdbd>p;7>z~|o=lEnSJLf4i%ox{@FHdu)bWyro?DsnEc zuTOAtN+7Se5{qu!vSFr@>os}am(u*gn8C6UrBQUk-^UXNVo`=?NkMA8V||!OQ$a^22}TY_$tETrr`y=Ht)9e+Oz#7g*nyka zSmDK*bv2eZt(IgHWG(#j=Q6^^T({RnBu=L!mMx&}(`OOLQ`icc=vz`s6>jT=bnkqz zuk3k;0Md;FJcr3&WVLAx?>$?#e!^2JbPdU& zh^x*hYr;b4M0^@NDSqr)Fo__L*hp44Si%039@zOZ*TNW)>&}8+v(%kzKNH~yku>VX zl>6l@E4$G@?Q)>$W^?t>-=0%@vx>o6R94m>LBs`{R~)ZLK6O~_@Y=CFln*n*Gu0v7 zOg7z3LVz_`!JPZu;qGBhK_ewQP*XAH_8&@ql<~YF&j0##1N;RrVILV5!oY?7J`xhn zHL1rre*jv$yKGOl-x`!Mwj|e$#-{dlCmxl!LQACz;I$xW_)J6s!2#6 z&KCT|#ax0IDB0QayHE4LfCs+GZ7@rgf2wTmDE#p*>5^f z1A5;Fd5*c}dn-Jr@H|<{lyime!U*-BsLGYI^DOwD?S4;Z;DYr|i%g z!HoYy4f|0U1%Y5tmv8N1U=hOU%#B-|fSXF9983*e`z@^zFtFV#Uen?p`vL6D{e!mK z=8XZ%2W}`@=dZ?|b%5H%v-xIhellSGn|zHRV*}3F#zpe)7!eU)eA>Gw|Ho~Dp1>46 zRhTkp2*SsufL;~r`%BT>3VV{bE_s|qAEb-+rH@byfUw8&>Yo_Z>0L#g)Tye81JUaA zLfOaHZZQs34btnK!>(c=v|H|XzTD6g=LfDh0!2i6sr-V;ry1n&!QHkuU#yfqeXKbS z27rBsg0BK!Qw#Z?I>U-~km9|HEa73mm1nf#K$ZZ@-J2gj8Ah&m4eA&j5pQXUt8We9 z507=IO}-Y-YWo4~H3{)O9BY0R)DGpJZmEe0Eyz45D1j<6Y}CE6cTH^q;O3r|`VZ$u zu!$om+~>t^*Dlm&>+W%rIE+G99vXtbH3?EkIbg$z`a2I4{_Zb;1$e%(@;Pc8Njk1ATA|e!;r+ zzH`hsnv=9(T-Ft=2t#LrnLYGtpQirxIXO@|?BvG0IP@b?Om2g&_&t&gD}R8Y=o-#% z&dHM#DUO)#^^MDlORNH&olg)f!DqcZ*c{#UeBtbLsYm_sadnQDom9r3!X9!1?ud2dO~NOko-41%1E?$iaerh0haEBOG^l9 zY*VOL2mqRrGeg$FOIT$8)rVh3cy$fY2rLSM{XpCcoIZnE7DKk7zd2c_RmUUTv7R65 zHh%73fXzZ$sY1eGtPi9+M9(?nyT~Cgk7d>4v_g{lT!l-&=6~;ov5g>!xRmWS?OJDx z+DwU*XzptiUd##Ini`cx)^fQfrU?)0W7Cl<7{mV(oShYZ`gDVvnRHG8Bj2uA&$>9Vnx8);AMZRXGFQ`L$8NG{;i3Io;dA=C4eGp5{;pfUL!tPr z7%Jeu8C#Zss|UPQ9XY=^vTAR515mqU|J}KkQo@zKdf@$Qwuas(-y9n)7*!Ikk|awXbtkj+ik6xAR0S1|a&-eeW_fhqF{YDUX3@KGMRXss7>+J*P;@AMP}hx=9Hc z;jeXCTvk%-3E+=?JGqhw`#-4Aq_mP|a*bmGxrY$P7N$Z=qrS-f5H`T(hC6JrhHKuh zLz=-hPkj<735Z}1maw_vxqixL%KkI2E9jGzzDm@R>d1?gM8F{mh+V7L;JU56yspnx zV;P^H4$5ki&d+B#J}xxsrp90Wf+XyNDfnSIy0E?#RT_6a(EhC%CBw^}TnP2M{dta~ z+dD8b;(PH@C$H{s}*N>V7ufzFu5-5f}~KARbqL88`#9Kyhq) z6}c#*&~(JRa=C?*x{r=fHA`px=|f}tZCvELXvMELsl*?yoL04o;k`cAeH#jBJCLjq ztW|A%Jfhh*U-mgvyxdvWKh;<;lb-!;xcH!@HT_PTul|-LGgIc1oyn~ivl|U31+>Fy zw$aJ2#e8qZ$Ot-h(DQ5IqPOt=k813f)@tgdRs`)zQ;7FXH;z>FA(tV9yQh2qf^N0& z=qF#fbgtU^u+RhXsA)lvwD{SW#_>7$NSqHx&%h{Q`nwlqwy&qColOg_v^!?(uNZJk z2saa%OR;xlwCx0(NYd@cP||-Oe)q(MEs3y|Lp*gK7%YlUD3wU3Ls}{R1TdQj^gv!id0Dq7QVSL-Y z_xj(~2`fZUHHt|;8(}WlX5Z)jvD;nQLtWME-*XA+&$*`}b@3#1ZbCAtPuV`N5aQ2~ zHut10{W_j6<<5jmaurAA{Q`lO|A}Ni9Q8zynK{+C9WNfW#!WIa#COYU?yE zu%tH<-=LIS)i%er3;^gAP{GZF-o>n9*bzbWbZl`s_TYiG)UcII>dqMpJsAJPKHxUu z2$0E@m3L)bta*|b8k~%GG-yL@I-JIFbbaR_eYF&%a12C~D_!@ATP~NG!(QQM`CPb& zp9}~>A-V1nN_i%P;EfcdZtz{x5uRzV{v$BR*XZ`$@p^T zi^wY4Hhi|w$b+HjkqHTv>>EscYEr*IYah>Ozf#elt(?cgR+PdI$Ugv$H#h4&8sety zT2pRMX1Nn=24%3$_p6d%c5<^2cJwq{}d`~<~z!b=q6Y`MkXGLDqC>BBKDyHucF zX^m8ac8?~PL2}jT0EAoOn@PSIA&`g8E3tS2{#v7~8!Do=%CoJvM5Q{_WSS*d2@Iz0 z+Mz%t%J@+cW$O>|Ga#5qnSZ=3B^8rwx@LpLgo@7_ou{f6@;cN-Q@2)Eh7mlpk>F#Y~K*q0dt7A_)il)zFl1Xv7alb4^XUJR~u3ToFs zdLW@_bTCRicoQZ&*MT{lYP2Rdy>@XXwv_{=2ZZG}rFnVa6ZDL&wpx@k;V?thsPpYl zOHp$rD}HY7A+#@u6gIWlHDduT6Sd3YHHTRfO3GjrG0eBI=&sddAtn-wu1`J1ZaWZL z`0Au@C33!Mf47WpqstK6 zP`*Qvt39;V&lAWJ({PSRUd-}o*B|hJX*N9k!;>%LEEjto2sn~g45Vo>7+s!AsK6&k zUT+doxH1EkLOeS!29DI>U@_LgAp-4n4huOEQLW>n2H(1X2%~z3*dayd zx3}r5_QH?2f%ai1wEN~%GM~95hc_w!Pb0%0A14olotMw2?M>RfWA%6{+sKV<)uYxYw%)K1zPh`yVUx+_rptI@ z_<23>DE6@dNvL=IbhJ(WRRn%_x2J3#KBwUwkEj~T_0PH zY4-%hK-srr3>4$N)DcaR;tw_S(ih@C>0rigJT#(sPzWx*8kRHD;Rs1SuO3+EEh2wz z;G!WjkKceA*h#~g(H>Q8^ym-!4~*+_D|3mc>Pf`=Wmew@%xpOVyrPq^!`)M`hP+XzB>o!w+^5H4-^UnN3vQ;KR(`^JIm&&1GrQESM$}QHLj!Me&+a3 z28ivWu_f&Vy~&vamn57)*nfrP;TsMk$mlp*J#gC*vb`l3?`vbsOrg|-wo>h%ig!(U zxZ*@HWc59KJ7;LMKMxMo0ZeaLcy!ybL#!ag-cR+hrQU=u)tJ)2UEXbMJH}#GSRAA$ zAfJYXa^dm{bY|5@f99;kNP}i007Nu|yp(&l$g9g|+Y^!a)PCoF6c=^KB_vuChst}0 zRs3}CX&eI&Cu(xi8(Kbk99Gs>ghYw-5-9>+q>C@ zV=fSYr4X}jA=>iQN>2bCPK8o~oec_dp&1tQ)68g@dx|Q{!q>&|D9VN(F*>|Sc+L%X zz<|pMV$(H$dIf*n)J;hb=RES7*qluRY0Yg}gf3FwkSojUzy+AO?MfTY`S~!295*-b zrQK&n?g2g#0{#d-ATEwBjoWc5UiZ-t@Aje`(## zW0ZY0=n2k^h@GWuO$jWk0Q(aHE~bZ$0E0T{iXmv0 zF9Ud-p*+L~L(uLH1Go;&@AFU%=5~bsDu>835MR3I1@ty|RrN?N4txlnY1u{Tl@{ig z_JdeccUk6FFg~W+7p>@ekSy~=|Yuy7&MM|b~TfUJ2%jNhWf$BhK=y!Su z(maG^uSdQ+XI7$S*Y=3dpU+>k8iW-wD1W2tJ+I&843?`-v``m~F^piisOW}(@WWXF-ZvNf^__WQ{ zdSo>V3k&2;!cpgKe_TQp)gk2#Y5PM$M61_w)D+VQl;LERJ~w|wVG(COO>7nN_ zW_k;D%AW1!U0YZ=GyFm(4cc;R@_J9??oT`;=gI-y-%jXnztPW@=EP7&Sw_4yHB_)! zHCtsS1Pm)`*^ua_A92lq>)k>f34n;I%$B;!=Dim0ewec`>i@yj-dmP=3ue#qJI?gR zrh!Kw{g(AH;3NN=&STBrxqbR>IBodqsC#r%ny50$Cku;N36}EhnG^8-!XV+dcgV%G zsgcFaLMogJ{CU;|HM5IF>jDm@<_W?l zkY+^zz`!*Jud#_m?5vH|^Q%>7;doy$5^!&+z3nkoLN$nk81d9!_H+g*{F6l<_l0UV zIs$@~GoDCm;NPTRzu~AuGb)OdCcH}mqwC$>ID0-w3lP`-f49D#=OWAfcgwzNGN}An z%hk88pgk&dJKg8?R^l4EQ95onA$^1giPJlciIxhQ#N9<6h_%&`Zk`@pLJSDYLh zV5B0gg-EA(Q@p7|ZTohVW5s}&85u0a4yrw2oxh!7p^%}02AV~2nY;x;nPgVzZ#+6e zkUXV|p*7Vy74>QsqpiP+%#e%U3vHQ0y;%h0%>i?kN}fgsF(~*JvU)ZGocG?o_>eTt z7kfGE$klAJGJ@~(je@0DP{Q9rFzW-q(p+}S`vRkOmkA>Qihog_IG|2 z8(O)24KRb>yHTO;lL9U#3l}8gbKj9E@k|_Uj)&`$k0*a|JuhC2X&t40?x`Y@Aq^Ku z^QEi|O|0$^qM`AWLA@i+m9*KdJ?fC_4q@C9bPs&MC^B!h#)=snsAyG55u~6_((>zp zO7_6hCy{245;p|Hi&G!Zjfvjk4W~G@6kcm#FVUu(D&{b z-PLvlOxWw+9WD#Sr|TioCQbFqr7+raRbK6chNv5;&B6TVOD^n@O413B9ZY$sQM}p+>>QDa)$gw~%+z-^t5(r74Qdg^_ z@V?fshu=ubFgqLhaH5X$9s4Z*w&A6u+}AsY%j?K?+39SP~p3*g*ta zj_z*Mo%)bZzKZ~tc~U$v7-xv9}iV=-z@UQhpr-&lHdfTVzR33`CU+hWvuTDG4u9e3N&bp6Y@CA%>CujD2&^TljJySks zna?CKvyq0$Zi_MYv+}u$HbH&s+58{IHX+RcG9_6u(MdA3Okr%wxMm216V31}2RI$S zRrDXt2g_bwTt>hu?@!~R^hcqHh+TB>v~$R!xWssP__FLZ%YG&BBlvOYcUgX*`&{;Tn z+^=d2E@yR|uFej)FA&r*mXjnc5N^482!0-m>MKy{*pT(ql>{EzM28sRfNA3bX-tUL z=E~0O4Sw{nt&Fsx$3!f`5MoF0mhM-r@~)eQyiUj75D5rjPnoZpg z;^fgmXP$$!of1r3m`nI*+N8znh^6h}2Ia+uyF*ipT&}l+iZ)|&(}`n(%;;U|LWeRwK74JD57d=Tp3I~n(jbZsN!j%b zqI~Z7*_|(0xJ-+wjFksV&4%@ z>K$(-Z?C#G_LqzBp?95}r3+QVO0%s&Wo~|~0!J`IUqQ**SU+zdLT416Z?3c$eF|%2 zh1~pxqIa?LRR=pmFS?6C%E%K$QG@=O|Dzlf+KXP?#NO(|^ct}0I!cTzZOJ;b^vvDJx&DfjyN+9QWJ>(z8ZZRO{=uZ9NT9pe-dlRAg78>t26 zX`&2?&8b6&qJ1+;PS(NCdve4#;KCN$bt>7{4p?jZ=CPazpr^N+=QjMXV}dn*C=E=7 zrTiHvI4Gs^?J>Rt5-DJ}$9@}xe-Vg<{}I{~J#aA=Z-{tj-g127`+l)40&>_EoUmTn zK=TtR-S~xl2ioa30Kx|e zljbQ8k0a{H269Z<}t%CML7ad@RUxaEaZqjl3TOu&M4)0lFBfS6?+gIU52RL!GByD?QDJRC3BL z2wxHq^E#oI*gk=O|9ZZFkEM}Y%ZqL6Au;lXZ83$|%uH+r5VeTo0yY?D@2gG=Zc=%N z&4KVMLD<^@pPXZb41oQZDA*J+s*it54oQ@8sq*q_F+@^(BRQQ@qmh9`QWsJ6o5Lsx zqbVGYhx?<~`PJVswipG_KDvFO5!ZAB-X6fm_E|WJW!@yvpu@W!`XaHi?yBqPM3$8q z!pa*^Y6OmRM_9gzn87uyHs||1_(8kb730mffQIHC25IdGosv*UgYUke;D>oM;J?A9 zo=RPA7Ar(pP&<5ExaDj@x-m+|kjK;W<_PTE(=(b$+<3nIgt!J0#`$?sSVp*aH>3y# za4JPK;(aN>&VXr=*N!9yAjEXfY4|J27Zp3#9}H;%x$&T%TGL^jABUAd)UHUyT~q`d z`qgA6DeDl@S$Oepp`_kAe?v0YbDb*ff5F?iy>3`0_U9YO8zt|I7bgkPXP>O&wuPgj z%rnX0yzJPCM>4XA3l-?-Ts0a07`BFKTjMJoA%f;8$GUlQQkY+sf^JuPyW0h zBp`Er+~o7EYr$M>DHVDdTIvrU;(xkNsS(mTW36+N*SSCbWTsbW7NklHxwDQ>jzuhw zEazXo6BO>lW?hUbS_NH~mYA{_(HDV4_)_rU`=Nw(@ksBM;p?3c)yHEmSH!qq;>IBU z?LhpAc9_19tQ}vg&1ghmQ8NDjxccj`s<-b86c!{lodVJg(nw2p2ndLjba!{hrc03S zP(tZOx>Z0xK)SoT>#lu%-}^rAbN}Ex$N>cR{H!(S7-NpXXInUGl{adVlzMW#IkjXO zPz*4ypiiEM>YK(?97%-cA#gM4eJU3~T18Q%8!_s?Zu;WMXjhpH$@_ofC z%S7KpS>!nBUFDtT=H%0_KNmS+Ba#PG25xyt(V^hKfc|vBo_1uxGid0Dl__-2JVC#M zOv@o8K+r0uM5)F_|26z%{|2sQILnEU|E5&a^_;n=QGWo67q%B!;r4jrxz197f-BJ5 zOFPfhC@c6hDVZ7nrArgy#8iOL;MWb8b;T3halhXJq$ z*2J{(S@e+T;AdgxAi}lE`(pFuo%7~7qEz9Sd~g*lD!=bFKbUkeDIVcLVdF7DurMrD zbX6kD&Lv#y+>}TdSL$>=C95VK4;|j2;6U*hA(=zGSx+Z?a*0WwE+Z&`g(nJbBnCBv zovkeeTbDb2jn3Zp!%Ei;F?&TLVxC)#BZ679#mB$_!an=$g&O`cw;F!^)s#M?w?yPJ zonK|NRoqpCyoa1O9cyzyZK{@ z^-OB%F_v*RKgmjo9rXvU&D0FFL>pguK+HLwdgc`>c5bYMTgu9kN;~nczFeo+Vq`J0N8XCyWjfU zs%ogk8pXQfzIb2*@ByPOsf6}b_EJkMM$Lm=Bvy?c1msYaPSuW$&7#a6$$Q@6A+8kX z%tnh*LW+CH2GzH4lBImF4n|;2^>!iN&!Hh%b8`_kgZ4Nuu)`pA0J9K62M51(xsd96 z-C%>d0)qo3acn_zGa0B;2MT_4slx5ueQDrw0`OX(Y5J4fflrubfeW?D5a-A5zu4OW z-yG=b);taTTb$8sG#vU1;~!tJ3@YP6l?u)8Z${z=Lf55Gx=Yzm7XnOKbdJz7o?+t}eOyD0?f#@sKQe@CWD~e$HrEvUE zq?*7$Hqq|zS0AW}w+RbAVOeKp^>4C*Q}QNevLOPO{z%k(6{2T}T@9;iqd<(qw^q)( z9gf>_BkrA@FBE)$m#HKAo~==k@pwETfV{We?eF#Q+U=C$@=yw_PRU%{wy;gjk4Akv zedDR;9upTMwooi%^Ii~$ZwooGFf|lgCT48ju<#E^tO!@8{eQv_uiOs4VV)l{d)IcsuguZZ)Dz zx_Uo?X?W<28R^x$B^G79@UuHo8!UDWga6PQ(o+ITq;Y>N^fzPx2~kNh2m+%S%+20I zmTyRgMk0xC=ZbDH8FC;1rX7XmLQ8S6juF25aQUCHRPGgBjNoSeEiv`Ym`c=o9Y+`iFzd1L>usv z`ejJpr-(g5$Mdp@jCYJ-^-(DTGZ*r zBRc>u0THJnE_7fsUg_-@%6Y9RU;v*Zz)F(;ux+^`1(r1CFE>7D0&=GJ^_&0ynXO6d zo-{*7qG^6RKDuIM+RyH2cuaL9_X`gz1@p=AksUxOX6>|i;)PounF%zw_vG6b)L)qUg;w6qj# zU+6WvRHQ)DVaP<0_2|($zU0UB>kS_>kNB4cWZ3z>N7}n*dYKHH&LZg=H3{T0!ngdD z$cRTNx!SP7a||L@LWjAd97j{n?>;Tz-R2wNzfh-bqZmvEPLJs4-#;(L&unx3nrZ$J z;_}g7t5ACPf;8rjafj{epY^V7Y_fl^?C32!ka<2}FfvylZDi-lX=^S(D;f^du3KK$t1!eoSB{cCNXz!u+9-WY#cJO)x)=>+xs=QQUVtd;)|f07WUJ{Q9utyYv|su z5JH5I6D+74alq{JH&FqGShlq>sjE+{45gzHsbKX>PZxAM!^#dYJp3-3@XFcum|#sh z99W9=teva^g600fA$M&wKmG))Vs~*{r`UZlk*L%Wj^MKRQ&^Qp$}$Kd+y9#h0W*Vx z8EWi@B8lt8&0Dv8zH?@2Yb$MH!u%(z`Pq2MEAx>*fO+J9S{UJX+Z9yToLs1--1iVn zNYLOoidk9_X9c5b>IX6}Fg~eZV}^E@I9R`v`}hn83LB-U$HWm<`ue2Le(qotsL-Lc zzAsO^V=>|n7HTiQTrKvdux}V75IZPzmT{=p(66*l>neSX7%5kO~~jQYDSX0ghlBt=`+hw5HugYjD8B9hn}l?5ips_ zg7%X6=ZMc2CXgX$@@a;(!}TE3_+dXoQh23oI^wc|PXFq+5ocjt32Lamru zLiqfCqF_73dCu-X^a`C9)~7JmZz^BzH`@j`qjJHzZ~x6%>dP!B5Lv#5oy?^B}Gl2(E2+GSUG7h ztz{2*2gC(E#@zIvLKE`gFm}I@z$%o;No92I)j83YyTiLX;U>55*h(1XjAaMms+HkW zR;eRrw4JE`FxS zYMr@m=VX%BuRmvU;&@ zbmCI=UPz{GzV7Ctr>3tK3@T1lj{P;zY;kg8AB4$SN_7nZyy^8dj%`CDjAO?!=LaL% zGCe+4!=EpMW=6X9w_s@3zi07qne$=&I6-|QJp`Zb-j`z(xHCdN$A@HYa;_V5uA8nD zY#cD$HQ@kmZqW8}tkAX~WL1QYyTf#} z*&uN+I55ngDx+VCuV+P|y35V0ut-kFoc`5qZ8{Qwl;Np0A$EyzQ77yKS4~d3ybHLR z%Z5wBLg28)=v@2!vO#s5OZ9EHwy`4qqaEhUVQ*s+7$7j1al@}wrT9!Hn;h1vSsqZ& zbY4Z?W)w*~Dc#V3Bj{76UgEj`d?c|Qw!Oi#j$tE?oGu)(tw59y!`Arfb%h0G1Yo{t z@}ePZbl6-N%eE-ZSH%J<3T(R2WN=1_E15k9`6MuSGwz@Ax$C9az_{w?^1IB6R<`Y8C(``vd@VT}--ida^zue=vAJT)O} zdm}2yKDHu+-y4NX7b53!jvYYzdF!M8{vV3+;nu=!_mGOo9r>;;vJji;mluJjKM3Y! zMz>_lyvSbvMg8Q?g_YijHa0hzdG2CMA3>QVCeBYB+imVa|AjU1|AY$(+knbl{cCTU zSM$5xi^PpN|q4vZ&2 zV980rnRe+j3VOW#A>(Pq!Yf}^`XOLN{)g`FG@x|NMc~tC?JU>}ZbTBQ{5&)+VP^#4 zeJMqep);amt)H_@K*Z^=)<=)hH4i}}uGntw*TD(-M(7xp9HYfD1|AeYW?MkOU0l&E zK@!0SDzI7CsOAFVLqVBlSYb-V{Y-7wkOxH)cSapy3te>mgyJX;kNs((D%O|#i3)=p8xW^JR#fEjL62cWrA z#!&XyVI(}u1$gC-kg;g;Md>owlRR0ehzpn<@Enz7wxP6F4|+MLiIZn=gaKs zztMyU#1}6RiC(IP6d@bBmVEaAGtd6om|%)&JUiaP1DCbp|HMz5G)Nz1V!=5o0ZiMs z#fxo~1O}tYEmpUFLaj`o46lvata1ldXwaJ=Tx+MkX$g&Z`CZ{==C%&IgVzFw z-@i3dlq((l65Sm9v_T0$hCf~Yv8a0U*zQ8Gx6MgNl`Q{wNZ+#bi&A1RU_8j52N-=Z z41bg(Te*28VB?$c0|DOZ;6{j+4|pdELu~4s{T6w=kC2hFF$J{yY8JdAf`3+HOV1?g zWEuJi|0>eKT^m$1ElB1iiR?6Yqr}COTp!r4o!LoQd_PN`$?G4BO0SMjAIwo5qbz3t zyOE6r5OAOYq5#nsig|`b(@C&AYHXOe$N=&{?ksi(A@N6l(o+XN;Oj%$ry(BSUsYcu z_C~{*;o_*y-K~1bI<*(r0S1|-t*(yBHG62YP;jg z;@fFr#!`7tpt2zJK1;1>Yegg(9d_PnO~Joe4rO$-w6Yqge)n$e4(%zzpw=_4Z|D7% zs+wA)rMiT*HGQ0)H}ODRc2~8D#qnAnvlw^OQpJ4KJ5i5A2JVT*;8-baVL_)XK#7ytmm7-0s8eAo*EPZ{j^+LDU{2u_IV z!a27i3_A&AD(R$ZyigFjYc>=H*KwYdkFpJH@%!}+lS&hx@>-_TWMn?2>qi6*q<6YM zU`vEVj1EJt8PK}kkIis{*W?5`Qo6NnOWTqQjxMn@lC$BkGk#kzMk(F;b*lH*I3TjY z%i|v}`s5n6ISVRh-?Gt9oI=#ZVHjocyX;i1!lsBUR=U$XE81Q*XM}ix5Tt=H&Q;k;ZV4z-tz;$l)FUr+sXP16m*3gTK6Yq!y0Lsy7puo*tvZb%Rm!X}c9hV|anBWw$ zz6{VFfcwgbm-zEyYKyqng5@^{X?yoqt>hH1|DJ(K3`}pT8ajyb_?^`_z-EHX;*YKv zH`7XIP>0FnHzhEiJ=6C+AtM!ZM~aX+IUNiKYv2T}$K7y@$#XD-H7Rv6F#o0JyvRM+ zG{3hxCw=Zu;LTjhYv+l_~y7d_mqt$KMSLwj68WupRGQv&p1|_wltGo#6%_N%Z%p zjc!Km7XDvD%Kc$BRJ-s^IRU<6wYeUu;|k?9M`}v(R@MLCNO_0s$2V_&Y3L~_;+ZiUVxcIjOG?F;63XU!F|F0JN&$izrUO1W|cmDYsB7}jOafFp{3V&1}$WWC}ibUzo|VPx9*85Xe)<~XxtXpB?0dr3*a#xAp;jHpyCN@yJbwP94?Y%#bQ}1);W&`r z;%^1qW5C`V$Zqim+V6Rd9>B>Ay8~%?BPe~JEO|J9h@AL>3P9<3Qc8vHXy5<F% z>Q<(l*Nuo1zv|Kz8QFBbc^I1=vEfO=7*CthGa^5H=cQ);4qU?aR8{q#%j1fxazVP` zv3eqK01?vt(cytiLXk2@tFZd3HUX6DuZ!8<)->7$r+8CS327qj>RKTKj2E9iP)<|Q z_yVL;ng)IpK3?op3@z9|K`dski~}R^@9z`S>|8zd*;iivj;@=S|3Y!L@zWU>s`Tf? zr?k3@#N6Up1xlQF`a+H4j9||h{K_Gn$D!2yH1X#SifHc`QgTZ8tb|~}D9`Tb=el1^(^)Q~!!X;vvkhn0`&YsmRmHhk!7)yyA9F8+uQfP#A z%yGk?ggy%9a^vZ~ZsikDOq}a6ol0kxoX}5`N=BXJ;^T4__+W5VkOEmE20d8XcYiy|L1B)zUC7Sk2=}{~U_NLet zZ700`^zVS@SWg3xcDGud?0(CrmL2VFL$o;+ zst{PgVHLU?vWb97!qg9*SIeqWbXGFrTDXY#_(>8#t1ViI;K~8E;n8)Qo$(s&&1gt5 z2e_b(_I^k$9&Ir&C8J2LC>tce_nekZw<2GC9UqpenOwxqxGf?Xa%^l18i7k)6!72NPLHt?O`1o$Bkk_>+o!Q@%}u>nA8Op>o|A8zl707N(zBl^7=Jem2E==u5WfNNBk|B;Llw{|kADGFqT z5|g43Ufh&yrlO_~K%B2YUH~CFR}y^bl7?5pm{PtfMR##1;Dk;aKKsRhS~@jmyL51Q!3j{p z_4D8Ckvgt#m%BW09JPjE0M3+E?$wW=&V@d=ZvHcH$C^7R!=|aeulySR1tkHGQ~zc- zcF#*#47|JHD2ymkb?0B7mGeEt{f^QRdb$TDwuhXa^W+Gn%dVj45^^RuH`_{k;=4P2nM*zyQeZO z8Jk9>`)>hc@?e=xZ){$vg5 zvF;MfC9eN~;heo4Lk&y`S+@l^b`)`-ddiz0iN628S^$Q+3@X@}_x_zF}}NC#F=2697ztOK?v1m0lp0@0-;?tl%%rv6RZ zFt64SZwxW(_KpS(Ukg55aBC$#q-af%h*-Rzx(Z90Upg2E$%#yEyaOqjrg2(OhIJAz@kuC=Vt6GVZ7L z<-c|_u51i>cn+==Wy{RSKnuxFQskh6hy9ZS4bU3syw*(#l?b7TGq~Q4ju3D&pUhNq zMJP~v=JXWjX64XBEX+1XEMI0Pr^f@C1x)P-h?sQP7nw`oo6T+CK)S(f z?>JL-wK45%MC=QN8woR|MsMPH9)uye+pU^94_XBAjw1^L;WLM5Ri8*<(hN0G0BtHyVrfDrdO6$G28 zI027mYarHyls~Q~)8P>VCNp;J@lKN&uA1Bb%u;xhCK*Qib1C<-p`s~7+TNbi*(Lh; zc8|gk%o{{xJZtmKxiE%kegX-sNzr)Il!!gEk2xaf);ICv`kUL!u)EOe|L z@h$a6GkB~RJYM9UEGBCL*({8UhcyztJ&^07-_g7#M1Vg6+9$BgxUk6qN^+&Z>s-70 zm;?UL2d^D(}Y@s(Tg^-g9EiM=G8(fdiHvT#6_!PaB*K53v$m zUT_cWqGF|`cJ>@mtG)*WbxykgyQrpkHpd@dWCGfj4lvFh%bIe&4jHhtv6r31t=q(J zf*|Dd{K>vMnKl{eHm~nmag?Ye>5{|}4%O5b0OzsCk^jp^dvhvQR+3OeGi*dSAb^Mj z9<3{Y@L+sZ(fjyt1nA;;Qh~U-I@>Q_&3f!z6oHUjhI;y{8_ssN4o|rl?d#VMFs2#k z;jVrC_h-(KVEP=JG6R_&MsQgNZ2?Jz>M~eQyD@`UB+oa-@aJGi;(MyVp{_W}9kMe= z2e@)Tn8bdmsLyBk>~js&)C7_zV;f84!Q(^I6$B(_+3@yFY{5C{u zD1~e@?;dvB{I3RVr{c*Ua8W~@aVIA)05*~n*0Mww;oq<#c)0IR z2V+s-U&k}#OoxD9v1jiDbfTVz%~K5Z9mah~_ZO9wdBrVQV3cLnHc4DW zflU9LyNxRbd+crF$9DSYuZ$2F9&14$Sx7GDZ9ou<5`3J&^U+jXYk9@J8PDpS2C$o9zFmxMd3|`mBlBbSiN6 z3%u^tk0j0c5c!4+Cp$Yq<=0FAG9O;BuZLjS=+bGMG}-3CUw^+pQ11`HB?mlU^#KqJ zS{sQE*o`ePRUeS_0nthwk?Hqsk+%?cg+CDT3n!qEnvKc#L~_aunt(0xxL7DQeaPH= zcJu-Q4Y>J3elaBf9VgXveUXc1LbRG8&a%&U3U|MJZPX(3{*14`bdm&h9JT z*Edi$+WwiEy^HLu9YwdU2J-(bp_}q7I8wZlI8X=iBDb387&|A|CL=&@M&@*R;6nm> zLEcO<3O`qP;9Ji9uWTkpmfVZDveg;FtyEZEjz_|~pH`=DVZpw;r&DFrgPD|~E{=$B~HJz-}{dc-40$x>if!pBMQucp2TLR10x{&ClJ!vxj&*(}CI7H$NY~~RX&Gzi zD2J!xUHew$8a+z-Ro=>X>-`nx+iKM_|{#LLZBpI=-|QNSos z{x`3%jYL15q7aEIjS>J-c^X&+ZRKwt7mrz_a-<`SM#sitSEz(p%$dRWpf7h@Iw zUum=cjca?zgwCBiT!kaH;(HNjlRDI3JVod>evdz>&#X%K_{OF&4NNs8rBf~{I=XFN zta;7V1=u% zj{-Vp`&48sp{f@?m#slOHoPDjrGJl^J%w^eR)TBld$!th4`(Gk{fZD0L5qHoXdyoR z06q-{%|t1=ME>?6sCRQB<6O(1ri1EBYAV1O3KyQWgl8Pp_7W9z=64uifI8O`yz1Gy z=(}=>saCuPkpOu$H3Xm|TnpgDN(FjBJ*~V=BT!c*F&tI>=$`25` zvG&iM%#n zp!n$U`^U*aEfwID0Mj~Z75;z4ujzBudX)gWbV|t6!RPVoIfi1@4|6fIVH%_l_biKo zzSKq!`Vo}({WopbsR0ib_ajdaqQ?$T2L>nq{b!pQ3r{=^G(ogt2rGB;xpY7xlQ&1& zKa7d0neo6#@dfb4Kw(#e5OW!~RJaf5FP!k74Jc%CSKzV4PA}?d2Xd z5GV{^F8PP?&khE4InA?r*5E`fUS}}H*0ZA53kO@XKIdcYwMOUKZj=U~oxG?B;7YvI zz7#kX>iOsIrAcOgYo4$n^Ko*jzgRTTW%&S9_IYHZLsm0V59PDy=;{qszQPe>HkiY& zTv~KUqy{0+H9y6t(t-QxErx5RS!xvL6sqhe*}+pi-q2qzK6x^+CNu%zE@kTEdqoV**598p7Jk*u_1I~ z5)f<&2-#mb8ZW%RJ~SJC?;(bceQj5ZcJdW9wBJ3fGQPYbei-SKtBJ*EG9vN3)agLX zNyvE_`#WiAzwJ3>%s&kSiF>k*VwP5$*Ikz4$;D*KK%Jq)@L`PJysZDO@ zWtyD)tdsTY*VsMd!2-c}i@R;^{525&%*O4dl8`sHj^#8Jwz)E}Toqj?C`VU~VWWhrsB48~ zk%Y>ho<@m}D-`K*Gf6Caox9qcOyz2x46+C018|cd8iRBIyaNv!ONFO7&sY18?c(e6 zjJ;Kh5r_76&hx>+YL+~0%QQH>#;?77ko#FZSnN|j;^dJcIv9Enlt+?WSJc0AxRa75 z_oa<_xO*q|RSg7s=rwusJg16_Mq6RL^}b6;tRZ%2KXHhFk7xaO3G``tkWl_!<5Tp| zD(YEgChI)4Qm6gt%+4D)rntZXl$|zyk+}7dv;(9NS-usq@ zN`yNZ`OEewJ_G2$c1F;3=G(s&8$lSi1g>O6!^0DyE^d^EO;Ban|d%4y3Q6m8s)i|T6?r^^}qc!iNSU+zo%PBL6qg}(Bu8E z&xL@bi{q({LgNn?+mCI1L0WeS5h{aZ3k!Ya#4SgEv_rURK*+R$?rY85!Jes`h)~Q zz5Gj-=!Ip8LbWtwp5w7LOCB%#mY6a&V(B-DsxT{r@qEff@`6?e)B$umy{3c@P|%00 zZzWMPv=GgtOT%7|+j=40mW+@IWb1;CGp25{%74l|ntA0@(aUqA@VLX&?3NV*BpcaTy{ zF(TqM9y#p6^WJTDJEVyyhyc|~3BDbOnFE4hDQctr`5WpKHa)cRA}ouMR=$;Huzrdx zJ$8Nm`G|h#?dZfr27b4YY`#gnn&?DEJjLXt4aKj zlI`*e&va@Hnrl>-pPw)}8+tlYh`^+L&>@E>pK4|IaV5KN^1kV>dy9uBlm9@jo-$Pc ztYc^GSz(9v-k6e2Ow?cEG>rcBC6QFT*b7#I#G{-I3jykMBu{C;yRnRCK z{-=SBo3Eh&80EeA$|D6CQHRJ<3&mx56N*PEE2GI$^E>bAsc>^K>1_oTfIqzi;+g*u0Q8nUOjcQ!)!~ zdXF8A?&%Xsv(4$rr~vhK#qV7FddWk`d`v{;Z@=xDFe5Z3KAL*PL@Hgb-WZKCM`(U+ z_?V@NeZ;qME}}~yx}t7pJQKHx?;XJX9G{NDclCw93yE_EImM~_sF9NChElftlQafn z1BvbQGyU_ftwt*Bx)4G?OJ2^;i~A}(Kl5CqUWyin%NfB)Y^KP6*zaEnW@Kwa8W(sE z9`?1Uvc#s!r9lr2oMbnZ)I@%Az_F{bFQqkZDA7X;Pim&BKSEZ7Td-&@tmzkh*Oq`h zH+ISY;Ui9mDoQK{E2sdl&%jcUsFpHkU2Sx8dI8dw*5s6iySqXdszC$+h`f>d>bbMt z!UzQz8ej;03EF;$obTR_ecwYKIRmFNEP{?HnYgmen_NeUU9lf0DfNSiqgcF_q6`qN ztEp*#)r$9@q~O4M5v<-GF0jBOlNE`!Qn$wkyzPUYpX|@sOx3JZ364#cimMvERA=I8 zuwMuVktnWi)?)8}H@qv`Q~w6HFy#7{m|?w~^n(I_W(*C#=P^F`%*V&OH&WtY5E9N! z+Jucnf4|x!iF7yw#AvaE)zy)fsPCF~?36Hy;d|OnSCL=|*TDse9jDM01~gwYfUj@A z-QD__6q6%JHRPgDy4ie>Q4wKrQ{=`t(0IwIHnm+a#_zkeHoG&AE|iKO#0HjA^2?gM z^;3PgaCjpwQ!q_+M`Qtc(5ieFTrtuXQz09^8K$ufJWLZ(u%dr)Z)iLR;@GMT#j14K z{)4HRJggt&WMFqT;q!->f_rD+FqsDme>k=rB;iOn#ADt*ii6vq8fx+W_3fF1f8R;% z(ORSE`;$9^DW}!?fVG|x|E$`JoJef{hrc-Y9d92g?sK1}o`RlkIv$ZP4W_;3wt(L- z@I*j<^_?JtZe&=vd$X4Z{-Z^+d35FQeS9Fj(=@lLpidAI`&j0 zx_#v8UCC4s9eVV1i}2)$l-k*H=R&4n$REcI3sI9Q%f`*Gmt9_?RmXbm_?MaqSwPq7 z>#`Z07Cbz780bwPgi&plWGFqu5uohx{uP=>1kJE__C#%0OOG0(b`jvO7~`*ir^u0u z+WMSSg!v+Wfix`q1?PI)(CwKgT~1eL7`3H!S#Pt81;|ou0hU#B$ESnr1>b70t4r`~ zry&njm=5hXO#0Iugg&`TAubMWVfiZ}6BsU*qvNB3+bDcow6AG((4|meqtAhyY4HoI z0knvZMx5y?X__L1e*2~pXBE1zq| z^{vZ?9yjxeLP?W5N4d%UT+uK|`Ag5OQ+mGyK3sS6ecE6&cE(SAk`Gb%3YIPGdPub5%ch1 zOjoZ_0+$^~NLK`?RxXRhP=&8DHa5uXCD5#<_50(VO6=%YiSt6nVc;*S9cdS;V0S7A zcMRS!ucKFxHL%N^y^K_#E+b$@M|!XJSHB~tTyDm}UtCs}4^%dKa_>Yoi2Gf=H7`7Z*Wd-#^2%qAeiZFm~pC1r0~K!1g2uw}aw|ESJq3Xe(%jSBr4-|5>E z@WZSXjs!^b$5QtiR||YRDn(uS<$1@e-SuBM_^LR@e_5tMj*X0?f1BnN^2<_#**PA+ zFv}?&b<1dXIFGH|a{I)vnrCUC0dIOoVID#t4F*s*bP`m`%O#tU^^9gq#q;%tFB9R) zZ?&wXJEP>O_6wxB(QCIoWDLNkPARG9i2Qd6XL+>9|6>6yOhr_SS}(<(vOTfv<^s%pN^Gx;0>=gbh;kwChU)BVX- zB}CfSke?42AdwfpqXIVE{)6aCfC_*s`z)Ene+wj?s`D%&l=B>EpyCeUetEGpqvNCvA*K@<+3^J`+ zb7WvcK^_;bw2AKmz&#?6cO_96qZFP(jg7-;RFY>&ch206ly{LIRq0oJ0x~MM4XgM!{hR zo6G(oJbPS}Ug5lHQaOLXP90ZOO*aT6N}CK^KIivbriD4xfImup-{}dBZ-+f#$;>-z z>(@KuM_`aB{PG1Cp51V%-30udz{G(M@bQc=L#(8v$)=Qy|)Dkz_wHyf}61_7!| z{w+`~7NpoBLNF!4PK68}K~=pE$O25_5Eqx*o1CMi1La!0KZc^gWk}*0A!7GSl;49= z|K(5FD=p&hoGxS^or^gHsA2w_lFyK_?;b6+UFRCnt=N^oEI@3hQ0e zehB^m6n6Mw9JzYZWWl#q%=8^Z#^054{u)Jp2XY`Q+NefiI}Ab%uIIXaw$NjB5WoWF zdn~p8D+Xwbl1A$ntyHV~$SHLn6itlRzgk8shkEq3&y>>7EL)B(V&Cd z_I5qyKgcV3H8Svb4^jvUdVo%(>E+ia-v>tsq7K2=hp6>~nlO<uec3z=lxxW+e(_ zO)3?Zq=rTlj9H;{4JusM%!i9uAkb4_mFwXQP0d;*^$pY@CADAhRfb0ssPg<=nYtBI zlX+TD%=eairL?f6(tleVDiN!n(3KJxsPi!Ii}Zf(Rhpk4wiJWuFNpSp7(qQYB8B_@ zbkx6pZ=f`ALbW!6-giGbp<$h27~8wn{W-!TfoRC~f{)4nZaP$83bHHI03PPQhTrb` z@}@AxtKfE~PK&ZPJ})bSD}fQAl`ScCf)Xfy$&p`O320ij)C2M`$HR#R#fU$f4Frf2 zffQxM(=KEHDtd@0Kl&XGV|CTATpkK%WHlV!m|Wi!i*~+NC@Nuz1mp#9G2-xldY}OP z_r5zaFm{5p%Ow>OB(p3S1l*v3fac&aLkV@xZwwW~#Q1rhP^#zz#hQW0N>dGYEE_8e)#zIy0vjjh#ncHbIK+{OMrTc1w z7zn#1(%?pve22#$vKgZ-P~L59j+D@L8+j~;T!{|k2!~hu-N9uEJYW*<`B50oEQnR^d~j zLg~qf$OAd-b60vSoKDy0t{)oT5)qRso9CvcXwYp@i1-quvNPlA#LTxyOs`i5qF@AJ zVo?9IT)}Ydl)R!1b^J6Lxa!Th%9SrBTR0%(u~Ci3Z>Iqq#JaywQ)ghE2tXsC{{omyLF*T!Y&*S@ZzYm$W)EZoV6G;R(3%sBz^i;9kyUPs zrYT;8wN8a?@3}1Yl>YPdmm9MC-xF{{sfx$f1;e*E~Zd|8^J{rVIScr4!KSuzAC;cYDikPx!_$44wnTr8K1R+>G~3c`jW zdKy*f{5p@_yRM-+c-{7-Q06DoHE-*~7@+?{R=Qw)ud^6ffdv*sK_i->@->9R58R41 zuTeMsK1SUSe@$H5NHpR6x?WAH^n0W_AfApXQXycrX`hT$u-r8Iw-Xp3$lp+De;y$` zYR3lIErf|?iOKtmL=^@daLEd>9!n1h&fHP$i~e=>?#3{IDL7JToz$ZmxEleyw6;HU zl~|w|ryx&t4|~XR-%gDILoJmEk_Gy4{BEutx~#F%d7-}+Z4a07tts+L4qo>@%qTb! z3D^bHqPI=GJ_0K@g}HF@5sGgN;-Z{>4J{eBzwXyfiE+QBUrI^W!+-r_Q<W#wUv-=%$q6PMAUCbmKA+FiYwm6PA ztVX^%-%KGs+R~Sc+eV)jdOC+A0D^N|gZnr~BvqahlA6r1zUd^ggl40X&}A+fkNK8J z^dF;fvmG=#HJ!jIU+xvx!d9zWhXF;gDWT0iPLm~$y-e@a3;%6Wobxx`M6S{ttAxk$ zkyvax&_5#8`{%ZnudkQ$f8ZEm5E1`fZZrt!Y<8(!ov!Y&v?~pw{LuwP!hyVjwHiWq z`&@t#*7v=gk%fdlX4`A2Yn^3Gczdx8k@myiOM2E(u3R=0 zYnkNW8B;>Huh*uX#jF)9Iwf>& zHfgcBGDldHZCqeRvgzw{RjU}HjUMc^Q=d1mbKW(r$fHMBwRKoF|5Et~poH9)ek+Mj zgfvtUCdHxn+5(SltM=ZDrbp~9%+f?`l# z{KkN$&rx83j3P;@eOE81^@$d|A_`#_@*bHp-7?<)mDa%jue9ngrMEF>WZ$)Or<59W zda8t0^$DK|KJoB=6+L306Ir(=in&Hi^M!B!eqLxti*6$(Hc9z;2vR}5YIu%vU7Xy_ zm+bE;fI>z<_r0+sRoa^Y1By*bRY(FhH*H^ z%39FGQ3N2SR^9`;(VOD#QaF4wMF;9hvU}dh{@G*Z!HX<_ki5PK;T01sn0YVNrVj%I{WN0~2u2jB8>lJ8lIQm)yyK z`ygVAds`CAOJP>3`PrZnT8VYZ!UCc0VL8a%^KsEIB|A-juA*^=d-2W#iVoH@?kMaE z^1M8cA$`cy?#rr`XBinbVzu^C2<#HA6dezbT;RHi`-2NB|_i`KqS{9N`Xe{YP6hBdd2Dou7a1DKG0 zK<^k3*tsW3mp*P`$W0A|th_{B0Tbbx#geSDxVE#7krhu|jsTWw(xz$K|58Dl|2N%m z7?}3gLhCliKC?$#>=H&rxpJ$`y~4M8r6r6Oa4KM6SxhzTP-K)A8jZubz3EgM+U@bd z|6c2008A$T@&c(E6DRk~rMNRCt{eWwf49Tm4VPp*{BR4;N0b!c!h=3LY&0FL;9$VO zT2PkTm&}W*uaQyb;RtUdhBKC`6MWsw8@NZt%>oDaFEB97h`?S(DnCwKMpJ@+Pjw(S@>0a?bbHnN@S7U{nWImB8FvIoBUq(1WxWv_Vd{=Yl_f{!~g) zj#HpM_kJEn=7ZPq^!QE}!aUO-aPNf35SQCCnx~J`je{vP5V$21S~YOcRr=mx?aY&6 zLlDIXWY4F`M5lf0vNA;x4U8FX`g5q!@V+HMVuaKb!iRY$?(zVUF3W2YX$lsGIGa!W zO9AWe*`K~pW>w(WEqV#PuCLxe<~b|0e{TN`1Cg@L;i{o^Zl?&x&n)PYTF!f z9h}$hxld&=-7Pg3A>yd!e4$3gHOkrasP;?qY=x!mh#73d!2$Z@w64N$fJ=&EMz$WX zq>3K%oZA9JvJ%yhGgX$b2b{%-US~Bxk$#qXz;2{t@RlUfUFrWU4sH0C_y5v7U0{*R zFyrI)pHT))+pVRxrWf1;uO`NtW@YjL7QCW&jW^mdY}@D)9T~#P*g2^1D{)L;BRCs( z)KZ1ExSt>_oQ(C=LG+W&C3BlESyEb-$SPrC0K;!ZLB^Gay-`a;BQ(@sPHklfwFYAG zJO~WsF&8#^&xVVzZM){;dERG<3NH^)vhhk-tMSe>}^k@I3dDrObO8s_vw`kRbnUStj^3$~=E+?*nGU0%t zrh;C0(vHd7FjC?|FKD9p+dAeAyMENTn{u7aN47?bHNwCB`y+(V7fPL}kuPbaj1X7+M_!#?SxS_3 zpz5(;U=QMz71-<2iluTNeo#55EAy^%5HUJ8jl=&HP2i*xPu8*C#n*q1qTWZe+x`Yj zwRrXYmy_;#oUCZ$C+mTaE`n0?@9|ey=o2=7%{o}4g3S5HHA6eOEj$gE!s&_Gh|K;5 zKgw1%?ShcR1zJALMlic)-kd?FKOaQlcj-%>j&>X^tsTz1QEeUC?tR7nrcO-4SuO z#rtVX`PGKd0K>s*I?LqhvXqxax}U6-Y#JZtFT041R?z33o_|_+ck3Ic+_;`6<1uY4 zLJ(boyQsC2#;DqM`DX_H*LARj_OYzjZY~WBc^t=${8ngGGYk3o$oqc zmps$&naoV@uirA{GwsT9!#JP5){k2XIlWRCbb?-G{=OGkLsFX^e|X4WTDEXWbHb7u zi$9u7EbeM>A)`TZe_=@JmoI%Ckb^tD2Tm@_Up=9cngh1wU@V1B; zrA*g)E`qpOyv!|u~NsXHYW1Gtr?^sC*t@hU20Fx!~mhr^4mPXf2d<;C_ zPM|f{LL(lmXR&~iPUbMuekHE&v7?uPY}qq=>mTFSp#dqQew+I$8vAZ?i7r^EQ9}yN z0NE0ZEuyV?xXJ)pG)&Mb3gY9v@i+6hSWR++sVTQ{SA7gpkKi|VqBcd+-& zzRkRer&B@q)ar2FpN1=d^uQ3sSF3K__1`_UZJe!zsmajc4BQ*;d${!amD!O( zrX9d2c$DpG!P^ZF{22b6Os6%SX-irQQUAF($}(^=02Znb1aW7FpQFmE=@J!9ho zaUCdUIN$L^jBJ@BZ4d#G-De)4u|ZvGv8TG&dvuX+o#?i&)gcB?$aA=NnSt=Fsrl+J zh#8FP3P8!EHZ}(&YpBYH^9q6R9vuDchyfZ8u+6IzczoIbkCHw^a=`!g`I5iArF)Fz zH4?4=K|+1E7qlO)bWhLJ|BygE_1|mSG4F-Bc{WhGK-3K28?NMvsY<lyN=v~H&RX(LKxCgPS7y2)lVFCkMe zVV5-nAbIz#gb7xll|B&7SfHxp&iu|D<`Fa|O?v z8{r|}C{k+`eW7I!ZAma_2C)e}s`(;h62+^kYhVDTTa&&Uuaatj20XJx_->4IQ|wA6 zuSo;}t+&nEhih<^aVs9XC}R)UQcvC?fQJUAFD`H_;2|NN7k)X)-FZxxI8YUoeTMCF(4H; z^rIG9Xkf%vc17@7*KmxZXbtcr(#`{d@-Zm+KKh%qCAxc1A4=_CwZMLHg<6!F$~cf> z)SM9#pzsGrn){*aCxTzzXf(M?7`hKlVv0kUYhr9B6`*942MP1#h=$qt2Ikb1Lf5!7L|6CRKJ=+}ym+MX;(rXZN7|z8oya;Abns;P;iw zoh~|?*T#1yrtJ3gm*X8z@!&JMi-YQG;CP*C!-haYAg`lSwo~SVji^-+NL!non$i?} z&W}g>4tf8e&(&b}3`eX!80Y$>8sZ4pT790K$b% z-!<*_NH`~G=;slr@S&$K!aS%uv-Ox5rVz*Z`c6LkI!tR5i8TAhk0NnkokTNXON(b> z4%A^sE2iPD*v=liQ=$HrMc;FDFuMmB^8X7pHyXJIujdJom2pix)6Mm$6){>XrX}EQ ztwaR!Mf?%NTCq}gd;kMWSlvfiE*$Y$+R~zu((K!K&2;4RB;uiO zdYr?qCVE_PTe!II`;&c%t2-mJ(3J{X{<5)+%9rE9q+jiVQ?dK$Ii2e181R$A=Y=ua zs=n_3rT|t6^MN{Hw}$11q@$K65NK5I_|bEAICLdZQ%G5qqo2Q({bYE91=4J&Xe*vO z%NI6KrYAk<$ZNhA3DwzmG41o?2Kn2o9y|$#WYHDxB8r?UCg*BwPSI-cK`wu21*a1` z`sOMES!?6g{q3NrzLXSo!6a^7$y;e$m@g=H_v)9KX6cf4`3m#Axwh?8iGzyKs6?|u0v}_%&E{~};E`xNud!sri)RC`c6gHA^mf~Xu;+EVL z2GZ#{QNzW3NeRCd5y%1$13(?^&&>B4~PL`1=d#RtfM({ zH7X!BbRe?m0?okaQ^|{B*RE-Y+J|y@Rt0&BLaqgw3JdPo8pcY>egqIsAlnFl$RvA) zKUfcfNwGH?0 zqfS8Ms-3C$yM(YFs4Ek0x%~qI4HkqG{Ay`eB12e2Fl{FVNWrcw_0AbcOm8NtCnK;C z#Gca)4qDzg>QY-17i}NE8`!!RW`q;lTL~pW%V-ef0QhoNrnMOH`Gw7dO?AZt>AmQFF*31~TIhPtOIZRcjs%%2t{k;U8ls4QZ@B zi+^+98|3;CzHIyn2~i~CUlhd!8mSDDyPs)}SkE<}gOA$6L+WmLT4C?S!`l}X&i1rv z7=nF8wDNuLlQQ%6yDca0T$~o7!20LI0jN&W-);9#ZxO}6g1~}^WP5qL*?nF{_yVKO z)7IYS?X?rRt3N0%*nAs?CdC-sl`V0wkBf(*-MG)GJa~j>NQsd)nwMZNj#^>^K}1KS z)b_XO<;!|=oM#4Pod7nusvs6i(x32us&y3MDJ#lLU@r9;-Kn&(Gc~=IV4;e^Dl2P} z=|9u6s&|`MZW6=2IU_tPW7LWeZq@HTJI60$yZhc=@({(Jj~AX&3=wlvWyve9PfAZf z&6&ZlS?k_9bo*=gi8<lvX{4s$&4 z+WF&RPw!%DmwS1=PKj9T=^4Hy{_sQ^wjgRaIY3XH4KAms+woURAqzzudn7W7pylD= zW&ms`-@RcX=0Ra#5k9G6HZJ@>08uM}?Ha2nvt%X<1 z3oq~>9#UF}WBKVZ^Ri04yabdI@Vk#FscuaK-e9lt?(1dN6(PHl?T?3a40PRZ_DKy6 zwdbocB0eNE*`4F7pE{=Rk5@313R&u#KK;&HvKo_;Tvye~NVlQHwuv>E&7^d~6eok5 z${;iwajO>)7NRtPc$J=W=7^VA)L#eO&MJR0b|e7n6}oWpS6X9g6prV$pf~+=YpS@m ziaM8{V3T66o?CN%d!82|kr_F+)-NJ;uNN?Rw80v1CjHBxk^OUa1(hy}hg^uj0X;jM zD+97XqWZfLp0I!VnrgT!Uy5;2S>@SIBN$V_P(~0L=in&LSU0ec;zT4NElnt18o7ZF z-6?X7QVxtY+F2E|{~hSQvyAaK%*Y!%x@OFp$@J`aT>s#E;PXz)baQC(@cJpHmudI0 z+fCw*8yI6wy1gz{Q3_R2U6gjR_|1O!0ltn~R=&n09iK3D#s@f*J*q{*0dauv=xT-m zUmV?tS)Nmu!?!>qR7ZSdh>9cGaf&74=m=FX!T>VhrUD5N2!X5zn^^Gs`idQUcA)f7 zu-zGjKK6QOXyJYI3R=RV>Ds19_hK(EZ)gZXK-9S|?q8x&{Bz*d=%f3Pn_ZfF_iAlJ z5ql-~1=jZ~SPo}_V&89qql-sf9Ly4u| z$6Zl4^GrHql|g!^R}8f>=hJTD0=W4R#I7#R(G9mnHXiPyqdc}lpLrhI$Z#g}uEa`XEBd~;Tsub- zo|KWCc?XqqO)s`yy3yA&fV8b%_1d5g250zJKrnclwCH;J8M39g2iCPG@Ht7@5q$d-p8` z@IVFgUI8LO53IE_qHnVIo8P)P&e6zEam26L1xvtb;tzKbe%*5ls>?du%%OgZvqb^NbaHF zyF5}-R)#JY_(uw8Rb?mUBZ_er}@*We5{B9MbjHZvKT4z#GTwUK` z#yZRXrhS-QJE*}sNNYPL+g%idxH*R%4LLOjdK?97T*L8xZz}~^vQsh!ORm;}(gST{ObX&`Z$R z2{uk?*D~#`euQ?m`1F>=le;O6-s0nR2BQxC8CeRO7>mA%QTm zmK4g6;$U$Msj_`mEte7qoBSvEe<8Q{U8C1^9c>eRD`1}ptfi$xq2NX`kjhj2q|Khj zn+B3NnCGqAR)$VTrWUKCO!vM&5;#`=9S{aywO`lLt)DhBUP#Rg3evY~4TN_z$$uf$EFRjcsCykDehh60n`?A%@&n80n zXRj~>B~gLA>m>?KI+O{~NV(0zD3CO?`lI|F0B73PP_9zmla7R{p55`nNAAK(|LoWDqSOYcsc==oa;*OoUTIi&64^VOXK!1rjC>Znj?C#RDXIAL0 zwiIC{_SXbn3*)XFX;hb=G>y3Fyr;4F9yIabIh~Fvv$=E8=>44Ehk-gIiW+AD92)YO zO7BuJOh`$tVge)#ID5KppaFtcb#;l$uANOuWguBei5-oU(XfCAS!25SG~6Jt{gO#4 zafYj@tAXN!p(d3c>>&=2j{J>XDBkb2e?fL@))uprZsAB z)a7q%unQF@KvyA-m$3^0pm6HS`3VRDOO}1%ebTyG@}E}pmh)z-6!zWIawFsDwQxE zOu=uebdW5(RcNTZ>u*A0Vd%#v(?A@U&w{ugB@S-_E@kc8ZB$-+f2*Bt8AX=37xhOU zDWh-W@>pHZah13?_bT>?qTtWw=anwzPX<#XKeA<>$Uyk(M0Spb-^;#N2@_mU1BjoP z!~l!#li_u6|G0ERI8Nu@97fO|rttP3Y6sY~y~s}DT~GCt%-p!TFV5mFQmN zqD)kjF^Y|I-~u`V7S)t6-7yYi8n^_Hh8YBwElkr{)J>8}vw_wLxZg+Jp|QkL~A`i_FWy3nto zda2lv-7wV{)ii}Kq|r%wVfFN=1fKjjLgjuy7EN7y^|nP+eE*A6;Q6F75J{Io5b*w6 z(EgYa1XQTH{M*pB3;*B)#}39B6D|+EWPDoGj7OrYBFJ0x<~7lF>ybo*Y#U=MTL@7}NiBz|`2kHrt`)V*ty(vbR^mt-2SRnDYe zU{Q;6l5DLD$_gA50U5%OlAtX*8d83RSRlHu0^1SS3qQDWr$oN|*4G9S*N?Kd@y`8F zwZ&;p?Tv>EzlzcPA#>V`IOsL+Te3=vePh#HjvZ#nF6TT~R5A!eP@U zb&oVD>&r;2oEG+L;xB{rLBUkkh`cP9L5x=QLhrp-r}ayOue(C)zWkIhD|Fp!E9A;& z;%V>L5am1bi4l|l-Gh4h&hNFqy`orRi=n@zBinz|^7?MsXXypkIlCWHl05eM@IIi( zdzY*W0lcbx0#ur6;0%U({e$mukf*48mkcrv;P7HZSt;m}qnNqT44*^qwh*EwiPZ!g zS>bOaI99lIfgA)m|5}we76DfGn{z(+gPB#zX7{f>5W4~sHBm_80K?p4kfIRB^^ML+ zg~Df-;fqg3=(_h#6K&Qy3VJ8+-(XU);e76hnhT8*6pn2A$F_b&`96%3*2^OzJ?AA(*8?40>G+Oo-&YL8#k)Tk39aW#?4$8ZzHfd1JnW}cX z>!=&nMPEg2S*=*4APZgkZX+rOBmm;<_Xg$VV_jGgp?9#Smx557+*%6!}lS>qYZ zsDNsooTu8xi~wq_tYLR3kMQczTWk3gve|{l`Av8HZaglwJkk?<`~CE%;#E{5?8c8L zA1?emy-(w+yyK`Nf3K}RQ=VZ0HgQUh;a^US$RkE`9jS!w^mJEduYTl9>u{%x!mT_uJ5%9Tf=^79e z>^_?e>^`k~u)@!`>O9U3_wcloqP%j*< z@nT4j7#J(6`JqD{cIAz~lzA`(+*Fb>d4UTFSY?cE)v#*!u_aq}LlXG#UC#ah)$eDt zYT<`VXs+oq6qaJW3SIO|ZFWh}M6@1o4z`Gv z5ZyXzs83SyzLAj6pnSQ--d#7jIQ>CJ?d&8}mGVs@`df_i6VG#W`s;zp%^p`e;+l=a zbnqde<$W zOzODX`76U1tssn$?>`8vZ}bYq@uduG(ddVz^-ByN&>lW%;*qncYcFlsA%tHQ(0@@K-9`QKqNaFa`G>%)20S3R5utJNFuxfSrQkM|QvNZ@;$LRBAzZ z?9Q4QAROfY*P1^RQc#yT+B@MozWhP-zt^7Q-wY>0u|P%QVKp^Xh@QA1_RGmR_vKDC zl*kM0?4Vu&BERKy)yB~_eL^E- zI6G;GiScjGoSr>|0A(;$-#r|&`t{fO&@17N144hgn}jr`ae9lx>&<(S7<)nE+wmx> zq*!EQ^XyN1?m=fOy78pEsoAN>j}29r9ijP5=l-(aTX?a#3a`LW2hJg$=%paHbb$gq zb8ntqPq1>*d$sSA-)GEmE(qpK$tjshP$Pk_oo~MPSNkjtzxb!q31DQ6I)LS`9me(6 z@!m%;!73>--72#3^`0#;GR?@-lfH-yk%^<`SdN%pgPCMeR=1L5T~I#QWAmd?06(Nt z7_kbJlN(*U@7G!C%okV^Q8ihKiyh*(W1JDGLv9OLrGMg)z!qtA6%d>aQ2V!=!L-x) zF9zeAe9Og%pC*BC=aFX=vT^AG7oO_JL{|)SG(fiXk1tx5kllC#9M~}3zzJRgtDY$0 z0rs-(3?AzDezUWfAH38;d1J{C?mmquv;mrcQx=+4SwPlDZM+0zI7CzH}!I?sJZA-mjJ`HcO!gH zJaATL$LC65ay;5eJ)Rl&scVmJaQ$^3CXrW`TI^{{TXaVj57QZ^s}^N>9ta2WUwOgv zGbQI)D`gzJ=cxioH;%o&p6`pGAsl_sMXLn6&fcXCs8Wv<;Hc^!%$zHCpWw0zhAj2c zqqv4kud?$N(P`FDa1I` z!~FC~!`6PC86e)v0`iF}U8*cI9e*$Y`ay^1b7S%NlCBzpH#W^4`{h8MI^@oC3cS!_OI6q51LLuPotI8NRNr!?NR0NVNZ*{+)*j9j^%$^FDbfwol2W%rk zjle%Jr#vy`y#SjbA?F&#>$hA62l}Jg<-tN-tL2s+V^nqe--VLw3#gtPX)}tVM66tC z3zm;~;!mt#1cY|Bth68^_d^tBhj0GV;(9FBo+v-Ff{``(U{`8*e%IdZo`xwgPDFiv z=I0mW^t{H`X*e7**?Mf^!M$=ycEnsy1|H?-zi^3G9a}bk%6(?RIPX> z(9Tk@X%0y&iSrVzVsn*b52~ajfZ&7_=jdqOF#PuL-?9nxF&cnj8$W8HCM~BJ}#rGMxba7fNg>z`7!7OPYzm`VikpX#5q(+(n^{F zB~X&T!k|MLK+f^FxSYu;(z$}7O2%x7R`homx_JjtPJsQ8Nmw;X5r0tzS%9qJWq}Xa zI=l=4XHF0P;bUe0QccO2rTqmgTKoO{ui08ue)bK!1ateEf9KjK5;iCE`XVgB1OjD(!%FQB+ z+WxPp8|-CXj)`!$i00740G)e#e_kIgcIoE3wQp}%FMNjo-rfo5dH(j!x6Rqt-wFao z+U|T?Oz8}LP(zKzF&C;PMpdK6L9KyxCBA25hKjaENGzK--SeYFLa8o;ofDfT;R2b| z$D@m}5|Ya}Y(nFlt=g02@-h=LZb$n=t>?ifev5j&DrFi!W!d}fI-mXsdG1otBAJq( z9hu%+8QRXMuZ;c8mg4D)V*hcAYJUXnSpl4d3)P92Dqgm`h;%&x=R9f~8FYP;wdZF6 zf!G4tD$e}=Erna2f`m@aMJtQi|8;4Ypn7A^XlA)-h4UQxl~LR9t~5nQX5 z;izaL7Us0~LLnC(XD5R$F~x$F#F>NBC6)E0cOKIiaHYG8=j$BpTaOiAH*U7ZtE9k_ zlxjhKzW!Ym|b z9imPPQwzB~U%sTkk!Evx8l7xZD(_?`lNhucY2fUC%540E&VPs(ch0_mm?67d_?5!j z>_+2zRjrn;aResAqShIr*3P90O2eFkYDDt70!vt^zr+6!50NmM=J*9WonV%V{8pF?`WR1wwnC-{rv}0 zJIY7(KJ6Eqakx|PT&n%YlS)(;BCZ@+6EkEI>##6f`!W{Mq!u)+nnapx@{;zzhm@q- zrdO?lc*^N!uxo5O-=F+%HCl6cjKDb_J{Kczn2k=B({!r|Jo$_ed{p74%i1y)AJ0Ma zP@Sf1Yy9YDNv@(3Eau-bG`yFW=$|@NkoLWECjS>ko+#WE<+!PC*Vjd_OYl6u@hj`- zaOUP3z<@!RPe~j{@oEQWB{})d&2?fzT--=KlcW+=In?)zkJmB#ibT6DwqAi}FXGUy z=;wEJeK=sEadCjLFk)aeOu?-;kv=-=fj&nXD?1+%{x!u{*KM}j)36CGgum|ii2YL0 zHzUILX5f>&f&2M#NMJdw1h=;wYV~k;bgs!Mh?OU$TR$zF#8vp6VZxckUlJ6`l6xo@ zI4pus-tF6aV!ovZUa&p!9XatAUcayG`)lbCiHuvOc$c#C|r~-^4t=rRb#lJLZP?aoTe|VM(3%H7Tw(wN#JV>tSw3=>uvJ z4(7xdgd8O}KHCVZrS?^j1X6({kipCJiP8RUQ@{l5(Y8JZ7BqR*cWY^j| zVfgnl2?jPDUZNe4td77SYmbwgdk@!|@Cp50@t~92Fbj($ND^;fjL?uW>E-nHayhu- zKH8ly#s1bn%tgof2@7}YbJs@wu9m+Ni8Kx5$^R7D_L^|HWozMkHT1lE*C`by@9U@6 zw#3!U-NNSTXBfUG+`WYE(|gJgV%^Nd%2QPY$1 zd(CTM!mE#DdWbZROX9CXDXL-jMfjz=oG|4PYh5yNR^rTe12{s=XS&i1GBJHUr?uDt zRMAM)ofzNz7v3!b)|tfXq#H4Fv*0}5<(}c~$C;yKL8$&|OP}Ojs33iY9oSMX zSvi3fW}~1_E>^h|+w7TT{il5u1zSPLAcJm4zFXIM2-ep{k zAW9m>X3n2eEJfPN>yk-f-9jMADZ20VGUf@Nw)xdNTWFIvAY}#UXt~0at=pIMoLnCW%sw#yt|0AdD5@nGGY4Q_nd+J zdb^q59I8_H*3vd)hi{EgyGnU~h)*xw)E&wBUA*<%H&y|e%gqj_WNdDM9*OoFjV_%U zo~x27TS-~1#PXJ3YVnyK=ZBXZ``0TuWYpt6kX%hce17p6hh+5iU2MuX3GD(IC8;NS zK7;5>zn&9r)F~`Wu=SQJa-^*uZbi%b(UOp$V)hjxmaaNFnCV8k-TE32I+h%`c3>$8c409eq}u6_+_8>#p#Oiu=DX zwn**si9fnfw~)I|jJ~^Ht1zp%;!2HKB7yuiVBo;AB=a!2WzOk9nT% z7;ipB(Da$BGUCB@YfH+c9@koM&!@LFh1ghF0pqj<9rq|+vh8h5?x(+-0mu&{gqS2P zLCWuEQAeH@jr71Vw;8@c>oQfA&u_~~yfB->irlW>FI;ZznFteOJ|C*6kEgD?Nb@w5 zZEh>tGw@hcr@Jg&EV%zWJd63NY=L8zPw-H?>{hZjLC$^8CKtj7Ndew+CRqfPgNNgK zP4^ZezQ40IekM;*_4XxR?HCt~0>ZQt!)TS!zL`T1lXxpiVNPzP+HTw_IqNQ>BF0v9 z@_M)3-o56{S$@Qvs7*_=t0luqpl}k>)9S7_cw^>v@OetXA4cpKK7XKP{#I-L?XFks=OOpnTQ%yj8$)#7~-?@zE*o|zElzJ z;4iCs%OuK$#Dq!eT`#Mvy1Qvyf5$No?Tu z-#~?pnmGE;#gq2Va5j1I7VFC#TL+jrMoIQEo&U3HE~WPi!K<$w8SkirLC$J&XWAnx zIb8%-X^_!|YDeMSw?CSzA#X>rB{6U;YsKOa@nCf<8J80jcd`P_e7fp9tQS$wyr*ez zx4!cEjT|vq+E=rWp1i@QTm1Zgka&<@wEyOqGnH~bKjEt|cr`9uplXtHdAe#L9HPLg z_bSAMChskx`Qroa(o);*r#CuRcbJ5Q(NMn`W)Cv+@?s@14t#;J2#a>4)74AiU6!Go zxQ>pF-D`}&UE4Rd6^MNyxF>OFmGX9|57aI%eOX^?M)fJSdRnZ@-xeYlv(<4<9FDF$u`xA!|Mbz=D@E=lc6Uq z_*fBR0X78a(F=)@c+;TszPaqDM&mY9gD3aLiwyksF*U~kB9TH}UW);49Y)vzI=U9@ zYD)vPqt5ldr&~urYr2N?Re}rrCS+6{6}WO2fp`!MZ{7OXRYjEe@fL(U7PXak&bZGH zB2uR?s`Ow&vl#wH}}qjhVI zjJtQSJct|~=0a$2s2bWA2=E+#$XH@Zdq1`?iB9Ws^VU0cUh^ibmxgU|%ggLQ2W8bz z5pi8?jmE??w7fW5J6=0+0X+c2{i)VyqkDHFpFY*8G(F&-s#=Ju`p5vcg~P|dNJwq1 zf6bS{h;js{J2K|-;g%F3gg(1Lv2JUzo8;mKhKBGkZ|a&vWPeuzbt6Sr*KPNmK}IHD zkyN)O|CrxVxu53C27iK5fQSOr?JC2}y`b)JPD z#i`sh^$^SbNqg`!&Dm;Z+;DB|mj=kW6AWcPpZc;^Kvn=3I813{pBSGsh^Yce%|K{^toU(M0Jf~i6r{1YnV?r}7 z+$|daUVJoEw#P4RBKrr_;~%9Mnc!VGXBQGWmk85JuA%bH$`f;2(<5M=oU{NpC6qr>P>*-vs_r?(zsJW%73^3!HlSd`@LID zjJbFX!NYSO;vyYbBUE>^Q}CCQG3Z``LA$MfH@vqbP^UZX4x0MZH!#bJ!C>d+(ft<#ZxSHB zQx6=UvK^QrXa+;o@wM#8z11mt2hEB$?vOPjcd` zd04RaetTIXxXfoPkLQLtUAI*YJp~McOa&8v?9ofj8a&e6JRtk;=Jekx93?Ys5MmM) zp+ygQC}sLg@4ZzBe#7M9kTjR%l-~G)BrZXlZ6YuU1Z84hq_pqR1YC(kLdgcxnY_)< zfBT@WAb~%R@3tgbF1)3;VCD_Cng?4N+C&DKq+MZ5c#pWdx0gvUzpf{0VS^C`mgFnK ztdQioc@V&WdoWgH4W}Y`sUJeSpfwZ@ZFn)~(pk5Y(`i$?dL~h<6HN zK@2QyA57OnLx0L?FJrGG;7Ev~V@C}BCitM>H;;H}^yiZ17{uFrsiW&)OiiFm?!Goa z3uo4MUl6yLbGhy4&}Msam6Mk@5<=cWOA>4-s?3O4=Lqw51}Pr~l{`~&cm_TJGycz(1(F_fj9)9* zr~|75&-SJ;{TWf4KpMftsWdsWY|qYo_N(O-IcbyyKHt&q5>HU~%0rl|_F(=vj13{f z@`C(2{Dm>`G10TO-Q#83%WzOuc4FQQ^U-7w6B1g4H+z#VEOy&B1q2rR9tpL45`DgROjmV(iR!@=^}FqO#}IgdaAi zrv*3O#3X1bCn!=QFGhTIuZxv5J>`As;;v)=$#9wl>JN71wHlg(64NAXD_r)i)$OCi z1CBP6h%~Hk-iph{F_(!xI4k?*TxMs#DwsD^ll`h@?g3m2;9ojA^_dV=+UJbUjAGDg zf}wtWqYoHn<3Z1yfIt%*mi%d>UCGen(xU5X=?OGlo;pgUKjPk}<^1kQs3MhA5KP8> zKUZgI9_O`)#XNvbSLlK|{ zI1#CB!gt7h%};)DhlhU!cR8B7X39|6*Jz;}81~*Oa&?3DB z37_vb6t~jolBj_R#$^}kp-c5tUa(sf0Kz0DT@|^!_)C8LnP2mTwc?Xc4t$O{XYCr) z`J%><>(8MjJ`8s-UpBeH%OL`0?Ybsah&iV#Bh6i}N$FNEkEoBVQfIl*!*~H?rJG;c zRODybYo`0I^|Vy`CMJ$tgl!ZQTUc0{G(RM^u=-WwKFZujxVu!NdpBZIyu=DRr>~hk zaDVNuLwGemo}~URQI;pCR`gYv<2q$Wbk;2L{`+uRfQTqbcQARkQx4{g&sXV9!t#3! zl>g7(kgiBZB+V)o=}UQHV4$Fdx;B$1MBM#_lhoK88~i^~sG7!9#w6MgeTHhbzYKBE z#%3{A`)oj zLe1L=30rL330KJOg?=+exw97S9*jC25M!XhRJ;DSkEEE8bkfDhO5($qm{_fFh?;!@ zA)Q-hMD80?=#^%T=r4^r@G`A-##GB|YzCO!4(TE@cp9x&y05pBPB7^9f&*ENj1&Y5eNf)w3IiwwdY8eyjb)WgUvBN_aNnvW2VLr6& zy;fe#<~~P#%~$7eQ^0m&f`IXXn;pvQlM7k4YqsHHv{B33mD@l12XR;CDQNZD_MVh~ z0y)|`W={LIS8)fvJYV`G&NFwUn+U7QPLmzEK?<4$_IDbWiFi0Ow4+t zB@ekbBGXUm6id4{q0>NaG8?!lXEpq&TBK7IXUp za*4^4KaNuZS2$7@ z|LO+?@V$^`KAd|n*-=(9@@Pqp^Nsd$N_zIMJRAL@imn7&ALIv~LD*#vmpi$DHhmR- zZ*jBQ+MI=of1&|}lrRHKZ+)cMO3cuyW`;c0J!_hR$prFVw!)w8-bLHqIF3j!<#qI* zL~|Rc>6q~6+x2`*4B*IPJ*V6-Y{*pvGErX&R9gP5w6 zcAlU9mqUc4O)sZl=1%PH?p+zF$6vvbTj%D|KX#>#%wO+Xt=QP0zr&?=j-OYZ11rjh zg{b-1Ut(yIR5z{;H`${k8j~D9L26A%!26W#pp<~O7dsShPDP;d{1fMZFQb4e%q7B5 z2xUS#K5$e~@}(pFqCYk{yOs8uZV;^hE*(5dXt&GAn0zF1!~H z|9G~h{U>f()bD{$z|*{_(jcs|GSHnDPA8K)uj6AyLqplWRYS1eV2~aMI^bNYzs+SN z&E|?Ys}-TI1YbDU^YDK`OkIF6M^=_o&hob1qLjmdRhpN1*(K-k@kR@GxgC;Y^oIfU zyLNNcx|=1Zlo6cg1)BMvZ@wZ+laK zK$$XOoLbaJ1TJ+NTd@i3>f*7{?ZXc`D!FDJ%YWKCObR=%imT;&#N*}9NgM|jM0R=- zi>r|nx%SA2JFpKB`aN-I*t&afxwM(DFt8n7^mBdJnw39?llbtr(yvZ$$wR z8fP{KQ-?cU$H%+N^*Uy2$f^Kcy5HwpQ(>uNVXgxPy@g9g6R)cO)KR^mfyuPORD_uJ5CQ4A3Janzx_=!1WgCT-52JY{1u*hejmV~6h2TAYL7MI2GHRMZEWxf+ zMRD1o`{JCDMT8Ztc$8r3Il=L7Q4)1@E z{n6aNrnW;pA*OFQ_fo|`iL_357uE0t5CKM)Zh6qBT>3bn&$13tkGhi8^l@=Ht6 zrMd>=*|=Z=C2U83v9&>{5hSdCTXo~~bkuk*6k>~#D#uM-3(N@n2SI&1qh+i&=w*q> z?h<_-!+2Fi3-}aF5;PZ4Wxmd_|A1}_N2#Pf)ElM$W= zSZDLQr_GX)w(hRrI$vrF_dnaM1zJFDC9RKOJ&3dQ%MD zm(T4M#`u!rPIz@9xT6ze)W}0kiYKpJ-VJl(`%0;xlXSDLZhsKIsPHCpgm?(wU4Omt zDYQA^#=NC91TvM&&@#Ab9f{FcUbY5?gGf?U-9 z7zf(x{sYKkbnAE+j7!`2402YKA4}W#i$war31KhnP)1%VHQygxN$b8t0}Bx${A1wU z!pqqy^_36O~I$AFdOZXuMz{C@AD=}3-n@lQ`I~2Mc&AKl>wk{)!`ZL%FhoppE#W_FA|0b zn=%iHRCW1fw|NTgZIbQr?nx^tQ0158e8aNJaafO_I1X#hnk|}Jli2odva%Q<__%dx zqb|V=7ksUs)>aAq=SkY*tsQ;fK%Y?Ol0@$a(f(38Tmk-3kS|#gt)>v?CFT!ZHpt|H zxh#nGU#>bFJ$Q|2DVcF%cLovlW6otdH%}66o~e~YE=;0*7{h+qHYHV9LnBnX0^V*n zs6Jx6x`T7grn4`u@Jl(*QWxuY*hkn8f;vYuLxfBw=o7B6AkNK&KNphxUr94)B{90+ zu}!H(sQA6;yr-0e+2g7HaIJ!^nab#PNsTfM@kGwq>4|zIX{|1o@0mD`GP^qYa}Bf* zfpaxInS?7>$#G3fH#5YBkCg&}7%+ByT*C0wKukb!d1BvZ#7{C6pM-SMFug_QW_eA_9NYu4bkN2{y)DXIB5U|ua3+_4Q4w$K@punSgo zjOIe`g`ATu1qNXfF{%{3DWiuBF8nN&c>~(J0DrScwOk503ubJ*@C}{GW&=fy`sEy( z&gRWkif)sMicOHmjYJop-Ag^z%JG_TczTrZ5dZNq?Dntrl!|lHc#R8^zqTIvcri&l zwElQaZ_6RjD~GDSeyYdPAYx_6Qe4FU)2o?gPbmi3x9F4;M63((hac@L@4hBoxSK#M zkv4kqnYhPqj$|D$?+-2`}3p!ueKY?EZ?;l=*ysr?o zrXGcZa|BzzLGZh$PaLt<9X_~a)G?F7!)xI(@X>sbBW;&Kx+CNSNj#O8WbZShWnE*^ z@t6MS7qTZ2Xklh@8WJuW;_JGDPPNQ0Olh(o=nyRw^mEz;H99$p?yLXFY|!_m$_!_C zV?T4$@*++J7MgDIU3Jc9dDb^8zqbMxEuE5re-583gPCU`1eF#jL7(UnBfXE)YOz=9 z>eKKs5yJ$df-|wvsB~C&q0jGM}cehuN9rOPyYa%9a`2^7<1P z{|{YX0aaz!b^D6a-3`($-KBJQhlr$fNry;xgS52L-JJr`(%ncNy5a8ge*bsx70cxxj(VuGA@fOhA)pmehZ|+`q20p2Y+LJ)qAAKxz)U zX5c~TRM3GYY$*cTlr0YJMEuPHP-jW_JHIWLs*?}Ry`i_6^?cdJVekW0M zXsl~IUE~Jk0=tkPWED^E+mtnWI5sRNpr-|dHY*26R zcUaYkECV&wWURlBTex5G{V5p`fy9A3UllDCz2A4xZ>G8FYgJ~?rv97}2{}E>$CydY zSJ-roN+jhVg>wZvrk7JasIt8SU6xZ}JW3h?s-VcHw7;wwM)gLz8zBK$q`m(vUbvwIV#+vid5@cBmlpU&-)1_+xF z**^}Dxn0YHy({^a0Y=*~DU$AI{5!u*`{!eO2>H{IUst(3?=6|vdBE(c=%f8}q~BeN zU++d4GQ?v^_1^@O{osGv?qIx+{%uZVjD)m~gw)patLrbC8OLk7l7Hq?$LLsSb_of8 z^O?KybR~Rj{HYyZkd!%=jXX!b#ibv&Y}y5Qrx-?yD|R5rs;7WG@+kr{Ze8|;eTXPw z3Lkg$1GTZL1q+OIsHRg!Bnm@=GGFlAHD!62AYQRl)>6ul(!u``vWq zIjf4Gu=1c$MwZP~JT^4vPEmW-fG!1!4sOVRcP&5#N)*iDlp+Fmgx!?bm???=%A?*< zt=$|TaFIzR^sye1m0-MoutRvNxP6XJK)*6MPvyQ@?6@cP#`D6tFK-R$cx>tD${`j! zJtZgK$bQ-;KYi+R0~_Ss*WS|qMmh-k1h<-$ne9Jt$+TEedQn@w3NCIgLMexl-dr=> zLN&hMS5pRG-}7&$(#8LQBhno){Q?Y8uY$qdCLFjJVk1S}#Owyji@o^?(w`X~A#H?{ zIY)#D{EC;Gt`r;`WI#sg1dAM0#LtRQFar|>Sm02J%VNwI);*{asBR$be+3`%aX7hc z{K7gve!_0IG0?%tjTcBDFuuQ~0W8fE|JMS@v2V4nvV4@?uKZ1Gzoq1ItUYVk+~a4H zw{*9xer!f;SaVu4qVW6aByLc@Krq{EOGE@aC9|W*d#2C8b#V#s5E7Lpz{&7Y1&9Tt znKGqQ_m@Hludr2{EORNuZfJHev@~WZgai=ncmp`Ijk=|!MSG6C;(V>Ib%G%EtTUVA zQJFWCPXr(X&a)J>hr!9a6hgqucyW0J z)Z;IXEk1`|?G$oH?^0Z2bdE)yzr^)%if?(GZAl|3;n>+5NVFznKq@x0~`!mRD% z+xh(Ragjsc!>Kv>?~qGkR}%{eO!^3%C=q)%wTPBSA6kEBbPT(7`1_?iGPQ?_2A``+ zL;Tv$z}V@h)#t!xp6gXe$20l!3yU6f%zuZN=>G3pX5^%y*5B23w$6!GhzzGljaI6u=F~+fD%kqoQ8aMPdr%!l0Y1Y^L}N*_ zsEX3sfz5XxKMDZSxcznqsZ@)JKD-;~#gCB~$0t*rb`3r24k!$SN0p1G5Mvy0wt}+3 zOEqT%ZS9%wQaLC${9JmW7-WPE%i%*Dup1xMj3+;Z2qo_pomBmS`|HJA;Onp`l?ew( z;_<7iT(*i=>&A#Oa=*lYJr@+e!~v^LMkytjMVtG&0*6L2=|_2SKy@=2uGus_Ynhm& zF1J;&)x`2VYC{0rL3K_^8@4VXtiz;Mr4q5u>_4uRb|DuP)_YFJf47wu)ejb=9x`z7 z6W{4_UyX@<_tQ6Likptd(7J?us^KLAeyx+wpkWJ$@I+-~_t6=kml5{(M}~f;fYrwf z+lQ%+2de1hl_=JYnDxAp#Z&a>hijeMPh@!ZhF|<{b~^?_QtCmv1PW3A_p@VT&*vHk z+|o`8YVU(7YXmqX9VdPQ75eMDspsxpi-O&}BImsi>fNXeiJ%zkW+SD^E#N!w%`t zeWDdDA~<3xYwzIiM~pUux+Iiih|pR{VFtch5Qf5>=qst?yaLQbm4g5Y(9r0FEy z4SC|il1b%Z?q|LKFT-=lL+t7KM+6+WomKw$-9qrhics4Mpd20d#tDB+`#{-#@N~D% zKC5WVbRIcvZc^<+B_p8KQ*yaL)dHoA#@C4JoN9x6P+@=ey?zwXY=Isq9$2|})D0bn zv6G(uVVw9iWOMNum_BQH8eTn+5P@BQ-Y2WCqNy4M(j8ElLCHi#UT<7&@Hju9a4NTc z0rzR~mS6Hm2^sU>!)o0%*M%-;629aY1Jxf0c@31{b%I|EvjMjH>ua!&!RX;N*QU^Ymau1$%{%0OJ@N+6E+ z#rE$o46-7OD|exrt>3dZrwg{VwXV5sH3K07o2THgrwS0gvEzJN&weJm_g&c0=dq7M ziD-BOd2Dk!`S=jS`y}`u2I2Gnw5UeFRtCtH4K^sl9I0)J-ufF4aco*f6!4Dm{oNfa zxN+f`mOw@OH}+YvvAG*^qrz7hNl1R8*-yG`@9^k{1;cd#-411TC-UfJM;(|wr+wTn zr!^6fkR(0zcqA$s!(!y$0Ur_`vyOk39k)bQfHV%|a#nO>T3cIoGQorb!dzUE_>I?| zAM8{1lO$eMT~%Q_3V}m=7bmp4<`$zHp)8Z{vwxw*HY1s0y7Z3J;_}W{S(PpR23S)-m~~Hn9Ke1(2l2 z;g(SzdojQP<~z6T17hFoJMcDBjzw8Nt7FxSR~!?bd-{LuM>M7r{?>O#{idb&oXmMX z=V12x>kbq}RL0uk1u1Vb$wifgPtu=?NNGr2HC*^r=2=u17}z0hk|{6ER(8>Zv=)q| z9a~6)Y_Zr^PHHwhWpf4S&to4q2xK8-A}(;C#`f#f`j<{;u*g4b50!;RDuCoQrOIhr ziyVw|cp*dvIzQk7(KHe;=;Th$zXlWVL2o}T@9Skvpqv^syV(A^^SbthiJ=EgH_89~ z*5h=H2h<*(3^X7{K!dev7+4B54aqstO8AG+L*`np zu}h5_URJc#6Zt*eBII`VP$AuHM96;=besQ)k^n952^kO@@S>~uLt8U?u*X!xBT#}`{b4>^3@zFYM^|8p;0H4%J6585)?0E!Rk$*Rfn z^TNJBKDAjFx0uwHhG`+9@#qo62QI6Z3aQ;@mX7dO^kpcFgzA^!ZMd;hh`SJmr13Xf z_xxQXA>gtG2GxYjkiNm5E`-V^Sd}-3>H6JUYdLxRI+?8}?0K2eB`Z;9Z{UXnNa<~A zHdSeYye43O6k8FvcD(Wz7ZYOyfiX813utIphy1~P5wl&UT4K`p?_a@X;;)%J7xPVokY~5=c zgtC|*vbN{36016Fpn{*&D1@p`%9PfuhuC0$OyVIpYCZAL6jtK0Hnf~>nJ6Xg3@Rq0 zORIhJ!^I9nKKkRzJXNa4<NtNv_4{EWoMlK5-B?r<9>Qy9dV;op9lN(9kSY&gP@iG~m4!8^KNyvBjm{f zlxqPqCSA4-loULq%cP_qNW_C6?QH{9AG(nCY6ZaJ1?CbkIaWLX0H*QT#So}x6gb#H z5hjDpay7otSl1?IHfFcbK`=e!*XR&%;7OZHy?K?Dz=8D$W;N*R#U<#1{$BzU7uV1X zl~611>GqMv{#k1OfG>N0O6b0I{Z3B#IyGxPcxuP%2*1t?(1Ur>VPkd4h2~d$UTV;;I8f>+h0^ zzK(aQRbcSOhuU+M3(y>N5hXz!O!<6#11cu=@0Vq4YsCvpR2FxoDuRM0M#bfw>5t-j zoxm3>{W+D({=VVjQ49QAmjI^bVYHLuMMU_u!7Z2%&{@!G#YelLt;g|^e}1)_hZbXP z_@9Iw`@ac0jIvW3b#P4@J=bOXTKA%Cz~}ic&NoKEsKadI2dI@g%owdS3?5klJ?sAr zH~P#AGH(Whzm7S!AChJz?C|6sPFqrv&kNF_HL!rwR{$b#e&}-fW{+ca2Jd9 zd+Nn!3pxPl*Q<2_19raK(UmJ{4a8$O#ST1VJm!G___%lsr9lwN{!I;l_o}V{bwU*p zm?>d2oev0tDyLY*8Uf}XK~;PqnuQ$(hy~yc;WVq#O|g~n8{BphtC*7a!ME=(?pgn` zxP4~E?99A*Bq~cd@$w`lD)~-MXm`YYr{LBU{!Tt%aqYDO3SU3sjG345qD3*r`vyCB zG4a{WGxUx%@cT744RY>laPqT2t*h;~cSz8}2e4ujleNUAmx8&i>y1}hdE=5&V;UPZ zKv!jDF!`1h#Q4#S_Ry0jPh1w3BLvjtFStzgYX=p+y$cO1P@P>vV@9lq*Z6qJOsByY zzy0wT|KW0ym7YPnyDRj221&ima!j3lTMYOdjTtU+X=lqlx7)k8iNU_c^cAi{lJbCE ztdQ1LN^ll3>(_%eQ*FpCBXBX&yjS!tofxu23>2=)=aDLpk*x>zL1mlDtF-O5c zxU6W2X&JG`cceFCXXh%!^nVn;Adr0@_?_E48^pwKzGpi*LL9@$&`bXb>>tq9k!_BD zt4;tii-OIOe$=RL)mOlb{RawK_sTzoc8 zLU#;!i3tO7dD+H*6u#NIfgQJdA&@3sG5VE8e&rotW&))PI!$+tKO@o8|Lo44T@}-? z5dh%r2#%NN&Ty}$^1C4n8ks;yY-|#r#~qVSrckp23S$dk(=qzx-=(9HO2GkFlCU|P zrtqk0h5np*$Oe07I^Saxx z?_rRpMuG&on8|v4aT*u$;%EZnln;|9!Z8%1-SrY3>a87!_6h&-%f0md<(r{l96&K4 z!PMJ}et{yjla7w)F_C*Fu$;@E9t4HR#vn9#k}u|UVX-L#sd^GVu0j5B-7^3CZ0u}<|C>F?AUoSdA4({p9st}5mgy%tisXusoxrZN^=omvM} zs7dyf|MduV8$dd(R|{4+TlnG_`IGa6gaMBQ03EIOpo>bWsR_8BJWQ4jKXqS?nNqZx z4U_#`s-f?s3dd*_bN`PS4VWMRWq)(jZwSI5iI6*yed{UDl3l;H)ZI`FFVv4dJq^sC zomC`a;=Eu^;U+M!ZR0|1l8w&1-E@ItK6j*+4gUyIbq!V$7O{!&fXC#yn6IZPQM*ArWx}qy4BX1aH zBU#m>LVpzIG&t^Yv0MIW9Jknpn1y4G=~MpGb%3Osa6Sl{twPCBZTlr3IKQOC|A#DK6+f*Ye~!vTuOZA&zn1Sa z&zSAQh{{1O;zTCP!0%3y8fj!N@+BQx)qoZ?Rv1Ycl)Qb<;eT+vhx!kJo7(5RiWHFY zCE9Hfx92HTj2vV_W8wu?;yOAgZw#BEuKuZ_b_wv6mDN5Nlm`p-Fj97J#>U2m0~r9I z6?pV4=z#&T`o-vSEswux=mQ55iSF(oYlpQpT|R;r=I}A!Zcv~LPrv@SryM=T-{}k> z^(|a20E4N780X#CD<+$aD;@VV4%mQ3V6#*UPeD;KzD$>dQF7!AYC2y>VkeEFvW(<3 z_Jk>63qHKo?LhV3zi9|5iuMwO#XF9SWmKett>tzIRO9ely9#KDSLjA|}QsTC-#&AS`)k zSgRy69>X^}lK7i%5GX12AmjCY#0D36WJ`+CHtm5%E)ppF##lH?Kb;BP|w)ybp=%Yao>3Iv@aI>tCs8JAB{KBsm%4 zBcaLke2>m3kiT2efz5e6R7!v1N?GFpsVdI0uqUAwb0-la_=h04FYi|%lmvdI2lF33 zJQeSM_;9vMS-bC;npCK0T$dBTN53z^0-Tf4nJps0eWPEU5WgG1Sf>1gFQ|b4J`H?C z$0G&e`a&~pXzo7&D__7#13I=7K@l?;t?56!4XURC9KwgJpjv1kD8-#2!vy(d7_jt1*Sr1896}QnAwS_CF*Y_T#%Ak76YeC8rIixYCycSOaZt;*|jsw}%myAQY`YG}TqZ1rGsizmS;+hLc)$l5-$Aa*LU!wNqw8|67SWh{igLim z;BJze9v>v{cyU{CzaWSBz9*hick1NJ!tGA;MTM5|fHkJ6DOdYr!CUNR$KH)bRbA_E zLL?|!gGRLdeF1};4J@#V91rJ;KykzyLt{fwL-G=-OQ(G&dBqP;S>j z;EV@#1ZaIrP4ZCvdmv_W?W3fnOFYK=s*g<3**92pN`?|XCQJq>F%7dvy^9B~xs|nW zt48gJ;C6hCw}PTYrJy5MVCmp^qkMVji;7@8$`t6=;%K2mL4s9{Wo$eV8YU}dZk|

68uG2S}fst)jO|b$SP-Q0^ik1`dxE}xzOQ{)AalcPDq=lPjL0e*| zlbb@CFYx_PKlB2`|4POE&HmYW3`6lvxoARw#e{b(?7e^60s(VL%$#I;-@7o{J;mRf2jM&vx|XYCN~yiW1!Nh)bDX46&Wh{Sk$e6~1g zU0tNFfxDCDr)FlhL5?ke6TAI^{35v;7DirI>^1Rg=GbxLl;%K}>lLq)XavYp>;*YJu6=#dJT%4YO$%KvZ#576=7oI8TL zm+sP)#1_N`IRp!i)~5x*t!>+#`bDyhXhAaLlNDuSV}DY?m95i(=l&_>leIeSYm6il zq3gqvL(hYk^|p(ntIzG&k|Q6gtW(>w{jONdYl5PP?bp}FZkbIvE-oy^8f$AAXB$|{ zEPbBq?fv}W$-RRexCURMKcp6A`KGEE^c~7`Sb~wWulckiSE#Q(gu7W&i`ZZ8a?s(K z9R_knYim`)s(b%gGg*pzJGA0*kRHQvBF}NGP+7ASK@%%>qO?^nY;H8f=o*a6;zbo9 zSUR3ND+kjohNPx3V&>M^y&#Yk+Fhy1WF&kfx0Zy<{DedP$HE@Xd|*P5&LqAzJ!mDg zo-~uC-il`K!DhQQ;*HE+{w35}M*Wyq;W{lvFv(aMYiO z&CY#bJd4p(G0;);_(VF58}(I$rzCveG8W@ia+A)c#Y=F^t^O@9=n87dlxWM&R$9o&d*&J@1?m9P0H@v2f+Pg8~_ zVX5}^eR<2VmR-wH4oQTVJ4Helo3-g?e>%TYV{BCw;@KIGx~A@!7;TLh0&DmV@9NTU zFeDRUd!9-5OVKr+1`E!&-HT8Dbx}g-xSa_J-29X~$R+3L zZ@f(HLCmvDy-#U>v?Bew@MC7Wfnq@&z3i7&N`x9En^P@07 zSZ?oHq0 zM_5BgKOs4{x;KEU_05%rO;+}9$K=rZ!WcsPGd+G@pNV~4f$c+;;x>O? zxliYntd=u6cUCAyw-^F41+!RSXbEi~1|F1OTpP;md2KD$D2v_weBXr8z}npt^AIFz z)1HD#Z1-_=;}_z3&%ls2;=1uNPMk#Ak#gH_RNkeoxSk;ItG~QyAD&Lx!2ei5U}UZH zmuw(}jK{V)2+YGyCT|y&Ffk!U)}?ruGw}oLve*+O#5QuDwsAdJ@JEIHPWye1FNBzdI!Bk(kKU7qyKQ=5K2ajH8FVM)ZgrE!v46RSTnNpY z7342QKItwBJ2Mqsk4iF-MyZrWSXQ4==YPbEufpDymNC;6@p1AF@4s`+UGFUR5PwO< zHPfJOI4?22OM@G;R;l;N%Ce}cJnC*iYu{S$N5!X{=IXe#V%n|mG2gekc3n5>7eV{d zZ;G^$ce)n|Qwq_FYyv_-;jUp_ppA#OFvo^i0J)$zdE+ zM_PBM4kfw3JoA8f7`T(TW@s_Z+~1e}#O+K$J59z~Y zMMYI*Y))a}CkAmoFC~z>lkwQK5~h!|%OUViH%!dW1k78CiAZXl%Z3H1Zm8NW$*CO( zmlak&GwQ1TXwyoPIQDPu+vfOW_V;r%b#c6eV!vv9)lyUQM_)Cs4uz{U=Cb_S&6LOr z9W7brqg^Ko@7>H8742CC6LF@z<}ic7y(8s^Oa|H`x<47~R^^ zI6HP23|+x9#0j|)Fj%7bd!hoH;WksDGjO0 zBKKJz6le(4Jx(53e+@7G{(VS7TN9u-YiB%Fr+;%WRD%{^SGs1HPDzbdogmlEB^$1Nwa@4b!bkW*2V?fm?$ z%bWPGvt}RnwaS}z%*`#L#BAQAD5I16x~1nm+qJ9xOVW!R5)~wh2-MR=#yW z`}QciN{7gobmu1+MW<7jg%&7Q;^xuyAX>S$yb?tF zD&0aSH}s;(S$2QrU`3NK(md<%OTua<;?1h*YAGvfVx!iTaq-qp%}n5nX!tIg&1em6T!E>^Z=&c+pu?6<{p zdjZJWKwI>9LYa+F5a&l^U47_h||8Qh*_lsyJ2oT?PS(rF9 z@Pi;P(S`ax&n~B#?2fjXPJXJl^NF;0dT`RR>i5_m#BbWo8t}N?ZfH7gUTi#W*7pF{ zE^8s02iivZuRiRQGhVi&H&>O+=fdN-Yld9u>dHG?#S>O2q(t~;2 z^2`8U|McL5FJ9RGo;5RAC z;P}v7+RYz7ZzeBHnFU$=)AU_$Jtvl|xtX?7Dq6hna%*R2;+zloU$RGL@dYH$H9wJJ z8j#@0OE0#jJn_yP7pv62ke&Br`R9`0lGjIJmPd7TjSaC zYs3(-z@GJtS5ITJ&w0G}s}-%)>GmD`ouFB&g0?m}y2uSm!}1kI*V``+e36Ss#>2_* z?iUlgvL#4eGLhz)Cd;D4{%dj{#z`dOHKWmjZa z%V<;&OHYJIHHhS?{PkVL46;tVCcqrqcXf69RD0FDr&qkUd>Od4$Dve!*+ZuY?{(juD6xHr&K+g|~ z^9yxB(9stbnw8Ntbaal7)2Au~|6q20&_PrdZ42-^_Q-&~o)ZB3D~{euOQG%QP7w5* zbq2YAf-DpL;Hw=ErZJ&&4p>;Td4(}|rEvqxisj3oD3|D)p9NwAM6jG3mIvCi_JUphXz*ahWZd%okS)7_43Iwq0c+&p zlC{F|LI#uk zcD&sK)VZrga`UM|mOmQ2@k&heVU~8x5j5q(X!lJgZp;dLvJ@UPcI~$!&~pU3uWzR- z>*HXssr~!{ZQo{DbCuSt9CmQ1(0k1nAMa*{3+4`*tzS zWU|ql!zug5r@O_u%5~cQep;u3ShwRPd2l(t&-Y#qEkdS~NWr>P07QSXw3Jk&aWXN) z0fW_J-@cBe!V0Ubtc-0*)+e!G#-kxXSwEF|6+i*w|4-LjmEqd4{4mM9S1>O$%uaI> zxWLN&wZStfcbpS1LHUl2pnDhn!}Ti%`FGuM^zovBi}+pS(?jAd-AF4cDCvS*p-4EFWTFvX$oV6`bWW1w|jas0KAM%a#=zoqYt8>c+ z2QkESp!h&C6vJ^k5ThGlgVz`ax-JB!g@$Q|m0n-HYoCda8#h&b&(q5uPG{gfo>-rI zw^1>a@+TCDZVy)7&hABRHh1*N)`CdwjX4%oCkfv_4cLL0_bEe-z)PiT18rhvWq776 z#_>=G5kS_+XeEd1Wxw3w>SzT$V~PZ05ccPqFRMtP%L)L3lf(Hj(Wg_M)Y_pOaoDA{ zOXZ6zl-R+1kEdJh`5FsyT--~W+%?foz z66lObQ+boXC(hux^YO44vVp>&AW(NCD8>Lwr1Y#=b`ywpqHryKEQq^nh%u&u!? z%+R~tGsJxlKw7DPfg^#C9(fb*kg!5aLX*>%^LFaZ=vU9o=WM(3#%Ed03TxBR^C`U> z7pE<&%Oja?!u{~%k0BP>UQrL-a)~a%W%|#((2TWZWo2Nr;R=*<1QZuGUCzJ{0<=cz zCX|88i6k9^2l|5GQ4bFE25J>-R1G|JX9?fC?`A&!-jAaHiQ{*_C<=W$m;9N&L<5pB(%_OE+Z|uERCNyGpWl z+){Ubo8?7TR9=rrQvlh^8#@R4nEBFz`x{sj>|lp)kLSQZ&*h1UFaxFt6}DgE=)yha zhR=mfO;m1eXMX5HBUyevy^z>9Dg4>t!_;{c5AS&aps`?f^pX2$JZTkvcZUZhF$^`8 zY0Ea8n!|>i0L|bGNAWNq`b0h`0W-*SYOZxwU+-EKI~WVPsvndOxIZ;%H*P22&o`Wu zEcJX5bUQX1PQGsfh^FW%rlx%_+9QF+>r?qaf~{y64-;ks^L5v4PXts~i6wBlXk z9Hldq0u;I`X#MWL2ygS`>4`zW>Q&?_}yrbjlnrp-TyZ;W*voT zE&!~vA|vVlAHpYOlTN*)1{nj4YSNdCZtPI3(8AjI>{G7M*st0%a(;3-eC-aDysTM6 zujwWOKQcc37;0q=8{F^0j>L>KljpYJ&|~OIxR6)K?i8aHXT#7_h2d&gsW#(CRj|9; zP;4nMtDBsPIBDWj)SSwXXLxve9X}i5+aEf;@tObuGbt}WUiObheAZOr3v7f}L;~r_ zm-mL+vC3(WiTjj^(NcUOI6Gjk33$PrBNDdSCwj1ZCNOzc=)PnKW${dn=A0gWJ zg@1I^$+o#KTP$7^&3ssi_3Gw`%Zji|8eYtMwczrp?oORg3`uaf4Ml%b=OOLJFtNox z(W~l4ooPsT5r)BY*W|GLY~y|MvJGtHyBSa;iAvjRl z<7Vmv0o;fUDF4Ku322z>ac6)5s`9TIC^B)op?n8e{9(`Dk5s8HcllyBe$RrrN#UdQ z_2sPn$lt&$TeYpvZz|3Y9jGO%jId>Jnx*+f z(_kP_X6_}NecVj5i0*k?r>50km_#i{DaA-ev30JZr_s~9*L!>7$0P1;<&*}^%sO8x zPc3rBF2*=xb{EG}<}rR7!Goq*Pq$-kx;i=^EFGws(uwDq&V@mkH^w^ULq<-+@ZIaO zfaYtCM|Jw&2(kqVFhq>PkxP^r?yMQp!MM4?3a>Bj)NeV6C@J7mdDF&~0Z*o?q9}7~|M+xBd?4vH8BYb7Y+f%``y;AVc=5>#^Z$2O}=qEdmV~r&Fm#2lUMbYa# z$Vwd{uF#);b)18Ck7V*RZFq;nZsyNBG>O8e75i^5t&p=cVDT(o{dA*L3`7GdwRQ$Oe#@xzWJW)XPb z;8{jUT|Qq`SAG{ZxafRTKE0S?g(9rhQ#6ss3u2B`6rS|WaGY*HnO`Np0S5%fA5pQn z6XByXw1}Xz;=<45*V_`zB%n39|HOKgvp(-^4}bOkoy6dKuhRWT?}dZpU!N-UlZ{rH z+d*G#=x)JxMfqq9f{B7&!H>#+lMP~?rQTuI4lr0wfR%z-nsUi~GgIjN_i$xpr`L%O zlp6J)TF)=8&H}*l;tCD0o1LSXUQO34M{~AlzRxW!x98bLAH8jy6oVW-n^C<<=f3t3 zWX8*-Ah&CYiq9nigdMo{VkRQOL*hdEj_`$ja{)cCALW)?H<)Ebu0FQN!kLeaNA*kf zA-^r?G}A3=$-3cZnrvLyT?eu$4`|#z;0z;%D%fc=A*Je?;=vd~taJ3kiE#W2yG9ZzZPHQ^g34&9snFB`IWT zAXsy}@tj9o4CqEuk!fbvFXE~F*UCsxigQv zxU?Z;5-(^%5wBXuY?@6C`WhL<1Fnp<hGj?J2pe-jgRV`(G=Uu{@Y$Yka*V{7*21?;b#SZ42lB0pM ztWf@rw$KnUQY}8fhhoQDPq`1TO-o8QUX#e&R3K7MODaO-tB8K`)7*z|;EG(*xpG?R zKgvr}0jiIGa4|QA%`%#DkTJ86z^Lw1?#!B^8b6uwXiE1t7D3^^k$|jltYi%o{_$ZX zIr*4P>eGbv;vNT!tT|Z1khh_%`Y%y*YFGO6cx+4in%PXQl5!g?l=_KPzd6zHfz&8M zOBB$p-}3*2ll8)|i1QJsBlg#+O}wO1U%E+exjD~%_D=&-L_{t~avH<6wE$&{w#>X;gCjr=5-jZ)WAlb6&LmPSir;}-EyI+)eqfd+L*lOY)KT5-=e z8uDdp=U0xJ_wh8$dFkL41{rZ?rzKlXe!LEg7F5i0J-XxlsSz%C;++USuk+v(E2hug z@1zL2D;yk5gD}uSdcG+*Lv=$a7ehewXJUQ=n!`d>vuxixROs);df~2}k!wIiwl>iR zPBE(L?yT4Keg+%_gC&Ejoafk~#a?jBCrn#WJz`K`!_% zL{>`tH{U38kh57{5$j{q$J5XQ-LApgpW0q3#z$jBbM z#g*wI6hP^UsIG`Wr}kaN?Ilw%zM#GR(Is8P(4Vi4-7TPxqHOweD2lqIDVdU%p(#<9 zMAP{kb^f-jW+5OTzI3M^@WW6dD*}UJqZpAQ5cc1kHX}SOj1A;>8ZjXdSgn<}4vV&6 zwHp5!+bQg$dI9zkJ>!pV0bXh9*V}xW<{Bzz6kTGO7& z?wwrl5A4?xLdEZlP1VC~^Jhb4cL?TwSh6#6XCoF~2o1zsx{W&Z%JH};S+798XJ8C# zKm(Zs8%vYi4{DM3}w6Z&4dh))fT?RsXf5MMX4gyU1JVYqragW$4OucN{3s zz-T`x7o8ZN6c?9g1=0m|k{OhGy}pGeGa!8tEywD%?|6J+nArwS@AU-lMgu!v=grI| z*MopR(>&}PLj6A1b`~ITs;Dv4uUrzitv>Sg^yKYH^;=rmfQo>0kL%@_DvKZpGV9@Q zyPA}+Fb0lKnoPt#VcR1=5$B$AX@+-Zcx}z1ip6jQb~k*#EO{mgTRG zx|Zuv+eLLS2Y8jk-1;|$;~2hr5GYWat2U2l?AW~ZXL@*6%`%Abl%8k z!*jKtkfAyb@3IRk!08^3m%{WvsgVg45$u=TkvkrbK&wl4PVlFe@53nqAQ6DulPsNQ z`RlyR;H8*|Q+_B2#az5@ke$)Cr50PS@>wTmXRl-9sD5sY?$gj@T)*n`@dGD=@p`Hk zVd2%D!SGTtQgtXxQ;)Roi>oIR>eZI_}3YiYm0w<{T;3jGbi6eH23NlT0o?>7Cixyx-jNMIdUGO zQ3L!Qmz9`%Ctx6PL5|`*vtePBmmThCJ72F`RwkPuBG>00__FPth!sRtq;TW}cp$bT zHjMu08CYcLltR*T zx>TX(dbQ)`2=wuQ=OJb-57m4|Mvj)ePM|zO7l$}lB&1mXK1l6Q~Q{yu?%NBXb_p0`&pQo}gE5qu|^*o<5oC_~K!8uRQ z_kQs3&%EfGt6a4h9|6Lo%4)aUD(Tiu)yEx$bJNMc%#4803qi++bdbl4FHeWW%f+kW z;&FUhSZrZnDa$P_O&g6S6U)JXitn_Fwu;!?+)+)D_qA!=N3QC6dVM!HIA9NPao3q~ zo~!>T7V|OW1XHI#!^1xs4_~jwjH^@(=iMhnB4StNKRKeBP;FA@StNJk*VwqoT)^XH zz|#l-7td(fa?`hPfx%w*$~3yB$19fBvzU(aJ8MDr$2wB)i!L%XS@fzol2zY(8gvnN zQBXBUB`q#aGqK0~=v>adJl4m^WmFHxCxnsfE4Q=Tjsbr!t~Y2YO=A7JFH&$2kj`-S z@q`V@@0bS}+niOst7m4mN_a$R8Tx7k2fgazuQ2jBv#|TK>u##x)D)Vq{xvTIRw7_h zmS+J95efoex|-CuHwyB{-W@1}uHR12_s{{Y8+7e7;%+O=zseV08--ogy$S?W08Ez^ zp1hP`0UOn3O{DVJdIWVC^(1v7%DF46RD@v26!GhV{E4wq6ZS<%zNNWRw1@V80PlS6 zjF&q>5EmLb$QJ`hhC$PQJ2!B!RnLbY$uWjaeE8@o7qhrco2eBhX#xUU1{$vu^;f9C z#3U0RxOha7s<7ee;n1|i?=7-wmOx`M;%;qu!=+68yC~DPZe}kFG!dESfbuu(C9+^fci#6mA_B#QJQr zBPkbQ{f4iHn-DcFGDtPvQE`S*c2bTp;!01EMnyeL^St)2~7hY9HTK?aK6< zhYheCu0D$lM3cTwI*V5jkf9}|#&Ydmr-&T=2^I*V1&OxKdK*z#nrvz_L+W!ayk$n5 zGhustsgvp3gkHl!g4NG(Khwr{4s7&b(||LhXNC{>H+~3rS+MwetK#NqGvPkUCK#o& zmhg$?n%4gJ2xdh3?-6W(Kxd9VHmAMn@GUi?u%^sn`l2}v&t~TqxjA*h8tdOxG@62G z9m!ykL8uMWrf>4U=z0sNs={tN5~P0VoD$njUL8XjYQy=F^1o<6RkDV} zgk=zefn%s-6t?d~z9q)H_{!L@27CWte|Z%_$3)k283z$L=od3KBQJkOVyjCj#f6no z>V$F7L_(T7HMQ<8DM~FO)+5@}fv)&9RkZKKVA;6Kl4YZ2;nYn7hgZ%~R-Cq$$x+6- z>1|NAt=0i>4dE^dZ3z#*cM(DS-e1@~+UMPS6y@u%L~8S8)-8U3$<^c5|D1K{$a+37=w-wo-$#4}{;#jQ z)J3ETrqS_aSsOiY1|BvS2&u}4W*37xzWFY?9b<{UadJAx2sF8eA+c?Fq( zQ4bx=4rG@9EQVD%xz}X7M8Tap$b&_k%1K5Le+DNlNcNp*o?(B175ztzmeZR%k{?&G zX)6OhtfSU?T(PeYz+OgioXf6M!&Qhv$iy(CKA}j*7LiahrE39zxDN4xs#%VIwTl}L>PxTimi@EZYcx-33FtC zxdKVkLqa+a5(&|=l7`5H~K@N?mET^I&t*1$uYQe4Yo%Dp< zi-1ae?P6HC`4`HT_AR8Ok%WN7fs0WR2Nl|DE@E5|k2)a)=vc>rb+7sU z-Z;(|RaM)|S~vMFmpr3V!Vd&d#Id24MRuc(u(jLF7SJD&VI^ed3 zu?>WLax}$KGEjgI!1XC$W{wPx`Ic-VfSn7eV^tEQGO~Rm7Z)Llixje*ElIDvO|mh& z5GkT3R$V)|e)FoyaA2$#g6%?U_L?OK4DAfdf8`1CS?A|rA=;IBhUCzXVsS6gy!zAh z7*&F2f+!%>wK|qz#o^su2B&Buc_2`_PbAVRZZcOBLGs~lkx+lY#0sPHT>N77@Tj~) zbcK&};DTjVQ&mJl4}xzDDeIFtZox!_pV7!evj7jGyk0EjveOlVmhgLFvZ2!KjFR|) z3fGVi1-l1WZI&$Qm1W$rSm~lvIII7n88lcZsl&gZH{TrI{a{IAb1#EBSe)l2JCoRu zyF}!{6n>%tn0U)wvREZlzQBdbbx<+>?fnND)cB3xNS43VLQnWu1lWL1X7Yo-JX&nH zGO7aUJlSRaEQp+%U6{-AYjjzRs7i3}j@Vbtso6xknDxanl<%|6m_TfaYk&twW2x83ha&8z9ySicCdO5pN~;oocSYsk(#ZL*_ z5`gRF)D$EE@fpYxzp&D~^3u0}`e&GHw0nU0C$lK+Q4h6>#eo4RZKE56n>Xt=|H?;( z^?uDv&QFPnEX>6(g^Rp}M+{r7SfKgM7b5Z&_&)gf^|L}h?iOi^>@NJDK5HIPc31W4 zXqTIt*^x5F?#yuBif3e1b0*$_7CPiZr5ZQ%sUaoTS~)$WvmQ8!$bKFIz`0s?V4rE; zyaBnYz-Eqp44(je*+7+B&u-b_B^4D$sz*2BR83)5CTmjv^9B`}BSSwq!x;fX@F#|l zWaa0xx4n^gg0gP`Xc9)#cdY4T%5pO@5`nmU>a9Ck7|mn@UaTFz8$Nw|Vlf1d<@tq$ zkvFEa+<#>!5UlV2kCsyeEdpH~lZ8$ZP}&2(R&YkwO{DYNXvT}mR~t?9E2fwd$k@5y zZ$?yBY2TF`vmCR`bRmR$DTv8Sjk5_tRl8KHDPhe15f|gWyuJf=?Tsl(i|GdtcnO== zg;%Xgvq$M(vT6-@gzYtxMBk22BZYHpNR_x+IJDP zqc-~=86GvGX+t+zg4jepSz&JR--FElESId{`TcDNbklxgn8xn!!0YXVBmx<}fWXF- zTrV%4l@^+`Th>3`)0V!=QH2b+iwA59>D&dtI+sPwr7HtFiBM~>-_Kf#W~T3EwyyuMc0fe?q6Nj(Np~r7i#BOH2?lVt$3^sx z1Kx*~gX{{Zv_P&^=UK*m;La3&ch^;%c5W+RDva|8eC6a4GLi1rq2 zFAqtXQl;$hqy=gRP;j)Awt^)>&GPciJ2uLYKR_E>>}OZ!$EvXLDGEUzBUc1^iBWle ztyYwrQes{!(|DAd-tk*9Z!yOutdn`fMF*+mu8sHkAfNy&_Um_37qAyzZAC?bh}V$t zq)Fn%y+FMXD&@N*`Fn>;4QW4X;si#i*CJ9;lk zr!3vqq)fR6PYyz?^}C>GAOhalBa}0o!4J*CEuHD^u7TTISqZEp4)qk)fo71Dk)!bq zM%#R3C$MVL^l$d=qU-!UHx2L^f3ae~-g5z82h4OhZ}OMJin+0md)8{j^$u#u9OI?3 z`I{>LMt4uiUU%mW{O4;4bjg}jL=gT2DY-jZq?`Dl%xG%1Mov!QBJ@PlEHxeYk?|2V ze?LzoVuQ8vTpr?p*Q+L@y!2hq0~aRz&+8XyWV6#hf*dA>{N?3; z>QrPjvOnATcM?JQE%|qLcIny?$4bSBu?GA58QZ_lWfCrYPP9XSdkqo++bgKS{69{{ zm0>-~F`e<`h%n3TTjikBB8b;q0_r4SyZ?p?2fy7oAX@M4==#POE%mz4)9-z( zVsT<%$kWU7(qHPeqX2<1&rj*yb(Se3HEF1mO;XUni80bpMz~}1%ziAYyy5ng98%*p zy76AEm(!l?*gf4Hcml`p2-2drS-2jl)KwzBFS+>#b>OD;I8~^)Uw3*U@P;{u2>E~z zym0qG$eD)(?S{;vvbE^qKLKWt?DxMzBN_;Ck%rwJn-jxzLUS^9aOCdnM%G2|LP;{c zj@1YLT)QoSGB+9dxvtBUgSZ1U14d}!VFEQ;KaWoun1EpqJ;*gB3?n&0$%Fcto+BG# z)hz&sH>Q8hOIO&QE+hzRRnU8oWp^3+;eTgcj*5VI+}qh*$#d8IAWu7x@)1m$iQi8F zk|rEGf$~pVm zd8lLS7Klp+&l<7F2cI2pFqB?|Ul)|>a@$$f7P#-%io7{}LM%1SGzaQn5no_WnbSSZG`uGTEj>^qMp823dkSPsg{DcH>y{R35g?yaZrI!jRz#}Pd6jIQ&vx+l9I z41iu<5u@gQO!;u}8taHq#t%x!E*Z4UYN$91J5bx%$uBffz3~8{1D+lrw-@F-yd~g( z*TE8AnnL89*e7LdRXw6z})BY7VnzYjRqSaQRNwPyC|L7 zhB(aIU?(B2AqLVlc4BC%u^(sLX&>7lYhZ+W`11aTUcGTrTD;Gs0CWdr9F7@|`CH`5 z<~T|9pex=12NrROAIN&rg6-&v(faY8c5!04N`bCM^@*N#INA!s)VT&IB8m6Nvv+x^ zQ#E@qK0*WAk2xAaQhla-Va;`-KgO?~%g=g51~ zqULFO1)pu@^@@d&e8EdK-CyH&n=<5Dxf@NjHix2fVh^EOrtY}t2HmgzhFq!;YaZtj zN4SH9%J%k*$02%Xc{DxnMWZzkfa^JpYLpOj(64KN*uSN5Q?3C6e9_(91n~+^3zpy5 z96;xz6z%TF){R~~2p$&;gmxI*77?Y^CdC@DWNgw+LauGJy_5g0zBm$mQ8_4TiT=^S zf;1H!E`Yq)Jhx?*FGzNVuCHoT*f@21K&5nR<=58RI;EWqy8%0Kh^GC@I(W~QcL#&I z@g&JkM=cvHk;!7o!6uD9;01origjDMxzZ*4ugLlTO0|WdAuSModYsz(>&WFji}%e4 zmeJ(HI9)w4mS-?)$8RG-rtd-dzhUGVKjpY^_>UAF84>Sh>C1O&N0{@V0k6@ zOIP#P?=z&%i`i1D8Mg&qJsHD3b>aU021eLl4 zU-dorKb{LHN1Ze>jW_+W0WkyUhbrtpF-7a}f9U`msID1I)K?5uuTE5Gz|T%Q(c8Y) zaVa1FxMy5o#d&fCsl`eXFrBDh1k3(YM_5|fjW$*fS>^jzApM+)zUiz=1AZ*#K+)n>l5TztXnJ}EKI1#!a)+5cq zn`Jr(Vv6m2#?y|I1t1R8p<9C-QV6As6;lMnnpfOP4j*H2dzQPk$7~aL>MR^kNsqXC z9!4+XHA^K)341=Lq)UbWuS%=`Rn^I7%`Q97)zeO-h{K^UFy8qWEO>D2tcaumGFZt# ztlGR6VL|w9g3)}QrUHTxvAo%^+F2JvtcE=x>S}c~(#%qyU^xZYB`a#E$T#?5Y6IkS z*huX~QIwRFPiF9?ML^+^<@U6b1QqkxKq5Qk4dN)c1`m34ay7&P~S z_9D9C9z!>V-D@H#s2KsNtA-v-$^)*=k!#aZs-^LMA_aNaHybfCB5K_o5UitO0(yrh%JE31XS{+NZ0^$M?G;$Jx_ zdBLk3+jGw{Aa2U;S{K&|En%%fwZjzwHvD_npqZ^(Z7RTPiicB~rm8=&XP{d=m%|Z4 zm@M@=pI?ke&Ka-wWyCn(4F-U;v+ov)vDX}EUq404YtIgFo*ZhogL0s~6TFe;y{hXK-H|TcGD1eFL5APj){f_dh$S0)^M`3cXoUWtSX@6 z%HDWtPCu`0Z5cTzJ<2H0h|i_rC}h~R9ZJWJ+*>smo%Xv^ z`O@pCMKzCJP`~$or8Cj*>{R<6JJzAsYN9%3pT;_F zkfz&LapZtOh*9|z(ERBgD88dCT7{$hP958H!DFE@5|!Y?Wgfl;{}^SwhsnS+W}e0|NK@Pp35sQN4FY6)*G$d_&sEKM3t#C~%pU3q$m zGFTY%%d~`)UTDnj#H1wIZKp7j#=0K6q~&(goQ@UkAU>1MN{WRhezrq2*tWE#;=yHc zKD&Pu)qNv&O7Ol()R*>hE)wI^bf5M{DDDRDCTKIX2>F!ozH{da&yMq9_jnhdc?(xd zS(}XbaBNf{u{n{)%t=sH$mHD}`#ai4^J22%RaqsP=F~6t)zuR-i-LB3?<6$29j2KT zl(}*;s|ca|Ldj{!avHP3XL7z;=5qfuE^IibM`W~po?>jtC`p6fLwvFEzOC3SyNN*~Tkq4+L^vTg!S1xpVM2aWXMOy>I6VBt`Q^EY zLY%VBl^r#g`c_w~?V#)A3iSAt#(=j0-OSjQ-R(YGwXg@HQu1s(-kF7A(EH@&oq;#O zOHe3$C!F=G?S?B>x+m!4O%QQ-$n_DXmZ|m!QxButwXTdJIM=PutTep)$4|Y1xO&hk zG=mHd9OBwz9A@;d%(*ArO}!CRAQZK2*=JHPfHTIxRpIe?0$G=T{T#=LY)9&K3W^{K zAp{LY#s^-T6Ln97t?Yt|_9hxONndc#Zp1?J$Mu|eVU zqnFS5cH#y1tWOz&zr&;?NcDK|GUq^=`74nKIzibtn>KtN@KQI%bj|8mo)lWzz;dVI z9A0{f_*m}4?&Fp|8Opk9^P{AA!*TzKe`^hAa3}Qnw{lzTo&U-7dsfCt0fM3v1oEUH%(iN7S@3Y+y!Fru-bTO***K9e6I(i+Q9H1i|95$|; zW%SumzOrE8&g@)F%uk4$Nl=DR5x{z$+l3mNmvN!Oa9VI{w7Q0xDNhjc={XwGOveL% zx?W9LQ)2r`gjS=pusB`|YE?k)DxY3JXFq`>3><-h)M#nJK5Bm;vB6i$1OHpI``_1kziGd9{UK562Affo!0m zo_7Hm7Si*oUp!l?6x?|zNcTAl!{z=Mx!^|z^F4_xQK$2>aTU{=eVq(ylCT8w*GUyL z8Wo}MLnvreYN4H^{0G0rOoYwcCe@2=l23QIkP<#77w!; zt!aV%Oo8COF_=x^sHrX7ujdls@zUB(*Yq%W+~FCGXx=CqOczLk-+6;Sj3y$je9XGC zcXG%opa30IMLE&1IbYkQukL=>c^hBv&YlFW<$N(L22TIM4}E)7Y{4}&M6wDSC@a| zd$SEX)|&C7&-un5a=z7F{1X!%)`o18-WT$=?xw`p5}M`BO~homZ@p!$18Wq&DA}@M z?>e0xVCMf>t_@nuPngd4WzW;gO)!!9yYG6YmKV7;b8JVwA6wBw{jm8Ii@jEQPAC6Z zoBoYu4B)5TH45m$rSLi%9$0$#9-ZdTI&yRf8Sob5ATKN+*IyQjl2gjT1cPKPz(%Z|a--np1UqLe^=na{b?lKvq!Cwqt15k>k;+vlrnTPLpm#B1ywM(&mX_&aRJU`iAV=}Cwb3q5ExFO zpwVgx;3NGQ`jw=Hu`;WTC#{)^si+7Vp{#CfVPnwi`Z~IUhty#6LRC}*TTS&tCAN~> z#5Wnm2t3}u@tEPSU=%MsYtd;~Evun`CTrCbhRAec)jHa%ZZ+HvMqsh7_RN*LPnYlF zbBhz{2Rn-=yolD^tkhRPKRUc!@I;0lI62;sRl)_vKg~5_bXsH}yip-Rk*l(JD$f3R zsh^OQGreNn))a5n`fgqFH+4ed%*y?5wGu5UkL~;Yqr=sSfVhkcl_2laQQlO9<~;fY zV1oO=fg0WAdabJ$_cGZ8-ettVMyHo71cGG>Z2IfO{e};$gTa3s7dgP>;o^tvFq?rA z;LiP7qh0yyA}yP#lfexe6ldEDr{n3>T z3Ocq1`!hBQ**)$FbEUP3N$yzkD0m-FDZ%5U7cF&^XSJSQFND$ojBI^@$;7w4vxNh1 z#eQuT@bG{vAj}$IaB&I1B4)u@cm5TR3^>+d^O8o3HS)&aUE zeHXvQl&-8z1fXbKFSlMfjT@Y7jTA$3iF*C))p6UduQ?tu@-=glMo*;8S-0c#J*Ce+ zj&QWpXq1!|dC=Z3oSfg#n_IC9kt3ev^K`T8-68FBq2F&Ddf;@6!UsbYx`4_<{mc z1x166o>aiBqockR#r%m@jm zh7P%+t6tGC9QdZ=O?{;ClDT;tJ%g@p=Rh2`tQfY$Wv=T7$5lP(h(>;U87^>&RXuSv zl-fd!+LCXY!k)cRS2DEccGn z>26>3dGx}$K3pSc1kGJNUEF3qz2xdt{QvF1zky9cR!VGn<{y3AiyH7{ij6(*4SNbx zq;G`;>gO6b>#b>A#&XVOtWFVAN?YwN9!d)`D)GpaYdHE{yPKN;-?}oNc6ivk5IdZ6 zLIDHwuWs+rdL14?`b}$|^=42z-@hL}i8$`5U&&-Li$?(dPjHSoxvcEQo&J&1vZvdp z(q@(j&RRTU+ztTldK*UC3=aET;ICt5maSS-fx7}VboKGk^PaFXC^DnnoIe2y*AR8} zxbk^#N6|!<{FNun&4?SBeNfy|)Hm3)e%hxVdG-ts-H9b9r|MoZ>fYJk7|Jj7+PnMp zJ4H&wOhQn#r`eq1xlLXrLGU=x`xN>@`3Kl3CX>o!6-;knO1~+hqNwW5PyMJ{{PAoU z5KB7x`nKux4vdfYc6;HL4elF%L>xAj)n8#8Z(!1SJU$5}kWm)HY*}mi6cqd#4u5sw zSWk#hgb-%r^=mAb{Khdxs|#7_KjML72DMFfvIZq6nQ4!`Nnx~NOP5~lp>5>_c^`E) zS?jNfOt}FGiad%^SIfx#L=vzyW=pc0WqzLhE-;NLUBW$AQB*|@|0pRM<4qO%Taezn z)3A49%zxqP@lUz7l$yGFy%%jLI6U-`hql_m0qW6nKzyLymOMV^{fC(nDXjhddPjEZ zOTqx;_5-09C_(x$M0O7v6tT?m@}#LL`{R{C!Dtd!H;c=;FSkuvn@C8w+^$%9J;Xw9 z)~?bmUnirY@}jDGYH@0)Oa~S;;}wML2txR>vsiBiGIgngPAd!!Zto9>enU4=g)T~r z>ffG1@jRX)14p5t;C-wKRizQ_*Bx0N=ILs`nX9=Qa(GQS0rt&xV=7?0*d%zUvtXIZOVXdDmj zRdZ1D_fV!B4?6oYKTcelMDV8G6X^2CCL0#w6{>e_M;ljuh^u|ydqtf01x|`5lHprh zW9GDEu0Y#yd|87KRWlD9wWTfAB1%z#_fyU-E^a7Q!wfxL}&K%aC z1@iY7a;)!r6RjNe_RhvPKATj-##PlZ|9RosxUba78qPq6Ph(LAJN-O)357{yL<9pW zv8vAG*!Hw8BjB3Hhoy0B<>fx(WUlR+@j!Ev_5H$ViC0ARJ@h@JSL-g{tu~au2fJ#O z7hPyVt*}Vmlb`CXZADsR>dcJe`FSV|lz(no78#sY>4^bw#SOLEJ2M&^f4xjj@pDAG zAeFA(L4LfWjG1E~WX^j8mRwlMD!3*89rOZMz#Vn8QcE)S$Tn(ARTYR%)ulb0NA zgIMfMo_9ynI{y~60N+WOa@$g`*UI+Ii})J)8*qiI6L|+CYof+c%ILJ{-bI(eSH@j= zLzh`(OSMU$p`zwj1m$C`Fy%aw+T0OvG21^(E%-4Y3>?F2GnD>9FRX_ng7D%$dmw}) zXgH$L))yV?Vl)y2_LW9`jBf!&U&T=435~&KUq24VCDDSwTDI5YnzBEi_j$#BE6#Rx z`SMWrML)52tAL{t4RidoeQoWU(~Zu-F)=5jGGyn@h{lTqZbAR-$=K2|nyg_ytKE%b z592|9OkZ)88~7F+&g&11hVHLk9T^Rc8v=e2120rGp5Ye$;AiS#Y9=)-lPabOWDZhz zepI&?T!DYvVG0A&s7bTFk;@3&h+B89 z<)jM&0CwHuvq8jAea=yS#f=i!di<83^85E*Zch|d*65~b;WAQdZ~seC)Npqw53z`v;Y2uRnLms$x{{=e}RGEzd%Z3+WV3t{eu4%#%k^n6&T#Fw53R@pQA~9 zYGzno57gTp(F`mo=!+55)P!`q`9f&3t&t-Mj=9tJ5)l(4!JhHrHxy=(%8hMMV?1en zq0bVQT$`Ux&I|bl*c3pSa?7O}e71ydcU9f^C}?jzCng!`e(V0bxzZ7o)qj3O4a2@+ z*%{H=Qkv&JUThhip>D(kZaDADrQ4}cfcMGX&CG#d4Ag|>lEGbw!}nitUE9T+E*hGl zt2Z}(Yd&y3Pca>GA3?uX#HiWe>0{!?cFBlt$y)ij-RS>s&6M+x~-on)RMFa)Dbzx}MSah-5fzbnzxZW@QW| zrPM0I`a+2Vd@xpCM%=|L8{Oug1k>T!eKz_r=mTE4EaXy%ovgmvyU|K_(@a7BT3xX z^Q6Pc8Z!x|`)7E1*tDV7zKb>XyuHZieJX`bED12|yC~ z#5yA>B;Qjx5ECbbJemW51NbvIY2fy(5`)(hZG7B{-fsIX7cOFW0-FDe?DD8j#g%<@ zYSLi7HtpoZzuVk}de5twKh_<`Jd^++y$pHu2v&FQtJPmow>hT64;qmkYs2NFc?-CR z!r{NqQScW-3kuZww(mI@wIY-K{hzry7iy0JAo!dCO~}mbK}Kax<90(3@(;uPMd>`= zF|FcO41|L@bIdpXs0u=B&&@?hOwU+C39qf+fQL~#F=5lF!BtWa?tMq&Mmt-&oLTp0 z6Yr(jlqtF1o**Ewfp^5}G24}6zTU>6EU2uwF}63p8Xy}iKsGUX!*b((aWrbxexr1& z+?*O*@JsFogo))DAx#TN?j@x|7S1D!R3L@RMJWeX&lb3#eeiiRv#fRK2rVoRKd4+J zporSg;CB1`Pr6P+3Mw6%00~2;w-kb?{bcrDkEvTmMZtIXhEVLY*{sFHfV%p^-FoN~ zG3iQX%d#)kAX$a~=m7~cbL#r~xs2)<<0BC5UmZv_wfQImSk(leu2N~YL8) zlWYGi&C_cfLI42rv(ZSmafnW5kA+5KLJ#YT`)Fs7OI#xF_VLnpU>xgL?J z_s56wU0vGYkAWfQB}8u{7>Ez!qsW$|jed{>vdA$(TLP9K^(FaHchN~um&%6{ZLV6!S7W&`1&M$rjT|Lr0#vyC-;R+g-rPthNAK;cop6``v zMMJ5*|IUh(7JBg%&U0<5`C3=n@$q80dDwFZ9xsh{fX_^w?0hnak1u33-Z->#%|AF_ zJCjgLHyl>wOIOaUnUtuNZ(BRSQ`Srjvdr}!CNi-bUnY$*vN?0}iEW&Yh)QhW-26*J zAokXG_OBQUWM73pEB=qYtFty9s|}~(_Ls16HBHXHY`(y}eDE$?oW2X9W234s zyhyU}s557FyY_qtnmyb<&dAF{@kTA2u{&+lqcxzS9Yo;iX1o>qGWxhtzMqq9`SNAb z2Y}muXyk#S9Di&OPpKfk7&GRakUkGZPSHTv(icFVckO{7YnF;Ial93itd4R?@d@&u zg@+2(@4kNO%z_%&WRc8Hf{DqUEgdOX>Mzaq>_QwkgsDoTdx+pLvNEJbkw0@^#|{$m zSZZUEl?4?Im_w*^oS?0ph4zy<`i5u-Tk}3AYUlK0EiMjF7OWrpX$(oGUe*cXI^7a_ zze=bpAAHwRI9=1NV(Xf+Q^MR3(_0{xQ1?h4jRd-y_XnJXc^F?~Rj#I0@11|Ci_1+A z)_A#i(>i)eC`>`|EY!u;M9_dH{GmXSYq9cd+d8W>JW>io#OpLl_vpX2a03aGQ1EX$ zJkuk$bI^n%Qig!+KqN8YjnlzE(!B+`>Z-g(=s;u|$A8#GNHo)%4CZjb2?O}gA?Fkv z^No20&X2X+t;fqFf9l)Ma}Tte<3fsa&1CL|v7JoJEL}~TOGa=lmz!R10JxUXB+;mp zEP!y@?AKm&b(8Q+3OKKIC<5pPB83plZ9O=K2bz&)c=xA0e|8K}N{^~kUMNpCI+s>`Dn@^7Hy6B8B2X67^a zyOZ;s-pDAT3ds_Bmr)HqIzOU=%}c=I$*|D+&u{jiXXmQIZ4~0`cX8bb&<=pz^=)Zy zZ_}LwvrL`i($^9#X#&qf1vt2nXoFx#=vJf0F3hlWHoud|r|bX@&(AQW8qE+w(R&AW z#s&b%CH27sH&!WlVM_T4;F`OH15X#2-YCxvWp!B5=5UR(5jhvQyrL@)&OJ2D^h@k*c`_ zjz5m;Vy9AnhCLZl9~!D%G3qY33d2nQxo{+$U;t>k(fp+oJ*&!3JkEH$$QR$;odwTfw~C*zMqBGUQ~5!^67Z)U}>mu->%9vO_@j6nt-QelYq`Z5j zz}49Kq6D{SXg{O#TrLt#FQ)!Yh^4asJ5I1@{KfL5*%Kzc zd3ZMnKm$O$vJ)a0$b%Ux{y2q0+~E5_!`C6Y4c5N9non=+3_W6uEB#9`74Rd<}NJw zeWm4-q1u95c~uoK&vX|@HxRqk^K<2Pc>SzayjN}&cC((s5ovwJjhJ!DN+Ly#IW;sK zUkFnLF0*>K@hLbUz*pz(LP@38|AEl?&u!3doDVK~oyt%qGaErb$YvDO_yDM5w7nEG zY{j=mF`3d4hk8XsBB)AG{JF!T`(2r|v1C090J@E2R$ z@Y4UlvnyL@HskQva;?9Ew$roz2%b5Xegk=~`2>HV<)0*2n^12F$Fq7~r|s3bi_Rjg za57&2Fan{mEObZPCB(W5K*z}ZLBM}5QILbf#C}vsPfa8k+xKZ(~*ch zyjw!~Y&s3{jXw9#>!;kytl1Mw7WovX6B$THA^ke{9h`Wpzlg=Kxo@&vY||Pnpf~0h zvO-#)C$3cUe#75YDx zr$_Bsx9-nBuhD5Wy9cJRoukfVC}}B6Uq^&W<&wTNmE&e&TN*@v3;(xzk=$*1 zG>2!pEF`SQC1ypNQ(pZcQM>0j{&s81AgqTiFu6xYO*M!xm@Sp2 z2?q@1CZE#0aTYJj8-9i-M*zvMN78NgLY(RHJ()4w+qF#@vYktG_$>`Jg`TZYR`#0* zW{?#UG~|ZqdBOd+qo1}O;aK^F5qtebLa}OBs{@3glc$V7{xCV(j&;zcqqgA*p5*=U z5CLg_^{?(`_0vgntFOyR>5sKc=Bg?O5Y;4getC*a;`Mq54!B>f9Ch?Auw8AVS1P)t z+GVDa&}gzw1?R5G$e#Tg$D`E(+8$xUf1nJGONe6x z=V!&lS`h@lb+R(jDJgzXPt#_fyW^rMy`Q|I)f8>lIl@#(OP9Z$8taNTh_`pNkH#G! za6j6YL{ZIb85#Qd3HfKJ1Tl-_d=y_@VIj7n;_cne3J`%*TAx1%%JRwTpI^WQL3OOS zUpyhR`^W#p>7dDtC70hm-%gIDOQz1-e}lMolK_I|j&68BXV|`)?PYYE(cK=>>Nr#l zbpZkMrn4Tw{e7$`A&B-JT&86nGgf8V+~?8rcMnS*OjFbHs%rfFmISJZxHg>mSQ5*0`K?r*PW2dPx>LYe-xy}YliIxP&I8a5j`_^X3 z2%vAKZEloQ8UW1c-S!vv7ME9N;oZCLl=~+x@Dsp2eDO|mF(vpNcTe?R132c+l71;Nx6pS1mlSon4TBTnC#M#9wEjBY@L;hZ#X^Il>x{C%kybSwU~^oVrWG3f%#XB%_IWu)+QJmgrHb}UjPU% zhHFKBhDg04a9%+HL=G?|qkD|#Y-f{J;QJQq-S9weQx>^lRIh_4|0iMju=hEgb{I72 z0OcBQ-g9F*9nVMN-(q3}DxWswv9f|&E4$2MCJPBeIVBJy%*j)sJ~ytj!lTj{0b~%y|1Hm3%7Gzge9fyIP8%7gU1mMFw8!` zIVxw4f!8zp$3RtxnVJRfDD{c2Zj?xNb}Or(!KZUWNczG-I5-fSdy7n_Z_mM{46$!$p9?`?gN@f(UPC4 z9UA@s1rU6YxlM6MJ$Zx_?B4KJ{v2}SUK zdB<00cjvqFz9SWn*4>m-sQd4Cv6Rk+EA>9tUjow7v|x?_83{LIwTxl2qZv%_dfPT< zm-y?#vaHyLj|~_K-wxg4;jSdRdRt~yPBieWuTE#?y4+EC5Hjym&l*uLy->I9_2OS( z0%+g*hbG&m&yN6Y3xkm-dNWSle5E`HST@3tb^Ov@FgxXzPiSu#DsgqdQZrbf@#JyA z0t3H8tMTqW)b7EP>w2WzDZtitF0Xggh%lY+Ek;V`ab|} z?C!Kl>?zy67W<3SiXE5;!^>ThLr!ZP{L~uhOT3C;B ziAHO9C+Wti7?nmoW;Ux}B5sC8}$-A`rv^$y-=d z7aX4;d58%xDAeI@k)Ck7ywO48Bdm{%Cs)P`4sie94-y@?5Y5MQ^XaEryO6Cc|FMad_A1m{{Y=TzXLCdc)fy41#yeRi=%P zmvw$?lwSzunm?y``${WV-}{Yf=W2h&r>J}SY}q=6h#HTtpn#%E8B3zmMvp3#P`+^Q zOQ1+1OR22L3>7JOlr)1#=~w^F>Mzf&#G4Z#1z9y0t*y91gj8>IeqYg_^R#Z}QXLwf(%t{KIjabtY+<)f+gm|w= z8yTV7*aTx$J#8mvQN0*HMe#Y$SKa(;x}#*VdJZ8H@eF~%^tcBHo2e3R@Uy%Iae@5; zdJi;ckp*&I>goh580WdsoqXGn&i{?$rszS!)8s5dgs`J zih)E=#D}7#l;`ONf)K%S^TOWsvx0Yxb>E2s9uq1~0NlEw(|$B4LW zvoeui3I3~Vao-jV;|U4Tx)bvyNQmHRRD)8?L`JC4>MnE z(v>JAtB<#L@5UP7+$gAtgtv>I_-=#nq)lJK!SzfgR}9W36tR%dgrc$gO+bV-3Va3F z`J%0f`93&y0z_|s7tjSTMcplkWdty{m=xO&Kp%Rvgi6P5KM_tKu_Vr=2lN^1=X~V} zK4#J!*5y)*UgZ0p!)qSuP2hux#)yK^1(pn(^=ORG(bAH?%RP|5+`2^}M&8oqVT9X) z*9~|y<}084%>Zih#rX5{)m2f!(6O2?24+HCd@L;Z2DT`GdOoD>fR``0UTnU5GPC&~ zeHI)JYX9UJdpA`T`R>YY{EA@<`ioaQe!US6Y#Q!^Dr84yk(^bH^q0Kvd+ojEnrqH6?s1QM z%qiW)0b)oR>D=0>?n4tc^WApSkoL86bBni%Vi-jNeD+4g`;3+1cm2y_Y>NH~P8tN)T8KtBUfKr@mDuqCSyrXJhpBE@NOMkX7B< zF8{)X)M=0Pq{C+d%TEQL#n3UW9_P*0?8uIRfdMCGsb6lr$LMJ%+uI2z*WLoJ`&L~? z%3C&sjuAB9PPYUP0MX^+zQ zfs*c0+n9l z(SXGU3*7yvXF&1$q-32#&mli#1(#E|zz*oZc6nWJVb>v=_4NLXLsGC!bLWKF;pzJ4 zK-(+BlH7R{M@wqi%7m!6s*k5d8jTP%pm`a%3)2F;NX$6Lmi;@S3YWfohcOG-F3InU zbXJg@>o(h!K5F=A7~C-HhKd#v{fn|Fo)!_vXPf3FEO|(}q>cV=5SVgIX?`?J&hEfH zu}8BzJ2xYDv?|`mBftX+YlXnr+a`%(9UUDi4-bzxyu>$Ei7A?GYX!t^&|>h}FO{=C zqcXT==9biKwb&U`a+KJanVEdqI#5ky&(;i|+b5>FFFa63u5Fxo{9op&S1ZEqv^~GD4#MM)u z5TlAXvzz?5>^nJn&09OpVLMy=c$k8+v{3YL+xvzkTz*~_dQ{uC?A`Me<`!hiIvUFF6g`hKPk`PXRe}NUU}@wFaH#Y39->J~;<#n%#qU!DB9oGS7HM4b zOHhh^S%v-j^`7>XG2^pmoa|G`%`O%NyI==gG$4DI9e6GTM2D#YPKZFd2iboGvZa$d z-M`+i-(4p77My_1>EO8yplafN(d+>e`SRsQg~e1Yj?>2QT@aAhVgrSbptFw$MoSw_ zOnSQP`$1(9^+qIVOo{5ep?Huu7$8*2zo+nf((1-X zY&_TRL&M)wb7Y8q8TcFm=xRQStj^|QFMMp-_JS?Ax@_0YPdL9GB^?JRWq*k_LQ=$I zU}eq8t>%7W1cRMYu4Qdp!_PYY&5eQbn7HiPWjzmstH+d-^MA+(g@3(&r0wBQ^7|(|D7ETbMxKm6JUEyr}(ZGUe7Dgk-za$uxa0w zzd>Lz=b57;e03za4gRwlv3^5XVU(F&69{a`AbP@=@2?0^cW@ZaI+0&yM5wh zC>^dA+Nm44-hZBw1Qo(d@?FWU+|d%UzKlxLE&3{>sQN4jmCoy$3_x{&9)D;b{$Agu zXPo_p1?>;)Aym~@{8@7_zlf0i-E=p%X0hYG6zh|gQbe|dr+7IeGX1F^g`uIr>Dzht z{sy$tT#)(H{n&AbtbQlvB8Itgkgl`eLL~pXs;bINObwgXs@MxeZNPU0A#?z5DW#az zGus+qNgmw~!D7gQUatk~epK;KNZ@(*u77*K+I%ezKYqSR0`%2|*PZq+t?RD)dY`PX zN9i8O<*qcTB4*gwn4RX0oxx*xVUE}>US_q2S^1`v+C(URyDYOV>632~>BO9BvGP8= zYRxnqJhhP41>s$zaGiA8$BA1$f>A{9Hxnx!(YhX@smHD z?O_rPPYOM9pO{QJb`hGTcn+9C+x;7P7OpeirKggSfLhxq6h@}*c)tr+dN%8Src6OI z-bAK%*RZuv+1((&2<(cDjt`_PbobiBgKMq|YNF*n`z}h?Bdwz#el6C#aT>M#$z|3_o;k=@r68Dy|`o^o=-A%bFGLsjW<6< zX?{msG3fEszdCw7G5N=0(E+)IzaMBWbIQwupFKCW$f^nNc7YrS0V17-X0Q#=)IAY* z;%v;afB*JzO1)|I2P)3GI%ewkwS8O(pj_sMyvGL%CU^Jk-%j7Z&p+GvHaLvtw$q0z z=uF;bh#Ek#zr9V%XznhhJACVzd{Kk>{zv)Vk{4gy7~2iboz75>P3H}p%YJn^O;~d9 z!pe`4m!q@0ug9jtEJ5LqYow1($`An>ro|=a zZX8~M60Gi9VdAHsr9ba7#FxMBSlhh3zS$SmZUq9CTr`I12Emv810e(SgG|JZp87gC zpaP)17bDwyWLFx+FGuo8MzKgKR>oB5$gZTyBw~hdjAZ)s%4YreN@h;;ul3Q=fb?FMDFYU0#V%T84zI!y&&AjbN>} zaY{x_gf#}rWrI|KV3V@S6vi{ZP6H9Z9l_&W;BQj-or9Os)j~^KquT(?92;B9tjms= zg%Dx^X&6u4w%rxiD|j*^oJ>lZZggV)$JZIa4qvZavCRs(d58dhp9X~UaVfPk&6fzk zDrWwu(Mi$G>-nIEfDLJcW$j>zrcZQe9ZuI{wX&aG{uP(u+4n&FHrEiK<;+^^-0KP2 z6s@b~10Erfm6_!q@3N`gDWSBb#mV*9`oz~G zN?7gVmBe_-7t~(?fN2CC+BGRHbZYk{UF|Z~*CSwWWkLK@O-Leo{Zq^ZNNWJKLW7z2 zDYj?LmBHbp!X8EPsF<^ICi|}U;zC2c(fYY=z#_+EwOY^6r+#$u$z5QWoA=Pjb{t+> zP^B|5QCRdmLPV5}feTd#m~Z&Lu#zg6NGU9r9FPxd*ZBbECv4ENcz*3T%9HJ1+<%kP zlx~^;D2)5?&yuB>r;k?hah@k}!z2^DZuuF0ULJ>{ws`*<{4NbI|5GWftuWlq0}-<2 z!wIDieTCDm&MSGhH@@FH188kQ^c#Q?N=Lhn83NZUzk!2Z0D1h^2YBJ?Rl9L8rs%?w z`|e3?(-#+#iqz8TDUDf9TubjvI_;M zrXVDROdLBXGGjPj@e{C?cFHQMIlZ`|54VD#L6{++HVlS6DCb6bl1&3&6f0D1cs&?jUy{QdH24nj9Jc zUA%jX9UXX`h-gMU6Z;5kgD7pUaq(X~$GM}?pT=H`vnUEBfOy|fm9BLB$TYFNQcIYT zf0vu$BXjvYy{+Ueo4#)ArtO9=sgm{ldVek#sPgM`i|S0%Oa`RPm)-4%A`0`hu}*i; z4;!o3hQn#~_q7Q6k)0Qbr79|_eQ+|MzhADOp_hy_q=CIO=w$Wep6k)qkMv%x$YYzB zGWsZ2Tzy$*h>vM8i%x%Cx7*v$OMBaV)MiNKpj>qy@veI6X-I`_r@db}>gDNV#2s0I z3KomMv$__R+`#r!iexJ2Z4%|9JIql0@J0}xXI)sls4YtL?rC4pBm(Sw$ASq6N4OCL zKLQR?x-BUrgc0KrCOXl+EnoG>ih;1O@Y|T)TI5K01i5g3GDn25W|nc8z>v=HiY*Ik8T1(3lEk?Y59 zA|D!W&8}d~wgHsrdm|O@3g&40)0(H5fSGo9$&Vqe$VJI4>+>gqxc9 z0Fbv)Dk>>VwLOt^lok%T^r+6`oK@#qI>&07kHJ2)4}4m@=za!kbQT|-LGqJt!CFf8 zPq#3wUBpv2Bk8Q-Vo4IYKb=}TgW)(HLhffz5X&DtFZkT?xZJkvLM&%-uW#w;S#wI{ zMyP~(@At*jEc3mrDVd#}L@EIReKi}N0;Dd1aEb5q< znXTC-?3CVFd+$cirf#~O!RRHQ}9Y|r&$=YT3rAV+7vdSsBih2 z@rpfky1|L<`H~x4RU?;}_S#_Sm5BaRz<9={x(7aWV4pvm_<5?< zJHCaz8ImU*3p~8BuZE27eI|c}rOQAgeRBtR*c~<`q|}Z20(U{V+#@u?k}vJZg-M`x z0Z<+#I`U%(8w2z7EwLBg3Ee+FTI+oM{@s5ttr1;1A>WfUHFn8UFp_zI7`x=>&zzc? z^hKS*r+!l&72#t!c@?H(=2D6;a8W2k+u;|_ z>9BPwjXA5cTBi3sBp>O^9s&38llKrPSwKZz|KC0b_161Pz55TXi80yszimubon{#< zAopt)DuCAaRhj4w$E{+GSfqaF#xCwF+_Qh3ipvgk7d zsHJm#-+hW(d`uPYhx;3PX!Lu|&}|0#VTRMSCA80yqmSnM2b2+;ViWOKoY2J?&b?=+ ze?6S#I9I>8qpehAD;b(>Txg<1es<+2z!`cvUq^uC3vn5VRxj-ew-|dlyGh_nK*qun zR7Vur@NL%4<5u43+yy(sFJ;Q$=t^H;@YScwA}eQSE!+B3TY>#3qd=3V#hsXmasiX( z{&Osy`w7B{a=3;wh$%x)f5HwIb)&#pWivEJYIQnxO3Oct0Uo z&}Wdw;vOejBXlw=vQbCVboUYKz|NI=-CE6n0ot6x!XADZtBZq^@n?ZFZB(w^e;oz% z%hiN9-K5K5E%Ie(#(YwRCoX%7b}osDwKL21eeA^H>2r*04jtQj$1k36l4hH1n~oIe z|7_eN$k_YPhZ@+4nKzDD+4Wmk#v<~y8*8GG$z@V%(rX8vlBK%Gfi&&r6Ot<0q1irP zxF&cz&2jWNl9ufS^lIny2w7|!wLciM4X`E+CD4t0D1{x*xB4l>VhDsj-Y09E7VL`)XYBj2!w#6>+u{1uD(9kqYH3-661R-SRA&OV| z;91{xVB4-&p40hP%rg{!+euZq5XrPy!7+)H-m->T+eq3f4<)VZS#j61@R?_6lflMm z7}e(OoaCVxGKCl#q0iTgAAyT+6)7YYL0+)%Y!xe*4nl6PFQq>qzwCSaNj+N2K>S;O zNCm+NWH8%A(@k6^O-3rPFAJ}-k72tE1(HNV_w5{l$Agx?k0%7{&rsb&m9=Od> z^;FZ**(h}rX`M9uZ~>C{G3eEQP-1Cv6ip<>KP}l+5tGuJ;(VNC6f>}susYhqYNnJl zamv=&buFn<9WnSh^=?#M7*?ypByM0QW`M0%-G{x$nj}S3(J1GN!JnouG0B}>RfS8G zj1;A9ohsyk(+DB!Xod!xnp;ak8;MyH(Fz)5fFuT$*IFhAD0O9GiFg9hp0*>3m*s%! zy6|uob~Fx+aLl)uL=}7drBDkwLFEFsiHQllJkrLkp)4GF4TuD!Wia|4KC~ z`pDXgTU2yV_nC6?W$v8ewP_SSS0PKEGEl6 zH!2|O>%7WKXovr{HknM^wL7@QAK^g~zuwQ?<`kkE_SB%#(oxL4O_1;X7Or-5@Fu8< z1TE8sYR|qt&IqBY6=Ur8ZyrXNq$A3-ok^#+(NTmT38lc(^yt*Y&p|T|1dIkkZnrcD zU<)_K*6q`aCR&uaItFDU{@;A5gHl*+5=Dsoi7|_mEu6-xJN=#7EN)(0>u2|4Qj5 zRZ=Z(?2Bz?*RprlLC06gJYhMZ%>+jOj-Q-~ICywr6BEp!cKjoQ-+6XeA#ZlPQACab z`SRH|8VV|^3`8~E1X9erHs6Kv1PN)ay%Udgi`5T9RnT+Z0Z&}Kefn%DvTRxlWt-J+ zZgwJx|J2HIvFdTf__JaeEZ;@%hg%aW)zU?-{B@SVZ;j5YS-Z-THFCC%seB$cLdJtG z&%qJ}d>%Wb_X~H;{mls&-QpoF7^d| zrgXgs1=29XF9_^Xj>D4iqqpo zXvS*urHHhhB9UdxlUlj%i2YW*-9HOaMnr^ci@$u32IAb0+QH6_#(ewKU$V(FtIf_5 zo_lJ9oPj$E0M&XnwnA3-@*egV{!14y)8Z;tZtl}{*nj;kQKGxY%#s-t|E$Jx#ZS_u@2WwyFZ(XXRa6ZpTw~O2q!m-VV?yXSBQ?=64JXmwesVQdeKqAW ze3+uND{CJ);I`y-2$TKH>Se!hMsAQl^>(`Xk`j|l_^WZ+V}=De*ejzVmeK>5<4#}`{u}S=G zk^g3tiNz`c%1RT{OeNmHcUm= zvI9IbTV6)QaCs}W^DddeZ|CHmqORm_p%~$Af(3$Bqsg?OI@sRw#+a~*fC!%qQni(y zI&1{UNr2L5?_o<=Q5m{VLTMzc8q3cco55b4*Gb?-AWcK|rO(N)A^>&{=Qrnx9**#4 z;nLX_sCyxaD?6%$`%897?FE4k|vldF{bp`ihKD(But{{2R z3S;WpJU3NI59OMS-87>YZ7jp~ltI-;h~oG(R&$agB5ga@A4zHS0~6Zl){N*wkGTyh zv>e_}ai_3IlKuGw)GZa#_?RGc^6-+GfQdAsrFMU3 zN2z~p@rmLYG(s=X!197(>@>)qy^|fill?ivqQq5g?55pOFA?w(;cm#v3q~Emp9sq? z^K`Q~=SG1ivw~z7H6YG8lmEIy?h6Ws1{t*8BgN87T0v;D9nSx+7C^$JM*pGx({#%z zWr!T(@zm1P(b~bw(c~v6JjhxVkDbDcr^|P-vw?ZK_cbIHxj_!ge$EeA>m@q`1|lSO zIo8zH7hhxZSTi&8Nd+O~Vydd-0+Sk`oW5;8=D3G~(DrKd8Hy^CVW5?=C}oQqKW7#z>#i=a{m7%C z4KlSBcMKmNAG=*+E@or2R7l?;a@RIvLI*mh;wpvDSz7vEo2_trb_O+s59tDf-PXrRp#gd6drmDsHv`<(CJCHN^^)uu0Poklcn zb_$2o&Rt(xH0ghx?_h zA4PR|Gej+wUzy$wL?!lD$6;~tCsbjnpGBUFK z!othJ`*Y0+5nmjZ{=ud8g>H03?2n2%;jUpBVv(GPpA{%Ppqo=ub(?s+NcAv>g(SDjRuk8u>wx3^UA*G~5T%y(dIP|Z& zY#+10imj9W(5zLGFwDbL9+z0N8n_4l=_*%3!_R~f4{ii(EqsJV@#pEQ)!Gu$ffyRG ze*6vzdP5C|nbrOD7PUD#YwAvtrBeofiZ08X5A~Za7xSi@VU(#AXffmA;VI6momj2E zb}JXVzBw(m(+fm@R`&OLfU(ffnshKv$M4H@y#mt7+T&BU)=u-wqFZInC7(oHPvjm? z;m~D%Ioqo(icvHUb8eo$JShF|mlk2)m!?894zXS_`(uJH3+u>uv!&o{e7l*GCc}=~$Ol*>B3h2M81O zf@xYo{px}K{h=5%jY5;3pCm71@&HByknFFcq6tR1G~o2$w~iTZ+^P0_}5?ET~^vQYAwt;zN8aeau{A2 z-&}$8mCadRosCx~aqkMF_+;XB2tsa)_EK1DH5vT8?zfXTT1rY-rRGltH}1h%D9^5+ z7OGmcfxT{ht1W6=jBy1mJ<;@i$Nb`m;S&~zBT3?FEjNojn1h*T#7?u2cV%*lK<_$l zmuf~>PHN5y7py)g2jcH1AZg}*G^P9CP55I(+)X0^KqEILl+UWFot711rJQY+HI%%K zwpu3c8^-Ifv@XGkzlIy<3~!kR7y%rZ{MR&$2&+T3dNUVPqtCr#yWg)Jho2~+qV2mE zrZwL}6qwNclxw0usOu))SclM}O~_cE|J~+4<7Ss4KjSYJLErWr0a!Q=21w$e$+n-tiGI zkBZ7_KFv@}gW=S!GBsw~hK4dAqIIvZ#K0sM@dc0l*TM&JYkgX9X7m-`W8?M+_%~e= zcm&K;F7^EW@JGx758jySM%##^h=|QOH7XT_bdU zAzXV*nTJ`sdWxN>ei^q;^k(<5lyLR|O=i<~Qp~<=W)hE!JtL3-dZlx7scC9urZSv+ z4Vd<|>L~&s_x`g6{}(CB+A&jzosgzbq+N*wz_JJGia%NcL+#K2(=VUv485B(ezk@( zruCDfqYVApx#Q!W!efA&^(PD1-LF;%0i^FPH!xWSE=hvVU6BE%LD!}(EG}tC$sbOi=aPYZ(KIhB9Fmh zbYi&DxgZ@i&j%Si{d$Hhr@9iGO9hti)E;%*8J!q?QmDww>K~~%7p%$qMeny$go|ch z@OFN2!9{&hLldqUL$XH+tcbAV+Xau*Vhiu;KG)RL+C?#+VeTd+!)pxnZGMq18v|`J zfw?!T0+A-T6yGVCgpp&6Ruel^b1;9(CIf z_3Suu*->B_Qm^+qrQGYGRHSy`?a0@5yMyGJ= z4@RWr{EG+=Xyh_jVqtU_z3f}~ntf^w+AG5!MlVJ4^ptDxDPSm8^70~ylgg@8+zdG* zP8sJCb#kVb8Qexb}}`$u>si-*o^b9;Bt5y$$4JNJ>v zW~u6N6G7IQXP=#ucWt1}Jtu}{=C$_qau6}V2=MP?BOz*plUu8k+Xj?r!`t$l>K;|U zSS4U)L%qgprDI*~MwWgsrV#2X$2&nRtmElQE}~nF1E9hmMoFuRwFi+KRGX%96pdnX zTH5t@RC{G}$1^6oIHb2CB3F9xN?;)$r(w>Vx&~E#86tF<{JFWF^%upTYS;dRCn;)% zTwN5`iEy%56c$9E@HLM((b-d3P829=D2G7HBcrerr%fKV1O;Vsd*$8Yc+8D%rQ}>? ziKwl+v$Ly&mJPu2`WhOxFk{ja2h_(R3BgfSf8Psv#tD2+UVJq^J&b9bzL3uanV6_u znR>n%m7wA`-+|gxyT#e`aQ}|aFi{D`LLT?a^O)BjH>9_&7pQxfM1sy_Qo#GgjGySm z7*3e&gD|5>Oid!s|0+NP*P|J z&s32`9=^QPaX)SaV*yTV)YKoHetn*vn|mnS5&YZ>s-WT^j4Es9>XP~`G%_(j@4!pc zZ7S}&x2@eMgg^T4B zV4hbq<`-CuWfs8MfgN*mu<$@&57s9t4RqTe0zRn$?*Yxr%e#APSd|s#I%IL6DRJ(} za}8pW==kW+MrT}LfQh9-SAGuIR$?0`wdI*m-Tu*}Sm{4E)oR5L?A=0+vczQ8sv|w! z@bY2e6-qQQ#214&t<14N*+G~29r6X`*Y!+a+oLyN2ka5Z``>3HC}(Yqu^8Vy#{zE!P-?BEl1V3gqJ)!h%^IN zLr*CVwzN}N%w`XAI*HE7kaG1^P}S@j6^?YTpUGRdpCVHM!4R4 zDVpu&D^*kSxx5DO1Ww4!w1?s(Mxg@;1P}WiHaroEWqlOmj)!WY?9dAspZ#Ah9T$Dp zA0IM&K@^c$uHsAJ3+S88LG|pxi8K)pOoEn1(n3}Lm2h5yc0(>#&+T#AmmC}fY)$Nh z<#v%}PP^pp74F3+1G@Z3`2UJE0sejauFprk3;-xvwZ?mB5)I)j*DH{mB0Xf$_)04$ z0@lyW5VHUmSD&VP-SFd7{HbfvoQ3`Z0K zH!$oIaS0BoN)a$gET6=Z*INHt)){;W#8K$iLVogTsfwNKU&Cs#b#D5ILEfnG-J<8F z!3%i;=4-w9k@c0i%T6litm5$??Z!w-mtowdt5vVpm#q|EmPT5$bI0@yq%(ERoM9R9 zwDE6n$G(VJtCE8-)mKsQYxAU|V#N zHfOHd_%FT+wO}hcnZO7%cW7J204#P`K=4AE2)HoJG$bbs7E^1pHy#E|1SOgL{oe$;zv=Xyu+&pnh z+f41+7eHe)PZ|61THGQ&TBk?CWugrG6*aZ@|KWHB-*QBw={M?0$e0t5i%90$`o8l= zK9+qs8_;Jc;rY_!5Bqz{m?@ezke7HN?MVED)~ym{W)dk!T8VZ11=0&<9u!PME&{r+ z>@WpiZ_o}$VyPEWL}bQvj;bSpy(}7tK8AsEkTzPu$ zQ5||B>%5HkL2m+Hje2-csAtegOog}T!SQ?s{ zZItr&v~jhrEv%LVil7bhd1U@W zxH0BZc-&BtILNFt?IKnYw3}5uYkyBl)s59!JCdk+Jrx!@ncoTWmL3VNHWu*;-MhW z^ksZ-+=lxkuN#qZRVtI zM1vXHNx`^>4|XBM9=bW}EU|}#1nC13(+rLJ&b`>Q$nOb){n>HG9I~r^ki80hqG;cC z5Eakcuz2|FtEa=iqPKwLAXfrZ_{es9M_{cL+8th~SO>XgEzxT5WlB6)o{ev;vtuEK zn=KGuXtm7w8mc9{9+{~MVR8g(U?B%!UMmUkbqKVvz*?GkO!&adiiQcysg`00thio9(jde&T`iax%4JW|Pbxtn{W{B$9cj-JC z7XM86fq}7B;SSAIO8V@VFZis}Q{)QG68(A7+2zdDcQ!vVg^`m?P{Rpm1v#~3&4CHLLzTEbBrb2{)YfxaMKdqwS5WY3dF@3g z9wFY^LE4r6!)-@yHqk5F?Ze7rS#1=-RO{(9)*v3b_o^g}yAx5`2Vz*UK|$S7d-gdM zIvBB&PscX=7PehQk1o@(w|Gtd^&pdillqiV=tSNUo#%p@6HuceCH)HBqF&nT^)7c% zq#S9y6;W8KFo4wzmkpsqbyRpM$!0UXBMhXK25Rn>)Zcb@13jQBjYL1I4ZOmF8P4|_ zfAvR;Zh*$)ZGmC_G$MJDJ>SkA>e;Qxi+3xiNhc3vB`mZVe{URwXNXx zZ8ud(ImYdyZu!V~OQmy)>lv2Uh|Tjk8$-`z>G7i2}CHR`WFm^cx!_+|$JW>w0O@vp_4=86Tod3eygHnTr z41R)h8X&ueUH3Z3m^R{oMs!&0Yymka5*jw~m-+8Ho&-C|jn)X2MuWitJ{oBZK9L!} zsg?Of{UFq1306(7$VxZ}@`gSM0bqyF=!S6*QOH=>sxcGCPC8AVxR`?PvO_ZOHlszG zZY??|(V8$hp{UWbZ9iz_*z7dlcZ0Y~p}*4d#uGIu(b^_5b~(?GFkYFSfy7?8fKbo} ziNE_UTm?Jn4f4%YM+0M6CIL=|RlK}ZHwSm#&0av+f&q9OL`Vmc7SC*xNv z!B&;T!nEd6q# zIn_C)N4n{psP@#Ul>>$j{8XwWZK|?ASx8v~V#-?)bJaky%X6P&u%wxqszQHvu*Wim z7pI|fy8iy1rYe7#k!ET>o>?s!s8EdKmV>W4hMBVPtWom9b?tvH73THm-V5blv-d?n zGCEQFzuJ9)hmejdR>7}_zsIglvlXUldQM>KXl&{T`rX)Z=RIiLASZ5k3+$?xQ?jsD z%%rNrFdCd3Wf^g>&VJJ}b1eK7PSyY8$5oYc9^8uu)qEvFnV=!CEKkM|3rz#1%Q~s2 z_3$mrP~rWuksORc(Ec=3FA&@+HW{|n2hUTpOkSZDx_{9E|LC6)QKW-CbOH4S{3os{YwIxM(D+DLi~65OwtlR(wWH}!e!*wSDt>5O$9-aCdYpe* zEndxx5m(L5m|59Vwc)Baw^#7TD^2UZ7GgltKMam5jv>qC-rw5UK|Ny+4*KUIqXMu)QH=KXn~YeA zX^h5kq`m{c8FNW9d1z+f+ka~a*UmeOS^b(>%9*q>L1FD};G&y1u?T1hI{y7MS64KB zMf(dV`HHMM${ZQTlRm^8bwjH6|8`ca61Xmyq&|PW7pO#a{mbb2^(x*n`_Vni8xQt_ zVP#G2J{HFNx4wIp^Yp&X5^?XTn}4WSXFBdL1YFoS#_k0zZEkPhknh|+`FiyK^f&m+)x`uQ^ml9t zc#IUm!LmslPQ*Xnrv-S8xXWKdN6!*R=jTr*=5!l9pMUzH(D~IjFp%rQLv+6NOW0v@ss2IAXp7eKf8+>i=ac2*>9?34gtZ`%Bm}&c*y{MYo^=w z>u%db$>koQT3&gHAokvp6nr^DWvY>S_pB2McEg3m+n6V53V}->QaeK8b@iqqp^A#z z43428Avm}Vn9SX=zs*JXNZ!UC{8*>Rleahp&=+E?YqrqODrZPgPVVAB&j$+o11kmvBk) zXGf^2u4c$hXCCP7>+1r;;3(4TUXH<=u%+?EHIhHdw|iXp0D8Dy+P>PDvjVfWJ_z5gWju6%4@G@TIB;lvjNeg9ZOwFf*n9^@E7btUy@<1Ta=VZXpn1SR1QjYp&J+mA9J)|jFNy1Teyw0b zpoeWQNK>?#SKq{~FZL*@sDwi=aox#Nct4lw^jxDQ#tl3OpK@z8xU1CPUyAM_AQ%Y= z+dP17M-*akfO;N!-8(lZt-9TTX=Y@(xOp_Xk|Q$ru}~1l4i+&|bPPuJN{US_A_8dP zKIgqbkC!Cq{QfD2rPRRH)fmJK&VP>O>=ivKAs>ks-b(k}JUm%-bx)>BmZUy?;v^;} zj_(+;tT|KX(1@XtlJ22qWhIZHVaQ!cZx)4FdSyyXYi4fz{VRbdotw$b$f%0i(+u`d^;MJa$>@SX(J zg9B#%ot-)Ri?|+9(7m>e3;muPFT$t2ma*ZF3lzyy3%pWQ51BROc*!_>dVc>nFwW;P z{_~PICCWR*7RMP>1dqh919cQ=&nbA|Xisx+z-B%o>&?!$picv7Wc#OFuaQJxD~hWI zTFq``K9uwZDX1pXe&5)9Rg_z3`As@$Us&fr`{@@GroO;*I^BI$he0{FuZHt7JgaPDlz@VmBXO6 zun-NQ%%dl=->I_F!QHsE1#U9K8<7$CU{m}VFn6!M2e4aI|KZ)mVAJ&>C<(x5i{+>) zZeB2XxC&(+c=wDHpDc8y-G%|ywRHDBc}G29PV>lm;o`A39cP6Jax0SFvc$AtdVHZO zQ)Hi@aeRToH5B>=8G(MlYsqU_v+dQqS5WPu`W9!+!{E1Z6X>1rMbqu0T*#gBXl|B z`c_uHGg)*P^C$KJTso>g^EXlx3z^0g(H=gy88O3#r}$- zy~m+lzfEpIN~CciYmg%%BtlxoIAKYmE=RIhh_I`R7Jdx~1QYJ2sx{&z_yjik_`|-o z_}hAo5dHJPkJ*-ElYgPQ1ztg$L8sYB-^`2%VYxFhK_71VcMnge8xILHh&s%+iIO-b z9a`pqW&HbhgF)Kz*S_Gp`e|J%xaGJKu#AlvRtUF`n6I}P{**v+-y`~f1Zef}lv?`r zE&tHO_`_#Dnanos7o`sGj;9@7S&hKXYn8c2Yq1lI)RXs{c6*xp!}M&9=T3RxPA^T+ z84;nnn$f8B9@vAT`+f({wU=+aJj|)~SpJIMni8Fypt+Z@4OG~B{#DWS)9XW~VB(Ct z3t!Tu0)?g(OVlrO;!c{JsfxfvfO)MKOkS;xw8E_>+QZdmYv$B045+1m^@LxmTYgER zaPk879}|KQZAF}*LsphSL=N!*x?wSWJEWS6{?z*{?0v3ZDzK}$>=WCLU{b4{O9v?} zKWYP>CT`!qUMkt`Ic2$YiSfz_D4AF@-ik4c{q^w_cI~5Bvk6un^$uC{{aAt5HdTRfaBoVq)}Iy4wJt?D-dv;AEkzfr+vYW*T@F5+_S(ubQt za6n562^3`oOIKxpTbFW#Ca7g7-xPCLnZ*i{;gaT}Ku(U|Oy9^6l)RK#oqTi4)$(RT1r7Z3qq$kS8 zghvwy30t(yGXdP>Z0ZSAA*=biQ*zjTB6Bacxc|-Taj7x;^<=^c=YJgE zP}EQ=|NXUW*${trc(UOi$G7kQf1hR&rh*;)`J>MjkS=;fg*Ex$sv(t+od563ngoFp zkJ#~FU*dYi9I;n_U>KAD&itR#4@X$?1ohobT>Ii*{J1Nv#Q(gVY`d{ZB(T*+FDoyp z!c?6Mq#j7y$0oUtyLpq!&+#58>z5?>?!_xcoYeobbBGr&c_yI#Gv} zww9m&(IwiG|G@004p#~M&k^bv)fP|$7TheySjhq{C|ElCjLL~jGFl6S621^)#~imxLg1G$jnA+ix+#?>KR0TFB*T1)!OKIxmm-71*3PnW~!M}6&?pt^r zHG2mRuFyAhkUK|o3*LRHt$_V2>rF(%O@i=lTSNp+=e;*?)%YYjI_y>>rdWbWqqJ{J$ zI|(KZ_@_2~v0QSHs<--JwQufcJslBMW_t_Tb3x7rIDciO*Q<7)RSU6k2_n*w}Ap-^UNAcRonp(3dyWzH-z%RDSoMM6l0%CJO585Wt6VM&G%GG$)ImDw^ctcCBm z?)&|o=Y5{{{eIi`+rB@(->+@Ex7)N`>%7kMIFDmL_I*FEYd?L%*98^YJ9MQ*B_b!Y zeYljimq>t%!;WLq)XH*-Dmaf>j>_I&{h8J<>0Q2Umij6=0!DG-)IFMjr`0eumCYlC z!RBh$9MP%=EGxf-UQ2X+s(G3sEgFip{MTOWyPk=D*m}&3+LI>^euM%e4_EV3a>$>Pm(&J`K>G*c$MZFi4`d$6S3KehmIY_@Qux#eFIZqT1*Zw|we_bI)L1#a5 zYhl?wFPl#!9h^N+ya<8RWCO|`x@~d3%`T=L6QN5JYkN$Q{rzHRKJ!A@zs5+kF7YBf z_>1Y7Q}aU5i{ymdLGQHB-A)Ap0VGQTcU4l!ytURkv zD&r0vlh@N7hRmbR_Rgf!M%oaE2er-|7ki{p&b*#b6TIWqelG`t7INsnZBx#V1!j_* zDB({I$i<=u*4NP~EyKH^Fl7a81kH~|$W3LuWB5;>!KTLLG90mV+9<<%>{uW7;XLLW zn$4>mlkY`j(qvv4(#6vL`<}}%rE@IuKl=2Ka?cQY#0LWKQf~X^(C^f39Qlk3R-;zn zgeW(h2tsAtrepGf8!5Hp$-d=VR4>zSBSAlEY4NYIcKlp_*y0CgG%{icIl^b~SO#p* z$HGvl}#vy>Ypm0TzP+ zv9|p4pWVC5FlDV%rn@b%vYV4Ol)&kPTQfWE8=klU$vZiQyV04?l;G!s(SadEa9}{d zwVIdZnz;Vs>hF-N*KgFP|F>7K2)nPNS@+C!V0hDysCLrg?`?|2?Qf^S2g7Y9y0)9^ znYpIXXGU=wgA1$X27!6wN}2cl^@CLFdk3yu>)5$E3au{fJLc9F5$+d~ufi53{w-i5 ze%>un&FE&@^gf@&1CPJ5mPoI9tZ*6IE_8J}zGh$8NvhMKvolHe|HOJ^n9+c}hvr`w zOzpurW1EkqtT7Sgu@uV$Wd8v_ouvydZ62jh|J{nP8fF;1icz2DoLT~!jq2Yo$M)ak z@Bd}8AA3n{UgSUilAMrt*d}17{x=u>sM%iv=RXtbzJxh<+6t#ND1L%-8P-7-g9RgdWL)bt&a`T|9h31omu`_dr)m@=A}}hE3L2z^|`8VPjdzT z>-EwbABNo*|JP`FV)xnNzg$z`jp%<($WKnu|9|n4k{kytfh$8VF}>}a{+lcFZ(W)^ zBp~2#mZfkGp2Z&mZx8bKXaD4=`+)b*-zxx?pFlv^dE_3I- zpEV^!pMCyWYKIfPkE(g!P;P1xzU)u8^+D(?Mwm!)c9n0rKY*^(elnAUB9sJ^T1i3UEZKFbA0={x0M~(Ee z=@*3}o}`MMmOBXF*X}%O_QJ0OupP~4&>kBiB_jU`?~bkp1#bKx!e{o9Rz}Zm zsz%#=zS(_FXxIC4Cjnl}1|LJI*qzF9NlewAt=eIS&%1cb{mn3OW$p6uv-(&Jet^(+ zQu?U%S{1{hp{AO3+g(ZPt*1uFnN%0`!LUZB`iK|70;kSXp(G|-NXW3Wx>KllPqVal z*43V}fIscs;t75WDxICA<*~u$!kcuYi8G;SVIk4_nO_IL1P~rClb#Id^ad}=Dw6{a zE?lmATUN$4P&FL3W_br5#ho^&pWQvWfz4c+Zo26-ym=U2Yfw)<*6uO)?R!Hn#aXtB zBFq4X0QV*~M>jP&;Qg$LiZm06?s?0jEW+VHdy3c?4oBIgx%U9vwp7Qmp_=M-d{ z+PYSvzo$Fo_r&7d8=@M2Ng2)$`@IzJ1jo50d2Fy zO`bXO=Np*~OT(!ZzdcqIRlfTVuapu8GfjMEeaewVc3(L_srp@Pobow0cX z@gB0cK`V?%RK;*BQ0ctP-yLzw*>YDBSWpug;IK2lX|bxzYhNsnd{*EPvFB7F2Ru;{I-IY#b1Ct&)CpC+Pf~ecEmtiW;YljxBv{R7Pi1$TGaW zcwCzEOrA-3Sevr>qZgUG59_S-O1@jOwNLy}I#nyESi8(-KI)>I?Ec#4+$UU{DY9jR zPM;wHTv(TNBlMp^hW>6s+G)6q>8+#8CdJ)DEB8QnEG32@QdI-*Nq_s{_ezjlSDP5E z2g6ALf%GcK(2)B^Q&qnB?J8UUaUy(0QcN)ZRVF2{{%7BP+2nk~9A&;&emDaoBc3!3 zjkXtDGRNb4CbF@(uxTk<%T5^;c-l0<{Q@(;=6Ql+6uc873HMjZTInupnx)jYT(K*b z$6>e6%~m}Sy4n;jiG0AoO2WoVtB^^Rqxb>;-Q>*~6GKt`yS4=3MD%V;1$pNdgoLm) z27c}YCw5U&K2K4LqYWZ~^^;nD>hZ&8E4H@oOikSs*)6HuTpW*w$Ca{vXnPg*T_cDV zMQ{{bk@nw0i^cBx_ZMQBxT#Uxa^4sFNJb zuVc>A!)bO@YDMDv4>pV&sXfChjs-nYmJeO)MhP-_7|D&*pskR6qHp z3xLqnMt`U3E{2LG2(#`}F~8j}=e6aEQq*TrV)EZfJ_k7j)@prIJsx&4lH(PxUY{mS zk}`P&gL>C5-Zw7dFEtQ$={+T>o<{&|9w8S_sPKTHVDjiH*i|I3?HpbKc?0 zmj?g1eg~=@891_nt52NzJ z5Vf^Tf(NTHlQ_Sfke_qcZ6!IS(gdgtg`eoMs;O_JUtwE%oUUuEt5zf=9LW|R<(u0R zsTUf_#;hxJATsgO53MxSz0WH!d>u-*m%Lxx%wikHzD{Ae=pCE%!h<{~msw7(JlZuw zBsN6GH~!MRY*MNJ*xVKW_=cpFk%>TmKR)7y>OBLQ)MDi$)DAI^Jhb23`PIL5kwO{$ z{%qj==@&ikFA8!L1Wxjz)|I|}xW1yXIX`?Kw?K7+HMM4CQoQb**YkGe>{@%HtGUuU zn_JOSy%m82A7l+KS--gQJ#R=3#GeiCHJYgt$KBT_BZwvVkth{&+_zu9^2Y{IYJ$yf z2?wH6e&0JiDXy|BhYATvlRyUr4T>r^91hF;)!7-f#xDILvYOdOMm>GMTJF(A+e!9Bn_!$ypzU!CJrv&9&l*?OvYGSzL!p zB6_YXKiF8br2BX$ION7>m6sW7DIc^OOjQkev#J(X*ed+jIMwSibxZ@z3v;}F9wC$l ze}`#ocKj+FMN32D_Ghl`3;Y=a14HD4)iZabDwXW|jI~FIoxDtw+?e1H2~k zR5J9mn|sKcV|sCIUe8(D%qwc+vwPmYcuM!0tMPN>6#cQp{jZJWj&e(Xw=MMJW?ui0 z{A{*>u-{QaQSqssCKvqW5B!TL5GbO;O<{WLd?$*{gVr48Iyxm^LhE(eTD7+kUTxR> zh?kb}Pt=9Gs(mBZ21+g^w=L1p$MSj&r46Eg5wkq~SbHd?3oP5D#z&2LF~h{}NdEiF zUv=L(;b~ItB13Ykocl0Cp19Hc(tc-5e!27g&=7HmQL&jP=Id5?hMA*-zkscWEH4jF zN(N0zafhMzc!Gc|wd&qcPR=AX&KW+%Jr?HAZwqp;ka4bcK4`s;%j*3Ts&}t7OHG|1 zzxXVzT%>#r7ItC#QTV|~w0Lk#tHye&$&%culbNUu*;hh1A5k=2Hi2r>csb|L$auAn z^|*BlkzY&EXY(549t^yJvvd2Q`s)lmpYmq&g*`QiSQEbZ;6U4-`Y-$RXQy758&g?s z?sAj~-Jnz|9$kA^rcNQRC6%K1Y2x50sd64EX|Pkce4}ak3~UOz9n|&LmE+6_)|alnG1zQL3gXscaNSd5OvpZN z;MZKBlA*7yV9pdG)PNe_G5VCF{cp zwI`l19zspbDV(6$NyZI)zT~HJL6DjEolAn}ORe~J#oVJp@wR33G z*}~%Hio%t{ZKgZ^t64g6xGJN3R+RLti_d1W-cH;~PdL*htHq7EvM4w~cZj+r#%6t> zbiJ~BB{o&Hetl?amh9N&$J2RiSA{?|8yCkC$Am_cFCV;qmY*_h7jGJaZT9>8p`_JW z`S(_UX?JsVgQA}-PIYe+3Z4sj!{i#{&E{+Sy?t;;Hk;1!i%x28qK^m57#pV^vnIQk zl=+*k$h%N`)@7*t2~5m@^kB zaI{#;1KaGVKpV!v@FCdBuZ9zDD5qe%OoM+~>)GllPj7E3)Nkirf#vdwp7(WDEK#w9TtjSveNKq43$V*!ZjnKkF%sDgzT!)b`mm8gocirylaPVQ{SI zle|sj{dYPfYyITq<#mF{GDwo4yw7ZN{LpSy@I?A`z#ca8IE47=j(nHz>~W73^hmnY zHOoKkHhtG-)^Ma_H{6XeC)0w6g!g*el*y6mZvpK~d09E`T=~ttaR*cG4j3>ku^^nx}l$9iXd2SN388e%R?dzbmwE)xt?vZrCAVFNUjMVe7!vmFOgrug{&4#nV zYfKDJzKwTC9Z|DT1tI(yK@{PQnVq$V4%Xy_#mab$s>79!GbdK@ZUwY*uO+H8xz`aJgH1Ul>Z6aVlX*h}L3Q{3b759Bo*5cs$uc?)jq{ z2AWQlbFy}qA>P>hvm&(t8f}9h@ z@90B9Z~T09@O#&5sOncL#F$uT4ps?(R5lhPn>b$Wp`js|qb~w;ZookI@jVMFRoPK} z^*KRebFYAn$5*--h!rZ-XVOHZ^!3+&V$+{Xp(JL?=dUdMYIG04$28{w1=Jo2UjE#cx6Cyn4_W8{eJuNCPg`&d-O+M* zmujs?BF_6B@d#F~75IqqA%gfMWjq--K}+rVTxX6T#w4B8Vq05>WuIPpeU>Yh_uN-S ztcQFm&iAx!eA8|liHJr8aOe2<;HgkouHImwy0k_57;lP_kdP2kz9bhyZ#QY}gTY!? z&V3O~HW7sBHJDh_`Z#UXx4b-ni>S`CepVW6QEg-72bCV)u6y%zn~P3)OgSor!r$XF ztuTbA-|}2$l4q1SY+!6!dTSE5DXhO_lvYMTct@wFLasBelpnik9PtmKt{?k!j_ zWlx-PQ|*<*`3=NoES;p?8iE*D*3J!3^7&T9=lN~Ps&tzp*S~+$KZa^FQGAz`$}$8= zLDi6g=4>w1)*RItZX`UhRyE8k?`qng-TmpPMjUm`k)WzQDA{>tW*2miScyyrSHM!s z!}l3`YEolN9g1~;alXPsU2{XZG-Oe2dV1cgOgv2_k*mM`cY}pQG*eXF!<`3I*kKu% zmOW+oqZ}OHM$(K-2HfP#UURE@|L*L}_Q!v_u#&ayncTTC`kk5a4^Lg|&&s1mkE&^C zWFGB`dvsiK64PCz=*&j_x^|>Jp#}D55rwT9?RTGkbnC4$}0fgyQ z?cGoPZ#G3EiN8PYA8HYN@kSJCN=?YW2!JeF?Ei5$|CAb@04Gcnnj*pfZ>Gk55Ew`Q zP1SCE2uO+HUj^FsyWjp7!;BE5vgB3tT^#ua?`;0>zt|AxZAFI3@&Ah(`ahg^j<%3R ztcZOZ6?Q?ouXSLbY$PeFX|FA853t-f1 zjY-Ap))f8X$9~K?0yfaKz0>fA6 z7XvRRX!LBXtZ}J{K7H^`<`@(KuK!Po9B}jy))ZRu>7Z}$2cp`B z<0S%xhN8Z!Su84StX9DbEQ0{301ZnIOG!vPab*`(hnFcdkfz4ha(Z8v9l8Bs^OEbL z`YrbZKWz(rxBuiG*t;+M67)QhGKaLZw52=upyF{ua632MFoQ#vUbom@f?nY0ht^Qb znd^6Lh_@^7%SCL*JdOjvhW;-iAv4#^+*(wWJ$r-O$96&8R-X}?ep*yOV%6b>1CjOf z#%gN2>PsTe)lzs_xnrEC721FGo-o5!n#V%xo=8+mHs{CBN?D&D8#5SR7;->m3>;i8 zqor*TYa{&VT$Tw^KLiEOXVbX9gy++=xBl%rlkMMCRm>|QYxQQ889r~5IF9@#=ScD2pq7e%4LTaqOZ54%e;m1-1L;?xNtrvgLh zf{|`p(YKdB2I`>naN_Iuaksj$NflZV{ZknbYtT8Qy?8oC0k{B@D^#u%^Yv>u#D)gI z_&1Y|uEdZVl4Ah!pv+qWEUg>4Z$fcEORTy{MP6-H7363KgoU~f2>gow;XE^uOI~Y% z8=Gz4N{CWaD6QBe7ywWqk3KZCAnW#Jqx;kJ7c%mJ7j(Qcu7l(=L314^_{I7sP&QT0DMBi zz248~s3F3lLVV`8{fkPfZoX@9Iu8+Vht1c9eeH$8fOq1D2AMrhl zvheji`uL+%!Rd26XSDAi|AX(&Dk{!(pR2#PBT5Jf8YqXu@m*9X{haHU*YSgHWsEHC z!Fm8aovsZ>&@yo?&bAEnK6_3BK=;BZ0A;}HV#7(V;~(WO+QF2EfDm=ow|$VJ+wPJT zyhsPM$mpbsMq$-UKjWRpKcho$NDA-iMZu1wO}VS9RVoF90$;GAH`yml{XHE9*PG#S zh{dm_z{K9piL;wVutT7y9r{#gkr)A9S}gBZ8~d~d&-TK|`&pORxhcj>@R6om2|L`t zRsdyaVPrCvdE@b?-I-Uh?_@^x{RlX3CD*3GB}Mr5?asFhHx(?WHaQ?qH0oOIgG(A3 z+ju0z#?P6_r9yl`?kN>ncyiY1++6TsEncW397Ls1K>;CArnyggPVhSm;3`CoxnmKy zPAe@Xf`pW{&w3D~p9_ET_}YiIgSyCMS{mj82^wc&e;pCp*_XpR2T}R_!tBtg)Hwn) z8sBI<)FR!}_1m(p>F&}>=e>2+tUjm9fI4AMba#{LW=B_!L}ea{#R%2!3?3gV2F7i% zyJv+8bvmh&jqMi18|(pSW;EWv{kl~}cbEF6=TDK~a)4s)MoV~T(vwPs^G}?*us5`L zp}idUXn0v^ldy%&sx%kh5fedUu6W?%_JoFMh~(XSC4U%avJ0+tm|9BYiMm-BBnvxl zG;DDJ{<#HS`8Nwko>t1y*0rHM7$XJC#LdeXVaQy}K89wq}Dov{!TiFh~e> zX+L*$Fz?GFh>UzkA4ZhTWVLPKsM_dh(FjddxPDjH@95^W2*vjH_6TB!k3hhV6{OaT zsoJ6<#qSA445CjW)nRua?SIdNyPxLuhhvS+(AwT5wx|OJbh@JXJxRuStayty_SqK) zrSwG6hJuFzI<{V(o>sRVLO~L4vG1$MvUj zuJ%8H5P#=%=HEJcBcGd6FncQmh-dw4TQU^FC`MLnXA*(ZBXFGAQ0y8Qp__ zn>BofT_mCIWIDVE*5}iLrEBYjiMh7#53>v>c$6QP_{_u3eQe_v5h-~)moc~p{{Xl{ zWJ4QrmLGyTxtOyihq8dmHgynaP0S-`QcQMmSjcdY|BxNi=W&FM%CbRT5jY7TJ^Klc z?%OVfea~K2Xs-5XT)wwf<9;wllEQ9}ud z$z>nKadB{5fNLt+yR?f^^N_g_MyhP{qpvf7Mj)BaG-bn)1dH}D-*+zCRM6%37Aw%k zMUCy4#eWmVXP!Slb3L#5_>nqG7%M!%6P%PVI@Z7!7036zA!+40&zkJ`-T8Avw{Lq& z=QvOZ51)jc{oE#d3h{U9o6hex3<)V+%8?~Tc{j$i0FU8>TPr(L)9ISC3P z3nYVapvjhethLIGRa%x5CN&jaKT&r5E0KgqES?ooG=rG|e)ti<5aQxl$}11L=lB!C zy+3ofVM||}RDYYbAzf3G!6GkywcWykWN*0Ilh;i$u6lqO;(XqX5MQ^f6My7{+~igLIlO!~hb|{?C!z&-Y<-z|QPVL?7iC@Bt{f zv}%-XYm}8hlPmfBN|ZjwyWi`&&E@Vv!vGE%v=c18n&;b^KRhKRLJl8mNjk4{J zjG(n!iD7+eyl?+a@zUZZ71!p$2%&Ne&Ue42>&2PheD{H}&3R(DI}&GGKA5y>Kg3t8 zjLCLnJb3UpzYqfy0wgwJhq{{Ev^R$={;ljeX*O4PJIV}}(1NPtwv>%be}L^z_O&mN zM#|BnTJk(NT0nEhfu6rrx?^FkQ-BNpY2P!G**GkxJW3&dYWqSb1EqE#0bg1O z5PK2{FUP4Hb7kU|7v2*9vJiABEEV&!Wcug$cV*gYuC9E@d{%}NI5MDGSnpGpMK1_2 z+`jkKRIUeeHc9_F`+}Stv9w6>aPW~bq1J4Q#;P`GFHas60}zJPhRAPZkJu+h$syb5 zlZjeLIWBPy_sv}oQi82?(}2Vbo44*MKVcln zLW*GkYub6A(MGu9KZW2&X6Mfc9t2X_8pOx5BIWQltq|`Z9T9p0<#^k3>N)4cKYudc z*t|97ENc22CFGW5W>=J}ke*mgZvz~vrB+-e=wxR|l@RNnzuFs@$bFB&x$n&b&;`$} zye<#PZ+qG|Rt()pB<;R~x9^QXL)rpc8OJ^6OD@r3nP@lWT}|3|4ff%9S^(thxZlte z!Gag?JnMF-gQWE`RT*o98*n-w+8T8cVwL64Yz$IfBPpz%cR(B z)wQVpGS7UQQhM(_eKQX2)b{L>qJr|0T;t72t=9@VHY5lhW<;|S)!u>L;!2_Eg4R~i zLhMRl_g7o!kpOD9muvx{D+MS|U#v$5%5ki}op!d8(6p9-(qyaoA+KE6aWY8Zp59Qp zpZwZod4DaWnfhe!+_NGL#ALzwy8>GkKyBR>NO+n`YN-|F2!sd#s11Pibb@9VSAcqm zVbDc`g;%z=1R>!-6dm1x?`12ACT7ro9rrY21&9z~RI8u8-M^`!{RAgcu9J84XZP|l z0W-G$Y+uSJGz4tj(|*%(4`xZ3TT6IAaT+Z<2VZl2G%UGqXJRn zjz6an@IiXosR|+W9Y=e=#{dy^`3|&m1+ZOPZ-nc+zs3+O`tyd?V;+L+KYZ_Q#EoBw zN-eW-(RHy75?&;MG_~?am_L9-;v{!gQ&YQ8*F49ELT*4>YzUmL?g7k~#DRm52@8&$ zJP3);8gRZZ7RWRo0+yRuOjMYS=|Ei_wmu=30}&RdON?`W^kHbB2#f{9JTPha_5eB} z6UM@=M_mnm!)wtN=hX?#0Vbfj3NJps9eG3)OyP$_~>U;Cn2uHmh^!A3N zJ3JQI?HxPwZ{Z{q`4Jxk1wY_Q;E~lQ(q)t7$WkD1^4}Xime|wO8yDTX8yNNNf)u0> z;KPQ@8j?ct=Rk0TAUmw$3RUDom!}(Jaev=a|uK>#sOFq}Uc6IxahD(Exq88@&wp$g}xJNPQ^WCmW1_(J$<`@%J!TLr8 zdHK4v6jGLV53gs%pY5--W9NzscwFm+m9#QFc(|a(RB{nK+&+m& z%Htf&sZT5<(kkz+LV_UkQh^>fMI_Q%U_F!XRdar5tsN@w7Q+^tI7J0GAw&2+;3PJx zZgh8XZz!nD*8R?K_F z!mZWU^k$~kqKfl1RK0nWk+6Nj3_6?#(9;9d1;{qF5QP2FwtR^%M2Y{lcLq1GVr*nDCMKo~xC`iE z`AUtpR;SAj(7E=#Ii_swn)oz9u9RzHdyMe)BS5CQ&YF8|rrc~uxoM&reemD{HA0%+U)WYfETNj3Ybqo8rAT+0_!9TbOfO6KjS&3 z(Uf$3_NL9r_KeF*{h(@t?y;05>UrbQ_1vc?Ze{4v*cU6A5{8ie+`rLXy(<2mY)4`P zG@c;20+hIx7yCd#D1vWmhcNmg7qUALYB4 zPZi=1!t;QBE@kDz&y=jsWLSAa+|u}N8NojL=&VPN7)d(NnAEUY5);OepzTc~vSi0fB+RmLSbSu1L$yzLR`= zVejKG4QsH8L7d;*Bn7!GzqkpcGTc09Fj>CCWRem}SEHhV8YTXna z-b+gu47+yaDt<4Zf1s=igzYn|`eg3?wT+~~NObVD{n$!`*=KIpvg_pTb;gM7-%-_+ z=EUHOf_;a+?o<1pUI0?dJP_!>da`{>p{8AN1HNLNy!eF!__`<7Fk0v^gc5YRzJ^0{ z%68!~Y&H;3$3XuCRs9^&Q%+Zd`bMr)eiaKL%`N*1YdCXxmUH(d6oTp<&nak0k*R3S za|!(!%}RP=Cs17JcqD}rETGikF_9tplt9Fs1G5bY_t>6O3R0w+d-YCT-70F@uHp|b z2`qvI2cC#4Qss&a>2on`HVS1jt+0?D+B+a%V}RLiA0B3ctmKCM3XS9Tw3fDkUD|FH zuwOs=eCWW|gmArbVXP^@k2KYJfeiO^wWg}5;UTbwgy1|?HT?#a6AU%cwwK;dW z?5|F+Sn~M~o?OW*+4IxF#3r=KurLJU2PuFJbIOPVcr+28HX&cvHKMqz0q_knL? z8{k6bcfM@0%^dlFAYq}sX{l`}w8TXCyb+?U1eE)O?9754u2_@h7sU+g@hpgCIml}64TI-JSy;*{4$w85ByXgaSDcerrNGQ}HpOBIQ*f3=Xm!Voe;jH*F}uYndfR z0*&LlLpcc}1dd@0$0M4z%ycbrZtJ$Bl!Gs~mtT8J#)a;hrW4514(`RVU979$T!Mt(^`@7g+9TO#vf7B0G3EsISm93f~0nGm|rInre8rV%Lu*L3Z(4s1YEh zXU{vasKAkrwmyW{)^9Az8#g4Lmp*?Ct_!sn)*I< z(elj-xA^N>GokMf^rJ%i^>(e+63B|q1M&&M_=K`?J#U5PCcNNI8_YTY_DG|4V{6vb z4{bx+ZVM~+rnm7QZteuYI(o~oPlGuOiXjTJDQlonZUK*WgKz`qUzVnlE{<#cRBJ(R z0?xR$YN=twL0o@I;;q3nEiOtxf-|YIE$my&s~qPux4!>NamKz75l3|zU!TPkVu|9h z>tkNF1%`E!#tvpx6hHvTrj0}iS(tyln;y6!@$PFd4XV4X`HlnWmtV=lJ}36VD%0ud z>9sA+-48nt9t0CSj=TR>kx2U*kOGj4XU{!8WrmLlx1pGRF|l&D`{88-ldOxqB(0y? z>cADd43EpWlcPL3_dWcr&YCCSwt?K!c2=uQ3|~wZu8ZKHF@W+Ky%k{NfV9_LNPAt> z#DC7gFVRcVFB?YOEvb73VwoGp= z3nx-XNEcjRlRgdE z4)JmP=YRkAjTQfgJ_N+g@}K|xzx02k?hW<(fAVyUd>hC4$^u&4fA4?SDe`~!hW@t= zE&uH>5txg^S13I=eez8J_#!TXw-XFL@VFr>3ya0uf`1u$swAMmu}2YZ3qFFGS3U-g zR8STmdw}iZt$1~&L-0Bi17)`7M7nnP-<=~PeQZ5Eo2Wr4T0ff&GOvyXG)pZco>uW{ z5{D75={T^0h>Qve0;;O6zW!-5abe|yz#Rk81C*+&t1D)}0~#NMy@fwQzya7Sd~<^> zP|b&bt9B$w42d5#z{a1(C;4o=`ho|g>@T~YH&9UkwV_1<3==&N`O~Uk1X>}A?#(A) zKE1!9zi(@6rz4=Px|$!c00Sk;JDd^QQ)mVJJNW$&x<#|`G?<>pz%wq)%*qXds2V8b z(&v=guhXM+cf5}PzOM^(_hGUDkZ9CLwtzwh99Ud@rS_74bEiJwtxynv?z)^XPA%~d zj4l8{X3S#{TqD5azLIR=Lm|)=X*o(ASy;A@AaahEKZqjG=BUB>4c|(DvU?uZm{cKk z%NGmO-jgWv=yIQIs;4e8KPGv(rOOo)k83v%Z?I`XbBZT8+7EbVeHbv(a!%1;qTUWz z5PQfqh32%U@I9MT?Spn1-oQ+@Rlf(Y3X@Y>@VCI zP>9`G2PYTUWm0?hvb4YAZWUJr%2qptL2tMFECyN!fDoXCZyMwwoL%bVYc}SYcEbtZ z_idfZ7!j^p9jw-ck_|ig0Re>;(<)jsUplW&X4(ZaGQI)cMo7uy!U~c5AA~npf54gj z=2=>PofW8CV>N9CizAkgWD)Hkz#QSP*rK52$}xQX6k-jO&PO*SBUb?O!sG%XmIK5m z0I>l&gkvhUvXUC=C-f;`iwOl%i}lfWsDks~el@iG$HA4(aa$C^(?b^pVj%+v@nBt` z1thW;C9UKFtVDX&1Op&jK+-1wlV^VzUmzmpp#U)WQu3AP`_S$zm3QTUVn=dqB2g~z z&mN>vohD82nu?c40N;zM{#KCzT~PXm4~#$(zXEL?j5<`kkFd*rcZ^fvnKBFzVd8u6 z;Hqf{NhXfBu#e$|c3NePav(kfJ(UF}4v7B2?MfPOc07Ov;^BB5Dg;imfN`i6*dfU9 zb?`sryT!$PgPx=Gn}si_w~*fd_H9~}VSyw^AKIgVAP;6CJpf?^X95Lz6`iWVwFPGo zI6>{+8%ER}0(r75z!fY;AVn^XSW*j%WY>(PLe58VWY4J1Rb2n)GVkzWi$)ega!5& ziDHz1eb8VC9CJGZYlA|y{MBZ}YziK8%k`b2|0PCm`kv~h`0))M z<50g^L8Xm_yMh=~GWL6LO3=W|6P#Bt?|F$sd((biL;NROdJda&z}Tb*l^W)NJp2Ss z(hYw68V+upxIz^sMCO9#rypO8>|Aht2sd3XmZw1XogkR=4cXA(#X+RU!rzmq5U6Zm z0z)){5~r5?o4Zwz;UNDNz>WcKQFm`B&+OvU`SPWiZpTDy<61e`5pOM@YB%QtPjqRv zOjcg4x>{=I0lMsXE%0=)1->Y9R$!Hq>T&K(&pJ$%_GKc+isAx>Ah_nzyE64cIEv~4 z(;W#E)>v`MYqT55rC10HQrZLcsPVY3YqYDY>sCDr+~AWTqxERAeKGyLSyE+Uu_mnH zFjkB6NtT6u`J!Svt6Ix3taf;r;*wmC%}M9Kgdk8a4NEQQ!R<3LQ!J^jYMA>UQjk8T zP0u_HQa$2g0-)@^&ht68<UUs!Q+ZeL4I4`{uqU@R3j# z*sR4ItQAsY^uAup9NaM}S7rk%9u&mONHPFFQ|)l{xp{|e>3@-lDyVC!8`2hi+Yits zg3SxkQN{O$MeEjMpfhJ#NENz+u1S}2Bn&tbFi2fSRFy}K@q#U9ASV>m7D57t5GauL zK3TQpuMA|zH-~QJ@IuHW;K$mF0@DUNq*g<*6JWUMMziAtG#O;W!M9~A$i%<^!Ma4Q z?AIaEV{k{o|L`457oaUb29~x3YWx{&F2F%qAN-6=(ybonAD={bb*-wgFzlH-m<%}- z%24DAcdG$SsPlO)C@Qdd;Hf=pGsOaS!>eD6_U3_cJ{5mSjwq`<>YH5wIi3!fH(>FA zk}#+cgu)72x^gGEBL1%yoCO$(rFG||^n%e|xgUdT$3fw~tkcMGmU?07MS`0qb({jw zWyoB3Op05=v_ekJA|^KQ9HCUfp8y=w$a4HFtaY;u`V@-+ zm8IM+*gz^7>Bv7{otaUZ^u7d_g+jSk;;V-NP!I`oq#_CkaS<nJ2_90eDVGR2VP| z9OX^lXqBTmIgQEA%K40~xfQ?(sSO~8oxR_O*XBh{HLy9L7q>EBu)OOu42OwoJMZQG zL+C}cD&v9MXNXOkfdCE=;|Lg%-vsV|GuSmVg;;^+6-cOjm0m|sG9zkkBNGpa+{f1A`ZF&ueL@b06L4y#uVCkKZ%?0qzd>|2@K3?i>8}oT&D`Il0O1RxMtpYQ zT!D-F9tI=vy9q5Zat~-;;G7->?j9K=*e~pPz`_OLjCiMj#6;LYpmcqAt27FO#Ni+? zuu0(gt_8RQAV*X`TOhrl^T5TA@mfd3O%FR)02YE|2W%k<1y<}?cgf3e%oor{jz0;oXWe9)js}K|5n7p_7I~z15?X zJp}?*Ae6nCcX#c`^a}3U3dqZo1Ck89(?}tJ*n}Ng6&SBBPF(}KGFTT1PM)DQzz*FX z;O)}93`cS5Vfq(epS{yH4rydzAxvi4lfsLf4+2-(m7%Rif$DWTJ7+UZvoWWFCl#Il zr-pWzjTwaI4cbs1rm~eXD3oxFBnqblG(O#;jV%G%7`4R`AR!>3{8479tPDivbDcNg z-cyjdV%S(mK_8U3o-*y-Xr}>f{>6?Y#LR_qeL$%(Z1rRwh&FKv^45S{;g!Ux7X?KsV6Wedgg?fSyYmno)GO%G24Iy{j}FkWEQbLjLP`3-(2Fm)l7Xs%63z}9Wg zIx*hl{25pUu%?d{_mkJ)0Om#0p-ZrNS*4c4;k?>&T{uh)2t6|MD%#(_j@NTp6$7q? zku<-bXyUKn*zAz}ip(~|Xw1dT$QV%#I{X*^`NzG)?ah_M^f?n8ys5B{T-&+eUP;hI zPDLW17V2Ux$eIPaJ)mMjNP;i=bjLQO?iy-6JS_%ftq1n1WdVjT5HNvdNx?V}V~;-^ z(Lt;7o~ZK6-UHHbX=$=FI45Gk-d&e72U-TIe^WhI^yNyd;x)$nQqwm{7>5Km20Q7CIjMRmS5SZ{Yv0?Vrc;|#6>x?FamazBqPBU{P*>hTlFDK? zj|-X%I5YvFcH#E)-T76em83WO26`lf&L5Zo{i6j? zo?)4ZMy}y&#hJHCx$9}~WFl6R6@oRpiebm$pCW~OoK)>*`xQ_xq#3Ti^g3>wM{3cF zh^du&I9nKDDCv)vIb3*m6(RtjHgbx~@RW}0A{&*}=6=&M>o>3CGqP5x_~Irz-CUH~GX4vkG5 z;yy=~0m;RxuLkTsZm!%)_AV?WOU>(hf~tJ=Dr})rfqkl=t$-6MlL6_UF`N2pWKr3;^l?m>y(xd>y*b!NNkdo;VAg0tK2-rOI%3)#0U`A4DV#L!Sn2$I4d@xi0F7_6aKJ z_%_)DB|Ne(_a0C<0Nh0YChnyC1tjOg`97dKAmNE53}>_@Wrr-nX@WUzY9LP!(p~dE z47mYmu_17D3|xc9%v@xUOb8wbB=G^xAFBj1Z73e+uKFcEOIJ~d^$3phPKhnNI!p82 zfJ3nW2HW#WEX$I*jd}a&j*fdB>Iswr3~^m4}I)z2Q%mf96_Bp*`PcQ zULPRYHKZ_Q^mGad4KQrv5fn=+u+5P()`g5d$|@*z<=+Q{5gnweY|wn~oK5-4)mzX* z&m2?G1fS9az?F#U5jffV@Vp1az5|wG6EhKO zjq_H!q%$DB+=bWv-17~Ew&dh@o*x!d%Ug#0+5m{s6E#t{p{D+LaveEclha?Fh=b$PJ zqWn=o;?xvtj}Jbh-xU38=?!U?_eoDzy>|si_NsJBtCtg$c~)+5UXT8vXrrO*ytOYW z*VQmG2$z3P)mPx*w~+Pc?T{em(R)|dBQt=8JByXbN1Qq`S3iSp7-~@`_q3b-dy*!)|zw7 zF~*#0YP*_K(bnR%LuyxS{CbEol1n4#qzBr5cb~RgtZ*&c|IxF6om*%Pg_qx|8~5Jj z@7)OQ#FT{Xx5OyD8po8CtWxw@yAagmMz_VII36ASifSfqWi;7QA!5tn@g$;E0X~Hd zo>!^M(C-DRBrYs%zR&p%jUn(27lRV$fISpBu{BzkU4y5-57isvwjq+`bd)mBy@ZW)Ud8?Mt|yK2ad7jW9KY9D$wTF>~FJt zI`1Dc{2q{Lx6(FDs<2ii(hbyNcr}RF3qgB%zSlJ2Alq?X-fIwPA&sNxi)EnY$x{Xv zzVdyAY2QAtMl5A~i!^@#5Cx-2L>(G5)${Mu`qFm%PQ`MRfDN-?anuNNVXtvxaWZ? zl>dkB2nY4=vM>2Ns0cx&CAd%}b@b5>BXCpQpTBM<8zQ>KuV+lvgz`H?RgPg7=&zPO zSsy^7oPJ`Bc3xXOVb2{{j>o8t`72fv%=OP}2}4}#eNTzFV@>1#$QjOQH`9CX6P;+V zo0!0K%aHawh4do_38MrFV{$u{_k$-MC-(iMrn2hHp>$ufoq#!1?^I~2y8%PyD)Z&Q zkQiYwI&c&)3EycbeB|pdr;N%O@N^PTA>X6(KAO;OoNDFzG*Xa55Pk!^I#HwAVu;wj zu@OlBQMpTNanrN2s}Eq2BjN_id~3y=UHh=LL40A)pCxrJmsBX7fhiw7j@`v?qkG(- zc9AV)r(ZBM+yluCg>o$^B6I5dZ--H4ebzv@4InS?0?G${^)3G0V?V>rFcIQN)k33# z723Ck6V@Ia-{0dJtzw6gHF-Bo^Xjg_?cFJa&TlfXo~j!isF}W(fv@;I{VIHNGG9?a zA|PL`e~Xgz4Zgl;UM@Nzue7m8`8LcYYu_=05uTc`GJlzx@2(^1f&fUxv7vf7^1W>v z(IB9)PK!nmDu6fipVu}vCM^_7pvAB97Y-ZItWsUggYu3bV8LvkL)Jj`R$4HmdG+{Q ztdNBE+q-MaV80H+Y6r>g9I|cSNZPmqhm`Oknp0xG9!M0-k@gmBp@P2^UUq+p`yKhI zG(5V6Hn^gs2HU=Y#DcLba3^l|1S5r#Q<)WcxJEmBBPtytF2UjhDhSVyY8E_V@z0+p za`QR~kpX>BOO%^$!%>LA6MHGQQz_*WtOE#pw8;Lft=)o8AlhPxYVeHH`ZNl)pJ@FA zm+*;^^tTfH4^8r~<(F&R+70D6xH^K)fK$cKd;efn_tkS*83kuiMWN{eT@UKFtO$c? z`apz~2k{FQKD?pzbe5zT`TUeM)3_Vj3el{C?~(65{j1mWqpQ1yU3T7^FEHJpHRRal z$LOH#1&vKch%vCw9N*Fl zz$0j;IJQJLHLsa)>pAPiXUkzz`+}$K^{er4h;lGl@@FXrJ4}?f?%nh3*u_0EvYU?U_-SV7?|FMhwnXfhUt@f^>|GnW^Hc8b z=jXFSs}7$|4=&U_xlD1WS)#c;Ok%*bn!~_uZ`1&1*PnXh-?};|*}v5q2)e^I(jphs z_h~p|nA>sQa^t24VsC{u`nk5MNbj2nvoa@nto7&Y3Uc78_+x6C^LT8GCADzu$8`sR zD$?3JrQsE_A<@WRe0g~;GGdwenfZzgoeW=ug*lk0jPKPqRGj<*Qq~x@fc0fUA*I;7;wbv_d{e}b^ z?t@OErv?-<^KM4I3}F9$i*6XUk&h>??WU$-k-Ue0zHrK6n;CDzXC{`%92ZP^*!_cc zu8(^}{p=oPI$Ge|NG{)SW-{XG$McQ3J1J>c>6&h;pZBV%FFF?cXwIJ6)+Wn`Z3Z_G zT&Y+0oq6{@>52k{Tg>D!s2$*;@bco{hx`&P^_~)BTggoW)5@;&`5^r-U&+kbW~ZJG ze_#3C>}=#Wlq%f$1RDcQKSv2AHkzre_8(W?Ry#d!;{E=;QKQfLsBB(IYTst5@V=`q zD;Jhk$O3d)rmSZkN~?{VE;($AWaLWDLFzcfks|GOHri1;!mqY{`e&r)iLUJV!1b!; zm%Q)2G$X?~BlZ{e7tu}k$Ve~LMwdl>+7d_cg@S^@C;eN3`?*Tb+ZX68duBk`}&(#O(vNrmra zHzFx^r06W3I&)R0tiJx_3O3~H(+@gRM2#q3+?P6__v~uM;ccGLIypxUsEycK7-gF2 zR_1G4u4qK?4h-bATb3n0rJ7{!qdq_Oe&Eo-_3Z0es?}2IQ-{f@wnp4~Q=V{BvrJjiVZ6g!_WV_X>XCn5hxz8dy_||UeHxtZqDfn+j0bMX{dzb~W|H+- zl&kqVPs{FD%2y@1`JU`jw=CQS=WGjuErJ#!i=4(}NbS{Iw>tQZhXv+ua6bEH-=3sK zxo-2N{BYI*;uMe!w~~epd^HC%x$7eTo&hqG9H;9Ih8ZpPt`-SQR?@^pn*D^J0XLceQ|D%s0Q z3u@NZid;4Qn_e}V?W#9%ni^@21eD&rdrWncG z3`9FF=ayHG#{YRf$(XyJKP%a^`-JV-PVF34SdBKHt#>isPfomF#j0~IH(cN5<~KJT z%dA!j7H^Y$SLVi3bcHH>`AUc`@SMbt}3SmpC5oMtU6?t0Vur#gL%J}LiW(K>I) zFxPY-z4OKUvEt9m8I#1zcPY*DL{{{r;F-ny-$sm`OlUlHU^Zn^{Hw*O(1n6*`LA7F zPy2UDT6N^lE-*xn%S6&7<^PEku9ms8(qzV{_Nn=n{^2tora=}NQ-p6ML|IZ`+}`-s ztxMBwj>kflLnW04%Cy64>iOwul0gEe^{| zFGNNOZB#t}anZokYMmlD?g3sKHu!FR`a=h9l-^R5mHk&M$cvqS=V7d!;ML8IOkT9b zR0B^jhp}#()jjDFmc}VJ|C>c5@c;JgjsMZA@PF6IqPyWsTefv?>0?GA%m4X5=0q(2 zP6MI)|HCwpSLL3!-*K?4u6nqAYuKs4Gv4vIt7Ud?de%BQ)Wgr8-+G8%zy@5uhJ)`g zo)JarxA-xSBkCTto0xxHTUI<3mYHScQrpn*Xe>f#{mzv^sT((LbV=E19bCFYjD2`U z-W_S?zINm^(U__t9ap99@>X%$HpYQz^F5skY z+*EV=N5x4?sn)q{=5AX9JPuVPqkm@EXpdlCd%(Rf;h=s0V#gzGAC?k}1{}o`)kB3# zgI7jzHP#p8STav5+bmpMPV!=X;WKFaJYPUty#DL=y?uR_pW9uMdS-`(EO8@1-KepA zRb`1W1>}w^Q(FZD1u1TG3zaXkFfh!$KCC<4*%$NY>cUH!GLlLg-`Sy(?cV!)b z<+!5O=7IyXD(^QL{K&oajQ8lYri%2Dy_`H}3sfY0*Fr7R+jiFE;^DsRruF+p`9yVG z#CA@6FUPwLWI!J|N%fSQYRKR4>?*%rUFu5KGXHkvdy2TtCA$%g6jA)bl8KK?&EsPZ zY~#@dt2B{?%QeQ;{!4?%pMj%dhjd=lJjlNmwO8N6>4Bs6u!}Pn{n47myHgjl2I}$a zz@g{8Yc@*LGqyfjxWK;^+X8FF;BIc?)QQz2K0YRQbK`meX;VktSlC{xrtkHFi>pI+ z1acVC63c2Q3z%cZ*9nLeCY@TH^uMCo>5)Gl8D^>E6epB+<{)Oc{*0Y}?s2iI^4X$7 za@Be-eN0!wAKUn;Fd<#n{SOdw-5%X^&or#y996=a6Wo5rsNKQs+o^k6GJ>}>hosDM zk;O@>-+$D2O{Y^x`H#zNJOvGF#^d3%Cz0s}&QGyWV^bejlEft0Vs zpCzhe5V0jxq0gQv!#qBfHCBv+_gg3Zx?Mm}WXKL0ny*`9~d0uOf8~*1|bo_K6=boU(k22gd#OZt9(N{+`R!v&s8XO%y>$1%H^Fpc8Q~oHL z`uge3kZr?n-ZAwFL-=|APN2;s=Rwu12JLR~a}94*okpz`u11Cr*cQsZ2%Xx`EflvI z>s?+R=cqJW8;PofjI5<~op#m{byI3Dr!~IJB$Hb3mOcf`H;uV8B;!KZvi`8vd`pd# z@<4H=x@nX6Ds`WmFlBnXh)XiWYo91>j_g{SZH?zV?sd=}Vdx-D+u&2QimZ2GKVcsU zJH}NG&(Fka&7f>>l{|EO=WyEex6U!q;-t=}geg5v)P{+hJ1aHmHv0E#V-(oLj89^} z`mWDQ{qqP^5UA1wLcwy#LRj0dsdy?+i=d5i- zP5AZRg9@B*ioAB}Vr4R|+~X9jTOAHKyKf+Nbf}P(wxrYvVIQQcLF~J=SfPzkV^daS zo-c80y#>$i6bVxgzx&=#Ox`ad-5%EtKCtG#@{Sl80-qTAVeo!x+g#7)Tl#7qapq+a zSAC#e;!5T1LPDLGfduKUm1D<`A3`#0jGn^0o(6qM@P&jiHMJ{xL5X=Z-fhjKpuE<5X=~#a$;jD~I-3up>f&+9of% z=gL})WJFZszql}PasYW_A0s0L*`vpg3Ds}<)ifDX5bof~D_PE>AKfc4x*}4>da!OM zv64OC470U7Hfb=V=nrQeBpdqj5OvX8KUO@+o(lPT>(QleGp`R#$!cf_75-@7fP(hj zyJS_h#Fmzb8*cV2`aL_97u-_g$uC!j&~vWdd?vblvCbmCw|#5jQuQ`gDRju=82_;?K_ssKVvSUbmB%fqQEfeRN)4S?kfm zQrN7!nxb!7iC}P0YV1uZd^>E$3xd}x;svic&J3o;)8UGZ+&afS4_f_G?LwoKbCO1V zjoi-*)Xs%yuzkPv8R5V+>(A=;i#DDkD7Ghyyq~mOzGeqQRlYrH|M>bNt3nV;lxX-9 zj0Uf4_6oxJGfWT9O6M!lQyEW1;6dgH)&NR}xh%Dm%iXz(Q3N9y+QZSU1u4AuTG+ z=hLG|WIe}7DZ>hERps=AjaaKAMM!z9I;gc!5RD(wRFojbY;V|C}~L^0*q7 zeW_7>$aVXG=r*zj?X?|M^-Z8@AMA^v5gxjLasD#))kfcVFMb9^^-CO5rY zd#|+k`cqP0lYfZXfEvsBn2gA@0kdZ);z0-8Uio$uf@+@lh@CP0l`9%i{eAmg_oVFu z3UEy74NEETA^jQtc<0*YWC8S`J5_q;yLrzKbWEqs*%^l{6qsr2mWkwemiSiP@YVDQ zFNui?Z?0dB39=_yXUzTZJW*TJT9PaGguL6|Zs?WKK3W!I>3w8{)i&X;4fE4k80hl#^#W&Z!2zl?ndEmT!zS*6rt}a?+i6ULQ(IgW* zV}T*1UPjB)RMBlnh{)cjKil4(*Wto>V&|}nDHGtuY1$)hW$M0$%Y#2^@23rZ91ze0 zlBT@*B@O&8Dtclbg|na8=|0+1Q*rVtoSRwMsFl}oPl98aaBYr^Tw#u#Sk@0I^+ql6 zpp)Kz`GUxX!7JKC=KOCqkgiNJ&0E)9#giWZdxsNvWGGk zJ-c>*PS|mQ3V8o3iWF>g*g4?c(7$ly^}>&e9WnxZeTozuE>+f8pTbsEOvby17O}_J z?;qp>E7)ZNA3JK!2f3~i1%qLuGG>Lje5di1e25osxJ(UbxeeLnLwpqhJ+VsZ>23BO zdW8ovP-dd!aM^DE)5F_V`f6S1?SX0uwSo^zgG!bmmlu9|ew-qr8uA^09~Ljli?qAji? z^W#xA)jMk;;o^3CiJIs0mz!$R!pJWj1&pU*nZ7s|oY3N0>at!DIUDGGOk%ZnKVZo< z#=^6v*K%G4DNs`lSnzlqW!sGmEwlEEIbeU2Ce!HA>r+{0t*E|L_gv|-Xd(P^y_};& z*ngSY-=8EFpxmSs>2&FZNUENxshGtm@@5)EnKqb zG1{h!ZoeEJtB*+2w7u;gDOBXjO^)EJ4|g9{UW)gf~TOSh4`; zU^GEsOS=C~qXE)idMGzDzaC@8Iy^MAcXY?FP+xafH#^Gay`v#hIp;6x+&#NT>L8BG zt(GYXvZke=G&~4FWT_%Ma@cVoRBZH;V6N|+aWdm_!Z{ww*Gy9Xu^J}g!h(-)=U65x zm6yJ?%t}r#T|FMW;s*BIS`)GQCnMk_RvhcVZvNFF;M$IL9fKwn$#=8N4fBr&jFYCv zi(6;8TXHCa&IO=}_x;PeU;i2G3PwZ8^`bmd=3;9kHhZ;3N@^5@kaySI^7?4=g6j-U z;lcZxJz4Rh?-m1ILJB<+I6uFR@kMo7(J?70x{YbqSgt|X7QU=Qu(QO6Hyw=*>iZz; zUf{Uj(_kiEEAE9FYl3y&UKv?KVzf+(j)?P&0u6s&qBTFtpM8tR(wcAK-HN-+aiXN8 zGxa^^P{T;Kkni4m7{>m3tpu6YWx@yIieOoxP2!YTo^N>#oT{ z@D%Rt9x|*%Tdja|Mux;)Xc;M=5*$7K zc=tp}@*A$?dMHGqRHD=g^wh$V<=<@C=c16aX6WGXD+nTx}1+ z+PJZ8A#3L_bIYuAV}uCV$7mCp_m{Sn78iSVlIsnK7KwiXh*CXuqAL95cw5fEPTF5f z%nJ;(YowJF9y@)90a-Wz*=`}Si0SUj^Ks4V0 z0_3vW3};d0b0W1gJ%6qdCwh@Ek|9D!hVW&KiAcMc86=6yW8?VQkI{`wV9nzrV#0bP z4D5mjyN22%GqJzSa#(Y|5_hb`(N}a%ep8B78z|K->|Ll<2hm~KUdXjZZ|X~5B%frk zglT`7I|ruYGa^&;_Zm1ZqHc;O zS?iXlho;AKEIJn*y8bL-U-IR;-@3K^gK5G<(H?Vh$HJoYx@7U>EVq+vmuAN8m#Zm4 zZcL2kCD&}->?M^Z=#?U%LsTKTxP(Q(7ov%yPkBL1ALT{&)6c3jX~FvmPu81emF;I? zk;CeK<2k=`2QHE9{fz|XJKv}iry|&I<}^2=RJ-lMVU3+Z^$C{k>RuB$sqr=FWTFax z$MT9nQb=9!!6U89YKpz&!g3;21A5A5jwwcna_OAhO=> zzb^aT|12JyYKp7o)yisVX{oDZ8Ea*T=ST6zY*&w}`RwV}iZZNKAWD%jVsqC~Zm|JW znO&6TC^+zQR6rAn>yC?5)#vo2R;D0(oT^j(dwjNjdzChTTyO?S3=C7eY4%{}5A9yP z`tc?viD#6Q1)IHq^RZz-L$G1-9sA2k58w6eA>cJ2f!ZD`@a-K_x*}{^%GbC>&v9_1 z6ff;?0#l{-t`$S2O*FRLyEovodXyrkaCvM@16G&SADRMiTFNKWQ^v_<{ zNM9W$YNe|Y7cO1nw0F<}ibI81GIFr;sB1>yfMbb_=YLa#A4D12$J z#$qwV%{vin&!LEf?o@j>1GOOs8xv3>J9{*4Gm^v0d;?*- znFM%oG^grp(DRV@(G$z_dj~9E!39x57mtSLeDanNzCK~g`YX~3U_7qmy+uM7oSmtL%hOYT_76Zr7oxfwr z`r_QUsK*mjqFO_;LYkINiMmHCnC}O&FHUET(Tk ze17f{>uR1x2ljA$N1D_~Gw0Tp!iZiPl00rwc-d)^6O&se5_8CHYrDsj_fml6&dwb^ za{if_oaGhm_cm>NQQ`vOvRsVxA@wF8AzUAFqYp$;%sNi@Ck?p=i+PY07Z;PkSD@$o z^xC7#WK25_H(9mGtVHep@oLLpXNh)iH{L}L!?KuR`uChRwiGVjlt?wVM7c)u@$Jp0uiw>p8`z04{8&rtSuL{ba{pP-rMC^zVpw4Q5!RHES{4 z#VshpflZ*h_b2?i*}XVT|FLxx`bfflbjPKHr9|=)=lEkY)7|HR4MF9tT0W@qA+gJE zGzAfUcbDK$^{1xfEFU?2LmhLtpLdIU*EjAWt0C9xS}o7U_vUo1G#Oa_x%f&7VG*YT z3dl79GM8l{Ne6d2jD_f`ty{qxg3^9FO`hU#*rEc@d&*a`KTA4~M!OxQcfyFfwmXmd zUl=pL808i_@_sfkQFQ3#meKL)7vRH)NDxrhF}1moZ!;_1covAT^^>SW+5w&%&uJA5Nju_Lj=|5cQUz zvRUI!8389)35=x|3^v{;AN4MM&)vz6B8>QH(4C3bLLP?|QTR{o=A)!h)5Czh!~<-U zkAmt>7Cyx3QCfF=2!)ZTYX<2wvkUgs-~aBoRCe-C{+JB%va*TO%pl+EP^;{b6o~!b zxB3=Gd8y9KnQA?AY;maCo>3 zEL&E+ZB_IQT?hMa2t6T$N0n67U>%Y zg2=l;4+4A>TF>3P-ejdHUGh!? z%*53-#HZHB)|@yYJSgm)S9L;In4pV3ydONeQn(KwN8Dp=1MWuhL}5B}XnK~(;|Ox8 zrvdY8oE31&zK~mSmWFMTQC5S|it4(R(K7Kh!VRv}^@mF9E88&BC)NFIL|ndQMQ4EL z{*cf+wK3u))rRy-M&NS{8-W z35|Spbxr#j2B+ykD9DPGJzz7|3vc(A&h#??})54erv;^qD%1wRlJ^&|J8vd zQWZ6nk$o5Vxek39W%!~=M3K!*LFX{lxMnN1w#*MxP!=*+9^7b@Ds27g7#nz`sHLkr z6Qpv(0^n27kRqKH|l69d?p}Qs# zPoAH9apc@!#pl!^13|1UTB6>foCYGoH{N`qf=g9?;>fh7lbax^;r>kLyFIjY43m)rdp`JmkjgB4I0kM&oi90(0FC8Kge)*9TuLTtUiA}K%|k^ZVF(zTDJsR?5-y7MlFX{JbL(_ zg>_w&Gu$T~$EB>C2FEp0`~}J*&HrJ7gO>1i=ngB8XM;zCq#J=d^bZTzItrk?=)rnG zGb3Kf+!^N0n<+~~LtLt;owc~;ipnEBZ(|*h_~G0t28e>TNG)0+oD2x*gKsSp8l_b# zg&G*3#G1FQph(>nwXDFQVpa^cn}<7fA~nVC~?PGB4;UzVvFHb&N8V5J*%{IFk715c`+!d-=jm+)vYiek(bmf|q2;b;zdX(ttv; z3EJBJM>}86hLQYslblUxz>KHB{@%A5uSI_*!t$%ri&36t&i7rQQ?#6yD)%10w0F3N z5G>(qn6MbzOGphM@<8bdoGUoI*14`4ZIV$p5&%oJ-0l$8#48Gu;YD`d@=y32!kTC$ zp`%0J^qYPjF)2vo29?@!m3z9T`IxE>3!igUz@tZgrXPVvfk;#z$m-TidQbdy^lj^( zFnRXt+xl|k)w9nB4PG>TtwYz_HxAJaU!Js*3m@~HvU0|jtNn;+x@twdpp6hF$-Ax^ zsEJJJUVFCI>6g)S5~QmPMg7{;R%@n$1D6v&%dNXtW(44Y2*uY-TRw-p=^u8!3HMc} zMGq0i>5`crkOO7zM?nfD%3#{ySmD6?C6%5N03DD`;ya)5vuRy%CWE;AYxp^%5UJBA zzhgJWm&k{T&QcPj3KioLJJdr2M&s-CYrA^z$-Ng&1VBIy%(_z{5S28ars7d!14#%G z+l%@9ztHQ-`7W=*$fr7cbRhp!-Od`4e7QLi@^>ndrKYk7ZB(D->e-xUI>VAP4eD$T zH<_52rk2ERXC-6YXYT024&fm`BD=4+pq{Rs7#-7sRgJjR<Tw4L`Wjw|Lmn8lHy|F zbG!U8)u0QI_#QNxeFZARrh+heBSZ98%&O&!uRgkjX9p37P*!9@%`i-xT zW1#~u=qy8%;O_AM8`pzKk|H;@+-Nhr0AdNcf_6ZRT4_V>03m>V{}$W#p;{jsVRi{c zcXUb$tEc(pQSWxc_$e=Oj=cO7NHEWgUx82@E~&Dtk*)gC8lPXA;~p~uh}(EYlGuFF zPN4E4XUHR3FZP*M+0`vyqmmdkzIk&uIO~#}z>ovC%W%2i;@Sq+gx+$TG_)V8NcN3t zl>_nz{b|T8geAh)UI$eiB=kwwrraX&e?7F3X!E0osucCK`@3aUZ-)NGr;|wI_OBF| z5?+=>IdnUMixf<@(}Aa^srENmLSh2=>2Af42y1wN7Thj1JJuhES)wUc`lC>Rn;Xxc z%Zk_7JDOSttXVOVJZk6Q_Ym8aqlBO7ryV;(%H7YW@2oTbw8LyHnU77)gk{m=Y{b;v zXLR#UIqjD7j!aRLQ+CcBzU3YeP_q-?a$@AeH;q%$+qo9`|C!8*;QxARMNSZoQqJ z<#~aqivg&YltC8V8(DN7VO_!>KliKs1SqB~M z6Z~e_Ye9Kiqv*=esGWt<4Cy6Y&Bp0@^L!%tve10^D8a>j5SM3Z5;4poucvY4dAd_y??)T?76=5%YPq(^===n(Z5fUI=b0w|G(WC zcERue|e(IlT!Bc@fqwi`G?;y%7Z<4ARWNoAEp1D`TWJ$7iS`K zJmMu@jK;|b)b695JITfb>fK{qcUOem|DGA~h|V%>V<85tV(xXrl0fjqyJ@#VnIy{D z_B^^t&DLIfNLZNec>q==f^=>o1f$ZSN>b`2ou)i5||IVoqPYxr9t5C zNkdS8_P*)$>(}Jj!Hj)wgqNT_qW3zLd8as)W;*D zTI8PM03iSZ2VRpnjfNM4ML+%rGvLx2H|l@-@h*0kMK{V>qZNX%XGzQ(OwMKlE4Agi zHIddUJD1@Twe2~!CN{13XMivD4 z{!g8Omu_~9E9vwNkGnoc*H#zNTRY*YRs2#sR(;A>AtrG6vnq^0vcn+4i%CRJFQ1Gwlb4;@L9?J_;BOl*+9!8BYTh%Ci@Fn_&DaNulR8z+U}3bqk6Cj(X1OEffv_wy5!W zfJbE6#?inMZ}Sz+M?`r81T7F5!Vgm}Dm@6WYGjOLOG`^&32+iFL5dGg5&r-=ox|*{ z((=2>7c+;o;>{VLQhtS&LcPVHPkbPVZK=AJRU+8&$LAnWmIm~SMd&aPk3 zwAhUh0b3|#=#RO-M$_4c(x~vqraVaFtDx~lj`I+sia!m-DV4EWb=;oQ;>H6&aK0T) z+8h65Z6kso3=sir{hl1{Se zQy*c$Gs<-R)T{6>ryvV9xzlH6V!W@%6eAo|1OhRM-r${)T{NTFwo8P;8YiiXawXU}u5sHK{jyWB&Q7-2$zGPiHPQ)FcM;uMHBwUl8{ z@4GE|GUfIGR~U7W`&B6teWd?>HDDi5M6!Qny9B&2xH`J!jYAo!d6kYUM~ z$h%=XGD$zurZbXZ%dlt+GfOrLOe_d&ei9tZbh|=)K(WN{ms3xw_!52Yi5g*IX@sba zfAI*i*yB+P3nhW+vr)d8Mfn?$7K0DPbmu9I8()4-QG)F4w=Ut@aCn3C*i;K>Q`oGV zV=oB1W%fNZ9T0WycyB@U8hFk-#oR)|xJ_1>YSauJz+h;CQJoo3hRge9K=f6AhmPPK#dT(^wi#F z7y*WIDFXJp_XX^zbIW;HwlT4{U501~{fDl3W|Lb>1O~Ydc-? zsE>73cqIhe_@|-#%F%w!Wx`91S{@d}9k4jOe(E`ao(8yoR9D9d7X`(<46=B>Lq_tG ztfio$8i{|}@aPu($h)nR4;-g_!0GqvY%E;Dc(s9nEX7#R_(~b18iX6dB7oF_eJ=Ce z|9)e9yTM#{G;y(6+<6dwcft1)O=AQx521Z^jT%l{*=TDVRUU~^*ym*oG$3xE%WJL#|vE94zyjQNBi%21~Ke2;bV+&q_W=idVqP`%`1Bop8J z^d?B1&u7)(ZM$pnAde7z38hh06-tBJiE@>tpg)DS1B8cHO{FQPRmn=16^3tM=3@+z z7poe`^7`wh&g~ z6ETnjNxw&kQ;4?q+f%U}$R}lpc?6V#Qw0OL1l@mYzh}61ROr|d#>wuCt?011X|Yhvm)6iZOkq{giM>QC<}d#Y4rTmyG}a^p3|n*- zZYJh*;8WwQOlA@;MbGNQ#41JRG&F@T+R&halEzB|@E}Sp6k_-xpiNu{MVPtJq+!FI zcFNToY6)RyM3BYqpku2O%~W?g0++I*E~)~>)2lQSFeb0>g-8J?O;jnW>dX&B#9R2- z+auh1+yIv0_AXlZk+W?g^lLP%$1-+_$S`2NAHuCcq^H?b2Ke3y#~`{}m$ZXtf;&wc zbHYjg-9>n9!*$Ev$rtwTjBg(Ne(N-JKQ&G&ve$NmnGuorNQ>G%w`Cf_Vu<}n#x#2z z{8vZ+nU#-ae4%>izHZIeU2{W^hBpAk4SZp=!l@0M;nEG7K4`32SG~Ri71nO>xpdvPi{r(JR^sUrR6rk4t#B^vo2mL`RlcjK)+txP7=?|@iR)u(a|;*pUaAiPHJ`632Mmn@ zQ9G0d$T$8ef>^oKv4=oav!ahfrUOsHIW|?$`D;!lpBI|{F&~8)J|r&R&99-)|GW@j zS7EPSTSLQkRC*ca-0^p+WmMj(+Gje-J>VA{@{;Op$d<7G68>>wH#ZqD$%qaBalNcm~88z84+tO zQcEGRlKkcmvfP##AV)G^?DGsrF=VhB4_dWZ(?}VXa?Yc~D)e20nSxM)i*)k0|HHwf zA9xj?8j_ojOYQ;Ne+55E|K?Bj>{n{W&{?#f6Rzs&=Isbe=vsZ<`Rs6nxb(O7ekR&N za6E9BQN4zCle_Uh9eKC$wnGev#u2FDp7Y_%XwdsvXTyjamx8y!GfL#yp=hZ^wcr_! zqUnrBM+Z16_dg}}tHljX6-M}UkZP6FZJ#)fBfP85CN9Vx?a4sTVbuMEynNkeUl|>D zOX%q*bvKDC?H{cgZ?ETDy%4G1(dDX>F*mLDU4I0^l@8ZRp(9i^PlMnmvRghN;-Ruu z{*=`=Y(s%+YXBF=4)-Rxlg4e8oV0X@EM;UmPOz=KdQ4jg5(|X_?u6W1e`sjO-JS!7 z=7XQJo=0OMkNIgYFIi`%ZZV8nLdZii#5)l`VJq9WHRh6NT^QuQCxpELSfe`bkAx2A zZR7f>ei3J(qp|m?VG((KMvf=$SZp1cCj}`eik}m(^XFOw0*+@kod3JU9tGK>T=mXTZFPk`QI0eFY~Ujv?pjKH5nZxce8xq%p*Z+&}G=VF&$=wKj|gw*Glfd z+*vXrZ?dvz5}J~|VQhG(M7HX! z&^TOE-EW!6_bSUpn!31x=u3bZjVyr9fao!VAvvK%=%$VLenYlHFkI9sM%mp;TB4nB zmpf4%H&OGnm4eh6n@?D>H+s>q#M`vaMQ^9#@_2%Lh*B%7ijVXx1X`4yORXgzV+Xp` zv|G+M85tR@KFqfc;gBFX6bAE=@@1OmoDf1LUFx>}n@5ga)Pm66Ut3!lTYo4I37d9z znn|9XcU*{5AkH48SHWsWM!+AXrSz%IgwGWtuM{mi?{ET&0h?V}RpMehK8(IlAXRKq zwdmINTIVs$f|Af?wVLJfh;*s!UAp4HesJm`dAG-BhA&eL>X5VaU&IEYjr<;7!at<1lcbSAY& zs_jU=2u|^_{A9ox@%OTA##5zq<5FITYd>EJCv7MOuP93%g?2&PAvMDXA3#K_JrOJB zBh5rSUqv^o?X{vN6@sF>kG4zSq9pY)2Ps{bT0vrO+do6Ll*E>Cw+@a6#+E*Zo6H52E-2bcjlfF#0HWt8exq zeJC7aWFRsj3UrB6R|!=g$gy_PGuk2Thmo!6Mt$jp-pe{qfJYMHM*yfQw#;I8wM;bn zr#+>x&s%2KXCvE3PvtLY`@-u+Sl)>Gv@8@qoPB)MX4Ki=HeQH)g)sS{rIco#(-+c`9cOH!UskN87?5^H#T zeLh?b7sCyfhUxr|;negUpSM%zK|x56YRGQbJyZMAA4fzIQMM=V$Z!L6(;FCMVh860 zx2;B|=zLWQ5(4Cu$%IS2qXpFilWn|3@oSyPQt)BHYB=XibL3nUc|dLGl-ps-u!I06 z2h$odwrb;8{Uu^5LDXaE;oq9G2ND{I<{uzqL{e(Pd-i+A`mfQ=D8rStVpJ8z)hVIg zqcA~>`t)11A9x>5$wZPIShlk6;YXGdBHSh`)lK~G#hLT@t+-kp&bKXV!jmQ{k6z$~ z4o~*;oLLD+L;A^?5IEA3Y&+KByg*H;?B)%E3TWqt>z)ZF+POKGCeim&f9fk4!)g+K zxfA?8HuPi%LAfQa$8hW37aVRNr4d_sDxwa0hqkEbp3$~w(b%yCyhfx#`PGa4Rmg?M z33EvwW}LV~l9R*uIrl-L$U%DPT3e;Wt0@J$1&8K_uGRl?wkaR@ADwMiISC;JOb1cS zvPhW{!Eq+cY-#ni{LfvEx`T^)HIk`Cu)&d&QQW^D&}1K?cl$OK!RaWls(|K1o%ryf z+@y%ekEz$$|6*#3P7QT0I()Ai;2IsPKIr!%UO#^NMQk<3N?Z|a&xFM=8+JgbQ&9W~ zHzybb=B9VE2Z)~4Q?RtKCe4I^#)R;MgE=!hOZ2m%-U4@{J+})sW+*A*=!X&&)%k0i z36GFi-X&U*>W(=)Y{)YS_hi7>Sc7#WE8BenB+t*LrYCsVMjwl$=|7{QZhw7k(VT8b ztatL)Jm$t$5`2f(Sr?>&Z2QB)UPSXzs`mN+R(<;ZUKcg%?hieR{!_m&Y%DWQZTFr% z=_Y&T<1={FwjE2B{T#zHB6f}HkdwQIk8OAb|ApNlmDASMVZV-_40%-%?lL~iV=*{5 za^_25gU|cpoX*#|lPsdTMs0E?tLC%`+gz|>*a|bXH${Rvy-(%v!!MDvf|fgn(EX3Q z3cqiuSmqIxs16C$oDW_Pt1aSgAmp=f|?%)A`K@ zf7zLvO;raIm9oGo$C0 z-Hku3YULx>*li{pejmRCoh^F3?{{9cIK?DoP3#X0-@`toHKcfc)a>9zhmpHwy`N`? zGY*`iGH=%?Y*ONqI>ewjWwO(7QH^@126M6;TrMcSf+(qB$)pMo*Df#DdZ&5s+^eQa z^XX0T>p#nT?DL+jd33TJw&zdQO_4<#iMyB$uK78{@G<0g)!C_Z5fuI+_8}V3ova6M zXBaIix)(Zyc;5EqA9x&Uw{PF=s5r-yGY?I$>mD+*k>8W5r`Y6mlApdi#KQ1)UVB_p z!6x*~VMK{qQciWf1nlOmV)PwMhD4*C)b#5Q6JL~5g(#vmqZE|Gv z6d*ZUW%_*a&{N)WrLL|-;KIY&UbX0phEwSW3PZK@OiWE>zXYmIE`8dQplZH!%tfTC z&s54)sJYQx@Wdk)n(#jD1o>t$d69w#`4u$Q#bQh95pst*ZcPpc?QnD%__L!Ha>(&p zr^L4YqVF9JZ2qk=$(0#0CYRrQuWkI7S%A#5nZu3cEnFJOAL>T(<}8K(uBQ=};Xg^@2wX`tz7CCS&%zI{i`G4{D)?rnxUHd4A0xGE>9g2tof~a&$DheVc z4I+ZHbcdic2og#Q3P^Xuq67f}0qIzPbS=8$jOl*g^ZP#E?>pBy|D5aE*LH7NtU2d1 zpJ&8<-(w8vtjqT|Yg$atL2Gy9A@OBvHSb4wU{abI1L$KpqR*=j%6;2mS29Z8*cvkJ z&+X4h%~4YQj8ZSU=gM-;zQEXQOk3x2ND8lHrgY3tkJ$A=6G~xvs*i!niyEz7L1LZV zvQUa9`Q@=YbXt1zY`r;I|e9EyWoiUe~<-EP_o{p%P zARKrOemUzfe$i&k7B`wAz>Z5HK_HN`CXRJw2mYOrp|Ceod_RgxtHuY*anW8bYTDmA z2KFZ{-)^kq$+5R{<2M$deYtp7IR2oY9sajE2S7L1W%9b4KdH7!=WzB3=&Q~?1d)r6u%O1kL-=ZhCoKL?;QEq~iR z(5Nt`w0voW>UFh@YFDMxBK5gx9*d7rv zEn?_0G#tfTyk2S5_Mz2P@p!Za>}uW8<{4}h-s#-JGA$03>SNfb&;0q&Q13U~syuxb zUF9L8UcT%0G5J~mIzqLEHBDO`_2k@^3$gtV*>1ekmTX~ZH~a5fzHlZeVMw!ioVAhp zKImy!Y_9sraOFu-hOoW;{;4i$)Qe@@UV@m|fYS5?n+*zf(mVQl?yB1**!t63XVcu7 z&(D^p38`K^xOU|nuDfHu4hDM_-+2D?y{So>>PHCqsskX zuQ>|EY<sG# zGc4j|kqC{ff`a8wqi0DjVpIgi=BC8EqmRC6O5#zfCoK;3^w4ZNn~r)wfVz(iOq$O(@nSrN?LEbyu|qc6`s$u!kXo)pF*fw3SMQKFJo^UiS?HiXKQnBmG&9=whjNvef}xI1@7v~6_Bu>C_^!X zv9Tkq6RkZrnuv!Bz?lH z8cV47``YET%)4eI%CE1sK?>akZs>5}KIrO_iTx0%8#g~~NK(p-2sg~O0zdjDv)|-r zclUn&dx?Mb6Wr`uVBqm%7Ifw2ElmP9>|I9|m5`vLOfM7!7H2@cBwES!A}MLG7$W3* z_+Oh4N+$jf0=rJo^Zq@;(C9x!cXM~XdEUbL@16BFKmMn#Z~q||;}6eU|6Ybaf4Zgq zr^-!4>HnA8+qDz>@V_<;{HK?o$hT$f5jPlYE0`$xZ*}9JKa&-@@*tC^@5CFtQuo&* z1xu0worG)b>5G%=9|XI~ONc zBBvjFxIY$uoTwZsaW-{$(Z31($Mbp3y>oc$UX~8ikgP0~)W2}3&mq7c#)Gdm{OcWv z$myT)smAXA#LMJ>=X-0Mwz1apB2EXaXdIZw`Uy%;gW9h{OCetRgRVP^Rs@crdjf>k z8n}4m^R(-@p}IT{NrjaRs<93}c@p_=t<-V}9q4QJ2l~DK+nY8XfHkluBC1=lt+#Nf zf5G6{%j4;uN#~|2xW8{cS2)x)Y`J0KR>FI7Qp59&E8^u`>5zUgVJ&=cbj4?M-p9rY zpHs&!DZ7wD6$a1{LD@@lZS0K{rnC4buO_-(s%Rw>6TPrmEJm^#deTn7_`}FQkEN^s z9Kk#w>xx-9JZ6QQz(|{gpDzC;=_yC)hT$(@eNgbE2xxam!^4K& z)bs&ZvJcV4d{f>(UljgcD5f?WthiWdkCAz_{0RJhJ4VQ9pTNN2$L?&R?__aE2gk$2 zkDyL}ZMg6wX;xHuKQlDG9wJXr7}m&t45r{bPTVejo zYej=+*jOi;mDnz=Y`)7+B_$J+f9&y3mQzD2(>_E9FHfh+14&-LF{s$%{#y&ca^`Ra z)^BYTa-w%(<@gZ4o?7LEMw2DObl5vz$SjUy`9<-1j9%cna(cAyC(Uo${eGeSG~O$O zPBa)Y--aO;Qbk52s0@!<*>Se9IsYP!(-R&CZYST>u;zPogi|);pYXS}hEl@*(mbWZ z!JwNP59CaPZ0jAoQZ^555YKCv^Nf@!@;QOXwJx3=K#uVXZ&(?5G(D%o^3lem| z98~8VR)+?28MG7##R)rHUi$5;nR<2#dOyj=Ctw591FKt-hDo0&YT^BY9pkD9x)LNvSy%XEW?i~OF z03(6xq8BjEniKRpyZ(2+x9aSBJ&}@349q)K&mb6vS(r!NG+v&Q(naCeH^V8+F5xxB z_XSe}u?DBOesmkmX#&1csmx}lW&p$(cTsBaX5a9$H3&#QTzdXPH}CWg!>^R*ayNjk zT0$ikoI?^D0|#4MlNHS7#|;F&6tN+Kpqu2PAeCti=V>g+JnI2AsA<;>gx$VoKBhq_ z9SYqv7_s!=X&(B?Nt!R;gkJ(_!gXogeo-@|$K3k3KBSIfumPVx=QtM=V*UkbAS8QV zu33S3c(tM83Y;%LUd`1d^ei^25F%69)^JC?Y`4bD>UaZHlRiyw*+(rS%EH3J^H^5f zBWGZ=;M<2MFc__|*cDbC$$x@pT93@wM$bUP0Pg4-LDKFM4E~4v1nXyS2 z{JyA|u82Eo2)|H;{o9u?UFgr?w0&Q~%biB)a0dQJI-~k{x^}rd>MoF-6xlruk&xW{ z`rt!&0DRYY$LPWC?|SB}@9ltS`6sPH?)h#r)f0V_omD*C5O-yyIusH}|E9pVZxKx= z+~H%Vagt}xSWHDY4JT$$XO*4+y_A8)gSEN64atvp>TophNCLWNloZv^Kz6CW{NC@o z8h|12{sDH8Aq>vg0egWYNu>)b>GGeiV_eiO%xtAtcQOTtTV+Z0* z!~~61;DGIF#qq5dI3AuMOzVsT5lk{{4~yPW@!n6+o-J9iY;D$Whnv=Zc`WqTJQc(A zz+KmKfe&u+G94JOFr_OLx68n&vDt5I3`>r1%%2$zjuF=|z-fYocyp4MQvw_^?b zRsigHF1HugGKkayH!od^)H{C7jI2;g&rFil?@j=_whwB0Um$>!@k{fIxd0Tvz+_IW z+6qEZX(3i4ObyOJfnD0}PECOB+P7#WY)2OqWbaUNiiIU1Ap!Vy9JGD%EZymcyAQ;4 zv}pvr-hz?604ikA8^h@VF^RDyW>rpNzQY<~?PT9PR~;dGVjhr^f}K2t%R7y03t%4h z1SGP^=AbuM@eN6?IVRN@9)kZ*uKg5wd_cVL>aY=jX29Iwie*|BsG~#oZQ_wCJ5AS; zbjQNoVL68=CP?WcEg%utJz8SO=pPyuM1(Ba)yz7D594n*cfE}7d<>Wbv-%6b)VKuQ zu#x3~*go%-(pfCK>Du3Gdb;0oKX9|0|F~ge^?N1_ZIB?s0J9Mh>@p8{bZ{Ihksq3x zSYYRQMikkSos^Nw&&D1~c0?Psw>;SzS(;y#T2s&r6EY`KotjDc`c!~8H_L1C!G2k^6?J? zE!Ri$S@g;gYz}$yQ41CK^Nud=x!>FINZgOvI_dLm%bic(AIxzBgQZe|5lwHdkBfv< zNNmNyR7(9Sn+w=C(x|U@q;f6yc*Db^Lg3B#(a)1dsv!ANaKtxJbHYLX;45lwOJv|# z#8kJRC`NTv=z5MjeOf3<{I8C`SAPnfgQK$$v4%>0nro|pG1}4ibV)yv#Sj#*C0NSlphV_)CWYK=@xwG0< za$7}x8!Y>W_!=x&kbG!GOZr2*Vnk5D0q{x0A*ki{o<7u!=%hgOh1ujJ+eg)q(*ur5 z_A&&(lBL22^r3hlbmHA#?hI5z8aCKRKi;VYr;of&K!GMzl;Pt3cC^fY=J>KJf{@2ry*2lK{Kb#;; z@~`R@O-d`Jpy7=K)Dw3*Lalz(+(+9x_^dZ28$Bdu4r#lLwGMx)!j8_^`Q3hr>|_ot z_;bQa@7IT?v|qRB@3h>;f$i(RW6mQ8$H=2Uoz2#Ibv@C8J~<^tDd>3sV8dX=u*6g- z&w@m1tP+C-(DyT?wM)nui7tN1&6-hj9L7pX#(vali>}RNk=8NDq!UL=vO5NoxO+Uxh z+A2QLl!)*oti<$}n8sb%@+C2H;7{POt)}MAvj0#&TYZ@tc56F~;-yLEGUyY6E^_+! zw36reY+&(Vv0P(IRexNw8Xvc`D%U~`#sdw33?e!y_~W7CMg3Ai;F_Q*tz_N)Gup2r z*vO4in#;>J!CU2n*64uW@-KH9U41t5%9=9Ie#q-$VNDKxDBZ_f8meZ1Km>{24HxCfvN%diX2fuRf@S7+5rpHT8-dn zpP27QxDp4xO|&hj+An0*M3%ap;712!eUK* zIUelMWC(Z*XP)cBm3d<6UxG4xb{6^DX2g+bV|v^}(VpM$MU(fxlTg{BG+gSmqi_;CQM%YRASi zFdj9k3&BZWq^(lW18>8Hhstz0O;uUnZb?0ogc__}8lV=DX{m6gZ?Rm(S+%zh;?;at zIHlQ@O2wK>Um{cDg#>BOqG0;OZ4JZ%cFqSPVFv z@MVaR*y;%3Bfy@3M`|GBCPgJ4F^w+;)ES@gnRZcI+&2~`E=mZi8;V4h+7i&3>ra@j zFdpWuG3ylDekw(KxmRA?_7aE08%)?73?FBrV?ONdZ(tx%MUY9ThWu9 z6=AWCa4k5;0Rg<3H7-E4Dkep%zyo0s8LA7G%tXb3Z>C8E#ks>4=f3`~oBTv`C zuf9GGYGZ1eL_fQh60^}8(yva9*$qsipMcF-@6V#ZKyzvu*ozWy1YwI)q^!huh;uRb z22$k0(X|Y-X?N$KBdAj&Fyu(H>>~MGmrl=6*%#6@bb^H zcfq3uR@nfDMMiFUsd{wU$b}Dk;_;p()@M!nw4pRG*(_rjtzURq*Ec4DpR#zR8nxyXwkuZO&)@vbYl zE<8A?>Io(^9b4V%Rw>@8cJHEcJk81c)dZ7Bls6bUQtwm9V@Do;zKAFO182l$4t7p22D zrMn0T2`@u%SOeTzoZvLRFxYn>yQMewl7%eN-5`<1t*SfY)cVV+4TxX10|=?zx9oI3 ztw0xiGN(Q`kbt#(W1!%uo3?HMQ!k&$k5^0cc`LiEQi}taV3SAF0Irjg^da)^bjVyG zxjN)tgqR|wv{Yfk^7916l6#bgL~B?)@JZw#IVd;Q8pl{b1GM^zc4m!qbUEe9D8WNE=3Di&7d0LKW@i z(sya5>`^l_msIq$`I&9_ob31x*0vx{>`nJ@8vhPi8O%EiL*||BCa7f_jFlFFpVp*DcZ4j zDsC8v&XL#qYpv-Kv+RfPb7BXsZ(ZWYRQZ7QTfK=!uL~!Du7N;~+V37epnYJrl}0^+ zgB5OZn&xNx4hkP5$&N`@D9N4d_uMI@efVB53*g5|cm~C@0>Ds%q5-nR4=6qV^sH_V z-6YS|EtI9BOx=LlWt@80L%>Y}T9Wr%J;Cus%k0GutRsZQ<{Sui4 zs0^QT)PoH}z`D=F%k~J;14u;RpMHr=UT)+lT(h#Uo~$^k-z_~xlTPvtP&V=m_(85G zOW(UL0!AD2uk(D$P7i_!?=RT+2{ISnJjtt}g!_PC{~2)1NS;1!Mgt~-1Iz-vKG_5w zJWt+SI__(#59>0`mQupZA??$JJ}0UWEbn!chC~1eh)|E)G!VXZ93K1X9#=hAr|)ys zy?!iwnS(S-=Dk<(QlNrUdNy3*FYHe9!q9h`B1MEn(l zTl{Sr!^&-azz+d-dIMXP?{JvwN6h;-u)%QXGxgl^(QcO(_`**67^3L-L&|oqu3>;1 z+vTy$9+1f^QDn|`p~j~tAyO&Xif6V4kPy-g{145b(D@LcOJx;&HNW*>^0M15p1M_=(I!{T zAPv9FhQfNRw76_%zfk17x$>!@HzTYKOcLxFiGZ+-;Rg=lmVT;R%DA3@QfDx(fE5DY z=D3$}e~aI#;_9BIh3g@ir^8g<;kz+K)g1n%j?#f*R9bJJL_jB(t<2#>+!jhO0+hgWXQ@|W1CSNaSutu6 z=Fs$wMISD|HU`F@mI$vS9tDl&se$MHqZ(~ADV_w70{oZi);N^IHMVP(B54PyYsyKD z81@9>?6^a0Ta7?Zg=_nE0m{I`k@*T3@5b*^b>?+qX!3$hsxw6 zB6j;(l)*-YgRizU9{p_Uv6qJ7{{oS$A{^f{i-AB}B+NN(fEPu5(FVfiV(>s~ zRo}8blJKTwvOsmCIVS7UI{VXtctaOtPhnxMkHggib|5#B0)wuF_~UH#N^!f+7SoQg zau?Ah&%C}n!jG9sT;l*DdbaQqE#DFLkShD(@9YY}Nz4I{qo{ zhMv5XSI|b*wR?ax91h*V^4l0peTwF_aSt(O`iVH)@6*;yV`g3;Hvva-sVm6kuF&gV z@~M|UBT@6<(;B(a+B#lK07OdSe2t*x+R!(d4mf{k0T%@K>Q4-4!cH2yWSEHPYx?}^(ff88&Tw7y!}eF?gs zuc;AhUkLDbHn(9nBWVewU@{>It2*!ZWk6}t2)xQGx1w&{ib7BX`e@oYAYa@aKMfZw zDk|DvHfqXpf^-MbPdN`m^{rV`HB-3NEF<38IVF26s-~6)`Ponfayok+O*v2QNU?a;JT! z(cS*(edArV6+bj&LVoiP&o?%f=#?6qa*_&s;q}2PIxr;Z9s{1??PFUxQ$(WB zM0k%@Mc#ngLTupo8siwud#&K+b~0*1zz0Yn^zLartL647MjSqYBaJr9-4POn0EelU z1t9~ftKA?&0H{x_moWo^&IK#(xDIh-IuNWl0KQo~G|*HK2k;GG8*u6w5D*UtntC9f zAvOa=T__HoM^BY*(fU0nw;!pgm+p$VpMxDyzCrOPs>hFlSl~)$R0=z)ReTaQ1FSDH z^8=td+Rv)q8?LNWKAV@#p*f3I~-clw6Zs#!om{^vch%taJ z_q3I5Y)GnSTc%Oy$|8!ck`pVF6mj|e0^0n=f%FS1q^P~Uz4h^Yyv92>#exUmItaE2 z(D1LmF{B82ZzDRRlR!qy5mZ+{fN}$K9TTIW7Z5{v8+5uiy%IQE|5151Xh3i5grfsm z*n0@inE0Rs+b;_dg*^b@j&y5;?P_alI|0*#`m-! zgTEg{jr(i)4B#o3X0m*GUtEmem`aL=!md`Vb%8G+qJiba@V=+2_CSKy`*Lc%OjDk2 zkcBDsyMoA-Af?&B!Rd@AulKnrq5Bpt=eUcVfVBlu!2Hdpkd!Q&(`{_Pv6~hLv%Vbd z5nJ`VMIwX=Tf7D2EL0R+Z#@S*o-e@^LOn3Itv43?U(M|s3Js4-fbR>1i8SLu1F_aHZq$JXLSnt#sA59IU6Y2G*x_`Z@Gp~-Yw^V-ln_CHLRyja=SQNeoy zGjx~DYzUIk0;>XyBd0@~FRF^|0^B+#M_tUS370r;qk50Ush$_q+d9Q_&(jVA5B2z02a#&-e}6bRJHegUo_H9u}=qV zS>y|Ju|vcC6F3HKYBPcT)u!2T#AS()Lp@FHAWIAmRCtnYnGZ3-D|41c<_uOh2zj4Y z2q`SFfV+`jmuD!*R@Q#k{a@9e6sG-Pmu&A^>&MTzz3(Ucbzd5Qa2K5VTqD{6oeIsv zF_~b0@@jo;4vK<;=m3m5G&P-FEbfQIT;-8A3-2xLTA)GwFmP@z1-HZLXoP{u#>l{A zOC=Fa!jxtvCYvy5uE_t6bWWZ6J_xU8IM zO^spYozSWTS`s17Uk@bmgu-Rz00(*A(Yfa0hR98SXU0hWTMIx~2SoxIE0zC?5>)8% zO5+t!B+|q3fn>J$-0#WvjfF~?t}F@)9HKbW^4}l^07J@U?gV+2lXj95ac%_Fo7^EZtx9h=^EA~fhUc376J~>Jaon#I`6Fxqk%fF%v zYhUL*LE!z;1>VU#Nj9-`YI7Pz+{QnW=4ZLb62;F z?G0V(0Dw{M34US7sS3IY_HYjNE!67SHf~C-w;t z>|K|!S3?H2j)HQ9rz72WKK8weunW<1`eJ!(3m^nA2S8^`WglaE+7G95X1i#xIN`aU zzF;w^I;cZ=Jv0*Mji4W}9fu3ACC410jggLaDr>s|ev$j&#;mHR+@kyGIUuOvQMK*z^I6)7f zmnl~h&awci=~k40r_m{!ZO^<{7Pb`Ycbygi^OEWW@0DdX!@&D($Ot-Cj(K5(cKlBg zTs%DQ9Ers>$DaZOZ!BZmb21{nM~aot4h+xD&l4Vf!UDGm05`X&5)!ogmi+j=R;47S z=#GUtUph>;jTX5z4oXryPtShgpVU90)>XX!Es>oFdRu^y1;i;{*t5;@xWQuJ#p%S| zcPvT;jS~QmAlR>5SXntc(Di+uATHWPC_%r)#V?{rK*;cVDI7 z)W@;jUb>=VJ}n{o&<{7+o@jJNJB*e_K?Q(DBH`z>G~PKqAF&VXriNH4dq(g@}6QsK(=bm91pd2pQ}W~t6AR;bB_`p;m>x}$NT$dP6v9}6CgQww#X@nW8t#HK$f@& z9lSGBXD0YQ*ZzmTGI0cdVrWPcFpf)G#58Zs6Kg=9Hrn#n=iIhM$~|vk(PoSAXNmtu z-^r`{Ng%r|$Yx(!&dfC$Kl!FW6(aGsD3+<41!Q|kH(k1{0m%}i_5HgorSxY7>()6C zs`$n884f^hpEhykuZO!k>1vHVF+qfj^S4&<`{w9PYHQ_i6!Z!Iw@)~n)J^b7 zK8A;kHTcQN=sG*WHsbc{>T%ouKJWUEd^NFtn`1>}zcDq)odIHM8=t?Vw-(aMVqi)3 zuQ8e#{Vja7WMX1Gyly2{hF(xU<0Gv1_s=bMFf`zSZcpy8bw|1I zD}O%{+wEw$_8+R$J8+pTfKHOX(gAcrN>WlygzvER6b@s#`(JAyEe)ZNI+tNl!#pAW za9l2Ue=N_xubUO*=egR@q~OHi|Hf!F?ZK^}+KiSkS0Bw;tA>=mWIcS!LmY-dI(`$}aC*s0Tlh%6}*Zbl? z>;}>p^Gar~KyrxOrfwrl`9>*?yy2*7n1alnY%}GyoF4MWEg8Hwo^7 z`^)kJcvWx~mLG`?c(0zS2m8XO;buM1GiP53dE{Jayr75ThKpcp>zbRm;?rh8cg}+2 zg?8^y3^m>wX*yYrGPT&JJ6N@BzPC~c(g4U!??IdfbUz4Q19qSw3#s-2Fa(4l$!lv$ zYhw_RLGTIK5kj{?sf6P4&gMrOfLoAaHJ!f6cW<7?wuc~c79blD>XEyccfz{-E^1?H z{ti-b2T5{3zkopHEl>ji>jnx4?}U@b^Zf#x4>bBE7loPsCuyWyw&`73L>jsMKS?9E z96=fx^S?+V|DWWLmwWyxFFE(uym)7f<{*mIUVG2I#rIK zb8962a4)$uy6`Fmuy*dbyu77)0Nz4yfS4;Jc6Gh~u|EcCPvCF0h@PyZhBYtS8^9b1 z=t=h#aB+zL##?p!(JvFh)$&^WB2+quX2|A21VIQMw>H`PM<&J%X*S5-+;iDHFd#{N zTEI>Wd>sD4?nKnfd+Go^2ef85j1dQ$!OI4ETLaZ^1a*wSfTp+Fd~#izRvxL`8F#z7 z@&2Zq2&h_NoCz>BmxpzH8?0uI!ltDDQCI4G?<7>)kBQZUlCrhznuFaIC3t0cuADaR zL{Jx~wH4FDj}Oo6+36EA6q{UaV-_@+JIX@>{bUM+HzdyOl+`7;NJ`d7ON;HkycnbD z^3&9=76jK^w@x3_l4J$kNNI>?ugJ|ksXqNin}ZkDw6|G)0-o#H;>t?bAwohz>PE0g z$(8>ek^YT%JPrjg1n`FZlYmxM1hNPj?dtkkj_QHFT#y)o_ye-ddl2Vk?bVQAf$STp zzyNgjCT!hrrB0@Z+l4e0%M(J&TYzeV5)6LH38(`~H|>)=Y>01Ly?qtozd#fi7FK@U zSO5xgjx#< zfJi#}h0h@E*%HRa-XS|0UMT{kLG(1m-Q}!sgUN;zIY`I)IG~q6)CI@-65nm87N`mF z_I9mFDgf^wyEV)C^z~$73DIyqw6Tz93AtkGE&c+QNBU`OR zQrUtZwE#K4nr`JL{cdXPn8nIFQe#7m)D=Rp+RVn2OCb3LO*ArlTMtL(k;|jMw z6RuTmfdmUwWmJ74^UL?0FCJGpGEdDSk~9FD5!(f|k2s%$=0*XH1>^{_Q+L8J*nx=h z3J@Wy`E?Z}BeJ`$qI1x1m(|LNFNjX=L<8gTFYp2(QO#J#K>geZC=l8?5r|v-1FC(l zm&J;Fv_udCEB-PSjj#&M1b8HMI~BbM-CRM@IRFEK!9KuKys)h`&Oeo!yTLGi9_M#0>aO|J0jVQVoHiOSBHz*;Z_IcUP*A`p^H{LfiJk}{s@<^;Qr{30dfk7T zx4x?vUO6}xO6e>QxurNll7Pk-#uy#dSQZby1FfEh#&Dx46rOVE?4QR%@_EwG z)Z*9Zbg4B96gENhfz zrU^;TpZZ%#7Z+b$>IV){5>P~2T{pEcx#pM$x-%#$B)e66gEvXe`8_^<|7gv5m@U3l zkSSnGwzU=dbEuC9-Wre`5~;e2Ro~yd1GzDG?)~&dW>ZTHVg*aKqa53B+ojGiXV`H_ zXs1koGK}0r%P;CH(t&IU`fxvl4 z$u?wnS2|5BF|}~$5#b|<0#edgY+;BrG~>{U{x5RIU?H$BiWLS5AP@o=4b~Fslrs)5 zVIhTr0C{3f%%ZGA7rwOh3b(e|BWT*!ZZ~k)V3{OAT@33AO)8;66n+uT%?;`L@2D`q zumQus1>reX74`%$&Rxcehdq7o;(M;&wz*UAZR`4|dI%6mX0ZR@v!CTVAGhBwfSLtr zYWhrSX!@23_WtotjV^fg@gl|Os2Zc^WVxWlPNpINHY>w8x~Ipw$^l?PByeTU+1JL=;gQwKci*ywW)@p! z12Klt&Pi$em%y=RXlMw5i6A;qEN~Kp`tS=-6^X6@x+KGbVM$1e4A-go5)FL++Ir(I_FLl2d^V2}o~bp+uAwO9Jkm}}^SrV;koAuiOle?^*1 z4*52q=p>F~wmxu~(i73;yltB%`nbaa;!7w?Y&28Q*fUA0l5P2)43prX1OoJOD!E5aYXQ2k87JlEk4KcoDmD69l#f`u zp?w?l_C&IidTt1Q+s%dN<_jB4HbRK(`FzJIDPQ;U?5e_utw)a?%Z!C>5rYEW2_&qD zIu!&?j&l^3kWSKJyDHQG&)jp&-%zCce(MF}SG%el}G+>yo?@F3{Aq=X!(5L#i< zHS{}vQ5ofX0Ujd@{XHCGX5wq1$4ueC!XYY*FcS>dd-gkzLCEQdeo-g^CAkj4`*qjw zZk_DSUKS7#_$HeQP&@+RV!i&S5haMn5U&h8G~!`FP?e#m2$n~=E=dpZpB&L`mY*Yk z?8NwNj6qfV(dz+31?i%+s3mP3Jf;de7925xqJX?Gqf58dQ}Vyb5$Q#oD`C>}6>@Ok zP-#ia?|ceDI3ae00$QkR0sQXA2X10;fFDSruM2b_y9%BiJ(EpdcoqtzX|y;f!rAY< z1Nm=;gbb*Fi9nq)uuKFEG~nTo{fTsNAmdiND;;|=oXb@H63m4Rg!BE}kn`w6n$KIs zq<~DT8q2Ym$;OBzGTF{qGGY+vRmVL9wb=D)@TFR}v!u5>DXf zkVpxrIkjL$Xl)Px0)WSA4*izTKUwMk?sUuKq1gZv?)-*|6U=cPpb4_X$$|oV_G+?p z*Z%(g+zck*ypz7RXwGPrJR^6{7I+Qe5}YS2$M>Z(0Jwo$hH=%;Kud{~T>%%WVppfv zY0J+L3c3o=;Xy6Vg+-o21b&1fce2Ov}=8ta>SW1OYDSsL1& z2>1e$OF-{4JKjJ6`>a&W`hO}dX_r2PrE)&iY(a3>+1_dEmn*Zs<_jSJMZ^}b?P41r zhImO{Ac-<6YSk^I?@Tz8z<(P_2L3dc{IsAJhBTKXOoQf8$8Lkybk0{h?W`TDKr8hEoRgZdv8pkD zibr&gUBA54+T$TJ_fPE~&Mc8Ha@b0#Y<}yW>99PGJ^RkVXLS*D+Aij08$ikD*3ch& z!iZ=Z4bYcMeZ$52!y~Rktqg?l$@<8^99XseeHro4USKw1r}Yjs02r+g`5ts-^aRI+ z$ekyrF#2goWfpvR=7nW$6&%$4M~2n6jJ}}vuYtH3YWM3vqeL#g1Yd#TmWNZeMN{q! z9cH>#g~2KS3E&5H*-+_yelPVCwVc=s)zY@OO9zkZ}K%ltvC z|7zS07?Q=(C`o7qlRxveubg0qy81l&h7nLi(=Mp|HUC{L&`PQ>#?HB!n3_@$z651c z()+5#@ITVL$QF5T79CAYbPY^t)1H<*tSz5Ml*} zC9W5OfCF?BydYafddGm~?ORL(6deMmZ1r0@o^^En0wF9C0`qkmi3xvEhlHT_I&GQ_ z2_h;6d9LG&R>E!wUYGg{W5?pxod?Y9i>fV_3I~^vgO;lzgH@$1HgLN@euX-ss0(nVTb15^oC*Unh%!==whtjHiMwC5IV8NNF84W#TT)#z>pxI;$x& z1SKAnuL!C>o>}-7s0L!&3-R&T7;Ev?5N~K4@M@y7Ee0_~Y9Zme9||u(1Sb_Epu_q8 z^XFdai34N~co>?2-}&C>!DahE#n(uQMXOGL<)v(r*&JJ=a=rwx1wiXEg=A_C?|>_J zFI4sUV`6HDKS>hJ`9P85mik~Y4Rk+FmdZ2HtG#jR)jB#O?vr8f!t4GN5AQ_0@pkq* z;H=(q)3Lj`Phns2;z4^_0b$+iHfKw;f5xXYdganV2$)L93s6Y^NyznXV~r0M&VoxU zDlSd|tp-q{>=ZNhm0aLrp_)lrIf{S<;QyenTL-6#(s-aZ4KQFS&o}JX1|gr$Tu{IB zqWvP~rg{{MKpAf9L1etF1-hI?fY5Y0Q*8A{3NT|(5m+2$7H;_VJ5x~z6%d(24-k2U zJ5m5^{>3u2lk@o1V%}*VYz#XC$hu*B{i(T)pS~PT^V4}{57)F%GSHK zwp%HM!?86h^nw)!%X6iKwI(+8CJePuvyLO*znGM_2sq)VlgSN@DZSN$54ZP$oPIiCo%!3uifYgU6AY zLg?C((a8)_NDyB2nxZKjU62-+@*l!8{!fcb$Upwo;&NbQ1dcfX8!uHu{*TfTPhdQr zL*CR@ENQdtRD85pQ4Zu$b`XKXl5$%+L7OL_%g!XZaWqs*Ba*1q6H817DyD2-)bm7% z->9R7pZ|i5m^hK%*Xz@yXZq{ClkIek#cLKMB3aE}Nr`v8?#oVB$?U68&Q34m9Dkx_ zkN?ii$pdMkb^rEz$yW_Ki*cPVnOlBb{Wwy-<32NX0DY=^_iiTsb~-tF@iW9*wzJEC z<<@qlR_|Va_d3a)bF;qHq&WByZ4;?oL+U%G0~_k{sV%%&PbZb~3(SIz-!br0f9U>h z{Gj%S`g!FZtFE-0S`Ay1qR}`GIKyV77wf~jUMt=(2#ZR1b0#q08@F5z?-a$4Z{f*L z2xtlWzFbt;d-{3(o$;;6>n^^CnuJJ$T?vR$(vTmQd2)=UWv0 zdY;**c)_90{PXLN8+j$qs!b}_m}GtrFnGL;$Uc9G+yK6E4Fiw$YHIG)sHt<=mLO)- zvMxO$|Ca2F=L&K3-F>*52iITc61Fbx^rkK*)BhYc{g%wkoY$BZ@caEm9BHN38QF2d zuLMjSmM&nJM+n1PkEDm}i_YrrNmna*#0P(szc^oBK!;i)`l!uephd)Ekwc168SE3a z-K7i!+THnT;de@7(`Vp z&JCsst*^V=oOjO{@i|-Wgmr4GW_-i-zT%AsQIXZJw4Y>F1(t+--8ne5d9mKv{8Gvd zY>Ja|_Ty1#>>^9AneAmC^{lVjj;6%V`bODOvv>pp!|C1bkf)Nz|kCA!Bx& ze3!GfjwDTVzd4U8t?D3*vyDXG{|;?PMob~Jc}@?t&a3KhYe zg52d?{a(}JfOlyT*L9W7%DHAN?4_1T=36MPiloYON;*s1f0vrs{D@Lv($6%tmo_^* zRr{r>HsYI1NQMk%Wwbwux_oJ4kCE!;Kqh5&#n%j6c#8}2hFBj;lVl?sBQf+Y+lOx! zob0w-B$*q?qOY@JL1*X-!j_tw_jkS>%EY(d<3Z6RUf8El=Zy<$n1m4 z!dKF}Zg!)NEZUFi&4yx0#wo*0);z0M`DJS}^F6bdTBjO?n#vZBS@u95oe~tCv;u=8GQth~G{r%oI!&c=UO;RX$FLuDet3 zF0%7UQw0$fU?R)limI7b&er{)G^HYp9=Vk#p+MGZ+|<$ zJ#}B8-11TRU1Abh{5IZU+~}i|(r4V)6yiTQ6IZLU9lE0|%Fh|I_&}bh%{A&!_rqyY zc=5j;-8-y??9@c`q@AN{Z5Hj@=q3KZe8;a9?)Doq=89;g3hOP6@4@nsi#(YkJyy>^ zF}Zl)pX$aOI8%`}qQ*Xa?Mn9rm3ss8>-8(P4J%d+Gqw#Ao3$$hSGAXO@5$E>=`shQ z4Nqefj!Tbv^9Ob4Oc_a+RG7WvSNc!r^H4exd>S9sy%Py=H#r5+xyPjUTMVpbJA`51 zvg>FBOtY!tI0{Ss2#K$RJhhRU+`9hh%dyv%`u+;vetRS)rKM2_3s*mj4+3BEom%t^ zr*6q)U4sl_dIi%sj&1nOx|MP^%|^7CO8R?x&SO#L4W0@$&v@JZqPgi&Z^pdA_L8Zm z`0d{#<>x2u*16giCldr6uvJYNYC00>?5k%2PqZ$ztTIb|LB1T1n#f>DtsKlgt&lC* zjh7!Y=1aV9T&#yxzM67IGs6^gPOrvG8@w=6D{i2PW52;ljt>2E;zQ|=0;S|0G|ndN z#Lo$oR~MQPx29r2Y()R9>`>eBlmxDt1fEx>XVRKEv(uVjqWcyBjN zH{Lbm?}{}sH>DuA%uuH3-j#L(oDplkxim=iR>n-Frz_gu1zn0eIJn~3e-`?c-Qy2_30@3^4lUYb&+pg@ zr0^QN?JjCfd-EnS7ptM!0JqOpt1ka#g3|)pgyHI15)o%7a0q?%1LS;qhwwlm`_idU znJyV@6Y>_?rjhHwLW*W(H+r_emGBL%WBdqr-|n;OlDs5V(3qBN(q_MV5li zZ_J7O@Mt~~?8bfiN6A?Yt@kH|52*Eux8a06h82e63rKsI?k%t*^FWD%34t#{#yu^GTH%LxT@lEmU}u$vK*8~F_iRaTA6z}(LD$>jNWP}#OqAzp zfWYiD+aoIh?WaolL~zq177oA8UJyG#j7gmCEvS1|X_(#kl)uJG5Kg6#AfzO0bn8O> zc?#%xcsK|a!*MN{JZkrsANc+1hw(ao6r37e>*J*G#9*^jmwBVi+onh(VLLk>VlL9| zF5e1DJsq|i@I^jlX9PaGcC^3%D(uF&Iyymzx)+58N-9a!msuuZZ}{=l{cctOtI}99 zBrw{Ejn5t%36FhMa%I%=tP|>P(YJ7t5{(0}NsK5x4*4UyOExn%RpNc~ulh`L+cKv} zZ7R0d9WEDd0VqDH0karJd2{4UA|3L7ac#NlI-k|A<_U}=urxQ9P*C8szBV0*5$C*2 ztF@izrm}rvw@(Wzz2LAc)l?Su?kXcm42f!#R9$y>;Vq-FCj z{h1Gal;k|Du3iE|y$yc$jd@k>#C-cfK0(V*U5341Yw63SS2zLT3w%Li5a)?j#TARj znAH`dsbiSf(pGh z8_Sz-CxSXG`pda}b1H8ig*65JHu1GR>TJwMgblWRV@kErP6?(KFe z8I842d~)bobFNM-KMM7=+NaqWG9f18PIy+IaO$1HB z19v{|pe-Az!@=cMr6!5rHn?YzK#6_!G`0Ua#%*Br`K#vC{za*Yr8kpy>c7*H7JG+G zDL8qM)|Wh=Q6DQMtFGN}3Ys$;Q`KbIHn_{24y`ZK9yytFe`CIa(#t`Vk71-MF{E<$ zC_RnIT0Jyt3bY>TK7FEb%_2FV_y-6UX1LZlSZ+j zAVIi#R=?eGJ#(+6WKG}g%ZKjYc|k&7Cn57~=Y_w5)ZzE80dPrJxq{?VTNBSUW>r>q z@aCf7z#ERezC!kY75CloSodxJN|zBrh_Xw{P9m5`YcPNPIALModSvN_4# z*=2Sndz?o0IJ3uTJjb`|x$pbBuHSvXo_~JN>*=42(|3HvalDWB@%|h~djkFH))Y@$ zQ$+%p+J=At zTsE>T;Varcwd&nOafxytikv|MoO0QN9 znHLV_OWW!|#A?}H%$OYJTw5+*Bz!*Qx6_j@jX0sQH53f;EQ6DSoo;n>GEV2y!bavM zV_S(;tB@{yYJes^+mS8&*S4m)px(e1D=+E_fa!h?+&DtWFW9D(r&joj&5bV~FBeGV zc8x*hULGx$-*oP+J`x0@twQ*TyFopF9-;HfBX`fww#DsZ?;ScSy9+5{F? zvbsuI&K4KGd$fo@Q+HI}u;n}6SKDDA42*7l&55s$g`U+W+LZ^e^6Ks_5yGw=Ez2~} zP9ovQmumF|F9e>K)Ls`|h|FFs;2F|YQBRW8y=7%8;tg#a(Y=zEqLR{;Xt}o~!)(=W z=QQlZ_@fPT*6d!k>)qDM8afz)Y14kV2*_o2VS$(`#z9szV0tikBWqz8BF9Emy}GW* zYFh|e_T{>3Udg*cIKUI-KtpZ&oSU6VDVbZbkNZ^v`hf3MLEZS7)UW+Dnkxx?DgIM( z`MMD#o6m)3T)fAfQKJ{x_t-%?sPTnldJ8XaIpzQ?lJ-&U8itwTk_Mnqw zlKP7b6k~x=cO_Jc8hRPfgxg9fE?x>9oPj4aSNufLT(Z%4I~{{^EVHvhntw_{K?@-? zIzo~-*#=zL#d%8;G<{lGV}5|tXw;||KV!~$x#V2S`Td%+n0tjHiFv|Vn#ZE|odzkX z@_avhAF}J=#afnMo0HH*qdCfwIKD|*>R*GT@j3f))@3nAJKXQL_H(y}>sC3Jc=S_O z4;)Hv$sLnRq}qIrDbD(l&wYdU!X49~yRWt>&Uxaqd_yKRn9|Qu^S-KMNm4Q!T3lA= zhIzRvEJdPE{KL|9deIB`1919su=npDXN5@LOEB^iieb(DXqT0SL6tjq zZ#~7ldDPjNN9k(=a>jKQc?lW4*gM*sLB=;yo?@Lm8{NL5S}xR5N4KP_+`Gcg6x%TV zl}Tu;U~X|y2DWJenBUx72i9HZe+the%SKIj<~?w-%C@IVba2vmw)V?PaP6e1jFa_e z-=BG7*K_0(hcKR<~1TYbhZ>2}ibXUapAm(Gez zH(sXst3q@AG{bt}&vdH4Uw!5gsX6CgHFY-6EM#Ix&Hr0q`p17~l4Gdu{{8tcat6l! z?IGBM|9@X@T$j|GD4@>l5(D}F^WQc@0I7M{UmxM@@w&iEe|!0>a)Rvbf0Hs&XsD80 zVgGAEQ(0P?`o9klRnz~~I@{x3fX>rnJCcfmPc5A+8hv#flk#wUZO5!|Kx&=+ zk7a@}WME*}&e^;vCmVppwLqH=jN4LkkRatr-p%E1S8RI}VV{i7ENtNm(kz(42VZJBZ*i-sBEwWHrphE~n@K17FmP2U zk^v%jf}an0bS%9c_QeJSs4*?cX4B#tQRyG7&3A%(pk;5K=U!`%9XM=q{2+|ML@}^* z=K#*~o7f+tGH`lX>QE|nmPNB@$_YYTcpSDxOVA$KvUudT>Bc2joSq$fpAsWseP3&c zc3QYVY5agK`(k3qXHZbXI-PSb{DWqor1dRdwCLr*@2>~F|sP$$=0?y_#Cg6{I#KUfB3&Dbf32RV~jQ?4S z>to}SAOoNbk<#mYw0@0+5G-n)5QG-)r7DlA;2T}1l`oW+7;Jq zth5ak3@jpxmFNq3z@1a!ifhJlyFPXvi;rQWK(yc7^pL;7Mn!rl%vhuP!KE)rPZFpA z$ML)|b1|%gxBUt`TZij}LCdXJCuzA@XrUM}M?w!@_l7a!66EwsGH?`5-zUDJ zbhoEN*I<5ri_LEDO-6~b9Boc^w&C||9MoT8VT84WUbCLO*X^Dl>dgXIl4DfS?mh5@ zj z#eU%Av3!aUdnfEJ@W$nhNJA)I2dw;0fJJ!Sl7T7DP4SmJBCeZNvt)ir$pZpIU2^N3 zF;spHLV;7MKg}W-4PlK0`R=t3ti@b`zI?a1KE3s&n6S{PNjnKs^a)Vr=eHuvQ&M{` zAdCL8kFwt$`5sDpPdLFQS4-MqB=`xTv?WVqq2&xe*fs4vZwS3Wn!7^q2pi56bmMZv zY(p}OWT+u@iWx#-iZ+~P}d zCmWgTS7#=`*f}sG$tx4=pq+i14Of0 zdu2!X`xaK^_@mR+1hhuV2keTIC(C@29n$7;Xq?) z6VFRXWk47t>x9EQIe)DL7MB=2gT}tY%D3AuR8EtzxyXo=9Z7g2PNZ#E5|k_axsN8P zE1lcP|5G9su6;z#^q}>MGOv+Q&h@ABafz_ZdhTN@eCdIckO$)mwovA~{BdgmFbe1F z_Gs_-mF_XdzKjn_#zlpQeOrKSamDWPy^{UMz^P_z+sZb^cVBz}bi0|sC@*cN$;J80 zs2Q?%#;3TulIjP@w9k#Mx7Iti5ZFXV$YJ_*41<8I@&VTE5Pz^iuHursJ)Y7s;j|TR zD0lRtk-iv^q1PO<{G^E0SowCQd&jP!2Da>0l1RG=2!P5-Dc|w;w0GZ8x40JWyisWl z4LAptR^4^^tz9{%pzT<$v&hjae!r$h+fim}mm6%BY){k@@OUj?BjCP<+E4EpcMlDU zT}pA51lqOkA*ZTrL)|$bh_=gJu5kXCe(yPODC3w+07)fSB#k%)$!73(pJU&IhsI}V zyAPzas9C_PBGZawY3?l7H~C}AVf30HwsJnG|B#Q9_wv}k&cgHz2WL$WA3*X ze77xn%a{WtV1QbGDdcw?xV`4@b5G9hy!SyPFITW~ud!Dwu6!j;{#%UzyH(=JVf zdH#s&3-(jmk=XN^Cr_K|kWsdc&2UBV2W(%2x4fgT|5>s=vIpaMp&$B&71$_~eguLZ z9FP{Nc`nL}waU+MOz+yG0Jjg5h|CX1ioDSnxW#(5 zSV2gff`JTa&-uatL`POVZRh^a z>f0-mM8Mf(vZ&wel4%Nm??DVTcOXCdf{?=B_wLu~}_Y9bwpD15JUty8vK-?FA)KOSxQy zXo=?B*zySF(i=7uJ#uk)TZELHZZ|v*DMP$~iZuW&**JorgZts7- z51VGPNJ>_ztoeh_0jN`AXzBs%S=w!ctyOinA)hJuyR>RW7tRSBW5Rw!FLLv+C6^KQ&{w{v&ym^ix#Vs4t|PE$%wgXXQ1vw< zyQ-ta6lM|u&I`i!@-UJ;6deYA>x$tAPi|Z$zW&u?x&HNqF2vOdp5|Xrgz#T3K;Q2xCelXDf2)BHsDvwwzZ|KGD2p(aQA>-0$EeubXRnnUb7U}4f zo7MA0eHAqqw-{}QFq}xUX1KqI_p*$t`H-r1!1;UQ|z^W z<6X(@*Wco4eYh=pDMY`UVx+5X-1*bVq+qcAkdOgdx=Mrfgzq5aj16Xb-Z!+!F{AtL z(fQgC{M>75%MTC)T^7L?8|s^l`(P4aN*zlLxAwG4M2lLHf__)HSZkL>34jBGUx9-u z0JjcctV~}H?WCogt-68VpCB3p2hCo{c4V+t6u6lJ)2XxIS^yJ20?!Cxl03j&PfEy` z04hhODdKGe1)FoBC7_mRzHOa#QU&hpl##G+kaLoT>_XMz!~WaGA)qn<08sW|Kh3dP z9CG1!pQ1sZ@y*kjs#?K9>_!OoZcLvDpM01Vb@hdu06T9|B?=Nk8`8L6HfPu=)d2}< z3oK-|&oQ#+ke8>p19fNv_4%4RgwDR#1xSPBC9c7lUclBB3vzn7zL59NGw}A*)TW4{ zjhxtiuBlgQP6jJB=;7hH`AKv(mhg*BU0bxjSWR$^AvJVfPVl-Z+v^ATDn``qNX@oO zm6Aock_x5%1&9}Zyrj-S^482)zz)!H$z^?$Xqn>;7fJ zUT1v50tR;3;Ea>&-p8>(=c`C;#}oeeWxDW@qYH{ak3zyF<-n0h_NSZ8_{sX!a_qO& z-^B&2Z`W{Vs;%=Q1(Cvv0EJi>f81a!3D!uE9`oQhEV%$q4~`D3^haj*Aw|Zo3XMDh zvi-#;kMdy)l`Loj4r{52xum*U=e}<3aKQ}3)1_iWRt}eUMFQ=NTJ4UGl)DO8$cRXs zW1JB%s)tP{2;LQzLpZAxwbcwnb&#`B8(!i!9ZFFqQRIGjrFqKi&|j7z^0H3Oq5F!( zIrwa}fN*A*p-FNbZp*Sopt5P>^zZ7dz2Dtrg^ssOxmW^5oGmtxH5Cr z-;Y$wu2JkId(V#b^T$92xmF3&bNgW5;YP)r5D#I_a5jm6?V>B;7OHEX! z3$`c3iE}2VZ}6c-OExt1(ro2y>ak}adi~~V1!D!q@6iYg!^Vg(2Cxbu^MYCAU; zo_xKZl)xYJP9B^4b%c`2P^JuEinQ6z6-}dLh8;2QP76#8W`R-r8;|CZrOeQCJr0nz z;tiT!+qndYZF6z|Ru!>m-QFr7n}WQASE6wrug5JN!dlUBaq)?0 zO&zFs!k0(-zvd5tIsLf0W|dn*zn$eyHO2gxA&gh z1k^95sF)tZiLp_k3Kj4gF)U|?5ae>|YSOEyOfQd&hVf6pXhvM&GWDRn57rqnehfVY z(5IC9&M~K*IF%Rs+`1c8V2F}^Zhe?{;%VzOgZRCN`5ACCTHU8Aj2u@6E;^ud>FHoY zQ`0H!B$FRYd-%~F>2kYY)8hUA7n+&!za7WQL|hKQ*<6vzXq4pJbm zaJeskrZ7SEwUb^!W4eXaz!?n5bx2l0LK2oe*b#r5oNws@Ml#!o_AABAz66q*V0J(g z1v#_&$MQ`Rap(IO0TfyQn*qFvjxkU2uYETa=xn^tQm`oPS7!t{>jvPyn(hP9u9b(D zfuOKJ!s@K(o-rKVU%Nr3E!jPbb$fr@MfUuVNDHhi!VOrEGv$IF) zK^S6!?6F4=!0jr-NCO7~+(XN1bCFuvtY8`FNU ziJ5WmcJNiICG--1P~OqzhbSlQ)Q+h2p6P3WQn|dN->P3 zuR4wAb;d{UEkk7K{lV1)Ib_doXdJr`7}{qw&Uf_yPqFwQXjU<#C`k`QS)k&9V~(18m8nIl?VTBY!da=hX-5Z1$CccN#;_|8 zq`TwvCg5zIlY5wWm`E38&EnSB=v5pWUx)R!0lMt;py(dbdy+y99Y0H zg0jjy?7VCE{W8DFQ+H`QLG?w|^9CcO>v*cK0;-N;gqaekPWW{}oaKflM)fJ>`kkNh zJNFB72h-8i3vvcx@Y9A9Afy85x;#tFq}z(UttoCL_v(IT)4L0_@x^Oz(1?Q zCzHD9zrC}P*&eY4)ye*{FIsVFK0(01>b=jwaFv&#__SNa*otQ|H(5aVjWlhAleQ6x z{2hN#A{Py{{efm~3KfP#A^pwD&-|vgClmWyKlaY7u>%?StFB#l@uxrP+U55AihdtS zS1!Q)CjL*YOUK~EKOD;SupNyaJOi~+uC|vOnZCcE$6i; zu9V0Y&*HfX&xhDkXlVdx%fsat9MyVN2JfmTgaJ^m=%b(Vvm7YlH5!?R{3%3hn1LQ< z&0oF?)D|b^tbwh`hnb7XGuRo>?OT-VO!Wcf1c8C!5QzR@y0aXW(z}9m3~%77jvl=- zck6QpLaM>?&95$D0f!5KEbgYqmn*hQgVm-9T@jn0-m;5~1WColu0rH`tCqAFJ5#13 zUc2%vmJg)0Qg= ztw%Aoai(7E!SZ7$hz8ch-&VC=D;S{dDPX$A54K1l!-?tc=Hb5zuLeoz<0dusP2e-Y ze#rxiLEs;uTBoeemVYV_G`65?E2xI^0|cKQb)53F*AxN~18^ofx6q&zBm{#v(`ihF zejTp=cJK!XtMU!-Kiv-&^SfP5_hvpSJr&^Mmhau>68Y-PU|HJ=!OA2s^T6wC-QuEA zjip*HHh{4OcufX11;Eyy@VVfDYk>3f${Ly5exvK#0i}e2oPotPWDr}fvidcH^yREy z4V{$Zqw|t4v;T?mk#&Vx(=wPY5|3Hqbu6Nw;>1rBg_aUNLZgcziauqJ$;tTDN< zi>w1Bk|giq&MDX_j~d3MA+d>9HLc(VtmX1Dy{ZiljYi1s^eKW9#({!qkR5_8eW% zPMfoRoxAt4eFBxHO2P`Uv!>BmV2@|}8j;5VT;8bMte;$Ymz~Xsz)z?)*Jj|wT;;sPx?8pFBl%;0ixF9bO(CJs z=cW08FbFPbBjR~Xn(anB5Qr>NevciB-I2ruh;0pPU!$G;&$Cq}Csg}s?0)0 z&re`HPoNbMX~v2-7=Uhx3C5Bf2%@-=$h^rg6Hm#W1%nxnqQDzSiL9grIT5& z82ZQgrXQE*Ao~Kp*VyWQ74`Nv0B^oez&iZm#r|R)$ZZa%e_U$^VJT!uG;|@w<=7~< z45B|h5UltJ7rf~~4QadzPtTkqg2i>owfE>hKrAYW@*O`bNU9*vyyxJ6q;0^{L+pha z?1eFYf<%Vzx4|KA%OZqC+!u-0XTg2j?OFG39>L?9SKN`?nK&g z@*3PuHlWef&zMOlXNh=?L)Dn4iSD%);Adgszn`t7%fei&1DY*|?8q_huvW_xCS;zM!c8C4 z>L*h5?(+Xoc`eRd1}R0Cat%?#Ukb2{PpqxQi7U)BYRqY zo2DNBQC#>hvL}NxAbTQ7@NTW;Gu7u$djqi=jj)Ei;XxQcdyc^Pc-CjBZ12=aD9Ooz zvHm#kk-8|JJNOZJJ>Fg#v4`WY=7rCi+Qm}&ZGrKH{zj8c9zuLhQL}rP>!t)tAM>FJ zsr$j_g)c`2t=^9c+C)akp#a0k0Ex){&=iDLIqchD9QP_4h(FF$x z-k%5N_io6SWA#e-UOQz(o4%H~UolU#syBZX)g^I%^(y(d1)-bj3F3TV?jQjF*sNZc zmKFCBcMF&lh<_K=7hFX)TaplRt=iyP_8tA$=~qlw-MG4}ttx51N}&nZz`ma13qC%dlOtk-KalS1%Fu(ZETp4l)@uI8mU&Ah;3aHb94;9h?kV-#J#gv%ZhurC%&IISat4Yp>)4t0w}2YkhP;Xbik_*wYYmm&=`0Y&4B3V5rCtJu--zk|b!y;i z)Xx4vsmjGx`ms{#j+F({1OB5!>rchiacgj9$sFewGF{AC|EPl~y?f(5Wq_nCC}^$= z`E7xcs8AL3sd2Sy;GGNj(_XdF)$nfN_XBQkQgO|V(0;heFy*AHTRLq|qn3Wt-SX9* zkJrvoRPB$->43RJ0hE=wsp-SdTRh#|WW`}OvR`nVA#cTK$`v5VIfo1X)GYOmuJ8C* zH0PF5w+U5ORw}xa;~ryiigtEGjKy6Wc>+$A4ibOl8kXY*M@CZ0yP#u9$AWWem%mcT zsMiMj<`sro?dlqh52ak18-A{+TFYunQvM60srz(}V$kPEajOuM72SgJF-TG`L!x#6 ze#y4c(Vv=uK?@g(hnUSv_wyc-q54ipp!QYZZfBFtR7oDnkd9NnFWLZrf!_1^_Nsf=5u?@GH)#E<-z-bQoH--XgHA^SBj)KLEU!q-qlbvohsfd^ zLP!0Gm&I+Kv@GDiVt@OWv1||{4FNSr zh*=~Sm3mvXcmvM$JP0CIixytIIL;mmk5}z1A^~T9lC!f} zOAQS$g99xQf73!KyL$V04wyG32Ib~&4q&9lpj|Ds*EjYgDjm+J#BgXx&%tIPKY2=- z*s-{(F%&QGZ?s3h1WA*xUkvdHtjy}uqjIjnUoqrYUhSh~`A9ncsR+X&lHiCOKboIY zG*qN~TfNv=+cmVZtU$P&Y+-TS_b~4E4D5ZIPD@C1OU%dzW^Fb-wk36OQkzyMurA zTh+((4z&GS1r_{|)vCy&y4B%<0S40(1b?_*6URNc>|7nkZ6M}^tccds{O&3Lj`8M4 z9Z&q?X?zLQ)+t23N{vY$K6?G9XZ_QAm|c?m=KRj-lYh;T3sCHuyx%Ba)Fk|P?@c1g zoj_+cu0^^-cM%EaGI5xxe6eA4eZzlzINM{Zajiz_mx<4CnO^?^57X#eM!vI9d*we& zNplO`{BWAUA~u%l?!S|a!Hr&YU4p&$pMJ@H26SQn>EcwOhs4Hm)lEH#rC|i{Pg!0~ KE>Fhn@qYoFzugr8 diff --git a/packages/o365/1.4.1/img/filebeat-o365-azure-permissions.png b/packages/o365/1.4.1/img/filebeat-o365-azure-permissions.png deleted file mode 100755 index 19a98e687ad02b60780ce4408929547b40181aca..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 301548 zcmbTd2Urtb*EWhEmLS5T0s_)3AfZZCx}aDnq9lYC5b3>#P6P!+sv=#wv;;!00iqz% zdnbf|^cs4AKyu>ye(hZ6|E~Xe4%d}Qn3=t2_L{xdy4St#3D?nn!U*61(9qB@K70D; z6%7r*f`;boxeMp0du}N``Apr>Wviy9^Gr>RSI5oS%GSY>hURH_eBybK?gVRSU!!c= zd)5zczx1bith`dSIdkpXyQtW+SDs(G`0(NSrRW)boxgraWar!j$b1}Ue(CToxKTUy zp$fYIt3!bgoA>)<;;5ff#91`s52#q!50jRk{y>j2-Gy`SGK z!u1PBFOmcwL ze{Lg6@T+F3-0Xa_M9GMmgA2)P$bD*|<+5nHFU65IP@j1|nV}_KSTl{~!4KNaB+B*O z+$`6t-Jitc1d_TgUxJ`|QdsW&unm5lAfYWP1Pk{0oSAfyRV-3(@%dFr_N(2jFBapi zehF^)b8E0;-twf1|L_SuG`K3<5qU9V&kVTn#@lh=H~ci zhux~QC7b{Hqqoc|=UsUj=4tP}e)pP}M)iBwf(UoOlQZsFcTI(#E-ekRFAL5M7^p^{ zO4V27RNSJ;v4)+*dq3fnk6_-I{O0J%NTZa04bZys%xGMMCOVf!#V)DRpodPSk>{jk{MBjGJ$kozs2Dho4JN_=jd!Fa}g|iR6KhVD9 zgSKCg2y@`GZl~J`3C_H5m*aWxt4xol7oKIQ+DL-{@ekwsxeLz8ol6TARe@xQF7pl3 zF{(OeiHXz3nTd?kRKMkV&6IQ|tfg#A;XYSy5W~z(Z$;xXke0An^+Q^Jt|o@A8OWA6 zEi=pe(CfEgAI>*Fy7|fCHsfEnx?-<kt2tY9x#lV)#=g~a*4MSgTfv0QIfD4($?u6nWB+@B@?>$c zLK7!GjPgi_@A_X~FaCIM5gc3kQAhj!qx(;m`S-4>e^`Cwp3QdebNijetFp|*zl=V} zh6nuo>+`ve&+}>@?^wp_eFi@D{HF0u;F}i^2;>K*11rF1fkGf4C>mk>a^>Zb=ICu~ zZ1Q}ag`kh(5lvnEN$g3qYL>pviD1VU<4)h_j0-mx*cak};1QGf+)gkQWtclzFj;(T z7*$|}`lXXvqL-m=;bFE8|nJh z!x|3WYydYZCM7sjD>BP$3@RBb=PLaw#dI&_iRW$Q6{WqB&GqYil2#~3mQzT(lIEL+ zmNWHOsef3XT%YQZ>XET(w&$>CwI(u%&GmZbY=amD5emN+-qDSD5%7&^4ZHkgO>6*< zgsZ{FzxVV0RIw<<&1C7)ybVbk=<4)EGZ)?iV^}Teo4DM zHOXE{@XFH4r=|Ml0~YsQ7n*mJ3zrsE`M-Hwwo}nrhN!MLkE%E*?X8@)4d^;o?OHX9 z1x-v)~21JZKjR-gy*gEE#2Q zj5Ws8)uF?2t5fH2JyW_O7 zCH)(Ej2hgF+|^P=ieGPVUo~MTD>U<~-WZU$n$9lczS}KO(QSRvTKaMDQ@#1c_WYL# zFCV{OvenSq;WO$%{daE4QTu=Hlk!hyqM~7gH)cweiMdb*=7%o{FzE-qRyTzPlBR8PLq? zw~aH805W&@7IZoxu-oVq#jl;uai4%o;t#O*OKQneB2y33nMxwZG8W_X5@cdG z#1h)XmY6Ok1wa3h8rdI-W9N~)CCOv~EWc8|T5)kga3cSGO0%XJNwp;;f(;h#@VND+ zK{TXy^hVu%;|5dOXN%8L+^hN*mqUl2AHS;<=#wo05{9x59}BSB3$uzgeR7V&$Y3zM zwKIu#lJ0!H;~4TQM2NvJK_X$(;GBpCbhLWP!)IWpiG@$-GU|45xAD;$unla9oG#JU z$Gx)9smv}QhQ;#OMSvq(TZv=dB@?H&7N7ixNwbHJI+>Ch-y69V50_Oo?5)Z5*4ryT zI0bFTy$P5+?qzi1ggO3nyynzU)8RbyLn5j?xO}=tQdZU}%UN(@CvYve7}AxWNSIci zkF9hAhMbfUp$!29xhUPZWVR{<|;q9_IGiDrZ)ZjyH@W|q$TsUAq_ z8G#ZBts6a9(i_v0rf5@zz`}`=8jJ^}hOU{e{N2ELto@X|-Q^XYNgal<=l18B`V{@w zp3Zz)ltb4m?pGcU=FAlAEq9po5ptKPs^z4ll5I4kS~%SBlOl|J;gSs-;vx2UED4_mlV2v4;Nof=X`1tN`Ia4MF9*q zBx_O(_MJyDBVAJ#)_$~pP6{zTU2<5$f-k~U`7=?-k3JRad>DUopfB_`lTKTMZf4^Q&E01-Is@Fn zQq~Rm+*hRnnXcd3%J6O=aK~}dcrHs#a@;dIbN}Pz2o{=xBRcU(*4AUX@z%!=$b!#O zB6hunB_^S7lm)L5F426iq1n))OHXFrcD-Ob%>T|8`^op}HBYxc(3(?jv*%|93V zufKoar=_>;e_zST{Xd399iZ5sBVzYN#l`-sZ)#J8KYQhLY`rZV^dH$eS~|H?uc0I% zBO|WxuLl30L;ror|IyUoznk6@m;8S<{U3+^qp5<}pCSB@A^qE4|JqA6m=Zui?7xh! z1js(~=qmMj+^~K00!00${qu0BUv$*X-G6^mf78-koTE&9DOBt zWb)T`;^yY2-owA{iNE}-RnI|leUp`iW!-6APx#vI)p(@--R!$ugS|84>sScMRgnozddVG%?lM_QcFDltxI zS>lc!pKeh1&wfkoF02GMG5R0f4fW)w-_J{Ee7QS|Gza>#lOOq9uvC{$dh(CVOg;HG z^W=Xk{jqolrp8p?q z=GSqUthA-tSv4785UL#f^b%A(F=rRc!9k4pr$%~2|M7IUPuU<;I3`p?w`Yxaz;WQ6 zM9e?!#zBKtDV9A{c+6#i&w@R#xxMG4`u(rQoBwPI(a^pOdNY*&B8IcvIIFu~m041= zN=Yum;lX;>Kc7T;XZ?94%T%o{Ktl_~-6S!^nXVcCU^@TH0xF=)@kn;b!B_MWBlphU zYmurKy>Yi*q{#f^KQ@pMZL3x9*JO|O9p>^&x34j-Q~WrB)o7aD?eX6m@pm|g7o}>o{kt`w zU*f%pu9jzsnNcm_=R#?qQF0TRbcJ(=_{tuXTgkX?An>9lV3%#z;dih!>^1T^%y0?e zGfBiu`kbm)3{9t-aSjcx|Hj#mqoTUl4)s`t^Zm;;9$w>wt3Q(NN)U-~FoW4MUzdj!#S1}tQ>1LmpE+6EAM(pwye9DQf4Aa)I;3&_ zvmbj>q=gn@7Y1T2lbCc@zNLt1*7-G^j{Tyb`8Q)*i<07nz}<#p!sh2I5i|L&Trw@q z;m+NqOcWCuqVT`P6^Ex!hm}O&M8L9_2Yg zaeJ<3oZv?lxd2fQz@fqHwd`-js%#J9u zK8e;jjN7-Mk$k+?QSZ3DcCCHNJVx=vQ`EFc0Y8Rzom2Ol|MbM+^mu=?!N*;Gr~Oui zV!{cx|JK8yz=6E2*K@z3ifxDTMzhqyYAMwhP6Llu1UQxaYbj7=(t1UUUEW1nwa`mt zSGDi|C^_9k6N=2+qAw}}yj<;%_yLfR9KQeiig)Ou`U->WM;CQHySJY3@;M~iacsoh zFIi}|6CotOu1GBIJ8-!Zk?M(njHWAB2T7Nh$YGlvSG^4CW+EF}v9Po^+;a}<<_B1y zT!Ok;7dCPn@5UPJ9(1cLw)$ODh%K~6dvCu%6Q})7Nq+ky5a$G)y!703TN^Q+vHs{) zmDb*wm;Eb8guZGvICP!Ky)CF}W6((&;L-kA^b)k#Kb)597DisosA8ZqLD(wy`A-2@ zShSHzu7 z0*JU%X_S81P5jvLMh)JuFI~}`)R!vT2LwHZ4tTbNGV0a2E$CA$B+={T5jf8=X!RNj z{mZdwDc!Hg6ceb2)DuaS^R%0iVU?ig4m>nNZ`QA!e1w?z+-Zw-SWG`k#Tqt+pWqbz z{)W+cW5Jo@>k}12*+H80;yHZX%MCE5u8AINMJ@7JWvyRBk4e*yYxNGG+;7VLb`YrR z4+LX1Ozp%q0SVv(`OCUHRlO~TTbrOV6Swa2Fq30HS( z{y1wT0(EAC-^W670)Dq2>rI2ZdR~xVodEf{v}Bns`liGKdji~i$NlTcdPRSTil2h) z$ggfA^OD2wPX14OSgus=DknKgCKgqonNa4A_VFEkw&V(u!>03n`PvssM?d$L=Hp(- zgq){DXa#lSVAvkh`q0!~XWiWAA!JofDI1+4IdgrsG+?Yj;Va+!&>+3jmsQ>Dl2+px za5DRb9l&q1VYj!;(+eNqB^>*}ak6sU*XlPttBBz|G8VDAY?%nPvh2Ke>fAQErS(&& z{Qchu4k~2&H!Kn?ouKhoUm0|WPDbdhJnlze?;!i;`F5G!ir^%5Rw4BVXQo_cv@oLu*v3Qlx4n6=MRJ_7XnB`X$_At`WiiqoYZ&k5WOcP_4$QY(k{j5* zb0oV^tZH?O+N{NxFqR!0;BOeG< zGQeVUYvvJr69VRQm#0ncFbVJ3W)wh27dxf}N1Hv}qB?|ywS#mx*+-sovU}RZ@kZfN z+$lAn=~F{j95)r*eq<3kcBIZw3u9i%b(a=K+3`~%p1|grR%}#ruzM_mSx7KCiCv(! zezDy9HzCk?HZ`avOA0u(yMfz5471O*a&`wCCwlCS%qp$uq%Dqo*OJtDb(iE0Mpk4j z)+OMR(^zm>qVYoA&x21`@|-f#;UrkPdYaK^I!l|KCv+85;_zl{d?)d0BDTM*%W<%| zN-xL%;@W6s!^T8Wa24XE+~|{_ZlWY@GNoQ+v0R#SV`#f;eGZd|U1hYbHa{(gt!jgd zopSf=Ov|`%nk{H43m;!z_W}kBQBTrk&#^*xYM$DRn>xDeXw<<05n;iJbTz1&wD1>~ zev*V7G24?SEsHc-+(s+3avj1v)8}YQN+?Y~fAyH!4g`71p(Wfi5mNNdUKrd5H2Oc)LjRjOb zto5^=$d&d6i(Zw&P?p%L@k-#azh(=RU*^P$@u+ia03yzIaxJE^nhyvTcn=6Di1L?GvL9L2oZzxr#);@}UH69>;MNg{Nd5&}? zR<=y$Gr1R?UM)d>(Pp)cfH+p>Lz!XSUq`CF_s}^(g_=eRQGysH zO7v5L=_|r}4DYu$W*lo@?Tf>m3cWsABt$sweU&DAWxrbaUEN61dXVETjRfDTkXTjT ztP5NSd|_2MpE=Z%$e42i`x+!?-mG^aH zwDv2Lmw?B91g6K(5z}XADLp0cS>Pv-jnTEAB7mqPU6&%tgK?+5ckI_>>j{*x#|JHY zBjlQFtsaT$us|jpPr%UQ0htlmqSBdCvzC+oi3;mJ8L-WiSr}JQ0O`QhZ1dBtCn=#J zPSi}Pb7uB%drs^0S0uZ+wB2wiH5gAb{biD+8Y28CylrR;hYuj8362-=4WPXUP6MZl zy=iMWJ{yM{;=*dx@6^(t#=z0eM*6pnrYvz%kt~u%E~S?-}QOj zkM~xd#bh`v%y-0T!KFaHV<@O26`7IQW3Jz8re+JaTyh>;y&{H{PpkbL(x%|#BkQ;{ za_Uo(;4s2EcKk}lN^=Oq#ycjZEkaMYK>9NA*}ATNAC!<6T}(;9+LtuGVNq}S13{WY zFLT+&@oSY^b|n~Ks~t~Cg|-vr+Z3)Z*rssem0p&#)zr_p@iKEq^2reyYdeNY+o&AU zeijCP(ZG~U*&j0{V`IUoGL8;ZQ&ojBa;m?$n%cKPynzj3|KDhb{{-28I0wM9%p?Z( zZ!7RxNJzK1u@8)jKV+cq64WAk!#wHJfc<%ZWG?8_m3#-F#i{}zdjxG>Bq#;yVq{XB ztM8_nVrFZS+f7TZ{<;5bRCKC16zBCctyT+Qv9UdGk@^?=WyMJ|Ey_Vz>zql~C5u2` z^{d#W6+yDx8?Gr$TecgV{%*JAOToS&rKQyPf5grr(Knr&A~=;ier?Ndwf%UsEhP5} zc6Hwt){CxKj~dXpB70;R(lYJ3gv<9C71xPb%9|LAgWSfwm>qKNb+Rh9vpTnGVZ3%w z)7{L448Y-Ch{AQQx;XaoR%Juh{|P^Qyxbp72*c z8rr6yD)Ivjlg4}YZeZ>s3z>-OvWo|&K06TuY!Y5TG;=(t-xtRp-Gm5M2sCIw2Vm0!d z^w#s}Rjb1%hMG{;MpQVYdM9h9bmKCc+d5_B-y< zPbGZQ*EcB%VoTUYd~e@Q<613Zl=O-a3iD8>?+zo^d`FR`8iCfoeX5GGx=fX`vM3@E zf!1uB+?0U3<396Ul-hnfJ$bHtt>VFh?Lw{J4wXvB^84YWv`N_x!j}eR#hgM<&)IGp zU2$lTdE-*Jmf7~jO@nJ-p;c%7hh=jy%F}t8$)6WkefO5lc&Iqpp;7fUm1b*%`fs$4K=~PxHsC!6TzK7@5@!0Y}PCz?o4HTk#MqQd-f@QA=j7$)WO~k^m zjx|1oXg1r(WF}VvQD5SJqP=qnchHL-jCnPDXplz~$?} za6}yHVbG9GMzjB>X~2H`{`$m_X$)-=P6@F3^?%k_Y&@acslnO~ zG7Txc)~Q?7td5$T-zpUHpLvD7hDh}@HximXe$U#g+X_~`6f~fX%C^#g7`Q~D6K!5^ zK-r2EeuBF$IlhyB5#cwehBV9etf@kHm^ClGOQ_ox!$8M!?XnQw zN4Uy(nJ(~_F1E>uowU&0-Dx(k^;#Yhq&vpH2DFU8-h?EJpOxTo;rnS1z5Y@QTjMpt z34STH9az~|K$k4nwzJT6y0w6a)&pgA3&4$S5-%m^3{AA0dsOLHjkBdc`77 z4j*Rx3RF6V41*p%32|qc-dLT^Samw`BPvvCYb5|UgoHT_O{O!vwC(1FZiNO^q^i?} z&l)6(7<5BAg_ou)n7#Gh9yZ?7IL!jq6K%vGim+l*b(3ejm^9dL=Yub-9$Cwg0(`z& zulBvdu5$UlSypGYLNzTqycpe$xTZx)Snnb5zew}Ai4YT zQ3_;?uC4N5(*KT|V@EY@6O8dRJYYl0w3|z=&v{?0xSmjKYbxtn{ zF0=~*jHgkV38lS!U?hMO5p3#2n+)LO_MQnU>rVn2ZI-ohFCuiXLobwzjkZMY-DYcc zkgGvG{LyuKfb9!Yqple+=Eb{njQ%uxDfXy)JwghI%+z3q$tN2TVoh5tf1RpchOpmAH8 zEZ2r*r0HM7Pqy2HgSwjoHwSpl_n@TXwG#8bN3%0?(ek~N3>Q!j_~E1tucTOjr}J#! zRkcn|S*N{O9j+HzONujZ>HP0P`uN6eQh_;}wR6!a`y#$PlP~!GIK3%3*!r@NWz%l2 zd=?TOJ%WS~yL?X5&Ci>i`=5dOeEQ5AKMp7=d z-zYy>Vn|)`9>0oDG9%RX$4zRo8S9ol-8f;gn#gdvKMRSrzb?C16MBLptrRx(Jwzd9 z!%&E+UfPxt2}g%)k=ex#vP^N_3sdAt*pw2@&Z_Dx7FX4<7Coap11XIexEeU-kds+Wb^ zJ2K`x+@Qsbw?HXaQJ4IFV;ewW+JpOz&n+F-|6?BuFK_a#CNA>O4{>LHr@_}-AdCi#*&!OWV$kadq!z{E(S`B$bnTLV@=e&|6H z17SZJbOuaaMK_CL*?W;HiK>qf7ra_oActA+TdJFrsxk0vEsrzO^y{qk&$F^T{cS#< zZm0$U%0=qy(rN%$DJ?0-In@ADbmzB${#@GDKD0{N70kwY=yMvMNX$=X7|=q? z?4E{m-R_8_4Y#%gwGS`u*6US-T`peo3$;FNBn2LH90tnO>&(OF(lOH(Sa#?c6YCTs}nm(BFOBGN%?Y%2%zD` zW4pK!#;fGlCB9{TW5=nung_gdSpUQRdYIGL-uKvQtwUKwP~p)}JY8`_(^bSHzn9-s ztrDLIUB{6?lSk@2LivcvJ&JySLYMO(CZSW8}}S8 zwGHh|SZ6pgDelFV=oc^icy}IqQQ&K)0sfly$==Y5fY%@)P`HF~N$6$xM%CD${Nh#( zZ8FDYsN=?D)q}lgd=b9ycz=z=oI~r4P%6qR^&865(h91*6{9eCo@{M?^KX%r#8LaCRSvulElNmMZv&lk6un znJ=C}qMYI>tw0N)FelI=-D}!M#-^Y54|juE)F}jw30c$owUlo7tZ+8s*PAY$rXuZf zsr>t(Xj9=1a@r^jZB*lwXU{}wOJ5Es*hLeX)>=we{PG|#81ds&^u)z5xVZ0kx$SRN zNmR@(-llr@nQ*i2E#=Pw+G=>0hh~2IqRUbxLESbg+o=_)lTJ}XVNbw1f*g+`O%j1q zTJ9{Hpies`T}H=R1I!lX-$5Smo+t0Ly>94ZQO~buKj7GEa3Z9@ket6BRN7=}vxxgW z2EGneYHO0gg{TY(Wu4B4#^}-ac%qJ9-(f2NDb(!B3e(lv!5yc>Gy0w z!edH8{`bNPc@J^m{T6w>fR*v1;OqOu&}!Eovisqo8z!zleoTw1B#nz6yHs-~_H?%xDl?5l0k@?cXg`IxD7E_yfK%AK>_!GFv zqKXxQG}fAT9O{w5;(Ua~zmV!KWI1BAxSZP1?5iN#!?U|}5Wl{0mGkK6C#KmsWmK%T zuo&z%;x$6e%jt}nNjr*?VUnWx;*eF4G9xp4#^9c*UV`4dBR&g{V+16#?>A3Rrww|_{0cS%(6{${qJ6w~}3 zzyjQ>dHvA$g9)~IyE5?i&v3nBL#sOzQbae$8XQbXxS+{2@W?U&n1om^e4YZZkG}EX z70%6p{-OoqI9Jufj+&W59lTvdkZx8NY=Fym<7{-Pm9lm!b1NUv{*v!8<3ki6+?O@$ zcRo-Dar2E$$Y1RsdQJK_SB<1j@)0=zQ-t6pq)t&vXa&S`&_)+LC~gds>gG%@Jm%*J zIaSN}6O#SH&q=VTo-U?3`%7yurlv!?G)%b!rZf=Fs$f%=Cd~tU7?aXrCWWZq_L2u2 z52oU4dN$+NObT0XO?k+J=;3lp4bxl@{%vS9q-%|MBl>R@$Ag-$++76T$}L3b7EE3P zDy+coGg0Pzem7`yS6j-OUS}&*SrmrYzEBILe2xGl3!nkX&Q@o`@{Dnl9D0Ju3lgA< zP7O%?!?vjr)Rjd$zu#ex0}EUjQx*Ea+q$~15drGowON?(a)oBXUy>HyIz1*pa9h>v zK^?iL<$4c?l{mPKXFKMqOB_mSfyr4TkPuBam56j@2Zo`)P_#G`_V^3u>-geH>-r<= zbz7jsw!s!%Y9(u|Hykv>K(ejx2jh$8fO-gMnKdKl4Dc1dJ%cf3pjVB*CBG;V7ZaMQ zRH5Pf^y%ymj+&@_Gyz{89N^{~Cmi-FQ=>)N{=xzLR{YHzt|#@+L(xk2T1)Eltp_0O zpjZvF8}#|8hMi7TM)OtvUQZTbHE^@CXgCwUo&GwI{l|pWh{nXBkl|xNY8^P~z)p8y zdTr>wlb?R=!B8CxzqQAk7#dpg^{?_S0_kdWs@-um(4u}7VaK%B$#Hw+*iH6yK`o9W z&nW)tRqQ1;k4d7~GWFR3>12SLW-e1QR~@kqrYO3-!LZRdP<-Py;Y5dO&tQ(1`2; zhVhWhvM7sJGwk<>3!ac4ufVD~BFAZhKdCNy`glQMO?llEzt00%kpiKjHjzhcQ0WmJ z+#a?9D&F|aS6uN}zG{6G<~riha<7>%d{G`$ooM{ntjaHK#FJgm(JsE4>4mLBkNr0Y z;1Y>tzp|joj4|K_LI-G5FayEWd+JX2PWutKkg@E|VF<){wc{~{D@N(KAkD2)(BOba z!s0`k|4v6>BjS&4h1-p(P5yA^-5>6$y&O;Fo@@XDz}gxYGhgt8jld}i=RFrCSo4Gw z>O(Jq_E`DN#`2+CLwCQ6+G9JDvZ7UYQZ0p5hZ)QwIs%H)XOYU$;;W~UQ|gdAX=7Ux z$7#_rRI0sxh2NA)TF`-N1mFduI=7P=*619*5|(o#53Z$yb!l`*ZpA1b==&W^ zSgVbVgZ`Dun{vx}*c9zpdFKH-sCCeiGV(xje|~8OIye$BRhY*&p%$VUa)$?g;)*fh z2jqpi6q&Lg35f+%8P&3Fur*zz*H_!uYaFZZv(UnOUf>e~`TSzHK6Dx&>BNGvdVl5- z^zbF2np9H0?{u*turIvLg8lDc=wQI1N?vmkAJxK%W{9irw=By&2R6cY4MlD2{m1U7 zR!z}M;9S~oiP?Rco0U_P8esA?u7A&|D*x)Sj(ng@U>!qmPvwfnn1G^oRe7r;Su6QR ziJIwGtBl$JRU{$QugNYW1-2bD5vUE~NP{OC2c!Gr_0Tdv<;h^lGZtLBSltM6|pD%B-`I$Y6MgNFLaIywrt1 zNi5MEukd`#>1Jp3;nkRXy8N%#vXQmG<2&{*ZoI@FtJ5aW%8BA~LUDdBqcg8+GkQ@U zmtr>SKTFe(0g0q8XX>hjqKhts3CEnP1F=iKSN;rz1dbM}zKJ)Y?3gKlONRSL!Z#Ac z7AJzioF}UoQG3f`T>b*k@E_BBi_QU{!fN?yNb-G`J^RH9?)8H_Su53b$qHQRMeCZ&IthPIvml)2%}bC^DZZgTa%CI5^5DRl*F zPr;u;(f7^UcXCX~ZAv%L-KI#?1272}QYEjP!2Ld8uhh3}cF=uSK9}$cZ@uUB9K#qj zMT+n{jfoGNEnDF< zoKk3$r)mMk5PD)dVSbt^6UYG1_Jdj3eBR0E;|?3WCg`4xN1k zR?>6;*oLa)p>EY^&9+eCChq)$3apsId2rkC)~-gPsC0;w8UuyvT0#p5tT~eIzw=Cf zt*GL}|9(R7R}NKq1BL(qsZOYUJm(1$yz_zk;!oOSDl)F1a%e~Wg`1Dh;2Fdk`i~Db z?4vlOKcas&?2Savnq=eOBf<`-WEYRu$>Da{jNMeY1Z#?n<0|soD&88b{U_ckQ%>f> z{QH)N-n<%dkE;2E;8;ktOYt_ zdW|h3^qebys^rPx*MmKXmnpKMMFk&|Ie>?6^^zZcWA+%7VO&Wq0=rWS^VQi81@;+& z>NiDzdNdeNRUYbY@LM$v z%JHS*FQ<0*sw~m*5p2lxJd0tJ+nu6Moayx_hKxWtKE=osU~Hi{RWue}ysl;LKk`!z z*S|(c`^>Hob)d^kOak%u3zIS}&sv6_%pS*g==QbopthNE}Q)!M{%&kQ)wB@5K5SbYX0^Bvw` zwAegZzRfA^=Q)T+xCClhqt|SucpHJ6Jx=4>sYK+0?D?US6KxT93{SvxikaFJLA|mH zVKS+tSW#%JPt3MS{mp4oWf#vBEV#$!_~eG`d&TXaSE)*j`i$y33>kvoy%v+L)xCOP zCP7abAEOf1y$90NmZ`L=(*dCkM(S~W32=xNE58wKwX;^#%c%_4wTWu z!Tvw$3xaB^4%k%~T3;zRm9&cC18}rE;F}twxE1A$pC=TCcIw@QjNR5{ z7=OgLlYpJx$N(*_7D$-N1}Eg@!lyjpybg~!v& z8is~OY$qV0r~QIwS7FY^(@l!`$;u|bO_jAwEz!!!+<|_DUTX4X<}7|cm^2iIyto2k z72~Bp!%22^dr{{8;_F|u!5c^BLoII|38}BIvZ3~ggU*ym*kbQUQ8dFFgrLpn&h&Pm z5}3;3UEAf7Bm;g7*&IsNLw6BYbo@cn#p_8u+@dY-zrq=&h;Um%5gt zAQ2ER_^wMb^6>gJhRXdtG@^HktKw8jwWq_$7v%MqsCwER1;9^wCr(%xE!2fxhC;LX z%)pK#@?W4r3rZZg-FJAAQlYTkZRiu|@L)AEmCSf&6Wdcqo-wA*`b%wxj*E6{MELId zoNMyz4-?e$1yX#&ZWzxJ? zePPqAO9037ld3V3T|OuJ!C@)T4#YIT@{UFxMTVat<1z9K`DiKQnUF%LyA4Nl?vX{? z&~g6`XEy^$Aazk7wh%uc<2X4!-?2iuEbTBZK9O}=|2n@j4YA2?C>47|Ei#N#=N-4q z!hI2{#nd8@ugnp8n7{yKg(H!gso!)TsmQXFsu4WgY`vG9I}{1&v(Bv%y;e!q&1; zPDB1?QjBr(UG#6I6r5mc36yNRfSCOAj}c!4og|^H?QW>@^vP|GXHF>^^^QWxI!DZTaZK*gBQ|?i7Q1(VgDXS`4l6mICkoD zV26-}-bUg}z6!NFoHy9Z8&ILbUM4j7M;P+`2JeQu8p zrJ+~ogDaIGC*eLyM6!FXPh}RJetGi&27QY6vOY3fl&0h%ZdzT^<&xGq5FR#l3_C9{ zndD>dzf8@7lGVJIsBuHtZWUwd5rmhN2z{F2=DFBEGoaX6n@Kp1vLe;5qD^9GJ;|IeACEG>xkQ-5 zq3YK?MduOKlRgR0FAOa%Dgat~HMTc^Mf#h0dwi)(t|M=hBi}!iw(vodhQfs5r-z}V zeqnnvklM{<`M*wkohWuq`y{t?!a)ww1MU8Cb~@*jA8pNsfc#lX#zsjfx0V#b3gR7k zG4u&!Xm`v{N8eF5prr%lMJ4|NuWu!q_;xt!?Kg43#((q)`R8@UARMkEcn~Ss%^&UF zoo70TKRi(tB|nEXEIY}?gj!BhL$9u0`=yZwEZ*H(L#OZgy4=w*n+9WuJizCyddu=% z+wmQ$F!NXoFrrrwOEy_HM!YXPSg+_?d=OhW+fCK~I#yWcQ?Rp4Us_D5LV^f-MwVkC z(hvw$I*yh z{LxQwE04zBueCRzkQt$_`zqQ&nvA-EBLeR0_t>_uN%wXRWKo6|HF?Qd5v;^WA`1^V z*`K7pU~Y(QGGE zzzPpuH=fbC^ZMZZ^~s}8ds&~VzK*FZb~yKzj=@cTGwqL??XOQk=jgluTO%-HPHCE< z*?9>T;L8QE#tg)9JWi*OObgf=a}?$EvR7Ae>VL_&UYUl>Qg>Qx=~BuX{_6flekn1vXu?gX%q8v-+XwazJ7KNqg+y#!32kve9RNw zD@?fF4$_eVWi}3i*|@xQ{FCI4wI9(XW9mCIpxmkRF%#8#ww&$;Ldra+8klg7O=Apa zIL4O#DD7kVt!}uuRWjEC0)|j@w+N8W(eQPVcjzN{=mxeFqPD|$0>!~Yx}-mByNlLt zN3%7+1$ejMdq!|773;eX0{j7?f>V0c4hCGEH5P3QSg9UoaWUV>pGPNWB}fMwYwtYe zMuX`YitI*)F`j@?F2D6Ma^=9=xy8#Cz;AGBh32-~;cJ@;fU-+sN3Or8G%GM7$&w?=6F=mv>^sS5*X zU5rR_L+a*7^Ux|8TtA?41hQaWa4NNcNI)J?&OQ5UqB1> zcdzI#$~~s@1k5+Chu&sl+2t3}xBpXoTNE}Wl+1>=tYIghl4>vNd)=pWHtZ0Wjt6YD z-ux)H6x}LV&CICh!;bXAz@pM8wUd`1e^rJfFH!5o+@m#hOhbZu6HCSHGUL=5q6n4S zPu3VCQEAuq)#T-rzRrTuLPuOi@|&wu0U>%xRFoWYjbq}PnI;tePQLBPI)`NJYD97f z6Q)LXr|X9uqLKM|b_Ix!9E^C|0LPlmUCGqe=BSKFBc~?~3O(mtsubVbNtfuw5(Q2# zbWnP=c(<{FLXM_Hg^_Dt{WlKP^D@gP&k+r%tV(jprO8%$RyA(}tS@>MIm@-CgN|f$ z=d+`~1J&z+n*t2N-g;7>S`UGn@Giz{ufRMWSCg4HGk2LuYYXrFW`B|oF6NF}F>5x5 zRt+XjdF6l1U(jINjdyZ)r(~@b_e%c+e_vk-eGIAHQbyuQDP0=TlS)Ct-U^zw>iJbWREk`?&xMBQOam}kQgdDnVAp z6MaN2QpbeIkI0T}S89o1el+Yg#!=G7RPy|#iYilr6Pz2i)pzKui=d6ZRU^elW9LCR z@rtruyt)+8cGKBcJ!^7c&)uN&+*=ToT_*>Jq7-8luFU)irT|dDv52OItUw>?I|nju z^G|uKrl?GR5u8FctGSU;D91YD{({9~Se`2Fd%>f`_~R*6U~ZieaH6xhfvu@gCLgxo z)l819yu<(!JZ|lLZ!t6=;AQ%msc5O;}ZGhH1soOL%HFmH?&^ z&4q?AdEC%f=32IjL;H>m75$l-g=`7b-&o8UT5dQH>>ll>pSH4m|5t_l=7H$2 z^f(xK$t=spG~`|jbBAHcma(m@LRoWIO36#q`yQ{^Y&%r_H^d7>;cu(!uZ#jf$r2!s zVc33}2bdGN+8k-u)*ykKJ{1aR-^mpW6)yRF&*JD4igxie9nRGdRqd1PEwec#zLLDO+ zqK=)GonEZNNA`cl5!lm^lNC>7FF;SEFc{tQ%E~=TX|dev+6ScaM5O3(6;i^mzq$}( z1|>+38PBOrr9k4lsOphpzOPk9u-Oo{KT?dZO*3S@?>a4BrmzXiGQO@VS1MG4QOmj$ z)NG4o4at`ZX4F-C6P6cic>R^(+AA(9sY%sqLom)wNBl+6S}a$nuObTFPD;&F$)k0% ztDAVD_9esh7kd+hM8G(6d{)SZ9W5kcsnq;3I*L=a*RaaY5@3-41b3F`zLmZqnQv}O zO7ohgW(>aSfcC{|+jh5*|A)P|42Zg2*GFFw3luCw8UvMbyZc22R8pmD zM7n!uP+D3Vh7gdBp&RDhqwm^loxS&3vd;PN|L|Xa0-1PzPuzK3*R$3|&TV4Aq2IcO zpao~87bh05K_XEgRjp1;#$IF8l^k2EDEnN&y=!fRhriN)buO!N$2Qf$X@9-9{usNp zQ{n(yk}wn`a4ov|{Rkd&bvQFn%&Wx<#X;FIX{idcJKYy^7luj;k!=zh3xPxBx27q* zoQd5=DF~;8cc$Z@eXj0PPQedN%63%y#fCCW#qM6-F5qMKXP1PM_!Y*WUsih<5IpqD z`o@liOC9&ko5@Vo(vszBnCzB7Z`d{tT*CG3nr($0i>bu! zFxZmg72NWsC+@XLO}oCcl1%6JwEG<57+cZ}kz>jvm(n$I;#;6!9I`Y-v*=j%-K&qN zn*_{bT56P25#j0$)Y*o?5zo6aR(GmaRcpHp&a&}fWX9ME_8QG4(%aA+dx_z_x>OH^ zO4=@nFy%K1$6VMP_F5p&9-g}E$;{5c=(V1jojhA`O~1C%{mh`n!aY^p`lg}fikRFg zqteE32p+~`6G~Ww0*KYRn+(p%?cNe}MIW(!Uy;U&MfJ5(3UVw`xvsu?c(8fB+p)^l zAeE_;9v4wROsYJg8M!!$wvIrz21w^WNaGn8ZT(*Uh!(Mb5SCYmsEnqxFL&iHrZvDE z7Y>RXvQHezAsn=(=Cpb`==^DX)(x@1(Z3ruGLj-Tcy`79Or*KBd=2)}+z`KM(pqCF z-Jr`IbmD=RZ8^bc%H1)*h*H^a6AY(leR^S8>!UwB2u(86YH#Ar?(O45l$Q$w@Vp6L z4_VezRq*TB#NBn_8MJu0KGRv>7|ckD4jNkSdK`RU;|d5cBymcuU31t|k~SPFly%~U zYKp((8J&&kZ`BoBV}vw1a){dLz`28(#|O{W8vu2_#hgl=(yj%SlR@jY+Dw73i%Rle zmGA8C9cM=zd4>>|;T^^Av{?I=sGt5>KXn&QP=F*hvpMYDf%D}dg-zQp$4F~Z*^D5) z*~pju1pRo1SYQnrC{ADl&J-`CMdy}k zc(UN4YmI#?T&3OG;Ni%tir^12!u{TAaTKycV)+5XC(217l=jBnC}1wdC>@a>x^N zG&qz?4HgX%O-v=AJNWjsy5u%Z^uwuca|zQl)q<}h`dO$qW<~R6Qcb(DFRV-Ck7WXC zP*-~@s{j(NV$JxbIM^DSr{-F^DVE`<=_FCay%$%dKvYgbN5p%Ui^7qmTGnML4X|gx!r&Q#6 zpY_$N6`DmGzBW2zKKSv@QRBg)oGer%a&>xBVYK|sg`3I{FS#yBB9466-@TlQKP$N1 zpSfSf_I?2v>bOYV!iDN);nb6nYz-Tv&RiD{53|Uw7mofkyFGi^hm>`rn{BQ)%RE&p z^|R?3`3E(h4V5B`SU)O(o=x+vq-wF2 zyba*QKYNSPqwF|4;Z%C$)U7uj%`Mg>Q6z_G?H<8Lk$BuC)*)cYiFi7;f_l;9dNq&& z*kWlqr;lQvXO-A}rRK8AQ%RRG<@r$#;7lCG;oZ|K94Je|Xr=EA;_}QYRnN{?mjiOZ zHCRIJAiF}!6gf$PY8M#IJ-dZDbt|wKtj0EBfIQhAX6SLNf=d%~VIM@xdZ~eY&`giA z|9Ijs^Kp{)$sZn+kbzkc~A@X`M^ zg&tv|&~J!sgv7ZXFYJm=_~k0!Oky#DxqQlK85HG)Ca~-E&_=YY>m#8$yIYY8thzuI z9VC}y2{#qtzWS%=F#buM$rhjC!`K?yKSj-s!OP{}x}CiE?(<3kMMej+`)-_wn}d*m zdGD+vzbs^!{pq@M3*Wg(7REaxei)9lbZ_^Dr)7+UuFm_sX);~k$?ww*VtLv;i(oJ$ zU6dcn98A+Q5#oU9bihMDqs@by#jaC|M=6v=Z9WO<#vpj#|1cy_;6`3Q_xcz+f{bJD z6bakCgr;oZYfV+N-5Y7YnGRDiR40gc(gck+#}m<_TGE;t!mNpCyflJhD{{u?_V^4$ z9Fx{4K6&6$r>PV!-ryad6ndbn>@+Q~GeRG^`IcAUP@BRe0}r3Qu;*rz>tTq*|3L8m zeB(j`gr*9l89`(r)rgz&vEr&k`(gjK>VwKl&```6rMDtJ+=~7er!-p$mex$(P5R#z z2l+qojiM+I$)V>tTD4m4RaRj}Dh4T&u+9O06L2_8Tl(kRXBV7;;A|k~*5={JwSS+} zNYy_@CvV)GdiD4JI@C|_jTd*JyxSoTaw^_*tm#|JO@UH^6kLbawtwKb-COFH`b7@8oTrZ9UDY_(MIy-*;^`7jF6@Vs31{ z_^*BR_rLzDpCTW?^!?`>|JRNBpIQCS&iVg)I&y1IHpd8|fw6m`H0Fae|JN9Yu{V9} z;Aa2T-2S(}s)XWv$(*CvN+}tiRXi~{u48fgu=d7Xm_c- zxiippwVRr0v*}Km%#17pBY!?2R6Q3;G2K9!F@S<23TgJ(OO^0Yt`s*?e0IkZE6mwC zU(Xvu^vkS*VzTpvCPp7i$@Hhb6%>CS{n7Bk5x3HmtNQs=E=yl}0IoHiYBHq&_zMt) z2~L22^9mWtTsT@Hm+3$k*6`b>2aOd2*)H2wrIQiHWB&c+&h`S3@#PH#_(jS;2i=|? z;PLg@tEMZmIZwxWqmnTW-#>fUK~1IZIfFu`iS<-#0pKg^dJZYb0F(N8@)B)eaWV3< z`_^8ny#318oApC?pr2ye9L8ojhpP3IB58;cbj+nAe7Fc);lxz$V$;>Bw!(n|<0(`r z#{Tn>6N8K`3hCBmj3A?HcKmYSf;16H(2>n)s>| z7GJt}-mE`2VMdKuD)t)?EZc~HJ)Qmb@IEq94Yv#3@v%dMmwC*h3QW=5i^ngvyFf*3 zyvNjsFp?qA5g46)emuirK@Mxv-%vmayEzn6#4ZAf&S}qW9Jqk->8JaO6G`~&2|C;st;NH*<<9gIB|qeqXQepJG2 zsr$262h}@6Xs)UaYM#=mvoy&eBoLhK_rxfY$dJ?xzONVu^6QW{I|+NHT*`Yj*Y$4t zmklaRoTOfd^mp0agy11(X)M2ueD6q*Fs*${BA=yR{z;_Y{m1FZtATtjTNXHW`LnkM zCs)Eb^p!zyN_OKE#rtFIfE`m6*k9{(4TU~K@B&&lEfI(sWD&Tcy z|A0bDo}s~SLAgp)mRQwCyl-#2cPzUNsLJE?}`1ArVe1QT@H=W!CjtSfeZ6How^+gGwf znUu!b;;e0FI_M$fMMlv}Iryuh^!wO+|1)ers1x5r`Q zIl6_7_eq=S0YPH}sKOEcNpAyY(a_OBgFKEY(skpFT}!Xa(-Z6yZa9;nhAwkloexnl z%efijaMf%d1PhpV2FJMdn0{~trVPz?rD*f(=VxeC4&!1=1rj@2j?zsj3UGY2E~9WB$LYLR*Mu@fqY^(Z;0TxYF(B>Gk1Lnsnp`~Xmg`b8ZGd7A zTcK)L+_Svdpr{BSz%$f>eeT{n8DYY%C0qvWpHXNt0j$8cOf>;>4U|d0PAPh@*m?mh zNj8{>oe{Ef=be^z+gbaEn@J*YW_%WqL-sUtLAT@V#{jgOUx__HW48fVyI*W;vY$A^ zZ;v+RfxOMEDrVWoDaI)?mdkv2aAVlnymNV7Akmo&?AJ_mXATh3bZ|(-0;6t*`S(`J zPnv>G=p8+zJNi6%&O$ScleAA<1w_Q7)FiG*z*iodL zdXsXcP0J2;zTA@#yHriwsSL%Y$>Gl?SXJv5E=^LA?$Y-~ZBRNS>%D0?3S_#LTqq>B zieO!^L^l@GaO8P5Gj|2Lj>;t1!G0=82T4-yb?;8+{w$43lU;Rak{m?K*c}XJg8qc^ zAfMCbVl-OKy1VTR8MVC&4^#07Cepm(jS8!`evIRddhL?ux*_|6ffN0UQ&o9N8{aUG z3|OWkba$cYd69d{F=DHt__KP%Fc0ZRN$W3lOjBEGfUF z^_?$4u4>B|{AFFy~PQlKfLk`QQGa^6C!~cD1)Ra$3|;b;CQ>C|3^M*cPRV8{^5B!rjP<0iDT+vKA6u&*l`_B;`E4mNAy;iBOFV5)Q;dw%h)WWiaCf z@ACm@Htj1S@Bm@VW)3z&jKKKM$Y#{JQDM%qrU%L@X+q$4xV7tiEe3)*%Qps^aH0wl z^2JXP_rXJ?t5zaYv$whxG;|$BY+cF&VrR(Jvb!^j#@=Q#aNBxFVp(odxE+9;)jEl) zcC>7B6m--Q$CDYfZIX9%hHRNr$HEkuxt8~4lNi#zVfv1pT-ec&F zn6bGs+UJD$65K>AvUgS`)ac>v+~z0oV1^2x-Ovs*;DZ-o)G;ys;psD*cPcM98se~4 zSvKJYan{i3TD0tSZMfp?P#?AUU~}|EiY4Y{X3ED9$70r9f9; zgpPD?_D^rwHyL`XJD(m+QEZ`?F^I`0b7rVXj4ipK0`havnKMhg638`}^}^Q(cyuwa zBB+}mwha2$B@r|TZS-j;UYU=RiWN9UvAW|{BA%*LRSu=tX~*+Zd4xJQ zHd@U1mdmBr&rBbfmo9Kyci$K%3XK#^^pX+*%KO+x=Zm!Wv)(iE9}$%#v3r1LIrD(YC+lmM}hg_J@@=R-<8woJzg);H9T}#qR z4@%9hzm_;MbGw~Di_HJaVOo#42=6%|$@2y)(qhYnNP5B!B8P+e{GphgiqGylWgN32 zY(d3osbRVeL%5WHSO}T<{-BVMG|}*~xdIhy$pEoAMt!bG`#MFgVE^p_me&*B5kx0! zx`{hg5ub~+XZj#-A%Nzy<@A_^+ZiO)PKkx$0M2nuD8^d zspbMw%)bZ8N`JM|D8bf*IJiag>`)myEY!r-b&HMIYISB$i_y5+3_t*>6`5a2=vc4j zliBTgTica0Zi?Gs>3cp1E%Gdq8DeWN!u^30PTn83*JisJae0a%%kxF=8%TCt@d(0+ zI<vN2Y)ozk58hhMkH;lJ$vPttwjU4drBU9RtXqfp?MsP$5rECkh+Glnd!(58|Sn< zX}A!`t5ck6Vg}q+TsYddta`ge)uC0P&NssbhnLI=VOFU-BjSo{<--G#&V|71xs$7g zU!A%jS$)}i@`X%Krdnyys+TFbof_hL+|NJ+bUCk-G!lPEzml`s`8M@#B51`p8Ri@I zZEO4U-9R<&cQ}Y47*9(*OjQI0&NtZ%W)ZTUlI5fk?ra#M&ZP{81=Ek}~SRlWD#I|K%k`o?W*)Z0=Rl!FL@m9yqtAXT0JTz{1h`bIcWSnNSRgGqKGJi9rfSeAT_&R)3ts2}t8Byc{=dw!s zGJ;u_gx{CDpd`eQb-o1c_8m)3KIwRaKuo zjxG!sXPxm$yyB;(`?=35S2Qur&M;Kf>T$YE*texFNK`Zx*JM4Vr<%hrkUr}4(%Bqi zxO#)Cj(_n_`b+2U8F-SE@Pjj+2Y9`|KpLJc2}8{ZcP`F#fYqPxZA0J{K#t35rl$Dl zQp0Jq6~{iPVKyUzedkK(VLWAqMRUi`kk>>DFr5ah2T;DUv!|0ZlP#F{AXM%Fm)vJZ zg#k1P#6%1xNthd)LwSor`8pnwRMwCLB+^>thFpFvN8{uv&r>@>pNa%)OKWsi**f(uy0o0kb(6$%?uTUJm z1t%3mbF5Ju8oB*&kes_4kNqS)b|-iLH4oD3+e9#dO~{S5KAz{ ztyW5)=Bk>3PpA!CLlecdV4eaDwe$Qrl~4ya zDpt0@6xt<@Ho*&MF%ANrw2t&e*3##RnZ=glb(UYm7P7v7s>(3ivXc#CM|2+W9b<=_ z&lvJFKdQT%7ErUf?#ikiJ?Q%)J=KalV#DXSyzOEQbfM!Ix}wwRoJZtN$&FfYQDxDF zd~N;8e;8FdFz_DCV$UOqbc6-0N`!dW^Z1q5a_0NvBh*TqInos9rwGgl?1Z=WFGdzw z=&qg3*`}I9pz2i=SvSwbg zdf^OzBoTyt(`*v3Uo-(H=Yxq%e{T@-QYY_j@5k8Y>fP|m4P6^h&g^OB9rq0qdwl8j zd~cS9>TSOH^xdZ?dGN&x)Ti2)eni|r)jY}FF^Ik!9ZM(R4)iiN0(yq*s8pQD7%{dS zBElOBpW3ruM5aXC{hqoMK2KRP6$OMy5TrFWD3L*Yp9gUv#bBGAZ(=mHh>B=pj zn2%_yOH2>hHpn7E$?i8g@=qpC3z`k`3d|0m>`+C)X z+MTjf@1B+mmS%=MX%TzZ>+1kiQ*uvV*sr57uR+}RT}*l&=aoieDnY1Y6gGv^yj4}N zNMtQvd;g0MFLkLQ$TWXe3&OExUt^mFJ!b6(w$6g;ap zBy?Po1zu-+Q8gCYAxD2?-`&iLt%U_)0)eSCC_=b5UZW$tpZaMG&TObIjauHKef!5d zIi{m-T8vjYu8H~QL*0cB^{_V*DVj+1ap@D@mv5sT+9z7WW`@g4%a^JM6GwavI&B%F zTmcqvUqL?{uoJ<|O`)tb=tNg*0v%zFZC%(*S3=M)ct5q%}gH8lfpd+Syv+m4PRPP0| zx1x!|8S@OR475q3^EYK;C`a7+ZHF61_` zR6H|H=1+BQr4QT&gItfe(rt~yNoN4@IYoNB7vwvyvKVCUUlb;;JjZYU6rbI8<%P1I zv$n}$$S=75Xde?E+J;tkj6j!&ilMz z>RZ9)+26E~4_?Q9ra4P;|Kj~8Pw;ExLN0EqSynR_T1m_$DH#^)hNmzSEJ}nV$YWI* z8Cy78nC%Cp&M3$Q{qf)!$&m*aFHVSzXiqs|nxi$3FMe(w++20~A~eM}B{&teX|3x} zzPIGM;&&PIJ>tn^(B{++HP5y@@2udVxb|;V+`=FQVFQ*+zk3tPgovq`Pg+{9Udt5HM^x{Xt_=T7{7zUz7tLtR zfM#(Id4q5JG_l*#OQ#X{#ld1j&}w4hb6fi+mZX8*=~WsD*N+KzTls*z=wH9d91^L~ zj?pg`odk{5$WNaPTr)span=5Hwy9i2`H%M!xf9K+2YVbLES2DnSBChJIj>ygjQtuz z3K-4mC@-=;7zq>A!xt(Xv}&qyH9Emac*4l^e(hkE+j^Ska8V|&C_2icc`uRBI6Pqd z!yiZR@K2tl75(#{|L}a7P|lUs+D-QCmF88kh3MfJuAJ5sij96oSNlB1XHy9!A(W-M z^XM7h-MZkl+Ey0hjYlFBsE5%9A$@?omx)(2+k+MqgJT(}=WyY+o0101Vz0Wh=>U{O z#p_;Ad^Z-VCK*_PND(B=Ni8pVY)-1$#8dfflClT)Lr-z8@5p8_EiPUMbC#9&%v4|0N zby9ZQo>-M_a;rmLfp9{doX<+<>$2iQ!GqIpd%{E~!O?$^SGBBt&xUK$9A|W_D;n7y z-t6!sRaY!xi4nld-F`pgb2Tu0#6^>N)zansznr&UQ_3WK1b8mKQnUta8^)Bx&~qt71#Q|@Af`#HnB+Y8Dp>Qr@!X9l4MrYs$ZDL(dCXKVMKooZXLvN9 zY?lhVeFbi+;BgPG(tkAr_1;oB)dj9rY;Wa3uop2+Of+e1xAl-qfRc z@D_tEwOya)w%NvzQS0^4rqRq1S7somL+swbN@ah8vL)yH2U0(RU zo$0;N0Z5^RGC*<0b5&dW^Pflh-6l`^C3I3hHxZ{>3)?+n=%xjt$7s zu1=%`BnF6ttDXDOZ#^PY>Ar?Gtn-#77;j1IH&W=^bN#7vHRjXFke2>_1MsKsE!2e#n1)mZ zrZ_YWe)2_w@c7+*n}tHZ`nvfv0j?YNyq{LUyBq#&zxKPBqOzAi^}ge9#d# zVdd@+WD;weo0V80*9k@q`WqSc0;y;Gsf9{@Y(Z+Fcz(qM7Qi7zky?Nu#||@GzT|&y z(kG#zjc+RIu7*jCJsZwv$Kd+$jiG_Dy_X<>(%A^<=s4&l#4l z_b@Iu+mE$*Vs|UCP4;=%%=!QtA4A+L*7d%iRS9q zXU`F}s3aT>2h$)DD)U>z@aG>MA@uEuc;RCEaT*c)bHTM&UHjcSB~o>UMJ$#1m;G~e zW9Y6%pIb0dHEvCf$hp3)aj+7aKa&`lc+H>pYMK{W_XS7+KQNP0jwTM=X?*nNedqiBBHMh2?7{j2HQkY6TPA!yT>1GnK&#J5HZ z^yc{J1~;wu^5rC63(*mt4AT}T^4v9d-$mcmFecKelUSSY=Xmg)m7$~pI<+%2*e$UV zu%84NQi^l=WiTf3klO(ViXB2(VPw0GjGOzuZ+%8DjkMuXO*JU|Z_o7Wt3a)=V;ooo z&3D7$fGS+Fm|4t4E%sdA1HtqSAcDP%jOUKpZUIL63oFkZ3L6~F{21eX_ph9oQzy# zR(dEsnmu!xkxe&$Z>|3nZMt~2A-%n@Dh!qMaiEk z*m%t5-o%tA*)ue7G`wIWWAFg_Z%EG*K1b~>)n6@s5;u9p71@!>7TA9oxg>-sTg^?4 zuynJe&CBT(JJzenAgHW;G~CjR=>zo0;QNfBd3m>E|goJHt)y7_4zJT`V{BT z?|c%@STNrgrOms0;i*92c85S-$CX|oS^YIfu5LDTu-aBxYl@PX1dwDsn<&hRV$Xi} z@irExlM1Gz2yl8a)^AgNY8N0_ZpO>3bzMdK&$>T7m0R?n z&l*~cZ6(Uuv>a7Nm0Pu}x#D4~gtBmZ$>FPx$!kjGR;jN5eB>@9Htl zx%4RMCqT)wOx;rv#TP<64Czt_R4~-6)QczbK@&2U=`_Mh>zg#wDO`^ zrbRLYm-d^{F*}f(Oq7-8OK2yNKvaSPER<9I6y-}~kixZU{m*)GepnS>A|cL#_C!@| zwA}!`N>x$&w^x3EHsJ!lQ)uy^*yye2%XO3ck1UEOLei``2esd9CgzJAEC-6@(0K{@6;4HE7QA){Y?$y~0s<$RcxW_M#%JXS6de70 zZrF!btxVw+JroLdOz4-#mV2P?Z37npac@O431eYU^&Sg z!-n_9IHLfrW0}eubjImp>mvE^UMvgOHnk8_3-YRXm9~E7qBX2wp9iZnh(ok@FuzF0YdM}LMt zeKo9bZ>33JLNyD#d5S$|c-xRu5Dq>!af?^e67;+%G$Hm`s} zZfCpc*okWvq*p$d;ld7F_o{!>9&UY>BFdZ`&tJ#rAH+!QQ$l=#%kXnW7(dOL22cw< z+vCd_FiJ}RGs(p}2o2~wTDv_y4k*iCjQzTWaScYuKi)S=mF4Er8T{VzmZ;9U4#@#& zYGa5In9<2OncK0ynM8|`hq`}2;Hg0BIMvsRqwt~=Y{ri!b zA!3oNipy+`R<>OgxvlhuBeoBNPFoKoTh5?DhgoKPqAwIu2g<8u?&W^9mCl?|Oue_u z89$XfK{R9h1rIMg7#URu=g(c?+F{~CSiX;zc%}@2{Y469drB9QM1mgT2ME*8Xk6@OkuWpR&pCBcM?OZKHg6^I;q`xE4gUV8k5(|c z)g0d^lQh&K+~rF>uC}d%x(k?umpo-3rLhUv@E{g!o3ZWACPfD$RjFeo|33df%%7rq z6H{{k-q#>#077LgjSIzOT^3990`hGuNg8J#-d^3NkLySe(2u8%-c9h^nGfb??Jj67 zW^4V@E2NghuNUPoq0sZ#*bbvQMNVZZ1BQLYnjuihQTC8?`Gn6Sl}IOqQ0C#S)uiek zMcUDDE{Px-+fM75347sW>-~21ri77s;Ueiue-u4!pwhM@Nke*B%DGdAIYwubqeKxW z*ymJ~UGCfsKes5j>`&U{#im`tveWTB-wiXtz+?T;=-badK<&}o7)k!_pQls*ut7Z< zVJ#1)3UVVfrYj_OhV}L-NIsRVClq!bBbK>UD(QH-VkA&~rmtl;xICcs|MR#tob=`S zf0XExclkb_%rxGRG|uef%lKAqJ)7Hgo<3Dm+Rl}-#* zXr0vV^VlSlP%h_qZ5~V(`{Z2-@_$&z-$Z5kL|}!LS8ZDIK6Jui%NOlt_uf!uaW#G^ zY`8z%)J@*a@|#cihfUfZatxonsd=$EBB2R`yv;l$vK+nknX$7eYS~d?Dk0>N%BIQ{ zQ`uEUVXlAUad#kcnBtf^*9ulKozrnLigSCv-!rdwewdHBRPIFgZNjVEzbO;^eLh6j z3BW{Q2A!?{jS<|1(?jxt^Yr0o;z>EYrCVTgIOa5;9SAUj@yTcmVdqG zKTGqUrTNdP`M>?th?e5m(ZlB@nBD=pJrq}o+JC!HR%>^_xU-_Yt-tIzf%3`v8nAn~ z`0|%E%%=k{hvJMJ_WYei{kv6EWWoz!(qNi56aV=c%7vdnCN;49Ge8JbHhmlp;jl$L zaXBx(;pLyM=7|(;b917HgMT{)179%f+Cfo&d4iymCv`$B`mX%WOyi%t?jfmx_sg+; z{0d(ub;J6|Z=F_q9e8c@7QVC4&v&*{!W&y+jU<2TAU|?JAcC6gU!DJHz@M{$$!EFY zP)PUNfhwoN1Nuah6F>Ylx0Q#6IluV4R_GiRcPm8>0K%>4P49}&0_%+9PX{npKh za=|5so3b2E4(Ld3w0Xx{$IOPz06qdPjA9iY{Ke@oO>O;TD74 zi0A6>7vl}gK4bW;fXBZU<30Q;5pkyN_vvarJ}gGaZNeCjpIbVg9e$PP)}#*o{SLQ- zm+IZLJNj$OZNO8ahohXX{ljDSHysT9O$*?EU!>=w@HW!cw(ehhfdRI0n$pE{_qA6>5U`&Ld0Edvne&!5uoW2hF40Iw- zz1D5I*5Ei!$dQ*BTh5>8Tsb6SyU-;pQv3Vzbh{V6vMcQ>fO1Xlb&eu%Bl@U}?+8duHXN zu5y)N@A9uB^}j#d&lMf;hXqE5OPK#WZ5fYXMJA->nfNM(v+8vl_VFNJQ}5q>_*sJ?@D&-(2ZBPl&GPg7 zhX`rb4|CG(&yLzZ8_ASNO!8NXdqT$HKI;iJ<;&+9DV1eiSA)rDl4MbscMs>=IcQ3{ z-Er;anUy9MiGYLMZ)=l5^oF0wjpKb-N{Swo^+MgPb6Z4&)pcbi$#BGVLrO!@y5-Wc zD)o!sjBg+WH@6Wo=0E)?v+B>eeZqto#tw$&o+#Ty?{{Q(3-B~m`;&tpiSySQllfC3 z${g!+D4p6x>wVka1gI4kv^v1WKvJ%|>k?4wl!DtE(yU!H1%&sOs@EpUH^p&HM$Kfp z5XGxP8(SAV_iKxnaV3ci)ZkU;S0E%Iv`~UJ^I5eVjQrhblVP+J(TZ6Qa2tbJ7DlVv zDk0c?rMDvH;I`Al0qf_XHr3dSo^;}fk-6{drHPE2Y6)7K1NO+Q_~r3>9^PS(6I4MJ zo8{WF(Do-6%%VR56tO6qmTm?8P?P-SI>W7{=nfV0itvinAq=-}n4W+FZC<~@nP0Z$ zpKsC!u*eTCbN_Nk*5Glu3zuF5jF|o)G_0GKkxfXG4{`p4GekY5OO^exGdGFT^EjP~ zjmbMhPq2q78>Qsek!v)tY){AW&46;Z%+p$S^WB9?cmB~=7gmQn4+agl{0)Jf#I>n< zO>MQ%nAE9EoEW^I;nVTIEc7qe`#&d8ln>m96~oTYv5RtmvEaTif0xL)IxO4}lcp{; zmpRBLv|fIMkWYD>g=QxWo0yc;EUhq~C(f_)GSjcrKv;jmqgje)h*NDZawH^bA4Kfq zXxO_Aa8b6)=E z*#7oEA8}{;WHoT_;VBHvV8D}?)U%fZ$_>SLx~nnqf1LyCFUJkX5Z4x+82!q27v#R` zHc=4h)Qu0htV+!U0l+b44TzsIrHd$)3&@hinbpY_2@11pH@olpT-um|-eFrA?Mm?%*F>z!Bkrrv3>`SDaNxE#~OS{@YR zGMlniMc9_K$Y_JR^iMppOKxa>aN9Z(l+Q(kHZbn`y+8va&TA9e800W5n2_(^`1s{z zXCq@)R1BpMKj?xAW%Lx9qvE&o4Lft6PXp$(!)WhMkqW6Oy`{exDi~U4)xpGO9V__|3&7hpU&396WW=ok3Q>_l%X3) zJAC_*iLm)4)dUL66H9}L1T1&zQ?SLXy3ydPRh=x3Y)+Ck_-2pCj__WmC|Bib0$N>s zr!-Z#8T7UIWwN2Mk))yF@RXcg=aC)Li;$6>9-g_VPk#z}i6kV?!Lz zS7WOxVg@?52siPa30BreD&~1oC>qUgK)zt`qY-g2b>$JsNF<-2GOVQ*>HxlV$0-qh zU;@u1c^ZcRRphS0N~sv-JAi`J-=*ca8w`}@aBF}vbOOWe=}8^w%v0I`NniAQt}9nF zuOdse3S#OqZNjUPc9^0`B+rm)a*!j|bu$6uj_sRQeD%N{_!eE6Hy)9BwARx&rw;=v z0Vl$t7tF^qqUFQ6TE5u$Ye-j(Y`N6DoOWMx4e^VT@neWT#_o;dR z3Ch$ubM7g6ZZEa+&T#k9G8c3`YjF{)zCe3h1kA$rDdw2*V4{cI8_W!@BUT>GxGRBf z2yR=IY<=<}&}>#z-V2g_7$i7}%qn5nA0wU8cLhq69RFG*QlZiX1P?oUiTG~|pwOWe zLDE9&`BepfGZH9`%vnA4D;(0(JsB#{Hxo$;c3u~Ub7-lo^@c9jD5&<%Hwo5KLBJy+d#Q{$&nmE#Q?eXcQ*thA1Ukv;fFFdN}QrG7$g@=NK~s z$*44TIu>Vs0JUV1W*0D=TKv-D2kecZ|;fcuV{o=WE@EI1AuO7y>Mb zuCyETfhW#IEF8Hs`uXWH1KyQyAl?%K_qV7nmwIb5O_7hjXLVclp&Rwz(|dY{Db=YQ z?kzK%Yz_~1jiMRxI~jq4W9)XH4-tswwbUZ#n9MWM0eG10ED*F0$XgEhO7!T_C()pv zAb{f+JkZVC!aTh8WC7eH^D0HVZ4Kef5Faw}uUNtW56dCE$7w6D?wP;WvC!#z?kFSP zhZF1+k(?!@Y>_BcdISjEevuGk9{p&tVn9j9nz0-Q!asPmGb7Oo%h~U zF-M$l*xRQIP24(xSG!O=6(ey1JJOq%31AeqXxCQ#(WWtLJG5;mCt&%(-$%xe94y-R z$7Z=WVlIkIkze@81Ync4S@&+a?fLfDd&|rON7}aP2?GRoFz>bP{)eOZZ(dha8^Zm$ zr*Hq51atBZq2v2eP0nZ*C@Xe$_?!T6FJSt!P+!V3<)j|V?4_oc!a!o1+20&7U+Mw# zrt-30rSl6wJSe%0P zY^I&=;heMC2P7WhV1Dc?cij!+{CG00v$n`6dLR1ChMjO(&og>gd-Grph3+8JkBYG! zvd11((rxTBG@-QyscOl>k>%}<@7sOu+f5oBxCj)zUrmDzI>xlBy*-t3O-!fhZ5Bu? z%!H_zH@S;geR_n0LF8dVYuE>ifZO`{M#MUGn;cbDIq7>iuOPHJ_yHI6UJOcGJ~-brF{usb42{{3{5{m=;zjvm)RyIp(YhdUG2 zJ*yT!+SRE#Kh!fth{SE|jHk`ik?P6kGw4${4BB)`b=FpHn;zNq7g&6BGuq)U3R`R2 z^H@QB+q){KZ>tH3jRLCp6rJmtg}s^7v<_f*<;jv$Gz>aUslf?}QPS^=^XF%W*s0of zr^)u>3HEUZIUV7NA0IlWzajU_Z&m8S#gG#9`%B)Q4576@?_?KRP)>ZYWy(b&>b~=V zM*kkD!@U>&UBpZe4^xo;X?6mpDOfsl8@ZbX$!bR2ggq~VKP|*$*z$oe4=!mO_`C<7$~=R z>1_03t)2$k&pzy4z7vt#JlqETW)5rNv}?vZkU<9Cq=+*8ygx)pmnQxBX{K7@-tB!*A0n0BFu*cvIV3 zb=$<^#FK>F!_X$AIK zXi-}@$4$U|8TT)TMLHmpImx`%3r_Oa4N5|4K`81qgoD{4h$uMpB<=d)yQ9gvc^(ea zbTf~;@{G8wnq;mV)VVyob(1M>%s|jy&Y(#}Q2P~o9P?{!VSgFC47KOLFc@#^Ady#$ zWkTGmZ&ZIGGlgpmP`zO&GEJbeTA0ICqv9cdlHPPH)yS*pL4`_6;=Iy{tPw7?VhjUG zslq*v=B;fGmwKuWU?zuo(wJ9{w^p?wlNZZIDt2|+*tCA6&@;I6pqNc)^NRSVD$Odd z?QW0sIrj>)9;jPt_Qrn1sEIkZ6VZ^Kp@;lUw9bGlE??)foA0w3 zcAQFpn~~XZG2a8R$x1%0n%7JpFE>T;*!!H7e03r2K_Gjo4tIjkYBPrtZ|)%1_W91* z`m40tAOVtak|4ww6yT**ObZaP=e43_DPw$}sH@UkDL2R&oQBnjGOag1C+q^iUc!37 z_;X)A~b8^gP=U%*-m|LCb@(HNjzxu}xWRN;T z09&0L?Yf=G+KzBRjx7}R;<$6R-6-EyMRuOabk(H-2TC;lK(46u3HEDILM~fNYo#Om zEQIo;D%>{dTV-`7g|*KsxK*|`_dkSsF=j;kH5lYTtilKrgVtgt5dHl32WM7#*ku! z6b-&eil0H7N{#(ydS2UCbA^>{@Fv`|Gz5FI3Z(HO2cvm({bED*?i&H;@YyA9EkKt3 zzbEp);ZmMdPaqu?7ugLW4Y5fserr+hf1q%Q3;k?d9o(d-s8f{Cd+&0 zj<=}D<-_gG-^QY=_^WOfTjJ|*_v?JvTbt*25x;#|^Sqs<+FDDrK;e%;h$zbd>zG&k z+VRcXoB|bm>o|4;d`WFX2R~6R0#1Ee4!ls1UyuMewb=lO*N8h%@XK3iU9%t1qUBI` ztx+>icxPW3U1DdVk!RzmTm7Exz?WDgLn+n8B!X?X)24AlsN*%2(?k2(fjzu%%eZ7( zGVDpZfrL;s^)0bm?nNt&Yk(4En4^JIo4;_9CIv@_M+YFAAV_lF*>;=)h$`7T6xwY! zUBpcV5Y4{J(HP1Y>a1fa3=eSH=ZN%W| zzF@4u8bv|EPTc2SIX|TjJnarO`;iMtdLof>4b8Xqe%CN-xdjLQRq5^6M$cl@^f~f! zvL^T5%>2s|_v@|ZY7uE~PxuB_frwI!?St1GcuwcieJ=&aEdrZ3on3zIfoJN;tp`4V z&*ie-ifS=ki77m(U$fG4?sB@?dM|2h2Lgb2W+_amz zt)|E=yb~c1s3eFixL3Z-LE>(HEhy3*yD~0(O75ko^)dEqf|agPk60LldWp2TZA|X8 zfaEQQpx41{<;)CyUMIv%#vv>ijU0lIb9I9o?@!I7e9h}DVYHW&amB2S_8KG=mx9YsQ-l(ciP)PZK%os3phnW3;^$mmqdF; zs3<45xRY{qBGb1HPLM)e6zzoxOO%d|h^EH2UpW|F0&dV$Xc98o#R|9s<$10o?1W6e zgEW04!#Q;efU&pQK=c?7ge-vvAG7EeR+?DbQl+A;rMGptBiZG(+x!TEpIT;bD zf7=#5VrNNf4a~|Ekn5!jy{J&kM0(wCHvU}VTX{-?7No#VArOALaD;azLx40Z{6Cz% zcRber`!-&pj50$)sEoLzY-P{NE@Y3a?49gL$;b$ok(C|F7DbZ1WsAtp&d&awFV*}0 zeD3@EP4D01;Sb7nxn9q4&f_>vy_Xv>BS^BBN3`4ttCPP?V_R5pl{4d=WIrH}ag|&0 z@XLwPi9IK<4Qk?v7LB#Hw?6}5{KonH+f3s4*_L+sC67^>UU_^ltCsdl1tXhN9B5`5 z2h}~!0>@g0jMlxCBc>SPY~?FAKfC&~BD5)`1uWwj8|SyXZ)fsGYpK^O?Z1i~Gwdfa zE&Y~=*8xSAjPF5*mqbP;n|R7sU)g^+ti!qybxV`ZuBz@<2a*8jJad~b>xon2nq_k{ zS?65pyd@n-x==M_<_>XMveX&(;^M3Q+J*A*_G3g+snlk>71y?7eD77Td8pkgT-NDp zjmsMKD6ba6;MDf;3Ab%gLQ{d!xCxB0_IHZ5K0G8K-CY!S zA2_g+wVyPGD4=59Ol1{xfh1tHWZQt~dO%uL*sdr=t;{)+*cU)M-pE$2NgVU!hA)yq zUXT0=;ZXBOKSh!Jd-Qep+tbgiwuuoK5@_i>s^mS@m3EessL@1fwT^#`LRx8(^t69v zD3Y=mg`Ut{0jk>V8Q(Nz#60i&_Z z^GQs1R5ZB?z`>L*(SKT&PGUALfIz;}sT+Hf?Dpm6Y~RawF7*Eh7+s7RSEmYc3hM4{ zvnsJ!A-da)5e}z|emFgVVvjcA-l_Z-`gmr&=p#{j9MHBa=%LYR7LCev-5}k{ie5WC zVCdOvd5VL>ZFC{qurW;P)bis!4b~GHWy=^(3)3(91&_~gi45V8FeHzgX2`$3d8?$v zrCCU&zB0IZgG%wG-Nzq`YT=V{Ttc@JP3@I(UuRbjN!J88y-uCB^*Oo6M6Y91_I`PF zziax3qL}9dF_2~GT|VM48VJa~w5On}VR>DA)@_t>D4plj?HO*;p{EJ`0D8~=D(=mc zC}G%uJtcnVl4vN=doy!?VKJ0P+&&GUnz&bSIOjdtdP9UX8@@c55B9QIQid@mT@u2G z>$Cl~k-I7AUkijF)>|lf^>^c44CiEup>@?IsCiF_;4vES#qQS7-bIv;x@K(NtnjM+ z1Sz}z85qg&P9punAnRvHCnK9R7Wt~Bn7&%fV(kt!TEO9c;z8Jhvc8p9|+Y`Jm~XZ*8ne(-@{x zV%6N*V+310YW9DXu>Rlh_`?V(Eb=%_7cLYnN6br_q0W)t{psyHMP+u;7+`(KpOXwo zclmgBegg!-ZlUt2r2{1?FX;;VB@82!Or)kQDI}|uhH1f%k#u2-u1iUN z%0RPuFKkpo`xPwREpO^13Byn6iG1ZMRCQTwE9*cqF$%x>oVYH)u%$9{z^)WnfESp9 zB{kX(4MVU|z1|BXbu(sHRz*=o^YCNr{*(Ed!JIS+y;%eNGSQqbziZWJ`vxmxx}N(+ z(IxG#fjaWs$I^dmIpq^&zLM*iI)p2df5~!@w+QiqDHu_U#vRbLxy>EW*Oq&O; zqkCIG&nIpp_@Jy4FreH>^kH-pC`M6d(~A%$S9wFsGly#8Nks|{3_IvMxT;$ec1>S( z2w9WjYD_;#!HWJ7FkbJ^!YnD#fYfMD2;M?nKV5z{{gh|*T_W3nuLerjn#3Mf>wVnB zh#LPGT1|SDJXzGJ%!Vt=1k4F6QiR!m;21K37M-0r!rhc{X+H9bT#X7eUtC1cLdb=9*!(GTJXTi z&4=EO4oK6Z%F*U2O5u+j>P=PD<4Q=-Z7{pEGZ%NZ4gpX!)__%l;|9 z*}t;|HqanR#A&IFBzn&erOy1eagdjbWnI^@S1+OvsZ|x+gwp6Wg#I^I+5A=r=?>-_ zx1JQKv3+&lcSiM&^TQL|b#h1%4X@F^_UgTv?pFijeS8~vor=`#8RCe&>Uph&*CT%I z@<%@+^?>fqeJRuDck0*gZrmK`lM^UMp4qFgBTb$SC!0*@BXk79&j3d@izVZ64e@Z{ z! z(s2xO#hp{vXO0b|c;!6k<@FCGjE%n%l)UG@moyc(d!zn;tKRE&-=gWtnyRkk@Ae+B_paJmD25d-beJKX0Sg=_%9EEn_dC> z_s{eW`}EG@;AQQCZ^%FAf4zf>q86!y&Za@_$eYxo>`AuzO4dypD4+MBrc5U4O!VRS zmR{v!!!%AkeRM04C|%O?#xeHFOUzelBrl=`JkGXf&iW7x6-B?hT&Rj1-dR*HO9|(5(r)?AmwpZ&}_+iG^PQf!971 zZFDSe{1BN0EytM`aFAwwZf`eCGBQVVJJc^>e{F#t6kcu3Hh1R|b1ad<7t_pFr>}5b zMf(W2fOMy_MC<~V9BtcCtY}aImLVz)5b|jSuT=o1IIND#K5MLsVHPkGhZ|oW=qQDi zu|a7ezwpuJQ4NZUXzY*T5>2+O87J33bP{Am5(b7>AoGY&`h*g^@G(;C@$u_KIgJ`h z8UP4LYlqJL@@v#e4+xcYLIUxTxU-s+SYK^5y@x25 zB27YNx$EDa<}lLsyet}TUg_#n1+xNdD>9GT)1_@97#1=KB^Xf^NJ98x4inG@w!WPOY$-mq+LHyMYqC&+8y~V%$nnQHSj;$y@M#QmxIU)A0)ke6)ka zQz*5ix#}g+s9R}r&0ZNuS#FU9&89=eI>ESiQT$RK^6$H+K(A1DE%r&zumntvk-iqLAG&GVaY6rA3#lH9{&r}P~A3-Dc}U>9-9WKTmAM@*E6 zy0Dcpk*ZuJ7sh9ntQ=9bk;j4IWeIU|o=wiW_6LQ^hcT2{6v91a^qMku-t+tzsg{07 zaGH}zW38+LFXP8oaER?yz9bx;s;A$-xRFXUSc)`L=m(Lsmm87}X7utj=1ujJo=p&zy1u<5b!%)m21*!L!dT`JPYsH}x4cu`f-efAPX@TENttHmc`9KsCb8iJ+y( zacfHApe7yME_!${da9qDYvE-Cr=6Ys>45GMve^CrgtfD&f5(QTUrH&^>{FI|7jZBg z7xAU}xD0(P`=7KC`J{Yy!`J`flZGS02g#|q`@j0Z6*}pYN5(GwA^ZFFUkTy31yKOc zUS01+RuZ-nN#rx#mqDnI&Sls0$g!g7_3sD6-w%1-0Cb$njdtGs4N1U(m6QEo%lsFg zfE2r66F$MEwI@Gc+KiJP+&7WhiFW`v57rqEfX*es4=(Q9$$03`JlX&8PkutR3AW<@!1f9x z;g#LIW^qvmzVfad{OUv}7x(@q-c5q{v9P~WMt0zy=6rx(#gmy7-A_yY1y_-Y4R&x) zV*lC@(zg9KjQ$TdT^XS@hj+}U?C<=Cj|ev*CO-4vb5O(xreSTOlXCy8c^Vg8#a76Nm{;Nv?eB~ zWuR7bqz?2afZAB0{iMwx zW^n?oKRq2;C;+|gcsXhuoE2AtO)u(wxv2YdWyX;o2TB$V{&3cQ{?~^QSba_Y`T1Y$ ztwQ(&|G*Ug_-f9F@T(jNr=R`Yeg|0LBEibRpo6bt2E6cAb<8hY^B-KSKkbL`OL)~w zpP$?-;RGT$LQjQlaSz;j1!ee6Wv(yU==~3-Bnf-N9w>QmKKS2^157fwC=+Ls?)@kA z=6^o03E>D-_?hog8ZN4Ocuecw@kTu$Uz2}>g|A)NfL6hChU3km#aNHSq_umSk* z8^5o5v(7BX(a@-U};kv=$*JONM1{a}>v=ME@n!wXCOwGTe3 z&ItX;alVXi|Anf$aBi?t?dT5N$TmrMVgI)(XV(3{(G~;y+WgYY{NTUHh1`Z3wdJP$ z4bZ&|5!b~D9BY?@Us;W8UGarQ;h#G>jzoFed`sR3?&OC=Ffp11gY!QdkDtBa@IH@} zWII>_NJ#+}(kt@uPX<&MfQ_Uj(aG!`M6X)8kAaCl_B?e;@Dt$Gv=|2A_u-)9A<6oP+Ra1W3IKV~CN1dxz}x zhqKT$(G+j9JP^r`U2yuarwl}CTZTJOiEl?F^SM9YO)3Bx%c9=N6~yJFBf*$yjKjh~ z6d6ox&hu^4N1`gB$2k6(j&fZ_%!Ms9uuShxNu}CQ`nhAqweikwDzSEtU$^sV<=h4t z8~?YX2!a;`iOroSqKw-SW&ldKAo}?^nAu`gj)lhj#D1{py9+&fbW+ zwIqwE9OoyDK-ng4RipczcP&10<2aEphvNw40sI>{S9cxYe6xa}?uajADpK0rI;&;> zNn#4Arv-+7-fM*ma4K(HKm8Z{JQnyn5}r+l zS5j9hW?NJ5*`U;Rp-gAob$Jx$4#g6Jx`KHOuPYYRl^Qe=T%KKG-UQ5WibMn)k$OXx z704WC-O}Qqv4#^c1!v_t=*r0;aQMMkxA!1BKb2d1Mmk9pddPGXq8ZFcmF_t}8uKQc9R^ zP%zBX-{24eSh5Mo4rL}DQX8LZcEJ5Fo&l@^2;dHGUd`@@2TILN2*+B zlZyelVz}i2xPW#$XuN55H>NDSLciMi-ar(ijned@?^Y+VE>RosO-%E^10_j+eU8zaFsvzxqRnGt&kid z1KdsBSi}YexC>rUp#7|{xw~E-4=pvFFim#jmKgi?>x?Og<|X}3E=ffv;7*DN-w$}~ z?Q{(7uD!_;GBPrjk-^opNi}hUBLaQf^soKp`K}r1r`a+QISD*v+ zeA6I3cJ`cV30&|rm{Vlv*#NhL{)_X>D~B4t8_`aMjpe(m*;CL3s%t434ZPYecXckz zqSlTI^kZMb@Et^9w(;Y08(PsQr$d};{tM-RVmBPFg*I_G&*y~)M}{vR{xMu?KGZ2&CNN0u2`suaLNT-x*J0oF59Wp zkEJf)7;KXLidKGl-T&F+-q;Tos^&s(41M!(L7e#Js~r2cON(!&srK#@U0tWwaVhs))pBTxStg5*b__N*m{&*R<{R9v-z6W7ubgd3*l%Z?GM z$j5=mvqLrfRhY$O`BPBWeoDoccm6z|%i65D$r2DvjVmg_Fr-;)c{2ooYQ8-PMjMEU z)3*Q<#JC^OP2Y+^B^@tZFzMMiG6;y(@JuZX^m<$X4UZb57hhn&iV5J2>(=~_gsft* zXTx2#huI`XlY0|9<=2OH<{k0$CGOe+fTYh|DL)_s4LZz>*&{^1wE*r-1N^X?yhpN* z(+Uu~cAw!5m%rG93pEPoSq@D9ucY$ zN+xt2V_(>^+PLw|?Hwy11E+)I-1Sv_E7b+ArdsWeMsd2W)za^rn49HEzJ2B1viphH zn<4r{(E%BOMBJsbd5xz9jBLVdRpt0UqKPu704l&OsT32?5bES_SPbI}o-4OCiTT^0 zK0XEZmcc!B)CP4Un*5DPM`{Y7pN+MgzH{93I}(L(X8eNnZCKvxD7BSB@63-N&B}F@ zQVpxwp<9hnLZYEG9M3@VlKmr6m20`)_ffKEJQKjoPDU8S3vJZP=jj^SqYKxOClq5t{l{pYeN zNF&SCPrZKa)$L95^|0a0)bwX1b5^xsRPm0xMpK3B6Uii2lo2)M8iGwxI&CFJB}@7| zGx7H{%swgA%|aKI?Adn1?f1`i!7NP%T^?!$ESQnBU9Iol!ro4~eXpL6VUIa{z6%+e zmbukrFN;SeKz}m02%@9em=VL`WnBZMP-N67LUzux^YZ|gvtyhD5bs)VFOE_6(1 z{nC3~Du`JmafAYHdNt@g6~B>jTDu@h*<7^G&l&jz-4DM)7V^D%wtlG5UwS_zP7b8H5%0K0cz{zV*t!w@}V6N-^M0bydWM;h(2qjx=AISQAx0rpmK%F zP30RdOB^_gpt9rZ*B@YBOHd?9pv_k#7vhk|I4}IyUxZ=_pK#c>=F3yJb4S(lCXcd? zbzn&+@BMHbXdmBD;jA#JT~)6iTC-wo(-J-#Shu%K#Q=r9qRIi!(3TV(9ZvR*u zR6pna%;XDT7Es`vlGZIBJ%nH-4Ir?MH1Ps1Mdonr-D#v>d5&h)s$O*hs=E z0%NQwtM?nJI&1s^`ruCTK1ot;R5}jWNQJ#d5DCQc8H6`0YjD^rj>WWJQ7r?u+QT== zi0$9f4P}&HE7f*glxWojGeU?8$M;XnL2W|lbS>hdR%s+@q6#mn3}ISrx$T}iOiX*2 zm~iN|*OAYvSCH@j%~yydV;#R~ybgN6vf~ccRN01l-o`XbgIT;QV^1ls#^9cFhlU~zl`|bCvhrJqwa8pxaBw?J=2hy+Pn5)_ z$))0pDHL=9ni=+pRH^D|Y85)Epfju>QW)_1g>*c4upSz3~}fL%M7s!l*0k(WZg)5(T3o z_<>Ql?B+DSj)!2}7L1A%S_C4w zTjkqtFZRE-d1KM9V$>3I0b13urGS)I_RbvU`tcm|+5^nf=MLktQ|iCuX#H1f^$45O zStRu%9I0sAHp$HTQM-x8k2LP>m7j_(Vn*et<9H53)38*Rxcj0;A+ve79dOm#Uup2f z%c=J8j|Olga_UP(jMoUFNqm&+km+{*0(6@N^WTz!&_K-(sOQiy*15tz7($PIQ9EQE0_MjR#2)f7yo&I2Y#zJ7swKu&P$_I~Mc>o;9S6qcwEvvd6Bg2}~)r=Y2&> za#)UkQM?4mv}NIqkMPKGy@P&y0RaIf!7sif2D@jaW?TP46!IkcJu39JP}93$5P?cNdyxVa*?=N-#K!IO(aDuN~v@Oza=~zgVVcyLBlXyc?{^DYmH7;Kr>u| zxlvBT^jTsf#aDj7l%t(hemsa*Pa1lge}D0g$}1M}RI*mviamMSofn>Cj5{6bHcX7iIxBbS-!&h{Rx|sxIW*I3#fE z?)Z>GcosH8I^4SVSl14cL0e$=xV$i~8w>K-PC^)VgKWDZgnslxU33>w%dh8wkrM{+ zgj*iA()+9Nodpg6OB%E5YS(Rc{hH%@F}2I5TC0mEZO6xo=k2_9sRhM75z<(utMIM$ z3nQe6fBU;H(}%(j$qkGiwU2&s)PEQTPviSA{X67kXk_R>u1VoBx&)->ZwNQI&}VrK z1nu?vbRV8b)F(W@284}G3&)xu8a4>ja|Fgl-C@j4sp0h)h(V|g8p1Aw#G|}qu!(6= z5NYZ(yZ~6UE#&`FHhr<@MJ9rTcE7QjBZZp~M^$W#?yM;C%;^f=kZJg3Mr4%mI!5jc z#Hr_Cuvix@yWND0m7)@XZqzyq!kL!0{P~RT^lg#*_m%j`DUZ!5Ml}FxCp#@qoXFEg z?&iUD~`>p|)ii^nnC%1xIG$pKQ1)Wm6PO^XH1Mdc4o{ptm&bTcYa$9JxS~P_9`yH>Q zRTXXRdumpsl*!%edSy0%;~tErM}I5A$BOnH>_RwYc~JQJ5r4h=Vi#KxI|cT zo#M!!=n@imXVOtVkq77!zb97{Lakz>!iw(?WD=?-$K{uK zaDu^3Jvi4Ei5W$xI|%8ccES(fttmUre~rSP>G+|0n1)L@xsPywX7~HC`0Puscn0q$ zQ8|r;wC5R0SNNRF342O#`mMtZne+HU7-rTZ>zwLZPWwVJT{szNzhSpvq= zY*O^X9az}pYZuFqKl&G6orgRjuE5NH^Ijdb7kOD;P&MbgXyo}i^P*YyybfoU#?#Gc z|LyKteDN?C4Eap?ww5x&e!7x-6YFpTSogVzUQMX|VR-;bMh;(;2$j1F1QM5FZ1FGz zk6+N_%$E{wLWg+r8)w^2VMg7r832ob1OQPyR&nHvWXxjN)I|CZ_rp!s~GyX}t?1G-hq#k`KI^+Ka=9GoZA?4$he7Bn@!|yQ^D??G0(S%U>P- z>VhWZ65S2+l3^V)7TRpV;~?Mrk?-x*l-kG{5@^O5A*+s#IHcIo!uo6JfKz^h+~5x1 z0?aHBLGlx3(Iyxs-oV{&j@+Pd$o;m0$UD`S0jJ$Tiy2i%iDvMjykegYeAp@Fj1I0I z%~96t`t?i0l|C*k{mT4{!ps;a4N^ZUor{ZeU8=A1;?L3t{$sA>2rKV-vEnhh@9~5j3g3EOKY_CSpVV} z0q~BBv^l8rhTfa|T%AgyB08+Q6Z+a7o(0_!NcUGO54JObj_B@+SJPu9RT-9FD;$RB zd4tR#4yM)Gev%-UNCyxU9bisl3t(LA6|y%+7Vn4=U9^O}i5+Hf#Xp5IabP#wC~m>g zAjM#{hnFZw|LTy#MF_hL_P(*$I+F9(`ZC?d2xqQy1+-fVls|~pAdXc8WsYuLZ?xh^ z|5;U$36H%k9h1RQrw~GZEoyjF6`wPe&;H^{A=gg0k`BU>$_p&1VZYo)!(-tTT=qSv zhc$pg#xP%YUIQ~y`btD!?jQsI519m6jtiiu$DmH}OqRP({K~yqCWs~;%>qixS8)d% z-x8Eb8bDnJ1?9@Ovq0*@@Q;Bdd5zE-*lk9{D{jsp#0LBM0X1Z1FSCto>=k8N-bauR zjT%&VVY%-CsU{pu)~5wz5``eYJ3lCrF9CSD9!kmQKw2yuNRr)KzFX_S{i;X&aj!cB zta%_7&iIMDvexN_nPjeMw;!G5dl>iKds$2rO z4Qa3$WAO3w)5f5quu5f3nD`mgQ*J;)BuydUTmXErt9g(dNdr}T3G>bA!^NfW6O5h7 z{!u{7uR0IeK>J$b;;velvF-)F`jP5cy|`4Oe%8u3rzC`B)>q1Lg+SJJ<|G!rL*8 zAFsTg_ad0aoo0PqHl2~Vx!L~Cae?3FJFN1ITE)Wl#bj-#C-Y>em z)*5jTVMvFhn`t=|7gt_0p}4Q~xWVUrn*;rFagdgAf9iB;T>QX4#$(qAy4X3U5kmlIO%Q42TAZ= ze$OX;2rR_$ck+0BMyFeGc-?f4@2*DHq?I2#ae8dal>0R@7RArQyW>*tJU~em2{ol! z=~M8UoY!V4Ht;$;c?IG0ek&y@kzAY!Bw>u8YW=;+{|~`;tmxPBjXeQmUHDPFob@H-|xt{ z-ZEt>Mfn0GbBPg$gNk#Uv!H_ievd}dAX_Vdt36|pjzG>Js;&{|^iCvZPo)3}I=&_! zBtOPunAl~|drw!=g_1e!LA$7t8fv#8G^=KBz&-1qLQPh6@@X9HE}y?jXQ*9#$3(HU zZssVZxxyt`WI9W);N8=~lAUHhdi00a;FM>!3*J?~QJ?mB9Q}7;}sU{ zM4fqr>Ea?2z>htH6G@9%>BGP^Oxxg<^T{ufP)OWx?bKTAqZ@4Jk7t`nSinS?^|RMb zJU`h3!?TwXJ!x-Mp0_|oz%d1o#t(14*n$khj!^Tl&7+U(GsjF$Xjx#hgYZpfOn#dh zy@g7!?=IUCWhzbLhwr^$5Xcz%_wJ!D=u14*qbkZW6Ahlqik?UzYO3J2cpLHqxN;?a zdzZdES%7kP`ZGtCI#kW)Zmr}FwS|D!l#XQ}lrm#va0odRlh$(%!F) zR>1JQaneBD-xJ`BWSLc;|k6uMmuLIIXM&(AT3EL$_d)mQZ-zDYPUQBG}ransr-;bU)P;bBERQuT2lCu1MYYE{2X+m7#Prb)dAKC>K|=|w-Q8~F1`NlF5MxhYx1LQ*uB$L*R0=XdW@qK z-y`&If)HVS2Ba`@(QP93m&LhpUcuL^2^lCy%yNQ)Jz1Q650BflGo48g`|C6Bpwl1y z-r!&PMk_G;=0*Bk{NA?lpwm|61azd1ug0nk0k0vTW}A9m7p-D|D;WGM@*JyI?ka;yM|TjwYy$P`@|>Q zZBY>;x^BHMh=krMv6IFVXRhYnL68J;np{1G#=7l6c*3V;Q0m1a8EjszS%^_96LQPx z&U9VsW$<+z#UQ`o&w4B@q|itM_4>}77+tQ(%`Jsk*P4`w+JB7YpT0@RC5AF}E}DN? z_E(L%ix!qfhNb--G>bAtCL7pH_*;_1G;vr6OlO;nK*%`Rt4uH$NRl3;CA z(*Y~$-jqJ-n0B4sOM~XyaIY)a>Oa%Ao4)dR+$hsux((r4uE`$U@ufgEwY;jMnR!+b zhq7_t!7HdQ;$Kc-uO(|t%gjGpaegLpn*5{CQ)6f^JM%&A&`()0Iq? zU*K<&zhL2WXWKB@u0trpjIh;KdXle`RM5oC_YbWVudig57rU)yP8QSuE>z$Bff*Cd z8}AEkV9xEP?dXRfA}9`B+wvbeEr~BcnJKobLF0GEZNm?V^+?ufvVd0KJp;HI{@W<+ zQdN*!oAB^}s%9Rvkv83o3l$LmU#C-S2kxodDQuStztcADc=a(a(Y;@ zAR%tUhLbjlIi<^MK5J4o$ER}UA(%u%c0NF3i>4U|$UuHt(oQhPeKK2c^!{>SwR`eF zk<6FmMFUV37lPi=7gwt}25eW&A(1wQhqYYr1&||fjCtc#Ywm<}b=sj}5; zl2|qX3(}O}I?x5j!9ayU9L#f?XWYqJ2sb5#s^914GR4I6^1n*Z5-uano68Y`%W}VN z1wAnmZ~$K=8CuqHPx8GOA@ybrX<@5Se`Co?_@F{$yBK;UJGO}*JSc1YzGbDK@M3>s zZg&S|$!Ev5`OxPxp@C>JqUN$SLr&sjdRAHZ_HC~wh+woKrIRdk9lWvY=);C1Pz06ukC)V|kBGTz0(N$CCvPJ-CkkU6~O4iYGQGL~2~a^j&#?CH{f= zTFqtN&SoGiI1`Nn1ZA&LWO+!9BphOu$aCehMOH(D{&9tKIcIQFs?lP6g#;;M9TQP7 z<>A-L{OOyvUL@$~H9NHY+ttw{fm^D^V^!KJrDMY{)Kfb3)rwTCSK(|mLaj)hlh-@Y zG`vk)=vDd&@^lLkWW4UV=N3g#tCd6bfQFFa6=rX;$DPIUF$ryG6CTP!e?$(H&PcdDk&sTTYh=`{}_!w_qeQCp4rvg zsvP-U_3+HXWL6CJO?fld{-qkVN2k2iM0!&_@V;XJj14s^Ip%>~~BW{)=`)qzj(E-#`w%HutD`Hc4l@a+ESFnZ#i{SJx$`1ji; z^Dv9Eu4GtztE9Ub(UkiF)rX=XfQ%!D>wpYJxNtiY;XIwum98C6~=fPg#?}@D^ZTW z>qH?)-G(m9PMTK=gXK-reM=Arr&oLnW-9SM?RRKl+^e`BQ(axR2dcjDlRR*TJ*P#3 zojx2sCT;?~JTqeB2Vu>7Ht>xYO=MYG2gW>R}kzXc=P9{|L1>8sIa24 zu>Scm3P&k}mV|bIeKh0)?#CO29NcnM2qD*$n_ty7p0gh!qhJ~(tb;%N# zoAscG#d9V5>UT##%p^Z~Y-trr zD!m=Qkr^yJFe{MYgmti^Me??rA-p9Ozc)z?UpR-w* zy6s`JHGR9)=4XovoK4$z9Dug%Ek*%IL#(n@Mg||OczL}JpfkQ5-xQHM&v11%=bp-t{HUZ!wC2U%n^rHlO9$7y2pF~8NOV&V)qB=G zc>8K!Vz>K0DyjEw!Rtz(nb799q`@GP$Odrg zG#id+`V^?sD-K#?loAo#KPv>`doHht!O5dnnV!E}cz<<4HJYY~zq34l{sMqQ7pH`^ zY#S>Ze=Lr!7VI1HRaN<~n@nsDatRj@oPvWHKqOYid7PHUp0q+Y@f`4*RTiE-a`^mq z2GcJO;8vSvU$yNp>c2S;tUW6+L|$|Dmp6Z zlZZZ^(oigRSH3u}=CPiKVgq-NfX!f(6J`bpm_$wM3M@r+#MLs!-A`Q4+%24cY*MiS zO0-%<&?Tu8nkNW*XhGAKn&773!!Eg*CEa*R@7ZU_6FX8L{bjiF4M#Y5112F%PPE1^ zyt>S)S$xT7{ED8yF{lvQQ5?p9+1PWuwN|6XiOomU(Qt#e}(6s7cH+3gX!H$K^VXZGW+S7&OwaWE^t?mDWo zJp8T+8L|zvs=WP38}>X@|g|iGoTDWvW`@u!ws-^n}RNpM%$9{)G9Qi?UatF zg54-&k2K(~DU#W2#b3opjSpuxhFl! zr!EeUKIiqBNvF{iYT?UtMxdn^m(q3taS#)Jt-Le;%n)cUj3h4B=AepXBOZHxTL!aJ8w#yCrL^`3bczOmt@#Vc!=g0vrPXH?H>WRqLQb~O%w_>K9)@wuzgNx7>>Y!LYf z?H_y~Gr+V9V3x^8@>`XDI&>fGR4&?C^cOuH>9QY<%ukGD{tTjeDnwnT{Jn`SHLQ!V z$Rgu~q-#^o;__)|zYq#5t9fXz?g;7BBx}#>-5iP7kL)Wd0lqneYDoLbH}QIBA0Q>F z{B-bAs#EcLP~CzFar7kx0Yri?-O}X*L))uI|M5Y8`ljs^j&;55`cZV?@9HWorRNQu zJpSb2E57d6ZBUAV<49g@B?IJ>dTEu^nn>Ga`gHezUoMQM@Hg!JV){7an`s8he&S$lRFldKXOzH#Zh5i2b zuSet4HtU3+(dG-be>D5s{@5X$D#$iD;_!n0dBsUus8=24=JIbmz(hK13aZtW}24Rd2qH6xF9V%^+2p;T{ z)x5zucsp+GmA?yLVSiUepi#b=(DHjPgpV-7I~-yAV9G$_C1XaBe?64J>GFhaN$C&} zB+!rpPf(8rnZsf=)%d^vt5N~d%N4{{2v(!%{0G2s_ba@E`ByB}<}n1J)N*A8RRZ`N ztdXYkJtcO=6qoOKgEkFaJzh{6g4nvDup;?aCKY+2Yw$$Q-mTKVA}nDsdUyvh){((5Q(*X%;I0bLw2V>qZTw6$)?}86|k!OObKzn7YhCt-& zA#dof^S$(UP7Kx)rM2FL#~DSz{g!Z31SzhfA!{a#^iZ^6uYvc>k(1X}~j~Ek0e+`(-p0-XkYq zC{M59Zk}OC zDLqk`rytQG;J0?j9#NVGkOqVzTD7-MIsZ1?fS&bgs=3+T^zW8X9pkBJa9@%X0R@j` z%yAk)O=#9e)fw$>Z{$Hqz*#yP3W4F=7N5^=j^q6L$akBN``?t(TKZRc(C?kBB1*q6 zG65Da1>UkfQNlk_8XXU)YgPx84Z!--0lOdqgyx}2qovC8&&k0h1h;aCD(>uGx|RK3yBmhdtR4)C z>8ev*nGv%gP~z;C1H2T1uEofh z8uS`$axCM{o*Cs{jCsoB7(&$ZFu++!Ik~> zSGorVDNCJq8*ySatk4ho#!v;Zbex$eD1rqZhtWax8nHBcAf-D7CFTeKI*^vG0d#w| z<2~ecWGfNlW6$WNlhyK#1g`;cW*mr1^~C(GR!}IVQ`!N{TM9rVoqDn}Y4FG|h5gnoQIf`EbS!78pX89$+rP7|Ze zxYG#9jofQs`!b_x5XJ!;+7%kmZnH4-Fcj!2LY3juHD+4a?78M!2m~9@pAHx6_yM|B zddeOGffuy-mKi6rMZt43Aa*;{OPBqh+xIu$0ANc3m%VF=9wqg$K|kgeUNr9;K<(B# z)n6?F8O-zQpPQCdn`yvqynZw5dlx$S420YCCGqZ?*LPRagzAC#J5t8~t8z^5lpQg8 z(x4mfp7uT<%oOQw7Y0U>|EnW$R~M7{=KpP%)l#law8XN+0w=+if9gJOF9zzOjM;;DPdd4#?TTfWlHifNIcpC|$pG zE!cOwhfywu2{tSrmEXjk2W3)86DeJ-XlfOi+Zq;Jeb92iLd*APSP5((Oo)%(ID+QT za5n^?otH(ncGQx@2Qo90AgDC#`6cd#Q;x{CCp<=i3Nc!W z6aU7n3s)1S^NOVUvC<_!3}$PokZ@V9n#jqQ-NMk{mA9fk$*8wVOvXd^!JGbu zYPxqX5n2fH$LY$-n+#O#7{iQIP@{%9Q|nu|wVhI80N4>{HrWze=AfinS~~og@@xow zRpMzfPo-d-%%tXMuF(CcARe)%3GN@xGVN*uJBbOu>XjU8(6rTlXq?cFoFWtYhV6f1 z-oN=qDMGj!{6*En)kbI--+;b5`|?Y+%M8SRDLL`?M{shxsXGk5f@=wB=I(EDd1Qz@ zPUZ=bR8kL7LMI@<{}`{@!TKVk`bOOO9x(Aeu049%Ejod?saN+tip2}Mxl%#Fb9Gm* z%pL-$l`Y`5KhqE7t63PO@s7-)LO4y5wK)&RdySi;=^_0iQ{_JK1z^hO2=RyCn!PSD zvOnGUPCv?_7^oYK!E|DYcF~qp4}{4Y!;>_FkD^vzOXtM{SzBA?Egc$a}3DKF?TMU~iXm%%dAdmd08S1+n zSBxE*>Iyg!&{A6@?08?~jpt7PDvP)#mXL@Ug-{`EMr%l$9DxS4z0|>~QPi}YhQ1uy zGU@a>g$DdN8OrwyP^wCRQg=%S(ZUZv35kAxLSH>>svf)n4ct1Uh(7w*dKDpMZavz4 znM35&1hak=!12$QA(OxagG^0sj^^|TM?$#S2pILGH2pW#m{Htq(3&}4d=!1#N4Xge zfSk6=99Q3OI>~KW9{dLjfKxdWn|~D$R;NMIpZKl}63ok_G?)IX+%}m`;j&i~cy;O4 zI02Gnez#3~WSq=cj9p6z%my3V$iE|_+EE&D8qmc#dW5F{r5|BtC;uo}}Sp&877yq;sf z3iDvA)N4`Xml@hUy48&9p{O&Sp9dT!@rpZx?^fEMndQ&RV1m?dH zibHIK1@J`vzWNvHlrjcjXE?c$Fsz8!*!^FHVSYq+PkJ>02D(#2^Y|-$bm%D(EH2Yd zrm6ln*=+gHdr=2UPr;q>Nr_YhY7Oe{*L9m0LC8ELRrdL&HFF(8`aAm~?df+YPDem& zP(|Ym^eco&5FiH*e;$E4KOvP5q!Aj_c(a7o5*))awTMGcN-Nu_MbY8&y z?!u!=sw2MFDawG7MJRj#9rmdM&pzh{T<>v&tH$WvB;<tZpPxW zBhyM@!sBkD&kor~`Q*d+ca+VjNo(=>zYCWK@L@$Ii0u34DX9KL#gV%GtLw>$k3q^- z7my#Q7I;VImF2ySMd%^Pes=*i^0p4AerUwsbl=+=a-lPZFl)ae2{QC_OLoA^#jf(t zVMYSBEerehIV#uh6&Q*Pnx}s;&Tffb@-r+)Tnb{D3F22;aoLTVBI#fNUn~Nm#b^w- zeo@SR;f$sW;J}vCj^R@=f%6G0wR}63x&#*DM$j37F~~y#0`;XNUVc5|pI}NsGWj7B z@Ls*FeWDC#v2s8W322~3El1ahmTC4q4im!Y$VMhdk!=7m!T@smMH;H!lOs_*rA~Hz zK=Ym(&gE&iS4H<$LFaA1+|;wby#q^L!URe30N+`zOy~xFcv(`ueDy z&zGC_yQiUfX(kO5e*iwX=O%6~)gs~A^p*Rf^qo||)=>gH`a|7j^8ppNAlq1Ax1Vb> zkP)y)X!@J#y8;~c*Z%nNGNrL)uRWZ?=JDIGYmlaNAY{Iy%;Y{OD}3Lvvr~Hl@d0R2 z@hOUh)lzq}5~?p2YJ0%UesExm9~$sn>4X@*6&AwlheW$2CctXq08+0`S#1SQ@B$^= z3A(OL=?Rp&n_W*(S_Z{>rRS$_n~%no?~DAT#(h+@@=Uu)&+qTLIl}fk*Sy6Nhz1U4 z$rBlRjOjA)yCk_bWq0)=fs3GF-?>IWSEmYMfOU+)J)^DT3h;ir0z)D0{Yf%ICrSL8 zM3s7+dYI*;50hf+hSwcq#Vu8;5sU7=tv?#P&7#nB-?xQ3ti4&P%3e-+=6a0M4y{G< z<^I7J|CcoIFmhGnO~RX0fMZP;&iymjE}emWYy-fShSXX8q`F!azb0;aALJ&bW1 z>$wsWu-*n*`u=7>OvpF`8v6vG%&xjR6>jyApF=KBF}kcCdIFE60sPYOGO;?B^ofOt zIC57lCWUtPqwEFTq+7f$$n%~PU^D!Uzw9j@>FEqSerZ)c4;XQPGk4=cf;45Q0*Kd0 zuHO8lDfvhtDxzP^-*y`aA^dLmxw1yL@p;qp<>idkD|a%9?HB&itIxlRaX#Pk81Ue4 z0@(-%k*w0|K#{N;);o!s(fwkiDYLDY;mUOxRa5v=DPfq8oEf|Mhv;$8zp#Yi+oJwZ zGQWiF!8%#v9msCaLW5C1|N0+13}q#atM96ToVAyqbUQnC&CqMcVRUY|Gu}x6sin-)e;?v? z3F{`eF7K<54Gq1Xz}nxF;+9f(g(WK1Lm&h@bB;{0Hpg~Fi;Hx%kK=YU_(l&l{@k6bF6_{VKvBxAZ;MgiBCbKY@=Oe?vz&xFVS6y+EEG zV<;5Jro>PDsbnm70Z|*m$mCw~h(E6fl1Y!lXxkJbd4PoW1Pn_5Vu6B5?iE9Ml?**Q zXW?E3@Pd=)PqYHUgikUMJ7NoCVEly|Azom6-ac;Lrh)lEvoPq{W=LlFNpJ-fgaSndQYZrXcHj7(CL^Z5GzxJUhM3hxe z0X_J@YTh(fNYTv>`Ox)Myu$73qRmg}hK(*`-lizSUEew&n$rN3U7q(qK7p2W9N1w& zi9IMSw0%xDc>}yKhDOpnjt&}cuiGK!6@q`>-1NE=9zW{t9hdfPUrO6)AVesq=zkAE z#K@bs(a+CST`4Zc1B;@i={-MS)qqdit_;CZ0AWd;}mr-8K6`5rLV88+h_v)otV z?$RM-jGt+rE$08jxKQF8G`N`pI8c7tV~z*{TzTh!hoZzD1Ah;MBF{diHmXVRqAd4s z4=5O%kukOe1==10O3g0>z|mQ-yDZbV(YZlbnGVzi21WUTs$7+T5B8s33!N{=8hnR4 zv{Z=&XS5!{2OzyS^i#bYhcmbQQpz&|A+G(ZINF>5p8#|lcFvOP8Fr!I0($0^QN^w% zF)Rb1JE}3}=|qdK8YRgEC^bhb@ddh)>(5zIHIe_g_|RISw-hGT{YRbm1f3*>I5LG+ zCPu zEs6^3`?#5eKO6!yyjrEo$^4%RZ2}IE=z8dpKuBrfF$cf&-DQIYDTZN}Vm0ZS(f5?g zgL&*y&qkgUM}cagV_6fZHoX$&5#XT+wfKdimo*^1&eCEKGIEMOJE;tv@lhlsvG7xh>(Z;>ys++EW9+a}KL6lvuUl-8@==|JJgN zbp(Hy+8&U4@ovle`T_W;%&3?==iNkIlDlM&$*w(p{?9&01ALP{klAgiCwAy54K=g) z0}DcdqZ`r-Uyp=cUcFLtPmUX*B-y6BVYl(3Vcae*vT}ycgNjYHA>J`hn~m4bqL2ef zr1NjM-B4Cszr3rJra~_@32M{*y?h)!HBbCk&_|B^3)=K=Ithb{CiJ*O|OM7%{OE(+pRfw+$ z?@w!w&J4_7&Nu8vmzSI0S`wwRLQ>^O1TlSOz~c=ndK1<5B&I)bezy2IGTKcz+Ve_X zKlxfWD)?;I;eygO6f?7NsI82k)%0UOY~`7lkl?C?UhxDf&Drk*BGA(3|8J0E!@_$# zH>npd>nPXQ4#`c2^TOV=WLqXw9{~G{KA?Bo;Zo)*#_R4tlH$+Wzk(@VGv)Z#hB)K_ zSnxQq`HJiD<2npF+e@kNkOhw`z*9OPh`?KSsp`((I~dIfkj|t@-g)Z zmCXx7bgd%~FdfzW1B(6=J;!j zhJdfDI0%>}W-dIYX$J)X8^M~7$>*DHkCDAI}>hdH8VfV#)jPs`HiTY`>86c7QzDe-PSN zcS3P4-w0SA7e?01?)Bm|WPAqOePfh+_pA>%=WIiAIY{o_cNJ#*Rt2w-!}P=n;WCo| z4om|eYb{Ui;xqPO^16-?QJ!f?X+2F_jl&;75tU)t!!dwk$?GJjufbG6G#@Tb(}-%) zpxG{V9(Z_SjBly}@F$9aI7E2W*KOSXt2zE}e^~*&#wnw95@ao?<=#Nm2}RG>HM z3DG_hXWDHJi$(1IAZjs_;5ltEl`);DwFg!V$Fdp<yw2@U$zuEJ-H31G4V`(*~x0y~2P z1TONJz4?>PN_iO6 z``Q3Y4zY2y#5U%oH+lziRqS-TB`_py=#yCBIEveaCZy9e8I#HZVT!hG_ zU>Lpv>OjICTvMH`yJ8Mdjr0bbu&s#0Zq1kG6xy#zjwpE zZ*1Mc-t_GH+W!^g-(*Cqe?>`V9sKU@)}xFO+mRAw<5q`cz>?N2O%U_`kOAiR?c-8` zRF$s>=wu4eZ#E2BOm7FiBRSav;?nColyz1O=Yak_!Aw|Z?nipUJsjAw0~iICGOgE6 zLbjgMt+xe}W?$aHwt8lKX$f#!YqMun2eK0<2)z4n4oQ0P<<1b(BKZYMo=l9bJUV<6 z^RV~&fcGe4wPJl;X*dtm8=`zAPzpVS?wQC+lMK|0BE3G=QeH3~HZPD5h(9p_$f`v* zi8uYY9jyun=v03JYY}d>!zI73paAg_496(T=mW{RHpmE&%v=U`dnbt09N0BhK&ZDN z^dML^ExAk>&L8tx6XA)jK5;flC&lHV$r{L2&d;CqXOlZza*(%LE}nurNj?t1Y!uSc3{I`#Ae?Y*mQrbn`4d0~xBV&jo72(Zj?w^lr zeWtO!MxGtTjG!Yx@^6~xqJ1gL;yRs^%XnJ_qGaY6`-$zXfXMCvZlM*W9w<;6B{jsq zcorl^Qe7Bqf^Lz`5_REEQ`WvRM*uyU#|;JP{!Y5t z?Rf!Nxec2Ob_|hza4tVHCIDL5@+hMiaQMYCbwYC+3q%;;SE5my!IsRYvKP;r)~Ybg z!Hp=ef1}pO!KAQM$lVbWr7NPdf&Db%@(11AhuYeRh5EgqL{P2a)Tq$Kz%CPNV&sC? z@mgEQ@}u7-;b!Dh7F%gY#$5&ZE3TET=#05jzM>55<-+Z%tP z(ijYugFB;hzzq(c2X{yrTe#kV>nzHH4*_vGS%yKE z4YaAvK&N^;Ei9RLfuy0~xMy5<)5u4TGycl(7V*{a+s;KF{kV8H(ScBb{8 zNpp)+>-FP>iC}2u!nLS8e zM!0Imzj_v_42}x!dx&Au;rVDz$D2f}-zw1W`V}>~>3_C1l%4Ii{h|j<%)2YC+`vp< zB010TI@>;IJ!JV&1Vfd0glvsjFl@0d)g}6C$G%SR@Dq!U(4O+`$#=5R=BYY)1bzWgXsL3h&71g^Z zT@$&(7+!*`nc)L9HZyjb6TxSVwbZny2Z>U=sytv->RPoY>2Bb=MIA^2!yW3WL~(Oj zwN~-k33;ZpN%3PZ7*UN>6>JhwP4426pwFonCCWJl%IPLXJn~c9jg%)enI9owTm} zaMJWOhyFAhQJq!TqHN>V-y|9!Wys%#0vUgZ*!By>zwqkpWS$y+UZ^)e@I45JPJt>X z+94Uzc&%4edVk$4r+b{p_^PTlb_~&F%j7`+#7U_!+WTl@d9_G5ZCqPYVYeyF%@$dm zh9?P#g5llOJF&Uy#gtadu}7D8H%(0D?%B!Csb~KF{C1yXIFb(8{a~6 zV{zt2hBAHm%-6J$>b^DQjvCH2hHU30NLi@kvnL_)lY{It3bmyLSa(3+rD{xr=PjB^$uc-?D%Y1gHg)OR8uv=dc}n3JPRv+n z^`VZZjoX|wO7@;)hzBQGa;)AGoI$AEC_=|SmL*PSYmjZ&Axu80CbC##r0wJV~=v%42GYXK!m7>bS@XFJ> zBMC=!)Y#`|p_uZ$KehKxNLLDl2Hx4PJ{97vHN@Q#ahPr?)jn=21s{vfZf3%|9#q)9 z#O|d9C>IfYR&ZQ(m{!CYt^$6c)U;G7)4vSh8K zGF&A7pPE~%(J*%S?e=ooXx^Xd97hFVHHRvo*xC)AJ+=AL{gQDjo4js+6}2Fp zBCAfz<=vSxTs*k(NX6;TPo7Zb(yBnECfgu7D(ckaU736+6!JB0r$iEdJ>YJpkPFI= zB-pec8xgHcL`HE7xFh*JpBBspdq_a!LGfsjZa7$xIJAuU@#t>YEsBGL^ zPO1DO-%WA~G$5r6bjQ7j`S|m}Z;9ck`WSv=^1oCauaJCTgg_*1_-mw~9@58lTJ$}j zb$ju@&gxDle0F5!ZmeXa{9r!6l=c;B-0pritMlv7%?*L2``vQ+$}EeLy_84yPAJXD z?9Udb0m}A402*6xz5v~1*r+?Q+~nmDsqsY`^HDp%<_g=t&*TxU%cEIbN1oKv3apzm zb_jYgnV_uhZ6rE!9yX<0)xah%c$Y0UxypusMRi&gS&G}Z{DE17Ja2lZKTpu3&rYNE zOVnVq1SG=$I*j~00Ax13ung&lNwnb#8hv*iW}NhI6_tQT{!|gQF=y^2-EjEC!_m_b zPH1hh$@84cOVXrrdYoXi5QusIn&a$w)|Laa1uxJZ@wg{j4cl9WE6Q!+Q7Hr2ygIzu ze;4Lze{w-n%|@@QxESg8A}lrwYa0p_>RS(I$0fg%42xDjs;_fotU76QE$C~)-^JB5 z3>uLA9XBq(+nUmqurG;fN^mxn{5GgC;uX37+&B{Q5Pbue_FZh004SV>o5UL&o)SFk zVy3hk8qtI@oQQb-sn@+`Hxk?umdD_WNA+Dvj;!+c`=@(&MQ5oTHTZvY zt>$|?t|@&x+EbIpHk<`jV^?XxjQW0{a^R2Ra^7?}LqlW|FD+?W>uZmZZI@(drRLUH zz1?flOVrjMEU~mIZ=XO(t?K3}F|FI}c@X2po(SjDz;iOx-Z_Bu6Z zS;%--TvSnyU&N#YD{!Bbm%5=_zLIT91+;LZsrc;UIkz3FN$JWLJXvHp&`(Z3;=X?c z3Ts9%c9CT7ZOR+Rq?+;%5dLlD()>{Blib<-SI@S+aV#Vmzq6DZqaBR1CQ3H{DXyd6 zVuCMBHxLD|paTLf1_|j8zB&Emwsd@?Q)=te?RYL8&d8`$bC%0~%X$4_KvzOFp9j`?uTuO%oK~B6=&T=*zWtMJ#>`s_ z!+0YS?a@`Wu(5SxW>dSV0A5Sm-^$Z^4U@IhH|FbM;UpL#rc!m=M{(HaW9#5~ak{|3 z@JsWw=<2Kif5DDS56@eL(COCB|JB?YyT=}__hj=RnY%C%QAU8mNJ;MUV{*Jv3wuk% zXS!v)5VccqL}*t{wmvE-&+s7{F-W#nrMqd0e%If{Sm#`hJSN(sNi7G`g*YGY5}#Nz zNuKIRvW6~GTEydKbqXff{m*WXj|>CsdF)L%9a96y^;*w z=8to)!Xvc@FuqzgtJUAR`_~O<)+_oUwAJNd?t$RpB7Xa+4=y#rAvJdWf@DKY@%w2N z6Do^V7q-oXA6rn2>haL39*dBTdNVsXQ>b$TZSWr-s}y_Ua>D|AN$$^UHUNrp z&6X0*p`gF&o4Dna+_K)t4r{!dR%)Kz&*7-IX@*m{93k7el6$gmJkaInH3lx=lZeFI z>D$x)uL|E%#j^!Zv9CCD_J;KsOAgjv)5Z0}`pK%F7`XIJcnOen=$y8b$}+lRBspBh z{>ZZTn}4ECybgTDu$8w~1!Uit4uAiV_Y+X2QEn@z7tinRhl8oNYEV~z%DrTmBa4o` z^`s3h>Yxxwe_!?VHC4B`N*GJCx$ju?@4EDR-{E(*h5rH!+EUqbnu!|dD`ed9!k4?y z;llPWT`gR$edKF}l6?UpcO>VnwNB+ENa(5p%TommuZI_pvkYLhCmyXSu zOu;^|AKv6{4el{$|GGVeYa3TEp#@hal<(L1wuz^{&w~0H^ce%GO+*H*aku$Uo4A4d zuxqW}dC8Hi%F=i7G>^w2BdB+u#<1a2U_Ji%k~p*EY2Cf7u3!;0=p_cL=aA$3sWy2U zpuq+3RELJ(DB~V%Olu99{iP0zn%2_Nl%#lLn7<__%9328;+Qt6|HGE9y!NEP#wfZC zC4Ls(NFn}YFp2rKfhs8GeKhsLUJ{DQKFG3_9KF_+0m zxXqK{XvweAB#@0ZY-Vj_NukZ1VamMg7WunO2P*p?F{@qdvN|$YjA;H9 zV;XNjZ&OcI2jk`eQmFSfV6wc^yaWUTD1H;`zUM8Nkoyx@Q6m?*Dzp(e&S0EhSq&2& zs_Pl1xn|(8S-c$ZPQal`^HwkWL%&IEkl?6I?iTeQ8};$a8yVEtUoX&Ywf9d-5x$cR zbkoS%hnijJ)=D>BL+lH~bG^b}><>{}eCR$l+S=S?Xib0Z#|4uzzRYR_0mJ+M$|`$W z-S=s-4Z5K3S@I0lxE)bwNjfP8)#}LjQyhx)EV*w8{P0uKEt_<=qW-GqhJp6uB7`U9 zvj;F5>$u*DsHXy)mZf(esU1EOGIQ9PECyIzp>-UqH{ROcVVJGz>|&|C(%x|6XnOOI zb2Fa<*Y-|QbAxWY7HL~oB7XsF?~j;nPo-{DUl#!t*c+}GRo1$R_`Q?HcdoIsTA6nZ zGiP$69AgJ^T&vtvg)jJ73spy|KbVfc6SDWtjK8&27th*LqK4CDKoA&5H$YDS4_%4( zN)zky)2(46y?7fUN0_qqRMOt~22+XGnuqQOK%J}(y!NWx5>vaJpo3%{ zA43_Gf!&XlO>tTRhe^lpwTz0Neh2G;V?;_vdWvgCi`Hx7_KtIdm#M>!gm|CV_YSIs zPGLiTg3rm)fnL&Kjl6Y_>fy=bvS4CT6|KT556N}w%ofjDnn|6s4~N0j82V>rxo6?_ z#iP)AK0SWaV8PzkvM#ZvClg5`3#8eiSE6q?kDsikcNr#T`8m?c*{h@ZgQx=xdxe^4 zN;tUU2C=E>qhy4p^wA`Onr{pq6Sr~QUPS#80)q3?#{}1dRH>}cwC~;x8zV&-CtocLH zX46}-`CR3-UGv+?n2eH-Hb%n--}lRkZD_Gf=oUE#n$=w@rHgx1mu$HYU>r5V$6^+p z>$Ot;r=aya>0x4;MDqFtzAXHX(Adm+-v_)u?NaQgkCz|b)Pj-02fgcbWZz8Q+VF6= zkeSNshiEU}Y#$#+)o?lOROHwjN!!xO+XNeD-B&q%F=qfb5Xk3)P7(DC`~6y^wHvyO z*}_aUemGD(8l9~=PI=wOrp#cdJwUhAm&dZs)G_&@??+VXsJMd3)EnsNlsEN+ifit% zUDYniI&t~3#)Isvb7$~}7NuzJ)_XfogZ}5Dx5Y5%xE!zGT^NFINpos?(Cd>K^#$pX zc7bWsH}H_(AeMqwx=YII5(wQ6DPtX{5kb`dj?8-fh8w0#LCK)8269SMEwmk)H*BbC+oi%ij|Sf(mBxvYA*i^)=iQ}%X8gPf(T@$u>F zNAAag&m}GghP(a7`j1KSL>p1~6UOn&pAzt$XvV8#9Y;qhtvPtIjP zO)Zif6fPz~8~3j4v2rU{_?(5Es@rUoX55D4Vud3&c0a5Ash%{=4^f$PzD!;O!QIU2 zF>z~L)Nb)nXFqas?^`;9au`E5X{0_$aJ!hXLS_F1OVifs!mRS9gJE8ZThTU9Q!s`} zHL5=lMFWHNtIxI0icX0xUP$;>L>yuaJDgWZwx)GWpwzInQ|`Zkf3TUO`E|<~wT=b9 z1spyLaYo83A^LL~^6(?ExkLt+$DP!gtHP5Hj?Nm<4yHZmTa)zVHx9{l5<$j?rN{o!0Q8Pwk*E>X}i{6x_SzaH&~NM}=| z7o8LWkdSIQueAn^0PV%e^I@O{Z~l!vP|Kp8zfAJ6McjzU+&isn;J+R>9^0`J+f|-b zQFpu>q%pcP++_QCD<>Nh;tBhl)!3JZ?ZTZoSzMZbg3 zae#%1_1(CUe`NNg@8@bgn-91Su1=_ zsVnf;@QJZ1QgF8LT-I*aihO5uaFDd3UG3g$(187@eDy_bnq%fbEoYL6t0Gwj;de1g{9k2*pcON;Tp{!UR5pxLfpZfE5tZ2KVZjnHpI=xU_xt- z*$;G;_hlB+wfTb_7#Ed>$vw3<6|O!G5*>8nQt+NlEZ-uSTs5e`Pm!;}kCA_YHs?xy z)9rRPnTO1Qzd(?<_rM#wNA~*`Ej)1bl zU+7$P@giP0BkTB)aH{$@XK57~XkN1N$V4TmDR|ieGvVE;@$Dg}Qe~o{3ptW(t8n~e z*9RyiyR}l>NC8WFd@1SSIyX(nJ&EAiI{%PJ2uLMjsR}$C>if>o`tO;p!^RSrtN5`U ziK>A7rhpd9+K3{o`TOHp|BuIIv+cFh!s&KsQAa4S6T#OG5WaSloBT~C=`O7*mU&G` z=244ZhUnI{ez|z^ZQtKa!l@YXllOnkNLMa+Q-Ehf#ye%n!8mNsC2d4ZhUX1WjWY#p zt5lvx?=d6HY*Sej^mRGHTSZ^JaxWMc+{KeMw_7(JYk?W5KNIiJEn*%SPZx4i8$%>= z*+2P>&WnHCqf?8@OIrGS9+u8i!Y%t|xZY?aF&AGON}6q|qVTn0(w+lW>HD@4?9fe} z8)d###sAwRdzQf5JKG~GUgZ1AqfHa#@pt^|Oubamd;`1#Asdiy%8XO217qBEImhfD zbD6-$zk1P8Zya}GqjH4SaKSmzO@9&QbE>-e7e%El{`)I{N(LlTq^IG!{{?dgZ{oRU z5<|e19t|>Tss+%k>!OmFKfo-@ zeHxLiX4F}Dk)d{O*JMyjM6;;`LwOQy+CP3iD7rOHLgxTCy#B$A!Pjxp0=J;$ORqjH zV*g*)0Vy4U^=U3jmZ-nI{Bf6zM(i-TrfpgM)|LB5D_q;`c=zs$vRie&4(VeDjQ}9a zKD!!^ne-AxFPaTi(@ecJHZM2j^1~bJ@71MSMe=8$v`b75XHj}Zi(doA41a5Xy06Ya zws`$?!UydZe2l+4)WqI=^ttga^sU`D3bortWx>5dDx@5}HH@;x_aWe2;}jOvd4@(d z04>$-#%1^C1pluIZ*8%8`sCfa!BBIfwmDmAAu@z{L~fePokee+%W>Kdv?eb8(jcRk z8ppwCt9a7IT1Qvz6XJdIsbSIW-E5k1jhBWd6|@>2>H78!KS;^|qSn2H%q?)vPy6vz z|7BDC0sg7}`x|aQ0(drbC!Ki`-z?u05Q0o=gco_KPnMeAn6Bkqd)nE6znS@%;k2$y zqnQuc$vtal)nBW`{4!4opRJ9y0M9{?d>(Z{V>v z_&r=d^!|4GeTaeiH$Et?>EE_vUF+R(ZevYI6s<^b+PEohxNrQb#L-Gs%F=0 zPWd!rM6o}wJBm{N$`ETrLClSmI}%j=_D~n6YUKHjXowsx+oG>oG7u8*U0N=;(?wK{c_Bc}JaYkA~*%FYZ!!>OT?EvZSiT-nu!e?}#1J0bt8l_RlZ#N$k&(S2Rz|=;|Mh~qIK6M2AohPg+)*obrORmW# zXMo z*#*Hc&ssvX`EN%fns_%S%Ar;%ce~?mro3hnSGo5`=>AkU+go~lrT^;6N{)ExS%q@S z*Nk>U2;FxYS3J*)ck5F{Eu>9QCauc%)3&aC19u6OK7V}A!aDQ-8_>A|UVkC9Sa;H# zZZ&4l=@_1%jDFXywgO}lCDvVsU>9volNV*zpU6hC>+wnC++~$%avvlfe$tZjjzu+P zqh^a{;96>k1r9jtcY;6bcXfs2V0^Agd7qN>m@4~ab{Cbffn_AeJIk+gpkumhKb{}6 zFDyHmEFntcR(D*FG&D#7*?CR_e#5=R<{hNX93~#54Uz;8~wS_y}65nuQ z1M^JO@9C&1$dnTUr7t^*OsC5sYE)KjAhWjc+Y0-^0>-4_?mjIDzWRHlZ`<^?{X(ht z`UFi}rCNT$Lz@9#F~{mUXQ=jx|KP)nT5Sg)ehOyuZ=KQ4XL~;&n zT0Dzg>Za`W8MjY)UHUm?{*+&a zKqbevfZhIwb8JSci&;56bHH`JYQ9cFSSXK;TDa)&?w|*UBaa==g??Sb;PgHCcLhjA zOD^UGbl33BCta2&Lg7an&^k3iC)somh>HpEczQMZ1>1kM`jP?b|@*3@uY5rCH(7< zsCuQD%=zw#l^l~caXX%Ys8F7tihdtk+lhk}H>D4Gxjf2uY{dEI4w_BWCAt)u;!b;N zO58}H&CGtw)%ro;PD0=6&=+7Zv`A_l)-Z|?fItU#m<~;7&-TQ&pmdy$N8gHgF?KYq zEk19=k`!XrzxlDK&Q;}?WwPnHs;=D1?WK6Dt++)frvOh(I((9N`dmG?t3l(^oq>BS zZ^=-(wOqalPMBgiC-yVhc;k%Q9js`<=ObsS#3Y;dCUw;`i>VGXkpBq^Z;fH=Df#*S zy4|J>+B?x^(se}|zVlRE6~yT>?(1WzINN~o%?NGn?ibI?OZUTKKRD&XyFTQ&zLHS& zn)qa$7I*41RlOHqq~2k=F&lF<8!6fc2l{Adco*#w_fJJo)BrgG{;?awpimWc68bcr zD1{-oWou3B3yoFcQ(xV;P82rX7&M;zv$g-`?f|($DtNp%J5w;;;F&F!2USj!oymBO^|aK0`Aa3S)W`8#}~df;5?HIFaM5wYEU-~cpP=F zghtr^sc!TaB-b-4|f@SHXD>d%%ZD0QsJ$NA(4XW>6^I?ThTD^_cl4P8Nam#YF zec6&tV?_|d2{Ac1ZArcc{qOs^hsGWLhYQb}$Y>hX7n!n5Lz|B=-m!`KnaurKmfYv3 zWec-Z;7rtx{F!aegcX^xx+>YpG~Y&GDE?1u&}@i=)~9_t^1-90>A*=(E` z-Nb0a;n}zn8fMiL^6!Efq7C`4&q)(x`}>juQJ>y?`cM>~sdQT~*Tiro+U~rUu1s2E z4T7wVS+e5&5Nrt(_bIqYqJPxa+`T5rHk0Htpvu(^a3j7#xG-sD}@N8GK9H(9Bz^gEN8x9(1ze(F~o;0b-Sl}T`|#5VBzxo#c4J4&cfUV)L{i=Af%eERX#_&1E?Cl1=CdnXvwf^c`kOTB zR>di;f6Bs^_saM}`E_P zw2xYNL=AIQ+Fr4i8v*nZUUrP1d%R0hsQ!~%>2E}8#t?5p_xBe7dvkP9h$ki0Rp5P* zy>O%=4C~Kb{fqZGd|%VZxM+wxfubd78qmDfhok&-$fZQrB-e?2&uZuve+0U7bM_gq zrq{Q3yDr4C_4oj;aExqtqS^2b(I%NsqI)jXuIS8Kvy_vp-$`T}DrS-_>W^MV?814( zkx5IR{Gi4$)_x0|_$z>~aEg_Wwc=B#h~NkKKv#oc2$RbZ={cKhUb!iAA5acDi4iDD zS>g@eCFZ{r*K2(hOL19F(c&3ezE<4sE{a&XQolVqtVgw){xKyO9ob)J61N4!pc!gf zn*vmz&1nEsk$+YT6LP9d)%VJ*BKQSl9jtg^+Sa3$bUT|+%axJU*rYgzS-bUBhv(;| zoN{LMz3ASAdsZ8gGrqVjN(^Am)`cofC*_)b*Yc(K63lPQ$wk|h3($kmTR1c9GGpAq zaok|DI_>z$qBfL#D+zl|cgp$&B#FGUa%{cZlpfCk~r80o;2O zTF9&snbsup`*F`GV)_|)1Vmu398(BA<}mCHuc`;Gt+48OmE~Nld%tCp<>l6QGb{m5a3mhWTko_L=(DbgHgN57HPGS@IxJ$8O{*`2xTRfb)_fdsmA zqB)ZX@Vipa6veFigKes~wey~D;UlQj;KEwh%>JkON9^;M*t)C4&+oCr-D1D4o>L%Q z*FizAu6Ae2*;{}%K=P3}?{}yzQ{?GER3BVg?vW}~x(#j~D@1k%Ib?B|WrTNZrn-rHLgCP#Ht5ooq*0C|gQB@_8}2>_MNMu5jOETyw9a|DX5sNy484eh z!RQM9L?)t8V*_5_eEc7`3a%kjuW3e?Rc^-GT~QAwr7} z_rjBQVVtatryofLkNR%Rm4iGQj*t=tkQgC=PEHXJ#@<%l#*_YjPCm7z?Br;;<22WZ zn@Bcd$q&HOyqIN)q7-00x4Lf?fb57w9>xSR3r6;(>Yr;F@B1fxg%K%pyGrr*@Q(3Q z=ohFei)WFG>}TD!lSg6PP&sVyk=A4K8U;p$Pawu}1N&j~qn1nC$mKeDezR!SdHKsD zQXS%Q>D$5Qp>wCTI?ZcI!=4TEZs-lIY1X&_>HhT!zRSuv+Lvabr@U%!7u3-(APk6D z$2{!vwUei_iAyV^=IcK!|5Nj0&7Klk$fw52;!CFGf+@1X*`f(h9Y zJC*>v(z(m{S32*3wh#P!1D+kdfvYT$=puTcuzQEr75G#e^_YEx84hUg5!}d(BfqSv zuxbEbXhFAcc(hX&UneP4Df(H?I6MRC(5F(pyuV!%(YEOmK z;`g(6o*AyR8D?_2Ba*PUs6P9JU}ePq`$Qj?)MdfcaEets;rTiUR6wbTqmZz(HFt+1+OlQQ)__MUzaQcCPeaX^;=skkv&dmS1_%8>) zFVJ`*>DE)5u>ZRFc>rZ0%W)GX2!{ZmAEohVGZG!JL>Z`>0^}>q3wpKpgz&mLa7)m{ zXfIj^n??0cE~t*T-s;Wi?n1EexWS`d&XVu8v|cWQ@L}?E&)132I#zWG*Vk=eGIDS$ zZf1vs>Lrs)%(KvY&rd&)uK}>Eu>JeAR*TjZs7@kIRLBQ~oB55?Mlm0KWPY)m@39)R z&C@d-E}7H%epmQ5NRV^<$hu8SXpz5RiOL4<0-WM-ExI;@q@nKMvwhAq7G+jR4r+g) zaxJ6sW>Gv}G4lb?$cNX zizZ|xsj*XJJN$9WgA??*B3R=knrC=SPJA>Nn4LAxgU=(Fq{J8fYom@gaPpq8N(XVe ztmaL7TUyq)FBtA2lbk+(yR3nrLk#4pq+4h!sPuh|i_Bb16IW%=dopWL;kBHg@Lk#I zlSNj zCI40zD3-l9%zfTnx_GNn2~shdSVr_04?1=g8xz^NV7|Nax#fM948@gFin**w*TaZ2 z6f^h9jnkh%i_j-%&KnDodHri-opt*&K;e7~#RtK3-W+=TLUx$*1`SeRP!UP4s=O&I ztrI40szOfYK5KvmbdR%a75Hxb1wiYRGj0OVF68U9Zm7wfu!`rrR$t0o{1S1(`;qWl zD;hA_*PkJJz3Qr@f>pmjRi}i=L7&^0W>jaI8QA7lE&2voBF#9zYUWX7tS~%!2reUr z(kcEGxYVH7OY7(Ksq#zn8V+)f@l6_AP9J%*9Gia?vXb5yaY`Zd`um4aP}xEYn?v=H z!iB%u0NBH4azJ8YmF6m|wL@IWncKZlOqXfZQ zB$E-&R9di?uC*8aN_!}Us}g0Vu;}O>5y*#P3?Z4Jg)z~(?1cj+jRO)vO1(Ki|8)zvas|2!>>FE^ z>wfF+lj}N73w+JjHQQL6F3KqMz}9A5zK0TbA}n1Q5vI}d6qbEY8QNATtyUf|XlyG< zwI@Ek`stlHWY>!jHml1$UrHxMW^h(U6dJB(W_1p z6EQF?3hi%}*s03qc_agQ&zNznd(PU2QtYYmUNP( z3O@Yt9Z&@;n5u9U^;ku*2(JoyUr8X%>FNJxVqC=JpjB_JiB)S|nQ?u8)T(v7rq zcS(1rq%69->&&(HcAxkEzxNwwoT0<9bjVr{ljoW9p7*@(>%yxhF&V9Xgmhc7@Ng_PING&OC1-(2nt23lVs1xaL@2bI`&T2LTr7hA#@d7Cn% zZOb#ks6sWDVV>jM9QZK_ccc@a%r01Wy9w}ZB)UJ=`9LuZ{j9qswcBVJ(@*5v!;^#1 z#39q@)8Fk=t(ujxxz$`X8A&~3c#VnLw7Y0;wSwQNfv4|)Ty*51!iA}MD!#p&(G#m^ zPYlhO3qRu(skJQu`RTOmx~OV0G~9shNyGV=)8Wq2S1+axT>TDQ7;E)3L*76-?sYn; z-rw7e7mRF9dqS@G9LM+`&Oh;A+j*9}?~ptnWspu@($P(d##Px0tv3cKJ+TMfkepM* z1Fs;$5p?F;)LH8wbG0ykr|i#I?jviTgIusXkhZ~0($jE%W4#)Sy2D|%Y6*RtQlPZ` zMsiuh1NyK@1~rXO7|f@+z8GkY5bx-XHl&o85ql$7i1|b6k(D-x>N5 z#vtt?6kC6U=rtZKml?cXLvUE2K5+s4Ylm{v7vf}1qD1J~2cI_dzp>+_@LW!#txC%m zO{FDmIpLq4ghIpYbF2zK-X1oB^y3OLOIf{*km|~;q-#D_wtXryRS_AsRWFg`=Cd1x z7vI5OcfnXgJd$*e`Oqm z2eDN;#`2E_Gx#wrO^r02Ndnjdtat`_To&r0d6#Ab2wvU(J!wpVNh92Z>ui^Iuu_~O zXMTAuK8XC_K(s3R{G3An(7bH647Ml?k8JoOk!I7Ej+iB|iH=>GtN%(qJhl1C$wM;9 z0M1BEV>lGxI0x|CM1OX;1sjKb*Mw%DxB{}JTsVcwk4*6l?;quj3fVR(v9@n9Y&G&hoB^p&)qG`V*G zs1m0^IpR&RH$JO{=qKOcy|r#y*v~_i15E@9w{n|udMBd>;Gu&_aGUDNBZWH{?HOYu^L7l5o~Hey3+-Ff9zU73FoaK|85BG%z9`68f>b`e72dW} zVxp*HT2e_l5@58&cMwVLnxQ-(T*j zgUa|1$D}z(zjUB1ppU%8I6G;za4|VeJ)Sqc>3mhZcsYAdQ1v?2fcO5xZt7KctC+FI z-*`8qy|$N^T>RDA$>dG5lU7TuwyqkUoIf!x!dwilmkL5&G!|)2Eq#^Xg+^kxFm8|@ z>~s2jvUj@Apr#iXbBh^h6q6Mib@;WWG6M^bmV&-PDpf|{V-v`Qs$5erX08ewxw9;U zvuFoa-pfnpkIA~Z>gbBE2f5JSzr-QX2x~3=9PhV{rGVPZmfH(l=)-GNtEFb#x#Qf}g2WyZ7)lQyT=Y{c^~s_u6EC zeg@gRMZ9ZtifW6nvmjd(n)#r4RDsv$J~X(rgMNaRYGu^!ongfg$>_#Ec*X5CDf!9} z>sowTWuA*%YTm^^v|?GXGL;$eOliZ=u`#p`oZ6GNz~(BvV(90Cmm1I&Yr<{TUs(AX z`ku4CY|;7jdKMcC_snT$q}=@=Mc*upDaz4@-thLtMUQieL~BlDO1;hE(2+Zf^O5JhB28M>~OLvEA2 zF47X>6~T16l2gL?QVp4>lO?aPHn*f#jNpoVvfO06XDU=C%Wi98m{(HFTp%$4fDh{w zCgd|pJPCB$-8=Yy6JE8u=l*U=HANJ&0iT&9i*Ku!eQjpfHN-yi8HN?mb4UP>S&@ua8&WH z(mIuUEwcbrE(-`fGd;(;?T)dozD-a0I*kGlsIK?3EPzP&cM`l3!oRZqITe#(0BBw^ z$0?^e)6RmI>ywIKHl~TsS2w5|T|FLl5CjRYyTj3iY?ePDK@f3LUCIuIS{wwXm+9tO zQerMGvB{O16NWxcmlByhy6#ry`M(GA%SYaKsFoF$R5D)lD=5;AvD?S#Oj0dgdd$*n(oZ>SA8}I7!J16r3fy-*$%pirJrXtXU-OO7gE>FFUYY1 z|J`^R@3ID`wC0Mj!+n;6sp+u4)mGJS2DNOKPZw|>?2nM#_<9@FSNo=@2Iq+ItXj0^ zO=8+@&LCG-9Cp{Sl3M&PY#95R052kfipOr3qxYIQaN!MND=*R!aXDHaN1g3P_)BF5 zfvDQf@1&4GkHVsE8-<+50HD~n4HTFI2{&>+zrd9H9#Nt`*-$3IS8V<^A=2rX_?WML zt&>&Ib-=VBKNc|ghNnnVp4V-w$$uQKuwGS7wc-k>$J!qIC@|2=8*%67Kf%U4nF%p1kR>N9FUu?O!A?@^ol2ARwPPwI#2_xxy=BXn#X z7cFC}vlNytb3lmuWLHx$%s9WRALrpHVoufu;ou~ZK(ue0JN3K+>k5mprOP&rY!12j0ND3wlD%eYE>WxK` zM*|W^d4VqeG6KEOb@fF6nl{WQM>?DJa}edHK6|kLODB+iw(3brll6f9b3)3bcvqhS z|BKM&JoY`-a06+}(U2VRs+X%N+;QqzMjdjm&i36U6TXu*t` zE#oUE`AZFqMW942W`&!c8=C~lm^Z}O@bpBCr1Vz5CxU7>LUNCJUc`n zNFXcAdOddbHig}Sm(2gO5JH@B>&RdHMmR6|?dZ!d7}V#@4-uRvUS|L{BqW|46XIOY z)b6Wu9owe5$87&=?B!ra*8OvYIJTrmOD{Yq9{@{be#wMuP{q?t5sD{*pTB)fey`pd zx-kI~0URXL`Vaa+M~g;I2EOG(iVp)zH*#6Z18{^BX+eiL={R#q@8<<;Q7@X&JLy^`8fEiMkd05PQ z1*pZ_(G&0^&wkK_|B6M*2w7Pb-TgD5A4~0bOG^8{g@1QXsiUJ1UQ57v;{Z)XIb@4m z4*)F&paGoqTn+|0RLmwo!%a`1KApR@UA;1TNaD$^b@Q@EN4w}XLuUhdpbum~U2wWYpCi9dSSzXURm-W2P z>&ki8;7xV}__b1WOMpD71&EfnFIy?G-XSu`hpF8E5ybNCZ4>n7@pO_sz*{!{0$BIs zS8(-X1{wTbdp10Z1}*~?BoeZ|h%kcuCKbx>hI{iElr_N9)dkl97yyj7)ZxT>k=5Nf8}7lRc_Q+pNWY*hs=_58uN`0fvPkNAJ$4E%E^u}S@o+mP(n*Tqc;U84`xVc7n~JUz+NuaS_4 zk?wY>>EY?B_*u(E%f;^zQeErmPw?wIO5_5GbEUC?#q5vZiyagCJh493e?Rj7dLatt z9lDn0|JRWG2Kit1R?ie5Tv{%xBNWyiwPnMDxK0_9~oA1A5w_~|0Vt1 zV!CyLI6fiN{=5FjCR_9W@_8TN;C~$w-haI`;_v}@7PjvFXUNIK--`H>fBVEl#`rJt zevJG6e3dCN7xupzssHp^82toSZ1yv%Gyfko&|7u*AQpD9s{dIjh!AMDjfhUV9Kfmn%e(eztKey>;)erjTa)#F7m-DIp zArkr1*wXh~0-W!9%kSo|{UFNHuC?1Tkl{NSTX(JD0qYtw2JikCW58)!`>s{3Fu|%$U0c+Oh~ey&M`6*3gHK?n9)LYo>73psqNJg>XEMKrzXpZ zl02JpNO{glj=&WP3z4U@|nt$`t`lh zgskhmH3pp|JAIqPs$=gJ=Six5+M0~cn*Az}F36aS#IE_>q|hHTikINVzHM|{FC3E< z)(CUzpD;Vpn-AYpihTLdz~RlViGBSVOALsi+y&e!o%Gtw zMn^V(M5{HbPz7{wCXjjfFmxrFB4(Pava=SbDrb_bhy8S(3}RV=D#HpxxebNOv?rrH zp{B4F(v*0!N6`JRft&ICrm;2-D;Vh}o~AVDs4T*ICVSU?h`oKUcNCRVGRewLt68c3 z+q3N9BMW98A5CAn`~R$XV6H}G$qVxpkp*R+AorMqE!hC%qXxiupCuXyTfqawP#sM? z7r0EZ20(k0#Nm>$LPuOw`uJl8<m$^~iw)FFHaVU8{dIJ9zznF8Y5@ z@%K=S!0c%9m-piDyGR^9S-+MdA6C#1d`UM!4AkKa9+{FcAOQ4^cL@&qq7hHfO9?)z z42Osy!Gt|(yCf?2Y@3-yL>j)XWr?#SU%vgGipnC^e?ENNcx&n#28^6T;jzB8@Vjwt zc;RHAWVOHwP3kO!9*lOKiB`}5wdnu-*C(;?X}bC_*6yDl?GIXTsfyn){FA|LuG7Z% zbRUa`sxRGJinQW*O-NVa694s5*~bQ@m!CS~;cKKZ&9JO6Jg5@Rd9@mW&;p*0$7MOk zI6&1R9eeQ4YW!yy{#knM!AG#45*S?kvnqXmfIv`2b_5`YZ-jjwGi$ovRKx*3K4iiH zn4wre84feRd=|cArF8Cj-E|E_B7H!|)DNHk0l#f$#Oa_N?*&>MpsptYG-IGYqe_Sk zK&#tI^1o>6+A4yc(3XK`NvSuF-{Y7cn83bLRV%66eJX?R1;GOrljU}GIt}S|YxAHA zgIlA@07rnpZyh+XcMr>4FRaVP6(Mn8?(fd8R6S$~4=1JjH4j*xTF~Oe1He8rz&sm- zp0ci;0euBC5L6_p7-vTHEJ7TrVr)6?1InhL^gfQyDZb!AfLK($}y$&5HCeG%%9(r zH!a!ucwPI07@Y3O>z}4OwgVW7mcS${3{rJAF`aPj__)ot&PXI9OSl#+ZwXX!Hm{rj zZ%WNCQ1_SD{$*<&L)-!QBU!=T><8%KbH%?voDTF|6Amybogdmho(8jHW!mB>y8gEresnjJ4AxLYf_gYHMK4cm|*J z_N?hH4)|QADzt;-@Ue&Y-lMP#TgowvvF`HG5Vkn%&GRv*qy`E@l~)<&ZWdmxe#0u0 z?p^Jmt8pz0bJ)AkUSN2`=*~A-&!O$HVNl?>GnSsjWeXPEl}h%~FD|=*HLG(6Xnjho zxCxo;XbBFc<}u#8W|bTBS)i|pnx2JJTEnQe($W}xx;$N_I74gK*)r=nzg6l*D?4q1 zn~MXJm4FQ%BL^dtZIbuwLaoeErFpwp24XWZSQq3Soj2znUJWxjBj`P>q_()d|L zLIrn4Y4q7@g5kRXwk7EK@JZ&v^zAq*iM#dQFZPQm>au?PnL-Zr^a?KPya5Br89W%n z{2gqvseI?sVDPpuD@1r8Yv{H9}>-_Sl*x;;&GPxG35#5x0iR z;0CcNm-fj@`c#aa5~xdWS%dMGiUr9=lfjKUlW}UC*_IaT%&EO{Ht1P*>mBW!dANIG zIc@!Y_uZg~vw6Q<=H2gZR)M-L0Xx8h&`XdaO$BsN_5+@)in+>4*!n9_`xL}Fzyz$VpN-!qNlbJ4 zVA_Q8ozgtj1Ka0TX$AyjSergP-he}ZiAdXW)H_3n`@z&}c?6UlswwtYU4wwVL%Jg7@)la`#e*OK zgHbfV>y>$dxzhUATji-NX~Gx`zj?Tjn%a45rpj_z%${t>3%SDm?shdTkRg0@_!I=- ztngLGHYn*sgAkcBfUU(7T2!ZYH4(jii!_X_hTC*-2sgVt&72Whesmhjdni8a#Kn2N z-`X#5dw@YbA7L}KY5m=Ttj+VSJkP%GPz9KnF3YhM(hAAxf_RW)$SGy4#rJ?pH4wT!avkCJTaW?Fup^+c zasEmKP-d%u?`{thJ@}3|hFO?aIMfN-1yf`LJX8xrC_Xq8MsNUCR-IpKZ|`SWVc8p* zjW`KidE8UwSw50=zl?BN^u{~hFd|)&0gkRY=JT|awi$E=oj%vioa{7aR?CJ-U-msz z!t-n{U0&YhFyY(_-rrvy_JM7|w%6=IAm&+`fOH}!GqhU`hz$xE-(nIvI8C!}q8ke) z5;;`OS_cwZk~_ZRsRNdl7mSz(Bz9wRGG-)6A9)U#HPzo&T=|Mo8{p~*{j?eSx>PV^ z0IhgK7VmUhZI`tEPSbS)l`_=DH7(8@F#;q{W%5)7wM%}V5BXBZxJxyzp zRx~w#RL@fuucR_^`NLiMO{nUD>Z~BsWy`@l{k&P~&sKcAWkXn08Gf*E4WHx?r!L|jlRsSc+hRBk2ab40W_H_%NJWkS0GSx`NoTynmqQo`~17{O%n6t zFyF=}A*^C%!`-}}+orRmC1<)LM{nE~=85}%F@Cf}Yfv=S_qkcPG+?8h9xY74*%#ua z){SVizpkWBxI%|Wrl9V|@Vr}ne#c+A)M?=md~(Qb=liKoA*G*vH2<@!1MLSQSL;Eo zc{e-;C;j-1yGvU}JY>CvEBA&pEli0Ny)7I8^nI@5IKz+~xt+$enO3pv0?X4Hhs55Z zkcUef(pN>sGBd_FZqsl3YFf?Hlh#YtTV#>EX#?HAhgDco#Pjat-n6IGk&>Ptdf7OG zj@(73|F%nlZzpwWy7XxOO?h-leJ?>}0imGg5iniEfo=B;${3l**Dr`Ic-3|jDxEiWecA zE$tXqa~*`1+jLkRh;h~IV56oagDlj1n(9j;R9=`&9(DypW3W^500>B-f;JKtHT-jr zijT@fIC!~}(3?xH#b?(ZaD=$A)(LtGwQ}E>XCEEZ&MC!d^|{hyINlhcNCXWj5gijq zf>&CQ+CAs0IZJ*c?P5vcGz#SSXrhF{I|9c2ZW-+EO#x;DVg=GV_q0FH2mjy^?^NvE@ z0hA9(drdz^-ACP!`S|BU4BL|{kkb~0ag6oPyX@^;M_wW=CYEa!ze{=e@R)1)3A#BF zQTxVifc<^6YMO_q!xN955Ipmq1A+f+iP!jw7~fkO-`eXPOZTmO>@;&25z!&w!c7H4 zG@{6rk|fwBg919`cCU76V}&kikQfnpj8@v}^Tfst8P{qNru*`e{4zEuu8T4Mi7;hS z_WaU`DxSH9qfceabN%+%Kzgsn;wd!2nxHj`Hxmc-*N44@d`m=|=sP6Q)K;Y7w`g*! z3wO5;#B@qCKKe>Qqw-al{xE#EOK_NDXiI|9ju@xIg*~Y?j(bMpC4AS+sX5~*E>+Bq9)Q6_OjY)YO%bJMIccL+CsjW@a~M&G=xZSDv(^z-_MFuTW*_jR%8&35 z+b9qyGPJ+#rXX+epF;EO!9C??KkHn1^q}!VGCE#0f ztH%rcOg6m<>u%oMiHJXB#yCX6nkbwoC8g7b^6GmdKc%SD&CeY0Aie(G7VM(hYblv; z=+}}Vb$2~Cy?O@0gPh;ay}(XnlU{y!&}u@IuO5T;2{s=0 zb~V%%8f7+7=mN;e{R}6Y1@3V_R(8L%Q71$fzuKQ$coUcNxu=dlo&?%_?pk^S;lQ*H zcxdSN(p!|nRL-WCZKk@nm72k?$AdFlZK$s60cbp0#h$3$*cg;9F}HSl#^Lo-XKp`Z zr#AN1rKno=J;~CHb#G#}<;ELf^9PSb!%!wTeKfC|57+f*rM}L59*>ejnrR|C+|enR z-7SG4844b`Psq~~wa8TFYtMa5JeK=B;wd%PQ3o+Cs#6gp&F26kn2P<=SkM5sN%adJ zp5CTum!_rZVsRCYg1aSsdrNMiUj+H`4Q%^KCb9+X4e<`jZLznvq}gx^IlfmQnhj}b zv|^~6Yj~ZHRcfesP3$DRtxkzV@0wI_sf zkNMh?K80PN5i;iIw~%W>el^xD<`xv-^t7)E&opYOC?UjQE}vF!=KUb{Tsob2{j#z+ zp1UI?5T?Pct!_vzA7Yo(Dj*VJ)QPVkPPz_@5 zLYiQ>$EF$e9P8V%ar*R@$kx&@rL z>SZm(G>HQkt2y#`Q>s{*3F#C}tNAe7#{5sh9EMS*ij=C)d@Fvc6nl!)s1-lRUFV+m zvQKrcprFI+2tcWDsIn9-Lp0T9;7(~TVkpAN7PZpqL`_d~y#?{`>sp^mEm6l|JK9II zwG1owglWC#l$kAUiEUhI9|yKfuQaBcPV{KnYWR8}@p4RMhP`OYw9o&-6wr%`mgh97 zFUDVhIFja!pk$18Q0aXjQRso4tlzfys}ps2*3RtUaYToThgvi03pD$hV~V{l>S_KF zVb|&QtGtS8)ku<-v|tGhHebh!g04ZnqK)$+pz@+It8bDd^$V5emUYB^hJ^mKBj6$0 z#AUu(K;`QZjYaZMFxP=zgC`{ecYAZn;P%Zzu0C?nmuRXeZX zmEiMj>vg$n$?g5poiCPYoR8d?scRKY3@e)4vAk!xR|&2B>rA?i*9m&24`73VJtxB% z-oq!-mglOTH9Ir8^@>xf_&jB?NG%lnZGkMIO7#YerSD5p&UNbAgEhs7R`1$$3)Qn5 z`n~O4D<^rT9Jj+qIYhY`QG%q5w&bx?2N zdh??t=t44mYpMkIAg!M0X5A|d;Ih>|S>7Ni^<(`;*+{8-U@EW-KAr6qWw(K7@M)BD9Kaw(&*=IvUR*}w8>dT(rq_thdpC7D#f!W=sbJ! zJ0=N`##eNe=AwxfdxlS5?;efZ4Na6oHtrz9kFb_g9Qc}y(iN(JbYS1$u2kD4*^R=xLsT=874jDi1-vqP{FQOt5mmUv8^VIK3k zGp8%n5+mgU8;L011D=(TZz`Ql{o7NN`n9@KeQ9cL%;s`$(3=NA9+|#2+4l3^elGX) z{ z8uT)R%sL{GFVB4vD{ApCS}_XSB)G!%;5t|tF^H)&BdQ^Nz`L~qyTSE(+@J4AShn@B zR#Qn+``eQICdgioqr*gVB2cgc5UKYK>90g5ms;eBWv6dInFfD=tncs*j@_b-BS}Pk zGT8io!&5(_S=j#7PP*2fUVg&)kc*TQ1X<<4!*&^Th=n&Vp?W}n89qoA9H+9`z+dj9 zd2!6O7{pB^&{%uE3G~5!)k53!=xL5Q4yFZ%F$^y=e~ zidDkQY{WR#k41>B+-5abfa8E^?9Y@nC;9?SGVnx88#@hWjhiU6 zhX*0{6sMj;k6?T$qtHUP^!Lkj&^wNj_e43~M%H}gIOI=yu<)Lx($NSUdN;X4KhkXq zCsNRORm<}rV^gWACBD8TBf=3-EzkD0>rzs?=d+(Jz`=#;671_+p+}(ZtNf|}Z9HWl z54U-vUWkU>T;qfbX9RaZ74v$U<0y^SMW%G| zruu9qVs7IpIx|bp!vV}bW9l1OG!}C7(+W*u8SqmS#i#!{3Zjc$a^zz!KNdOuWqJnd z2zx)%6gQ=lhcEos(qgjT>3bTf5;io zN-`!h-{?%Rr=v1m@qZo_qf!KdJTe6(nl^*tQ{+Y5e2xIe zeULJroTmu1wi=E=o(H|&<&qM3E28Lauw->b6&alE(&ledk5)XUXm62d11T^|d#B%N zN7#!5>BVTHJD2t9iycg_geNuCUkp=JfDSyK*sNt*N>A)}Ka^7HK&84`^3tU6NiJft z{l;$BWbn_Tk)R%S8Ep)IMQYgWa%CNa#6-xtJPgyNO$-X^YE z#-v7%j#m~R2NWAs!EEO`JBbgz?ttZvI0{j_P2%sBQ8nyWm8B*g2ErUab9EcxbQUpd z*_ex)(NXGQkJIAgtyq4fz}z2@Yh%H5Y7ioJytBvX0e#cNX@wk2Pj5*LR+`&(e%-Pef1ufr>1#8Hz zCSSRpMu)MDLtD{KjuSQtg+-53@?l*YS*5F?nTv`)B##_yKBPMIu69GmC3Tw=ovPe( zYj3G^B+5H2JF_4Zpd$$wZK-Y8eNLMlSgBJYkKl1|*<9i$L7v>dq_y!htvg{pS+4D_ z@GKYlCH2Vp=gp$+fLlqAXOiD*MnzavHNN7S5(M@&^OMy`vXG7p{oDLV@4j;VN7U8z zZjv_W6(~E@lxETVPpj5nOKGz`-C>5RUxHpzilB04ubRbz=Ypx~iXeUl54*r!_fv*V z{_a%i^UKU*hse=24N`TgrxTuU&DEc^yfbcXWqoJx{I2}xo1D;Y$0)_HoU4fi zP1;JcE!sQZp7?!%dHPC=oSP*LPv=(Bj>lHDeCy8Nwx$A*H3C0ZP^p!x)4!b5E=j4f zq%fPe_b%oa%$lvTN(%W?8Us{$|M{CN4jjRCyE^{qW*7e{{GAy*x12L3c?GEb@oco0 z*n<5Fx2IJU6cio)fypBKiV~o?I_{(foX(H>yF(8GHAP}dL<%CwHQ3$gpdUJo6C)R@ zK2~{6wy=~OXC1vTerZl603;c^)xzOFDx+Kl^;T^t_(y}v1?a6u*Mv_l0ghYLRSq3F zhs<>x#_LZVs0p9&>-JmF)SWRuP;oU}*J^O9f~7^h%O76~^4n`gm}%6`ySCGMUL^_F z**G=6Exi|gE0`bYAa5D*c2P@0ejxMLJSa77{L!!mgm!A2pcI(GqmmJ7-Yp+UN-l)X zm4iWlZ(^nM>2LDv(V+?cOpLb9mphu^8~^>zDTM!W{e%4c5kBjQ^`zCy17=pqzcP;W z<=n3l-EadJpGbZ~!!E`{!m3MTtnk*tW3ZfQTn?91Q_buMRJZ@tegP)B3>Q#thO=S^ zPb~8SPpd{=#eT{}oKgYKyQ>({FsE#sS$~?B{kXk0re`BcHfURFH9}J>Xrxc|d_+S1 zAPCyU9k|vM=x8X%u8Uw_+Z;9MkBQbIkuoYIT!W70CU4<~9zm2}(_DlbYpkvAx?$vx z_LwSI9zuT_xt~f;Hfy7g~EZMzlYUo;*-ATk@2mBQBUhhWYyOG@9{^^uUy= z@aVgq-DmZRlR#IrrqXo&WxKJ5*?ch@yXPL%VvLrE866mlbD%>iWS9~qtyzCyP-6=s1QQm4OR z`4pxn!z-nD`uy5VtJK4-;-giSJbnQczlhARqgAoMF|rP{8u<&)-^fm$_qx}@WV_26 zlRp-LQ%U+ZQAHyT%=~tB)u!5d)x<|wl!q~TanC@TQ*xv*BVY1I^zJ;r?Q&pnE7G|SCaZXze3^T6v z+n1beD%b0oofTvXj;7Gc4@wGuSOBSRv%bH?99*fCw`Waf5K#OA zOw|;u^jfbfF!HQFEBoN~cAMN`K4`vNE-J_r!@}}Gh_fn*2|Uhrr|6P8{Hovj%^o09 z4%cib4n4HG*9MgGmuoA_v)Ti#)h(~4GE=`9`h~R_YZK?AUnVM-kLC+s6%)mDXscMO z_$b3XtBv7dx;Vd;MvTN7PV^gL8MM;*D|?S40LRg+=WAQ~qA$=rm|3JacenYKjMX&m z=#;*nYwTrt%7;dgFsC+wreIzBPRK%inhdzju-0>A4aM9bn<$>`dAw;u<3fgb6wS)PHCl znEV`WZK1`H>~xGTZzPtDMNPts92>-WqcHW}&tgJadcH?KpBb_q&%E~OLHkAt^QK|y zPA#M&6_-@w@|5y_s55x~;iG5%niciZMiibTfH3}>b8^szH3VOvaVl5EsIL#Qcaqxw)nV3~Gq4HV&UF20yOI@hDnk60Ge8|) zramY1A#PdZ^9Hsa1<_?QsBDr8W9h|@9IK2N=>@<(7#AH@!<6b%$;*gi?GtGPI%Rpn z-qy{+rp`Iqws@=i8U!W!1Oohm;mZKON0reHz66)$q_nP)*H2VP`58{kJ7wzV2jt%+ za|zX2OS_DTL>zwz_-$OyP;FG`HiSV?o>Xi3r~@AQKEA zUp0~6PcFZbSJWJI(tbZ?Foe_=wYet&27k#N8xNNZIf_Lmq1?8?tF#tN{|E*C4GaET9Gp(35N+Z;M7c{AjU@*$M`ihDG3(v- zaXMvCD629*T2Dp3Gr~aAi;Lgl=`H9E4La9GF|URPxoqal@+08|%Xth4apAt&tv;eF z{KrGWE9DM^hlH>9z?mIU`;%z$>>J~)C^qu0$T#Ftyt~waN$b>rP!%TW525dK0Y&wB z7f+(pU5-&$tkm-{lATuLrd@X3kp1-^JML6W=C<36e^L^i6b67PP7wrXxF(%1gG|gF zI2DNkku9kD%8=w?s08!l5WY1yxfMHj>!{STLd<$JQD@O>H@C``fN6Mu{Z#LLO1BA6 z0Kbo}bOXgeqB{zq55vXG?D)YO@7#fIvrrhk?*Aln>|+~v=SD--u;h(9pMOZp&_w2@26cfCS@mB z)^;G={b47)Z{Vb$P+N+Gmd?=BJI;9I|3v^fV#fhiL#6IH>NA~_=t+HR$hS9(2ZT>^A+ zK8dFe>80pICK!P31xDbkZ!Hg@E}M_%mwL|(2Uc|=n9Q;YpTj!~{wZ?)&lhjuMOp@i z9hiS+vt{^fmgQFsnAgHI$AEB&FkIpYq3FMDbR`LC)= zV^mdnmpMMpTQ-(RI;gImN2~;4`P%m zF2tq$Xurcu*@b}ZPdH&AY%!5XCuK%&f4g44QQN6cg?_>l1MHKfiJ*~6;9g3FuKW# zA*}6o<8RAwy=-=#x%>H|Z<>wM^eO1S!x`TJ-B?P`Qi!_T9-hR%3(Il;@fnmIh`))e z1os;nRBadG9p>!Y<#hVKjkYz2yUq^gnkX64H*K}Vs`J#^p597*ZViFlOQP$ zo(YCEG31r6Ww-SX##ME;1R>YH2TpY7(W!Ksl1$xG+CJ4W+B5Su>HnXBAtqYD&vnoe z6dKL!^8wz{I9vgcA{Ci!aMc?MH8}zHH$8Ew%sdG%Hsz;EJmxuv;82h5r+gA8G9~#V zb@!VSG-E_NWLh1{Vu)@q8|w7PV&p3YRB+-5Y1;+P^T_4d)55ylfI{NWKkv_9zg^Ed zN*6Ub0S7eA&!z{D1_d<3GQCS4pTbEcQL-XdD%TI><(&Y*5?T#)9K6W>at0xCs#0>7K{;`guU0fo)*JHZr054m{? z%ZTPH;0!jPMW{S4Ms{*VOj$W&3?@I8qb%8GhfG`%(fG<-w$Qr+6M0+jmvx&1==;Q_ z??pdY1GaU!w{eT%9a32CFOtt=Rb(0_MHBEWQqBF!&N0CAy&Of=(u`&I!+jK9wU3${y)L3!)vV|n6W0DnDEKQNg zx8faE4nu_>&#_Y4LaX_&EadLPvfjWb&r_IsRbN%vy*PO& zY4^EU2$?p_`pHZf2=jkRv`}25X$}N?L8=Qy6|2#k6Wg8)XXDz2l$y(Ux$S?gE{7-I z(~3vzL2x`ssR7@4jd`f~id#(AXBOsjyCp@>Po8|`ERE)pT^KQ*z!QAg*0^p{)p+D~ z-;;;4ycy4&4+T@PU_9lh-DA1=g9JAbNMYat*o2A2jlR?fhsC;ZcA^|jsUeF^^l1mA}$tg zO_R<5+dk*5g0+$G3%r(k0FW^NTlvp3U|-ZLs=H>DWja|no^}nY6Lj)L1$4c6J5(8h z3L*DnODOo@-DVEx2ax7;`_L zt7dib#k-ZUauP!-CrnbgK-1n_N#uQ`M&}9`FT6`oM7!WaKfKXgIW>*PuwAhO^9u656jKV zU1)_uV4|)+sK>a7ruT!Mvj*W@5`fDEZN_Ch0-(=P7ctI)RQHz;p#^@0ZlcJohWm{j z2LpsQYnOY#u;%P$ao8VT`HMw2{DiyE_m|~T$f{W0ipJiioWbF2=C?a``h>XX{)9Lu z0fx|lIU8{Yn-P2U*@L`=J`R^BM0o0D8vXC-ppRhnvN4Qd+HmYZ7`XsEGO zaUCzBtS-D*i$$kpY)2-+121uqmO(Ee_xn&gQRQvRU>qt=$-!*#1A1 zy#-j5Th~6WfGFaCihzKWg-S|Fqaa-pLzi@S$A~B(NEm=4B~rpLbPXwjfYJ>^N#`*1 z(ERtP=l$OIe7@iR{H}9dUciB8_OtieYp=cTd)ip5&3L~iVBC&D5}KVibi|ivHhzKwRa@FoyU~G z?1puCY7s`4kB2lznId=K4zl$fTw&xW@wBG^3?1+=5%jw{9+aWe)z#E+?P5T{1ALK} z>-D9!$8(;yC}Edm;MS!Ep_1Cuj2P*W7ve@k=S1At1>N*m33yqJwjaKgNgy(M%cwlJ z3y5jG&>7t=Zb8{)cCk$0?AU@D1YtqD7La(Hk<)1Dl2 z_>;P#TbB53lKR5fF;F!DEHzYlQ*zm>g#s7Etwez)4yUPe_rf;P{jnyt@Tq{(LNDiG zwL|~zgmeoGtJd2E!{IUId<>a#Bh~UgdhRE^Z%eB$nevBGrF`V8*G)S+xa3D0tpT{G zs79h`8QdFp_F=*BI5?x7(a7%-B%ziU`?VFWIo_@#Pn%T$#k{!WIE{RzyC~7Sr}U&V zl-Js@07v4yI^KBnM(o)}b!D!Zn3yS{?->7wWPLT?^Wys>!ednjTOyvxaObYDg1u5t z%l9=MO3sFUQ=E-WcjvbGS%=y6lWJZ#c@I;5x!TcOd2gCxigD%nWuyOssyrc*KmUY@ z0%~RKZQY(A_}qJARuI9yO=x@)mf!d+{iX>Y2`pbXNL;)7i6-@KP&&nKkU9C`+`!Xy zw!f|w5|TGMFSDCHUg@rd!Tj#C?-fm^5wMAVnWWCG+l%vf?7j?A$bFfl`3@w<&{Z`z zv9>@;MM|9-NfCVQ1gXu}w~vk*UK@)jv&n^X<&RK#zNX8ZG`8DlV zh=e<6-9Wv!ku^UMTCFjl1YpO;T;>48aZVFGD&i3zn;QbCSD(&@r`+J0}{u5%Qtl&hJCFtSpGuM>p7b`Dv3 z{9JW1jy=cpqhqFfzTz3%=NB3D-qP7$f)dS$umy+p^xrDz6=Z{li4Q%#?P`yNe)%Xe zd7A1B@_ebTs9smR9*5zVdHYY~Z)qisySn03rcYt6bc8!y=0U#W`<^;YX?ioqJ-AWv z8GGiKZDrfFS~-peoiD}-RQ!3>+wZ~ok}q;+>eJ2}3@HCMxC~&}X)Wxu^)Pf^2MMVc zVp*ibK&F_x`=Oc`a;^kQ?VUG%->71FxBSoeQ~47Nn2houg|`dtuSyH6@{*s|l5cmyVRKrHgaMQh(7?&L6$HonxR#S@X z66)S#o@;aSX<^%4?aBc*Y9&sxiWAdG-vDd7>C!{-m72IEc*GRtpypX}1eRgl8l(5Emz}HC2uB30^cvg?J ze3g^x_H*V^I$cB_`tf6`+U5aC#`dtqcFPjC#gX*q^nL67LiW@2R5t#(8Za5%ivvN7 zP@QI}%E&Ux9m##RKAEZAPra9K?`}lE>RH%s6|#j@rM7)M>P#|!c`-a=O@xI$RiuXh z#8QeF|7G!p!cPEAz+KYb+d`>fPMS2_;mFYp3!+rkW{SkAq=nr5GEllcf&=jAHAsQrT%rrijI&lEsnlTWK2Td|IPRXq<_&k;zI0oOtE~G zRBVIuRX0PUo>-1lS@~sclkmWjyR090K@nqQ&V!5>0=HFO=TNE(+QMWB``Jtc&-as= z@QH?p>xD?7^FOe}b{oraD(zk%>pwlUD@Vbv5WtG@1f)ZBSSHrFrm*K-C-fF#aJdShf42U4O-+c`-G)R^k)=#|>RSp!%nd7&RHbMjks zLbi1L+b9dpJ}XDAwv}M31jPIAv(D^mDl2-QOBmHcQFsQ-nxCx#=l7glFh^d?emRc_^h-vrE`tVlS2~J8 z6kT%cFj|4y{=nWXFZPH`d;Z~mPQ)5rnT59Ufz|reBA*bd44e&8DXJZ5hkl(piFtsq zrZqt>`3gwL(KGi=t z%}wWNThwL4I#Zg<9{`GIy3!tIM3iWt=Jqg3thO_};d&MjjjNpMbL@PTn|4^VB6`&n zN!hMaqh}_htB^d59PPL7dG`ENBd*54N@&ojQim0mUlrF__cW8zLYFjBp_QuCu=qx! zs#o%j?^WjQ=&}di*-IOr%2KAN-#O6h3EAe^qV1c_*XY6|+k^HqORGP3FZg&Q4B52t z!-o+KF&4tEb=;PBsr?_D3X{!Zn%w!MmE+4=tN0vhbW$Z1icF(CG9G>pcpVJc`#>2g zoL4SmSK+htLzE!NnBBXap2B&2e@NF}NiAOPO~7l$&7xx^U8|Y|hv63`+u=21-y$jH za!dDbF3wKfCQba>N$*>Xv=UanBarvIKKI{~THtF5$!qvxMa13NxZhCf;>o~9w&tAE zUUV8%lTTZTW4tY5iS8(VW&tH}X)4ihezwD3kKz?25W8>DlluAMpHpVPK1pH}UzxwM z^hEGC(>st@2H;u5TIQ53T&Liak}aWhCjnD|?*5I!GnCizhmWD!Y;-_GAS}HuRPMuV ze0}HbKK>SYf)bS{I1Jjd{n8&R`f2fkfOHO{cjtcZbyZ7zWirp^7KaHa={JbslH3Xf z=5^@4N49U!Wr~W6BQD6nW zB!6_^r0Y)y0zM292_6f{{eCAFd=P7J>;(Y=d_m_^d9w?5q@R3=3`;R@PhJ8RR}NpPv_WOQNa$ zr24imx=;Qz$_|CR9nfM4c^_q_gEpX<@T3v0>AB69j|bqo^21ba()2| zHu&fA5xwsELwfj+kNEjRUeFXnI@%lLvEqR~iwq?YNlO-$` z+7FlVStdA3yS38)Wpsg$ffZ40{J8M{GU^i~ytMacX>D^%GL+(>8mT;%?YssRZupzQ ztxIPufH)0*s&qschdWR%Xod5z2+flH^>~T9U;~AFuZI4YY5mvy{^u98B_JB+Q4ySZ z+n|fDKWzgQWNOnPPg}2E5&6r6ZSXrW_!-Ne0h<4O-oJk5{k=eG_T~|n7WTH#3)e0p zc0kbqA35l;@QM+P(`oguKg-5@2-=HDzd!81=oI|z|5{BF;Ro)%5BikEgA$T9h4sYqd3yD2izt4=v_QP~mbisA+H zT${9S(pv+qzP1++VY@9xjX}~)JsC=%fNU#P!Ev(T1zw_$11X9d>2brL`PQk&;e58S zyPz>FK2>1_a;vtb;{m=!J<7tU)m!!JGc5+uMu&@9c=^Az9~MUkyBr6g=G+c+Mx5>* z0YYZ_B7GtoL_h6A;tl?oc!O}EdiVcg9v_GTrEfRmQ6?pzhmrcR1J2VVVU|Tt^y0i+ zBn?kvV$E73-8JV7m1yrF^EfzOXX*u=yGSAEvN{*fnp^&WY}5mYln8KEtv(&b4&)`{ zMG)Fvuq0_upFVv)g6uNaXS^<8#Wn!m-tn~GOGUdZPM-9>a?k05AgC0a(I|fYWFx9S>z&`wbd0{kp_t$$< z;JpAvwjI@9Uf^H$`G0-EM2UazXYPt;F3LpE&M=MmVykDLQ7GRcSO*l1?{ z)&Ok6A9BSdRCt?&TiAW^(j`;*1{IODX9`-8z&Jn3T!4LdulAo$326nF75c}t;$e(*1^sLyIBG$Kiv_6Ic@e3A0owMr>Osc()#Y>jQXvpJi}wPKN%K+Ezs^fq zPW%DsI9h1-9|z9AyySoRV)qQM{QX$~4p|VBGuSDEHlH%52)^LPVYQ*1k7Vf089<{i z&lR|3lCy$W+(k17yi_FM>;VOt(z}@9GJ(9By=*~%bYGibiDhVVnVtkZkvU^#3Me~X z(2mD#zVqtDwOE~|i*u8J?f~G-cwnDxc2#SQ7HgAViM{)v{G6Z%fGcQtSYe#M_o51* zCHF{L;?G+h?My`xLnU6-c<4q8; z#*6!KKjf){isV%V*3$GfG{ zQIFyIk?C)5uBBMHb+3RTljigr)>lQ@Xvi{=E?;ylfcD$SE*|idV56Xp4gky|Vk*h6 z*7s+@UR`GMoYV!Lg`RpX1jCwF^*9og345OH7h_R;_kq(j`KPb?K!QIZNHqDw|HYvC zH(Ngz_w^)jRPQ@>K41ysz8-e-LF0Pn+ncXZmuSM|vobXriRCk{e}CJo5&Ti=QA*t< z?##g1Oc9!kDGx4meVD9;DcI^+j=QdidWzu^I`(Q^wyOpLu>Ku_9mfG!N9HFd2+lD5 z?Vs~868fjP$9=J)6xtdjdTV!q5`%^I3J3vcnCN5`Z%1cIx-WJ9s1G4mq1yf&NEo0g zClI~6T2J0$8YN0qhy@yJZCtY+6X1kTb6e>4=zk^#G&(1>>NmCSQ8+NEhg?n;a?jTB z1v*0Co{>-_utzB_=1&6!yREq4rGZn=&r+_3T*nE>T096*6<;ZzdOh@1^XDMf?np54 z7-HE5p8sLge|rh=tuXL}J?NlU@q=r~ zJQ3KsQ_OtKz{6tB+DNDpo;{NX!Ct7WR#~4uKZ;xfdn-ex6+*c0_VTN%55um%>N3smo3BMWaJ4rT^4gVKqF5~^9hI=)rR2v1RQ(+B z^-?h6hMHr2(SJ1J>y)AU5*dc;iJoJ(DOi-xp?v7Y^g}L`v8yqu13ZfrS{(l^&M06( z>s@b3z5C9Fc}wi>63^A>1v0JNx-O(%*M0Kkdo62nPodII$`VbGe?89h|Wu#2;8A&il#Zn zykV+o z#;K*tKhLQJQBqq$spB{YzRz7y!uAQU%~_po%#{T4cY(qI+$NE>M!zX+ z;3YT8+*xS(Y|QRRqs?h9H20cxBQy~=!NFJ(0`cxU;?&On%;ri6ulQUY8J&2P2-Iof z&(RC@8qE-MyH6Bb_oRV<^Jq_&0^orZ1n^gG+L8F}TZ=dJ+9rMGe>BcCWhMs#_zn5D z(ZFxQ5d%!7>GClTuHRGyT^7+LJS|}R-T-S)u5%2;dtN|4_Ga9dgj_+F!j1#He*~VE ziZY3J04L;ujN3ab2psDyl&#?LcZwhSQJlY>W{tj3`?2LY^ft7=bwyGMe&&B{q`&!s@<@%D& zPp1`qnSh9!VoJ<4=6{_de{gC{=c^?~h`3X0r;8nT0TZJo7(zE)J{3tpU!fne*52x| zvuZ-YeF(T;Gn+jsaX?`$W6@3gU^R%wLO;Y}Kq8|Q_Ko z2M6&0n|8j0$I8fpkwL-ZuW8`<-G$}~C}73c!Qp%)bn}=nX6QXTH0k68!eP zntBi$mMxD}>z%!Hi-{${>A@AF+i}78_loWV)?1{Tu<_64I)@Ytc}rO8_}5@U@1G=q z-}O?Tzxa<_f*Asg#%^YA`j-JsD}uik+^FfY{r`96z|l90fM17Ow!FIV)9;7s1$vz` z1BR~^%N8I5CXRW(%9<98<2;t&xw6QkFiKVq_oco#it3*~{o|tkwJp+Az`E@n4AT8P zPXeD^3N4e!2)@fAF8=5Ug!Rv=lJ$8B&Rj2*7_0K0DIFfZ_+4?i=?OyS|2%)1Pk`~# zJZWbBy>PsNUZiFvk7|RW5ZP5oIUW-T}(hY^ficW`}a= zuKKz)#Bsl5(ysQD+s}_-syp@RL*fte6LC?04g25BEZPBl*uu@}6ThbRdXhxdDQ=mF z%MRJ5W1}_KOj;X!6Ht$dF6v4UMpHD3UZbtCnyWr-VVSDy?6K(T@M{4cfKQ-bth@5Z z#q7dcD>MxA`_%nR4d!UJlR2oh#C>V3r&bzopMg>rLSt|e*_15bDVp4Wg-3-FY|zd~ zbI!e=_V)K>kWd9PulmgUw*|=JH&B?A9sbv*F9&Lqn5iM}HHmP$UBa&nQ~RmMSx-F@ z)Lp&*N1)AeIOI9P|l-t9~3Cm;P;K|7XUc`N0}n zyP9(T8t+A2FjvdtM{T}hJc(@X-QES`IzFK%2!`&QXAKP3UXUprJEx34xPh;Gd1e)L z<(j}#hd(`d`W|?$;7V+l$*%_&8i5CIj|aW=>2x%qFOnM%R!~R3-2%?y$M5&PzBBcC z=GxDZ858a3&))xIB*tV9=B#J7(eSrT7K7bCSbKO#)z6=}JnRJbo?*mK=4-Gr9FNl( zUnTquGr(xClB}W@&hKG zA~T+qaw2Y?_Se^#fj9WIRt@`yvwOc6OZrL2jMdvg;-B07Z~p|Qfl{*UWiF#|1%BDz{`EEzOriuD&5BWm{mb$6fr^k3CEs21 zV}h1gR@MkQfwj3Fp+{xP_CuAPdEgEcmDHWBiTFgm1uppC`LqPq%V1M&0_jpOULT22 zz&Te7af;`BT|Nmu0>PTuqJm8Ft5%`?;H{+@z~$l!=|~hVV>2k#U!Utp*2!#HYl?{Z z{4i(pTGO~H$FHRdJa_(wt03Wd!JlXBZ>$d0UQJkwBkBDtl&&vTyc4-Qd+ z4Sy8QR7#Hjwy8(pUGDmrCODY8Gi|I+)T`w=(AU0B$9$h6B$iK=mSNRE&t!Suh=$W5 z2ZuetLDD@pF_vK(*Y}AT=xBc11iZl-gZBcqcR(U33NH%B?K$R$zo76ORtatq{dPEW zVh-qHxthI2*4;hW@f-K0npnJWrAW}%Fv>SY?RRbfozK|pxkQ$xE3S$@%5PTpYjzvy z0FOm{>Vx<&?NLWqEIlQxXtLs-%;Krwb2MyuK%KKWa_{slENs=Jxo|m2r*fMW&SM#A zH&mrlbA05xF_y|a3)tg292N7AQ5nvr-{J-G#+43(f)Dp`@w@Nij5vT?a7wLmREbmF z1DIHM!;pE4{F|FHtZ6Fm?>z#!kU2*~aQjBB>@6McPTz#)YBS?0wzYCKe!FS@A!HT- zVu-Xy`8zpeMOfo%+Ceq=k-pmKWPuvUJd+q^I*sP_1% z(r+JgGw-p^!!8?Sar19)Ar%`|Wq}>5UVle@UcbW4dOG6Bz_o?lK22dD_qGGIE!_b~ z6RYJL*S(vEdYs}eN}Y66e9~mi(!Hn1sZ*t0;qJ>N^-$b$vlbj-HaqJzzSs+p7c2uA zO0b9D<2bR7E(?#*OU&7V(zSeA(dgxsB9|U zXEQ96I!i6~tv%Quf@>19sq$%)vDmL%sZs}}4OZGb%lE&qy__8}@le2hEEaQI5OWqH zi+&>>*W*029QL<8`0G5V0I_*Sd^F*&;~?4#f4ChdSpv&VaTqmQoAf-_x{#UdkjYiA46ZzfrV%So@Kno#xa4<>@ z%~IJ919voT_wV6_;1;cJ4n?#zK4{66u<+10h&YAyT9lL)>A{VA=H=+4y7R3xTS+LA zC?U*8Ac1b!obOcXdI%hR_g)6w8x3~yfr90;W*&GT?$+CYK%-Qb9;%`$jN3 zG_|8ztQI$RN6_iV6AiJlLVdTjuP#8QFnD>XeV%K?C($TiD;)%wkJ|4|oy*cL__(0% zr0oD9$kC}rF9*ET(v%NTfWDzLEMM&D5Q_m48kZ4H{=?P2WjTh2DSiiCGHUBNMQQhg zf|(Dy_iNC?r3~VpNh2=pf^)KmdywlYNg@uON++1TMw#inc<^%Aev=Tn3in|s#a_3K z!JZMyWo8DzfRG{m{p^W+`>|5k!EWY|bQw}L<*89M=ZJgAmFaPs(UsaUp0c(0h;^ja z!{r7F()f)e*AMUMS`%sp1YkU$b6!8ru@QMVAILCm$t?GPifn_!hG1 zUj7y0*bLTdp6*W`w`hy^6_1N)?U(~9_aFgFhj}0-29vRU=~<6o8fTYch;=jzFqE z8aQkCkEGhw@fW8Vyi|e8olfm{bsU3ex+Vh39B*y4TH_lLI?$RkD2vf+%keWUGq615!(KmBXnYL^G$F-&G407Cm_ z1lmI^teHmmtLJcDSeZKGLW8`CQT!1pQEEWdl1FpFu;t}aOYT`X+?o9fkL@Y$Nw|Ys zUreFvoN~|Fex=(hetU;DbhzwUTZoq@qCkatQ#!oXm;%ovxP3;K6+Adl9cJhvR{ja zoA)N1`C~Bo?jpG6sFww`|2_$Lh|ZWDJ^P73=ZC!ZeNGFm^ z7LIZl6)Gw>Z-I8#lS&X1I;$J`2wuNs6_pYgY@w9LXChq5h8h4VHdfJKQZi{FX&VAK zwPr2XPZu=hNr^0zH zB~KHP`7~AJx;GS9AE2o?qOAuW`ha?deZ?m{UWS$aT%Q&V%ZMM@GvQPJ-DzulHxn#y zkeUh*0BbL9mA6$N^%8M2u8b-GQn>fLxx1h3c0x2)CS5a|>IaF!!{ocJ8E-iZ8Zj=4 z%1!d;xuJU(FiK~kDL@nIO|d&cXBUGE?53yp#5H@%ICfS`Z%S*vPh!5?dTJje?&J0Q zuj3)1YG|2Wkwr;XB%<#b--ym)j@m~}1J3GAwW5gqsNf{~=jb<8A2xv&uVeO_jd=&T z_<_Xwbi3&`5~S^Axom-EVg~o>m*=ErT_3M$E^m65QLX{Z-||jf#hko@?*4}ur&`>D z8S%s77T+i#rSCDEbEk5b!iX!cmH>$#!{W1JT1El4ecDN@vwcA}_|3yHt~FqAJe3Rk z3zdkm4e|-YBBXQzB_(WhUwd}BNJ+v#d`fIJ*q}eGVXui~F3~e!aDUoU?D-48BbMyX zJ^VhR&d08iAFXjz`&|vSe!Pp_UtunOpSNurgxf7}o+1{!IdE64R9{E^LVJTvfK#jml42?81XzG`+~QhJ?zKg|Pw33yhv3V#XgTg@&vJMBp^w0Did( z7}0RC>skiA5a^<10aEro4al5nFqC<1C;3$aZhk91XROwRkjTc`?xFGm)sTBN-Ypj1 zKCPE4<3-SUwbREqa#4=zWo~uK5hI!)3PFskATi0ppORe?_+*}9CtZj6@2d?1{%X^u zfUOBh6_TiZE|YzB+rFGP8}rcRAsiJKRjsd+OyU|o1<(T3dKICB z!m;=w`J@}3WA0kA&lN|d3CaDd_T9(4HIihT!HcG_al zCnK2JshJZAcmh{Ayha^h#qVcCac-rVe9X7~bHDqXyaTBN4%tcEIET*qgr?-}Qq+BF zgN(ZOhSiL*9}NfXLAyj|-0J(ri0aP4SBnK6$J&0sZ>#Tp(@ru#?1w!n1f;NZW4?h$ z%W0*fF0Qr($q0dQm+*rPoH%nwSJkd#cn$T!`G#xKA~UteL>;LoOS?>^6(+v0>>@^z z#gT7uvg0zYB!(0^{-wVhGV$(p5*fa2dr5CJ@w?Uw(7|4a zQ2?M>p&JHCS@3mByOS;FvEvyCy}2@qux!}ROMd9XXum%h-jQw@#c*U9WZ+;_@_s#< zCHOmyWr7JcTx)=nujA!P!h89~?KIkR0iO}K>CD^-+-lr%3|>9%kFoZ+|%E zaAP%Fv^=uSYdho3|9V)Uh!DOfYCkeq5I`NvZe&uku}fM-au}eMxlMWGDSMdo7-5*P zIR;!wYF0EH{e23pa%lR&aIE8Txg~VKHhl+Jv2WibW7klq{obZlE3Q10uHkc7!Y1kp zp}yN66Cx);y6WHJCMj0qpld6g&0Q;W;lp32IO+D;bL>Cu^Xpp}@+>hz8bpo{uDg0c z`q^}RHvNRAaR@+4=(lE)fZfLss}`eQk>PCPp>W!JPO7q8_k+&W2a8$@To8yBbX?J2 z=$SKtB|_ME*DoYc*30j+&A?`qe&Lug`5{-G6GCoM_zsMvdz;<|WuH5LRg(rOzgQC~M)8H8+urg+C`i`JC>oX5QXJHaJ)ic9O{ zvr0t!{kuuN)7!(?Re`P(slse!WOuXu^X+4)Z_=;sbp4nZL2XR;!Vu3;O&)}B6$m2- zC?mcb(ix^hO2v@%#WHH4hB!plsLD)EcD{8Kni({JA?6*e3~-M7@bGdD&c zrxFr<3R^(e+-qsLk0IOjkwnA>IF&wles+DmcwxKq?mjImHV|C(tQ>mrWQLiof!%nr z%lA}sD;DSX;k8%8NCcWQ13e&jE82*;fsQjvC|aHyjDaJR=&M=x!$6rjVX zmzM><+r1fEeJ>b_>j>vmj(v4adT=N|Z_jmS`{{G$Wb*nXKQ+SuLBD8rujpw4c%6OF z294&LR@Bm1)7$Jh5A2vEuLiAsk2u#E>X)84PeM2#6Di+4m$ARdlXCwtBnp_Zr8G`O z>4xd((bjz=?ETHj}Y4e<>lXzmsvc&A$EcJBPOyz)l?b_1| zIOZ~>e!&CK3sI~{R$Ru>#=q!T7s&=i2^g05rHaL|}UiLbM0KJhEFiL$|kgRkBo26JF64ZtM| zEKgIZqt*_|$H++@E~uhB&bU;nlxqn{eO#)?-~b+}P*1#dIEsYR_4eBO_aQuH_~|E$ zA8w>dW_I`-LU@*)xdty-%gz{&Z|+$7QeLz7or)NkDL6XB)8Bof}Io+)xJ1uPBu>h3O#)@U13M^B=?CjJS^8 z@*3rj&ZN3Q#if`JAl+8PVE~dg0?)oum)CK-$F&T#HJrE~w%YL= zS5rP+8bI{(H7v9a`f7-Nznn8dAW{qY`q zg(aRhXwdR_bSImYZtt)P=!&&=qW5SrnGg0?s+){5DN9Q}7MB)pb5?g0L+$lv{T&6} zcA}}tmY1|-de6K0W5w-t)BB;){@+L$&=~{$+wH<_bIr&7M;(6KLuV%|B7!fu8`;-& za2inM7M5^C^%e_d2C(GU`we3@?}0gp(?b`NkVp(~?a|sZsh7F47A{uVt3-JVnI-zR zW^q=t(UxBkKa!oXhm5o*3XHGV7!Hs6$N6n`$yn?aG%>`%M11w^)sig_6{C7TLd-Hs z*2~GX#68=uxcVHvg!S*&q>jhAodKqOtbbFI(5;lw-6h^ZM`d;dl(uBbl5^;c%-e*l=DU!9i&=*V@N*k5tp6A390=v}aWZ1E6E z#Jv?av!~!X%**yD#qX3bYe@Am-Co11lp=Q%uFbWl0@t_ZyJWHpP7(4Q-LE2{&qk9e ztN^cUG&qoJAQS9ONgbp_$Ou_vgal^X1X-;nmZZy9X{+ROQ4^WdrLL0Kg{F57%Ie8a z=hQO|GeyvI=ppV}bFrfNyXo5X>(%OvLy+Y(B9X&oPPnW0T5-bRanH^%BlQ31^&DM#Rl;t5LC*g(fc9I_Twq3R?T1S>Ct6zeF$+kYWS0PWJUq?5dy&) zsB?y8Aat`rMyS7NLEf5U@B%}V_ai08pYZegp)f%3wr}3AfP+ z0Y=bz#T~gHchQzNci7T3z71kB4dciR?1LK6NC zrl7k0Pc}f4R||5-n!I@&)$kX8agtz*QII6)$diphV%DxzFLs0+nFK=kD~7G--FMVg zyqV{+S03|Vf>|8*J77|^A%pz>d&SXMcMtE?KK~@QL|;XJST{}#7o~Eu_TIx{q5M*M zVUOm%h+OU-9}FwBh80wzdIX>5?$PxgK|b}5pynRvbazn-+7&3P`8IC0P&fl1DrT5i zKZ{HEoJ)>gxA-sY?>D6M8_a0{*#WpVE*|j^~@ zJM`Gd0?s2PeePgsF%dT(TYAbfr#6V$*m!z)v9&9re1O&=`A1=35b-ylS`c$RnkFmH z;qzCB5_;-)hJUy{7;+JH|Em=N+=mM}maeIW@eP9!I6hz{irmh&vmTU>haS+*Yc|I7 zSeC*)kGpJKr>dFYklUvS+4*PS{e1QU2D(9U}n;zv-G`cLy(SBuK+_ z*o5};2~J08EDQPHh+eSa`Xh}=ViKRoPw;Jv`JKo&A>bD=XLT|k z3@loZ5WG!viT#nqX>L9{w};4{EKpOV927J)G00ULgwNy&Xh{#z72Lj_j6HzZcD2NA4i7Go|QhaA_By zw8Y%yxmuNRvZQGbx4}w3Y+9Me@0H#%f;&j6_W8CoQ06AU*Q0x1o%NQDYrT&U*3i`{ zF}LGoSgnt~K=jaL#ZsClHpIPPe6w1iKBKfPVXGqRjNM#)warc~{tAJ}s9n!~%c|9$ zOfE372ZAfT+{&Xpr+B$TA9r)mg2^Hg>eVYBh1Rd_730auGF#s6Nx1hMW;ZV=df20G z*1(gf&*a+O@S;(*BWA>tPM|7pIH24of<{_oXP45?vCCe4xcDNb%6r3XIyCdZ*CFbH zU&hF)nF}yVY4rIl(O7?W?fef$1)6cFrsBX>d|pn-W8T=K%hdXLFZi?f*w{UK_2E`{ zQ7fZvIh2O7S5- z8cW^)7}IkBNwW7tfvp1LUiEYt1h{&Ozw%a%i7K2Bs3qiy15kveT{|W0U7-{V2&mP9vgi z2=k8}H5hv@Dg(fym!bE2jb~b9`(~fk7usmnnMR5BCxl33bRSU1W6(G3v35&Zmx`CRM5V?lmOEZ@ zL|tlT)69Nrb%twj#Mn^!G!0B}1bpB% zY99((j-`#&3z^3A-H>H-^Uos?vtT-pfH+Tb_fPJ_9|6#MLkzNw&Zrjv^n~&Do8EoK zNMbv1Wz^^t*FH0V$JX)vlXYf-#|`k7)dl4y8=G@FB;_cQ{E(Rm^J#4*GqcfDIb<84 zy4{(*1R%KEc!*N@y#;INY4Nhu!$^~;HzNq*ugO=0dh=Sdh7F;q!7mv^8^_x~exACy z*QSQ{bwmcUkdPIc|Ju!_kunEUo{*X%oP6se1lwQ+WXQ-l;Crr};%mfa8fpJytx+pW*b)Zb2+U zFLAHaTdr>VPd8s!pPc@7ey$^Gs7;Ojf+wQso z=eK+l6||j(e-2@iW9 zsx%QS>t-ZyB6S0>VR`3D>cbYfMrhGOv+qpJCZ3+^E}H9_&}a0@k1uveEPl|Fne2D< zYZ$eF35%!&xI`*|Df(osoi6*TlL?z9XXsvVSLO?I>BWA)mQh?ysp28ZHZ;mti>cQ7 zW>7XJzOT5jX0#q0=@|k&Tnk~W3iBIyf$Y>oxtMpU=Gqf+Bc&Q^XMxcXKjlR2TxGmJ zewvz1f4Ua7%X*X;3a(*ATDxVo1E-%>hCFNLed3izz0+lq%mpo z9ibgDS*D(t$FzS;J?!9_wzareR>@x+!ybHqM{6HUe~*U{F76dr(m0@x!If;a;gNlj z`Hs^pyj5NX;i)lGx}#1(ZrFh9`twH*^l?4%j-U}tI?XH&DKM_c-GHQPJ^&1(G-V9y z1A@3d&WdKz4UM>D&tonQ;403X@;-sPKR5pTkA#Kg7s|s$^rWmJ*@Cf8x4VcIa%t0E) z@F3GNB+JRYCrLn^Mxet*_xyTDxtZoeR9z6Uw`POI`w2G?hAu)h->cNDeJP`05t|!V zhb)MJkjf~gxSvwXDd}qC{f{)b1 zYe7zAX(TLhkLS2o{n|3e5n_MnLPwzDpTLcOTcV}#n* z{Sl$P(-%BK9BX!^b-iKv#>4M2lV2%tims#P0vOV6G}uOE<$crS_Q1lxq)3U6r&=#y zlIfZiF+BGBar#Uf)tZRuBwwLnr5SImuVl;}%|mbDl;QbO^hn3(v{>zO&FyNNbT#@T zVKvwK&bm%3C^0u|*F35hp(h|GP@>4#>tzm&)bIPHxoxrQCj$`VORD;gs>9DnHP zP5Bbzc@HU%=(8>XzyhGby?vu1_%)}6J99zyos^hqn3g^fyJf#lidd4$(!= zAzH(2LE=3QOho`t4u}yM4fs;j@$D4#736!A+1lfUe#|`M$p%*@^}KO&i|3hCS7IxA@)k3bWx~gF*Z}R0 zYdDQ>^&LnV9qx(JuJ78hUfHMLx>@`<8_Jxcl~)7m1X&EgEkdb-$3E(nK9f2^e@S&@ z+czTk5J;UoI!n!A=Sf{{lqgJ(oFC0K@I_S`2p5T^cW@pveN&v@{~Ba?19NkXk!}!6 z=iz!t1{+4&9~>FDb$vB-Uw8H>DaZ1`4Vcwcvg=EiRxu8hfK>JnF@>HD7;r_rKyR%8 z{Pq_BPIZI2TnR*N)t-2E8Y5N7T+I^5Ofd${R|Not6~s}NeKk&oX-{;Z6c2FqMPU4L zYG;A!_#;7PmAD|}kN7*!I%pnRZ}>${?G=d5V*d($|fg@beAA#_rmi?4(f z9py2*b1dK9b)_D*HL7^^A3V^bp6|@Sd7ZrCdD-dkc_sA0mHAWgysO2Q9SlW|*fDa2 z@TJ_1s8ou*mNkY^#&yZ~3dNusWyRLlKu?4?M6L+8T^a|>cKZtKo?~KEFYgI7?v;!g zfcTDXqBDKA7QgwAsn!kLqkJ%Ku$4qow?ilW&PkF(7oreSyzFx9Kf8zFpv^!neB$y-DaYzkc*LO->nR^LeU4|;c&>xlBitP;&nH-)vRxUqD zOkblH^3`3B_v8hEPxpRjWdxS9ATx#Ez5nb-baA$MvdmudP0r7@ zk{llUprY`7$|9XljHZ3~Y{k|)a`BO2#+s28L>?$zd2*6a=_}L|rCd3%0F5acUU1)9 z*vN-Nh`%oL7i`o1=J~9saA}+4`k11L3p_9*w?XifYOq|J0X(B-Fvd6SD5q@m&RI~c zB1csvYBc7LGdM06di5%>6(ktoI4xfS>0VdnWQkxfEh4)&ujhI zvPb0lP9ZF41B9%AQj^>|SGk{*+ZTo~a7sZj?gfYgWOB=|JTKm11{El5;h)TAKEGND^_lVJ2+ckp=JJvAXih&X+izXI$L2yH>qP&lf0b1wIj01*n@@aukH zK>N6Zdn+bzL_}+);gy87LYhXD?Z?JngybE^Ivu8-E~Jn^TmT z?k$eGqdBlyLDieWPr)?HFm;;MMv0vp!ip!RK73saci|}- z!~A2nBuPrS3$U%=3F(4k34L7_Jp)a9KY0so*2q3K0XVBzsu~tdWZOn)?sO z_Rn1=_E#^++g47VM`_oDTF_||qch-_J;^0Bw?7KpuUBo*)AgEtUM3*uk9%_l!0tnBlCO6F(0X=m1PmzuL<#9p zO#mS1^sIt!mf{UEdiFXjH*0qyp|Y~-x$CPlbpZ|U6ikg4KlKSLpvybP`X{=%MumGF zFOs;HZa=I>JbU7FIA0#O=8mnk`j3sG` z+fLV+r)mL&O=)t))WB1#+Er>{+U=Ry4VR3v5F~mPkHC5JhiEp(O|&}#)?)hox-hfRBZT`T=*-Ko!8 z)pdESX9V_yQU~e$8fk*bSr*#K@AwGD(Qjqv3kYp=&=_5uxn8(u97@O6Wu9EZ>-; z{U_xTZ-jC43eE3mDITDxjrVZA?(?bu&-8sQ472}t`D4I+5YU$&0pqquUuXsQ@xzLh zDY$#1^9@!xXiR}m*6G@Clp}rd`=Tzq`O_8x4Okt zJuKex(z7O8NGGFvJe&nuFJ~krOJ#twX*E^U_!?HGRqTIkNi^QQV(FH&I&>)MWmV>L z1hDAoA2s~OuM?@dCk$CN02;2UynBeoDi`=q`&xmU70$CkF*Frz*RzUQ&j?37M?()Q z$FUti%@yBW>bd8pWTN1OTLGI~n+{=Gx^Ei8Bd9i-C~mT5So@OMg#H%#AIWkQ!6NVR z49y+8`K}QIWzCU}ID6nne7G+k57(I#0toQnC8 zQR`m2A<`6snNmkB#)T@KAEhH6X%y(p;5$x>`)>`ty@td(KP%MJeSeU{`{ieq|Jxzoz~Li1t8WrsYAcDWqT zCp6&dr`*{1qRW?{3eaRmpr$%d>uL|Ah1Bf=^na=nh!7*Ga4&2WNJvl!sDq<-7TRJh zkRV$*kJZJ>N@nH<%hLxEo+2k`KXeotC?)@$dhx45BqirviEU`y3IoXr zV*q?H1WE9lEDL}Q8)iGhvJ3Q<4RT*S70{S0m|L)i7ekHuKT^kEC9W%_pV9rFI)a^`Be&hFBD#((5kh`6{-U_ zAjkF)s4_)OTGhxiSA7dla0}c=(m>zHg5_oFs$E5kiZAsKqv+N?>(}C6p(zGnXz{-G zz4Hg_aTPU{7->E@(J#Ud<1d3xeAr(!+otcz9Gq3L&nrp4*S{7E;Avqb(3kztOAvl_ z0nLMtNGXSLAPw~p$Xx7>E)N9)5Df1@+zK}sr%((42_cwcwtolypY|UTUZ=-0->-*} zQUL4yn}g;raQMHE(kl@|@Frof2L&DPMKYY0kkq74FC-v9j3E2=F;Lf%+%Qmph*Gd; zPSKqNf@@!c^YX^Qb6hY8h>qX)`u5FTdiK}75VT-Lv&)1p{E15VC=TQ&Ii_|1U&CC( zVmOD2L8BnD+Ht*ezBTB4#zIqd8EF=gU{xfeh|6k<7O9Pe?BhO=B97jXcq*mV=ZlW_ z_BtiEkx+Y-jREz{1SYIM7*HWtUt5?d@3UnX<=R{AZ^x+lwt#v?JqD+3d8~75q>wuR}oUM}n zmRB7J>MVjx7aZ7PNH1^~D{m7Eb+ncs(`o-V0oeOCV8;IB%00CLavZ<1ZQ5Xi^{RXR zCTafrw1xVj*?CgfH{e1pB;hkYVEITNpg{NytMoqjKL9cY<^^RYeMxLKUqvpfk@Q1? zydgB}+8zJei<5PvLW)sBKc0gVf2sbD|~+2!Ln!hmi{TiZDcl%8_<>%qz=&R{J-rSlTzPZ1pkQKte@^P&dfMaFI% z3{q{a?}`H4~8{*ocLO*)KfrN2uRIoE%ha{m?XJoV6v^9$j5WVe#p2l7j3a9hhsfq z>>E~XHCYZbj)ya8$92Xd#f!(G6&?VXBGDXf1ofgSpww|so1Mtl~YL4SfjU5Ig1b+`SQxJ8?`tH6} z)t*<<{-rY(cqcWniGaXps?^T~qIp-cI34jAC(}Ja_rsXCaXgl45T%O&s2rZQ~=bhQ@3`(#^!} zD%z#5_gQ5U?KtEnj+zjJEtvyy6psm6>ZGze%9vg3XWw(9?Dnd~&#d@tQQ~#1O&uwu zC&c$XWZbLVxqHF_4^enY%C+7eHA30N4q!YAgiFc5QpbIsLpFdb9s&3UGx z=lMzO+yFpQo}`5c?OsbjW%K3hMlM-Nw0S`H)5vIW&?$Ba+t|;c-kz-3UTI}R>S48H zi=>G8ebn5USE!cOX%NWg8Zhfret}xiAa!a^i1>lOYDRCoRy{w%;_S#{E4cNw(RXu+ve3$?7vO8~ z?hCA-OHW^0XNh*y-2JVc(@l?Kl9OGIJiGvN>P3d{<(MY{;zs9Vq-Fvs(VKRWrT$z4 zEaZSu@S|p_Cy=cr5d0iI@9!v|R7Ck-ZfpLTVY-0@oa~Zv?i*Ft8IRnD8SfSHQ*_l{ z$-q@D@RrTD$@Z4VF{|J3j>pY?dmIBnLSPv5Z6>zP#dP2_W^f-j^SXJrINuE#v z3?bEwV9aoT{sLV6de3t=K+6r;-=3YdOf3Xw9cOc+Me@Tktuph#>#~@JPj9{81r8d8 z7)3%$mcnqVJ9k8OhfcWnAarEaKe=5I+B$ex0j}+$(rokHNsaQnh0Edj@Qr2r;y` z4P=W7H^$OsN$v=}tXzfPdzAphMLDczrkqB-hRvh+URL;1!}ymI?7JV&@Uo6S__Ew_0J z#1x4HKE@VmmE~Y2022W8r*umnAVIQ5;6MGNLBH|`wBFrsp5!49A`HXb8-H>Y|M1yW z?*yRiaKK`A+2j4$$Y^V$vSd&8z^C1~QyP$GX=LGytVC44L~NUwp!b?3Qo4x)ByNBp z6I00;jv-R1bfDBswWjKl59oMRU0$5_oPm}*Nb;gev7xlrIZ$V20QNr$$iSI%_5lxc zoK!miYm~yYk_$G$VFpeYNYpr}OGm!H%_`O_uqQWO?PyWC6=U>U#Y&lyJr$n;X-(+= z{-s2{e_$9|{or)bjpY+A&}p>9HU#)|sNIxpd+fSB1J6?eM5(y#XqK`#NLx?irvXN~ z_ItrYDFg>leRH!Rn_n4)dPPY^aXQ8a+;@}WAkAR{91BIj3Uk<+8czW4qwD#6i1Eh} zc?C-L`npv!P^tlA>n)e`M>F@|tB`^=bnja1DXz@v!Ku$^RQBFNCrS94-}~1O*iW9& zsUe0aD}n24Yp<36VH_xCv6IPDume+LJXy01xmP` zMf%O%w@_knZy+_SL`1%NU7jXGRDiSn`L6LVckh??{ByVc@el77!Z#rzOQQ{jtJC*1 zKG|fTv)$t`rMPze#^ccgU>^{`VS92d1~}1dU4YX|jkFEGD#soJ93faMQ7rX8nk*aK z4$P}SOK1u4I3Up+3D)@Zvy!1GfCbV4!u~_qs_hAdGEwwP0)TDIx%bnRVABndsz6ST z+x>gHLuUEi+4_A`RrW#Z_sKX+Lrup9xlm%&eUL(S6xkq5`bfj6xN!fJgwTS)5z~_|$gazlx5R!{Q;p5v~A|?mCJ;kUf~_WBDSh zVQ!mTS#CfF^)0SR!Q@Rusn}2PKxvTjqUO}c{JF;dw?BYj63Fg&)?I#>I_toLxRF3} zoZ_A_hVqKTp`ag1F{o8M8cmz)07|POpv>_A1aFz7?i-&dCrycv3ZyfP@j!Kz!)l7h zu&$R>=;hcm?~UmiX9Qn<8?R9(q5TG@#RvkZ`!NCm#h3>9e62F1;9Kfk2ThVo6F3(S zH^v`Iyd`8U2_j*E1K(ysZ7G2dwQ_5nEB|}8cp(X`lF0s#362|XophN$;wAVBfns44 zBd63cplqH_))1Jdr*wkK2FJ&>bSt1{FpGdyOdHb&Pk3MvGtvUbCz92m4FMW^(X5Xa zMgym%<6(%v3+_20x7;mLie^U^QexaN47^jEuVg%TYmrXYO^;WHCM%RVfFM$_TtbwK@OK0sP|_ z;}e3=k5FHz01X@;CIy9nBBheA#o7OL5x4^106jDc(A-5v3Zd2`4WQu~&|B-OEdM%> zj5zm^j}~(O^zTMT09j&auj%BJAp9b-1j?Nc3Py*#9)L8Q z+_##(vft!^|Mw_~Aa$AMo@o+Spdd{YFtQy9y!M75I=OI!gG~?Qbp=+3bEBW-YYjtt ze~H?;ATQDVvrqP4cMD`dmbAA$nxMxZ-lPI+2c9YsB$FiIdTZv|6{MZw1bHXbwAS*! z8t(r)ONCrOhDE^2-MGGJ^LJM-0MoMcLmPqiYc4|%z`aXm64?K43M`RwJe#ND+drLs z{5R5IAXr_sSN>Ew{I7w)FiZoFYT2?p^y^W-Jp)(s9`yEG|MzkE2a}Cp1YeJ(>azWH zKD{vjf3r?Pus#8f0B9o&wY6XbY2F#p46`14=qHNm$@XLXo=l~TRCk@OBoF)7KPzy50{{ma|3L&|?9 zxGn$8NQ0LgM^<9)?ePBdB7Zc&{~C;zkDo8EUAc03ncBC@bLEQ26(se4BN2T}M`GNc z21krG<>*!%zFCU%Rprm*goIZ`bFc<-KTu$#I4ijoUdQKn5{DtRQs<{fU{3McK?+6s zFxjMubS81z^8BRYNN04*Om&;L#-z8KecRy_)ElsY^|b-MLZ1*&L$*Ibw0gK(_Mt1z zo^(xycrI|357)A)wv zS0qw@{}#vXtEjO!>T`r7e{uECYrNm0;v1?zd5wWeWvI2g9 z>x4|?m=e4U_z_2Zkx&RahtL1~*uNk4pD%n#$D}}P3=GT8A%_EenlFAu)Og*7O8uW_ z`u+L;JRp25;Jp(owh+9(2Jgc(1_i>Bd;igmpFj9NU-++I7D14CVgorhZuLwQyaiF{ca*<=3GtiY zC6tEc^?yG!6LLPgY#tH+^+;BO(od{zCNmx8@A>RO&L{iOBhGOYix6K!=CxoS1_&CIGLCfn-si;@67O<4c<^i;{g3dVux z{oku7(FY8@g0j5ft$)V;f4h}8*P}0sXtCn6v0n?^ogxRFTE?=e`mHKL}*B!y_wy?F;-EX)u@0D1UDtXsN##p~V*ayN-q4v|6blcq^+jmo+O;QcX~<(}c}V zlJzyB>-S=9L#}_@^`!8>-ua=5A7ruE`n+5W@eP(ps;Wz_5pOQspYk%wGg1%0hW`BB zFVB(ILDNrF=YJcDe@!g?tra_;Zb56eb{6Fe*H#~m1^ulV!CG2-D(>f>#&dVxlmGfD zk!E0M#viN6i~jxI2p0kEN0Mx|1FXJ!3DZONhiiws=-0Udap{=U*?4bW8_2QDbw;lEMlr*UjFp zs!jEz3XZGx5>4ImES{}(`yCof8{O05TzV~u4Z01~%i5=}QC)%PRRO3~#A!Q?8%^W# zZ+w}MhQISld&gymjDPtzikijhJKeUvk_aDvBd8dA5#*<%XVZwb1)9fi*zgL0wjR?U zSY2L9uvg$VAEF%v{yuKBBpcY(9MoXPzk_T?-u>&nGk{thNuk;*uzz@S>rkVO2T~TP z)_paoCke1BP4FDILpE_SJHQ(8(WOcRQd4c3Q*S8Nfz>mYnix%78^mM=ma1JcA$X6NFTze2wK}$ z&n2|P+%hT;U}$#-eQa!woYqPW$!Dz*FSa_zTsd8W4tvdLZZ#@f}$Mozlm z){t-@6yZAwx-XV2z-R7&-bOVb13e8|RnG(Qff(w3XKK-o|A6-3N8l z%vx;?T0);FMJ9+RXdqPGN&=nIvx+#EsfD^O5;=pY8g0(hV#Gb35dMVXiZ`ReL$G`M#Isyh|lYeX6!Q)>|`=Y3@4~M_E2M)I`U^K>30ga^_oPH z;|c>SUOWEr&R<)rFXI>-2^6YC&+=(i)!CpY-*Qv=Jm$Wu1;IsGs>hnpk>rs{(1J-k z&m_?i&cBOz*nFXFUAG7aBvxVtn6X0?s!w8v7`0EgdX>Z*La<6jC|*%S+`Ec`UxX@j zy1{+~>UK4ta5dBe>d=QOxtm^~mb=x6PVNBGel|f&<(j$a;w}H2sv;C2pFu3a->VlHmS!z4C{&8ZAQIK!})yp?iEMCX56>B-UBczgoS4|0q#NR#EefJq$ zwT3hh6&=*^m7px+R5q`C{~tTcN9pZPXqc1qsPk+=_uAA7%Pih7yyE3C=8@;h^^2pl zRC7Vkpw?+jZDwVMf-+ptbByc=^f{>njpSJwwaN00?gL1~Rtte*xBMZ^G3gqv8ZS8j&lk)F*sw?snC%!;6IU-319{_+zWyKfl^R>}dkXM@LDvTu@q zySAhwU9Zlq3Sh0-1Tyy%;yn(><9~!X?tt<-2Y&e51?6H{Yt-A$x*sGy3VU`8$xGWcfz`Dr?Z=HEefTbgDp=~l6Ld?rp2{TV#i ztrMvYiG#4Lp0vYP6a2aPZriY?I{lQkQY%RNA4Cwf}~8pJIhGC4;Tk7(nb zZ%@D6>q%kJ2lx*KF{^h$ER|n<<|?Y1ars}LyDiX={&NoUqSm_Pf0b}V6Mm)py{W*5 zq>HE?bVKv;!Vd@``An1{7poG(=V<=J<))4(`D`e&i$3HqR>;GR(zCXx@VT(wm64pS zVMTJr8)w@YoL;zR8VyYf+?5+8qdoQ{{vocEUF*KqAuN^6-kj+P<5>O z>ZaxQ{972(o5fwsb7S1^Q7&uuFMqTPUl-P^jdA8pIGs7FCpk-S7?1}4+SFt#$1)8N zzy1)NiO~b_5_vYDOX9Ns9y|=Ix^OpvoRP()@wru{L5N_vbk)UfbOUOGo{KV4n+uEH zJx(}Eay0dHS@?3iB?QMF0ESTutNRvQqo^EDaGoUfCr{7VG~+-*K}tIHE0nh6N1pH| z6kzybXSG}=cTH}_kVSEZ1P<&!81W$qyFJV9d~k2nQCR8L+84ar-&XiGP@Hc2$>9y>EGm zrz`|^qIagjiae@HXoGRckA@3&QU~AKIuhgM1Zi@?kQ-jTubQNeIDM6dvCJ**5%T!> zkcR&~f-C6a+NPIHmB+#PSBftxs4@o6vc4WPLLrHA1)USgcxzyB+^hVDKq>cu z(5kg+J4irFbi5q4Cx-_!R(*-HrIEJ9_;oaz+M^UOV6Z7xI!DMoGed(PY>+!HziRrJ zZ6GdD`#p@LfXb&ER_InIPrsU#_8#lqLk6Ai#L>mq2f=SA#)r^SFpl0Ng<_>q*n=)< zXo0i`f$ttW=C#`++pNRY2@TzXLK+KOqHdYcPrE4CuIQ|7fdiA#Giv>VFD|{5&5B98 z(K1zMDKpkBB9o1c%S~%9Z62WGjm^qZT@GrLCXL|u4-0j^SNIz5lfbBsz5I7=h0tt^ zLo}7SR?!C%bsuTv84&xjodNdrql#W9gFc;e(J^>FH;;$gwR>-@jx_PZp{tn+u7S1; zx|kx5o_<$XC~=^w-tRIbM0@8W=l9N$TD@}*Sm2n}?4lVTQ)NwD?rv zb_$mEEz42mQP;oa-ZX6c!2xNlh7%jQS;UXqE5GnD*WvW(j=Ah&uE~p|<*!W!{P@Qf z?peK@+3978)IQ_oN!KZCkoM-T9|*agX0N{2?H!XOnBPbN-j=tn-EXb`C4wF zRX>(H*i6`K_nuA4z>(m6)q6n&(VRu#b3Io9B-j_ZOk3c zex1PY4#$t@d+ow1n*}Cs2RQ0!PT6*oM}c z+ox7yY+2jWaUlg+(~K=JPpXK~bGzom1hnIXvzL&n_XB3PQAJ*BNg(fXa%tl=qa`mg|TQ^(%wvg3N zZPOILCeA1e&}Y-R{u9Z2Kz>@VbX8`l?S`8iv0O)bZoP1<1C}_2F7eiMrDOmUF4`A; z)8cg;{pPc5yWYn;yY~yta?e^970!b`Ogc@%O1ktgR$C-{8^l|H+G+b;U!&TcH4*Z>*~CncK#Sp9XMK=-vZWMcPXKpgB}Kv%bE*ts%-Q~wG3tS z63X&&;C^51wzWD1m^-#wGbChd$pH{9CC_$s2#CLpyRw=~nIrx588HhvI1{iC-oaO7 z;U=_WbfO}%QXm6&B3}SEZ+;R2YTb2{z|uCQB-?x~Wz4mvs6m!v>wrJK<%7+P0eiGQ ztN0Wn!1L?GaqqSZU8&y?bxu27Pn3q<_-ZV}G7a79a>ew@QUL|a_^kYo1~$EQIc@7#^pVO71(mU=wJ9`5UYAE+cW@6TlK?ix$`^+VWBc)4Ne!=4WS30P zlB(hH(tSbhBcb4(Z!m54t=fGa^xqbj8%4KKY$;2+8C$EocBD@tWK-D?qS`)EHX6PN z@VvdoxdI16s$8=APPGk?CPyZZ#A+V?24d`3uJ@*_{n%`qtCq7`>HDb-8!xB&^BQ7= zdzL~J)bB1FgCKx2skdCuFif`r;6_XK`o%srEipB~Oxz$rQExwE^Ox`#ak4w6Ga8=s z?lUIj$*V7%VOvXEg9{zsD8e~aH3FR(8>}Chh(@U=^gm*NdtP}|W9;m({U-iw?4*>K zO+y=2M%~rIaA7)a5l96uQvR7Rq+27=@ita$E+lg@6&JDnlPL;AiYzjKgT zL9db#v4YTzQv=$RHuKv&K1GPNP&etIic0~b~pL}uH3WWZot z%Pn{K@CCope9{*qQWGRg|vp(e@_ak#B@!7f&-IEqQ2#>`b_9TJJxv;Gw%7^p%WA__c=eJ%n zMbq+)4xkI4j`#Vfi9uY#haa(Ib%lqvinF9*w-+bSVaJV>Mfu4=UWTV<4IM{6uIQxC zeLaW=T16MdWc!*j$-wyx>*)LF+rg2s#o?|5=QT=EW!8E#RBwG_NlW=l_hSfwe7@U= z1?3?2(?lqWf^;=#y*JAQ@cQ}<6D*KMl?kAciZ}Aqs6!S`xyyL>nFXbNdX&1|3x?&( z$3BZ_kW?iP_lTV;NQ7{Y-9T_3=#Dzt>wE>(t6wZ*i-9%5uY0H?uJbB7DgKtAZC`F7 z#|^L%MGS6!7Be;&cFs?aA~J_y4(ve`)N44e327-0*gq|?+Dj-4&30-=Zt<4*JTx=o zx`cx?uBWmP#83&l*4@1(@9#R6;b92`pL)_{!5*&_NeN^To}-Kp)awlCOg;34zU9{} zS3i{*5i*hxbS$o=3tF%PVCjN&z#GEIgnR)V*lHuxRE8x=lbEsLpk;1VgqkcQJDkc^ zaNX#RHhX%SYC;^9An4Hh9HL`sv`C>P8FH~Z|9*5{9Xxt?JX#2w)S z)`EJY9#mZ>U_Yvjm#2-b)w|F6ktC>JSK@chFB_pRo(ZM;j0-ja=hgfPn=$e9I6lS(|;s|%LvPqYRO zUl$DT1uMCCC`#ejt_eMJrxaS>W3Jsx7`W47dxOcg5UColei&bela>7%eDZwtRIaQ9Pv2-AJL$2} zZ9@=N;GVjgy~gf{o{uEDE4bYL?jFfR*NajB2EX3L6L|E+>J7~2cqyLchbmO%tZqHF z@bGogv1{<)kAHTq10hP!YT;X>@3L3;%c6&`_p@tnFWn93-{UJ#plP@pqCBhOuxjrP za#I*Er-P0xoR3johM0>CSZ64tS0ef~Bj#rv2Ia-crGwe61}lf_!z=>p{bKy5a|$Ik zZ%)o7vj(kcrGr%W`k@-b z8-+*8Q4$MrZp(vp`CJuSX6IJl9E1uUXDz54eJbe4W|3>)=Pf%eOEqwC-8^z(D(oq6 zs#1?tiUlAd6K{NBNJ`e)gmKBb=zrUKlYzg(uCh!0;j0JTy7YPE(%5O#-C zDa%gvRFS{%>Df$vw^QWz%k~Y)ix9s(6VYyTMiA9j?fT>`ci4UKV#OpER=Q{0^`o)a zM<|XmCB$o$_QzA_!<~2iVrQn*e&?l`^BgRj=(ANBc}Cs0jmt`)j6b8(+VA}zU8>Z| zM{*VvJ$EB~@-RP=L&x=#+BhHp4 zbE$q(m&LJ(vd%4{w#dAYL^NZU7C7&Wh{ayU^=ky}z3cHIp^IcRNs_o0CF@#2%m|D7 zbmsYro_`Y>EOr}Gzn>bl@v=H?_N%qm>EzeZhDzh;G(S1N=%@mL%-G=0=(Cl}E69_a zg6frDH}FB=ugXxeAtP?oWFSzP8&6#hBC*ummN<=KH0-p0DMZigLD--J%-lX%BSep= zVWM-GkL4+%$y~S(60~5x4ar|dE|aOiA55wQVZ%oRyfu#xEqe;BOG2Nn4QWKi>vhl32={P zSTL96W?5}{()LHDNDJT2w^iFQ3~yD@`>U(wg@Lp-Hh`u&T6v!B=E*a@8`YYj4)k(= zV3c$6{Y5+Vai}Ak@Rfl_cgq%E+#9!hd+Le#iTdaOqzfZjw`rh6XWw!+c>D)PSYU($ z1orMiTc=l3ee!0Pc_B?97X$g4>tqCAjD{pX+{KPPnJsP*JUIQRa4vM{^&=zR3QKRp zD{Tf^r3egXb+*2#<{PY9@Ho4WF^J)7pCWQ=ejKprSFcv zsQ1YUraP_ORku;7mzAQ$y0a zx$5|(-|c`Ox$k^@f30r^Vx)yoxx=~iEayDsFw_H2k;$-aIkVh6bER%7X|R4m!_9Mj zT9ct5ebjM-29LWDc0PU)wsgqEA-yt5p!Y!|k{dFY+n$ZL_$@+_`E3_mViV8y-MJ_0 zyCrxoyq+cZ5gZ0P9Lmgv{?DG9AV}*x?Va1wC@CgcBi;R z3b{WP529sML+hQ}9EKEgJ}tV`g8r-|iwsGl>YIl{*@_$|{no8~lb*x;nT}@hy61|l z_hB`5?p)^AU$`FVsdfz8k-L4e5Z%URy>Q6Ad~zIE0I!7Ul+EBV4GZ7f>mmN_KCxUK zHTCJ9Gti^maNL`UrC`_15b){NE~wpRZS4w>Y+$Mq-0NnS<et!K2#Q+PLZ<(x4}5 zOsMh=lXh?S14)!GE?-vG%riaC-BvoRtGn~LAdZ^FVoMu)@}i?wG&n|bks&Vah`nci zm7<#1-LH?p5wQTWgJQ1uhQ?!K-d9jTzX3J^3R2>mp;;_K%Lj}RviuKa1DSJf8crx! zFl+_)A!3{+6zDq*W3LIz3UoE_-L$a%M3y4(4U=t{(h$9L*eOV1^jT8OrHZ!v$fw>D zS^kaTtq9rU;gft(V%W2s3Fvnln^)%^F|bRodEZgA~VG&;}NoQ#3OHedO6YRjW1 zH_@?xkS@%}u-9p*tvpV?Yikyn*W%e6QkhA8)gju+QSJ z&SvdClnGvaexsvNn*8P)}B z)yptjpQLl^;O)wOXti3UgN;I;>FH(RbSG-K78Ct!7_ug0k~=Ydx>2Gy?i5rZ zqValasqrv`qry6c_NM)Zdi;3fZ0T5PsR&(p)ZBf&n}brPSaGTaTBk{Ct|8gnUc>uF zWv?kzBfKq7)sJ-6@?3aF#H-cLJCsx%?nW@u^vX6@1b}}|8F=YnB$@#=%9M5;Hi@n; zZ08#)ho622S!~l=UY!~Xr=Mnv!O9jW!(!9U@fxwyC;z>&@sP!Gb%r)Vgur@?`werx zpsf2V=}lRm%=sgSDVPreal)QG!bgj}TgtRJFKeKU#m4!nKwul>xKrlR+cdI6$XY^t zTFMCxpZdGe6|{A*8Ry|)vKaD;INnKwstf6ic1f?j@QA+kxouZlGz0j(ZB}%d0xgX$ z4Z+WrdbAKvLSyyy(NXZT!az#st~Y0>bKvB>z49avHWzFeA)}O(`v?KzZtbA?iijs# zVxifGft!&-_I1P>Aoa!de%Io7%;XazUYmt^fayqa&Ros&|A zIDEjQaDs1f0u`(9f@Y`xbtX?ge@60KvEm!WziXB&BB*hb(5S=Ztmz!0CqsukfbA8O z)aCXRPGGoJeImF&rJ+4h9d*0&6DZM3!axxy6S2!MI5Z*Wdhn_A8K$Tx3kcg>m; zj4TW}6(5g`rR?SkVaO8)8kqEloMfh2C{&rRy30&H8?Hw>p!p(MhclqCs?+k+BZaR} zafTi}Om->*#Ou9;8g;&AFO(;6%QlT$Q-t^@oiwJOTupv$dlt~+$ft0PzC^QoN4Hq#;Df| zQj-v~X~1N>YQbdNUNkZC0Abm2F<#)rqV%goXzGrls}Smn_&Vq3Nh7E+wzbBMwYobG z@Gd8-zT+kXL!YWzsA}b+=|^|Ivt)cbvCfV#S8BQL--5B2u(>}>;o)$1MV-_ff0?)E zoIR{|s^2f0_Hmt`P`DUd-Et6qE^<+>vw`l8Ba2dz^}Q$=S)%y@&b!Yr$V zx47s91_Npb`=a&2m--f5)}&7c@iVHnclH4IL#5W>IG;k5#ao#+ock5=UZ%hGOS55Y zcZZ+pV-ObGBjG@}bp>RHc_qD_NkRR528^Ft?(D>7EAR;Bs+c4S1dHZuzJIrD|e5Ye=?48%LpQyE-D(DPotU>#DhPD_79FOCZsM+iyz259V9! z%KDJLQDLq)JDD_ONx)XQuVw*-FTW`e=4ES9+uUHQ%SEb4>ycZLgELR(=Rj9um zu!VNdi~e!&#m2}<#Wh^BOsJlFZ}}`?h^`)YUEjcWb)MX!gUC_%Lu+B9I42bgpZA+r zqN6<4hYq8XhsFb+bk>wTi+`)gT(>`v`t@)|eQf`JH3+hT)|6m7D|uJsUaFd)Uwh=# z2vRX+1X=2#W`3F{X=RpEK{CM0{(%u-dR5C^uQ8u{Kkc&nTMP zd_7xwmi^%oY+-nCN&Uk1cPg>`(U*h^dWdaBpFF=U9b9yia-GJ*bHc*>-WXTm3E76@ zruNm;2|C+6$-T~YpUM(anJmw17SOtY1RCu&}LNx4fxL$~{ZMnOEPhF8V>`_+#g z!NVstvv2Okx<(=E<2~v@C!8 zLJm_DnX|UvEs%+V)15UfFkHrDZe0E>;KdL@++ zYHLPw&w5I+iwrIB0E4aU^%FyVez<`aa2euS37TO*Ilte%1NQQG2>a9KXN@b9S>5X* zg}|c|CNf-;kZ>IepO5p4T^^dde{Q;@^Iu!$o_b&756eMzTCy1U4+bHFvZ&$4q4Xw^ zb>Zm>0(wG4Sq!$#R~|E89ph&Ad5H4UUEjCgV%21QWt`h?F_FWrckSTN04=fn+@#se z-#JN^-&b|+bs{45$B=R~pLRv@1-|ZGXF}SH2MT2mhlS)PWm)g@S5gR>k1hq0r+R5y z@qc|DEy=g?!8i3NHGd+3tCmspDGBIz?U zF0a7$t~*%rZ8+aR0p3miB~Ml9jLB>2^)dISeYiLR%T*3vb!DS9>{i)Xw|Vn;HntzY zjwa5c;w+!%>!uTU$2~+0QP|5t8+dCXKQg&*EJQ#p%7)<3YuT=I24@pmT~b`0hra=2 zWPT#{r@4mjCINB;wMFykfuE-EB5Ew#^Kib&2i5)W>(Ts^t>3Ip0 zT&Y_%`{z9hh^U?0Ri(Ox>DhY;Fkz&pxBUo!ntHpmqJ=YeNGG>pUcRmjkYP9SoI+8L z3^(pCry(Af{GiMe^h2GXq6f<4(+%H9X6ocX|GlUAFaUsTiJIg@)YH0y?Oe(b(owz0 zsThI<=Nv5J8`)jFWl^4?>dVK)tYX3Lx|-8?+awx+CE-wfi)f+$L!Is}%Vtq8fni%) z%v~9*ToN_Rduc&9J6cSJodZux*Roz(h>YR3G0bXt3U0o7&!Tf^#IQtVmBvE}96#Iz zgxI^6tRr~|Jonn_DL(q(PSP>k<`{2CWPXpMB$jwIQV6#UDybjRw}z$y?9if1kRoFP zks&>~o9Md(VNmb%6D>ukF4hB~ijrdMifJd-b^RcU5)5?kaw3TUu{eTR5QIJ$j@TK` z&F8b7Z?sxCORrpr7u3U0=tvRwWS+Ko&;a;ff)h4Z~DfbX_FcAbng zBjkiMIMEG0YsotNaC@@1PgA|-oop?=9z*>bvNbM2$aJZ`K|J4y^1U&=kcj3X>hfiV zOJ{yD&d80)xG{qzO;^qBNPg&FDBcKjfdpfFVlHW?^yP zV(rnQ<{^)I`mzNGe%$2e@)64CPqRx1m_5%H$VqhH_u0c>ms0kp#BXo0q8H=e9ehSE zm*30WktBjQ<^m=&ijQf_$Y%}WB7{F>JGpR`p>&YckgyD&1@NiTQo@duPY6naxUPce_$)6TKl$<^~ zY+!k((SCQmydVx43t_NDDaao5O$hv}%o2b+7l50mYP)!aB~M^(1`m7GZD;X|b6bE% zAZJ;N>l*j{qXTs=hCtr+tI7VKy6zxyo^bX$CCI$Op9YdR(4o+Q=k}JSvV^zq4Z8Yt zgNj`dZQhy8>pQx2pun!!bDGOam3xm>m`_0>NI6t9ghJKK{0`%!>0rHaSw|FsVUB*b zg2_E~7Jv2Ubn8NP#Y$%9*#e&o_;v>mN-eRp-#hb)W;D&%buq~gl*xL~$z$>kl8~du zrUrm%h?50KKYL84p6^cO^&VXCNyU7FOrLJrr6GHb5=+j>@<@vU3RRSWm{Gv*%Xr3S z)CVH6q;u9wEg$WM_-C(gKa2oAqi)Y305`l94QhgT>n=5Je@tvt=eTn|?f^sgti4YY zj(`ID45=Iv@p;F;m0QxQg{j78PB2-nzn^Pw%O=;YSepUsE`+a^FU#&Ik*Ys8Zal{Devx{C?cTflX+B5*o22-S zS+ja|Kq`gmfpN3igkt{gI2&@7BB_;vDE6{5lR7=4PrQb&Xq{ZfzAf1FS^&7F#P~2! z1r`j_XgHvKDLb3baE|wlDLy)$f@U&GWWz+oW9?YCw?piG{*ivOKiYPW>r(_~6-~62 zhxT@P)xs6@Mh;f4ypIZ|f#?JE(OAKXbt1!&feQS+sERt!MX9(pOQ1}vQX^UWn{q+^0jPu+ zUwjijq~yx%d$O2azMVaD6tlEcc=wZ*UR{fQHt6pADwVbW*_-Hc)rBAWdCBJGZq9O( z2cMYk?-5pPG9eg8x!${4M&|2MiXS8>JOPeUa4zq}>62~FHT$ydAQ%(k|1fqIP*HB{ z!#@U!qJX49ihz>R-3ZdsJxF&qLkJ3ppdvAVv`Uxcz>v}n(%l_HGc?~G58iw3UElqm zvlh#x$nt&J(u;o|)v3nJstpnG4g{zS1~UMl7?w$amCWE=bWKpp-~X*`r-m*z%aW z!$=Y2$RA~jAzip$|J)hxv?1qO2FDOVym(QG{S%*+xB+26${{DMU98l|%x&HJAoDQ0 zWW<6cfT{vFD@0TGK@+=(FG92dW@TaE($)OSKT`W0mpP z*EE>cK%H#LjlPG?Dhw`Qc$}1+=iBovcbUf{z{yWs>PSR)2k? zcE4@eqdlaeb8$vCK$3!j$^)l@Mi z`DI88(>@B_N7b7erR1#V@dBT`(A1JA_(O@%7kVsK*uO851`g#tBc<2w6f|m$RHT0nI+Zx5sAGl!cg)oIo;(`IqPH4 z%}bL-e_B#x<&;pk-seCBoSGH(8;{RydXF1R^m_N9Wt`B@5?@KPe7IQq2lmU=5IDW7 zE8*WymkavHXKivR3I~oU2MisLO%3_2E)2OnJkYHm>&v~7tRSsbk*yXwOw<-JsBPXK zpiHGj+J%RadV59MzPaZWbn7WLze;knLvWj8E4ZI)F6+>x?EVZ*93@GScCjSl;JhArxbf4FG}6tQvN zq|8o~-eQ*wz1REc`%`(fpykMwZ>rHw?sVmGO1JWI7~#B-Sq@E^F308V6wZqE^c;2Y zRc5Th@4&7kh68PMX>|?{&yk;>i|z!c%!#foi45jgblJ9 zha84W+ClA5T%_jSqs|QF(OUVQ?}unviwT>(`zun(`@k2rly{%s&2HbSe}_wVT})QV zUP+zEs5Lq$eu|o=SfkzhU^+0^O%QON%HWafhJ_Ey7j|Rjs8upAR3>v}l=OS4g~(@% zz%zChC^m`7#WQ-pLgI6>byMl5`C5O8ob|cxEru%`YPUWEzx3E222+Sv!+K{vgpxZf zTvvzYEoqf;mgl+}(=N=%tvq4vS3}7=MIyy=;_lQf1Qo1%sYr#!xPIhX^nPpncGLq% zoZCgips&XbCn=HCmu4|ra!j5nCi%LnPsGF#7atD>_jfvSsa*IC$_ge>!G17u)Nwo9wMN`;VQ#Pv{4UA-nQ@i^a zYNmB3{eg}`eiY8}lVwDio=eVFUDd*SmjWENR$D}NsqQu1K^)Lu!f^BO{gx$EE@(c- zST!Z?xlnLuJhn)UpsiKB#VZItxl^aspyD`~O?@V}4FU1T@Q>6rvhlity;_RzvMTG3 zU*Jb6qX4|mL`}Et_R@&mzNL)vnWqzzTuO_6Cph%FznPxm|Slv}>Kl^SZ2+tQoLMUE+jg)Cf&QdZ#iDkvv2=nXBGKU zC2J*dk6?yMsQKvHN?Ngf+xC}^yq<#25Ln4t0HfC_Or}cE-V(1SCK|{f?k$=od9!Q z7;^ublf50`XihtFgElVI-4@u^y!{4e9LjtO+0n+|YvqAi`z(w4rJ-PvYFae!E+{Qa zps;ugYckUB;eF7E-KZ^OZfXa)N8g|fGAS-q8Lw4gO60o(jntjr*}hS~ctLAZ6q<7B z)}i~9@AaGDPPCWW;fMD*tu)japc61{*kBH!+MzOSa`v-U(MUq?rOynM8m8ARfm9AC zL1G~j-dcJtNwh~%r4Ly{Uvcr?pq+7dPR*Qk2C)MF$&&@H;X}8|oU1Vf6y&{qYKJ|t z9?lc16EB*wk^V|D1&syyAa5^?pRO935xqO9?-M&B1oC)}`1$AWSwgO4clc%A z@9|U3IEq;}^C3&AWS@3BPAs%w-^@J4-MIs|D0~uf4K*u%Th8+nJy(*YWz(P0y41TF zy2nkj>7RyIi3d|nFSK5q1iit8-b#+5Cpd#Vlt)P#PS#s%ukM_2P z_NUk3lL_OZz-IPR)Yxmv5K`PAzE0}&;wQ&e@l1usv8=^9G!rF|I&t!h`*Zz$O^Ym- zl9A6IK3OLI6&6=xKvm*nX|Yq5{Ja;U(#5*gWJd8yFl2xAH%{}4MOuLODI`65YJImq zgXU7ksrhKfPX)SWl~F-RuUf5ial8VU!A*0hSUw4ovpL`fjsqe~)PjPT;x%k&@qIRb zTz}?X1;VI?-?8(Hy~>URq^$tor76H$sZHw`olR3rpdSzPfalvUoeQHRJs{pnA|@%N zk)J#^0?`qV%e5E1vq{*Obs?eVG3ZJPzpI~L>zzG(%Uqm?^H5d>ect_21jZmwO3!BT zh}|7FFN+y!}UTFN|yj-vB$Jk!?L?$ky z9f}`;>ngVNBB`yk)36Si2|>U1UHPfIm;3S4B||erQg`7R7O%R13hlAJ-$}N3Iw*y! z-f_vs`;AY$_EBFoK7$wmd?m@`g}ND8DRAoEk6-j zcHoVyO&iQ9X0a@Ox~IOP!FHy=yZkLI{zPkqZQZk&WCzx%sHGLqa}<18BNhiLz)VKp zm`~Iv-H_vH1L|(ej1|*jv#BJ~94t3Qoo#lKy_~BoIlbaC$m=wG+z(a9weoZJ@}O#M zdh=yw)G}w*w3fSB(E3KgD2g0#7UwFBMr0IUy;Da5%p6U@9?dniXu_RL#0%3@LZucw zb0^M_lT;?s7tdG4&J49iv@9>PFlkbCWEmb3yT&Ho4FI*%FGw$)Dl`JXe3wCk730lS zSB=(T(^qE?j1OzEx#_J_Vo^RMvwc3@piT1gJllf0_U-hRhab+$?c-kyXPi5ZU-w9D z`_cjil4==sr0cX;xJ#Hlos>rc7baU_fiWw+sF=Vo!|wAzatn(?WJ1u7@bd!e007Go zNWj*PO$#LV=GG8Zct&!h8;K`Ek9T`BwO0KU`K8c&?sUJ;`-Nr?H-Y?~Yrm>Gp`1(5 z*2s3+m64wxtrg5_$bKi+-(J-!sFt4Zox5F5=bw<_QI)l!50JdiHb(L6HPx5PtVc)D zRMy+~_j9IXAJVT%H;j)}VZ=(5or0pFKo{>LZ`_@f9WBBIa8cHH@3Z|zUBm85=x_va zmULOwc(kc1OosR5?4dQ@Fst;M35NBj;3GkLo_@*Qyc{*UR!1#;njE%cK^hi|C%!4( z+UTO8@G8U;<@M)5z_W;J_0B)nfKGY^d`J_ALOCWx?ioINjvzPM7UyUc!E))!&T0xCA+wo?z_NwUZH%D9FBgoT*ppCKE!Aq(R(<2_wjH10 zdx&msMc3|{08Bcsfq6UyfLS_&{7^ELqB(rd1}jK$EM zeSS11>sX+Smp*?l8QOv~SN4fY65&sz)r>9(?!-w_V}KLOmcl1I+75s0;o4-Rz%q}{ za_%0&$qa-tu`Bna;XfrF@DxkU?ASICs^7AXm)>%p7JfVndMC#~%h)PR!yrgn#32tF z9NUT07-$LEojTfIk6ry3{%8385~d2xRL*5yW&($m*>1K<9xtLuPK^3t*inqAB47FHA-7O|P4I7#sm-6yk=~B|u z)aGLzyX8z}lBuw#*a_NljSHu9j028^H{w>pKZ6#%*FM!Gl{=SfzHeZ}Ab~5|^#p9$Y4@EYQ^R`~mbD>hryP#nlh3$tw>usJ zN`dA9=9ma(daoqu;>u>^jvDVcVl{VE#6gntmrw$Lh>UPJZiQ-1=-X>Xk08v{C(P8% zR^udid{=pyefdR978!5zpqniI)u+63LxsNC%3Her_bY!~9Z3Y5eLwGt!^KNWP9QJf zf}o?SyA%nASpKmz~S5kPJ2!~$-$^k|sG7>`-zRl*plqI93~ zVY1%7Y3DMT~Cw$kLcKuIwOcFo%P4kC#gnzCIdIgiV&?);0-n5Gj zXkQ65X5^D)V!=fR_sS#iZ+W|`za7~>F0YGEfpmxC1M4D1*pW^7`hvXRp%EO!HBAR6A{}<+Wfty?7uc%(r1a*Pv_ku!B09KKa`=s!H-TuF?0WCxCfLxb6l;gd)3MO%I6~vjc z@BTSsCK&xp9^MVQda>~|z>RULc`0lCl4nAr_FXpyv(4C9tIgehNZB^Mz7rW*6&imhsdr|i{ zP5OJ6F5((F5dZJ@|K}}$fW85^?_hVk--sb$LLgFVmu@is{ja|GDs}?!Fm9`k6I>Mg zcC&(SD7htRaIsVV{#ue&(PHhq5*Bvx-jNWnvj1wX|Nk!jf61m3x>lD@>e(l`KZQtG z@?m%X)fhvGk1NmJTK+>5{?{k}dU;8@nC*P$e(Pa2>QV$ECh8edtrr@?ObmSgC@!be z?~bs)yQq=3=tIm`B6OJF`_1oz?U8RTO|wxdxwHvyytLA_N$8`A@{$r76 zXY$QuZ1!vmW|73%9$@yukO_GLKTzysTo7_l76cu@9C5MJ%$=J}z2zMQ#<{+a**2%K z{@hV7&^$D}m)y7i^$7lE6@}~YmJojJa2y9DmhHVlXtG9VMrMMo>7t2dPniO-dOz%5e-mr-Z3|jTH>=c{*4Lb>#vh zYT&@dD+9>#zV{?NJvmiJD?G{E7{9KI6b;P#phh(ZYRCVX9`N0#>E^(QNpwq|4{YKc zqfX6HdE^$aC>LGLH#&k zd^y0Ej1Oqrq8;XZyED*{ZU+#;FF%oEzq{cHxIFS>k1Plm!GxSn>w*><8xRP0L{qEw z+wTC$@>N3{Z;>^4=mz+I_Eh3w!h-}xg5}wHq4txSO}AuVGXBfDpD23Cmx}T~+!K!h z{&MP}Ok2VlVsBJ3d8FZVC-K|~x?UU=%WZGavP<0=_wDf{2N zEN=7!q+hg~9X5|$Gk7~|+nWLg5D*us$f&@%`?RK|U;(&x4^E^*o+z3?x#taABc7n$ z`1Mbos^$~+O{7Rup<~V5$$mBM4uPYkuVv2R4_<{oyGo;wum(a5{^`YUZ(hfJj5bHi zId%TImS(x(q$slB3GTNqY~HXEvHkkVq-M*BTI{_{exxhvVS7piZeAe#>0QvqA-xbL ziLhxS8(wg29LhI*9oa1M`kJvhV5N-wxW540kg2%t?ebk#6;D~n{&4n4>6HT5%do16L4wD1P zRvrymS*E4*g4}_DYcpkFDY^_NCp?c%fN}M#a>I-HtroQnK#6#bgD@(|$_!}wylvks zy$m|dlvO?5K1&H#CjzcX*Es00M6(-QfRA;@42TCEIGwUD<3awZZ~(m5WnJaa!=9ch zye1!0%EG60Wi4mnyzybq?SAL7sAI1xe8X1JRP7_9Mc9eg{mlN4@KGB+E~Dnq&<}5- z0a{`*{!Mho@k}uD7+~LR0MbUDb5B>9yDcqqT4fYIj^5J2;{q2u%ck zs&+0o%9x)4d_61>VOnkIwE{HVm}}R{anpT)F1!D7`Y(?6f1XbNt>AnEDA1}b6M=(r zwfUmAT@EGO<382KiqWSJj)A-xp43i{GmNCW438sbRIQqMM~?uo35;MbJf{8S*(k-l zIxwoM1x+MG9xf*0_*F!zX|;e(X)QFMP|iRZfsPG;IAZxIkThKoxbVYhOco2gb{@=7 z@V2+0Q%mh+0=nT0npsfs43O3*?O>OXWn%$IUAa7Y(B-cO8!1r`2lU{>a)7NFzs)r^ zMWkc*+el^T#b7NcZ}KTn36WU`(CS+LiFfzBh#D$BA(D?xyvnsG|3 z*dMX{fk;DgMM{PMLSpAsagV?eP^M!N%S9E?igV|WxnOV^nl|S8jt>C_X!G}dMRql- z)=q;_I#-!9wV~C0tyHOXM3;5ZS&3Y&!ibB5`0rJ{FXD!qqLMz~OZtOhHiQ*Rxl_+n zF_`)3e#J@I+_&fah-C>+SbL{;z~m6(U64?-y$Okfd8H~OLf(=y+tCkwBn~M4cdY-+V|BPKEZ0joyQFZs394!Pp_eO znO%qWKzpZpp|WLFLnRE#v>-AqJ+3!_XSS<$u;Fta8~GDUKNzXVywY)E{;T|#y8$Y$ z%}l@qidD~>PbL8KrtHih8eg89az~r~BLf8=?o#d5inoX)98mf2-}~}^p3N_5d~*SV zA}iDH!7`)q2NaC8t?b^}muy2`TYI}lH!nig)U&WOBon1!$aa>Z~0yDUY=_C z9+(;o%z|qh1x%%&u?hib3QgmVT>?LDrZTxHrt&R+3om#KDkr>AXoLdE1_&s21`qfd z3v1e{3;~H3)cEWPf}LX^(EeITvnNE}d>>F{NI}gDni6=6h}}3|2?^K^h0v3&rq_F7 znr9Kg`otP9eM4cyI*4IYR9gcS^xoQxTElN2AN6o(az+@-@@Oueps6)Rl}c)a*Kx>5 z7;Gf6VCXp_=zRHW<7X*U^uZ9>HFQ%9!$xcD%$9)!F(ZBJyKiv}ZY!V1GP82;!$Jnn zXcIm0vZETeK^GjuWAyMPN}TPlo`U;BhA}C!nx`s|`688LFs*=OMFpl{i&&;fqi&8I z)EWb1ifPcOmxwEFUj=#t_4U-GR3%dG#GeNR@?(<=@@sIRckXOT!Kl^_V^#(l4Dq(G zPaqAdjS6sv%-v;BZgd1?DPrG^GN=bs^9nrfN133$On+ZPoTQ@Ck^Yio?vFIIA_=?A zZm8@n`4@BsH;tohIYD5o;4b={?Ihwx)iyh%Gw8L7X2;bok%j(34{fBWkx@R?!!`Tk zvPQGjE9um?|5!r$B$8ybn?njl73eftJ^QtPdK$NgPG{}s1F2Z{fBVBAk%50;)+nQg zIiF-^v$nvGL0Ez|I2Db}GP(0&fb44_5$ox=GT`Z9&7`~}kTWz}cf@nl za(@4mbxe-IhEA9Hsx_Xhnzd>o!iG_dbIVM=@3XBY^ZPY4H}VTq9_B=KW&X#6BbDTb z_SXE`o506n-K8P+f9XGnB~a-2Q`Ce(VM1WVzeJO?#V@^;d>mAlebSWI1t;ojj!Cx; zEDkn#z^GCPw9eswci9o3PUZi=iqWm`dqQ^A0rM95p4{{TEe*jnA-??0`G|Wwg7(6Jz z#(qTr8B{Fg7S!{|taq`MKCe9&)K$YundV2dLU|18-!fF=iL1>%N}`{i*&d&uGr?z8 zREef--i2`&dXl(J`O4MObpS#o-$Bq}ACGM^Tiht1B*wnU*n2b6i#L*gRx}1B*p&D* z1FD|2zR#lu*k1btQ8pCZ2j>tt>}na_S3o(Txh_LP&$YknE;t8f{D`4B*0+i!!=YvU+lQYfXP;nIsUr zrya{G@5k%kOG|hk`(%*V{~3-a+;0B$Y&qF?I+;iL)7P#DJ$4%1%URp`NK31B55Z}> z;d$gdeI!XkaCVfK@9!fhkiR*$`J~EAS)0Uq{rFh&J*JLJwUbdWZO*YGDrF@pBKD{w zq&D%K1+m!;JT5Rq@S0KSF2)l2Jc3aqy(fr6lB@rOZRVpjEW5 z)u7B_eY!nISut}@$lLRK>*Lk%eJZR-=~+M@ZJ8+grA_O2I@^7^+ z|8SG{dtNQ>DKhYA)mbgX9gt;=iMY`Ag`b{{VA~|X_=4HSbq8+Z0z$DhwC z^JXwD=I3Y+(`oK7t(rvyj10(3Z^{M98A_KHSb!ewx zgP|I(QOii6NMM9?k!riiTD^rZ2=Z;1xyxMI?kJ{rp837To9#4?cP{uLvz}bM;!@?{ zDCG$U4o7ZMDJF2;{`OonGrl}-L|F*t?B#;-gu_i(usA^n`$@9VogcmMv+ez_lWsY> zaNG9vF(>naiq+}1wDEi1<;~AJJIZCa#}o8`6Yak<^BfJ=@?jg3p=zB1T$gFw&vYT_kl!#)nvUr|n%iU{Q3rW5rNrSEhT?pZAxdQ{nC`R+}pr zuYOT=@oD96HPJPRTqm6ad`dldJ)VpTzV7C118pakMBN$i@sJ=@7x(2m#BJq-b*+-1=_+J$Sv?Q1Nn z@jKwT4~s(bN@s4OMkmiobX;mVPMLO(yU)?2sIfUR!kx0k{pt<6xS7(mg0?t4d4Yp{ znG8PLc+UD$Fea+}J?BXJW0-|I0mjT9mv0N#Xv1%(fYDMuS0Z2!2SjVMiCm60Ji)S! z8w4||$#jQ#@9E{7n+l8uV3TU~=zScYbUE817~^f*cTq@qap=yczkQ3VYh$vbcD+(l z&vn?AsJ#b>UDp_+f}E4j(Q*ayAh9bp-Zmos$s~bJ;$#K>yYh_%uki+`casF|`PqTE z>rb!Qu??T0!S(zt9S(g(T~g>MF>;r$(ddNm$BE-U=2pn510q(?&?LeUwTx`kDOqcO zjlEylLq6%6=d)cr>RiV&zIV(tW>B^>^U`&``-V-%Aryh?)E$AVRs|nTbJ3Jj+1_8T zP;FnEd&1Yg_~A@*OTeQEOAle)by~l-gdE%4fw=^Cjk4`@0kqWLn(E!#SMSS&9wLaX z-k*4+-gWfVthn2IZnaRl4L_Gs!uGH`9)J`n>$xU9XFc|_t!w(UpE!Yd zQYPKA>Wac0qQ|fG=$lX03cKRq?9mS-wXs-HBbLmrU`{ZC|B^A}8a3`N(Zl$wK|eDX zZZcD*zoEp-UT6TMgykGz5RoZolF)PkbzIv^Im`&E58Mw8Nw1uvy_zO6X!a_Y9?Y-m zup0Hnbwb(@_ZFCRHL$ln3J;nDb1ch2SYjMaGt>!B@7E5yrGKKdX9G5zIbP~mki|CR z1ZZ@!>qm_NdhQY^b|ON7(*MAt(5Ks=mdHWqutlNOm|6$4S)iv6wg}vx&A$5ymE_dW z#~e#mp^j(Ns?5PJYUC-BJT?yZRz${h&FxI=OP$Ia^7gBVoBEGWgVPx1)pUE{$?s#K ziLUYDIkZrgDVCtS-EM8;rwxZx%eORpXMBA@hFqrEjC>#eOGYQ4De?#P7p66;%VavBBNf4 z*pms8IK`W%t~@p_d+n^Mc@&{c+GddPCUFnpaHuxHIrQ?iU6<4?4^R*mDMvGbo-T@Y zS&UqxttW9Hc>(*QEA<-m7v>Ziz&drNsq;AcA z7LpN{>en7W5ZgQMBy1k+-q!*dd5Fc_M1cqw53B2&z8(>mg@qpzso2seEpRg`ZtGSk}_^6?oO(R4|D5km<-eMwFDI{ zVy7Q^U0wCjEJ@-q*GV1B_^k>A&Ps*KaRd*NmQFg$Pe!DogI2kJX_hd(+Kob6j2JBG z&}Dj285px;rQ?p(II@@(F!KiU^s2wt7uOr(`7nO3xvaWKujSCL&03-Jh*UMy9fT&z zA7_VS)B`^=SBJ&#;6+<%TT7S`;>{kwwiCiwm}#3MHn)M3=%~nB(DTGH9&dAA)0AOb zXIgj~XevjbgYtMZdn346ZeH2(lip2djR%Nq)kAa{Z(Z2-I~gKn>bEhV6lv#6?y?S~ ziqN;T*&`iRHt2xr=eE>To~929Bupy~jiGHWvX^#47w4#jM@}`}WF_}lqJ)DOlKQRK zrms2zY9Y8dxJz$9=FFv5+H#hGOFcp}>#lM`uwVNnnT{2Rr%$F&BQMw4_WT$qdGhzx zvN%p!6~bxbVdhj&K>Z-@)uC(l-0f&Vdii+QgcTwpiI_{UGuW%QzI0yKJ8l&?>?A;~ zG%1h23vQqBE>$9j|JW`pgG_39$j-i)$n`e!TZIcNxE?6H%hA9&p0Y$W$LbxXq?<12 z$>g0kH^EP8DhEF2|gyBa{cOX5q4BwO^Vs%MMCLa(50aQk?#c7I&QdlIg3 z-R+vv@AZfIqn)cJvBoCxJ{-kUHXa5B=@0rh!gltYVu8&hw09^sUY!s_&|2J|Sy+C! zu!K}0eqD*tHRx5DTP$k}?|3x~mW8wOx{}C37P%KGgAewxU8c72mge|}gf>)bpWf$> z_Ie$5JL|_b8jYv(y)X-h$??sldOMr<-fW|8is(&|alpm5M}_KM4IkgP?3%U_aQnnA z_2F-$xSvI)nyIiI!RT-sygKr8rx5LYpL3c;W73^hr{0ru74kYxEyiVPtdnl1&aREi zX`DBxzM7cEJ3_*D;>?6Dzo%~Y^cGx{kc*dsUJ`nB?`q81_gKBwiu3i(j(q9k{(ATm z$*n}}L2X+BR{&AG*7i1qmD7FOhzl^4{o4vMpU}e`Ktd*V6okO)ypO2wB!L;3^v!(^ zQ-F#$=|^1)ii)`I;7M~o4i0hm>juT8!OnWOL+5DI-ggB~#7>oDrD z4F?g~0I$er#&nD58piKe_gUK*@EN4EeB-W$;@xhYzrm`mp^t$A`Jys_f^0Y)kKHe} z0k9&Q;(j%(G$Us;TsW&TZar9P!eJ&R(AL#xPkBHnQpo?)K}p>4VD%Z{iqaW~%fxL- z)jdxy-Ra~j2fSdP>97-_&6+DVg&mwSl>^RkQMToAN9cOqegWF8Z*NM_rOz)nL0M-R z0CZGZB>;_z1m1|e`-?KPyWt=;T9oi8R|j+ziI$=b$5Sv?fIc?Ljpd_cMI+JW_rf4y zL)GW7)25O4xR8t`)!_j~%-~vK=y3;OB8JGQ{b-!C}f zRPYXa%{06NovehT!)A|aPpS(AUGTb7I&V%|k&wTSSqSjZj~iPnbaBMbi{qIVw_n?Y ze-b3uOHuTn_2OJzWg0X5@nyb3=z-99j{Dek%1QI2_`$^9Q?K)l?AJ$4dB?LI4Q+*^ z07d>|I$n}tg=o`2rc65_Zpo!;NqLoeG%C?vPaemhZ|&RglO~-B8!wBn(dF7tly4Xe z7lNqdoXW}r#}C|b-!ZND7agCc=ke_iFthqlb?WhAGAmShg*@Os2&U+1XYwwm`ibnl z62&lcZzEA8VKm0|{p~Lk>|w}Qqo>@sU`%;0(^+e~+GVl4JbJGomsrmFyK~GFy%pW(HZcGqae^UBZ z^!y1yrYGZsfv>1G!}IPLEk6!!0{9CO>HMkBFB@iV)W3gI+U}a*xYH@X#|L%YsD#!< zo*y5tcdn86EUY2hdCuJx@~>2%LG&Cu`YU_gN?zNnB@RxSkr!KEyE+1_5^JG*Li))R zj?XqQnnC$f1+JqqbMpx-iXlyiLF0SPdc{sB65zO{%CEPn&K7U*L0HD~4J89Nv9~A^ zFaVs~oXcfx2ses(Kj4AQ5_%p4#kN?Id(EZmSCjAEvD1WtU`!dB?pp~C4D+){0A{H^ zaTqK#?Fz;A9Rr5w{nkc&Dm7~n8utPnxI3RXL(ttGSXLtz&6m=|v)wcs5XWYI+qON7 z_6@ZiTBu3=TESp#uBTL8{2~hg6?;#kfZ-55=LF<^J8EJ|C@CK0fwL-bPDG=Xbt<0E z6+00D*+gX>^8fJl&n2cI6L!NU8JfwYOY=64Ev7B>%q zgxQdenD)4{-r#^mg2=vt%mW^WZ*?4O61;DkFfB63B@*Aj-MbiQn;+dK27V;Z3?1p^8`FR1p#>q{3G;&lV5N6H4PqGN92 zWK0gN4&2V(OmbhVZp8ROXI;BF5aiVa4T{_C@Z=f@)|}je(A|NCx#;Q%x~xpJ1#Z^` z#=*mpF;iz-yK_@9PRMG`<{-th&>O5d#~E3@ohI} zg@MhY0E}t<`0@m68Z<9PLygu+4|POcRAGV=8eiJfEHFJgTt0(?U*HS{0G`XT9UTqs;3_?o2fm zZ8}YAKiQE&KnfQnqS0WCO#Bf13iIvX{q%jT>95QK1CDl?pTF6k8{1)SCRE4U`iB3( z5ubK|mvnjvJ^hC1Trz(t?5TL1X}rD1r%lH;#_EkTkFhQBPaOD{t${OpB;6^e^SD`u z63@tHp&`1>dQw(C2uly-z<8Q;0sq-}^^NN@@mD68>~}6T?t}AZGJg&pv{&F)4?2I) z)0O6oC5GpMa0!yllrdS&N4vcD+0Y4ht$b{pXv`(t6ayUoO<`P}hex9zuF&Jw_mO%s z@YX%NtC=945d)&ogAN!m3(G(8!eIw_RYw-wZ<-nasO1SJ4kLDga0a=7_$?NFhURZf zZ$((%6znW?U^!2-+22uoNRU$x0oV6XA?mHf*1p+dq$ikV-&Jj#&>W`I-3*3K}#DO15QOJ=vz5>rt zQZzBFkM0|}>Ws;H=eA9sqlVcn8Ef**uPJp^mDVmJcBp(kEsv)6yk*{|*~>=GMuVcw|s@t_)s<50bm&00Gw((rzex1Cj z+q?Tz>Wq&kVK%gRJ1E_sdn2Y8F0b=Rj>w|C3HOP|G#L`uSzdCE*Upta&=!1<{Ai{o zo02S!uUdlrUSNJjnP&T~kMW6+o(>RMz4tMvDQC9!@Y#@Az)QTY^i56ElzkCgOZ@?# zgE-x@2MU?HwBm(vJ3(M1I%`PRMzRp3aop3bqfUCx5w+SoCgRojeKq%ZwiUUg3%h;n zT$$st7D`e3tUEZZ-@#;&LVM8)VbgT`_9-j<u7A{_e;3=uS=Ya04-9O5y{_ z9lVE)W9P4~fB|_(71pnJxOvK#{8U~_eO6ZB8_%iiuBl7wV_pCkIA7-=u={8hN)23hJT$G9bsAaPR>S0;-@B4A^;fCGv+C4Kl5goN-mFup$)bazwu7(~oO^leK< zC(V8t%Q*(67SmYF`%~yCa{!h;q*)`vpExSuDYGoY&95IdA?Pt*iril7wOGvU^HY_E zG!TM_RCf@|!)LCQ*`d;7j+3pxW!sWT4V?9Ua=>1--hFLILtv;@kaOrDr37n6!_y57 zP)?rIzQ6IFed}`FmjeiH>|AkgPvnRLq%x}e%Srkb9sPFHU^|wX*l5lNNNCIfbs1yn zTnXjg0!d$5m*zC!!z$YF9`Wxz-I2))bm2h7bZJ7ZL!}mt<&I3{>b+?|ia7)~^e>;k6 z>Do=)VsPF2lN-(_%0o3%Y@EbFA$v0s7xG()q#y869U^REL-&2|;e8-=ZyWL}ofL4_ z;P!rzICB1RqDxl3xBAFk?#NF(1_yS1@7Sa9MAj^f!Tq^hC8{Dj8tYS9hfZjbP$^C4 z*i_c-c-*-Lm|m*!2J>pB?AidWN$mD$BNX z`uOBKl8%2ybFLA*!fWP77SVk)MfIF+N7kjpk^>$Bf(%B>ZmQzcR&L=YLwT=JLdF*^=Lw31pCe zyq*W`WDq)wXHAvD{q!r60UovbXs>CnSw>cOnG0e^I(C0H179H~QbTNIyjw6ZO7)12 zOk#Q#gJ(HxEwYb;`2(>{0RL#QC2?t?3RKrCGNrBZkLFM4JjH}@5i0$GrkI;}OELZB zoDZ+~jY<&8i0AiJT9r)<1q`+3JL)LOSW$;(N=*B=4i|VVQ)Fz;*TV9~e1sCF5w5zm zx6dTup%sE;tmk&?W~dtNNdk9`A`c_@f{6W2F<4vO4BH%D7(1n>&Yawk8*BvZdcm*Tg=}6VmS7 z6a0QK5>y%`z%v~0F!|<-aeZv9SgJd%ZWol0)Xg1UnyEjD#W}w8grlvf$+swW-*AC4 zJf&t;YoEk6nPK|us74dnt5`T*!{S)SxH#tnzxruuBZP$F<5{&_TiZ+`?b#%vc)~{4oA^q{vmXw&BdPi+vvVNe5jy9 zJwy|VD5AamkOKYF@fw(}9kcvJ^;$;HVv2r1HC_0{rv$XFD|(BK8jEt`8-;zm!RWI+ zE{{Cy9k?Ybbk#?rg1@w(?OngDRa3#BD@n1%b9hTe-8ijYhrQ5fb|Dn8cz;?$*A{mD zq2dbBs3YVqqMZ1x!R&GNqFOscxwSn`xp{W^`h12>N(!;->{*!&cSy4xJhdc zvzQ!uf4O_{u@}O^e(je@j$SBSc6%i8W;j{wy_wzq+OSB-Fxbi-3o3WV>mBkbc2bF} zT?A}Mi64Hba?y2d6vH25WR`Q*{Um!E6^;B10_>m ztxboO(irGK8}@B9HjprWx8{n?{2=6K)3nm%LQDS`6j@>B@hMIe_Et!n>UC#lpJA^u zcIyhq^Vr@o@4@#s0vE=rd@ZZp(51C4_7Y>j0ntB`jZv6 z6(AFRA_ChnlU<$(Ulsq`pCpT`BXJb?4pJa=OtMG5=;GGQSQ5u?sFuU^gzA?GQ3-;JT=a-S?@B*v zIRSIE8A`_udWkaH$wXwqOf!37yS%Pn(UK2#Yvl3Czo>` z>PdQ9GWL%Z#@Syx@=-03AIL~5#K|h^Sdsf=S)sb0;tMPUub~v`epW?~ zfE@Sj-=jDA?+l+C+O|a!fP|zZ~5k%bG+We(K591=?TQSIWuy$n73}A zkf!!=tpvm|_p6Y$2b@O7-kd^SM1N~7{(6HMw=d_DW-D%{6oTI$cm;IL%JqJVS81}@ z`3WpyG-r$op;8)o*J(F8?N+-ULQ>cq9SqiQ`2{RXSrL` zRAjZCkqob zmD-hFf4ot=E3r{YV7P1x`=hH6thD;s4lddakD`4!zE(7ioMm2&ATWaA1)bGH$JQ1F zY?-Fx)jCU^U#rY%B2U2nE8Cw8KrqvGIKoNG-tiepZv3ncQKf6vnUAKlIq5q@>ItYh zUtfPQD^M&uaPuFoYC7$u8?380WPkok;2$-skeel3mA=86)}b|pn?uQ8kNcHUIyeWw zGBhXZOw>1=!$9Cw{BQ}xBXlblr3v4DYq1ls2)cI zmmha!A*e?O-#!cckocg2^+N*dBx7$z{DTdQNX*OEKg6ucSD1QgczARWT14?oo`N&m zk-Q7j-sCu?DgWGkYdRJ3=4}qV6%W|}vE-F`z1Xb>;i3CRdEzs%GwVv^;XUWbBeDR3 z5{`ZO&_U|4BzgqKC#vPvdu=|mWjnE&9JIz>dU>NCbo#9eAx$q_SN3LT*~YHedd(u; zoGqGj1!Z8fzW54pZp}s+NApDQUTD(AQ}^a8$-wYkN`+jxND$H^WIGhnL*^6E1&oQ{ zRL!y-Z9NehnWn-w{1ZxBpS3#aK>jO1gI@P$rB2yR;@{Hwe|tfXX(&WYSnx^j{C@jm zF<~;+wm+0M;i5?q6ydGW&F@b^P)7kH$g^>Us`=5`*9|$>>M{!zx^3}I_|f+I_}d`I z*Ufg->oDwE=@}UQ+8xujUdd7%iFOk%H;DKYcU>@^q+9~=2TC%}?Qa}oWU>92LX-FT z+pJyXJGO`E87oV*^JPG7`IruutM^-EflQvM|69ug#6vZbg@yv}bDr;ezxREg^Zes)WcJ>( z*IM_w*In0jM{g&|5|u2a>&>6tt`d`G!?%cUpj$8dW<7 zyv)cGzClpyBC8;hDVokvTte++c<_o#c6_eG$`w1-pL;2L_lGoph7_^A259^_awaI$ zo1A{zMXW~lr`$i#%Rq5|GR1u!I`mL0GW~Z@rr_-r5`&`Uo)JB2W6!om1+B5Q!g?j_ zH3~krB+Ucw6wBXkzB*9@jwZ|Tci`#5SUGB0(ryxZ)_6IpHH?kx-xj7Rf+wBU-_|Le zB7G|vPUb(*wsKJ*Q^x*I8=*#3WPFgg$mwFP^dPi=3#uY&)4eSI%A`@P#W@;Td4o}I z=Tw?voHu05RnW2iT$|%KMe_lbY4a)K2is{HUvGC@cNIrPQ!Eju~Zl_t?vydxDy8Bq)Y!AhRlGbstuz z7R~V4WniFKyS#q1f5pLC)^V4Uf!Z`VIF7U~Mbmy`QANE-4qGO|M^$FH-F9^)qgND{ zOZ{5~H{Vh`cGg9Xx~0d$Zuo}7P0v21qgZ;hN{xqeBjubuIXgWuLiaNNeLxV{*9EsRk{QXH z>G0uC=kW1uyyv0nPh(nSfE=q6HGwLycA21Lp@~c<5O*obtdlj;wtqyJRCO`cy*>`C z4Yr@P|K3>n!*#@ZHS9{uv41o3zn#ukpU$GD3_{;+|A zN-f8(A$Te_bEVetntUWU zqP}}Qwj(uA>YIQ)8Wy>zqRd)=wU+m|mp-{u2)P*t47jlnx@Du2HE>)n6)lga2!sXy z+ZgMg7rcrDQuVt2N89h2`D8%^;(ith#)V2)!z3Q__nORQPy1B$^^zQ zEq?2CkEe2A9-rROst5l3LqU(bmXs^s&@V>St2AmXP{(2Nu%zq%yZZn8TN78zvt1Wn zagh9Z5_qt%f|DWquFB>A(fa?x)A}#pas-0$a;$p)DEs|ICk;je(sXz(|96-Fm%IP< z-_8WgZ3!K|%YW@p4sXnpXC;5c{p+fK@JJ-)g^)K2um3f!evB#HZ^zk3@{cC{uc=r@(+db&&vvIF(cR}&6xik4SEbJQ0VjTe}ACxAI(e@MhK%^_Fp;v zzU?pytlbfZhidMBv{LO+V5Qpkd%x@bzOB;*D4-!1bkJLtf98(CU>G|iQ&~#C zjmb|>F|qci$)c}e|Lkn|)8qPthY>+6#mLmZmfQg|Vf(xp`~M_-_V-%!MuTzfF@HP! zdp2Hp%GqD}Pv-bC@jWK68yN^)e@ih?Ss1V5_G6`6|H*Sa_@08b;i0E|A7PeF-~+fbI9cg;aOrV86XyLawwZo* z{k;tTHz9`OF2FB58vo}^w-&-~l{`&)S{sINoG&8y$<4tQGDL(u2Jb$KDjqM-BDxo>}~r^ zPPQf*0f#(i>$_UB4A-R=B|6^jlz z9NxR5&ejB75>6azNY7GaYFa%z0$|5LDsiKOR5Hg#^T8iLA8&n^4u%`KtEG93n6?`- zH$9{u{`2H2FvV=mo}5pM9S_pc-V}n;=sk5VV^w5p_K-0r|L6z${n} zlE!TSi)vwsVKo4NXh#enNK-F>S;JuDr}~nD=usUI#36eCbB-H&ko}BEkCs!(&iaf`#%>bjx(f=utuZ_YfU7S51mF+UvM8@- zGhz-CTxIqD=zJ`|EE6B8_&gx>U(2dGKX$VJiRt=_DaXlHjWajE?H?}Z)o{bK?KmM7h+Fho73EmM1L9Kp|?4E6jtLpm^c=Q|V3-tAX$ZoUJZ zU2MIE(LeS)z)b^sq7307{9MS6EMW`Kxi9~l0=IeGA z91q=L5MQG%9xJYC@Ir)EVUS&XS*1+D5!mr+%TLQGYOvt0X4uDHoy9wQ_R%`>D@?HX&!-g`U>K30lPBY#lrXTea_w!=UaI{}qKG4spq062XPO*a`Ex z3OI`^z&nm%*igyk8-HTV+y_@*JN&J2{>KlUH*irR$Ks9)jqY|jXj<);7Ex9-B0SuQCwG~fPRTx{KmYft$As|;snJcxVmJ8L6ZmO9 z!2{j!tnzXR{_?KOUem;Dsj7^>pJBp*r4dBG1KPJ*)46PlcOixVOnD5{nI+R^ONJhS z8u3y9=zjnP#7=nbesSQwpW9qa09H6r=n;EtprS7`8uWN-r@uAgw30an_O8yW1zTDk z9rrW)1F)yP-yslzl)McUfC3{$4kc!Z;Ylf9E3!+^EYf(X-s?AjDWZ*^uk)r>Ep$QlRKNwve$elnm=>}jB z!OUsIeOJRW}eyo5_bYq{yy_AZgf>Wy|08V!@Hhfz^O8o?&DI|^o;lhu{)(IAD zE=g|3OVw||`#NG!%5iZ($Epbnm)WueayFiq= z6nneqv$4&XfH#q+<3NpAn=d3fIsmkeLTg?kVrSmR?Et`|1v~DZ`JSqgRcaPnl4ZV$ zH@sohL68mXBF?X47Jwk(L`M8sEa53^6`)T&#MX2GrmUL+VL{1b;6LN&yCXgEwPVDx z+#-%;yg7Xb@Y~Q(Oo{WKXHkY@mrwVJxb56q}pHFIDIxd1X%K) z=-f5;yW@cCd0?)+-QAV!FEz5L463%&4+(-}J5_aaz^)YPu<8$_Y}|5)T`L}{l!jJb zO>i7;cJ#J2l$Qm2?b}@X=-=sp|IrY9^OE?m3CU$eVV$EBn@1=qA$4RjoRZP;oK^4#FSR8+4^W{0QtpN$OZ#vZu9|GOdSNmWM;c_C1Lg$ zhgSZ4=-|h$z3PNiI3RfW{Am@Gq&-+Vs;xGtVihIKhCy!12#`^muEW1`WyjOHJWL6E zYU(&T-9BDy9p6Uh5Sqa}C^(EkuN-e=7we3_*q3atb1F1Ik2_M$%IT?x889yCBK z5=Fxs?>K5bx6<9}N80slklP4W*}zc>caAD*PV;(9EAkgStSgb@niiI@*&U$kL{482 z4+L%pZGmSe@2-vT^Pd5egA}e=W~;e<)~a((vMmI__sGwU7E{H(mA8vW_6Y?h-+$gv zE9$_Mt;a<bjzB6Qr245yzKo0iPAM)6Tfxvg-l0tBN%Por>zGoY#Qfk#MOAXmZ$ zqy!zU3sEy1XWjVoJ&dQed#2;C>NwisL?FmQ1nBd1B|`l}q|Rw=nD;S)+v15U1W*L; zmN>)(zpt8-0X0W|MhX7ce>FHg&h=?!Z@QthZ98YO9zeE_C%nnY?i0=PR@i;QYL~2X zJ0sbMxWA}LX389g&~1A?LX+hfs+>Ix1Cn8?v5kTAFGp71XZ)hD&8EgOZu3fDW1Lcb z8vsMEjVWo-?zE17eBJr9zHvxOLR?KdTR@(MuKks3Tg&5c!-mm{JCNe11I(nCiA@B7 zYW9;ubyw{4G4WTqN?n}j=(Cloua}!;QlSclxTp8dU3^b$8$7MQpC}>A_4!t3RRFm) za+*ahW>S<&v_aldHD1*Zkv|$`mZ3-lk?)ig-rEXA0HjVCfX52=)*&HdR_-U7#h{WB zJH#ghy6wNC*FrRZaSuOAnRAYz2g%>VT&VtS48O_~N8Icu`K%zs37>8&Zvk7U<6_D? zwWNZJou=_BW74hm?{s^0DC^!Sj}6e31E2QzI}YvDTwuX=Re+jr-KsGDi!^fRrDL%H zqQv9L*H%8aRd8X-rWfFfsZADtz;8c{@K9^PB6Jl4p@kyWC;DFTz9hGavhYy;_9NN zV#DknYjZ&(owf`%OO~Gc)bzZ;-Lxve5BX@M0NwH)0UG|7GAA^*yVTAY|GMVzE$T0y29)hVFdRZ_1_n1!SK9apzs9xQCbx zA)v14WZfDzb?t^SIWcH&#+3qCuy?`ko!~Bo%>t8Wl{QtMvwJL251cN){Z41IWz^ce zX%wL_;mHkSFvZb~3T{-M@gfwB$(x0a95i=F4~K1F_@tmpfU~FK54^c}Z%HNmz7O|8 zsB0x}!rf!sd2HVlf+%q<+DA< zjnHyH36e-2b`6~Yw~KtlaT(EMu2I>d{qOy`xVTHL5y@Rv`270g5kJX%(%SMJU3%=- zdNY3>HN;M>eJnkJC-L9pAH%Zya7XB!zt`}rs9j5u6C<0n%JLMj0g`X*3_iXqlCE;T z9bI)}r)lEab4boRz+#Tn2b5t$GftnLQiA?EotLa>60z+Y)Y`+{bQ_?1pd8bf&aQaz zI;Iqnh^!I)*2$h}z(U*N zqKXfJ)=iyp^Hn{xp02lLpizjOzaJuipyff>R&W1`PbL4}FoYdqLbmRsgRKzN8Qo^b zpqV7Y#k&#qwLY8`#?!u8blfO*&doud9TrKUz?%SY^bCpQj@W2_SkCLv2wOPMmAj($ z-)`0&Tq*M`@pk4m&>)1g$^ODaj!a(A;1548?Z39&QFNJ1#j@Y)9wPprA>*J1_{U$D zHcu&d=avEndsvfj_0xU*XV*#<^0E5}`heoYH*Q!~EZP3@p7rp=Njy~B|57pN# z&yG%(D#=pj`-2TI=9%*r#~!4*ga#x=9h7=6s-O;XRi0lobzR=_5Czttyg zX=tmqwZQGXmeaceh}jZ1M2*uQjdP;ye`2E*ZBDmGjxu!vUFzE*+O)MM7t*YWw>+C# z-NF}Hb8RXE%pe`g=JPgDWk-fBGoR`pBFX)CPlOeTUef)1^8SJr#)C16O|r1Qp*2EX zMD*QwviEHZN>yI(VIsI5WKwT7Cu^o)3C;#8Y9ISTsykC8l-))bikN>%;H_EVHI!}< z@{wg$cabc^GKE0Fd1gws=w7dKUrV0){4W8#8RP)W*&;t9`N8YBOEb0^+qE$z?w5oB zy@1)1S)~b`hU8D;xT6cBfX!GEP(_H|^iG>>rA-_7o)M9J{7B*UMckJ=eRDAi86J}X@ zD1V1Gdotj>Uike3p^YLQR(oCc+GE`GYmNJW*_(kNUtq`rHLXvReD2qgO0vV)RzS1g zp64o{>9EgBccdaX+MDVDRBRP2(7&_7+wV*)-!IC`Bj> z%@j+6Ps*4-JR}KQ+TTiV7&tgk0^|w_KF`vZhWK-Gd|zp~GFXL^&o=RX9D~ER7c|Ho zcu4FNoIN;btmv)@v$ht0YfoK50#d2UhfH;(0h8m{x)CX{!Z_)^9tP@j2(oQC;)U$o z{QcB&1T{xl%&0ZJgE?x1&Q0Is4SMJ>UAS1v$bQdSzK8Ke_gJd0`jTtEds%~AnF9?Z zSjUy!YU!Po)g9PVezcfo9t}&_j*iR*l^1+<2%+F+OqsBuTT*?E8%`fcjp35Qn~})v zf|&AV!xQL(d$jgTqYF>EbuNwv+EX=Yxv0C1qQP|`-!09 z83>Kwdw&7`HKH?}1gui8SEXu4iDRx%eh_x-PyxHHrOnw}pP|X8+lZG3txvn}-DbQp zaRr36bj*)D8|quVL+bgYgY8yS|D^5FKa)UNMOYl zgr|8ein#?GJ*-;2xz%R&mi^Lf2?&_M$TzXERlemNBFIlJQ(-(VeTop2EP6PPd7&`by%){qhfm4~fRFcCx<6E~~KIKcj zYAs;Z03kDQ;@>oNLE#&;F6@ACV|YU@brQ6Ob8XHM`}`{~%w13JFeIc6f7e;9=zkEP zDwpoeey!NrA|2zDr@obhZoM zT?^8+4?426+fVbpST(Zh^ugOLRc`C3QIZ+}j)dWh(s?z7K52|vqmrr43M#$Exi=jb z=U4eGgm$b`&$g#t9}h~=7Z&8lMPBIVS{^csDtsl*(iSYV{5{MSeQYqw4u%| zOjd~z%!BQrNUEwJ2pYKOch(11?BpjRJmpY!QTeNf0igSW|9vei4IChFnkDq4xshj= zF?6Z+`!X!L{;f*WMq5lD=6-p%gX4ljriRRMoGd$R4balYd@H`3U6!=@CN$oKxc9Xl zAd0i}r^DZnNtI};S0h0i)au zYU|Qli=bqq5B1@>io98}>`fR7TsF?+%J=?+zhu+!INPtXk*27yYNd?S-}hRk;8!C{ zTHuHfilaXUqs2Ad?SF^KnFtlNlp2zln0dCTB^-5xs<&@{l@1+ZS3o{szQU;Z^a@MU zY+0O#7K|oeI^fXl{mLu`+4(lLQ6G=Pe%k8<-}xCfyEUW= zP;R)fp`JI_G0jx2O|oAj9xah1SKnw5j(#b`qV*t}1s?9#Hb1U80y~3uj=Onr0unC9 zOQ}FqiZqj(M?SaN|6g9A2A+pU`1m~%g(wmrDQh)zGU z2B&isWte;NyA^?^IRuSsLFhVu9HCLwo!9};3D>l%n`39JcMgzANCViZJ5yk5XRuO( zt1z4LD9BadIeoxbqrEAWo^li~S!aUmXhrQ35JQ6{3+}+HBT+$pm1{^bhY18Xx}`4A z#|NYRXl$Qwx@ z$1DpUxVd|jdy93V-sWSViM@a1`tW%y0?gg&^t&`+I8wcmP!{91Y3W-hcOUPnEE7UG z(bEHka|%NlVVAQ(W`(^smqeV!eS1Icw)1)ZcAn<+2;IBVLoKdOPAmf!mAe&%Q_d47 zFus$`Sb=`ux41m|8-DZZT$++)rHd0j!F$sz2z%kyPCg+ryOjJhJkyl!~Fb)>_6<&aG5a{b@fW zN>$mLnASkpk*s?abUI`(3qAv>3c|)<=ysFm^mJL>X+}sCTfFsgE#O;=i8Az*-BCMk z<3)St9RMC1qQquh|hbQ?)(af z=XMsiT}W3B7vVhP*^3zhXg?s{GXJl58(b1Fg9;n~hQzM}2M!e-SJnD*;Or^At}h<7 zn6^M;47fQ#Wk|@w1N(-XFU`iUGeSGfX72B`YUjrPonzIza@shwq39~v!&k&6ZX~CC z@-Iyn`FH|-cGW(l{92XTXPWGoTSi?GBYD+Aze34+< z3UIDBM-YO99Vxe z=l(~$;3)GO19A@`|@~eQRrQYJyI_zuH|kzn0U>2fY_x8Sv5)?D5!=FBwWORef<5g*$VU_W5Zh z7^3HgGNnSKwD^Luu7oo)rt@x%oIfY)NFn>LZYAd{=tTZR1~5tgl9$y|8F$liV^63T zCXh`J58;S>;hwi6;BvV6YBv5hQX{E|={6!_``KHYLJKH3?x@jgLZsQe}Qz1HX_i{u1#J`*MTX5yA9rXYL28Q9)}U zR}>sk`*)Oi_=*Q|V(^hFR6XE%eq&E7vwC*4qpOQn^C>67?%*fAp=C?fRp4gyeuC7zas-8tTt|?Jc12 zxvrJPF0Z$_o1STww=t9B+W`H|j`!c`lE{M?8g*N>^3|Cas;7;LwJsVhN&y+Yojr$* zP>-7;`TSS?87&)Bg2X*p{VigHY2t_ilv)6tZAUdXMyM?W%jIm7;Sy%c**ub+*=ESfl@mNcCQVb1EJl&eSiVrhR>`Lc*(n0&V z-JB}8&u}(YUScS3{^=X;YaM`J&t?E5-gf8e*@MZAPPP^f;r<0&u<^?J!kllz$Eo&X zIHbm<2-$aXNVWR*cPm*187rfuc1~^O&t4qN+__+lb=z&7FM~9=uCWxYM9{7XSVf(T zU%!LN(?rvnEhhp3hLJmfH8X|cLSMTxxMUUZR<|M;B6r;1u7j{rh*!7kh2PR?a`sN^ zE#VDQ^by?v2tzU@T(7lso&y|cL6o$d)8-l18Kvuhi zsER%(m=MEdyR-fyu}aP6TmiyA4`Au*s5I;apKu0C%dd-{9Me`&(QTayRfp5~#UPO+ zl~P}R9#W5((i}RpfkIx{X_q?~CUPu5;+|BX=zClNx$aYJB4d!+#kJVH>e3;$722>x zP8qyGHIa&GzP$#9WlFJhik-aU70}^K_wJmK*Bf!rZwXrG-7r1Hj^1(aFr^w{SObhq zbEpv;K*_rf03l|R)57a2TPgo5`fj1QAn@gIu=P7pp@VwsE!O>>v$#r(;3Ziwa zoD2MX!+F1M3VY{OaP=PH_dm3PpzOw-e~uVNYty)LnYr1b5!nF@9Ih6rkt)~i*FZ19 zomzdV=;-kmBN z9onx`Eexr>Sw-kVxa6D*^a#1A?*!TK8g|_}2&LL5WOSUBxNJO_IAZ+@e_nlr|9nB@ z$amlF=BYvIm&9|=VMJHjjzU@~$l0dd+W>UurH}g6?iTpjm4cu#d3~41GV!F=n~9?i z$Dh$ZY)L%GY^oI)%A|!wtaoWfjZ7yw~QsuXk+-&3i1~-uj5$-omCL3Y2%^`e?vu+iy$&1Yw9EQG6?UYLxmm7=4 zt&37WYP=v6C>|QVGYY67W>hpe)3)&KD7XORZ=;cS)cKcD=|)yp4F+nEq=_@I)G2OR zWVKW1m$7<|TFEP&Tl$3Yy9*4ij4Id=Hi~2=<9^S-KdPUMp&|@Uer|nUllA#B`( z2{1Puv_=>zwA#2(W4wC`$lXtt$u4bgBaRPtkF5V8#S|~gRN`CI33n(bVh-MUaG|w;Wgp)8t(NO3S(301~|?c z?##Fu$Oe4>ete!HEHy&u)h6s`FwN?Hg|~xvRPbQ;^6?<(-LOHSshi+!L&e*G13&V! zm(W_bm|Ca%bmPp|*`bO=qU56RVWfGp*YUfJ@iB{>nro(E-yWc^zhU>wy>{^?YsOh} z2t(t7JZ9cXe@WiJv??qWdoDgx{c*$7-Q=P5Za91$&|Bv{=r3(gGH$3v;r!Y>n-vbf z!#^qfW&(12ZNcoXq;<3H@~?Xx-rQ0R!jt74LMtU8C)>|`tyb;cj7DIh8}Ptv!op5= zT}xgXH#iL%1)&b*zg#$FGY`F4U?oXRj=*1tdpxL2=jJsTRd}4!vafTz4U)900%C#u z1NG6i`L4*yMOOJ=gUmCXr()F*EB2yF*J=fS-wD+Q%6rk=3=JU|hV;+5cidDdPYe=z zvO7qL5LT!qIE5?5qnP5S-#F21K78jYV2u7K`mgG+$Fhvp+eqqi?jFEH6*4&OP`vd) z%)xknq`N(aKlQu1_eRM)!_pQ=ec4w`oV`94EYDw7qArznR}%J1B*@<7wfk6gGPd#L z9R!!1ih8mva?2ybezB9GqQNM50%Yu0=0zg~_XnL0*6(DsuZ<_>z_Z?gz8tn7&mtK& z3(^o3ymwlF9l3^y&41P1qPV`(uyx97w^(&p52+QoG*FwHqMicNa>pdg-?{bGzH_-| z5!mj<^G$c4q3yt_@i_zadVEP5pFVBmiD`obS5`C!AyWCR+0Ml1)%pXzQGFXiFKw5t z`V?BSXnigoS1-r)Syar&U*g6u*J-@{na4XBxW;ExDG0b@=nlrE$G}0N)ywKX>4VZ` z_j6qrlbfkt_@hw=pgx=u^>z-;K-B1U(hk}nK?}|feCl5!>_=blbx}-w?+9Qhs`W>u z6H{7y%YAHIx|UEhiofesxMUn~bOj)B`J#=k>@%+ey>u6EFX{(=eCfEMb)QD6_%i>l zP#|f;Gadg%hvnsH8=*CF(nZAdmhLJSwQb9fiqQr^yJZ)2h+vr%pVOg>b~3f?BfaFV zXwIyzclCIb&LyiK*k&Y#FN#2?q+Okyx(gGWM*>MCif>Oy>0of_x)qAIPOuV>d7tUA ziW80^B3OTWrxV@Jn79iV;U39q^_#9=8tewyFoQ-vPeI)1411SQ)U4C__2s>^`%r^vy|LvwWp(xZBH*%JLpS6a zR+*A7^kjqy?If~V!K^t9hc@nRHC=$z#Z6PhF}7&0M_PKG%1_QyvB4hxbI!o}<4%(+y9X%IiN(N358ML9 zD}9@xN2eD?O!Iv2pnCZeHqp2Cqz`pY+51%1o%pE^ldd9X8f{6-q#J(5V>Zni^)K9pYji&{% zTT6U|!dG*1aM#sL8V=cLeI9>D*2LWHtFc@&p`4$P#!yi`z7OJXA%?v5)~zMFNtqF2 zQ*+t!8RljS=Ii)q%d@L~*ob_m_vAQp{m9$+dHO6&^Dw`yH1ly6BNPLSn0X}1vo?MS zN31!bh+}{BWmehTvHTCi!O3~LUfI@Jng%2NN4unu-j+3dYt{@=BYoWSnt4wH`Pa0q zoC_R}jLw?G1~n83MIRP%2Bt(j=uu$woxpF&HbXIJ{y2orpwZ3r+ln?!Rw^ zw|<=W;ba5sO*O?Ra{k7?=CP0yvLu*!#zRe2RPAOwxu)y!d-8yJH{<($ZlT&n*}Ycj zeXS~T0V8w+9G0psqx&nZL*1rq|EjbD6?GpKAn_|*+jAd_)7oqBS;o2avt!}4ffk1Y z8|3u?Gx-YYeOxHY&TD?1T_5d6eQKLrIazRl39cdrSRd5z!57Ab~#|Gxj+#puNNn;yr|zKF1D< zq||uO!FDv2dMp2YM2#>OhKet06z0lj?8yY~`w*X{;lcbUGAh69*s!#~LgaLjR_Yca zt1f)bd80BOX@t^og03uei;_ke&l=iHa~QV9k$dnJ8wg%~F(7s(W80da?K2>cM#UN6 zq-ey^hl^2@O6ER|Fu1CFIu-99M5k4!kXwJ%fUl-D#Fo8mH;LbCv%mW&?O8V+{JeKM zHRyhbnBX-keQp}lRsuM28VGX@Qxd+(izqDgIz8=KuE{JeC1({Sr{9-aP7cHM1bZHr zqSS#ccYMsssl-3r>nDvXd{EbXo#*IFF+NoCEg+ZUQNK3h z+05DU9D~G7$b|VX$|WE_J<8&x0Y0cNb1BoTNoE(7SOVd>@XcFxB9EcMpBz z<9F@B9B;UbI5vbjki$NuCU1SnNqs!EXjV4yJDX*7zL5pD3j2WN)xCm7&Td@v2TQge zyf)Tftd4rBINX;#-`pDSg(x&pAZ;_(5ag5geaw~Lcaqrfqdq)oLQfuH>ea-2z$2(LQgxp`ptPSE^~245gk)58`_t$G396_!sK zlA+Qg7S%D%O@n!|A|I38e~N9vR=dq?))6K1e63iGj}U)x0Z_~4&y*mIzi5%Uz;BdEu1fw@@7 ztNa^NjJ@|?AVb;A_K80C1)NmNjD)qP3%bpxEW)84HeU|MD_$k8Ec0)9)#dEdo<0#P z2%r`wG?&HW!Q-9c4u3LE3KP2dSS^X7^p&=tr9Liz9rtmDaNpeidM4M=S?sjGs?N3k zi%H3x??qo|8CQyw`q#Oqv0VCj_eEc*NnnEr5Jmcw^EGAOmb^SXVUPkQjgm*6LY`MyQn!4Fw6Kj|-C#OJe-f(0JsLUl)_I00dzELqW(V?~xIksZAli!$PQ z@Oz#uJ=&rgueE`zVAlm+48f(zJ}Nz}8{a?bIo?`**XUQ>=gL zG}a~q#rYpKq)G~L=$o->^t98vn_h!qPy?lfL1B-xoJOx88vRerZr0LXK%s3-3cAzq zl}cz_)1OHb)T_BOb=qvus(B0OulEaL)QVp@Q6(na42+D~hd-P+pXHGX)dk_`O6$9S zj_|N~Y3%h8sT3-GlEKk0+L1~iXZx{U5?fbYoMmsn^-G$2Rzt(E3~fUe(1!5A`qVzQ ztTgSzY96+xS-tk|oK)Jnd^{dfZd>;C=mJ0d0=RY3E-oSnCz&|e>0m=rA?SGcjd>w< z>_yXuiZV?f!yHuY2v&YM00h)O^nO{33>%KgV!gFO3z19ktY9>|=QAf-@ z_{(qTmVe@hQ*UixTcn1(#Mwu@baP%}+kQ19g<)wY{RD@c-$YYMUiY$}JX z{;#-T&~1b9bKA_~<_!Lp`>+xLSCvfM`NQ&tRL@`h*E-lQ1yqv|GhS&Epd&RP=^sHd zv*iMnMZa4`C$Er1u_Vu|09|*L>@R?J&<$>(z@KlarZEY>Zb3V35QIFvg+en=0(&)gI#=>(p4MXgnkCv`5Y$1#a;%Zww9fj072(b7z6TX!39c?*X4pEVPL#TSe~*eRl(4E>8@d z*uCchSLakLVVeFuBsXf*TS@rNuJrZY4Z92;!hpDCIgZJi#fP}UkyTA=Uv66U(DZvG;6d)j$V1}iod^}(pM z$azUkb~;*?(Bf-V7Y=vN7cLb&6%KJ0HVuj%TTQ#i4Tlj+{Okk=dbtvibYtza?rD>F zh4-Rv^Gg*<9?Z4Ps<8EFI>c1hl-uiRwKvV8jmtdSfjx@fT&tF4(sG_+GU-O_O@S3x z>(+y0?TM2nbMPonhz(n@FT2yTI3RnfHf!;hLhSbyqVb5RFEP_4kpu_P=}|upY}KdZ zW@#O&GYS{G@hy^v4RZ4C`Hw?~1muGxcuM9_89)bc;&~0^a?_)gnh;xCN@{Q4k9&V- zZ%;5jt%-Vj)hn@=phnGM`~AE9w1hiaX*B2bYfm^VCjk0@whj)p__c*0-^|vi!PhU! zEbtI}vok6V%Z)T+v)Ot~MX04Yws|fdQ^+rDBCDbKVYs`x{@Of3X`e(Fvvfq~jF^!|@G@qv0N9cvl6KsN`t!YbIFPWqr>ilAYLY_- zYr}>e@}U97Z897kt;=LqTcJnEgve-P=t>Hnsph6jY~e;C54(5v-T=eUr_X4A;mkH9 zUAFdUa4w|5IRtE%HjtjBc z**o-~)Y*#yp7Id1qp#(cCO4Jid>w^%3Xn;Ws4T<$a<7=_uwTDRa6mv71+oKo<9%k@ z8O$6mo+p5;uOLB@G{rCpendB}8*9?5<|5|cfl-jCGu#{($W0w{J>G4;?Gm}npZjJV zpi9~;98hvL4sy(7!G_WNEWAzI6>MPG7;ds>SZDQKzG+IF8%<%CFMxa!+B_It z7?j&)`-d*LkGyTTY-Tgj;#6ILn%;Pa!ZL6{g^7mVX3#tjL`Uhpwg4uIpr&@=Z(u5> zR4(fIr00Mm=lySOq=rT#hoI7exyKkgHX5ZaK$zH`-i=-)T%{uBcq#}oC2i%6{;C@@ zw3mZ^fo8(D=I^a(L_1FmnzLWhg(VF^-CeO_9fDd)ZXDF5!k~u%+#6Qrd4zr%i6vEe z0;vr;?3Sp)hw6l}*7WRd{`@Z*-Pk`Hic%ssq<1>R{d?c@t9a&=H9TqhMrOdnXEgVj z+keAQuU!rpG<-(b7fNTf!HtAfHE|~vnu#^bftGjq@Obp82u3b?oxd2GZf%Xn8#4RG zggrz(xUCZQn?n&;-+|b%1ZzCd*B!|eSCx@ZV(OT%3>jvpe_X#NTqXbI=8egjp)bAf zVOnA=V&8>Hr4XLE0_(*U=uaG1r*C|XgMSozp_!B!;V7}(ju0=vr;eJ>`c^~ftL5Fd zaJuvE=30%{bJuS5G2+tgI;b9$Glwe7Z>}$fW1*T;>xIzLSI-PR@o)04Y}W<+3dTD0 z#XmoDd4CzSNm#Y9p>&Qil`Oi=>VsXYTsK}2QdyJx?cp|m@u>*t`P=e2!ch`vB3xgG zr`4n;8T6!tA6cMv<+Fl>3Uc2%5_Iaw2*b#%q^b%W(asIz73?$$QGl?;fO1!cgUrA| z^xd1X(ULixmY#VC=f#6w;wcl@8J~cS32s`VI<=^-Wv%T3j*gg+_&d|q&&u=n5BmCD z>%Y8>GDkZ#2JYnZ$%axYcU6LYWX7lnT(8e;)Fy?_wIhs#VWXtHlhLk2SC!;0#SCF# z9SynO)CJq9PLZ8Kt7RIsLc(nuQeOeN+QuGh7=Be<0cQ>@pZb%rlI#}SseFVVQWZD1 zC?`SvetH2%YBzuJOb(xdLw_StrxB|oIA$dXMIP?9m(flJvA$j=F_=Dspfl)RF}}~= zWier!(+w$7$%nEV11_Uj;F{kOuF)VVr zW~;=i?@^J#L}vaMoTHfyr&3YH0W0P`u53w=N)n?}PA{U*Pf6&xZYl);_Cq9(v1)!j zLS&br5RXQ#{m{c4prAO$RZOh>g*fwPxhN(yZ`3372hNq_)4^(&6g}AZT=38t@qqQH zLa!kJXbtBrz%$#NqN_kzQEkQbftuV$KJ-0N>6Y$E3I$!i_OVL#nha=Nfa3 zR({YrWo1v6vy>^G>C9Z8eyc)S8IR|FFRf<~or(EdahAE^L&^ird9@FHul3TS=)=t@ zgjt6~siIW}L7LzB#sruALt-Fj~7*7#}-&Zds~?^2oBw44!BK3JUv^R+7tA(bb$^ zPqbLZ^wYo5=W{2_2$|{tiA0caiF=%_*Nxa#*|g_B{TYeLKD`R5u9minxcxe5+zQF~ zl7&&eF3uj0D_@r#0ps{}Km07ot|F#b=6hrxk@z?5nIzD)ElR$uFgFq&=v@tX?DTaL z5g`S&(>O~qne-+$7P1v@>_9iwp%l+d!4ifSkFa7{p3I6pQlLR9-y!X!weNjts!esb ziG3loP4e^BFCB1JQ99EVo(B~74gO?q3ZxTl)9hpB%+GSA9V{y2Q883ettt?}#33SB zF~EDP8Mh zA0}M#%H6_xmOx6*T{J78SFoDwM5B5lFZC4#noQ?sA*-O6qP_ZBo@p3BmD#BClbEitw^)yTEo76FFG1`lG zLs;>3_h0h|)173;rBa>hnB;X#_2A?M= z1uHg|G(8041NlA%Co8;LDyN>Ft<@|3j%^deQgu2(b<}V}I6M-$kv3ly)zu z6`XhQ_f4Gf?cVsZ&QrI0Sne*fH5u@v+(NF}wA50KM1@M@yX(g~#G^cw*^>g%y6m%$ z`g7B|*nQPXs28N6q`@}hvayKG3?NZ)bKKuHqpMC+KcQ=U=8}lL;~tkp0KRtn+>N(< zRqSHI(LkmfWWT77Zyhk5Xt$gMDiWLF-rcEtQrYuOKL5cji%dd}2jVQZA1j(H^bNOf z+^#js_swIhNGw+(%~g5!Ba{0_y4A=2|HIf<$3@+B`zk633aAJONU3xwDGeeb-5@P3 z-CZIAN{;l${3k zm{@2vlQ;huW>`cVx3A;@cq@i(OP@WxdP7qkH1VL%>RZKQ;FR0q(?!izJ=xZz?Vsqa z49rWqBy8Rfm+qoN`@w|W1Z-tl3SyQw65ag7P{D-0vcaYuk>A~4TkkLE%e(Y;m5wvs zT$~9+2GCrTJiGcU(qie?dq!QehrwR2%TnxXS?Vpr+h5;w_)f<|mN@^Ok$=(@-K~!# z1`6I15wWQ__jjy)wK)1gp+C=n7^IwS9oiBd*OCHJ6x+YIl+*hXeEK7A9iJ%`lyDh* zop13ifgSR&t+JZwlXm~2e(NUS#@!Cz1F{G@Z%1-I-X=|yn%KDv86G;bYp-*;*VmGu zbIGfH?PPsUJAhC{HI@6OoW3&iyCm1!dN$kI!f;2K<}Wn08zbO0m&e>5rx4&3&vbI95?EKFV*-69s^sa& z@C*UL^D8$Xmm>t{Lc+pLPqBcakskIorRe3-L%`deC-&AdVJMx0s-_ z;QdM`?~=&&HS4ohV3; z+(w}!58S=2yFgEO!TN(j)Z^>Hheq4qfuw)>Q*EgL_{jPPd^`jqwYLz$)NlEmNJRR8 zU`WT*W4rD2|npy$GiJH}hXU zADspcjbHiE97}ls_TonOo5y*NMc6WJ-%Z)6v9mb`S=xS7w+Fz&-R+>I?(xqRhk&;V zCkED1FFtzb)$ZaDh+e9IKw3{vsR+oPId1w|1ognu{-<_AAe*_uqj`g&q#x!Kk_BH2 zUIU)A1)EG z_?DS-$8#ayhwYwrGV^}h)qnzKfA)dw2x}@ds^@F_*x-iCx%H!-=j>!m2>?hVpmbRr z6T;>^er^Lu&?3*t#u7CNm|G$+K=OuZJ-Ul>?>l73^~<2#f(R3w8y)@Xwbp?aYFWFy^JczzT5(s&JZ4D&o{<#8GpCeD0o_pXp*nyJA78F0V1Gb562KK+!*HY-{GQ3Dc!%ybqb1%9k4j{v|Tzi2e>l8)pGF5 zfeb1rM%I_tb@>B<5=va>3!H9ufAouCu79!UwzpdUE=pco9a$Cr24L7nb=+RJwrdj} zzni2iM@$1@`mhy4Ac1j{h}5I%RPK6r@b2?gC^}NPH8jJQPnf6+VX5QtG1T)jFOTGk z(#nXKsqN$Z+IoYj=6Z$-u|*NZKf7HjQwoye&%P4h4Gn6 z=9U062nKne~3u*nRn$UunjY>UOdG^%0FQ zX*xQG=F-Kw*q(nAo1vomxe7!izMk6YcpM$KW{A4y4IHM+%H38oIa&oJIVXTDt(!9g zls)EcL|zPW{H!p>Ad7lOUTz>By7=(T%mfG8y=3(%C$Z9HICtQR!qCD&*Zi)8mhI7rnED&(|sZ16< z*HmxLezQVC%jZczpE65}6lCP8aL%4U zO=RsztjJyt;N5-q_0p^UE0fZQy&BH0^E~@lWYU0b)EGsZNe_av$l%q-=b!E=SNrHU z?;&pzCW>ZRSnX`~Q5fqm1cZxNrhB42w?$b92~g2Bezv9kq(&n&2R?v)<(Yg|XoTa} z6Q?U_wsFJdXSvD9V?$=ehqa?dHljp+Ky;jU-TGiqY_!ZMLBMy7MrF$iaNT>EV4@hz;Ve?o;3H15F z-9b%}@BQyRY)jrii!{kggAQ_j@e}qEm&6d_uHfI-ssHtJqRnZ;Gu@+A&%TC1F_F|P zCN!sae}L@P=vwV|U)ah2Q+{873%lHa! z&bHxB_5g#1N zF0XSo1;6vEWJPM+d_rx@G+H#FvJBwL$FQDk-BF;PXCyBYKoYb2NoM#zl6nE+1%=IcP&wsLD8P_mV%+Is6U!(L3V{&9zPj5cQ0J71%9vo4^o3nf8zA5X?9b3{U zTd!$adf#lZo11%E4)eUz#3i?d(5vBH%p?}&49bhzz20>C*$?Z~N|z)ToE7qP{9U?k zwM##p6^mooSYIplRetk1zCmm2q2>@*3JKnb^z~#a!2333ibB=zWhN1h{`*?fUXa9b*QrhY{Bsq(qw^zri{T)y*%BcH?u) z1~h*oftPQj80-#bA3Q(QKTK-w^iZbJYBFj1p+hg!UFIQHZh`MS|MONequa81R{tB2 z>`%h8nANuT=Do&m^>>)9?GotVePNZCJT~$@J{Aa}sCwGeM<@I!2?%w4;(0H;o{6q2 zB5@^5XFT@&rm2$fX88w9Z*k*=kmM(+2PAhb+&Rl+ zM%qQHTioCW%T;qgE(c{M-4i=6Aiaq?V~IdV$d4?-k^5#txOF|_4s@}8!-IXsTElv4 zFq*Q~*zgj|@CQ?Sp+F{^gn)E(lJzZasxCqM*rWf4u00(N9(OiJSLG)&$JU8~fl_|2 zvTFZM^Y`u2p3Uql_jmmQyI24Ku-mW8ABn#!apl3S+lsuOBzCYx6q>U);La}{KffEC zpLB2ihRfj5$Ul;mGj(a;(b!oVQvJf%vx0Q(Lqm`D)jNZY+c|Zc0M1|*&YoAt4+Gi@Qj|DFVv&b+ye^H z3PW?GB+8j&$jY1IyQ@|!v!^R;M&7M!-~P(aTYepgR^n}zgL2@=e&our1tR5d{G{KL z?4bz%{9Fr4S4MxLS`|bj#7v4*p-IPC5IPh0L0_en9yxS6yL0cwDri9O9l;|6&YK@5 z15p=+ygBvFFFqAu?uOLS1 z83;=HG8F??_G?cCtGQ0#kDW9+^o#6Ah$=OfH7Aqkj$SE*^`;2)uNaK(3;DU}Seg&+ zqnr)#xDSO6V7aEk0S90h+t)RB4>}&mE6OII%+Hy7$1xeX~I6 zDgWnLnjAdIA4J$NuD7YfL;m`wgfST%NGB;n4E?*Y1ksI~X3KY?S_tCbhdgkjbRlH4 zpGN83<$3TicLDii_J{1vG3N}xr`V%-qUO*`CNwgJ2*CXtZH%f{=A@| z*f-Ppp5f)#6^04SP**19{Ow^^n36-0rpTCWcXDFXw`PSjTm!_kdLo_>-qan5D}gHa z9CIt(UWoQVLUddyb<$pFL+HBX;9+*&5j-InbtzHZ!vUy%?gA=qM2QxXm5mXZpjM6^ z*){Sz)ZDJ_JEpuCgj!e3=aebtmkBCHQ}Mn7d1Sz4*g~xx;rMYtf$%ZGUl^!5112=! z3_>%?lA8K9mZx$b+AQyJWrE;ve=FcsZPBDgz4ipmwPWHaOl-p=mrlXQVBkt7G1aLb8*MB4?1+K6efMb zC$VndzUCXtq^#tDrF;dS1#1;+l3>FMYU;@fU#)+{rFJ1~y-c{L)$R5HIe~v@ew2zx zIEA(1V+2<`#P}kh{Ro7!Np`zUrpUnd^ZG{3d@X8<=Z=|&z0Bil4MgZtEoTj$mD)pf zq;w%ozND7H7*a-QsxhGP(CtIY)&lR7A~+ka^+W~1(FHE0@Blv(2zC9@Ig+G)3y9dJ z9>nZAOnBh|nYkJt_xUVWs;K*IBO136D^AMz+e9c~zYmB23nX|$NO)y|4)0P2{Y^^b%=c(%1G3)@X5AwrTRvCMetmaPd@|J>UF!qe zbS*c^G=~(IMJxaLDduCGT$9lH&#xjWNzYQ|hVGk)S{Fu$H| z`8#?B`2>YArU6_YzM`bJxk+!K!%%e@6B830Hxi!Unk2{ERj)klVted;E<=&GMwX_4 z(0xRHpv=<>1G4PBQh3lc6V|{plBY>RlHD~@2o5Vc(izRy?iX{Qwgn2qnBW+@>x)|2 z+7=iPRnSI3DS7Ru-zZ2NR!?U^AF+g!b5$a%fLNzVEbXq7;O=1TDq6YG=oFh#q*Iow zQKYZ)v!&&l;S2kS9*rH73+Jy%RuefoWfu1+C@6LwP9VNFt{>D7BhwUa&&22YtXN5O&uMQL&i9b^x3&%H`^pJuvK6%oSB^|zjp1v-( ze;_)zV*L|bYS~YNIUhwbFqKkst&n&{r&9gBp&hT^ZYA`aZ!{8jY{hX96!|!Lh_Y#ui1Mkx=SX8rKHtC%Jn9dSVo%II>h{oms z5~LB2M@Qb!mSE!r&NKfk;kzZt!Zyez5T_CY)SY|&R-FIQdx;tRI~_g3@~>X}*OdR7 zH!$*_OcHcuJEAUI5B^$=K>b@lOFsH*fAQYGJ|2=LJu?l_cWNaaDzj9sIhwSQhU7(k z`UHw+)9wNi?koWkdxfam+H~+Oay9B_zh)k$ZRup7fmA{CK)u!k;D}5>Q-JE|T;k^k zu_8y~rZGuL@3w{FAZ)}X?OmJq9WSSUcGdah@9F-{`RN>A01Q1{#b4)t z7>@M2Ne7a_xz4?RGsgJ8Pwk&?nJNT#I@sf)(^6jjwNP{(KuedE_QC%iniYES0IG3W@%DIkvlz$*=L{U?$u;noFJET-*gr-!eR(WnHvj80xBrEeF=(%!#}>`LGng9IH< zfGBYh?(dDlp$9fjLWGg?-rrQr48p<3$Iqg#-&^V??^s{Sa$y3crn1Y*%Bq!^NVBMA zzuv-Kc=umK`**kBlrZ}o*m#k?*;Jz6Kd*9!4n#qq{Ke-Fq5QwC|Ama|F3(hAazya& zo0wmjB+wzrRU*0$ShR#p~Im|Le_;?ALFa(cIE(d-*>n`0u74_<>zz zv2jU0`aa>U*r#I|kEFvsT?{5vZWQ>~3)uNg)>?MDL;wk7`rd5Wu|NJjHHl`@PvJ;o zt_C1_>IRyz+WG&p9slF~bi|jU4LzgO?{TWU0mcbdxvtgjm%%IXRiZXOhj@gmF$1-3v}2kyb{>si+NZ5^!FO? z6$8&_7~5*@|7gvhKLf_D93gBe{nyJgB`yau5FH)GRS7T@t{9TEeY&BZlE#G?;rl>eYo)k zxcateXaaktPn>vv_Xt*_8^!?#@6kKM|GD#@|AHXELhQ%IHvb+q^F!eAR=dkG=YO<` zbn8I#GJEO2C8y`C5_GZJ{~_t^ToUSfGv%MDnn?n)Ap@;`_(!7qebBDp1j_-fzj{wk zv;Xey1#lG}hldn5{&lVYC*=W~`$7ijy(%KVb^WjAfeVblepaixJo=A_hnenjkvf9r zxqmNGhw|kb!r`;J|H;-%(1`;)t%q1S(B}8ZGT#G~&;FJ;qWd>7{;$Nx2@E!g#0BT~ zU|%R-&P7yx>*jwnb!R{%;PLQ(`1_WX_|$G zgyel@-oT#fdOY*dgnDipm(pJhkgl1a&}{pO*HFEpBz=|q@?kb|ojVz{W4<4*CvX{Y zs;a625^dpv^9?7bsVDY&sl0YWi`A*ov6m|ZzLdEXKArzZhfHPs`U^1-*mdWJZ@DW( z!LUZS#d7KiqugmZ^ij^EpWGWBbsjWgzHeSdQF1_`P&FogEg{!xp%(e)&WoSwF4}Gm zE=+T<=2Z_D=*U~AT$y8m@Wuf5QMJd^QsYH3Q)7QB3m|dC6d7#ERb>#;1Qs`*Xlwm8(dC}^fpItClhc8`e$rkg|NBt=^JGpG=(4YY zDcgLlPZ@RUF%k*m^2tw^XI=7^@~y#?pbf`fx0!XLM)!(1cAX*ER-+>jkqFhuNyb`a z9Kw}s82Uvq1*uMLD6y%~+tjSr@I<*t+1ffv8N&UJN@5sy+CHfc6$b=Rfqc=MRf|9k zTDd8&+X>6PDNLJO_0v(lRrsb2J7=?|j$|R17kKF<9s3v_{FdeZw=*+9eiJ3J+$3I= zWYra0uUz6ba?ja#lY1!JB(Csd4YPm7S-F^MZlV0a5me*Rix8tXkC7T(b=W{W^Z8%V z^eVI7)Di7=*1J`ed zqcO0|SzmkZF=S=8pQB~X7E98$4D-{iJ%xHI( z9WrHSiN?y{obhv1o_Uo`MGr)Q8E&<$uO`o$7~!a;+_6$kEFNb_ENa_-Zj1G|NZzpA z+)JGZkgKnCyJo2VDo|nNy(OLqQ;ShROHtpcOD^wsBP1tDhwI1VzeKtY1%Mk_yx929 z?(mKv3 zQ*ijC5i5|tA7mrs3K}!?o6zIf{}Src9jh!tvlCN#uOpSmvPj>(HU8+hgtm@LTi+jS z&}T*G(wkgS>b|MV0w^n~?z(KUii+_J@`+uk6E0@^2^>S;RUccK=e{b|t5RyRap!Mq zwTnGj_9y4iePV2EJoMdIN^tW4o-Mc3r9{5H@}Uu%@X-KYE#IAkN@>LESL4MpmF(+r z4uNDA#Nh+1SPH*gj82*56m&|j!kS^FLRecafgMGy-j5B1KFCvtt?zQ^Rm3H5=z5}s zZvh&`a?P1t@oqucq&HiH5C)(ZHuZor)nSHb&s3GH2P7ynCdd8BxD2OJ7UE??+7R{( zF~1P7_r(uD5qp{S?VDelqgJIYf)z*|9DRmH5==Ds!FG$-m@-^rcpYZgXUo?v(5e93 zqEl&Gb0%n$U^`Pcf$IkNL_LHW*4MfaWGMTM9n>D^IPk3iNiQl>C#y@mW(ad^CrB`e z-5M3GI})==z?~z)Sa3V+pIQ8$|K50$*@VZ9ojEG>ZFGK@K+~N2E5~_t=c=IE%U@?1 zcB*scOEvB;IWJ%8oLJdq-A-%lwJ+A^)|Zp{NWHm)adP=aFqCVp3+nf9m?_}UDb?t+ z@<^w){dw%iBI#2gmD(h#GZ4G<2x1AM?`tW{IkS(w$0BgX$+1J<@Kcj1(KnaDx7Ypqa1rHN}Weog>(0%>M<#-89i8Jq3%LjxWT-#Vxu-6di1%BSZ!k{I`z^jz$J73dd`Yd?_>Q&r0R%O;>+5U&C9B z{PNg*Hgm^cwe@ni9Gq-=g%QfW8JApk& z0bgbkGN0VTKGycT@Ih+)4Y#%@g3zBj^XZj!o}Nh?%AyY)J7_pqyK>yRu1_awQ>9t8 z%Ez-ZuqANCo3w^?_KPdWrr4w2DevyekSqd5YXy(mg6rJkr|+^3Jbyq$-A{`fJ%hY! z2+h_itod4(x)W2b82MO@7Jv&=k596>Y$a4(lKPLf9i+g0!8X-(3OM-JO5_?Q;ywXD``cC? zTQ#Nj2%(eXSmn)U0H7DUg{TFiW-;NMNXK)xqv-{)hXDu4;T?-yOr1J*Q>Xat z@H;KhC{$|=VL9|a5K3iDo?I#FOIr#i$MxAhlqWgbaP|;Dn5Src0U}_PpD;4E6|LXj zC{z-Ma~k>d^6eeznTk;NDl>I_Uvb0%dn@YZxNKAt=P0GU8O*f#e2<~7{kxBeNlaR$ zsIZ^g`v@HHLc1~u&qvg(|J#TFM&vO2<;$0z{rS!PScDVAFLAQc>ajXwfU#Y9(B)R4 z_vWgJeOZm8FgsGH!+{oe7oxCdZ9y8W>*eD=2&yPUViARY6Hc-j6-HwDWKoid_?V~M(ZNHI^Gkj8@8 zxO-|9sVhjRuTaToNaa7uPnZNkc&hML_SyxI{+2IX(>9sKFLu((Z6}6= zv(yFE1=tPFiZ${y24TwN(}6wy{URJd5s7bUL*Dz#9Ng&Q#*N|mKG#W8WI(^xOIO?u zJ36@8>5yiVYn%Je0Ln9}-L`e-vKmf8Mt9VtBBL_cq{T1%BHbZhL#TaqrQE8qBT@i4 zPjcac$L&@JMFy;!X1CX1-rYRdJ_(Smab9vwvgHWhaR8}C1HFrDj=WF&mKD^4_aCa~?DIGTU~f!BQKBI?uHRu6xzt7b%Q#m(Y8mE0XI3v__3o)H^_;2> z)oEpaw4@g}=?}T)Ja~(W!M~rLt2q!&Q;rQT zrP;&5>$R!1Q_idJ?=t^ck3>lb6n)+3UG@lt1%t7KDy?;T%a7kprTM;zQ6rLfM~5qGkTgm+RfDr{lTh2Q#<|6-zv`TprCRE5q~lOpscQnQm*7l?^gZCxuCFuUQm8^>du1&t)zJ23aA` zH?_WvN=M1cb}gLW=?}Zok}@aksys^Jj_bTbWf!R^l2W}o&(EnoGbcxs70$U@1Fixd zbntpafKE#?vDiS1rOVbeu(Vlk9%mE=#lU6|2ClmH^)nUu z+NYc36hgL1w;%F8NBA>!tkQP)&O^oaj;7M{a+F0+J{B@lkdiL(6cw%3luc@5@NSs_ zCLb*&;ROYoZ|Jd$`S1##+T3_S)AiA^^N_luFtEv)`&7FhEz*~-RSC5v_NEw)-%~4< zyS0`z=DJE3ghv?H70*^fY)*0YIzb=+z`fW3xp;=_n(JaIbbta&52NlJ{{V`1O$3Cr zwYA}H%}yp)V}DGaosykQe7wo$yM$cRhyZbUYsThQgq>`cu6rviVYEJnq?K#3(Q^76 zQO6jVuF0#$>QNr<+t*;v?c9w%cAjZ+QgM!@8Ft~O3X~Ag4|i3Zr9gmxi)4Nc%)!Igs2t!+r<`4ZBf03`==NdudClZ$SL;d zB%yUc)Bc1R_G>&a*p(~r5d9V$%Ji!nv@K#h7MuU7V<@rIU4ME@O0A;ZdV3(Woo|P; z48XAmR^ZfoXZQQj2RTvC_Bxi9(hN{y0Y(kVebf(*xv*9$$E6kw=4LBh_cqDji5z}* zEB&Q0T3;$H3m$^$);jH*v?P1(CzjC|+W2#Y^?26irn;#)QJ{UYrm>Q#Pd3F*tB9l1 zU$=bos9<~SFrztf=6__HYWHH&?$qJOdbd$jh35PH`Pv89{t5SC-oT-!?r>!_9Ockc zz|GJzkOQyLHcyhk1-cuj&=UwZ1?(7C0Y$<3Gem>=x|U#tERRoAIA@(ot!qt^@VBYI za{=%mPK0LG@Q1D5x*QdV`yN@|?-;%))UAkd5ot+Jzv4Jmh*yVJm6N}OHiy+1fLos3(ItNv0dkCLE z3(07oynguJvYx}|sn={ShF)%XC+o#tGh0B7f-=`l=fv`NGt;n0fXCjn12EdJ=e{m3 z9)Qnr`a91(piq%Ay1y|s3T6do6vS+l*>&s#4vD>vNf{T42{xhj{F)0xII;|n!;|RD z?~>#x$TL_oTQwaH4nd@XT^Ia>gk|mhO~Vlv=cXe$ezEt&{H#T)U-56tkrLkG^cK_N zjf2|lwq0}XbD?_K5=Hswp!oF)%FQ>RZ5k%$YVB4?rcI3HJ zH*dtx<)l3bnR20o8 z#orxw;$x>d@oMCedF+X3PGf%R=%ENn*Ty_5f2y_-rZ{tIUgh@YP?wtOxyR|=KO2@n zJeLqdtyDt1+{+Gx;fgZ%X8fAio*zF{e+D%7yqDd(6evoRMKm(9;%+jcMGZe#aVoDj=Fc zGFi7hv$Z#U#Yo*_{D)l%|K3O(*Lf&tcY&!RsGg?F84y>;>%7WD&J_amyx^j<-=am> ziP8SAA3Yk%tFWj5$awi9K5geUQJ;zRTUua^V#)2ppW&0;Kc&NM-4xQi^;3jFD58YP zwB=Bmv0`jlmU=qu8n{+mP*BH^ihKB@XQ&`za|H;Lr!Q_ei~05I*Ric7fQ$bDis5y& zj|olFfr>}>XlOWjEc<%gnAKa7gbV@K25PQvT`9VQB@^oFbya(_3`^Nqx51gWW_g`& z{lo-RF9f{vtDKjUV62^p6@XFu4rzG%4r=%gXPSqBbEg}nr%Qg~l48Im7=skC0TdGZ zvdDvmgbATQ+EYmw=EJqH?Zz@xy6p`!L~0bB^%pzmX#Faf@`*h0xT@?naD(xVPD#(; zFjP-uk-MTBTF52P-XC`)58XOB)1Cosdi;F5`NG<|{^_me-K+UWG$W(NmC7bbrh81fo!66^et;V&>`s4^S;be3}Dhi&EeY-*FDosuN4ZwitX$3iU0q>?2Zf^aiw#~+>4$1-eF$b z@z=G}2t~QL9geg42It-xg$t9Io{VjlPot&gY$(S~Hwv0EKc6~ZUjI6Fy~^Pun}E(7 zXD5vObW3R}@%0x%pp%v5dTz5BejZUTUA`xT7FwKh(C_yWQ(32Ch)+dAU@2{{Lr)v9 zsxy$5XZnLzQk5j@-3ysss}$<)pf-7XAd2~14JJ5_N|%B!!OoO@{m4W-%F_NC*lq1s zn3nbJ;e(k}RA+|g*|Wj-CTeOi!$k{VIX$TlRnxvMnNsyrmsF2nxV|h`!GO=1D z^dcz{!01fegm#I0xthMVgb1f(Yxk$`xgsHT>wPaQ{DN+9BLcg`E&4#Ql-a})tAYoH zX{dR=?0ik`ikj$tdpbDLTmL73pNM6KKVypmXxxiQuSyJlaZM`dIWNG74K5im#&&R=1+}5*GWGMp}j#1 zUFWn(-w~UVK8tP3HxN?ylN6b}6qfKHY&7%s)f30Lf~!=E{iGPXr|YwL4Ok+l^^QXB z-Ts%KSqwC^Qu4fn_*^VD!?gK3J#NJ=9hJ#-kNf1Ajf%FMUj!;_J`~6*Qf3|wcrO|2 z(FM=g+?i0IgNJ^TC|=a0+g}^w?;g8#G`W2=ihyR#bxlnsBsigQ{VlHn%K<_s5yUzq z6U0s?)IVfn(%d~;$~UF%C>ZdIfAWMj!8nbz>)K{_4HwI7DF(AU=2DSuZmZim@eJDbOh`2H8VO-I z)WykxC35I7TBgDKjs{U(4z;_uRQFw9Bsa4f;Nox4aZ@T5?k!2Q{c>?p zk1Ho(t4>aW6c>$Q6f=X`jBz8)AIr+!cu2WrQslrwOUKA{b+bifeEx#(BP)iD-(oi5 zA{ZelnL)&+Rkf57nW6(I+Se0M5kDudgJzM6zf2;$1*3*Dp=fmBm#R5h1JZ5rk_wvE4~(cLYPk$Yoi+< zLss-Y*+p{FAp=_HWd)C^yf?Rv-HheJ%EeI2hA#GaxAtlbn)`jI>vK9i8B4wowoXse zBGK&5wdgvU>Sr}&W2wc|BpxPN0V?9m0VT1{=JjK?!W*iE(9IwLizFK&|Ef+7Mo5UI&?0Y(~?#@9lAapFpJ5ZK8sUFJBl0J6|76uU>~z0 zFS1k4G%ZMV>eN#?-BvR6>6GM$v*YQyL;)h?Bh}Whj`XTEpL_#cl)b>Z$9y?N6x$D0 zEFL@biax+-7EQ@b*rd1OA@W~C%C2Fzy59L7{r{mgmGK)ie#i6x;_f39(w^ZdN6Bv; zXAjeAuS516Q+)lljtGe8tck6OYZiJTIaQ7w0nN#g%op&DK0! zRxZpTIb%&I2(5A)0DmeAzyTxM9}{x#!c>8{t~EE-%#g0UA&fCRID19)$*mFv5sM~w`20nNQ`v{s zU$3$sLk+fM<*VFkG$cxXp9SM9re-NS9pjxFdc^+(vDoRhg%Il&dX@RKP#N-#?XkZC z2(QiiMH=OcnYTY{`o?wX)!EEXt9o$2!U|2b^Y!@~##>ih013LB0rN7yb8Y{?ffoH5 zYk!O$JhTb1O<-YcnjHMt(2gXpE`?y7&Y3nrSB*Bx8)?z?ddPq(S3q1f4M097PjNgZ zj@DKN%<2DNmjIPC`Jr87{V+#4>jzCi_1Wh6TByqP;e}|iX<>vrVrMVESXLooJD_T4 zbAP2bb}W>5L^^|vl$7DIOe3l+GMiAZ zPF-tl)A*;XE=}Fs~?{kq6Z6Eer~h zv9ugjwU))}FscB!gU+SZ>cbCoYc!MdU1W9l#LnU zNJCGWTjd@5z&YZ?BGvb)X|zB#Z^1#!Eq4XANC^ zwG=IE{+rzIAHlN#P1y`{kSi}pe`0S(L1 z%ys#hGpWPoXgK~{F2O;N*(gaaaPos#Xf-6yDvt&}Ej90xmMGj;~d0&83v}Lmt zSB$SZDQ%g^>|&xZK_lR8g{bc*e1#+4W?AgA2qs@aTDI_o*FKe=Ejd=g;ukfWZHG#+ zD%yAhV7 zQywyGn%1p-;yuGVx`e7JxCS0kMV2kmeb01j2B2$DbweW)R%b@q=eCf@vAkfVePS~r zfjK#dwb_WXv|@bsP;S?pvAW;0LEMXj^GI6Fel7Iyvs8&(o^-JVw&cX}5s?7?c)<$P z$rv~@3m3OSEeAJ%DXA%6OwVrHEuY;Zb>T!_t+q&0KSivf?{u{u6?d2u9{O3UV8lal zN+4Pzu{$~bNB5RQu2$~wHk@M_rU|uG^=a&Trfj4xnO-k88RfJ&&}(76+p-6M+3pbl zCYQ99vHTV;=JUfkp`}yl-J6UOF&n#6dz9c|+MB1$n}UFHEMoykh<;y@6n5c81ssui zUaSaQz%F)wVG!+^*T3eG)$L{eWay(3)-cf|01qgLZ4=n@faJ=E94sT*hxovtoZRIg zRO<%y9)c6Kk0OFe=l585j5S&{sRyN>!esO9hyKCci_Qn9C6wsPja$o@huM;ySFhpS zxUFs7F5``kp%xawiuJsOPoW$!JD>LJeZ8*1g1XH!33AwGcg5t&xHTJv?07XQknVl03Yz&593@>5U+qLMs_S)!C0z&UA0WXVZ6zH#(0 zyjxj$cn55u(_%kok-opGX6)Xzatqfd&sNOK?FNObX*v3gHaQc4edUuYpD~=Dmu5W$ z;|U55HySsCx=mcZMPyb)tt)eI%J=m9*rj^dPrucaiaUS7_q85S zUEKVjrqVppuGt>93C*<{kR->$@2B+)L;@yW3O^52Ft}Kov*xe+-aT2Kl|up=8Tck9 zY$rtM*$-$#emsXR3@-IbaMlcinZ4`iX;Z7#mxY|r!chD!LJ!66B6z!iw{4p3%o4N* z1?XOH->~tl?GFz?LSFDa&r?J)5q4N(kQ3%T6`ot2fZ-FZg*1X#Exj(JL-C^dtZyh2 zUS-@AH|al2gvz1H+m`DMt!Eqxi=gVpiNZpPwMyLvWe}$9{I7k7EoY96G>IP~l>Vj&C=a9WoyDfD0 zd8%8+j7N9F`liP(@s0<~0IKD18eK89w`+TpfkUQJYb z<&;Qq3uDI`{z2a16%t3kgRpWewFREwsZ>x3!`5EJdVt-Q|KAST|IU{{;_X$AGdSk_UmV10bbywv@fpS)u*M*Z6K{WfA2o!g-S#hd$ zDxb|L_l@CG&s*&`L_yT;n(rl+otB9FOV=IhIm>sG+qlrpHfF4@RKSBWC+3$hz0>-v7Ps;Wkk33Ki=~d`T>}n=`YW0XfJ(kUa9rj^`}q1VR%J66Y1mPYha~J6)Dx-$LkZU zuFV6=0wbg=VAgP5(Sd+4d%_y&85H;x3_g(~4H4{@bIH@L#aKHQ$zYuK3XD{Sp!}$V zddyjAB>^(wqlVXMS-BNV2B|4q3-(ijvqV=2nX;%;tG1Y9?L_J1`Mp>vtusP7*_euF zlKri3tazd!0d#Pv5Y+EX>W5thg04(!3$69sRa_lQ0N!$`PE2F{d;zZ#4(!>dl1dE5BrH zwLV+jY3?wklr19g+AF3zt3*<@*T8x+-`V07HRT{yt+*-_pk!QYY8l%KQaJ>s9IMG8-wE^3Cekh8@460z z$chHMOI>oSwt= z(WwSPDn5eYU^^zjEqNK=|H_T?0|1;$i_x3fLcq*-V;C&t)>-dS=?QmVtp~~rb%v3$ z*-bsY&l?B5UFYi>^ORk~D{56r z)Kp}>T~2~1mz`NjomyLP;jB(Y7?`v4)gcbLz}Xr35O8Ut0g%c%e8Ian$+~(JAHZvf zm_#7-l7zP`as=nNHrI>ZfyV+BnC^IK!?^d{$I1yJ0*gvspf$79scha9#e)5(8Y7Qc znzicTaw!1^`KU(W+0$1fba2ojqq>z-Fuq*WvyuG^K6OPK;r8qJ2=zLfcPcGGlVV$Q z!oj7uF96sly$UdcCk;uPPj%E*8vUSUTOjJvxyC;ZZLa7~rgy6wxf4YFZ7Pk<2+%PH z3BZ$-qLrgcQ$>=`2qUaqep=OTD1@i!0MWpk`8Rybmjf`i!BW&x20e{JV3vvS&Y#T{ zZqKJuJ=T6(J{y`PH)l2EM&1_Snj!4!!ABT*p4KxF9)|PMUOe;7qaZ^(!rL~EZ&G;9 z53Vsj6fRJoZOU_@-jZ0>EVfU$1cicvi4Br3CL2-{pR8>YZ3zbU#C(x{vI`{8>aOVS z^EzWITk8X`)k%q>kT7)py5Lc-k$bo3wtZRq8t=HOMFxxm>D;8dUKx;H%n{jp9|d^n zW~$6zLbU*7J7Mg)W?Lu%a0?T#G|lyTAOMUReM-{G8V(XLtBzmITlkl*tArz;7#rpycg-__B=RSF5Z zH*`D_+WddvJ|97VB6P<)sr^LjObYCMTGl5ducoeUo(pZz7Y@32Mq!Xg;(b8;z{0hM z+O)E(8cAZ;`rP9V+a)_3*mUEeuD~7p@P8Ql3ZOW*Y~5hNJ%l6#*WgZY2oT(YI|P@; zU4uI`K|5F=L4&)y1rP4-4K%@>_cQ05d2`>pb7rcj>iU7|?!ETjOTYCkF3cFq<)SJ+ z0!r~8o?BIdH{A*zu47nUm(yl^hXbj}RRcg_)y-7mf>-~>Hd%nZonz>x9ea!(v*D&L z`GF&miio6`>MEvS*loLh7byPUH@v0;UtKLw)jM21pLe+$C?ESO6I5(l2q)(@+4G2X z$u3k0iG85__29g820T9)7CMOl;mZd2XNlEh`>-TTwzKqAl5U+)_iobRI8dHm!gQM% zdw7!PnANBlC^2-wWJ#i!0LCZH&M5i zwWpVcsdWgD;fpT8_hqKr#6UFzp;`FQD*rlt;z?G`0wO!@$UMU|)}l@CFK8^Y=@_`= zxm`yjpI$>vW=0V?VcKW)-7!>=y%rVuubhRNDe3A>4rd?7vRxgnmU&HWcGNB!b-n_D zE@_DxJAgg2|6XEEJxVl8NBxaY<2k05*;MY}GQ%{+EMt31W_wI#i%n*lu=_VbyXlku zzEr(21eVx~jJ`l(Up{Kpa^v^ccf1~e2JORD2D?jrY6L_6%%Vq#D*EsJ0h>zHg zQN|}708~+oY4rZRXKuH=v~;=A;LOa-YXf<}IW_G$_Tgr&adH;KPdiqf8n9^77Mu=y zy7Of+A^|B-K#j1v6`ynbO>lKYrk@i%<+Wnw0ahw60nZ}&0FXQJB%%H47J=$r4N_Wo zm{>aN;iAadrf%;{Uy6Cj_*S&liGn>66CQq&`6Dktdlp*P`M#=UR=2$XiT%RlJo zBeAEu&G}>)4iKhmzsnWUUu>Kw21pInMuK=bu;usK+uH{wvMZT>J8t9Nl7aFLq?dFf>b>MMFs?jp=tZnr^0_>FCKmNKr*iDSsn_7p z4L;(!PR2(9y=cJ@KuJ6k0Zs+dQPyUqtSi0gp6O;Td#;ntH{T_ui&hv!i1*uW zX8Jwp;0&c(%S&^O&@bSXz!H07{ip0_hzj5%EERcJv+XX!IPdhvVQPB8^kT2MdHwO- z50J>H9vjT>TWxv!+zjn(wtbygS_*Kf1WY#Szj2EwC z+&boAR#1N_DDI5idbc>etr{|M!aI#)QFu`^Vhh${xY*_c^O{fkS}ytpHaEjfOUf== zd&4FRM0OF`tH0r^PhKc4i#NOuCUPSoqhlgco|Qzs^C>?B(}T+O!M&96IuJ&2n&5&qva~ZE6ttvpX*y z2@t%NNH+T8bqsjCjz?L*bsUp{%sHyO9LKUh4dvJ@Q9uyLapNLtbA-7i5!wkD1~@@Y z?fP+1IenY}{*Cm0X9;-+!QzU%$%6o{VyyhEst?_feXirRn(kYPLV?kVzs}_wKjdr$ zTH6p_sIGB5%(H9@Y@-qkdzBYDn#X0KzwbqRMEvF4=tlJ9Rbmwv?BKmFiYkn^YTj+}w;skd zF8>blzWWi{pttBh7(Y0%4)_Rj+s)Q;K1AG;P{%n0<8{-n*o?Lee(=@cHopy-+Knlf zNHXBKxVay9>wMh!#n8{6Onl0b=RXLdNzvZ4V4ZAb2aU!P=x3P*xjvAh@~- zXD0LY^id{z9d2qqWlu-1zYLZ?K3Ov<0CIC((S4WvIm`ZQZY5Qrd$7b0J?|Z6*K-OLANkXrBadVbZf0zLHn3`_TS=2l;@V+m)ID69c{EE!-yg z7{2#Nma`Q(x0ju6v%G07|4_t8s(|%{^RXxQo%Ji0j^oJCf;A7^Fw--{>S>8uNqD`} zbZEr>Ip2Et9J6xQ`PZE9fr{8LXom=I5Gt|-k6&iv;{3|2SRqgCD9uoFk33FP#kF6J zNk&E%-#4wsBvTj2eS3jGg9)37_cQ$Xf!{!zA-r!gQ?_^PPgS4f4xfv z36T*(aAwT#`=eMBsd-vg`3anCSVpSmU!7lDi-2I9{f7}@EDNuVZ3MHb{kUI)w_5?m z_$BRM=4dBxPA>YRJ9*~IzA50hIJhr5`*(^=lLB=UpLFwY1FxE*Nq324(4PUf3$tW= ze1uqOKz%}P&QF|~b4vTAvJO!AS9y?5k~KJ%+g`eFFKBR%{Rdc0i-)zg9Sd-S>iVm0 z0pu^4{_Fp^?s0A;;9cgzPaFy>Rqvz~G9@KM|B;TX?VoGzH>PqnTaYntE7 zV#@QEyWp58SagZFDB{dRvneYCAF`#rX*_GJaJ3+AWMBb8q8YskUWunmIF!oW0;1MF zzSpnMJf0RV?X?J**IUI-X15M3h*~Y?sp;Dh)laIgx;!Y%gO(ao^_M9g3qGNvZu=Ex zEh?X_)pUzvQsWCo)1hmB-;~}4^q9u;{MFrB!30F8^CqwD(-1kIxdHjf>~T2$A=Elz z&Q-}gOR~L6gkg*X(GiXVk0QoYwA^9krg_&Pw*tCzRWxYMOt>JLvF_Umy-738?)dI`Wj|Yg z0mgLV?e+QfwTLo17Q-gF32o~e%j}$(M(w$0@mESNl*XUGx^|n?J~~ zb>w#(*D}MocM20frJqB`d>q>i6;pJUE$>>aC5ABhRhqZ!fSdsPR*B3o`O*k96copD zFH^C7QJS%P(Df(#$iH*rl7J+qS$Md@pMPHgC=hn140&5oEpW=#!wXK_ zsParxKSAeaD&>%`@;e%R*@d(D&ZgAuG>2#N zRtF1WZ`9xJ=c#;9T-wF_!0W^H_2O2ZEn5wq!}?XizDeOycj|7&-TWgi8bGPc6sFzZ zINt%_tL*mCgYcH#rOA@0sFuo#V%FW)c?9h9LQn|&((IOZ4PZM-mvp*AI@3T9AEEPK zt{$87dNmRG3LFQ^%zhs6-mP?6&s#NhUJ)1H@0>z7d8BP$96~7Wj_RsL3t#QrG3sWn zIajyKVWKfFIk!DssPfzj5Un0Nf3OQa!+xF+x!=?gVkx|%FTt0tH%F4EhIV$H#+q$A z;db~V^hfGmu#Smr2f4>u;W7J+08qTJP+)jrC86v#?v;A)EMMTfOz%Z}I9f6e17gxm z^^+2qyfiu)R0z}c+`>TN>Ea8@Zb~`42~OG_?M_6SX>3{8E0<{*X90=bZxnp^Gfu?vbX&V-tlB0QIo+76Y!r`vnROFiZcOqK^dEdoJ!hGk z%T-TCxB8E=jb16u&J(JEbF+sAj;$BDvNT^;^H4yzRi|}_V-5ggBgN` zfs09rY&Mc7-*)4n8_Uti8+%FAn**T&SwC5}skOw4ZFg<8!(H9;WE`z^M))_D2rXt& ztF6j3OQi!B=Qt64AO)j^+h=y3F+77#bvg3aPE@IGc{a6)+>EdDJ#!y4i~hdt*@O{L zPR69?e>P?VjppzWIHj2c79`HJ0=3(!bbX#NB7MF%!XK+`T0hQHM|E+D=$vy|u$|>! zxsJaX;i~d*oc#EqJW6`bw9-<^x*XNg(&cA-p?FF}K->~o-%RX4j*qdGQJ#CX55>}m zp2-S@QFGj>h=br^;x=I~ZcC9ZbH%J|J!bpdWnKkDr}E=%hI+3GFMH`oDFJqJ3V6GM z3HiI4jRPzJ21%C;guLQguzMG`4I#5GKccAlkgK3v%%t>W@}){9Kp?d$o1U%v1?&n#7Vlj*q= zmS)m2{_1wv_Q$kWF=pGfhR&qJ#MUzAo7`)&!eaF~c5e1gR;y)2x4xA({GjFN&T(Xy zN-xmq-*%CrH3ETo$Nf|Lhd*xkh6vz5V2!?gzZd+r?8%>4r9PN;t{Uy^ zGo$2=RN`(L?_J9}t9sAGT$x!6p$w}Wbl$(d*PE#ey1f)Xdn8BtH)`$Abb1T$kv@W& ze=;ojGd^+xz~kuw)i8fKM6=Wa==|w28G&4ICl-+GE8wCq9l7sh_u3S?@>Q-7)XpO@ z;Hiq4U>ygKYk^fLGr>w1%`jlUV*Cw0fYc48kCU^+y~2SNlhbrL>Xs z#{aG@e+5`+;CvbKpOJ6?uo4XT&i~M`^QS!NsvgC5@NK*2PqEblS2Ath;ZIJMzu!`n zpxj4@fp^IQ!5_>1fA;u4NS^K!yu{l2dh9bMZPkvBjwZi|XKyI3B~vT+_1)}h(__xj ztM*S_&VT=fV@EPD1h9+eG_SaQ))rX) z!-4%{?Ir-J2?q!H`CsHje?~(8p-c16T@Tg;K8xHBuFmHVaXV4~Z$@kNnA-jil6|~N zS&!x?A(Q#y4+6e6HsF+aL>a#P@3?)?ih#X=zuBq#^TH{l0nhm6BanZOt^OB*lKBB= za4>Tu_{Sf7Xk-R}#vGiE4UPQ2lyLv@@Bc&Kz_$D2KXUsZesz-hW8r8Gz=sFiBi8%= zr+fU5H|?_qEUgDqzxy9jdIs;Wgl;mN%2SFXz-9Y)2;ILECaINc$t_R^zth|D<{W$gs__yu%j$~eCGe--&g7$X{l@{ z(*8Sk9keiD)$qq(>*W3r(s4ZSe0$1S_x!&T8up{=?^IcN^~d+2Gknx>GYIRB|JBi7 zNdbAv}Y10?7{@YnYKZ|nY--x>IWu}!RARKlhkP3=AvrnEe>v`&<(9weVmPW}*QWJ#p; zmm~qYF*z0_^uG?>Kfl)hs$D-30PHil3Mxycw=rLh9xGcL>--G;I(}3?Hza-vm5Rq( z;U3>kZu->xv)lTQ`r&{1_N9*~{oWz@&!~O}XZ6O#o>$qZ+9m9X94__p=~A<)j^Zts zv|7wU^>t0W9MboimCGb2r_`o7pv5(zUQ#H4ji>FOtG4D4kOweBImW#)FVBt4+woJl ztdnl9p{3^?u)1}u0zfT=@T?xfoEblS4}0VZ-J2?Ah$iAm0)R~B$rmTU9J}M=0hWQ) z&d^QZH91#4)$^kKQ6MG&PQpw*XD9UU#q{T2gC)qQ5FiZe*!`J6i|<%RGu#j37^tc; zeKNCEX1Ri;e!W~>0;76Y$;AV6J5iqvKGB;IeP8b%Ci?EH!R(;9Dvae;r(s^nT*b@` zBU0DrjBuFJHP+J#W`il@uL@rS{JR2I8}Tofg3fp6Ywbpb_!J)Q?{eH=OCJhV-`KTI zOsIy3g_Ui4+#J+y0>em-4~-vFK7ECc`b_56-)8Oqsou~cMWm1b7LpVS7WsK5hwxB# zZ(n2En7BgI2${@MH|hE?gbH#tIT9NU{V!@PG_}$5G&&dGi62hxUTVA%eX&&cDwfWdEroc0(7lGpy_sXAIZoVgH8)_ai0U5Zb|Z1zPZIfeP(Qepef; z_bcE4x<{Vbm#l`LMsgm2gXg&9v3+IZR0_bTFk!Zf4U^5X&lxqzE*6|(2h;hdZAp1- z(-wSh4qPE3x!42@0A;8cU|D&C*8eng|GTarBSjyaJudLRv}2K$n*CUEEJdTCE#5Do zo~V$Al|24KKU3Pk^$%A|=`G?r3NWwFq|oloP>EcoCIWufYiCoWf{(cj52r9H-Z~!9 zVJ`ncKogpDEmND!xcsV^Mr2>+G8$AQbO#dnJF_m41DHdyG6S#TAQ_ak!~i#xdf5tb zsY;keslHwfXr2aOe+6LgOJ1(Ll}aW2;FpAi$%j4FGG+j}{=gN}*osbt$X{-t4I4PP zIl#fyg?D`WclsI}i&z8Gp@lK;F+cPua%m)L;fz0YMD`UB%n#_v_e#knpc;+-X_LC( zk%YkY<_|{otIfrqP2MFQs?)O%syC*2DyqHY_KEebG%1DT3h37CODAI67MtWTwmzI3 ze2~MEakNt2_0y`dFg&@wShFF$&>TLNr%9Oop~q`}mf~$j3$FLMafJx`wKT^7NMesp zw?lNDDvP+{49y}&ESH+-Cv{YD0nZnq1cPhwqxHigW&7Pp6nWTjyz z4@FcI=VJOBqH!iZmh<>TUJvcaJM)f%EsrI~!P2{6OOY&eZKS1c6kkiYB8XHwcx ze+1+&g6A`05hqDkS62YwFM}1>#1T$g|uBwLR=JGRF@UjwqfK7*Rm zs}*hlP@^BEY5BMefMK!)Km90|vLT@ZjO>vgZ*Z}$6`Flu2Byi-b|97l=J-`u8ktS- zBRRaT+oFrV1Pw)>0IcZ*qo>}eGsNt0p}yob8asl6BQ+{mw?Dj624AV*<3&AM)~Z;sNB$y{h(fNWE%R z@bHERi%)WU1+o6(0>FsL+MAHpy*OTrWcdP2fXVqvcJt7QEo^hxe4!8XlJ@>|Z_*R> zQUMuGQn%V_k{uZ25pOwHRp8&r#J0n?5{BOJtd)at$DG?{hD;hEnSZ}5uvR}$(nnio zjT-Ih$rkHdo*&BJLT;L@Ch51827JO#43uuxO;*kD$o%oBl=hGy2g^DieKTs=&{l=` z)!6I|>MO4-58sd5?OTmE84)-wDpzB6rTX+1aVw@be_O0+-v^Box0-V?^e>n^eW)3( zvejM`xV)0#aQT^=e|&2o)a*)FX?^hSSB9S#-*P;zNp^;YfzPBaFvYt>#$9~^zWYZ> zLw`7{!+oEh1>q~OUg`h< zkCS86SP0;RMdO*c!j=|SuxX`Go{jK984=iafH&Ko3+7wV!#j}fS|LzD%sg_PEz;tc zt_AME^ew=1UV;)P5KOBs0`?e_rmY7Zh48xUsX86jZ}Y`wxZfZQ8d;zVMDN9y&*N+h zyFc%~Yy$|kd7YrewGAUjQ@pkdZ+l^RnZAzD+lOv^lXvd306ASR+D&j(Vt|~mv@b0j zo>cG?BuIghF$o?S+<*A#BZfy&S#nY3AX0NSeNTj>2w99Fw%${-PWa{MVl*mry7Q~k z`=}jRAtkSNmBSeeP>C%byE(}p-(Q|?GyGV_{i%x1ez(?D=IeJpYd*|N;7rtq-M&6+ zo_UaF6ukL!%hN*r`T}N`;koxlaXSkdcn=@*Q#=Y?4>`N6gY479^*>at2n*i8$|YLN zs3G4SU_I$+{A`lv3xmr{w9ZzKe{t@ZdQo-u&H0{LbK zvLLzi4%Q)6Q;K3KPMu=K282D!ifi(2#~mONf2s}_8;ALd(|+E*LX_lno5OKn8O~u2 zc~#H~-Z`MccyY;vtVL;B#PX4GvxRn7x+Vc<$A(+b>paS{aZsljO+fV5 z6~;Oe(8cpYf>QnC9McUT)`%a=U;L7UX#MCh&qk67%Kdh6o1=nG}ZfhH;EYWQ8Rvq!N#syp^&cgFNs6>=S3Z2uflk%+rQ-sR9&sd3S%^B(0s)C^i=OPS=4p9 z+tO|XP8?l}g(yvvMn_~0_dzgT1{b-le2@KFFH+k}^E9InjF)Ss!L>u4XM6Rqy01@E zTEkcH2r-Tp!d+PmS{4Ssa18|O_omWoBFDX9mRh}j1su#ws#d^Qet-8VU{E!mP0@q$ z=prOctJ*hmwugSswE+JiL_ozmL_ybl?!v%EK{&r**KKI{4FSJhx0#bn=~Zqn!CG`v zX;y(cHGfCvS?YeIigj(5jdAk<{TKSg3KhS>2r=&SR~2ImCrj)qKjye;N|#B<3((Zp z7r!BSq(*+9ZSm|*BXqj2r(52iw@k9W>DW$9Nw+3k7Sct0p#d0iD)A>QHfu}IFAh@% zCviFP=)b zw}HzzyolITtSpK7d6<4LyYKWU8VqeQPZ)B3vR|eCG|}pAFXN0&-3km1axWlZ$rwnZ z+PY?akfHQnqX9#E;W9!ay<+L^&d#9IBf-WJ6K}&6o=-6dm=gg*Ugo2q7P^Y#z}1%e zDu8q8+updhXwc&Kd#7;h$ zpVDTyXXi(LQ8 z0@JUDR6R2ZfR9F$BGZF^W|Aulz8XOA7i$=1YaLwLY2Z5xe{WWL4e>*N8@9f>xb?+> zgS$@t$9iX#hh!rc2U8s^{LuvZrbH-Z-Bhn zLnFGrZ|ZWMba_OC6Z{h*QTQD2lcw&UL7ZP=`v}}G(;}bK^i8n1Q!KnVjFjyl0|(T? zLF$sZZ-G&7TfiuIHv{sX{qek58+td{L4#FtDMqoGI^Y~MqV#Hd$b8hX#5p%AVcJM;F1*dKIqU7vD8%`GN$PkO<3BT*UCZ492IWH}^&*AG^oZkYvuM-9&iQS(9 z15je?hkLwYf|3J{(ojZ>SCp9uoAVQ6m5o`XKOsiMi*$+0ZR6g2>9&55`!P3=DrBr+ zxzJuTG{Rx`;2L`6y7VdkcyD^9_Y`0sRV{m9H%fth8mA13>k&Z7sEqvf?d$RHg@p%3 zK{`F@qQE1}k3vl|`GP)XKbU~K5=?rE=?+&(b#5Wd191Mr*Oih9PwJN8r`qgg7Y&xkV3 zWR>G9Ic8u?v66#5G3(SD1;*=9*Z$A)xh@Y^e3mkq)^npltqZ^Ca+-d#hm+wOHLPav zDG!W{@Gxmt+3T}WV~fYGX}z1W6r~A@0j8rQ$}7t^Mh zw2|VTOr&3@Cj^jb={-+-vFh>lF;HVdTiA#Y#VKfZeVQ&Fr!F4qKA_z7?Zf*SJfm(B z_Z2wWmagtEDG9-_In(;BPw3B330SVm#7S3Pt^<)8>yiGK{MBf=AjQz;hx;34J6l6y z0ki(_D^~u0q}Gy&2rr z(Zpmnt%Kevr@L5@w7V?CWtZq{b~Tl?L8<=iayVsjD-wXUweG1$$Q;k{{1}o)NJ{y3 zJ~!pfr-+Tk8)9A}oK<7#WaDY1kB4g_ zrz8n1UUXBi7*@tSJ+nDHcj!>;wNCK4^c)v9v=u8ST= z)`+={bVw|Z37TnokH+#WQpyGB?0$NIiuWArgm|<9i=IKBU*@AXhoCL>WG^sLuWx8O!+A{l>Bp=xkI~PDgM0&|{+hl1YhT+> z>>ZSt4P4sZAeX2a+SkD45sBs+H2C*=xI5&<0imjh2iehdKWs>BnHZw3fnDGivpe$< ztkF|(Ryjy)z;oU*5K6*Co3dyPu+ffduWja-XZlPf;y$zF&|e*uU73lM`U)_vbE3du z5+fd(;;L((J_&omXEi~$y@Go31h8FhaROLCcuAoqa)gX5YyUZ@9zINBH4%Tf(7qIP zH9svL{L(TGd7I|#d`AtCOdCmz@io~AY8S%5{T_;y4C{p5C)h(tvkn8jQTv%D&D1<0Fd}H)b4f@8gK&n<4j{@#fR&A zq)qu0)^-t{fDs%#68knd=H}J~@!qyf>}At?hL`4Avp6R2BK_-mUi2VcxQd2YRL!^< zTHJhsL&z2|xjvy{=A+=$_Rl^2T&Pds<` zg9CKzkkXd;yjU;Bp8Av-Rp@CG_3&F&Hs^5x~0S6W!{oPF{^}6R{{2C_R zw$vnkBuNQ}he9*Ddyo@{rg6J_2l6`O^oqe!NZp^4@JMZT^vi5zo87m}D_y*2(eN8l zOv=-nBDQ04Fa`N78dxT)=^_byyooMH3Uxm}AcZ!SYuA`X%C^|9PxTRf(~wl~@y@6% zUWy)HCs5m;&ztd)Jzqs);34$7D*^)+mKPo%Z$3Rd+3+1vh@#byV#}?;?$Yx*=scvT z{wP%NeXu2L*WnhJ5h<3c{27D+Qf0FnJ<;&Q!pS^9AmU-6zFFI!t&FU9`Ke|uXkF(} zi~aNSfF?!(n*q&hwoH5z$O36+zsz@HQP99vgIuhR^qF$c1u$E5goZgu9v&4Rg&&Jb zSL79{2Z;g#No5FL83iFsH)2~*)QmW;j?=v)#GHroQB-s+h))#`p4U5;O;UfqbX(33 zq_pNK4(ph7lKatiER=q3q1vF@Dw0PrJ*p`1TU@4lCb_(6`}jQPT^=cT`!qYVjK%7G z(bpl_P(JEtf=S-!sFH>E6VCIbKBvFJ&Q^AE5(P%ZL}29ikaeHJ(-mbC~otn;l>R%x!{!xWmgD8wyp z70D3qd9oWY*g^+AgFC?vp8=HM)}}v=%sh3n?plr3$egFkj=6N~9ri1%vT}urcjE)i z3?)2eeq_yO;Fn)W8kkn2?>Le~HH-z5o*Tv9b@Sau^hY=}08_dnzIVTvO}5pWGdUl~ z@3^9lXd~I#0E$6X**a`CTHN%&fQ8|DL!nkk7JS z^6P|GUllT?Q#BCYN7>%SmH1b&{xNZ_?7o_aWlxR{s0RF?veIO7|C1 zQ(`m|he{=pgzyR2ut=U|Zzol?IWaS(6dUPVAg}m}A=lXemjZFMqPkYfT_9|eWR_$@ z&z;k~Hz-*SbZ%}4B;?kcgj=q*Qf=b}M^hi}V18Q@DvDg^D{H|<@A^)-L32C%5<-+g zFOGZJn-2U(4~|;GdEk$p3of}Ae8?da_}*N1+!P)_J%>H+(=(sIciT8&uBbaK_MV-D zy`AK+$jE(NVvgLj9}k49m~jplLYPZD-z`RSygn2m9!zpXo+Od3A+*;!(GN=~3?N zes#RL*h$HiN3ltl9f`8Uo$U8+pam-vG^Q&oKAJ?v*lGhj=WuU_1M!DO>Xtx}35}hxPR&5)_5f_a@iL)ud89=?2*^y4*oxXiL z($l$UVB~lEU78oChpjNi#A-Jy(?vcp&JbM z;Qz*%ekJNyiH9Qo-3Xr9>=D=!2{LTF2c+?L3MIa){|9-YkvTbt_kg%;1KiB^9 zIDmTf?!$F2Fc@C_h2@gRO>sWv!}WBl+y#l?x2atgpNs>L@BI~RbN_2cDJLiE&=_Ut zX|gRqhqXekIiHiPXR9EzsoEToDVrh!!7rNHCSQsAweATyCl+LPPQAU(sWV-6>hFF~v zQs3T3FPKA_#`VJLSXv&O`Q+NxDaiZmkMCDQNf#tAYAC6A-Z^!yyn9Ler0%uf7GwpT zCz-YV;eE{O-TJYRKD@N*Rq@3fS;E@Fw}_BBuvp!jqhNjui1#F@!(2B?bO*JPgl!RZ z&ZqoA8T^K-4#<_!p#t$>5+Xn#s*MtLZQN`*>6Br82vcYEa4fwtTZ$Ok8l{>4LfQa( zUQ4uYZp--?)2*A?l)<+|YzfQ%NL9bl;7DXpXC;k(m}fMo>~{8cDqzU#MRJk<=9##- z?UXvrIr&4Kb^Q5eDk*45Z%>t-cE;O}X_!Y?ZrPB2*1VaJv|P{dt}+?K{p~^5u5gBr z>{alJ<55s`k1tp9Yb`MHa{2w7#`DzZD_keD%2)axD6v9DQ|~L6N`x;B)a1uQkXV{8 z84!rdX3Uf6nZ@0Jgk9K&(3x{@YhJYi6C3w)tF49ST*hdxBo(ymLLOR%<@D-)zMd&7 z#2+9jH@~F9yymkRctr?#}NF`Q*5v}U2GkS~h z!&OIa=+`lQ+f={#-*sy{+OB^2FH(#mee4dP%cCP_X4h--TRY7^AX7tDUofw9hVI=) zTs^ifEb+bwmnoGz?vX1zN^-EYI!f*J`2kcupK_l-TvpVq*{VUHj#Lnc{}!qEXijiH zpyRKn7=Xd*_qTPKz2ZzX+n^wf3-J7V8+#T5--o*k<_+9q3h(FdKvzt1;Fl9Le)<#9 z=SJ+r)8A267qTVLc~B2CFM9$}29XVI5uJ!8e`vU6bsUN00NEM+U+!@D*oLgwo1o9^IP@bD`v@ht`69gf&CHFSo^6j z&|i>*`CEgHgg$h1tzASQM}=z_t|#rxbV0wBC7sh~mwd<8UL&W|R}a-Pg=wb!ZtR8OuVQSz4Kfyr5xZ;_ zQzF}j^P9&L%#>~+qnX+6i6Mp#`@L;lHL4fDN%j`)g|q48#oO+84_PnseI94g=yW9z zCA9K7!+Lww-MIbW7ovDqZ1vk(nHe?jWax+e*0)a)c}LpLdPamF_I=Th2j$;&U;9bY z;Xm!A6br#{Xa%L&Irw~9=1(d|q(rK}5`HX0KEw7Orab40oO+IOam!UBe92X*xVS!u z@C}O%m?VD1Lu4adW29quHxent*4&G14G+%ujrJK_FTOt-%eyvOY4cY|2)nI&A4H}^ z6f^tQ?*{Wi(os04`xB1Rn)ZZes|xFFE7 zB~m?pDyHK#-7wapG9X#mi>mgUH;zrDfwl8)6EHf5;q0qzXcy-idM;{lKJcbg6n#Oq zlyt8Jdkz6))x{SIzE>#hY}5YM5(##KMtq{B$)moXz-NG$>2!iwH{7OaDg#FS#nQ20 z%#83(5yH`7_hkAy1-tWZ3rJubexaHcu%O*SH*IZuYh=)thQYYxyNma`RSAAdC#U^& z!SdmuW9jU)KJqnYs}po{taZ-EZ#AdImU+DOH}<}4tl*l#!IpWZJG~D`EiRy*!Ug`^ ztX4IYu@)K8yi(mJ;`PN?QC|%9J*2vIs&pv2NSE+6iPT)&;g~|xYEhDEpCfjaLlC0>F3I?HJX_Sa({S>Ec=FyVz|s8jskz>;&k-{y zQ(6QUtTfTM$lY1&bGaUXGmY}lWTJLiP4zC02gWy#j?c83T`n#K{po}*CItl@Uu{E> z$lvj`DC0c!2C_bTes}Ye`Vf>XVv{^!WgH=$4*S@&4==2AD0?Imm?kTOT^ zJC8eSjOe=!V-!+U{B&&|Q$sQ(Q{`n$1aFo`X%ftC^=E?$mTa}V(9k0%qLo&Wmx%_? znwHQhh)yCydL$l{GfowgG~EsuA{RW3)V{x~rl2#apL;E8@ZH8w^JqwiBF_3=M=AMx z+-647?}g2)hJ2J`o_e2Ljg0Tzcnix9zVZMWcX(o6@7E4spmq%fk^>TuVF|}8i(g(6 zTmqnBdOFOF`|Pz?7m??15{5VSt=6;#iy?OV8VS3rFw8BqlCiE5V5gxbZUIk7EW4^%@Lg;{THwbs|=U1N(Asdo( z>^1`gkvx8;66j05;Yy>vVip{OyjM5jFe9VsA}}5OGr}1Z(haZQ-Gq0ObujhY=jGU@ z@X!w5o{1cw=^;F9%9! z2xDaFG+T_pN66cfnb2Hia;(i18kZgFEeX>HX;V2BP-)OCdMZOV?EM^o$D>=^ z2=gi1sWI{{a^q(q9)tdl?BBTgY}I)7oBz2vLr;W9Mz;gXLHF+wyPs(zRHbGC=Exli zq_Q|YA4UQx?M5A*Ko7($N-^FrScG3$m7C0^L${6WJ9#ORhdVnU16?R9yeR|=bxvpH zy(Cc6cPN^?Sd`-C;MGgYX~ECxNhmz8oI&Q4ogQb>+FIIn=c1GLKvw7pY66NsG-L`3 zgXMl`VY=yjQ1{Gf<2uVFd#sta{#z|EDUi$W&Ycyaj~2$@+v^X~`jyV_DprYOf-QV& zzv6;^DBXp_tP?XZibG{gN9u8Rw(d&`Exs7e-@f`#BLJ&q`PENfTNTjVc3g%FN^*U= zC@H;TW5Lw*l~yF9>}Y{gSZyCm*KMrs%fOH|O`Dc$SW*+bZSG zJtF;WymM%3&G&t0RRl9KcytI_l@OHi~0yUBw* zk4gPhD#i;|k;2oYnUU|L>?~nE_|U5R-hq`H9P8Fo>P-z&f1*-5QcJH%0*QOyii=Ir znu!n+Y?)Y>ndc^S40PCgxtq`7nr1a=5Fr6)!E6i^$O3|bAM)lWqVBQ;5_DeE@VKg1 zleGV&*vH17W)8W%BS7!}0p8;iZ1ZKok?V~VMQMuazxVaW(*k(8K zO;SiLCcdfqPZ+2dwWnq1092d7)C@Xjibf&nT3N+W5MsS~E{%w<_JNRQsOwbv1-|k* zCf4kR!q&>iWvTEP9+alDav|^IpS1ddZ!NP0S@$2N0`qDyLBH^oQ-VI9BQ0uvi!woi zoP*>_>Fudp#(oAkZ}*7|mAC23ayjH}7Kuw2B0Jvm$tlv{>r+l7{3$bDUJA&IX%E_-s(g(GS;?u721A1!SscfIU5 zz=RuSS*CE9Q(Rk$5=1xm5tW@f^MT~`#R#2jjqyDq_KQ({sL^2Y^cn{gX}nmhkxVIg zM^149Rx@vl3k@IRLSK`EQga5}%U-4A_we0{s=|-oh2W?WZ7Dk6fU!@IF2^^s^;_Er z0!RupwoHzcIz2(BT|Z`Gc++&*AgvW75(ue5XJfQX2@)R%(X&`8h@A{^!gdM0%N0e* zaxk&^!N@m!B>Ez4698<)P9MYL2rQ9$7PTgx_91zHy^ofKc%TM2HJ?X3<-;{&32jNm z3`~4*QpGQf2RDsK$3R^$nR96reWPnP#@3et`SILA;X*bR0xZ#IgM`}Z6bB;9IYJLD z2WT}9Kkwm%!ZjP#X%3`KZ18r!Rq;X`sTD_$0YA~%xF9z1h4o8=*PTXy+B9tKNn@O| z6`ZXjJT*pTSGFrO{-WUZi@S;~iA?441_|P*(Cz@&3->+#|Uaa)8}()f^gTh2%KHw<00_gO+{P5*sCa>q*_1O$|V?$4HP zmb}>OJhBYUh~grFcaxq`jw5*+Gl5Vc58E6sl&nwzKQSSoQB2+gKt*}BTHazE70F`s z5??j1yZJ+TH{u9$JBEioXUhH~<*5K~6fpQ^;Qf0pu}F3pkxSX4y8D7oY9?X5ooZ#u zN4YQ#4(h%t66EIfBB6Vkz|E`r*O8{EztU2s$XDhB2FX~fmRJ{Mg}KMfHXcj%)8lmb z+sGgazN!qiGbFO8kkQ=sL7X2kmc7geLP9SU0 z?=3ll{@EfBGwa|?Y%XEvh17K!^*J1LXmJQvs@49^nzH@9skAuQ0{}`%etq-%K|bv* zTOngB8G!S9K{>&4BH8ze@I^V+4cb<`Aq3CFY6$Dl^6us-CufJ);g!UAz}d9E7bxxu zf4a@@KC;?i&-qq2p{;U6Ku??zHOnNW4v%`l!z+}+ql|eFC|e)lyNo+Via_v9(3T9I z7sW<>Y2iK)PEbjs!B24fgrT$c-5)>7CG>!}kIm!zP{{EVf>r7KuR2EU!-@6YKOU2Yy+DIeF#2Z4LRmLD{dGv!DnPz3Z_GGAziSPhg7KN z2FUVfay}V8wx2y)_JCMs&T9x+$GHs}yMqeLLECqGil@Jdt8^5%29T%)O=#Z5SpqpU zc6k8gA%}13VH(`VA%>0=$X!)8&4k-C*_@SsgcUCCjZD6fCrl{R^%;JJSOw$bd))pz zp;r55n+tUIauN#u4SzaCL0Wq)ePT7bgdiSiO)%LwsO%xUt$dpnDL_Rl(>xeVvC(*O zXIe3*6LFzfhJ!CkBOY{c%|w4p3$Og$pxXBTu=W;ERd(yzut6*Y>6BU^-6h?fQYsD7 zBAqTkK)Op>8UcgumTr)g?oMft{^#=bJ!hZq#NK<1e~dLy7K?}HnRDKK-PavT%Os^$ zOa4JFIRRCueE!DFyGrHQW2by$+s)92TcJ@EL$XlT;OK)zbR#~V{(w>PDffqbC=MAz zF0RRgCoFQ%GsuFelB?`YiE(D&gZgWhnC5B`3=ZbnCZSIcnODgq zjSKI3VLtD=k7zYcMtw4Kuacq%@n;S-YdmFItIIAssx?+-kS9CNwsW$iZoml)a?jR) z4)xlYiP1EQ^)ZI{$Ke%`?&~t3 zU1Kz;oWlLtT^MFUP>z62cZ5>CuzYe1v&JDJvnuT=ieX^MX=Kq2bB?2Kvpr6y-52$? zOR?RS+Gm|ysiz@y45VVYJ4d|nAB#3<2|LT2rV1kG4O0v}&rNMp?5{enio>3Kub>)Tj2tE1GG8nsAAvel=0mgf=bo+a*V7OQP zeP$Y$E2N6L75@dy0P@UyVy;&z2)4`JN}uyPgN;B=`(~+r&q2HuA$ld6x-GyiotgGg zw;wXJdaz09b9Nl{+#JMR;Xc_DsV2HjQxtZyLI3#CO@pPj!ucsFKG@*FumY=8`5ERl zw}_ycyoVtHHLUs_SK>y9IV@DVN1+3;R+ujYIkJ?x2 zXSzV7);&{&15b>m$0tE*^zL5V6ciSFQ4yqqkW|{===bg!n&FVCK)u*S!R9PtngsPT z!AgmZV8NS%CT`NFZxe&+ z1LO9mRkA)mt%Dd8x$#~2Go?Nimgr(|7Ur(DYk5|mTUnW=?7Jh(_%-e=t_c#>5BaFTP8_j*lu0svhCJo0EpwM&6+$-w4UIU_ zp&Ik>7TXK$K^!VgiHSG#w*XBRwHCXfhLH3sLGf3w+Ehp&(L%w)`SuvPwK$&+IYGW( zl7?7^8V2fPowjiMI45l)rM`D7t@u`*+b6{OS9F)XB|ZtQLK$w;i9 zdOZ&gXL7tcwcEn3B@YdS6_e-E%imGuGp&S=qq}wy9jl-i*_I>;ThbE= zqUPG(qX1yGxOFyP6avLL6A_CC|FAY@74goCYG9tyj{9KFp%8mzV_V>G(Y&Woyo6eu zs2%bo4i2L)zX1>&n@2<7d=i-&J zKhhE4Nb_bcG-J#ahM!0zxGZG*;$Y3lboTnXK<7(Mdv!0NxTykf3f=RlU+5X`${3hW zg;MKsE&Ap6MxCA?1r#JWmFgu>Py58b7k;HP!QZ`HBrz7aimH?T`djf~bs9iYUSVZG z%dW!t+)2`#aJLK85Uh%{iejdqSvYrRHkJEEk|}NJOL7g~62$GNvwneaL|5GOkLX=4 zgsUr}Qs15_WU{e67o%zOZ@Ht7-(LHW3G=LZJDVF|&R+&aZQL|kTJt)TaHgm1^#pX4 zj!Y|rUhO)Ydz&lR1vIN?mm@BA_#Sq-!1DbXII@~_=%$QW#qK}MT#07Y5~FGHRe0t6 zrK;*-Gnom*FoKJ)EW<_Nv%O#C+4PR-IhLPGpeD|oEHx8Ieh}-*@%(fyf9qmr~c5e6n?mfKGTqGPQ6TQ`OxiJaz7 z5qvU$zuWI`Bz+B2q0aRWoFe`Ta0Y^e3NNDQ&r8}`S+3Tgqd%6vc&kyS}{&_oMw zaW6S$tzH~$?kzl?xdM(TnFd?YhkR;*+|5cJ9G^bPk60G?o0U4ZbH2QwadVc~n3oJv zCK)LaoHno`h`N_3h7|3+<9>nYr`dT|5B-9{=M7}3wJqU2?U2inAX8g)AO2mEy44Tz zp7#wrPM*JXuKpIq#oKvVq_MB}efQ!*VvNEzl1wN|zXc^fh!Fq~Wit>^&{C$Db2G5B z6#b|$IQ*V8I@tLqo>$NvjaW2`w`Y_t7sOb~=teHUNP5+3o`_#3{5fq;&$amMD|s#6hVnNZODYAh}EDYYN93vr(PgB9<_M1Bw`YWSbhVB|Bo-@ z5(`d)V#xk(c5ST>tv`Ih|1A4x)>i1#FvxuJj4z!bFr1s9u$pktXhZ434vJ~}*aEtU zd+(cT&ROLXh|$EunhD78seB+)HK5Hvs+>)EDuevd%NCIxW!}Ya62$fPDQ;U|qz>iW zn1kLmiH}L(;+bJP@NB%njz`|cYDU1=8q}D@_=2NATFD%D&6|d)cH41PPi?|LIS|DA z0+q^ng6o*}h1S88cWur*rcvnTpwk5*blNvQiLlC~6KOYSTqavCM|TCaOcNY^QjOyh zfqYW2?cZjN5#vW|g#E=YG>S@YzE2Aju+n&&y47E#9a=I5ANP_k z(w>YZ@fU>ex}1NpY#tEJH6Bo+05J1A1c&gZay;YZ2Ml|}Kk|dVMw%&lwX z(U|04PT{P87MtzDk=6&wQc?8dYH$R4w9#tLbB`UFtY?Tx7i5#S_ZaHkdd{i3wq2t; zCh;85wu$|mJD$I1??;Q}ueZe)v!035KJ4y7r z*~&W~2MEY^kd_$z<2zWX^OuH`zWIF9coB?)mRY;pgnx8L$v z3H5Z4$C|Qw$HG5YZ0!un=W3I=KIqE$pn;9TmcysdLjVufp=~B11Eft zO4KyJSrrh7t%1>~o6o(GnbSQ^lg4ErE>|>Z?0ypUIfC_~lU1`WI-`k3jql94cVu2h zmL3ys)V2s(XL+=U5Q))bweNtuyXtPU1o;jsu=uBhuf)tsFWIN?m8l4~-=JmY@5ixy z=SAG+BUL0v#)o?ImkX6 z=-88JIC+Sr#}EOpj}gP-w|J1ybfLL#kc{$ZCBVf4%jN3n8?UD)Z}DBy;yhac-;n#S z-OzS^blDG}aj3f&mEAKc2jtnlgTB}@p@JpBp%x|+Pum4*Kj3 zc&Dwj>2H_9Bj*~8b`$tTL_l9q8x3#=t%OZ&EVD3_dUQJ{DgKhYFl-=sA9=MjiJ<#8 zXO@EA#Pv_nf0;dBNDm^aFmL_VdQ@MJxz%3wOvofl*RMJNviJF?BjwcnC2Yp2k$4cy zRbgZa`+b*A?f)5?#wP9o_K4bqPtcUcXd@;FUCNG#b$;YlXY)`Lv&L1yZflIYoWDm2 zD313PXMKzY+Jw)O{FnkYd9W_Uf@!I*YQG1v{d`ph;V@_EKAR9NCo;Jn^_0W-%iWTX zzeC0%OZZapu;sq~M7rWzOJ#&t4fuK+-R@ok&}s=HZIzsL{5i0kUif?Nfc~N(SPvGD zgNhTf!EJb`sp!Wa?AEn2TUVvQ>X)}qb=T~WmW%_KZohYsuqzCc?Ca9DC*@(tWF$fD zILA=ELKHDj0~jXXRecS*tV^euD`W`-q4Gf|v`LFZ>Jt>@tlyTs--prrX-*UZ1=@VC zJ|-Z^4_iSxiXKCYZ4J|LK`g#p$~|qwr_bcfxSS_VmTiZ}xBgWm39aPSThN=z|8)QB zc9o`SyCrhZ1*n@hu($Y49lsuT8f zKaR8}TwkzdGj#dMlCgTcWP%D~ls%hH{R-G#mxDalrd)Z$gvL8*qY@IqSyEgj?O?zOl5}BC{e7{RZ$QK*CaQUBs8eCR29glOJU; z_7YiGbC=p{0I^DqC4P-f^MOVv&T{bG=of`TsvTP9sjE`+QRfJ^*IodjR4+((rt~=v z&>mnx6x)Tb_FF$!mV*Xq2T&KS;~Ez6Xbe3fSqmKWw2~RcELYN}!^I-6G#8Hwb~yz- zT$Ya~9)CrYjKO^HpcAw( zP~XT#jwv4MxY8A^pU!@}SfvPD^QE%6Hvm)5M*FN?jdvr#o8o7?+kT5M6_)AX-dKT- z%#$Z`o<*Pe+X2+Rd#w{U%V^#Q3R@kw|Rqnw;h6LdfE~w4UOIxt}?5UcAs+K<*H6 zxrR~@=QR@RM>VrrAH`UY3!I~R;cG5OUk$yZLd2_L5$nE4)?p9RHijaSMwr9#sJL%R7Gj(u1Ebm4IIY)**`WHQstP^GLSbNlpxp&QNh=WWOo+t_I-Vxmz}4Y z#Q=%JezLntxsiz_sQl8Z9O}5#7CcwIad0?JFJ25B%8m3LWU)(;w#rgHRF0V0$f2jq z*rQ~8*%*e6M3Xo0o~6o#H(~Pyg83**Sb6!dT~QCruAXX90mwP7vd0e18rTB{AVQ z(WgO7`b*Rj3_K4akkdUcEL6s4YKxauzOI)QALVmFL4GQN0uy=RP59{+0duylR_>Gy zbJvQi<|~IJi+jNSR|M+7Jd`^3O9Sxt7k()Nygt-hmvV5q&KL(N3XhQ9t_DGzk@;irw5wf?`bq<^MTp`!1 zAQ7#BZoEMus-FW+mj_0v+>(M(M?vMt3Nu~}SBJe)YjSMqlvz@8k?t*kB!tiQLn-=t zo21g=)z#5}w-#o&SfK?qb9}YT*^$iM;4rb5QZCf6OkKUmw@9=wr?UZ4r6i7ag~&?* zYiuIX9*Fj9+r;-|XANRV=!phR*Rk^}WTeYDX8VKm*6%)zYX)qa2hmeEFqMcbu3`&S z1rTtp<|w72Up^^3xyH9`JpQ!)20VHekRhg?Y{jBx$zYO~foMc(xtBfP;cYc{P)s6$ z^EheT`(A?$8Td`fYOJddjbmAPg)T9kip<_xM@zjqTVb zltq3o2*lX(cTJ zi&6W4qbvGtf%=j*V?_3RoBJ((^MWt!SD3aB)RO(q0`?Dk4Nz$*F{gA|az7e)imh1} zu?DBuN_=dU_?&p^LxlT?%V$y4P(ZnPt?aGjv42; zhs>C}>bpWrP2W2Ga)lvTA32C^xJ*73%f(!MkKhpaPH|=V#&fkN>z>1`+OCpVBT-Si zhS=PpN`NQk!y;!RP@|W-hI*6Ggqz+p?;S8H(q&C&(}pj~iS@YMoUi8)Wh%%`gC2KE zi}LZOjZk%WZb>?h#!XL4G2(i1xl}_V%Aid)ibyAIt|0y;6t}2cE){^6i70Oa9ujA@34;dh*88{jIj^BIWj`qS^Uu~LgfL~hC#V^^BnkPt@3SY& zx8*Sn|K&UONWs{@pkhQ_;h!c)J3&xr&rL;IZO3ly9&8%J-AA=_!Sc2V`9zW1J%ix@ zX1D})B3TFj=yd9NxJ^4|oF02{;BLVfu`Hio* zv9oSE@*@#U;VdCoH>d1Attq8Yp_JFJ#XyK4{nqK`ziqDVOv_iWOV_*&BUPm4yB}p;?kQ1s>yK{yCw7I?u=vm)_ z%TTu>sJkR7w5@+EicA;Pha)x zf=F{Z72(BsA+ zNmQI@0*VSJx-t9Z4k`cK7L%e%w#*=#7<`i@LqC|dXfhdS=7IQm7-4!*&b(j2I-s0F zqQF}ddx`mp@@@S75h@3}J?k{|4uYki6ISz=pH=uKSyq1OvGo8U8JB=Oy-;$8qRvEM zDw`RYJBu7;Nbd(!{9cLNa%I%d9g*a$d5-}R#fc{LnD|$ap)N(31n(2lIn*rSMP${2 zFp)NF&_5bkrG(0%N>d*x`%QthfvZP{wnJqP16U9+bbc)^_`+nq^IO)oM1yuz(vD}? zX)8`hIk~>LDv}@hQW6W?@icNHQNcg0f`&eSQSTz_dbHMmG{v|pO;>B8^$pIX5ednYM7FskH}nlj@QUYlIM>TpM-0Ik8FN> z!z9iWCL)N~$&cP$LVo>p?ROMsuk<473u3Rb@OidC=iMO0lil@03e4zd{eYHt z@I%#qF-Jswj(!pG0KnFzV3fnY8R%&w72&Cs!t(C|%a_>IBqOGlv%U+ohe+pGWk2L# zrn-`8U80tlunD@(Mq|3x7m6k%6Q%CY&pFrkyv_tEXT1-#JXbjyomXfFAMszxlVTEN ziC`MO)+zI}Tq*Aib&&ezyO&BTW^j#!5qHB6h513t6HZ=+)N4oaSr5?^6%BZ)ZhZM! zCxY7Q@2eB#&FYs!hhyB}B4Kz*UTip3^7MjE0S1vubg-VFE&qjUF%*c^Smby~^KJe} zKl9V`mDD=H`C!2uT_%b-zfa1r@z@hg+hKS?)rSW6bekVO2Mg1%sew5)TZKZ=wSD2UU$9^{Hl`EaNT-weLc zONU%yrajoCVjh;|50cC#0r(5&U=5M(P&a6<_a?j!4#Q-n(57aEiE4g!g(pA?nXV1A z@Jw2KKZHqugC@jEj)@nNp|0tTBfi)(Vbp+cVsw?mldp8Cb~G2Eo2 zo-S1{+!ibmk{{RgltVdFU1%Myo|<@lTMA*EVQ=>$kw1A$(%0AzN@8o^#zo?anEQ%?AHtamED`zEje{)>bVW9tc_V@>#5g=hZb0mK?`?N4 z;IsnBH7;*C1>wl1JkzMEUX!s*v{)&)!w2{I4i!Nf_)zd-M*#jo@XD42Z{Rkw6QfXx zLg!!4dw!^)I0O+oCFnW{YPvLxvhJIIbiP=0g5{SNuu)w7a84BKr*7cJn6>ChB}+-B z=A0%eBC#LrA|V*Uwr+@IPwQ6$Axf7`&LIhsVvk>t05{v^agR3D>Am|MG^`J>?$Ghq zFxuF_4nX7M)LrrGfnm5*EX`)IUm!V5<|rAThLYJ} zD`>RR7iee9d3uM{S!`D_6*SR@Lu0YgC_e%6x(P;wDFm1OF_a;)G3VW>=LCDg%guF= zXVmk6o@%YqyDFbp5M~!$kBKV;TzM%?D8`oL=VGYuxKc=k^2d{BMX(1 zx%CC8SS2$d8cdfDdgMo;W)G$au!c2IQ_DX;>v`%V5`PS@OGJBq94Ll05@p|&Sq!sB zErXf1zYb(kcOQ1YJ{dpB%@+Q|Z?hSulrNmCZll==LgX1ArsU4Jj0>MJYR=p*l>{d& zn#E12Z&r9hs844>F1tT9)TCkOc6hAVF~myQB4xi^o&z%8YeR*<|;3I6wVMt(@ z^Hj`}!yGr^&`yMPO$%R0y{f^WeFh-<)YtCDsq{Nj)cm?Dt)CVs<_)@Fe+l&nlep~s zIC(5+HRz1c^X`{xR}_U!dV=8o3d^{)8b*9IJ{lN1_Ez^jymP$}Q?tg?IC8#)|Cf0JIUclUTo+2joT+ILn50#!V21x9luXG z{QQb;(z2QM;Eo4hpH3GYzX=cmhrEl|+uv0u?1W^i$KyKSVlCujRWFQ`3A74>t25pe zh+cKpTYFuP$1W@@+->YH)A2w|7hQnI1TeB%T76bEmJm(uiDM*Ye9HMe@5RYlpwrNc z1=H7~pBGX^jf6eqd~LO1XWW2JwCz1OTBs+$#>ye5v#&MfJHR%%W?)cU@v`pW z7n}T-t#HarP4BcxkF(iuyj@)SUN=TCK}L!5h3IQQxwkeI=8%IPOY{t*r^@hiI9`4t z;P^=fTs(3o`g0j?-$Pbe_3I}pO29j2MGdDMpgSHlUtzs@z1ShA-*7r7Wl3A!-Kc_S zdMT$Yi_}=EvE#vGB@ms3;TeAbO#?&ysz@h@mvkL-52|K70}ha5U?(pH4yOou!|?Qp zwq03Y-^O2c?@N(gx#TDIJo}>7t|?aV1^oNWy`@KD4qzJXij7`&LaeLicpK))E2)QF zv@xHFrfl6CcjM=6~~Z$1~=|9nv3TKDfcRkuIM&Y`PM*CfeXpZNQ0k2hCVD zly%tjq8fXQ=Jw)Q2Upywyhy>XZcU83pVh8ScaaGN>+Ynpy(lF+U$#F!>%SF>b5XcH z*pjX-zCJ%5QRV?W7Ei`?9m8D#_t#ZF2Y~)$E78&A>%H%26nfQ=&p6CB|G-PDyHY2l zxBaNNJiPZ%;m#%X_w%vGb#T_oICHlqeB3$ZismYPy8} zPQ|=KD3t@+(`wih5Pn>sl)r_g5eYdrzQdxl9RXL2)w_q8$5lyb7Gzb>DRMO9I1o4cJw7JQUa?GM5Hn+`{az43fw|B~jzYqY zM$aR7?&q%;;4(kg;rSq<@z$7z<$R{E>vAZ6rno78u6klM|G6n`nMZ}5((+W`2VWQd zA3N%2yy~vWUr}OvsQ&g_gyDXRa7R+ZU*ug-@4vINgeb8n_sFmItIj=|X^vKlEc+8J zh;`F1s^%wkXE|n!C6hLI1;pUx#GF{*;O96kOju!e8Qx=Uyecg*oYq5KWG9#tw8%-m z)5&#x;5&$|pM#aj)Wz?#u@IcFsI&*@AkgGHod4VhSQr%_ga?$)xEeQDJt46|`(vwO(cvCgguM}?Tm~;nx#w%|^PPkW{W$B00#p4u8}mH@ zIBpxfK*8_wR4@z9!-7@F#YSJCPCmgiSBh9 z$!4VB@cyh`?yH*j+@_PH#2U$#!#M)9ULR_mx8of-a;h##M*1R1B@+P8<`X;y+!GT2 zd9-{$VY~*4Zp(W#WgA+*At-;X!GC;>C4}SH(S#V`P&T*^FsuL$?Jyt!=KHg*;G^%F zKC6E01GENvFY`4^TC5tcPeK0u)_S72*|kk#ib5hFk@Gw6<7g{I39xHOC{4@rfKXO% zfTebW@(2iOvfi873bfPmE2m)N50fQn!XCAo^No$JdktrOVMLtuEyUbb8!a(amgC=3 zyl&3DeUw<)|7_NO+~{BbiDiIq^4CQpV|d9Oyr4YbxF!)VH@*1JPm1y*v~g-gjTgdJ zb7Oe)C*deB6*q|0RCza(PG#Q?NLS}NtoGo>#ieDUTGMxO;VShIucXwN_Tu{{K!Gwh z{Hjs(vqxc-B*j4@G5UYlP}vMkxRfv@YN7mn`k3K2R&Zcq``@?!|9EGZ794~NG_8Ao zUq%3anK}ydz(3FTKOLw4e!V43P(VS4+Wgr>5RSkL`dNzA0sqs@|8LjKcnd0^Wp5)z z+?C-{3|{nb%mB4jpX8tK|5G-9|M-9YRwV#rr?mo*6ZHP}E3M#{(J|3t`OhQupS$&! zNc{J&q84y{YC+0Znf&J=1s{QILnJCiXAU#(FL3W2{r@joxe|MSx*L-5zl2Lt5lsI7*7@53$GB`KjM`oN&v|Q?25Vy^(I4{PkNp4fjywun zr*(^#B>mZuCqW` zE%(2+g|aE&o`TDa%w(cE57Q7_Y?>qk=`+^Mx;(ISD(eK~6PKGWV ztf%{sM?m4v>LgKs%b4+&;{JVm|H@N&mr8)ODdmjc`CC8Z5`!}l`tS)O<-hX#e}9IK z8otTY_uI|>KG-a9RhA&_YyEEtNEhNgQ}HOimosXd?yDW5Y1Z1KoS+Ms>!Vpd`bEGgOn<8>@3VTriAW zhq`7mE#>eP$}w{uuI2v!@mEx$EKpRVh-`Tl0io~j^$LPJHCz~;e-zu_YxvL9(F2ZM zVNo#}FUa4*N&=ocX1RUz-+F9QIH<=ZjJ}KMQh?uG_V?k5(t@kncv^*j>yGHI!Jd~J z%K`^&K6>*0?}zhVg4?2lLo@4t>!xae$xsxK2G-^#q6h!4BlHj6=RaGSe>m~p?`c&4 z{)tp1&D1lgkvqz4&+$@-uGS2j>!HaJ$V`2Zi=jyZ zq-q}ubgDjp@dZh6Mma#j-?CG)o~D(bD)q;Vin4(P_pPyG{x|eul;}A%{Dw^Je*ur! zl;36N6%raDW|=#N&~X&Fyt`tKe4J74vh<&4=z<$zPPrJg`s#Mt4^NSZvQ&*AV0Fbz`*6Rsbttm8tRS*}Ru6OZ~n$r>(x2JLm`$ za0Fzo0t1NvQo{j?mTblyVeFP;`Sw5HoLFms3zP@W=_&1~N%QBqap9T-Ku`kK_kg@5jE@mVGI+zCV)v-Eb`<_34w#ox$N} zQ@Qd<8$5r7N8s8?Ksn~-(E0R5dlhh#Mozb;S1@Q_zc^WfAk z$KM@DgcF@>m1Zv(<$?@-E=aTFf~a5Bm4HxW>oi>fY?X7-w2i3p+ex7*}?UQ(BoxYQC z16x2TzBl~#d^KUM4M!PGY2bI54K!C2J^W5XsCxgoRt1t!Y;|pQw3WTxzmj7x(b0xu zbTO^dOro-9GV&9QD~R~va%Q^%>bSoj`nPLR-uh5%&G*xe8Mm#T@fwrYJd-|W%Ps;j zH#3LQRt0C>ctgIXO9+@n!MB(A8O^W@#5X$Xnd1J5&aLWZ*B2*xk6>e0Al6dU*H0q? zGfs5gjH=2cfh3J|99FPoA0TqHuC$qbtzG`g&}AaC>G5YO?HY%igj+cAd>q4b4iFr^ z@q+X9%aGXnX*GH_5CM*QOJh&ZZ*cN{K9E2R9i=ukItNEM89tu^Ui&r!{8eUvC+5w` z9tipPlP;O8CqU9mxB4^$kMTo^ap#BV$1;zy17%c7&X3jwlrziB2VC;d1@}cA0kAcR zM(G3L%Ev!7>olMnlgxXt|G9gSK?S*bEtTj&TV7(=O#qOY1q>(sC;c}AB(K_&%4Z%I z+syKR68i#VemLBBZW-M08|`SX+sk<~z{#jwi)IF2b?-yK|Ewr5JdiTm=-D2NUgM7Ef^RJgmvd@Fd_awc#98O07Fp2 z56vP0Y|4BfT&^$P!i0(QJ`mdgU^FAp!Abt5N9P7m)xv{)E>IP4+@`|#<^&jzGcYhc zLp)A?XsoTopt1}@p9z6_*K9ZGGzAB#kXt!UES$ka5Hy0b5cl{62RVa=B@|94qI2@! z+C#Jj7!5^2Je>b<$NyKgCi?xqj*6Jl{5>k-JZG}e=JW~v@B*OvAr`FDE`I6#MW?E8 z(!P_lAMizNmZQJVt!Hh{1!F4E?{iT*gFz95-GKdh!$K=+6Hrod1DZ|Smh-Y`O!O`= zkjZfEd+K&dd~?mjQ-R%;l;Gxr1VSe&I|veKuz}9WGPKql#kfP8BID+RcbS$L>AJ)k{oU7%6l&Ww^;*Vm?w3+mB~0F z`e5<~(me%hUcNc6+iRO2f7r&ec#`1&WHg|bbsf5?*8oYm{WP@e?M7zc4Co-6n{47- z2l>9`rxTxV0jsd%w05PH1xUu=J)eU&#nhWGNd|tau$~@E-3UM@-Ev*>qf?j6>B_$Z zgy;lG;H=KO*3Y<1TkGjVIEKi|QIV9>{u&F>#Ah|Zwyw&ls+z~>cl(#nP{C^c|3SJ<20h=?Rv$Cg@W&f zPpH{4M1(eEmjD2(!nB9!yw4P=meW_gDi>-lmuF`^jha!EwC(B~PsisJgcgRxUGq!BdYd~&l z?qcZ*b6YpI-{mEl`&hmfOX-Nkr_{CQ{((J-8uNgbMG>^`HJs#}+)pEFVn?_@?8Mk0 zVD`AjYra?=Y|bQTo-+_b{g(>TRFb5ccOv(QO{#eP_Jti+p+}pZ+cuoU zA3dN~RVbTX%Q%D&up6m+V@r$aUyVIvxQL}5SvS_SFo#X4Mo97zpz)5`4glbZsTLg3 z>MMQ^a3FM3fo6A_HoAT@re&Vg?2BASg=yjm<}ds_B6HutqN71)v;>6^n&~r@_6CE1 zlelfUjB*@0(AA^(uw{Zs114oXSK1*=#RMtR(^+~hZRBI8`Ub{_PYaE{`;1MS`NVRpy1YQU!oi~P_Qw586u}^# zMQ@8mb6*RU!?z_v!VV>2zL;kY)(SYm?kZFl#s}Yp)wIcJPam%KHtG*@~Yi)|TuFFSeN?cW*>TUU&!~!HTf6YH| zkSQOx?2>mJaPL(tcs-q1@9EwqX<#7rDMJ$90QZZWeUN8Y14zhK z0GmDx>K#ZC>^8NZpgJ>8eXn=Ueb0J-*pV`Tz$YEHghI4)M(WT-fzm+7 z#B?Bj1fc6*LQ${6Y6Kt-<%?p3Yk19M7)h9EMdgWod`nU`eTE^c7YCwK-KK{K`rQN?jQeAXSoBiwZ}$w~D7Rs@g;WRy$JLDCku>IB|-fdh%EB24Vp1Tm*K!Sq_KJD}X;9DtSdJTRBBoq+72- zpGJe_U!jn|^0QsP`wTdiM7#*@fJ?OAZYdbTu~)NB_DLYx;aDwH8Pswuprv7NSR>89 zRW-wQ{%jef-%V3S24xcA_&*)FZ*d|c z?UJv7r$M9p19WC80uoVOH$PgLL19dC#nKg6Voy6qcCX zPN|L%zIgSq!Kr73jsZn|cDVo>B3L1M26u>h|3oL|?rW;kNEG7|d^HHA4GEB`&^^w= zA9MK&@%RiyQnAg6tfWY*zVcPqx=Bxc{U+yHYzJxI)Ro}TsqLFY+x3S*J^GCu!nqoG z^tnFQ2`H^^k@Y1d2rc@27pQrLC>p-0ZdaC9f7g@Nw)rH1<%HJbZ!fcu#B^Qf`NClXr%n3se;GEixc?0prmgO zhx{iXP&BXJ?SqfiYl*PLi20P}_O&^jcB{L$*O8)ovDO`+&RH52C4~URFp}+RNcYOC z{Ls5tvT*kq3FkgrIqI%2Vk%mR{mSZI7&Te z)8XAqnd&dkUVr~PFAH@9flD8WLi{ss6sEpuBbNr}fbp6Pj z0n8k9ZJJh%^?+?qK^x?drJhNOirz&;$nkymIp~4+AR^T}Cxp!g->A2uY)~JyYyx%) ztj&hNC~0w7UnKYnot6yBJlVx7kyVWRkP*Qg> zuRhzX!}`<2dySGtj) zCN+QZLa*x~uL)w+Plg;Hbrg=W>|;HIM-neVLzJ`E^|rxCAHVMppK^{Q4DPe2il|@( zs

%#~Z3In&P_)4GpwL4c}kI>)6=C={iR_(fbUb*sa!lM;P^*(|Y$Q#dUKJ?-d3= zGw=Vf`YZLN&0=Dnp>S~HcaklvDrgs1Gs}@`UoaM7E4=26DXEjZ_-+ET$_BLMr0qVf z>Tm${(L(JgSHM#ic+9kfNm!?OH+YiM+yw+f_}@GI{Zbc1k{$aVa0pzu4WbN|yW=tF z-6z(f$nO#a_OZErB{$h-sw+S5d)|irGiM}cX(nuwZx>s6=$4*+pB#k}rzLbC99S-t zr=1V!w~v{&|^1+NxyOO7}A=T@4JPouT%TifzhY;j80$ktWz0jn9 z9kS_3&mbXq!Nl8JI2;j!q)K{%?dd%^v*wH4u{VPh9-*0J7A#Bvdyijg^0dv!$)G#s;N3WkI*$TV4A3_s|$NyL>Al2Uhzsw@Oj?F}X2&6SR4 zaJq`p)kE5=a~%G~0fYRQ0pUxg>m!`#;Op~H2khH(lx^;ZI{GKtOA(%wXSRdI7Tp#Y z4bw}6mjXKb_hfha{6wlXi0i-Xa-}xf<#sP!AFs#Ks}I9g_E>K=&p>D_5_Xqy9<-&t z{bdKH!Ua@&I+UAuUA3bMNRZqPM*Td+z_1{Se={^z=Pf&OeK~*obVPL^Yk^$tJz)Ic z4d14%!MR;CTAKYxKt1G%g?SeX(;EqMUqm1K23JxP;Shzyy*Jw=ZN4G(hPi&8?e=X7 zdDU3M@+Z&uwaX6oGE1eotzV(!zn;?F?$n9Aa@Lo*wKnRq?Dn0raMs_AYv%hld(2G2 z;D7t=$>ZI;ZgMZOtbxR9DTk3|a_VUVHg2KHoy=B7(;q)O=Z}qhJNB#T)8k@A_U4p~ z>*kxjY~BpTtW#msa|!Vs6=J+EB4J}v61Ww%rJX$Xuz9`phE@CN$hI#eNOT+0)_Atd zQ(iIDg<-QYS^@jD(xd6#=D&D*piBG<(T2l0HTDRc7+mxk_ghf6dpa5+G5eQcBDZRWgZL9?a0N-Be4AyqH0$)~fNo?7 zrm8pC)#iV@rP27H6O7fKY16S&T-JVcjJolNDXNjQ>~!KyPq;5n<#RQe&~*be#rg$~ zh)2R7uMb*=xx7LL;vEVEm*P-2yqOAeO7^UVFtK0(CoC-^)%GO9n3$R2+clj0!mt4cZ@z$sJTt|J?j6ZzT{`b$JrDIQwA*qbuR^mZY?zlzsT@7% zDfagzFlai-9G^K%WFpgQ=(Gs${aV37QO-4s9sQfzvaBDAvw z#d3dyqqyN5;ak^y(FsCK3LA2`izL_t8-HryUSkhq%vgQDnF!a?L86Qh*{I0}F!?EF z2$W5-ud?5@Kda75@WftXiUo{$VH-=8vqVg?Z${SV5yoSAnmR`{5f=GoWnCM*sV8!B zp@cK-K=$@_^v!Z>FhUYF@39oZBk^~^w#mxXATK*SFo!K6acJvALrU%QWi%oJSM%9d z9diMFImr!X&fMie{BnLB;(Xys-r+}LxvO#iA64H0)KuGTtq2N6sTxp_Dop}N2Wiqo z0kNPE2u-RGT8NZTrGud=NOxU#rTc|a7&l`YMY2!1%zb!kJ*(6;@w5{&*^epvkd`nL4>FI#oO&~ZR9Z_@c+Lz0#Dt3qEFX8Fyy z-a~NQc>iNkf~sPkVU;2ismqk2lP`JXG$hup_TyzvbB@+|1{78$qRx{H@grkvNW`yK zgjNoKgxh?sF~^@V-=~~Dlm>|B{Wu`WZLofwldQQ{70~{YesfTC9_>o!2M4=eRr+aV zPNeMtEHLO-6efFKj$qY%HA1oX06B^@&Dg7KY))o1R??c1v;Lyfwk4xn1Dox9c^Y@V z48d+u)j!X&6!SDj6vDhp87#*dWT2d;mbRR&JKEz~7>36kSCyT#b(&*cLYN5>ijm7X z4Oi0yJnm3U&1pDxi4CWlUKgKow9w1ASl!6s3naMuL?Oan4j8)rcGmxqu%ZMa2^QL) zTyo*`&cryrM!Rl>cL-Lc-dc6lHc%x{}^9c!=_c)C)Xs7@15*Vj8MrV8S~2X-H&$K zbDyU&N{!3PefZ(-+z2V%`L&Ii8ur8>A+22b|zfn)>W^ z&FRTgU8Wsg4I|S~6Zu=n2@$zp{Iy^2mr9 z*?#^%9R~|kU?-NYllsYH!iS}r3M2cm=)lc2`I!m|phRw5$JMc0d6lVpBL-|F`ZtZH zD}NbUF1)56)aJ1<#_s9R-w>$iGM55K&}+wHXl;b_yRoGWIiu8bH%*XR#ClTBV8eQK z?>D=x)?zpDsFtbZ<*U^~4L3c{wMsYILFK7lnVIABt02qo8Pis)4SAgoe$$DwatSeI zwnOX7&W7GJ`*Et76;bDhKCtW-oSk(I(dh?EsbrQFM5AI6UM-(wP@~mTD`8QQiW&dl z(bL9P$zL5dlNltZZ~lvHViCUYAb&i?K6Nj&iDy#Si+O7cA+^C0G3nyz zeX@ZCL^)x-HQ_N@o?$QTseCZ}iZ9S@yS&vL<-F!4vkF?uv8%Xdh}nq!Bb9pm zId9yqI+ecF{<kCoXM)@O%gmxfF2rw10^oE*!5T3~}WtQAzfKo;{4`X@-^gi6Q+2;TFCBunD}+OhEB5Rj4eU`Kq(q~A=a`#E5KHV!|g@- zHxmT3gi%erOKmY-ZbIktHNbV6W$cAv=U^>I-lVoRZb5hS#a_^(*ViVHvuD3rJqQ2J zHr(@`@>Ou)TcD@)t>m5fdPEjJV`mLa<6O`J74P*mg1mC)E!+VQ7Q2iX?dwjBH>*4amSyi(jUE~C9i9yNt$k zExTgncbx&FCxKqs7v?n4`YP30ajjsY#&{hk7FuuCnBi5H#W6#qEOiAxz!tfdWK@?y z_O)@ot0Lnp_7~b8OGeJQZgK+lHp7mZE#||I&d`fYS>?nz!lQ7zSJyOSV(*GP6a$~wTE9G3Wp0^yXWpVXgCTy>P^b=1Y!RxTvS(*Kkne!M|bHn;=Y z2wx@76+)9Nl^N{_lwW<#aujyd8|O^*p#A&%n!$+ekJ!4A`}Sp!q8>%IJGsqOtW_#t z{f0Zk=^2!N#rKnjUfd^)`ffAo^m(yKCtt}nrFIQZJ4JZx4I{nT49c+$PT0gHG9s2b zwI;nKz^wNWZZ$F{i>@}bEgsZ!!WVeVA?Y#6g$v!2ZmV_+PCs(W-7+<=T%**O%q33d zlF6(hs9+9tvDeYC)1CwFYgjvM3;!bT^>yqC%e^fd=6Pg{_q zC)>wuvpf!6i!QF>fA#B6F8eGYbLU7!@5r2QX{h8|egftLkQ2ED7yorrN`Ff!uW`U< zPIERv@;>o=9blAnyZ^mm1W?HxT^ear)0Yoyo9#tOQoWD*Qv>lb-(`V@*A8flDQhfI z%mt4V%61oZ8R`20G%Rnflp8NcimB63tv_i3hN<*>?h2S~?WP7xOq#1<@sT^5X?(-G z4ZqrLSI)SFfzQSZL?*lpwT}nNVix5)lOrGK2G#E)R$i9)>ks|@`Z=Et{>oA%q81e`-{dQ+PA z!NLvt*S2NnH;s}JX8{eO%q%CMfo`-;gZ?f2ot;5oTslA~(Mew1#gaeo-BY@>>i2WH z@_PsIPHOmb48z$t*qct?&QX1L%-!-nRn=bAml`(v&5b+-Tl$kGOr_pIL&g2}y>B0H zKhqlc?j}*#gYY=drzY0BWi(~f@E?#RIWXzmSbRbOPaJ*OHNJuZ3+Dm&Ly@d*VJqU! zSsL3}VvqP-Ekh1xygNm<_k)XC^&@%F&CBO=iUJ+uS92WKNk}_y?>_K;@7UroRFkN$ zZ_4XH5Ve1l&uV<=*r4?!6HM1-APUphs}cV(8t}oRQ?BM=L7U3cp`)3P=U&l^A)s|! z{#?NGSedSy`=<8dm1BF&txC{*okEZ^Uw=vFl$@0A#(sm66#Slua9%KJR!CVM*Uce1 z3JVo1IBsG1W@2o7hYeqYs2{5uL^oz)ZZ_%Wy?E1N2;%18 zjxCYxg0d)oO``o9HNCvK1YqnEFKY{~)ciWku?K?+Tn{GKxs4i9>2Gj)ZLywe>Phd7 zPoIfz`6hjt_wtdF4c~3x%PnI+WzO7XTEUv2F0H5Et}@fZEm>Xb)N03?AMg?s#)BnDO&lk5c$aSX%PIz$Jr z)-W)PxdWu1nESsn&k$D!LqTYx4}!vR-haD56X@(sY|Wed%s-Sv zz*;ZE7i^b{0O*O@XOGLF#}B=vSHvXz!&@)r^VD^&p@*hf2@*9!+_K$4z5RwnL@XqP zu4PHYT#P+FK%s~RHJe@7t(Gddrt4#C(<@xk9UM@rM{kRJeG(udMs6^6Bc?K*l~9)2`qQ!7)8q+~2(W?SPv% z3sEWV^ROK|BjZLUSg-$D?6v*(UJbgFe=ISKRkcIk(qZRc)bB$(SuE3zVjf92m&&7T5z4tfWWZp@iak`BTT)=1@@yPJ!4mHp||RZ4WAg z3&gfZM`r`v3nUFal(+;WNRHX8w}}2J8srEWX{oz$aonx*KTIXOxGdw#zJ`HM7|Yty zf|wHzN?UAoMudCKcH52>&>y1$?tzouU-9t}si1l|8NMUu zDZ867MgBBrDp+uChW~e<=>Q63q%+dE?%x|a+J&F>2v^C3rO0v>MG2XB+L)Uk_lN7y zn!T1k3i0?E6|lz8wZZLu#!%{hbi}lI*kY@D6zKv9DPd=|`7*ug=%m|aW62-{HM+q3RRfGt zqbX~x<9cy+&ONNyJH^keBH*Y-MctKl8A@9rt};=j#(MUkbyE$tzvwIIdrX$ug|0q4 z3&7m%`BL%I26lBOoOv{BXn}`qXjC|v;5fd7pDbaZZE?E5u8|KLI^M7ZpbrOQ`V)fQ zhaEP=iOsE%+@)l@#shq}RBR>lOQS`yob#t>KDp-4A+Hkr%+_?1Mes5rrR%`F&aAf*u!Y#WErw^(R%J|rXrdiml0h=iDeCz$!2PfC@qL`s0z;GO}>Ws zx#aeGU5wf%WiV(v0DcRy#`#g^m5zSt0kYTgE9MARJs1ugu5Yf{Z*lLaN-6vZ%gSbr z3LqXB))rsa)Sv#NG^gs;Y{QhjzR*nuj(^r68C1n@R~UiQl@7jwCksB!sSdq|VbpWK znSLWw5bFM(arm@M(>b)D&{qSDH`RNe`jH#A-)pQtI%8*_@DbB?g+D8{_pJk1!x zYOR+m8knRR6)y>{=WnSpGCJWuHDR4Mi283nYz%3+j7^OCQM@-^t!fY0GRH}6GRTkC zLc?0_ncj8=>Sw8e<_Ey3n!>O3FAgP3af?EDI{5_pOw8ofVw>OaeoNvKLnb~UF)o1jl~kVSTtW^w4h=fjO*d+Wbr4J9P98 z_LGg<>cr5y3f#YkS4Z%0dwkdE`&+=j-hDQD8a&NLx_CFc3wJA?9y(qq8Afe3W*_y9 z{{F89fCYmux~H9KeOybRx4m;^$`=*Sk?*|4^ogcO@(oAp1OP|T={H)Q7YK$Xe(Wbr z=;ZHJjh;U5IOJ$w4B*`p(srG?FRB*Vrk`58|2r$!T1XssyL(5{jftd2m%r=sHKrbu zv-`?N#2Uvr;qXj6KgE1Giz<)q{oMOOrs0nY0&2f_s`%iDfEvj^hbR&-y9wy5Q*vp) zZOYzm16SZ`@C%{k@>uhQ+I3L?STWgi-^v6Hk*wQI>HIG`%&=|X}BW?%;u!*O6x9K$p zJ4tvPeb8^=fw`{U#%HJ6nLb=R$A3KkGl~00Hik)DWD4%y8qs{Tjr z!&_EfN30~136})ljIkq9<+{KRT+{lw{Puw}LtlAo)6UDtefae|w!}7@v-}=2&~+wN ze`B8zvm{Gn^dC4tH)l)9kl12s(WMSi`b^H1s|9H_qalS`&#Sm^0(Hli0v;rwHj&n? zP3e?L`H&z9R0lVGDJ(!t+qp*l&TM@qsTrJx6B~dH2Pm|eR3RqAT>TVV@vfy1^iX`M z9&r?Qctib#QL|#7r6WWZ$~cBh;$}CKL#xEZllhL?1Rr0*KWL7(#ql(lC@|sN#~Le- z)VMU_BZ+L!abNv=cqp-N$v1OFcLJ~(@}{#q+m?e@l^KUpEtbE%)}wo1xl~Jp#&&do z8Se0*>cX{Z9ML9-F;|KKhU)gY^rwIB1WCgX~ z^-kV~x@v4Bqe|PpkBy<=<>szGj?dsqjt0~*;-R69Rh&?1Mf5m$^4dy{y!oK8KrnFf ztv0xkCQNz08yoHnfu&-1bGhh})wJz`V6olLdVQg-;(HVuN}uTZc2lD)?i(x?;}B171gsJ3Kdj~H(*PMdO%jZsZ0 zn`-fKx1K0*TV-Av)s>&)?7<}6QIhGmG!5xcDa(amA=8!fQXbyubXRWRoH7ZyGbO z?(MGFgxhA06aKNG67GS8QXgF@TM5NOid?b#VOBC+YlZhrJGRArP||c)3scLc?zz`X z#oSzIHW$yWj-xdWJzt)WdhNqm-*!%EwXDmgDP}$2O6$XEHKHRBX?Ywlel(gH}3u?hYiVnM`cG~No zQG8uEXJZQtN}#HFUBUWfQv66uE7h2dRy`3>OZY`$v|qk=dhl|?(mz|9%l8S$Ld=QY z{!mmfc}=A_R)8IXSHaV*q|P(vLlr--%u{4vOP z#%4?7L(>`bqyIv%P3?MR2Hz44+xWdA;$lo$r;S8kt~;2wD9c z#+J$B( zh%-SblDjn&KaD$nM6hMN=6v?rdlmi79Sm;a*W};N*1PCoG3)5=lT#qCsE>|UFwXIB z9)6p`>VY=9JJpXBmG@7{EKk(Ou@!rq*V zBhF4Yz4PLqb1GO&$$p&H*{l5IE--e@kmTMn+3N@y;!_^^|`Zw;6*fcNFrmc{z8l`q?lK zdPP*Ve6z>)4Ebs-=7-V@6`&G^szogLfx^iOZ}V61E`3QVy#wU$any7+w#Bgd5n_&2 z!9wHv9zJwgqUu`QQmXrqySLS%kpQ=UTl#FC-e+Ny)>W&!DCU@~%<#b{U)9Nl;c!Rf z8oR>ccYB*&UebgvvFG)$p7=(u_2S{z^k!RIj;T_IYk53|8FT4bw=xsw^kw2t%)SLm z2SPZY{(3p80mvN=79dV1Hqo2E$_t9{ueJVNK zLA)ASUD;QfEVM!s;5FnQE_`{VL8PP8^;_)1v1Em8VCh)`jwgN>;?D;*q0y28kzfY} z`k*|tbr;7%0=am6>tcpR60Q{Ydz4+x^ffbmGW13fnV-!h9|eTq+~V7L`O4LFx^-O_ zEaH@~*JLPba+y|JhUhye1-BIyv~yn*p-JO^Xjb|{W=k0@^sFi#R8Y1q6iS+}>ecLDf~Db~fKi#IMa zBn|4&6>d;1B9OyUwg}Dl3eU@6Leq2W-Y+tq`$D9qT#9Lm&wwa*g7uKHzdqb7f(x0O zR0)D(VTXfu=#4A8Lp4JP1zGgU%RE+*l2{!(#CY>dSznDClJjJ+?1-iUEcF3E|Lsx- z?~OvU7Vf^cGJboDu<8kEolmq~BF8^KnT|K>c|6Zdb_A$-IK2(Q-Ov=ZrB7SG7EWwC z++(-07bkKuH&jf&ifpJRo9vS^21NiAV!OAi_p*xrcJo7}{~1r*qnHrdDJt+)Q%)$m zj|Y{BO&?F8+J8i-B<$blpntHqU|^Lho3};6jHg{t1U}wzSB%6pAJt16Y!fdCJz!rA zq;7adr!`5vbY;y}atwX^IaYE3qg!aj4~Perw{a!;pLENgpV)lashrfBo300j?ddNI zA$M!?M}a7BFSY~>IR0*27J*o{qyZem5p&cOIv0_EN=;BQOBr6|jn@k1?^cUUPg2?)xK_Y{@THcsl&F74;&PW?!aEDx#g9}`mlo|cU)@ft+Z8p6ZQam zTN8KxW!Rci9*mQfBX9oyGp2|J~7ytp`ElKHB%TqJLA%=e+N1xCVo)Dm&D zyBenr%2O`!1|+?g&y*;o?yqHT5^A9(2QlsM>hOy2T<(}$A97<`CN1vlNetjUtKe_F zpi{|TK{Wt7cWYL8b^*t+NP8&-i>m!Nw`NV5t3(VvVSAY2mhJjQ zL=FAv{oap^bF010=7Nctc3ZLYlq&CkP(d9lA!aoAL zyw_*#vAzVY^6fmh!*!OUh}icE8!#!ORz z+r!k+-*W(dlQ|Gr7LD=2A}nsU92CNQ5%-!dD2PCP&`f&2b*(ui@5d7DW97JFuXyg@ zLQm+!B8R`bbiTFOIb;c1KO|r(jRB7??@tX-@P#6R$=r+hDY?pI0Q>UodLeH(ZD)e< zR9)8?+P~E_)ZFqU5XW542}DG|R@+itT+&qfqKH*H zg))Ng1ryxpnV+x`ku*U$;c%Hg?FLaHp8@ni%1)pT(O@{BxtA31{OEl#N7B(38LZl~ z^V&;w8MJv^I;T6c=kSaDmLt+Qri4=dQZwtm^5yB7I%ebn*uJU0(MB)3LHAz%ORGAt z#BV3v?nb#oGqUJdBWLv6V1PX<{t!#l^{?|~7&^D{VNWvR^ig?L>At&idxai-xzLFq zjlQRyI>CAEK6MBR1oo=v+;ZZk>n(gDk=9{@!DYg#nj_ZAd&zrypkQzr= z_Kt2XJhG_@U@A7)K{Up8d8&c2My`A8kBL}#5*Z_YSO0|x7m8h^ok7F`0FG>&2sq_X zD4M$LkK9Z9)73llK%q-E_ifd-lNW5J?JfW<2P&Oy|BW4x$>k#suvy81SWmO1O-hVg z^D7a{eV%rgq?L+>7n#4<9|vz+mYjd~nF71E}soiSt?WuKkWIC~!hh zgNJrF2q_@vvii$?LKWGt1ZXq-Fs0+OR7n#vE!LY-F$W5givcM8W&KDN>A#G(17dVv zaZU44Je-^JW-5yn{8c^uKn1cEaBBm;nq8=wFJtff*o&Smydkkh)}F(z=;gB;@4u-S zCWabZYhk`pfai5i%^5V8!T`d_p-HQfJNfF5`boZ{m<;_;Ig^ESMKo z-6fmHq^U0)YwOP%^+*>3Eb7AQ?X^I_ZkuMRRtR0qjn}`ZAQ3qJg*8A=jAF`ssng2P z{%hWvIY&D>r%{Ka)y(cPd<^A{kg7S`%~MKRcQMdcE$n`FSVo2qd_p1IHk>_g$}4`X z(Y_hT5g{WSlG<>7&?0{|D;|-u0np`&&Iwy@?ev?McXa^_lzMmeQIfEPWci2sV4^jRSz?DH z#9W*1eH22h&OGBooXkVcbOq|e(WOJI%U14STdA0@hGTeBqPx+y*Rywv1x#2wvDxLP zGFBVIb05kOncZBiOi~EV_N%=XhJWb8I@};;nyI@g)Jb=<5uwobC)Pzs)VjJenY&fwPryX_jV{krs@~$U)9DG#<0M$ z9}1}z1LtPT8+g-3L5F~Phf3KeP71m#tQhD{81VjMX(^**36MDGt>${405`IyvDF+U z3(Edjm0y(`6H`27WD<`-ts+qmCGK^nBk!B>rlY77W`9xggKF)439> zV83Z~5_t-z(Z_FZ%Y)5cKly$IPhqi~xOC6`*)H7ZSTBFxZd$6@2%?#N|LXnR435;) z(>2Rq`!|zbw4MQOhIw<_5fe1OZ|#8VsQp#x>OpN7ComVb3|5*PVL6{#kh8=m zF}1+So%}%4&l^=Mo{$Uw;>KKVjgZg&GdJivT}w`8dk#>Rjh|m1SMz*HE4AIE98nZh z1HANbq0Xg!UP|mNMJJ3k>O-uhbH~J&0HCr4>`o!JBKXYFo~H_2f^sdUO8|G@i~4tg z808k)yOS-S#W0j@n@6eAWz;R zwMsUh&D62`AF|CB`m$BoUo#$g^%Gv(CU6v9wSU^X+srsS7(Bn1AGs=W8Jw?i<)0;!etTY&IWcZ$0T>kLq`>A#SWmCe`E1 zEHl^myP32YxaFu}gUZPXH=%cmWng@*_c!keG9{HPAAT7Ar$Tr!0yQnBwe7hd~-GVb~->PIp>Y(d& zuVpVo@o97t_pLCMM(*?PhqkM@NAFWFI>WNyl4t9T_Bf&283~g7Qzi;Mgyz_LCfI)O zv+Y!UGpNWz_zmnIcCh_B&orKq`%c=)ukZVYtlk3Uce>p^G;6wpGEb6*wzpjccZC6y zti?z+rGjUE#_fI0u?nU-jSCa?&0G21W@(0(zhrC%+e*=}&2@r5LO<4Z6$U_C{h>d{ zsA1);FwuGVGmcZ0FWS=Tt=xgbnZ3m zc(vn#`RKcQL0h%Hw@DDNr%g__{B^k@C{JBp7XJ}(F06$qC`9)a`{B+}AJI-qJr1={ zyy!-Y?j+{=j1tR+aln9uSAC=)FY)CEmY=0(yP@cBk48NEA@mmGbd{TEvIM~B#%Zi( zOH5Al9N;yjBgXV14*~z(4D(4OUKSyyCO3?{Srp*mpP=FyuENf^i3NH@(h!wZJ;nbo zC^InIrTm+^sL+-O7C^mbNNXQ=BE4M=w5&OIvPSplx4N7AUH+-!ct|YI?6-d_#~x2e zzj(W4BD9!re*7v)d==Phyn&(9h_}GA?5#zp+Zz5sD?z&X++u}hlNVIafV7R&~s74Od7*Jlz+_cQnowZvkgZV%a40cRk6gH`5aJ7jDn$aMPL<#wfWD!!ed&GUy2vyx8L2R>AEg=W@P5f$aS4raR#?tU*x zEed``ge4{o8a+#fQP-8+43h+8FGb$NNz*O-Ski(*Nz?)FYT+bD?&`~MnP=?TZh4k z)Wlj&!Olc6zTm~Rc#3pre7it=6G%#Ed?bk-*M(ss+S_B87HL7uzv)z!I$qLL z+3~NR`T(RPG$0O@O6Bf)Xx10{*>>ta26QlI&Sq%r2?#pZ%LJ_BvmTe5f>SLONK?tL zqokrm{c%O8V@T>Z(Jcgq%r))mtnt*Q8F6WpWtL-imh7ucUFyO!56p!L(lV*~CjfxM zgKPRq5=FJSI^TnkJZpT{2j_JK_yxURQ)=^$5<|5^o*8;(GcS}NWFdw)!Ly06x%s!e z5jH3hi%#+z7+{Cr3=sO^oEs$QVUoE|oZn@?UHPsy*GC-ECRJul{YaW{s9&UWfuLSI zzTNwKp%XUx*yYIuntG$62gW{PVvXn)9c6bG{ z+)_9&4V3qlH*ItdXb8NfIZ(IP!Y(&q*5a$Yg8oU1;dZ} zcAh~a?_`Fk6vP0CA)29Yg&D+ADwQ|t#%0d&F~bHa-#tV^XpEPTq0amgE>Gv#3=E@l z^bDi%(2rph&Zb*dpIQ4?Qc6{15-bS<4aub1 z%cWW|B(XCZm*^|+MKo#72MzLanNX1PQrjm+Lilb32ZW?IWoSb*+yF%;b$upf}EZ2-+B_0>l6ICcaa%tlNi)u!iUS3UeRq7h8k%{wl!7(d{uHd z*g(VKZmBd-l2J`~>Wz8sjdDM45Q2bb3Od5IG9?H29)H??zlk3VCO7Tv1CmpmHr9T+ znir&BQ`bUr`pMy%i#66=5J`4JNx69FJeYIH(0yH0zS){7U(RG=AIJ%`@RXf*GR!Nt z&4k1MXr1Mg2gQUcQOOqFw^w$BP%n^~mUoGdryoMSO2Tp?8Nma!&X*G4PGC=X%O;7)9ofFt zQnqj66MQVo?kkx;eSi#OeR!3B03f5=W?=nl#jAh3d89+wrq@I*ZL$S1eVJjFp~Q;4 z&$g+nR~%A&#lH{PXc@!+%;c6FU@k)W3%5E{N$9lVdpI9>1~!m%NHy!TdM1C$u8ml9_kp{5Y=E2 zOa3<)4(511&j8a8?QgbA4N0OmVS87!!T60(BJHgDd{j3JqufaHv-sUWy2q+c%aky0 z;|05n`1^Au)s`uwwn&(ozK>Zs9&zBhNZ&?DUo@{)vHRj~O3#qZN?n;OYEe{%^O>klM7Q_| z(V$<1s54%z65}3#B;944x#~hU@KU6cI4r|s{M-zv=X#T8_e#+L4g-hf*J+H0xl>$Z}O(rb> z4l775su3FUhi}yo0Fbbenp2Ic$^K|-^$sun-x>N1LY@xl{>UqI^s^&1myy2xxfx)KIXbm=FyxCI8YwT0)1=fx#RGa zMp5#FP?2l~s$`^xh5WY)n;AU|tC7U7e2jU0`_TC(D19S_xgpDWgZr(a2Bfr9Ix8x( z03r3oDjcO19%j^M+2R4u<6g-1(U;F*Mh%w&ju|;WdHMIor5Is7oUh?4z`&H}_m$z_ zYfgU0H*JGZYqSsfT9rNQ6je;ktq#LqqUAVJ_o&UZkvC5!H@)arv^vBht5=5ejM@&& z^v9f%_nH*fvssaVVAQXf__BPq^#@tmU&4ie!(F0XIl0?Q-E@gWFqQgG<(gP=-)X>y zh34>>xT+tGO8`v`SOW<)7#~MqN^Lyy1>Mgqj?t3(QT)%V_OlOEZXb<8cJ-q zu+T$5v*5AW^6Ujofi1ck{;;=FbBDlHN?#oUs}>+DrTo6hGU$R zTj0LnQ{}MzZEp;s&DLAgt;{xOK}E*>BLx5yq#rCVB5!F*XZ&I`bCC`;fft4-G~1NF zUME4~_SS)(&6jn3l&0{yfe0S6twP+97NMJX%kju&^P||yiIf(Bin&KK){Hch72Khp zTqM>+*y}1&&+iv`@61d6D(?M8GIRZfzt`WKz&nRiTb(Tw8wGp;SeEW*zp;^eys5Z3 za=Bj;gjW;E^kj`GdAt!f;iKf>ma|Miw zW0{yG9gHj9+iUaAkw=4qMNAOiB1KxaZco_?i9l} zdqhnvy~g_%$?q(yH}$U+_%f|ZH^u{A!F-)}LAb_@jfKVvv&YgJlJ5`4!E6RYMC*S8 z0m@wh|2*i!KP&;69HjlUaV00mn}6=xPs$>{vpHsl(x@{<ywAdvTUhGkTBhet+4|zPh;lG}=^wz@;-77o;M$27 zwSw0Jo_MUnrW21Dzk`9-MU!ifwd7r<+TXRh)UxrFO`rbdyD6x2$61y{byB9y;Oy_4 zQo@(*N~}(H@9y27;E>0Da(cM%{y6$PoFtg7p^#Xzg4j1U)_J(wd(MOl5mB?-FTwobd5R(+E ztW7Tm^E}YVHyu5Fu9_6?P7|~JjZMO$lVOSeaMC&}XAw7&p<-xAI&+~zi<@b)&9A$f z);$k5kF+$Dn%@inccWD%?!vQYV-1{j`Q)A_#dWiPKKG}fQ@rQCx3)Z_2j?IDt{O2> zKoIp1XdhnD|1d$c%F7wd)K8Jp=EcyDOA6XK8Zs=$LQN=^0%YtG%ws8#(J0$@p?&*? zklW37PN|~Q795g`&YFamR9L!U*?f1VW2?c{v0QnWwJh;GwL|C`!Yh_*%5rOEv}7+i zyd&K%?C$wsQIzD=BRk3Aa>|R{#@Xa9QzdB~=sU8O;yRFDGCi^RZQh}XIWlEttYxC2 zbYlrutRZoJvK_bX4W}nt929}k5VTy{fi0F76KZ@px6Z)8y5Yo5toN&_m~fqntFMCq z#!wUX$Kxa&eMHlQo7p&xcj=>iLD&oF*h%|kzI)uvhzDVyj-UgSIbs5YO)lMI%$=P+ z>~>L13V~Z~_vs!^jip@}IW-ioCrzJNFmNEoaE@pq|JVy=Qt9p`+#>|;&)q);z0#YG z6YIeIWusy>mjj(hfFxb%YOA zc1gSNExc8qgi* z>SF@N^PEy*rdYnrs&G2*_dyf=(eH7W$*jphzO}_UiDix7YCoS|3>`1{f+`fiEL=re zyNmW;{L!c6KEO|b^}U^9f4EOKLdeE$Y^8}zn#e9XX&rfW3I6ChwS5g5!vOu5Egs4l z{8)pPuN6W|(`dCOg5K5z#EScYe$9A;qsO4z%06RocVkle1GO)ozyEdio)ijJNfn3S zr=zf4zIxAmtUAs_p`3E)KPzO+&jq!c!^8W<u?sbB-3SgZrW+dZC-p#1A4qzwDG$3A4kfK2vh)ryNPFQ)pHW#Fbrq6hc~ z|0ZQX^F!8$>&3mUvqy;^MQi+~PkxPmr@i!_iORtj;1b^b4|N*&D#Yj_Sqm-9)L2Oj zFtq~o5y<@-QCVBdye@j=DV3hwX)YD}%MjpKV#tC0deK}WIFqJhQFb}Pd%n7g;JXn$8N0%jqb;KHb?$k6T#Nch@;e~oxPU+O68O<+%scUdIbt*3~uwni9hZwD;iP-M!@3W3cp{ragK(7LB zHZVZcwDJmV@vDDopZ{L$f3Nyj0B~j2eRTu=n@SxCvd_J)JzJtIj&5S0s{AXo*A^2R5EX*l{6wGB}VGZ-8oAZ`b!F0|gZ z`SE%89~qecxi|jviNS9269>)lSUqdrknS;W=&wf2$F<$-c=_`QgdC)xl|9!Ik4dxGoj8|Phyti0 z|ND;red|9v7bCqLgY@g4{{5yOFI`a6mR9KopZ@n!{oiZ*KOgb`Jo##RafJLo&fYt$ zsV{2-wO~a=K|wmGfIuJ$(wm5gbm=`v?@elefPjF~kuFt`&}$%}1R}i`=^X(np+gA0 z+>@D~_xZj%GvCbIe|#Pfu+Ki{?6ub3YrX4zOHb6R|5`X*vB1E|95o8D6o2mZk9Ysa zD;AQ#n?N$@nR5QkGXZuG3w%ob3iBbZe=_@j{QJMI_<8`-(FO}<{k>u9j;|ddduum& zX!U1)f31xFvAqAul^0yVigzlt$o^vuF9d<<#bst1|K&OV?mz$Czf)1bGfb6^44M7) z3>M75xVksqw*R$r|4-g9;7DkJzpBxT&y)D$xA%Z|Y~$I&{!bUxzZ&%224D<}lS2l1 ze>O$VH-V>e4YqsB{J*~GzZ&4rb)mb!e1w(FbJ+iy&r{T$NJb|+EZdOkf3;hVdj=ehiOC>Ek> zKwAf3s<0`?nN$NyloMV3o6c9pY}YEz1un!tzCkI#AeXV61}^&TF-;l1~tJsrW! ze02ym#!=dT0GPy1AO9cw^ku*9%qwAbUqR#EpG*JQpic;~yUgAB?VpEYi~#Hgs#dP_ z=fZ#Rl&{i-2{BZ7ziyoCFBjrM23$~dkY)Mn|9?I7|6#Qkp{x3TxBv+IBU8fbF|E-c z`QuKI1SdIBs^0VO$NC?)abg8N=2DNhYT=&~yCh-YZwKmsvT6Us2mPamdcjKAow2Un zQ~(W2X35x--VZ!Yt3qAxhm*+tM8)fRm8I>WQA|pD*zL+o?MfOR!w(vNoVk3w|2% z&bIs{W8)WI!yyFp)L!}CIuI29?*F#{+Z%lPFQdbsU;AIb;Hz>;9}+3(z9zi^A7QPg zN`uYDVV_|p48xeGUUPs};?_%FF#2jaZ6#QSyYpZ|ow{CgwCk8*1%Ccn`A?XD&vN57 z?Cw7u|6g7l$pZ3goJuE~%YEHRp7FnfJXYh0^x`AF@(FuEoIVFk?Z@dhDWu^7gmLZ9 zHl`xXugxx2B^7hYCHhAG)sTG0H;xbq+FyD8-`?c^^V4d6UoHUl)A-}A-A-5U1>_@3@ z{QG6{KiAY-+4N2Ta4s>uzp!0DzHnc+7z;^#K9zFb<(XC3>m_VEpgyTGU3eIESvv4h zynXHKm2nYrb%Q@!gzX~= zD5qBg$d*3NDieSc6u^GxOaM%tFG~Ub`1hS4ggo-*(HZkaqDWoa3iSg%?-O^_$xf%+ zlO#ZhvJu!PTW-+I90bw`Ia?%+Fw2mkfTM9WfzEv$fSPTD3vXDsB-%!q=W}G;Qn>^u zyf~@CiF;+k z59k}+E`^LonQDp$=SL902sMO?nASTOkVTjR5E|Zs|28f{V70M)>PK!Jgsgl&#s43 zCWx4uAmhUS?#G8O9%6t=6Ao$)+e|ucsv~cSC0i6o55FgzvO6IW@{uy<27vmC9UyTe zhf4rVe-)6>5nfC%Zm27Uty|Y0nLOe=f(P*alC*BsyPWrQ#Ej`bUIX{Y+!s%Ms*?;> z=ixo{nh&xMe~8#^2WU7Pdo9VLwl()HrVEw+^2>c;Hwdxw)N?mI%I+jo(6q*5L5k9u z(x$4~bKXBOMI};Z;T-U7Ra0&=qUHX*Kz7o4j8EP3tzVawj3BFo8NOg#*i1V3p>Ww6 z@>l3DPe8ecG-Dzj;?WM6je#_cJ2sPPg@HDR#2}fKvQwsky8hD z9Kbqa*nB$yN#DuiP0XeSknxnRs(jnC=>K31z;7!#d^@S#g!OVFy12ugwH^>Ok^YwE zbwJeCU!}Ph*Xrvw0~-OzU7a?74nKkiDwzPBiQno1fk_Xb9n)Z1KiHn10>n%V_|n$u z0ol#*+Owlo-y02lAR)V|g*aasKD!e-&A#jN)9&+O@2Kv_@0ExwB|G^Yd+14%0yRK| zOFS#V6Uz($LU;p^%pqN;;x>8n4hf(>gT%^-1{Z+Sh8t~~pp)61zIwOqW=hl(ECm;X z_rW)Uo1WCME{xq^5c8^>w=Zp`AV#+ZRh|PKfK$nWPLqU+;*kxIDNz_04ayK%7nnc% z%$j=Lt~4Hy9O`p@r?i@k$r8Z6JEZHc*&T+c$NCDslm(z411J8G&=*LIhHXQyt#xz*uP`icZn zVLfFjqMk_4t@>+{Vu0IK7#EvE?V;ys8>*K9_q60XY8dn@b$X>fj&Htf5@cd_C9&yn z=KO5QdpDCIKwxVMfa#CwllyecdPvS-fVVNL=lc_giWED{;-L5M?Z_)x3IR00tka%& z3(*p(%h@cc&oY4O8q44sdwv8Vq(>JHmvjETqwC@%g5V!^)qywW#dhr4b;&7o9iVPo zS1(UiLy~iW9_lyoSag15e6{csi_ghC!@#EFIHApf z8M{Voy#Gaxt6gEf@Prv4cXaCLAm--OZsxR|c4#D#+X-96#bbbk|L~ zC7RI8G}ubaE!RJgO|c1p>E&{2V5s$8?>&S=Q8*P3{JYP3r5k@rBp(gBkL$P8Ow%kd zXOiREEp8}a$z)&+h0b!M3Te2hq;jfW8lZGoLvi?48q7yB<{o9&?$}Yb^GSM|=x8`( z`{g9?`h~DSb@^+!JEV>QKU3Dip~(Pi#ed1K5%V-nkP$a{%!<#beJ7{3(^; zj_3)TLypebD|$dWyaE5zE(B&aN&RR;A9)V62z|26yd=P1 zrge&&gTIXhsO_)DH)w!;9yw}tG&ZnY4EYSOl!5BE;SB%=f@beH$)@C15dIDE0?0&c zr|nUF-ZzHf4Gx3D;0eI*Hcs5uT57!Xs6GVX@Gwuc9IGNIuWQ+w1W~F7i2FF*9Ns8N zzy=uB`x$*r@4B`k_luLbK+TBhUWhxy;lZBqT}Ob*c$VjUTch=12#BoCQ^K%hv=Wfe zyGEfUfnLeW@2}MA|L*O$JdhnxGZ)O^H(^?^4&Bx)DH8-_x87l+j(+&P4GEA3eFdbN zN`09qI7;n4$2M9Q*ABw~X`oq!dth%+sm^D0nF6R$)t48-IbaxpDzWnJqt_o#PvR>g zsrK14L~8H!ou2Ju+~h!|A8StcCZ+&|Cc6H9O#)A7$#5mW+Zg2WQ+${FqIEhSyy5ma zLmX-8hvh4Y08yf?+p^QnBdtUrcKMX(yn(%u{L%5<=g#f4bxejxDShye;w4zv{a51+ zl}#@hKqXg?aB1fvyCDlTfXrYPh)NicFM|ry9WEvXd8`2q6olRr;^POJT8-bsx4QT4 zW3l;luw&$MzEvmuOv~+bkspIaAEXr5zt5$_1`55C8tlnd*VO0T4bmnvMMEz-3KTD! zgOEngVx2~bDJ3zfz}cf}iO!zg(DV!L3UOw6h00Sobf^n>SfOx7r`if+LWp^U{TK24 zxL)c&xYdF2Y_vC@;;!%#_n~`~OIx(-sCz~-p^K)Tn`6mjFN~|_QIBbX3H|#vrXFG| zxfVal(rQ5XZ}e-nZ7h)q6GHZF@SjA+|8eR~iMe3cp+tqQOWGbA3>>~AmzZsP7Nd)7 zT_Ne_@42Oaf%=MlTgSJQcbxshJ7Z;cFeG337SgG+rO*4+jJE;NQG0Ot%`|oND{L z#u?SqsJx$kq1;~C9-ir5D-s^DL3Ap`d(l2^G2nh2u%S?T6A1U?U9-CU^@_D-h2=dU z(U$Ii-Ird$)z)x%hSQ0C~2E*YHkDfSY~lJ8XZys`<3*RzqL;+JWtbY1yZWHc9{|_q+Omew@Zfx*0%??Uux- z3cv6o!$TE0kGMSoOLqi$F+gkq>_IKx0~(ynT5rlvMvV-6Iz#{^O4*h9D<81Wz|ObU zk>%yljz*TH77v0dm9TE0OdTEY1qE~^&v!g&rlFiREo%v3`!;|^XmFQu%TxipnT2AI zJBjY~8agcYpPFEMT|B)_LnLt=2&jkVtR)@QjN|Ep%aDYm#rkJ^&mb1$_6sGwX9fBi zZXFF@SmPdiZiK$}c&Ti#%@SJy7Q2?uIdK$nWC-nFF~inAd1_m%U0d#9%rwx^A_S*& z2;3b^td5q>>=B-(%>)%BE?znMGGG3v_a)2Hl~X0!mEZ+MYiZ`Q@<)pwdEf47dw_T4 zJNF*qN_+s?A8Z|ffe~H{IiDXl$5%K?r)p3Z1hWq+ez2zW`CC!3PyI&M$!>_rcxZ35 zQj(pqIzMhcQ2|?rhN-6%9X9xwhdRH0+(6$xW37*hY1#$iplQ+ zXp$v$T4<(osqZJyG;rLEQy+gw;Jm8$Bz5`>xE>g>y_Bu;;$#A=Q^ncBth1uGou$9e zMWOAGw))09)>pMCRsP=~wJb&?c04!mTS=17=97AtNaxq=+hYRXLXp=+JWIK{sMAlO zkA&+lrxhlSdl#6ywtSF!HJk+;MW(ohjP)lInvQ~H13WX|F-;LD*A%zWt0XpAabiCu z+>Nz3kLXfD0^GwGit8N@fWuD;_cOk+LVmLtme2D%XEt;qVQ;tUL!J)2Kd@mE4n&xm zV={kQuJ%pOmlaNAo=BxmbtOfg7C3dvaDM+^K}Bzq;38lO06eK93!?q zp&O|gBNmR1V?n+$F}Vb{nW|mD?7oahC-j-|X#Sw(85oF3TY3oF`Q2{m4a&LW;AoGx z{g`V--X74Ed45MjTX5Ux4baB_jbjsT((r=5W$r_b#m-05pOV*KDsZ4EBv@c7gW&6u z?E|_w^7)c!b2~|=BCmd5p{G|k&`^w|3ONQb*x%=|m4=+jd+Q1-9GF=uv;jXj1fZq^ z8QBwnh$L(Gz@*khJzC^6=^>L?1I8V#^L34)4(KA;tc;aRon|-VlRbb8YOc)ye7=$? zXsMnr<*^-R?+4tu9n&c1PIA)}dJr>2iEB$DJy+@3+tcO?MK`rRJ}h<@X<2CY>jI7x z;+_dvRxnN(iJj+UE~YPTiy<7o=#nnV4l zNq6RJmfncuAv<+k{G!QPkkc1ORdx=#yZmHs9lLu$`|In3T|GsT~~(VjpY zoC2_Iyjh(gB15R8y;h(3Y>maZcumjEiIc8pzK!9O;kKI@>Z#YAbuXQ`E<#TL70m9_ z)9J(?qnmzf_Oh?U_iEVAQf9PQdO~tE#37?=J-+d`sI14tA$um_xfY69Jlw`TAHBPK z@||0%kx0c9=&e>96rC`o?cd$IHRn$;%AAoDinjyDxq+ONw>r zE%NaYL@>)NCc1AYdAIdYAw#F2dy^ikh1i!!ygkPIR7mNHI{96oq?jt_uCY!3lYQ~G zXmD09Z-Ma>LOJ1u8`IWrPapeF4{(bkM~_)aA>#bt4h!e4RQiD>wc!r!&K@!1d5WX+ zv(0m|-AfNRRzmANoo@9S7uchub2K9@JwC1-d3z2D>Rtuk8AIgn&wWiewoh%pF*)!I z(&B*(up&ydaJU|)*5>@b9hjJm7I{y-)*}SMT&xg7&E6 z>3+VBWxKR4kuC?&#&~+zl#Re7bx-K_mbXk=k^$tv+PoHoddI5wtxRP5L=V)LzhJ$g z>q^;^trEj+_Y0+OpEFs!WU(vzbe=%lefG>yA(b`7`HLwfOX*na<9mLf8pEu+D^;4!E8b<+hw(XoZVU9^2rv+t5QLKE zrmR_iFX<}i$hYotMj!4MyW2NhI zi!8J~!B=rRp$s<@2Mfv>TLtogY*PrX|MimBla>5UKp}>?lp}Us-zrFKG5HDV>4JV~ z_VyZ62s(@td-tXJWydwW$G3?S*Ya6Mjbhw3Q<6mJX<}ke5l#%HX0$mGc&EEQ!kD&b zCsEJZ*>6Wc8ksnBPHb!Ax{6(?)b*OhClJd7>FEm+i$bmZpI;WH&8_zbp`-O2W`a^wmgNjiw|3nmXPA!E z0e5Y|aLNBFuXZ?UrkamwN-S$cBlwi7?I!np{2Lr(C%-V}$QbutPek*b;P%A$!D8(T zv+e3eWdF(iS2e7b-dIuJ+-6u z6YryJ)i2)QjfsaC<7?iH@q?96$K6Y2IRP{9FfU|Lkg;`tIckd&;t57UQf#BAlnA2m zYu{YY!_BV%NMpJ871y~rc%N{zb@6z`cKh?X8MkTpb%B^*l)gnW>AE+#@9II0COtVl zzQCYH@_Q~ZjL|{Yx@>Td?mDLHr$Z~-JaazHT#`uE<{G^$3lai-z4KhoImSLC|A6PX zzz%cRZQpO?NMmz6Hh1*kuE{WwGvNp_Z6<+6b+G4u6w*3$JR=1J%D+mA_$HYTMSpUe zbd=T+PkI$HK=R-zV>kGiDK)eJ0NwyX$Ja*0TKbX0aX^o~U7Vmskx~f7?K!dTq|oNP zZ?U@1sSKmvkMX|=q3D%=uC-x%gPg>y@YUkNXN%kX8yZUPr@vXnWi|lT_(>_cIZckX zCTgpy7Y0D~#1&iFyQdDi`Z(>qsZ%Jwv&A(HrOqqlnyRTc9A)fn94|ud&Edj#lif!2 zoD>w6=u8vwmsgT0jU?dsFk7qvNONaTnJ*HBccS+RZ;du-5vi#tGopC(I`q2NXHOvA zo-Jiu5pb{;5%AR!fRM{O4(&<+O?nP&@A;WZ@PY~e^rYL6*%9d2VdbC~6VV2U$e)sj zM5Hh?GU~4;M73+)eh?>eBHJm|jLch_o%>ad5)KrXN7982?7=@vi`mCeC%b1jIYL%id53^#Pr) z#cqOexJ*kZHhE-b&&bSA9%5t4y$QWPU>a*Od`i2c1+=^SJU0**#PJo{n~&cf-I`5yY@sr=P2sk_Z_@BdXw2!62WcH5 zZ6@CFo#Hjv<itiNoc{6fiSyQ@#* z5g^HA;4I~^gu02z?zGf;kc75r9eqrKGYAF0ESxXP=^h8Fg?+EmCjh(CzD*^}xqe=6 z48I@zOjsq-vdFzKcjXgkh?u$caSbzu6LYZ+xj|di*CR%Wdh7UBQ z`S|U3o$cS2RY}^D^z?7S1?E0I_vr}av@bziFikd+Fq_PlvL99ryn!#XH)zF&9uKbE zpE-d#bPx}p1I%2VwNZZB?&Agk5ea$g6p-xVq;S~*nKg{H$W8x#(rPiz-egY?_m?x-wp2Ec_1xH>7BfFIe>xX`w|#jf}!;Zr(rcVu%jX7mN_0sJ9|DzgW4h5 zTL_&qdxb*?8}WlQS(2OQZvp8ZiyDOomB*^_lst zk$2fuHgfD@pSlT(YA<=MgjG=dn1_IN68zGU#z3j(R$n>NSsK%EQ-sWnNOV2Z08-9r^_ zy6my751C*Mlff^^7HMar_?HCucMO?kdITvP@4rgVCwoWN&>}Q4i~eAEb#Cj#XjKZj z{dZ_eHTBsZ6**?Vu`@MOR zaS!T$$AIYmOY%=DL_})$Ufqr4y7_pQ@lNoE7jKwiA}@S{2Th)z^c=~jdb%zG8meym zx^=xv2w^94#nV)t^)CC=N5u)#J?`!i4bSbVU~tmmt!guia$L1of=$z|M0D1-v76lz zQOGew8<6qT#p_wmRt(n2cb6>jhNA~@k2i!UW zmY1JTytCTzvfSUH7>*O0L5i4+AHNGp;#!x~sdXCaD!_Ulb1KN@8RTY@^m~liL)TH| zo0xMzW!`Cw%C8GZx$^sv!j``U#Vy(!->#l{d;WGTiMcJNuDM*i<&_+s683aiVf{O4 zC`>>XWv(?NZj;72;Ef$HtNr>z-=_w#gAo@1q*5M{7N5Kyy<$6UuyTeQ7e5heQ5Gpg zxhNeC>qZ-ocSt&(d5_HG5!V;nNu(>?qFZUF+i_JGxr;=R`j1R5mfBHJEG?f>OdLpgk54i(7wfv_XY{f%gZq$Jxzjk68iye3T>8#=zNzMjU$gY zwprzPH=w_zR$XYaLUUo#v0f=&vgTf$QR3HGUOIABcgvdt1uvzGeMogDYgL1 zHoUQ~e3&{vD&8d|({0qFl|4GUTf+aU`r4R|;jXTacbsZ5rNKHt&C&M4^1fBDpT>FOZsIwnq9J@t3bEMNM5&bsad{v zIq#{4wJH8G1QOVxj(amc=aIQP)-AnUZw+&^;(`s!l41#JsTu)32eUzvuG`@g+!AJO zcAw^|1vsmIe{mG0*(FWPL9nNKo2Zt31k&7KJ54bl<^4*JvbT%Iv<-4IVC~X9RMt6n zZ!%NOkCyI4Mjn%f(&umTXA*Tc&?jTv3R>QW3;7KIPF{?u=6aBPBo%jYy5kJM!B38y z_E@ciXppYc0-b1Wul$*6s%`?16{B0lKBl%-7rEgSP!PZ!(CE4#H^iAV z{K$l!TXK2;v8V!yff8$a(WT3`6#7X`jaBUF`&pnHp+G=^u^9|Bw_h1Jd ztWlQK9SNoTw3NLT$W_FV+&>0{{KiVh`IoLvwA_vc>bo90%87$B&ONHS1Z)wMI=I*y zj_e>xELEE5LGJX}Su__AHITz)RtR;V|TzNFs?Y5S=;*^+wkY}>OCZ|s1UH&lg^Z7gy=+`b7 z661T34kjDjJ7@Wr4N0WZFtGc!bri6QqN)GnqeQwdCeDc#aMT#JDwJw8N9sLXE15Ma z?62A`jcC}Fr^NKK#@*uJs(4pvIymTXtg6}wNdl)%O(2O-Fw5Um+Gv`xgR)-JZOyj1 zY;2Yz-0M02t@Hizt+r*V*&#MW<82xceJ4`=T&h2Pwra#IpyrI1S47C{^)jZR!Ei)@ zg7nz7#>7>z`1aASkby?KYzzf|9X_ALNHkBf>)7R2vwfg=*vZoZ)J}t8*Wqf<#O&~j zY4(!=GmQoYhQp^K`$t_*XHx_X*Y6((i1Hge^m0s!^OTOa8J!C%{^)~w#z9+->z`eD zq)9wK^Oc;QT2yp$@AsecXEK0h3QjW8B)UUKC7}JM(Z9cMbr%2okzqQ~i7jVts zEB)Egf%NP;src=QLX4Jx$%tt~nVd<~Y6+*32eZieQ9+5lMxCyA$?N(IK_n zerEh~Oqx4cPt28AuWnEwZmv7Ta>iZvOx?C}7g*&#_A>hH(E6*$GnJk5i7;bd=Z)pV z-=(ee#AC!C(vP8@i(Mj@nwLIhte7*1v_T%0GiK&-+&)#`)bzW_0yh>wp2WXqQ zgPid`*7)fn4g=DBA8nqBni$NrKKr<4>elDv!KZG0QdsFhq3yNZtlJFsgoD^sskNc2 ziBCLlke{n<09_Sa0CI}&kf*4*U2Nqha0vV~&pP(Pg_ffafk<5~BRv5nh-utb0%-QU z&W7AWK}lCZ!v?D!JzZB(^9XGn`*kIS{SInLWhz8G(>4_pXyoWh+aA~gAWJun1`=NF z8QOTowO{R)T(soQxgDJEc$wyr%zSUeOhrqvS}Fi$dsI+m)_Ew7(;+LXKWi|uqLp+} zPaDuum1eT1#ry=kN+=w)wUa1D^>XsRn* zYF-O?LyM4URR=)|P4^x?3BQ{I;*K@2%)?lqd3i;btR|)B1%&nnk<=Wzz?p9#y;SMI z`&(TM%!2AT_NXSSc)q=*qW@Ksrm=4bCsKn7e@wsBp}KTM)X7to zCPz#t@VQ3ryeR;w3vTtH9&VKz32DKpxzb%@?*zye=vupjdt}54_nso%*RiTn#s<`$ z?U0q`(pOxug*4{FaMAzO5UkdKJthjbejZmRCTL~Jwwk2`QOaC}d$o|Nw zHlV^(biK$~olAey8TR(HyepZs$piq@1ZXLp_EpIne+CNn5R-R@2d2{6Llc2wz0RVz zjC;=)bDp(zu}RQ+4yeGLKKHOq529Q`^I=0HKrdur8)Sae6*JpNIrYfI=yPPZ79gl+ z66F9u5*C)g3`(oj6ei%Z`O5iJ&yB>59-r0ZbYuN_Wc9V3;prVS#Qo;FOk-ZpyL7$X zVxol;Rca$_Q~L>7r{y_d-BD!RI;WebpgDcPj#EWXVKoGsD!F7sCp?#Kof)1oZEJ&oz%%PT-zIoG$t;j2A8vwBK28&pby9x=h!Y z8o(tkd(-ggJMKGlz$QLgI!)th=BoELtB30k_mu6YX#+*i7Eau%%f`PXeRSIMVw#%V znBkvvknB5FOx)1sW%;GBWFsn_4L?@#4D5FbPt`U_Oy>*_`#$o+uraV1hs2mIA6aiA z5ZX`Yq0>8un?Q0nQjj88d|-d&Opwv(%l$H{bC6CY5Mt+#we*9Wix;}BCBKignZkydCGop+ZtWELgyk2r;i zwk}r}xbh1FQiP2JdEZSZmxv@C7Oh(ZMyI;5203s>>21*w4w&Vw?><{`pWjQeK*EG> zPnqWw2Hv6~OI$vyY}>tMcSO|u(@8f<8?fZSjS*W~sb0kuV~=pX`R4Xxhdx$3-0szgo3$LXG3G=H+3xrhfdY|a_zYY0r^{Eqsy zC1HJ)MN6?xz1CDA78TJXxF7%zGHE%6sc;{2%hN_OfC0wibs_RWetfp^4c9Zy~%uCxy z{hWDM*o|*|pfY)r*w)^woI8xB^xVMKWKP6uWmq60xzNO)^voPveQ%E)vrnW=p*0Yz ztDn`Uq!4Q3!y{tC4x2A_7G>z1P%_Yf6A|)K&9W1(X!6*}OJ2Fb77-z!KFe z30Kl}1VDA02`Ht3Aej*a4dMZ0TI9YsFKqjJwF&>A0zNX=t1RAFkQG*;ZdPrU1uq*H zR9vFQv&AYKgk-@>*0D~OUf!DQV~tWL{#S??`(FMk;h65qj;Py+B3)_u@_Cp2av=Ik zYXw_Q#mPzuzm9^V-GJfwV%giKX;GqH0!E>tu-pJzvmmD@w+TK! zDN#@E+<<}ie=K)q;qw_1G+PA|2R1iPJRqmAQ4*yGnoxX792(?r25qwe*Q8DDDq6yj zhd()D$A%DHYJB33UM5G~1{Gdoc?WfN-ukKR-J!YT7AeN9$Y4a%w@ePD&?LipYc6YO zo7$_@%g4zBM~Mrir9AANx4(`^7ogc^s!&RnvBmu*Pq90rGnD(exQzsr2j&Cy^XzFy z+aD`8ovxT##|qLgUhutrx9uth=efK#-T=>w?_<-wGK|Xa(uR%Z)5<{ZEmL-n@FAWmQN*E_4Ga*rg$g1f zYGt!2$te}`ZR2YD*g%-9Bp4&5KOB!dKz2c_UKLYQfc5DC{rK1nk1-sCg)0vYpe6$r zh7lQiE|iGv=(6qnHPaV8Y6$)B@Y2^6J{@l`>LVGJBi!{Gvub*AEkNG>iy66(wO4Zl zleRnO(5CHc;sxDe%Uf#mlwzEiqB1yK4BI$bEuwSp+0N-p2xk{AU=FJEsKN~T)BQ_B z=W0knp;*E8yUnSl4vWs`V7lmGN>C{0!ggj3CR=aKO$WIaV8m3s=0BUKZ4Ro7TQ{A2 zleV*N1f9?d9}?C7ilXodA2?(uZ=@W4wqSD@!x_@?y+lmByDrl^GEU)Cc0Odf|LGa( zC^fOA)F$peL(8xW$rGVCSe0{FUsdni@)0A>@HxF^lNL;VUO2I`{L5z|+;b3TSR=cg z)w-pdxVIJdC@WSI8lyi^UQAUmJ`mV}=xXX7sV`nVT3!bl13+jNw(ujxpT~Z?T6;?z z&4~H>CF9kdNs|S(nnmo1^?J$;a*&lCpUSlS&Tu^JpbY=I zV~W0qI(~TD!sb+EI)82Qtu+W)uqJ9+GwnO>GFbGPy+%ZxinO~<%_K~3byuu&2eE6* z28KK!0v683%U@f<@tnIB(DQsucgPcP!cHKz)}(_Rj?$d=$y0woNFC)wZ-+H;ylv{TBQ~S^AdMLX`?VIIXS4C3vmSW@URY z6Mi~e_fS=bq6HkwKU{l#x1Ft1^`~j!%#=c8?nZR(DULkns!8{Ay3!Oap5o8ul?-IF%0*vSIx zgNh7}avwY2?M0I`O;P{o@4O=?*J*Zxn_0fxnfJ}Cz1{N<+1LzQOq^7Pg26T2egEC+ zU$T>+fpn9-W`$Jv3bvc{rKy3gS{eA^&J@rN%~!g!e6>+mJ4xq(czTWpr8eS9;>tC? zgUos(9$S=zoDX?AP*>v)dnihrpLDg>M7fq3Nq&td%eXZNj*iQ>vqiYFceb{okldx; zfJ}p*E203c>S!zqU0oa*=Qw`J8a&HsuTX2}XS$FAMV0E8-sY<;64NrNw&W7phzVc7 zj!|S8POQCFT6jWTxgjqB7Z~p}j@9itd6yG@kwhog1}kS6D~@Z69?{&sU$pF-p<&Qh zCC8sNHX;%Dn2YxSe#Y#ZfAzQ)dr{st8p?=I^27`IbwQ@kYDE_>ffbU~pE0F2*#znB znJqM83#Hb@u-ap`Unsj^3x53UtmoK5y*9Y>ZOr>G5nq-{ca)7YMr}{$Th)g}?Q9lS zDeIJ}4tzKpderNL;q2k3PaV^U(#r%JG5S%JijHWY z{)t$;arn4FmF_VMuX0+)av_l6d_5}ToXaiq`0$+Ts}@zvXA9nDbS$pb2RcECh-JjZ zDKn@e#a&*ShHX}qXo{Q;&n)$(uzq?DN1oWUEPY>{&RcWW33;Ks{aCA@wV*o~4#KdL zd+CfZr{ee4@_BG|Wuqu*&BqVK&Pb#4JG@&}hrl$pM^1QByf9um-+u?XyMPr7=}@vu zW_=s`bhoclcjv87`FqRHjEI{w;*5Q4MDpd|eGNRlx92aPLB}Y6i1U0+m+k#dW{e%H z7e9YPgzXNwu*O{1a{IAXAFSMVK(wkO_O|N;&OnIoSLg3mmKfC4)zc8$SnXb7_TrYu zG4W08W_va{@3B;ma2MY4zAav7xfvy(`jB|Y0K2TzOEeA_uPuo@^f)$GULP1#tMdxZ zW=r2)8c?spB0@zs*$g~ykI02}ksF*96u=-a(nXfCwbR(hO*}6Cu9SCQR4|sRi?ER8 z3G*4f<~n?ptkPqk^Y%Kqc`Z6J^8MDYdi6>Cm*%9FNbXHKXpIhorbz8p8M<7)RozPn zTg^~>m-uu4Aj5i<*nN{cPEIhsFj`TFZI1+hZGubr6aOkDdwf_{4%f<~adXF^kr4TL zzc|;$&yTO>4h2>8?kJ1Is?O1d)tk~28|y%x|^3fIPm zK^p6pjpaROs0Vo`Ekgp9Nn*55aZ7^ui+Csfd6$CYI-k%*oaNTV5yq?4 zkO$@pBswOEl!GE&Kr=(aHOq4JUYYh`-kOxz663R-#pB!|-t|r~ub&>73q|pWkA-!$ z&Pv(1tfDIKnw8CCCuMEVBR=xJoT9|m9CuimCsB&@ntoid`J<8Qt|X6XX_v`h)c9Bn z`mTvbLxJRlOSq&LiHx`z`-mL&uau@|%XJskkKsMu#TmA_7kEymKoW5HMbvRXhIv>S zX&~C78=%0~Cdpr!_gNO>!Zm4C0nKLfu%ZqAb$ZzmWqVg}y64* zs=Z-(`8#U01LB^0{fKY!#w0DT88#^rr`NR;GWN5j9Lu}szVGk30)kb(-{)4Qa)%@_ zrg)@;-17K2{`Sm)jv!A&ym}NMN3=2~&yb(xgOxVhTLVhAQ!_f4lI=&PcHtEO07?v@ z?I$0G*Vf1TDva|x_u3z4Ek#*+bs#Of*yzMR`<~&7H88ugTJ{R*7DtXZm^+(dWoJLm zN7yo#3?jKzb)*`U7Q$S>m#%Z$dzQlayEmS+4Tkxqfbc&o@?2dw$)m@-Q%>+t*_6N7 zcEX8!uU#q>KC1WM%?c9#rb|ucC40*PyJBPw4?zVCsQ6cj6>tdw;<4Moajv)w=a_gB z5iAN*azrWb{WQbkgT~?LmABZ@D}6h?@Z?-}jNON_T+f|qt3Jr~uK7#x5MAUhl z9ZlF#Bt`KzxOp9l4)(I=6D?E65w+lvztB4X08OOV z3KGe-J^h+Bl;boy;VrF-viYO6$J}a(Xw&S|;Lp116!y76@)PE%uho$cdEo4*VpM}p zjnxdzW}Ne__#7b4vz)eK;4R`eo-y~SQ6F)Tx#^58gyE)gaYwytpw6LiySp)a;_&La zv3v9Pp+mcTho{if*BOe4{cKpWCr#`Jr}3^8vANaHi~~8PA73opiHw)1+3bZ!ck}!d zts%K;eJj1~geP;uiMj0OX?bF5>?u#x{u69k&3(;F;cCu_3aTmM5z7Ie_&tmAG$V80 zYts(x!;|cG+M8W!wf1|1*lRl8JyZ`#uXpt9>AQg7uXRSj>gp(3Muh3?OU#{``L~mr z2b=;$l`MRYF14iYmn*F=*80iN{t^{CLHro-Ul@p$BR9&OHZv-WXHN}i(#|y+7 z1*XZgV764e>y)f+b+-tW@3y9IQm*W?h^WxT1b(z=$+Pg1y>w??QxDg#oKGreVTzRz zm}{j`m&VJT&z6}li35=H+O_iX=SbCv!!ov_mKn4_3+9FDId1sL-+g)un@aS%x28&+ z=Cl2{BJ>;-x0Jn$#s=4N`267lXv|tQHI>E5O#n#!qP7VvK`1S{@C~T&=uK$cSMl&6 z4Hlsa2eQXwco}2Evr)OutnKGK`XeS{q5a$77?&bcDb1?6hs;Jdk@I+(x6S068V*|; z42LyMjbhda(yYwNp2mX(Tit?e%3hvaieSV0+XUnCmZ@uaE~3U;F-mVDOh5Onq0QHI zW3_e~#d7X!KBReW@fKpYs!7LITx&x?99!E~AU;H9!tSkXz$M#@booAsf4{f?9t(>| zrdrm6m#r3~h`AR&{^*etQd))dtatxZKQHgW1N#31HmuU}`!d6$_nkapSusBhMAMPVG90)sSkd|RD^{rsX==NWyb=9=234ZQ1yY8!^G8Ckf^Tgk7dlQz8}FI z_Wo)VigK{rZ^SmW@Unv-h@2cmu=YZ?=iNTd>l8h3YdIVuOUQ=bq&u|+*U?Ib6W#hMLVl`TN)SbfOJ zDb71pRVK71lZU9rDd}jCv}jFnD&1g$>8@AKhg+5}>t})Ni3{RyQ2*x2i++`A3La^a zGmWC`dZ=2P+|?le zRLY1G>?$MrPUj_=mex@ay+@91c<)c7ey^f8Uy#UKq|yBKoAces?2P*cEZ~hu^UIw| z4RIa?YtZ^s^O#gh#V6gbuOw2Fm+oYx?!mNAomW{R2fWEu*}^ig2D~JBSq6MX^Ehm< zOPGvSVn-bH>JyLD@+HGCedxuE*a;EA@8HUgakcHx!j_b-!Qnldv|tNRDCCV+!b9aR z0XVrZPwkY>kJ@5rqD~626kCbe6X)EsfT&GMGRo}5>?g-V#op=_x_S!FR{{#DFC)s_ zl}pXCO4q4_tUJBZz+|gzbvG8DE2;oq)iShGJVMutyz2W>%xfwXN-39im z7+%lK51s)%>r0lDbTdM6piO75$^vvp=CYm;TpBG_2HoF2WQa?Yvf-1M;2#m<=MclY(nu)&^$bh0ExQYmE3mYuRwQr2YOM)o}+%V3BsA)$;lOJwZ3K^Th4WXZmV zkbNJonh(JE8S6KbqqH+FP`ju0{M){?wlS*A-jX=GHh&>OA|yR3Cl zirOqm!f8p+<7TapSU_S^XZV#+$}U7z9q@TV^Zy{6$Ku*BFZ0tpcrvG0t5myPJ|>Xx zV{X#a8f|PSsBbI|&%@q=Hr@@=O05~D)?z8o@TG#etm!t~+Qt{TrG9RMNF(JWEt+UF$&Q$3P=3~@5so-l@vyvY&rj_}nAUp= z`tYl#dL%%%2=IiPEnKNEr`rRx*>=_q?%5(`PSjp2t(<8i`y=?hO&pAH=loTQ$jj_c z|MX_gy+3>rYcm<}E_df55mKZBjF%NOmiX3*#MjpR*%S66b~DsS_ri`V`R1JMC5&0l zl&uMUc}78K`NNct%0~-5uE`QO6c9cj*GR5e%Ve+VFf1zBRUlL`ZuD75;{i?9g@(k3 zw_T{%R*dr!tYYjla%bIp`O*@!hqz)e)Ap{DgbpeEVv0C3QH*?Zmxc=F-Dr%RRk92#(2LxCBl)4vU+%WnC%hWqOSi7i1 zT#S|G(O#;2IH!uhwWZgri)Zy6qTSN`noArK$6ht{<{A2U?r(3E6;o50W!srpFBAwe zM+vH?OV*%x%EfCos=nk6m`hC=3gF*zw8r2{J-QrNHP^A?7LB2(iLKyQQ;5i|^i_TF z$LHWvrNwqG9h*9*h~jShvk-{}Jwf#6(-6%#XZr+mIXuYfS0o~@u?blPEU?rpf_$9< zapVI%7Yo;=8njf;CY}w*?lSInDhkaR$q6uJ zs?46i&8PFxBCcA|`^?HA<7kR!&1K{ILyH*I?(1F(K=U^?8GGz(xwCF|kyV!F6Y@NC z^!A>bj_`ye-9!eVpGrxhhiaEQN=oB!CDqjoouPv}N@qY~Ipke>nzOPRX1)S%{}MIs zvt2whKF;`RxeJGHP)K`@pu?}R2b8NE4NP2hp!hMT&yS~xpyJp{v@ zBMAaN3hbo8TwlkE?LzvTZyb+yoVF-E>+W~y8FzZVhX2OD1U-4tEv-W z#M-gu+#YC~)h*3s!Iqk4W1EUpo2qZmz&qQL%wv^97Ov(xl>cupv)@yo} zyK>e|Vr~KryJTdIw~3{X9KFo&s6I5K=d6Z8R2KV}P^HfJjMOH*TG0Aup~g>cUos_S zSl^gG68(tDPf5aUPCS3Rc8#eHOo<9FcJ79VRE0aB7&=j0F{`N_N(0BLKF{39!wT-1 z8ry^!y>;YP;lP$|e*ir%Vqq`$%WSjVrn^9xYi^Syw|gQXksGT~<4Td@Y1*=Q#e$I8 zre6ZQyTHNHaKesFo~=QnB(s_>ra`w#{u(7|ufi+D=_k@cpxX zuh5!jxO39=Gcs_Sn;N~V&XTN*^J&aN$Ty{oz6w~wl<{e%Fi^$sU6NaTa<+@OC;2mcZ2=*iK=HCIphJkt)1!@&nbKa|aOCJ7?? znJYQ?gN?XV17ckKi^j?`RN1T1it@+f;yDVj0Kun1ry*7MaY&u5zHZ#k4V|fS##cua zl|pfxRA#g8<*u17cI;BC?`HxKH3l<}$Fy$KqcZ0`bipvHtVL)+I-#V_T{Wbv7PFA= z9!AWc@Fn}%(?-o4a&&DoP{ertjy{Dp?WP~Pn#L?4ysHgP+OtD%(FbSYeuXh8V8L?DHCgMeSAhgoP>JElK&4bsTn@pHL49Y!Wq{xwd46ah zv)wjP(ynkd9M@i1?K5}mB(hzue4#^xM~px z+A7}}Y%rlO-4S90ib*Cl_yjp5si&Nrc#+zSU}@$vlD6}syK|O(=`}vq@adX?ni(a# zUVO`GvjN2Yxa(TJoTC*%J1MgypMt^{n65q;Tcm=yQEFT6)T|I2089IHQcmRN) zZLR@yez;U#uG4dKtsEo0^U+{&gG8szfT5|1Ieql#>FHNQYxsN^tWgo=HaE;>d~Zez z{JKoG?oZ+mu&ABu6d+l93)RBo;s5>s$`lV}Z^GlxCfM?;Mzku$ z>PGV3-;U?Ta)Dk2QvOed_NMq7^>A2sjcNYFxR(a_tZvo;k%vxAkH=3K5iF9DsuSt9 zx4$40k~cH?U2(Zs1vp#=1^2?mOiP^e zC{m1k^i@HhS$K`{2#-?f^|CeDv+zv8k{DXNif+CyqMMugo}S0deb^PHJ7!92l(&<< z|Df)K-FrJ@eQ%_$Ts{I006rSrVJBmw@7Cgr>pM2o!()Q8ye_hGEj;vVe(Yf@WwnG+ z(=luo2z0cvwdUbjqm=K&6P9Ob;u*De@64lH%Y9pOnmbXA<~xH-SPgL!HEtu$7(%rF zdy8SF%z!L(RAy&$qbBoC2`{Y884S97Zt;jNm%R1?RbFh`TkY@REeWf9h^Wyrv`cQh zAC5$}G~i`*0%C+3D-r8srl++5%( z;g>;4p&qLgnByK~xkfDafP08iO~mA)v%+AnQ5qt_t+cuYpflnpiV1F|-|&y}H@-dG zFh|HmWcByu`h029jdS^-$JUM^apvOTcBxsXOKQSdh(RU5d`8}K{&N1!;jqE8TBuZ| zU6td2&vkzZLu-D++-O6jeLn4Mq7lBCnPP4Id5WiG@c5czummmIveAi(dv;H?)xg60 zT*TUqhOgTT_=uTL>G50b3A3gfrIoOZk_*#MPfJj3hhyfSo^)JMuWSlUt=1vT-4_5i z%jXkt)LMy{m9PR_sa)I$G(c5*0A1psR~E>(bb@~tQPj~z5s`N zXyCP<-OaN~r0aWxXn^?%1C@+LLZbf>poSwX4~$OUjf$&$vs9&#`Hq+Y`<7lh1wka- zEPg?u%Yu%at%|(~^SwAvL-~j<>$K`=t|cdh<}87R45y-JA&k@kS73C~zTy5YWSQtjI3tEm&?t z4RX5uUauKtEYhCS&Zu)J=DE&r`YHMBwmBL!%^%;?wM;~wSY2tl6=)w|4a}HT6)18H zb)Suv(|T;bil64vYB^^{Fl|&7GSaYIJw0J0-0RFmla72SkmS1Ww6`_Y;G8h%bsebZ4rokVM7Kh@(%Gkri#IQHS?ERQ6cF=|K;2F83sR}PbY*s* z(JI3^JBY~ZbK?xZ?iR*n?3_=oqJed4b5pYT+x%r%N|t!My+_aW-L=kD=Sqoi;4Uu8 z*e688UiU?xzh{j2#^b#bx+U-~jO}f!N*F0WekFyc;4^GT9!}Y{RXpu|3$A;kv{h

Icoy8x#f zKvC4~NTgwwdTM~FSV!*8q*;~d`89)xj7K#M`^rb)cpTwZ%zRPzLF=8-aaCOihMxg zd+uk2mMTCQxsc&5eCFFjse}!4tCm~EiE>991;2W#OT93;5j_2;(YBTW4<#c9OwB`V z*D~80xikb=uY{NP^{N@JA^N66P?-D%QIJ-oTQDyNMO?-pOskEA&|C4K_`>#>5!A%q zWC1Io1*y0cCt|)i4;RIXE1l`|vMe((cX-_Bq^O8cndnI#Xr2#tToo@)avnT8Xi(`j zRS(~th;eIKHOnTZSK6;A#(v<2yMqgARAYGG8)1=Cx?74P=GPxJK1LKT`yH?>HlJ|E z!~~^&oZ$ZOXA~Yc(j0mV7=F4z19X(gG1@}>a7#7u_tH+4oRD#!J_Z*KBHla9_=|6u+Ar+oe=jd15u- zpT5A3WbM0CcnmY?c#3Dhd1#hu^bwf*Ny1_8Xv`#mF z>HtlrwQTWe2%8(w@#0`;#AuN%QoFy;1y^L&0o59#U##JLD_VyRRn*j$=sT--~rF|M#VG}GV5W*wv{to zqW6d8=@EiUt&_+b$|LzyEoaR*!e2yH(R~F#h-xr!dA4{i-3D<2uBEzX=CwIO2QlFD zL@klC7HWBHravm>Y1Qi*$^{H<522NAAYGjk55Sq^cp_o378}_EtPV?rl-2~ADP-cS zmV^pbTTm}X0_2;Ib2&*e)%}}6)%VWDeb$K5YCj($$+|YtD-kU+RM6-0u`w-uk>whI zlGhq%CSX4%k#ScydP1WG)xD0vB6C8DZ06Q0cyYT8rE^+}5@|G_z_1h7!sDzdPae^= zt>Dh|7?|F~4fPegV^qMZsp)_v{e}L$)bx!&>(N%RC2=_i^Rbkb<2=M@X~I3_nH)r; zlAjvqQ*lgBG1NyK!p>dI-JJ|B%-R!OxlFG6i}hJXwy3bKf!P>qcW+QG%>y|XyB2?L zNZFvRD3v)PV?q0*Z)l1bdklqIs2NSB*Rr?~nM4#8PdDiA?0xZ(GMW9LYQ<#UbW6v3 z<%ApMPHPTqn(JaqE`w)d?1Oi?3WGVgcZ~bjy5uajF%2zhDs35ASs;7qFhD_aTD58= zG31sHzZ9YZ7j?dCkj1T5TkYa7NXOgph{0K@ZAsKI*e;@+0k(6)z+ZP07ZP$P9|RPA zcEuHPO7_XoVB%5!wrYXbWOFZvws~iUr+V`J{zlZFQsS#hHVAC_8*y!$DjZ=IOM!Ta z)E-VU>|cGZ%{evH&e#*hbWQPQ=ko;YTK$YOXEMPt)J_p))%^8Sb^O>)x7#E> zvf=aBOfGz4J3OA4KWBOM*imJs2gkN9N^?_YY&~z*PpTvEjAQyHoRha-hrcY?rfI+U zOlXzy2>C1xT(d2uh5gu_8Dm3m>r9QX9IwxNq=QuN2;_Hh$p0B1={2GjdhBVy*b zq#W#n7Y6fQbvT?$6`pXFpF~E8q2LirFtZR%1dG;Er8LWK9y3*{z9-LU#>n;YkSN^$Kw(P>UlqX6vysjauaho+}jv$f2qp+N0z`Y<(2WM`r>i28@sl}}4&xpZgukp`Gkv?T8iN9A; z;Nl(M*Cn9s^7U8Xk0)YPrPaPM_H`ouTBA52Uz5{8nbYS_8&_qQ_!UM{Omw8!3U7YGW^*k)IL3Tu^jlZ46l zATwgKuE{ahzIdDXxf`#sh2>0-Cg>D$vsz!oOq5GLpgcBIWpnPe-mYdtu;iMSk!?=c z>`V+M;0peUwB>2(i2e&2cd35fX3#tXNO4Y(E8z!}-=mmCj0cOK!tyE8t*buTdy~%0 zluT;b=~*ts=-iX76si$nrKw_nQC{}Z``kLJL8|$5^F*Gg29eONY`#w=zYJg12 zJE9-Rh|XpjXrz7cSyf6$WW|Cep;Dt6k2n3M;S$kg z#-&o!s%L|>G$=rY0^22Byiv+0h@Tu9vr7I*$J(WSeq}|A6@@d-Rgw5`6NS{5H8RC* zj)xCUHUgB(B!}KooiS6CYj>0#<$1ykhItlU%AAc}?2QMvl?J1tG$zYn$M9hn(R(eqMQ;NmX zC{B#n$ymrY8uD1q#cuMd zOjtQ8t2D{S)7>qX!yHQSK@$ojAggES7pDaM1AH743M#0>-AP@jaiYN8g&~fj1b_Q= zwhtpKKCuQ9H#(i7XkyS(cUZF!O@=3Z$Z9 zHzN7@t`G&{bh+ZK>6VWXCyYc}6T%nv<$8uct61Mvvb7j&8o>HzYfCNr%4Jz`xTG^( zDG*6e*;SlsrOMvi)!W~F$~~d&70ldnyY>cWh$(t#Kg&x&HHp846%56u?oHMQ2l?lo z*vlXA2Ypgtlumwe-qRaa!T<1E1;?A0W5IbeJl6W!#Qe0z->j0eU8-jdX0~*t zUh%@T<}T43Guyv-aF2nmh3snBw@i;5ql|_k@qC5NiM%AIzkE>K_Dr&-k=TaL(7bpQ zY_POeKv$^4QUj&ur?k+!lC(axR-L}?J%OB^^4FWXkUmJ~3A8S|F~wWWA}m@Pj0L(Z zuJ)c66A{*r(2Xi5XbRj2eUliPE3uFyTZ{kjY$Aq~-$faHy(SSt(etVzMD_y$!B-A6 zwTm_jXUv41@>ab<7mx3vORM-(4Sr?_mYaW6ao}upZAoz+>+Iy|0WwE^-X{cppa_U} z_$(-q0u3_DfPODpBKcC7>i30a&s5aP-grIz$8>RZg-iX>*6~(wp(x_}oxX~8eTGUV z82#G_jd!avS(=?OG)PrO>24X>`=91WZ7IayMQn*d!*xw;O@sy?e!^q*>U9BMeWI}4hh&y=$i z=7}iRffb`kVx@2M^eX>Q7rUL_=sa@4^7Wago<*V6v~gEkVAZzl6jH2CYw))wWWgsp zV|FR6t+L-T3XG0@|L`=&6$*y8LcNxZJC4rC`KaB{?74aB##=_Uw@R>T4OJtWywJp3 z;;g)PBqZ7M#S!tmAI1jHqQ>k8e_ZAhf+vasgmwL*dzU8IRiDXO&}FY3t!>U#Vm-x8 z)~h+#GM-V<3jo#A1te?9PT+)o)<(qG6rmD5|8CRFVjelM7z9DKM!XV@+KI9{2y@3;^eU!Zzr0VM@wlI^b)&! zoBTiEqjK_iA@<4}p5cKtcB~&`B0BV$7V@tD^M?FGIzpE~M1 zeVxGu%3q$>5#J3HY7Hd&i)g<7d>*R&QN^i2ou;hUx%(x85DrgcrhG(Db*_Bs;%ZCo*uJ#S4o%MG@EgrVs!``vYjq zGTw&*!WMqdd4WlaAh~;!wSr_Ww?qZ&e?0HySE6|1wdwXNR1X8}%lcV)oO7Oh3A7`0 zM34yFWF;m4IZ*hD$a;0^?cG-<7h-fwf(zSk(*^*z@amT92tH|HURwU87gwl4{U@UJ zubKHJULa2+Z{EXDn~ldx*LJRkCVDrlK3g>NvK%;l|Ifq-3Y<2!{#2-6966w5yqz* zUz7790rp3N0_1G?y*H(DAl8=J-d)~n4t7CW_RDEg1lhUVJzp^pGe@e*@Jmvp9oU{Q zl$4kA;-4P4AxDArO+12RzVgcr0pdzSc@@yBB_IHd|8Rx>!RNqt;7?=4IfI%*O;2(} zGW(TzWTJVLCXI#X0Yoj|{YgjBd63>&P<+z%OCEDbn&ZSctFKS&EwB9$tMA*`yD*%% za(nZ^b~AMk6X z(hQW+5qISeLVU0ui3H#=B@KB;(H*Ej0tuEARqfIgiW327UylGX{Kn+0tKQHL>XK$# zxbOnJ4@h?%K$cIXX{Isq;=`7RfIh0<8uaV^FGKq?e)8@g2hW@Wx$JpoWtD*6`!j70 zYD(+Hf2NBbER#;oueMP`}O3dlW%*`}z4Z>i~Z-`wo;q0{ri`&%sb7 z)P>iA1u%g3&jSJyK&f)vCeW1a*B>2xANcz&RqzeFxx^#~JM`WM%Ib6ewOhVP%HP4s zlL4G%`P`3D?CNz8qP|~kS*#%PKUmU{qjE%xwflR8Afeh| z2;rPx2OP9@5H8Z$D0>%5cVKbr0DLj^<62=j?uU2}nC-d*O~OMHs1Txrml)@-UH|*o z+AaZiA)!7}U`;q5d%zIfPa&)>gntRp z&p>ZrM$ohBMt|+c#KbQ6E5C8gU3LKn{a5xM5 zZ>Q%Zd5=Z;AN%#6pWy*HdlK*PR}Y-M2a;!` zBW@(Wf5m<1eHi-LYC0%*7OEfs!D>T5x=~|)^UJ}i{`0s0{y?l0IE}CLi$6$zZSr(G zq|?)rY0Llqw+Bc5_#bu?lL&=x!*yL0|C8ALPh0G}4i2;*X5#-_VHtpaQTK8lpd<)=@8b*Ld<_HRpC5h^SD-~i1g6FwEMoCiN;wICGGNhJ^p7b%?0!s= z`T8C^@ioTFQxQeX@2RMGpW;ASX`pQehM4q_2h%187UX(T5G3tZn1p|cWr`~0v^_8@ z{m(Qm9`Z3qd{NLBYrJMYxMQYip%)EvMS;GBzwF`v{=ffbga7-1{Nus@|H=q3JZ?7R zjfa<1z>Euc4oi=kA8h^_FHj#(ou_IBhc;fKkdCX!EB$#Osl)PM6-&12Hbnn=5CaO zTLIht1e$GsBwK^Sn6NgZ`R25l*68;WKOeUSMeN%T($vily_Gi5Wk#h+3^f^fc%?m~+_oB<_@&KN~M#`Sm2d&yHhGDUE^6)^bb1;-HPEfUp7J zwldz?T;a>YtPgN{&8jD7i}k;Ao(d$pR>9B=&g%1x^*+;jz-$k5+p+kwOJhm@;X8A8 zPHq3}0!?N1jdVX}voig^J95!U-wgZPkY1z;yAA=#1f+0~9+YtKDplKDc? z@*zvLNSeWqexLqNb;*043A1;U2}n}@{VAV4HUq$wWslkeEAs~{&FA>GbIweQnsuuP zphX4fJ79#o7M+vHAn@Yi@>QQ2K%Qa@sOg?x0CQ5I=(Wj0jMI)h8>RzIz%vX>;l+zwSV>rS?|BmjPE7 zj{yjT(($vomx=ksLb+yumLUSbHq~@=bRCqG{OgDZI(yX)2X3j9$?ZIKo^n&kS&ArQr=#%0+uR$R%u~%i&aZ>Jw`se=Uew_ zL58etgujW4D&unR+E_TCYr! zu#EaAe;gYl1kyg#!M@?3^8RVLq(Rio_OF-6-yi5EBKR{ngZ2;N`kF%B&2a$-e|=c& zCDd0!MM&ML-59c)t|JTvD<5q~XW5L%;)|=JT>==?{p9*V{_6A(yc0+h8h>Gl;o|C{ z@Y$??^!3Kntt+F2#`S)vV=?J|&44H)5aN9bp$(<1{P9w;PEG!@CVCDck&@b-QLP85 zO1g*DE1wGibCeuk8bv7(;2`kIEOy0TSiPNphVX#W5Ft&HIEs*sc-Nh+7$hKB<=6)hj-twz+wAt$sicTwcARCc z&kwe1f?{RWH$dEJQU-Ca04!ssT;eSpU{fN4GFdwa5H1I~^ysq919p-XHxBF$;F_TO zlY;Kj@gyj?Ub}Py+>j}y_VLc}uTh&F%|vko3_vWu#Wx8tw-o|Zt^kPFg!CHPq1Vuj zd}G9?R?C?a^wA`saF_T@Zk=RvoB(8g-QNhXw)u$P?wNA}`BYj?^L@I$teg<}|2i+V>WYQ1;5g*|1oN%$u; zaS&%Flt@Y2XlhTBZ?LXH{4pW3dO~Vb=IoUk@N>1Zx~$l!4J8sQ6{+2|t6HUxe%%TuW zp}n&~_H$O!?$R-B14lU>vq-tI8YorZH7SrB43h*XV}n<-yEG;t==JNz{1_v(-QQXl4yffSl#e#c(HM65(Of%YcFx3@3HW}# zm5|ENQvY#iCv}>M$OH4syfn<0s<_Xk>5e|%{(M&0mSvF8Pp(ZG^svg}`pgnffSN;!3_WE>j!+5yNWUg*W9jMXTRpBOn+Hq2;@#g|{5m#>F7C;vv=y2)2%8%q- z1(`$Tq@+ABsw@U2n_o!T4>-ZkXu9|RapKZx@2w`Iz-}#l?!9Y-Acm4>q=V4O{xeGZ z@BZQMOYC`P3z)m$?V^M+ zX0B+4RbbJHA=FWm{$%)MTp?J(Cp-vuKW9}5X_i;3H`>6lUEaahSmL81im-wc?w}I_ zbj(xW0(H&e>2^T-6)BXK+yri1{0Zw@5nG^P56biltES~4fe{ivc~S6cbDRJhw6AIv zHja=rz0N{#9kjPhz_Iu>UpoFX?{*O+kV>xD-8v{?AHp%Fp_<0~DWQkF6Y?&eqOH)n z8eeQM%r}xKDP~XsfQH6`1nOp(Lga#KC?2C3)J^K~J^DNl$*-E%)iYy&7pWfRxj-F? z?=uZQPIWmNfFT%e0mDNpVXSAUrE89yKI060`BM~VDf1E#KXXq$K7 zQ71^`01UGi073`#^v}PfWN_5t zf_n$-7W2=UWlKZ(*iAq&N8f~Euc8o}FMQOgEFxDB0gSf~Y!b9Yh?_R1q2?oQo+4?u z+ zWZoByTJ|H5>;3EulPrK4HQ@!bZ=p~e==&Ljn0C);iwh7wAScCpEC&B_*T zG-fs&OXwawPA>p4JPLVPfb`X39tqJ+_Bq(qCjN2c$Vu+Iw`4SGcX4!jtk^D%v5X`S zo0DuG#+;hCV;b5Up}Fb|zT^=)e$8lzxlSob{Kh5Vy^i{kU28)H+5snP6u8_JwcA5W zCOZH;OVn$OD*4$Q0F#i(L5Vf|TzrZ*aB1f(i~4$EhFF^^4wBvoOAPX)vnYTEhCSjM{9Yl0qsjl_9e8<;p|PC znV{ID5ljWaAubOsd6#Eb1FfP`xqjuf&)yav)Ej@{l<0IyA(k=J9~?F7B>-Ee)|Zty zBona(3Jn1OUztDJ1=2}v;KTNTNN;=z3UI-N%=j9l^o%nST}drpJKp~0Jz$-29De4q zxceg=FtspV1_r>ddM$a5G)b5>&P@UY=GPgfvOPRrqhzB1dzBne3cBBW4Vs-K14rq9 zrX8ZFKn~$+pv1rI$KS?xO&N06td*;P!zRx+*`-S#1OlGbT!v?wR z@+NjbbA{5#=4X*q_eY?Fek$J86F_QbbJ&1^xK0-eKnFvSvq{PJ;>ltgNGNsV^NJfe92?gG&wW3N*9;qB5W(&{2?~C+8|?E6oOx#@eDofW2=G)d z%WhwYG1{Hgt_O8M4YV?RpleZ6Z1azw7lkIs7ygxF`FC3j-jf)i5MjN*y%ejCYAs7% zfVrX=oRbmjB=LIsblg6BtI6dYgTR2$$-M%FCnu=-ld}s5%`7*;&^SGal-380KT&Hp z*8?s}Zeu{0CzHh3B0S=?n!;WMm2)0V##sjbP5_jN?W|=;g&mb65oVd?Dh9XFpCl~m zeB%$R7S7SRfA^h6;{cX>R!BB~b}nSXHb3!rtD#%H?-+Reh?EZm9W^b&6NPy~yjUK~g)$*TJ=42h4yDdI<;~38lG5RF5`Fp0Y2F6r9w44QPM^ z9LGP)EyY8j+F7oz1;t$nOHi2$!1lwedX*#=T2{~rqTT*zSY(9-%oaoQA*1vis(C*M3l^DKh;mM(> z^V^Wd-vs8z`T9%JUl09Tnf~LJV}d|zKinDJMRbtKgbJpv7i{Ol`yfhkbV zI&D3E+!GM#rITRu`1E{_~RS@2cNDC2$^mG-ZcBQ#YtQ zR%Nf+a`58hz-;#OiZUMl35w7Y(#aLk2aZA_bR}7Ku>8z;9qLUy7{S&_6m?$}__cKp zB*7wXB-1{bKm2L9LSj_K`bPTKH~KC@1?mk4CWT)rb%=FH_dual>P7CKUhSKELen*we{@pGWox%nKTBxM~`C2qu&eu0scLCRp-#j<|9WV zkN7Ex9{nwZ3#>pwhOp26bCmrLrIqG^dK_Xzc)Nf1fIzAJL>Z*u;Sb{rB*;H{(&i8L zVGFp*lU_$v%YMJre>4xjKLF?uWv)}KZK%k8u<&w_4 RKLY-{E2nZRU-p6D{{i+R!-xO? diff --git a/packages/o365/1.4.1/img/logo-integrations-microsoft-365.svg b/packages/o365/1.4.1/img/logo-integrations-microsoft-365.svg deleted file mode 100755 index 3763f267ff..0000000000 --- a/packages/o365/1.4.1/img/logo-integrations-microsoft-365.svg +++ /dev/null @@ -1,16 +0,0 @@ - - - logo-integrations-Desktop HD Copy 2 - - - - - - - - - - - - - \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index a261099e07..0000000000 --- a/packages/o365/1.4.1/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "attributes": { - "description": "Sample dashboard for Office 365 Management Activity events", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"title\":\"Total audit events\"},\"gridData\":{\"h\":6,\"i\":\"b6942e2a-81dc-40e4-a932-8b7a864b28bc\",\"w\":10,\"x\":0,\"y\":0},\"panelIndex\":\"b6942e2a-81dc-40e4-a932-8b7a864b28bc\",\"panelRefName\":\"panel_0\",\"title\":\"Total audit events\",\"version\":\"7.6.0\"},{\"embeddableConfig\":{\"title\":\"Event histogram by service\"},\"gridData\":{\"h\":14,\"i\":\"9673e6df-4b1e-4771-b1c6-c41c9bfc7272\",\"w\":38,\"x\":10,\"y\":0},\"panelIndex\":\"9673e6df-4b1e-4771-b1c6-c41c9bfc7272\",\"panelRefName\":\"panel_1\",\"title\":\"Event histogram by service\",\"version\":\"7.6.0\"},{\"embeddableConfig\":{\"colors\":{\"alert\":\"#EF843C\",\"event\":\"#7EB26D\"},\"legendOpen\":true,\"title\":\"Events by type\",\"vis\":{\"colors\":{\"alert\":\"#E24D42\",\"event\":\"#7EB26D\"},\"legendOpen\":true}},\"gridData\":{\"h\":8,\"i\":\"70ab7239-c65c-41da-8242-da61750745d7\",\"w\":10,\"x\":0,\"y\":6},\"panelIndex\":\"70ab7239-c65c-41da-8242-da61750745d7\",\"panelRefName\":\"panel_2\",\"title\":\"Events by type\",\"version\":\"7.6.0\"},{\"embeddableConfig\":{\"colors\":{\"failure\":\"#E24D42\",\"success\":\"#629E51\"},\"legendOpen\":false,\"title\":\"Top users by authentication failures\",\"vis\":{\"colors\":{\"failure\":\"#E24D42\",\"success\":\"#629E51\"},\"legendOpen\":true}},\"gridData\":{\"h\":17,\"i\":\"775ced7d-7c58-44bc-8d4e-2a757d2c218c\",\"w\":10,\"x\":0,\"y\":14},\"panelIndex\":\"775ced7d-7c58-44bc-8d4e-2a757d2c218c\",\"panelRefName\":\"panel_3\",\"title\":\"Top users by authentication failures\",\"version\":\"7.6.0\"},{\"embeddableConfig\":{\"hiddenLayers\":[],\"isLayerTOCOpen\":false,\"mapCenter\":{\"lat\":42.68781,\"lon\":-48.94209,\"zoom\":1.88},\"openTOCDetails\":[],\"title\":\"Client geolocation map\"},\"gridData\":{\"h\":17,\"i\":\"15fe975b-6b8b-4445-872d-e06c041e2c31\",\"w\":38,\"x\":10,\"y\":14},\"panelIndex\":\"15fe975b-6b8b-4445-872d-e06c041e2c31\",\"panelRefName\":\"panel_4\",\"title\":\"Client geolocation map\",\"version\":\"7.6.0\"},{\"embeddableConfig\":{\"title\":\"Data Loss Prevention alerts\"},\"gridData\":{\"h\":13,\"i\":\"481f1778-caad-4971-b598-bb61c94bf998\",\"w\":48,\"x\":0,\"y\":31},\"panelIndex\":\"481f1778-caad-4971-b598-bb61c94bf998\",\"panelRefName\":\"panel_5\",\"title\":\"Data Loss Prevention alerts\",\"version\":\"7.6.0\"}]", - "timeRestore": false, - "title": "[Logs o365] Audit Dashboard", - "version": 1 - }, - "id": "o365-712e2c00-685d-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "o365-0be1adb0-6860-11ea-8d6a-292ef5d68366", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "o365-8b033510-685a-11ea-8d6a-292ef5d68366", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "o365-d43c95a0-6864-11ea-8d6a-292ef5d68366", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "o365-897d0c70-6869-11ea-8d6a-292ef5d68366", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "o365-dbae13c0-685c-11ea-8d6a-292ef5d68366", - "name": "panel_4", - "type": "map" - }, - { - "id": "o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366", - "name": "panel_5", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/map/o365-dbae13c0-685c-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/map/o365-dbae13c0-685c-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index d7c061e5c4..0000000000 --- a/packages/o365/1.4.1/kibana/map/o365-dbae13c0-685c-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"0b910b6c-77c8-4223-892a-1ebf69b0ccb4\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"acc53b7b-3411-406b-9371-6fa62b6b9365\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"geoField\":\"source.geo.location\",\"id\":\"3ba31ffc-7051-44bf-96a0-a684020cd2a3\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"airfield\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"maxSize\":32,\"minSize\":8},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}},\"type\":\"DYNAMIC\"},\"lineColor\":{\"options\":{\"color\":\"#FFF\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":0},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":30.87292,\"lon\":16.67387},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:\\\"o365.audit\\\" \"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"2020-02-05T03:25:59.045Z\",\"to\":\"2020-02-29T10:59:01.067Z\"},\"zoom\":2.88}", - "title": "Client Geo Map [Logs o365 audit]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "id": "o365-dbae13c0-685c-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "map": "7.9.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index 7c0cb148aa..0000000000 --- a/packages/o365/1.4.1/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,56 +0,0 @@ -{ - "attributes": { - "columns": [ - "event.category", - "event.type", - "event.action", - "event.outcome", - "user.name", - "file.name", - "rule.name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"o365.audit\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"o365.audit\"}}},{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\",\"key\":\"event.kind\",\"negate\":false,\"params\":{\"query\":\"alert\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"event.kind\":\"alert\"}}},{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index\",\"key\":\"event.code\",\"negate\":false,\"params\":[\"ComplianceDLPSharePoint\",\"ComplianceDLPExchange\"],\"type\":\"phrases\",\"value\":\"ComplianceDLPSharePoint, ComplianceDLPExchange\"},\"query\":{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"event.code\":\"ComplianceDLPSharePoint\"}},{\"match_phrase\":{\"event.code\":\"ComplianceDLPExchange\"}}]}}}],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"version\":true}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Data Loss Prevention [Logs o365]", - "version": 1 - }, - "id": "o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "search": "7.4.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index aab59e7d3b..0000000000 --- a/packages/o365/1.4.1/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "attributes": { - "columns": [ - "_source" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:\\\"o365.audit\\\" \"},\"version\":true}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Audit Events [Logs O365]", - "version": 1 - }, - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "search": "7.4.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/visualization/o365-0be1adb0-6860-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/visualization/o365-0be1adb0-6860-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index 2fdb82d937..0000000000 --- a/packages/o365/1.4.1/kibana/visualization/o365-0be1adb0-6860-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Event Count [Logs o365]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}},\"type\":\"vis_dimension\"}]},\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000,\"type\":\"range\"}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":40,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Audit Event Count [Logs o365]\",\"type\":\"metric\"}" - }, - "id": "o365-0be1adb0-6860-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "visualization": "7.8.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/visualization/o365-897d0c70-6869-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/visualization/o365-897d0c70-6869-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index ba90a63e18..0000000000 --- a/packages/o365/1.4.1/kibana/visualization/o365-897d0c70-6869-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"event.category\",\"negate\":false,\"params\":{\"query\":\"authentication\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"event.category\":\"authentication\"}}}],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Top Authentication Failures [Logs o365]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"failure\":\"#E24D42\",\"success\":\"#629E51\"},\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"event.outcome\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"asc\",\"orderBy\":\"_key\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":2},\"schema\":\"group\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":15},\"schema\":\"split\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":false,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"series\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"http://localhost:5601\",\"pathname\":\"/app/kibana\"}}},\"label\":\"event.outcome: Ascending\",\"params\":{}}],\"splitRow\":[{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"http://localhost:5601\",\"pathname\":\"/app/kibana\"}}},\"label\":\"user.name: Descending\",\"params\":{}}],\"x\":null,\"y\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}]},\"grid\":{\"categoryLines\":false,\"valueAxis\":\"\"},\"labels\":{\"show\":true},\"legendPosition\":\"bottom\",\"orderBucketsBySum\":true,\"row\":true,\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":75,\"show\":false,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":false,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Top Authentication Failures [Logs o365]\",\"type\":\"horizontal_bar\"}" - }, - "id": "o365-897d0c70-6869-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "visualization": "7.8.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/visualization/o365-8b033510-685a-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/visualization/o365-8b033510-685a-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index 6724878043..0000000000 --- a/packages/o365/1.4.1/kibana/visualization/o365-8b033510-685a-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "savedSearchRefName": "search_0", - "title": "Events Histogram [Logs o365]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"event.code\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"size\":50},\"schema\":\"group\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"drop_partials\":false,\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"scaleMetricValues\":false,\"timeRange\":{\"from\":\"2020-02-05T03:25:59.045Z\",\"to\":\"2020-02-29T10:59:01.067Z\"},\"useNormalizedEsInterval\":true},\"schema\":\"segment\",\"type\":\"date_histogram\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"series\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"http://localhost:5601\",\"pathname\":\"/app/kibana\"}}},\"label\":\"event.code: Descending\",\"params\":{}}],\"x\":{\"accessor\":1,\"aggType\":\"date_histogram\",\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"label\":\"@timestamp per 12 hours\",\"params\":{\"bounds\":{\"max\":\"2020-02-29T10:59:01.067Z\",\"min\":\"2020-02-05T03:25:59.045Z\"},\"date\":true,\"format\":\"YYYY-MM-DD HH:mm\",\"interval\":\"PT12H\",\"intervalESUnit\":\"h\",\"intervalESValue\":12}},\"y\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{\"show\":false},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Events Histogram [Logs o365]\",\"type\":\"histogram\"}" - }, - "id": "o365-8b033510-685a-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "visualization": "7.8.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/kibana/visualization/o365-d43c95a0-6864-11ea-8d6a-292ef5d68366.json b/packages/o365/1.4.1/kibana/visualization/o365-d43c95a0-6864-11ea-8d6a-292ef5d68366.json deleted file mode 100755 index ec9ec39027..0000000000 --- a/packages/o365/1.4.1/kibana/visualization/o365-d43c95a0-6864-11ea-8d6a-292ef5d68366.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "savedSearchRefName": "search_0", - "title": "Audit Event Type [Logs o365]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"event.kind\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"title\":\"Audit Event Type [Logs o365]\",\"type\":\"pie\"}" - }, - "id": "o365-d43c95a0-6864-11ea-8d6a-292ef5d68366", - "migrationVersion": { - "visualization": "7.8.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/o365/1.4.1/manifest.yml b/packages/o365/1.4.1/manifest.yml deleted file mode 100755 index 9dd4489a3d..0000000000 --- a/packages/o365/1.4.1/manifest.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: o365 -title: Office 365 Logs -version: 1.4.1 -release: ga -description: Collect and parse event logs from Office 365 with Elastic Agent. -type: integration -format_version: 1.0.0 -license: basic -categories: [security] -conditions: - kibana.version: ^7.14.0 || ^8.0.0 -icons: - - src: /img/logo-integrations-microsoft-365.svg - title: Microsoft Office 365 - size: 216x216 - type: image/svg+xml -screenshots: - - src: /img/filebeat-o365-audit.png - title: Office 365 Dashboard - size: 1924x1409 - type: image/png - - src: /img/filebeat-o365-azure-permissions.png - title: Azure Permissions - size: 2660x1030 - type: image/png -policy_templates: - - name: o365 - title: Office 365 logs - description: Collect logs from Office 365 - inputs: - - type: o365audit - title: "Collect Office 365 audit logs" - description: "Collect audit logs from Office 365 via the Management Activity API" -owner: - github: elastic/security-external-integrations diff --git a/packages/zscaler/0.5.1/changelog.yml b/packages/zscaler/0.5.1/changelog.yml deleted file mode 100755 index 4de5416f60..0000000000 --- a/packages/zscaler/0.5.1/changelog.yml +++ /dev/null @@ -1,82 +0,0 @@ -# newer versions go on top -- version: "0.5.1" - changes: - - description: Mark package as deprecated. Use the zscaler_zia package instead. - type: enhancement - link: https://github.com/elastic/integrations/pull/ -- version: "0.5.0" - changes: - - description: Update to ECS 8.0.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2599 -- version: "0.4.5" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "0.4.4" - changes: - - description: Uniform with guidelines - type: enhancement - link: | - https://github.com/elastic/integrations/pull/2044 -- version: "0.4.3" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1995 -- version: "0.4.2" - changes: - - description: Fixed a bug that prevents the package from working in 7.16. - type: bugfix - link: https://github.com/elastic/integrations/pull/1882 -- version: "0.4.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1864 -- version: "0.4.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1684 -- version: "0.3.3" - changes: - - description: Requires version 7.14.1 of the stack - type: bugfix - link: https://github.com/elastic/integrations/pull/1541 -- version: "0.3.2" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1513 -- version: '0.3.1' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1428 -- version: "0.3.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.2.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1279 -- version: "0.1.5" - changes: - - description: update to ECS 1.10.0 and adding event.original options - type: enhancement - link: https://github.com/elastic/integrations/pull/1112 -- version: "0.1.4" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/878 -- version: "0.1.0" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/package-storage/pull/181 diff --git a/packages/zscaler/0.5.1/data_stream/zia/agent/stream/stream.yml.hbs b/packages/zscaler/0.5.1/data_stream/zia/agent/stream/stream.yml.hbs deleted file mode 100755 index 398e8368cd..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,2655 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Zscaler" - product: "Internet" - type: "Configuration" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} ZSCALERNSS: time=%{hfld2->} %{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hyear}^^timezone=%{timezone}^^%{payload}", processor_chain([ - setc("header_id","0001"), - setc("messageid","ZSCALERNSS_1"), - ])); - - var select1 = linear_select([ - hdr1, - ]); - - var part1 = match("MESSAGE#0:ZSCALERNSS_1", "nwparser.payload", "action=%{action}^^reason=%{result}^^hostname=%{hostname}^^protocol=%{protocol}^^serverip=%{daddr}^^url=%{url}^^urlcategory=%{filter}^^urlclass=%{info}^^dlpdictionaries=%{fld3}^^dlpengine=%{fld4}^^filetype=%{filetype}^^threatcategory=%{category}^^threatclass=%{vendor_event_cat}^^pagerisk=%{fld8}^^threatname=%{threat_name}^^clientpublicIP=%{fld9}^^ClientIP=%{saddr}^^location=%{fld11}^^refererURL=%{web_referer}^^useragent=%{user_agent}^^department=%{user_dept}^^user=%{username}^^event_id=%{id}^^clienttranstime=%{fld17}^^requestmethod=%{web_method}^^requestsize=%{sbytes}^^requestversion=%{fld20}^^status=%{resultcode}^^responsesize=%{rbytes}^^responseversion=%{fld23}^^transactionsize=%{bytes}", processor_chain([ - setc("eventcategory","1605000000"), - setf("fqdn","hostname"), - setf("msg","$MSG"), - date_time({ - dest: "event_time", - args: ["hmonth","hday","hyear","hhour","hmin","hsec"], - fmts: [ - [dB,dF,dW,dN,dU,dO], - ], - }), - lookup({ - dest: "nwparser.ec_activity", - map: map_getEventCategoryActivity, - key: field("action"), - }), - setc("ec_theme","Communication"), - setc("ec_subject","User"), - ])); - - var msg1 = msg("ZSCALERNSS_1", part1); - - var chain1 = processor_chain([ - select1, - msgid_select({ - "ZSCALERNSS_1": msg1, - }), - ]); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/zscaler/0.5.1/data_stream/zia/agent/stream/tcp.yml.hbs b/packages/zscaler/0.5.1/data_stream/zia/agent/stream/tcp.yml.hbs deleted file mode 100755 index 678c7087b7..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,2652 +0,0 @@ -tcp: -host: "{{tcp_host}}:{{tcp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Zscaler" - product: "Internet" - type: "Configuration" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} ZSCALERNSS: time=%{hfld2->} %{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hyear}^^timezone=%{timezone}^^%{payload}", processor_chain([ - setc("header_id","0001"), - setc("messageid","ZSCALERNSS_1"), - ])); - - var select1 = linear_select([ - hdr1, - ]); - - var part1 = match("MESSAGE#0:ZSCALERNSS_1", "nwparser.payload", "action=%{action}^^reason=%{result}^^hostname=%{hostname}^^protocol=%{protocol}^^serverip=%{daddr}^^url=%{url}^^urlcategory=%{filter}^^urlclass=%{info}^^dlpdictionaries=%{fld3}^^dlpengine=%{fld4}^^filetype=%{filetype}^^threatcategory=%{category}^^threatclass=%{vendor_event_cat}^^pagerisk=%{fld8}^^threatname=%{threat_name}^^clientpublicIP=%{fld9}^^ClientIP=%{saddr}^^location=%{fld11}^^refererURL=%{web_referer}^^useragent=%{user_agent}^^department=%{user_dept}^^user=%{username}^^event_id=%{id}^^clienttranstime=%{fld17}^^requestmethod=%{web_method}^^requestsize=%{sbytes}^^requestversion=%{fld20}^^status=%{resultcode}^^responsesize=%{rbytes}^^responseversion=%{fld23}^^transactionsize=%{bytes}", processor_chain([ - setc("eventcategory","1605000000"), - setf("fqdn","hostname"), - setf("msg","$MSG"), - date_time({ - dest: "event_time", - args: ["hmonth","hday","hyear","hhour","hmin","hsec"], - fmts: [ - [dB,dF,dW,dN,dU,dO], - ], - }), - lookup({ - dest: "nwparser.ec_activity", - map: map_getEventCategoryActivity, - key: field("action"), - }), - setc("ec_theme","Communication"), - setc("ec_subject","User"), - ])); - - var msg1 = msg("ZSCALERNSS_1", part1); - - var chain1 = processor_chain([ - select1, - msgid_select({ - "ZSCALERNSS_1": msg1, - }), - ]); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/zscaler/0.5.1/data_stream/zia/agent/stream/udp.yml.hbs b/packages/zscaler/0.5.1/data_stream/zia/agent/stream/udp.yml.hbs deleted file mode 100755 index e79a8a0553..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,2652 +0,0 @@ -udp: -host: "{{udp_host}}:{{udp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -fields_under_root: true -fields: - observer: - vendor: "Zscaler" - product: "Internet" - type: "Configuration" -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -{{#if processors}} -{{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} ZSCALERNSS: time=%{hfld2->} %{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hyear}^^timezone=%{timezone}^^%{payload}", processor_chain([ - setc("header_id","0001"), - setc("messageid","ZSCALERNSS_1"), - ])); - - var select1 = linear_select([ - hdr1, - ]); - - var part1 = match("MESSAGE#0:ZSCALERNSS_1", "nwparser.payload", "action=%{action}^^reason=%{result}^^hostname=%{hostname}^^protocol=%{protocol}^^serverip=%{daddr}^^url=%{url}^^urlcategory=%{filter}^^urlclass=%{info}^^dlpdictionaries=%{fld3}^^dlpengine=%{fld4}^^filetype=%{filetype}^^threatcategory=%{category}^^threatclass=%{vendor_event_cat}^^pagerisk=%{fld8}^^threatname=%{threat_name}^^clientpublicIP=%{fld9}^^ClientIP=%{saddr}^^location=%{fld11}^^refererURL=%{web_referer}^^useragent=%{user_agent}^^department=%{user_dept}^^user=%{username}^^event_id=%{id}^^clienttranstime=%{fld17}^^requestmethod=%{web_method}^^requestsize=%{sbytes}^^requestversion=%{fld20}^^status=%{resultcode}^^responsesize=%{rbytes}^^responseversion=%{fld23}^^transactionsize=%{bytes}", processor_chain([ - setc("eventcategory","1605000000"), - setf("fqdn","hostname"), - setf("msg","$MSG"), - date_time({ - dest: "event_time", - args: ["hmonth","hday","hyear","hhour","hmin","hsec"], - fmts: [ - [dB,dF,dW,dN,dU,dO], - ], - }), - lookup({ - dest: "nwparser.ec_activity", - map: map_getEventCategoryActivity, - key: field("action"), - }), - setc("ec_theme","Communication"), - setc("ec_subject","User"), - ])); - - var msg1 = msg("ZSCALERNSS_1", part1); - - var chain1 = processor_chain([ - select1, - msgid_select({ - "ZSCALERNSS_1": msg1, - }), - ]); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ diff --git a/packages/zscaler/0.5.1/data_stream/zia/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler/0.5.1/data_stream/zia/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 520eb80c75..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- -description: Pipeline for Zscaler NSS - -processors: - # ECS event.ingested - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - - set: - field: ecs.version - value: '8.0.0' - # User agent - - user_agent: - field: user_agent.original - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - append: - field: related.hosts - value: '{{host.name}}' - allow_duplicates: false - if: ctx.host?.name != null && ctx.host?.name != '' - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - append: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/zscaler/0.5.1/data_stream/zia/fields/base-fields.yml b/packages/zscaler/0.5.1/data_stream/zia/fields/base-fields.yml deleted file mode 100755 index 9a64f92d5b..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/fields/base-fields.yml +++ /dev/null @@ -1,46 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler.zia -- name: '@timestamp' - type: date - description: Event timestamp. -- name: container.id - description: Unique container id. - ignore_above: 1024 - type: keyword -- name: input.type - description: Type of Filebeat input. - type: keyword -- name: log.file.path - description: Full path to the log file this event came from. - example: /var/log/fun-times.log - ignore_above: 1024 - type: keyword -- name: log.source.address - description: Source address from which the log event was read / sent from. - type: keyword -- name: log.flags - description: Flags for the log file. - type: keyword -- name: log.offset - description: Offset of the entry in the log file. - type: long -- name: tags - description: List of keywords used to tag each event. - example: '["production", "env2"]' - ignore_above: 1024 - type: keyword diff --git a/packages/zscaler/0.5.1/data_stream/zia/fields/ecs.yml b/packages/zscaler/0.5.1/data_stream/zia/fields/ecs.yml deleted file mode 100755 index 41eb38d57d..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/fields/ecs.yml +++ /dev/null @@ -1,539 +0,0 @@ -- description: |- - Date/time when the event originated. - This is the date/time extracted from the event, typically representing when the event was generated by the source. - If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. - Required field for all events. - name: '@timestamp' - type: date -- description: |- - The domain name of the client system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: client.domain - type: keyword -- description: |- - The highest registered client domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: client.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: client.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: client.top_level_domain - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - MAC address of the destination. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: destination.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - The highest registered destination domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: destination.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: destination.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: destination.top_level_domain - type: keyword -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: The type of data contained in this resource record. - name: dns.answers.type - type: keyword -- description: |- - The highest registered domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: dns.question.registered_domain - type: keyword -- description: |- - The subdomain is all of the labels under the registered_domain. - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: dns.question.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: dns.question.top_level_domain - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Error message. - name: error.message - type: match_only_text -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - name: event.original - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. - Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - name: event.timezone - type: keyword -- description: |- - Array of file attributes. - Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. - name: file.attributes - type: keyword -- description: Directory where the file is located. It should include the drive letter, when appropriate. - name: file.directory - type: keyword -- description: |- - File extension, excluding the leading dot. - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: file.extension - type: keyword -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - name: file.path - type: keyword -- description: |- - File size in bytes. - Only relevant when `file.type` is "file". - name: file.size - type: long -- description: File type (file, dir, or symlink). - name: file.type - type: keyword -- description: City name. - name: geo.city_name - type: keyword -- description: Country name. - name: geo.country_name - type: keyword -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: geo.name - type: keyword -- description: Region name. - name: geo.region_name - type: keyword -- description: Unique identifier for the group on the system/platform. - name: group.id - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Host MAC addresses. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: host.mac - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: |- - Original log level of the log event. - If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). - Some examples are `warn`, `err`, `i`, `informational`. - name: log.level - type: keyword -- description: |- - The Syslog numeric facility of the log event, if available. - According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. - name: log.syslog.facility.code - type: long -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - The Syslog numeric severity of the log event, if available. - If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. - name: log.syslog.severity.code - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: Host IP address when the source IP address is the proxy. - name: network.forwarded_ip - type: ip -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: The product name of the observer. - name: observer.product - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.name - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - name: process.parent.name - type: keyword -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.parent.title - type: keyword -- description: Process id. - name: process.pid - type: long -- description: Process id. - name: process.parent.pid - type: long -- description: |- - Process title. - The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - name: process.title - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: |- - The highest registered server domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: server.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: server.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: server.top_level_domain - type: keyword -- description: |- - Name of the service data is collected from. - The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. - In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - name: service.name - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - MAC address of the source. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: source.mac - type: keyword -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Port of the source. - name: source.port - type: long -- description: |- - The highest registered source domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: source.registered_domain - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: source.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: source.top_level_domain - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - The highest registered url domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: url.registered_domain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: url.top_level_domain - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword -- description: User's full name, if available. - name: user.full_name - type: keyword -- description: Unique identifier of the user. - name: user.id - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: user_agent.os.family - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system kernel version as a raw string. - name: user_agent.os.kernel - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system platform (such centos, ubuntu, windows). - name: user_agent.os.platform - type: keyword -- description: |- - Use the `os.type` field to categorize the operating system into one of the broad commercial families. - One of these following values should be used (lowercase): linux, macos, unix, windows. - If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. - name: user_agent.os.type - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/zscaler/0.5.1/data_stream/zia/fields/fields.yml b/packages/zscaler/0.5.1/data_stream/zia/fields/fields.yml deleted file mode 100755 index ea69cd79e3..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/fields/fields.yml +++ /dev/null @@ -1,1754 +0,0 @@ -- name: rsa - type: group - fields: - - name: internal - type: group - fields: - - name: msg - type: keyword - description: This key is used to capture the raw message that comes into the Log Decoder - - name: messageid - type: keyword - - name: event_desc - type: keyword - - name: message - type: keyword - description: This key captures the contents of instant messages - - name: time - type: date - description: This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - - name: level - type: long - description: Deprecated key defined only in table map. - - name: msg_id - type: keyword - description: This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: msg_vid - type: keyword - description: This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: data - type: keyword - description: Deprecated key defined only in table map. - - name: obj_server - type: keyword - description: Deprecated key defined only in table map. - - name: obj_val - type: keyword - description: Deprecated key defined only in table map. - - name: resource - type: keyword - description: Deprecated key defined only in table map. - - name: obj_id - type: keyword - description: Deprecated key defined only in table map. - - name: statement - type: keyword - description: Deprecated key defined only in table map. - - name: audit_class - type: keyword - description: Deprecated key defined only in table map. - - name: entry - type: keyword - description: Deprecated key defined only in table map. - - name: hcode - type: keyword - description: Deprecated key defined only in table map. - - name: inode - type: long - description: Deprecated key defined only in table map. - - name: resource_class - type: keyword - description: Deprecated key defined only in table map. - - name: dead - type: long - description: Deprecated key defined only in table map. - - name: feed_desc - type: keyword - description: This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: feed_name - type: keyword - description: This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: cid - type: keyword - description: This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_class - type: keyword - description: This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_group - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_host - type: keyword - description: This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ip - type: ip - description: This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ipv6 - type: ip - description: This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type - type: keyword - description: This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type_id - type: long - description: Deprecated key defined only in table map. - - name: did - type: keyword - description: This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: entropy_req - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: entropy_res - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: event_name - type: keyword - description: Deprecated key defined only in table map. - - name: feed_category - type: keyword - description: This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: forward_ip - type: ip - description: This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - - name: forward_ipv6 - type: ip - description: This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: header_id - type: keyword - description: This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_cid - type: keyword - description: This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_ctime - type: date - description: This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: mcb_req - type: long - description: This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most - - name: mcb_res - type: long - description: This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most - - name: mcbc_req - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: mcbc_res - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: medium - type: long - description: "This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session" - - name: node_name - type: keyword - description: Deprecated key defined only in table map. - - name: nwe_callback_id - type: keyword - description: This key denotes that event is endpoint related - - name: parse_error - type: keyword - description: This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: payload_req - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: payload_res - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: process_vid_dst - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - - name: process_vid_src - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. - - name: rid - type: long - description: This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: session_split - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: site - type: keyword - description: Deprecated key defined only in table map. - - name: size - type: long - description: This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: sourcefile - type: keyword - description: This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: ubc_req - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: ubc_res - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: word - type: keyword - description: This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log - - name: time - type: group - fields: - - name: event_time - type: date - description: This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - - name: duration_time - type: double - description: This key is used to capture the normalized duration/lifetime in seconds. - - name: event_time_str - type: keyword - description: This key is used to capture the incomplete time mentioned in a session as a string - - name: starttime - type: date - description: This key is used to capture the Start time mentioned in a session in a standard form - - name: month - type: keyword - - name: day - type: keyword - - name: endtime - type: date - description: This key is used to capture the End time mentioned in a session in a standard form - - name: timezone - type: keyword - description: This key is used to capture the timezone of the Event Time - - name: duration_str - type: keyword - description: A text string version of the duration - - name: date - type: keyword - - name: year - type: keyword - - name: recorded_time - type: date - description: The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - - name: datetime - type: keyword - - name: effective_time - type: date - description: This key is the effective time referenced by an individual event in a Standard Timestamp format - - name: expire_time - type: date - description: This key is the timestamp that explicitly refers to an expiration. - - name: process_time - type: keyword - description: Deprecated, use duration.time - - name: hour - type: keyword - - name: min - type: keyword - - name: timestamp - type: keyword - - name: event_queue_time - type: date - description: This key is the Time that the event was queued. - - name: p_time1 - type: keyword - - name: tzone - type: keyword - - name: eventtime - type: keyword - - name: gmtdate - type: keyword - - name: gmttime - type: keyword - - name: p_date - type: keyword - - name: p_month - type: keyword - - name: p_time - type: keyword - - name: p_time2 - type: keyword - - name: p_year - type: keyword - - name: expire_time_str - type: keyword - description: This key is used to capture incomplete timestamp that explicitly refers to an expiration. - - name: stamp - type: date - description: Deprecated key defined only in table map. - - name: misc - type: group - fields: - - name: action - type: keyword - - name: result - type: keyword - description: This key is used to capture the outcome/result string value of an action in a session. - - name: severity - type: keyword - description: This key is used to capture the severity given the session - - name: event_type - type: keyword - description: This key captures the event category type as specified by the event source. - - name: reference_id - type: keyword - description: This key is used to capture an event id from the session directly - - name: version - type: keyword - description: This key captures Version of the application or OS which is generating the event. - - name: disposition - type: keyword - description: This key captures the The end state of an action. - - name: result_code - type: keyword - description: This key is used to capture the outcome/result numeric value of an action in a session - - name: category - type: keyword - description: This key is used to capture the category of an event given by the vendor in the session - - name: obj_name - type: keyword - description: This is used to capture name of object - - name: obj_type - type: keyword - description: This is used to capture type of object - - name: event_source - type: keyword - description: "This key captures Source of the event that’s not a hostname" - - name: log_session_id - type: keyword - description: This key is used to capture a sessionid from the session directly - - name: group - type: keyword - description: This key captures the Group Name value - - name: policy_name - type: keyword - description: This key is used to capture the Policy Name only. - - name: rule_name - type: keyword - description: This key captures the Rule Name - - name: context - type: keyword - description: This key captures Information which adds additional context to the event. - - name: change_new - type: keyword - description: "This key is used to capture the new values of the attribute that’s changing in a session" - - name: space - type: keyword - - name: client - type: keyword - description: This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - - name: msgIdPart1 - type: keyword - - name: msgIdPart2 - type: keyword - - name: change_old - type: keyword - description: "This key is used to capture the old value of the attribute that’s changing in a session" - - name: operation_id - type: keyword - description: An alert number or operation number. The values should be unique and non-repeating. - - name: event_state - type: keyword - description: This key captures the current state of the object/item referenced within the event. Describing an on-going event. - - name: group_object - type: keyword - description: This key captures a collection/grouping of entities. Specific usage - - name: node - type: keyword - description: Common use case is the node name within a cluster. The cluster name is reflected by the host name. - - name: rule - type: keyword - description: This key captures the Rule number - - name: device_name - type: keyword - description: 'This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc' - - name: param - type: keyword - description: This key is the parameters passed as part of a command or application, etc. - - name: change_attrib - type: keyword - description: "This key is used to capture the name of the attribute that’s changing in a session" - - name: event_computer - type: keyword - description: This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - - name: reference_id1 - type: keyword - description: This key is for Linked ID to be used as an addition to "reference.id" - - name: event_log - type: keyword - description: This key captures the Name of the event log - - name: OS - type: keyword - description: This key captures the Name of the Operating System - - name: terminal - type: keyword - description: This key captures the Terminal Names only - - name: msgIdPart3 - type: keyword - - name: filter - type: keyword - description: This key captures Filter used to reduce result set - - name: serial_number - type: keyword - description: This key is the Serial number associated with a physical asset. - - name: checksum - type: keyword - description: This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - - name: event_user - type: keyword - description: This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - - name: virusname - type: keyword - description: This key captures the name of the virus - - name: content_type - type: keyword - description: This key is used to capture Content Type only. - - name: group_id - type: keyword - description: This key captures Group ID Number (related to the group name) - - name: policy_id - type: keyword - description: This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - - name: vsys - type: keyword - description: This key captures Virtual System Name - - name: connection_id - type: keyword - description: This key captures the Connection ID - - name: reference_id2 - type: keyword - description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - - name: sensor - type: keyword - description: This key captures Name of the sensor. Typically used in IDS/IPS based devices - - name: sig_id - type: long - description: This key captures IDS/IPS Int Signature ID - - name: port_name - type: keyword - description: 'This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name).' - - name: rule_group - type: keyword - description: This key captures the Rule group name - - name: risk_num - type: double - description: This key captures a Numeric Risk value - - name: trigger_val - type: keyword - description: This key captures the Value of the trigger or threshold condition. - - name: log_session_id1 - type: keyword - description: This key is used to capture a Linked (Related) Session ID from the session directly - - name: comp_version - type: keyword - description: This key captures the Version level of a sub-component of a product. - - name: content_version - type: keyword - description: This key captures Version level of a signature or database content. - - name: hardware_id - type: keyword - description: This key is used to capture unique identifier for a device or system (NOT a Mac address) - - name: risk - type: keyword - description: This key captures the non-numeric risk value - - name: event_id - type: keyword - - name: reason - type: keyword - - name: status - type: keyword - - name: mail_id - type: keyword - description: This key is used to capture the mailbox id/name - - name: rule_uid - type: keyword - description: This key is the Unique Identifier for a rule. - - name: trigger_desc - type: keyword - description: This key captures the Description of the trigger or threshold condition. - - name: inout - type: keyword - - name: p_msgid - type: keyword - - name: data_type - type: keyword - - name: msgIdPart4 - type: keyword - - name: error - type: keyword - description: This key captures All non successful Error codes or responses - - name: index - type: keyword - - name: listnum - type: keyword - description: This key is used to capture listname or listnumber, primarily for collecting access-list - - name: ntype - type: keyword - - name: observed_val - type: keyword - description: This key captures the Value observed (from the perspective of the device generating the log). - - name: policy_value - type: keyword - description: This key captures the contents of the policy. This contains details about the policy - - name: pool_name - type: keyword - description: This key captures the name of a resource pool - - name: rule_template - type: keyword - description: A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - - name: count - type: keyword - - name: number - type: keyword - - name: sigcat - type: keyword - - name: type - type: keyword - - name: comments - type: keyword - description: Comment information provided in the log message - - name: doc_number - type: long - description: This key captures File Identification number - - name: expected_val - type: keyword - description: This key captures the Value expected (from the perspective of the device generating the log). - - name: job_num - type: keyword - description: This key captures the Job Number - - name: spi_dst - type: keyword - description: Destination SPI Index - - name: spi_src - type: keyword - description: Source SPI Index - - name: code - type: keyword - - name: agent_id - type: keyword - description: This key is used to capture agent id - - name: message_body - type: keyword - description: This key captures the The contents of the message body. - - name: phone - type: keyword - - name: sig_id_str - type: keyword - description: This key captures a string object of the sigid variable. - - name: cmd - type: keyword - - name: misc - type: keyword - - name: name - type: keyword - - name: cpu - type: long - description: This key is the CPU time used in the execution of the event being recorded. - - name: event_desc - type: keyword - description: This key is used to capture a description of an event available directly or inferred - - name: sig_id1 - type: long - description: This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - - name: im_buddyid - type: keyword - - name: im_client - type: keyword - - name: im_userid - type: keyword - - name: pid - type: keyword - - name: priority - type: keyword - - name: context_subject - type: keyword - description: This key is to be used in an audit context where the subject is the object being identified - - name: context_target - type: keyword - - name: cve - type: keyword - description: This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - - name: fcatnum - type: keyword - description: This key captures Filter Category Number. Legacy Usage - - name: library - type: keyword - description: This key is used to capture library information in mainframe devices - - name: parent_node - type: keyword - description: This key captures the Parent Node Name. Must be related to node variable. - - name: risk_info - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: tcp_flags - type: long - description: This key is captures the TCP flags set in any packet of session - - name: tos - type: long - description: This key describes the type of service - - name: vm_target - type: keyword - description: VMWare Target **VMWARE** only varaible. - - name: workspace - type: keyword - description: This key captures Workspace Description - - name: command - type: keyword - - name: event_category - type: keyword - - name: facilityname - type: keyword - - name: forensic_info - type: keyword - - name: jobname - type: keyword - - name: mode - type: keyword - - name: policy - type: keyword - - name: policy_waiver - type: keyword - - name: second - type: keyword - - name: space1 - type: keyword - - name: subcategory - type: keyword - - name: tbdstr2 - type: keyword - - name: alert_id - type: keyword - description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: checksum_dst - type: keyword - description: This key is used to capture the checksum or hash of the the target entity such as a process or file. - - name: checksum_src - type: keyword - description: This key is used to capture the checksum or hash of the source entity such as a file or process. - - name: fresult - type: long - description: This key captures the Filter Result - - name: payload_dst - type: keyword - description: This key is used to capture destination payload - - name: payload_src - type: keyword - description: This key is used to capture source payload - - name: pool_id - type: keyword - description: This key captures the identifier (typically numeric field) of a resource pool - - name: process_id_val - type: keyword - description: This key is a failure key for Process ID when it is not an integer value - - name: risk_num_comm - type: double - description: This key captures Risk Number Community - - name: risk_num_next - type: double - description: This key captures Risk Number NextGen - - name: risk_num_sand - type: double - description: This key captures Risk Number SandBox - - name: risk_num_static - type: double - description: This key captures Risk Number Static - - name: risk_suspicious - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: risk_warning - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: snmp_oid - type: keyword - description: SNMP Object Identifier - - name: sql - type: keyword - description: This key captures the SQL query - - name: vuln_ref - type: keyword - description: This key captures the Vulnerability Reference details - - name: acl_id - type: keyword - - name: acl_op - type: keyword - - name: acl_pos - type: keyword - - name: acl_table - type: keyword - - name: admin - type: keyword - - name: alarm_id - type: keyword - - name: alarmname - type: keyword - - name: app_id - type: keyword - - name: audit - type: keyword - - name: audit_object - type: keyword - - name: auditdata - type: keyword - - name: benchmark - type: keyword - - name: bypass - type: keyword - - name: cache - type: keyword - - name: cache_hit - type: keyword - - name: cefversion - type: keyword - - name: cfg_attr - type: keyword - - name: cfg_obj - type: keyword - - name: cfg_path - type: keyword - - name: changes - type: keyword - - name: client_ip - type: keyword - - name: clustermembers - type: keyword - - name: cn_acttimeout - type: keyword - - name: cn_asn_src - type: keyword - - name: cn_bgpv4nxthop - type: keyword - - name: cn_ctr_dst_code - type: keyword - - name: cn_dst_tos - type: keyword - - name: cn_dst_vlan - type: keyword - - name: cn_engine_id - type: keyword - - name: cn_engine_type - type: keyword - - name: cn_f_switch - type: keyword - - name: cn_flowsampid - type: keyword - - name: cn_flowsampintv - type: keyword - - name: cn_flowsampmode - type: keyword - - name: cn_inacttimeout - type: keyword - - name: cn_inpermbyts - type: keyword - - name: cn_inpermpckts - type: keyword - - name: cn_invalid - type: keyword - - name: cn_ip_proto_ver - type: keyword - - name: cn_ipv4_ident - type: keyword - - name: cn_l_switch - type: keyword - - name: cn_log_did - type: keyword - - name: cn_log_rid - type: keyword - - name: cn_max_ttl - type: keyword - - name: cn_maxpcktlen - type: keyword - - name: cn_min_ttl - type: keyword - - name: cn_minpcktlen - type: keyword - - name: cn_mpls_lbl_1 - type: keyword - - name: cn_mpls_lbl_10 - type: keyword - - name: cn_mpls_lbl_2 - type: keyword - - name: cn_mpls_lbl_3 - type: keyword - - name: cn_mpls_lbl_4 - type: keyword - - name: cn_mpls_lbl_5 - type: keyword - - name: cn_mpls_lbl_6 - type: keyword - - name: cn_mpls_lbl_7 - type: keyword - - name: cn_mpls_lbl_8 - type: keyword - - name: cn_mpls_lbl_9 - type: keyword - - name: cn_mplstoplabel - type: keyword - - name: cn_mplstoplabip - type: keyword - - name: cn_mul_dst_byt - type: keyword - - name: cn_mul_dst_pks - type: keyword - - name: cn_muligmptype - type: keyword - - name: cn_sampalgo - type: keyword - - name: cn_sampint - type: keyword - - name: cn_seqctr - type: keyword - - name: cn_spackets - type: keyword - - name: cn_src_tos - type: keyword - - name: cn_src_vlan - type: keyword - - name: cn_sysuptime - type: keyword - - name: cn_template_id - type: keyword - - name: cn_totbytsexp - type: keyword - - name: cn_totflowexp - type: keyword - - name: cn_totpcktsexp - type: keyword - - name: cn_unixnanosecs - type: keyword - - name: cn_v6flowlabel - type: keyword - - name: cn_v6optheaders - type: keyword - - name: comp_class - type: keyword - - name: comp_name - type: keyword - - name: comp_rbytes - type: keyword - - name: comp_sbytes - type: keyword - - name: cpu_data - type: keyword - - name: criticality - type: keyword - - name: cs_agency_dst - type: keyword - - name: cs_analyzedby - type: keyword - - name: cs_av_other - type: keyword - - name: cs_av_primary - type: keyword - - name: cs_av_secondary - type: keyword - - name: cs_bgpv6nxthop - type: keyword - - name: cs_bit9status - type: keyword - - name: cs_context - type: keyword - - name: cs_control - type: keyword - - name: cs_data - type: keyword - - name: cs_datecret - type: keyword - - name: cs_dst_tld - type: keyword - - name: cs_eth_dst_ven - type: keyword - - name: cs_eth_src_ven - type: keyword - - name: cs_event_uuid - type: keyword - - name: cs_filetype - type: keyword - - name: cs_fld - type: keyword - - name: cs_if_desc - type: keyword - - name: cs_if_name - type: keyword - - name: cs_ip_next_hop - type: keyword - - name: cs_ipv4dstpre - type: keyword - - name: cs_ipv4srcpre - type: keyword - - name: cs_lifetime - type: keyword - - name: cs_log_medium - type: keyword - - name: cs_loginname - type: keyword - - name: cs_modulescore - type: keyword - - name: cs_modulesign - type: keyword - - name: cs_opswatresult - type: keyword - - name: cs_payload - type: keyword - - name: cs_registrant - type: keyword - - name: cs_registrar - type: keyword - - name: cs_represult - type: keyword - - name: cs_rpayload - type: keyword - - name: cs_sampler_name - type: keyword - - name: cs_sourcemodule - type: keyword - - name: cs_streams - type: keyword - - name: cs_targetmodule - type: keyword - - name: cs_v6nxthop - type: keyword - - name: cs_whois_server - type: keyword - - name: cs_yararesult - type: keyword - - name: description - type: keyword - - name: devvendor - type: keyword - - name: distance - type: keyword - - name: dstburb - type: keyword - - name: edomain - type: keyword - - name: edomaub - type: keyword - - name: euid - type: keyword - - name: facility - type: keyword - - name: finterface - type: keyword - - name: flags - type: keyword - - name: gaddr - type: keyword - - name: id3 - type: keyword - - name: im_buddyname - type: keyword - - name: im_croomid - type: keyword - - name: im_croomtype - type: keyword - - name: im_members - type: keyword - - name: im_username - type: keyword - - name: ipkt - type: keyword - - name: ipscat - type: keyword - - name: ipspri - type: keyword - - name: latitude - type: keyword - - name: linenum - type: keyword - - name: list_name - type: keyword - - name: load_data - type: keyword - - name: location_floor - type: keyword - - name: location_mark - type: keyword - - name: log_id - type: keyword - - name: log_type - type: keyword - - name: logid - type: keyword - - name: logip - type: keyword - - name: logname - type: keyword - - name: longitude - type: keyword - - name: lport - type: keyword - - name: mbug_data - type: keyword - - name: misc_name - type: keyword - - name: msg_type - type: keyword - - name: msgid - type: keyword - - name: netsessid - type: keyword - - name: num - type: keyword - - name: number1 - type: keyword - - name: number2 - type: keyword - - name: nwwn - type: keyword - - name: object - type: keyword - - name: operation - type: keyword - - name: opkt - type: keyword - - name: orig_from - type: keyword - - name: owner_id - type: keyword - - name: p_action - type: keyword - - name: p_filter - type: keyword - - name: p_group_object - type: keyword - - name: p_id - type: keyword - - name: p_msgid1 - type: keyword - - name: p_msgid2 - type: keyword - - name: p_result1 - type: keyword - - name: password_chg - type: keyword - - name: password_expire - type: keyword - - name: permgranted - type: keyword - - name: permwanted - type: keyword - - name: pgid - type: keyword - - name: policyUUID - type: keyword - - name: prog_asp_num - type: keyword - - name: program - type: keyword - - name: real_data - type: keyword - - name: rec_asp_device - type: keyword - - name: rec_asp_num - type: keyword - - name: rec_library - type: keyword - - name: recordnum - type: keyword - - name: ruid - type: keyword - - name: sburb - type: keyword - - name: sdomain_fld - type: keyword - - name: sec - type: keyword - - name: sensorname - type: keyword - - name: seqnum - type: keyword - - name: session - type: keyword - - name: sessiontype - type: keyword - - name: sigUUID - type: keyword - - name: spi - type: keyword - - name: srcburb - type: keyword - - name: srcdom - type: keyword - - name: srcservice - type: keyword - - name: state - type: keyword - - name: status1 - type: keyword - - name: svcno - type: keyword - - name: system - type: keyword - - name: tbdstr1 - type: keyword - - name: tgtdom - type: keyword - - name: tgtdomain - type: keyword - - name: threshold - type: keyword - - name: type1 - type: keyword - - name: udb_class - type: keyword - - name: url_fld - type: keyword - - name: user_div - type: keyword - - name: userid - type: keyword - - name: username_fld - type: keyword - - name: utcstamp - type: keyword - - name: v_instafname - type: keyword - - name: virt_data - type: keyword - - name: vpnid - type: keyword - - name: autorun_type - type: keyword - description: This is used to capture Auto Run type - - name: cc_number - type: long - description: Valid Credit Card Numbers only - - name: content - type: keyword - description: This key captures the content type from protocol headers - - name: ein_number - type: long - description: Employee Identification Numbers only - - name: found - type: keyword - description: This is used to capture the results of regex match - - name: language - type: keyword - description: This is used to capture list of languages the client support and what it prefers - - name: lifetime - type: long - description: This key is used to capture the session lifetime in seconds. - - name: link - type: keyword - description: This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: match - type: keyword - description: This key is for regex match name from search.ini - - name: param_dst - type: keyword - description: This key captures the command line/launch argument of the target process or file - - name: param_src - type: keyword - description: This key captures source parameter - - name: search_text - type: keyword - description: This key captures the Search Text used - - name: sig_name - type: keyword - description: This key is used to capture the Signature Name only. - - name: snmp_value - type: keyword - description: SNMP set request value - - name: streams - type: long - description: This key captures number of streams in session - - name: db - type: group - fields: - - name: index - type: keyword - description: This key captures IndexID of the index. - - name: instance - type: keyword - description: This key is used to capture the database server instance name - - name: database - type: keyword - description: This key is used to capture the name of a database or an instance as seen in a session - - name: transact_id - type: keyword - description: This key captures the SQL transantion ID of the current session - - name: permissions - type: keyword - description: This key captures permission or privilege level assigned to a resource. - - name: table_name - type: keyword - description: This key is used to capture the table name - - name: db_id - type: keyword - description: This key is used to capture the unique identifier for a database - - name: db_pid - type: long - description: This key captures the process id of a connection with database server - - name: lread - type: long - description: This key is used for the number of logical reads - - name: lwrite - type: long - description: This key is used for the number of logical writes - - name: pread - type: long - description: This key is used for the number of physical writes - - name: network - type: group - fields: - - name: alias_host - type: keyword - description: This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - - name: domain - type: keyword - - name: host_dst - type: keyword - description: "This key should only be used when it’s a Destination Hostname" - - name: network_service - type: keyword - description: This is used to capture layer 7 protocols/service names - - name: interface - type: keyword - description: This key should be used when the source or destination context of an interface is not clear - - name: network_port - type: long - description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' - - name: eth_host - type: keyword - description: Deprecated, use alias.mac - - name: sinterface - type: keyword - description: "This key should only be used when it’s a Source Interface" - - name: dinterface - type: keyword - description: "This key should only be used when it’s a Destination Interface" - - name: vlan - type: long - description: This key should only be used to capture the ID of the Virtual LAN - - name: zone_src - type: keyword - description: "This key should only be used when it’s a Source Zone." - - name: zone - type: keyword - description: This key should be used when the source or destination context of a Zone is not clear - - name: zone_dst - type: keyword - description: "This key should only be used when it’s a Destination Zone." - - name: gateway - type: keyword - description: This key is used to capture the IP Address of the gateway - - name: icmp_type - type: long - description: This key is used to capture the ICMP type only - - name: mask - type: keyword - description: This key is used to capture the device network IPmask. - - name: icmp_code - type: long - description: This key is used to capture the ICMP code only - - name: protocol_detail - type: keyword - description: This key should be used to capture additional protocol information - - name: dmask - type: keyword - description: This key is used for Destionation Device network mask - - name: port - type: long - description: This key should only be used to capture a Network Port when the directionality is not clear - - name: smask - type: keyword - description: This key is used for capturing source Network Mask - - name: netname - type: keyword - description: This key is used to capture the network name associated with an IP range. This is configured by the end user. - - name: paddr - type: ip - description: Deprecated - - name: faddr - type: keyword - - name: lhost - type: keyword - - name: origin - type: keyword - - name: remote_domain_id - type: keyword - - name: addr - type: keyword - - name: dns_a_record - type: keyword - - name: dns_ptr_record - type: keyword - - name: fhost - type: keyword - - name: fport - type: keyword - - name: laddr - type: keyword - - name: linterface - type: keyword - - name: phost - type: keyword - - name: ad_computer_dst - type: keyword - description: Deprecated, use host.dst - - name: eth_type - type: long - description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - - name: ip_proto - type: long - description: This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - - name: dns_cname_record - type: keyword - - name: dns_id - type: keyword - - name: dns_opcode - type: keyword - - name: dns_resp - type: keyword - - name: dns_type - type: keyword - - name: domain1 - type: keyword - - name: host_type - type: keyword - - name: packet_length - type: keyword - - name: host_orig - type: keyword - description: This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - - name: rpayload - type: keyword - description: This key is used to capture the total number of payload bytes seen in the retransmitted packets. - - name: vlan_name - type: keyword - description: This key should only be used to capture the name of the Virtual LAN - - name: investigations - type: group - fields: - - name: ec_activity - type: keyword - description: This key captures the particular event activity(Ex:Logoff) - - name: ec_theme - type: keyword - description: This key captures the Theme of a particular Event(Ex:Authentication) - - name: ec_subject - type: keyword - description: This key captures the Subject of a particular Event(Ex:User) - - name: ec_outcome - type: keyword - description: This key captures the outcome of a particular Event(Ex:Success) - - name: event_cat - type: long - description: This key captures the Event category number - - name: event_cat_name - type: keyword - description: This key captures the event category name corresponding to the event cat code - - name: event_vcat - type: keyword - description: This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - - name: analysis_file - type: keyword - description: This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - - name: analysis_service - type: keyword - description: This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - - name: analysis_session - type: keyword - description: This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - - name: boc - type: keyword - description: This is used to capture behaviour of compromise - - name: eoc - type: keyword - description: This is used to capture Enablers of Compromise - - name: inv_category - type: keyword - description: This used to capture investigation category - - name: inv_context - type: keyword - description: This used to capture investigation context - - name: ioc - type: keyword - description: This is key capture indicator of compromise - - name: counters - type: group - fields: - - name: dclass_c1 - type: long - description: This is a generic counter key that should be used with the label dclass.c1.str only - - name: dclass_c2 - type: long - description: This is a generic counter key that should be used with the label dclass.c2.str only - - name: event_counter - type: long - description: This is used to capture the number of times an event repeated - - name: dclass_r1 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r1.str only - - name: dclass_c3 - type: long - description: This is a generic counter key that should be used with the label dclass.c3.str only - - name: dclass_c1_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c1 only - - name: dclass_c2_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c2 only - - name: dclass_r1_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r1 only - - name: dclass_r2 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r2.str only - - name: dclass_c3_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c3 only - - name: dclass_r3 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r3.str only - - name: dclass_r2_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r2 only - - name: dclass_r3_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r3 only - - name: identity - type: group - fields: - - name: auth_method - type: keyword - description: This key is used to capture authentication methods used only - - name: user_role - type: keyword - description: This key is used to capture the Role of a user only - - name: dn - type: keyword - description: X.500 (LDAP) Distinguished Name - - name: logon_type - type: keyword - description: This key is used to capture the type of logon method used. - - name: profile - type: keyword - description: This key is used to capture the user profile - - name: accesses - type: keyword - description: This key is used to capture actual privileges used in accessing an object - - name: realm - type: keyword - description: Radius realm or similar grouping of accounts - - name: user_sid_dst - type: keyword - description: This key captures Destination User Session ID - - name: dn_src - type: keyword - description: An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - - name: org - type: keyword - description: This key captures the User organization - - name: dn_dst - type: keyword - description: An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - - name: firstname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: lastname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: user_dept - type: keyword - description: User's Department Names only - - name: user_sid_src - type: keyword - description: This key captures Source User Session ID - - name: federated_sp - type: keyword - description: This key is the Federated Service Provider. This is the application requesting authentication. - - name: federated_idp - type: keyword - description: This key is the federated Identity Provider. This is the server providing the authentication. - - name: logon_type_desc - type: keyword - description: This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - - name: middlename - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: password - type: keyword - description: This key is for Passwords seen in any session, plain text or encrypted - - name: host_role - type: keyword - description: This key should only be used to capture the role of a Host Machine - - name: ldap - type: keyword - description: "This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context" - - name: ldap_query - type: keyword - description: This key is the Search criteria from an LDAP search - - name: ldap_response - type: keyword - description: This key is to capture Results from an LDAP search - - name: owner - type: keyword - description: This is used to capture username the process or service is running as, the author of the task - - name: service_account - type: keyword - description: This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - - name: email - type: group - fields: - - name: email_dst - type: keyword - description: This key is used to capture the Destination email address only, when the destination context is not clear use email - - name: email_src - type: keyword - description: This key is used to capture the source email address only, when the source context is not clear use email - - name: subject - type: keyword - description: This key is used to capture the subject string from an Email only. - - name: email - type: keyword - description: This key is used to capture a generic email address where the source or destination context is not clear - - name: trans_from - type: keyword - description: Deprecated key defined only in table map. - - name: trans_to - type: keyword - description: Deprecated key defined only in table map. - - name: file - type: group - fields: - - name: privilege - type: keyword - description: Deprecated, use permissions - - name: attachment - type: keyword - description: This key captures the attachment file name - - name: filesystem - type: keyword - - name: binary - type: keyword - description: Deprecated key defined only in table map. - - name: filename_dst - type: keyword - description: This is used to capture name of the file targeted by the action - - name: filename_src - type: keyword - description: This is used to capture name of the parent filename, the file which performed the action - - name: filename_tmp - type: keyword - - name: directory_dst - type: keyword - description: This key is used to capture the directory of the target process or file - - name: directory_src - type: keyword - description: This key is used to capture the directory of the source process or file - - name: file_entropy - type: double - description: This is used to capture entropy vale of a file - - name: file_vendor - type: keyword - description: This is used to capture Company name of file located in version_info - - name: task_name - type: keyword - description: This is used to capture name of the task - - name: web - type: group - fields: - - name: fqdn - type: keyword - description: Fully Qualified Domain Names - - name: web_cookie - type: keyword - description: This key is used to capture the Web cookies specifically. - - name: alias_host - type: keyword - - name: reputation_num - type: double - description: Reputation Number of an entity. Typically used for Web Domains - - name: web_ref_domain - type: keyword - description: Web referer's domain - - name: web_ref_query - type: keyword - description: This key captures Web referer's query portion of the URL - - name: remote_domain - type: keyword - - name: web_ref_page - type: keyword - description: This key captures Web referer's page information - - name: web_ref_root - type: keyword - description: Web referer's root URL path - - name: cn_asn_dst - type: keyword - - name: cn_rpackets - type: keyword - - name: urlpage - type: keyword - - name: urlroot - type: keyword - - name: p_url - type: keyword - - name: p_user_agent - type: keyword - - name: p_web_cookie - type: keyword - - name: p_web_method - type: keyword - - name: p_web_referer - type: keyword - - name: web_extension_tmp - type: keyword - - name: web_page - type: keyword - - name: threat - type: group - fields: - - name: threat_category - type: keyword - description: This key captures Threat Name/Threat Category/Categorization of alert - - name: threat_desc - type: keyword - description: This key is used to capture the threat description from the session directly or inferred - - name: alert - type: keyword - description: This key is used to capture name of the alert - - name: threat_source - type: keyword - description: This key is used to capture source of the threat - - name: crypto - type: group - fields: - - name: crypto - type: keyword - description: This key is used to capture the Encryption Type or Encryption Key only - - name: cipher_src - type: keyword - description: This key is for Source (Client) Cipher - - name: cert_subject - type: keyword - description: This key is used to capture the Certificate organization only - - name: peer - type: keyword - description: This key is for Encryption peer's IP Address - - name: cipher_size_src - type: long - description: This key captures Source (Client) Cipher Size - - name: ike - type: keyword - description: IKE negotiation phase. - - name: scheme - type: keyword - description: This key captures the Encryption scheme used - - name: peer_id - type: keyword - description: "This key is for Encryption peer’s identity" - - name: sig_type - type: keyword - description: This key captures the Signature Type - - name: cert_issuer - type: keyword - - name: cert_host_name - type: keyword - description: Deprecated key defined only in table map. - - name: cert_error - type: keyword - description: This key captures the Certificate Error String - - name: cipher_dst - type: keyword - description: This key is for Destination (Server) Cipher - - name: cipher_size_dst - type: long - description: This key captures Destination (Server) Cipher Size - - name: ssl_ver_src - type: keyword - description: Deprecated, use version - - name: d_certauth - type: keyword - - name: s_certauth - type: keyword - - name: ike_cookie1 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase One" - - name: ike_cookie2 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase Two" - - name: cert_checksum - type: keyword - - name: cert_host_cat - type: keyword - description: This key is used for the hostname category value of a certificate - - name: cert_serial - type: keyword - description: This key is used to capture the Certificate serial number only - - name: cert_status - type: keyword - description: This key captures Certificate validation status - - name: ssl_ver_dst - type: keyword - description: Deprecated, use version - - name: cert_keysize - type: keyword - - name: cert_username - type: keyword - - name: https_insact - type: keyword - - name: https_valid - type: keyword - - name: cert_ca - type: keyword - description: This key is used to capture the Certificate signing authority only - - name: cert_common - type: keyword - description: This key is used to capture the Certificate common name only - - name: wireless - type: group - fields: - - name: wlan_ssid - type: keyword - description: This key is used to capture the ssid of a Wireless Session - - name: access_point - type: keyword - description: This key is used to capture the access point name. - - name: wlan_channel - type: long - description: This is used to capture the channel names - - name: wlan_name - type: keyword - description: This key captures either WLAN number/name - - name: storage - type: group - fields: - - name: disk_volume - type: keyword - description: A unique name assigned to logical units (volumes) within a physical disk - - name: lun - type: keyword - description: Logical Unit Number.This key is a very useful concept in Storage. - - name: pwwn - type: keyword - description: This uniquely identifies a port on a HBA. - - name: physical - type: group - fields: - - name: org_dst - type: keyword - description: This is used to capture the destination organization based on the GEOPIP Maxmind database. - - name: org_src - type: keyword - description: This is used to capture the source organization based on the GEOPIP Maxmind database. - - name: healthcare - type: group - fields: - - name: patient_fname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_id - type: keyword - description: This key captures the unique ID for a patient - - name: patient_lname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_mname - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: endpoint - type: group - fields: - - name: host_state - type: keyword - description: This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - - name: registry_key - type: keyword - description: This key captures the path to the registry key - - name: registry_value - type: keyword - description: This key captures values or decorators used within a registry entry -- name: dns.question.domain - type: keyword - ignore_above: 1024 - description: Server domain. -- name: network.interface.name - type: keyword diff --git a/packages/zscaler/0.5.1/data_stream/zia/manifest.yml b/packages/zscaler/0.5.1/data_stream/zia/manifest.yml deleted file mode 100755 index 99ea159b95..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/manifest.yml +++ /dev/null @@ -1,204 +0,0 @@ -title: Zscaler NSS logs -release: experimental -type: logs -streams: - - input: udp - title: Zscaler NSS logs - description: Collect Zscaler NSS logs - template_path: udp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - zscaler-zia - - forwarded - - name: udp_host - type: text - title: UDP host to listen on - multi: false - required: true - show_user: true - default: localhost - - name: udp_port - type: integer - title: UDP port to listen on - multi: false - required: true - show_user: true - default: 9538 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: tcp - title: Zscaler NSS logs - description: Collect Zscaler NSS logs - template_path: tcp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - zscaler-zia - - forwarded - - name: tcp_host - type: text - title: TCP host to listen on - multi: false - required: true - show_user: true - default: localhost - - name: tcp_port - type: integer - title: TCP port to listen on - multi: false - required: true - show_user: true - default: 9538 - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: logfile - enabled: false - title: Zscaler NSS logs - description: Collect Zscaler NSS logs from file - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/zscaler-zia.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - zscaler-zia - - forwarded - - name: tz_offset - type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields - required: false - show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler/0.5.1/data_stream/zia/sample_event.json b/packages/zscaler/0.5.1/data_stream/zia/sample_event.json deleted file mode 100755 index 4e149aea5b..0000000000 --- a/packages/zscaler/0.5.1/data_stream/zia/sample_event.json +++ /dev/null @@ -1,148 +0,0 @@ -{ - "@timestamp": "2016-01-29T06:09:59.000Z", - "agent": { - "ephemeral_id": "6ff67be5-c9ec-45fc-98f2-8394229007a7", - "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0" - }, - "data_stream": { - "dataset": "zscaler.zia", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "bytes": 1803, - "ip": [ - "10.206.191.17" - ] - }, - "ecs": { - "version": "1.12.0" - }, - "elastic_agent": { - "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", - "snapshot": true, - "version": "8.0.0" - }, - "event": { - "action": "Blocked", - "agent_id_status": "verified", - "code": "litesse", - "dataset": "zscaler.zia", - "ingested": "2022-01-25T13:13:54Z", - "timezone": "+00:00" - }, - "file": { - "type": "psa" - }, - "host": { - "name": "rci737.www5.example" - }, - "http": { - "request": { - "referrer": "https://internal.example.org/sequa/abo.gif?umqui=reeufugi#mdolo" - } - }, - "input": { - "type": "udp" - }, - "log": { - "source": { - "address": "172.30.0.4:56583" - } - }, - "network": { - "bytes": 3942, - "protocol": "tcp" - }, - "observer": { - "product": "Internet", - "type": "Configuration", - "vendor": "Zscaler" - }, - "related": { - "hosts": [ - "rci737.www5.example" - ], - "ip": [ - "10.206.191.17", - "10.176.10.114" - ], - "user": [ - "sumdo" - ] - }, - "rsa": { - "db": { - "index": "ntsunti" - }, - "identity": { - "user_dept": "sperna" - }, - "internal": { - "data": "iusm", - "messageid": "ZSCALERNSS_1" - }, - "investigations": { - "ec_activity": "Deny", - "ec_subject": "User", - "ec_theme": "Communication", - "event_vcat": "ntium" - }, - "misc": { - "action": [ - "pisciv", - "Blocked" - ], - "category": "umq", - "filter": "oremi", - "reference_id": "litesse", - "result": "failure", - "result_code": "sist" - }, - "network": { - "alias_host": [ - "rci737.www5.example" - ] - }, - "threat": { - "threat_category": "cer" - }, - "time": { - "event_time": "2016-01-29T06:09:59.000Z", - "timezone": "GMT+02:00" - }, - "web": { - "fqdn": "rci737.www5.example" - } - }, - "source": { - "bytes": 1884, - "ip": [ - "10.176.10.114" - ] - }, - "tags": [ - "zscaler-zia", - "forwarded" - ], - "url": { - "original": "https://api.example.com/ivelitse/ritin.htm?utl=vol#amremap" - }, - "user": { - "name": "sumdo" - }, - "user_agent": { - "device": { - "name": "Generic Smartphone" - }, - "name": "Opera Mini", - "original": "Opera/9.80 (Series 60; Opera Mini/7.1.32444/174.101; U; ru) Presto/2.12.423 Version/12.16", - "os": { - "name": "Symbian OS" - }, - "version": "7.1.32444" - } -} \ No newline at end of file diff --git a/packages/zscaler/0.5.1/docs/README.md b/packages/zscaler/0.5.1/docs/README.md deleted file mode 100755 index 6317040b06..0000000000 --- a/packages/zscaler/0.5.1/docs/README.md +++ /dev/null @@ -1,798 +0,0 @@ -# Zscaler integration (Deprecated) - -_This integration is deprecated. Please migrate to the Zscaler ZIA integration._ - -This integration is for Zscaler device's logs. It includes the following -datasets for receiving logs over syslog or read from a file: -- `zia` dataset: supports Zscaler NSS logs. - -### Zia - -The `zia` dataset collects Zscaler NSS logs. - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | -| container.id | Unique container id. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | Destination domain. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location.lat | | double | -| destination.geo.location.lon | | double | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.mac | MAC address of the destination. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.port | Port of the destination. | long | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.question.type | The type of record being queried. | keyword | -| error.message | Error message. | text | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | date | -| event.original | Raw text message of entire event. Used to demonstrate log integrity. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.extension | File extension. | keyword | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| geo.city_name | City name. | keyword | -| geo.country_name | Country name. | keyword | -| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| geo.region_name | Region name. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| group.name | Name of the group. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| http.request.method | HTTP request method. Prior to ECS 1.6.0 the following guidance was provided: "The field value must be normalized to lowercase for querying." As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| input.type | Type of Filebeat input. | keyword | -| log.file.path | Full path to the log file this event came from. | keyword | -| log.flags | Flags for the log file. | keyword | -| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| log.original | This is the original log message and contains the full log message before splitting it up in multiple parts. In contrast to the `message` field which can contain an extracted part of the log message, this field contains the original, full log message. It can have already some modifications applied like encoding or new lines removed to clean up the log message. This field is not indexed and doc_values are disabled so it can't be queried but the value can be retrieved from `_source`. | keyword | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | text | -| network.application | A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". | keyword | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.direction | Direction of the network traffic. Recommended values are: * inbound * outbound * internal * external * unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view. When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of your network perimeter. | keyword | -| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | -| network.interface.name | | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.protocol | L7 Network protocol name. ex. http, lumberjack, transport protocol. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.pid | Process id. | long | -| process.ppid | Parent process' pid. | long | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names seen on your event. | keyword | -| rsa.counters.dclass_c1 | This is a generic counter key that should be used with the label dclass.c1.str only | long | -| rsa.counters.dclass_c1_str | This is a generic counter string key that should be used with the label dclass.c1 only | keyword | -| rsa.counters.dclass_c2 | This is a generic counter key that should be used with the label dclass.c2.str only | long | -| rsa.counters.dclass_c2_str | This is a generic counter string key that should be used with the label dclass.c2 only | keyword | -| rsa.counters.dclass_c3 | This is a generic counter key that should be used with the label dclass.c3.str only | long | -| rsa.counters.dclass_c3_str | This is a generic counter string key that should be used with the label dclass.c3 only | keyword | -| rsa.counters.dclass_r1 | This is a generic ratio key that should be used with the label dclass.r1.str only | keyword | -| rsa.counters.dclass_r1_str | This is a generic ratio string key that should be used with the label dclass.r1 only | keyword | -| rsa.counters.dclass_r2 | This is a generic ratio key that should be used with the label dclass.r2.str only | keyword | -| rsa.counters.dclass_r2_str | This is a generic ratio string key that should be used with the label dclass.r2 only | keyword | -| rsa.counters.dclass_r3 | This is a generic ratio key that should be used with the label dclass.r3.str only | keyword | -| rsa.counters.dclass_r3_str | This is a generic ratio string key that should be used with the label dclass.r3 only | keyword | -| rsa.counters.event_counter | This is used to capture the number of times an event repeated | long | -| rsa.crypto.cert_ca | This key is used to capture the Certificate signing authority only | keyword | -| rsa.crypto.cert_checksum | | keyword | -| rsa.crypto.cert_common | This key is used to capture the Certificate common name only | keyword | -| rsa.crypto.cert_error | This key captures the Certificate Error String | keyword | -| rsa.crypto.cert_host_cat | This key is used for the hostname category value of a certificate | keyword | -| rsa.crypto.cert_host_name | Deprecated key defined only in table map. | keyword | -| rsa.crypto.cert_issuer | | keyword | -| rsa.crypto.cert_keysize | | keyword | -| rsa.crypto.cert_serial | This key is used to capture the Certificate serial number only | keyword | -| rsa.crypto.cert_status | This key captures Certificate validation status | keyword | -| rsa.crypto.cert_subject | This key is used to capture the Certificate organization only | keyword | -| rsa.crypto.cert_username | | keyword | -| rsa.crypto.cipher_dst | This key is for Destination (Server) Cipher | keyword | -| rsa.crypto.cipher_size_dst | This key captures Destination (Server) Cipher Size | long | -| rsa.crypto.cipher_size_src | This key captures Source (Client) Cipher Size | long | -| rsa.crypto.cipher_src | This key is for Source (Client) Cipher | keyword | -| rsa.crypto.crypto | This key is used to capture the Encryption Type or Encryption Key only | keyword | -| rsa.crypto.d_certauth | | keyword | -| rsa.crypto.https_insact | | keyword | -| rsa.crypto.https_valid | | keyword | -| rsa.crypto.ike | IKE negotiation phase. | keyword | -| rsa.crypto.ike_cookie1 | ID of the negotiation — sent for ISAKMP Phase One | keyword | -| rsa.crypto.ike_cookie2 | ID of the negotiation — sent for ISAKMP Phase Two | keyword | -| rsa.crypto.peer | This key is for Encryption peer's IP Address | keyword | -| rsa.crypto.peer_id | This key is for Encryption peer’s identity | keyword | -| rsa.crypto.s_certauth | | keyword | -| rsa.crypto.scheme | This key captures the Encryption scheme used | keyword | -| rsa.crypto.sig_type | This key captures the Signature Type | keyword | -| rsa.crypto.ssl_ver_dst | Deprecated, use version | keyword | -| rsa.crypto.ssl_ver_src | Deprecated, use version | keyword | -| rsa.db.database | This key is used to capture the name of a database or an instance as seen in a session | keyword | -| rsa.db.db_id | This key is used to capture the unique identifier for a database | keyword | -| rsa.db.db_pid | This key captures the process id of a connection with database server | long | -| rsa.db.index | This key captures IndexID of the index. | keyword | -| rsa.db.instance | This key is used to capture the database server instance name | keyword | -| rsa.db.lread | This key is used for the number of logical reads | long | -| rsa.db.lwrite | This key is used for the number of logical writes | long | -| rsa.db.permissions | This key captures permission or privilege level assigned to a resource. | keyword | -| rsa.db.pread | This key is used for the number of physical writes | long | -| rsa.db.table_name | This key is used to capture the table name | keyword | -| rsa.db.transact_id | This key captures the SQL transantion ID of the current session | keyword | -| rsa.email.email | This key is used to capture a generic email address where the source or destination context is not clear | keyword | -| rsa.email.email_dst | This key is used to capture the Destination email address only, when the destination context is not clear use email | keyword | -| rsa.email.email_src | This key is used to capture the source email address only, when the source context is not clear use email | keyword | -| rsa.email.subject | This key is used to capture the subject string from an Email only. | keyword | -| rsa.email.trans_from | Deprecated key defined only in table map. | keyword | -| rsa.email.trans_to | Deprecated key defined only in table map. | keyword | -| rsa.endpoint.host_state | This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on | keyword | -| rsa.endpoint.registry_key | This key captures the path to the registry key | keyword | -| rsa.endpoint.registry_value | This key captures values or decorators used within a registry entry | keyword | -| rsa.file.attachment | This key captures the attachment file name | keyword | -| rsa.file.binary | Deprecated key defined only in table map. | keyword | -| rsa.file.directory_dst | This key is used to capture the directory of the target process or file | keyword | -| rsa.file.directory_src | This key is used to capture the directory of the source process or file | keyword | -| rsa.file.file_entropy | This is used to capture entropy vale of a file | double | -| rsa.file.file_vendor | This is used to capture Company name of file located in version_info | keyword | -| rsa.file.filename_dst | This is used to capture name of the file targeted by the action | keyword | -| rsa.file.filename_src | This is used to capture name of the parent filename, the file which performed the action | keyword | -| rsa.file.filename_tmp | | keyword | -| rsa.file.filesystem | | keyword | -| rsa.file.privilege | Deprecated, use permissions | keyword | -| rsa.file.task_name | This is used to capture name of the task | keyword | -| rsa.healthcare.patient_fname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_id | This key captures the unique ID for a patient | keyword | -| rsa.healthcare.patient_lname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_mname | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.accesses | This key is used to capture actual privileges used in accessing an object | keyword | -| rsa.identity.auth_method | This key is used to capture authentication methods used only | keyword | -| rsa.identity.dn | X.500 (LDAP) Distinguished Name | keyword | -| rsa.identity.dn_dst | An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn | keyword | -| rsa.identity.dn_src | An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn | keyword | -| rsa.identity.federated_idp | This key is the federated Identity Provider. This is the server providing the authentication. | keyword | -| rsa.identity.federated_sp | This key is the Federated Service Provider. This is the application requesting authentication. | keyword | -| rsa.identity.firstname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.host_role | This key should only be used to capture the role of a Host Machine | keyword | -| rsa.identity.lastname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.ldap | This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context | keyword | -| rsa.identity.ldap_query | This key is the Search criteria from an LDAP search | keyword | -| rsa.identity.ldap_response | This key is to capture Results from an LDAP search | keyword | -| rsa.identity.logon_type | This key is used to capture the type of logon method used. | keyword | -| rsa.identity.logon_type_desc | This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. | keyword | -| rsa.identity.middlename | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.org | This key captures the User organization | keyword | -| rsa.identity.owner | This is used to capture username the process or service is running as, the author of the task | keyword | -| rsa.identity.password | This key is for Passwords seen in any session, plain text or encrypted | keyword | -| rsa.identity.profile | This key is used to capture the user profile | keyword | -| rsa.identity.realm | Radius realm or similar grouping of accounts | keyword | -| rsa.identity.service_account | This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage | keyword | -| rsa.identity.user_dept | User's Department Names only | keyword | -| rsa.identity.user_role | This key is used to capture the Role of a user only | keyword | -| rsa.identity.user_sid_dst | This key captures Destination User Session ID | keyword | -| rsa.identity.user_sid_src | This key captures Source User Session ID | keyword | -| rsa.internal.audit_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.cid | This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.data | Deprecated key defined only in table map. | keyword | -| rsa.internal.dead | Deprecated key defined only in table map. | long | -| rsa.internal.device_class | This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_group | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_host | This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_ip | This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_ipv6 | This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_type | This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_type_id | Deprecated key defined only in table map. | long | -| rsa.internal.did | This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.entropy_req | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entropy_res | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entry | Deprecated key defined only in table map. | keyword | -| rsa.internal.event_desc | | keyword | -| rsa.internal.event_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.feed_category | This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_desc | This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_name | This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.forward_ip | This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. | ip | -| rsa.internal.forward_ipv6 | This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.hcode | Deprecated key defined only in table map. | keyword | -| rsa.internal.header_id | This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.inode | Deprecated key defined only in table map. | long | -| rsa.internal.lc_cid | This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.lc_ctime | This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | date | -| rsa.internal.level | Deprecated key defined only in table map. | long | -| rsa.internal.mcb_req | This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcb_res | This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcbc_req | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.mcbc_res | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.medium | This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session | long | -| rsa.internal.message | This key captures the contents of instant messages | keyword | -| rsa.internal.messageid | | keyword | -| rsa.internal.msg | This key is used to capture the raw message that comes into the Log Decoder | keyword | -| rsa.internal.msg_id | This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.msg_vid | This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.node_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.nwe_callback_id | This key denotes that event is endpoint related | keyword | -| rsa.internal.obj_id | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_server | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_val | Deprecated key defined only in table map. | keyword | -| rsa.internal.parse_error | This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.payload_req | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.payload_res | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.process_vid_dst | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. | keyword | -| rsa.internal.process_vid_src | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. | keyword | -| rsa.internal.resource | Deprecated key defined only in table map. | keyword | -| rsa.internal.resource_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.rid | This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.session_split | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.site | Deprecated key defined only in table map. | keyword | -| rsa.internal.size | This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.sourcefile | This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.statement | Deprecated key defined only in table map. | keyword | -| rsa.internal.time | This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. | date | -| rsa.internal.ubc_req | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.ubc_res | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.word | This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log | keyword | -| rsa.investigations.analysis_file | This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file | keyword | -| rsa.investigations.analysis_service | This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service | keyword | -| rsa.investigations.analysis_session | This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session | keyword | -| rsa.investigations.boc | This is used to capture behaviour of compromise | keyword | -| rsa.investigations.ec_activity | This key captures the particular event activity(Ex:Logoff) | keyword | -| rsa.investigations.ec_outcome | This key captures the outcome of a particular Event(Ex:Success) | keyword | -| rsa.investigations.ec_subject | This key captures the Subject of a particular Event(Ex:User) | keyword | -| rsa.investigations.ec_theme | This key captures the Theme of a particular Event(Ex:Authentication) | keyword | -| rsa.investigations.eoc | This is used to capture Enablers of Compromise | keyword | -| rsa.investigations.event_cat | This key captures the Event category number | long | -| rsa.investigations.event_cat_name | This key captures the event category name corresponding to the event cat code | keyword | -| rsa.investigations.event_vcat | This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. | keyword | -| rsa.investigations.inv_category | This used to capture investigation category | keyword | -| rsa.investigations.inv_context | This used to capture investigation context | keyword | -| rsa.investigations.ioc | This is key capture indicator of compromise | keyword | -| rsa.misc.OS | This key captures the Name of the Operating System | keyword | -| rsa.misc.acl_id | | keyword | -| rsa.misc.acl_op | | keyword | -| rsa.misc.acl_pos | | keyword | -| rsa.misc.acl_table | | keyword | -| rsa.misc.action | | keyword | -| rsa.misc.admin | | keyword | -| rsa.misc.agent_id | This key is used to capture agent id | keyword | -| rsa.misc.alarm_id | | keyword | -| rsa.misc.alarmname | | keyword | -| rsa.misc.alert_id | Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) | keyword | -| rsa.misc.app_id | | keyword | -| rsa.misc.audit | | keyword | -| rsa.misc.audit_object | | keyword | -| rsa.misc.auditdata | | keyword | -| rsa.misc.autorun_type | This is used to capture Auto Run type | keyword | -| rsa.misc.benchmark | | keyword | -| rsa.misc.bypass | | keyword | -| rsa.misc.cache | | keyword | -| rsa.misc.cache_hit | | keyword | -| rsa.misc.category | This key is used to capture the category of an event given by the vendor in the session | keyword | -| rsa.misc.cc_number | Valid Credit Card Numbers only | long | -| rsa.misc.cefversion | | keyword | -| rsa.misc.cfg_attr | | keyword | -| rsa.misc.cfg_obj | | keyword | -| rsa.misc.cfg_path | | keyword | -| rsa.misc.change_attrib | This key is used to capture the name of the attribute that’s changing in a session | keyword | -| rsa.misc.change_new | This key is used to capture the new values of the attribute that’s changing in a session | keyword | -| rsa.misc.change_old | This key is used to capture the old value of the attribute that’s changing in a session | keyword | -| rsa.misc.changes | | keyword | -| rsa.misc.checksum | This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. | keyword | -| rsa.misc.checksum_dst | This key is used to capture the checksum or hash of the the target entity such as a process or file. | keyword | -| rsa.misc.checksum_src | This key is used to capture the checksum or hash of the source entity such as a file or process. | keyword | -| rsa.misc.client | This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. | keyword | -| rsa.misc.client_ip | | keyword | -| rsa.misc.clustermembers | | keyword | -| rsa.misc.cmd | | keyword | -| rsa.misc.cn_acttimeout | | keyword | -| rsa.misc.cn_asn_src | | keyword | -| rsa.misc.cn_bgpv4nxthop | | keyword | -| rsa.misc.cn_ctr_dst_code | | keyword | -| rsa.misc.cn_dst_tos | | keyword | -| rsa.misc.cn_dst_vlan | | keyword | -| rsa.misc.cn_engine_id | | keyword | -| rsa.misc.cn_engine_type | | keyword | -| rsa.misc.cn_f_switch | | keyword | -| rsa.misc.cn_flowsampid | | keyword | -| rsa.misc.cn_flowsampintv | | keyword | -| rsa.misc.cn_flowsampmode | | keyword | -| rsa.misc.cn_inacttimeout | | keyword | -| rsa.misc.cn_inpermbyts | | keyword | -| rsa.misc.cn_inpermpckts | | keyword | -| rsa.misc.cn_invalid | | keyword | -| rsa.misc.cn_ip_proto_ver | | keyword | -| rsa.misc.cn_ipv4_ident | | keyword | -| rsa.misc.cn_l_switch | | keyword | -| rsa.misc.cn_log_did | | keyword | -| rsa.misc.cn_log_rid | | keyword | -| rsa.misc.cn_max_ttl | | keyword | -| rsa.misc.cn_maxpcktlen | | keyword | -| rsa.misc.cn_min_ttl | | keyword | -| rsa.misc.cn_minpcktlen | | keyword | -| rsa.misc.cn_mpls_lbl_1 | | keyword | -| rsa.misc.cn_mpls_lbl_10 | | keyword | -| rsa.misc.cn_mpls_lbl_2 | | keyword | -| rsa.misc.cn_mpls_lbl_3 | | keyword | -| rsa.misc.cn_mpls_lbl_4 | | keyword | -| rsa.misc.cn_mpls_lbl_5 | | keyword | -| rsa.misc.cn_mpls_lbl_6 | | keyword | -| rsa.misc.cn_mpls_lbl_7 | | keyword | -| rsa.misc.cn_mpls_lbl_8 | | keyword | -| rsa.misc.cn_mpls_lbl_9 | | keyword | -| rsa.misc.cn_mplstoplabel | | keyword | -| rsa.misc.cn_mplstoplabip | | keyword | -| rsa.misc.cn_mul_dst_byt | | keyword | -| rsa.misc.cn_mul_dst_pks | | keyword | -| rsa.misc.cn_muligmptype | | keyword | -| rsa.misc.cn_sampalgo | | keyword | -| rsa.misc.cn_sampint | | keyword | -| rsa.misc.cn_seqctr | | keyword | -| rsa.misc.cn_spackets | | keyword | -| rsa.misc.cn_src_tos | | keyword | -| rsa.misc.cn_src_vlan | | keyword | -| rsa.misc.cn_sysuptime | | keyword | -| rsa.misc.cn_template_id | | keyword | -| rsa.misc.cn_totbytsexp | | keyword | -| rsa.misc.cn_totflowexp | | keyword | -| rsa.misc.cn_totpcktsexp | | keyword | -| rsa.misc.cn_unixnanosecs | | keyword | -| rsa.misc.cn_v6flowlabel | | keyword | -| rsa.misc.cn_v6optheaders | | keyword | -| rsa.misc.code | | keyword | -| rsa.misc.command | | keyword | -| rsa.misc.comments | Comment information provided in the log message | keyword | -| rsa.misc.comp_class | | keyword | -| rsa.misc.comp_name | | keyword | -| rsa.misc.comp_rbytes | | keyword | -| rsa.misc.comp_sbytes | | keyword | -| rsa.misc.comp_version | This key captures the Version level of a sub-component of a product. | keyword | -| rsa.misc.connection_id | This key captures the Connection ID | keyword | -| rsa.misc.content | This key captures the content type from protocol headers | keyword | -| rsa.misc.content_type | This key is used to capture Content Type only. | keyword | -| rsa.misc.content_version | This key captures Version level of a signature or database content. | keyword | -| rsa.misc.context | This key captures Information which adds additional context to the event. | keyword | -| rsa.misc.context_subject | This key is to be used in an audit context where the subject is the object being identified | keyword | -| rsa.misc.context_target | | keyword | -| rsa.misc.count | | keyword | -| rsa.misc.cpu | This key is the CPU time used in the execution of the event being recorded. | long | -| rsa.misc.cpu_data | | keyword | -| rsa.misc.criticality | | keyword | -| rsa.misc.cs_agency_dst | | keyword | -| rsa.misc.cs_analyzedby | | keyword | -| rsa.misc.cs_av_other | | keyword | -| rsa.misc.cs_av_primary | | keyword | -| rsa.misc.cs_av_secondary | | keyword | -| rsa.misc.cs_bgpv6nxthop | | keyword | -| rsa.misc.cs_bit9status | | keyword | -| rsa.misc.cs_context | | keyword | -| rsa.misc.cs_control | | keyword | -| rsa.misc.cs_data | | keyword | -| rsa.misc.cs_datecret | | keyword | -| rsa.misc.cs_dst_tld | | keyword | -| rsa.misc.cs_eth_dst_ven | | keyword | -| rsa.misc.cs_eth_src_ven | | keyword | -| rsa.misc.cs_event_uuid | | keyword | -| rsa.misc.cs_filetype | | keyword | -| rsa.misc.cs_fld | | keyword | -| rsa.misc.cs_if_desc | | keyword | -| rsa.misc.cs_if_name | | keyword | -| rsa.misc.cs_ip_next_hop | | keyword | -| rsa.misc.cs_ipv4dstpre | | keyword | -| rsa.misc.cs_ipv4srcpre | | keyword | -| rsa.misc.cs_lifetime | | keyword | -| rsa.misc.cs_log_medium | | keyword | -| rsa.misc.cs_loginname | | keyword | -| rsa.misc.cs_modulescore | | keyword | -| rsa.misc.cs_modulesign | | keyword | -| rsa.misc.cs_opswatresult | | keyword | -| rsa.misc.cs_payload | | keyword | -| rsa.misc.cs_registrant | | keyword | -| rsa.misc.cs_registrar | | keyword | -| rsa.misc.cs_represult | | keyword | -| rsa.misc.cs_rpayload | | keyword | -| rsa.misc.cs_sampler_name | | keyword | -| rsa.misc.cs_sourcemodule | | keyword | -| rsa.misc.cs_streams | | keyword | -| rsa.misc.cs_targetmodule | | keyword | -| rsa.misc.cs_v6nxthop | | keyword | -| rsa.misc.cs_whois_server | | keyword | -| rsa.misc.cs_yararesult | | keyword | -| rsa.misc.cve | This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. | keyword | -| rsa.misc.data_type | | keyword | -| rsa.misc.description | | keyword | -| rsa.misc.device_name | This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc | keyword | -| rsa.misc.devvendor | | keyword | -| rsa.misc.disposition | This key captures the The end state of an action. | keyword | -| rsa.misc.distance | | keyword | -| rsa.misc.doc_number | This key captures File Identification number | long | -| rsa.misc.dstburb | | keyword | -| rsa.misc.edomain | | keyword | -| rsa.misc.edomaub | | keyword | -| rsa.misc.ein_number | Employee Identification Numbers only | long | -| rsa.misc.error | This key captures All non successful Error codes or responses | keyword | -| rsa.misc.euid | | keyword | -| rsa.misc.event_category | | keyword | -| rsa.misc.event_computer | This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. | keyword | -| rsa.misc.event_desc | This key is used to capture a description of an event available directly or inferred | keyword | -| rsa.misc.event_id | | keyword | -| rsa.misc.event_log | This key captures the Name of the event log | keyword | -| rsa.misc.event_source | This key captures Source of the event that’s not a hostname | keyword | -| rsa.misc.event_state | This key captures the current state of the object/item referenced within the event. Describing an on-going event. | keyword | -| rsa.misc.event_type | This key captures the event category type as specified by the event source. | keyword | -| rsa.misc.event_user | This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. | keyword | -| rsa.misc.expected_val | This key captures the Value expected (from the perspective of the device generating the log). | keyword | -| rsa.misc.facility | | keyword | -| rsa.misc.facilityname | | keyword | -| rsa.misc.fcatnum | This key captures Filter Category Number. Legacy Usage | keyword | -| rsa.misc.filter | This key captures Filter used to reduce result set | keyword | -| rsa.misc.finterface | | keyword | -| rsa.misc.flags | | keyword | -| rsa.misc.forensic_info | | keyword | -| rsa.misc.found | This is used to capture the results of regex match | keyword | -| rsa.misc.fresult | This key captures the Filter Result | long | -| rsa.misc.gaddr | | keyword | -| rsa.misc.group | This key captures the Group Name value | keyword | -| rsa.misc.group_id | This key captures Group ID Number (related to the group name) | keyword | -| rsa.misc.group_object | This key captures a collection/grouping of entities. Specific usage | keyword | -| rsa.misc.hardware_id | This key is used to capture unique identifier for a device or system (NOT a Mac address) | keyword | -| rsa.misc.id3 | | keyword | -| rsa.misc.im_buddyid | | keyword | -| rsa.misc.im_buddyname | | keyword | -| rsa.misc.im_client | | keyword | -| rsa.misc.im_croomid | | keyword | -| rsa.misc.im_croomtype | | keyword | -| rsa.misc.im_members | | keyword | -| rsa.misc.im_userid | | keyword | -| rsa.misc.im_username | | keyword | -| rsa.misc.index | | keyword | -| rsa.misc.inout | | keyword | -| rsa.misc.ipkt | | keyword | -| rsa.misc.ipscat | | keyword | -| rsa.misc.ipspri | | keyword | -| rsa.misc.job_num | This key captures the Job Number | keyword | -| rsa.misc.jobname | | keyword | -| rsa.misc.language | This is used to capture list of languages the client support and what it prefers | keyword | -| rsa.misc.latitude | | keyword | -| rsa.misc.library | This key is used to capture library information in mainframe devices | keyword | -| rsa.misc.lifetime | This key is used to capture the session lifetime in seconds. | long | -| rsa.misc.linenum | | keyword | -| rsa.misc.link | This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.misc.list_name | | keyword | -| rsa.misc.listnum | This key is used to capture listname or listnumber, primarily for collecting access-list | keyword | -| rsa.misc.load_data | | keyword | -| rsa.misc.location_floor | | keyword | -| rsa.misc.location_mark | | keyword | -| rsa.misc.log_id | | keyword | -| rsa.misc.log_session_id | This key is used to capture a sessionid from the session directly | keyword | -| rsa.misc.log_session_id1 | This key is used to capture a Linked (Related) Session ID from the session directly | keyword | -| rsa.misc.log_type | | keyword | -| rsa.misc.logid | | keyword | -| rsa.misc.logip | | keyword | -| rsa.misc.logname | | keyword | -| rsa.misc.longitude | | keyword | -| rsa.misc.lport | | keyword | -| rsa.misc.mail_id | This key is used to capture the mailbox id/name | keyword | -| rsa.misc.match | This key is for regex match name from search.ini | keyword | -| rsa.misc.mbug_data | | keyword | -| rsa.misc.message_body | This key captures the The contents of the message body. | keyword | -| rsa.misc.misc | | keyword | -| rsa.misc.misc_name | | keyword | -| rsa.misc.mode | | keyword | -| rsa.misc.msgIdPart1 | | keyword | -| rsa.misc.msgIdPart2 | | keyword | -| rsa.misc.msgIdPart3 | | keyword | -| rsa.misc.msgIdPart4 | | keyword | -| rsa.misc.msg_type | | keyword | -| rsa.misc.msgid | | keyword | -| rsa.misc.name | | keyword | -| rsa.misc.netsessid | | keyword | -| rsa.misc.node | Common use case is the node name within a cluster. The cluster name is reflected by the host name. | keyword | -| rsa.misc.ntype | | keyword | -| rsa.misc.num | | keyword | -| rsa.misc.number | | keyword | -| rsa.misc.number1 | | keyword | -| rsa.misc.number2 | | keyword | -| rsa.misc.nwwn | | keyword | -| rsa.misc.obj_name | This is used to capture name of object | keyword | -| rsa.misc.obj_type | This is used to capture type of object | keyword | -| rsa.misc.object | | keyword | -| rsa.misc.observed_val | This key captures the Value observed (from the perspective of the device generating the log). | keyword | -| rsa.misc.operation | | keyword | -| rsa.misc.operation_id | An alert number or operation number. The values should be unique and non-repeating. | keyword | -| rsa.misc.opkt | | keyword | -| rsa.misc.orig_from | | keyword | -| rsa.misc.owner_id | | keyword | -| rsa.misc.p_action | | keyword | -| rsa.misc.p_filter | | keyword | -| rsa.misc.p_group_object | | keyword | -| rsa.misc.p_id | | keyword | -| rsa.misc.p_msgid | | keyword | -| rsa.misc.p_msgid1 | | keyword | -| rsa.misc.p_msgid2 | | keyword | -| rsa.misc.p_result1 | | keyword | -| rsa.misc.param | This key is the parameters passed as part of a command or application, etc. | keyword | -| rsa.misc.param_dst | This key captures the command line/launch argument of the target process or file | keyword | -| rsa.misc.param_src | This key captures source parameter | keyword | -| rsa.misc.parent_node | This key captures the Parent Node Name. Must be related to node variable. | keyword | -| rsa.misc.password_chg | | keyword | -| rsa.misc.password_expire | | keyword | -| rsa.misc.payload_dst | This key is used to capture destination payload | keyword | -| rsa.misc.payload_src | This key is used to capture source payload | keyword | -| rsa.misc.permgranted | | keyword | -| rsa.misc.permwanted | | keyword | -| rsa.misc.pgid | | keyword | -| rsa.misc.phone | | keyword | -| rsa.misc.pid | | keyword | -| rsa.misc.policy | | keyword | -| rsa.misc.policyUUID | | keyword | -| rsa.misc.policy_id | This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise | keyword | -| rsa.misc.policy_name | This key is used to capture the Policy Name only. | keyword | -| rsa.misc.policy_value | This key captures the contents of the policy. This contains details about the policy | keyword | -| rsa.misc.policy_waiver | | keyword | -| rsa.misc.pool_id | This key captures the identifier (typically numeric field) of a resource pool | keyword | -| rsa.misc.pool_name | This key captures the name of a resource pool | keyword | -| rsa.misc.port_name | This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). | keyword | -| rsa.misc.priority | | keyword | -| rsa.misc.process_id_val | This key is a failure key for Process ID when it is not an integer value | keyword | -| rsa.misc.prog_asp_num | | keyword | -| rsa.misc.program | | keyword | -| rsa.misc.real_data | | keyword | -| rsa.misc.reason | | keyword | -| rsa.misc.rec_asp_device | | keyword | -| rsa.misc.rec_asp_num | | keyword | -| rsa.misc.rec_library | | keyword | -| rsa.misc.recordnum | | keyword | -| rsa.misc.reference_id | This key is used to capture an event id from the session directly | keyword | -| rsa.misc.reference_id1 | This key is for Linked ID to be used as an addition to "reference.id" | keyword | -| rsa.misc.reference_id2 | This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. | keyword | -| rsa.misc.result | This key is used to capture the outcome/result string value of an action in a session. | keyword | -| rsa.misc.result_code | This key is used to capture the outcome/result numeric value of an action in a session | keyword | -| rsa.misc.risk | This key captures the non-numeric risk value | keyword | -| rsa.misc.risk_info | Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) | keyword | -| rsa.misc.risk_num | This key captures a Numeric Risk value | double | -| rsa.misc.risk_num_comm | This key captures Risk Number Community | double | -| rsa.misc.risk_num_next | This key captures Risk Number NextGen | double | -| rsa.misc.risk_num_sand | This key captures Risk Number SandBox | double | -| rsa.misc.risk_num_static | This key captures Risk Number Static | double | -| rsa.misc.risk_suspicious | Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) | keyword | -| rsa.misc.risk_warning | Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) | keyword | -| rsa.misc.ruid | | keyword | -| rsa.misc.rule | This key captures the Rule number | keyword | -| rsa.misc.rule_group | This key captures the Rule group name | keyword | -| rsa.misc.rule_name | This key captures the Rule Name | keyword | -| rsa.misc.rule_template | A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template | keyword | -| rsa.misc.rule_uid | This key is the Unique Identifier for a rule. | keyword | -| rsa.misc.sburb | | keyword | -| rsa.misc.sdomain_fld | | keyword | -| rsa.misc.search_text | This key captures the Search Text used | keyword | -| rsa.misc.sec | | keyword | -| rsa.misc.second | | keyword | -| rsa.misc.sensor | This key captures Name of the sensor. Typically used in IDS/IPS based devices | keyword | -| rsa.misc.sensorname | | keyword | -| rsa.misc.seqnum | | keyword | -| rsa.misc.serial_number | This key is the Serial number associated with a physical asset. | keyword | -| rsa.misc.session | | keyword | -| rsa.misc.sessiontype | | keyword | -| rsa.misc.severity | This key is used to capture the severity given the session | keyword | -| rsa.misc.sigUUID | | keyword | -| rsa.misc.sig_id | This key captures IDS/IPS Int Signature ID | long | -| rsa.misc.sig_id1 | This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id | long | -| rsa.misc.sig_id_str | This key captures a string object of the sigid variable. | keyword | -| rsa.misc.sig_name | This key is used to capture the Signature Name only. | keyword | -| rsa.misc.sigcat | | keyword | -| rsa.misc.snmp_oid | SNMP Object Identifier | keyword | -| rsa.misc.snmp_value | SNMP set request value | keyword | -| rsa.misc.space | | keyword | -| rsa.misc.space1 | | keyword | -| rsa.misc.spi | | keyword | -| rsa.misc.spi_dst | Destination SPI Index | keyword | -| rsa.misc.spi_src | Source SPI Index | keyword | -| rsa.misc.sql | This key captures the SQL query | keyword | -| rsa.misc.srcburb | | keyword | -| rsa.misc.srcdom | | keyword | -| rsa.misc.srcservice | | keyword | -| rsa.misc.state | | keyword | -| rsa.misc.status | | keyword | -| rsa.misc.status1 | | keyword | -| rsa.misc.streams | This key captures number of streams in session | long | -| rsa.misc.subcategory | | keyword | -| rsa.misc.svcno | | keyword | -| rsa.misc.system | | keyword | -| rsa.misc.tbdstr1 | | keyword | -| rsa.misc.tbdstr2 | | keyword | -| rsa.misc.tcp_flags | This key is captures the TCP flags set in any packet of session | long | -| rsa.misc.terminal | This key captures the Terminal Names only | keyword | -| rsa.misc.tgtdom | | keyword | -| rsa.misc.tgtdomain | | keyword | -| rsa.misc.threshold | | keyword | -| rsa.misc.tos | This key describes the type of service | long | -| rsa.misc.trigger_desc | This key captures the Description of the trigger or threshold condition. | keyword | -| rsa.misc.trigger_val | This key captures the Value of the trigger or threshold condition. | keyword | -| rsa.misc.type | | keyword | -| rsa.misc.type1 | | keyword | -| rsa.misc.udb_class | | keyword | -| rsa.misc.url_fld | | keyword | -| rsa.misc.user_div | | keyword | -| rsa.misc.userid | | keyword | -| rsa.misc.username_fld | | keyword | -| rsa.misc.utcstamp | | keyword | -| rsa.misc.v_instafname | | keyword | -| rsa.misc.version | This key captures Version of the application or OS which is generating the event. | keyword | -| rsa.misc.virt_data | | keyword | -| rsa.misc.virusname | This key captures the name of the virus | keyword | -| rsa.misc.vm_target | VMWare Target **VMWARE** only varaible. | keyword | -| rsa.misc.vpnid | | keyword | -| rsa.misc.vsys | This key captures Virtual System Name | keyword | -| rsa.misc.vuln_ref | This key captures the Vulnerability Reference details | keyword | -| rsa.misc.workspace | This key captures Workspace Description | keyword | -| rsa.network.ad_computer_dst | Deprecated, use host.dst | keyword | -| rsa.network.addr | | keyword | -| rsa.network.alias_host | This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. | keyword | -| rsa.network.dinterface | This key should only be used when it’s a Destination Interface | keyword | -| rsa.network.dmask | This key is used for Destionation Device network mask | keyword | -| rsa.network.dns_a_record | | keyword | -| rsa.network.dns_cname_record | | keyword | -| rsa.network.dns_id | | keyword | -| rsa.network.dns_opcode | | keyword | -| rsa.network.dns_ptr_record | | keyword | -| rsa.network.dns_resp | | keyword | -| rsa.network.dns_type | | keyword | -| rsa.network.domain | | keyword | -| rsa.network.domain1 | | keyword | -| rsa.network.eth_host | Deprecated, use alias.mac | keyword | -| rsa.network.eth_type | This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only | long | -| rsa.network.faddr | | keyword | -| rsa.network.fhost | | keyword | -| rsa.network.fport | | keyword | -| rsa.network.gateway | This key is used to capture the IP Address of the gateway | keyword | -| rsa.network.host_dst | This key should only be used when it’s a Destination Hostname | keyword | -| rsa.network.host_orig | This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. | keyword | -| rsa.network.host_type | | keyword | -| rsa.network.icmp_code | This key is used to capture the ICMP code only | long | -| rsa.network.icmp_type | This key is used to capture the ICMP type only | long | -| rsa.network.interface | This key should be used when the source or destination context of an interface is not clear | keyword | -| rsa.network.ip_proto | This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI | long | -| rsa.network.laddr | | keyword | -| rsa.network.lhost | | keyword | -| rsa.network.linterface | | keyword | -| rsa.network.mask | This key is used to capture the device network IPmask. | keyword | -| rsa.network.netname | This key is used to capture the network name associated with an IP range. This is configured by the end user. | keyword | -| rsa.network.network_port | Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) | long | -| rsa.network.network_service | This is used to capture layer 7 protocols/service names | keyword | -| rsa.network.origin | | keyword | -| rsa.network.packet_length | | keyword | -| rsa.network.paddr | Deprecated | ip | -| rsa.network.phost | | keyword | -| rsa.network.port | This key should only be used to capture a Network Port when the directionality is not clear | long | -| rsa.network.protocol_detail | This key should be used to capture additional protocol information | keyword | -| rsa.network.remote_domain_id | | keyword | -| rsa.network.rpayload | This key is used to capture the total number of payload bytes seen in the retransmitted packets. | keyword | -| rsa.network.sinterface | This key should only be used when it’s a Source Interface | keyword | -| rsa.network.smask | This key is used for capturing source Network Mask | keyword | -| rsa.network.vlan | This key should only be used to capture the ID of the Virtual LAN | long | -| rsa.network.vlan_name | This key should only be used to capture the name of the Virtual LAN | keyword | -| rsa.network.zone | This key should be used when the source or destination context of a Zone is not clear | keyword | -| rsa.network.zone_dst | This key should only be used when it’s a Destination Zone. | keyword | -| rsa.network.zone_src | This key should only be used when it’s a Source Zone. | keyword | -| rsa.physical.org_dst | This is used to capture the destination organization based on the GEOPIP Maxmind database. | keyword | -| rsa.physical.org_src | This is used to capture the source organization based on the GEOPIP Maxmind database. | keyword | -| rsa.storage.disk_volume | A unique name assigned to logical units (volumes) within a physical disk | keyword | -| rsa.storage.lun | Logical Unit Number.This key is a very useful concept in Storage. | keyword | -| rsa.storage.pwwn | This uniquely identifies a port on a HBA. | keyword | -| rsa.threat.alert | This key is used to capture name of the alert | keyword | -| rsa.threat.threat_category | This key captures Threat Name/Threat Category/Categorization of alert | keyword | -| rsa.threat.threat_desc | This key is used to capture the threat description from the session directly or inferred | keyword | -| rsa.threat.threat_source | This key is used to capture source of the threat | keyword | -| rsa.time.date | | keyword | -| rsa.time.datetime | | keyword | -| rsa.time.day | | keyword | -| rsa.time.duration_str | A text string version of the duration | keyword | -| rsa.time.duration_time | This key is used to capture the normalized duration/lifetime in seconds. | double | -| rsa.time.effective_time | This key is the effective time referenced by an individual event in a Standard Timestamp format | date | -| rsa.time.endtime | This key is used to capture the End time mentioned in a session in a standard form | date | -| rsa.time.event_queue_time | This key is the Time that the event was queued. | date | -| rsa.time.event_time | This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form | date | -| rsa.time.event_time_str | This key is used to capture the incomplete time mentioned in a session as a string | keyword | -| rsa.time.eventtime | | keyword | -| rsa.time.expire_time | This key is the timestamp that explicitly refers to an expiration. | date | -| rsa.time.expire_time_str | This key is used to capture incomplete timestamp that explicitly refers to an expiration. | keyword | -| rsa.time.gmtdate | | keyword | -| rsa.time.gmttime | | keyword | -| rsa.time.hour | | keyword | -| rsa.time.min | | keyword | -| rsa.time.month | | keyword | -| rsa.time.p_date | | keyword | -| rsa.time.p_month | | keyword | -| rsa.time.p_time | | keyword | -| rsa.time.p_time1 | | keyword | -| rsa.time.p_time2 | | keyword | -| rsa.time.p_year | | keyword | -| rsa.time.process_time | Deprecated, use duration.time | keyword | -| rsa.time.recorded_time | The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. | date | -| rsa.time.stamp | Deprecated key defined only in table map. | date | -| rsa.time.starttime | This key is used to capture the Start time mentioned in a session in a standard form | date | -| rsa.time.timestamp | | keyword | -| rsa.time.timezone | This key is used to capture the timezone of the Event Time | keyword | -| rsa.time.tzone | | keyword | -| rsa.time.year | | keyword | -| rsa.web.alias_host | | keyword | -| rsa.web.cn_asn_dst | | keyword | -| rsa.web.cn_rpackets | | keyword | -| rsa.web.fqdn | Fully Qualified Domain Names | keyword | -| rsa.web.p_url | | keyword | -| rsa.web.p_user_agent | | keyword | -| rsa.web.p_web_cookie | | keyword | -| rsa.web.p_web_method | | keyword | -| rsa.web.p_web_referer | | keyword | -| rsa.web.remote_domain | | keyword | -| rsa.web.reputation_num | Reputation Number of an entity. Typically used for Web Domains | double | -| rsa.web.urlpage | | keyword | -| rsa.web.urlroot | | keyword | -| rsa.web.web_cookie | This key is used to capture the Web cookies specifically. | keyword | -| rsa.web.web_extension_tmp | | keyword | -| rsa.web.web_page | | keyword | -| rsa.web.web_ref_domain | Web referer's domain | keyword | -| rsa.web.web_ref_page | This key captures Web referer's page information | keyword | -| rsa.web.web_ref_query | This key captures Web referer's query portion of the URL | keyword | -| rsa.web.web_ref_root | Web referer's root URL path | keyword | -| rsa.wireless.access_point | This key is used to capture the access point name. | keyword | -| rsa.wireless.wlan_channel | This is used to capture the channel names | long | -| rsa.wireless.wlan_name | This key captures either WLAN number/name | keyword | -| rsa.wireless.wlan_ssid | This key is used to capture the ssid of a Wireless Session | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| server.domain | Server domain. | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | Source domain. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location.lat | | double | -| source.geo.location.lon | | double | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | keyword | -| url.path | Path of the request, such as "/search". | keyword | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | - diff --git a/packages/zscaler/0.5.1/img/logo.svg b/packages/zscaler/0.5.1/img/logo.svg deleted file mode 100755 index b8a21a2fa6..0000000000 --- a/packages/zscaler/0.5.1/img/logo.svg +++ /dev/null @@ -1 +0,0 @@ -Zscaler-Logo-TM-Blue-RGB-May2019 \ No newline at end of file diff --git a/packages/zscaler/0.5.1/manifest.yml b/packages/zscaler/0.5.1/manifest.yml deleted file mode 100755 index 14247824f9..0000000000 --- a/packages/zscaler/0.5.1/manifest.yml +++ /dev/null @@ -1,32 +0,0 @@ -format_version: 1.0.0 -name: zscaler -title: Zscaler NSS Logs -version: 0.5.1 -description: Deprecated. Use the Zscaler ZIA integration instead. -categories: ["network", "security"] -release: experimental -license: basic -type: integration -conditions: - kibana.version: "^7.14.1" -policy_templates: - - name: zia - title: Zscaler NSS - description: Collect Zscaler NSS logs from syslog or a file. - inputs: - - type: udp - title: Collect logs from Zscaler NSS via UDP - description: Collecting syslog from Zscaler NSS via UDP - - type: tcp - title: Collect logs from Zscaler NSS via TCP - description: Collecting syslog from Zscaler NSS via TCP - - type: logfile - title: Collect logs from Zscaler NSS via file - description: Collecting syslog from Zscaler NSS via file. -icons: - - src: /img/logo.svg - title: Zscaler NSS logo - size: 32x32 - type: image/svg+xml -owner: - github: elastic/security-external-integrations diff --git a/packages/zscaler_zia/0.1.0/changelog.yml b/packages/zscaler_zia/0.1.0/changelog.yml deleted file mode 100755 index 3ecf65eb1b..0000000000 --- a/packages/zscaler_zia/0.1.0/changelog.yml +++ /dev/null @@ -1,6 +0,0 @@ -# newer versions go on top -- version: "0.1.0" - changes: - - description: Initial draft of the package - type: enhancement - link: https://github.com/elastic/integrations/pull/2459 diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs deleted file mode 100755 index 49e3770cb1..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,23 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -processors: -- drop_event: - when: - equals: - message: "" -{{#if processors}} -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 8f9acf997c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -description: Pipeline for Zscaler alert logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - grok: - field: event.original - patterns: - - <%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:_tmp.timestamp} \[%{IPORHOST:destination.address}\] %{GREEDYDATA:message} - - grok: - field: message - patterns: - - 'ZscalerNSS: Zscaler cloud configuration connection to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes:double} minutes' - - 'ZscalerNSS: SIEM Feed connection "%{GREEDYDATA:zscaler_zia.alerts.log_feed_name}" to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes:double} minutes' - ignore_failure: true - - convert: - field: destination.address - target_field: destination.ip - type: ip - ignore_failure: true - - append: - field: related.ip - value: "{{{destination.ip}}}" - if: ctx?.destination?.ip != null - ignore_failure: true - - date: - field: _tmp.timestamp - target_field: '@timestamp' - ignore_failure: true - formats: - - MMM d HH:mm:ss - - MMM dd HH:mm:ss - - MMM d HH:mm:ss - - ISO8601 - - remove: - field: - - _tmp - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml deleted file mode 100755 index bddad62cfe..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.alerts diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml deleted file mode 100755 index 94ad86350f..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml +++ /dev/null @@ -1,33 +0,0 @@ -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Port of the destination. - name: destination.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml deleted file mode 100755 index 38608a7891..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml +++ /dev/null @@ -1,14 +0,0 @@ -- name: zscaler_zia.alerts - type: group - fields: - - name: connection_lost_minutes - type: double - description: | - Amount of time after loosing connection to a server in Minutes. - - name: log_feed_name - type: keyword - description: | - Name of the NSS log feed. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml deleted file mode 100755 index 1bd14b8c53..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Alerts -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Alerts - description: Collect Zscaler Internet Access Alerts using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9010 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-alerts - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json deleted file mode 100755 index 0749ca369a..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json +++ /dev/null @@ -1,61 +0,0 @@ -{ - "@timestamp": "2022-12-10T13:40:32.000Z", - "agent": { - "ephemeral_id": "8c093fcf-fb2f-4baa-b794-40edb011194d", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.alerts", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "81.2.69.193", - "ip": "81.2.69.193", - "port": 9012 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "dataset": "zscaler_zia.alerts", - "ingested": "2022-02-04T06:31:25Z" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:32902" - }, - "syslog": { - "priority": 114 - } - }, - "message": "ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes", - "related": { - "ip": [ - "81.2.69.193" - ] - }, - "tags": [ - "forwarded", - "zscaler_zia-alerts" - ], - "zscaler_zia": { - "alerts": { - "connection_lost_minutes": 2440, - "log_feed_name": "DNS Logs Feed" - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index cbad42a808..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,209 +0,0 @@ ---- -description: Pipeline for Zscaler dns logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - date: - field: json.datetime - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.datetime - ignore_missing: true - - set: - field: event.category - value: network - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - rename: - field: json.clt_sip - target_field: client.ip - ignore_missing: true - - geoip: - field: client.ip - target_field: client.geo - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: client.ip - target_field: client.as - properties: - - asn - - organization_name - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.dns_resp - target_field: dns.answers.name - ignore_missing: true - - rename: - field: json.dns_req - target_field: dns.question.name - ignore_missing: true - - rename: - field: json.dns_reqtype - target_field: dns.question.type - ignore_missing: true - - rename: - field: json.srv_dip - target_field: server.ip - ignore_missing: true - - geoip: - field: server.ip - target_field: server.geo - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: server.ip - target_field: server.as - properties: - - asn - - organization_name - ignore_missing: true - - append: - field: related.ip - value: "{{{server.ip}}}" - if: ctx?.server?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: json.srv_dport - target_field: server.port - type: long - ignore_failure: true - - remove: - field: json.srv_dport - ignore_missing: true - - urldecode: - field: json.user - target_field: user.email - ignore_missing: true - - remove: - field: json.user - ignore_missing: true - - rename: - field: json.deviceowner - target_field: user.name - ignore_missing: true - - urldecode: - field: json.department - target_field: zscaler_zia.dns.department - ignore_missing: true - - remove: - field: json.department - ignore_missing: true - - urldecode: - field: json.location - target_field: zscaler_zia.dns.location - ignore_missing: true - - remove: - field: json.location - ignore_missing: true - - rename: - field: json.reqaction - target_field: zscaler_zia.dns.request.action - ignore_missing: true - - rename: - field: json.resaction - target_field: zscaler_zia.dns.response.action - ignore_missing: true - - urldecode: - field: json.reqrulelabel - target_field: zscaler_zia.dns.request.rule.label - ignore_missing: true - - remove: - field: json.reqrulelabel - ignore_missing: true - - urldecode: - field: json.resrulelabel - target_field: zscaler_zia.dns.response.rule.label - ignore_missing: true - - remove: - field: json.resrulelabel - ignore_missing: true - - convert: - field: json.durationms - target_field: zscaler_zia.dns.duration.milliseconds - type: long - ignore_failure: true - - remove: - field: json.durationms - ignore_missing: true - - rename: - field: json.category - target_field: zscaler_zia.dns.dom.category - ignore_missing: true - - rename: - field: json.devicehostname - target_field: zscaler_zia.dns.hostname - ignore_missing: true - - append: - field: related.hosts - value: "{{{zscaler_zia.dns.hostname}}}" - if: ctx?.zscaler_zia?.dns?.hostname != null - allow_duplicates: false - ignore_failure: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.dns - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.dns[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_failure: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml deleted file mode 100755 index cc2e29669e..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.dns diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml deleted file mode 100755 index 85de65a321..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml +++ /dev/null @@ -1,98 +0,0 @@ -- description: City name. - name: client.geo.city_name - type: keyword -- description: Name of the continent. - name: client.geo.continent_name - type: keyword -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Country name. - name: client.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: client.geo.location - type: geo_point -- description: Region ISO code. - name: client.geo.region_iso_code - type: keyword -- description: Region name. - name: client.geo.region_name - type: keyword -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: |- - The name being queried. - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - name: dns.question.name - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: City name. - name: server.geo.city_name - type: keyword -- description: Name of the continent. - name: server.geo.continent_name - type: keyword -- description: Country ISO code. - name: server.geo.country_iso_code - type: keyword -- description: Country name. - name: server.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: server.geo.location - type: geo_point -- description: Region ISO code. - name: server.geo.region_iso_code - type: keyword -- description: Region name. - name: server.geo.region_name - type: keyword -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: Port of the server. - name: server.port - type: long -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml deleted file mode 100755 index ae183b145c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml +++ /dev/null @@ -1,48 +0,0 @@ -- name: zscaler_zia.dns - type: group - fields: - - name: department - type: keyword - description: | - Department of the user. - - name: dom.category - type: keyword - description: | - URL Category of the FQDN in the DNS request. - - name: duration.milliseconds - type: long - description: | - Duration of the DNS request in milliseconds. - - name: hostname - type: keyword - description: | - N/A - - name: location - type: keyword - description: | - Gateway location or sub-location of the source. - - name: request - type: group - fields: - - name: action - type: keyword - description: | - Name of the action that was applied to the DNS request. - - name: rule.label - type: keyword - description: | - Name of the rule that was applied to the DNS request. - - name: response - type: group - fields: - - name: action - type: keyword - description: | - Name of the action that was applied to the DNS response. - - name: rule.label - type: keyword - description: |- - Name of the rule that was applied to the DNS response. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml deleted file mode 100755 index a47e838e8c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: DNS logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access DNS Logs - description: Collect Zscaler Internet Access DNS logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9011 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-dns - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json deleted file mode 100755 index 86b91a6988..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json +++ /dev/null @@ -1,124 +0,0 @@ -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "d288c261-b8db-45af-99c0-a673c3c6d8e1", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.193" - }, - "data_stream": { - "dataset": "zscaler_zia.dns", - "namespace": "ep", - "type": "logs" - }, - "dns": { - "answers": { - "name": "Some response string" - }, - "question": { - "name": "example.com", - "type": "Some type" - } - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.dns", - "ingested": "2022-02-04T06:32:56Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:54202" - } - }, - "related": { - "hosts": [ - "Machine9000" - ], - "ip": [ - "81.2.69.193", - "81.2.69.144" - ] - }, - "server": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 8080 - }, - "tags": [ - "forwarded", - "zscaler_zia-dns" - ], - "user": { - "email": "some_user@example.com", - "name": "Owner77" - }, - "zscaler_zia": { - "dns": { - "department": "Unknown", - "dom": { - "category": "Professional Services" - }, - "duration": { - "milliseconds": 123456 - }, - "hostname": "Machine9000", - "location": "TestLoc DB", - "request": { - "action": "REQ_ALLOW", - "rule": { - "label": "Access Blocked" - } - }, - "response": { - "action": "Some Response Action", - "rule": { - "label": "None" - } - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index f27a8cfea0..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,270 +0,0 @@ ---- -description: Pipeline for Zscaler firewall logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - set: - field: event.category - value: network - - set: - field: event.kind - value: event - - set: - field: event.type - value: info - - date: - field: json.datetime - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.datetime - ignore_failure: true - - rename: - field: json.outbytes - target_field: client.bytes - ignore_missing: true - - rename: - field: json.devicehostname - target_field: host.hostname - ignore_missing: true - - rename: - field: json.nwapp - target_field: network.application - ignore_missing: true - - rename: - field: json.nwsvc - target_field: network.protocol - ignore_missing: true - - lowercase: - field: network.protocol - ignore_missing: true - - rename: - field: json.proto - target_field: network.transport - ignore_missing: true - - lowercase: - field: network.transport - ignore_missing: true - - append: - field: rule.name - value: "{{{json.rulelabel}}}" - if: ctx?.json?.rulelabel != null - allow_duplicates: false - - append: - field: rule.name - value: "{{{json.ipsrulelabel}}}" - if: ctx?.json?.ipsrulelabel != null - allow_duplicates: false - - urldecode: - field: rule.name - ignore_failure: true - - remove: - field: json.rulelabel - ignore_missing: true - - remove: - field: json.ipsrulelabel - ignore_missing: true - - rename: - field: json.inbytes - target_field: server.bytes - ignore_missing: true - - rename: - field: json.destcountry - target_field: server.geo.country_name - ignore_missing: true - - urldecode: - field: json.user - target_field: user.email - ignore_missing: true - - remove: - field: json.user - ignore_missing: true - - rename: - field: json.deviceowner - target_field: user.name - ignore_missing: true - - urldecode: - field: json.department - target_field: zscaler_zia.firewall.department - ignore_missing: true - - remove: - field: json.department - ignore_missing: true - - urldecode: - field: json.locationname - target_field: zscaler_zia.firewall.location.name - ignore_missing: true - - remove: - field: json.locationname - ignore_missing: true - - rename: - field: json.cdport - target_field: zscaler_zia.firewall.client.destination.port - ignore_missing: true - - rename: - field: json.csport - target_field: zscaler_zia.firewall.client.source.port - ignore_missing: true - - rename: - field: json.sdport - target_field: zscaler_zia.firewall.server.destination.port - ignore_missing: true - - rename: - field: json.ssport - target_field: zscaler_zia.firewall.server.source.port - ignore_missing: true - - append: - field: related.ip - value: "{{{json.csip}}}" - if: ctx?.json?.csip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.csip - target_field: zscaler_zia.firewall.client.source.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.cdip}}}" - if: ctx?.json?.cdip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.cdip - target_field: zscaler_zia.firewall.client.destination.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.ssip}}}" - if: ctx?.json?.ssip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ssip - target_field: zscaler_zia.firewall.server.source.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.sdip}}}" - if: ctx?.json?.sdip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.sdip - target_field: zscaler_zia.firewall.server.destination.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.tsip}}}" - if: ctx?.json?.tsip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.tsip - target_field: zscaler_zia.firewall.tunnel.ip - ignore_missing: true - - rename: - field: json.tunsport - target_field: zscaler_zia.firewall.tunnel.port - ignore_missing: true - - rename: - field: json.tuntype - target_field: zscaler_zia.firewall.tunnel.type - ignore_missing: true - - rename: - field: json.action - target_field: event.action - ignore_missing: true - - lowercase: - field: event.action - ignore_missing: true - - rename: - field: json.dnat - target_field: zscaler_zia.firewall.nat - ignore_missing: true - - rename: - field: json.stateful - target_field: zscaler_zia.firewall.stateful - ignore_missing: true - - rename: - field: json.aggregate - target_field: zscaler_zia.firewall.aggregate - ignore_missing: true - - rename: - field: json.ipcat - target_field: zscaler_zia.firewall.ip_category - ignore_missing: true - - rename: - field: json.avgduration - target_field: zscaler_zia.firewall.duration.avg - ignore_missing: true - - rename: - field: json.duration - target_field: zscaler_zia.firewall.duration.seconds - ignore_missing: true - - rename: - field: json.durationms - target_field: zscaler_zia.firewall.duration.milliseconds - ignore_missing: true - - rename: - field: json.numsessions - target_field: zscaler_zia.firewall.session.count - ignore_missing: true - - rename: - field: json.threatcat - target_field: zscaler_zia.firewall.threat.category - ignore_missing: true - - rename: - field: json.threatname - target_field: zscaler_zia.firewall.threat.name - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.firewall - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.firewall[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml deleted file mode 100755 index b5aac8833c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.firewall diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml deleted file mode 100755 index d8626d9fa5..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml +++ /dev/null @@ -1,55 +0,0 @@ -- description: Bytes sent from the client to the server. - name: client.bytes - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: Bytes sent from the server to the client. - name: server.bytes - type: long -- description: Country name. - name: server.geo.country_name - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml deleted file mode 100755 index c8b4137da0..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml +++ /dev/null @@ -1,127 +0,0 @@ -- name: zscaler_zia.firewall - type: group - fields: - - name: department - type: keyword - description: | - Department of the user. - - name: location - type: group - fields: - - name: name - type: keyword - description: | - Name of the location from which the session was initiated. - - name: client - type: group - fields: - - name: destination - type: group - fields: - - name: port - type: double - description: | - Client destination port. For aggregated sessions, this is the client destination port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Client destination IP address. For aggregated sessions, this is the client destination IP address of the last session in the aggregate. - - name: source - type: group - fields: - - name: port - type: double - description: | - Client source port. For aggregated sessions, this is the client source port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Client source IP address. For aggregated sessions, this is the client source IP address of the last session in the aggregate. - - name: server - type: group - fields: - - name: destination - type: group - fields: - - name: port - type: double - description: | - Server destination port. For aggregated sessions, this is the server destination port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Server Destination IP address. For aggregated sessions, this is the server destination IP address of the last session in the aggregate. - - name: source - type: group - fields: - - name: port - type: double - description: | - Server source port. For aggregated sessions, this is the server source port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Server source IP address. For aggregated sessions, this is the server source IP address of the last session in the aggregate. - - name: tunnel - type: group - fields: - - name: ip - type: keyword - description: | - Tunnel IP address of the client (source). For aggregated sessions, this is the client's tunnel IP address corresponding to the last session in the aggregate. - - name: port - type: double - description: | - Tunnel port on the client side. For aggregated sessions, this is the client's tunnel port corresponding to the last session in the aggregate. - - name: type - type: keyword - description: | - Traffic forwarding method used to send the traffic to the firewall. - - name: nat - type: keyword - description: | - Indicates if the destination NAT policy was applied. - - name: stateful - type: keyword - - name: aggregate - type: keyword - - name: ip_category - type: keyword - description: | - URL category that corresponds to the server IP address. - - name: duration - type: group - fields: - - name: avg - type: double - description: | - Average session duration, in milliseconds, if the sessions were aggregated. - - name: seconds - type: double - description: | - Session or request duration in seconds. - - name: milliseconds - type: double - description: | - Session or request duration in milliseconds. - - name: session - type: group - fields: - - name: count - type: double - description: | - Number of sessions that were aggregated. - - name: threat - type: group - fields: - - name: category - type: keyword - description: | - Category of the threat in the Firewall session by the IPS engine. - - name: name - type: keyword - description: | - Name of the threat detected in the Firewall session by the IPS engine. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml deleted file mode 100755 index 6da5481a66..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Firewall Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Firewall Logs - description: Collect Zscaler Internet Access Firewall Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9012 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-firewall - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json deleted file mode 100755 index d5914ddf13..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json +++ /dev/null @@ -1,127 +0,0 @@ -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "41987f90-74dc-4b4b-9936-4347028cf558", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "bytes": 1734 - }, - "data_stream": { - "dataset": "zscaler_zia.firewall", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "drop", - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.firewall", - "ingested": "2022-02-04T06:34:17Z", - "kind": "event", - "original": "{ \"sourcetype\" : \"zscalernss-fw\", \"event\" :{\"datetime\":\"Fri Dec 17 07:27:54 2021\",\"user\":\"some_user@example.com\",\"department\":\"Unknown\",\"locationname\":\"TestLoc%20DB\",\"cdport\":443,\"csport\":55018,\"sdport\":443,\"ssport\":0,\"csip\":\"0.0.0.0\",\"cdip\":\"0.0.0.0\",\"ssip\":\"0.0.0.0\",\"sdip\":\"0.0.0.0\",\"tsip\":\"0.0.0.0\",\"tunsport\":0,\"tuntype\":\"ZscalerClientConnector\",\"action\":\"Drop\",\"dnat\":\"No\",\"stateful\":\"Yes\",\"aggregate\":\"No\",\"nwsvc\":\"HTTPS\",\"nwapp\":\"http\",\"proto\":\"TCP\",\"ipcat\":\"Test Name\",\"destcountry\":\"Ireland\",\"avgduration\":486,\"rulelabel\":\"Access%20Blocked\",\"inbytes\":19052,\"outbytes\":1734,\"duration\":0,\"durationms\":486,\"numsessions\":1,\"ipsrulelabel\":\"None\",\"threatcat\":\"None\",\"threatname\":\"None\",\"deviceowner\":\"admin77\",\"devicehostname\":\"Machine9000\"}}", - "type": "info" - }, - "host": { - "hostname": "Machine9000" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:58194" - } - }, - "network": { - "application": "http", - "protocol": "https", - "transport": "tcp" - }, - "related": { - "ip": [ - "0.0.0.0" - ] - }, - "rule": { - "name": [ - "Access Blocked", - "None" - ] - }, - "server": { - "bytes": 19052, - "geo": { - "country_name": "Ireland" - } - }, - "tags": [ - "forwarded", - "zscaler_zia-firewall" - ], - "user": { - "email": "some_user@example.com", - "name": "admin77" - }, - "zscaler_zia": { - "firewall": { - "aggregate": "No", - "client": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 55018 - } - }, - "department": "Unknown", - "duration": { - "avg": 486, - "milliseconds": 486, - "seconds": 0 - }, - "ip_category": "Test Name", - "location": { - "name": "TestLoc DB" - }, - "nat": "No", - "server": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 0 - } - }, - "session": { - "count": 1 - }, - "stateful": "Yes", - "threat": { - "category": "None", - "name": "None" - }, - "tunnel": { - "ip": "0.0.0.0", - "port": 0, - "type": "ZscalerClientConnector" - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index a62b7ab78e..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,292 +0,0 @@ ---- -description: Pipeline for Zscaler tunnel logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - date: - field: json.datetime - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.datetime - ignore_missing: true - - set: - field: event.category - value: network - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - rename: - field: json.recordid - target_field: event.id - ignore_missing: true - - rename: - field: json.event - target_field: event.action - ignore_missing: true - - rename: - field: json.eventreason - target_field: event.reason - ignore_missing: true - - rename: - field: json.destinationip - target_field: destination.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{destination.ip}}}" - if: ctx?.destination?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: json.destinationport - target_field: destination.port - type: long - ignore_missing: true - - remove: - field: json.destinationport - ignore_missing: true - - rename: - field: json.sourceip - target_field: source.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{source.ip}}}" - if: ctx?.source?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: json.sourceport - target_field: source.port - type: long - ignore_missing: true - - remove: - field: json.sourceport - ignore_missing: true - - urldecode: - field: json.user - target_field: user.name - ignore_missing: true - - remove: - field: json.user - ignore_missing: true - - append: - field: related.user - value: "{{{user.name}}}" - if: ctx?.user?.name != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.rxbytes - target_field: destination.bytes - ignore_missing: true - - rename: - field: json.rxpackets - target_field: destination.packets - ignore_missing: true - - rename: - field: json.txbytes - target_field: source.bytes - ignore_missing: true - - rename: - field: json.txpackets - target_field: source.packets - ignore_missing: true - - rename: - field: json.Recordtype - target_field: zscaler_zia.tunnel.action.type - ignore_missing: true - - urldecode: - field: json.location - target_field: zscaler_zia.tunnel.location.name - ignore_missing: true - - remove: - field: json.location - ignore_missing: true - - convert: - field: json.lifetime - target_field: zscaler_zia.tunnel.life.time - type: long - ignore_missing: true - - remove: - field: json.lifetime - ignore_missing: true - - convert: - field: json.ikeversion - target_field: zscaler_zia.tunnel.ike.version - type: integer - ignore_missing: true - - remove: - field: json.ikeversion - ignore_missing: true - - rename: - field: json.spi_in - target_field: zscaler_zia.tunnel.spi_in - ignore_missing: true - - rename: - field: json.spi_out - target_field: zscaler_zia.tunnel.spi_out - ignore_missing: true - - rename: - field: json.algo - target_field: zscaler_zia.tunnel.encryption.algorithm - ignore_missing: true - - rename: - field: json.authentication - target_field: zscaler_zia.tunnel.authentication.algorithm - ignore_missing: true - - rename: - field: json.authtype - target_field: zscaler_zia.tunnel.authentication.type - ignore_missing: true - - rename: - field: json.tunneltype - target_field: zscaler_zia.tunnel.type - ignore_missing: true - - rename: - field: json.vendorname - target_field: zscaler_zia.tunnel.vendor.name - ignore_missing: true - - convert: - field: json.sourceportstart - target_field: zscaler_zia.tunnel.source.start.port - type: long - ignore_missing: true - - remove: - field: json.sourceportstart - ignore_missing: true - - convert: - field: json.destinationportstart - target_field: zscaler_zia.tunnel.destination.start.port - type: long - ignore_missing: true - - remove: - field: json.destinationportstart - ignore_missing: true - - rename: - field: json.srcipstart - target_field: zscaler_zia.tunnel.source.start.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.source.start.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.source?.start?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.srcipend - target_field: zscaler_zia.tunnel.source.end.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.source.end.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.source?.end?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.destinationipstart - target_field: zscaler_zia.tunnel.destination.start.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.destination.start.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.destination?.start?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.destinationipend - target_field: zscaler_zia.tunnel.destination.end.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.destination.end.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.destination?.end?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.spi - target_field: zscaler_zia.tunnel.spi - ignore_missing: true - - rename: - field: json.protocol - target_field: zscaler_zia.tunnel.policy.protocol - ignore_missing: true - - rename: - field: json.tunnelprotocol - target_field: zscaler_zia.tunnel.protocol - ignore_missing: true - - rename: - field: json.policydirection - target_field: zscaler_zia.tunnel.policy.direction - ignore_missing: true - - convert: - field: json.lifebytes - target_field: zscaler_zia.tunnel.life.bytes - type: long - ignore_missing: true - - remove: - field: json.lifebytes - ignore_missing: true - - rename: - field: json.dpdrec - target_field: zscaler_zia.tunnel.dpd_packets - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.tunnel - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.tunnel[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml deleted file mode 100755 index 14fc7f2ee9..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.tunnel diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml deleted file mode 100755 index f8e16301c4..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml +++ /dev/null @@ -1,54 +0,0 @@ -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Packets sent from the destination to the source. - name: destination.packets - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Reason why this event happened, according to the source. - This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - name: event.reason - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml deleted file mode 100755 index a0a7e50774..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml +++ /dev/null @@ -1,113 +0,0 @@ -- name: zscaler_zia.tunnel - type: group - fields: - - name: action.type - type: keyword - description: | - Type of the record. Possible values [ WL_TUNNEL_IPSECPHASE1, WL_TUNNEL_IPSECPHASE2, WL_TUNNEL_EVENT, WL_TUNNEL_SAMPLES ]. - - name: authentication - type: group - fields: - - name: algorithm - type: keyword - description: | - Authentication algorithm. - - name: type - type: keyword - description: | - Authentication type. - - name: destination.end.ip - type: keyword - description: | - Phase 2 policy proposal - Destination IP end. - - name: destination.start - type: group - fields: - - name: ip - type: keyword - description: | - Phase 2 policy proposal - Destination IP start. - - name: port - type: long - description: | - Phase 2 policy proposal - Destination port end. - - name: dpd_packets - type: keyword - description: | - Number of DPD packets received in 60-second sample window. - - name: encryption.algorithm - type: keyword - description: | - Encryption algorithm. - - name: ike.version - type: long - description: | - IKE version (1 or 2). - - name: life - type: group - fields: - - name: bytes - type: long - description: | - Life bytes (number of traffic to be transacted through tunnel before renegotiation). - - name: time - type: long - description: | - Lifetime of IKE Phase 1/2 in seconds. - - name: location.name - type: keyword - description: | - Location name. - - name: policy - type: group - fields: - - name: direction - type: keyword - description: | - N/A - - name: protocol - type: keyword - description: | - Phase 2 policy proposal - Protocol. - - name: protocol - type: keyword - description: | - IPSec tunnel protocol type (Zscaler only supports ESP). - - name: source.end.ip - type: keyword - description: | - Phase 2 policy proposal - Source IP end. - - name: source.start - type: group - fields: - - name: ip - type: keyword - description: | - Phase 2 policy proposal - Source IP start. - - name: port - type: long - description: | - Phase 2 policy proposal - Source port start. - - name: spi - type: keyword - description: | - Security Parameter Index. - - name: spi_in - type: keyword - description: | - Initiator cookie. - - name: spi_out - type: keyword - description: | - Responder cookie. - - name: type - type: keyword - description: | - Tunnel type. - - name: vendor.name - type: keyword - description: |- - Vendor name of the edge device. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml deleted file mode 100755 index 477b606f29..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Tunnel Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Tunnel Logs - description: Collect Zscaler Internet Access Tunnel Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9013 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-tunnel - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json deleted file mode 100755 index eebfed78d8..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json +++ /dev/null @@ -1,115 +0,0 @@ -{ - "@timestamp": "2021-12-30T11:20:12.000Z", - "agent": { - "ephemeral_id": "63ac98b6-0ff6-4943-820e-8505eff15937", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.tunnel", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "81.2.69.143" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.tunnel", - "id": "1111111111111111111", - "ingested": "2022-02-04T06:36:16Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:44374" - } - }, - "related": { - "ip": [ - "81.2.69.143", - "81.2.69.145" - ], - "user": [ - "81.2.69.145" - ] - }, - "source": { - "ip": "81.2.69.145", - "port": 0 - }, - "tags": [ - "forwarded", - "zscaler_zia-tunnel" - ], - "user": { - "name": "81.2.69.145" - }, - "zscaler_zia": { - "tunnel": { - "action": { - "type": "IPSec Phase2" - }, - "authentication": { - "algorithm": "HMAC-SHA-1", - "type": "None" - }, - "destination": { - "end": { - "ip": "81.2.69.143" - }, - "start": { - "ip": "81.2.69.143", - "port": 0 - } - }, - "encryption": { - "algorithm": "AES" - }, - "ike": { - "version": 1 - }, - "life": { - "bytes": 0, - "time": 3600 - }, - "location": { - "name": "some-location" - }, - "policy": { - "direction": "Inbound SA Policy", - "protocol": "Any" - }, - "protocol": "ESP", - "source": { - "end": { - "ip": "81.2.69.145" - }, - "start": { - "ip": "81.2.69.145", - "port": 0 - } - }, - "spi": "123456789", - "type": "IPSEC IKEV 1" - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index bc5bf2cebf..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,308 +0,0 @@ ---- -description: Pipeline for Zscaler web logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - date: - field: json.time - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.time - ignore_missing: true - - set: - field: event.category - value: web - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - rename: - field: json.cip - target_field: client.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.sip - target_field: client.nat.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{client.nat.ip}}}" - if: ctx?.client?.nat?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.deviceowner - target_field: client.user.name - ignore_missing: true - - convert: - field: json.reqsize - target_field: http.request.bytes - type: long - ignore_failure: true - - remove: - field: json.reqsize - ignore_missing: true - - rename: - field: json.reqmethod - target_field: http.request.method - ignore_missing: true - - rename: - field: json.contenttype - target_field: http.request.mime_type - ignore_missing: true - - rename: - field: json.ereferer - target_field: http.request.referrer - ignore_missing: true - - convert: - field: json.respsize - target_field: http.response.bytes - type: long - ignore_failure: true - - remove: - field: json.respsize - ignore_missing: true - - convert: - field: json.respcode - target_field: http.response.status_code - type: long - ignore_failure: true - - remove: - field: json.respcode - ignore_missing: true - - rename: - field: json.proto - target_field: network.protocol - ignore_missing: true - - lowercase: - field: network.protocol - ignore_missing: true - - rename: - field: json.rulelabel - target_field: rule.name - ignore_missing: true - - rename: - field: json.ruletype - target_field: rule.ruleset - ignore_missing: true - - uri_parts: - field: json.eurl - remove_if_successful: true - on_failure: - - set: - field: url.original - value: "{{{json.eurl}}}" - if: ctx?.json?.eurl != null - ignore_failure: true - - remove: - field: json.eurl - ignore_missing: true - - user_agent: - field: json.ua - ignore_failure: true - - remove: - field: json.ua - ignore_missing: true - - rename: - field: json.login - target_field: user.email - ignore_missing: true - - rename: - field: json.action - target_field: event.action - ignore_missing: true - - lowercase: - field: event.action - ignore_missing: true - - rename: - field: json.appname - target_field: zscaler_zia.web.app.name - ignore_missing: true - - rename: - field: json.appclass - target_field: zscaler_zia.web.app.class - ignore_missing: true - - convert: - field: json.stime - target_field: zscaler_zia.web.stime - type: long - ignore_failure: true - - remove: - field: json.stime - ignore_missing: true - - convert: - field: json.ctime - target_field: zscaler_zia.web.ctime - type: long - ignore_failure: true - - remove: - field: json.ctime - ignore_missing: true - - rename: - field: json.urlclass - target_field: zscaler_zia.web.url.class - ignore_missing: true - - rename: - field: json.urlsupercat - target_field: zscaler_zia.web.url.category.super - ignore_missing: true - - rename: - field: json.urlcat - target_field: zscaler_zia.web.url.category.sub - ignore_missing: true - - rename: - field: json.malwarecat - target_field: zscaler_zia.web.malware.category - ignore_missing: true - - rename: - field: json.threatname - target_field: zscaler_zia.web.threat.name - ignore_missing: true - - convert: - field: json.riskscore - target_field: event.risk_score - type: long - ignore_failure: true - - remove: - field: json.riskscore - ignore_missing: true - - rename: - field: json.dlpeng - target_field: zscaler_zia.web.dpl.engine - ignore_missing: true - - rename: - field: json.dlpdict - target_field: zscaler_zia.web.dpl.dictionaries - ignore_missing: true - - rename: - field: json.location - target_field: zscaler_zia.web.location - ignore_missing: true - - rename: - field: json.dept - target_field: zscaler_zia.web.department - ignore_missing: true - - rename: - field: json.unscannabletype - target_field: zscaler_zia.web.unscannable.type - ignore_missing: true - - rename: - field: json.devicehostname - target_field: zscaler_zia.web.device.hostname - ignore_missing: true - - append: - field: related.hosts - value: "{{{zscaler_zia.web.device.hostname}}}" - if: ctx?.zscaler_zia?.web?.device?.hostname != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.bwthrottle - target_field: zscaler_zia.web.bandwidth_throttle - ignore_missing: true - - rename: - field: json.cintip - target_field: zscaler_zia.web.client.internet.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.web.client.internet.ip}}}" - if: ctx?.zscaler_zia?.web?.client?.internet?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ehost - target_field: zscaler_zia.web.encoded_host - ignore_missing: true - - rename: - field: json.fileclass - target_field: zscaler_zia.web.file.class - ignore_missing: true - - rename: - field: json.filetype - target_field: zscaler_zia.web.file.type - ignore_missing: true - - rename: - field: json.malwareclass - target_field: zscaler_zia.web.malware.class - ignore_missing: true - - rename: - field: json.reason - target_field: event.reason - ignore_missing: true - - rename: - field: json.recordid - target_field: zscaler_zia.web.record.id - ignore_missing: true - - convert: - field: json.totalsize - target_field: zscaler_zia.web.total.size - type: long - ignore_failure: true - - remove: - field: json.totalsize - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.web - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.web[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml deleted file mode 100755 index 9a074d3470..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.web diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml deleted file mode 100755 index c708c61ec0..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml +++ /dev/null @@ -1,136 +0,0 @@ -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - Translated IP of source based NAT sessions (e.g. internal client to internet). - Typically connections traversing load balancers, firewalls, or routers. - name: client.nat.ip - type: ip -- description: Short name or login of the user. - name: client.user.name - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: Risk score or priority of the event (e.g. security solutions). Use your system's original value here. - name: event.risk_score - type: float -- description: Total size in bytes of the request (body and headers). - name: http.request.bytes - type: long -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: |- - Mime type of the body of the request. - This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients. - name: http.request.mime_type - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: Total size in bytes of the response (body and headers). - name: http.response.bytes - type: long -- description: HTTP response status code. - name: http.response.status_code - type: long -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. - name: rule.ruleset - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - The field contains the file extension from the original request url, excluding the leading dot. - The file extension is only set if it exists, as not every url has a file extension. - The leading period must not be included. For example, the value must be "png", not ".png". - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: url.extension - type: keyword -- description: |- - Portion of the url after the `#`, such as "top". - The `#` is not part of the fragment. - name: url.fragment - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Password of the request. - name: url.password - type: keyword -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: Port of the request, such as 443. - name: url.port - type: long -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - Scheme of the request, such as "https". - Note: The `:` is not part of the scheme. - name: url.scheme - type: keyword -- description: Username of the request. - name: url.username - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml deleted file mode 100755 index fcfdd76d8d..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml +++ /dev/null @@ -1,116 +0,0 @@ -- name: zscaler_zia.web - type: group - fields: - - name: app - type: group - fields: - - name: class - type: keyword - description: | - The web application class of the application that was accessed. Equivalent to module. - - name: name - type: keyword - description: | - Cloud application name. - - name: bandwidth_throttle - type: keyword - description: | - Indicates whether the transaction was throttled due to a configured bandwidth policy. - - name: client.internet.ip - type: keyword - description: | - The client Internet (NATted Public) IP address. This is different from the cip value if the internal IP address is visible. Otherwise, same as cip. - - name: ctime - type: long - description: | - The time from when the first byte of the request hits the ZEN to the time in which the last byte of the response is sent from the ZEN back to the browser. - - name: department - type: keyword - description: | - Department of the user. - - name: device.hostname - type: keyword - description: | - The obfuscated version of the device owner. This field must be changed manually. - - name: dpl - type: group - fields: - - name: dictionaries - type: keyword - description: | - The DLP dictionaries that were matched, if any. - - name: engine - type: keyword - description: | - The DLP engine that was matched, if any. - - name: encoded_host - type: keyword - description: | - Encoded version of the destination host name. - - name: file - type: group - fields: - - name: class - type: keyword - description: | - Type of file associated with the transaction. - - name: type - type: keyword - description: | - Type of file associated with the transaction. - - name: location - type: keyword - description: | - Gateway location or sub-location of the source. - - name: malware - type: group - fields: - - name: category - type: keyword - description: | - The category of malware that was detected in the transaction, if any. Also indicates if a file was submitted to the Sandbox engine for analysis and the result of the analysis. - - name: class - type: keyword - description: | - The class of malware that was detected in the transaction, if any. - - name: record.id - type: keyword - description: | - N/A - - name: stime - type: long - description: | - The round trip time between the ZEN request and the server. - - name: threat.name - type: keyword - description: | - The name of the threat that was detected in the transaction, if any. - - name: total.size - type: long - description: | - Total size, in bytes, of the HTTP transaction; sum of the total request size and total response size. - - name: unscannable.type - type: keyword - description: | - Unscannable file type. - - name: url - type: group - fields: - - name: category - type: group - fields: - - name: sub - type: keyword - description: | - Category of the destination URL. - - name: super - type: keyword - description: | - Super category of the destination URL. - - name: class - type: keyword - description: |- - Class of the destination URL. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml deleted file mode 100755 index c7ec897dbb..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Web Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Web Logs - description: Collect Zscaler Internet Access Web Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9014 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-web - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json deleted file mode 100755 index 7d38b9cbfe..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json +++ /dev/null @@ -1,140 +0,0 @@ -{ - "@timestamp": "2021-12-17T07:04:57.000Z", - "agent": { - "ephemeral_id": "ced1fd2e-2f17-4f67-b8b1-d38a1920abbb", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "ip": "81.2.69.193", - "nat": { - "ip": "81.2.69.145" - }, - "user": { - "name": "administrator1" - } - }, - "data_stream": { - "dataset": "zscaler_zia.web", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "blocked", - "agent_id_status": "verified", - "category": "web", - "dataset": "zscaler_zia.web", - "ingested": "2022-02-04T08:48:57Z", - "kind": "event", - "risk_score": 0, - "type": [ - "info" - ] - }, - "http": { - "request": { - "bytes": 600, - "method": "CONNECT", - "mime_type": "Other", - "referrer": "None" - }, - "response": { - "bytes": 65, - "status_code": 200 - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:48722" - } - }, - "network": { - "protocol": "http_proxy" - }, - "related": { - "hosts": [ - "TestMachine35" - ], - "ip": [ - "81.2.69.193", - "81.2.69.145" - ] - }, - "rule": { - "name": "Zscaler Proxy Traffic", - "ruleset": "FwFilter" - }, - "tags": [ - "forwarded", - "zscaler_zia-web" - ], - "url": { - "extension": "com", - "original": "www.example.com", - "path": "www.example.com" - }, - "user": { - "email": "test@example.com" - }, - "user_agent": { - "device": { - "name": "Other" - }, - "name": "Other", - "original": "Windows Microsoft Windows 10 Pro ZTunnel/1.0", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - } - }, - "zscaler_zia": { - "web": { - "app": { - "class": "General Browsing", - "name": "General Browsing" - }, - "ctime": 0, - "department": "Unknown", - "device": { - "hostname": "TestMachine35" - }, - "dpl": { - "dictionaries": "None", - "engine": "None" - }, - "location": "Test DB", - "malware": { - "category": "None" - }, - "stime": 0, - "threat": { - "name": "None" - }, - "unscannable": { - "type": "None" - }, - "url": { - "category": { - "sub": "Web Search", - "super": "Information Technology" - }, - "class": "Business Use" - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/docs/README.md b/packages/zscaler_zia/0.1.0/docs/README.md deleted file mode 100755 index 7061e34980..0000000000 --- a/packages/zscaler_zia/0.1.0/docs/README.md +++ /dev/null @@ -1,1121 +0,0 @@ -# Zscaler ZIA - -This integration is for Zscaler Internet Access logs. It can be used -to receive logs sent by NSS log server on respective TCP ports. - -The log message is expected to be in JSON format. The data is mapped to -ECS fields where applicable and the remaining fields are written under -`zscaler_zia..*`. - -## Setup steps - -1. Enable the integration with the TCP input. -2. Configure the Zscaler NSS Server and NSS Feeds to send logs to the Elastic Agent -that is running this integration. See [_Add NSS Server_](https://help.zscaler.com/zia/adding-nss-servers) and [_Add NSS Feeds_](https://help.zscaler.com/zia/adding-nss-feeds). Use the IP address/hostname of the Elastic Agent as the 'NSS Feed SIEM IP Address/FQDN', and use the listening port of the Elastic Agent as the 'SIEM TCP Port' on the _Add NSS Feed_ configuration screen. -3. *Please make sure to use the given response formats.* - -## Compatibility - -This package has been tested against `Zscaler Internet Access version 6.1` - -## Documentation and configuration - -### Alerts - -Default port: _9010_ - -Vendor documentation: https://help.zscaler.com/zia/about-alerts - -Zscaler response format: -``` -<%d{syslogid}>%s{Monthname} %2d{Dayofmonth} %02d{Hour}:%02d{Minutes}:%02d{Seconds} [%s{Deviceip}] ZscalerNSS: %s{Eventinfo}\n -``` - -Sample Response: -``` -<114>Dec 10 14:04:28 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes -``` - -### DNS Log - -Default port: _9011_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-dns-logs - -Zscaler response format: -``` -\{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} -``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-dns", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","location":"TestLoc%20DB","reqaction":"REQ_ALLOW","resaction":"Some Response Action","reqrulelabel":"Access%20Blocked","resrulelabel":"None","dns_reqtype":"Some type","dns_req":"example.com","dns_resp":"Some response string","srv_dport":"8080","durationms":"123456","clt_sip":"81.2.69.193","srv_dip":"81.2.69.144","category":"Professional Services","deviceowner":"Owner77","devicehostname":"Machine9000"}} -``` - -### Firewall Log - -Default port: _9012_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs - -Zscaler response format: -``` -\{ "sourcetype" : "zscalernss-fw", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","locationname":"%s{elocation}","cdport":"%d{cdport}","csport":"%d{csport}","sdport":"%d{sdport}","ssport":"%d{ssport}","csip":"%s{csip}","cdip":"%s{cdip}","ssip":"%s{ssip}","sdip":"%s{sdip}","tsip":"%s{tsip}","tunsport":"%d{tsport}","tuntype":"%s{ttype}","action":"%s{action}","dnat":"%s{dnat}","stateful":"%s{stateful}","aggregate":"%s{aggregate}","nwsvc":"%s{nwsvc}","nwapp":"%s{nwapp}","proto":"%s{ipproto}","ipcat":"%s{ipcat}","destcountry":"%s{destcountry}","avgduration":"%d{avgduration}","rulelabel":"%s{erulelabel}","inbytes":"%ld{inbytes}","outbytes":"%ld{outbytes}","duration":"%d{duration}","durationms":"%d{durationms}","numsessions":"%d{numsessions}","ipsrulelabel":"%s{ipsrulelabel}","threatcat":"%s{threatcat}","threatname":"%s{ethreatname}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} -``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-fw", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","locationname":"TestLoc%20DB","cdport":443,"csport":55018,"sdport":443,"ssport":0,"csip":"0.0.0.0","cdip":"0.0.0.0","ssip":"0.0.0.0","sdip":"0.0.0.0","tsip":"0.0.0.0","tunsport":0,"tuntype":"ZscalerClientConnector","action":"Drop","dnat":"No","stateful":"Yes","aggregate":"No","nwsvc":"HTTPS","nwapp":"http","proto":"TCP","ipcat":"Test Name","destcountry":"Ireland","avgduration":486,"rulelabel":"Access%20Blocked","inbytes":19052,"outbytes":1734,"duration":0,"durationms":486,"numsessions":1,"ipsrulelabel":"None","threatcat":"None","threatname":"None","deviceowner":"admin77","devicehostname":"Machine9000"}} -``` - -### Tunnel Log - -Default port: _9013_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-tunnel-logs - -Zscaler response format: -- Tunnel Event: - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"%s{tunneltype}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","event":"%s{event}","eventreason":"%s{eventreason}","recordid":"%d{recordid}"\}\} - ``` -- Sample Event: - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"%s{tunneltype}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","txbytes":"%lu{txbytes}","rxbytes":"%lu{rxbytes}","dpdrec":"%d{dpdrec}","recordid":"%d{recordid}"\}\} - ``` -- IKE Phase 1 - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"IPSEC IKEV %d{ikeversion}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","destinationport":"%d{dstport}","lifetime":"%d{lifetime}","ikeversion":"%d{ikeversion}","spi_in":"%lu{spi_in}","spi_out":"%lu{spi_out}","algo":"%s{algo}","authentication":"%s{authentication}","authtype":"%s{authtype}","recordid":"%d{recordid}"\}\} - ``` -- IKE Phase 2 - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"IPSEC IKEV %d{ikeversion}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","sourceportstart":"%d{srcportstart}","destinationportstart":"%d{destportstart}","srcipstart":"%s{srcipstart}","srcipend":"%s{srcipend}","destinationipstart":"%s{destipstart}","destinationipend":"%s{destipend}","lifetime":"%d{lifetime}","ikeversion":"%d{ikeversion}","lifebytes":"%d{lifebytes}","spi":"%d{spi}","algo":"%s{algo}","authentication":"%s{authentication}","authtype":"%s{authtype}","protocol":"%s{protocol}","tunnelprotocol":"%s{tunnelprotocol}","policydirection":"%s{policydirection}","recordid":"%d{recordid}"\}\} - ``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-tunnel", "event" : {"datetime":"Thu Dec 30 11:40:27 2021","Recordtype":"IPSec Phase1","tunneltype":"IPSEC IKEV 2","user":"81.2.69.145","location":"some-location","sourceip":"81.2.69.145","destinationip":"81.2.69.143","sourceport":"500","destinationport":"500","lifetime":"0","ikeversion":"2","spi_in":"00000000000000000000","spi_out":"11111111111111111111","algo":"AES-CBS","authentication":"HMAC-SHA1-96","authtype":"PSK","recordid":"1111111111111111111"}} -``` - -### Web Log - -Default port: _9014_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-web-logs - -Zscaler response format: -``` -\{ "sourcetype" : "zscalernss-web", "event" :\{"time":"%s{time}","login":"%s{login}","proto":"%s{proto}","eurl":"%s{eurl}","action":"%s{action}","appname":"%s{appname}","appclass":"%s{appclass}","reqsize":"%d{reqsize}","respsize":"%d{respsize}","stime":"%d{stime}","ctime":"%d{ctime}","urlclass":"%s{urlclass}","urlsupercat":"%s{urlsupercat}","urlcat":"%s{urlcat}","malwarecat":"%s{malwarecat}","threatname":"%s{threatname}","riskscore":"%d{riskscore}","dlpeng":"%s{dlpeng}","dlpdict":"%s{dlpdict}","location":"%s{location}","dept":"%s{dept}","cip":"%s{cip}","sip":"%s{sip}","reqmethod":"%s{reqmethod}","respcode":"%s{respcode}","ua":"%s{ua}","ereferer":"%s{ereferer}","ruletype":"%s{ruletype}","rulelabel":"%s{rulelabel}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} -``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-web", "event" :{"time":"Fri Dec 17 07:04:57 2021","login":"test@example.com","proto":"HTTP_PROXY","eurl":"browser.events.data.msn.com:443","action":"Blocked","appname":"General Browsing","appclass":"General Browsing","reqsize":"600","respsize":"65","stime":"0","ctime":"0","urlclass":"Business Use","urlsupercat":"Information Technology","urlcat":"Web Search","malwarecat":"None","threatname":"None","riskscore":"0","dlpeng":"None","dlpdict":"None","location":"Test DB","dept":"Unknown","cip":"81.2.69.193","sip":"81.2.69.145","reqmethod":"CONNECT","respcode":"200","ua":"Windows Microsoft Windows 10 Pro ZTunnel/1.0","ereferer":"None","ruletype":"FwFilter","rulelabel":"Zscaler Proxy Traffic","contenttype":"Other","unscannabletype":"None","deviceowner":"administrator1","devicehostname":"TestMachine35"}} -``` - -## Fields and Sample event - -### Alerts - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| related.ip | All of the IPs seen on your event. | ip | -| tags | List of keywords used to tag each event. | keyword | -| zscaler_zia.alerts.connection_lost_minutes | Amount of time after loosing connection to a server in Minutes. | double | -| zscaler_zia.alerts.log_feed_name | Name of the NSS log feed. | keyword | - - -An example event for `alerts` looks as following: - -```json -{ - "@timestamp": "2022-12-10T13:40:32.000Z", - "agent": { - "ephemeral_id": "8c093fcf-fb2f-4baa-b794-40edb011194d", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.alerts", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "81.2.69.193", - "ip": "81.2.69.193", - "port": 9012 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "dataset": "zscaler_zia.alerts", - "ingested": "2022-02-04T06:31:25Z" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:32902" - }, - "syslog": { - "priority": 114 - } - }, - "message": "ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes", - "related": { - "ip": [ - "81.2.69.193" - ] - }, - "tags": [ - "forwarded", - "zscaler_zia-alerts" - ], - "zscaler_zia": { - "alerts": { - "connection_lost_minutes": 2440, - "log_feed_name": "DNS Logs Feed" - } - } -} -``` - -## DNS Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.geo.city_name | City name. | keyword | -| client.geo.continent_name | Name of the continent. | keyword | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.country_name | Country name. | keyword | -| client.geo.location | Longitude and latitude. | geo_point | -| client.geo.region_iso_code | Region ISO code. | keyword | -| client.geo.region_name | Region name. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.type | The type of record being queried. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| server.geo.city_name | City name. | keyword | -| server.geo.continent_name | Name of the continent. | keyword | -| server.geo.country_iso_code | Country ISO code. | keyword | -| server.geo.country_name | Country name. | keyword | -| server.geo.location | Longitude and latitude. | geo_point | -| server.geo.region_iso_code | Region ISO code. | keyword | -| server.geo.region_name | Region name. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| server.port | Port of the server. | long | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| user.email | User email address. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zia.dns.department | Department of the user. | keyword | -| zscaler_zia.dns.dom.category | URL Category of the FQDN in the DNS request. | keyword | -| zscaler_zia.dns.duration.milliseconds | Duration of the DNS request in milliseconds. | long | -| zscaler_zia.dns.hostname | N/A | keyword | -| zscaler_zia.dns.location | Gateway location or sub-location of the source. | keyword | -| zscaler_zia.dns.request.action | Name of the action that was applied to the DNS request. | keyword | -| zscaler_zia.dns.request.rule.label | Name of the rule that was applied to the DNS request. | keyword | -| zscaler_zia.dns.response.action | Name of the action that was applied to the DNS response. | keyword | -| zscaler_zia.dns.response.rule.label | Name of the rule that was applied to the DNS response. | keyword | - - -An example event for `dns` looks as following: - -```json -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "d288c261-b8db-45af-99c0-a673c3c6d8e1", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.193" - }, - "data_stream": { - "dataset": "zscaler_zia.dns", - "namespace": "ep", - "type": "logs" - }, - "dns": { - "answers": { - "name": "Some response string" - }, - "question": { - "name": "example.com", - "type": "Some type" - } - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.dns", - "ingested": "2022-02-04T06:32:56Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:54202" - } - }, - "related": { - "hosts": [ - "Machine9000" - ], - "ip": [ - "81.2.69.193", - "81.2.69.144" - ] - }, - "server": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 8080 - }, - "tags": [ - "forwarded", - "zscaler_zia-dns" - ], - "user": { - "email": "some_user@example.com", - "name": "Owner77" - }, - "zscaler_zia": { - "dns": { - "department": "Unknown", - "dom": { - "category": "Professional Services" - }, - "duration": { - "milliseconds": 123456 - }, - "hostname": "Machine9000", - "location": "TestLoc DB", - "request": { - "action": "REQ_ALLOW", - "rule": { - "label": "Access Blocked" - } - }, - "response": { - "action": "Some Response Action", - "rule": { - "label": "None" - } - } - } - } -} -``` - -## Firewall Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.bytes | Bytes sent from the client to the server. | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| rule.name | The name of the rule or signature generating the event. | keyword | -| server.bytes | Bytes sent from the server to the client. | long | -| server.geo.country_name | Country name. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| user.email | User email address. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zia.firewall.aggregate | | keyword | -| zscaler_zia.firewall.client.destination.ip | Client destination IP address. For aggregated sessions, this is the client destination IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.client.destination.port | Client destination port. For aggregated sessions, this is the client destination port of the last session in the aggregate. | double | -| zscaler_zia.firewall.client.source.ip | Client source IP address. For aggregated sessions, this is the client source IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.client.source.port | Client source port. For aggregated sessions, this is the client source port of the last session in the aggregate. | double | -| zscaler_zia.firewall.department | Department of the user. | keyword | -| zscaler_zia.firewall.duration.avg | Average session duration, in milliseconds, if the sessions were aggregated. | double | -| zscaler_zia.firewall.duration.milliseconds | Session or request duration in milliseconds. | double | -| zscaler_zia.firewall.duration.seconds | Session or request duration in seconds. | double | -| zscaler_zia.firewall.ip_category | URL category that corresponds to the server IP address. | keyword | -| zscaler_zia.firewall.location.name | Name of the location from which the session was initiated. | keyword | -| zscaler_zia.firewall.nat | Indicates if the destination NAT policy was applied. | keyword | -| zscaler_zia.firewall.server.destination.ip | Server Destination IP address. For aggregated sessions, this is the server destination IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.server.destination.port | Server destination port. For aggregated sessions, this is the server destination port of the last session in the aggregate. | double | -| zscaler_zia.firewall.server.source.ip | Server source IP address. For aggregated sessions, this is the server source IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.server.source.port | Server source port. For aggregated sessions, this is the server source port of the last session in the aggregate. | double | -| zscaler_zia.firewall.session.count | Number of sessions that were aggregated. | double | -| zscaler_zia.firewall.stateful | | keyword | -| zscaler_zia.firewall.threat.category | Category of the threat in the Firewall session by the IPS engine. | keyword | -| zscaler_zia.firewall.threat.name | Name of the threat detected in the Firewall session by the IPS engine. | keyword | -| zscaler_zia.firewall.tunnel.ip | Tunnel IP address of the client (source). For aggregated sessions, this is the client's tunnel IP address corresponding to the last session in the aggregate. | keyword | -| zscaler_zia.firewall.tunnel.port | Tunnel port on the client side. For aggregated sessions, this is the client's tunnel port corresponding to the last session in the aggregate. | double | -| zscaler_zia.firewall.tunnel.type | Traffic forwarding method used to send the traffic to the firewall. | keyword | - - -An example event for `firewall` looks as following: - -```json -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "41987f90-74dc-4b4b-9936-4347028cf558", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "bytes": 1734 - }, - "data_stream": { - "dataset": "zscaler_zia.firewall", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "drop", - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.firewall", - "ingested": "2022-02-04T06:34:17Z", - "kind": "event", - "original": "{ \"sourcetype\" : \"zscalernss-fw\", \"event\" :{\"datetime\":\"Fri Dec 17 07:27:54 2021\",\"user\":\"some_user@example.com\",\"department\":\"Unknown\",\"locationname\":\"TestLoc%20DB\",\"cdport\":443,\"csport\":55018,\"sdport\":443,\"ssport\":0,\"csip\":\"0.0.0.0\",\"cdip\":\"0.0.0.0\",\"ssip\":\"0.0.0.0\",\"sdip\":\"0.0.0.0\",\"tsip\":\"0.0.0.0\",\"tunsport\":0,\"tuntype\":\"ZscalerClientConnector\",\"action\":\"Drop\",\"dnat\":\"No\",\"stateful\":\"Yes\",\"aggregate\":\"No\",\"nwsvc\":\"HTTPS\",\"nwapp\":\"http\",\"proto\":\"TCP\",\"ipcat\":\"Test Name\",\"destcountry\":\"Ireland\",\"avgduration\":486,\"rulelabel\":\"Access%20Blocked\",\"inbytes\":19052,\"outbytes\":1734,\"duration\":0,\"durationms\":486,\"numsessions\":1,\"ipsrulelabel\":\"None\",\"threatcat\":\"None\",\"threatname\":\"None\",\"deviceowner\":\"admin77\",\"devicehostname\":\"Machine9000\"}}", - "type": "info" - }, - "host": { - "hostname": "Machine9000" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:58194" - } - }, - "network": { - "application": "http", - "protocol": "https", - "transport": "tcp" - }, - "related": { - "ip": [ - "0.0.0.0" - ] - }, - "rule": { - "name": [ - "Access Blocked", - "None" - ] - }, - "server": { - "bytes": 19052, - "geo": { - "country_name": "Ireland" - } - }, - "tags": [ - "forwarded", - "zscaler_zia-firewall" - ], - "user": { - "email": "some_user@example.com", - "name": "admin77" - }, - "zscaler_zia": { - "firewall": { - "aggregate": "No", - "client": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 55018 - } - }, - "department": "Unknown", - "duration": { - "avg": 486, - "milliseconds": 486, - "seconds": 0 - }, - "ip_category": "Test Name", - "location": { - "name": "TestLoc DB" - }, - "nat": "No", - "server": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 0 - } - }, - "session": { - "count": 1 - }, - "stateful": "Yes", - "threat": { - "category": "None", - "name": "None" - }, - "tunnel": { - "ip": "0.0.0.0", - "port": 0, - "type": "ZscalerClientConnector" - } - } - } -} -``` - -## Tunnel Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.packets | Packets sent from the destination to the source. | long | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.module | Event module | constant_keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zia.tunnel.action.type | Type of the record. Possible values [ WL_TUNNEL_IPSECPHASE1, WL_TUNNEL_IPSECPHASE2, WL_TUNNEL_EVENT, WL_TUNNEL_SAMPLES ]. | keyword | -| zscaler_zia.tunnel.authentication.algorithm | Authentication algorithm. | keyword | -| zscaler_zia.tunnel.authentication.type | Authentication type. | keyword | -| zscaler_zia.tunnel.destination.end.ip | Phase 2 policy proposal - Destination IP end. | keyword | -| zscaler_zia.tunnel.destination.start.ip | Phase 2 policy proposal - Destination IP start. | keyword | -| zscaler_zia.tunnel.destination.start.port | Phase 2 policy proposal - Destination port end. | long | -| zscaler_zia.tunnel.dpd_packets | Number of DPD packets received in 60-second sample window. | keyword | -| zscaler_zia.tunnel.encryption.algorithm | Encryption algorithm. | keyword | -| zscaler_zia.tunnel.ike.version | IKE version (1 or 2). | long | -| zscaler_zia.tunnel.life.bytes | Life bytes (number of traffic to be transacted through tunnel before renegotiation). | long | -| zscaler_zia.tunnel.life.time | Lifetime of IKE Phase 1/2 in seconds. | long | -| zscaler_zia.tunnel.location.name | Location name. | keyword | -| zscaler_zia.tunnel.policy.direction | N/A | keyword | -| zscaler_zia.tunnel.policy.protocol | Phase 2 policy proposal - Protocol. | keyword | -| zscaler_zia.tunnel.protocol | IPSec tunnel protocol type (Zscaler only supports ESP). | keyword | -| zscaler_zia.tunnel.source.end.ip | Phase 2 policy proposal - Source IP end. | keyword | -| zscaler_zia.tunnel.source.start.ip | Phase 2 policy proposal - Source IP start. | keyword | -| zscaler_zia.tunnel.source.start.port | Phase 2 policy proposal - Source port start. | long | -| zscaler_zia.tunnel.spi | Security Parameter Index. | keyword | -| zscaler_zia.tunnel.spi_in | Initiator cookie. | keyword | -| zscaler_zia.tunnel.spi_out | Responder cookie. | keyword | -| zscaler_zia.tunnel.type | Tunnel type. | keyword | -| zscaler_zia.tunnel.vendor.name | Vendor name of the edge device. | keyword | - - -An example event for `tunnel` looks as following: - -```json -{ - "@timestamp": "2021-12-30T11:20:12.000Z", - "agent": { - "ephemeral_id": "63ac98b6-0ff6-4943-820e-8505eff15937", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.tunnel", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "81.2.69.143" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.tunnel", - "id": "1111111111111111111", - "ingested": "2022-02-04T06:36:16Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:44374" - } - }, - "related": { - "ip": [ - "81.2.69.143", - "81.2.69.145" - ], - "user": [ - "81.2.69.145" - ] - }, - "source": { - "ip": "81.2.69.145", - "port": 0 - }, - "tags": [ - "forwarded", - "zscaler_zia-tunnel" - ], - "user": { - "name": "81.2.69.145" - }, - "zscaler_zia": { - "tunnel": { - "action": { - "type": "IPSec Phase2" - }, - "authentication": { - "algorithm": "HMAC-SHA-1", - "type": "None" - }, - "destination": { - "end": { - "ip": "81.2.69.143" - }, - "start": { - "ip": "81.2.69.143", - "port": 0 - } - }, - "encryption": { - "algorithm": "AES" - }, - "ike": { - "version": 1 - }, - "life": { - "bytes": 0, - "time": 3600 - }, - "location": { - "name": "some-location" - }, - "policy": { - "direction": "Inbound SA Policy", - "protocol": "Any" - }, - "protocol": "ESP", - "source": { - "end": { - "ip": "81.2.69.145" - }, - "start": { - "ip": "81.2.69.145", - "port": 0 - } - }, - "spi": "123456789", - "type": "IPSEC IKEV 1" - } - } -} -``` - -## Web Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.nat.ip | Translated IP of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | ip | -| client.user.name | Short name or login of the user. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| http.request.bytes | Total size in bytes of the request (body and headers). | long | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.mime_type | Mime type of the body of the request. This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| http.response.bytes | Total size in bytes of the response (body and headers). | long | -| http.response.status_code | HTTP response status code. | long | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.password | Password of the request. | keyword | -| url.path | Path of the request, such as "/search". | wildcard | -| url.port | Port of the request, such as 443. | long | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.username | Username of the request. | keyword | -| user.email | User email address. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | -| zscaler_zia.web.app.class | The web application class of the application that was accessed. Equivalent to module. | keyword | -| zscaler_zia.web.app.name | Cloud application name. | keyword | -| zscaler_zia.web.bandwidth_throttle | Indicates whether the transaction was throttled due to a configured bandwidth policy. | keyword | -| zscaler_zia.web.client.internet.ip | The client Internet (NATted Public) IP address. This is different from the cip value if the internal IP address is visible. Otherwise, same as cip. | keyword | -| zscaler_zia.web.ctime | The time from when the first byte of the request hits the ZEN to the time in which the last byte of the response is sent from the ZEN back to the browser. | long | -| zscaler_zia.web.department | Department of the user. | keyword | -| zscaler_zia.web.device.hostname | The obfuscated version of the device owner. This field must be changed manually. | keyword | -| zscaler_zia.web.dpl.dictionaries | The DLP dictionaries that were matched, if any. | keyword | -| zscaler_zia.web.dpl.engine | The DLP engine that was matched, if any. | keyword | -| zscaler_zia.web.encoded_host | Encoded version of the destination host name. | keyword | -| zscaler_zia.web.file.class | Type of file associated with the transaction. | keyword | -| zscaler_zia.web.file.type | Type of file associated with the transaction. | keyword | -| zscaler_zia.web.location | Gateway location or sub-location of the source. | keyword | -| zscaler_zia.web.malware.category | The category of malware that was detected in the transaction, if any. Also indicates if a file was submitted to the Sandbox engine for analysis and the result of the analysis. | keyword | -| zscaler_zia.web.malware.class | The class of malware that was detected in the transaction, if any. | keyword | -| zscaler_zia.web.record.id | N/A | keyword | -| zscaler_zia.web.stime | The round trip time between the ZEN request and the server. | long | -| zscaler_zia.web.threat.name | The name of the threat that was detected in the transaction, if any. | keyword | -| zscaler_zia.web.total.size | Total size, in bytes, of the HTTP transaction; sum of the total request size and total response size. | long | -| zscaler_zia.web.unscannable.type | Unscannable file type. | keyword | -| zscaler_zia.web.url.category.sub | Category of the destination URL. | keyword | -| zscaler_zia.web.url.category.super | Super category of the destination URL. | keyword | -| zscaler_zia.web.url.class | Class of the destination URL. | keyword | - - -An example event for `web` looks as following: - -```json -{ - "@timestamp": "2021-12-17T07:04:57.000Z", - "agent": { - "ephemeral_id": "ced1fd2e-2f17-4f67-b8b1-d38a1920abbb", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "ip": "81.2.69.193", - "nat": { - "ip": "81.2.69.145" - }, - "user": { - "name": "administrator1" - } - }, - "data_stream": { - "dataset": "zscaler_zia.web", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "blocked", - "agent_id_status": "verified", - "category": "web", - "dataset": "zscaler_zia.web", - "ingested": "2022-02-04T08:48:57Z", - "kind": "event", - "risk_score": 0, - "type": [ - "info" - ] - }, - "http": { - "request": { - "bytes": 600, - "method": "CONNECT", - "mime_type": "Other", - "referrer": "None" - }, - "response": { - "bytes": 65, - "status_code": 200 - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:48722" - } - }, - "network": { - "protocol": "http_proxy" - }, - "related": { - "hosts": [ - "TestMachine35" - ], - "ip": [ - "81.2.69.193", - "81.2.69.145" - ] - }, - "rule": { - "name": "Zscaler Proxy Traffic", - "ruleset": "FwFilter" - }, - "tags": [ - "forwarded", - "zscaler_zia-web" - ], - "url": { - "extension": "com", - "original": "www.example.com", - "path": "www.example.com" - }, - "user": { - "email": "test@example.com" - }, - "user_agent": { - "device": { - "name": "Other" - }, - "name": "Other", - "original": "Windows Microsoft Windows 10 Pro ZTunnel/1.0", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - } - }, - "zscaler_zia": { - "web": { - "app": { - "class": "General Browsing", - "name": "General Browsing" - }, - "ctime": 0, - "department": "Unknown", - "device": { - "hostname": "TestMachine35" - }, - "dpl": { - "dictionaries": "None", - "engine": "None" - }, - "location": "Test DB", - "malware": { - "category": "None" - }, - "stime": 0, - "threat": { - "name": "None" - }, - "unscannable": { - "type": "None" - }, - "url": { - "category": { - "sub": "Web Search", - "super": "Information Technology" - }, - "class": "Business Use" - } - } - } -} -``` diff --git a/packages/zscaler_zia/0.1.0/img/zscaler-logo.svg b/packages/zscaler_zia/0.1.0/img/zscaler-logo.svg deleted file mode 100755 index b8a21a2fa6..0000000000 --- a/packages/zscaler_zia/0.1.0/img/zscaler-logo.svg +++ /dev/null @@ -1 +0,0 @@ -Zscaler-Logo-TM-Blue-RGB-May2019 \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/img/zscaler-zia-screenshot.png b/packages/zscaler_zia/0.1.0/img/zscaler-zia-screenshot.png deleted file mode 100755 index 6e10c51d8482c01d50e8f0469e09010104995954..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 87669 zcmZ5|1z1#3*De+)k^<5o-6@^Y4blyg(jW{WsUqEt;LzP2LrIH>Fu;%w9W#S8NGNd6 z;P?Iiy?35ReK^B8XYaN5TI+q^wYE_&HI;C&DX=jxFmP3r<#jMH9w=d8+{Jl_30#@k zrd|a8x#OjyB#Tk=g9-`!aR0T8h71NqeZu3vRu6!mA9*MndtqSU^`rmX8FnwT#lW~J zR*{#{^RxH`fAGp|_LIZcjojg2+iSL>rYZuF(^`% z^&Wg)ANq4YJWn3@faprY3kccIQ|SnK%g>^c3k*o!h3`#9l+3&-^G6OK+M?yiQ*PgH z*Y;AKT^Py4EI6vRHhKMCh9n_=NBnpGJAsqQJ8TRu(bIw`=XaLg&vowtt(1pntLG0O zHj)dU1Ym|fiTS|ChBk!8<0#4Trzxt*de%BoN^u*AiIL>O{4XhYSkd2_cemcvLE@!R z!F*BG1`LPg!@z{V>dE~7=7a?KtFs>>ZQ*%HVDfY;Lbg_JU30sIxPp2`Od`{>rR3gfQkC{NL6rwXT zUn-m~O_dVUq)fgdzn;Uu`dc({&XY<~u!fP*r_9@+xggl6#OsT9d=O}ss`t9$PG;jIfiPHsPQvbd{jnsg zQPvPy24JNvfhZO88f_!a^eNSNA&Kx>;b9vYv$EM=3o*IDzF1ks!>|vi1)7htmiUUM zCcFr!Z$D_mRWTn)X|*1{0!J4gNG=MFgA(b$h$W9{+*8Dce7LHfIsaKQGPq zHaiNiK#kA(I)p+OaYz02ThtR99qN?e{o(x0fZsR5QUMNRW8*!#Jj>lXJ8i%5_1#?; z8EwXch?@ea`4`C`{{U;CYYCd|McUU`J08`JL_92 z{T0PJ1S?H%uV|WPW;CN?(68;w4JL5#`1{@IlmY5kr?72}#En@A`TcAr=q6@P;GF9E z=y5{f&e!#GZO2;dilr!bYIwrUp9AR?SdH*uC`&Z-q62@WUtH;gpL6Nn`BDarlKEK5 z`JWp$#SyLaSI6VN1wqsCAIo(23ldC!DaSU@S&i9O?Oag@_iUD)XQa8qV`vsHh)sIV z$InlGP|sCfa=kf>lp>cO&R+>1Yh#`YjZMq;=s=PO{@Tx#8{^0w?6aKBzhqJHJF88| zKgu{;t^FM!*JyV9`h1V21`2K-4hf^&59SeaZzp}+x)1FwJgB^~Or}hDI8N|ggT3zW z(Q~Jte1DJJbHks@;(gMh4wddtK%ox5_b>P1*+9SecUE2ooDWZ0!C&tziz4R)R>pef zKZGoFlSp^pn4b?z)~-hE-`vp@kc!s&dnN_izj-Qk7?_Zg0GQH&`*PB-JKu79C*9WJ zg<*LH7T-ufS#{|YAG2gf(NB6?u@9`2*n`=nsNSXR^@EG?F49@}AK!Dh^it^OZedND z4E$Y};g`}A%ab2UhOdb&C8pycH|HFGAzS)^$Ip9YHm~iu1lJ{UcsUAwRuiu5Yy zkh!4V?+2T!(6`Ze%Zays1m-_w-xK~1Ubu|7XZz#3ZBQ2inw#vN1npqWQ1 zJU8f4t&K-jVed6UXZRJtuD;UB$av_*hWU|z%Xx_9z=!=1qJ&Qxbti(kJ}#a~UdM86 zuLqfb{#_btbKA!FiCZiJ)s0_U^5aYZMLd-QLcM^JMsV3=JEYj;O5Q|!ZzgxVGfssI zPyXUg21tv4;z%rKE-Rv%*31d#)A#uEBKxLOwN@fmrZJDR*3S~$&6<>xjYCQ8{M3?6 z`eaq`n4#&w4MBtT#o6T;UwF?0U!2%}Jxl+g-=l9#li0VNa5RbqS++HNS!||qJ8|7e z#HDoux|_IxRHg0r2=*#kM9C9`u#-4CG$*^b+CIp^4}QQiL(`vP+L2^NkU&Sga+#32 z8q#w#dyWup$#={n8M`B1@Jq3aWzZPJaox8RRnzS$A&Ox%Jf8mQvkO^7$ieoU_8DvU z?_R8f_Fb_8IrU?qzarOv{0{54>#l@D;+1^OSKLlcX}_?vUQ2dg?T`2U?Osge-|Iab zrWrB}@gUx3Q{`j!S6k}1#(i^h`Zn-lQH%bptCenqY%hkVFH8E5>EC{y8&V$Tsy;CM z=EL~aX^&0i+cl5PG8=-Z8aI}2czC^17^`hXjtboJ4dd(A| zU;Q~NNZik8OfW`$bIEfPxgX3j{rRdL5_Z3Uknl(c&N5Z>nlIO8vMJ!ekRv3a=k4-6 zzk_-8z|)0^KqSX<49}G#Y4>lJF4SU_W#IL$-x(GywAi@#{!TdlazaH<+vEL^;edm3 zMOx0Qu~Mpxp9KMLezn#zTz7X6{-TiWe{bJZ+fAx96G-HKvvc$1_rSwg^Rw>fEjL_A zMsN11S+=QtaMtI%LgbZv2>Fex(OG+oj5?)a<)k|Dy*1I+94dM~svA??vlLUNz;M1x zG;+R`u)~)BeoylZqF}&xO;{%A@M9$tkluh$EKAv0N;uMBL=N#6mLn+DI%goG5 zuOpj=Ngm#hl|tWMa3PnxBGt2uU_d{Mw#q=a8zyQqv5rUB1V~#tJkwHC4RxCc&c>{kDOSVA;NG zU$6GF)w-vr=Yj*^_=1a#e#*xOz0SvR-Hq8JnIL*mr(h$f93nbdNa;$3473$Ej3cWG2XVptz*IVFRH~?(w#+u;KANHz9c~ zU{^gKc8dQJ_gJ@{S8#~Tlervn(!8zua(RF9>OqwD`ET)=&pK(2!#nQQAP`PJH>n%M ziU_qs>0PeX&JZ%nC2YMj;~E(kCj$Zz(=#w=E!A6gI?yf6HIugf^pl*N)H!W1@&q{* z349!}g;cdP)iAbS@CaXP=*~%{Q=!fHI1N3zR2b^D(d-0ScVjgbtcziY0KG>!c)r>9 zlDb(|5fyDS=x4U1H|@yJ25~$eFY6NkXHs?5HGDGxfqeR1gjTmGh5B6h$!)mfsn+9b zXc(CX=q6Wr!^8Dvrgwzeo^pLva#U#MHm|qUam3c1oroS#-p>06+AC57O40iN!K|y}#XpT3 z`#SbRUdvtjDHrDpB}3s$tZs8b%AtZlC_m2qRWx`)}J2K-`Fcpf7hBf z-n|et9-`s9jVZcn@zKDXSdt4fd>&^3?iyJmrelXx#mWa+B`bsGs3BrqaC;@o8w`VL zqu7ms`zQE#R)doY%Bs=BW7)N^C}?zr*iYZ_YGoDGFB22Id!63TCv{TleNM4)a761} zMr7p`6#90KZH|Y$>oVo=AI3$+hr_I8nz?11CX022%^FoRh)?}G+jf3addoKDmp|B< zt(hK~%dY7$U~#siT(h=0kyDz2L5e_?>KSRD;srU<>C3{=G1ol$Q#`O3Xy#0h&5(rG z!CigvE2h?JIp4adn6VJjqMZS}EoxFlH+MFnUrBA^=VW|rlOC0XCzYgA=XWgmyuwB- zeZf;QYVUs0UwtbRyb^9as_Yf3o^hyC<$#j;Pvmo5HxG}z8YiTABNxK$&9n4Wot3?X zBH;0VKfC-|^1a`?A`+j&I;%1%vt7546Wm4R=&RSl#?6hX!R0Da*7CUOvm)R}UiT|u z;{*nkfQnEs@4*Lb=x=(Ju+e)_f3IJZvD~f8*bT&Y|AC&)Xe!358d0^r`x7)}e}8zGPeS7EY}qK8 zc#ndT5|U*sB6~WO@#+<8xji}z2$0s9T;cqCaTcyuyUA4z{Ljn46A_){6zIZIe(9p; z8MU&yI&Vo{yX=qCW0r-3?0Xtj2Ee@nT0yVmq?S6kXA#*!L@*TKI&}YaozW2};Vi4g zTRSXBfWODFMs`wGa_q(i&+6tVkZznD9SQd@Q{E zGZh!NRQ&!8g0M|dss2sB*x$|E5Nw|gIGLJP)Mw|~ar}-kCmcFpdt{jhK0|LA!Z5+@ z174}qsDzc)o=eNX)mo|kfm=;MqocALoxrE`8=erYdH4KsGgTtRj0mp}9FaBWs%)$z zbu8DdEnqqpqY@JN@gy%HuHBnMRXZtu0^^?Ae}cg%lTrdPZU3=pD;)>NJyFs5ww?IJ zSIs7|^#U1R+kN8wF;YHp#Xo_5Cf=$0@;zdV&|JT!!s+zhy->s+<-0)_#XvJ0ifrHx zqX{T16vmNWa4!Ez({`!z?LAHd4hSTme)|RA5&)OTsJ+%dky;Ew1V^Fe;Vdl7^v@+p z7`QWn6QZJoW}d7a|Eb??7EVe5=g(Lvs5y&2CEl`nHSs9JnYg|ldf?yLc6f<9MD;%_ zQ8}XB6Wz|(fcB8jhg<4=j*Zti00U9*dyqJ2cjYdCiydz zQN=M&5zj0>{Qe#*V1pvK-M$V&-v>7k2L}&>uPc`;Rz=U3bN|ZXcN~UmoKKQU<41(* z?`+eH&W=;N4>AN$oHzN?XL)Ui>vgMbil;@^&=~4x7Yb#g{em}}egXy$EeLx6Y3ltl zk;r|8q#~awR<@wF8qfs$-Q;-5&fQr&wb&v(D&D@%E;s+sQK@7>P!8<;%?m*8H{5;zVnv+8w8VZS@F}v0T+v0 zL&I`+Cnu}7{k%`9XlGro&~7j$XsF>Sz|OAo0Llj-hG`WoHWl_LZSwRi`bXax;dteV z@5DvfR&7UKA~n?`r$!Gh{wnK_D(g<=#;CJQjmqUDKOveHOF8La)GI73(DOyCqT_@- z=#Wv-w5^VyoITyNE{|Ymre;Q~2LJrt5HVwPLWb2@w;XCNc4eN_GSrfqwtSxWA*Ofh zbP@J_J>O?}*=a|9osjU<%uItJl}F~S6fDPYJ1v@geG1E)&9w}*^&_q#;*opF4eY<> zLpDFO%}efYE!ik8E>84y+NIj&(RqDG3sz8} zh0Q}?=Fqg)g4uQDyyS0HN~LT)g+#&qmvo$Lp9|^sgyNU2M!|DSX3V$dwFzL>9kf`E>B0d z#A}}44F>b3A&cMjMrIi-Je34B5&Lv#kQ!uGRg6ZhrOTvaFc*j_b<1sb=ymHxAy9Pn zF$39uN14%E?tqx^Jrt_l)Y6QGtYGEh*39X{5dcc)sx6K@$*wfyR4_4V(6q+9dk0LG z_9Va3fD_tWhKU&giW(owUMWMvBC;DrRJ|My`cHRPI^nN|P1Y&#V>} zLoCzDiKwH}MoAgS9-N7Ff{AK(N!QDS0#hP1O~j24%oC30-v+u%;9Z6p@lc^`>% zJa5zrCT?BwWcaQ~q(W>hlubxWTDjOqiyy!9BtHP3xUjxnUz$@dD>^zF^u@k8uL6Px z@4A9eba}+Zrz_v$ljKgow!%hSCS8v+3}M#qO%enQVbJ-| z(1--NZwEpGt*fsN-}rS|fM2F1S2W{}L2%JRazXnuYco{$1j($RK={53hm!YxT&SUXMaB8!-v2P+t=3pm(5~y z%3cYdcedkO*ODZ0A2wJ^5{~g5QL`@>AAwcn4HM8DOHrZzmS+%#m3IE5sxs;()@FBT zUfgwhxJZcxD+S2G|9oHkzE?)#aJmsP2ED>cc=eeH51pMIvg-f8e4E|zyP&9vO5rhS zUVik+@9`Lb%H3?95kjfzC7wT}T{8OObSiK7Daz?oJ^si4 z#LUeNhkyXA>wPE-uLS>xR(ODL&0?E{bQpMxMszl)-|haKz+J*I8GGIPPYPWw!9b)0 z?&ke(#NFH|lep7W8-hWTfHk6`0^oYSp$RjF?S-A=9hP-;Pzk#ym53gGWZyzQgHpZk zjZBj-Xsxv;IW4C^UDI`l&gEmFr~$A6lA z+Z$ZKococlty>>n?p^U#`klxd zr_o4>2z)I2s!W{AI*dS&{qmu75#p$DqIjvhe1H4kp}IX0B;b-)Y%AQ@yS2&ZhbsubHWUP748{*8HMQY_|j~ z@3=Al;7`o5S6=NyFU@Bis=&bPSv&vH8F?#bkFQae;fm%9sS0>J=APDf@u)@PfBsSj zZ+!pp{mZ!@!GjA?qoz6x?Ib)~yCSOz8sUA?KYz3opb=nYZ+#psp$K;t8j*UXhwq@WH)( zsD3wca$rcFL0Xuy-I)CAcVz{uU_5}Yz0_ZPm$M`#I4Htif${(#0L1^(@J{cl4HGcW z-Yk7J=*&_Wgs+Fr7efQ~am?ACV7%4Tid1P#~^{rGxkIj>;9I)9u zTaSd`o^J_vN1t{6p+4`Q8t)$#x@8nV%mSQ<{PbLVp6`B!v;$85#aDYiD{r5>^wpd) zfUS;a!&KwH^#{>h47w*~gTtn$iDTp9td_6k&UeN`p5jIHXGU*50f>Kr$53*i{PC3h zh&G^1DFe*^dUF$7?<|%~&Ou5wzGc;t#w@hzTp69tp?|&dH_8N*nob8@S=q|pjS%OT zj{f*Iy&J#a;^GV9PWJL^%g1LC`%L!QGc~eL-MR>O-(tALG;)g)cy=bEQqQfZ0K~c1 zBT%2f4D@8Pwo4|rSk28h%mRXf=Uff`!G>Sf+5g;m#*CXZJp41H8oHNb0e*!R$>_5* z|C{zuzfg+0UL0nHHmqFLFP;(b{?pzx@PWWZ2QZ=!x9VGoMfK9osr5}S0~r-nU$yY^ zyS6qX8=Nsg&l-HelLEW1)tB_L_o5sYiU#HYtn$F;@u)OF|40^Zg@@!WUgF=^^T^@#u9Zu47TCfDN~%x|!^F|`;k^Z#lQ{o4 zIssaRdCoRxV@zx6TeCv{u7mLUt#N}$FRy|JhKG@RkC;;)IUCdtgyZfcCV&2z#*uEd zD_EJ7lv6Wg-ZiMi^vM`-psg7nVp^V1ed=_sH?sS^OqUtCG%s&aO6Acz4)Uei%SCZWVtQ6=_?CfQ zrMIv^E8VxfFJBR57B%y>iWw%Y%e6D)R()kzt@*|J?xQOcb$i05(*jOGV)bHpl3m8G zF=IYXow~41`8P2OG=;g5C0h1@jBduMm@$`&4DI@w&D-6eB<4qlJPb#3{Fp)U03i@%hpuRVXc)_&;V-|v^05_ zy%hsJn#k!6)`Ly=@0{khbU%tnNJp&3jk$Wn$L2LwV&Q6V4N<&r%XA2;ay57?A(d<4 z>l{#O(G3!ZB}7!9#HIxW3QJ2ZYb${y-i6X%o~}rrt!!zeYR1)YaNYShzAv2q|Hd@i zW|PF^tg4g(YB2aAX6^Mx89-631F76PF8qraS?IZ#$ZL|cH@5A2Hz^c!WIJ;d7hah+ zJ);HiW^Xi;f{1}m`BsdQi;DmrH3#&Oo?}Ndue4zXRhsr@ZeuYS z)jW$v&rdlP$rXG~7iy$j@`@(>I=WA^6SL!Ty6;GWImdSn%iol;Mqka6-_DoQDY2P-dl}iwjP2$`h+r6T(tR zVF7);E%a`xfgXb}%VR!1=-2P+p^LjR#&)<)JK50bg_^CX;V%;e;Yw!8YMP4vCfHA& zta%hv$U>UrBkff9^>I2BVNGe5%`S&`;X^xzlh|#N7V=6X{dM$- zDd6`-1LrR%g#?Xj4ONRuN*MDC8%+%_GIR=cTrG!giP!_eb>s71p|Aa2Rs;fBCYK znp30+3_~8o2Pm&NcpcO`wZ`R(c1IWYSSu?OWCMY!1`7bG2+e8U>IAu(cLiHRB=Wvm z*OS?xy&|#%E2S`ljX{!x4+@0{^p`p72^&d^AZ$l4(O7wukx8-VL^vc0mvY7$_H8pV z@)hE?7BUs%8gGH==sRu8k37p0izRf*Yzk%4(v$3x+ zC`_}BCkQI0ZAkHWn3d&=QBz*bOr zJS`xqtf67=35rkl+C9CnYBi3##h;Bko%puN?5lR0X=RnpFWh++$8S0KCl(cGRh7C# z&nZ*j6>U!(ORhhjTk9~H+O4fFeq>Rlb)58E?5>Mg=tM7HUq1qPiwzFiP|)upW`Q`; zH=8%BS4@L&~R;(iC*KDJn` z*Xfke2wgyPK*3Oy6j`r)=aSMs<^Qp}jC|N)C`vlg9?)KO4=ek!SE$RO+rwzg&%vAq zTeko`8Dh;Ji(3v_T09o;ZXz2So4K|(k_OzC-(H;X14-cnIz1MYvnZYIiI=(0)tc4g zs6;(7%D0}JqV-qt3jJSN#4o9OEbk*re7%>miB64S<;N|eVrvwGQOP<~5}^C;zkcG@ z&c2RCOLO#D_jvUoSwunb~kqbLKFpHF@82{i=o}xQa_!f0OIH|+ki75R)tQj1sB6;h)!|Iee&lD zkmsl1rQ)CsGR5Jc#O&<2(1@6Nr%h}l&SPvv*L4XAjk-=&rcDrLS5 z>?Ed1Ak`Ri1t2$TWfip8l~O;%Q%B;iQw}%)kB*IwhG`Q9nXd{TdU}G3Q&3omb%p8* zd8Lf+8{amuDE)4!`_A-?FdaYp6K~uxgia4pd|E048yg|6M)jqzthehu3VmN$St=(K z1$1)hPDFpaas)#YH2hyh$hbUbD^7&ucv&wsdVp1`Cp40kDz40LxWam}F`er4va{{x zn(KU2`lj*ai1t!3n&}siGxH&$k^v>%pdfViA<^O&%SNY9nlDsG#tVnlk}^`l(r56f z#QdoqT(pb5BGBola75UbuOJOsfCNa01yECrSt%X8CrMJX*3Nc;P_ZHp?s)AW(a#eCXO z4?Nt685O{@h_?X80*Z74KfoP_b3`En@w2{2@k_MN$v=0zm>e|fal?H=w0;=hy8L)q z!X3+!#z}yeH*#mD_PrAI;}G75t+N1B$Qx2X=oA{nD6mMWaX5ng)NGV-w_p zdzNKBX|=j9T6_0E?c1`qD9z_F_V=ZgF?W2tr&)BOMO6keZ85 zB(Mt&b1eaah=dSq1Cg}0?zcK<_^R1B3Ba69O?p3rcj5qnLlCHE05LBs0ZsC--M2O3 zf1ly!Rd*5T!vvMJ)cUt}YVCCP`Bm0WJj=HK5E-CzV@VbjweI@TT)Sy&Hk($3mZs*k z@GoP#fITbE)GY?In9{c>?|G7{sBrH+Mou8gIPf_4hD7?$pnKi%m?SG3$810PF_HE< zj*bs}c9#5ob36oZDkAhe~)-> z{`9tXN{{`?X#@)H_?=f&L?t?JjG!g^5+QY9A#^IBG}7+V9uynqxKwYV&U;*fhgR!e zH(#!1$2Avb4NXuQ@TJ3{Cx zJue?CIORWFDex-?u(87;fb?{Rb=U9jNa(-p%hW+Alk&WV*NA2dbRh20wlG;eKbKXUBB;=%NM9Hd&{P4Tgqz<^0DJkqD>~;QFMV zOQkTZP#GK?JfxGFwsw-sq9X;PDqFwOlDF5D517z&8Fk& zc#gw%BdRu0Q1sDx->%wij|3#~m|00HHGS2v=aRan%SST&vu5C$4J}aDu@YqeU4#HF8nX+767|hevao^YMw^-TNFGNb26sTwN?uSLAGM)VAUHjTh z-r-myuGW4ZojbD>fZ)Py_VQuEY(&G6DyK;kfsmB`Q3G!L<-t0*`5g6pSgYG9AUv)f z9T!0mrkI$zS2Eq*Z+hzLFw#X0QXKsT!cYsC;Av`4yuzXaAQWE>&3QSyxGCJM5G;s6 zV(ARyT`~kpfwqx}dAKtUZn?8V_^6=M2{0}~b1+(kZ|zRuf_=Wk!c5Fb|M2}gPEq;U zK#@HBn$=t^V>p3Y-`v3~zIPWNF>9{&e9l1(xNl5cbGwfF5qlBHAu#aso|Jij5@|dw zPuPg2vdfz+rRAvd_WTUJr2Wc)TRXMe0KLc1nCB`fP=5LS$~i3M&%mRl`q?-xpj zSEPoh9ygB51E`GxHRLup4fX69KF->p;nF)V+xxp<_*}>VYXkoz?-~UR-!@Kraq{QP zd;3$<72ugCZ;`+Dw1q-tua z;i{2}DF1XrA-z_dS0!Zn(1F~x_>!ZDR}?dww1g}Oy(n}H4BT+rDK;i0CQ7PnOw0U{IAMeUb~5sPkJD$8Ha{5pp++k35r=!BRt!RB3v z-Tm1|$|}sifB&`_oTSG|h$azo1z3gNwIczo}0>n#zJGy0q^+ zWgHqt{%&^b*z{*)96+91CRd2rlw0U5oR(-%PD8jJR=k0EYba}|glk-R%yl|aV`4?D zfZ|uecV>_!txl9#&?RW-<bQP7lQT8*f=cYU0;Qd(_ zWmHs@vZki2k3k8|E%gvc@$_u)C^{#j30Py>*xdZ$1hxTM4I*FY=-mCr?p)^rl?8LA z;n?bU(pNZ9@(KvVF1?olPsf7hU;z=DIhqonidJ_FG{iE#LueH}!KAz^l+FEU0lrwO zmfPa%W99MnQ3pKyTb4gKHZ8df-qkf1a8Q;bEGDMPq7(6%p>Cmy#W_qxN54g(Mf*vm z>`dWxsCrUzYMEMi)(LOQlF-|UG8Zopi1E8qCfp6i#Djh8rRi4qOB~qsP&1F2QrIYX zE12Zt2za#%3vbni_A0O2R6V1{*#T#H-XI>eL}>Hy0Pb7UTk-2YAh!Z}I5-nEg<@Gi zoxBZ-jP`uS%sfQ)Tv+*u_QKJLUl%00y$Q)9D#upN_J{khIX30P!>2Li7J|X_j*g9s zpq@lKW$QU>Jf;Xci`?bfgoLJkv6`jg)Kc~5+K?IhMr6fdLmQ%u6~M^N5!zw+gm@v3gTW8hN7#eP#@*3`A zl_OmX{#=|4WbuGwYQ2PUc+EnMMe^TNt7I|~{#;JO78wg7!TzGu*Jft1HAg&5TE&dz zj81mc{9s07yG%~C-z-h$4L_B;)FVuK`rT%)8aU@QC2xub&_GRFMBLd^Z%?EHZn3ew zxt1S6GyNVPxK0RFPt=J~N&rvnu8cb0yze)vx1JyQNOSuYNR**Z0(8!Lz2|&Wq!uUC z+_Y9doGUheeVhG&J1gKi*xD9471|Y_b`*JUbAAbw%{5*%TLwS_H>=@ev#SS5He^&3 zeZx{mGJrZpt~*iu9~F{L*VPNOogHv;FS-U^XTYMiIkJCgB`vTG)PuSj9xt*(=GG7- z4PxRnA)e;%|0O_v=oW$vDD+Fe%f0?(h}frn;cnUEw(fX!+1$2WvuNCWjplg38Ugum z15v-uELu2uoOS8-2$~D*J zqtpGs;l(%wdR*#;J~}4BMuJS>KWb`%ZUxM;CeK7q z!#uPmCzp&iqUt-y=DX?NU}^t9Scy4V1u6B{FEAt}g8;%l1h6}JMF+1m7Ql>HU+x=> zmcuSKkwBG}8Zhoq1Jh%xMib~f{9fx~;ZPg{w-9Ebjm_855&kU^@lOT|dKxbm-_~r@ za+X#Xno1|K^N8z8|lBLiLX7$LATG+G;5ME%=~djC?p z?+u^M)`S6y8<22Szg5<`jbQ`+NTn;Yd&CrjZd*8M($j;@Sjhy_{G`D*;5LnYPsf5s zn)_u-W2fGEpAP6DcsG~n00NaGb#)U7Xk#3jp#W&fuWu(gg9l}!6675f1a*?1K&OQB z?$$oT!~{ngPPH_9uZ07_x{1qSA7Sv`H(m2*OF4LaRzZAo2gM^WlA0xEctch z+m~p&7+wUG!Qw*YVhhEac7nngt~(b%aeJJj-ybIC-hL>?I53EMQLEx=sI`w#W8TUR zdWrK-DGyT@6g8Z=Kgn1C-vpdgArL08QHe$#>Dw(Yb~5|SXlL^=~A9Y@;i zVb}uAEtFmn3ld}B)s<{)V({`LEO=1ajPrA~v;<6#49U4iMt*(A@spr|^F+;}+r%cO z3(~E^4aZ1v?$;w1n&$#mBDt9$Z~7@fXD2&4;B39Kl{}&vsCI1So3kbF$Kes?>`tLe zifnf(Eu9wD*6sYs59|3n@DdQN8Iv^)k~*l9h2~12weVv!O6;T}C_W}G3@9`HM!QHP zH|%Ir?ckHv72DG3$|7`WsoZ&Q;^!8AY=5n_OLxg{Y~B<=lm!iHID1a-oFa8nF52fI zsJBJ^@g*}tMy>|(3%h0RF3>4u&-%^^gN$pOoTnSiOalzeLW&uPSWl6aQ@`n>1`tvw z!XzhkFO|_Tm*VDIJX}m!=o5Y7=g(y+Y5ZWll#Gv#Ud{mynTw$nS(xUNFCZNHt&GxP z-#Pk=<;wukTBl6su8_cwk8wLQh{+n71blPJE(a&asr4cOWMV3(e!nOG^E#J9*`gB0 zoi}Lb6_8|{NufkMc+kG>f*n;7LFLRwNQ-VJ;diEWpJICV0LF}-IWO~N*m3c7`+H#%`LoYPm7pBGaQ4<>t>L z|Cdh#yyIYb`Q{M-Ef1jhJ+!{?w;Yu)$|597l-%>@lb{}|(Uu=>fK-8+3t%sL%UTKh z0Ehx0&{^3!ydZmUq0L8dQfEA9%5vdGEA=iedw34}yi~ct4Z1Epj{^4lpvb|&6~}D@ zJOaCo-Zeg)VZJNA#tnRKR&Pt_e|hPh7J^KF<-uRh&cmcWTV>*--MggsUm}wR6vJXp z7Jdr@T(+*RjzCM|6z6)aF?Uk9m@PFAfC{Wq+BJ_ETo&5!hV^{4t!UVtQAvperP*N> z)$WQ;s>wCpBuI}}gGUM?+B#7iMSk*SAwnIv*+OQ8&VC~r*TjOme!M_UNDY8(ujZ5K zfdE7=%%UrO@0G{ba%Zg({vC>JZ+f3M+W8i(jOxX^*F<*uMy>ws!ELDf%t}1Cw-UYK zk4}~N@W;1}1(CAcsZ?oClK$XR4gIDT_tpTPe-z0ict0NWn+P&Q*p)`L`)g0ZLi1_3 zIk)-qO4Cy{`saPNvR-Q9p8QjMTZf3rd_duXc)YOpuLwSH02SS<=i?KDB0b{@jJdpC zy;2sYC84G+-$nxP9%zR>f{Fd6m5Tm&e*W^<(8=O$Uip~Ql!hG>3lpNq(aZ%$QBe_w zkBjwmW1GTsbOTXrjb@yPZ|(H>wrG$-4>8m6mI6AlP50XG`7V1?)^zwt?sc7U8*!G- zT+%6+kn@^QBo^6yWV<`8#-VMxT%`8ln}}o73yVqnN`317Zzz8Op%&CYW9l{W5r&@1 zN7YG~TVp|Cqmp!{UOL^eYLvO?^(1k6okpbxsJStXJQ-SL5UP<-vg`)$Jga5xxByZ(7QV{0RAvxFOD=lQvp=r2`?lJnm zYMjXtIPl=bvGc!{!I-1z+}d)nLxPS!8ZtHNR2NGFHIQ~f$Ik&`0xGT_gOd0CD-Yj} z(MydZ=Wl-_Yh~HM(CN;>VL}j@P&VveQ6hQfjsQ+9xts$#)zjxfPZ{a>qKiuaxKOev zpI!JrT`ZBZfW886Jj2L&yZ7Ly*BP}@XPL5e?~<*x3Zz{b4NhjY`feMMu>RZc*<7qf zYBN@mc7DMV60@BXLiiqo_A5F>$xp@n#~^BwaG>8P-g;^X*Qni^T%9?*2K~K2mr-?a z_`lX$K>VnLCB(L^9RGPGl&!6+o8UZCH4PUy``W&wKNYvFCQeWzEmbq3@+Cs}=|B3` zY?EF1yvlbjPEjQ`YnlC!z^3t)qvGdVFeV@k3ZVZ&RrOmP65?!C&nqfMI`TGf z&yRy9^(1D!tC zbD<>lD1@52_!C@mmop74k}=X8#UK#v#fhp?Nj-=v$j(8SY!L zcT`~lPE50EkeX*kru(A3t^FNfdxA&on=c!|oM>Oz=bqjwW2B&@%qAeAj=K!U)H9fQ zC1WM!)_xJrCYk6sAQ-(yWY^|6g$Wk;wTA?XWCT=rSlCAm6F(R7i3%S$b-@7XtKFqu z6KBCi=zi!OdHGBNQldD;W^g@965u&L9n?TIqw6ow16<}v|I%1DArrw`RLor1RcMN< z+uM9;8DkRMZQ^tD* zIk&NGS6CbJLM!`IQaF=Bn23oEUd%}Bz50 zEmk<8yc>*Fy}3ER&lZa{!mdB5+k+#`TiTSX#bt%1d9|Yj^3-}U>y$MtGc&5=jadx1 zEI)ksO9g)R+fM?JNo37jVl`t`j|_gleFMGQ{9VsGHhE$JTAqPE!bZG@R;7W>S!dm7 z^5!@$yS~kVPU>KyZHI*`23~d zK^Wo}YA_q9Ev*1Gm~5#Ye6VB?B&#h|UDC5ao#pYaPqsxV%t^+_2Q%mGwLVZR-(f6f zypR7h_e*{ulau*jU8aWEJR9tQqhg2m7ZsFAp*Xc7>rO;M8cM!+&;`mQ!302*XR^Yi z&qk&z7BB^W6t&7&G?a!wE0YKb^m0;~L5oM&Q++{<+)j5 zA*=o$3ZPY#s95JpQk3rw_beFzRX_!Lzm1b~0Ey0Nei)>Ck55}0a~rO=Zn%wp-4>-QN@jDF&6RaBY9B=Lef{)mHUN2?jN$in%(5Ee`|zkwAbK{@-&A z1&NRKD{~J3=yWiY9pJH8Eu7zWE^>V|E?u1BL#kGhf-kD{GBei(r`=DdI`EZ;GK)fS zlkG;)ZsL<_fc`0~N9xx4*&u#0@5U&W2dQg?R670LO!OMNeG#$dKL{Dwmj$;PhB(jU zK_Hm-LPLipVpy2Oiv2G)6WKSSq8^DQiHq{F7s;3E>1Ujpac%e&7k$hkxJArae4=7< zAaTuWjGx^Ye`TJ|pw}Lfs6i>b^8U|$Z>jVtU*KP@8+mB~gbqqVMgMfPx{F~{IWk6} zsNW6eZ49H5H%Z`WaC73iU|NJFIqmTBXI}3KMa1m6$SFR|J>gu1(-*##W^r$zR zT-gF$1gy1X16^l7M~dK7jN6wN>#lw^O>({wg~jA=&KEn08=IkjPi~S@g1XoWHn*B-qZ)r?`Gc_~R>a;0}N~MFA@I zf6F9;h-5UX>C>@Sgape5y1Ua}Vqx{SRI6rX@mXSo7A`r49NM6DhKx|)IL^aL*lj-@ zFzKL>8;szqkOVq$aa|Tw_fD%R{Zsk#3;F-;ALR>@mTn*_IJk9w*GZvq|ydh_1} zHgPl#t5M9&%KEU*q6+ki$DtdP0IU)EU##)y(IcQSW5_-D4_R_@3i@!!|Mwf>K$EB1 zQ=WmIz#Yo-){qP4rQ?-FE1^czNg6$DiN)gmix)jWA;X4K6DdWTJC0vFUb>BjJXw!# zTi?xPxD#kQoC7ALxB9taCP9Cc(eFP_ni9o{fmL)cJ))qcE$v`Yrr(3jS`1H(cfOO0 zNGJgII&e0%&Q^txsK`*+P|FelgT(+;R!n9AK9#VVL>L)0jtAT zu+$Oo$4Yy<$aHK`n)iO|a41o6TH;R!>%Q{s=G(6IUPqTV#F1V`Z`D->F%DCk|NS2Ee(^7NyixzJnLQS+UM+Rf7tV*fb*YYJaON@ zCzCs{X9zj!Zz+&pF_aMUtjE%dI3zaJlpuIt`9oxKdUzT=2QwasfI}gL@TrDk)y+8} zU^6{c$xF9rOmy1Mw(xQhdznB_FXCXxhmE;x*bW(^eY_)LGVuYtv^N-IVwFd95}u(ff>@m z0ll>K_+_zf1!nJ9!=G$OA|_Vh4ykc=9w`vB0%IA(7xpWsemhsjqU8a9Grd1NcVN_a zIC?-%193CBpXPh!?BoJ7Tsi3cbG<6yy+)A7?n$w&4_pNs_ikYCFS1JY8|PAA6&rJo0d?=905Ky^@4;+_){ z;rR^^zj1Xf^ElariVnZ=e(Pmrem}4@gW1bWi`(Kt`}EwK?!PU8z~=ko1zy1t4QN*L zVF{*!5D`sxx&w?-W&F`Bu7n7C~p$L3zq&cVoMAA0tP-#R=&t@?khLT+4raepx>K$A%vKT|iLq zGPP|5yv+yNvu^88(xxFODq}Tn*8$dhZhZf*LgvTa#S5T_o%{rWcwjP6kIEHtCgDPE zB{D~bHRpJ3w_A`1iBgFw(^8H_b5lwm>}`M&*nvYOIA4Q*vLIkT zxI2AXTFnn_ZC=@Vc?+@Wr%$$A8kqwbJ9g2&0ToP%HR1X;@plnnP2i3$9jcHY5H;W3 z5|guS_1Jx@ck@lRfAS~fBS>rD6>H4vyIVjC`2{*ySp^L$f-CbtO9|Rrwp#)pK&I{F ze3F?7K?Tl~&7E!D6T^XPGM);Jg1}wX*_dauHM`Fv65`sIV41lsFDR8hX__|rNT^zB zQMv4J=dZoDR-3h$1bS09C6w3&1b?f?e&9h}eSBBw_*}|@WN!~t1wTfZnhK@8P$TQ@ zmU2;mZolAKfUT~UjFlB-TZf+~TBG{49+ecuP=gK3fsL((l$Q>HqezBI3cPR2*&;Q+ z&B-acvWoI>0?rz^ysAYaTTS~MQrTo=--##~2!J3doB^(?dTM)j^GPsyP~1;7}QPcvxw&>BH5gDs?FYRJt+V6WmX(TvUXAz>Al!Y zB0jpP5B%<-FD+HL8IXY3wm2_1#7Vz>O67BSu$Zn(Zkp<O7_Bz5wf0U;E zE8aX09X71^Pw?{Z&6OsA{6i8@6ZE*pfbLC{3E!RM{mpZn>$ClU>BPS~CU`*a4i?g* z&07TtrgTJqTpTX%Tni;W@s#@a+cf({A6{b0tpekz*}roIfAV6eslx)sO8)!_6e@xp zI(ZkK2m<%cCE41!xf1bIAb;U*8-)Vv5+TUhjc=RdGOho7Ig$}lOUI_SPltJ+BrWaN zLNQiuo}1fc;G9H3>1Q~2{D)MiXABjASY7=!7pm_o{oDVdkDzMuVHJ&+rjnt9lTXa; ztJJ5rfE~+nXTPYr3%y8_t-WrI!|+1|0iWgnJo39Y@a{*_pgH;YC&|vvhX25>xQC|H zI!&rU7dLPPuYZ~2C>nbJtfSaPSTvGIuLBf}8s6590Vvl(c{>ojO&W?>I4J(H%KN%Y z!kq@i6)Uu^)-1*)!c&-jFQh4@_=hh^rq&UdGKQErGfBzDT<()uq!?vpftG~XJNCwp zKVE@Na?IW-e;dW{_x8{%c&`LnT%5gP(Z|f35+Vz{h^8AMV`nm|v%1ZxE-5PMo6OE$ zAUm1spA~(PV22% zleuLn(3$SS)>LX|f{P187`sv+_gIa90EgJs+!M)duqw~s5=S}_CKrnd|R&dA%#OjT#!y`woXWFYyh3axTRaUe%wO>@W_+ARk zXC(@^_^&j|wD@~^j5&*VpO|Lnv}G=CH<&MatRJ4iYBc*}<-FyjU7c{f#Pte;cU_9k z858Giv%1zm3T-cYZQTRQkn>Leb#nRb{IX|W9%uwXKZ8d$Txq@m{ictia#jcG`tD*y%8AdxyVUM7+DxnG zCu2@Y=8mJ6<%Z9)=tO+T)s!bTIzC;RClFIDh%h<;J;Ql{!HNa%1>$2^Kx0j_(#_A< z4%zxWw`MM7ueXTYHj(1K1=R)HaUH?r((QiQ?}{v6zRqkp8qE;3z4>tc(cJ3&*!|Ex zQ}*1iI(~1S*TBMgD%4aazRgqgs4Go>nECp<{8TZPX?p6M@=7D_Q^Z42nUZa=ql^ne zS7v$><7ISa%woMVh-d{$>x6xj)ko)tgDYvVsslfM%S~``-oY@v>iYcfHP}GNM7>d0 z{z%nbdiT!9dNJaURmdp#MR;lSQ#P3H2zot3t+BQyOvP2X&pLYI0wN1~N>=F0l<3rW z<|0Y^h9YXoN^itS5+*8S(6;0$-(80eaaxNwO5;0Ju{xhvMQ?hl$(3E-S5ei-DwA^< z1$LrQfw0X1A>k?rN5SDv`M?f)waz0-^eC77R@>0AObic`_?q*L@k-+OG1$+6-ZYq{ zQqh#GWXMlv2^;zzGnJU$N^bx+1Y6E4-vkVA2eOQU90UYmVQAxUQCSwtyO@S}b_?Dy zW-G;XxwEZ)>@(izl=8MRpEq4amfSkC%Z>6jwCrp}yCPV~LDDlWG|S?7+FG3zF;A~t zDKAFyj}@L`|2{rh&xyGzv^0M!>5iqS6gzgJ-q^xTaev!t?p*`H!IkTg2=~V&p{rSk z;%dct^Tb_z$xpvU9nyY{oz#1+Lh-c*XD9MvmCoz5zMgNJBB#&WC{YCHMHIDCl$~qE zblA#!uL73F;LLcbZN#tLk>!qt_)}Q^e4&GPR7X<>Ga2+;O=%(@BPUbH8%=tK;Su&~ z3@D2bBAA%v7R~dbOwF4NS*|5aoOgS|Dx;MPNB ze`kn&#=x0~9$a}9PTQ4;D~}F4XjU#=w4iZwVE59K$pdCM0aQo296@o(VHyfyC5NjIM#VQC>7q7)Sfn+97QP zwMOu-xU?1(HVzh)Je}Nane}BsMBb%csu5>%rWzq=%%SB ziYCb?er11p=={zIb}YGgroWFw-r2p$+Z*7{y^e1O-TYw{v*{`8LV1oD1lT4_N1XBL zMP=K5`fqMzC<+HUqt2tbrk6b>N>?61|Ma*HmhJ)e^F)Z6P6@ zrVf@bctJWres-bvt#+iK^zdLZRR%lsQ7HEE=5|!dvzY3{<$UrZiqgdGICOduR>{(o z1D)6y+%k+4$E3@?-o5}57$?PihCMB6)Mmjb?$e;%A!&+f#tBZE7ub8ZhPuU+XF9y5 zr7_+ymfs%oU0n%F$hYE?2gb!*JH~rmTS0klx=OEjqH(hpvp}Di(D(P4Wg{k0%%6d* zMc#%V)UyYv6mW~+h|>&?vVE^MdPo_o6GOMQb8}Qm>lxI0k<-e`DUR`yIZ;A8DPxi7 z426;zLO#2=WOTI4JV{m1$8Eo4&KUiX>>x&6>8Yv2{obvT=R1Aa=uu+p-&80=?$9R^>+J z=Oh$=v*RS|qXbP09@A3A;Zl z|GJaeqa!UjW7DvN{p{JZww#u)T2nknI54Zk4!%?`AxSKz_i1lq+|gh4G$cYZVm_fF zL)G+va84ja##}|OFy?d2hZ?O%PaKL@kg2sLg2!w78Fe5vxwQ(!)1^BCSDch%U)udH zKPOncQY;iMRFPDCSNN)@M#_fmliVTs3!V*f-|3SX9}LYYUMGj*k}Tw4q>A%%!Ib5f z%32fof+>=cNRV>}X|2X<-bmcY!LerY*Xi39e>0`Lu~*J%(uEpE82ns-fwc6RdLkDW z=8cJ(W01XEIj}ntY)j*;rK1&j@av^cmC*I^ifJ&L9BWFpvI4;Ww7C2-W94TTohOKX zr7pGjYhHoNyLII96{j(IL@YR`Z^^yOQ?#60DJx=2Z4bOz^R#s2U?=9rZeEePAud?> zKV^su_Q!#CJ*`E6&{MMJyg>>bK@p;t+z`E-9QP(}SKz&-acRshaoIT$WVcjn492g) zxl3AOnH{*OeRU}l_cM04L=~3GbV1IJyQ1B*Yu?a6$K3Wc%a{0}LT*be*;s?*yReB? zq?NjiQLdPdV{N0aw1j37NW(@{v`#U~kd>~)8RaBPN&#QcsHfvs&X@EFl6bFP@Q8NJ zMpm(rVqV$-;bv#rX7mv$5SNyQ>=x1afu6=a?heI|@=|sZ!KrqZRc3}4G6r@UCj^lxCuLvW;hkb-wAjYVs#$>q zt1R+8aI85j%Zv``=LTE~;bNs32Pfn?BxV;)(qj|_9+Wwv%NG)bZz(B1N!3V?pjBQi z$Ujmnq>?06ma6(Rm83*D9MZ-{%Di2gX{^H&)MVKMYtjv|yvjrX`OV_Z7LVe@sD z`3W5P%e&?rWiSv=Uq`oEHq?seyU9pR1ZjD>Gm}paf%cCyp5%zELzRXUsZ>dH@#{09 zW@QIfnV8JsnUEQY=*@$VAGHao`b8bW-&@&?ObF0yFilvT$;O@9m)00?3mr>Nxq=mW z(pYsuk@xYKEecJ+mw0YhL0`ZiXiZ$^AxY=t7UysFhP?iy{61}acU+oetrKT&b3OpQ z8%jA|oDkb;(!No*pe)%$H{nS03@k6L6wa)M(A{^(q89FbrXy;JQUbor%nIj}X#?g} zI);2_p0R(N7IcMdYfB- z9O-{#8vmOlMf97!dF9A^(12EX8*v^Fgb$k9p|G7&F3UJ!E zG@=Nk6T?N3WpV>%HJY#a_&#=ZnbPaEh{zbhHTZ2Bcc!|i*Q47mWK5jX@VdC;*kBaK zfc0$PORS02wY7!RT{nC{3mS8t%UV(owxqZK=(=?q=6xHMB%mzz1Ijs|hyl9pw`f$P zkQg2w$a6d_EUAcd1R=L8hYTLyG-XD4j!-0QR%C!?l)-5@zP?Os?F?CwuCNojFZGL7 zJ}NOt$Md+&pe`%l{QfVX0$WMrwad(Y2Kw$lLZ@|wvdI*i34Z>T>OQ1>esx53gBcKT z)};uJexe~JD@-!@^J*z5v1Qbj6770jc!SRSTTP3?2py2klT%TUGBXnafEB1OI{V#A z>7vz@d9) zbDxxzmGJ%hf_m60{!!}TXdEUWjC`xiu6_opWabtYLw?4#a>V1sx_<5A5u_xHM4>oX z8}8t^Sh}*o^-Sz2?CI(G91;A(d7?C^&$Kf`xDzOY5iBe=<+Ub0L`29Q!A`QOs*pih zMZNsnJy1dg7KERDed7U-K&d}7DK|Dt3F$4B_HR&zcQQb~mz$fj-ni{~O!VFNdLVM) zkFo(v`smN*Hiqw{MA%$= z!q3mo#lCXshKT!IVm{P?#3y6(%uGnREyTN6o9}&j3=6M7FaEKm?H9JF_?& zcXV#@zUbou<}ush)Dtz`>4GBXU!K;&Af`_~Dl-3}rNVBFJ=a45bQDQRc0ZjNbxFcLJlvC;ZY@*@-X}^406Ertlbk zhv7PqI|;>$KI&Tn8bF|R-IXLUYyTm;-|63VN0JpVD8&8j>$_)un*940gSTh`;SCwk*RgS!IaB4l z1BoYdXVfdH6;0^e{)qKkRTaK!igIw||0nKU@X!zLgN8#jd#nJyEk7>*%oxk__S=&j zStzZoH*phrkC%Sj`?v&n67tPq1+qULwNEt>KoeGjF_x*+2%0|asin7>19i- zq~hJ(W=oZgl;rmj%p^o5jD==ze3|CAshf1V(@V#{3YLqUK#uIr+Z~hxJMOm2e?i;X zUc`DdqsM9$B zy}Z3Mq{;WelKvmWyKdm!Lx@>Wf%znGs-9D@7`NT8MRSW=H9!G*&@=OyN=b?N`wc$| zevFE|aUUMU|BHb4_fKu907@m!plPaHZ?&=h~13p+NZ0WG^}4FkbhF4V{Inu#3|LA`g!aE z-a%s%l&Cpdcrnpa2vf|V0Tu+;bhb6aVfohI6WC$mHf>G`ANg-u-bHB5hlq+R=*>J5 zH|2Xki^{(sjog{nHsX+gdsMRBTEE2i$ih1w@z)2$ro z)(PD$xxJZ|#PzON1P+appcQ1fgQ1JW+oI`d0@?p)@ZLZvD&wJ*J&ly-sMyMNtmJiu zkG2$nv-y1Hnu2f75Z~&eHG;v{93}i@w_8q7_hX!ld*QVI_|(*(PuH5EFlB#>FVyX5 zVl>ln;O1{tP$29%cS0rV(B&oXzWGRb@=1!t+>>WlJ3^ONMV@=j#By_JXfy2W`Go8q z@JF%qEku+G_Hsfl4{f$Yu>EVOq=`5Bn)}ez65_tvMe`nas-1K7H@$F_TDBlVJ}k3q zE-?nq>U~=joV<>N*lw9A9P42Lxd<&RrHfGY8{-BZpMk#%byvK)xOhSv11+ICx))l# zo6~tlg9%-l)t)e`UmeFmiyKd{5YQU3d$SDRYYZ(f(J#HVFG_1&x!DVryLwEOeG%uF zm^WqIf1yhqR7pd5lhic^7GDbzrYJZ2L=l?9D71TzKx2v#L{|I(P z^l;iz-jpC#DS`~XzGH46`aSL*0D1uQ)W=#*j0tn)Pp-|-3};VTKg;+JEHJh1aX}*Z zB8cOU3*W4yo{kS)owlOgAn0y;UY2PS)7-x<+CjgLNV)diWGUpUe73Gvl98~5I-NR`Wgh2Dh8?auf$ z7tW*OM6SmQIT1Xy`4eWz!v9mf0jVw}?ML_ZHTP)Kfd>7hGhv~x;wRUeb6i?q_jFXn z8q4cv^H&}0kgDU;GP|YO-Og2p6T^jL{=to*3>zm`)C}*R!N-D^Xlb_I7&pgh;)C*M zk3dhdxI0~o&jEYw)qAgJ2u1=%>Jo>(^C7JQ;~%^QXH9QW zk`SIpPVpY@&tsbq!!q)cwU`T{xNHf>=_?He#{xNTOtA!xrT8^{&+dEaciR(O{qjCd z&uU(;bj`{z!bNEHo$pzgr{n#w>wD@e@3kCMe>i`faaeJZPHAP% zT{+B?jV+JmQ)y*0HUAJonAp_rFVdS%dQWFc>i!a@`%vlnUfnzPy$W@+$bJy% zdpwc<-U~DRbk}=*?uNnZ;H)sV+v?3gX~HzxQC;;nw@v<26Zf*0t&eW1z3F_sZW{L@ zJ$2jB=5G+Tye^lhPPX%OJWAkej8f+R0>2*FE>2KE%f@M~`WJ_K9gun;2>DHe~HoDY2fmmX5USpU@rUN`cs{r25P4j!>b2~9y}KE zzL}W(K@j~Ji3!?)6H zx@h^h8R8p2RV17vbGx9Z4v(+@W8u#POQzT_Z;0YFO`dA}|#_ATVPxwBZ zkh{tjcE$z4(0rZ}pZ+bOmVn?9Ki%qLIw9;#Ocv z>YmjxgTXssq55R;TJ$R!H_s6Z(b*|u*yXjO+W=zgM;w*E2g~C&%p_q`l8=a;5$uIYd8Hlolh5fS)q z8F;}E#rM-PF^w|omYX-{pP%TZcPF-9kvq(L;#1bVE=28n?$I0coSO)-H@U}kOK!f^ zytsjaDDviTZO>MY6IY3PqKUXMxizHDdymK~_juZ^+X3%O;0(S%Xj$0}#r2{5J!a1v z6yK6#*P*h=%ze=38_Vxh_oyv2fxkj(FOWpYNSAXUa=DTNhO(X6q2(J{H)y`c$Ii65 z&$dUn4DGl5Ln}`7TK#OBk|UY4ThWmP8xRG3O!ndyh}{RSP8E7M_dA(B}%a=SlTZ zN7$TeFwDU7A?arN_Zy$H-czYLv0~QMhsR4d*9*d@r)DjFg2!D3SKGp;zlkRn`c05W z?IT3g>M%?YgY@fCU*a^f;w-El=q;RhqNee2iZv+ckBRTA?=`yZUJ!jx*p2+V;aVcv zk$dstq^`9yFh%vA<$R!Pq;qDS0rBzU0joUrx^-QGi)}~qP_7#JA6i!Gc3`ByNuPUZ z4?N257wXQYtxoweh7 zn?xVk9bWuKjc9Z$&0vcKG)D16RFQyb z{y?CCn3aLwO*W;hX3nVZ39V&KaLyjtz>&Bo}8KHPQSrcB`X~R|Grdd`Oc@hzRv|pcdcdMRL_!CvGq`SSH3T6*LrtgX-Ukq2zu0T9_4^AI~i}x1Z zvZ#_7>0aqDSjVTld+|AVc%Cv&P+M$5 zqjM6Hl9LU8v-96oUYso)jznaFhHfW7u(226n7q_kl;vwH$iMfC=U&Q!4lpj5~s#KX-^+oO_{+mwlp4TvY=Wg1oJaEOMgEcT+2VY&HG zn^J;n1%O)M0|bhC>&{CfiJu}4ad)z9_-ml>Cx%?-(@bABoedabFdpMFdeS(^^|~-N zJ3}$sHoEW-pn!jLSx(3m6gEz5itZ0BJ$a0vUgeR)%+|5tv?#I9oSmEfiiuMk&Cuol*TPwmL6x@3S4{EKA}CBvR#fRPf$mvKgf zJlBb?TU0RxKt9QnrSYl0p36$T72DmNo98|e-o|%!OVx~=92u&2MTHi7zlwOBkVZ^; z6aI#Cx@6_l$Rs}IcWHVUE;gOJhJl0O|NFO7*6zDoh&hmNnr_xkz%H(|Y({otCI8Sc z-Lc#Yo<8))#XWw--Tz}ai&dm>OnO5>GG?xh!^x9Nqv{XC-+#Js3RxinDMs6rf*Td) z6xKMyfG8~UY$YeLZfU;tLWb`=C0&1eYRufyS{x_^uUDmSzUcul6ctALu=-J5%M~#s zdsNW-Vt#*5&|7U@-@@Fyjdh^;!_C=(oPuUoP~!6!GI@R(Bs0#ND7g0FZQHOyAF5&w zx?3ekW=G#cxf-qYNBML#6(Llz$1A&Fi3pwqB{-X zqZ&>AG@N<~z~O`zUruH{aSje0_y5GoEoJ#0_;{@&?Ec7#yb>A^1d9%sv#~R$dy3!# z#&Db-Q3-~Ojv6Z~t1j*E+KzChs+Ovo(kB5Xn9oBmJ}Oas-2I9&cTrMC&cASD-r!h0C{F1Ej9UDX3KG2>U}yc-_(Z z%!G}N$*r)9WRn4#t1+}$ATSj84vKY}2|#;VLQdvKjinmU#Q<*>{7DQr=kBzC8RXX0 z$q72^IypOUzI`Je61ngycTMa2cKf>efWMA`5vHovaJ9 zY3|spl(PBH%@=5keu#n}N|>5Ide+V41c`GK)B}>(XunEUON#>9#c}H;mB9J_K*cN{ zY4XT&_ch|&jm;Hg5bY*t?od|8TX)JJVHmKh8M+xbZM!&c&gS=1cdv13XPkMTK0Vkg zn!hBPKbyE2m6H)j0T7?dMYTvM(_`S3b7r0phnEgFFlo6xhOp8%SR{uJw1ayKp_*Y3 zF=toF_W`8}Nhz`6{rxud)bww>wE0+uN0_;|J`u1twPZ-1M217`FGXmMw*^0OVJQ_V zg&u@RHGid(Os>7?8St?_N)48S&vqcqe2>8>SCmdG0LQOUdr5X#xc&B*NO`21CB~}b z&KQYCWcy~~qZ1eX=UT0BW|Fej3h8cpz#jzII1tS@>7mUxn+fhTEn&|x1P=jh%S`zh z&(@^pJ-P%YQ90Z6(wwv}xRK4CXp4~WO$BvzyUr9D0Oqvu_V>MlScZ|1;QTka*U(lp ze$ktU02#`xs5!cQOa?@1K?agBM@Q({!*Mf^8q4ziDH!m_gP11eZcVn}zF(}-jINP{ z=XP^3SCZaKGPYe-U6{Juppc5~l?i!8#ZqD?ubj@#j#sR#v+KMVcP*iz>VI=282$coiFGx74y`QMwWO3V z3sEjg9L|a%ubKXBrd*V6S=&-B(>i}s%W&@f;6L3Yg;PWK77db~!47pq^vrEX0cKj- z0i_(>f8Is#w2ByrD`sUJWYV+qjAWl*#QVq(zdKvhyE((l5u-A?B?#S}0>)vcQ$Q*x zW(UgD;olX8l^oq}P_uw9A0F!*?VtJEd0u@Ej^hvy_Y)a0&g@h82e{6?GqSSjG(kP5 zmXJTiWOcpH+-O5&fp1ChkHVj)kGl;*KIQol676Qhbw4)!Y6@KayLixP z45^S0UiF(%=2e&6A5zgYOmb?>a{-fIbFDK#paV3>9~0~ zR@0&v%N_E*Wo2Rbz4?yo;BK5^GHuq|S*-WqEQ2I(2Zg33^8$W z7}^ff!5JYTKI=Is{&IxZYv)^=xApS6z@hGODr1X-L+D2Ejzr(17#;nbb39N&t`iK^ zmqz(mQu94xt)E)RqH40-X8Wa8lMBD1l2Ta48b|aylz*Xy(<(rxW%1cr6yiDI zA0}#dMZATxWKp%>1J({`^=$6o=z2Z!JM@WjkNSJSI;b8Rtoc66<`03o^zP zRuZHfvvkiFAf)=v-W5M!Zh(VNDs*&kj0wOgmezm4 z1?GPB1~29=m7g`Hor+=M?&=Cd-oa(p6B1BPSWSE^~GRm`Oh5OCrnk9giAOb>7UGHsYu(=hSaF$=e zIGryL02>jnZ0wZ1tWdeHpz)BlQ2TBUc^<(sGr;p@zR7`TYzFYfwpl|psQd&s~8F++6z4>?= zA*0MlnQ{z*0s=%#t(An#P-Fh<4q})9urzFtcCW0&t5+IVXs-Eqd*wXbep|EK$54_- zKaFY7HZow9(7VO?XR8kH3)A!FB$H{#KLv~_}Y#k6&PVIlW! zrPkP4)FIhTHbd~y(P-?NqEyWG|DovNZImunQ2EkcE41kN=gr*d&b6_U!%f{29E2$xsqvM1D|qBBu$E5iY*6tSt*EoKkTZlwDs1RJ65Y$~P;*Y@O0{B?G zW__Xi^w^<3k|z)Gm_~woMg{_Nb4^p*wVLXG;-ZtDNuJ60&dE*8c_Z%cxV9qfy6^c_ z&6yD65emmVWuu^ZCE2YoHa|UG7W;+R$7&nBMH*HLTP5y0+_3lOGZWpUJ_mgy}cdZlZh`{46JN2!onCVW3>`5=1=%e zU1l75!>Q?t-Y6Q9CeUkSuemQ4m@$Ka2w?8+u3PuCQG9;5pR2pxp z5mPfWsF5sY|1v9`Zx&Yk*m-VS{rN={@yUU|Rw>~@9S|;5QGF}z4G!L?-6;nUFwy+N zlJ2&TgEH{eSu$DnAZcr(*&HF-J-utrztT4^p=nFEyXrd{m<>ltzdNT6OYx&e?tlo; z%D6%!SsncCa5aTvb2#el)JiOUWtg<2q|oc*lN46yP?>lD1_~ohHu_oVBTwU6!r2Gr0c}KSj8w@%OXSQHXI( z0Zk9E*zlwpYuA61ZzZ5Dul>T{Hh(b}@avZa-^r!4g&qRLDc34J4xQiIorV6bb?mGu z>#>gYX7*ycA`2S_&*RR{ZiQ;|A9xpolao0g&mX3KsnrzjrhS`=C`p~xvW3rKJA83@ zN}ML@%n`jh3#qIDTJWy}dX^eoOg=~pGy&uRw&S;0g_7FU*5X5F72Im)vg?lA*H z8|ip>jNMiP*TVI#y{S}!h$0K`rm(%w;tA{5cBWx{C^Y*s(-V0&Vvipq8l>a|0*V2( zNK7WT1|Cm87{t|%GEp*d14%k28fxnod@6D;w z=}H+BPg9(?B)g5S!@h=sy7vonj;VgiED zi204&WA1sap5ed*q{m9DXsCaVQOM+su5MhsqR=(D$obVkfXJ;HKgO=!;?;xKn_zK* zh)U#V_8TQ-EaYeu^YS#W_4^@HQ|1KOVe8&7-DxuqRZKk?gJWWrPmI}m-P*kul$SPg zm6tB<{&cd4*Cn&DQJjfY@MhG}v(|->($_TG7)sW9ilV8hx!*f~sjD_Z_0%;|@LC+O zaMxQ4jJl=E%gyiWdc#m=Wh=C8DH9#wVLAxZLpe*Yd%|Ti>1YhKLy*$^$s3)Jgp?k- zY)=K%3EGu0o38%!kNRkVkwfcKA4|SrIjz?Xkn~O)BfTUPcCNc~k@z-$oGOihp#)LE zx?$60_8LyO9*VDYp58pax@M@`IO!qZic{0lLL`WehG8oZL*<$B4NVczDsp^y*aLSM6|Ljf{j` z$OqRBQ-gm#{VxGzdR2xO;E2_&IblpsPEADsT87bj!`SFJ zs4(@d^KvGMS^myy^+cZ@V;AoNN3rD~Wi>t;Qko|4EML6e)ZCgak0Vy^kAsg-vAuFaXBFwX_>KUo>dnz9?F-({<4?p$v1Z~-X^TI z!V(RhV}C8CZ^~GWcQ!LKTTEKhYxDCLe~yozRi`)Jc=DYDDC&w}>2E~cu`)Bs_7`g> z{@QVk_LkN;0sGkz}V3Sq1MR?IiP}CO!NH4<^ZyLI)Yif)D zH>cia$%8;?qT=gUt3TTuMi!uS1s^rp%Eb7zGu(`fGoAr@PIKwg8bO>lT@mAOI$CKB z_0Un94_nWdV5_YrQR{S%^|cBhI==Viot1S6SO~OF5tg1j^tby%53j{h-NjVP`Eih$ z$`#pS&5C!4=sHdH5@_iX5vV*t05XUkm!R^Bg8dN;7XCRTWcdCXVcl%l6yz~bjknv> zW#!hQ0%0mVn1N3coEt(4dU^dF0T>%AU%r5*AI&>XZ0G0acLfO^Jx@;20*;g5u3XbA zpVK{s8JA5N^;Q>l03Hr1EhU<DY9@u&qX?2SmJ0Ud$4PZMUGQT0pDYnyNv==PaG* z7K%wMQezNTHGK@o?GMU;rGuohI4w<}hG3${1Qi8k(^*y^Fc@h+k6sIXu+6mU2mfjp z;`|L5p$*&Y*v+?mhSq!{v^DFx9(R?nL?=0RvD2uvTSop3%mPi;u(t<_aZ*kZ4(q9J z(vhpH#+#Pkv{Qyhl+IiwMGh6~$;D5Ic>=$Dp*});_QRONKyv88D0}TI@lHPnCGQ8f zdGbQ{E*dn5Wip8%ht8aon@q4!}s z2`*>Z%X$A52(=l9e3)M1*02_MTViX7r?^<1mxohPQ2{xJXfU-uj2u9$n=ZMa_#XeT zm>jcYe2^tJHddeYqYbkF(I+_uX>8yeDVr^qRV|(_i&8A=f>sw7zk@Rvw*>8;z^g`O z6WQZ5Icm18+muFyj$GX=R1pgsy?|jWaOVH!SO{e4P>W-X?uDbP<9s7_dwLU1(q#AH z+V$SDt?&G<^QE?`Kl@VWS_HiNVq8AuWP@@?U)oVMCa}dBYIiC-WHq%Eh$a%Pz`*or z>dQyWrH-N^tP4#bXC56PPM-`h5|>+F*0rz*DdkCzjxLpskaBoaIMvrn;0%mx0q>x0({q;~!m`#DWE6{2u+C7^|7?#Sw9SO%qUx53C+@@*uA#uf zK?xEQOq#Rf34*m`XOolAvOGmZ!&(y2;4a24(zI!v^O3BCW|#J4C)8o=Tck3zHWB(@ zy`!QeUw4)!t;(p-P%}z=xOT|YQaqujrB+rnLPbT9>hO*-frg@olDIuPTSO;SFM;7= zd|ojB*tvkQfmY?n#M5&08jOYxXJn>>UuE4&;}{~~=9i)Zn)70{f(akhfdD`C`A_J6=xQXIF(uG}J^&k`ZZ}Khojx>0zLFGY>PgeE%Y;l)!yl0l?MIipHqODc577sbu38N_hvK*_pvR z8;%^zwEeDd#jlg0^3V1x)e`O8+esntJ$RLj<_8s%D)d{D!yFjw1pnap-;&GL9VEQ| z62M5O3<5fTKcms%R-(P@alwCwO^H$}BKhnMW%Ava(%a}pCx?6p_sL_>8gef9U7p7g z{azti@;_mTPL9|0D={%|T)e}!m18{N_6Y)s`C*k+P{C_F7aJTCv;y|op-)HI>bk_i zpZnjIMsD;lixE%5K{`)4W1h38$dnf(Rc?}j>;mup%yq3N6v;Xq$JAKYOMyc0NM9M1^l7&`-u(CYG_>Y%I ze)jZ#YzM=&wVQHtu~X~8RL9|~G4`6zsKzW;mWw_tm{HA7`7jTx}7{2|; zyga-Oic7nZvp!G=)uCHceo2YAg~d|{1Tr`^9%02k5YG~CjlRYsP?h7W|6GnAMgRob z3aYAp6w=rR#vK74>2!UKaNv6+SVG~gTL9F67j*x$-b76W$`a7gv>)Vz zx<|K4ZMj{^jE=MG&$sx4;+IN#`iJWoDgS-jG+0OMRxYCXCe8u}D=G5HKF z@_S|rZ-AcnO&5F^*5oVBvK3&oYsCf6TB#zL4bv8O6=U>!mEDEkMLt?dqk*z)kKQ=t zNVJF_aKon)93L+X&GQFiYRT!(H`z;jrrciZO$=o&=F!V-F!AV ztbDIzKnKJ?k$4@Qok3_O;{R^;F2RwlKBcioiRs40eNI@;!0EF-70LD5p z(3~GzJ~T9BagqLg4k5@1{auVP@N)5R(<0TS+V1>72FovoX=n)c-##7BeW+#GrlLPG z4mPx7>W6TrhbQk8?>=Ozb?Ym=`fqGt?k8muR4cnUT4Jr3kIAQ}VHoLY$z4?i&~YR4 zpTXTkzEZ@I%yn9cd?`%>Of5%HjR~5ZG0NRg`n3(S+Qs!?#Z=s94?lXOU>6u&#l7^| z`)&Z3Ft0c{5iiF0n5;Zin3%)}W6jdg2-CkMn;k&J#k>2tZhYmt|9<~L1}8YUz2;&_ zj~uPW1(XyQm}KGR^v<1-~OmXxJf<66l{Z6CctxknkwJxb0dsaXwCF-)@Gt4 z8xV&V&SfSHOOn;b-z%icQHqzLs-|E~6l>%#WgpbhAq`>mCc@iDFc=*b)x}3nO7Mh< zEyNHw7dnT9MYPe&t*S7~xXPtRoDiTkGK=0WR8BP`HR}96T%)#MK0s?V+WEMl$Zf?f zi8&?8nRM^LTnZYE29w@Y^%}z@MvXeF4fIs<-@QF=Ra8nC?{k-4m+yc?Sy@?msh!y4 zNnc+H1X@37*abq@Vrf-T9?}=j9`5}(Y1K;HVio-|I6NMa6B_EoBE(b%!RDTvgovb* zf3F1A=Yn4*(%2jNDusitE-nVW{I2>}Q|w%Jd*x4!Wh5j%^J*Maow^~#U|=|BN{v%Y zHz`{?zQ!Fz3g!1i)6eoqyoyHmj>%7!h>#+!&&fd{zWnYP_3gnCNuCnb!Q9E9KhOTU z;tyv}PsE+ZU84H#E~l7c^PvY}`QNo3Sd&cqp6}Zi88KJP3#6j~&cAxWxSpvXZ95d)G&iT)EE8ic`#E%E ztwN_{dZ)Z#=}$Nq#+rC-KpJe4q#F@=`8ug-Cnn}Vso&S|EuW^=)P4lw&REZT8g5R) zbhMQ7S5gknh7FbcV9*vK8j+BcLyRm-k5kOM#EzP;huIwuJ32b_-)zr=QA_kXmAHM- z%jW8B70`OB_Zbmu7Ci7bUrT9pK2So><$#$)eT~bG?T`5#kDg!IhuSFIHy={}NB!so zZQW5xM=3A1CtRk_V-|$eJO;GEdi*UA)CoOb!e4Z>V5HQ25W`}W*)~<+2Zcmtykf!u ziBen3Rge>lI(h*OP0xAL;0#qd;u-!Fm=yz}@eioZ-ci7GY?z?fyRlJlt_e2z`A^ag zM|%~DHAIOadW-U!x+O-DrdZv}g}9Cf;ZpGJZ{30lNg;9|QX)lEtt>HbB8WAT=^F+> zf)2-XME^g8y=7D!Th}d|1c%_EA-F?u2o~HWcyJHy?j9_-OK^90cXw~x3BiJUW4Acx zd7t-w_s=&*|6mNdt7_M-+Iy|J=9&{feTGT~LmGo=o`d!K%IFH1NJaivI8p@ClY(fG z8Ra{f;tZZ?FTh&fsph*rq^L-O&8KKwOp;4RXT2v7#?;bsKIE%pxb?<4>{qE#Cj|c5 z;j#u2pth>gv)dGYX%P&#SlE-8f>h0gCvZ>Olt$X|KCr3u+fLV8=Q68ewI@tp{ zz_vb)^1A;G@YeMhH`h*4!T1BD6z)k9($Z5QL$5NYV>^OU7OBr#p3jwh{xYc*qRLL= z!!uoO&CM-!C6-cxf*rEoD%7f_85Nu6i2PT03sycS7{RL-;_u8Z&>yY2uEEYNaAcR| zV8}ggeT+{~*6-V$3DHb`p4YVLYq3x{AoB2fdUD_BIJ=)b#Cx-6u@e6WbdTr#AL!Fb zQvZHTDh~1DWAu$T1v=2EQA@?aE$mg9I(O?-f5NC_HT=DiO#?sJRFjpccG+L7D()#?6W;$?E(?M?}rl#8H&quG0#=6FF^1l@3aN;WaUy z`Vk#K4lR+E$z!aO{9x^K>vg*7fD8*FmjQj2&73&KOoS!lrB5itk9+BN*?5Q!9Lyb* ztGUL%*Ov~C+PgI6YH@KT&x!p3_;vQp2RQQ9c=EWO!T;rTZeUq#a>H9!(W4}9>LDIN zjP9$Jng)aWNtePuDlRSCT_zH6I^HEc6dm2NV+{g6-#41gklyRy@ZilOtCbFh}Hu_aZ`5w&19dkrMB%Skq@n>gjp>mCO25bh*iJRM{1>w}YDsk;? zwC&e>VTO;-kc*=JT~DPadJ9N#RC0YUPv@0) zPnkMG$)Qpy-04aUm7UjwE+;JGkohfbWe%y4k!F6LEe zTEMig&drP^@dbj_>9L@b74K=>FI7Kc_#Rh(W68Vw*y)6yYn>5J)R8m|707}(Z&@cs z+t`7oMC0x-I?(MYf4Ded$A;JMLt>KRy1I9?r#dI=pE-YvI}A>&CGq<(=))#^ONVim zx9l-w5b~;Ifv4rtcp`RP=p0U)yYgpbguZHN(P3=wEHat`@R#OjEH$SZr)ro>+E7b* zelynaa0uOFg_<{>92_B{D$UDQ36W|}T^&A(vdl2*Uy08t3m|A<45=~5n$DLSK`Lv* zKJD3hR9>bHqCa#dH-_nD%)iDygm3wKhC4grq7e`bqpHc6mtkRIbyv8x9UL6&Vkc!R zF#zNBvn|!DYkFUK#l?>k&K>}BFi>Y?EZ&IK?OrZjifzsLTUL<>$JNa)zU-5Oy}jGl z`yQCfJFAC!0ex*37Y-!9U;cF0reE31q4{vg$p`uetCbJNyX0qN+@z4+Dy&ar@H#Bc ziuFt7(B4z$D}yVQVAr*ZAA?H0;r}`J5tB;abT;XB(LWbrz_he^x(Ag$FXz=rO8wmu zDe71o6aag$d9!u+0Sz&?SboU zGE~qbNB{TG(1JJ)(V|rJ#F8D$W?Q}dop*?IpwfreOC^RE_U%)M_{pcUZF;(hC2nTq zr4uPxCKiY;(x>q68T7^!G&O^;bs^l|m#zFe5B!fG^$iTNz>wxB#MhxSeHb#I^VoGs zDUqE|Hoz(jUHM)i<}v5}%a#VdSB^h3H==ya)bhyQ1_Ags;Wnvop3ev1il7gPc5?jI zG<%O6;_1ZXGWh%_P@uMVcB&pD^Up5vbbOUOBVUi-$Z|snN7q0Y01dfhSC4RZR0lNd zhE@!aHPkZ);JV#aJ%{1UbhN3QvDrw5Hc&@v4PrhLjNMubHt84&QvPQMiyvj}97h|{ z7aL!g0I(C-@PmU0o3J&?=e-}aLG{)-c`q}Uy`KKf;B!F)933m&CbwvqiV#c zXcsV0w1857;~bAli0sC2=AK%*hTL|!i>FM34wfohqFiXNl{)iZDuIFpq~3_&+}HaF zytzr_oSaEsQ70=tXw4>GA2x1J2p zYY?v^D`k(u#7!u&oAU8c$EABPYvZ;!VAtNlb8zHRzUEW_0NLDVP4{~;6d!W?+SFG3 zk$@omgzU-ebpOY+slCnhASP_TCK|LJ)88AyBx(O!lGl-dF|%d?FzTImN5}r*VaNWK z>^}n;75+R0x6b#pXz%zpBsZ@W4XS?9xiC%X9GP#>uQSp{aZkL#vddLf!({n%P`wJVYz zlXG!t>ELb03#R3ATYBRw-Su{1y(gm`PMN5t@N|FyxD#63D24vITux3dxzZ7xh8pd! z_g{>wd2IRIxdPsYap+Pgqh!zr>c{UKY}+Y+G(1dP5`D=wFA-rnA( z*4F*&?Qpi+a~~`Ay*2njw34P;t=5<*ggiMFSc8elHXYY|_LEpy#ntM8aT9jgPe&Y< zuerTik+h`b_VLpLYIS|#fVe-$x;Igw!$eL)0SZu!+)*wBs#|wl&(F_8+`7R7KPdsp zK>ZzH2X?-KUS3{icC%-{#xAO;*t)7~Y^9Unuv-5)Gh=TkGxmGq;M%>z+0c;FyyOTH zIcr{O)82|}Vt*;GtR7+M)Dd-PNj*VSTz9l5AtW?FI2o`qar?nvH#D^0(7i2O9}dom2d+8}PX2;bat6~%jy(M}^g zUMGX^g);NhV54mROU*<{32U^AwXX!V2>B@%|4UU*$QoW7_u%Vcg11(^qc0Q&Ub$)}C z=^Y89PzwH;IL{8!F_}z@G?K#3R<6N8TL?cve-wbI=5#Cr=^>oXssLsRD` zqk4n$cdXl@X5|12oAba)@6g_?M`G$HU=#O^;=QKUSmBCM(MTxWEMV!y_OFDk+i6sTNu- z%MAh!BC90L0YWu7IgJ=RoK74I3jQc-`c(J#y?WvGo|v4U zb!khYxDp6@>kly>A1I3d22C@HL7g?Ty!$l_JIdYkBt~ID=lRHu4ng= z3t79U+(u+#>79~_Ze|zF>-x)q`8)EbBPwHYKI+W(ffQOM3=6o5GMk3moHfJVJ~edl zK)gYtegzC6GqkUYu7BA={J52B*^ zOzLz@spC&QS(oim7G9oqS9g-@E*FLq5MK5n~tZqVFf6h z)3dXq6-etIKJ=P9&d$y?@KWzavxNr-w8VkuE=?9=x9l zyLG~A*ao1h9s_3G+pzO&0c*LhqorCE;UhFLIRll-Y)&j47_X5NGK1Y5TZA_;AFVH#hGBim86OA;Xp_o#d89Zw&w7@TvC75TyvyEgXngqyVg8`HHUDGP{}2jF+`1l; zjX{V$@hs}#aA`X^5(WoWl`=Ml7zHZ$m8mgOgkz{8k^!!Wp9|#dY>){c$WJQ&3`uZb z?qrF_a=C^;Z%ePJqPYJVO8n@= z{u{}93eVHkMei1;X~id~UcAfJC{M)x+lD)&j7je)$+#h`73P2K`6)fjE0o=I)lVo zA8UHZ87OFGdc=htR6esz@n-Tt^-ojQ;3Kze`YQoh0O>ygF7Rc8$mnP^p3CY%U=8Pu z!p`skNlJ#Cko|iYgvt1OU;SLTly<&E&&Y4m`=6OQ%GWB)uKjGu4jMJQ3@kWsS6Wsz zU%wsHG=z3Q1gu7|zL3GDqVKo!XXPsV--gVuf&ccD2ZPs<;`)CEqqTd;0U7ZzyE-~9 z{*Uh6*%-iPXV$2Jgmo&jTmwNf3hJc>!uq`PY$gHU{$)N7-I{@?6nu;M-=xL;KS_%i zQEfRKy9Z;BpW_Md6AAOo_Zkw`q0FbKNOrn;6g2V6BkuE&E&Ip)t&i|iBVHOf-aOky zKsNUJ3jOEP6i9qNd&+|J(cF`@E!NBCbg}AJE_MNfReG;93--r9e@zDgQ>DWXxnzHmFU zO)VHkbj>;Nlk=RIQI;M^W~lI?v8phIN;_}Ixto8ORheQquss2km8Z24}h z>27SUx3I1s{2S|TpOW?4>eQB&;-#m<-p)^DH5wb&_P0A7yUqyiO8NxVM!v4`|9*O| zxAS~tyA}r72-;^Y2O}?$U9Tm+lq@sy{E9O&I|Y_{w{i%QW0KXO!C=4;@hzcXlU=wZ zpk3GonC3P$iUp;laMd-sG&NRa9v*6>@g(?XWf6b)6`$QwFz@vn0)Th8-_+I*zIZ== z@Zoper?!cLc9a=3;#&Kk*qK4D`(6kqLhSWAxs-D*(nV%Q?ebg14*)ypJJU5vd@j!q zj4x00IPYux?p^Z$zQe}Dvs{(grSm%F*5l%N9H;FjlaAZ9jIx}&Yv+H46%I1wl^{)K z>d0cDf|8yrg9sbZt9i75oXRO5^<2;`Pl~TBzi=6QMz+w2uPKPNcfZrECu6oe1K+^t zah^Z<_B=h2-kfj;*B`NOZFZAM1V`Q-c7ai{)Y!jK>ZBYx^N78QIxj z=OZ#3TmAmQLHA9%2Rb&kKcr=#qlyJ=BjLK(WJX(Qk6W~`b6VLRF+b0K2LZahT~x_9 zZt-VksIr=yVF3I^XM;Tiv~Cs>48Pa(4cF!GqJQq7Y>m<0&2j5oH9RXTD=9T6d^!Ov z%HCWtzM)}(0dK$Ciy$;C^!GK$IA{I^Dd1rPveGktkr_1@wG=;eFQdak569q0HNk zM%;6hWdLNfqKhtm%Q1G0-4hWKhTg7g_AW$y+qJ(NVooqQUu?Eu>~u3Xw-y6<{Ueo$ zVWY;Q&dSEfo-%T-2)^eOi?Ce{FPuaxMNl<+l=8-tYzUQ;u(U8@>+FYyEe zZ$XkV5YjvUcV8G$id#UHhu=(1;V&*H$(WhZecTR|(-fSFo0>i-7E1RtxA}GOz<)E6 z|EBfxcb*6khv2z;y#WfP==m3yG6}z$_YkM%7R!1<_KtIDDoq3V{Il^=8;^gtn6RWg zfJyu=to2nWdz1*rlX)?X<34hwqv+{ndurkEo3io^sW>f9fg{4hS@)GQqw@|mRU6T# zrxmnrUn2!FQ3|X_4sP1?7Zlj>cjvR__uLT=VwZeh8D$Uj#>68ifTh!#f<_}^QFS$- zwm#i54jT_+lZ$xuVyeBoaN%uwCy@;iwb{VMUo{>cZiK-R4Q5)3cY=pF2(iW%sPCLK z7UFLd`YN`i6s91}W!jVT&Q-hnBg1xW^za;h*4K{}$_6u|p}FK-^y+nQq!Q^w)YV}M zq%#6O#Zg{tP8&CpQ8U3?9Us$)P*PA3lde*5o^ZS3ApIHd_Jg@}UAD8*hRSfiP)Os~ z4HqYJdqY{9JV{|^Gm}U68yiISiTN%4c)2UYAc~BI)UW(KHbc@1Bb{*JTQHlG>&a3f zS_SMhxsW{RN&B8GK%v38t!P6+2sx*wrx$i}Gum)=bAu^UvFNOeMiZCE-5XDj*x#1` zX{wer5dd9nRcd8)_J7j8ghlb*!xzY9j)44)jCNiBPQxkKcEG!oIP8rl4=+$w*EbXp zM)7&_Bl$nv5}k0%f>J&g%I&Zg6c&KE#k9{mwdS(!8#`kkN!7o#LxTeA|JK*nJ?)EwEI45> zIyP-cr8*%2tkz^pXe^!DV-%BwHYr3Cl7fsZg{qnwFqM1uYpEPApkHAw1f;$RSuL`p^y(7=^IzR;r9-t)p2EV3T!mrUxKy`OY8tygEiHPYB zqIFIkpk_8bHCnQ<1C~ z5f3SX(iw}9g=H4fd@>j`qJdtrpl|&Z+6Jj7qKhn2$N7VVUy2wTjybuKq|3>&zr)^z zIyos)&)66%2t%@rH0%?q91n!p)6?thhMOpB?fVZgufmNu8IBj_=qv#hZ$Ktp(EV4k z|~ z<6kw#%l2?bNmG7C8YiDAQ*Vrc*@{NP5{F41RK)S7ky$5|5jIfVfP&8t>HU_OL71R> zQU#~O|A{$<-oLh%WomvNC9J)#!ptme}7O;a{z|Po9VI5z@yydpmE!i$VqLr&b zyZ%Wi&trG4a6VPaWxtT#Sle_^4Y>}G+lz%iO^5qnt)W2!SUUHRw(YeLdV*~ZT#R;i z7i*jfj|Q@5o14N1SyMpZA{*)7sriH4N|;x< zHi>Il{sWIf!5yo!Iur9iz72d&#GewKn7AP^#V#}RmiEEOt}cOw8l*o5%NjTB;b>GG^t?+-Amsx+JEc__(LM6o&+lO1|3hbYgykAUR*+ zC==H|Hs2DTnb9JyQnKz8TyXC(BdF5v<8{x*cbc%UZhWL7NL;F5Pr%|dVhF@_05V#a zbuJDd0u!Zj9))iK|1Qp7x_z~;(D49LjNtR4Z3BwWl45v??B{PiM&Q%)cg=^F4baH* z_u2I;p~VP#rW{LPuNf}^!Jop0_^iuQ?JEXzhIQ9jvzGs21~G!UG@JX4@3vBi-$oV0 z#xZ?~c3Ic;SH4~CpB?9&Iz0Sue!J>gag##M2{^{pENUsJgHK&pk59UM$;(;{qP8^GuNEAl&}-W4du3 zz({VM#37_!oo_$^i4Et=TUcUU| zM4}?5rG)NWcO$%&4cR-G)6ved4b!i=`tf)A-725B1^3w9jOO5ZL@U*np%Gq()8ucy z^STwwod;#GK4ULvpWn~PfIIykts zCgV6tI24KWI=0hF*TnU_Gu!K6ojA|JSa?Z3`CplaGuC`>I}O%#er05f zsNQzfCS^OWhh}_H(Ny%>*xn_uUkgP}!;{~OIzJIn#!vp`iz1h_R(j_KoNH%f0IR}4 z|4-T%pow@9k&%WI1(0N=Q{w}_d@dmUOpo=sP{uwJfNX3nzJZPV&PP;uJ~Jj@uN@pX zodwaIouuPV=FD1%kFJ>@HPVnfyO%Kyf2}K6>)SRBmJPd$euGbEvttJ=6fp%CeYhHK(ZOdOs94jKGQ#?@vKM z?VUszK0&$ZaqS1ABk6kPl zOXXS&0k&T#h>S~`eVx+NQ)@mqH?Vgr<=g4BkeSg_uz=6PPvY=5Pb#H0md9cSn!kWl z7FzHO4f`YMQ!X&E#PTmV*jRtpaq&vQy2v%J)d~*oE0NB^BJ`t4@D3cRtZ)%vB9aS6 z5wDC3WK3B~=dQWa+M4$jvCUnIlviGN^cgL-9-QbAd%RqW zTf~TaobldH=xuA~q!0C(HL4NXI~}C$kAih}Vr18FMDa=HWu2<)PWX& z=W9|A@&2DFBGy9v=YECLMQDQ_-AzdNYB>qwc7)eF-iFn~iCv#xPG_lJH*%FT0)g_$ zWlC%L-FX2I4;u$eqtU>X`d!boRF zzYMl&5I)-LbuwhFD!S8Hd*@v^9Qm?p3)=9p#m!kY11>3096tfTM*b%O_p`+mnmrgs zbX3vjWPwv#QU_OOz2OglIYI;NPl5u;h0vMF!|7!PQwM3}7Y#SPddhu;6F#fMdr;dj zld_RkWxna)l`X}GMobSGpzw&&}^=D?PGJ~bv{>cz;j9*0GUAp2}BC7|m>M=dbAO-(;1GA0|@ zwNo2c4RJ(fTqaw^z2cO>Z}(;)kLdQ;v^YU6OXXI#dn60^ga zRywHUy_NBbXc*qXlNWl$4Vz1Izk(B2I=2S!;)>&2v7Ghj`!U77590)S(3PP6I@utj zC_C4>8LoeDc5=$Cbud+g8d^x0Hf_;=Y(F?* =$@S*)LT%z?JAzMN4IVm02_o09? z3v9aE|2^Pn@Oy(n?-JMRvQjwYVL+xka#%Uh&ehCesEwO*8?-b(x_40DVaeN4pY?X{ zkZa8Zf#dVs36J7j>5B9eaR4AaY-~E11r~eOvqN)>;60nJ!+9*g=w1*;s7I2QxPJF+9>*FVr+IY!+O@+r{)yvWOl)1kj z?VJDa6S}^Enn(!e-NuYsiO(SJYzhBpRPxtJa9g3V9*!uj!noVQOswu97zv}v)X2Sk zA_``vJFEES?Q=&PJnB6Og>HV-m_#4ZEhx8Ud~Pr3Thl#pdti8z=USjoO950h$y<1( zYdzvR3{NwMMyVvFy;9wlsBj+3FD1{hNN;M_d|8271Ny)%9OCV57!ZpA9ZZ}p@7G)( z(ot>MUwA0<3bLw;5l-7$aqnRQ0awa>Rvfes_yOgbE_##C{+yn_Ie`imI?g^zAYY;P zulVR6mw}=Hb6MC?>BI6ecXXVCiqj%)+w;7~&^T{U-4(*r5!4-rvNBuS%fE<8ZgX?K zE`B5de+U8h&E|e}9KcH%0N@osjKOy(*!Fj+0|qAM`LAC(qJZ?x_KyDf^v`k6iq1}u z_}s>F3Kvk>B%z_fa4?<>STg)6TPUoSWZ~5Le?dhmPtTJ+UV*)b2M1fW02*S;1q9Za zuP8xA5`wTQ2f)L2MT?D%4Y1BdP%oK8gtxsm0$$^th@4o&=hXCFjkhjLrioFR^K3Bj z11cHk3#J07hF9|Y$C)x{0b3*jN27emt(NWkOe^Pif5|gOXtnT6j=0uD%U{VmGT)MG5w$@#??Fu5>+{}jx!&J6Lcqc=lyY`g)^@dhFGorHBQ-;TaKT2xz z$Hmer%mxSd3R|KOdm;jje_DW(u0nIW)^*@yGe){EGa;OWEiZ)le4g(MWz)M0Gks8A zWqbe>0<}8R48+eVlVmaR7-Bil zAz6Uwo9p4Q_?O5ITq2+`QZ6|yq95sx{%|Y|JTiiq{Wnt0AN2sC`O_!gO1U&fhHd~H zIGge>-7JM2&8RAnO%Crz+B5ieBXXMzfb-&h{{F6qL2$ad8y(m}|E~1!$`eln>=Zdv zWFk!L3fit`Y99t@$k}5SIWayHSN2U@A}1x|M80@iQue%ioHDO#j?(HftnS^IY|N~j zmO{tL68+Ih6n@C@`{V~`3exwen&@ZE=vqMl)n5Qd$zT%P2x$#}V-LdMy z)Q8mHk!i_YkNlbv^nwkRL2b?|&cP-n$l9GNX->yXfP^rOf#*^n5RR7Lq%ubUJ_$!Em z=ihQ?CzS=***}|+?!WuO*2t9kBBds(+)73&uJ3k1Me4{NHA3!MJP;JY#w8SHMNu+$ zzhx@AV|8qK6!{5#l}RH*%CK8G@zUdPoB%&(wiH^oVrW1VucR{$i^RVG2hruh(!^Pr zDmm>q`Eq@oZVcl4oCBAcBTKs&bWqQ!xpFXLH#a%NX`M$>9z@Jvd|hH4hgC})&Z_!B z{OR%074qdCyi#KX2cl1j0wCPB$6Jo``4yrrCS4TvHnc=FkoD zG@<=a<$mn`A&s#oyLV7tO=)aFtJWE6-OC19LvsbvulM};N?8C&I%Qi=A7!wB@ z#(@Gh-8)HL7IpW<#^3T~V!TtuW&u3;?{U8ymEYjng4zzZ2Th&iZy zhk;2(Mz(ZVlT(8@daCw^kELa5?imU$^7~Rv{}f6MOXj~rur>I9GPc5o2Ew=QygrR; zuO7qpnapj`rIeFn#1QZ4GAdEj^20J`w@G3QXgycg7bUjFN-ATjOH!ei#zLG-HKw;_ z3LJy_v;ZS(Oof~AyT~(+86wyH9zMN<<@5N2kf*ac>bHex9vLQHPi-2h=pnGf@}73z14)MTh;rY$hFv+LLmz%2ye5y}Z%? z2?K@278#l7iNz`i(hdoqI$IIX#}nevDzG>DdWPh6H{gK`FM(bhj*N>77sze@1SSJo z7W?bmkm!V?P^`ufrhkg$&4QYZkA)kCvCvM^`tD6(tOj1$KsauyA)I3?h5$JAMJ<9ax8z3S)Vh z)8@N%)UqN~k%gL#sN1tjz*`^%w4i)dnW!hA9Fui!#&7!&w=JZ{w4$(PZNG3E(-=uP zs!*drf&IoC2w+C7a)`q}EX=jehF%!bx7c>`+_kFWV*Ohd3#b-SvxTQLGRi7%$7H)k zR^zk*X=p6pbt?c7u3XUYPZfWda}q9)c{m8K#=y_6scg5vEU1nXSWHO-pDQ?{?CT`e zC`(s-I|M#uTunoCGF|bqt^?Z(f2nd8f_oiGR@TG=Qs1ibzIpUyV^aHT%CS;G9r^R9 z{_jOjR!5wP>eW?v__e-@G^K+H0rhB_rVV$1AL7A7N)86#)-Fsv$#10hm^rSr4f((YI)RTHR`9;hj;Whc2kYJ*0;2at7Zp!O+% zv{2eTD!gr~4Oeb?it$oB9!X9(I$gq!xh?!|lNLy6seuyme_qW|y9ENNvyeif{<>jI zW|KckJdPXbN!%7GuhdMA*c4~Xl$LU}c*1_aRA4_=^m_F2vQu@&msPE=rTDG(6U1?$ z7LH*k_|@;gv>BS%1^RPrFFNb@ukF+3K^ZEkL}G#=bP`ZX?o?thThbBI<(=xb$}+0F zrhjWlN$9$2-PBq1{iaI2S96xj1}9G>gw6{fD|1F-N>!2cYA||v|Nph+MU8TA>et#b z)1xJ=X;*b9`{P5&r#5$Xbux`(Ub=Y5{r&a|(VtBs>&f5!-v>y^QJerOEAH<}JIbQY zLzb27+grTzz+_YNhtBdZ{*w&DU8{5Ow>k@?(v+nHdV=KC$dx&BMh#oiPH^nI9Gl`% zW6{ME9B-9~$_|A~$6wrZ5eg`OZbg>i+)j^PULNn=uYRiTE&(JW*|}M2=_Dc!S=51@ zy+4X$Zztr-a8k0P8-KAMQ<|$v=_%F!l-_%;U*{v-1}ONuo(lj64A^QIGtH1C!rh+? zV~MfF#NUkS{L3h4Ziq&hl(G2?Ui2#y`_%El#>O;;G^p42yVuJTM@kz+_EFD<+52)% z>#j9W-97Y_ePy%q+E$yjy$e`@GI z15s*`k+oIEzM||UOb%bfmf?DNc`p7UdD2WG4BY-x!ThB@LuXmO?b=^$Vw%+>)$8|; z*34>zWOcSz5A~Kta+*p}Co`k-&^Okh4eZNrq*d&N#&y_-L>T0zsl)Eyz@;%6xO||^ zzz8MHT&`8~IWUK$8{>zp6Cr}S0dkEe1#GI= z35I(&sEP~*!E2XZY%J4OkBe7u_Q1^j<+?)N=aaDM^9dmuv`hbNdr8sf%!{YwN* z<0-wYe*jkni~pjTbMc*cT^NWqhc)~IrBk_cE|!^sV4Dmm2Ea2k8`pymuGXWKX%N;7 zVLaP%!0j%U-3(qx=Y$QVe6ZOS1lt5!x*vWOPsXIh0-!(FonaAwYaOr!vIhyZ8>yL${yq)Mmw z>9cFDYW4!A!lKH`$U(embuNxwrmWemE5U$8c9QfTz0LvotjCs^g?xzMwIMYiXqj6( zJN0W16n0&5_-pUh@iME8Af&~NCHZ?}E3CKU8lZUP=;(OSz(HAiUvu89a2=j?^vzrA z@Q=*BG||5sgP!3~<*A6VBa@~o#Nr_=oIEl%Q1{0?+((6OPNn5-J{I<@^OE{PYz?ea zDfG?L(t#|L=WyscKTdV1pRjkAe%$G6AjecoODmULCvqA_nvS4CD$>gJ9}J^IAw8;4 z2m|BVDixZ%hurs4$S61;Gm{MvQdHy;Gn?6tC87}R!Km)CM~CtoUT;#}87?jrQ6-H{ zdmx&mK}Yq$sK{N_BhJqRfo$L8(~weIVsJlohy_mX`~<48c|aq{T)UHzMBieyL#0P4 ze?Ns0K!6f;6WyhlJRiWE&!6a=tLNEUn48OPZ|`k)xgtTY5ZUdvMU+luw+V`>L^U_J z_~H{3wlgSK{8<0J_m9;S+~F5FqzP=4;#F!wrHNiabvGC!PYy&3x=&WZzB4wgxDOX? z4GkzjSt~c(@*q-%ic2+^uM0y!W|W;oowcP`@S2sw%?a zf4H}S1oU)IoEtBkcmX6$;&sdyH<;Jbt+;KnuV0vlJxPCku zXN;?+eb7Q)^m5nf!Cm%iJwoS@qpAfzM|Ur7}j#J38qjs)9#djk6O3m_9@dA z0{?YoKxXA^+~#F3i?rsSEvu&-CBy_wV4Nqizm^#BBr0~n{Z(9-vPW2|?aP(O{)RS=reLuRS>S zU}p^oG%GvXR=SI7ZeATeKsAt%lLR|Kg61*Jvs3r42=CY}6&b zMr~FHpQQJ*o73!tD9}_BmiFg@YP9Z?V zD4Y2VU^F#Icj@8;dwA_mOf{~-Aph#j82HB@){P~I%==4z9 z-QydAR`5OY(3rHi&bk}Gs7KB(!Jkova9Az>d}X5Nr>m^}ZYXwDa0gnI6ry#DCX(NH z3A_oD{%{(R+F+mZDe9(p!>uPWBxGQ;vTb5(mhBQLRB82s$!tbs(b5?ZS1qbJ?z ztwZ?a>D40JI30WzY#aGPqWpYbVmX96qxcKpI9D4i@X0pn5dB!#aK$b!x8ezQmjYAC zJ<%|HGKyi+O@INTV+<6fMP_jJ@78E07=5!R{l&a{Ek#pdqVyOVCdKSDLatPNr|>k! zNd4QMGH5n~)6ghy=PbtH>F^I+>B1|j#pLW%>YG+x87_I3&w`ACaH2{HtBl&V@>+J- z!5}1@xTd3Fi9M>S?97CCAr(kZoT$PX=;v0ukGofVCZYK&kzjK5kk=;?udK3FElwz) zCIL^Q)NaR>=DK6095s>FA29a;8WwhY?m)|$qq-!msBEa_a;O>;U_ptCx#KQKoxU=g zAqg&t=CdF6mTHa9z9?DW2a1|19rMuArXRrzZZq{CDPU#FV-aDnLR~|=k7?;xp*5A; zvsnxC$hALk*c7c3D7oQaN%l$7@R(|sFm){AA_o27I)z#IRt6g0d_M{_smR%At{KDXKtT8D6WF*o^ z*Uz^lto+vW(Wv^Gls&$HZ-IoK3m(C`+J=?nNI0%PGFsq;&q6gt|M5>XV&rK{ZM|iL zxMG7cjoQ??>dx8`j;s#)NN*=0b$@!?w(AJ9dg+YQu+GnnbV=%V1wL`!JBazBi)HF` zs8|A#u=dlVn87!ri|J&Ivf<+Hxd0}fFH|s6v$@QSZ10d}b8K4*2$0i3(u(KT!E22y z2-85W=uVSAX0@Q)P+ndItwROJ2=Wm*N* zg*Vzi_>oFb*L_e?Bh8q;`s*KV($dhJ_hCj6lhTEk!z(JrDvLa!WmUvw@cF`EV=x}9 zo}I}%2~TAMNXR4^pePmIdeTPl*;rZ_;2Z&cR*;Zfz#FIJtOy&BF5*@jLq>dW$Q;}g z6(0U0u%M>&#_idYd0W|Cg7~6ur2_VnGWVmL&tE%eIGE}xse^qMM>1Mk|4Nr)p7)4| zzpFAI?&9d)KuopV04BwR--6feYM`GVspkcz+-1BWhF_?XcU?o>mMqr5EA3~|!qT!Q zRul;hlc0azYm(=Q6Dd+G4#90Ntm^wZKAjp(czQcyDA_`;ni-kS~N{S6sPN%FN;<^$JXOML4*Fg@)D9j@v~tPvYhPZePoBku z3K7}f)DoDwF*7#L}e{`>)fEZbKW-YGw4u%fmx^aJK8-UzKX ze+T=<9Ko{O&Ec^am~&9InIoy71ng&5rQP=VNjY$oJcvwDxfu(TXzTs$fxqCw?@-m= z9%J6SE~Z~UeOb;(E{8flVwt2r5PDiNt|q#28<4%75IV0H@*?VAnC+DRDF2)}%Fp^Tolp21!ojwYEKwWzldZt?R$o(#QB0^}P#qvW0Rvfh_ zhS{+*Tmv@y*7~P&^UR|~Q-Rrbyw9D0bfy4-l(P4)~!}A&H0XEHoO4A~@azK^n$Kr$;=K@)lj6 zGYnS6y`rDRqDkvSr|D$_Idu{fjor(qw!%nR3cQt;99!8RLr&WLnCxBqrbp+UF$#yc z;%q~L82~k~aD?Jv*IR$KqOuad_FvZI-+ir5(v~a*MLQ{&Cp0~?A`{m6u9}{3Flvou z#lL;?^N_0F`0=LUL*CJ{l`6Y`JuL;D>R8cC#`!EMWhJ>I1DsOU@Yc7VoZiA;k z2taGyV||GM+1pV}zFnx0A!v20Sl9c$T+|E4KaCsrZ_1C4y^I8Hun+F?fzBJ6(2DE> zY<8LCldx38QSL}U5dW7~SN2^TTG_&py2xdP6uFSQ@Vx*k-P6$m-9LOSR}96ESXAz< zN9haeuG?H^*+C6vFI|wo*_GBUy`4%QJ$?Zt8uvk$?#E^T2v>UOT{F=g>*7jENC*Ld z@bP&tASrnIz?&b{r;q5+e_>>q-{i1Bn8y8UGO?k9uVWEFneFW-xBO8TE*(!D40+3L ztk!D?R-FG10MdF4T!kIQ&AM)itrXQBM-AFdr|Ye1eb)jxd?8QdBQs&p7$e0`^>q#Q zUL9Hwc&^$Q124Nry4^mWd%8eR^7wpfp}qami09FKdIg*b7HAilpt7W7092p3&fwm| zS3W`YXDnmbN3!qv{N(`^R3e$x37nwX@cf;0I+wbW`8*V>5rO zf%5GpGY`GF|Jqvtxkrp>N4#T8-}qt!}T327noM*WM_tG0;U8#skp4U$0zuhZx30tg)#xC9}$p znRd!|l<%HSNLN2o5WYB{et_22cXCKCG04GMR-S* z@K%+5ZmO@yWNne0)90FivlZF0Ub4qDW`q%IRav;RT01}W{Y>N`_xMn#9sdea54D{- z0DoGCg}*m>iGfC7H6#!tg;CcB8l;l=tPmZaxiaR{Qh!b6z^FSC@_2?9&cnjN8T=VD zTWq~0Mj_z(2^kOr(GDTT7SPW+>eT4xnO%N7z_dLZVxF4=Z+Yq=SnD<=Y?whr62g>XUfC8`*l#>9?Cz3ep zcxE4O4NczJ@bXDnD4xv6N+lwUAokKTZm##H)>i#iQlOoo^EkS?>35Qsdy{%dDmCQf zVG-A<4Hs+;mK*uoECeP>YP&{QLth*s1DR^ruLESZ)$&WA42NAis&Eu3jamy<#Ko&A z4zA4N)Q55}hjSw74)$@>BW06g$NhAhTiDfyW3loI8DiLq#;s3PCs@nZjO(w#j2NRs z=5Z6F!^1}BEe(+ceuWNd@z~J$#nr{h<-!)`N1Q~%e$fRNaS~6{0KYwVMoj;^wwISK z{-25Dkc*MS4weG5hkP0$p2Q#PM$(Eq#nuWbJVrvGNF^fPbBZH?7{;Dg+9K3Lnn1Dp zWf$2hZg+qC|L}E|QEj|$x29+*4h0Iu9g4Pr;_mM5P>K|HifbwE?jGFT-Q9~rf#B|N zhTmV__pEi+St}pHBr};zm}j23@4c@ra`7^PPH9dQgqtLo%<2xn44Y zu5*|FduMS9{|6gh`89sWZ|B=T>csPCPq)o|wZF(O#>FP&w3hmn&P(`vo#oB1?;U;n zWDnFGY|m{N%e@a+HMXL6=n&718znb+1H|q`c$Ef|Z`TD9tha$q^kS1kp*(jB!!%+g zP@y(xA&<}TW#;A3m<|8Sh;*ERKQ4$}tAPvJhD3Y^qWDY~msu;=E@{m8H&cg&UhR!tgx#Jxu#U|+ZHC@YurVxM%=~#jBL1%3 z^c|Z9MM{YiqtsB&Ei=!2XFDNXH@%~016{io%5LWoxJumsCCp#OW3{T+0Fp{8?tpZc z(5p6kQ}Y8yoR#IQMaJr*owAm0BF^BmbI`jxWXByZG|ezoe@Lx|<-Xm5n_H#YY|+R9 zy0kJeP_5^V&%vjbxcd5`O3=d0>Klt;cVDS`c>J=$_sA| zME3ar1%+#0i0KCU((PH6DH511|M?!uZOkA#ZoTSR3@6awrpu`wxPVTmYTVbcww6$e z!UT7BbI7)go_*8*v7ZhDeA8`Itc<#^?FmLBv5h6s%Xz7NrhmA1cPl#x@KjL3 z)#aA|ee#D3ZnBdTXB}De6Pe)US7928Pk)Fl$GY{>wK|@O!*D*zouN5uMTLWiHV!_W zWOT_9Ck2lr>fc0tgeiLeQp<=tOx@Q7zTZcaonJ>l8}IO!DlwIH1h)={>Z=rp*H8_3 z(F-_M=dbu%m!*bAdTVVb4VedAQ0w_k8~XmOUK3Pm!$fiu4lDYkTB$yF8lJkHD*4~IwwZreEgitF3)$m>p|&as7uH6mhvq* zN@L^<0{rU2EQDtQnh|7~N{=__d!ULXidelk(uQwFcP*b8kY^(8tdY7(7YTGEa77W5 zvw?mw1A*u>$eO}n(3#{MG>7NA%y;Q5KVH$eX=3BL}X z(knC;wK!q8VI#Mt_G8SJpvDKvjd2s_irGC=foGW_^^<|n&R{UxnBPYU`+B%qux!+h zm7*|-o)@!0?1ktoc@>y4#@KF=|C=5`F z(M6~2w9$WIV2BN-Cg)G`-gdOMxILD>Mf3xWx)-Vxox;{@y!5bgE_SZ&+_zQwnL9cC%TzJQ)tsJ(nc^o8Al6k zQxMw4fN+{7I0uBXoZ-($jMDE@B4p(2*mB?al|qph#Dh^#%w?0A8*me~CMVf#Bh*EN z*oQJ6w5;*Bbpi~4F#YZq3RdFAb!9# zQfSW7W!h>-NSaZ#eY~zouLD@d@LE?@{%shvLci?dWaEs+O)e=Z>rK^|o>-XaQo4f^ z_@E13lBT!gB$S`E*CkYp-&d_#nd2#IBKRhJ@ILsyEZ*i zIFKM3xVhU+!nQc&rZPwmmeVo)&Gr0}8cCyWT|vUd=-<7|j;c;?o=bZ4`>`0ldAPpv zU<&C`m&q~B|HAxwEGbmRM2P)O&4ACsWe+R!T;ThA96jDc=l{oz71|!x-BqLDnl@ z0vJ%3dZRB*o#0LttQfRh6x~`2Y|s#lgQXM|#JyFoG*EGx`+Qx5T}9fAsf*7!Rc(z_ zORbOU>@-Fs!aKJ8CLYJ;nNbLIM!KR^3vEJtmQH4%0zd0L7jM*aV;Qr|xC)1)aIfK@)qz9araeK5;! zNLeeltK}7FfAQ11_mJ1_O_PbN4A*m0{fFZGK5{yc_lj90HjPYiMm**lbL_A*lNtw& zTaf|%i4bq*rqvGL_x>27|7lun#0UPtBV@OO-pC@|?AJnX0dNy%$H8w58hvlZp8uJ_S-JY zq{EbR$%)tpySTrbe;Mmy$=}$smre~05TCZ;oLC0SY`u?||ieGw1*!AF`cmpn89G&pDy!587jd#2b=7&~oDEi^hzRMn) z7T1z`T&$qxbU#l%ACE8+(zwnh_?rih>&;`GyGXl-{27o1D{K3I+IYqkKO&U5*$Psb36V zH+b*TR(*}EDkIe~RYRjYno>g1@5?R;IC)krd*uK@Zsj6vgNI@0!@!k6)z$j$@_2X2 z^Yd*~(y5Z`qB*mD)8IUv#)a;%uk!YJX6v$VB$OBIp7th>#=95yW!E|z3fy-!zoJ&x zZt!^=QL!k7L0|b-2z(}NZpN|<6s{J)Q=KAdJE6YB<(I{jFu|LCq8^qIAr2$Xr~iA2>21#cLsi{1 z3Uf#ExV4J;CysDF{u4mvjgVe@(a?Cs=11CI_$%@F&O@k*mxY`w$9 zm6+jg%OJ^zwrr|HChJ}`HDhwe$hZk61dYxov^<@sz}HwBCQWUOI}$ z^-yL43!mB?8VJ^OSg*iKCwU~q9hc|&@jn%qFRwc)f5L?O%XWPd(Yd|s0*xrUiaqNF zK?kofz$0Jqk&xO#cxRGovC-KWsf0o$WC% zy0B0xw$1&WX^7CpONRF-E5izzBFnnUD_T2-QF|lPpSQp0Y|@{dJv)FzxI*)z6;-*; zA*ZSLS2jG1Ip^r@IiZFcLntQb>3O*R`-ZRz*VtG51$&rM;uzfjsX~S|_t2ov+rKnc;3k;Z)T0PZE&==%R83~z zZlJs#4?L7yDIcTr6%t8J*qWa2Z=tIbx^^?#yk>zJ&s@ullWAwg2D&IBpB~Bs`c*z% z`3HmIm*3?KQr(w56~%NJ{9b%LK?r1|WN%RjsbY&B8P$mGjs(c)fD3pCyUMy^&8Ol$`ys*sMHu7Xh03A^{;^9=HiRPjRE8wfg0=nuhewQe}0yuoIf=dG$87=@F1OKz2VOB#?i~Bz3esYiiH^LC)s!#H*oBs4Fvx7wuQLy`>(U@>bz$ zTIrFnrgEgkF7vCL-?FN&)n@j9+Tt{&qW4$JiGa!p%wopDY*Q3T6ep)}P=ie?c&+u3 zN2ZqVok)#>LCt?b4uCF!;MJ&4jYLQx8im%U$IJ3@bcOAeuOYgehbvCTl2g&?-Csam zA-=h5Zy6C^6N!8mTeI}j1=}TA(<`TBAQ=V6f3NoK_GJ@JTBGjYT;U3iZ;mO5a{@T2 zjraoyKbi*v1B#;PWgj9GoQainmH%Sp_*DXeb!&oB;cv^c!Ar4iVc!pI^79G#T#cz7 z26GKh6!)obU>(9X0{>va!rgY8)>Q`V@cm)I;DKZhDhRM^E)L;zd@Y1D+B86dF19^8 zW>7NZ9?7ls&={RrJEDHi9bn!gOids3u&LBB5i|C`9McQSIwG{)cl_AHT@8$kgt|@Q zRPh6=eb@B}tb9>d!J+6-9Pe^6r zBx?_#P=|YX*pRCK-lbnx%{Rq(u)ZaVDQm$w!cD2uUtH9TrVV2pY+8ABuDo)tNE~Wmo>_VEwcE$3clsnFuy-W!DKkLbv=LJ2FRvWMu{Hx056X;u zz>jg7l!te_X{q7jsem8Sf~`h-j*3`~F_vbr!QGbem9;uS@M7N@3XAIe`ilQfmR_^!2=zT`}2=Z~-5f1vl=baNR5 z+W~NX0R+NmYkvTB`nG;XPa;3|{IG(yVjr}ux@qCh@%6~J0EO8XD7+A`yTG2ERnlM1 z%*>H;(hYgcO)R#*phw4GW=-pO@Dg!5yhnA!x(9p?K=MZxxC!3Otmu^%U^kX31i-8y zAMqp8c?D3^8NEUl0kHXN*vZM*W>4^R;^%LeyMzYJ4k)x9?=vOEoLgJ`N znR65v)rE$JMi^))|2i$!(upiN8l&}k2yJU$8%aM`}w*f4k`<+h~ZpbXyPzcQVk zOB4SUqH;I6$aJ!4XvEYs*VqC*wgoh^&Cz$ecf{J0_`FadGbeK;E8c(qsw%6f*z4rp zYpTtA`$1X|u@ol(Hd8sWkaF6G1NkP;>)|!qRhiVp!JP)TD^909?c$|(c}l<_#jU8U z*y&YWJ#}}Y4=8rJ%zO&lAPXYp`^RznyK&kJBq>ce`d!C2oTzSSjV?;4{TkT0tly#^&=668~7!tQy&LvjM^ ze*AN)7L#YidSHByng6Du&I-^UJpHs0&Hj0EC1AL7Z|`_}`>33LEn7UzBondiBpF|? z%$=<6$nZIR>6Q&tzq0$hGm&|YGWh^_ZF<`Drd84kp2g5bVWwPa%%$BlY-{rJu>XhI zho_NLCcudJ<>-hI;(~;rsHxg%I1Pv>Ty2^?`iTzzw4zbvAYxJFo`yx!gJ0$6Xo;SyA6Y2o}kyg3d85NfDrtH>J}8M2p|gun@O3hW&+uRC5n05m0Wsf>>KwdxlVRAP?s z?H=Jnh4wrPYD!A|BcPb;c1R&8=*#i!up$JoSEx88b@*`M?gHK-PZ>?e6Ve~T!S1oA zi-o7}A$|EoPDmBgs7FLa)wkuxdhpPNs=N;daDulA_v71tv%ppOXSS8M(;-YbK>WeR zM%HUF)?*)4b+=5n`Az>!?JI-Os81Qd&Y`hXPSViQ3KhPq7tlGF6g%#(0V>v)j_ht{ zH(ytKld4^57#VwG2NxF#&ONu{j|$b!(hJWU+p;i#zE^+h;un>mo$gICMAg`Is5HJ1 z%lEv9xfHNFg;i69UaPK>j#O+^$rt|T=|nE)Nbf2gAFK#eTm>I;REXUAGyL;Pmz@m9 z(_tV6MIj=atOsmojRFD!9vH}4{oT4L#Uw3v*vI^e511HWC%@dH=2koG{S_gU%9$}WyL=$5V2cQlIed#^ zs4Gonjux6xWKuZs&LCeYWa~in`eUg{hiH9VC!baL);$;`FRWDLLg@$>v8pFt@fAM= z1qnW@d}MdzRGaOlrFQ~)%~8`*b5j&VV@Y3-02@jnxa>$R&=0k&{{#N4XqCzeYaxO= z=5M()-tN14@mi6glhK=q3ItH!Gv;i7-JFe z#f_5DIuScz$GL=Uq1Bfy8xEO8luff6qTeY^6PA@mnu@o1YDy=jaMzYTCL3vt2aRCE zdEYNE{-pC4*)jcX#vGDJ!clS)78rOu4#`LC*_*BHg%}q~sVCzE{~{sOlGDY8xO(TCcU!?cI<^cqZdjTM zl4p@3^)j3YezC_m37Xxc^E)`a!ACLKo^@O|R^ifmTIFN)xu{<>6%lBC(;Skl&b$JE zVz%Ne7YgbUa>YnB^U7u7&c4SR+Ym*4W71%Z(f4Tmw1$QaK4AM<4sO#A%;b6(Dyb~5Ku6pZDW%L;&=haCWiu#2DoWNH66YLhB635NG@nD+- zl`=M)RkqS|OqfsYPdcL2pz6iCzc@j!Ugnv3F2OUL)htzOALj)2O21$fs(HthoDXo> zlaRXfktGOLD(#t6OErV>rt<+qzAqeZ7kRkThbCsrA&NTuknmtpKog=>F*$m4%yq&q zVa5^ih2jyQOm*oUM2Hc4pli;$Kp-E{Gq3p`PoHSm^?JxYTCO>d>j2l)E^59r5EyJ8 z8Jp-0ME^cZ&4oIbH4t9>9q9oOpo@w}$IZtbp?K4`OB78iYV(_o-!lXo@Qpvpm=L+& zTwYe8yHec{9P7B^Vq$J7luZfYI7SrRN{dUF_^?sZc78j`P>T@k#}|92gvy13(VEyTrr>h z>CZ4$h=yf}nG7x9yJklvf{pfgtXd1VQj#ZNKrrI?`R0&AIz4vOa2deOa>xLw7u!LMO>d4@ zoS^`ek|@B<)G~^`A`b31-Vonx&KmZfUv*D7_}Gffo?FHzleV^KrjIe9$BM7x-9%gX zxKy@;5WG|Ch;n;79br#M!s4u-4x~|BNx=j^E2j^~Ga7Dy7}=70XN3?Vnl8xFKJEf8 zEA>QOpf>}!`>OOlP<(dl_k&fzoXv3A#1QrmuuaCt$5$vAO7vf0&~hf>A;-4hUHY|8 zhioq8(9KzX{!qqcePSU*F@V`0ks&zOgIpJy*R-AHJQGhxNB2;sQa1HfVF$aGkTXO0 z2JYf}annj)_C~yA^KGD*<>Owk(y!mY);;V^MtkCqxEf^@eqJ#OfzgZz&8uhPX~tq@ zhrBR_i_mi0Xc-v;mwjIOIDW#D!-zTl04|Q%iS*2m{=jX^rR7tmKcjLV*j?v%? zIm25a=%HD`PkUZARqs6UspG%*8VUkRXTw!-n&((FYr^85tSVLIy5z_YS;SQxa|Tu9 z<#m1xv^j#831dnD)n%A8BXFAdnTR2qwypMSChUA}gacgrn3;}l>l3J^RHIP&V{e?S zy-m*2Y^+?67HWx13!Q@VJ?Zqok}8Q1jd0kx^{ktI07V_A;HHfJH&4_s|2G$+!|-P# z7X@0)NlzrKzayaNaR}Ha6hW&wO(~#I>=+=iiHoQ~lqwqpIdz-0 z?)07Wy|cfAmq}yRC~acur=X(J2bfV?1Cv`nu*K&or6j9#DM|OMw8^C9h)|K6vnq>D ze7vXlVc{Vf1ee?09S&M5x~}KZW0WP3)VNP-HtL*SUN|KKaZn!Ox%n-p{$gi)XXhLe zssY9f2PlXI6i`2>wn)Ex3G3y>bOiR>$JM-k@xfh6v1JevIiyx>)ijd?sd=WS`PrY* zlZU42)#FGazEk-XxZC~p%cd?fm77BgWxeF^+8fd{-+oOAB)xeT^eXX2s@R%KO0GG4 zm+bB&@7IveZxWl&rhR_7%^RYq>|Mg`jV`6f$)0gq?nBwfRF@i5(y1<_4osm9wAp=1B za+P+B81fnVzR|+*16$gcYK47wJZ&_aNy8tQH(dAjP6xhi;?;nUfn#7%Uqxw&M;NNs z0qc6*PKu6w!L<9L{KAiuy`3+R(?zCWJD7b(&o-XSk~VChkEh6IS1oWiKeaUEfuqrP zU)-7YkG!R8^ljLh1P$4NNOLPLnyg&MO3dbI41;T-xqaA`R7w*w3tOT{rxa#pUw@x0 zd)tK>yY4d_=!OSQ#(!C6{+Yq1?eYt&H}`M~MKm706OOUh_3e)lx$usxbDYaa#AS3+ z;%qM-`M?ZohK}eO@mEF5;H1DIwJimW>7HT8{EM3nXL2(=cdL8hYsVvT=%P@U+?{T$ znVuhe?8su{@oawmwtm+&Ww8l=>_%6aj}ub0aG^4;`sJ_CMGw-1`~FW{`u7E6zFW0x zU1#MP(4VPb5Q`?<&ojK4JaN_SzGk8shA8bW8reMm{b}=fs8zN`n_8?Fcrp7DV1EOD zlOBRN`(U7H$DUtYHD$rH2d7MK+DWMCk?zlmDXS(MzSX{_8{(uSAWkcR0=ldm_A08DpLbB%Cx2me%lWHU?5-JLyNlNRS;ej35kjev-JYLk| zz^At&Ug#Pb2Wsv4Ap7XSnpo163Lg5(E6wvz)Y1f^!~C|J<+|-^O7s8%afoSODWY4E zF;!-@U-gYphKGr%80v00cfW_?5`A(q>g^1|CcvT^ z7#;pz8Sc)l_$Z-ns4(9z7Eq6C07=%WKi;m-+vbZd8+~T~1a_hOf|z>n)pF+`AvXTZ z!40#q<)R16MAA;Nott8qGkHwTKnb`5;Z)Y7t_D;aw(s?lF?p?zf7B)BxqnDJmWZLM zf>KdZ3KDcYK1`aPoLdS6!nOgyRwPwM5P)wmLh9Jw7RD|>cJkuih^nQMiDIOq-J-ps zaF0^4$!l75iu0^GrVwygtP zzvlrOdIPsvG9jY<>RHBT+7vjo^OXTdqhtE*9bB6>*)-1JgD~n7+NbyPcNZo`*N1pN zX2l(UyE{b>dk;cBXiOci7DF^uP{#gZ>n}!&&_{YUIFUDnimL45M@B|^^SxYs8@p+F z6vX*lbhzqqBBb&{r>tkye^k$4AZ2pSDk*quIgE2rH z&*H{YAD^01yq_h;L@e@DSRu{gWMhLrV6zfv9P$z?w|K`@TQJ?YtK62>7u}20!1yyr z0B2zJj3g@dF=p=HiYztTFlEQ{C$zb2b)BG+FO7#Px(X?z#Xls88wpOWgr*DRj=r-> zrj89BB{jlaMLtFnVK;An@mZY61l)9FG?vJUA&Ex z%`75f_v-uB`QbgXkqpYv6217ZcN;3p^%>U2d~yAB%Rt2zMkGwf6jGHrZ77zIhrl5E zvE1ePd5|u(4ARkO@5r70e4mCDMTF&x{zU1XwMvqVVnPuB0lbeQg=1*g44{=o1cO$b zTh%xyM{Is=%#4E(p1x;%1vNw&J5Jsq>pq^+#$U_VoS?8;x^a^t1iMxUg(d$F=-ssb z?}aAe_nzZe6C;}2$z9U0@IqL4-F*y+ErswfChrNieTmU-8+=s zn~IP8yv3UMbH|KSiX2?MLI`n30bvzfFyd6B{jk?4$(QpLnSFDOUBvkPi$gUw9pV8m zs5JFMg=f!WjrfR6SdZT{R;8gLJyNu2aoUrdqRvON0YX^BT~JzvE_@`qoFM}bQp~AW zc2%0l0qvQ=gaRkRW-g~T!mbYkzu6nPi~`VwUK}p@8^mFiBPwZ$x4S;92x65(sDrZ$(7Mg)1+j9EkHBRp4mqT6jSwSt3i~8X3=)6{ip6gm z1)S{3n$Q1G%0dY!3M0|bF?+2<854piM$*__@d0Z*{5hJ2rlwDvGm|rMt0Tz`GR3bb zQy_8xm@M7~1g2e*uARR6;R|ppif9=t^+6=_!k7FUu_7dJ1}%b~C^9%)=3LV130gr9 zz+B4wdN&2x#nZNLy=zjwQUi+53unLS`nV%L)qF-+)?3f+bG)%IIVD*ngCt5kkwZ~C z3Ov#SMc(ZBpdlj}e+cz%{<@3nC-8Du%P(nR8z?45$8JZ3^P;7tw*`{})AJ~(acGcz zPMVGg223<;)(w6cYMhV7wrX35{_y4-4{;}Fa%npO{6-AucwuD?$d708lx;0Ecv)?z zroKXqzhaFLf0y@;_|irLAZD(K;(MF0N~AWOqdkeV0Y}R1R=$oP|5-dFZQtS*`0r;N zrd>H2uwv>I2ftTLK80kvtt=$jiuf|LB9mk^i~eMKw#$4Uyy50z!!HH#NUM4oUzy3zzpZlUrl!K-<#A&7x+_0T z;vCS0P9EQN}{ozKzg?ftXGZ=$`oQ*f^bH+IaJuJfydB(nuww(1gu zmvwi|q}}iA2@A*!pr~Yn#uM5REc8EUokw9CCM@>NIU7qPX|03<9GFwcEff8)pz05= zjNKcmhkV07cVL$d)5}C*B>x6+^oF#%W1zOAY{;9rFgEI zrC1SOFuYmfP?-&US=97i&?ii#YXMqXDGZV2!e%)>%bPv7lPNx(@_r5tJ<3(GCQHd1 z+81=GVon0~yFwG(r?%cDDdjlDaAOHxh|012)5|cshrJWr4|$b$&;kwnAEMd+MOFZS zR{{SVZJ}w4W@$Emgo6daiOe>!!jn~t_u6Qe`jWoy14Nb5JqW-a=?e(&Q{k)f-wYoI zOy`Hst94=!z&EQ#r2mD7)k3a72*{!)gLkX9DCFI@o4zOHqQjp)A&u*;o1$$C=Ue6 zbx4*xWpV~axZ&~jRf$|&l+cw~Zzk^U*Tv1g!T99*ekeo9$R}(fJCYg(YGNb-#Oc8a13Tp&Q|h< z$f%?%2bwnJra?ieYDfqRD8s0Ul+z+06PDS9{r-kDD<$~pdfJ*6Ir-h{ROWRNvjjli zg&7fLANsBTX+%t_OE@;2sh4o)XV%?DhL4(;pRUnY_m|0UaNHk2A{nad1?RcF>Ee5r zEy9`ila@z53LZ_CW$h1A$x-hyz2lU&&W1Wao6g=1f6iHSwul^yz`f2sA==1zJh(38 zE;Bz81ymupgddC9i-)~e4!oP_X5*;@tM_D`V0^~d&Mjet`-|ir1FDP@P~o51_pPFS!u-#?6IW)YC?5UtB^g|AYStgc8PMu#GJfBBNp8XP>d@s8j+r52OX~nc|Esg|fi{c1FkEvq@3P zaR$_zDs@Smb_(=pD1nE;r%sW=a}oh*p*9T(=A8W*t~n@%urk^ukVhKqbp6X-@@D&< zYyy*(5pF8q6Fg{I8PBQsL}7B`&r6MzdLHwDwZ&g$Mz!5$rmn@Mx1(Ly6ZCCTvw2kP zYj@RBHY$z*kK571u$Y4epbnN@Cs2(8+1Ux7BjR5Fb*91C$}g{xqkczp2`uOWA$4QG=VD-2oef6~Ny7~xBb@=X zj^k^$@`UqI;*Pq2^2mpi4^V#M5o0)b95YyfT6xN@osTKXO;3JU2gv;e&1b8qeo0l@ ztq6H{zA=xqJ8)j& z!sqUVt>&h5)j7Cho7|?dhX}mSX#AFx1bk1N?#~a{Bvfx`KKWNOBZ!aM$tQyLzG@!w6MMaQ}uQwExghkROq$`~xLfGuGlCfZKhFEZgu?hR{u|E;6s6HQa z#qRHcbe6L`w;?4GBF@2uwb&CqJuopQosC8er=4q=cYgOj9dH3@A}TN6?H9QN6Qtf9 zv?hP~E3I>{q4=Er811g60$p^F$}$$U9XA+t(#bXF4Prn)hP=+(W&c4M@l>DOLXvq` zKYl}JMdQffUf;pMFDgd^p(uZGksUaElTm~B(%T&vJqlN~4#A$qShS1j?J!4$3 z;R_U|I1C76);!MsU3>qfhA?MORK)O-GlU-l7@LdTk&ZK^#s-f;=sLFx{!JQ4dKGh`$LP^O-ez-SB&%El+Q%#<%0SQ)bFeIGx|Jkw`(|)_#^6fasC}Swz%73C} zABv&eLC(Z+R?$s&^xMz z^0qaVwI9PQb&eSTnQW(!w(+ma2w?u^$NyxcJu~5+78cLmWbuMQPhxv{sX?zNxw!{N z8e3AoN2&v)BL)#kOOQ~m{3l5VBb&qqH-UwU+d&msM8%FE{{~ygw`g zIX8U|VOJ?iEiRbL0DOGgbbwTwv9Jd~F`TKdyrEYmMrK8?` zn?g@&WE7dvmWUgu`zvJc(kn{X@bIYjzhnN%94ZU*{De2ah=quf*07&oPd)PU-ePh1a zBi(jZqT3qIH4hX!atq{aGG3?0$o{(84`#KGX+)VjaMxjZ(-UFj)OL~S$*_Jy53*OZ z4CR|aheHre_8FJ<)>bST221AT5$56`JN)@+zde`Ch7#z~QbHimthdpZ42Mp4A+8;y;G%lY87l}Rg-o?Y{%PyjVszw;|()@&fU?0w^7!w)vis8OXW;PgywHD>q zueU+~aJ!xmVv(GzrBHAlaGyN&o6ge}yX-hhh4qRaK0Lv5S6hIkU7M!3(8QpjElXo3 zthlVErZ%TBPvvS*$GzQL;fAp^1BaAU!2MA*uupo{5rzJ(n(BPfg9?%_G|Xh?dEj|a zxRO@((`Bm)PflI&PuwdG3N|F%>C$`CQv4WQRf5rBz6g?8ntH310G|s5e+&fKk<+W? z9-?J_I++jOtD|0R!gD^3OUlKCL|nS;Z`3ch0dz|W)dE_7-tbaTQlEGD7lOf^2iC1Y zN(FY2QAyz@DyP=%7jMSE>{GRDR!f|FCw_juk>z7a+^$m%d*Z;5g9pMVHkKRN4jKW{ zGhT6z)A_P}*#Q>-#}j98P~y+-E1@3f=k5&%s%Bk!r=@-v&)x;>3X$>2{-HI>o*g5q zMi$kxzeTT@Sv`h?pHVa*k#SQl01jhXVlO8sXXzfk&R04#A^;$!oJdK@hJC8+wU2{)FS4MN)~s=~j7g$3Ik9ULlNee!{GtkRVH6|%GTXXw@x zl)4H@<~;6)hPg7e{#tRnU*6|^3GE>$N!IR7Vqgf#rH_qOBV`?&MYVRU0Ut+VYgw23 zJ)~FtrW;9OMZo~KpL|YcRtU=&G>p~d1jbf8s*r#SGw!zsKqceyGaV@}s+e5r#=~Yy z;}`VIdy6Vq>5RzGr6y4vX=<4fetY{*0E6;&r>7M4h6}8>f$O5e`iD=6M}yfJM@v$X zkhFLZyyRw_UqB{a+ZtcTR!7u2o7F~6M+c1^#|psGx#b_oYMeJmZZV2cM=Q~NQDQd+7wpYH)lqZ?q6X*8-~IJ zgc_z)A2bLj{V-%^rKLkfY|R4P8juY`FjH3g1jGBpx^b*Qa1r!zeIYwEJBTu8rSfPS zGLXisvNnvUsEr?p3$x#hZ6k@sB=$(vU?|>E_4HTWejy@J=-RNUVirQ%x=a;w9_9ygt%OIW-z7N2WODS4NNHqkw?GOBbu z_&d7C3Dctw22}m~{Fg3h;Rlbn;!z;|(g0_QFn`YE$Wd`Yeb58RQ2&`BhvYuxuo(D* z@txS*Ud?#+J$}{oh1!jHvYU17;-X!Z(8^b=EyMn>PTZB0J-8nKZQ(tbEBarGdO{w| zv!6c8lV&B}o7|5*jj^N874hu+O$+Lr2m=u6$KUt9A-7KCJ|t$84`ran@vVrqMF1(8 z`ie*NfB+|~w#UwanR|0@0>@Y}jY~xupIL$L8Sq=%A&AANfJ{#-{_Sp_W^nglY(cqD z*_|4lzFJ8@au{t2qhTs;KqKv4??m@{AB07oG%EZz{F8gG+#86`? zg{nicPYPA5@8r=mKxr}gZsEATelV_*Pv_r|&K6)kRhsYEU604JkOnZ=n6mwu8Pxb; zx%>@8M$6)<-3k?^I<8nb8O7}pm)@xugT=vwiM6>vO{NhnJCX`@t|66eD)?Ax-MZuB z4>kj%ePmsY^(X{)MMRU1`JVsF?4jOGpfeq~m*M>IUwk0Np9V zY=l`%)q;66{nOu()FD?fPxnFGa~GdE8j?>&m{$YmQThH#%h?I)Sc=i=@^We(6Fs4b zk31YKs720SHKM%z%v0F>B^Ew*wFV;*aQe`ns++ z?`|}J*L@LyTn8~6h{mS^GK@ZQw6zo7&z~nirT<2b zKIUux%c1pw=f5b%zIWtg;ZqPp4vxkjGOvWobgO^M^F!tS?>GGuB>no)|FtYt`ic<{ zF8NBo?$G~w)c;>d{?}KS8UL4x`=34bw|y-E{;!n)&ZpFWKkr}P3f4gTe@}Fot!y~c zfTS>6>lHV40@UZ%&lKu@#bP`Evq{(uoPw5oM5-9LtWKX}9>0r8sRHI5KT+7R@cydd zjNeOvsx?jyt z@Sl`3;4iN)H`8u-g#jXyW1Z-gkP{Bp&!2>+S64fp!Cjdr6uHTxIJ{Ps>bAFgh{B?x zr!1WP{ry1^i$_jZq@A;fDWhfK52t$Xn(OOvfly(Buf@NS0!|jiylA!6*kw@*#CpfY z0`xRA!V>g6V#={_@PD@#op3oF3)t8&1NyYvdN$tnpe>2{i?hk~j!tq@>jQolmk$|2 z{UCglAQ`WHw=fwQn({(nX@}TP1Xo&od~$B15GM98-~iQsURe<}olR8E;pCe=dYv1* zF65*L#oQmPe7vzcq%H2a#$Cp^F1J5DqPZCxW{#~eTad_DT5^MZ%?u&B2W+^vE^_5C zbwmg!?F5%LCqQO8pI#Cy5DMB$z~KbFJBD3hvv;rsp;lCi1|+inf8$l%4+q6;4{s%2 zwa=!XvubNm6cnN!BOe#Y(bfT^5)gF<2#ra&$&f7ptU+-b9WNVBdD}BiI*?a3lhtWl z2cU%w3{5!0GuTo17!Wh@v1Pyh1;Va?oV|sghs+WpsxJ;(f0zln=yD(ol}hkfXI95j+)Qp^zOI| zzHQ}O0?D?=SUS`u-@wnTP=K6(fYXiu5YwHip*;^GBa0Q&-M&0U|;}5&nDX_rU_kg-3g|5m?G(`kV6#BMlx#OF25=o4!1W z?@SOqkJ)|8Zp->Q2`ua$I>Gy%=|B51iNGZHFH(jZ{LN}LbOhf$$yoZZ&^HxqIUZ^$ za!k_iqp5)tk^1u1xoB_KEnwln2ZhXpvIt1=qoWLad!S3iu<%t~5bM{R;^L5U0JRdq zVQ;dz_&uFpQ4!h~+HWB{u15!r7xGh872a7p7jn3#_l6#LTe^l6OWTuZK#8r4G zh{=6eDL{$S64{nwL2oE2zf~-iyq(zBXGvKEgLrtb0o_(l0q+^|v9{;O<92Jx>tnv2 z?9x{?6u4K=h4yaPjBki)mmHEV`LophdakI?dG6s$ttA5W zM++e%p`d3iMcsg@bIE7pZ_+jyZ*Cug`M3qp8T-oa;~)@x00b$R^L%&kXxnco<)X=T zw=69!%@4rorlzTYY~=7>5lrFk8QyatNkJnIAwZ4S?RxJDa43CeeGlU$?4DG_%fjr3@B ziTHx;@z~9MAOBH6MI${lCRpE;-l^Y__Q`73Ge%emQ+QC3m4@c6t!<_IlQK4HFR5lP zt)(DcKgXvpY30iYHu_65gWLfb!djR*PqoiLRJ4esBAJ`pPX#5dpup5mzfUg5oOushb8$W8fCA{gECZy3+Y?2-E-jYxrYqnA3{|`Ktd1emnpBzfX;D#vR=5 z51#&CYZ+wj6fVJpEOve3zye&K|GFTDzW<-6?`qs?kWfIpxR1YdN8gQ9X;%O1>TAQ} z(wFsL0~&c?_lEq-4GtTV`_0V-Ui6;C?gVfu{-+u(TmiYLqXi6PB>Hgvmo7F z|EIF|j%uQN*M?CPR0LF1q^k%BNKu-!L&jm2z5}Zbf-Q&7EBnF+)wUr!xHN+L-X&5#* zhMHT=EGL928vpqA_rH0{m}>UB4~cMdMaFbwh_br`rzbde}DMj z=a#~Ah|kp%HYMZh0E{t>e3|arE$#6yj{5uDaTdTpvIp#k$Ch)B2mk0={h0~CD8h89 z`g;hvIOS~8yoL37I(Dg$-TmQ*u&qnKHEyr2*=#Q8wgrWW@CZR0rB51M@!}VAUW|@w zPZap9)Xuz4vJ!R=FnvnwlG{YTI1DV2sAhgQ;cQ>;W4a`3ObuzRq9S=R72MS)Tn=*^ zo;8B##iiLvm`F{n&(uhHhBba7PwTay*<7-xwnbCdUtWWZYI^4gZH82OMm#irz5*yh zUVE`rnm;r+g>!_`1H9R!S*ml!rNt;ujDFx(Ry_7m^p6tNn*{JP0@8}?GFd+ z_{LIS-CCpjv=Tv&=O5XA+Obv#Z6Ke(?)`fM{(fG#>L@gULWz8SXh5PPiPHQR_q?9myJM>!Cnw4|SzHds^m89Y{T1qt%se0_un}|xLSh3CBP%7t2 z?excqA41B|^Px%;iZO2pJ?)=p^i42 z4f`A0Fnz zT42OQSyo5fcAx(gykib>U?8+u?^f$1QwW{&(yAogzefnizj)3l-XmoN*>Mk#?&_tgmk>CoP$EMn5Y}KMNRU4HP!BOIE3eM#wf&qlc=A{-Gn?L^ge6u?kII0j&Xv?);$v~EjyF5gRq5yybHayi2carZtGZN3Ko(SNL4ZP z5+6%6!ycO*Q?@j0qH4@lnJSVw=2*}Mfy@&asO>&W9wRL^EKrEU{MzAn;Tvwu&Y@mg zfJ!S@m_y>0ohjwQMlxfOY43h7@t7hnx(JOgPGlVPiWgsOo>t2>Dp2s5jQixXG#hK8 z4z*nIoQF=6wh@j~4L9!44ZSnrLp`b{BTHueTWE-X*1&%j2;yuzhK;ga% zwbhBOTjgx+#Ym!{QZTv`cCvZ3k7Rb`E6G-9O-1S>_1YmTy&9P9_G#i}kTvgeRYO3v zF5)vezQ~2+>`yP<^kqYE2Y7wDeLe|dapS{rtzziYqR0DiOJMkyYtuA3Cn!mwksOzCoPQIQu&oS z#SKT|;zO0GxoHe8$#(7LB>zL~FC$iPIdv|)bYZquhBeRobPqj@3N2+4I0%8#+E?v` zM+b!_s);VMwbV|%(-WB7_J`Z}ZA?M72c(bI5+H3H$~`3q)ZpgGy#2$za&mxJHoC2o zY|F;1%`6ovmcwtdp#AC2VvS@CO{Wv269JwGYLNhi!Wo_C+USvA@J3H_cizyDSoe%i z(BG5COlGfy@Y1V6SM*Pc@@SH69~rucsoB=h7q76klc76q4_$WX-B$^QultX<=8*?p ztP^A{`9}9!TcTV{@l)bt3fAE6i0CuE6hY&32z_1h~Yu#ReW{SayLk*#-$ z3^T$D7RX4`XNqDpHXF*Ze&QiJjHNkppI=9B{Sc~3v)Pak-j?Q=JCW|Ey-Q#^{8{xt z&&j0I-+r;VcGvLm=i_2;?TZEVPhnjx(XjsJBVG2U(eR;M;muaJs^!^PH*gqwhvl40 zU(vAMRy(ZC*v;nx_>jnWUk*D_mDu5~bfMRqWcFvR(j3UQ#^h9oR$tQWlg5oV zr%IUuM*`=ukfR&dr^z^XEO|O`ac6WZo~#!*Zwq;r#W&dz$KD=Ce{HrYjbWfk{P_)& zJAK-7-t1@u_6(>S2iwF%=dB~=ZKnt@s9AmPTSPsgI&~zU9+(E;=1*+kra^V`1!=eZ zx+6EMNqFM`l@qnSoS7{p=LkFxU9`#{xE3UFyi}RpI7Yv3&oJW>Iq#KOgBV+F95ef@ z()HwtFQrE^5eq01{>Nl9u5P$A%{d!QtXNDY;O5Aiglmmz&%#TUx0Yh5Y)tCUuB`FB zaD2tP>Ah%rxCW3HcwM}fBiP@HnYbRqY&8G)g*JPYOH69bK*-*irlRd;IlT83r-h@f z*_X&*+y)fjNN~^cq82Da2gxPkQ)ibTbFnAjSI{s*)2j;cH1V6hNU6)A?QqXaUsZ9h zY!x}3OW&_1KV;J|NcF-H-Pf!3Kz_rbyJ|A-=vH^Wyi<0qDiQ{59UVKkCnu{$oJxHd z2Yg=O_CU~$^}F0+qG!u-hi5hsJ?BLX-G}#ayo_PDG<>NOoODS@@+s|}s zr-?TjbMn`8aeAz@7vyxbIo+Q?t;N*DZw$PIe2CiR(HI{Jp-RpVSvJ3Myp)buzbCcn zewAN0x6C2og-0Lk(YTOq=T}a4G2vp4tl?R$amhtAF{Ha(yN0-Telg}FfFbD@<|bEi)pG12gaxzm zb1$obtxOsFhF^FR=8XfQKGB#>+U-=}d4Gg_!C)y16j2UwL7f?y`CFy6OnFh2X?sQ* zNb!eyED0PqT+q2WM&C!n%ZShbEsmNObjblL4Lb=}7W0Hk{rY@tTj~Why^F6_y9Z+p ze%^e4b0Xhu0YRHPwl(#yqVQidO*L3E#D>Or3#u}z zosc+6^Y>J}akYWlvB`p&cWbO@NLLSFV|#s4>)sn2+sh=a1|-;PduNoRxwEm1MvJuM zBQLG^dG$$O9lZuTCg4mZQ_6j|FbQ-!6QR9pI1UjACQl;gq;qK^lf~)5q%Fh4DRp$G zL8#O+Y5K?n;_~j&b(xey?r!Os${y>8!J2a3D!$ZhI^%vH0tc|zP)RaO3Z zo;p#7Gm$?wu4pCmshju7eu1}xKlQ7K%`xUy&xt#yav>Q!&F`MP^T^a)%6CJcP>m(m z++QzopJ3DJ7b5$8II?Y+opr^V=2$KmKMa6>_}S0V#!-EQ@9Fey4`0B9ll-tPlBzeC zjmp-u=ffm9=AC527t*!_lg3@I7Oh*H|$aZj(PU>+v@=uA+j)nAc?qt{u{g_ z@cvvR?&cAmeimcS-jO|0*@O}7pE+1-bj@OVfwVp#u}xBz-`5wjqU|oRuAjUZ`#dR_ z(6~c??xa=vE}U>FMN}d+^F)|V((^c=nbn&XNfI9p2&lo87ATLn7!z_&5&d+Drmb5q zev%jE?w(|OZEY*STNwG)2LwqELC87q77F5X1|1Ieoy47MuLqMZ_>^X`A}CwV4eYD? z_Y=@_Cx;;m*@p*vqRle_3K z!d4~5ej$<1Bpepwixd3(ti4f}(A^9o_!Kv6+6%x=c_Hf_KBSz#KC9hH^@Z}X1kv>H zfF|^CM#0RgXBZ4Rnt~hw#PzefFyj!sPoH~rQBMvF-zQB9za?hkTzsne(Sh`Dtmd5})F)kbe-0(y}AANUlW93du zPtdKjiN@tEe+M6zyBk|nPGXifez|kh+8l*lG`&UlpTGIRVHcp=yNECWKLUy_C7w}A zojkeh!z)+){*$>MpRGks&jlA@i^n$^E-_1eR7npga!xz9uxPbtf(0LxI%C zv$fUs*X>4rM`r(?KjFL~3DH}^!Y}?ZuKiusIvCmC??ur(_>)@r`;Do*h~Aw4Uxr6$ zDjM_jZ*|lEn&kQCfD8YTv;MQs;~Q~%hJ~Q&ni-<%pFq-|Pv(|iEw`P)SEp(GBQ^I5 z_Wn;aw#*q$~al4-;rr_jbK4cOgQWu&{f|VR|;#2q+m~^jQ zzn+#>+J(RmCiU<)Sr;Q)U5Hb)-WAo=fVMo-6$p6&>GMIz8^hwhsRe1;UdXPYC9kg_ z=cu_J-=NDWhONaj9`4qI8_p$8Z-O4|TwDUpg;r3%u1T%i+jD}qXPX>eNg*z-L^>@O z5Pnpe3Omn@B8i-21iMT>4`-+w;XC0MzLCt}1KL?cb%IDtSFc~gqgX!9Em;xTly5Cq zzXlrYDFX;z;0wV@hqw$yhVeIPb#>Q|AIbWhpdfG1Bsm~VeZHRg46%CcaE9=THY%Fo zH4f8U4BJ&;mGZuroX6>n^RN6Zn>&le`tMbocgGRM4%>@i;a``pt9*+Hf)JPK$4cJw zt0nz>tf9zDI@rN}yKl=U@dW3vu(0q@@Pjb(z$-GqO`cyTd3Jw4^mjX*l5)>B3QiQN zvPFjid>swjBVJ=wru12AT^*KUcN2gtOt~AFw6cPH>Y`1X)&DJTqQ%N)s*KIPkq8>a zw6(e80m9*RIseHGX?&Aa)f<2~U9aAivwLXPZOORj*Vs@9$H}VsnA@!II~6#P$9mG% zCjYw9O5)3x^X?11ZfP3i3w?~+fithX;N-c4eZ6wK^fki9T|Pm~s9lAD0AGGysa@;! zlO1z#o0huF2cWd%BMv9w|`h)zt>Q_sQ~lb zz7~^HH92jzcrRmR?uI9?aNlUb-6&BPHfVOV^No#*0J~PNuyM7KTUB%OJQ(O6|ZFrTz2g4#?85 zVXM~gp&P;MSAk4p>1&iufv#yr+s895ILk-w@(-n?X^CqBq41fP3-|i<`1wUBnL|H? zTWcp1yTVBf%8dOA?-iMDbGE)WsYL3FWbe9T>G>KPL7>k%w)?td0<|3{iDV$3gFV@S z!O+#ofbd4^)sKFx(mogZWeHb7`(5Fty%V(G9`LfTXe0Lb5EzW5`?fu-lfM{|d2F1w zdn=E_rxqfeo0C&#ldPtu)B-W_tP~0XbWrUKQ><0uADjo}u|w8C@3#gbeef|2C%fKc zOB<`l;dS&s;Sz~(b*fK1=i~x96gCPsrqF#UV*Z4a0IMWAA|TX%Nw3V|)N&rR zfz?OK*4XO07KbPFInJD0kI+Ig6(%ZLS|SqPe)C*ZuAQoUO#6IBgA$_-TU#(1O&soB zoQZXt--RD#Fz2Yq8yZSmX%lDa$-+MSyBw!L%z&bD2$oRBMYG+q+n-B4Bk;zUFN9Bb zlI|R{krp&7a6)ZA!V^$k(7ziL7S@6U#18alC0$SMz?J=Z3j5&g14&a(zsYwT`3%CSbT} z{;hBbi4{35SX|ITK3PP*$YO6$Pm(E|j|haHY6{7#j&eqpg+b+%-ib33FeEB8;f%pd4)ZP-I&r}Ny8 zz4Ou`gictKG!8l@@ii@uaxbm4kF8pugC0pX78Mn39vzLt@$&0Tg(1A?=Nr8?TUzO- z0)eKxm6DKWsHgj1=jUZdcG~KdWZT->+glVWM*-O^nVl`7%qr*e)dqkjVk@*5%2bbM zfAn61S4unaaDD~cOFuc}(@@PuM@?3%*{_|bdQ>o3at(a4-G7;h$#0~p$_I+8ZSeMq zKZ##~x8D{ksvff?PIQrofh3rh+iA987jE|xEz82FkJmrCR+O`p+`kmU7^2H6G}d7~ zhf zYSG%)zJAm@Gxj`>9Nx-{@GLe#@J;X6<3ZEHs*G2!x=IFq?MX&2G>jK}=J8CZ#Lv_U zWZ|+Y>Ch5K>$yDam6VPK3j59=_hQ2?YWC8sDcT1c@RslM`4b}3*fWI^GG-*I=#fg3 z8eKIWHnSx&-mz!d1%L2sz9NM#!f)bGoZ zMq;L=9u-9R7j(>~CbvK+Y zsy4ShqgUss6G`@yRLHcYbe|aYr*b({?pKddi&c=VwR3n$`DDWVmwvjBPvg#1xq2d% za#;h|EwaF*y!l;HS(zitp|``DZd+%PfasW+RMg|;Hc%DA8po`?NNgVnic@#WEGf}D zefsqJkt~z=4;yLY#}D3ay&`zycdZuKYqXpJp#ihr=f@D($Vw5Hv~;IgT_h@` zQb#s9PeWU|v_It${FdB&k7a6mfa2$2sp;Dz9{2>))i@RZ{F=oNv{nbsC#fZ2RB_^c zeeusotG_sH%ndQtqV$+`wZb^(;pS5)-c^%qcZ=lo!An9Khp3wN;$SZsk!gi=Nv)L4&uWn_J8p!toE2Iz=T*OZw0%N!dWE~1oSt# zVhonCslFi3ZtsnV)hdDAOzZe!kIp4WMF)qHjQFbI?qTd(Kp$?34Ri7MJloC-i4_;MD88t^(NGl?bU^pcs8=JU| znHlU=;%MOzO*rVmaM8zKb&m-bl6z(V>wYw12#ITG(Aw!M_Th}pDxZ;rulhEJ4m!KL zyT>_M1R{66K7MpIf~fC*qzc}H%Gj3n;j+m@Rkk5S<5m*=3|42yFR-r<70W%*h{=^j z)v66NI^!Qe{DCBpZt=@sGHFXLpL0c8T3godWNupOVy~!DeX+`Vbl^@+@2GBg;}!S$+Az3)C|?I>rnOj z)2sY;nKE_yqZh-}ps&i3Pm@oS?I)-RA|fdj<@VR_8Sp)Q+8z~gi3gP>YZ0eULZch` zxfsC=Fs)0FV0i8wE7em)_;r?qh%!k!9>(gQtD6`>kE(}pfL~KSOSWvv&dYn2r4oM!s8YIOy(9lk{G|AO z1C?3DTtN?%T=u5Y_FL}9!-w&pjawerNpOTN+Fg16&71WCRG&+b>$9Y+@~uw%@^cmE zis=!vM|I9%F)qa`sw+esc@Ej-C#PSf7XMCaFCh@N-G}T7;o-n)_FM2glfEe>oZT}d zytU6QWRc)Wz%|-pKa%&su9lt)0;& zIBdr${$T6n`E%>f7wAyz`8fqK(_ZvrTwzj^xao0@9~#jdV&OX4x-R2%!pXMo;WHyN z32KmJF)f|q>ASCAzc%ikaYg0&z&4*4ZdwieT5@*j;*mNv|IE_BADrBO-?42=5I1-6 zLRshjOZ8O&9jWT}JtDWt4IVH_2wduKtz=IaMjg#gdnVGmu1^7z>Nw3>6QluW62Y>n$;L5uzjdIkbc3f!yL!7mh)kT}eBsbPVhBsx1(MeO$o91@L_Kge( zF_p5Tlj3g;IdFWwNJ`16X$mKV6h(66*EexwZ0a2B_t)6E>2)o!$UA6Tu zGgRFfo5jzsjlYs8N55m9>JDdQXPYRBc*5I$G+(}QncePx4ty@`G{rxUEhWVHu!FVY zVak7BH$8gnaP{9!U)|qF`{&Wbf0^~{zninMbtjLrzG$&Kk?d?THd zm7ALjF_AdV0tC!*^YfkTT^4Dl?W_q6=+sUCl+;yI%vuepx|yik#%`L4`}QA^h8)P= zvDc#`ySux&MDNIZdwWmypPpHnO}nRGacCMZYWV@+=Iq(ImcP^z5IhekLw??Jz-v@5 zw|z0n%`HT1>{387f`XKehLI$lju{byq`sT_hrc?bzFiUm=mR%7DR8MCuMglWO2$xx z%~XZ<_wQ87?(W~ba2t~)@2%tN%yz$SI4=K`l#Gn#IUDdaDj~rJj?@MU9mnXRdzKu* zlv4@2D>P=qYc85Ejczl7>)&EOs;dxkat=SN&y=e_yU4-azHBbLycb_SI5l{?^!~3+ zT}n!SDpIvgZ%jqS)%xUGr|^pxXc2i(`Ff0#L7Z`eyCRjsvmaqUr?0TE2m}PQ11BVc zO1@G?Pylf^vD&P=WKVQ=*W9>!eK8|#Gu_XRUx-`)Wlf2+;_%Yc(&7i&wMOZ~q*&?B z(`EU7a6@%3HTkt(vEUqKqeBY9M`=r-mI}_HgQ;-S9G6t;)zym zhVsD|qps)bm7#{}$D_|if?}=T_8h2;S9-zUW@IY)D-w2>g}x?dr57CCx@QwX2zf-V zKo3zbbcV+&GVuHWjCp2Bsvf{7Wix?~*`|X8{`7z~0(G|oR9Yy_XtR6_(C+#U5pxw1 z@on|i4#CYlvF}ynVS;HTDk;`wXgQ50i!$(wIpl|g} zbS8uZ*NHc~fLJp)UfOMv&Pz+H{H2bLqQmo&0^|Bzz;^+9FP|#g&J@{OL;zkmfz(t9 z6ae%ed3!|RpXvX z0f9ot#?&n(hle(KfKbbNf}%DkCBhSOQ7U(C10d7MXg?W^-{3iSQyXgc;a7u>klqbG9G-1;69 zALPDM^)wf7I^LGnHELGVuYBiEdjq=|otT?=n_9tHvYJZoeWi{Tm31Pa(W_GtYK#EX zOM_5L>zePvZ`}V06%}@v2CADk1|s3d$5aIFN3blmft{V62d?WDl3qoRz6Z)1pAWOj zbQ*KEFh`s;WN`CzrL`)kCg7vRqe=ZK()Rqe$(al`e4OBDMs_&q^CDczbT>ffz`o%i z%JSmN@l^ib^MjeyR@lsQX!g1E1><)+@>WVw$!v>?WS|)R!IBT6;o+{nqB!j_&?Gnc zEm`Kshe`TfOfP?Hpm|OIxjl8M1+MlCycH_KpwT-M<6AMN_L=UkSGT))1j<#u@u1_L zw5i~L^GQ%p&=OFa83R-}O8XZTRhgK0?Q@-{r-{?Z^8a2uY8Fs;rpU=bR7eOy#|nDm zpD(p5hh^h%DxgZO5P_y2D^TC3GiQsA=Z37gz#oh;_-Gcoji=(=vOizrPMC2LC+49=@a7G+qoPckSkP@ z+~FTTo^j(X=e)h@^=1~U>aa({Qa60M+w6i+DpK0>o*`YL+Df-JcJalChBQrQIs(y4 zcjoZ$VcV#vnw6E6O)I$s^J7MOlfA1~){@_9dWC5mx;U46<C*1@b(=j-DgTWm z%o+EuU>9}ryu;_#3>V|;1&SvAvUKHWjB~dsio+Ftb`>ewi(OYsCO*I}F|H%7iJcp& z4H-4_W4<%E!b%6Rw6v=t#4M-P)ZEy<&vtbh`5tv$^4%H}!Z@Hz zLp>!WrH#g*o@?_fqme1rs@dsjX)|;w9uuIZN1DclrnsdX(PVygred?a&WPsAnmQ(S zu+0W!d&5Yyg!7g%&yD?;Db$v-zjEy``G7L(+YVIti%?ozS z*FLGZ?cU@MX-bqamE8TSh+$y0e8HD*J>?~}7P-@NEz0shtlAlxJUA}rv@95bj>n4_ z%dyC7PeeAxA1lQ1^%<756@9RXc11NeNNwegMnpz(m!si4yS=4S(bP4Oa)IGvT&0r_ z+`78eN5^JWpFRz^C+zV^_re_>uJNU|;IH@MJa)l=WqE5DNI|Li;zg>w!qf2`t+?*d z;o(Up&uL6S26dK7RsJdG>lWs6pXA52&tgaHqmmk;U1L?%mpou;<=0$}V6_-I3}4Wu z?PKF-NFS6=t^2mfZf(A8lbQ-~$XMM)3-6R}p73rak?42z>eX&ISnm~(YkV-tFhD)f zoNXL<3BWJ2l@*lN0P$|~gw+Rqmf+k+Tu^YnQB>&(o3W-Pmg^&Ih z6bAX0mBnpoYwKbU^#J(J0PUe>gp0YTxOn%`Zot751r^nY^nZ}nERB|)-n}>>-J0s6 z!tdWTAGmG4w}%#`mONKmhP&EN%g}Z&Cyq{cJzCBi#b0p{5pZ zt*ELTshvO4b+93wSyiQWLIhM*J_%f5zs`M>-9Kin1Q4;BzlZ=b7(FAl@jIBjO3jxq zZ?`@ee4FTzyfOvMuC8@(f91+3{wFBX99evs^V2x?fPSkQZib&B9(V!Wub07K@X@+v z{M$tQm*C(?=iTH}HIg1j<{JxJA=WF22?++##l-XfUV7ijm972Qq$C+2{2LV<*WEU^ z6`9)fD7P>_ZfonYrk>s%p+0Y&s6cKdGqXzC8*7e)LPHU=k)D2KBkuyE2gUW~KP{NV z-hA^w$Qc+I-05QF;9#`oU|?W)+xGclSD&nfEYzkiKO8h$deO57LqO;ztkA{re^-#1pe158LM@Jtn9ZPO3`9hW-1M5|GHP zlE=S+5M@P*6Qn4oMEL{~FNX3~;4xdKfyCAwdww}bU%oZt6d7=0D?)Jq^d*>3*cC`LYkd9JQ}La=&U9JO#bsYyPf~_cHH=l#&fLvp4zM7d z3f`>CNcB#wxlL2>VA=}S&&L4^>XmY3g2v%Ea|W{sL%>Jfog_AE2rGrDaS zCp3xGU|vPc5S69j)?2Tj^l-tI5wjiLqFx_TfARe$?@fSW?>FKC!f7TWwqrJNgDXo* zJy`;iX5$c0Wj|Y=)SAy(U+KSYQH?EgYDf_CJ;6AwH>Te+^Rk`+trgQ=#aVb_~@$&sO{d%@R* zqJPgVuksZoZS6`gdWt>cGYbFwm?qoZ-TmlzAsK#k(0$`inb}IJs-gdL2d9VLZD_Q* zPO-iakE6Phy!^-i`8kRZQdL>m1;ndjEa}x_ry8O+Whn;S{<_T7g|)R$uL~M*a|l6r z6RS5P+CIAD*(p}*y(jk7yZ)S!CW;cr-gkt}kd!bsz>hoS93*n*vSJ?ed?Z=x6tTP(PyHIX&RlKoLRj+2ZDi z-nX1g(g-h zy&QUVo}S(bhk&w(+ihr8+su?1_a#a4@Hp;d0Jc$6D|%zMdTpxqG)t3XtfG7 zjGyLy7}Ti3qOUzHrujn8f-law3lz!E1X$Va`AmKcSkf}5K(F>$l}&$)aXnt~nL(cD zw+gU5>CL#MRCfYLOAA%)Z`X~W3KjM_(Tf*-{~?53R`UW)5SNrxcNSEg3Ag3)BMHCK zGee}d?GzLc)337YsbI^Fny0zKAS>@f-n0RlrLRDo3S1M)%fcpPoYVHc7aGdAe4vW! z2(MQdL}}f@>Q&WzNZM(hI;*LpBiKk6cu%|-p+StUb*kPdkq{G8HZzMo6L_X)qB5~= zQJdCIz^GzqdE@vKm7+>WHICj$S<9(Bghjd|YZ9={=S6HY^46?8fcWX)$OLz+wzhZ< z`EVh;dsTze4A)2*^?Hq7b+_r!ufajS6`BjhXB22I1hp|;y#q_wO?%5GE6Ags@&E(- zC}5}+71+(KrEYa-7*pX26}?uX#f%{Uj+$^O4Ctx zGrK((FU=HiE<0(z)KStlt7NOysh zCN8rYlW=KOqRZ;mWfWP8A81H(+#7rU{%rl*zNDi4f^7R(0EOAwf1+i6OHFA@thXw> zdM)-xNl1kt+NI92M^FS;?}mOnZrYdWviELRT1nXDm7QJVA@$)T2tJa2|JSc8*REM& zSNc`R0@BjDK=Ax0?v^$nv9kz5iGL0aEk&XLTvUq;t(T+LnlzYP+V0F!^fIhZo?@__ zVE3)Q_3*;f$`na%;j9LY8=Jvu=aD zHX91>x_nhD>EZR^Zj}WQFB`tLUPgtjvJ@lU^5yffICK3oC$nkyX|ISq)C53`QhXOf zF0W$MFYG_Dgs9_VPmlM@b+Iew z&%dANxa5#&r>OFLHTtOQb@wSYVM|e$iFRePET7#{vqu)sKeIjJy(d`eVq%Fg7Z)yI zcv=S=dB4yxMvAHeSN3P1Rkci`V@w(>`t$|2-`@w;vzi@ai*ctT$AAVY>#U*CVdV&s zA0z3WcEn`wjb2?9sPqrIiI|uelcOSQ>{`Z{QNJ$oxWaN}WReNT)H;~aF*NLHd#m|Y zRpSs^>xp*~rvGR>zS)4Rmf&7239BVeV+oL&7kq#lDTG(QVeg;e7F{KGus&@MUbv3( z8EEo0GAi&Anw9lrU^QF4UgMYES+-PyaV|2dRHHLvt1NernV6hh|D2)I*O>Jl2!@)n zkOEZ|4rYL;pxvgTR#)HzG$nFcfjx!q)G5CzhJ5EmhE*YFs!2)I`GIkogoFBQ7;55L zpdz;Jo?dhVl^5$fBnlJLnFU@4(G0*W6Gq3A zad2?T2G83oCxvS39DR+qpQ?Bo7Vr7YUN=p|vJTa-+kmMc9x9;YuIx54+YCBk2{S6h zbdjefK)_;BW0E0G9Px5=WQ?H7r@GRu)nOgKcK@xz$C%hSV41+#-!I-@q-8r9^s+j5 znPS~k>@+>7`}EmIWn*JRveAP-5IZiOhlgtd6bs5G07iVhyCDT+y<&*0G3pER>^d2J zRnb}5NCR;jPft)KVvp>o>BA~I-N;3~=cU%r)SQbS|H}}45xn3JQbj+Z@e&r(g=@% z6h)|%7uRNDu`zw@2_kNOCw&cYOx5_!yuq;k-XU;ZjNQx!F4t@Fi4}>U*!1<^Z31VL1jzXg0Z8iubw|I@xrY*>kLwAaZe6YNQsn*AYfTVe0tSB(Tj`8 z75O%veEkHP-W4fn9sdNW=!Sni4cnV9fr}zJon0=!Kb8W@FM2hQnjz(Ldo z;N2YSRdu>X9Pk(pfV7kEDBs{x`?Mc{mug^kx}II{8)y2L(kDsp-ZEwX$1HZ}H_oPzEYRsg1MDc+w-R%!oVLNPA2D;Adep)p@|>#HenR~eX;K)!&C8U@=An%_wK5oq;1x@)= dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zpa.app_connector_status - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zpa.app_connector_status[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/agent.yml b/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/base-fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/base-fields.yml deleted file mode 100755 index 35ed3b7e09..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zpa -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zpa.app_connector_status diff --git a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/ecs.yml b/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/ecs.yml deleted file mode 100755 index d9e0a461e9..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/ecs.yml +++ /dev/null @@ -1,69 +0,0 @@ -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - Translated IP of source based NAT sessions (e.g. internal client to internet). - Typically connections traversing load balancers, firewalls, or routers. - name: client.nat.ip - type: ip -- description: |- - This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. - `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. - This field is an array. This will allow proper categorization of some events that fall in multiple categories. - name: event.category - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. - `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. - This field is an array. This will allow proper categorization of some events that fall in multiple event types. - name: event.type - type: keyword -- description: |- - Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. - Scaling factor: 1000. - For example: For a two core host, this value should be the average of the two cores, between 0 and 1. - name: host.cpu.usage - type: scaled_float -- description: Country ISO code. - name: observer.geo.country_iso_code - type: keyword -- description: Longitude and latitude - name: observer.geo.location - type: geo_point -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: IP addresses of the observer. - name: observer.ip - type: ip -- description: Operating system platform (such centos, ubuntu, windows). - name: observer.os.platform - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Organization name. - name: organization.name - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/fields.yml deleted file mode 100755 index fbb36ef10e..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/fields/fields.yml +++ /dev/null @@ -1,125 +0,0 @@ -- name: zscaler_zpa.app_connector_status - type: group - fields: - - name: session - type: group - fields: - - name: id - type: keyword - description: | - The TLS session ID. - - name: type - type: keyword - description: | - The type of session. - - name: status - type: keyword - description: | - The status of the session. - - name: zen - type: keyword - description: | - The TLS session ID. - - name: connector - type: group - fields: - - name: name - type: keyword - description: | - The App Connector name. - - name: group - type: keyword - description: | - The App Connector group name. - - name: private_ip - type: ip - description: | - The private IP address of the App Connector. - - name: timestamp - type: group - fields: - - name: authentication - type: date - description: | - Timestamp in microseconds when the App Connector was authenticated. - - name: unauthentication - type: date - description: | - Timestamp in microseconds when the App Connector was unauthenticated. - - name: memory - type: group - fields: - - name: utilization - type: double - description: | - The memory utilization in %. - - name: service - type: group - fields: - - name: count - type: double - description: | - The number of services (combinations of domains/IP addresses and TCP/UDP ports) being monitored by the App Connector. - - name: primary_dns_resolver - type: ip - description: | - The IP address of the primary DNS resolver. - - name: host_start_time - type: date - description: | - Time in seconds at which host was started. - - name: host_up_time - type: date - description: | - Time in seconds at which host was started. - - name: connector_start_time - type: date - description: | - Time in seconds at which App Connector was started. - - name: connector_up_time - type: date - description: | - Time in seconds at which App Connector was started. - - name: num_of_interfaces - type: double - description: | - The number of interfaces on the App Connector host. - - name: interface - type: group - fields: - - name: name - type: keyword - description: The name of the interface to default route. - - name: received - type: group - fields: - - name: bytes - type: double - description: The bytes received on the interface. - - name: packets - type: double - description: The packets received on the interface. - - name: errors - type: double - description: The errors received on the interface. - - name: discards - type: double - description: The discards received on the interface. - - name: transmitted - type: group - fields: - - name: bytes - type: double - description: The bytes transmitted on the interface. - - name: packets - type: double - description: The packets transmitted on the interface. - - name: errors - type: double - description: The errors transmitted on the interface. - - name: discards - type: double - description: The discards transmitted on the interface. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/manifest.yml b/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/manifest.yml deleted file mode 100755 index befec42cb9..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: App Connector Status Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Private Access App Connector Status Logs - description: Collect Zscaler Private Access App Connector Status Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9015 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zpa-app_connectors_status - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/sample_event.json b/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/sample_event.json deleted file mode 100755 index 709f1b7405..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/app_connector_status/sample_event.json +++ /dev/null @@ -1,135 +0,0 @@ -{ - "@timestamp": "2019-07-03T05:17:22.000Z", - "agent": { - "ephemeral_id": "5879b806-6298-48ab-89a6-19ddcf612162", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "nat": { - "ip": "10.0.0.1" - } - }, - "data_stream": { - "dataset": "zscaler_zpa.app_connector_status", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "package", - "dataset": "zscaler_zpa.app_connector_status", - "ingested": "2022-02-03T13:30:46Z", - "kind": "event", - "original": "{\"LogTimestamp\":\"Wed Jul 3 05:17:22 2019\",\"Customer\":\"Customer Name\",\"SessionID\":\"8A64Qwj9zCkfYDGJVoUZ\",\"SessionType\":\"ZPN_ASSISTANT_BROKER_CONTROL\",\"SessionStatus\":\"ZPN_STATUS_AUTHENTICATED\",\"Version\":\"19.20.3\",\"Platform\":\"el7\",\"ZEN\":\"US-NY-8179\",\"Connector\":\"Some App Connector\",\"ConnectorGroup\":\"Some App Connector Group\",\"PrivateIP\":\"10.0.0.4\",\"PublicIP\":\"0.0.0.0\",\"Latitude\":47,\"Longitude\":-122,\"CountryCode\":\"\",\"TimestampAuthentication\":\"2019-06-27T05:05:23.348Z\",\"TimestampUnAuthentication\":\"\",\"CPUUtilization\":1,\"MemUtilization\":20,\"ServiceCount\":2,\"InterfaceDefRoute\":\"eth0\",\"DefRouteGW\":\"10.0.0.1\",\"PrimaryDNSResolver\":\"168.63.129.16\",\"HostStartTime\":\"1513229995\",\"HostUpTime\":\"1513229995\",\"ConnectorUpTime\":\"1555920005\",\"ConnectorStartTime\":\"1555920005\",\"NumOfInterfaces\":2,\"BytesRxInterface\":319831966346,\"PacketsRxInterface\":1617569938,\"ErrorsRxInterface\":0,\"DiscardsRxInterface\":0,\"BytesTxInterface\":192958782635,\"PacketsTxInterface\":1797471190,\"ErrorsTxInterface\":0,\"DiscardsTxInterface\":0,\"TotalBytesRx\":10902554,\"TotalBytesTx\":48931771}", - "type": "info" - }, - "host": { - "cpu": { - "usage": 1 - }, - "network": { - "egress": { - "bytes": 48931771 - }, - "ingress": { - "bytes": 10902554 - } - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:33226" - } - }, - "observer": { - "geo": { - "location": { - "lat": 47, - "lon": -122 - } - }, - "ip": [ - "0.0.0.0" - ], - "os": { - "platform": "el7" - }, - "type": "forwarder", - "version": "19.20.3" - }, - "organization": { - "name": "Customer Name" - }, - "related": { - "ip": [ - "10.0.0.1", - "0.0.0.0", - "10.0.0.4", - "168.63.129.16" - ] - }, - "tags": [ - "forwarded", - "zscaler_zpa-app_connectors_status" - ], - "zscaler_zpa": { - "app_connector_status": { - "connector": { - "group": "Some App Connector Group", - "name": "Some App Connector" - }, - "connector_start_time": "2019-04-22T08:00:05.000Z", - "connector_up_time": "2019-04-22T08:00:05.000Z", - "host_start_time": "2017-12-14T05:39:55.000Z", - "host_up_time": "2017-12-14T05:39:55.000Z", - "interface": { - "name": "eth0", - "received": { - "bytes": 319831966346, - "discards": 0, - "errors": 0, - "packets": 1617569938 - }, - "transmitted": { - "bytes": 192958782635, - "discards": 0, - "errors": 0, - "packets": 1797471190 - } - }, - "memory": { - "utilization": 20 - }, - "num_of_interfaces": 2, - "primary_dns_resolver": "168.63.129.16", - "private_ip": "10.0.0.4", - "service": { - "count": 2 - }, - "session": { - "id": "8A64Qwj9zCkfYDGJVoUZ", - "status": "ZPN_STATUS_AUTHENTICATED", - "type": "ZPN_ASSISTANT_BROKER_CONTROL" - }, - "timestamp": { - "authentication": "2019-06-27T05:05:23.348Z" - }, - "zen": "US-NY-8179" - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/agent/stream/tcp.yml.hbs b/packages/zscaler_zpa/0.1.0/data_stream/audit/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/0.1.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 91496d2050..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,276 +0,0 @@ ---- -description: Pipeline for Zscaler audit logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - date: - field: json.ModifiedTime - target_field: "@timestamp" - ignore_failure: true - formats: - - ISO8601 - - date: - field: json.CreationTime - target_field: "@timestamp" - if: ctx.json.ModifiedTime == "" - ignore_failure: true - formats: - - ISO8601 - - append: - field: event.category - value: iam - - set: - field: event.kind - value: event - - script: - if: ctx.json.AuditOperationType != null && ctx.json.AuditOperationType != "" - lang: painless - source: | - def eventType = ctx.json.AuditOperationType?.toLowerCase(); - ctx.event.type = new ArrayList(); - Map referenceTable = [ - "create": ["creation"], - "delete": ["deletion"], - "update": ["change"], - "sign in": ["access", "allowed"], - "sign in failure": ["access", "error"], - "download": ["info"], - "sign out": ["access"], - "client session revoked": ["end"] - ]; - - ctx.event.type = referenceTable[eventType]; - - rename: - field: json.RequestID - target_field: event.id - ignore_missing: true - - date: - field: json.CreationTime - target_field: event.created - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.CreationTime - ignore_missing: true - - rename: - field: json.CustomerID - target_field: organization.id - ignore_missing: true - - convert: - field: organization.id - type: string - ignore_missing: true - - rename: - field: json.ModifiedBy - target_field: user.id - ignore_missing: true - - convert: - field: user.id - type: string - ignore_missing: true - - rename: - field: json.User - target_field: user.name - ignore_missing: true - - rename: - field: json.SessionID - target_field: zscaler_zpa.audit.session.id - ignore_missing: true - - json: - field: json.AuditOldValue - target_field: json.AuditOldValue - ignore_failure: true - - json: - field: json.AuditNewValue - target_field: json.AuditNewValue - ignore_failure: true - - set: - field: zscaler_zpa.audit.value.old - copy_from: json.AuditOldValue - ignore_failure: true - - set: - field: zscaler_zpa.audit.value.new - copy_from: json.AuditNewValue - ignore_failure: true - - set: - field: zscaler_zpa.audit.object.type - copy_from: json.ObjectType - ignore_failure: true - - set: - field: zscaler_zpa.audit.object.name - copy_from: json.ObjectName - ignore_failure: true - - rename: - field: json.ClientAuditUpdate - target_field: zscaler_zpa.audit.client_audit_update - ignore_failure: true - - convert: - field: json.ObjectID - target_field: zscaler_zpa.audit.object.id - type: string - ignore_missing: true - - remove: - field: json.ObjectID - ignore_missing: true - - script: - lang: painless - description: Map the fields inside AuditNewValues and AuditOldValues to it's corresponding ECS Field-set. - if: ctx.json.ObjectType != null - source: | - def objectType = ctx.json.ObjectType?.toLowerCase(); - def operationType = ctx.json.AuditOperationType?.toLowerCase(); - def valuesMap; - - if (operationType == "delete" || operationType == "sign out") { - valuesMap = ctx.json.AuditOldValue; - } else if (operationType == "create" || operationType == "sign in" || operationType == "update") { - valuesMap = ctx.json.AuditNewValue; - } - - if (objectType == "administrator") { - ctx.user.target = new HashMap(); - ctx.user.target.roles = new ArrayList(); - def roles = (valuesMap?.roles == null) ? [] : new ArrayList(valuesMap?.roles); - ctx.user.target.email = valuesMap?.email; - for (int i = 0; i < roles.length; i++) { - ctx.user.target.roles.add(roles[i].name); - } - } else if (objectType == "app connector group") { - ctx.group = new HashMap(); - ctx.group.id = valuesMap?.id; - ctx.group.name = valuesMap?.name; - ctx.observer = new HashMap(); - ctx.observer.geo = new HashMap(); - ctx.observer.geo.location = new HashMap(); - ctx.observer.geo.location.lat = valuesMap?.latitude; - ctx.observer.geo.location.lon = valuesMap?.longitude; - ctx.observer.geo.city_name = valuesMap?.cityCountry; - ctx.observer.geo.country_name = valuesMap?.location; - } else if (objectType == "browser access") { - ctx.network = new HashMap(); - ctx.network.protocol = valuesMap?.applicationProtocol?.toLowerCase(); - } else if (objectType == "authentication") { - ctx.client = new HashMap(); - ctx.client.ip = valuesMap?.remoteIP; - } else if (objectType == "certificate") { - ctx.x509 = new HashMap(); - ctx.x509.issuer = new HashMap(); - ctx.x509.alternative_names = valuesMap?.subjectAlternateNames; - ctx.x509.issuer.common_name = valuesMap?.commonName; - ctx.x509.issuer.distinguished_name = valuesMap?.issuedTo; - } else if (objectType == "executive insights user") { - ctx.user = new HashMap(); - ctx.user.target = new HashMap(); - ctx.user.target.id = valuesMap?.id; - ctx.user.target.email = valuesMap?.email; - ctx.user.target.name = valuesMap?.name; - } else if (objectType == "idp certificate") { - ctx.x509 = new HashMap(); - ctx.x509.issuer = new HashMap(); - if (valuesMap?.creationTimeInSeconds != null) { - ctx.x509.not_before = Long.parseLong(valuesMap?.creationTimeInSeconds); - } - if (valuesMap?.expirationTimeInSeconds != null) { - ctx.x509.not_after = Long.parseLong(valuesMap?.expirationTimeInSeconds); - } - ctx.x509.issuer.common_name = valuesMap?.commonName; - } else if (objectType == "server") { - ctx.server = new HashMap(); - ctx.server.address = valuesMap?.domainOrIpAddress; - } - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: server.address - target_field: server.ip - type: ip - ignore_failure: true - - append: - field: related.ip - value: "{{{server.ip}}}" - if: ctx?.server?.ip != null - allow_duplicates: false - ignore_failure: true - - date: - if: ctx?.x509?.not_after != null - field: x509.not_after - target_field: x509.not_after - ignore_failure: true - formats: - - UNIX - - date: - if: ctx?.x509?.not_before != null - field: x509.not_before - target_field: x509.not_before - ignore_failure: true - formats: - - UNIX - - rename: - field: json.AuditOperationType - target_field: zscaler_zpa.audit.operation_type - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - remove: - field: json.ObjectName - ignore_failure: true - - remove: - field: json.AuditNewValue - ignore_failure: true - - remove: - field: json.AuditOldValue - ignore_failure: true - - remove: - field: json.ModifiedTime - ignore_failure: true - - remove: - field: json.ObjectType - ignore_failure: true - - script: - description: Adds all the remaining fields in fields under zscaler_zpa.audit - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zpa?.audit[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/agent.yml b/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/base-fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/base-fields.yml deleted file mode 100755 index 05a4a1d0cc..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zpa -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zpa.audit diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/ecs.yml b/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/ecs.yml deleted file mode 100755 index 1281f975af..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/ecs.yml +++ /dev/null @@ -1,79 +0,0 @@ -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Unique identifier for the group on the system/platform. - name: group.id - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: City name. - name: observer.geo.city_name - type: keyword -- description: Country name. - name: observer.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: observer.geo.location - type: geo_point -- description: Unique identifier for the organization. - name: organization.id - type: keyword -- description: |- - Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: server.address - type: keyword -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: Unique identifier of the user. - name: user.id - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: User email address. - name: user.target.email - type: keyword -- description: Unique identifier of the user. - name: user.target.id - type: keyword -- description: Short name or login of the user. - name: user.target.name - type: keyword -- description: Array of user roles at the time of the event. - name: user.target.roles - type: keyword -- description: List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. - name: x509.alternative_names - type: keyword -- description: List of common name (CN) of issuing certificate authority. - name: x509.issuer.common_name - type: keyword -- description: Distinguished name (DN) of issuing certificate authority. - name: x509.issuer.distinguished_name - type: keyword -- description: Time at which the certificate is no longer considered valid. - name: x509.not_after - type: date -- description: Time at which the certificate is first considered valid. - name: x509.not_before - type: date diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/fields.yml deleted file mode 100755 index 635cbfb9e0..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/fields/fields.yml +++ /dev/null @@ -1,43 +0,0 @@ -- name: zscaler_zpa.audit - type: group - fields: - - name: client_audit_update - type: long - description: | - The flag to represent if the event is a client Audit log. - - name: object - type: group - fields: - - name: id - type: keyword - description: | - The ID associated with the object name. - - name: name - type: keyword - description: | - The name of the object. This corresponds to the Resource Name in the Audit Log page. - - name: type - type: keyword - description: | - The location within the ZPA Admin Portal where the Action was performed. - - name: operation_type - type: keyword - description: | - The type of action performed. - - name: session.id - type: keyword - description: | - The ID for the administrator's session in the ZPA Admin Portal. This corresponds to a successful sign in action occurring. - - name: value - type: group - fields: - - name: new - type: flattened - description: | - The new value that was changed if the action type is create, sign in, or update. - - name: old - type: flattened - description: The previous value that was changed if the action type is delete, sign out, or update. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/manifest.yml b/packages/zscaler_zpa/0.1.0/data_stream/audit/manifest.yml deleted file mode 100755 index 2d52b38a98..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Audit Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Private Access Audit Logs - description: Collect Zscaler Private Access audit logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9016 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zpa-audit - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/audit/sample_event.json b/packages/zscaler_zpa/0.1.0/data_stream/audit/sample_event.json deleted file mode 100755 index 76b48d8a4b..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/audit/sample_event.json +++ /dev/null @@ -1,89 +0,0 @@ -{ - "@timestamp": "2021-11-17T04:29:38.000Z", - "agent": { - "ephemeral_id": "75bcfb32-c04c-4455-88ed-41a659043c80", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zpa.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "iam" - ], - "created": "2021-11-17T04:29:38.000Z", - "dataset": "zscaler_zpa.audit", - "id": "11111111-1111-1111-1111-111111111111", - "ingested": "2022-02-03T13:32:04Z", - "kind": "event", - "type": [ - "creation" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:54030" - } - }, - "organization": { - "id": "98765432109876543" - }, - "related": { - "ip": [ - "1.0.0.1" - ] - }, - "server": { - "address": "1.0.0.1", - "ip": "1.0.0.1" - }, - "tags": [ - "forwarded", - "zscaler_zpa-audit" - ], - "user": { - "id": "12345678901234567", - "name": "zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com" - }, - "zscaler_zpa": { - "audit": { - "client_audit_update": 0, - "object": { - "id": "12345678901234567", - "name": "Some-Name", - "type": "Server" - }, - "operation_type": "Create", - "session": { - "id": "1idn23nlfm2q1txa5h3r4mep6" - }, - "value": { - "new": { - "description": "This is a description field", - "domainOrIpAddress": "1.0.0.1", - "enabled": "true", - "id": "72058340288495701", - "name": "Some-Name" - } - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/agent/stream/tcp.yml.hbs b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 71d3f0032d..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,306 +0,0 @@ ---- -description: Pipeline for Zscaler browser access logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - date: - field: json.LogTimestamp - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.LogTimestamp - ignore_failure: true - - append: - field: event.category - value: network - - append: - field: event.category - value: session - - set: - field: event.kind - value: event - - set: - field: event.type - value: connection - - rename: - field: json.ConnectionReason - target_field: event.reason - ignore_missing: true - - rename: - field: json.ClientPublicIp - target_field: client.ip - ignore_missing: true - - geoip: - field: client.ip - target_field: client.geo - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: client.ip - target_field: client.as - properties: - - asn - - organization_name - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ClientPublicPort - target_field: client.port - ignore_missing: true - - rename: - field: json.RequestSize - target_field: http.request.body.bytes - ignore_missing: true - - rename: - field: json.Method - target_field: http.request.method - ignore_missing: true - - rename: - field: json.ResponseSize - target_field: http.response.body.bytes - ignore_missing: true - - rename: - field: json.StatusCode - target_field: http.response.status_code - ignore_missing: true - - rename: - field: json.Customer - target_field: organization.name - ignore_missing: true - - rename: - field: json.ApplicationPort - target_field: server.port - ignore_missing: true - - set: - field: server.address - copy_from: json.Host - ignore_failure: true - - script: - lang: painless - source: | - ctx.url = new HashMap(); - def protocol = ctx.json?.Protocol?.toLowerCase(); - def domain = ctx.json?.Host?.toLowerCase(); - def endpoint = ctx.json?.URL?.toLowerCase(); - if (protocol != null && domain != null && endpoint != null) { - ctx.url.full = protocol + "://" + domain + endpoint; - } - - uri_parts: - field: url.full - ignore_failure: true - - remove: - field: json.Host - ignore_missing: true - - remove: - field: json.URL - ignore_missing: true - - remove: - field: json.Protocol - ignore_missing: true - - user_agent: - field: json.UserAgent - ignore_missing: true - - remove: - field: json.UserAgent - ignore_missing: true - - rename: - field: json.NameID - target_field: user.name - ignore_missing: true - - rename: - field: json.ConnectionStatus - target_field: zscaler_zpa.browser_access.connection.status - ignore_missing: true - - rename: - field: json.ConnectionID - target_field: zscaler_zpa.browser_access.connection.id - ignore_missing: true - - rename: - field: json.Exporter - target_field: zscaler_zpa.browser_access.exporter - ignore_missing: true - - date: - field: json.TimestampRequestReceiveStart - target_field: zscaler_zpa.browser_access.timestamp.request.receive.start - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampRequestReceiveStart - ignore_failure: true - - date: - field: json.TimestampRequestReceiveHeaderFinish - target_field: zscaler_zpa.browser_access.timestamp.request.receive.header_finish - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampRequestReceiveHeaderFinish - ignore_failure: true - - date: - field: json.TimestampRequestReceiveFinish - target_field: zscaler_zpa.browser_access.timestamp.request.receive.finish - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampRequestReceiveFinish - ignore_failure: true - - date: - field: json.TimestampRequestTransmitStart - target_field: zscaler_zpa.browser_access.timestamp.request.transmit.start - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampRequestTransmitStart - ignore_failure: true - - date: - field: json.TimestampRequestTransmitFinish - target_field: zscaler_zpa.browser_access.timestamp.request.transmit.finish - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampRequestTransmitFinish - ignore_failure: true - - date: - field: json.TimestampResponseReceiveStart - target_field: zscaler_zpa.browser_access.timestamp.response.receive.start - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampResponseReceiveStart - ignore_failure: true - - date: - field: json.TimestampResponseReceiveFinish - target_field: zscaler_zpa.browser_access.timestamp.response.receive.finish - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampResponseReceiveFinish - ignore_failure: true - - date: - field: json.TimestampResponseTransmitStart - target_field: zscaler_zpa.browser_access.timestamp.response.transmit.start - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampResponseTransmitStart - ignore_failure: true - - date: - field: json.TimestampResponseTransmitFinish - target_field: zscaler_zpa.browser_access.timestamp.response.transmit.finish - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampResponseTransmitFinish - ignore_failure: true - - rename: - field: json.TotalTimeRequestReceive - target_field: zscaler_zpa.browser_access.total_time.request.receive - ignore_missing: true - - rename: - field: json.TotalTimeRequestTransmit - target_field: zscaler_zpa.browser_access.total_time.request.transmit - ignore_missing: true - - rename: - field: json.TotalTimeResponseReceive - target_field: zscaler_zpa.browser_access.total_time.response.receive - ignore_missing: true - - rename: - field: json.TotalTimeResponseTransmit - target_field: zscaler_zpa.browser_access.total_time.response.transmit - ignore_missing: true - - rename: - field: json.TotalTimeConnectionSetup - target_field: zscaler_zpa.browser_access.total_time.connection.setup - ignore_missing: true - - rename: - field: json.TotalTimeServerResponse - target_field: zscaler_zpa.browser_access.total_time.server.response - ignore_missing: true - - rename: - field: json.XFF - target_field: zscaler_zpa.browser_access.xff - ignore_missing: true - - convert: - field: json.ClientPrivateIp - target_field: zscaler_zpa.browser_access.client_private_ip - type: ip - ignore_failure: true - - append: - field: related.ip - value: "{{{zscaler_zpa.browser_access.client_private_ip}}}" - if: ctx?.zscaler_zpa?.browser_access?.client_private_ip != null - allow_duplicates: false - ignore_failure: true - - remove: - field: json.ClientPrivateIp - ignore_missing: true - - rename: - field: json.CorsToken - target_field: zscaler_zpa.browser_access.cors_token - ignore_missing: true - - rename: - field: json.Origin - target_field: zscaler_zpa.browser_access.origin - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zpa.user_activity - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zpa.browser_access[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/agent.yml b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/base-fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/base-fields.yml deleted file mode 100755 index 26ea267ad3..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zpa -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zpa.browser_access diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/ecs.yml b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/ecs.yml deleted file mode 100755 index dd4bdea5f1..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/ecs.yml +++ /dev/null @@ -1,117 +0,0 @@ -- description: City name. - name: client.geo.city_name - type: keyword -- description: Country name. - name: client.geo.country_name - type: keyword -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Name of the continent. - name: client.geo.continent_name - type: keyword -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Region ISO code. - name: client.geo.region_iso_code - type: keyword -- description: Longitude and latitude - name: client.geo.location - type: geo_point -- description: Region name. - name: client.geo.region_name - type: keyword -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: Port of the client. - name: client.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Size in bytes of the request body. - name: http.request.body.bytes - type: long -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Size in bytes of the response body. - name: http.response.body.bytes - type: long -- description: HTTP response status code. - name: http.response.status_code - type: long -- description: Organization name. - name: organization.name - type: keyword -- description: |- - Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: server.address - type: keyword -- description: Port of the server. - name: server.port - type: long -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - The field contains the file extension from the original request url, excluding the leading dot. - The file extension is only set if it exists, as not every url has a file extension. - The leading period must not be included. For example, the value must be "png", not ".png". - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: url.extension - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: |- - Scheme of the request, such as "https". - Note: The `:` is not part of the scheme. - name: url.scheme - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/fields.yml deleted file mode 100755 index d29515193f..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/fields/fields.yml +++ /dev/null @@ -1,127 +0,0 @@ -- name: zscaler_zpa.browser_access - type: group - fields: - - name: client_private_ip - type: ip - description: | - The private IP address of the user's device. - - name: connection - type: group - fields: - - name: id - type: keyword - description: | - The application connection ID. - - name: status - type: keyword - description: | - The status of the connection. - - name: cors_token - type: keyword - description: | - The token from the CORS request. - - name: exporter - type: keyword - description: | - The Browser Access Service instance to ZPA Public Service Edge or ZPA Private Service Edge instance. - - name: origin - type: keyword - description: | - The Browser Access domain that led to the origination of the CORS request. - - name: timestamp - type: group - fields: - - name: request - type: group - fields: - - name: receive - type: group - fields: - - name: finish - type: date - description: | - Timestamp in microseconds when Browser Access Service received the last byte of the HTTP request from web browser. - - name: header_finish - type: date - description: | - Timestamp in microseconds when Browser Access Service received the last byte of the HTTP header corresponding to the request from web browser. - - name: start - type: date - description: | - Timestamp in microseconds when Browser Access Service received the first byte of the HTTP request from web browser. - - name: transmit - type: group - fields: - - name: finish - type: date - description: | - Timestamp in microseconds when Browser Access Service sent the last byte of the HTTP request to the web server. - - name: start - type: date - description: | - Timestamp in microseconds when Browser Access Service sent the first byte of the HTTP request to the web server. - - name: response - type: group - fields: - - name: receive - type: group - fields: - - name: finish - type: date - description: | - Timestamp in microseconds when Browser Access Service received the last byte of the HTTP response from the web server. - - name: start - type: date - description: | - Timestamp in microseconds when Browser Access Service received the first byte of the HTTP response from the web server. - - name: transmit - type: group - fields: - - name: finish - type: date - description: | - Timestamp in microseconds when Browser Access Service sent the last byte of the HTTP response to the web browser. - - name: start - type: date - description: | - Timestamp in microseconds when Browser Access Service sent the first byte of the HTTP response to the web browser. - - name: total_time - type: group - fields: - - name: connection.setup - type: long - description: | - Time difference between reception of the first byte of the HTTP request from web browser and transmission of the first byte towards the web server, as seen by the Browser Access Service. - - name: request - type: group - fields: - - name: receive - type: long - description: | - Time difference between reception of the first and last byte of the HTTP request from the web browser as seen by the Browser Access Service. - - name: transmit - type: long - description: | - Time difference between transmission of the first and last byte of the HTTP request towards the web server as seen by the Browser Access Service. - - name: response - type: group - fields: - - name: receive - type: long - description: | - Time difference between reception of the first and last byte of the HTTP response from the web server as seen by the Browser Access Service. - - name: transmit - type: long - description: | - Time difference between transmission of the first and last byte of the HTTP request towards the web server as seen by the Browser Access Service. - - name: server.response - type: long - description: | - Time difference between transmission of the last byte of the HTTP request towards the web server and reception of the first byte of the HTTP response from web server, as seen by the Browser Access Service. - - name: xff - type: keyword - description: |- - The X-Forwarded-For (XFF) HTTP header. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/manifest.yml b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/manifest.yml deleted file mode 100755 index 45508b1952..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Browser Access Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Private Access Browser Access Logs - description: Collect Zscaler Private Access Browser Access Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9017 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zpa-browser_access - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/sample_event.json b/packages/zscaler_zpa/0.1.0/data_stream/browser_access/sample_event.json deleted file mode 100755 index ce40a5e7eb..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/browser_access/sample_event.json +++ /dev/null @@ -1,158 +0,0 @@ -{ - "@timestamp": "2019-07-03T05:12:25.000Z", - "agent": { - "ephemeral_id": "10484a2f-b664-42ef-a849-7386c8257491", - "hostname": "docker-fleet-agent", - "id": "acf7dca8-817d-4681-bad3-1cc9bfefc49c", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 60006 - }, - "data_stream": { - "dataset": "zscaler_zpa.browser_access", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "acf7dca8-817d-4681-bad3-1cc9bfefc49c", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "network", - "session" - ], - "dataset": "zscaler_zpa.browser_access", - "ingested": "2022-02-14T07:28:10Z", - "kind": "event", - "type": "connection" - }, - "http": { - "request": { - "body": { - "bytes": 615 - }, - "method": "GET" - }, - "response": { - "body": { - "bytes": 331 - }, - "status_code": 304 - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.26.0.7:47148" - } - }, - "organization": { - "name": "ANZ Team/zdemo in beta" - }, - "related": { - "ip": [ - "81.2.69.144", - "81.2.69.193" - ] - }, - "server": { - "address": "portal.beta.zdemo.net", - "port": 443 - }, - "tags": [ - "forwarded", - "zscaler_zpa-browser_access" - ], - "url": { - "domain": "portal.beta.zdemo.net", - "extension": "woff", - "original": "https://portal.beta.zdemo.net/media/regular.woff", - "path": "/media/regular.woff", - "scheme": "https" - }, - "user": { - "name": "admin@zdemo.net" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Safari", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15", - "os": { - "full": "Mac OS X 10.14.5", - "name": "Mac OS X", - "version": "10.14.5" - }, - "version": "12.1.1" - }, - "zscaler_zpa": { - "browser_access": { - "client_private_ip": "81.2.69.193", - "exporter": "unset", - "timestamp": { - "request": { - "receive": { - "finish": "2019-07-03T05:12:25.723Z", - "header_finish": "2019-07-03T05:12:25.723Z", - "start": "2019-07-03T05:12:25.723Z" - }, - "transmit": { - "finish": "2019-07-03T05:12:25.790Z", - "start": "2019-07-03T05:12:25.790Z" - } - }, - "response": { - "receive": { - "finish": "2019-07-03T05:12:25.791Z", - "start": "2019-07-03T05:12:25.791Z" - }, - "transmit": { - "finish": "2019-07-03T05:12:25.791Z", - "start": "2019-07-03T05:12:25.791Z" - } - } - }, - "total_time": { - "connection": { - "setup": 66995 - }, - "request": { - "receive": 127, - "transmit": 21 - }, - "response": { - "receive": 73, - "transmit": 13 - }, - "server": { - "response": 1349 - } - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/agent/stream/tcp.yml.hbs b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index e489e89bd5..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,444 +0,0 @@ ---- -description: Pipeline for Zscaler user activity logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - date: - field: json.LogTimestamp - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.LogTimestamp - ignore_failure: true - - set: - field: event.category - value: iam - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - append: - field: event.type - value: user - - rename: - field: json.Username - target_field: user.name - ignore_missing: true - - rename: - field: json.ClientCountryCode - target_field: client.geo.country_iso_code - ignore_missing: true - - rename: - field: json.ClientLatitude - target_field: client.geo.location.lat - ignore_missing: true - - rename: - field: json.ClientLongitude - target_field: client.geo.location.lon - ignore_missing: true - - convert: - field: json.ClientPublicIP - target_field: client.ip - type: ip - ignore_failure: true - - remove: - field: json.ClientPublicIP - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - set: - field: host.domain - copy_from: json.Host - ignore_failure: true - - convert: - field: host.domain - target_field: host.ip - type: ip - ignore_missing: true - ignore_failure: true - - append: - field: related.hosts - value: "{{{host.domain}}}" - if: ctx?.host?.ip == null - allow_duplicates: false - ignore_failure: true - - remove: - field: host.domain - if: ctx?.host?.ip != null - - remove: - field: json.Host - ignore_missing: true - - append: - field: related.ip - value: "{{{host.ip}}}" - if: ctx?.host?.ip != null - allow_duplicates: false - ignore_failure: true - - script: - lang: painless - if: ctx?.json?.IPProtocol != null && ctx?.json?.IPProtocol != '' - source: | - ctx.network = new HashMap(); - ctx.network.type = (ctx.json.IPProtocol == 4 ? 'ipv4' : 'ipv6'); - - remove: - field: json.IPProtocol - ignore_failure: true - - rename: - field: json.Customer - target_field: organization.name - ignore_missing: true - - rename: - field: json.ServerIP - target_field: server.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{server.ip}}}" - if: ctx?.server?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ServerPort - target_field: server.port - ignore_missing: true - - rename: - field: json.ClientZEN - target_field: zscaler_zpa.user_activity.zen.client.domain - ignore_missing: true - - append: - field: related.hosts - value: "{{{zscaler_zpa.user_activity.zen.client.domain}}}" - if: ctx?.zscaler_zpa?.user_activity?.zen?.client?.domain != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ConnectorZEN - target_field: zscaler_zpa.user_activity.zen.connector.domain - ignore_missing: true - - append: - field: related.hosts - value: "{{{zscaler_zpa.user_activity.zen.connector.domain}}}" - if: ctx?.zscaler_zpa?.user_activity?.zen?.connector?.domain != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.SessionID - target_field: zscaler_zpa.user_activity.session_id - ignore_missing: true - - rename: - field: json.ConnectionID - target_field: zscaler_zpa.user_activity.connection.id - ignore_missing: true - - rename: - field: json.InternalReason - target_field: zscaler_zpa.user_activity.internal_reason - ignore_missing: true - - rename: - field: json.ConnectionStatus - target_field: zscaler_zpa.user_activity.connection.status - ignore_missing: true - - rename: - field: json.DoubleEncryption - target_field: zscaler_zpa.user_activity.double_encryption - ignore_missing: true - - rename: - field: json.ServicePort - target_field: zscaler_zpa.user_activity.service_port - ignore_missing: true - - convert: - field: json.ClientPrivateIP - target_field: zscaler_zpa.user_activity.client_private_ip - type: ip - ignore_failure: true - - remove: - field: json.ClientPrivateIP - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zpa.user_activity.client_private_ip}}}" - if: ctx?.zscaler_zpa?.user_activity?.client_private_ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.Policy - target_field: zscaler_zpa.user_activity.policy.name - ignore_missing: true - - rename: - field: json.Connector - target_field: zscaler_zpa.user_activity.connector.name - ignore_missing: true - - convert: - field: json.ConnectorIP - target_field: zscaler_zpa.user_activity.connector.ip - type: ip - ignore_failure: true - - append: - field: related.ip - value: "{{{zscaler_zpa.user_activity.connector.ip}}}" - if: ctx?.zscaler_zpa?.user_activity?.connector?.ip != null - allow_duplicates: false - ignore_failure: true - - remove: - field: json.ConnectorIP - ignore_failure: true - - rename: - field: json.ConnectorPort - target_field: zscaler_zpa.user_activity.connector.port - ignore_missing: true - - rename: - field: json.Application - target_field: zscaler_zpa.user_activity.application - ignore_missing: true - - rename: - field: json.AppGroup - target_field: zscaler_zpa.user_activity.app_group - ignore_missing: true - - rename: - field: json.Server - target_field: zscaler_zpa.user_activity.server - ignore_missing: true - - rename: - field: json.PolicyProcessingTime - target_field: zscaler_zpa.user_activity.policy.processing_time - ignore_missing: true - - rename: - field: json.CAProcessingTime - target_field: zscaler_zpa.user_activity.ca_processing_time - ignore_missing: true - - rename: - field: json.ConnectorZENSetupTime - target_field: zscaler_zpa.user_activity.connector_zen_setup_time - ignore_missing: true - - rename: - field: json.ConnectionSetupTime - target_field: zscaler_zpa.user_activity.connection.setup_time - ignore_missing: true - - rename: - field: json.ServerSetupTime - target_field: zscaler_zpa.user_activity.server_setup_time - ignore_missing: true - - rename: - field: json.AppLearnTime - target_field: zscaler_zpa.user_activity.app_learn_time - ignore_missing: true - - date: - field: json.TimestampConnectionStart - target_field: zscaler_zpa.user_activity.timestamp.connection.start - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampConnectionStart - ignore_failure: true - - date: - field: json.TimestampConnectionEnd - target_field: zscaler_zpa.user_activity.timestamp.connection.end - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampConnectionEnd - ignore_failure: true - - date: - field: json.TimestampCATx - target_field: zscaler_zpa.user_activity.timestamp.ca.tx - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampCATx - ignore_failure: true - - date: - field: json.TimestampCARx - target_field: zscaler_zpa.user_activity.timestamp.ca.rx - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampCARx - ignore_failure: true - - date: - field: json.TimestampAppLearnStart - target_field: zscaler_zpa.user_activity.timestamp.app_learn_start - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampAppLearnStart - ignore_failure: true - - date: - field: json.TimestampZENFirstRxClient - target_field: zscaler_zpa.user_activity.timestamp.zen.client.rx.first - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENFirstRxClient - ignore_failure: true - - date: - field: json.TimestampZENFirstTxClient - target_field: zscaler_zpa.user_activity.timestamp.zen.client.tx.first - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENFirstTxClient - ignore_failure: true - - date: - field: json.TimestampZENLastRxClient - target_field: zscaler_zpa.user_activity.timestamp.zen.client.rx.last - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENLastRxClient - ignore_failure: true - - date: - field: json.TimestampZENLastTxClient - target_field: zscaler_zpa.user_activity.timestamp.zen.client.tx.last - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENLastTxClient - ignore_failure: true - - date: - field: json.TimestampConnectorZENSetupComplete - target_field: zscaler_zpa.user_activity.timestamp.connector_zen.setup_complete - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampConnectorZENSetupComplete - ignore_failure: true - - date: - field: json.TimestampZENFirstRxConnector - target_field: zscaler_zpa.user_activity.timestamp.zen.connector.rx.first - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENFirstRxConnector - ignore_failure: true - - date: - field: json.TimestampZENFirstTxConnector - target_field: zscaler_zpa.user_activity.timestamp.zen.connector.tx.first - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENFirstTxConnector - ignore_failure: true - - date: - field: json.TimestampZENLastRxConnector - target_field: zscaler_zpa.user_activity.timestamp.zen.connector.rx.last - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENLastRxConnector - ignore_failure: true - - date: - field: json.TimestampZENLastTxConnector - target_field: zscaler_zpa.user_activity.timestamp.zen.connector.tx.last - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampZENLastTxConnector - ignore_failure: true - - rename: - field: json.ZENTotalBytesRxClient - target_field: zscaler_zpa.user_activity.zen.client.total.bytes_rx - ignore_missing: true - - rename: - field: json.ZENBytesRxClient - target_field: zscaler_zpa.user_activity.zen.client.bytes_rx - ignore_missing: true - - rename: - field: json.ZENTotalBytesTxClient - target_field: zscaler_zpa.user_activity.zen.client.total.bytes_tx - ignore_missing: true - - rename: - field: json.ZENBytesTxClient - target_field: zscaler_zpa.user_activity.zen.client.bytes_tx - ignore_missing: true - - rename: - field: json.ZENTotalBytesRxConnector - target_field: zscaler_zpa.user_activity.zen.connector.total.bytes_rx - ignore_missing: true - - rename: - field: json.ZENBytesRxConnector - target_field: zscaler_zpa.user_activity.zen.connector.bytes_rx - ignore_missing: true - - rename: - field: json.ZENTotalBytesTxConnector - target_field: zscaler_zpa.user_activity.zen.connector.total.bytes_tx - ignore_missing: true - - rename: - field: json.ZENBytesTxConnector - target_field: zscaler_zpa.user_activity.zen.connector.bytes_tx - ignore_missing: true - - rename: - field: json.ClientToClient - target_field: zscaler_zpa.user_activity.client_to_client - ignore_missing: true - - rename: - field: json.Idp - target_field: zscaler_zpa.user_activity.idp - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zpa.user_activity - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zpa.user_activity[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/agent.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/base-fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/base-fields.yml deleted file mode 100755 index 31eec69bf4..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zpa -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zpa.user_activity diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/ecs.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/ecs.yml deleted file mode 100755 index 3b2cad3b78..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/ecs.yml +++ /dev/null @@ -1,41 +0,0 @@ -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Longitude and latitude. - level: core - name: client.geo.location - type: geo_point -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: Organization name. - name: organization.name - type: keyword -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: Port of the server. - name: server.port - type: long -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/fields.yml deleted file mode 100755 index 8e0f0d6da7..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/fields/fields.yml +++ /dev/null @@ -1,244 +0,0 @@ -- name: zscaler_zpa.user_activity - type: group - fields: - - name: app_group - type: keyword - description: | - The application group name. - - name: app_learn_time - type: long - description: | - Time in microseconds taken for App Connectors to learn about the requested application and report the learned information to the central authority. - - name: application - type: keyword - description: | - The application name. - - name: ca_processing_time - type: long - description: | - Time in microseconds taken for processing in the central authority. - - name: client_to_client - type: keyword - description: | - The status of the client-to-client connection. - - name: client_private_ip - type: ip - description: | - The private IP address of the Zscaler Client Connector. - - name: connection - type: group - fields: - - name: id - type: keyword - description: | - The application connection ID. - - name: setup_time - type: long - description: | - Time taken by the App Connector to process a notification from the App Connector selection microservice and set up the connection to the application server. - - name: status - type: keyword - description: | - The status of the connection. The expected values for this field are: [ Open, Close, Active ]. - - name: connector - type: group - fields: - - name: ip - type: ip - description: | - The source IP address of the App Connector. - - name: name - type: keyword - description: | - The App Connector name. - - name: port - type: integer - description: | - The source port of the App Connector. - - name: connector_zen_setup_time - type: long - description: | - Time in microseconds taken for setting up connection between App Connector and ZPA Public Service Edge or ZPA Private Service Edge. - - name: double_encryption - type: integer - description: | - The double encryption status. - - name: idp - type: keyword - description: | - The name of the identity provider (IdP) as configured in the ZPA Admin Portal. - - name: internal_reason - type: keyword - description: | - The internal reason for the status of the transaction. - - name: policy - type: group - fields: - - name: name - type: keyword - description: | - The access policy or timeout policy rule name. - - name: processing_time - type: long - description: | - Time in microseconds taken for processing the access policy associated with the application. - - name: server - type: keyword - description: | - The server ID name. The server ID must be set to zero if dynamic server discovery is enabled. - - name: server_setup_time - type: long - description: | - Time in microseconds taken for setting up connection at server. - - name: service_port - type: integer - description: | - The destination port of the server. - - name: session_id - type: keyword - description: | - The TLS session ID. - - name: timestamp - type: group - fields: - - name: app_learn_start - type: keyword - description: | - Time in microseconds taken for App Connectors to learn about the requested application and report the learned information to the central authority. - - name: ca - type: group - fields: - - name: rx - type: date - description: | - Timestamp in microseconds when the central authority received request from ZPA Public Service Edge or ZPA Private Service Edge. - - name: tx - type: date - description: | - Timestamp in microseconds when the central authority sent request to ZPA Public Service Edge or ZPA Private Service Edge. - - name: connection - type: group - fields: - - name: end - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge terminated the connection. - - name: start - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the initial request from Zscaler Client Connector to start the connection. - - name: connector_zen.setup_complete - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received request from App Connector to set up data connection. The request from the App Connector is triggered by the initial request for a specific application from the Zscaler Client Connector. - - name: zen - type: group - fields: - - name: client - type: group - fields: - - name: rx - type: group - fields: - - name: first - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the first byte from the Zscaler Client Connector. - - name: last - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the last byte from the Zscaler Client Connector. - - name: tx - type: group - fields: - - name: first - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the first byte to the Zscaler Client Connector. - - name: last - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the last byte to the Zscaler Client Connector. - - name: connector - type: group - fields: - - name: rx - type: group - fields: - - name: first - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the first byte from the App Connector. - - name: last - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the last byte from the App Connector. - - name: tx - type: group - fields: - - name: first - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the first byte to the App Connector. - - name: last - type: date - description: | - Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the last byte to the App Connector. - - name: zen - type: group - fields: - - name: client - type: group - fields: - - name: domain - type: keyword - description: | - The ZPA Public Service Edge (formerly Zscaler Enforcement Node or ZEN) or ZPA Private Service Edge that received the request from the Zscaler Client Connector. - - name: bytes_rx - type: long - description: | - The additional bytes received from the Zscaler Client Connector since the last transaction log. - - name: bytes_tx - type: long - description: | - The additional bytes transmitted to the Zscaler Client Connector since the last transaction log. - - name: total - type: group - fields: - - name: bytes_rx - type: long - description: | - The total bytes received from the Zscaler Client Connector by the ZPA Public Service Edge or ZPA Private Service Edge. - - name: bytes_tx - type: long - description: | - The total bytes transmitted to the Zscaler Client Connector from the ZPA Public Service Edge or ZPA Private Service Edge. - - name: connector - type: group - fields: - - name: domain - type: keyword - description: | - The ZPA Public Service Edge or ZPA Private Service Edge that sent the request from the App Connector. - - name: bytes_rx - type: long - description: | - The additional bytes received from the App Connector since the last transaction log. - - name: bytes_tx - type: long - description: | - The additional bytes transmitted by the App Connector since the last transaction log. - - name: total - type: group - fields: - - name: bytes_rx - type: long - description: | - The total bytes received from the App Connector by the ZPA Public Service Edge or ZPA Private Service Edge. - - name: bytes_tx - type: long - description: |- - The total bytes transmitted to the App Connector from the ZPA Public Service Edge or ZPA Private Service Edge. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/manifest.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/manifest.yml deleted file mode 100755 index df6b66c514..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: User Activity Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Private Access User Activity Logs - description: Collect Zscaler Private Access User Activity Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9018 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zpa-user_activity - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/sample_event.json b/packages/zscaler_zpa/0.1.0/data_stream/user_activity/sample_event.json deleted file mode 100755 index 7cb6453ce9..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_activity/sample_event.json +++ /dev/null @@ -1,159 +0,0 @@ -{ - "@timestamp": "2019-05-31T17:35:42.000Z", - "agent": { - "ephemeral_id": "2686f611-4bf3-4df9-8934-843cbd32d161", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 45, - "lon": -119 - } - }, - "ip": "81.2.69.193" - }, - "data_stream": { - "dataset": "zscaler_zpa.user_activity", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "iam", - "dataset": "zscaler_zpa.user_activity", - "ingested": "2022-02-03T13:34:37Z", - "kind": "event", - "type": [ - "info", - "user" - ] - }, - "host": { - "ip": "175.16.199.1" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:59296" - } - }, - "network": { - "type": "ipv6" - }, - "organization": { - "name": "Customer XYZ" - }, - "related": { - "hosts": [ - "broker2b.pdx" - ], - "ip": [ - "81.2.69.193", - "175.16.199.1", - "67.43.156.12" - ] - }, - "server": { - "ip": "175.16.199.1", - "port": 10011 - }, - "tags": [ - "forwarded", - "zscaler_zpa-user_activity" - ], - "user": { - "name": "ZPA LSS Client" - }, - "zscaler_zpa": { - "user_activity": { - "app_group": "ABC Lab Apps", - "app_learn_time": 0, - "application": "ABC Lab Apps", - "ca_processing_time": 1330, - "client_to_client": "0", - "connection": { - "id": "SqyZIMkg0JTj7EABsvwA,Q+EjXGdrvbF2lPiBbedm", - "setup_time": 192397, - "status": "active" - }, - "connector": { - "ip": "67.43.156.12", - "name": "ZDEMO ABC", - "port": 60266 - }, - "connector_zen_setup_time": 191017, - "double_encryption": 0, - "idp": "Example IDP Config", - "policy": { - "name": "ABC Lab Apps", - "processing_time": 28 - }, - "server": "0", - "server_setup_time": 465, - "service_port": 10011, - "session_id": "LHJdkjmNDf12nclBsvwA", - "timestamp": { - "ca": { - "rx": "2019-05-30T08:20:42.231Z", - "tx": "2019-05-30T08:20:42.230Z" - }, - "connection": { - "start": "2019-05-30T08:20:42.230Z" - }, - "connector_zen": { - "setup_complete": "2019-05-30T08:20:42.422Z" - }, - "zen": { - "client": { - "rx": { - "first": "2019-05-30T08:20:42.424Z", - "last": "2019-05-31T17:34:27.348Z" - } - }, - "connector": { - "tx": { - "first": "2019-05-30T08:20:42.424Z", - "last": "2019-05-31T17:34:27.348Z" - } - } - } - }, - "zen": { - "client": { - "bytes_rx": 7115, - "bytes_tx": 0, - "domain": "broker2b.pdx", - "total": { - "bytes_rx": 2406926, - "bytes_tx": 0 - } - }, - "connector": { - "bytes_rx": 0, - "bytes_tx": 7115, - "domain": "broker2b.pdx", - "total": { - "bytes_rx": 0, - "bytes_tx": 2406926 - } - } - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/agent/stream/tcp.yml.hbs b/packages/zscaler_zpa/0.1.0/data_stream/user_status/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index dd43d92952..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,239 +0,0 @@ ---- -description: Pipeline for Zscaler user status logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - date: - field: json.LogTimestamp - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.LogTimestamp - ignore_failure: true - - set: - field: event.category - value: iam - - set: - field: event.kind - value: state - - append: - field: event.type - value: info - - append: - field: event.type - value: user - - rename: - field: json.CountryCode - target_field: client.geo.country_iso_code - ignore_missing: true - - rename: - field: json.Latitude - target_field: client.geo.location.lat - ignore_missing: true - - rename: - field: json.Longitude - target_field: client.geo.location.lon - ignore_missing: true - - rename: - field: json.PublicIP - target_field: client.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.Hostname - target_field: host.hostname - ignore_missing: true - - rename: - field: json.Platform - target_field: host.os.platform - ignore_missing: true - - rename: - field: json.Customer - target_field: organization.name - ignore_missing: true - - append: - field: related.hosts - value: "{{{server.domain}}}" - if: ctx?.server?.domain != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ZENCountryCode - target_field: server.geo.country_iso_code - ignore_missing: true - - rename: - field: json.ZENLatitude - target_field: server.geo.location.lat - ignore_missing: true - - rename: - field: json.ZENLongitude - target_field: server.geo.location.lon - ignore_missing: true - - rename: - field: json.Username - target_field: user.name - ignore_missing: true - - rename: - field: json.CertificateCN - target_field: x509.issuer.common_name - ignore_missing: true - - rename: - field: json.SessionID - target_field: zscaler_zpa.user_status.session.id - ignore_missing: true - - rename: - field: json.SessionStatus - target_field: zscaler_zpa.user_status.session.status - ignore_missing: true - - rename: - field: json.Version - target_field: zscaler_zpa.user_status.version - ignore_missing: true - - rename: - field: json.ZEN - target_field: zscaler_zpa.user_status.zen.domain - ignore_missing: true - - convert: - field: json.PrivateIP - target_field: zscaler_zpa.user_status.private_ip - type: ip - ignore_failure: true - - append: - field: related.ip - value: "{{{zscaler_zpa.user_status.private_ip}}}" - if: ctx?.zscaler_zpa?.user_status?.private_ip != null - allow_duplicates: false - ignore_failure: true - - date: - field: json.TimestampAuthentication - target_field: zscaler_zpa.user_status.timestamp.authentication - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampAuthentication - ignore_missing: true - - date: - field: json.TimestampUnAuthentication - target_field: zscaler_zpa.user_status.timestamp.unauthentication - ignore_failure: true - formats: - - ISO8601 - - remove: - field: json.TimestampUnAuthentication - ignore_missing: true - - rename: - field: json.TotalBytesRx - target_field: zscaler_zpa.user_status.total.bytes_rx - ignore_missing: true - - rename: - field: json.TotalBytesTx - target_field: zscaler_zpa.user_status.total.bytes_tx - ignore_missing: true - - rename: - field: json.Idp - target_field: zscaler_zpa.user_status.idp - ignore_missing: true - - rename: - field: json.ClientType - target_field: zscaler_zpa.user_status.client.type - ignore_missing: true - - rename: - field: json.TrustedNetworks - target_field: zscaler_zpa.user_status.trusted_networks - ignore_missing: true - - rename: - field: json.TrustedNetworksNames - target_field: zscaler_zpa.user_status.trusted_networks_names - ignore_missing: true - - script: - source: | - ctx.zscaler_zpa.user_status.fqdn = new HashMap(); - ctx.zscaler_zpa.user_status.fqdn.registered = (ctx.json.FQDNRegistered != "0"); - if: ctx.json.FQDNRegistered != null - ignore_failure: true - - remove: - field: json.FQDNRegistered - ignore_missing: true - - rename: - field: json.FQDNRegisteredError - target_field: zscaler_zpa.user_status.fqdn.registered_error - ignore_missing: true - - split: - field: json.SAMLAttributes - target_field: zscaler_zpa.user_status.saml_attributes - separator: ',' - ignore_failure: true - - remove: - field: json.SAMLAttributes - ignore_failure: true - - split: - field: json.PosturesHit - target_field: zscaler_zpa.user_status.postures.hit - separator: ',' - ignore_failure: true - - remove: - field: json.PosturesHit - ignore_failure: true - - split: - field: json.PosturesMiss - target_field: zscaler_zpa.user_status.postures.miss - separator: ',' - ignore_failure: true - - remove: - field: json.PosturesMiss - ignore_failure: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zpa.user_status - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zpa.user_status[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/agent.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/base-fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/base-fields.yml deleted file mode 100755 index 8e148e061f..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zpa -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zpa.user_status diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/ecs.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/ecs.yml deleted file mode 100755 index 7de21669b3..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/ecs.yml +++ /dev/null @@ -1,40 +0,0 @@ -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Longitude and latitude. - level: core - name: client.geo.location - type: geo_point -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Organization name. - name: organization.name - type: keyword -- description: Country ISO code. - name: server.geo.country_iso_code - type: keyword -- description: Longitude and latitude. - level: core - name: server.geo.location - type: geo_point -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword -- description: List of common name (CN) of issuing certificate authority. - name: x509.issuer.common_name - type: keyword diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/fields.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/fields.yml deleted file mode 100755 index 5a0ba28658..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/fields/fields.yml +++ /dev/null @@ -1,93 +0,0 @@ -- name: zscaler_zpa.user_status - type: group - fields: - - name: client.type - type: keyword - description: | - The client type for the request (i.e., Zscaler Client Connector, ZPA LSS, or Web Browser). - - name: idp - type: keyword - description: | - The name of the identity provider (IdP) as configured in the ZPA Admin Portal. - - name: fqdn - type: group - fields: - - name: registered - type: boolean - description: | - The status of the hostname for the client-to-client connection. The expected values for this field are true or false. - - name: registered_error - type: keyword - description: | - The status of the registered hostname. - - name: postures - type: group - fields: - - name: hit - type: keyword - description: | - The posture profiles that the Zscaler Client Connector verified for this device. - - name: miss - type: keyword - description: | - The posture profiles that the Zscaler Client Connector failed to verified for this device. - - name: private_ip - type: ip - description: | - The private IP address of the Zscaler Client Connector. - - name: saml_attributes - type: keyword - description: | - The list of SAML attributes reported by the IdP. - - name: session - type: group - fields: - - name: id - type: keyword - description: | - The TLS session ID. - - name: status - type: keyword - description: | - The status of the session. - - name: timestamp - type: group - fields: - - name: authentication - type: date - description: | - Timestamp in microseconds when the Zscaler Client Connector was authenticated. - - name: unauthentication - type: date - description: | - Timestamp in microseconds when the Zscaler Client Connector was unauthenticated. - - name: total - type: group - fields: - - name: bytes_rx - type: long - description: | - The total bytes received. - - name: bytes_tx - type: long - description: | - The total bytes transmitted. - - name: trusted_networks - type: keyword - description: | - The unique IDs for the trusted networks that the Zscaler Client Connector has determined for this device. - - name: trusted_networks_names - type: keyword - description: | - The names for the trusted networks that the Zscaler Client Connector has determined for this device. - - name: version - type: keyword - description: | - The Zscaler Client Connector version. - - name: zen.domain - type: keyword - description: |- - The Public Service Edge (formerly Zscaler Enforcement Node or ZEN) or ZPA Private Service Edge that was selected for the connection -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/manifest.yml b/packages/zscaler_zpa/0.1.0/data_stream/user_status/manifest.yml deleted file mode 100755 index 68be6616e6..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: User Status Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Private Access User Status Logs - description: Collect Zscaler Private Access User Status Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9019 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zpa-user_status - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zpa/0.1.0/data_stream/user_status/sample_event.json b/packages/zscaler_zpa/0.1.0/data_stream/user_status/sample_event.json deleted file mode 100755 index fe6f41e163..0000000000 --- a/packages/zscaler_zpa/0.1.0/data_stream/user_status/sample_event.json +++ /dev/null @@ -1,130 +0,0 @@ -{ - "@timestamp": "2019-05-31T17:34:48.000Z", - "agent": { - "ephemeral_id": "24dbe515-d3ac-4cb8-aa21-eeee2c2f9204", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 45, - "lon": -119 - } - }, - "ip": "81.2.69.144" - }, - "data_stream": { - "dataset": "zscaler_zpa.user_status", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "iam", - "dataset": "zscaler_zpa.user_status", - "ingested": "2022-02-03T13:36:02Z", - "kind": "state", - "type": [ - "info", - "user" - ] - }, - "host": { - "hostname": "DESKTOP-99HCSJ1", - "os": { - "platform": "windows" - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:57146" - } - }, - "organization": { - "name": "Customer XYZ" - }, - "related": { - "ip": [ - "81.2.69.144" - ] - }, - "server": { - "geo": { - "location": { - "lat": 47, - "lon": -122 - } - } - }, - "tags": [ - "forwarded", - "zscaler_zpa-user_status" - ], - "user": { - "name": "ZPA LSS Client" - }, - "x509": { - "issuer": { - "common_name": "loggerz2x.pde.zpabeta.net" - } - }, - "zscaler_zpa": { - "user_status": { - "client": { - "type": "zpn_client_type_zapp" - }, - "fqdn": { - "registered": false, - "registered_error": "CUSTOMER_NOT_ENABLED" - }, - "idp": "IDP Config", - "postures": { - "hit": [ - "sm-posture1", - "sm-posture2" - ], - "miss": [ - "sm-posture11", - "sm-posture12" - ] - }, - "saml_attributes": [ - "myname:user", - "myemail:user@zscaler.com" - ], - "session": { - "id": "vkczUERSLl88Y+ytH8v5", - "status": "ZPN_STATUS_AUTHENTICATED" - }, - "timestamp": { - "authentication": "2019-05-29T21:18:38.000Z" - }, - "total": { - "bytes_rx": 31274866, - "bytes_tx": 25424152 - }, - "trusted_networks": "TN1_stc1", - "trusted_networks_names": "145248739466696953", - "version": "19.12.0-36-g87dad18", - "zen": { - "domain": "broker2b.pdx" - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/docs/README.md b/packages/zscaler_zpa/0.1.0/docs/README.md deleted file mode 100755 index 5d55fc4508..0000000000 --- a/packages/zscaler_zpa/0.1.0/docs/README.md +++ /dev/null @@ -1,1248 +0,0 @@ -# Zscaler ZPA - -This integration is for Zscaler Private Access logs. It can be used -to receive logs sent by LSS Log Receiver on respective TCP ports. - -The log message is expected to be in JSON format. The data is mapped to -ECS fields where applicable and the remaining fields are written under -`zscaler_zpa..*`. - -## Setup steps - -1. Enable the integration with the TCP input. -2. Configure the Zscaler LSS Log Receiver to send logs to the Elastic Agent -that is running this integration. See [_Setup Log Receiver_](https://help.zscaler.com/zpa/configuring-log-receiver). Use the IP address/hostname of the Elastic Agent as the 'Log Receiver Domain or IP Address', and use the listening port of the Elastic Agent as the 'TCP Port' on the _Add Log Receiver_ configuration screen. -3. *Please make sure to use the given response formats.* - -## Compatibility - -This package has been tested against `Zscaler Private Access Client Connector version 3.7.1.44` - -## Documentation and configuration - -### App Connector Status Logs - -Default port: _9015_ - -Vendor documentation: https://help.zscaler.com/zpa/about-connector-status-log-fields - -Zscaler response format: -``` -{"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"Platform": %j{Platform},"ZEN": %j{ZEN},"Connector": %j{Connector},"ConnectorGroup": %j{ConnectorGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"ServiceCount": %d{ServiceCount},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostUpTime": %j{HostUpTime},"ConnectorUpTime": %j{ConnectorUpTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx}}\n -``` - -Sample Response: -```json -{"LogTimestamp":"Wed Jul 3 05:17:22 2019","Customer":"Safe March","SessionID":"8A64Qwj9zCkfYDGJVoUZ","SessionType":"ZPN_ASSISTANT_BROKER_CONTROL","SessionStatus":"ZPN_STATUS_AUTHENTICATED","Version":"19.20.3","Platform":"el7","ZEN":"US-NY-8179","Connector":"Seattle App Connector 1","ConnectorGroup":"Azure App Connectors","PrivateIP":"10.0.0.4","PublicIP":"0.0.0.0","Latitude":47,"Longitude":-122,"CountryCode":"","TimestampAuthentication":"2019-06-27T05:05:23.348Z","TimestampUnAuthentication":"","CPUUtilization":1,"MemUtilization":20,"ServiceCount":2,"InterfaceDefRoute":"eth0","DefRouteGW":"10.0.0.1","PrimaryDNSResolver":"168.63.129.16","HostStartTime":"1513229995","ConnectorStartTime":"1555920005","NumOfInterfaces":2,"BytesRxInterface":319831966346,"PacketsRxInterface":1617569938,"ErrorsRxInterface":0,"DiscardsRxInterface":0,"BytesTxInterface":192958782635,"PacketsTxInterface":1797471190,"ErrorsTxInterface":0,"DiscardsTxInterface":0,"TotalBytesRx":10902554,"TotalBytesTx":48931771} -``` - -### Audit Logs - -Default port: _9016_ - -Vendor documentation: https://help.zscaler.com/zpa/about-audit-log-fields - -Zscaler response format: -``` -{"ModifiedTime":%j{modifiedTime:iso8601},"CreationTime":%j{creationTime:iso8601},"ModifiedBy":%d{modifiedBy},"RequestID":%j{requestId},"SessionID":%j{sessionId},"AuditOldValue":%j{auditOldValue},"AuditNewValue":%j{auditNewValue},"AuditOperationType":%j{auditOperationType},"ObjectType":%j{objectType},"ObjectName":%j{objectName},"ObjectID":%d{objectId},"CustomerID":%d{customerId},"User":%j{modifiedByUser},"ClientAuditUpdate":%d{isClientAudit}}\n -``` - -Sample Response: -```json -{"ModifiedTime":"2021-11-17T04:29:38.000Z","CreationTime":"2021-11-17T04:29:38.000Z","ModifiedBy":12345678901234567,"RequestID":"11111111-1111-1111-1111-111111111111","SessionID":"1idn23nlfm2q1txa5h3r4mep6","AuditOldValue":"","AuditNewValue":"{\"id\":\"72058340288495701\",\"name\":\"Some-Name\",\"domainOrIpAddress\":\"1.0.0.1\",\"description\":\"This is a description field\",\"enabled\":\"true\"}","AuditOperationType":"Create","ObjectType":"Server","ObjectName":"Some-Name","ObjectID":12345678901234567,"CustomerID":98765432109876543,"User":"zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com","ClientAuditUpdate":0} -``` - -### Browser Access Logs - -Default port: _9017_ - -Vendor documentation: https://help.zscaler.com/zpa/about-browser-access-log-fields - -Zscaler response format: -``` -{"LogTimestamp":%j{LogTimestamp:time},"ConnectionID":%j{ConnectionID},"Exporter":%j{Exporter},"TimestampRequestReceiveStart":%j{TimestampRequestReceiveStart:iso8601},"TimestampRequestReceiveHeaderFinish":%j{TimestampRequestReceiveHeaderFinish:iso8601},"TimestampRequestReceiveFinish":%j{TimestampRequestReceiveFinish:iso8601},"TimestampRequestTransmitStart":%j{TimestampRequestTransmitStart:iso8601},"TimestampRequestTransmitFinish":%j{TimestampRequestTransmitFinish:iso8601},"TimestampResponseReceiveStart":%j{TimestampResponseReceiveStart:iso8601},"TimestampResponseReceiveFinish":%j{TimestampResponseReceiveFinish:iso8601},"TimestampResponseTransmitStart":%j{TimestampResponseTransmitStart:iso8601},"TimestampResponseTransmitFinish":%j{TimestampResponseTransmitFinish:iso8601},"TotalTimeRequestReceive":%d{TotalTimeRequestReceive},"TotalTimeRequestTransmit":%d{TotalTimeRequestTransmit},"TotalTimeResponseReceive":%d{TotalTimeResponseReceive},"TotalTimeResponseTransmit":%d{TotalTimeResponseTransmit},"TotalTimeConnectionSetup":%d{TotalTimeConnectionSetup},"TotalTimeServerResponse":%d{TotalTimeServerResponse},"Method":%j{Method},"Protocol":%j{Protocol},"Host":%j{Host},"URL":%j{URL},"UserAgent":%j{UserAgent},"XFF":%j{XFF},"NameID":%j{NameID},"StatusCode":%d{StatusCode},"RequestSize":%d{RequestSize},"ResponseSize":%d{ResponseSize},"ApplicationPort":%d{ApplicationPort},"ClientPublicIp":%j{ClientPublicIp},"ClientPublicPort":%d{ClientPublicPort},"ClientPrivateIp":%j{ClientPrivateIp},"Customer":%j{Customer},"ConnectionStatus":%j{ConnectionStatus},"ConnectionReason":%j{ConnectionReason},"Origin":%j{Origin},"CorsToken":%j{CorsToken}}\n -``` - -Sample Response: -```json -{"LogTimestamp":"Wed Jul 3 05:12:25 2019","ConnectionID":"","Exporter":"unset","TimestampRequestReceiveStart":"2019-07-03T05:12:25.723Z","TimestampRequestReceiveHeaderFinish":"2019-07-03T05:12:25.723Z","TimestampRequestReceiveFinish":"2019-07-03T05:12:25.723Z","TimestampRequestTransmitStart":"2019-07-03T05:12:25.790Z","TimestampRequestTransmitFinish":"2019-07-03T05:12:25.790Z","TimestampResponseReceiveStart":"2019-07-03T05:12:25.791Z","TimestampResponseReceiveFinish":"2019-07-03T05:12:25.791Z","TimestampResponseTransmitStart":"2019-07-03T05:12:25.791Z","TimestampResponseTransmitFinish":"2019-07-03T05:12:25.791Z","TotalTimeRequestReceive":127,"TotalTimeRequestTransmit":21,"TotalTimeResponseReceive":73,"TotalTimeResponseTransmit":13,"TotalTimeConnectionSetup":66995,"TotalTimeServerResponse":1349,"Method":"GET","Protocol":"HTTPS","Host":"portal.beta.zdemo.net","URL":"/media/Regular.woff","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15","XFF":"","NameID":"admin@zdemo.net","StatusCode":304,"RequestSize":615,"ResponseSize":331,"ApplicationPort":443,"ClientPublicIp":"175.16.199.1","ClientPublicPort":60006,"ClientPrivateIp":"","Customer":"ANZ Team/zdemo in beta","ConnectionStatus":"","ConnectionReason":""} -``` - -### User Activity Logs - -Default port: _9018_ - -Vendor documentation: https://help.zscaler.com/zpa/about-user-activity-log-fields - -Zscaler response format: -``` -{"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"ConnectionID": %j{ConnectionID},"InternalReason": %j{InternalReason},"ConnectionStatus": %j{ConnectionStatus},"IPProtocol": %d{IPProtocol},"DoubleEncryption": %d{DoubleEncryption},"Username": %j{Username},"ServicePort": %d{ServicePort},"ClientPublicIP": %j{ClientPublicIP},"ClientPrivateIP": %j{ClientPrivateIP},"ClientLatitude": %f{ClientLatitude},"ClientLongitude": %f{ClientLongitude},"ClientCountryCode": %j{ClientCountryCode},"ClientZEN": %j{ClientZEN},"Policy": %j{Policy},"Connector": %j{Connector},"ConnectorZEN": %j{ConnectorZEN},"ConnectorIP": %j{ConnectorIP},"ConnectorPort": %d{ConnectorPort},"Host": %j{Host},"Application": %j{Application},"AppGroup": %j{AppGroup},"Server": %j{Server},"ServerIP": %j{ServerIP},"ServerPort": %d{ServerPort},"PolicyProcessingTime": %d{PolicyProcessingTime},"ServerSetupTime": %d{ServerSetupTime},"TimestampConnectionStart": %j{TimestampConnectionStart:iso8601},"TimestampConnectionEnd": %j{TimestampConnectionEnd:iso8601},"TimestampCATx": %j{TimestampCATx:iso8601},"TimestampCARx": %j{TimestampCARx:iso8601},"TimestampAppLearnStart": %j{TimestampAppLearnStart:iso8601},"TimestampZENFirstRxClient": %j{TimestampZENFirstRxClient:iso8601},"TimestampZENFirstTxClient": %j{TimestampZENFirstTxClient:iso8601},"TimestampZENLastRxClient": %j{TimestampZENLastRxClient:iso8601},"TimestampZENLastTxClient": %j{TimestampZENLastTxClient:iso8601},"TimestampConnectorZENSetupComplete": %j{TimestampConnectorZENSetupComplete:iso8601},"TimestampZENFirstRxConnector": %j{TimestampZENFirstRxConnector:iso8601},"TimestampZENFirstTxConnector": %j{TimestampZENFirstTxConnector:iso8601},"TimestampZENLastRxConnector": %j{TimestampZENLastRxConnector:iso8601},"TimestampZENLastTxConnector": %j{TimestampZENLastTxConnector:iso8601},"ZENTotalBytesRxClient": %d{ZENTotalBytesRxClient},"ZENBytesRxClient": %d{ZENBytesRxClient},"ZENTotalBytesTxClient": %d{ZENTotalBytesTxClient},"ZENBytesTxClient": %d{ZENBytesTxClient},"ZENTotalBytesRxConnector": %d{ZENTotalBytesRxConnector},"ZENBytesRxConnector": %d{ZENBytesRxConnector},"ZENTotalBytesTxConnector": %d{ZENTotalBytesTxConnector},"ZENBytesTxConnector": %d{ZENBytesTxConnector},"Idp": %j{Idp},"ClientToClient": %j{c2c},"ConnectorZENSetupTime":%d{ConnectorZENSetupTime},"ConnectionSetupTime":%d{ConnectionSetupTime}}\n -``` - -Sample Response: -```json -{"LogTimestamp": "Fri May 31 17:35:42 2019","Customer": "Customer XYZ","SessionID": "LHJdkjmNDf12nclBsvwA","ConnectionID": "SqyZIMkg0JTj7EABsvwA,Q+EjXGdrvbF2lPiBbedm","InternalReason": "","ConnectionStatus": "active","IPProtocol": 6,"DoubleEncryption": 0,"Username": "ZPA LSS Client","ServicePort": 10011,"ClientPublicIP": "81.2.69.193","ClientPrivateIP": "","ClientLatitude": 45.000000,"ClientLongitude": -119.000000,"ClientCountryCode": "US","ClientZEN": "broker2b.pdx","Policy": "ANZ Lab Apps","Connector": "ZDEMO ANZ","ConnectorZEN": "broker2b.pdx","ConnectorIP": "67.43.156.12","ConnectorPort": 60266,"Host": "175.16.199.1","Application": "ANZ Lab Apps","AppGroup": "ANZ Lab Apps","Server": "0","ServerIP": "175.16.199.1","ServerPort": 10011,"PolicyProcessingTime": 28,"CAProcessingTime": 1330,"ServerSetupTime": 465,"AppLearnTime": 0,"TimestampConnectionStart": "2019-05-30T08:20:42.230Z","TimestampConnectionEnd": "","TimestampCATx": "2019-05-30T08:20:42.230Z","TimestampCARx": "2019-05-30T08:20:42.231Z","TimestampAppLearnStart": "","TimestampZENFirstRxClient": "2019-05-30T08:20:42.424Z","TimestampZENFirstTxClient": "","TimestampZENLastRxClient": "2019-05-31T17:34:27.348Z","TimestampZENLastTxClient": "","TimestampConnectorZENSetupComplete": "2019-05-30T08:20:42.422Z","TimestampZENFirstRxConnector": "","TimestampZENFirstTxConnector": "2019-05-30T08:20:42.424Z","TimestampZENLastRxConnector": "","TimestampZENLastTxConnector": "2019-05-31T17:34:27.348Z","ZENTotalBytesRxClient": 2406926,"ZENBytesRxClient": 7115,"ZENTotalBytesTxClient": 0,"ZENBytesTxClient": 0,"ZENTotalBytesRxConnector": 0,"ZENBytesRxConnector": 0,"ZENTotalBytesTxConnector": 2406926,"ZENBytesTxConnector": 7115,"Idp": "Example IDP Config","ConnectorZENSetupTime":1640674274,"ConnectionSetupTime":1640675274} -``` - -**Note: In order to populate _Slowest Applications_ (visualization); _"ConnectorZENSetupTime"_ and _"ConnectionSetupTime"_ fields are added into the default response format of Zscaler User Activity Log above.** - -### User Status Logs - -Default port: _9019_ - -Vendor documentation: https://help.zscaler.com/zpa/about-user-status-log-fields - -Zscaler response format: -``` -{"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"Username": %j{Username},"SessionID": %j{SessionID},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"ZEN": %j{ZEN},"CertificateCN": %j{CertificateCN},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"Idp": %j{Idp},"Hostname": %j{Hostname},"Platform": %j{Platform},"ClientType": %j{ClientType},"TrustedNetworks": [%j(,){TrustedNetworks}],"TrustedNetworksNames": [%j(,){TrustedNetworksNames}],"SAMLAttributes": %j{SAMLAttributes},"PosturesHit": [%j(,){PosturesHit}],"PosturesMiss": [%j(,){PosturesMiss}],"ZENLatitude": %f{ZENLatitude},"ZENLongitude": %f{ZENLongitude},"ZENCountryCode": %j{ZENCountryCode},"FQDNRegistered": %j{fqdn_registered},"FQDNRegisteredError": %j{fqdn_register_error}}\n -``` - -Sample Response: -```json -{"LogTimestamp":"Fri May 31 17:34:48 2019","Customer":"Customer XYZ","Username":"ZPA LSS Client","SessionID":"vkczUERSLl88Y+ytH8v5","SessionStatus":"ZPN_STATUS_AUTHENTICATED","Version":"19.12.0-36-g87dad18","ZEN":"broker2b.pdx","CertificateCN":"loggerz2x.pde.zpabeta.net","PrivateIP":"","PublicIP":"81.2.69.144","Latitude":45,"Longitude":-119,"CountryCode":"US","TimestampAuthentication":"2019-05-29T21:18:38.000Z","TimestampUnAuthentication":"","TotalBytesRx":31274866,"TotalBytesTx":25424152,"Idp":"IDP Config","Hostname":"DESKTOP-99HCSJ1","Platform":"windows","ClientType":"zpn_client_type_zapp","TrustedNetworks":"TN1_stc1","TrustedNetworksNames":"145248739466696953","SAMLAttributes":"myname:user,myemail:user@zscaler.com","PosturesHit":"sm-posture1,sm-posture2","PosturesMiss":"sm-posture11,sm-posture12","ZENLatitude":47,"ZENLongitude":-122,"ZENCountryCode":""} -``` - -## Fields and Sample Event - -### App Connector Status Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.nat.ip | Translated IP of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | ip | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.cpu.usage | Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. For example: For a two core host, this value should be the average of the two cores, between 0 and 1. | scaled_float | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.geo.country_iso_code | Country ISO code. | keyword | -| observer.geo.location | Longitude and latitude | geo_point | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.version | Observer version. | keyword | -| organization.name | Organization name. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| tags | List of keywords used to tag each event. | keyword | -| zscaler_zpa.app_connector_status.connector.group | The App Connector group name. | keyword | -| zscaler_zpa.app_connector_status.connector.name | The App Connector name. | keyword | -| zscaler_zpa.app_connector_status.connector_start_time | Time in seconds at which App Connector was started. | date | -| zscaler_zpa.app_connector_status.connector_up_time | Time in seconds at which App Connector was started. | date | -| zscaler_zpa.app_connector_status.host_start_time | Time in seconds at which host was started. | date | -| zscaler_zpa.app_connector_status.host_up_time | Time in seconds at which host was started. | date | -| zscaler_zpa.app_connector_status.interface.name | The name of the interface to default route. | keyword | -| zscaler_zpa.app_connector_status.interface.received.bytes | The bytes received on the interface. | double | -| zscaler_zpa.app_connector_status.interface.received.discards | The discards received on the interface. | double | -| zscaler_zpa.app_connector_status.interface.received.errors | The errors received on the interface. | double | -| zscaler_zpa.app_connector_status.interface.received.packets | The packets received on the interface. | double | -| zscaler_zpa.app_connector_status.interface.transmitted.bytes | The bytes transmitted on the interface. | double | -| zscaler_zpa.app_connector_status.interface.transmitted.discards | The discards transmitted on the interface. | double | -| zscaler_zpa.app_connector_status.interface.transmitted.errors | The errors transmitted on the interface. | double | -| zscaler_zpa.app_connector_status.interface.transmitted.packets | The packets transmitted on the interface. | double | -| zscaler_zpa.app_connector_status.memory.utilization | The memory utilization in %. | double | -| zscaler_zpa.app_connector_status.num_of_interfaces | The number of interfaces on the App Connector host. | double | -| zscaler_zpa.app_connector_status.primary_dns_resolver | The IP address of the primary DNS resolver. | ip | -| zscaler_zpa.app_connector_status.private_ip | The private IP address of the App Connector. | ip | -| zscaler_zpa.app_connector_status.service.count | The number of services (combinations of domains/IP addresses and TCP/UDP ports) being monitored by the App Connector. | double | -| zscaler_zpa.app_connector_status.session.id | The TLS session ID. | keyword | -| zscaler_zpa.app_connector_status.session.status | The status of the session. | keyword | -| zscaler_zpa.app_connector_status.session.type | The type of session. | keyword | -| zscaler_zpa.app_connector_status.timestamp.authentication | Timestamp in microseconds when the App Connector was authenticated. | date | -| zscaler_zpa.app_connector_status.timestamp.unauthentication | Timestamp in microseconds when the App Connector was unauthenticated. | date | -| zscaler_zpa.app_connector_status.zen | The TLS session ID. | keyword | - - -An example event for `app_connector_status` looks as following: - -```json -{ - "@timestamp": "2019-07-03T05:17:22.000Z", - "agent": { - "ephemeral_id": "5879b806-6298-48ab-89a6-19ddcf612162", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "nat": { - "ip": "10.0.0.1" - } - }, - "data_stream": { - "dataset": "zscaler_zpa.app_connector_status", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "package", - "dataset": "zscaler_zpa.app_connector_status", - "ingested": "2022-02-03T13:30:46Z", - "kind": "event", - "original": "{\"LogTimestamp\":\"Wed Jul 3 05:17:22 2019\",\"Customer\":\"Customer Name\",\"SessionID\":\"8A64Qwj9zCkfYDGJVoUZ\",\"SessionType\":\"ZPN_ASSISTANT_BROKER_CONTROL\",\"SessionStatus\":\"ZPN_STATUS_AUTHENTICATED\",\"Version\":\"19.20.3\",\"Platform\":\"el7\",\"ZEN\":\"US-NY-8179\",\"Connector\":\"Some App Connector\",\"ConnectorGroup\":\"Some App Connector Group\",\"PrivateIP\":\"10.0.0.4\",\"PublicIP\":\"0.0.0.0\",\"Latitude\":47,\"Longitude\":-122,\"CountryCode\":\"\",\"TimestampAuthentication\":\"2019-06-27T05:05:23.348Z\",\"TimestampUnAuthentication\":\"\",\"CPUUtilization\":1,\"MemUtilization\":20,\"ServiceCount\":2,\"InterfaceDefRoute\":\"eth0\",\"DefRouteGW\":\"10.0.0.1\",\"PrimaryDNSResolver\":\"168.63.129.16\",\"HostStartTime\":\"1513229995\",\"HostUpTime\":\"1513229995\",\"ConnectorUpTime\":\"1555920005\",\"ConnectorStartTime\":\"1555920005\",\"NumOfInterfaces\":2,\"BytesRxInterface\":319831966346,\"PacketsRxInterface\":1617569938,\"ErrorsRxInterface\":0,\"DiscardsRxInterface\":0,\"BytesTxInterface\":192958782635,\"PacketsTxInterface\":1797471190,\"ErrorsTxInterface\":0,\"DiscardsTxInterface\":0,\"TotalBytesRx\":10902554,\"TotalBytesTx\":48931771}", - "type": "info" - }, - "host": { - "cpu": { - "usage": 1 - }, - "network": { - "egress": { - "bytes": 48931771 - }, - "ingress": { - "bytes": 10902554 - } - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:33226" - } - }, - "observer": { - "geo": { - "location": { - "lat": 47, - "lon": -122 - } - }, - "ip": [ - "0.0.0.0" - ], - "os": { - "platform": "el7" - }, - "type": "forwarder", - "version": "19.20.3" - }, - "organization": { - "name": "Customer Name" - }, - "related": { - "ip": [ - "10.0.0.1", - "0.0.0.0", - "10.0.0.4", - "168.63.129.16" - ] - }, - "tags": [ - "forwarded", - "zscaler_zpa-app_connectors_status" - ], - "zscaler_zpa": { - "app_connector_status": { - "connector": { - "group": "Some App Connector Group", - "name": "Some App Connector" - }, - "connector_start_time": "2019-04-22T08:00:05.000Z", - "connector_up_time": "2019-04-22T08:00:05.000Z", - "host_start_time": "2017-12-14T05:39:55.000Z", - "host_up_time": "2017-12-14T05:39:55.000Z", - "interface": { - "name": "eth0", - "received": { - "bytes": 319831966346, - "discards": 0, - "errors": 0, - "packets": 1617569938 - }, - "transmitted": { - "bytes": 192958782635, - "discards": 0, - "errors": 0, - "packets": 1797471190 - } - }, - "memory": { - "utilization": 20 - }, - "num_of_interfaces": 2, - "primary_dns_resolver": "168.63.129.16", - "private_ip": "10.0.0.4", - "service": { - "count": 2 - }, - "session": { - "id": "8A64Qwj9zCkfYDGJVoUZ", - "status": "ZPN_STATUS_AUTHENTICATED", - "type": "ZPN_ASSISTANT_BROKER_CONTROL" - }, - "timestamp": { - "authentication": "2019-06-27T05:05:23.348Z" - }, - "zen": "US-NY-8179" - } - } -} -``` - -## Audit Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| group.name | Name of the group. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| observer.geo.city_name | City name. | keyword | -| observer.geo.country_name | Country name. | keyword | -| observer.geo.location | Longitude and latitude. | geo_point | -| organization.id | Unique identifier for the organization. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| tags | List of keywords used to tag each event. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.target.email | User email address. | keyword | -| user.target.id | Unique identifier of the user. | keyword | -| user.target.name | Short name or login of the user. | keyword | -| user.target.roles | Array of user roles at the time of the event. | keyword | -| x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | -| x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | -| x509.not_after | Time at which the certificate is no longer considered valid. | date | -| x509.not_before | Time at which the certificate is first considered valid. | date | -| zscaler_zpa.audit.client_audit_update | The flag to represent if the event is a client Audit log. | long | -| zscaler_zpa.audit.object.id | The ID associated with the object name. | keyword | -| zscaler_zpa.audit.object.name | The name of the object. This corresponds to the Resource Name in the Audit Log page. | keyword | -| zscaler_zpa.audit.object.type | The location within the ZPA Admin Portal where the Action was performed. | keyword | -| zscaler_zpa.audit.operation_type | The type of action performed. | keyword | -| zscaler_zpa.audit.session.id | The ID for the administrator's session in the ZPA Admin Portal. This corresponds to a successful sign in action occurring. | keyword | -| zscaler_zpa.audit.value.new | The new value that was changed if the action type is create, sign in, or update. | flattened | -| zscaler_zpa.audit.value.old | The previous value that was changed if the action type is delete, sign out, or update. | flattened | - - -An example event for `audit` looks as following: - -```json -{ - "@timestamp": "2021-11-17T04:29:38.000Z", - "agent": { - "ephemeral_id": "75bcfb32-c04c-4455-88ed-41a659043c80", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zpa.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "iam" - ], - "created": "2021-11-17T04:29:38.000Z", - "dataset": "zscaler_zpa.audit", - "id": "11111111-1111-1111-1111-111111111111", - "ingested": "2022-02-03T13:32:04Z", - "kind": "event", - "type": [ - "creation" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:54030" - } - }, - "organization": { - "id": "98765432109876543" - }, - "related": { - "ip": [ - "1.0.0.1" - ] - }, - "server": { - "address": "1.0.0.1", - "ip": "1.0.0.1" - }, - "tags": [ - "forwarded", - "zscaler_zpa-audit" - ], - "user": { - "id": "12345678901234567", - "name": "zpaadmin@xxxxxxxxxxxxxxxxx.zpa-customer.com" - }, - "zscaler_zpa": { - "audit": { - "client_audit_update": 0, - "object": { - "id": "12345678901234567", - "name": "Some-Name", - "type": "Server" - }, - "operation_type": "Create", - "session": { - "id": "1idn23nlfm2q1txa5h3r4mep6" - }, - "value": { - "new": { - "description": "This is a description field", - "domainOrIpAddress": "1.0.0.1", - "enabled": "true", - "id": "72058340288495701", - "name": "Some-Name" - } - } - } - } -} -``` - -## Browser Access Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.geo.city_name | City name. | keyword | -| client.geo.continent_name | Name of the continent. | keyword | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.country_name | Country name. | keyword | -| client.geo.location | Longitude and latitude | geo_point | -| client.geo.region_iso_code | Region ISO code. | keyword | -| client.geo.region_name | Region name. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.port | Port of the client. | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| http.request.body.bytes | Size in bytes of the request body. | long | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.response.body.bytes | Size in bytes of the response body. | long | -| http.response.status_code | HTTP response status code. | long | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| organization.name | Organization name. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.port | Port of the server. | long | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.path | Path of the request, such as "/search". | wildcard | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| user.name | Short name or login of the user. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | -| zscaler_zpa.browser_access.client_private_ip | The private IP address of the user's device. | ip | -| zscaler_zpa.browser_access.connection.id | The application connection ID. | keyword | -| zscaler_zpa.browser_access.connection.status | The status of the connection. | keyword | -| zscaler_zpa.browser_access.cors_token | The token from the CORS request. | keyword | -| zscaler_zpa.browser_access.exporter | The Browser Access Service instance to ZPA Public Service Edge or ZPA Private Service Edge instance. | keyword | -| zscaler_zpa.browser_access.origin | The Browser Access domain that led to the origination of the CORS request. | keyword | -| zscaler_zpa.browser_access.timestamp.request.receive.finish | Timestamp in microseconds when Browser Access Service received the last byte of the HTTP request from web browser. | date | -| zscaler_zpa.browser_access.timestamp.request.receive.header_finish | Timestamp in microseconds when Browser Access Service received the last byte of the HTTP header corresponding to the request from web browser. | date | -| zscaler_zpa.browser_access.timestamp.request.receive.start | Timestamp in microseconds when Browser Access Service received the first byte of the HTTP request from web browser. | date | -| zscaler_zpa.browser_access.timestamp.request.transmit.finish | Timestamp in microseconds when Browser Access Service sent the last byte of the HTTP request to the web server. | date | -| zscaler_zpa.browser_access.timestamp.request.transmit.start | Timestamp in microseconds when Browser Access Service sent the first byte of the HTTP request to the web server. | date | -| zscaler_zpa.browser_access.timestamp.response.receive.finish | Timestamp in microseconds when Browser Access Service received the last byte of the HTTP response from the web server. | date | -| zscaler_zpa.browser_access.timestamp.response.receive.start | Timestamp in microseconds when Browser Access Service received the first byte of the HTTP response from the web server. | date | -| zscaler_zpa.browser_access.timestamp.response.transmit.finish | Timestamp in microseconds when Browser Access Service sent the last byte of the HTTP response to the web browser. | date | -| zscaler_zpa.browser_access.timestamp.response.transmit.start | Timestamp in microseconds when Browser Access Service sent the first byte of the HTTP response to the web browser. | date | -| zscaler_zpa.browser_access.total_time.connection.setup | Time difference between reception of the first byte of the HTTP request from web browser and transmission of the first byte towards the web server, as seen by the Browser Access Service. | long | -| zscaler_zpa.browser_access.total_time.request.receive | Time difference between reception of the first and last byte of the HTTP request from the web browser as seen by the Browser Access Service. | long | -| zscaler_zpa.browser_access.total_time.request.transmit | Time difference between transmission of the first and last byte of the HTTP request towards the web server as seen by the Browser Access Service. | long | -| zscaler_zpa.browser_access.total_time.response.receive | Time difference between reception of the first and last byte of the HTTP response from the web server as seen by the Browser Access Service. | long | -| zscaler_zpa.browser_access.total_time.response.transmit | Time difference between transmission of the first and last byte of the HTTP request towards the web server as seen by the Browser Access Service. | long | -| zscaler_zpa.browser_access.total_time.server.response | Time difference between transmission of the last byte of the HTTP request towards the web server and reception of the first byte of the HTTP response from web server, as seen by the Browser Access Service. | long | -| zscaler_zpa.browser_access.xff | The X-Forwarded-For (XFF) HTTP header. | keyword | - - -An example event for `browser_access` looks as following: - -```json -{ - "@timestamp": "2019-07-03T05:12:25.000Z", - "agent": { - "ephemeral_id": "10484a2f-b664-42ef-a849-7386c8257491", - "hostname": "docker-fleet-agent", - "id": "acf7dca8-817d-4681-bad3-1cc9bfefc49c", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 60006 - }, - "data_stream": { - "dataset": "zscaler_zpa.browser_access", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "acf7dca8-817d-4681-bad3-1cc9bfefc49c", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "network", - "session" - ], - "dataset": "zscaler_zpa.browser_access", - "ingested": "2022-02-14T07:28:10Z", - "kind": "event", - "type": "connection" - }, - "http": { - "request": { - "body": { - "bytes": 615 - }, - "method": "GET" - }, - "response": { - "body": { - "bytes": 331 - }, - "status_code": 304 - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.26.0.7:47148" - } - }, - "organization": { - "name": "ANZ Team/zdemo in beta" - }, - "related": { - "ip": [ - "81.2.69.144", - "81.2.69.193" - ] - }, - "server": { - "address": "portal.beta.zdemo.net", - "port": 443 - }, - "tags": [ - "forwarded", - "zscaler_zpa-browser_access" - ], - "url": { - "domain": "portal.beta.zdemo.net", - "extension": "woff", - "original": "https://portal.beta.zdemo.net/media/regular.woff", - "path": "/media/regular.woff", - "scheme": "https" - }, - "user": { - "name": "admin@zdemo.net" - }, - "user_agent": { - "device": { - "name": "Mac" - }, - "name": "Safari", - "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15", - "os": { - "full": "Mac OS X 10.14.5", - "name": "Mac OS X", - "version": "10.14.5" - }, - "version": "12.1.1" - }, - "zscaler_zpa": { - "browser_access": { - "client_private_ip": "81.2.69.193", - "exporter": "unset", - "timestamp": { - "request": { - "receive": { - "finish": "2019-07-03T05:12:25.723Z", - "header_finish": "2019-07-03T05:12:25.723Z", - "start": "2019-07-03T05:12:25.723Z" - }, - "transmit": { - "finish": "2019-07-03T05:12:25.790Z", - "start": "2019-07-03T05:12:25.790Z" - } - }, - "response": { - "receive": { - "finish": "2019-07-03T05:12:25.791Z", - "start": "2019-07-03T05:12:25.791Z" - }, - "transmit": { - "finish": "2019-07-03T05:12:25.791Z", - "start": "2019-07-03T05:12:25.791Z" - } - } - }, - "total_time": { - "connection": { - "setup": 66995 - }, - "request": { - "receive": 127, - "transmit": 21 - }, - "response": { - "receive": 73, - "transmit": 13 - }, - "server": { - "response": 1349 - } - } - } - } -} -``` - -## User Activity Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.location | Longitude and latitude. | geo_point | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| organization.name | Organization name. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| server.port | Port of the server. | long | -| tags | List of keywords used to tag each event. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zpa.user_activity.app_group | The application group name. | keyword | -| zscaler_zpa.user_activity.app_learn_time | Time in microseconds taken for App Connectors to learn about the requested application and report the learned information to the central authority. | long | -| zscaler_zpa.user_activity.application | The application name. | keyword | -| zscaler_zpa.user_activity.ca_processing_time | Time in microseconds taken for processing in the central authority. | long | -| zscaler_zpa.user_activity.client_private_ip | The private IP address of the Zscaler Client Connector. | ip | -| zscaler_zpa.user_activity.client_to_client | The status of the client-to-client connection. | keyword | -| zscaler_zpa.user_activity.connection.id | The application connection ID. | keyword | -| zscaler_zpa.user_activity.connection.setup_time | Time taken by the App Connector to process a notification from the App Connector selection microservice and set up the connection to the application server. | long | -| zscaler_zpa.user_activity.connection.status | The status of the connection. The expected values for this field are: [ Open, Close, Active ]. | keyword | -| zscaler_zpa.user_activity.connector.ip | The source IP address of the App Connector. | ip | -| zscaler_zpa.user_activity.connector.name | The App Connector name. | keyword | -| zscaler_zpa.user_activity.connector.port | The source port of the App Connector. | integer | -| zscaler_zpa.user_activity.connector_zen_setup_time | Time in microseconds taken for setting up connection between App Connector and ZPA Public Service Edge or ZPA Private Service Edge. | long | -| zscaler_zpa.user_activity.double_encryption | The double encryption status. | integer | -| zscaler_zpa.user_activity.idp | The name of the identity provider (IdP) as configured in the ZPA Admin Portal. | keyword | -| zscaler_zpa.user_activity.internal_reason | The internal reason for the status of the transaction. | keyword | -| zscaler_zpa.user_activity.policy.name | The access policy or timeout policy rule name. | keyword | -| zscaler_zpa.user_activity.policy.processing_time | Time in microseconds taken for processing the access policy associated with the application. | long | -| zscaler_zpa.user_activity.server | The server ID name. The server ID must be set to zero if dynamic server discovery is enabled. | keyword | -| zscaler_zpa.user_activity.server_setup_time | Time in microseconds taken for setting up connection at server. | long | -| zscaler_zpa.user_activity.service_port | The destination port of the server. | integer | -| zscaler_zpa.user_activity.session_id | The TLS session ID. | keyword | -| zscaler_zpa.user_activity.timestamp.app_learn_start | Time in microseconds taken for App Connectors to learn about the requested application and report the learned information to the central authority. | keyword | -| zscaler_zpa.user_activity.timestamp.ca.rx | Timestamp in microseconds when the central authority received request from ZPA Public Service Edge or ZPA Private Service Edge. | date | -| zscaler_zpa.user_activity.timestamp.ca.tx | Timestamp in microseconds when the central authority sent request to ZPA Public Service Edge or ZPA Private Service Edge. | date | -| zscaler_zpa.user_activity.timestamp.connection.end | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge terminated the connection. | date | -| zscaler_zpa.user_activity.timestamp.connection.start | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the initial request from Zscaler Client Connector to start the connection. | date | -| zscaler_zpa.user_activity.timestamp.connector_zen.setup_complete | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received request from App Connector to set up data connection. The request from the App Connector is triggered by the initial request for a specific application from the Zscaler Client Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.client.rx.first | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the first byte from the Zscaler Client Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.client.rx.last | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the last byte from the Zscaler Client Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.client.tx.first | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the first byte to the Zscaler Client Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.client.tx.last | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the last byte to the Zscaler Client Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.connector.rx.first | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the first byte from the App Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.connector.rx.last | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge received the last byte from the App Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.connector.tx.first | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the first byte to the App Connector. | date | -| zscaler_zpa.user_activity.timestamp.zen.connector.tx.last | Timestamp in microseconds when the ZPA Public Service Edge or ZPA Private Service Edge sent the last byte to the App Connector. | date | -| zscaler_zpa.user_activity.zen.client.bytes_rx | The additional bytes received from the Zscaler Client Connector since the last transaction log. | long | -| zscaler_zpa.user_activity.zen.client.bytes_tx | The additional bytes transmitted to the Zscaler Client Connector since the last transaction log. | long | -| zscaler_zpa.user_activity.zen.client.domain | The ZPA Public Service Edge (formerly Zscaler Enforcement Node or ZEN) or ZPA Private Service Edge that received the request from the Zscaler Client Connector. | keyword | -| zscaler_zpa.user_activity.zen.client.total.bytes_rx | The total bytes received from the Zscaler Client Connector by the ZPA Public Service Edge or ZPA Private Service Edge. | long | -| zscaler_zpa.user_activity.zen.client.total.bytes_tx | The total bytes transmitted to the Zscaler Client Connector from the ZPA Public Service Edge or ZPA Private Service Edge. | long | -| zscaler_zpa.user_activity.zen.connector.bytes_rx | The additional bytes received from the App Connector since the last transaction log. | long | -| zscaler_zpa.user_activity.zen.connector.bytes_tx | The additional bytes transmitted by the App Connector since the last transaction log. | long | -| zscaler_zpa.user_activity.zen.connector.domain | The ZPA Public Service Edge or ZPA Private Service Edge that sent the request from the App Connector. | keyword | -| zscaler_zpa.user_activity.zen.connector.total.bytes_rx | The total bytes received from the App Connector by the ZPA Public Service Edge or ZPA Private Service Edge. | long | -| zscaler_zpa.user_activity.zen.connector.total.bytes_tx | The total bytes transmitted to the App Connector from the ZPA Public Service Edge or ZPA Private Service Edge. | long | - - -An example event for `user_activity` looks as following: - -```json -{ - "@timestamp": "2019-05-31T17:35:42.000Z", - "agent": { - "ephemeral_id": "2686f611-4bf3-4df9-8934-843cbd32d161", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 45, - "lon": -119 - } - }, - "ip": "81.2.69.193" - }, - "data_stream": { - "dataset": "zscaler_zpa.user_activity", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "iam", - "dataset": "zscaler_zpa.user_activity", - "ingested": "2022-02-03T13:34:37Z", - "kind": "event", - "type": [ - "info", - "user" - ] - }, - "host": { - "ip": "175.16.199.1" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:59296" - } - }, - "network": { - "type": "ipv6" - }, - "organization": { - "name": "Customer XYZ" - }, - "related": { - "hosts": [ - "broker2b.pdx" - ], - "ip": [ - "81.2.69.193", - "175.16.199.1", - "67.43.156.12" - ] - }, - "server": { - "ip": "175.16.199.1", - "port": 10011 - }, - "tags": [ - "forwarded", - "zscaler_zpa-user_activity" - ], - "user": { - "name": "ZPA LSS Client" - }, - "zscaler_zpa": { - "user_activity": { - "app_group": "ABC Lab Apps", - "app_learn_time": 0, - "application": "ABC Lab Apps", - "ca_processing_time": 1330, - "client_to_client": "0", - "connection": { - "id": "SqyZIMkg0JTj7EABsvwA,Q+EjXGdrvbF2lPiBbedm", - "setup_time": 192397, - "status": "active" - }, - "connector": { - "ip": "67.43.156.12", - "name": "ZDEMO ABC", - "port": 60266 - }, - "connector_zen_setup_time": 191017, - "double_encryption": 0, - "idp": "Example IDP Config", - "policy": { - "name": "ABC Lab Apps", - "processing_time": 28 - }, - "server": "0", - "server_setup_time": 465, - "service_port": 10011, - "session_id": "LHJdkjmNDf12nclBsvwA", - "timestamp": { - "ca": { - "rx": "2019-05-30T08:20:42.231Z", - "tx": "2019-05-30T08:20:42.230Z" - }, - "connection": { - "start": "2019-05-30T08:20:42.230Z" - }, - "connector_zen": { - "setup_complete": "2019-05-30T08:20:42.422Z" - }, - "zen": { - "client": { - "rx": { - "first": "2019-05-30T08:20:42.424Z", - "last": "2019-05-31T17:34:27.348Z" - } - }, - "connector": { - "tx": { - "first": "2019-05-30T08:20:42.424Z", - "last": "2019-05-31T17:34:27.348Z" - } - } - } - }, - "zen": { - "client": { - "bytes_rx": 7115, - "bytes_tx": 0, - "domain": "broker2b.pdx", - "total": { - "bytes_rx": 2406926, - "bytes_tx": 0 - } - }, - "connector": { - "bytes_rx": 0, - "bytes_tx": 7115, - "domain": "broker2b.pdx", - "total": { - "bytes_rx": 0, - "bytes_tx": 2406926 - } - } - } - } - } -} -``` - -## User Status Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.location | Longitude and latitude. | geo_point | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| organization.name | Organization name. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| server.geo.country_iso_code | Country ISO code. | keyword | -| server.geo.location | Longitude and latitude. | geo_point | -| tags | List of keywords used to tag each event. | keyword | -| user.name | Short name or login of the user. | keyword | -| x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| zscaler_zpa.user_status.client.type | The client type for the request (i.e., Zscaler Client Connector, ZPA LSS, or Web Browser). | keyword | -| zscaler_zpa.user_status.fqdn.registered | The status of the hostname for the client-to-client connection. The expected values for this field are true or false. | boolean | -| zscaler_zpa.user_status.fqdn.registered_error | The status of the registered hostname. | keyword | -| zscaler_zpa.user_status.idp | The name of the identity provider (IdP) as configured in the ZPA Admin Portal. | keyword | -| zscaler_zpa.user_status.postures.hit | The posture profiles that the Zscaler Client Connector verified for this device. | keyword | -| zscaler_zpa.user_status.postures.miss | The posture profiles that the Zscaler Client Connector failed to verified for this device. | keyword | -| zscaler_zpa.user_status.private_ip | The private IP address of the Zscaler Client Connector. | ip | -| zscaler_zpa.user_status.saml_attributes | The list of SAML attributes reported by the IdP. | keyword | -| zscaler_zpa.user_status.session.id | The TLS session ID. | keyword | -| zscaler_zpa.user_status.session.status | The status of the session. | keyword | -| zscaler_zpa.user_status.timestamp.authentication | Timestamp in microseconds when the Zscaler Client Connector was authenticated. | date | -| zscaler_zpa.user_status.timestamp.unauthentication | Timestamp in microseconds when the Zscaler Client Connector was unauthenticated. | date | -| zscaler_zpa.user_status.total.bytes_rx | The total bytes received. | long | -| zscaler_zpa.user_status.total.bytes_tx | The total bytes transmitted. | long | -| zscaler_zpa.user_status.trusted_networks | The unique IDs for the trusted networks that the Zscaler Client Connector has determined for this device. | keyword | -| zscaler_zpa.user_status.trusted_networks_names | The names for the trusted networks that the Zscaler Client Connector has determined for this device. | keyword | -| zscaler_zpa.user_status.version | The Zscaler Client Connector version. | keyword | -| zscaler_zpa.user_status.zen.domain | The Public Service Edge (formerly Zscaler Enforcement Node or ZEN) or ZPA Private Service Edge that was selected for the connection | keyword | - - -An example event for `user_status` looks as following: - -```json -{ - "@timestamp": "2019-05-31T17:34:48.000Z", - "agent": { - "ephemeral_id": "24dbe515-d3ac-4cb8-aa21-eeee2c2f9204", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 45, - "lon": -119 - } - }, - "ip": "81.2.69.144" - }, - "data_stream": { - "dataset": "zscaler_zpa.user_status", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "iam", - "dataset": "zscaler_zpa.user_status", - "ingested": "2022-02-03T13:36:02Z", - "kind": "state", - "type": [ - "info", - "user" - ] - }, - "host": { - "hostname": "DESKTOP-99HCSJ1", - "os": { - "platform": "windows" - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:57146" - } - }, - "organization": { - "name": "Customer XYZ" - }, - "related": { - "ip": [ - "81.2.69.144" - ] - }, - "server": { - "geo": { - "location": { - "lat": 47, - "lon": -122 - } - } - }, - "tags": [ - "forwarded", - "zscaler_zpa-user_status" - ], - "user": { - "name": "ZPA LSS Client" - }, - "x509": { - "issuer": { - "common_name": "loggerz2x.pde.zpabeta.net" - } - }, - "zscaler_zpa": { - "user_status": { - "client": { - "type": "zpn_client_type_zapp" - }, - "fqdn": { - "registered": false, - "registered_error": "CUSTOMER_NOT_ENABLED" - }, - "idp": "IDP Config", - "postures": { - "hit": [ - "sm-posture1", - "sm-posture2" - ], - "miss": [ - "sm-posture11", - "sm-posture12" - ] - }, - "saml_attributes": [ - "myname:user", - "myemail:user@zscaler.com" - ], - "session": { - "id": "vkczUERSLl88Y+ytH8v5", - "status": "ZPN_STATUS_AUTHENTICATED" - }, - "timestamp": { - "authentication": "2019-05-29T21:18:38.000Z" - }, - "total": { - "bytes_rx": 31274866, - "bytes_tx": 25424152 - }, - "trusted_networks": "TN1_stc1", - "trusted_networks_names": "145248739466696953", - "version": "19.12.0-36-g87dad18", - "zen": { - "domain": "broker2b.pdx" - } - } - } -} -``` diff --git a/packages/zscaler_zpa/0.1.0/img/zscaler-logo.svg b/packages/zscaler_zpa/0.1.0/img/zscaler-logo.svg deleted file mode 100755 index b8a21a2fa6..0000000000 --- a/packages/zscaler_zpa/0.1.0/img/zscaler-logo.svg +++ /dev/null @@ -1 +0,0 @@ -Zscaler-Logo-TM-Blue-RGB-May2019 \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/img/zscaler-zpa-screenshot.png b/packages/zscaler_zpa/0.1.0/img/zscaler-zpa-screenshot.png deleted file mode 100755 index 45c90c9d1e539caa5f4a574f5190b59e0ebc1649..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 268761 zcmZsCWl$VZ(=L|afj|iE7Tn!Ez~b%@EQ`BKAb4CN!}T*%|DRW?XSFXhVe zGP-`|C;jMO7!176LVK7G+C-S^J!S}G2?%5`Quvt2$jRM0imqN(@t)j%SUw^P4u)BB z{~lvn<5fmsls1O8tz`&CPl((AR$iXY>cw<6bv76H7Frkh0zsR(4LunydYf)DzOxd{ zmx;auV)%IfKYSheeJ_uX2Aq@P6{!XtwgCX@D!eJlHAgDdbydj`4S|0D4R-q>fKr=2bwlsNO7F%28;V>owWm0PLG#kG@5o9-R3ZR@^fv%o@z|i9Gf5BP-sey2Y z@QiSckn^3e%i>^a1rsil0Bu@Ynzor4bVB>TC!0is*`*<@*`+!4^@w0cjRQzVP{v(z z=(PrzxV!jo7*>Bljl?c!;Y}b(u>;KdmI2k-79OQOkPDtCcW{K#L2%Q=#otp~^NPN0 z2>7o>zC(5^PUJ73Qz=y7xUqH2D(zh03^F6Gusfti%U z7IkfGA9OqD#wMgV@Zcl2#+5J8gm{pB(mhP?w14H^$Ba!Vu;W7pWa ziua1nd-eU;9KO-GdJuek9%>#UPEo4s{T|u#|33X|0k5( zE#p5jGY@n0;>MRBzWY9@n7n^pSJk_Nw|D+>Rs^M%x*dm&#f_I8m3rC|img$n^`3Vd zoJst4O+=-iJx%F7^EXXQh{hzOge`8~fhje-vVZRVQeHiHLoMcXyV(h0DoZ*|IX{=8 z8>jY@4lutpT76kr$?=N*S#%$Z2J&il3f#?73z2-ZKhLVg!<%sA5;r(sU{)FkjqTgf zu}BT|J7@C0=)ePmaF6J>E@xq9&C09rLDwl?9aHEh|MlN@dm8J3KLsem*F$w&?sc_Y z;NQ3=D?`u8NFSh`Q`Azxy9CKA=`p?pNzWv4zc#rm|JlXX@$w0Ika+KbdGPJm% z=0r<8Z#emRck<{0W?R99M#bet>@a#DBz~asdetF*tTN3Ise||8`@_O1_ zO1(dMz6g(NmVhNShV%yA=h#D=@l5Hto_s3fH}6(plPfQ!PZN|HU_R>|clRoKDLRdy zlLM#_tkP;UQOn(F>JYfs=DQS~%bAIfI&IPvaS81<3r zA@zCy;S7sQz?~1;GJ$HGJ>bDJC~tEFLocvl*PGO77CkV7JxHL!o8a9Hk9F6l*q}3X zi{vD8ggX3Kj&I?4U$b)KrZ#Kp5!7p;9&}jHvP&3fBhP<|IG7?I@TwHQ&+(mT(0J0l zrTop@AFIClXcHZuBvEy~hYLIKg)mD!Z9`L^9-03@CUye%LI)nPVN;D#O3R0xBFDim zEC^6gJHO8+eNhmU16G){$r<=&OKR8Hu=0764a6SUHRkz3ClmxTC;dC1F$;eMU(yIQ zJA2s3vt4)@FpEl>ed<{F&GvHNNu3ovaK#J@?+h^w*>E#G13^(?uFN-Pn{edrvzhNv z7ie>R)B)S{usDmSZ1Lc|H*m1?c{`=$yR4-EkNBg`fs8WZ^wWio;tEB3MTHABf?9^DH=pHlILy$JF;k{syCX zdwE6O>J4jsMn00~{;<23o39iL+v7G~?6mg!dXejNL^AkAQnh^?8HKH_n6axRg{W>V!M?%PUyfIxq5bFe1W)UD zdpkC()4sesOcJ(w+B&qnUeN=OMS&@%p@T1JkEzOtz4K(q{Q@MzHw$4o)=ssEaL3qF z^j|qgG(63mzZ5>fDnnQUYfM@Ooc)Ri-@|h(UXuH+LSHhU&U^=GUix2D{0ChjEWQ#x z@>DOEoqP60p*QbJZ8m0EJ9w0B^f|B9ZGviXZ}NHeo(FnbcmdB<5L&?0@m_>g<^WNpV56_`j6IGDV$c=3cqb-py8z!S)A za2Z@i`Q38}qe1M{4{oxOH;;{3e8UX*;M%={qKDF;<4TQ*!aH+1+q)2*=lh-;-rHe~ zsk^n63CEY6br@psVjD+yqT$M%)i?Ci5k@FHHxLNj6*^D0=;k8zuLwCju1!;O&g=$c z800}dlmgS1)LJ;(wPw0c5BAht;kfYDQ2*Y1i}er3I?UzhAs5}$V0+h4)2Q$6UDpL0 zi>u6Lb$7S1Cx#ryaKF`an@3xZDUqVg&}X0M#s2$Q=+t?S(d|~7f?y=|8qL0O-p}Wd zL#nr=B0ez^v~Q+(`iQPOrnVB6w3q#Y$2x!+ocE# z-q>1I9vEb`ZgKerA4u)R6(OWxkLPf2_$uV#pWEVEq;qXqb11ZGT^->~YWM^xg#-aUvmyM!(SFVAreUFsq>3C<< zX|OTkiP>O5+M=LA1&^g(NzSDDRl4^2-o4T(DNe4Zuj}QHPj_Hu7kK8=(NBYkjL;y! z^B+WGn>-9BpWgMMRw}sz&%&|rEi2nlDQ+(egs#Nl@Ew0DvY|uyZ`)ZTD>CR9< zi0=Mxzi;)fi0miCOP@OAQP0C<_9X+<&611$zpb7GA2MEpk8+J#WTF$$3W+9+{553# zF>$!J7XbhOCc)sQI*U%hje^Kno8oa*cj(i=(jFiE+t0Qus~m-PBGJ$UI7_ zMRCjHz8^Mb5~?4vyZ>`X>uS)d`;PD*6}ldOp{?(v&cq}77~WvGop)Q>?_u&t4gP60 zzroEEjQ3I*v@aBD@g`&&6P{Pw!mf5zy!%L<*2rK%=PK1HH}L%22_6o;uX|ec-%Ep0dYflba?|?gAbG%M05@rz)XxBD3XR@`0rUIB41th6bE7H<yR4xTm@iG;aMr2*KePxl3}Me5E` zu^UBZpyZ9Mzs)fl^ptBWV`tV&|5}0*^75y0?^_bXUcSMAMTmRD!T(Nq>bU(rEe_L5 zy_c<^5(|-aa6D!Q=CY^R7_IUHMMXqd4zJ6~vCE{pdfY?NG$+xd zbX?TtyogBTO`c5dg9G$GxS_iPKBHeLgNA8tbhMJo$Wl&Mo73J}8VM=oEC!l@xHx+f z4$(f1*HM(eOFnT)_sJ(=_X4ilyVtOpR+MURY1+AXVS22;Al zaFRNMtvILO09`#?Y>^slGJ~;yl6B+K?^3W;X)Vu?!+sLz2KpKR>a_Spu%gA=Bv= z^db3p1-+%577)LEc~;hzMRTd=( zzzt*4oaXf&(fd2yVe;yv)h1Vk`e8e~5&6iav+nUYz(iva0N``z<7yVvPP49kuTvrwAJ-LanJ-( zR7L@_vtLU&~Kc4r{GNIwxc=u5+tUNrZu2vO%KuwvvH6W?8ZA9~0!~QeNo0SS49v937 z>P}``zes`#%deTy(E;LCqRgM&N#}Uy8sjAMrNe?cpa77o&%VFs(*)zF3#+<0&tPa6PLMo(2$qr%wLgIWT*wl zlDB<>s{Ki_Xqd`RaZfZG{~f<4_WmpPD^qa~h%BriCyjzRJ4+KM)k`p9#TV_U8qHTs zgdMiLnJJv`XXIn4rDIhH5%-%rozFuN{xktc9b*yVn?>2$nlt*NJ7YJ%Ze=zWY|1`D zfD=ibzpj=VNF1|0^`0FJ+(p;rRh z7#UqwhHVJ~bA@#2SeMwUINYajut2F-q41~~C`J~}(j8&j>!QTd07IS%a&zORoju|u zo^0)&GzM)!TsoPV$M|Ao@g9Q{-!Se?NIKS=el{{rEY_(0)iV2sN9=Wb4aJd$s)?Sl zd8^LelYR<}=oioT#xgtLM?b*(L~;_mYYIE+8mCg&1eV_`D#i$$hOak&Z`rvw0LZGM zAGsz|RVr=$#5o#uHW>pzZ!`GLL~?#T+uVjO)=QoSeReE8^n4!gzp=XyXl0$p)t5Y1VuHL35UHrds>2kud1qF0oa2^7jSm4*&AyzZA5UgiCWd~R{o@5M%;au3)^UmRhI;q(iTrt zkWE)u@~5NEi;;m9oY&5rarSy{3^S^~e0SbHI=Z0w7mnU7(yzs;8pP%=5HPW3w}iL` z&L_u4A`P`!WQ4vJX*I+9`MP4Khy*aTzt%>pxOrGFfLYC{0Vb57i+(*cf4qY*xKcV{?5@J+(cNc`*Bfn5nKb|r z>cT(c1(ECJ!;SIkXt0L@&spZ6QRNIZZiZgF)9a5IQLbG$PxE|MvS@8qSycl&KakwM zPclO!-!a*Q9R!uJ(fU%Tf>-dOVrjX#hkrRWh(xcfu4She@~q`Xc<*Kj=smT`m5FDO zZjI12%*JM({slQr>s#2-c*Kh^nR{~iDXzA(cVHcM5o8+EpC*-|T@6$^#Op%ps zs+XEyjZ^l1jC25q&C!1i>)V|Mwp=|Ymf=_uRV6_SPgc#v*1D=`4_o+ADXx6_XOeD$ z6j`wS*#Nal)&2>BWa<+!S7wtOMuo@NdmO!__1qI8Nzg5RR*Hj`W7zI(34TF!_}q4c zo(k54D}~={_WiBQaS+SG!ll+AzX+PolS93H8MBVDWLrE#rDLEpV*X&@yzD0DUw8`- zh`vE-5acv^Rf2z}d2*^cdHHr-i%W=N2IWGAHrTqdHumxznoA{k0ppTj5bh@Tp znTo2CC>eW_FwAto*v9iOiesph{=1H$u7E-JC0k5jLt?RcBA06RoSSYzU#q1j`c9k5JKjY3Evf zOf5X)kB9@~G#S~3--aCa9nfTvc&AbiH;0XT8jI>Z)@N0JeYxx?H%T=-JVu=AQ}=*y z(I^Tj9?TS%U?LqOv)I4C9-cnW4jui`MkeTD&B-KoeM2a_m!{#T?sJf;ae@4#>05~H z=ePF*XMiD447>ZDD1MHYd&)a5HsxIaz}OtLu#6YqM0Hr0xFVwtp80Y~%Gy#*JJ3*k z?3GXk)m!ISjYBq~{nB|zsy0RLs|G3Zqg}1^G;p~&$yOJ4_7@2D{`1E|d!5I&zqVN8S%lsjq_AZ*|+ zy7y?shM*6DXlW` zZv?l(XK_LCG-0xApk&Eu1^yU;nt>Y!lk&>*llL zk7V{x_k*-8$@tw*f#w6-nvp*?1ue|6k!?6LnO%izjT3JYs*6)IXLwAp0Xn;FmG>eP zE5y-^s{-ps<*e(}Ls${mXbPL|3)d3rc)!G{7CLtK)xzrV#=ldPdOueWl)1kh0w2pB z|EZ3m1rTO(n_0-$8f^^|;#Z=@8@q6g4qGF0f6e_KmJcBVzj9vwL(szC8~g=-wEoq| zK2v>QbkvEv7A#$`O105jU&peJ%bs41R#oXnF}dAd(7r>*Fjz8cHwfmTNJ4ScM1=~h z5nV_{{o|#i8fn@*AS?QMTu(hO{nY8Ud?K72sBjFmD;oA1pr8b$*z~IocF=%xp zrQ(!+nU%PEY4;k5fu%u;M!7NW;m+%ZPJaBeEY+#`a|AF&Pe~&`U>cj0;WO3q2qkg5 zf1aq&tpBJiXUqH2R(l4HMr=%-y3QST>1&)%0yyzTpNOP|dv+Kc^6V-FG6 zJ9C_PI1{4znL;Nm>kaDkToS)C(s#O^Rrw-ka981Dd>&~Pp2(eMe~G0l!-RkhD&XVU zn#|x$dfs%Estx;fV_!T|lI_=Df_4M8kDR-em!T1>UE;(Tad%z^vHl@k{YtmN6!aPA z&%}#(}` zFOypu(lY~dAKnn znSY0^8`&u+5sZ`*Q~uk(o{qRfOK6Dltu&To3Cy9Sbw3kD*WL!`Sn@tw7_XfOlQ7N@D74!hdam6I^EK=y8wF0s)5vp}q-^a*h(}=_2O=W*=F;qnx)qY`VeDfC8WL3Rw%i^?-BulRG zXa&x>HdExH_gKbuissR}h9Am(M;^O8)M&)=oGgB5H<~f)ivfQMgcmpNQeh)McTDQ# z&M+R)NbAhRp!ExW8lAcPYJ>pfm`6)zT({IZT<5a-zWp6}Y|n;hQ!*^sarF1zC+VTZ z3K-wzi`bs6%U@EsITd1)>zYkpsOmih4};g$0e&*`_7MQ&kdTf!hA>pu6NJ#Fr6skI2x z4_$bJ>^$Kgh%CE?>ptE|`uV)aaq3un+iemrdF1Y}Kz{g7Tpq_-MF$u2+ z8ktarBFc@YJO2o=Nd)d7^qA&7?ozZw8kgRvD1mNNjF@r?#3V&;)F1S+&Xyv5@qNY5 zX^pu6|5^)no&gZuW2JQx7u%~?N4D{VNERCw{fd*ykWs_jH&er?3-g`b%6@zZYu@Ok zVTC+08)vzt>z@ahh0whp+2UR{(nMc=*d)F$#K{dc!uyn*q0bKEC*D|m@-2+iSm5Rf zXAWRTJ&Vz)(>7^R*>s4Nd56iay{jlKd|Ts<=KsT(4WK)1ClM#>X-FQ^SqQ9GgNu76 z1X-|3SBsU-!ZNRp%eUZ?hBC!x083y^#-`KppUS_DPL|GzTtmc8(+qqRg?6kVe|ytm znk~Pk=UjLq8JZ#(k#_wZ>silKdskr}I=>f(3ZZm*`=#LktrSZ#!yeua~laaWg;Ej5d_IAa- z7zL@yXGmK%NB6k4we+z|u>TsE=`Yi&CF`^Gj_#9oL(6qDSc8QKYk3*XBWIFn?!fAW zt~Tm*TP&VWhI&DmyxkE$r&(z$UMUH{$X64-=AQIt@Pb+EpS!t@lg=7ft}vZ3 zHDhxmtL5`U!NW@$;z`X-S4zU2bk9F=IIsk3W@-i|c*Gv8;Hs!4wDWr}Tro2< zy`HsFym_1&d^EGF8T!=OTzQT-SE?FWR~T88Fc=kcr@9_vkKrxz@6&{BufvNu>;=ZL zNo#9P!38>4O@&U>9m^Fnegvb8>O13EqhK4^Gx4ZzNaRjoikF(1sXH;4=*xla!*cK) zDks+l?0BM&g6@-G>v8<|uFDV-tYniW#X(a^CdW#gz5eET<9vdu5|79mtaLSNpo+vN z6XNtV(*+FiOd%S8MH6i@+e$1gMa!jI7UO)?f~wIuER5wYt4*c>jj4rK-x?s(m~bhh zjxakR`^Komg3Id_kEUoeJjqW6o*L{UG}Ctk4W6LIWNGIO9W+muKrz{LY@+x+)m8s? zn!Am5so-kEQ79S1{aCPU&7L^60I+W7m3{|sb=F=jD;2k@2)Ftit3VbaO^aC?OuTTZ z)E;E*{i+Ln#pL_=ZfBqJ)sG*X9_k%SxgtVD;BJmE(=ul@UBMlH52Ln1*2TY9e5byy zos#KxLDsvIEyAO=_%cisP5jWuhYANM@+G0_RaBhcPcWpF?&ZX(hVj>kCZfNb&Z(Q@kk$G+K4SSf)c9i z1k(uMcb~#p$WjFe+WhqOU!Bsb>VxX!*uKLdx!S~b_M~L4T}`@R`s&F4E05-Wvd!f$ zW4YmNG@{N}p_LE;vbq~b*0m>$-d&Ceba!+|Z%xtWMhCg!&V2f!3gT}gOF%upuMq%t zTLl}tEJ8=~=3x!3buHrL!ddy>0VI)h`#ez>Kl$E+k7_Jy=Hea2m3wWLyd*a~ruN(V zfW9>C0HZnU(y3SVKt2S(AnRQp`f(a~*cv|cwgNCdyZ@XM7dn1f=9RE2O0Bb`ih^IU zQjcfjiI~3q#G<8g{;jXrZE<>jY@s2cRvU`3kTx9Fe0_Og_#rztDI6e1IO)$P{V)?{ zsq)_MXQH%uKk5pZj}&UnYD6{aLGF~ps<#IwG&@jKI=}<*O+OMn!jcIGdt3Bgpx4wk z?VxcgUCq2-BG~{K()8)4i(^OhnN%hj&O2JMop6V8T4h~BGm3kCz%9(sNV?-phqAQY zfypYaeFwEb*}sh0>d2`&Zbuh{ycBsfIX|Xh-&PM^dgc%$X&VwSo{)yTH6_nJEyzan z2=7va9O{V2eUt6N^o=jbm2j>StfnT!)^RmE+R+j>Z7LaD5c;W+|ZSZ z6+Nahl~);6wgR2sCh5Cjgs*@+6O|NuCGTL(!rP1{RyX%e35DnAjRx;8EG8{E2Re#C zTgzh6GjkE7(~-g)&>SwXK@_)|I$=fmm$`|Ej`kfzmM=%*qI*D||l?)%7?C5`v#LnG}a%*2*2p4F5A8KvhuSkr%nZ_~f5+zxl z_+V=6)GDkOJN!)~dy-<6Q?RAcwS(S22RD*}j~ZVOWE_Ye6!nQ^Kl3Xpnp<=DzG@qN z(y`6$4ddP~P1&pWOnX26B^@~N>p(4eOiwKINx=ir(b8^Suq%}~UjAmhMVp&->}7(z zqK$C7Fr@iia+&ebZv6(cI6^v&sGa-gd*htM+4SGqi2ZaWur}3Rxe1E@s1M3$gjg1d z#&v|GjOq!rzSdU7M0O180y6MGUVm0W@)O0WJ4t9 z@Xlk$=!b1)k1;nP`f3A4l1@NOpXoq-iqNog5)=vZSWog+&ajSpcBFzC@TI~f&B`!^RUhlrRRAc<&{)1M96 zT5B`y7Ugi}Ig1vL!&X`rmLV33xgaG;di!H;c=&slTU5@X0II>A9dOPQ=1R(}?Jw8r z9zu*wdWS)cG<}P&#s1p;=p(+p?auo;{x{d?uzkL8mQeG%c4p{I4D1u#@p1Em6jzh* z+D3MA;J+Hr)21~^7E+2JA0@!Gm>cmJqPKBi$wCm_oe1E3-*I$xcchBg@*L)Ek)=dB zbAc_}vf;XjTIY|xi>S^^w5XxM3Zk<@WD@L6h%0ruvRn#B99ErTshlAWvBQxN%7L z$Xe{z&U2}FOn(u1wS+Jy4V4g&HZ-*@;xC_@^uShJd3EymmO^PxBQ5DU9)`p{52kU_ zowP{ME1};VU&`Mh?ci7)U7u>BKyqXXzsu1cVC$rwg#FTeE}yHO&rjhK1~wx~rX^p;f~rJw>tA zgd33?-8}^DXg?#x&iYihuC^?)rWyjmj0{69XXSRbHn>+3dzn=?8FvU=Dec?=0D=aYNYB{zpDHaCO{le|cb!lm| z2-OFt%hVr=~`_l6Bi;D&;3q%V_(G9Jp>UHJ(f%QH# zteiV!l5fc%M!X#5cO0EMFy8Q;Ar>KE(He?WJ1kiLeU)!wjHz9MgzHq&-f*4GG)-nN z3(E+ri95I~(28^AJvqsxlQTd?Mej+%Oi;LKg6o{8WkdqyfVVXjxdZ*i6hb$R+YQbX z9zZd-etj)$FRYIN`Lnab9Mps0{+`on3Xv(fvH^1WMgAvNOjWK!K~^3 zGZM8G!cIsCtEkl_n+=nC_)#<=1o95-%7`rryjzD#^z02~odxPoPEM8AO><&q=*AjG zY91&KrR2ITM@3+GD1iU~!ziU+KHw_N4ut?79_mC087k^}(h^2}gYyX#{w=myk>AwCz+_$hyX#WDr&X zkKY7ewG7NuNGunmCu*tkrt>D^y-J-&_q(*?X?UfAtP=t3I^EgP63(76Hc>Q*Xvt5W z(_}K8lq@vQm*(%P?Doq@n8C~Wmca`5=odfUWzB0!m|fN;=RYLHwFy)$H|+;P?{o41 z2@`u=KKgOr$+%DV|UY?Z6sm_18)@i(p1Spg!$`ime#Q-ebb5tUP zB^<20QBhN?*VWS_lO*6II6mJftETsx9#Hn=9xtO+Yup0f+M;4FK%P!txHbs7_x@o2 zJTFA276fgl72U^}223dI=rav?orfq#l>uAo0HHTBL*0#-Lg@M_GWq+oO4zjO?g2^3 z=G7`=roqv_W@N-O$qxU*Mu}}U%T|kQkq6Ktu4hd(xp1dRO=gM-0UF@F-!X^y$dh!c zv@$m0D%9yq-^eF6}gc6CL1?0wSt1UomXI;r0TFyKv$J~ z$cr~)a-wr&=k^7jNFfmb*t(ek?6xJ&sKd8k5PTw6@n$g3^N_3{INJ+Te}6Cx`y4Jp zN=liM6mspl=Re!4_=ZCG0|aq)H{2>8a^M@HdIow4t8V+oHSlpZv{F}JfAT=`WfnF} zy~Ri_`dLgzw&g9r9!AsH!+a1>cue9RubM@}Y4s)Gt_Go9mv<#c7W&M zX0VMkzNfTs@X};bj8@BG%;nKBzhD%g7Q&(`N5@#m(M;-{rRLl zL|8#pDb_?F@tYdFcGR{})-v%;Xw||djgJg<*O#E1!NS}76n{Kjmt20ptE8T#J#1fA zCNO6{q~FoTzf=2gu`3=Ak7OwQi)ELete}4#^N#(GI{a1K_&gQ=6Wnw&%)n~J$Q-hKKxz|@$Qgp4fn`T3WIIvSqjeX{uTJ)y^}#GSIQ zZ>MP}!W*_*^sHOxzfY>xYY-3+0EJC)@f~ah9CN@flMoq3Gm^*C)oq~XV^I3w4lVqN zcz^+d*t)ZQdA5gsr-plW@8{M+9W5R!0D$|%;oU_m#Dllpet?(z>zu%%Rpyri)KI%+ zPuhk=9!q4{Qm^4WzkTG=zvvX+`eAe^{Z&QQsPosVC7|GRd+S*a8yB2vk`}^)aRw2! zg!%0JUz}B;s@UpBl{B=E)REf-AUKP#MqI*x%gcnpfkLA5;E%Zg1B0M#fYk?klNy+_457BCc7SL)I~0rF`!!@I1}p9_~9; zp+*ip?4Jc!B#=WhxIk)>u$31L$rm`+B>C2bF|evpXuL?+UAr*g2O;4VQ@=+-whx^_NTZZJAw zy&goxYmlz}U3wZlYFJ;0y=6Kp%zN~xP23`*a(^;IsnDfP<0Is=ape6d8|r9ey&)mJ zT&8%z7m=xHFFNKX%s(V6P%-x4X4vP*~4?0x+Q*zl(wV!|(?+7QI}ig|PHP zRMX#|&@Hx_*pdy-Y4AV#T@WBUlB~5~885WxWcV#*#n&ckH-#5qPZxuEr&^VOKicV& zyuY2Cw;sPa`HJN3G12iLE$9$RP}uUhcoQtd7vAy8fKQAZb+ue{Y3)dw6C2&9(}Bu> zDyB?|cGjzM=u|sua_fOhA}3Y%Ltc|Gb;TDC1(CH9=d({)jQ=vU2w>+V6K+W%QcPy3 zUlsq?hiyfqZZyb|qTrmVOO^6e!tnwu&Kc-GICk-a5zV`-eV(k&^mmQ_qVu&g>}*Ht z!zVbQ+P4bwmbMs_y-Px78^~60i}j~4d(bKsiM<7UZV!v5uQ!HWxK@^b78O)Gkcci;WH z<6iTnoW(u$Po~hoj)1m>0dwyxSW1CfbA|Va`k3ctmXgq?+6df(@dMb*XZG`zy&6{U zRJaB5`%c`3(C7AjA>uBjMHyaj2!>LH-2u;=?nIgFY=jebBBRIAC#-bz2UNoJ$dgj9 zUL?#nE^Qgx7;h4{89(SzcqII?OT)(}+!yFBN5c=Efxa^FWg1hw@wE#+q*V2jaeReD zn=8#GC0dx>@@qtc14}hlmsV#MQ&T|lEts+1C-+>9yq+!fpniNM$62Z=KOB6Jqk`P# zXmX?{W0aPeCjfGk<;@a2D(gu3SN&ehSgoFn{BnD$yC_13pql?Dr3^L}Tr?*5J#5|Z zxsCx}mD{~(OEJ|g_jTYP6W(^S3iRS+j+leDR}D1 z7XE$PeIB7kZ!9?ito|Y@k&0E;ywUSfjJk@&G;v9tCWUD9*nin2eHNRMURJ1QoKJ3`na=tKZu0s@ z=TwQ^edgqM(#&k*6=ZtW^Jp&ObCN9%-_!Ac+4S-Y2uz6B7qA=@_%>W>9k~tTu1q~{ z{S)~wcMd2V9XTPt{DuVS4%|sWGIMhss;lafXG3?s!M;*&ut+^N_>zQHT!>p+^HBCg zj}vTvvv~G}Cs+hG^79)W9|{AOxH_k$gErZ!#3rk{nu$C8uE;G28=#6?)^sb0j_g=! zY-paRRh$m0l&BI4uo^IxVVtzG7$NrVz}vk=nT7B^QG7HtE619ozO1de*A`o*7A2#zEf|~QlnX4U+43);d5Be3 zwd;AMy8Hg=IlkB1&U!HdWRVq{C-oW=zfX{Qxlpnl-lz1q`sOOIaB|*zJ`T$i z>X!+DXKmF^J=*L(;KIP)lOmO7(e%snXJHFPlK2&I%^&->`>ytCEf5;kz=zHA7imG~ zO~#kUB&iQv0ds10SfJ?fYLta5DR|DT9s7(h;Y&s9tMJJN6Fa`t%-W+-#aYOLNj3B5 zSIgIJ&plvx8X-FiJm;W*v`~_e`uXoT)M9{w8Xv3Gh>D4Lz-?tgTi?87$_ouqcB?7h z;j!>&_AZznCn`p9IY}?mxO zo^fo3dkdGgV7DlF;m3ln){hp(=x#K-iXKxE1&$S*0}=$+Gh31(fn)e>Sq&X4#apQ} zh%ACVQpasJLEVY74wT=gjPjxaOoSj6T~Tr#y$>JI+dwXpW@Yf3iw_uttoE8dAI@7dRMT(ly=m7(-sd>h&bO3* zseZUtFihqx@X}M0ef(gGJOZh!W~HsBp$*=d?oFJFXgih_L60}^tVpAzs6w3^wEC!6 zaWAC5W{-OIE(6AXxF(3$U|+0!P*FXTShG!H>{o6K%UIDyVcS+F>gvgod57pCXs!@V zRx{S8nfD9tvKG&zrlEHy+^rKt_Fh=}_ofl+Xwc7B95oQL?0@1=Fy~T=s}{!RJ2&Ly zSrzXFx8PXEtk!kMBshI$TK20sPxjfAZfDbXcIE%%&hPLlTq3=HF7X*`{>u>5@1GgQYOMOL7D&LYp`MYYo<@ZCEHq2 z+F_>sf*fLb7djQQpM8HKJ-;nF%F$QE2v1EY%Fmw>%Pd}%jBEP5mqM``YaM!^jr1+S zzy-TZG&NMz!)Kwy`@=)uI5fsH*Lfr;DFgK>;?qwx6MQ1Y zZ!9tMZ!B$p2JcJwmH3+!w%eWkUd{fezg#^WUY&CEMQaggOZ^t!kpjGSmNW(_#Ug#1 zYKg$T&BmKqYq4fX4mn+Ko{z8`3CE|Yu#Iu3i(W5VFn6v|C5H?;3t$50Me!vzkV(S= zJlv3Ky=$lW`WM228*tGm176T|1qUAl0wiMQ%+$grWqk5v63NW6m%;(oXN15544P5h zpa=Dj5%v$2wrSD51P_Hns96{;agwv`6oW$FUvj^RA8S2Gzb;X?AT)OMNno;ZwQ%3$ zl%A##7WV+IOYef1X zf-m+{!}$NT-0BTipqRa<)Ym@o3?dP+1tb61;3|>5r0NR+C_HIAuGJH;cUUO>Foxof z;5@cIX?6klo$}w8ZC$O!Kv@QyKPK5he>dr|Yx4gw7aSJ?j!&lhW2miYm~UhXz9*Us zS%4$;G)e%`h+PPSvFae24*3Mb!L(6Y;=-JX3}b)3?ABawL3>cNj8&G=$%j5X91>8I zaj-RN%P>E*v!A&}j}$UBN@PlXh%;y;+GTzxKKD-qMQ4)pi9@^5c`-*#kcL3kXR597 zHk|F?Q2V6HBALV;`_v-+cWn5T$7vq+2ST*!8o;l@_2U4)X`<_1dqFjg$RyMVmNJG2 zmggXg=FQZUbQzoE0j-VGGANF-*v2-S&R?SoUJsDj?6{~v@9_`;(H;F49~YbX zN$NRIr1iN6J}{!4Bi=Y!jTrZS(dYYl?gD(MwPP^!9Iqfw<8*PJ=Oop*an3At$ z-PU=?Kln3pE_0DYJuSMv%}^>;bNvyoh+e-jad)1ur6Kheky$xv%bMo4)0C-%_3m&KU)v%x8^k*_D-O-HTBj<`| zg`2mSf}?E|%5@j{tCDR%%k(7~ypjopXG{Ur%D0BJ(%ar~VvvsCLsBcfHtij>OA9DI zueFMgv7HDc;?M?A(U!|=bz@DxEm;^hEJ+R;r8`wGoOc4&c#_Id-)FfvgfxWA{_A#5 zMB})BEu{d}(3je#;UE28te_NEe;}y&yBhV-EeU*Fhru89ZyZ-Zc z#=U%ZS@I*@SUxFRFjG73gQMC}67K&2;y@k0TdUpwI)qhl=6CT}zMvmM&vD82fZtRf z$c-BUxkP0XCzo8l%IcTC{x2d571G1wqCCYyIS&sHkNk+OZ~B{E_oCa{<;_GXR@NC0 zF;7u|P9NkO!NXF5t3y)Kp+%2%qlS>B`~rS2)XwNFX9Ow;h^(rzmK!yyc(`omB51cX zCFI|qwZ~=WiE|uLy1GVWES-oABn8~G{p{&7F24kZicZaU7@O3LhIu3p1dDp*_COV- zwAAVGOWmO|MY&3ahYZ4~RAIC`yNVKuZda)*t7;QDzrV-w0t!J`U8X?2$xd4kxR@@~ z+kE97g~PRH`Ebt(6`V)H4UeM3SitGG;Cr#SHrFjX8q>x_i&Ivx)QfY!;&FO|pdbWY zqTh`J!Ih2azGM0@+AIQpVZrOMazOoa`T=!@SPaDk*Fz^^ zW}Ji3ks@t_8xY9}%_D6|wH{O&wYW5q4yFVA%@@31W;s58y=~K@vI)BC`7LQbYCfQFdiN&9fk0Uk*+QWvMcXm*5&MLXE!*rH6#TzG?0Rf zjOM~m+HJ5Vj$nlD^*gOo_1R#AfKYZuQK8?-w%&*X$E>bN$XE6!OhoQ%kPnvniiE7I zv(ZlDavxQO;y_0jcL>*G-%))pbeeD46-aZHRiZ9gm6pcPYIdoB5O~X0d~a!SP8V4M zTtw_{LIAPTmf|doJ(ef1CdUue+S)K-5n%kIhU@u2op+=v5#l?wy*gXV9YQb*)A)~PZH;z2 z8w`>lBhY8FP_CjxW*j(%c7o%g3UjT>6RC8<1c+Rt{nV=JnWeWijHv%`m&mhyVPXho z(69i4MRkqO^keEkS|TxX;FG+u&)3;6aihb-NHhk#q~i16+rR$*BrztK)|TUlb88+ZWpgg z%VpY0zHXs4a)48LAE@nz@M1Y1QrG7BD(XQ*)tPSK9+X7iv zYtvXRXidx78k^VBtT{^$nv{jU8{Y3+iUaKdZL9lEzJ2g8$FeNdIG4EarJsZ(CgvjnEL2Iy~dZa!-!S|d?KT3jiju9mWFAi2S3YQW3~)Im@>Gst`VRy5zfj6$m&yTWGzN0vs=3!`&PT@C(`ln@Uld+rzh0kc{BfXbgQ(rD_dKu7 zrkxx~82_sHR_)Qc0|D2l-SQzV%h`ZX>DA{#0VmJJ1n~&GhrqZ9fXtm7AI&M7@a`xJ`}O^KEN@`V*-)OA7i6hzK{vUlNAyd8$o zL9`y9-5kiJTJ9Y>v@Lj~$Ce?E!JXDQts;+W8poqY-MG>0o&xOL;jZ1R|Hf%%S zq?xUt>+mg;=}DPLjmyM%N?v=_8Rj?-50B#E-|l-x$}20RyrNQNxH7{xqVOeEeoJWM zdO`iL)Ku3XR_!aetn1NS_r_cXy98nNz37#~6$exM&R)dr+8eoe#lC>Dz}1rK#;=RIaS zYufx-UUN~v``|V_55y2p{PJxoWHr|7{YyhJNsSClb$(IYe#lOf!g`mo;D}R?|=o*RAyr60~>J1{~@fOR7+7>&B*9nr>R%3~2NNW5@;#)eYeGvm$9eNDu>+5LKt$T!P*Nbe=F}*q$P$2j9 zC$;a<@0;DImpB;AqD=BWJQfbh!oZjcX4=pq53*RR&S#3gi#^ zB-$5b6p)WJ1ukE^n;}Q-vGmW#C$vZS8ii1O7IHU>IHisd)%zShmuD(AsK2M0_@gi2 z{ncn605P;dWj3CztfJZwr%MfFlF8JlnU?QB04Q8ML@i8Dj3i`VU-5`FkEH>971rbE zD+G`P)Y%jI&7aioyHIegK9xTlG3(k5j6j~~vE>KCltCZbtd?s0FSD&ONkv*-xY-^b z1=pkvhLIdR-VIdCO6NRKgPaaKA`!6M$eOW?<@>SMiY<+ED1mNuJ z)RZU8=A_1f82zN-|#rB-;LdF+n;Yd?^b@^}8b=dMsa1pX#-KBA7m+bqoTHsrtCD=+(Ak zp^;#n1u1PzHu*^#gn&$)=v75zXA?w~rm1j@Pfo~-&Gj}v9&-Z&8w^lI2Q?73FI$ZQ zY6Iy&H0;)QzD3{hCT#~vV~XOrt#+C)?JeJpXtaEzxqvo~sg;v~&BJnNCXoAaKeAgF z-Urk9h9|VoTI4<eMFzku_){Ka3{zV*Cf9KdabBz!2RgI zX|E0r*s{}7L_fZ?y$#y#o!=Um-%%}xi%sIw7w}GaPG&+8Xb+-dLjx8Ii!f?EM+6u- zq_m@mU{JryaqUN*?1jYEyw)*DLs_$f^B&6=Ou(Z}AXw}(z32gU;FUUuUb9eHoqnmV zJdhhUS{=lJ_Mkn~1*mg<+8#7(f6Bc(G#wqLA{iKYB^%VA>~_dw8oVELJnE;DEonQE z1FQ9&K7WILW9@r)YWs_>foy_~hHOHcjJ$&XV&ld{zeiLTEfnMdcP_}I=$6X?Zh)KE z13WwKBq)mutO5&zySaOXd`O3I-H@ufZirL;g>PZ~qDA6cJUmWkz&9pUkb?|`7tCJP zR;Hwa*+bb2I|6~9EMQrO|WY;Lgb z4SsZJR7O)pe!zJEg1@4=PRmGUp+I=V`s~|>ri0Az?M~tATJ{*z`iSrol`TpEQ*}@a z|M!pDQGDvgg{^6$EX)@?E2KKUzoJwBbK#C-A}v*Exn^xzUb_PeY{=Vir^lQ?J9bWU zT2{OF7nV8NJNziRU)opJ-9rDt!af$(X{Y7`6q+3k=_vxT)WH<-G3{)~D+{E{LI({N z0%naI8wzA&ZCZA!q7;qhyxc$=!+>pt7AE>T21&BXXpW)1;F+5$0(s%4cw(YZxbK(` z$U=HclNYjsjKMmxh?9%fsglkT1?OSy!*d)RDtj&R`zQBSMOYwRwE7Y+lnk#KkF~F>Yw(6v5mza`&aa$l4>GJ#yX1B*YP^a&d zwoPBF0c|Ii{peuS=cw!vl}%h4?Xo*&zMx#;-}Hjk(r+i|ld!N&YE9t%&_6xhm)lTj z(Gckan3d2w9>}#St6!Y&9Y)TXvPLyE+QY+Ru@Eb-#neTIuqn<$juQ^|TjKCkAtST7 z))$Cc?R=P85_?5WJgCq7n(bC8DaO>-D_5sYke9iFjxc)KWvkM$BZo%@0(q6@cOji* zKDd0)krP=zz5p!_AS5=`<98N?v3O-*F~GM$c>UHvYqjPS7LS?08i6V1M1Fss3KlFc z*qD|ZH`pkil(SL;7M<1Q3FEix-jk{?mlT3+}fP#78%P@L)?Y^_hqZBbqypMGb7kn;@w0}Q1&1i_0eK2j|sHW zJ!1WYo~Mc!^*>G?C=|E^f^eKm8)C$;toO?R1WWd17?7sV#ya_oND!G~z}z!@cJhy< z6)se=^RSrU{sgsore{L-oCrrsmlQKU0t6c07&(@{3%LYB#P=Jyfv-^9u&mK{N4skR zlWj`NZCkB-42Z%~1MXyoClhkVv4s4%Js}4M7WR!z8>*Gv$sbX0U6)Q-LZ9kOCFGtH zTHY!HmDd+f7daikJLNrIt}+2_J)Z&s6W3p-5{@_}qCTISGJ$L|t_^!rxvd*4m#bdt zf{!i*xGgg-(+Mk=JlL5u0|;5&)Tse|p1z}@iNLfOR#w;d74itY!#Kjm6Qv#=i;wx% zvv{ATU1dff#z#)q@Pxd4%Y;l$Ovvc?gj576*>(1L;py?Xvwi6$ z7s=1R`)%eoADoW?{Fyo*1IDi@|FktU{!Li{`s>#1{zxkwUC%~+EXUBkE8-Hr}=izznXsgJp&#sgD+00`W83cl28buU*TLNUD)E^ndoq%--VLHk1 z7>{Wj(|2^kdK<_nPT1m`Kiz8sAuV*8SusHyNpq5&<@sh2;`ru`T7T=pga{yp9?^Q{ ze5VfRyBOC3MZl=J1|IUr4catQ#&m(SqTOE#@V%#IKIk9H8CD~%ez1>Yp6N@aQXTwIe%>tM%m{Jtq@Glk517y{!9DqRA1A+=;FxsLcaIu2I>;l(W@%c za-GWg&YIc*d5-tUwB^0}UP}pavWX_m3$!&@H{uqI>G|29eSNHF+64eab8T6?A5)L{ zgYw3=0E-c~q7aY=WTa?WqFOjzlXTh@T&6_J#HofW|BHoK>of()$QgmYgcomN;Fg&O z7(>|O`8%$S2K~lQ+eNNi8_0v5_B=BkUsvE_OdJ^kK}}4^J8n4Foa^D?Q9S(99gjPYCsEd0?2{!BjhiOU<1Xf2NvoNKzL5Apq!~Dbh2t zZudu8$mn_&GL9<%2ukFe#y`5ai2lb_V4(3kqp5HO8zB_|1piVrma~BXOa!Asz>R_+ zF!=9^UIL$}_*}%VDd(-PTRg>|>+&qCYOKFggvZ6`Bu@@mpRUhaXQ$!er{-+cl}r9gTL7CL5F`=hqZ;k74NzAwRQS@R&bbo5m7H;GZgRZZ@@(Lp(e@ylP@M2{nh(4~f{@@A1UbWj>tJn$;yeXi#jhzA zaQpgfQfuby@uI?ge`YCAK8EytEQV}?71P@4KrUKsefuH@p0m0_)-_h?H_HG17888I zAU&ar?J$r94-HNSqa89>gSH~alnRP1o1}t- ziHg4?#svuVYFM8i*#uD-S1la75O*OSGr>1?ecDnXng_Q;`%#J=Z3}~W%+^^dKd8kn z|AheA1YfEz-mLYc(FSCu?~M+&nD?V?GyBk)@e{nRR{K!ZZ#qV`EzxVFCelXVg+zsK zxoBH%zQx1CV}5uDzA>4!WT`e;qZPkSJX^QbC(e-sdh*alk5W)SmJDFAy znCTXU0t-{f(OmfSXFfY+eOf4Tjp#&SMf`X`L@Wp~jW0qbPXDpQy|^_kFVRLadlY&$ zU>(9VOs4k~(!R$DZD%(JGZa6zxpre!LPmq6{G=l(cN|a3e?FIxpQr-G$apRg4C`wL z<{r=nrG$Gjg=8_NjPkyDPrL)}!xUzG`YfSNk`uh&Xlcy;J|6ZRIYo`)_`;1rh62s# z>i%bsN^kFg5gNdgz1HvWN(ZCPD7dqMX7St>0tkf(9;YRY#bKT{eI)_w(oyYmFIg4H znay^vzz{#PfMe)8AhmF7bL0B7+@K3S##nH5uoM#(ARCHJSaD4(O>ybK^x>Cp7uhuj zi&NeeeJq2MD0TTj8=oBq7iChX>`slRY9& zbcY)S0;PVVJ_oaJ7E4?}4skLNWwO2^q2+C{?p7EuB#26uSids35*4Q%u~6h9xNJc? zN_$G3#MKU#(U2E>SBH_2F*$OyUE15VFe=(d67oc^%GxVfHlch|k8+h0-8CiWGKkPS z=BMPJ?x1a%t4_R}LAf8+KKCVCtgD>a3>m0X5U0E+^w~ySFsN*D_1Z~!-nz70p}I8w zfPI_-509lmF77eb()8T6gz=$gMyt&}YhjvJX(FGc>Hqz+kIL~AC&R6H96NSGZhP5F z!mUg=OH;%CI!jZ-{90>0Fl8wkraQQG2pRl(LK>39)L)!v6OkU6<9HX-r_Kt5C=N$q z!`jhCOJ+35`tXS(Gz$TO$eQZFSde8XPrA-?gv7Qv?(yz~v0`A|;h`?;uO$wSP{jI# zOY{6hO2xW$pDHL^Z)+r?B2(;pRZ!$fAMCJ}v(bAM0*+@o9QQ0Hm?DLx3|4h6PY<-G z<)_C}vZbkFNfneNBM}u!|=%r6?s=tzqhDAY1Bf z)K3UgS6)w??2=>0yJYq1W;uDH+tk;ps!BOAn!Bv86fnSpD+<~b1_iR=EKPZb97i2( zstR{{oR&aoU+7>03O`LKZELBvQkF0kxlk2}osoWEE^x|!_JTDc)|L1|WgBZ$rdcQS zW#IdbHe7Z;86$3JK zTTzQs+~P2(YObsAiuE>agQAwEpld8)mN+;OjJ)%U%z!cR!`iE$p6Ix?}k2!U^uvz0bQdB8A_MS@u5KbyGdD7w?yob zzGPz^QBi5+lKSdO*`%Gtw&rQM1i7h4I~4m3PH)in)|FZL9>3BI8l2ODk7?UROiWA~ zqVz<2msG1fGCrO%1nTPM8dJYIbCmU!0O~8g8FNL!XZ8y}q)aX`8EGrn^irjgB96!@BL})hul46v6)YgYc|R=F zCs$s^M)Bb@DVsK~k*3Ca*|~G096R2r%E_pl+mbfz13)32t2Oje!jJ<676IDc*+>o| z+18fZ>Bb%&3u#@bn@o4#P?MIcw7;a!A^JST6lFH4e=4;+&WCs_CdlUnZFc%|u@xw; z=VmZ$sSAvi$4j-Hdcnp(uGDvOjlPo&RTDBf*eB`Hk?^d-LEa&KA!1&#IW3!N0~6u* z%%(tIv`Me6+W;nR7)+Q*><))@navnm(F5xU|`q~rMtFol67laWp!J# zDp3g;8XTHBhw`wTtp2mh?|c!x4(rr2Z)tjZgEpN3u7!X;fqoM=RBl$t#VP}!2QmT8 zOmo+^Y$<_WeN5XA1{CHR6mB+Nh2BG(>p5ZX-hJ|xx4%c;^WI;VH^1%Y&9;Y!N8y-_ zd(0_T8;i_&!m_n9m)USub6Q%Gqtc*_Wc28`Q?bN!#0l$%2W-^%8&%OEI_QNhcIrEV z4?+zV7$^}ahWIyg*W|p^q*atqj_B~SZ^wDuF_Q3tT{ho2(o-~IFL)*Y{!H7Ki9_h5XuM(LXW#N3I^>tzB!44 ziDFYIcB>*d*M@#Jtgla)DSQN2x>w&9iXvn#->}HHS}-O?ha@#TAdeg$lB0uZRgTm8 zZu3{dl@5H;60its90JKDa=ee;{z0j&sg|0WN~4feRFsG7Ng3$rld=>0hLDoW~V!6m8 z^33%0%xIzA;283e4Xi==hJ4qBlB5oY1`|_+<&lV`5Wy=TelKhjGuwt~?+m^(Ncd#$ zG;xa6E`g|;HE*-EQA~s8{j96D&k2#tJ7JvB$tG@~nCIjfx!*u4Asut%uc;5kbi+Vi zC@;?qh>2AGOc-Pd*#ryI?JfEsB?B863fbgv_pm(OmC|xLt7*cD283y+mOaYx1zM&n z6U?*=D{dAh2$VZHDHWCF#`0v6nRkhc$~hVou!|_N*i``*0^qgJ}jyWQ?SOgV40xH zVLyyMjNXe5i)?b)>c9}GOJ&f{(?Nbl4b8I2&_a#Q<^xDk+#Wh|^e_MF6Y_T-`%C%c zCq5#d{P;)AwugsDZn*kcXg!Ucp6^D;ZMvP3A0Q-X%a?C@{{0U;WTxj6_$h7y*FXPS zdGQNhVAiwI*VQha9ldhywl>*ZpOm3A(cu{>51Uy1WgVr2(VdrWv6dlQndaM)FxI86 z(=SKDjsO7{vb0tO?oIVpF=RQrSxl5!EZz`+*Qvmd?=z+qL|>r|=#wzhA@4oORJhp{ zf^7U)Uja^^UDmLmz`7!OpDMj50iIAy$WN<2)6r0Isna|>)HywMo~5lSke>1U(QdhZ zw<?ixPG2x39}80m)6R}=IeD^MMn}h`rlv}j zkIX`K^k}=ZG&f3hwMtcrp`j5O(B#B{Fbc>ezfr*46{!95CQ#AXv z?omIf`)g`MHfa086kr6zXx{7exhTu{?t}Eoo}%xj=QEX%HgH?R%ws%GFHpXkwJxCe z(--d2zG1W0wKdwlW5MY9IkRX#Nnc6hZh|4%OPGKsCxnTIWR8~N-WhMdFSX~{MJ}_TEDQ00z z=tU^Aw2!oB96hAxx5>4uPmrdqHD$7` zdFdKw$`KAjpf-w5|ir+c(~^ds89^;)MG5bE#gmA%g#l2mF!nwzyEMld;< zma*}akyq;LwU8Oy^_%)r%0T?0?)HyaS7X#! z^dAN-vR!M?reMnQw6-suTJNZ@4)g~d+K$jCFu;*(8o$Ts1DYQCH~JOi5cBrEqr{t1wK{mmMXS7f%x*ZV#Uz>QB8yPJoLoYmgS^wC^{!LT&CzWv3Mlgo zJiKs|&C6_v5;Jan>X(1IZWhD0q_yptl(sz6^FQ?Gef6jd+?ug{+pRA)+u8Ws=l?~@%FATUn$=;-{6U^msg&G%-%n-Ls#a|)%QN~P@btdt z&kj91vV<6+ViDkSvk{2p3&*~W*UFK>G|`;o8S1Fa4k0q zIR-(rN*mjAn^mA$oiVX%%~c8c_x%a^@;*B{mJ54(r>!GdAc61I?SIvC?>>RjG5uT)C`cRX^gKQO zhbL?RCpr&~qod&6{D-Ew5xMB}{#;Xo!ZtYrJSP#!-MMk#zH=r19_xYV4mXMj-aYwn zdEr^t)s+>^x@PWBg>ZaSQX_+^kfFn&) z@0FDPfgu?h8dbr7K^Xg@Mn}g?ImN=%;o0Yo8oyyXcW#mm8&*qgZMBJV2dE2YH>ZsY zj%##*Xh5*fQ=FFs$PH_>KA#x2L>2j_?w!+;HVTT-w?mk+tlQ;U@qT!m0UDd0jkUE2 zX{(`4$$gB+=>u1$=(nhAtWy_UTK2NDF`Yp)wN_hy*R%Ny=04Q3%d}74RBQW(#YXo? zV5Xm6x*A`DVd4@3D{=a0-XZM{Q|+m?0KybYOaipIca3b}24wSr{Tv5j!S&s_&IN~2 zAa#A4DwfD5SgboBE78sv>wLY?L)~`ZB_ECsCFI8{ix9--@g4?(Ro*zBl-my_~eP6hyI8)pMu2TP$~ z`n(%}E*8kUYqtUU$wl^_Dj<(cs9b_oDKbhrHEw<_VVZw{{d55X9vB>4yG~_~fk8QV z=(tgkDk>}F_=&FYD2u_NVHq48k%o{k1;{01W8<=Z{VG|%u1#udDy3HI26fbxVcG|l zb5xJP-ASo|d{T5F(eH1!Wtlz$OK~i|qo96L&d1X>pjZ?f>FObE7XIPx)V5?#hfVW1 zeL;qr+oS|pEJK;U@+5XP4;#a{rv+nK0a>lbLh|!<2n&nXnu9b zif-H>vPN}{uFhUrr^>~6YC@`1G3oBCp6{;SueePa0pQ4GpzZbrg%#HLIGX zsj<$C_GH&xss?p{GL6*}!anttU>^)_EGDSOWT%j_$1#*w0<^fn9rDifRjf{#YKrBQ z1J6S_!tyLS7(~6s(v}l>P_upl2+Q^I8Hqqk!2HoJ*Z! zzz^asPKjP9AlJ-bopvNB@dSU`(UjSDooX;0m-eWlyv$f|xVDFO$654Jzp)H;MCW2) z`u&S}|4uf6Y#o`j)|pH@#@{FJ&XMDtBMEuBKPd;0O@!#?*f9gJK*7vIYJ527Pa!tn#@Eze}SmH-3rkw#})5tsICw0~2 zH_{HU4_OAiz*(C@STV>#o5FQD9Qg&^5errik3s=SN}a^ol>UO52u)fRpRanvZ2c-_ zkG_$9kN&aPR;Sb(+D{C2xN?K$^Lb&Mllj0AkKxbMw&7cJ9Se8X^I4i+cF9F@{q@(H zU(ngrEqDI#ZmF)Sk}rPw-(~k1yQcPK<0n7eBbzsGlqa5eT7LYK`=zn5QNHw*ugW=R z?Uuj&)IS<)(8r&AT7GcnU2@?C=V{tM$oc1;BX|DjZaua^T3bW&Uj^jr1A88lmgXjH zBNB3k-nS;SBz@@7CuRNG)pGR}7t8$*KBoCOUoJZTZ28uI|G@l$=MEl`m%Zdh*}ZG~ z)UtQq0rTtOu^4#h!0eW$Nf?j&bg(gbAi=dkH zfkZGz2_bkCLj4tM0@Hvy;RC?~gqwN6vC-qYN3k?x8sD^nOMb90!jj-e8VQN4*$B*Zk$xbOB>X!7xg!J|eN?Ti#cB&21+dC*VwN+w&uMI|mC6b&+_ThM>WQnblntg}E*5c$k5-CZB{z-97W_WbdP8N?iMTv*R-PI770Z9f0ApWBL)>0swGCpz;DTp0>4m9-!@^*~}(P zGobr8&NP4aG;G~>Td3#F0%Ln1dU=TN$v=tI}Qv3RB{e)yb z-NE-E@Lf%+UklkuLrfssp&YffHip|GTehr~*5*d7>lLbtB&D^baY|_dqhsSTp~p5i zMdqpJ0H1~Si#keQJ~Xj76I$n(lFUFB;Q1(97>V#))agEL!|7Y1)A&6+W&>pj{T{a&OzB7Gq@2x# znB*F?`OFkWKhN8j%>k6{QB~}3+L)HDTCO+f;$-vrfOg0JnxCodxsaxJ+3kJaQ%=P1mnqCl5dRxV-Y^FExbdlTSP) zz4H3kzDl-l+amk-Jtr4kc!BJB@DVw9=&)RO?bWjTj5Fl(U-+_o)<5_{Ez8xp|}Q7*82g5n;+3MCqZv zlswcWW_ly;7FaxCIt~2I;>WaZykFL?YBK&vnOaYyQ(j&sn>MX6)*Va%VH?Gxxv9ad zXFv-P)8bH0<^t-#1+6wnTE22PqUE15<%E{mKsF#muTtfoDe~^()Cqk0m1}LH4&1ht zKss9QwXHCL+VnVtt6YQ%`K1n9qBTrZT+o{7n~?U8Y1drF5UiT-g|^imr!Vj=hTlp0 zr?`Hm5OCgZ?R$z9B+3+LE!UKD>Wu4eJ@NzD0*lkNwSnogkxd{noNR(jKr4!T(u0M1 zeOk_Gwb8|4R+@Urd15!x0--f1T(#KjcwCU6|gEL$P;g)OF#C5 z?UPe-3GW3NHRjWtcA$I`{Ayj*gq+trX{OtkYvF*Ls8jib88E9>HLJW*CY@b&pY<-U}etU`=l7 zs_G(}YttqG-7P9V6R;Jzg}_x<@x_%_^2-1;`E}FvxesngoPTBq3`(rOY+EPS=y?|} z+*P8-X$abN`Xv@O&@fkU4F+_XK~u~&e;^geGrcx%r&Rxp!6!fSS-F4D!*aKd?vM_SQGbXaC_7@}Up@p|Ly#YuBzZBvTYvoVscMSd+f&#W%{C zo(%O^rpS~8mMNkZfQt>Lpu5Pp`LIp}7pBX(h84wt2>pc$K`0Y6%$KjS#3|cWB(dqy z%OLPTs9`rNtc=ha&^Qlp=&8);J4sNn60r?e3I`u(O2} z-MndyvDyHnZP~oeC?@^=)+t`pm#G65=Y6_=U|`6MxXuNX#dBLMnUkx|Q72IVh-?qp z&&YHxK$eb8STdMVX8bHuC;IgK4pmklJ+UZ<_+&~w*T!!td3f2@zywFh2lC6n2UBkG z$wUkh>QZ(cf}Ehvns!C^<*UCQ9{E7|jj48X2836!h*OmDwwi?TwYlHUjP)oG%=BOi zc0TaE>$QC%LjJS;HVyd#rHn@Q4Y?sIJ3zqT z1NQ9cS$+l#2sx|!IB@^&5vf!*~%i_q< z{Q2_mI2CZ#-E%?g^nCnv0-GLA&o>tjr{}NAJw1OR=;`W^&Mv0suQrvL1wu4w%x3K| zjv(bXZrve!+aXtap&B!s?y1Gu*u4yq55>Yysb|3v#j7Byz)R`$7HPux!txOfvf2=_c9Xeq~ zE3pL07%i9urW|TH=UXwwEPI*`*+KE9xnp`V5e zb&W{u3!SP@nJ?ErhX*Z@w^R}HqsTQqzf^!_=Ha2~0FhD9UO+U`l+bR_&OjjHlN~D_ zq7L&LjcQDz85i}Qt{m%p+=kStd}Dl%Y8$$)THDBV)^!kVUL0s&nJ!5)OrC~P)|X=T z6kgmt;AQ|9M{$58B9cG(W|}eALT1I9_K>!R+@I@a!)61g?CqJ<_ZG;6c5*ph+i4BTdtEXm=hqJ#nYyi|No9(v z3_Szz%b+f<$nd`oIT|NpBEKNh3=fSOi&JLO%mtK1W}+ZN$GMH*mg8CvYRUpRPvs6~ z+h<3#XV8IZ@H-m`}*fXVe29Mc-p7K|NxS0z(G+l!fS`T#LSw{^pqKI}r=IR;l;ajBV}-_p`7FS_|gdH!|R z$R!tDVD3$jyEnb@HFD+|JLRdp`{bIdFPH0{ceOn4nk&t*O-+S6D@F$#9vPJ%-gCe4 zU3%|N9@O8%^6J}OWZGKbrtL=;&T-TCJv@pHrstdfU;A?UE7k$BoBoxxRhiTCIfgED z)-KZ=7%pymu@JpS^q!@J%U4^gH2e@kwv=fDg9Yg|YtwS$db=;=oXvEZn>J=nu|e2C zL1DSDEp4LxL6V^CAbb<#3G33=@3fX14p=f=zacRG-DZ0&#^OVNQIt3jB_aD9Iue}W z=PCeLDUfgS89fzZs9!sa`#Y@lYc4q9jcL-1de4&OS;70EOELLb=*8v;e1xGG(ph@M zgZ>^j5Lc~AnE)8|szeZ2A(t&}32`=}ww*9R=2lSNWiqe4c09^Totc2*yMHI{xT-PZm+1G@i$gXpj zudzNKJv^2g)HSTOi(zp}vw_b_d__O&Ely{Jnf9xFE%FBzY-QS8;P9Ffw_k87T(-xrHE0#O2v#hT5KK-y*@ zALIgqs4M`V&42;mZ160rHSf8Q)`ojmleOw}vHE&8T_=UKL z1N*Q}#WHnpa5zkz8))NlS)3ZH?34}GcYjAx4h~M|)mWFRJjzsjWD{Z)P@WyAvuq!OQZP=v_(wDoIhlP0SFeBlVvg<@d9 zM#p!*Se<_9%U_jGf9A91cRp?rA&Dx=%jE-q@?rUxfBg@6!|Pt9df37Sim^6*{i|*< z)AQf{=2x4=1&RW0+J1E5cn^q_a2r2wB#gKik+LoW>MEKx%dwN)3w5m232R+CDjJ zO5lhZu3yMwL&ieBoEQ$IwNiz}9Ou~RxA8!+fN*`dD;Z0UKBI~(B-w00iMnJ}+H^Dv z0aKuf*zDeg#i%niyK#N=3Cx2$SyFob9!b#!84VpajdM7J$3({De& zLPT9a3C}Kr_+CW;p^Tz*MoDo9(?%_COv8s1&BOhk5}=e|!RN9_-6QV|xMY*79v({t ztd}58*VSlW6{gJ>OuMFD-rvdWi7?S47E#g@ViH#&OrvGn$tF8>+gOn%0u%h}f;RiT z;y{}TX^I?kt&vUaHL(gsK5^tI1m_05W374>H(n_nHl~!&vE_>Yz8qB1k&|B20Va2H$6+meF&XCMBJoG}cYC z$tLI@xC~;NelAP}gKD0?xtSRp(lQt|tN^A=X+4GzrQdgP3J{eT@PIJA65S(G7ncfH zhWCVnAOK5rTp2O@#>1l&Ky{~{VeE8)_I(Qh*P^ej)XwIA4u^?LfZzDl_sViCV~4fh5BE zHG^MUSl?F=p6MKuo>AwX!Xpm68my$5!XAtcNkyfNI9mu(s+8n=x82=+(%4u(=c)PG zz@meC5yh$+Tz`ZcS)gt(Ee^u86wsOFI-qMLFc#zxOCBDj1cl8~iL*Tp@_t^%jwLN4N0 zl*q`)1>9qIPv;!ig z0P5Y;fHUh_DG9>ktkFF@N(IRKwdD&B4uxJ%|2aIlxWs8b-3Vgyi=X?H@n6a>+YSp2 zyzSxP5s#ccO`~L=tGKTEGF5h`baqHvLU!K+lQey%6s319|f%JGHLRJhiG2MdVzF z&$&E@LtSOU+!r#-`AsXUsMKo}`DHT&++|S9{Zn1zGCGmY{hmCG#U=v$`ow_LS0$yf zq1H_CCTVwO>Y0S4|Z6kJ|77{Jw85?Njw?>sv=>mh`F|_ z>nH$_G-ql3$C9HIK#&)rAUpJ_GI;swK-R0iHlH@i!(%Z)-_fn@H9mKTwXB}mgjE2E zL3X~PwMv?cVH{<u1A+>I>&Mj=ejhmX@nVF-2HOF99Kj<*p-wYw-C39`!j}6*LgpgEo`3#Kgo!xAG zt`%xA8-*jHcQ;2YXNz18CPs%OH8Ny;n6iHV(P0%(Jz<&;D48g#Ox+yn=`w_=bM9RT zsQWZfxzN_uWFqX3k88!u!s9)*-u9-FvZpH{|8*!~e9y+=2|boUf^1+FL0verDQ%{s z_KxDWFOZjSwXQWv0gxpS0uJ~}zDnOWLK@1IhexTx&Je&irnO4ExUF!Xr%suGSc5oy z_%!ox3X$?qD4RStkO&7kwZbQo^6WrTzI!Ag-_m~lK=CI1oH8H}Kq~PJF5*4g4|nry z^9$H9sRf29|8osKgKUA@0^AwQC!ijEAPRU~5UygtDA1`fl}!fBFNEncUE?w|pOO!^30o5ldfv^*P&g7?L#7j2JRg z1qFVI9O;Nq7DJqdOOzyaiy=!R$7JraB&oS}#B$KwJtW48O_c8IPsmR?Legc-lBJB6 z(o{JsO{S(}L4cLla&5v0aC1cSuP<2kgbEl|YV#Gh8Konley-^a_(0_zkj-CxHZv## z7A|uoTOFL$2^Nh-E()fDf+S5(;$JhZ>%;P3M_Ps7w05iu|MFa-kgFUY4CI{Vv>_L= zeO#3)urkF`r$$mzQ>Asg0DoaonB(&(GFW+xjEtEP*KF);NSm@iS)NEIq)e~#SWi;E zejuUW&K?6GOxtyvGK8(_rgtBN$7S}ajdb50epnH@(*Ep=_(tw zzf|();Sq=Js)P`z1YeKz8q)5)_=#3p`@{-v^{Xvjmxzi;F<8NeqzMR3s|i2O!MIanS}yL#(-|zjDwRS z2`xKTHu;|;3Hi@wMfUcFI~BY`USk&jRS=Afqu&GB1|-U~Pb-p@X?kK@<&i;2r^X~m zr{$OmZ%=fLnZew7WOW804p{Pm{m94!{MxR4^x~o!(l&g+&XecS))3WzimpzVwPzDGHK*?L>J=0DC zWJb2j^_}w!$U2m5W_LBKY(hJ_)aV^cnEboEkLe%s`n>g}kv|WQIG{tG(`?<{tqxu2 z(Wl~4;`{>qosMapMhu@gDTd03iA2GwjV|gG}+=hSvGzf+`)x}wVn)R|WDJzE@ z35nD&9b%MqEJ))Pvrmu7yq=hAxv>8bDDHZ8F`8} zzfpO0o#vr9+T!HcupvyrQ@towRv|?YTqqzylbUn<+(sj~^A51uFY7m?1^?i7xYe)%l+*Mx%-5c9W7tkpsufKYm&hsReVyBf}~(z z1HlD?nexaKQ4|&2i#*w96=aquVTx76xy@<0YIWN91m)dd*k-3_LgesUY9z#2n%^rm zzvTIr&7LszC>Jf>psGPzGFVtqU0G%YG%MB%PXb4sz&8m?U)t_ z2-C^&QA3vYjRo>VPr|rn7@Y_fOqh~qi00a4U}pbdq3bZ9GGouEZtH)DX!=e3zFxda zpD~7zE=7=UqR+QhX}_Kz08}7Yg%*mT2}sU_JkXw2`6Nutf*J7DUuMEYLEp^#qU{2d zanjgIYuRfbOUk_`lV*UISuT7Frs0?A5zkwjHkPHxG{}v}+bpH{-Ww_dIbY>kg36fz z=Z(m)(}M>d9!mveglGB^a@UEZeC;`rdsM%0pgs~13d`-wA~B9kdUbB%6kW&8v<&3N z4XV58Vbo1@2&yNu-0q9q2h7!C)LWQ(c$79`eVU%poK%I!RbE;J`{Q7bw?tyJj$4w` zF4^1DBRkV zpxikk^0KX=g=CnvT!0eRHI^AHVIjb(5Ji@e?p&|(BHijDI7x_x2IM z!S0_6=+F@I5$I7AtE#K>e&<4gh3UTDN!iz*G}EN8!lgV!iuJq!A&P~@HR}T7&u^7> z$V}ZD)pUpfNYXQ#Z8>C0A%58Cgb~)=l&4Y#a|R4>n{le^>#6W*il0*Y2&}buUM$q&T#7g_ z7>N%}{2DJebc`gVUHigf^s^A{kWLIZZc#ZS4p_y}PXO9a2G)3g%$VW*LEz%cKH85I z3dmAq2CVBgHI_@Vycn#Je*eh{IWagXPxdB_4?gM(7RJQ@1C*oMNp5Y>vZno^@lUVm zNAw-EYM+YCLa;9OpP_YelfEOKk31k#mNL*u__oxgv+74BH995@jkN{UTgr%e-xyT{ z6%tfdOHV3km)%2LKuGtqox%5qL*g3Qc&FIA$NXGEsQ(vF!r#^SC-^XhSW0ssH#nhcUL$b|KCv}{rj+0LHvLS5ZA zkj&r&TzkU6%gvj#UDUprnP{{xE*Rn#ruVCCLVp~+Pm~0Wu17&KmZpwZF^kF@@G;(} zsfWknV7@+06CA+TEmU0yg>l&M-rWT98P!gCU zxc5*S=H7ugVc<}6RMQ7 zkJxKC@SY$x83Ddd%U3jj!qDJ|nF6K+bMPkq8eA0V%~aX|0N;&2>{z0fZ^U#AT}kIj5!c>gc%2Mm;?P zQd3Q;FTcMzAY2@|qF zS>v9N{0{U9DAYUgWm=gqzTYE7a!%+OW!h$1E?u3FbJtc$S%nIX^F+I9`UkW_8`lh` z^dlE*5H|{B5S}0Tqbg|$(v8|TB70ExAi&~4{e4E?QI$0(j3Zii*VNcLNIgb}y);sfY4e^@IfgckKGhJU;Xc4MXisq6#mpJU zi^L&&AH0dfG@mj}jsnP7xD~^(ghc7&gymz#$H(Q&^DZ>Ud3bmf5C8as$E=Icib^|s z9=A#=j2aSE|6R~9EHyPXQdwDP_L*7odR|V_6u1gc-8RRhndXvK;h;>~)^0F2C zZYkn~e$RTQscaNE`s@MOv~jfwv`|Q!fO`z*$194%16Z#I#%GSQy$zY_JnU>`|G+s>y&5Q)4e`3uIe3E&u3n!pwX?A&F~m zIfsEt{0l=&lv+JK)ubr|-oc^FXznOKr^n~>rHD*&Ad5Jq+;JWjNAs~Vb>Q1Ds0^Wf)kYPvE42eFpf8NW zf!>rn-8rVu89wMDf?FU{F%|rxRW<^2KJdPHf4Gn+Mesb#NNTQ3%N46spXu*6?akUX zt@eOCAP^Y@XIwdCK&QDPEjOsVQqLa%NK?4|OMu;EPq}i#G>m zqrFZkzToiGMKy z62=|t03m}fMSLfo*&HU82u?L=%0LhAmWbQqX-niFi($dbG{EI(UFraF3F(Fc+dm!{ z1@^3#z>smce8>g*o!&9rG>DwjYTZMz#7(oz1xPIJjqF!!U~P&UhfCKaNrU5kqkDjv!)JRb`Tm3FK znaRSSELNKMt&MY81F#5U7rx}2Y%-8a$d8UEY0Jw1F!C5cQD$l?j5$*fcEQ2yU0F9rf_=m>u*bkEm>L_lbo0 zH39!(Kz$>iBr_Dhcf{%g%$S)C^cU;vlG2w-%ALo;#0a=Q#v9D;M~1=G5nAFOPWis$7yFKvq_ zPE90o{k^{>>e`(I$@$D7cz~`5T|;NC~;a$Jlv_mzDmdha+)h~+NC{Q zoTcMpf%m+oHX%Q0Psq0qN^F$)C>SN>m{OFZQA!}rnR-h(YG|mH!NHNK0gu^$wQY8h zfG|ZlxqOZF8I+9;>sLuvcb|-@0u%=XAy;QnxcRpCog|=2+C;Ivur-j|wpv#L5UCy> z9`gfz01HYnyDEdN`whyTwX$IV)?pksIYJqdmpU3sQ zs9b`988Il14~ujR2gYLG!^2}`B35jyREgF2e+masorQ=qDPJr^uOGb)Wavy%b@qnt zbi>oV+K9IkC3d>gfZ$5Rd@`&?nZ}$AUhBqszJEgcRA6N40%<78l#6mzgui{zPOX~_ zC^=C=tC%>fWfKCgtP($$bJKpturgi5a-0p`AJOueLViKpG*O=ormmw1cIx*#m85Q= zKp8|RAOby+WKW#vkV8jKN^MP*lot@r`k*SfM5m2D8-yuklxV&9ri)XSD=RCE)krQ& z)7?#J6LGqNvKF4tph2}}iQpha$!9Qxh?k`tCEvrNltDyih=V*_X$ByrjH00xb1noG z$5KxjoTLA73)?l?|ImIEGULIcG|)9_t$*m-uu_a#)ord96TKZA(|ttMZ_+YW8$%9L zF0c}UB<<9G1i#p{^T-$w^bn`tIw10FUwA?eKwLqZZqV{vOpp((20@~Xh^sLVQDUIK zMV4cbo2jR9KyG=w$3~S$CM@n-D-Iw`@y*&)8AxT2lJ@p)IdZgJMn}g@1l-wx1ucGd zqu`o#IS5mS+L~&qsjf1?D&x>r9muZ6z?KaycLa;#{WvkZA2JEpO9v&+X)bkmjLD|xnl*hx7d)E*d zqH+#o)84)N%u+D)+Kvo$_l!dvi8>orI?4KA7tKYB?rCU{y4CVKS z^f;%yFjei+RWqlmaV)PZ`%9BX;02UmV{sZooIccJoBrkm(x<^PW)n0Llo#k?{3NCtQkzDK88^g+zJXLa>O*Nke23 zplRK@HYu;j!32lELIodv#y4M>2Jyk*%ysJnqdey$G|hlYxSkD2Xvon^R;8t-lIeL? z8RU4%GD41rhsVMI*|e)MEvu`;gaQHCRjfMb`lkCkM4nsWQ}kB?@DoY2b*z94$r;K9 z40y6IC7f@{aacQY>`&ThzXRD;Z~d@GK_9{Q&+a2hhd70qdaNfQPxXX56vib$))Y*x zn|NT#rXJqLgf=&W018{oJJ10 zi7#Y)mY>riGCVRSsnn!w+q&KasGKcoKIH=|_Nbp*LztH3CrrV_gbj|%RQ)(m#+dDb z>#v-Z=8y$8_E=wb zktw)^Sm+%;enS4w2mVY31_#Z;I%%_kYZIa0VVXeAY}w)n(3MV#<^zN&Q>U1skd3vq z3HkBKgxr2ej32t5Pr1IXtO~|l{XEh+a0gSy?vWe0dXj$zUPa2m85ZEWRuJKJ!1eYdvvx7iZSFZ_7bX`c0-o62; zud9*T+G?q&unv^-p=&IYFy&bx^q;qG`kJ{gp$bq%WrYejx$lAUjdF8#bJ|?>E~e7#&^fC8r7=95 z+r^2ZKHx@DPa$}3d>;JrjinQEc-YD%kM}00zTZOX>|z3PlUY1i4l^y*OrIT3nFZMd zf9v^>i!dD=w=+~`vjF8jBco#`NJK6m+i)Fx>0ZAfEtmM|yB;1z2iB$pfSWI%HpW7| zbv~f)n$(8Uxi$3g@K||>Reu;2ed*>v+9JWKAw>!yCLu>Z{h80oul?%#WW)M(W?`MQ zLWonnOWymO&g5t=pdjSZEgNEbr3YnJwL{DaPdxR6F`Cp~iBvO7p!W5M00Zol{(%#WCtA8?-rUuoMn2tZ& zbv-;h=8kO*bGJ5ifGjhXR@w$Yh!twNMr3l@jLo%yyjW$E^V%#y=25!9#Sb$H;y$tK z2dh+8NClY#YNWHyx%88B1;vX%Vf({r`fXJN1q`&GO-PVP%A?)Z|EZBp>>))1{%5gx z9UeMc^=pb%X_J-@KNa7@qxhih!kxx^+jQDL zqZey?fZMP_K|j^6?a(!A(sIMb!1x~b@bFlfh@}+>KEM=cM^HNB(n1JJN0>G=)XVzy z>&(KsBTi>SzI(DBmxtN%HQWAT0DoHdciL&z|M^@(?mJ!DFlXZc8G*|cy?(y0 z2E}H5eL`+Ol8}3jYsaA-4Zg8q_KX`tD~bKoF+wqnXMV)BNE(+ElnGgxIA1wzf1H|6#{Z zbS)^bgNKL5!eFgU=dYX?=*hEL`azW9r;q?DtE&UKxGj*KP1Zj#dGIIvX{uCzPpV_<+JuKCTTQiWZwQ<-YjO zn(fm>UmfJtu|exwX`ye_k)y+DA_ykrdq=F#J4V#qbabppW-mE&2lwW=?>smvBdOW% z@W_c#X&;(YC228ov$8-Lan_|bZNgXBOmef3_5fe4*@P)zWHwi%{9Gt6FEhTwux!n4 z3!c*Z;3pOr6&@ZQ7EG;uygMP?S_exJ`MPw-EUfOf)CF>3Yg#T{9mtL*+wOa0f~n_B zr=|_u*Bd4(2)g%JPtr_%$8r$a1mB`q5H2Q8s4N5_$^GU+O7?5sx>XTf=wP#(rcdC? zV4-<<7+K1i++EgHypugq5!S zp``HZVYlpNiP<#-s7Hh%X29s^y3_F+&9F4>tTI7qWwxC zes$?z=zo}v!mJm{tn+n>EU;LjBlpGH^qKAnd8#wKVIGW41S)S?xz{5%`2JX!HfdXM z@v6Yc5c9#vq$Tv@$|mI{PR`ATfq`Ke85xsxYg;qO+K~x6c<>a#w0b;o>fwR=3j)s3 zH~qL>>)`@r6ZBMcVJDX$_Z(CCXEDLpR#h^PE7n+R^rZ^qHZU+Kdmen)EVw>&>!f3> z=F&YpJc@@{(Gw!l5uA>cyWd&K0_ktA*r0imnr4CpfAxQtQ z0Bh6jEtRTtpMp#+a}dA_{jIgYsq?u&-EfhT}gie57t!#Q!Wc235O?b03QaCaB+a&$KB1=wE_MAVgZGfwtqfFu2JQNW?eEy zY9k;SOF%4qkj0Qm&d}%L*>*GpIjxZC8z3_2{!f(%UM0qS#{^SPC~+ zsw}#C_5e-!fV>dr3ZHLKt{-DAO`93a9UPYGs!D07&upwvq0Hx3d8J161!kfxXHci- zyLfmorTvKZ4Fg(_S=vXeQO11W$kIntK0(%Ta!E99$6|m16?`6VtaEMr(qZp2`{e1T z_sQ44`QP&OZ{2Qw*(UuPx^4F9uZM?6@sN`iftbi9P7A@$z5DI*(ZBk*8SP+{gN5~v z{?#YUzCz*dnTs%83he7o8j=nmpu^Ll;9_iHrn#QmBNII;5a6$HHs!KBPqbJ- zwESGgGXz684yii3K51~`M3>an)yk2{dilYzvW(H`t@UX$(#zLhU2CH*&(%`oRD--u zE&3H}4$_WJ2r0dA!u3LcZZbGHBJG1I=`3qDmTnJ4tV#L)$koVFkg>GU zPxXX5OBB49j79&rW#-Ppm*{oEq^ZSY05csfO`_Z0ohGz^(x|nS|<&`$*qE&W#sqyqP`{nrYlV+V?w!yJuC#KeO z;k)0vQ{Mir_nPI?|L}Pk9vKPu6b`QO*yB%zTOJ-OA9+Mn8lTM8hwa%2OaebS;`G?@ z6J}xk=idD`vo9awuAl3Ev*iO6a!fv8>d*B1yHD64Pc+gQoxE-w9}MK?O@XYh<$huM zB7*5YkebC7HllfF^lx-B-dY4@Wj5mURH8~1LHyYK@X)AH5Od+#u2D%Lb$jFmudon; zWb@{=(vc^cJ;GD2>y(Ao9EE%hl#-FrF*zxX(w(X>Q&8_bo{&3^T1!=Y*P)zHd<`+K zzoqn*$;;HDe^@dS7YkYU$yQc8mLDK8>5o_r3?`&!oN332jA_RlgS!eqKhazjWcd6m z1PApRhlgyClv7ETIxql6?=#!L&FKnAQZps7!!F1KD3j4o#lR94rpD)5vuzs}8R^ASYQMr#97E;&eWP1d9Pf?geS-8Oc`bGeO(D6!mPmp^(p7Sy3UCl@&6o zGDDnfg4+mu{pQ3R%1(d(kR0tEk>Tn#=}eWI0oy~`Zte+*(-v)e@yQJErAt(Qtm{ez zBUJ>0!rlE?A`Z9j6!!`(?^5W#>Q`tqScF)o7WpPueZ8se01jVi_f z*<5@Fa}5F?V>E=NYW`MraX{YbUlwBNUMy@_zfLx;Un`ega^cj%HtCmMdePLrTo@i6 zmS6d$_sBo}{l{hV#`SW?9e3&T1#;-n5i_-aWW@S9I zm$Al%IvLOoaspGf7+57C+{glf9MItlAw`ZJ?~tL21{qFP3wJUKvPvxkKe_8T*Rsk9 zN;7$0>MzXw%|c$LHo_$a*@qNsiACf9mp_-}QTiC3u>BB$4zT9qyFrFgkNB1lrjVUe zQ|C2(d*j@uz;O)}|HYhsKO2Z#iz}7Kx|!}BCKdtoolNH=VA6B_Vd63bQZCcTUMBEMc-o=>j)ExQs(CL0@)8 zJ$68ge%uBmq|GLs{RI4*i~a~<$~~5fEOnrdsa9nJqm5z$BNGBm-`}q9sw+&K1sJ3q z)#axTJS6w;dD#52P5J}jI_Y!4_rCu_`SySPk0Cif{LzoeiIeT}PoMpwR905X9Y4HB ze*BZ4%7YI*B47B@ziRt8B;Wu3o#B}l?HwKR(ZBgSLzw>Er~gSl_ql&D#OSC0;d93N z^`F1^6=`X1l7IfvzsbJ+&&hxP_jl#XU;e5gUjOtj{#uS4jhH5Tc$6RtZnhjLm%q-ddpX)%aZrhi@17RcHfRZcZ)_b;p_9or>b@5C>~&6EZYDDGwYQmHQ44%YQyKBz*%zDtM)3Vr;}jV)mFF zkQId}z9=VHb>ymNI~vl4IE@3mc4gV@mSjhcv`bTCoos8Xm8wWoH3XN|YHMMKuz`iq zMXhNw3VQ8Y>$mSzfmdY~{ga`HWFfjMx){XmSjZAt&0c08+~Jj!(uT7j&Hgr2KYT$R zA4z5qrnuQSy9rA}YlT+`oQ3I95~hIuhvy>t^n9m!$ARnZ@555lTDkzNVw~0Hcb5s7 zN`JSdE-e?gGBw@yy|k&cf1B$9xqf|GZrd8jg>9!UNCj4Q5V)rTD9|i%pl{e(Z+*)n zn=o~MDN&*MsnWjg#9&J9J3J!y92%C}_YKRV?Uwb$g$9wBJ&Fec)@lnPm61sH4p@n; z(=xG5%Sblp|IDegU~+QO5T^LoUDMi-VJ(OC96p7yu6weZ0V`V$uU(gxmuwE?oYwHb zQv{yU_3gPj_vo(ZVi31up-W^ndzpc7hnG!C6X?Xx4O%~?*`Tfw-=eM}VJuP2_tQTF zzGL9xn!@a;jQ`TTebc1tQUbYz=OVyjv4D&NsobU4JU*=bSA$I_CIspEaMtc!vSGt| zv(7Kuc75H{dOrN$KmDk@?v3v>gzGieTq#fOeMVk>+bwea^RJcFZLQML(J8mS^hNUI zlTXXOefxF0OZMz}SYH0Jm&nyuT`sr0_~!6R)7YfQdD%V|iwcL2ab=nqJ zNONWC4-Mdz$TCO-xKkO?9P|<#0lW zvVLw$+C+8E#@bq3OeBn3g*Xrqf6wuhJkuxgll}%tNtv;(itwh|3EL58nj;itra}_& ze_LbWB+-1~-j8Vt-I9gquBqMGiMnu&%%p|<3$KxR!RaNk8cE7TxFeb`kEI3m0n6%K zWG2>2_}7jSrp%H!s|Cv^n-&HBP$3E-3IF?$wdOpi_b3IzGzx;XN z6c4G?q)e#HSAmca11#K-OR@)Tkzs4J&M_lA_MK)o{*a(*pIg%~HL@%3^ z4v-hRM&n(%QJ)wzVlm%K|3H9(8#m%Q$gW3$`wXV}-y8Zvg_M1!fBu1wOC6}HPhq92 zGRUwBao4W1KASNH+1HoI+c)e!W0#z9#!k8I))&dkZ+)@(Wt;Tdbenb3^Wpb?=hx(u zpZJJWRaHumPD@!LDP!Z~W?+c##T5Q8edVk2;uqZ{ue|N0=A8P*hN&s}>@O5gJ-t`% zxbtp#-K$?NH^1O|lg3QNkzwnzWO#H`l5;T1^YB;-l>NaU{NW!lB_4}BMrbD{Qc_oK zdv-TfKKct;($LhR4PutWu|Q0!Pq6Z4BqJ6F(%b0d^5M%MCSV4TK1QBs{6iVD-r@h5g-IFMm@({P_h zZlL%=B%IZpKg#mZ(5M;QAewzH;uJEIfKUhq(Ra_`D8BeR!ipP<(dPz|CWr`@UkG7C zlSxTeRLf*pr6F{-H}VZFsl&hl{`wHWc56NzIpF-8E*7SqA*LY3B+W>i-i$puKcc71 z`5C8A$T&6TINxHlC^VVwKh{UeLif%PiW{#meWSW;*iXC?)}vYZ9$3y7~c1*=d%n9_!{>${=N*x87+ncc^`z)BL( zcJK;P`mXx5Ps8ftg|!Pu0A6R;X84ug?#!s-VbsK?O!3YL>2@1 z*X`A1u>sLV`G$nrP!}fV0eK>Cr36Sj>MTCkncA9<0QQ&$M8c>FD2 z1~V3kEf=kVi%}U)8xk~Q*(LKgTDaWr_y~-T(5C8Pf^6`B8zod^p{*+vG<>j*f+2_plTUwgskw+hw3(h}RZvXBN~S`Ej4c2W|gvhpz;4{M>40_IihGnz{izY$_>gdN(N+T+%ZJLKdHjQEn5OZ;zERT z+=NOn2r&p>r^2!{E^{-IA_>#0F()eW$Wlc`?oVTPWbDp5HulsoF?OFv(eZSz3g-p- zv4${3k->cogySFsYK95tj&YAu4y?~9v*d}q(>7q8McwZi3uISg zFg1Ox5E#OA$PyYI+K%9+g=v9}m6im-!jyg4;NHA)mk<4sWH2GaqvNu@J}uQFJyKs+ zD{I!YnBxJmNqKphG&O~0tfvv49bn*#x3u`^9#Pq_A&^Vggb8^7S&nre-!dDNHPV-Y zXm;(tmrV*szseEg`q3^~C2~e{n3#p}@sxD;^c$IE?V9{^;TfQPLfhADP%db9AUqlP zWnKTz0D&lLl4-e0+Y@A4j2a+7&TI}$nS$J1Y?xvcSGW~3lEZ}Q^xP-r*i%%PH=nco z+Z|K8vyRJmTF!kQMFV8#)4fUQwg!i@0=;54DL|w}+cc$+x zkq_$f0vEzM`p0V3KgctKu@m}0*Kc5J8jeE&jzG2NBdZ0fH`^I^#Nrqjn~;}pP0O&p ztS7qC(l?TlQEkuO`GWJ!dD(bi&qMOeGyCPKz58YT`n4u{{#mgK zdC$Aw9-dKp_}IrkE!SLggtV|z2+9#E&aEt_HQeR&y>6&`E zf3!{7J9=eoTw5ds)~EQXL?{{>ni+=D<#DO;a97e0oIh!2nn6N-dNS-F7Kk|IZZY6K z?Nw{7Rm5yCqxLyoJ$cr?z!bKn_&Oz0B$f>j_Vc|mMuP9$KPc()DygcScEBgFpFCWF_mt% z6yXNP*;V^*Y6pMWm$gK}X6&MW@-A`b=n_TTc^0g=+=e-}Np^{>hMN{)g1MGW@hAXT zPoros6+Rlo24AK06>ee5{81Zd)W8f96!4-^I*S1g_xuZurWKd<2zWyQU=_xRSrx=jL$R+BGE4gpkVXO3bo)fpDz54*n91TCX|hy!gDi0fW5IgtqJQ!(ap#1KgW1+U z*^31$F30-MZcZ)H%?z+F-0x8sXipjN+7}64j?A#PZ(26FUzZnV2h?BTHh#9EsE z+u<5{=@yYqb!qwD5s@1=*s1%IDmkPkQhHoU8;ztiG`AXy)A^E>kflev2juZ1y{bs2 zrL4R{%5_Pq)PiN{_+(Q02Zm(b*m2pus!o^&yn0o$$;-a|N92O@cIk1`_bvs}6s5!k z>|i7c5@;l4{h&U7!@{f@esm&fl;c_2(goxAU?6oW5WaM4;mXO~C*!AS9Mx+*e_bHW zRVvW-l$Ostk9ZvF59H-BmZnejCXBzYqx<&D^Uqo>Yg+5%>As{PGunso`5Q=6WEw5j zM<^!wrXM0S431;fY^M}sQARC3cJzcatKw5uSuL$K__4FcFE&iwim6~3Ns$e^nt8&s z;GcP2?uI&NmOX%nWBXS;?b#-^XfU`joTyc3FP_pnByE@1WP`T+(F zqHW^Ip+K%!6UeS6O9Y_Ipj_lD6WjyqJA8GX-6C>eFlnZi&$S$tIv9NG8VzJk4bxw3 zq;&iQ=E5_o^zj|sd*IzuP8ZS#1L`+Q;8=f;Y_FY=hQzp3RFuoAwk8u*dw672nwuM> zzAjJZPBBglTNeeCH{J)bi5bY%hru##$1KwfXTzzmH08Z_>-S$@W35c{xsP$ce=h`i zb|1vE8{fZ;b`}iQs9A@2lo;@DNZ>5K8DymcG6~aM+xy35xUW}sx0cJc^)04Mc8@{| zrDa=#$hi^S94k}gnS9@zIzrGItjVY&01K4+Sn+VdnJ}K#m3F9hpB9+_H)WgGL z{+O?&X)I}aUvHhU=BiExa#WSCjVh$JR!vIha3IGACnPzUl55s#rPd0KBi{!)6Edt) zDbXZN%NxQq5*cKsuA7V{RCCefGBRC`-vG^2h4m3;d3Sq?E}mXEm7M zGoZ7pSGv3V<&0gM&GkxxFzrstqg{clQbFo6?I2K+c>|Ec07Y*h*}Usy(kj@zW}8%W zK=K|M2;|l+f${qm;iU5d>lG}hqCzN2?y;dj-n1()ekbo~Pnz$!Sb6s-4i4-0Kd&W_ z^V_CLa}*4$HpYjCrM;_Pc5Q5t%IYff&H2WBRHDPSghVUTirYu6vYPLE537KIFm~N~ z8=S?taCqX$=VZ&4b*GegF!{{NY{q7|VSh3Yj5K>wh&$II=J09c-5G;Cb#%tANJ89c zGux*E6_hYxM*3+8tVi*IhXu!6KPA)U@z+>z66vCHdJW3Z3-H@gmYOz|gX}#LsL5gFU zHP+uJJ$*w`zj}?VYbZCC#JC2kDNBbgIqdNaq%e5Ek`J6;TNaoAlg@`K`i`+K*K)Xe zb%BMj2rxxAt8Qg%MmFqfWO8v>#-a{mIjs((HnJ)8&L14NPQTmq z^Fh8g={q3k&wM&;j{?EF*RlbrP$=P@4T2h=VDtSczm70PK%#C=R@O*oO6#uPfO5$9 z#5xYEFYbwj$8kMA+qx$X9FPCS-Az_`cWCeEG1giHTUl(F;+Rz?Gd6W&dONa~bq+8| zS?Mzl3lm~aFDj-!e^xn|Q7poQ?DWj`%5F?0(4g0*gAz5sE6-{AV=VDUwb$VJU_cKO{ec z!hwDd6v4#+eHw~5&*1`j%?9L0h;`a(>IxvJOWEjT~Y=kM>9*YM^7Y5Qn zp>kyu)O&*0VIfSJh3v*^u2<_m-!-ZF#00@3lNI`1t*<}=GF{ZBWhS%;CGZn2JEGS8 zxqxhgm0YK`E4Wsn%#DquWOQs?YPDXMifl6d6WODy8OJH6w!@X|{Ra8=6%iRVEvwqa z?aMmEZf6}hwHZmzK97VMX{Q0`AF=YxHf)&-sDE^2$R@})`L07d&Fr(rN(>@wU1b21 zdbAS3d*S^!xlPq1)7A~>f;`5|AKZ3q3WFEY{xG<0-l0}D0MkG$zg$q5PRejGx}+^1 z!;&iyl!u4M{E;09YHU(vcSD?5gUwulpz?|?hPdP?#rTwOHN9B9y$Bb4a!^|WV;TT9#$kdAP95M{~>h2XKKv_?gmq|@kxjF8kuB1Gu%fmh8@~o_uhYt3Y#K_f# zx*8|08y9;l=6%US=2R0m>OsUQeR!6LQ}$6 zSY5F?EjQ?Q-dsOD?G@z{1*s6AJYmgx-@y^-3(eyY6l!a#Oq;Nn;E_z57Afabo8gL) zW2RCOXu>o$Lzq1-jbE1*rkk|r67DmIrWbRum$r*b3lp;UyOn4<$T%DycnRKQwN!n5BbG3Rjf!(mv$jjiTuhWzs9dAV zgo;uJhHQKJXn&L~I0OSo<4(n?J8PWQ&raF)d+or7t!CHMsSTK4l9vDc+?bCK`v*ruRF9sXO zN0P>B4xfTf{!d`EQBh?q%*(YEyr_-Aq)eAV99pQpfGkVdIo6+&AqtLS+{~_@V;8o=C2pTdV+qrM zSr5}KX38d6s}{Q9u64QqqVgHlGqJ`#70=E4g*2_Nz-UJGLai!hutV>Ex_~YaF_7ox zotGz>y~iG_qdnD|j33M`lsNG4@F*Gxo5TPqGVE-~%}T^n-cfA;l41JOedY3KPnmJH zPOyqp+FFPv5nNzq;}+d#j!9T1mwOmel&Sg(_C*QPDTHY#hBUn0WBev$EKwny<*jnE zy;~dVQ_&sdMuT<`>+9y$=FxBxbnCwlCFG8yb|k(K)akwEaGN;;(hO^k?;V}HMeCWW zm@!3xDI9BJruUz#LhPyXPkA~5A_ejq3#^3yZAwA*rdU7JL{l2FROfE+Uzn+6-6h&s3@vwC$>a+2hjq zb!oboZMV2IexvDb$+vGlOL)DEJVY0}YiipZ=hAd>EACi_spAc1Dk$O4G)N26PX|Dl z;=gyX2~!5L2FLZ?Yb9fF>TGRKse^#PBv?D1j+oH*vAfy2_~1J*Wp_yXE@n*(F0!)b ztlm(DjBKJyuhhtazO-}>=*AL)z8vBQ0?3tocD~i z=v=@%*jkS-%(PsPMVJEW4ew_$<*L&e^aWU8LEwx`&i^eV5>TcQOYt3;J+RL=q&|-6 z4#*m2csVej)Hz!Cy>UZUG1M*9L!C0()1k6Srwk2^%IN60F&bG6@HnQQjXYPzX1HO0 zrZ=MfbC^1nW)`zY5lssd`H7~@*vAq{pZ8*}Xn(W!xt(S;n#Ou0-E2qFz|`>uGi8&k zRSVt7*j}Mv0O8qwJGije&x_p8*g{1jkZacka>E8|K;$s}jZPo%%(QzL3n3#sp*sKL z1bU+F(samW5X*abczB!=bc`S`1ZKw3Y?!s@r!pIYQ^7Qqmu?ezq&p!ehbN740O^NM z!b{pF?NRw!#&BQQrA;*y>2%m~fH2M6HAh3@(jjV6waxPQfzD;uAY;XMQr{;;Den+J zW6mP85YPb6;qW;Fiw>q}&&AplFuIuIvl+nTFP0_BX%GEYbkO)BWm?+!guZJ{E7t3# zth##EpvnkD(R?hq5Ux6g1LMCD1P!e+q4jw6+EvEK$g>BI$?)*vI3hIJ51#?BI<=`Q zc6&ON=Z&^4W>2^~{IN%}?H0C4il&8${A8zR>~l+)KI@Wo9)EHj1LD$S({$mFOLK6? zS!5|F;m_1=pc@(6D-ez_o$r+Vxd0LntGP>71+u*{lL(_v*wL7lbv1MAOO`umPgwd> z3E8U(B0el3NV>Ft-BcTx_jRgYM`Kk|(p7bGawxrMZP{W0!W18$C$;}aHeqUKp=eRT zlV!2-+yM11+$azbqYUunvbMF>rs0N1Q2|+sA3p|Q8CYs4*E(6mV&eKGNcBo>{Nm)+ z5mkr?s+SL(=ZqH;WqPri2B~Olk=3hPq(U!FECqtS5fr!BFj>yZ_tYjUy4as^gTG;# zSq~TfMAN6XBWY9HB!r1(HInZ3nRT~6$8oVs);au%J1*Q6pT;t^GMzSKn_srwhNfo7 zCSm&2ZlD{}$FEF`rxPad68+<1g6lJw%S*+IAN?a5NR}B07i&63HK!A3@9?!=Tb?jv zX@`me46G7tIi)+#Yt8XK@+r|C9v(%-xOV(kueF2z{iA`@K%C^j|Igl^2T7h}`F+@n zh`jI2%BrlptB>lgzI(c7re|j7TFlJuEM|5WmnZ;cfIt&K83ChA5NSpkji8Aj{sE09 z$ta4F(Eu(4Kscyfa#bN~78_w%10?>&G1ys1so(MtU?JVMGF3mev^f;e)dlg`CVNN(ihY5$%KzFm{zE6Zd0x~pxnf&+qwGnJ$FAo9SUTcP;#mb8R zZUwUYustBaS?8)n`?|OS4;NH!B!jUZnf_2PFoUV!XZ$cO1&50O|7B5Wl;q}xRxPLOy~3E zJP+iuZH@~XiSjJE6+RD5kvZ5&pWiBv@Qq2E#*i4#(2a3H{WUCgx#v)q1PHMScb~)M z_fcSqR>Hg(lSli^j^z$b%R`$w7IOkxShs6F4+Q8X8HW&rb!t3Ghf`2B^UxHuISn%J z_gsTUT)Em}3$t@J*tTK)z0uI>eE^tO;qVH!a~|ue+LIdhp;vYSv`K{5*p6i0fwtLe z0Y3Yb_|83=8ra>lR{;G*x%;+F_a4xA<3N~?9ty%~><-f|X4O{i2I$uuv|3U}PjeCD z6b_S{T`gM0TCA_5WG{?}F6nHuuFeiC>cK0ORi{(- z0{nRz9x98*K=5jjEM4H?2Hd8&U^|)y*cR6ewo7dCS(|2W_W5sv^I&5fP#}limNo&l z&ih~h3y0V-eLoI`WFdrggiju>)@hd}fX)vKyyAJqA3U&-Ye?`-qvCa#SNhrmjhKYj z32B z3`FQ&!oIfYdjo9EN7EOE9Rh`w-o2=2G(wr!`EE(DpLWi(b(1!nzz@N>O?x5zLu#`x z9Sp0_A0OGUUp^7G)3vm=_yJHoJ)O3^eD@k13<*9i_98UrCI{t^$tknBGZA94A( zM{{v^DV}ioc!Pt8!sWx;;qq>~^i+OR*W?+2JgzYg%JI24kkSLxYj#Ah1`+q50EYbE zk1hEL5SX$Z|JZE=MFsH{o16CYVJP2=R#JKjHw#HsZF5M_gSz=jv#Nm@nb*cja__ zGyLuDlgH&9P>0LKi9|1iW89-L9)MbexAb7d)Sy1^{SOFC-->X#^+ZKr5f zC@)v4Xqc|Aui5JAnw85-_S&L25W$9Kvzv=m`|RO$dv^|PjjFA$t=UIT^t!NfFX6^a z*?xF+KG;3gfZ>19ZqV%p5GLIl*GBDB%bb1a^kF|uf6t|ddko(nD|+1`JmL_Yy%27p z-N6L*`c%*cyj!?9TXnPrt*RbDuqn@=~x{Z#fBPp~C3qHEJ3SB)TL8=wr?tLc&-Fn7W(u%d_;`O1>P@V?_lG{+39PNH z+uHn$9cd}s>7)JD3vF@_148KK^@52M6HQXJr-zad>dt{Vf`zr4OGUdS0(CFuedfAH zdaCx)9xLHs+Tpxt-3Phvd=Nl?J=C#bpF9%cXq&w=dv|u%fjO0XpnbzWcG&EyzTG7` zfcp&#|LLQ_G{C6t$JW^SZETh;i&L7LTeP9|89UXzW>q!Rbq=NM>aY>fA?fg^$;nxp zUs$qJ55T{YJt zDFmI6t_SD%TDDqHfgCzVUo?cXpIm+ga#=RhCO`}{&v$>q`zbI5;5kN@s&=HaYQKCk zBDa7!@u)wXxW6m7nNn9C*mhr*!%P7*;+pcOEAonAsT}On^S7}c2pD8Bgx6Lpwz|4% z|K7)+aQr^(!#?aC{7>I~$2Cdk*V*Y>w7+pC5W2U@Ep~3cXwUU7S!ZXbwY9aygX~K_ zPi!ePT@j(d7MD*RTKAK(uP$hCTw7DVb^Env4!M@-UIN0C-~HLR6-z~bz$7S5g45f< ztSBQ^e?L96U~MYn`0+zo8TTU0IFnbkkd|c3WZy zPItRa-|wG$h%6Wb5Ge^F?c(6UEKm5!CD-T8hqIr}VH`VgQaC^e<;wsXqD>GvXy}uT zT{Mg|b0_53g^=a!5uZ?l!F2L=CrvLsgKI8a(*oS@CJNS*S|ICG^8^t!!qXqllJ{@EX zKbmN@m1@DB?Wq@Box;wRU~@1L9J<0g_)~|2ChA@Sr}Do&y68gF z0;lW8S!<_)PmZCQt+v~XBFg6G7VN-K|BkQyAOOux7?Stm5h)wn45%6N?e1hXAFZZO zAF0~O-o3X;#`ZewnqqqoVZc7@4bWGyIedM=>~I&`Q?VZwR(J14^LS27DqGZMMFc?n zFcx6rlzU+kVr`>f)4B&jq}#Q%VzI^M3Z3?p9&D(m%{n@8?d~&xUAlPPR@Eqm2K!vN z00DC2)`U$@&sjwTL`ORV*wzave*4@r)IE+OAs&Al^Tl`y=aTF5Hss4Z{lut4Egyd# z$kOo}?_Zae0^2~!m$K!lh#9)F36|l!XAwAX5koh*hHHEG0>O~ znwK402<6`vZNeCIFK$CeVEXp^EHDMA4|XNIJQC)OX24<@8vM)m_*{LbKpnsn@%~*J z>^9VJ7<;zkhce-7@?t!1(-i-OQ+vFfVjuQlAMDl3C~20gMXsx@#V%=ldTgLzJ#7WI zm0w+7+ho%eXi9Ppv=>A$BM@P=1g({f?a%z(z}d6s>?c2c)!lZGzlRSX8hEmS??OS~4Er9LV5V=RyaPZ#?z&_?v163F9?&jI{ zp&r&3=2@Eba1feed^`v?sbksz!l%2{6dqdM8hZGzQh2!gIwF)O=ZeyeL0E3B<( zfU0^K2^g5L7uMC?X+1q1HZag*{rx?5Kn%*!!^1XmXvh}Du&~{AEAU6iJx3NKAQ#3L z4`^KRlz^$Bvp7EB;TYd4Og&_AIpQ!;PWZS>xb5AVe#R$f?b4;2cK+fGd;8o~yLe^P zmX<4Czl~0`RpuJYN{)OfoPW03^VQN*o;tT(9i(^+^ONEpO#xxN?upmD0L0~j_8D4e z*u{mJj_LOpV0r>=Ci=nq39I^$Et-$FSugNKsJwmQ2MN$9Lm-09Ap~zrY99!-?o{CN zenP*9u$5}jt}TRZd-w8U?)w3JzZ2czlUD z>e`xBD-{oiQ|;Mh6ih%MTsW>afc@J$h188$z)FH5?y*)4i@5Z=Ub!8O5q`*n`sV6# zn2>USEz<$fBI)2K=n@=@xl(I>Wy(*Y(krOIVz)(Hc4qI zJqzQdXfFZ>qow8_OZ0?ooH50K(u!k-5nQXYUjm@9!kVZoH~XXG9n7hGUETl_$@ zIH@nO-`0DZMecmPK1e{jh2P?^r*;(0M57@v-R=ASywe5yun!*u(Cwi4u8Hq_d%9qQ zZB@CL*aVugU@#^W)Y$36B)j{e@5aqr_QM~)Vqf{nAKEv*`R$0^40l>SfFK9W&4t++ z`@vkVCfYk2fEc(6#Zq)F!AJ8IAF}~&I-nt*@*#~brR$vbn3UwU($GM|6g#G$I#S(pO_N4Iu=~V7u>FE&+1|YI&lgnYrfqyd z1iQLTsz3U{PsRg*2RzbSwT`>^mfcGecKzy2TNu0Pj1W!pP*=g*P-><->9wrJ&Qv?? zOz*lCrf%5$%&cpYCb)HL(ixQAo^C6}Rh_oB){IFBD?QEcZ5A?1ATU2Xuu8* z5Be#+t72IEJ`FBi?@r}8laj-EzJ~j54yWhEkNBG0!-5dP7RH

9i~V$p744X?TgYgWL`M*Apc_1%qfc^q(DKKnym`8$h7Yt!aOwKw zVtfy16Tahs=6{5fY_m^v$)lR9pamL%@6ERSkq+e>uKHm@?5(iI%u&tFu$a;<3*gYMw0cG8XQHhJ^&- z)clo=q7AmJS?|Ivr$rJV44s)>@SQG)M}{IDqUUdIak`|lv%}}It-6K3eXR;=K>~7N zR`ft_t_GCa~dxj1S*x+El9gyGB z(rWYbqARqbVRvO3!(|-5OiC zN$}3jDt5`;O8}kEDf#RO`ygPav%wC!;{69|7mNmsGt3z*0H(IH5BsnW_by<{Fs~HI zqQ~1aF|rLb-JUy)AbZ`nKVUbLn1vi0@#IsV%9F?;i^ckRm6n>H~yt@kKt z5G~p(ud2MOHZ+cBuh!rvUTBvq3zwl^na6+u5GlhZ*Iu4y%WlxjA&spucT%rtfzE8STX%PdwX|t$P{V{d*{*#~Xh4D>Wg8RQ=ay%t zY)*{FiOy9!+PPt+jf(nJ$-27QGbZHfwNW>#!O8iI0gW&>zo>f_{jjKFY@Gf+4KI~N z6$s(@8x!1X2*+q$xG{g7Pte057Q)d5RMYEI82iu*i_11PHf;+FOTG;dO%_~-#sloA z@SZEn6=zPcsRnqxs6JC!2%Q;oz_+%kBjxtBW%tYZ1R8Pf>#{75A_~^cMK$ zdE%D17{^1C0}W1W(V-#D_R4!rSb>=f`Vr%1t*+i5U~)&(l9ThXSDc6OviiEla|F+9 zRe!&q?fn1*An(U~^j?A6fNyPc6GB6s#XHhgLST7oY|`F-=YoyOZ`U}{)!k*6MQgls z_M*nqHtQB0F)=Y?Z-@o~x3s*XF{Rr&Iy*JK-V|+e&S{USnK_LsqGP6KRo;20O`uC~ z*Kdy6^&6vhRry#1?(gptZE{Pr$vGFK_VxB?Y*Rzq13++=r%l)u!S?O^$?7b&%~z^6 zqIUn>f%jfunt*5Hc@XX%(!JT{y}xCDXRxG!sJOapr~5YSXtXCXuW#C_fviP+ffH-d zipRbw0x=FT-7P??Yj(6svE8@E7e%LUOOyzhlM$$Pm8$lT?mb^#wZ++4TUuDK{$j;W z^@v(uEn7uA0Nd~Z1cznO_#6n;-`C^!%>(qyvijNLLfLwI>pQlO#km1F3n~!8@wXvQ zT|9=}OJVt0mKgSU3VVcbKzKCy1Y=+`zUqs#b9$GF$yuA3U3A)n1MGUbI=!CZhuTG- za0bTQ+>#&SNqu4SEj<^G^s(_7jWzRrIIpM08%56{g&X~55Yj}S? zZiF{)&WDH7Lo(1HAORYQl+xcL;cX6o$_bRWf*?<54`hVN^zW)?+Y;>h0qDj-Q+6zJkh^U*3W{-*X9~R$IvrW7^D2f=KS#PzM z4!63t7u%I!cre=m1C;M$5SDB~eP*!g_dOyW0^7Q1rXJ}j+F?CwTPs^wiem0(y@O6q z&Dq%4ln+j9dE4sHCkXY?(JAZfY*!hrfpE?>lq?tnd4XmE59%jF<-!>all=J8%x^3k z-|;CP!}!=ko1C0ezn}IkZgcZXu3btxV*t!pml%@vwkSYGD9W{RY}t34X{zgmrDdC* zS@6XfG%zS@MhpqK-rgRsAMVEwzK8K+pbmE%KLKMx@Eaia&9m<>pP)x0E`?(>*H&uG z31bl&oDkn^GkZ$o55mFsV%)nMV2m1U7gMP|1_MBy!0@;^|$Fe?ZdqRY8=>3LYs~8@J@xMEXIE2_y5GcFWO{isNaqqJ7Pcn(QEel z8}HbWBO@9gC+)X?=MU{Q7HO|sw^v?$!)?4DK0IOK_prS_3C$Sn zX744?=Mk8)y*dFQHw~j3!j$jj;Z(N+o`-&qK$mA=4&8_C!R?9`H|(*lWozB2*lMxO z4}WCQ))znIFeQSy3Ir{K?b!d@xrv_)R8Y0lYHP(-8`cNHoYbt^4)=#XVj(_XCK`Fz zJAL7R=#p-=C5@xBUucq}JtZ6IF1kH4PRwVK5~1Jp^t|YlX`fp$6~vhfjo>!c)xVcC zKX0sWIDO)`ZFrw7sz3tOv$nRrCWd6(3HLw!(;ql<@x@>MMf=Nt`AhcHQ;*x%zW!%+PB=8b zZr&WVr=NbpKJ%H6+q+^&u3o)iU;6SF>?0rfkd2Q|+Oy9-Wq;u>e9`*)di*}CA}kP& zEU&KHWidJkRHiEk6U=@*9wwzd2dX*-6TpmIU%JCO+aq|Wr|R}`_F;RNTCUoQ2jm_f zv5xi@yLfZf+fV+}VP*rSfw`E&H@ZadZM7o09nk)`3=P1Cd#m>BP}M$saKk=&uxcOD zGjx<^tXf&Ixs?rjqCcGQ{ip~_1OsRVA!r)uYq#SEx@@q&+qDkR;uskjaxF`=D-RtS zvSUXN`gZ)S0A}RSp+UPPV!XV(k`Ws~7UX^13z$4z;$b;Q;m5H1`EVW=9bGW^TW@iz zbGpFu%fEGN%5ej1yFV}}zu$$NXn=Khcexf=p-}Q~1(A!N%3 zL2P;9z&_j?KwqBLIGxO-K-vtn7krn;rTKu{Ev&5v?UT{53H#BHUvt`Geqll5=%UTe z&e;!t_*2m-6ZY|szhr;uFa3Etar~&g_WD~+uPm3BZEo(+vN0|%`a74`-&Y5*ll}1 zAd!WW%glQb`2he!(w)qoKTiOyu(T>#qqS(qhq_!dadKwSrsvBsM*zlBOlV;v8cp8A zUAq{-$QmXQ-!?teZuYcjl9QqxG4TLh^3g+_=3TX8#RZ$6oU%Ff!y_7}pHupX?!`6i zz(VW$aDRu>CL@DgqRG4M@W=tDQRe3t<#*YU!^7eQ`kZ;%3c5s_^k^>Ups2+q?4rg5 zfj@385NMOyoC-L`(*k68a0#En(W$CyVfQI>Gi{R6vv8d2IdF4+LH&DmEpE9VbkjgR zqD|QO#({MRJJ~JAHH>Ge99+9-laa#*tw(%JxAKyH{l=tSyD_10%af}gpw0*Hkr4MV(G(B{t@2CrL4gBh18ndk zl*}^ULx8{%TKkCF_US(MHiqYguO$9n4qI+!qb(c~n+NJ_YWcxafZ44KBoFy(Q#eE2 zMY;R15Bsn?VCN8uM~%D_V|=Du)}&8v$(rU@J=}{k76kiF;VZxQhb}Pv@|V6CG24Te zt$X;rfOPNlEL#98%j8J85EgML6oOMG(L06bpL@!#T)l38`t2WPwij7_eqBt+(IbcL z<&VB#XT)rL@{=ERX5`&>FZw%B&rIm!6O$hA@9(vz&YZTBCy!Z+h>7Dz58G2up7zyi zR$_ne_x_#ztAF+{>`(sqTh6#7U={rA%zMKSH~aAS!kCTV7Gf9ej{PZQYe16%yI>t% zU2a!vv8~V6qSYX}OX@OtChrjuPdl+~%C)l-Q?^lAu^}-u2uVMGyy}`83@98fh0ur- z`iDEJcB)sdZOJ}zVBHxPv`aT>D(gAeQqO7*nxt$!N2`>6f-sbKK;trPyWa}h+FM1O zZ@6}4Iut7F9=vx7@Ea4{i)s0=2V=l}@HyXIObf($V04-h^WgIFln=MAAAGb*gRr#A zx7PZ0HdPGyGe&{3qT@QY-6J?fn2fduj2jF}Uth17v~DqLoi@Zu%jaIJjFtsEfTr4%z#}$c8=IkJeJK#R&64y&*hE@3@z6 zel7@)63j$fu={ZD0rM%_^7BI>_DwOJ^4erDpK>SAs&V6?hmMQBm~u_h16I zyL4!1z+QO%X?yOOGxm&JrBbo$*KaxP!uYYgvSO2y(`ug@tB)MAGfzC~TB?`@Id<%@ zJuaGtE%^vySq%PX|Ky+BkG}JLD=#g1pQMd5OurZHdn@STfDKjX2dS}i5TTp;{Qdz^ zTLbL^g$$ZThvsUx`KfuT+7ecjXfuqD%y*fcNc9P53+zSS4!E|wuwY%w(=H%=`C!#v z9IjfwXk`Sk2Q&^N6oocnv9`asVkcXd>|-NUds5%7(X@$!KQpvR$!Qbl5w_VQFl0fO zci;s5?EozlXp`lYRoB=|5MR*)gf)YPXqFJdDW1Yax58z9oeMNZHfQI;?l+n5d2xhl zY^{eTaoR-mB(wwzvWVWu&$n{=L}8D+Q>xw>nhjd6)PhD%i_BOY83o_e@h9o-Hm$B+926~IgwCU2lkz%!rs zwsLq~E&pzT!@@9~a_KVWR03Uc{=zlUCS$g|yf?H7boWuUe-;Nma&SXV<5hRn9u@5m zz&A{m@8IFL0p~qE-0fuSOzfqIhoTU8&0EpdTx$PS6&pW^*uq_uNh{KaM zTGa;Q2b~a61Yz`8Z`D3`tZKcH-iPR8d(l>%o_;dERP}?SPPH%D(*qlJx*s8E)sFW> zVOA43IM8KnYh^pwzP>B74hT>YWbJezW?6Zsrsr)?L^&tcLbQ9==0`4c^AJdV-o1cw z08iNce0U4r1*QB&oD=KGm%~rteB50m`e7QTW)_^GBAy9I-34JRTlgW4)??fSt-3xi zC^a{N*2_S@b#!*PK$ZLjbrhHsG}M=uSN&QqhikI?6kM}sLth{JEjSOm(}yi!5+(Rn z5X0oYTrs98zrL8l^10qezTi}RRzG!q4D;i-To}Ms*tNybh7p*uHUG>&&;oME<=qKT zhgYwTIs?Llh*t8*!6DaZM&OKwGQ!ky6f)fnq{Rcagu3>L;CT0j^=sZ)S>s#n=E-*k zovj6%Tq*d04`?gCHdVBD=L%kL`*808^A|QT+hhAkfN%&craL{jgSPe9qo?f1;X`ge z{qoi8KJ>HT%GTOe%?E9*9PU)G_I5ph0KsY6cKq(y3wH6+ReR#`NA1ZokGVOdyw(e0 zV!l1Mv(vgo>-2U7lPC#DM}U9Fhg$6tn0pX7Gp2k{z=94!xvrKE@FDJTpv{+JTcRi$gMnvJwp{9B-*+Efr4 zpWhkrU;ucB|?5^ z6a=yyG&eappDQCihvTuX=#HA7!d2a)mKLr}v1u~mKk!gb$y zb+^C{n6P*d&ZdAShgRv)Jj8ROfx4%lPnYM_=;Mht;T!+lK^p%eY?e+0$b>b~ug$^r zJ9@9H-|WLa?8Dx{!aO$pTWqNy;vx1oOtCQ5V>kboPQ;8&K*Q-akY0BbG372`2hV_jv>6~wePz<@2V-G^-Yrn6U;33l=gbK9z9<9SLnn{B z<_3055ma!H0*`s(#L;ZPV|)I?51+7Gx5j)6T(fbLM?&!P(u>d8um1VZ*|WNa)o#%c z4y@pD9YRcq#=Qg#-h25C0AYDflign5Z?~|oX}Uc?_;}}yl|EL!KaN1~BOJi)CBeWuuv#oYCX!uVF!<8Srjs zX=B5ag9p&Q^uy`&;-qE2xq5Iv#qnc8ogeXe$6I)qKjMu}8S;1!3zyRJer0vt$}6kZ z-`8s`t*yc(rlVdk>iMH{Mnu;p1}5*&-Lk^-WKsc z8_VO}W1UBr)iVx{c;0tp*!G6N6g!-&Dh&6$CM(Q3)CuR~bvpqVllAp=*M4D}<={ZC z4G#7?lQJZqL&nh9T~u3T5p1sk0U6J}N}cPW_j>%I&r*-nJ%_4Hh^d>?)RHu|_Tk=x zq?MTmnA-mKg4^=FGi}qV4Idn`4}bW1-*V3ueYVhIs)H@I*d!erpR#!|;MZ^5@-gSY z@Q}BC7TC}vJ$(3}@}Zf&vSm9Z|8vhiX}|X6FWA#hJ#Os?Vq<1(Kdx*9O{~2Jgv#v= zQv&zB-8{4p_a0!%A>T$I5k{9-AgkI5(I!dY$+&sETXTSDll*D>37~hnmFKAewPjt? zxx>|277Y;g?^ctKela_@pz-$hgDW|p`B8XCc0hgZWnxxhC?WpF;_&iwVulBo@Z0$G z=`{B;*Cgk88pC=FPjB!S$}7HY9^1%hi3VCh&#j9x!Dz})IK~~9!{ZQEwzRhS0!+$7 ze$rfnSM|cZR>YNhS$+@733DY2r?{Zbl7q8s1s_2c4LW?cxnzzr1Hu>pWcJ9J; zyD>U#ue~X{TACeSD>^ajDH3Ua z)I@`3yXedh9}I`V#Y-I0^*aG*6KvihB(2dVeJ*H*ZW|sN5KY@=H*bkyeGhFt?g4@Agbf;0H~ z`i;Xknyr0pAH0?)2K}MM_F*&7j`>a>8V*~6&(79wTjUURK5Vll)2naGDs(fOkqAt& zN6O(1i;K&dNs8M7gO1;9ca0RSD2Paeu3G^mdcT!JV7f5BWEU@9w|CE7vFkS`Y;gy*F^T|10)e+Kb_(1q?4%1&bg%Xi~7Ho`dZYBM}&f z8e>5?XkY|EXXbRXEnO}@etSEDSd-g;5v#QH- zWzD|+&F|aq{r=a5|E_)I_rGRm-@R<#{oYUQxBllpupj*BH9zGaVeHqx^*#Ho|K$(u zC$GLKW@bh875b=d>2=3J5M|vv#koIzit}@Qv0y)&F4k$79_y;wr;k+a2{FWOJ|g8$ z&=}tWT3f}i>89lMi7*E+ZaqDnZc7)Nb8Zv&Jpve%)`DthkH=8@tar6o89S+yeYp34 zZ^)sCRRvz3x--EkTlAqf9)J8%o12?=LFv$7zrFCn)6Ss(>wojx_TT+Ke#5@?t?%2h zqlfL$M^5=}7y7}86UXc$AAZ5F&{Ep5vV^TQc6VA~I*Wi3URluFH5l=3khdJNF^0PcK47~w8fEgc59IY$DLM%+7(+cEk z@DrVqXp)RZ(M_7Vd>+rI@6g`njzgzX+2je&Rd5>PmDk^~-}{4a*mu7B6aU7ubBp$; z-}$lqFaN)<+Bd%WJ^Pcd|Czo1###Hb@BGARlOKzQK@f{Q_wRoH75nNR|Ec}tl{du{ z>-|NW=(Z}mDq3jW7m%E05fXgfCxADvHu?5!(MHRnOGF+ZKrJf6OQN$e%|V`&H-TTj z1HkM9i@D29=ni;3Xp{cFo^V*;%GSK%-2!tDq(55wdkydp=jXz1n0?qipg@v{#w5sL z5n_6=V!!vJb9QNT#{1Jg?883n9_Tx7-I%f0-hS8CRx9?-yoi+8-vGu%4$@B0$U`P5 zh{>(8J$8M4&9!gJpr{PyrXG4Pn_Vm+_+hdPBWEU@Av+sWQNA~>l z&)Dh59+NvDaRE)3@-SJbu{TJ%8ELKk{(xP5r4g2mthK z2u+V38TRehfLDWlQoBh+?Iu5k<)RnEfx&?`Nw_%?+;ekF-q%}-B^x?`#$q_BzOIbS z4`r|w_Pm~Xpug7+92oHNgLJ^hSN!->!^c2`ESdtbY8z|Vdi%Pa37|Rf zd{@Lk-@v4V+8up+t`cl*JuwirxYwGElaGE;h5{PnP2k-5Yu*mgFx?7ZXwmc-klRZb z*O-OLflG6NW$SA%HeH;!8yH;-V{@D4pnY4W_czej(eB5F_p=8gavLa=TI}-Go4zIg z;ZrAkd;Qt77wpy7-?Y}2R{QWv&-p;-)*y+;`+Z%75^?RLp@(C*)e8?`( zt+@%9Vu3>e%^up@uH-uGvDcDX>8a4I~StV=3;Zf?=(eD3G- zy!ti*GVGkP(;)%)G?f!}KmOonxERmlovvs|%J3*IStw=%O^)&rZ5-b zvv4>zHtl8zMn(>V^pG6LykDz+j%#;I?8>wETvFMP^ACEDcT#Vei< zQ)ftF|AW8%*X^KaG^>g>(S7GcXWqIsVLhTJEBcmBABaAoJbx~=*K12f*Oa7>qmY0m z^fAq|kM|=m^=$Dyn$srf9k&8_=jqu6TUoByv11xAn*f6PS>;*NGxAOL5_qpyr;2VC zhH>8!)-Y@~y;dDyVX0z2{NXF2HICXN zk3M7*<5Tv1#WBzE@<%`9&vfC!6}xu*reP`wQyz~ze9}e^4cpCIs?%NQ;Y$_SV~HMem%pxIq}?lf{F5m{X))s$NLSmf{SyZ zf1@FPFG3n`cMHv~i=%K2lqY5L{2q^vKjev;mn$1BcD%3XN(VD*Emm?_g7DR%%fmi- zv>;lR>&&JWR;;6=)93Y8c2TGd+HmPV|Ih!y|2cGAjC5~!2OV9lr)Ip4hEg;X42tHI3;xJk=X6sDKIu5@bp6gAYOL>3`W$(&toZ+`~>3L(A=kx9PLQGA~`|4V&>WSxk^X+pkOgZz!X}fyurrS~; z7J+i<;x#ulf-SN~9)8FVg_)R`va45a*oz-}*5lv%-jDrY7}6nnjta*K+l)sLKnTC7 zBTf*e4WLClIy&v9Nm83&`y#{`^@Hu0hkL8`n0Om@1f;H>hIuBs7|7Cql->*wQo|g3 z`-!$3n*o|ZoI+0fqrUbEu8EMEu7vLnqu;8^sWUaO2hgH2lNQZB+}}W3Mmy)A=5_4P z-41B_j3-A%4mxdu?b6;J(G(|+*+Zf$pd%0r&@WFOKO%bNq@8~3l*ieYPro>Jbi}p$ zp+^`?4<8=(@e~`;q_MbzW*#`=Y~6)6f$<5~_FH#bSokQf7hEU?4Z*=XdkN4xJ*`!Z z7X_!?5Mp5S@@dg6v-W5xO>!(My+ExRsy=FFMLZ1mQ+4G#~wc0KRCQmMEG0N_9$ zzc35P(3mYEoLT&y)HAUAkG90X%6lwpJmX0*gY(p2Fl~i>b-pd&Ui?YnnB zZ*_2ZAhd-hfRYf3O9;UkXZH#a0$*DSvE!JkV+lMPV;~1nBJgB)%JE}I?4;i3nPJWjz01`VA(%O^Yx2l>Lp$d*}7y>8P75wV!1LG^Fwx>8KzJ*&mCBz1hHEQ@p`zkYLDpCa>&qKRQDahx!HnUUn;t`*3Ct>cQHA{#C_N?@ZD%$ z*A{|((#P~Yu>nS1A}GBo;wfp$EQ?rO9lLI44t3Z=!(DcAs6+jG%@54s@Eo>NCD`s$ zpvi$|28T4EK|mYcNq;5JjIQCpo}OM!fVz&!7N&!KI6VwB1%0KW z&Vkts^80=1iXn^VY4i!!$LZ7b$cQJbz>S-ew!XIE+6{iPP;AEZ+!DR`X(K2GZ97xyKTph9d*GqW)rA`-o7sXeh5if$!pWMgJI+NtP9~8*Y^rW z%VDJ#p#ehEPM8S2AKzxLfU@_;#Rmsi^qSTDj^MHHwoMWGLNtQftkVqY?DTQ^TSi9+ z$5==n7JGe6^h-B9opCfQY6W_Og{Q`{7&BkcQ%ZC=ne^j&y^e38r2&Ko% znn&f>zRx^bUYN7PT}AO5J$B+ir?rZOXU>Iw#@tPUCbx1xb8l*D&c?^5ecq$*K(Frv zV3L?i5i+olKp$gn3G*9vQiC9r9Vgx09X{tEObuf_{6RR4f4Q=1OQI3_`f5hfC^z{Y zjD90N_<=Ub=S7&yf+)7qp^2yqpL2D8Y?G3ggQ?gZ1D$}`9H&VZR}@~fIngP;u%|la za7s-1K;vL8gloCRU8Ff0{p2>$Akj7Ab(#BoDSYT87IvYd*p`oA`L&fS(+OgwD z^?VC@zgc_w=`+qpq78rU-HV<+I5?pEWqbGhB|ClkQGJIt`@s)?>W73LJUFcPUhsul zwCnkH5z`FnA-b@|PCqECc z6aFR-^y6kgIY~H57Ft!xnWum8Y0oS?P}wdg$%LmdE|&yBIK~3_4UZ!jazDnmaDF{` z&_BQvhtKeI#VK!TL*s6>r1_ddVC9rCCvYL$YPDdmO;p`TwQoOHMN#f%=VO$+ z^aLpmcsh=7&LwEPCZ#pz1M+$5oNmCD)yd_eZ)5G(1ovpa1|kyo7$95`W}sTmN$b4Z z`w2CX7wYI77lJ4@7rgf442nheLJ}kw9OjE$1Qs$m0{! z&Tudx=7DP{7Xp_ROtcsga;2iu@Pu%HYq4*NW(NZ!gB;hVJop~Ok70L;G~ySU z1qfFd!+13M7>gBXU!-k3`>+prpwDvBIJ6XpDqUX?QaE33w4C^K%npTN9{uz`b3=+_G_Fs+JV z+SjJq5j2c@&>WnA54z8_l_OoEaTB5GOeGv(2@S~j*%>(T}qfIow@;uD* z>4lkt$pamNMkNcwXs*KBFh6=O{p5YF*%a4LEgZBJ5jd`CLP6Mxz_hcgQ#k^y18o6~ z4^(r_rVK+vRn>L*x6*YOCgv zq78MH>|qz02BGm@ImVFgcJWwp1G>liEilyww2KR^HnUdp@3W!!+-k{&x`JTwesqm( zF>`8fp}p4Jme)8wZ5W}i4L8fC5MyUBZtEVLpt4ZMEV z2e-6o%4`^6ePi8cJZx#eEPw1&za1ZHI9}>5;o8)Keecq&PwKp|p3q-90iFI%01eHl z<*J?3<6=AS2jc}7(Dt@e?X$;&5RwW*YJdLX6@Twz#}2#J8{2+w+#C}jpzDtxQN@SK zy>#W8h=mP1IDEk7G~u(&BMpe{ZETalHsgxNyE;4V!0>5Abm0bDO%QbOX)av4>h;}u;E1i2#M~FwZP@9=?FZg_1rUU;YI5EQOsc9NsDWFH zRVS$X#E3cJ7SQ{UtBBjx2?P;ZecN>z2-vIhRr}J(b*nDSxV@<(M-Qt1wb=K6@P@70__TXYCg)UU1{s8g$5bX;M(NLufN&O~*9ElgL1?<^-Gm6Z zS_;qZe*A&CK$C)P;`B2Z3k1Htt**N>j2+}7yXPmYKlwh&WjM1dS4Lg)0B)!xzkt}aWHWZ-mG#$(4;(Q6@X_vqh9!fsqyr9EwCvbe`3@jrR5=Cohj^|e(=Gi zIFrtge*Bt!>rcODFMjA5J97AtzR|3G=g)p%4?l8JS+FTvu!Z>rF`AS1^2;yUjq5k< z%{Sk+7e4f?EsGhMnwqkY3D36Rci+8Wum9{#`?W8B-d=p+X|;uUTP~Ny)U|xEvfIafWo+jU;+Eaq+zB7JOUxM)qz`DTJmR^UZ_}i zzw-5}?-n=w@JI%#CPURd2WT|1NP9cL{0+j=Bn+BbrWUJqp!4?E{#-%sqi^;7nZr^& zGOnYkn`pj9KsY_UQng3BSMBk(IUnEA(4!wrYhGrHGg~va0(QPk&CJ=M;X&X2&0Isf zM<_=hflgpfMmq_?Vp2W_ zgAakDGf%k5GtB?I{nlAu zux5u(p-{C&(I$*-FFgOWjgF4l&wlon@}F_R>)ChD+ZR6fN#A~d_MHp%#v5(E#cG2{50< z0@ra3vzXp_V>&Dl476|9hYyCv4{frhdtSeO%V}=RV!+3t!96xU>Eq6b=mvJOsC(Is zTgs;~2L&4zIMU(Rl+126co38|7!x~0YxIk@SY54XJfHS_Uf!W$&o`-lJu^M$N)Om= zXYptqK0srKGFofj5R8U(Xw(}N``P$@_adl@?A+|mV8+! z;QMa{p%pgd$p?kc(g?>y=v{VFxbPF_;h> zPwi;u2SF)J=Ur1nM;q~TPag5cyBB~E^H1Ko>Bj!)Jai6!DZQuzFD7>9T|K|Vl|MZFPKl~5> zmYq6r#I>&eum9~ou@wo;!NiQ`A@KlnR;!ws5$^{d|uleX&qBOiI*e*M?K=mQET-_D9i z_-p^`U$sfhc47hn?+&=W7Guy6o!w9g2>d?W#O+qKM{%EFXG@|iw_|O5@ zCWT0bIHf<4#%g-7uh&GVTKE37NDKu(7blQ}rkvnTaWE+`K1|dwKQRA3tnnAGWqj~( zj9<8L!--#*vm-|i`e9VHJn=d?Z~-4kk%Uia`MA4$o_JpZ?(w5gO7mC>k+Nyow3!kxDH^=PH zzVkyb8~WrkpZJcYoyc1`NmZ&p++LiC12E!*1Og^Me>Z^~smj=cfIz6|}xs znE2SoUefg+vm0WN{8=WZMC*LQUjFFwdS1N*?;v-tH**B0Y_;F5umC|`Uu)GKAE=5h zDca3=K-JGB#E-n&Z%q^N`DhEEKLlF6YLAFEp%3&FS6zt2VLk{9fzywjaG~Q?FgZEn z^Zv;bhwJaB2VlHMXb5u-eb1sOi+uon0vZC-0MPjy#sh7#={@V-zn04TCGhT$3n$tH zhoCSCQ-iQ!a5HU^u8-kx*wm8qMhHXE*2Eqsb%x8+Ch6J`h8wBjL*AON|12$q{hm2I zv6LQuGH+Y(s@D&G_zsaak#jax5$M2k7cPt5nz1uaJZeV|AGDjJJP z@2zW~O)&lT?z`uG97C9m(1`KtqvD;Y4+J%~#_k!EgpMCO6a=nZ5U+*iU_qF6$u(%JG8WUW)>cDV zm|ug2=@A_b{R@4w6QEsO6Kz5n2=%cyy_@p|8Udl{k0-+$^WEoGs$Tye9TBfK8}R$E zd*J(Q3k~Ucp()_k$2^2nJfb{5?YoAr7nbJnj`MyRFHVrs8t|L)HGqouL#Vq-W-W!P zozQT5R&7O1+lD);Zt74S)OQ>H%YXG-PCG+$Jn`7Wc57_X{`tT7|2oa_@BNiubvvgV z#P%=9CtBh!{Q9rh`SX`VoBSx4H*9P3vlDoOuYKb?>Pzg{Yju0xLd$n5C_Db9xT|Yo~pfbKlJHcK4PQ%&*RN-s>hHwrYTI^1)eeNf5b_a zpX7{bSApk|LulIB84jGx3r%-^5EMT77LJ!;bZq+?e?9|H0RcQ)rn;pMUNt zP3UF&jequUov^`{4%<eB-Qx{gQC1>fFMwXDY$USrj))4tQ&x86& zs9IV$+<S~)g;ocQ6K#X(O5A7xTcg(-s+@AsYL8dsI%Vm+AIy zm9|r$%^?g5j7-7C#;5cf%st%6Tr-9l6%{X>q;gg@Nija+x>~CC^Z;~;>RPmk+qD;+0RzoE z9_Wy;bs2#b^9pl_sQFl00Oly@4B8~x(J({MBFy8^C5-zBxR`UGVbBz03w>F13c}VK zV(`(TI&uWbKo08apjH#iu?akwkH;``3iJnk3vEWWcOpr`GTWfx_i2PjB#7! z`gYK62RY11RJpuSKhi?OXjFiPcQILIrB3cvh)MO;kviYz(!pfWCjA!nvkGP;H=lohvt2z2%n~0OD zu3K0w+LGE(PkTs1Zi0E91EN*leCND<>s#LyZQkQ2{Xg~885eN=-tYgh^BnAe!SokO z8$bE!>rN}Y_|o%s?dlDuRle}~&x(e4$PTOjv#a+fKY7hQ{ppYSc>U9#zF|*4{kZR5 zgzot4XFj2^veSO+w|>w0vyXl3!!D5R?d`RrM-RIK8)q-{=~*!I;c^r4u{TF2oY&01 z^S$J#HO+Vpy7#dEMW@1A{eQa#Pe)hAs?a%$< zCv9=5Y;V2&uKl9IXuSRCN3Yml{EL6yx9b1)Z~uY)`mcS_KJ>yfZV~_?Mr&)E{q9%( zoyuC*eV_2bf-SOqBep~{F+&J!S08WB6kXHv#*&zX*+78m)!%b?cTSVD?g@c}y14qU zJtZb%QFVSh#)9o49I}8-32eHteG8ke-6Etp2!ide4;*t6-)C2^rOeysuccC7iHAkI zv{%d?+bvG?sE*ae8A}o{FeCvKjD{1E3UewttMm~0HBg~ye=r|xbLLb~1fdA_M>%vM z+TMb>89LDK+vKsGMcZ{kvb)0>mVUOVi4aU}x%T9_Q0`?t7~=_@(i?rA5ql z6^?D;q~k>MXW`^-j!wCG47504u6W0cA<+f$JRi(gVgm5p!9;AqNbnu}nwZDqx%^2` znq8mr=o%RIR8HRcy&2?FT+fz#aLES;)R<0es&ZHi%t^4ZiWw4CfDwLTYm7SUP+DjM z9nO4U|C4K}4?i?Ub>!RQRma5BH*7l0WXM{ohxCK+-4FYcOU#QiEh@W9?S${f$(yt_ zF5rG>62XX|p+kP2vA%uo45$xhPUQ0(*f|Bb|90bRGr(Rjhd?Fpy3+IN^ZC2(vbcTt zIRbSb<5Y1N9fWZ7+4hZ!71k2@yAa~|iKEWEK#Q<_4Z4c0_y}IXpMLCN-$Y4U;_+ znk(3beQRvW7lGZW-9r-$4)!?>;`4{*ALba!!Y(^=QU0|3+LPzrLBaeR5$1goq%eL$ z2V7X(rN5vxO1}>CMa-LAjFV?+sp8`T3x{z=QCj_?t^P9{@ytO_Ku0vAB|NQ0n`C(! z!zr(PFWgs^L2lOm- z2M+qw=@q99RHpLKR(xSr>Cm)o2$!2dY+qS3ixaea5lK5jaEg{`S66MpH{BaSDeVy( zxm>3a+=Vqf|6$BJC=dB~j@aIuVhm^56%xnPOE9FB6faz2)-{jXGOIC%4o z<+28VRr}%he&FqiL)oAi*tx<^zwiIxr@o*%D*6N4!$0`pE7sf7<0gMzdg*zmOD~aBt?&6b@x&94`GWEb&p+d|3JYk?U#Q>a-#hP^$KRb7Z?VEI61hclA!M_>d+Ffe zE-Y~0z%NWLYc6aph&F+r;QKbeE;(%Bv+(f?M>qpV-%{frN`cTP18pi#@6+tM56Uq% z=G)g+uGzIoHb{G*UhutNuYSY6 z``sVe7k}xqnN3uH4>>=-AYy3Ug{5o}La;O>=4O6=-d@wQJpTA2&a7a25X}$>tCJ@W z`wID$E4TD~*WA!O0|Elp1V6j6WY?#b+^8)FUQMXeeB*k-x4yrZa9#`v0#h^wMwfy; zzvtzSbcN=9JD6UsigDbWm+ytv=}>$1eG&Y==ipRJAY5W_Tkw2&mtD1$6OpZNfYAEk zo~k`9M&ubeGnGjW!yc&j z3FduP{#{t8@dYA0InR@G;LxyT#ftZ0@(oUDIHki}1V=bJJ)XNfPL6M|Ca$68%(u4C zKM1>vc~)Z{{NzGBm$$)rSxv5~m6N;IS}l$6y89b`!v5ssoPQr|AkK48h6o*Ub6%(DgB_Y*`r15;R4fiS6%kZF+2j4QNbs8>!jk zR`qd}YZ2@+p3*+kwu(Ci7-hD5a&I)JX)_5}NJInnt+y_^zZLlVg`fiqK4=N@Xz$T< zwhs>wz=&Ylfn61}8MN!re7ZF{;U-SdE;}x|19KH@L8b5TL!SZ1?iB3&qJcq6Ohg{- z7iI)4()qas$6=rNPrv;=H`noz4?k~@iMer_E4I~gx$M_tznFfB2@Dn~V074)&!Q4^ z3pQ47+`Q#l;F$bi(HPp~!o};pumNqd&fuu$WIj4SwrDqJ%5F1ix`GYYg8gjDZ0tSW z>YfCqqq-0F?MFmUoEfOP@N*}-SQw`f>T%#z9y;{RI!mHiRA)bLw27yuym^;h*~|q2 z>FkQ?vMtah&kt4YqoPfo6RkLe?YWd&KaGwyiGb606|}baVxQ9|F+G3+`WDdEe3GPK z0A0cu&wR#$E+^t+6O{7U`i?M_ZQ3lHQs&{21GQ&~zYB{?cK*V3d-vQmG4C_3B?@?| ze$q3fxQC+;vM!H&HxrCWEQE1T z?~R7h40h|4UUT)dNm!W9(IEm%W~Vw&VW&;<-+-_j+QDe44fJaa6g|Q?=(K{u z2vk{gN%@n>DNI&{u~a`K+$rdK7Vn{lmQU(;UaNtO9)Us>T*mIZ5vlG`UI=fqwC0dJI%YsyYUzd%~ zmF?oCtGC7WF>+DAu<_Vj_G9qfX6XntLC@TxPFqP1(j%Hyf8ei0|bDq~Q7 zKJ9~cjcseEF4!Mc7^gVzh-=oaz1OHd^>ux077~;oEUI|}ig8@*N}3NuBQBZKCCE); zrVLU)483qGNTuaLI3Cbnga>ayvp~K&Qj3`1aN5*1PI<`d*C?J|lrp!v-(CX6A-iN^ z2hgg!eBq)q5*QT!?stDI=6}O}@{`v?22~teSkaWjjvoU;Ph9N{A2HbH`}C(iW?%f` zFZvb|J|>JfTl}4A5Oj7i@spotCRSY`Z%YpQg%icsAUb25$aRE$}C z@4bY}Vn}W*7F;6(rsPEtz>oC@0Ug?>*hZlVZU=5cp^5;lIXu);HQ!Nkzk*&YPmFB^ zo+sx*?!2o(hSg8~HE8!n?NTv&2%S&%25lKSykD~eH>0+NK#MJFv`xqB2S*%jCl{28 z0Xc90#=6V3Gib}Kj6>{Sx_r|O;j`k7Z7B{gI5^zz?Rs={Qhn}<3rP`>Li`~hKsbeV zD@5>^;x5GEzPi6dE}Y)ipR2(~bC89FFyI!N63cnV)(=j?XB!+s#e7=Qs&GPF&Y2MP zCHGTY4o1TTtD@8s15(3>xHArNdB(#9q*;3OQ+O+v&y&KLi;RfhtA^(pk}HcjVbQ8x zV;kc#W7OEhtliSLAT4R2r2K&)3Ga#v8nSxVTs`5a`{dU-|1ME*n#F5A0X)Xm7>)6m zEDu$tGDdx)lt7sxP5w>df;^Jyp}1z*xWGZ z?!!K83xPHWeFwo!mnOy08#ioxY}_thxMFXx_M%xve?9e7KFbHuGYSCX2dT`j^*~{bhj@<0Rimffo+v?<)wXEry zwt}r{M#9GYrLET^?h4RuO#;*Y)?jD&>7gJ1#e_yWxb05i0CQ`1)di^cE$CZi<8Z(< z1y7H8L&g-yy8szRKY0hw!d${U09|shvua0Ge=aa3PyX6%90ErcVqvzkg;gcsn5SUA z$%F6{ngj=Z00UnCB~RB*ZS2`dk@RLZxaOqhU!F5$HN zmX<)HOia$(==h9ifYt21@Pi9=P>WMPif46HtJl1%#|Ob__#hD%zYUP$o)-N)U}KR* zf7%4?51x#6#KP6x0An!pGdv}9N#ge|ind1BPy6rDnBELl);ZXuMu-qXX<{Gl9+*pa z3kU``K`bYg=e}IN_=vk24z@tLj zv$zZY2_$oIH*QYa8 zZ=wkf|L|dvZV&YZvj^|am0XC|?ApA;gw0m@I6DGUht1MHFqdmnJ96HRL%Yr6i6+$RQwCV*fx$Sna5gyK3M*BQ%w9IwSWk0KnpUJqWbV9V|KDMJE1iq8??$?vHO z6VDuf@;Bk5%Q~|jo)^djrb<(W@KP~fD85$KUc=Z@)wh8k>?+w;fA=f4zPf6E>DRyL z8lDg#Z@l@An2l%bYhU}eed<#$i%?nh0~FZGhUV#azxN~Ga)0B-sOM#+g;f)bf^&cq z+w=eC-~3;>7T34`?1wfuG~o8c-c(*x%Gr8<_Uw5Vl0wA2`ubabI16g*tGd^(efbL- zJRbA9#vaJaAN`PT9cBPYTc^`@qN~eoHo4YjGaLGD?VVN>lT#3(wYD&8)ylH+cDZf6 z3v*`A42A7wdj;1P!vQE`qm#_;_Uv%U9@W^GCT0c(jQe}L+y*e6&@P9X{KQI_=s8Vz ztSn-&Qn0f#B5>Y=cJQ7;eCgZ0yLZ+Mn&)o*9_Iv8Yj5x;;m;_g2{uO5=)eI zRm{STTa&(}f&O{@=D4r&p^XV64ADO^F{?Joq{R09u%`~Df(ePOMQo*}t)g+tp;Bn1 z`T~I*nglEWpw$YF5ruoD!>3qK=+$J002QX4E!>O)SzXD`f-#)Z@Oh4DF&Xqf>`JBQ zOZk#ZL^D2G1(+E?`va|qz^v5L-8nHHuY)*`VbT9`fk;nG2zkM~uLKWg@!-3QxSAh{ zf5o$Fnz-ya^qn22XZ3i)J0^z^+d<G z!i;tb(Z^vBv{N)bsGml-sxfXREP!V~eco@w)joXiKpTR9W{Xv4W!8TD-S29?F4$+q zSUmI888PFFzI`4IEa(ij>Z4)$_S@&|sV7fcpBMwS=$|@u!nfX|;la4cK`RIz(CV0* zoA)hnEQrC-AbfIx=uK><_xg4>cGbLl?xJhDzAjn@<_I%Hh!wCc_KfJ4#U-})&xqkU z?luH5F~IHt#(BnT#+8}%HoIPFvz0=-727+k(AwsmV|{Vn3aiV?*JjJrl53knmo#c~ z-VGoyJvXspqtlCS;s@HqZDqzTJS{qdZE?2)7Hg@)`L#fo;4aRKwpj?Y%7mVMO$=VX z|KAs&2fpnyZ_2az3db~{Q?#*m8De3+q4N-AFIEsd$HW}~8ka1rA~<3$U_2(w0;w;u zDh$oQt`_JI4tZiM2M}mYDUGolngF^34L)cN%mfh^x8b`Pps&HF10dM(5bS1#xpQc! z&*x7Uq6!Z%=DQz%@_v>kA3+xj(v%O4Lth4;T$s~qKJztmGAFgq&xaj5EQW+UIl*A0 z8S2W&=m_<>98FQ9OYmb_qa$DRJ+H@W_uGy(Nsebo$`G}9eICl>-SFWD30L%;*?|`p zbC{b^LR%e49MzHWBJuotF?%^(lf{QY|e`+}Zpcec}n1r3q^Jpxda+aOhX! zYp2yVUFg|_cGxM+3SoeyVBd~4v;(W1gL08r7r)%#EPTwcU zHO&g`6hO7sGDi`mhOopcU{LiWL-v(ON{ zAljh_KmXES{F1kE7J{)?`tG|IeW&m7{q|cvmEz6ctNzyhd=zBc+ntu4d%asnK%9 zIAkWAv49pTGM_dPFuw1i;rb86?F3Ty$X&;G$=9Dd6OQ*vzY(t=znnHinx|*@;Kxu1 zXZZ^*hr$#ErlXE@thpQ_2>F9nD}C+uHcjIV9Abc*_%$J#bz*>D!dp501iv940@Re| zfAWc^e0vRJ>IhDxTiI@1zGx>NI%!}2m0xrfax`MmXkv>p_vS=dY(*N>Tl?~i4ftVIVOGYt zKgvo1ao90MOO-I4A6p;fyXQggdYjkfv*ciN?)vnQqw&?VESoQP zqKIyT0q+}&W)Jn&n8mFim5&w%c4-F1fG3+@2q0NKhhWFJHrtROT8D=RocZ>v^^f)h z1YI}{z1>&&8g1~Rz1Kg`<13LVJ=rWHjG&WMz_d7k%~Z-t0;^Ov?&$|V!^xjq5wUoE z%BHIwc4NKUhPqpPav?3{#X+!VzS2J8dhWN|?L#IpHm%51;p ztzcXd(}ACu31?K?uchI8nuo)6b?GrJf8Caj^q9xrBad?z-&uHw2)5rNT;%)0d@+tu zuRcxy`bO;}tUUr?&%SZW=-}y2PEXWg&V( z_o1&tY~L@mNzQ8yO01>V=geX`G{O9<*IiM6xdZjY{Dj$rn@d%nM-ggo1^KdPXXoV> zMGp`9jw|Q`7CNz6ipCLi3$zLI*1-bWjX` z8le=nyrE6fTtGiy=K*sq%=hBritwTn)E5AMUH#;JpMzt3UTx*l)QXKQY}ic8fT=~+ zv}|*Z`bj>HXJpQU)?iV$03)Y<&F(ICd5wxLfi{^EZGtu@=LrNlBGMRglvATCa`@

)2f&+zejJVG9giK*z6#t%Mi11)5}6YUCR0@{$bD_11w zP@X#@2w>=;Yd9Q=vXjybrX`3&n=}FfAGGYfJ|gfPFatv$yf4P92N0M?w-TJ@KZ)aM z{3#q$^ZA2U^OK7Rcf{)O0 z8L&^v*m&yX372=E8UNCY&v_d~2J*-wr_|?Hd>)22VUeU=eFK3ebocYmKjpHK(a{Mn z53T;;gG1_1J@({Nr|szBLr%BMiZ+3-Vdo5e3|Y(PKldp+a`>S4LFgnFfRUTP1f}=T z;AxkZ+H9`cYO5uU|B)Uk>Y8F3^96lWW8eIY`b*VjM4PPYy^rmYjZ+ka-kuR(J~3~P z^{iXh#)`Es&)L9Wucx!vf(9vzvyIm_Iv*EAd%))>2VH}}by49f^JW7b;hxQ|f4^Lv z=JPgAKbvrlPv8T1bjed4)binnd(m@z#})H?EW;PF01`=y@suC!Twp=;>qA}a#7sid zq_m})6p>LySh_9(mWEd@FWGC0L50~@FhU>;LtJmLm%?!&&UW@@c^knWF!zwWOsGsp zxZt!=%QOq`F+f~YH1mJ?qzLxu3H6y)J34Z}?*-8{JrivG(ebcj!y`bjaj3$Y-WM&8 z;o)I1>T`bZO&SEdx-^k1h+VJ|byl|i+_*93E00t@<&g9E(Zl-Pu*sDW*dv^q6=N{RYJ(bs;@A>Bq`8v=4%imYilRQOt(O( zK%^xa1L6=nf$u?6*gH^thgQ%W>bpgKPLFMIafZ&NZ;`bru+rRB40cT$ZTe=ALtsyI za0pv5{mzU72-`Sx1c9k9CJ2oIZ?^8!_7P^mpwpIt6UPtvmbb)^r1B>wX1t6M^);B0 zW-kJ2PDC^s8EE@WP0y*Uew!`zT6sgvyDIWzZ`C^0?#Y|#^{Uz*5Pp=m0XJp5j}_KWuIwE&jaxb23#6f@Y()G?#r#MuDVuRe_yut;i6BvvUhJzqqJWY>gp^Y4PzLW@c(?R_(v+nsAJToQ{h*BX-sB zEWXWIj7wi{uWxZZO{|U%_l{hV1qXU-G_OZQ}m%<4vh@CAj+ZPWhfg> zR?31efKON{v{|8FjJ)^>Y_|5bR_*avJaaihc7&Q`y)R0VqYG=cq(*nRug%R)p=nD# zT%IPV(FlR&Ak0GMl%8{PLHtDju@Az0|7S|7c zx<>z5yfN&*Ay5bOC75=$i~?!S1_)y03C(Su&*yhJltMTmerQnRlU{2;z0Oej&)3f49%TAXdb6Iw?T`hKSSkF?$bc^`axj9#2gLdE0d;l;;o|`ZFILu-v z+lLNXHm=_(a6il$b`;m`-LseM<)@GP zV$tPGH|)9RPRCr~Igy*(3GjUw2j%&E#Gz34H0VKj)=dxx+xq4iBD5L6WBMUZI1`Er zJdJov&qJmt6oK?CPxN2xTNLjbl)BQ66J(z|6PgNKFv=gk@Ytg|bEw-6^>y5_)*>Hw zY;M`!9$VDJA63rvVEV0lsm2%H3!qV6ov+&8Is>y1k?DQo{dkUmsnvrAv&SKjOLItx z!lxvmC<~|!l!|k|ls)DMsazZL<=;(Ln*21MD=G zHHe4>vYw$q8|o;kLv7g0BX`c&qouL7FeBo0*^V6@_Cf8(KY81pedf_Rq3L(j`FT#h zH@8Z!#Pcy2-uIyQsC|{qQ2S){xjeSTg^g)jWZRU`EFZXQYU>=z^>KagBskp)e)!|J zoVa`J5fNkhjxg3RoN4u(?e+{H5QEq*y?Sj_%*vp*U~G`Gy3X}J$sOcm!*H0+^z6I~ zSC1S%-~y;Lz%_klRoc7fuela0iwN`9W#iQ@t5ic{9n?FlEY90nvCXbudqP4tMwPSHxDEM%nTG-3Q_xBDyKXrbDSxthxBU%L5UK!r~2hhFK>_+-K!7#97JZpqD;a~+b)A(cy9o$XtX-8 z)!3*df@zW~3t*q_!`F>OIQhd}p|7#I$u!mc7u4=u#_ z4m5Q4`x4@(X$qUuYLTt3Ys}sxOAT^~TjfK51MQDp*pD2F$SnXt<=EJiLRD8@V21&_ zP*#@FT0-f711!b)3ZPA`tQ){g@UPPH9ya3feD!)&AVZ#Or%hprcu)+Q=XOd~>q|rr~qvuzk z399xYN>IWjN4rnXaSG()&?^&jD|T*j&8nTf-d6L%P8JL1RyOP*v2c&7D$;e?wtD5K zZ$i5-i7qJ$2VLlSVqRSSe)2Lrkonn90Nx9}V_xO6XxJy(2qg~6Wd|9Hyzq+9CYX!z zxnBjKt&ZZ!!Qrs84}9h_I-<6)%R&x^+MPUp(7$8CGtLA$Cb}5T%8YrOKB-Gj_!!r_ zB%ISGd0g~?6z3iUH8A2ytS9(<&@LQ{G+xG&LqEP%b$2(23l(WCs_Lw?@d5}M?3xdGN47tg|u55WXp$|ht(Ji?}Yy95?x*a`EO9;t6U z>{JdNAmLanKWKq}W`F%1taY5DBP z53{%+dm`Et<>aqVxCAl$Qvaf1Q=54{FEqXV_WTGG;|*7N``U~4>BkOOUxy0H-D|hN zwY@6i?!@^g3E@!3 zxinluS#{|Nn&Bd#MFwGl5RBCXIz2ws)vYv`fdw%rtPZUem4J$IWyz|mD^@Oc+Twaq zgj~VinyR`Q_Yu*GyXlNo?=c*x0l)B^{k@t|bMdf-O_7&7kSK z75wl8KSf=P(Dh2YEp3F8asi0&c~R!q%PqE6Ub3>uXKGP8d8WmbobIdIh=}&I>gJ4q zCLH(W60_lLQh53wVYUs9u9R$HEtE-~lrITQVNOQWrqN){w!kSJ;lScz#m1L|eVLhx z`F8#R^;7jg&qp55uXk`iyEZ&W!V%`4q~YV3)aNU>pe>5Q>Mngxv^Q{Qe)p)q_0!!I zPuI=Om&4%SqC~|3wrr$#3-J&Jk1(7qj%dpBEkX;5kOd-mJRnn&=g#FLn2Tl*a4~Pn zKs2JVB>nJx#?_wCdPe&d1{nqyyR58gvrW?5Rl4>r0b+&|dwnaXnBzRKEq`BNx)1LK z(Ek`;hD4wr?C@S05*+BDIeH@WTF2FeZ|828cdPV-cgW-F0pTNbNw3B|7?OVZBJ~`< zw1&1RbV=CaUMaL%RkVq%EV;(`QlY~ZH?V~s?1?ch4s5f1yBWCsZ4RjF>F{|A4LwXM zv0%hF0ibE+bD;(o%m6V?@;d3TOrCY~o83pS#lt%~ORHsSf^ulYHzWtxE-gWmMCfp6 z&}A{Av=QjmtpNHG?PvtyX!5a0$pRVMxY??Wxr)Rq%&nDtQEN&aX-soD+ZKm93vT<7 zZT8rK!~_t6ROlPVdKTRz+FYA6i~~xG z?U&tiwBLc)=fEX<>YNxox3ucdHm&-Z5nTe$#lkOrEYKbCV5aE2+?;cKyq~8Njt)Kp zq3MdgB{g`21zo*gt0K@z&?eoA!?&bs*f9c)$+mm6#(0W#*{r`f?N|mT*}b_~_DrL{5+M zpG$X~XYd4fjp=pHvo^u!96g&|BTo&5q7#I4`6+%kPCxmwfGiD18ZO3x6b@;%X9>94 z^RvjpZWp${_p}8!*dd&J(mI8|wp8-ng^cOdlKQR2ZcO`ZtgYH|OSi_kqE$3!y*(XF zbDfB`NO$76M|*L@4@iFap(D;?@g3Pgad>1XC=HTNj_2f1sOd_;G2TNLwux|I8+pFm z`^u#+(=5$hcwhbJaM{;%=Q!u}YB<^^*9Ke!)h&6$jFid=Kp1{e*oYD2(vNknxhw=_ z8P7*KnvAv;nr1if^w2{g2%bIMW&Iq>zDEGz#H4y-u99h(`ki(E{7ddNAn|8g5chx3 z;GJ0*j@k-0TlbIjwYu#$g`}ZI3NM55zOU7_lXEYt}YgY$MmjfHj&q_i9|l}j3LQzQA<>D4mO*sFiC~g zDo;=O@a13-g3wg;s+%q>t=QD`g5I^_hXPH`mR&1$RSpe|p*9u?RDNDiN?2tECM5_` z(=&kgxTn<|!#|AIya*QrrZ6GO>iPIGEJQGtf((apm0f^<{Xr%GUx8B^*SPOtCWC8w6k#EBz=7|bvpsI`!0V|OE_7LOr$35V7OzVs-;9U{)-?%y93=mq=;XsgDd*!tJD{3SA0@HnXuYf+zJc+jWg9K=wa&X$1 zx;C2ejH4_pRZFeb(bi&XOADI2)~%(Z)9nOf7G=B~=#plKM7aP(^husB!G1g%h|E1K ztR#XLTa**J>G*29jjgn};Fd!sITRG(=@SFGj|OQ3s0<%>I);4U5XbOFa9oy9%aO<9 z@!I)pDZCZF4kEH?S_H4w-1W?lou#VVT~C7Qyi34$M1v2zrOasuhX>szIzlPFb((MH zRtv6aH&w3M(#o1GiT0sCF)g-KSG^n-fjO)UVLD?wCMOW2LK7pr+X{Fd@*%XUXs(!E zS~m`0#a?fER&0rLm_(YN|6`gV5AZ)K?i>IbZ1I zUI~{EN5_^|=Qs2Wtt$AC=o9kroL=|(@=gP(tYu}!E-5zhF*U;Xa5_Z!$WI`IbGYa; zM?()_I&D?VO`=s3?+AEH&`ySJ)3LM#4o4-i zufJRLNsntj6W>ePgt2X6a>j1mnsk9F&oOdP4JlV1Ql9c*PG+^T=Hpdz$Wbt=54;z z=Lb2VaN}~51766doF0~YHzi(qav8& z!=)G6^kRDm530}61fadFHD2NN*sDIc*m0*JTk?_a&&J zYCWPJYF(w4BiDU0a8$(OQFD#B44UB*Y?B5qkH>~DS{#q`o3-b@Z-SIRT|+-ySzfhX z5rA8rNPb=fJngF3*5QYHu)UHKn}>VR_|rEQVF`nSHU}D}2)fV`#8d=r2?ix;tu}*p zwXa*N9e$X|hRRl<{($KjS$SguAL?px!`HMc80~e1VIE+V&~`!tGh;5?uNRo6ID|hM zglKaj$aH+ngFm-YwZnQ0Y>*AKR#l%QsBUK#ojE};i6$opt})TAVnFIPwz(D-$7}$_tUe^mz|-2Az^DlI;<|$-zH|ne`+`;3T!Gv z{L{CY@cC{qj4+kS)@=rH3=PA8#&3@i58)ICJWq64*dYewu>~K-Xkl^5x4XfZpdo}1 z1fhE}*j;x&{RFHaAKnFwj!t`*3VBsnw@5r`qYpzi|o--Y!SyH#oR?bHhzpRq-JYq9EDtf%`$&MOZGJF&=oM}x-) z4H|TsjY*En5<;LM>X66f&;cT%8GaKE*ebsOTppjaOdr7%MH5K*lY_3{`ye!hnP~(B z?Kf#-qAfU_q*Zet^ZBd@0_^s3peS4Vp>0`MWQ<4n$`Uo$x+_Ag>pfdsE7j=>Js)KS zTBGXxL!S1?yN!&F$>HSCDuwan-QC_h&lsPR=SBFsvVx}Qn&$9ysH5mb)i>$xR7b%V zL_gsGw29Er;``8N*F=**S3)CTCm-4~gA~kAArPl?fdb(_gT}DuO&7?+Jizsv0 z5!|Cuw+|mYWNjt3jug+p8&NH7yL2E#L%xugl5>B#v}R6On&Oj#=VEchPm_Ou{&=q| z3qfGYSi`%nXv|&|L;2D{%^fU^Y20B^x1~EA*u>$&%rVpIZznh;D*gfRF1JRfJ(d=8 zacI`FGh+BazviN#gv5dmyv=3t6?26SS7JkUa(%(<%%Hi6qUH6X3vyS)qvgNHedDN! zW_Y>K=%S~wyM}AXm+*3VJb!hN<;y{1UeA+*822egVfUGdK}E9*q5#doyo1=x3rsPhJhm(XvCuApOAJW4YNFZf z*`cbdzmGgRNwHsgeYw?{kc)F+%a;p-bSaw55XTx-te^=1LUwXt&Fy}S40O36 ze+XN&LJ*jumFy?Y3dey95P}Hv@8I1mpRIP-#CnIVwblft0RmIO_DTl9RkgKw z1f~$~!t;D=?ZhSx0xY)1lb36@6PUu#b3#7MjV}-}+{Jtln=mg&G=cTBaCk*{60Vz` zSrn7bN%S2e{#$LPQnD3es~OB$#kXz^>H^i0@`rL0qoE}4r-@mqF)a;o^2IQK5P{Fg zweExu?-Sm$EM}1LlYYu~DHKXd3zGrq?o&|2CE%F@gwtBnAuws;Kr<&CTqnjQ3RE+Q z!GOx9r-bl$%AV3{c}Qct54c;SlX~`6*Kp?kfhmas%##pwZ2M!I zCK}g`?}!%ilnAT%8JYrzn{Y*!230Q2*Y7^;!|edmHR!mX>NU5={2&3EW}LtagO9+J zcV$8KpvG0U_AZKGpue$2AHgw<2_1-qs=U@M0#g>_uxp9HD^Hg&$1ratfhj^Xv|Gn3 zEw)r`6{7<)6a-684vIEu4O%16C(tJMWq;K}H$Jz=Gh_%fL>=%(tEwGs#KB?398m>Cs$I`{J8JgK9!{+N2;K z&7Y3Kx*a>v6`3K-{b;Nf{Q-UAf;ims!=yzV&rNs5Aw0!*IxD8}%)H~u>Y5*Zg76PPF8w{fi0jU45j^!7;_fRS^kT4Q zo}*3VHq@9F7lK)-yfBf9*MF{Ag#dGNBi)c3_e*~Jnt|-PJn`+mDvAD+0oPrBeZ~ukvu|K^J&)n>}GrYX?9nyH8z@rg| z#~kmVNJCaZDihBO)xWMFobUqwPJVqX!P5hH8ovIH4N8FI}}4Dh=#__d1NoU7Q_{FV;Ori*j+D7LiP)ZCJo+^P-sb~$l}ppC(Xae#Ki#DT`*=-6~vJzokd=x7&? zPs})xj~2+4@g-X>imS+N%jadY`zerwq2N+I;DgtN{(NpzRP-grze&@hc%R4%Ou?;* zao{j17mx~{1g4}>f8^!8U;L-%0XGoHb)H+QMg^BY#^t$w1_@w#ss2swcNB3e29L$6w{_OgXewdsRE%ngpN zyEv5}y;@Q}yhE6oop%jWH0B!tEo5IPP+e~ajCqgrRqe69&<-nVgM5>H*oU0}4Dg9= z%gl>BNC4rFa1Y*z9O>r?}qDyW~ zE!vIgWxKi7X`MYiHqyJ9Heswl&;+wXpT&MXcCb^|MT3NeV(jxnmmq9lTmF3q8dsVP zEsm@GI5b3SK?QQ?+sA<|^VH{Lj@b@q>$C$F>yJW%Mm+wOPKC~?0r6eO*V_Esvde_; z$inHtPR-%+F|m`t=iWk#&1nrwNbURQma2xfIuSvkRL4G@&w_TV?f{nRn651PTAeX+}$g> ztWIF6ANS=*r@w?#@>9CXh+)zYl5&_9!$n39$gNb?o!;P-YXqF!gLdDgdAv&x*s`H? zRL4Xka7{&%8`muBMov$-Fg4L4kuH(L&+yTuXN6A91g79ABc^+qieO(A`oT1L^Uj&0 z#$wog_k@c;oQ2*5&>1kbE) zA09d2v_haw8t9Mcr|a|gNU*8w?LaS%pcY{>0{%Sk{Vy#PT{&hupiY-n_n1z2@n8^a zqXEtL*xkeI!yQADdd|x?XeX(yY=VYsxh|u#V>s_(LY-@tFLRr-Z*nNfK>t4TfC){} z_Qb3iN)e1PEZ8C=`s9(opIy~lLkFr%jajjO*fstUsIpstetA=fiN!S=7kzSlY{o9H z_gmjUpB?P3r%QqYOAwZ_$btNYe#;`Vs#R&wA)4PbHyrK`!qT*mOWJ+q^vvFr8(acv zny90AK|%T+A!BeEF2?<;m?sm8CKuCd`NO!!4FawPj*qx}eqHVU@tn{!@VP2mliH3n zO(_C$h6~8^6nOO_Wo+C^T$?Bth!^ z2BE`khSU)gG(_v-8M;Y43jURQS=x0WeYxfl6N7iU#^6F(!`= zwz>iAgwH!PkkKYZ6Bvh(8>Vxv&?)8>y(hIF^%G7W9A9E}t?GhP26TvM(itfbs-ej| zH#={=qT~^_U%Ni;&x6(=eVajv$pgD{y&?cP)!nyytDhs79CHGIbKz-Qt22{< zSqVfyeu(z4$7@J%eD~l-T=X5lM+8g{a|z4{j4cF>XO3R-GqfWKM}&u?p8`7swAWy` z=BnyUy4LN(3U+f+K0;Ia&{f*f?kflS z(P#6*(gfIkX56AbBXqbgfpI$q6NGWwgMtvK$JOFF)E&la7!Tz#@NGMa!LB%T3F9DI zG)d@3*7eGYEzixmfNrp>H8a0JT5>Rx9B2wn;%x^3_)5`c*F-<8m2A0Ma{8UQp2b|s zKGhp`f)Iu-1$^$&JY238ZDzh~?V@VhTT8x3i=YjyQUr?3H9?bg!+QI=-G(X)kGOWx zB-o-`F0`o)2Rf&qc^^m$CVT^7yJg83w_k<+Je+N4GG!Tl<#|FUnHU-#!& zRh=)(UlQ{Gjez4?%G=iIIVg*5|IkADMcnkv?yEfNnysou)gd_j`wzaqm)|#sbJsAL zt9;KB0p1aM#1DO2sra|5oBtK|XvBG&Na0*Y56VR^3xJ0K z4~JNmSC9|y1Q5=!Ym069&=}VigM!TE`J#Z zb$a)3H*$)`YeU12p z)_5;Abr@8iMLk2&WLJVZZ$Is2__qe6592rC;ML=T^VY5(d{P`@9PqZB zu1Pr>(gQwW6jCtX{uu|SmaF!{aKVNu>%w`_A`%Xb+z{sR`!x9Kc(*=KaC2!{;v< zUo`*1dj(@lVJkYu{~tJ^DMCzjMm{`s2cgB*YzRvx%H`P^o3D!S+vv8B9x^{+{OnlS z<|e0Xp?%PvJKSbR`&#YrK&KrS(~{q^-w1Ebasq$8iPnH?(3E)(KHqx}dZA|TL|0{96vDYzgF7o=ID~vdts=;) z6|5cO z2?Ts=wjOZE!1UCt71t|{W1BkL?jdYfeH`JCf>pPP%hqeQ?zgwK`&Oqm5%^PU?KWL) z4=3VBNbg_g6C@DhgfpLjKOJvP44>Ft2U15BNu1$R4v zDcgClDfd`k)wP}4^_gMxr@c>wwz3cVa64dJXJPX}I|K@#FVLp|1Z#{*%p)woVcT?N zalu+ON!-5KnU`5W)eG3p(WEeAo73RkXFn!6-1r^^`aS zDbggkwhcR=Z{A(i>|9y2E)f^lwN3L7f*dsHup^DuC_7yi<;v@tH{%=%q{l!xfCCa~ z574X#ln~mXg-S!>dt;xS!x^#pJ9jgF%{6ZS=5Ebfkt0kTv7X<_mlY%-0B9(6c#+Wj=azl z2+Vvg*AMSUI&(HAC$L@53HqE=5AA@!6#Am2r7h4B%+&}rBdvm9(-(VHt{Vm6e(qT4 z4F^f_4C`Vlp-uAIrfZ~&&VVk#Q7*z)o-NQOt2O#$InXB1FKfyi?5WlkbP?u;_mI=; z0wJuI29c#vYk8=TLznRV*r~(?710#zYJw(l`b6&!pNkOOX$Jj7kKe2~$3+J~&rDCx zhn*;HTfNU0khA>q-Fc+m4`mY$h!}N9Y1;v|TCd+2cVYkZYRP6xy-t(hpw-cm-;TC` z#++Wk2EX}kGZy2ZO`!YH@b~S&x1nwJVP~)-S;ZE4nq3Rd@%-o09ao<}<;|{XfX4Jj zcROILp&el}nZ>XN2^h1W@tI?&3iv@5q7Zx%=M0IJg*lsAZ}UTmUmnqXCYJA=(XuU0 zPTE@UL3?4O)eZ?cGSF$qM7uTGU{63jVp2w4Q%G`?`x1PN-VBW0`ILre7RL`tGPK9& z6y`6)BgDJ_9A*jw;a(B4assgHlyo$uF$V;V5acGou6m$Lg5TW|4uV1v%#}G+){cdy z8_Z||&!;?F2~E*3otm5y<2h}YE?>1@{n9ThJY_d;-m=FZe=O$O8eG#<6A=%Hkk(ai z1v}}`y9Ew`;*f=h)%mv)2;Q%NcGRdQR0aZsKx_j_LQ~-4r5k4bhukQ9cV*5-M>Qdf zD4i~J+Y86L?csrv^>>!6m&UV=z?4;gG+G%19weyibU6t4T4Fw5LsDHlq3g<3xE>#3 zTa}riV*tjavbba~912^&L31tN7;OWX6b1uaZ)cltLqy}z4`P~Ibd5TMQ#U8(ZK~QS z!aWeLeCp)#gAHv7pgl3Du{9qJ5`?udDKIsfV;s1O0~l5|#0+RcS!f%u^4zTTc5@PW zw=*bg{U7Y_wXSG5-~ZA8r*bYV6l_872zarv>=bV1^Zc2gIgKM?7)q_}R?#~`Xddb; zT6cR8953lvW@Z<4+pwC%`>D#D(PA+mX>8!reMI-$c)4or)m3L=*m|}ohMofz&|T-G z+Qss!YlD`T19P%2CJm;9dpKj_xFAgB8DJ*Bxwff@SA?C;lqfu}@(_T+ydjN-nMmg!H3~{lfy9|Z z+~(Wrs<*LndD+Kv7!2A?_|~CFJ~s!q&<;6Jfm5(4w^QvEfhiLf8B=}_$9VV&K0)vy z8W1t+kkYmS%tCNlKHD$nH(I>CR*D?vr8HGHF178gKs=xy6viS#n>ryj_GoL2k8biI zOriU*58DF$5{-6*?hm5Sl!b^{jjePi<}m0m1g6+qU#l$J?Ba@Tw02lk<0%?l<1Az- z&uUw@9UbVfCl0jOq3)6mbQIhkWHW&&z+weV&;tie#vw=5erj1_ARo`d0@_*z`Ls>p z5cA)duqh10z|!iv_1LOC+^bncV?W@Gpn^$&3SH78L|;d%_3I;|m5Oj^W_H15piShD zO)vTO^{VD?fUlX2|A6ktJEUodJF&Bh_JU9d#)o+%Ak<*-v8y1OLi4_FwU=wr zeV_^E_0E_-f<|Eh7a9cm1{%TRj)O)hI{m@*g@HMz7G7H$OEU15MFk4YLFuv@8NzuZ35K7Vax#Bk9E(l-_v6ujji%%2W4f6 ze{}&fPA>w@F+aB?x~=T_utiD%l#$UVx^Q)E&38jhPC=Wj`fex|^=pSil0RLiA0Wn) zpYXw_9R+-X?7AiZErqFwsp(l40$-b0wAF#5HYXYd+Jrh|fz9iB8(=YkcgGGThmx{8 z?81Byn9hhc*%z380IHlF)_UNGX11bruFTmj@v!sj;`v&8?WGf4cD%1- zy_(CQX9h)|I~zZ{H0J9Zk?rx3UiXDie6daJD#I~<>fbiIQDd}AN06h$zLP!Y{d1gEUfxZpGj z8WWT>;H(u&wz#}*vm5Q!QYqU?x$Ih$5P`!72I}k`yKNXvLvgX^FO9;;5;HRIu zXNrEpyCa-A#uXll601CPs>b8QY4gvPGtZD2-t7S|??H~=pM z!(bTEiiS84CZYhKslQ~a2MwMO<}}<8N7IxEXGKiPbhHQ8+Csgo`9UrSDXBYfm}Thf zYV$*w(CFbhpIH57!KL=+VZ59V1iyAoMAwG}XpPLP&tRJjrikZTD0JFFOP{T__gJ+p zn332G(C#6!=!b0cNE#dp?!!Lp3S86l0Tr5}8HEtbHS5%0SnWq^1!5IjrPpUGHosJ{ zso5nTtEbl6ZJ?*ao;=iU5A_vYD|IKp9EF)0G`t@eV7!jO1Rk&bn>+dH96uT_p+)>aNY^|hE_zfr z7WL<=?LN2W!7qz|;2i-HG_Nms>U#PQf>Rc-XfNCc4OQq>2Tc^rsfD(7&Cg~F3(J0( zWVN#FLN)jxo{70A!Tcf%Ym+`-jAPHVqLIE$#E-y>)lVuut1oc5aLQ9pmw0jza8|K- z*Jh^%+r2I{q5E78UBSXB^c}Pab0+4Nm}{U(oGuX_a|hM(lC2{Y70t!^Dy1xGVuGH4 zmMB3_i9W$30zyvc9j7-`hptHqT@vHaLtF!`!t;Tr4p&u2Wj(_Rv<}aiXcOoUz7>9= zPZC{%uX=|rfkxtcvykcnTHasI=@JhIdc`AvzAJHN_Jj(4epau|`v^^;L0EwG1EW-L zPLs5$oe2j%F~ZO!m~LV_KlCBO5$F=!+S;0%b8<~%4wvicwC=7zoA53f#2~1I_OJ(n zpW!1SM(c_Jpn;){ph++t!Sk5tk@0Gel?&=4J-b)&7UHM*F%$$9$iuG)vZ$GXkTEP6VE zQOay|#p1f=joLv_UWO*yErq5T(L@@5O2eT=^wg2&J!WBk!T$Nb_}BJ#{`TK;fhmVV z{pN3f#r~te`*-Xg{#XClKJ%GR#+=RJjT>`5aivb|mE{!>UV1M9p(%vc6L%prW&0O~ zdf%7~HpuR@oc96{nm)=l(T-sAl6f9DKL_C=!l)#IucghFN?rEM(QZ36(BihmQoh>( zTRW!o?o7b3rQF}3muU7Ln>v0jQ$tdgmhf3pE}So~Ep76_EV;nfbB?sZ@mcl^6#~}C}MPe&dLi*)>Raluj^g2 zL=LSEG)4)#=BLKF6>D=lY?P6(ek~x(D0<@7~{cbJoXr&5D>uN(%u-e+3v>ua4;nZLfO(tTMLs8 zc?*V#2EIA%uuV)1_CtGNM!Gvae;EJ$3G@>KDGnr5#5?419u0^Xbx3J^KThU{IpLJc z(XlDlC|d6xviV|{ZIt3^$mxO|0>fsDsIGQ+MqNt(*y&ih5BrdSW``i?Znx({l%LaF ze{n9vS=hQ4fPT^28pgZ+wqR4<$8N!b##6NDD%Fy$wzS)Nd$%1K?6N0^TkL3$`W6zP z+W-PHG)yT60quQxxKji85S+&22=%xy*Ez&MO3&~>KAsEv`0oM!LnPtcb9{uY!h$r% zR5bt0>05TRmaL}*jlFeWuw`5(ow>^Ma!qtJd|%jYZ?}r({mJzXTP%nMsA?W<$PeVh zjMNCpi6_A+hdN?Lh#?qz?`V#&GsL&*1I$@1t(s3;ZK=@ieXg&tV#C7&E;yWhHD|J?COo4Our$&p`kNds!1YyL}!NBb~PUp=FEUmaXI2`?w1W zvMk0{W~QxBDO(q8wP*)~rPvNfGt&jTDtu*S#g-IbDYpAu?sSQ+cSl>N%tDK|{dt6? zY)OYcQB9yR+S1mpEYN#Jx2ewahLiKvC!tHANrYq(kliqB^+$LL-NB;nnx1!A8KGaG zQ;Mn&7eFh$pb4+4x+hBu}sKGdGqWVT~$_e%4L6fvgZ5FzuM-CgNlo9R| zAn>W-UXJG{hEqICBN~x;91!s8H=_B1R%<0_m`=^u$jFeDI(zKOO1l-?cfXhma0MFH z(3w=H(76z7vsfO3Q`a7chRMIf42F zpZtJ}5XZW7?}RUiIiArB`?$U_i?d_n({5_T=OQ`go=`r@gJFCAj)kUqa6(FXT;oc4 zwi242I(5?K7Z&V)_^1Ee{^#HRioO2ETlU}lr1np`7XxR<-ciKpQ zyA5|0UE6ji&(5Jwqo|fIhplhEO(>?_*Ff`*!33e>03qPNxlFb6fUb+Du>36Ofyk0X zWD3XVHrElz;p7Uf?KZpKW={;YSZe|MmaEp)8Hg&bNiGcnd3SYz!8_OtgL!p)EEmU5 z9>+JPX@JWE46rk%BDAlI$3UAIhImC23`BRz?pl~)qSgwn*0Zr>)m65$2SFfO0OKny zHnCE)>GFn6Ev;LnYsl6+`>brOF0^FJ9cA$h5b+R!$GfYprG$wMY|F5tjW$o1lk#Dn z{TXy2j0#~6H#?$N>E(XyFaxnuMh@H7mUS~R15wwPFZZHhslaLgjyc(6A30c*1RyfU813Po- z281nKpd13!m30-Qa9~dKZtBzc%x2?5+s8*jT3#Htv1}(F50Bi z4}!w}9@-wa189=V3q{}gLKxer_w4~sIq>nfHV8Y^a3LX|Cwd;(aoGKU_4y$0$DbJ8 zGMw^@0I?0tiz|gT>+5Q>!Io9m=IiO{_OUh0J;5<2<>P1`-xM7IZOQn}_Y=D2V!-n& zn677vOhYz!;*7xvPBBfzc6#U%cEvEaBfLz&PK`=YbN=e8^=&M~va8OsY!usUe7R&3 zVsdB7>%nAC_plYa`~09XG+ce2m*bw$7@ei6J=_y)xx#p-Eq~A^_y|v-X9C?71g2<& zqP02PQMDuLtg97F+l1Xi&<$;E5a(eh3eSs{Cc<9oi|dn}Q5S|5T5JQ_L}7&2*d6U@ zV*!wQXqIIW zIc|(deK^r3m_C56Sy^3k+C)V<&F8dc(L}%S6F+|X z#ZT>_h7GvHNAe4kjwUKvq|hcseMEeOq#Rm`oqb=#^()f#1frj%2qF$lNUOy?Eykgj z*#eA`fu}{h3rr_xRTovKO@d}?muQn-tEfUbr1ee&rT{bvH={l5(`Gp-O-f*G9V32XoH^zEgxt zujaGiz79Ji`UDdNXxn1Ka64ceeOK=af9rA+IZR?a2*7yV2sK;?_-{U+!bH9GH3>W9 z!mhlj4-n$`qCEv4o{ z(?WTUb5E~d&0wp5>#N+GS!TVQ1!38c+BzJ0VkgRC;#bx;iu?h&lIiG zv+thsv@d_@i|#kVZ~o-EOMh9-WrFY%^Z`BWopkc;;QUNgL`>EG>SK2|kzm(zMLh$8 z2;=j6{FwI)@SbO9YpazH3dAN}2LV@0$mhu?H4DdRc1!J7OA;LU+$V3ykDo7t z^b{wbZtvv;T)eO2(lemh5%R&b;4@~D7I3wA@EQAKn3sxScPWmS^RF)!>_)k07iO#0 zuZa<(?ftFmHW~${2Z!s;LXiIohsKC`RdwAF@F~WYs@B(DaKZhZma`B0Fro48$$_AS zc{hNti1EIUg8`#9=Yt5mBU&rWHxCqO5NRAoJRX0tv=~Tf8D5|%AO>>yT-fP+_uZ@c z@u$uQn&7x5g$W>(n-$G)pmoh2ZJ8IU>SJyO`TRM+1~lK1`7;lU>ke4}2oVnJ0Q%Z= zorh}Kme^*d5#4=TVJVa?V32DOI%o* zobDIQ2Z=6G`E0pI7z<_N0#Q|-9!+7MF*r0!*4Bj>-)RLvkFcAO9bFSEj=CeDt+B0|Ibg5(=zZ88()hX~xJ}-jmX(_s z_7v2uUC`Mhdg99uMdTd-<2yTH7_ShTvbgjh0%JRJlXvFASo$DAv!)nuwS;`0d{PQ$ z$tj$}ZK6x!PotlC{4lnqG(p|{vv9#K&u`f0j+)Kgx^5$fhTKkd4Qk_KSNn=}c6OQX zj3~8eKG2*ezFSklE+PLU+W?b1TBc~1B0&A${k{LAJ%0Kz`^LAv6LU0y9hSWpFx-i- z^X?}Qv^gK@4ITeMo{z4n^Y05x(@*eH8ooP^M7;YJLaOrGEVu4n?n3#z0|YKMULdlwJSo2%&EB`> zuNCc;akJ|S=2{}8rE+@_xR&Sbz+kW2GF@ruwyWhxIhyP5Z*b|o!;I3@NKaPj23B^M$lf=NA&z?#lobm za-BL0_Do%Ps3LIJXNXRV-2T)iN5R4rsv_gDtbnI-p`-c(?S>`o9Bi} zgSkRr>~V$teY_r0y@dKyk~^V8+ev8|F8X>^{Or4>aQc28$ot`YdRSftDISq{Fx@c3 zm?lAMl;=Uv4%6}OwP|}}N^P*GCNOn^M)_GpfT4*+-7#=I3@UANANJvHfZZ#jOEGeX zfbjlQ?}IHc1rT~Y=mJy1X&mGyOH&|+uE(cH!bcq8Fs_ENHM#t_+|SFX+G&@TTJ1(zbGEBfiZ*F&cf0@0@z6t$i7q+Q zU$y5&n>;T6kmw8Ol_W6Do6t~}nok{~p@~8X z&%$%F;|7gY!bxE2^`io)|BC9fUpHfCnbRf8leswmdtLK>rIKx^+_EYYdckQE=m+Qs zq>4x?+gq$4x1q^xRrJV;8Uu7mMXd=Mq^(;ouJjen@a5{daJo+POwnl??8mlPRrJc5 zio&hyn>by9Q+q@(4c!rFlh}TEMmfH*(o_Cf1x@eTU5tstJJBtfE=RUl@uqz=odAG?=S;=h&%CYHhFMy$-r#&qA z+zl`$AL*+4;g1ihz!YHYKyLD&b-QNcNWg^ze)D;Je2nqBw1`i*;4@Bzv8pbu!O_Zb z$UKq{-pA_(pK(5!dP#IbcOe}9*wNA9@h~?OJe=HCu&eF)2qZQ%LqBzNXI6k=PSG;` z&;G$bvfub8|D6j`Ibr{ozVM4NM?JiGbI!MJ)NRiPb}&%v7Em!~m6lT3y0*u~KQM4< zzThh8_?mYg7@z|+LcoQDTyV=Ukd-4pL(^A+m*G;r?R*b5_yHdx`Md}|ISgQ6eZl%g zu(mm|6}DpsB9J~E@}>a<8?>zOK~O5{E(KEFWLwH1;+W(XDpfzFpVfCyBF#fejA2&y z5mvdtD&iAxLhYg`*atBk=B8Liv(&2yD5|_4^>r=W5pMviiCXT!#(LK*7h+Yb$aj|~|k&8)ZimQA(@kCuzBNlgB`1-b={(Zg!9tuX2O_WQ68cLHcHVUH1kKMO?r z&>S!i!~zLh@gD@+r5P|b#~={K=jtM)W1ul_y-%nf zhk&NLrD{i7%2r%ov%dab$NSW&@04g0k4J~8pj&7k5s&2%Na>klu+PQO++@M8UGu4; zSy~J#>@$SZ8_e1Ct1jgQOS-47a)9HSwfFSek?x{z-}fCR8qf0p%{3?5WT-8i6M%^c z?3E(y1hV_aX9)LC@0ok&Tpc7_!s8%u*O{7GbX%nh8|^l&dCch& zT@-vdJtOZ)ykF1f3!Mr(ZK8Zmli&#JUbsYqKyzUIlr8rxz6LzBN7X7Su&i$h?ZMW2 z7H-3~eWlB-McRaCZDm_~YfGd}Fd3kCQ#pYa(T|+tJdPh}6GgpF@a4h}5WlSh7lmIB z#h-u`s4Txlh&{M^PHG1gn(~D zy?3c@pc7c^t+aO8g0=g%gWp2HIxhaS_TG06e1DW4#8q1dQu}>)U%}hRZeR!by2T=gTg7Am6LGp>&M%) zT=KVYT$9Sk`;L!cAoF7wf&ZKsz9SlKS)f8_8p@MX1}`JJj<#JM1eFJW8Ra3Ji*_nB z1rU@zar#mFFaObhZD0N4uiJn0cmK8>I4~4b>j9xD+fv^Tp(((&jcW^L&+2g$+=m9> zAc@zfAc_jURavdzfdD#0BLrMX$OSir$wyPckLX%?3V0q52S24X^XtMM2!4o%4(#YW zK8866sa+3pu(jgtn9fZ9e^=m;kV@dTp@laZArM}b*9cOS>g6Fux(mk^3Vc%^*l zIuAx1vOok@zQsE}kAni7Ry)2@ayxY}9JA5xT*?BFA6r`htB@#hW@QL?4eAzlWJ8gEY#W>W#uMr-BX{NoP>&e?n z<>((qBnV3hM@B{XAn;T@sQ%EtsEQfEzSpWQs=`oY%n8Chgr-5`wbU-Aqm6?b2bZ?88ogah7or?K=dg5a0Vy1L}poduure z+J3GDruvD|x-jEk2t=Iwn`w%G-`a1?@4P}?yypBGId*6uusc**wpC4t?CJpTb4||q zJgjer&z5y;@TNSetSlV7`ZNU@?lm2{WAOKMf-yaXfi!RUmg*QM$>XI~D|4`uaLM-R zT+a3>z_T&VvyC2m>OgkC_=BJBU3=e9@BY3Km%@2^B#SeDRMzA;K&!*%7nf~eX~pRa z970_V0fqk9P~7PecOeYzk?0ZVG2&r6em!j>lHRpSopy+{h}%^ceL|RvNh2RZ(q$FS zVr@%%s|!|JM58zz;62Q=ID7=@4ZJv6CU0(dkr4=101Txd-ZB98GJlRwy49$zlnWE7Zk z4OxnNNsP&;0@*W*MxQ) z++F}}`F4NwTiWx}LyG0@zwb1*seaDR7JbJXBL;Gl2j!1}I{%jj?(8?04kpDtOi1;! zDeQg-@{^7KP5d+;QVyGyEmmWk(+WByHHTxa`T2u-nR z>b}xMZVlK$$Ke%akt0#hKbX$riTHcbI4Z#+&^M>SEs2e-Jd;mzry&1!IDd(VRc zbcQ^5wDyw^ZVG4D=6nyjADD>{mh(t+zb+j85D$oitM_Zn3IW-jiL#oh`?Pre5QSwxn?PNiVL(GZd+#6x3GY+Z? z4s{|7r3{0@_P2_rScIf#ox1Q;c(%JCC}pdDIAlTZB0S6rTipsRXeR`Xj$qJB*Q!|V z;mk?qR6+Ri+?Vspm2)8}I1=UXJ)iJo@k}A$7%ug=2eKqVNb{@0zv3a)!!ho8a2~JW z38ZlFV?2gEJ@ffViNWLN%3{$4rZ9oLL&66>&SL>5AP<_uPY!5KYTK~c*;!kdTU6bJ z(|_*%M+c7|8pi1V6l57o|VCMz4h^M}JIgRqoqatpe0EcQZIVLm8qZ4dMbb099!CRL|P^jw5RTi}qZAvj%8 znP{A{isN)l3`2|fR(m}aG)oeqQU>%4+N$I)MB2n1<#SJknbZRfLRgOXOY=Kncd@=e z0R)uCvp7VWAw--`sG~JfUc&qlNqEOKhJ*7wo6;yDK+1>nxc|hw$qB{o7R>%ksSRQK z*0aSQ@<0cB*i(WA6m8|DgJwOYbz7dBwWYZ^tG0>=j{NYQ0Cl*mZ;v9v!R~_7Cj0Qg z0PSekkQ&tvAhg+fx7R?CDCwYW3g2@$E*|Ye0LJh)ri-qqQAzX50|1O8c?j_uGM`Sc zG46gANO=Mx;qg7#%#Y#5yancXM+E2Tb$*R@!RPy6*5=HC78@O#@m(+(J(B$Bx;u6& zH1)d%NH3R!rcWI14TJt30z!$mZ_U?)rYb)ZnhM^F0RTwarWoW_a33PD?G0@XzO(3~ z2Lf_U+QFl>pStvf&Lul!c{0DgQv#kR##8<*9Y2QMk4X3Pct?k_6F&KLXub(Hz)tlQ zZFXi(1a+tSO)2a6l##;8@lCPsn9{R*Hipx^^5G^v4n~A-gYz_ncs9DLml+}CFSs!4 z#$tGW7?61}OFT~=ru1He8iJD0)XRy!XN`Usw*o%BQxceZyy5**eI(|BE&6i{Wgi$3 zmf~9cbk|mAuIATEdcR;p%&(OLpENo+jG?n2=0X9OoF$FMYt!*2?^#~2dB0S%9uO;K-^s|Pr|X= z4DAWpq2p2-ehh@L>R#^$)6l;*Z&TBAe(1(XUz@EI+f|=@fIEY^6?2Arq%+hx1k*n3 z!`%SmBic#``O(V1-6^dKhVO)p__cJgC#~|S0_>*5Ngum|(F=mX5zX>l_FVVVjwe?sTeX-8!=gM=Gs4?6?=UK?@?C7-Cwl-^PZ+FKbP|!_FYobf4 zk>2APuGM(K^}M&+9aJLrT3G<*bbbVwR+eQ@C_;=BStoS)h?j>+&TAM`En;CVqLKL$cL zv{eoo8{Am1<=H9g5nu z&E1^>SJIBK&-?V&I&eRCz*vr{jS2O$R*j!`QN{NZ`1qBB5U(Ng>G|xLTcO^6hN1lO>qV;ho$sWRu=|#IXyJDOSjaC{h?)?y&qHW5y2qrC7j~|qVezyQ& zhOMw#E4aTQ*PI&zgJo6L2X@mRA8fBMG3g>tfvTO~UTSKt3MA0q6N+8XY+K zsZ-O@(dIZbk8i zuULtF`+{|G1b#xT!f1lRI22ri6yd1uuc0g)(gZUClMPkeakPoZ%quF5rm!4> zUkV53h%6kVA?$t*zbP!2&(kcN;RwXITwNr(&X!ZF;Tb0+>4i1g0Fyak{^1ZMq>sS=!4!?8Dsx4E+q+rmg$-!}7pb zj4%QXE*~TAchLLfhYSzLpA4VNlOLmA!&Ms7?!#wIvV{{77t9{?lSPVVDwf;P~c%My9<>cc)GoK*ZmMmalcNC3n zgtD5FJ&nmRX3wtE)Zki}XlSxaVF7^`>Cpka*P_oap-ji?C-0~FOV3fOpBg@^1LiFG z2+S}GG>wh*@~R6=eF0eSTPk5TK=g&~4Xxw{SBlp=@aJ1=(8}3aI~x&qfv^G6nX~JLI_VW9|R2pU4oEw zQS&N3TlAp=+c-E%`GQlq(K)RmN1MoK6OZHPA|4i~tU3@rWy|P>fZm+uKGAx7@ayq< zm4I_Repv7YJdE!V;xQbe{tGUpsS2%ApAB#`5BjHF(I&C84u2(7x;P41H$<1N+SF=` zt+)5sV+{Iw02Ybv1Q75;uf8x`^#xt}**<*m;O*~jz#HG)f6LH6cJKcG?EP7fWJ$8; ziK%a9zQ>Y#Ro%L^+@;sc!EiW3U`Px|f&jq>0t5&QFb{+I4D}Vsm*xYT=x%g#rf=O^ zva&KGGB#grb9dwa_ZJm4H4Bf-$gGIW@JthTF%cEjqeqXPqpBiuRP~^j4D^6w8_~c1 zlMyj! zFN;7gS65ppV`Su&<1pV$8Qx6F{>GKJ4`uxISiFMw4#H`=E!&$3Xw*cG9`;X_P{IAxtO&j2d;7$ALo|AVG zXed26xcF)DooJb_lrSs}xA7rZ@RhFe1cQ&jB3zNbPEMn>!w*VWd^YBYmpZNI_G&aL z)9t--b~7lSUX*emWu86XyzkqX4kBixJ|4$xyvz^eWSL*X)iO&FzMf3HRDBmkn+`~F zei{|xq?&3Fr2`^ts5HWASj35=yKC{ZvmsO}GAHX-$c^2qWzwv6Bd zOte*weI#X&y(%9o?%DIRGPxX;vHB>C557Koa(dxCOZngvMhRb`1?f=v&;or9U#q2a z#fh7aQS#<%`zW8(UCND0$QNkYHxmbIks;$HYBDNfW+?^=vouul>O8f>6y*Ap@1^P% zV}zNd%p~Qj`4}r#N`oVaKv*Dkek-@x{Q`KT`szT^COp0Lp~j!oA+vE9W;`{?HhR0s6XoBjPCKv-E4mO}bz7lGIID&BPw)acm$b>cb7m zv!gfCOJ?J7nQdw;SD3bvaR&N+5%dYh_WbIz&tWE$>bNT71(=spYp@{CmRAMFF8X=W zv!xgDI1bQf_yFefam@7O86}Rk%M0tr7uV%fI>_WwddO&6MndSx*`;6NUS3GY65=Gq zP-8j%SOsPU3wwk%y+h@rZn!RJeg)qSRTUT+TLm$*bW=LXo>!=VtZoUt1oVd{r2)l? z7cle^Uhwh)7aap#1ji_YrgabNGF#S7yj76oq&=HS8&Q4f^2^AM)>xjuRdtilJyadS zaF|khm8HsjH5NG#Q2Drng6=+8qIe%-th|1V{ME=_4{?lTRo;%N@-7b_Thjx#=_dSS zdZ!}|d`(CH%@$Pj-K?5=Pr5AoQ=@nC%=m>ai3OAoN7RPy{pHqy>Tt9C^9PbE4f{5K zQ{Y+0M)-&K=H;)C;)MaT^VjfhKs$8M=yJZEZCZibz*xga4RcG5 zy9{ldtPtT4cI-=hJ5Ds?LLL#22=f!XY2|ylW#$*UiH11S)J=j9xpfltnV_Ae5<0FT z$GF{1MrC97u$*6Sm*1a8|IGM_KEfnQd<;K-cwGjA!P4^l*LIrLqP0RYkbm~<++VCb z+#RR^eY-}B6M}sH%|AUUr(v`Xt3ZS4 z!NJ8(i|<5@Uy@at3+#?%cGQQ5oRC~~8oFlUhMDBmsR$sU$;&MIm+F0J@(*%X-iSCio zUR=x2P&hyMgkeG&mgwVP#VEm;!GVe?b#i@WM=Kv*VA&gJBS$hm3`K>eL4qN&z*-0T z2W+sI=Pm?YfcU%tP^FFJ3#!wQD#FBfe8knX8Q<}aPgIdj$szt1Xraz+X>J=!m*O0*dV+;PTii-m zU1Z4gV_6GV*-|)kjy~L+r3$1h)2Mq_x62;gJLU9ht31^h&652bv(Z&NTUdQ=pD(;$ zTq>|B{!sn;2kM_wA3-a?s=A8l!&5MOEP!%Y2j)9^6vh zZ%Z#=Ohq?A?+67Z9GU1P;Rq#8`AK%IC|>f0!&KK=brW6&bI~|VeespflsBtj&PY%8 zN=tfl6Dn$|GP2zf4+GbUe&h<)f9fhx2UKzJ^}qjF(C$7US=BE>=IEt3?9<>Y?c*y? z^$_}AJL5m7PN9s5J;6XBbjHGs((I}9;$Z0bM6H3Z=f8^AZ8CzR$2Y@Fr1yQ z>og@#+7lYzKfBL%LE$jPfr`WQ+s;^B!`lPy`5OU0kSq9>fwqF*ggqiZ;RVtf+?Hwc zOj5ebkYi{`-9Cs-WXaZ!S=gWKg-KoK1PWz;o@qu{L7DD-qREx>BeY0ox@yXl+UipXmnZr z-Nm6!SkGDu&c~pbWeQ$jU)#BQ%`7w>7jiCyiiu+Y=OO4jh8TQ=YH>J6nc>BrN6h@% z%2}pDmgcwPNZ;l0Hh{Oae>$I+|LN~F&})!iL%{#*i_O=bf%VP-k8ouZ;*kt#eLN$y z!Y|2MSna?x!VCE=d<_R*8+ns2!cO1PEzpg;MrJq?im&N`1&x+Rn3ht-0SaUog`1A# zV<}~Pnch0E4#44rvCx_vsGqabb35e@_jlcS{L|THd~v*{HP!>7ZLi3>aFanC0OFY7 z0#KqGFI4y90U8-$t`*}8M_CwH5ixo4s5~qC<$wEE`{n*X9ib`>$1oi!Y5w%tlXCCg zaoHK{*l8RyH)PzLkIKd6wCo+=mDmc0GN@ze7t}3U@oZnmSNKX68naR;hm8_lM9ks{ zYKNwH43p=hQP~-)e-k3RRNqOOZIy#c_t*8EhmH}3fgzsD5-_D*2YmjX?!&sjfDa(Ux$t<4Kbgnd5YA@Y~{f7EtmBdN@GrB!?A& zO%!3t#UqEeT-Ud-tuR`3j^rhWS207bF!yy+Kgjv`4RIk`P>F*Vdh9T*aw;anV*i)Z z_>#UZ!(ju*R2JZwc|4kz|NY1F^2=ik-co*h8ph1m0r&rjj{R@zu|2Q>{1-Bq*RX~+ z2^VVq12tx54S9Ck8p@~V8ybsnGE~7`1C_fky7~IkB*Of}7!rbz zW!UNT$ZGctv!^-N z%1l#^rw(qUOkAFwmy5}D`RRxE{UJgerRXHo$%SW`j?2Npfo&kJC3KLRa;i91%Q|Ke1hooMDY*jbmgHQ1iH^R&)WwpwP)h?26?d~}3L<$iU2PjH__exh7 z^l_C3n61h-LV%K5KLJxW8BedQf1sNTh?6p7eMHx++uZb#UO!prBoSwM;}x&t&>eV= zcJzP*R{cZQXGkku-fn6KE)0C^?;5#(f$7~-=F)1ZUTDE zzkh}^whGqpPD1wK-#dJRa^R#tpWKxH{%@;b4eodUpI@kRxTCOo`yK3r$%fplNt3@s zvB8rURtnR?>iu4hi{nz(hZ#2`O^1ED#s@lWl>wGlp>CJ+Q@8Il>1+HS{)=hZ+uJWY z8c6U{;yAsU&BEq<9SCDJGQ+8flan{2;GpgaxQe-X`R#E!rXEjT4_$6t&~TV8!ndFj(D)kaCznhu_MSNCyM~r)sxGRlhp7o%< z#buK$$}lgxySrY-Kb6)Q^-o!;leo61^Dt5zrf!shifseqRSr{A3=e7FQ}LtubveJ9 zdWk*`)N5(%Go_oU@0m&lPK*jGJ#-@a0;`N!92hpT2uL?p9Q=l?%Im>aIZ@t^X47)1 z%9|-3WVt{2Un#AzmMJj#TK0Agl2J$0nXWsYzqp?cbKR1~{fuWh>MYWv%=HT|D$@82 zH|*OIf4!_ym`a5FR;cm>J|@yW-qA;_0LGC18}N4VwmnU=ynVU3j(>K4?&Take4%r% zXPK_yZ2)`YvA3xW?llVI{E0l53LBg-Vz7L~+Z2d8P zwU9A%RrWF}zG3b6855HlWBg~#h_NEZ3!HeIV_PMLdJLUv%$0t^p6HzT35m*1%;$4N*KUn%j7>u)X}XDJN+&&LlNZ7=q9VP@iA=i5O!=ItVxLG)yWE`n80#m>!@3Em^kC{F zp{Hbdl~?6Wxh7p(>LzjB$g2JUPaUda^WJ8h@3G>1k3sl~zE8Jd+}^L|2^bo)#G+gL zzB)`T?&5k#G1tZnsD#^+bIyEDjJ`HLaI)+$<#|BA$(hz`cz5CZ@O#_}l;bs#)yCUu z>;IoG!*BCrNBZi|F4b9yzmv$g)P-|3KnqvCmm_QPo(kx@950z?gT4xt&{+Gi-d=1v zhxj%=3fAAVmlk@CMq&%k)fBo3ch-IzAL5!(uweJ z0P&#kUQvG=Sh65G^ zB#Xht*Li*LCZ?D=WogkD*W2Z%hZ@XL+!d9|^LR3|^LTq_M;WuEUh(ysr+Ub7nr`pV z?_s!v(ScGPw1z9+j1uy%3VrTln#z4|n6P&k%htSPUwzD$c#H}Rg>agNv4A1L%v6kq zDX0zzd?G`PW%*RnmBKG{-H(K4x-j+>W0~B9%J<7GrPHz02mh@TgX*8btM#Qx>1!)Z zFsCe`(I*F0){Q1E!jaC@$1RTS(=EcuucS}D$tquwU-QT-J|1n9KdQgt%{P(6H>zLK zB*0$jnPf)Fr7D~yl+1GKfu$Nh*_Q!w82jDmcDX)~{mp&eu*V)@vfZn7~Qmrdy>_Ya1SLvLXQ zA>-=mIhJ@K=bTKhoOZY?4M&viRq}&UONN-k9oDcx<3IxPgg#w2bkvAIh+&CWeQI33 z(fCXmHrVz@iUiB-ujbq3!EnR2MO;(pZYv_-ppgqHG#P-v%=a2W6MQ^J+3qQj(9AZ0l7kY$56tvp}SXAjQ5((}5fMvw6!{oFIC zr=zj=B;DT*#jPDz(MHNkC}r((VrL^CBB0G8XKyl|3;5m{3SDxbc4%mf3MIY;1zQr4 z9{|a?J`J!G=e|UmB7KE;dZdf9n0fkBSztpc@p*lt`~Z|XKxVa5PRFS-Fh0&N)N3jq zzET^8Npz;oC}~tih6;+DI?GucI84JBkqq9322{$b3=516_9*3MurC<1I~ESpG)Oke zgs@P0ZW#%msWdN`rmOU09mlNIr@B%;v@lm+>HSVc=Sn+N{Qi#T@wi;>wA^p1j1Wi&)@H(yeW=O#6ydhss>$sQXJyv<9@i`;R&mtYjPZw4azDA4T z!2WeSpU9jB3MgUY1+)u}VPCyfhbcx0=Vl*0D8`HTuhX-y@zdvEpD`S!>>bS4ao0x4 z8r~-0;Gg)}4kMb6-_f4<(8!Moa0K9hIJu*W1 z!ln?1dtGC}$5_6Msh1FU8{!gNlIbVMThPZ=o|Pm6je|ek59baaS42ONu~9aq(A+;5 zIK0S9`PXBun`Aii6y*bsjO)95yS6LP*V$JzK3p1lj{fVl*KlIWg$6UByQC1pctQW4 z14pKZCJ*#^hCZT;RGHw>%B*LM$7O#$DL;QO^!58Xgj@qJrrBSe{npzxis9OEsE++H zsNMFW7X8CW8p)6|D>h%|GG2v~6slv)hh753iAtQErg~!d;3O|`S*Ly@9Wk7x=pyJP zp!yvl`U!f8x}Ne>_l+5(JO@R`lkTamljZvHLO662@_zfa&(v|F-}67N;7@% zFpDtAaR7U*>-P9Kr-4=`_(;nZNSqtpq<5Hdk58rNv#r36kd=|#YtSDd)AN6WUJE5Nf#+p<1AE#>oz;_cslOhCW<+f%hYb&f2YxO1Q~zf^1s zLdqCt+J2U0=7qsW1jJZ*$9Lgnl>V?JU)E2+MO?(Ed^xU@D?^W?&=#(!Fg7leWAGmQ z?QyJBvEM{UAN-4tq<4Q4r)dKvY|Xba9LzB>fJn%H&D81PZ$riT@9n0(;SJ8Rb{E}w=r&8u)3k?>@Ay=D_(TWmAILjUw4a9P_U#KAjI(MZN zI3|S2!z_~Yw8sSZ6BsBP;V>nS%ahacSI67sy~B9vGnvlHvlr*y_mf%eL!7@dPJE5J z$gBfC1V#Bt!?oM+0BxMaY>6~fP+SRP0C>5Wim)(5!cd7XIzLB`5CrA)<1-p1Y62hxIR=}{rg+A8KKPY3X@P@a3 z)=hFu4jqMjOp#@tE<-67qe+=+Fg`fg_jTi7;w2VwE^kzUusTe;u$c;$)%XUTF2hgK zB#8+e--FNTK`yoix>4b$<7qkCx+y<<5RTEQ#`crb_>w;QRXTs;I-`!cc668Vcvc3x zy9!H={vmmDkb>gvG==AQ4Q%}k)8L^($*iM@pXjFYwR=8BX-8?r*vdz`3u$y5TLfJQ z&lElts+v_solHC%hh9s!L5GQo5Dw8xl!GZ4pe z&k7dDc-^S7?Zcd=mo4;<&@m{^LO+Q(ztF8|oKNx@UunZU{+6`*kGy>TfXKT`D;bDC z8V4t}gIx*u*J=C{VMJokO~|WL9b;NZbA0PWEj={5{oo@8VywL5S7ZyU zx=f8|as@q}t3NX}E_@^QpAhHxUKa^HVi6W{jHr)MZ%baM)o=34!*G;_?h%OJftLWLKq%n_7Ns*Bk`BN~TfGi@P#(&4aDVZF` z(gv12{}>#nd{}`cu6MTKuavtFny-RPmojLRRiSAYSH;06*0^ZUy&g%=s`% zrpko9Ksgo}FrSReHF*i!wGh|QLz?Zhnpx-84rSeozs!xZn?8{)kLU;IeNor}jPv13%!-Jtqn zJ4Z16CpD|raIr5Dv^&udD$9uWDw{7DytEFJbV};HBIuOKE2LC zznFdZB3$`e^fXS8Ws%Ky$Mo2auW3DAR32z);X_2JTDZjv*_Q^VCLgaO445cTgNBSt z;JM2s`9}lYBOT9I@_APFl&SMpIl(oo;rj%hMcM|>IgV3al>Lw$r#OlKc(Hl6x4=;U zqW@*EK;wDkGu~sMnJQbMO}|K4MRiq6VaxQ>htufjWeXjpGf0+br;A7!ddLE;FBof_ z(lTbUAE-vI^5Jmqt$}hpP2J>111DSKu$MS5ESL0ElQ}qz~{tb

*=ISUpy^0(ov4@AA2Ss zFQcD6J5zn!_ybSrFm2bUW4TW1i2YlsqZ>w2bQ9{X)*lX1J51FktebG0ikv#hTsnpw zri2@>G*vg5sGwsF?(DDbnWef}xeVVcUKHjfE_%s@;&H6Tz^Rj?grb+QWCIcCcu_8% zIHg5T^2!;}3(3d2utUY+B-JfY@;I34S{l=Zi{DO8Li5XMqiB+eE_975*H6SNEC#wr z8|g!~%=ei3Nq<~~J5(5mlnXgQo=x(wV?RXxF|ADSqRCXiVfsS42rFOy{z1GT2>o@# z+qIA%svs}bYW1w)2L|!n1-{EbyWpd0=p~mw0>>%s@IT`)mGN~~+g?A00TB*iMs*^S zJjPTQvJgUy9q%+1>92x+SvP^AKP0A)WJxzcR^`oS;&3=iQ%A@&=_JkLxo0QpPti;6 zt50QHpx)NcJpT5Rzr<-uL*=X$+;D3+8?hU7aKYb(j#CPcIO4IEIilw?ml_6$|Gr>w zGbw-m;z^mEo|e)1SvfzuC}&c7{07w@mZ=HvIM`u&9)s}@0el(tXTdkpWYB!HgLVzM z%KG>o-5|v*%NGsbRE;m=yu2Qs#!SPk@o8*CV_z60t?}z1^J>t9(|O0BbZ?u+A4~Eb zmyKT-#tBOGjgCi2T`XD8jv>yW`(EXJyoNw8&!5<+i5ZNbWIY3Jjuq=b* zx*P*E_!vk67kuO`pzTCL*Gn)pT}|xz3btYVh=_7`=dv0mPaeAr?2mSFHqtd;dzQxG z;eodo@cv#(;A^8kb!=QeIc&PVCdy|tX2BT-435(}n}d23;z;vx{7NFBG;xV$?-|SVDN{_ylZqjz;GRQV11@K2mwR z9uwW`U(4XxEJGa=e<~wC@UFXXW?Iz$DiPF}Jn4nz^%Dk(;u;@CqbTf-J$J|@ye zAHT>WWJ1yKglxllt>$d|CD752_k4QtjxT9`4g${pAEs&^PWojyWV7)MIGGQF1shcEH5$G;W zu0wR4TnXDT5Wh{|q$nJ!G0Kx`(581d1SqUS4J}T;l0k{1F9cKXXgsurapXXkbQFh$ zVs7Of&P#~n9Tz32ybI*G1&y?htTI^20nCr#bL@Grgs+l z4nz>a?lQ{A z8)eU{A3c*UiNo~6-8#dRF_iI>G)aa3>}P-BOj9?^$|v-)Y_yhr1?p#6R!24S{H3e| zWZxU8qNUDxAFaQAuvLZ{shD{;9#6`bPoBH%yTh0FfK9kj?OzKwQ6k<^U=P!~?l7f6 zErG*T*c1KqQ7x_y3r#8o%y&p*TyFT$h%-z>H8oa8C~=hrpAEmJ5v8#@Epeh&gx!!8 z7PU-xKIJR3rM%CodzBIyXeS@2v=|l0Y+T^@+}v&ocVat7CnF3+U1X*vj#I*$8(ZGz zln*c*?hVTR_NM)MI8vGIgpXJq z2A%_^=jY`o?;Vw070Aa++r`MZxE!nOe28E%TNd;+b{(WYbR~)rhhc(2!&0Z{Q0Z)A zCWne@BLYY1;^R+BSB;dM#gPtFjFFMf%*PelvV6&KmOfW_jP`3(nG?AxPV8lF5+I`r zL8s9VH<&($eg*1y{mfL!T+6mlVVy>Ya6Mv3;=ct2%N09kQYK!EdHpzjqofs|#ZH;Rl(U7!WW15`RGxtQ+sa2cSbp&3^YI1mRhn{GAH0A* z2+wo;#ij0@j*xBQ$ueBq8rJYm0t12ul(VZ%broCX!QPfoF2#sG5?ACP<)W+5{+SllDvYQ{&Pu2iPo^4`A2WXEk-hswRw z(XpVeW5wsSQy11nlpg2tSjy8_1>M}NvG&^bhMJLhB}y#nStD zd26Ss2KiW?uR4%Cm*V3ry;V2y#pz_Jn^1kLNZ|oHMF)5VXm*QWN%-U(de@LyNg5Wz>pPUsQe9AA-FB>wV`Xc z*@*K4P`AZ>-|*;SUVeQvFCXmdX6aJdkLXWNFUtSsBUR+pRT)T$xY8ZCQXO8aK0Vtb zJBrb`{N$4l$`D249RnPufB1npOd}k^j7w1$wTP>7H|7ji89yytF&p$EylD7t;P92^ z>{5q?qzRPV;piAL{ZhEb=W)bmn&;zr`TKkEwYQ8jt>x!g3}@k%6?cxofcButbyc8w zIb3NfinPR39_bqx>`>g04W(r7%P`rNR%%6*^!niq_+!}tbU4nV9&c2-XM9LU{D1vn z7$wBB(LEnGdG_K=7qeex8#s0YIPR-}>zu1>7lNUY zGdD0yY>e0_5!SHuR^tYs4^sKmg9P;k=d z{u(4QUZ|3NtPB?2hkaewv2duYcX$Rwhq~S!$>6s|x0T6N{=Qk6An z)Tx6H`-q7rI|@UQLwQDUK7u>q(Se$b%d3|F&-0}y%WU*OGYl2-9GU9j2wG8P>-qoq zVzYdysvtnvpvcAxNZW%h(aSdYU>bW{uVD@EI`GUs8O_VTd@wIRIoK$_Ke;KV7o)N< zo0bpM=2zkD9HQdmMQ!LNYz>4;b8$H>XP3FZ zDaT1KQC#XK@$z<|lc0a(OWe>$I;yyH-Nfh8pBSjOHHfnkhNbv22WrJYeId$J=>X&) zgFZl-9>VI>fUbB3c`70w018Ujx=E34qP|DZ!Jeq~6Y&Glfhal&`U!f+l5Qe-uaj)n zI2`0dU7Pg|-N%=8lh8-tZ_`b9UV5IcG4&GbC{<=&56I%#s#NIbriPdF6J4^YkZ0;o zmtk`e2CS9De+}o)0;al7bd!g>QI0jN;avwcOK)xX%cFUDe^0iM+U<*z%kt%mi}GK6 zgnf3c_PA}j@SAL_{ch>;m%bv|M;|`4Z{=MAU558Cr5)d8pj+=D!XeB!NK2P8(I(eV z^1VFbg7O@+c>OG7RhOvYWgVfWNh%q`CGqWp*emgQOvoee;Nv*bJkj&`cSofh=#fI^ z_zq`!7CqTO1Hu3Je<)>dZ{L0sUdrOj<3rQmXiwAZfniyC-zsR%- zgI36Mec!+a+`l~y%EsH58-p_0IVcxbTjj&ywFY7tAsQu_wXwAsQ_$%Ub~I}9Mx0rx z_l^%-@$U*e8gWfhs`RkjSy0*gCxi#z!uDI~Qb44mux13PFtg#O zL6LFPafEAQ)=$t*PC8JDQKDl8N5o@fL|o{lBk85gG^LE8ST88b^!aF7yc}OzFEcDr z&V9Tv->9HyLsJ&lVU#@4wPrU;i2qN#%*RT=w`5=B*#$?+#Lw~ zrOHM8NBdGBPV5`f3B0z`0Tt~ zOy}i+H0<~8?HBe&d-nXy2FT&zzRQb~fI6j|EZJvi9Q&90EfwXjt=3C8JJ27Zw^z*1I6R9rE<`S(bUoE;j_Oa zjr&3&4+bn20LNExpnj-q(ohD4xegu`_p_n_3Q>WAl;tdrP2{Q@XI*8UZ7QB(*k}N2 z@gf|>^^6Uu1Q8!`fiEC%aSL4>OhIbKoPU#z&g~aUY3w1!(TZ8iAX1AQFQ##mYk6u0&$J=u0CZhR5ccA`* zmusw=;bU^|(z3ZPq?@pZ>0JlVQn>Od_jsp+ zm%^r1r*XLIA_{v;*6q0I8^^%5L`Qz;#jnd}S=rsyS! zsgv|bp2>$Uw5*#%xs#v8%aNK0ItyD8kq_+p@CIgy*M*H2nz=`wi6adA!U<4>Rp zzO0`FO^0f{++EgXu=Npf3;o2Y%r{x0eo{9vRV4RuNiHGsj2G!-3Rm88$5pxh zQl5H^{vC#~Tr7~9hNEg60q)ncsq|?*Cr&|J{6simB}^5Njy+7*u!g$;@yu_O-=C^G zP~XV+VMf(&GEql`-(*X+&XyXO{U*{)nAw+0`00nAy*Mq$vg6(rzX{#fqsxu*Pkys> zcY(U?A;KZdxK7k)i-QVHpsW0?*y$tsNjbwo4hxwk_>2pE1IqAXpF_peOOmI5o!4>E zIzt{SWW2nPY5&u`)JGV{gPPZXd!_`e$YtW!|N7S&>Ta27`n68emz&zg+aatmgHk->Dj!q z@T#&~o{^QV1l=f;fhBCTtP2aXu}52pFpU_i#U!cu+Bww5nrR!aAJSSGu5v5IYP6QY zlUC_6>@=09f#WodYgJrObtb;XFeuRL*k5d4m=08oiH~HEu$=%7QJzJK4H!KvSHo#~s0>(62jV*< z51gnVdywpsulNH|@)=ySc5_xfJl>7juQEu^FUD?T{z!y6Ka8^N?Hz|H3;Tm%xG@72 zr9C@duGh;3bssLL!mG`4Ipb^Tx@48p`=Y8$>=)+Qrn-owWpKzUU7C5S4kfpw`+C8bK-CXpRPzkeubp0Rmye~F{PO*n zNs4ZAbhOY-*z0*P*eR3A)Gx#^RB))i4L~2^V+l{yE}u<9Kl$Q9cu9YvK3!dP4=+f= z#?N;c7#n+taOfKRWOPebnLG|+eWM1DHlIokru} zOYxmfa+`jVIz*)t^|?3^+0S&%M8I7i8Je`&MYBTI7iS9uf z_CjOks9*33-($NW^byGkqnm8c#^vhbyd3Qh)b3*S-b59|a(zBb8RuBmO)jO_aXtPp zl*&f=qwb?_CMxX3__~be+t#T-MU_o8BAlb4lSpP7vY2rivd~L(?NA{fko;1mKsVuq zZg?2U5Tqli6}_tq>U9&ECe(aID$Flybu#jDBH}7*rGa$yqI5wjez{O^U-Fn=MpFGr zW}1gOEL5EYt?^J~P({QGT!mds@z6xhK@n7DU#3xMlh@CxjC|lD+{yV%IpwK5g$uff zM`pPQ_SWyubYH4C<;esu=y?I>WcKVD)^L}AXPDXgyiigT^>a)+`*gHbe)?dqd~$!- zbdzK2CVSyGku67mJ{nKTv*)Mf{#){!Fs85t5I&RUH<6CQs)RqBmGYC74_VP4GsBd2 z{6him%kpof8K^+Fy+rvFALCf1W)^&6(>;Xzq@4PU zhBMCkM2++KssV=&Kh2b;cbNKxrF0iw>@t3F+<)_T-_mJ%D|8Pp8TAiy3?{F@ZWu^e zgPyOj6#otYPKLADynRiX(xG^ZPFK6l8U4BMDdBF#gR(c*ns>WUzGBh(tqgLeu`6i9>lu{ zdTf^$VT!e%6Q^yGhtwxFBQWhORH9{m< zbO4b)jgagNqVZ>XDf2QuP}(VcEYm7d?yt?`a$SEMb`7I7K<-BUOai%akwtqkNLqRV~U31@a!U#|`a( zycCy?*F)*+7$iKy7$qYOScK2j7Vpb~nVdW?_m7!Izf+!{oVzc9-}XMH@qD}PMVX1p z?Ax(=NcKEsKQWxaTr(XfOW-b*@0kpf(apBE92luH9dj)0UgcSy#nBriK|RY<<-{m~ z{&u44BOa%y@@N;%D={jao6OA8-l1wLq@yvF3|{@SsSOwlBQ6pIAw6r$=$v>M(foDs z7rK!a_-hlhX_Jk5kV;MQMB;K-c(8`boaH{X)jYbLmDbZGJr7w9^zF zBz2Q`v8!^bj~#2=_>+tm6j`=zx${m_cRUM-@lLuykOd?!+Q&J4929Yh3aW}0VWEwS z7LIW)hcf6b6Ve*cY0_z$&Qgzk8dPu+;3BxceN|?(A!c=QCZW!aPxh|E# zD_~TJ&`TtTN)|74g{TCgx%%Z&x&IM;f+va@AoeJ#K&~)l4DzthnV`FfcrZ@Xe;b?u z(o;heCer{Om_hNDQz+$&a*CcJ{!BM|SJ#Vf61qmxisHF{$ec~pO)_j5D8{;o@(GBrU!a`gAC(azB-68BWy5=dJ?X`x4Z!$x0l- zK0SQMs?Gsl2_++q^^gn;t&dcBjQPlFSTtmzyI4nHxFQZ-veX?I zVo2w(@IvF~0}W61ja0wMXj1(q8dK(F;Wznj|9SWkzLnF|#_1|}6j;b(ka&G;0N;lz zETwrz04L5w3L9_y7%&0$%6Y8D_Yd#IVEroKdU&I9dUjD>yg2hdOl(?D$H0;u-hN`d zyz08`9F@`Wr|L9K=O{d==fPi%hW0>q=tE~$k)C{he-;nbFON(4v-0C1yz9_kLh`2i zNouH+hDxBt2~D84VssKT+$F? zR0pJ?l6&BW(Gh$aBTEL1H2b6z~rb-6JvAo~sab95JUn&*>v!G;{!>M?f(zOLAg*UzhH@*ew= z7t*aanNfO)?s4N&US$jysjpc7NJQ4tiq!YQ7^(V59d?>?RA`+c;~l4QT>1e{Q(jf> zYw+Mh9ym17OTsCtbQ(*P%+F=7lk_}!HCnGB^%!_#l}8*K4zRLhdvTpQk9i^WkW~K~ zePcYs(aEe)9H;DuNgO|<%aMT@*y!qq2l3{?PSs$R(wi5Y>3QcFrd%iN&!dR(Xk0F( zU+8pYx6Yu-vh|2Fn8A_{;Z9}E@li@%g!8ei3+X91hUZ&@av^1d{C$k_oKhy*%=SVb zS(;^v%=$>^Dd9L(xpcZSmt4r@`ob%(G%hf@Nk79BnW>OYhOmeqIBpVYQ{O=D0k`J` zO6tOsF4O9!oeMWrh9SC%qJ1iK4^ePQA2D6TQ|!5p2PvA3TQT0BRAH-Dz69wMP~??z zdX8D>D8XB9Ugv`9OvoaAoL6Fp31nRG{48YpH$@+2M(r1>d}K}otxWKhW?&6#xTC-` zPv1I|4nSApwj`w8olfW8L;9-#XB8_5PfpLviR?V|5?=7~GM8_~(254wL$3hFjNhKc z2b<7G&{guqEn#&V)-zUta^mNCp*Z4sf%{|}I@QmQVwLWl1TMIP80)IABO!;WB*TKH zXE?Ax%Y=08$*1l?pWpP5L}X%;U(nD$><{VXq!sm;505?}T=-bxeusV%x(Q*Bv`mJ& zr+d07yY&j4bbRGFwhX$~0E%vc9+JoXcmMJ)aGC-h1a1T5iLVP^bIdEx^*sZ{!f}ei z#()bj7&Ds!`1l|i+pEAG!0ymW7&^xL@8460AO%V{`13EGmIn`x-I=TcA4H(hZ(PXpu7MueWpG%}apOB$p&e5xVPh4waEH`& zb`s|G0}WmjB;K@!8($lFji+J5+tBC?4tEZf&jy?E=%Fb`MyJiLUHcof)o`ftw&V&U zL7E-24wNKN&jw#qeHF3~mZ{20dS&Bh+o*hPu+;N=28d3^%*?0@9cvnxj#S4j)uo*si7c?Dt?4pPj2+(eam{peV_6E1##`lhxLF?58K*v01Rn6%V3DGKPWy(K1uJolgtK*Xc{Y? zU8?w)Z3>Ft(RoDObK3|}0*nP{8X0sX%F|l7j*A8^9z@2)*eD^bu*E}rUX-7_aW+bn zfwh03>S3%(nd{~abslDR@HIh{51(3mq8+7Gh5@{xO0>ZuVLC*&RBrfOvd?AEhsEi_ zU?E)^B-~&6EAmJKCU{YfQ9x`C#x)q-7 z5uLK0YK(K*63h0PssG`glf4pnVdWX6I-J?3-ePEf&xXlV{WD*>McxArQC{RSgOv7` zGrMVjV77CQ6LH8(kZA#~0f!U%6f;2RS6UmsL%{!7>ijMKUcfyb&}LkQYZ0?UD4^b+N>HK z>0KbGb&`r+86!$V*1zM8;;E*jshf~49T>>{BWyfGl!r!righ0b{nSrXgv(kPYW~tq zR1XwOyit7WB;ha(M3>=Z?v~Qybag!_QS9TaG~%tJ_%sn`-NbRBgMg{iP{d3J?;@sL zKc*_hLRRBdE`Cyu{*v;Psfk#3#c_k&>7kVgzS0b=VGVZ}cO+AQrK zzlqpaLdH=}`iI}2&C9=jSgiAq=Us!o$ier&l`aJq)Z?CiDu^ZcYK*bX_0;jU%i;Ay zI>tW6z0_5j9^y2SF60qsXK9~~a7FtmI$7{@FU#N4U~#ZD-9#e$ zO~C)tU+OdkVi5R>M~t}F!B@c7=Kl@=#d|i6o6Sc<2s4nf{{?_8X z^lgYJ%>EtEo}EaC*zywPz7F#1_AGJxD)@?1z65k&Co)c$9g7o{w=a6O?hH`(Jw&() zmq}3lv~cBl<{eI1%6mknAE?@=aKXFbgAza&VJM9-*_H0P4UF38tso~A=1fSV?)ef*=H*;^aN4X%=T#|rQ(o1BPUYoc7#}?F zOV^qPiIDWY^VF#016JfpmvR2mzYfmj7Ac1sNw4Gk{8UWU6UwJ#+k@VmZakIE!@w~ZG2}xU0BTHGM(9{%TqqZ8v5x2b z1c;U#he$X?)&J`p7$g3YrSA8?Gotcs3wuK(9H=W{ zoqiD~s<4Z1jCgn(C>c+wEeoEX7%xH&S}f|NH|oy{%?2>#9Yq;Zpqm(@k zd8*kX6r%t|A14d5{f}NfS=7K6%vlWs4hK>e)z|ELS@B5S&`mkmXV1t0maqLm#t5@Z z+cp@tK;JfB2Y4xnqxXZoaP~4AucYGZeD-8@?B=wM&9j1yGWrpcUoh^5Y;szD!?mR@vcS+G9G7)#T6K$xP8U_~JxI|{ z4))`%1M#Log4Xo>U|jQYD2#QBRHo_Xuub0}9S0w}VdaJFubwY*t(%Bm(n+K)!eH!W`pQi4mMM=$_1_Tf z$+`)sf)LNLe8&lvsD6_6;0xFB&YLo9N{d6TJFI6a^unkRbQJUvW|H2Zi|RPpztUG! zQ=DGNsuyF`O|Gx6%6QCdG`@z64C6QTk93-XRR)!e;xrw`ys+}tPgKNSPtkwSUP8uBH5{3e8% zVR~|Mu68XwrCSNZ*u(5nmgL_yi?oMt(!?k)A07TL-jBY3l`(e-a_nkQ!zQb76;d3> zR=q?&4J}=Sb6i6w$+3-}D&>hk_p?OXz5lO`AV3Ns`Eu! zzU<0V!Twtq6eFBfde-I|Jksc3>6I1aZ1^aSm1alq64p3o8zhFJt-J~AL8e3D0|Xmr znNk_K&bZc~t{PA!%&-;wsL~n^S>rQK$1qETS*(1`nPv0D1CC!x8$ZaHZHht7+oF`S zKOP@sAkKB~w5n&(44Vph-n0G#YuR=F4H+r82yr%`+(um~P85S708}<8YRG z`J4FOFu4$7oY)Ydb6|!Aj!zx$PJ+0e>c1grGfw$UFDeq@DrYQ6D$?SiAqYN@v7_>e!dS(blV8q9)+j*w$^sm>hBf?9fajhM z?%f|U>ogpx?90py&ew6A0@lT9!|>O=)erHpC}yLA>`(UT#b$Y;Jm0+Dpgu?46nnHE z4cJ5eZs{gpS5(LAXO)^byf93HSw^R+=<%v{=^oo^*khc8rY%hOpR$GSvFaoZ*@CwY z(xpLnN!^5HZOnY6@8>yV6&6F=MCtL}Z|q1nQK#>%YfKmV$T!hTQWpA&u2Gl{RP>W5 zpT-}Yv?|{cQYYvl)DKnYdeU*o6?UBl5lW5>-U8_t)0uS>K2DO((M$t4te-}Oj4)6f zo3tY844Z*1{m{9Ib9uzTyKV_rnsx24(E6g}I2O^5`1sZ3mFm!Sp!`%66`rL-J9k;#PbM6PZ2RM)_nmqk*lR(6kg}`!0ng9qND|ZN=%!q z#*-FMHgTbPpp=kVW%q>WAa;auu+GKDJ8_y4W_1h|GS@Mr8>sxe%ysdVi!ViGL^rvX zo;=_=l;yp*yQ4VW6D4x7_2Wy|0Tjom_~0X*^GYPFoZ&;h&|g4`y2Sf$A-m8$!VAV^i2cZ-N`g2E&bKe9bTd@;9BCYEFeYDh_AHc8&>h{;TYFEX6Yx! zy6EPERvBSo?=W?^$_ZQF5VcH0gn1}>iF6M;OBLsIlJSA3>ni6(E;=s-V|yw_7`CUo zW}sk9&@&e=Yc-Avn|@O9|MK@r_NJVs31qU0UkBgjn0E~Zs!(Qdu(u>{O#o(WqI7+B zUdq3CSe**r0GQ=*etxM3KnmL4(Dm{ko^Q4{l5Y~C%2`@h%HQ8-84-%7qYOOo@9J%# zY)jy97#i_&3#43>lmwUZLH-g(!v}4Eq@2bJ5-*zJPX`Q=Je+c%%c_!IOsX4uFQQXVQ*S@hlU+Rzr7ZfczDh9RzvW zK+%225D5b%;xJP9;_H?S<~ey{gy^&?cGQmo%@6_gY!OEq3>JgsiJYX$gj_$)I`3(! z^8r4N_(--uWHrDuij#nPL(gaCDf_1J@hI9~-nRutJx6(?uHi8Nt(2IluKRDsqm4~J`rUJztgE4I88B9tj(jL^AJ#2YwO5s92a9+ zkr4sNC2}BXGalfWRcNxB*7=jMK;?7g=^`(cKhh&9A$!U@XOeOs2C@!zFhZygrQ6Z* zptBNeVYr}Ec8y{S%m%i07l>4)4m^j`%A8mcsad(?D5y5tfcq`VICbz7s&F(}BmS6pCc@5>0t8tk|)E$czi!q`ee` zr@!{N75YVwx6R~ex`}j+2-kSVLtz>uU>GIgEWMUa!rrCmCiI`XThdX4=m|LG&`}s) z<{Af#>g@eeS8?e)_3Tr4-QU~LdWqvzCWoOyozTuw$x>h8+Bo;7#xd7Jtq=3QrmQQa zhpH}vR-Hv*eliWzVG+K{&uquNZkDz67t?^uGmleIEMr-I#?c<(d8RE>VwX+4>s?{r zABB74F>rAoK0aX3N9OIbpx>vLTk&d~#PUVDni#%166 zfsW_JEg!H&U%`orjxeZcKq?TOWiDNWW%|rU+tu~VWY=O>(Vt{-t((9rPhTd*A@3EL zk@Qs_@mxXhMy@FNhKu;IuJ2FMO}te@O}j+NA^sPz8eYR1?kMn_<13*nVSMLXFvy0o zY4LIVS;iC-f*vlq*{=oK7c1Mwqp8~WwO?$ZH{dsU8$ess5a@5%{PPFJ`?wRn3qTjU z3?cBZev%qislek^@}PeL;TNcMmA8+?RAJp0sK++bz^0c}U4uB&rh8O*^5`Y-rq!tm zUv-nDI852Ee6Xdl1iy*K1N4gV%~hGG(C8NFH;I?JAY*9Q_~8HbZ>86~X{YIJ5Cg@l z@rMA-5V_v)*SPX)`Z!Km-pg0LKlz$v`nLi5oBp|eQ6B~1^Xb64#M=NKD83#?N5yq4 zHGY-*F5IcU$O)F|XNkggvXonPD@Mak-n2Gcb%8XY!BS{+wj$d9Snc*;V7ec z1H?dK>D*wT^d4lCH(TI4m4hnY1XiY9|EA4@KtS`H0dDV8Q1VoE+v1a{*l>k-^6i>!pN9+elaei(ZuN=SZ1MlcPN#28OI%rqHR0;to~@yohP-7@kVSuC|LL6hBW7J`r;sNv zZq-bpPPlI6%k|?ly-BZpmK(FIX-#x@d@TTfes0%GHxJXWk5(i%9?c6KU5j$hUg~fDab-M+4O8vR=_x{ zW8-D64y_fmqmGalx#%Wb22Rw2y}?575cS@tH7vFkW1*k$Ot}g`r-QHYIvu>@R*=gJ zei45zh5dKk%rvKi)*rNzlr^w?4Qu#e09^~tQdX*2Kn&%bnEL0|f4s($G$v>eKcgwz zQ}*f5Gv$teO^&}f8L5@N##;Yx0c6QQ{rP1$dHPel`Ln$lpaCv{!?j84XO$W<4Dg(b zs9m)N{nc0-c}2@~Ff)2+FT*c;CvxRJ7$Mn}vxRle!~yetdap^XyJG(^Hs z2?g9rIPs<`iwd}Q(!$k2sIG+7c>xTMp{Zz`+WZre&Jy|JJyq%_c-f@~*JFVcu z8`b%0AZd+=rE22Io%&+{KG;_MNRVZr6L$wK-uDL?WtYOyt$g_sk)>SQ2ns%?L=iE&YnjKGLxo20jWcrrpQ2Kq;p+X9!g$VsLg=M zcws`%C#cK|sszxK8OTe6fChpGy11dP4TA(V1A}9KYs-$)p(tpFsZP!ZJ}3gl$!u~} zc6G0IHQ->BuvgfXt`B$j?qJ(*f7>h$QDtFFhv~v`s(z=&xeB6a$|w3G!VFYF11Wy; z5stLXE@hS}AC9p+qL!(D==Bzmacfw^4+U_XVu)nFOFQH_N6r#aw&uYZ$)2IF3v8W2 zCRgelH*T)V`DmuR)Kb|G`V9l+WF{jsWofl^ zqbf}G6I5XdV{D5tu7!o^Fl9_@GQv;|a1jn3YNu%Bn;hLl)DBdgkJT59eFsC`pH1l| z%;HdZrojP3KVhx@#&D-h6&@?hb~Q~m0oAFm>LZEhB^WKKmn2>2CK2Zsx5Ak!i13!i zonANbj8r{8)RF5cvDGv2DHC7g0Lz6lW}2#!hHcNh#W4vlJ7Htkhw@UFbMqwga+j4b z?+sO6$+ApKx(Q+Utbee|o1P-nzuO}(Z(T3cMXeWT)bB0vlm>RHtzSi*mzW0-+z zFC>(c@z9`~fXEVcmW&cw`H>!|s%4fbGv*NiCK27JH4_UetOVDvhPw_t|8|n9A9P#f8SiBDksp7} zhoP202jkRoCi-Va`jb;BIK!`5>;El5r*J>bmWBsA(eJQetPO-EC{|~ z6*oj?j4=&i^2l>MYcF`k2i7r9)Z>{Dy(GrC75zgL-NSlFrh!+S^_A*3;pOQ}cZk&% z_M4!aXk4=oM2KF3t-gidM7HY$-9%#}<0O;Lpy4wK{J;Nl?KFKWfRps;h} zx`t|ypxUeIYoXv8YXeW34c(mpjXLAp;E~nF-t$6~X%X)QhI8~%^ne+Y1MzB;a|{kp zjT@r_17xln=MN0213)&Wlr-w+F&^pY9)N75i9n5q3&}0h)Y+Rl!RM;#?J|t36QZc5RGkP|yXlG#}@w zKfIudFfZz_?Bf=tf>fF8BgV%TsBb>FfMK#b-1h8K%atBO!-|p8*il-;X{>lA2VwCb z4pbw@5=KrMc$L{z@DfJ9`zI+e>~TvK5(XNrKS6DpG{`h-Si=tr^jzcMViSA*&> zlAq2O%f4eM+tnC5Ql{Y~-EMjYx{7rWA^Hl2%B99K8z_q6MK9^R$0o->dz8#$tSHV> zWY$dx>)fG_1mYaUSYlQR`|qNU@a&_X_`%_PqUjW+UZ@8V1N0^5sbd2CF(Mr_94u_2 z{^f7W$4s0f_yG1wXSS(9$1y{OqnBozg4_%9RS&5$-w)zUBaU`WJlBdo!XE49b*=GX z3#Cz*m$pw-!V#rJPgMQ2#^ibuy1>em7rCjMaD61p>r}J_G<8I^j{Tr;To3h-W$1)D zUBHTrbD1hz5nLX-QU=gXpt66%d8#t=(w2(ggHTkEE?1~JK&Jb(JJ?ZwC%r*MWA)3` z)m7P7-!+uJocafskTXq}bQ9&j&`Ek;2(R-{ZG^3-=-h-8xvT{rGwAsE)90f&4slkm z({|LFi3Jr_f@@gA4*_TgbVqy`>Zm#%L&itazPaO+c8K4E<@wm4f4)#JKKKUf{J#NE zP9~YL9i6{rbH^aZCX>p)1fATv2DBnS9x@W0CXn$90n}mjeGDx)Og*-V_c*4=;HwUT zOni)Wp^KoGr0hoBed;5mPhF)sONrBsVa#Kt=b>)>-jMz9r_w{V?JKb!q5Fmp#kz?e zzzxM+=tSry7xU|~vAZ2FbSwTpe$I-8wbS&iz$0&Ns6k#8oueF%(?=R8S-$^mmg+O> z?oYElf9dOO0UZG4gf`&8e|x9=)<7d%0*9kP2Nyp}G}wlKdHvjuX_PE@wZ{eOCmQ=I z_VU^hs8L4)PZ|w943d!33AphqY(-f0&P)rGU6$G(?@6HhGh!%E1K%9R8xk5k^jc|V zbOyq6og7Cg%dcb)hg{*Q=v0lK@G8>DFdaP&6)1*CI8Rj`C}k1P(zlTcJX59Ev8nXo zI2F(HQqw{EW&3oRXo+HlB$S+=Dl@CZlj*FmukQw$X@yMR(p3tWCl4{C@)i@$IPL?= zD*N|Qyna@W?~MY!S2cVa`W`7SjFBsq_(q*79W#5Lc>2EbrM}K|cA0?XSe@|;90=4+ zkNP)I5aOXBs1y*7CQYUuh;?!*jwC!J9EV1afa5cdN){DU1uZNf--MJ`iqn+Y9L(a# z$`~jQW|v~1=&a!+)x*g$eH@`z)2mn>r!;ns3MZ3^jLK~rCgDh>xZxP(b~aweXE>^- zQpuKRm2;U4RL~YynL-W&m0>txUuHe)Dk?HHDFep|(`*V(23 z4uLb-a%_vmhoP*CD30=QjQJW4T_p6!KHTdjy5chCrKReYWrm@{={&mDXFC5x^7~t= zcO0UsQ+xT6w(=|Bmmdln6Dm)AkPhcKNI?@B>>0STo;ju-_7W(0(3+pICeAnk*|Gv= zC?4I!`pIiuLC zl=!N9RQW+3s;bhp({v3#Cg5cfTbQKt zk@kV(^wCITgxbkR-(<$Az_!BncKLMrc4nC-P)__NcLC^26N2po0*CaoM1jhuJkj}8 zy1>v)7`Nbqc4Jwh?rGZI3&&}UX&&3qJ4_`{eWd9jA@BVr_L-26%=?tXj_1MfEhzRsp+eqadmq7AGR0KG#VMv!{4ZBW2jnybYhTYi3 z)7aA}Nrg5WHnJrrX?-gaVaXNFeK~BD=((|>pofG8d?bzWWo~66MPiEt?whWeI>LdL%7X6b@ZQykw3;UU_Di#_ZD237DmU?l9MLa-ipB zV_WIe&s(2hXp>Gfc0){?P z%VE?t)v$MP(7=H{GSj$;^Augg`wfev#8HNz)nyovKqeDn224(zIhQH z$1cDbIz6yT0rWoh@JlJW#aOxt`LHiL_lNsLZ1N!K65}35UQR=9T%V4=(slDP`(}H) z){*Lua*BSW`-Bd3C4&)JbP75cG%u`roUbpb)4BdAyvUVY&kMT7xz2rm zPhtHru?+nI2PrFCcmYcqbPnjW(m&0ni}P7!y&*!_?^N#*x%3yZ-W$@>Su`p=9e3OgDNnA zx(x*H#=V5q_yAL;ALKOdz%)W4ZF86!qhn}14If^|ds;b4t)3eU4mR&+76)5sACOqFJ)w9h4@19%}N_k|3Yi|wuQOtN!O58;LAnUI;O z6NM9P^ys)|s8Bvpj1!h(ZYlqXE^w?KO_wB@A{37T&)#1X$uU%NnSD4w@Ic*Q4{!lu~2j5_F#bI!-;7iHBN8A*=x} zsAN?afiCGP$_qaq21&1*Z0&56ed#ASHpdzeE;aVC1mDZ^mCm|J)k)AzE;TlsDW3~H zW7irR#u_+J7573{^+Jce5I@p507XAJ5&8p)$aO3)AyYR=odl;~>L$Ew&KI~FDhE!} zQR*hhg}M~$S~DqR@T_KO?-N~TK^mbQ9DD%Fs}S&wH0L^T^Z0VxWNA}sm zNwT@_@pLjP3VD_(PE%%_@+EzzSGhy?py;YNHI_XYW3dt@bdJhK4o zYC6KE=9N}q@KsJz^bht||9o8h0Vs(S5&9{!``_D*JdkBv1XEC9CAfw){E&dQhaE+K zMjx0DJ8grPx_obivFLRjr}UFwjN*mv8r0>fJ`#fM1OkWjlhPJzSqnu(hdJh%3aNJ( zXodqr2U#F`N0li)9j489BEIP+I7}+ zdBLX#%nnpNVAe~Zdho2D2tU2in6f{V4x%wcX`ktNJkznyZm!F3ekwhA?KFLRfOGUp zTBaSSU7Lkx`uS()F_?ZVZGeIH>)<~=uggu}0`OqdQR$iS!`qklT?Z9+0ZV}nBwvl< znqP_hwQ%KC_hFP&6rYM~I@U6r#>kRUVgn@j<}j5dvSgI#L13wOHhdJ?GvR}MHEia1 z=)pO;o_V(Ee7K`dA{sk}2{Sfm=!7ps&(uMjDgCL^;uQ7F4lHBtt+Y&LW?(VDR`;g3}Xs~eXfq=S`~vqg0mEg^OR=_W5Y_Hjxm$< zXbeTtj#C(cou*QV>70NT59pYLlp!+KJlW5(IZcs?aO!8{dATop2fL0q%I0H~mNwAt zVU26|ku=J~#tFwNGn~RvJdCd!$Uo-cMs=fN?$rHa|mgUT0aXS&JL znFcCd-nFc1zGS;6qj$KqZ6k#eqV!;Ru#f59?v7;2M9-mTo2tTzW3SWMbmFgW-)L+B znDue3^GqgF8+m*HkIN3D1niBG;4^$8V-uwa<%pL`w4+QX;(Lh0l)Y||116*~twv0R zOtXeH{7`{mfTy2FoqjL@Ic<#>OUyKV-Th6UtNqd6z725yT_M`5*>@JY;x0jd9ZMj2 zMm1f-e20Xatk+GVe_PMsb?DsI6pEz_Q`(3sv^I%K(0G&nrNLQ z?<3)MPbJs2a5`^Cpn6ac_qAk7C~ix2j*h~;9O(X#hV65^EAzo}=F7q@(~zsDXEw6gRU}Gd5?z+Sx+sspu$RU4Qu$Jf!j}|{liWe$LXIh zqrZC{$0-vg{^yfT)3*X@zvNB3259$p2C~pV&sVTWKN-c?WrXj;OBlKdV-<-!Zc#tR zMO@h0%eqP%$3XRo@aZJ&9j5T{LRYq^!b<9wrpzEszX>`B6U06~(Aai!Rkrp9>W8QH zpUj1yS|dpmxSd!aNpybRPB!3F*19>>&l1MPi|bk0IoK^%gH6ZbEOmnyJ`+CHvCPU)iNZVY82}1{iuYH(c;2cq zZ5a<>rs3gCT9LBhIMpL)1slbDr0Y7t0Y(xXKO7D``_lEHoLL^mpofBPV?=*`wp1Ck z2|64SxI?8b6$(JE{6}NU<4gKFk1C2U>d&TE{z%kRO6(MVnlzBFC8m5seHX{fnWag& z^*7?pe*GvE`MbQF2VP|{l`O*`_lz|94`;E8Xs0uss)&s|T*ZFzb z-QCf%q-RFQ+Ax7~4pFLLB&(QNr6;V(O{>9D zA=9j34L@W^Kh-KAXU|1G4E4HS)PI{!(;n2#cn?U%gLzl691(5}!i-bPnuzsw&XmEor9H_xJ9iA1Mjk%G z9_W+?{wsA8oU~CEUM`=BGTx4L-KVm=aG0W#3M66U1rC8Fu+{m5vD=KygBb zXm1Im)9XL#R8(RQ4!rzD|DZ0}-xQptZh~G?b&t?dLLXV^BsJ`GGaZYwmYi|ch5=4h z+*6x#4RCIu@0rk4VPoZe9|@~$ewnM|d7%q>`y|3bbP;CVvXW_A^=>D);<^44DCK~P zcn|~~hF_7x_h|t=JLb_(UKdpEMqh=1XmgqhaftGf%84p$t`knB6JVoI0ql3WsRx*C zh5EhNt()jsK`()#4YJB*SGoq_nT+bQvvcKfqsMa7x(Q#`2XUy*&?j{>_GEyo%0f30 zqGu51($SN6fs1}Zf5=N*X5q7EsjJOc^^F?FVT(%MWF2)%3o5Jx*RX~kBG8_0d(hp^ z^!LZJx&0t{ z^KhndVeK^i-he@zWl#+Eud_@a!-ThzdRE>zFnH(rAw0;y13h$KTt*q$Z{%Hoz7(%p z7pv(A_YE3EXyRu-`9SI;_=t-JUy+6`p=IWUiZBmV-Pw7X4IiFH4-(dSP+r3zsSRHM zLP5R04SFU;jlI71)%51f5>UgZ19+y)HuhrKJw}Ney^!ViOfzpzP_BSCB-!YDWEKYo zidd&puyqpL=cGo(m5 zCZx<4Et=H=@BrNgBuz-(6%D-|y{D%*3my>cf-!A7G5x*R> zlu?GU3?r7dVU&O5DBhr<M@D_&*Ky0 zswliM^bKS&hDF#$33A58igu7zYW>80K0`|#zto?HZi2&9s1E;9a)#9%4GNxRD*1(E zGwBvH_36yocp>>0!gI&#rWuup(lcl&#($`d1q45ALHA6>lSn{J|@h<|QWc~`2mSOLRH zaeI=XQ!Jnc^Ehax;4+4kS;tN0x>g?__lmgt=zQXJ+PJ4e-IB%|6=_*g%Bo`*x`|4q zYh}d?2ych6FrB72RdJ%8aC+t8M&`>BUE-laellExO>QEpTk5tWv2eP_n$!f6^aO;IURFWFRvH`nMU zqjGU^p*-WO`tLnBD*Jl_J=@ZIs%`>3JHIGn8AGS@opPaufpe7YOr|OWItqQ@<8e@Q z74`rITxAWbzM&t=fWs6%Wj%FD3o5Jx*RX~k8_>07zxUzS=q9ukx)3H) z>O?d1>i0d#%zhK0`cZFVs2k9HCek6M(ivXp9^BhizAQT!Zd+G*%!{;xp|=HMk{LS5 z=RzE%S9HYa7~)mJ@Qq}c8(i@>_t#F-?;TLL{^{)XW}7m&G9c^uc`d*p7Z0c!w3uHU z70)11@GF6VowA^0;FLI#LBtn#|HXq+9_m44S<&m3;cdWD`5g!Yf}f0AqBQ`aKENJ& zxv_=2hF`;scmY)hPrJ|p#|O2a^*^YMcx8FDgX zX6c?3SU$M0Ed`k6a6Pi$Dd@1u!I$DV|9I+B7rlTxdaJAZ($)iRsIU#nHP-BZd` zX+y>3{nfvX6O0KA6O1oYU$f#w`S=8N%!elkW0M zs=$R2qM4H?h%7N-mCp-FB#+8tnDBz+sUFO8Aunn6WO35_?{Ha)$8owfyVA3}t-r1K zqOFii@uQ}D9J5Uo)(^|!t~G}Ei~2I&9y~bk(l?Bi8$C;;=R*xVBP{EGKAD%NQaH|Z z){C1he+l0o@ls`Dh)^ayF^ejCB`%B;!e*1!pP)5eg-o-CHT+nCHoy|%_cY$Wj?)yq z0;d68%j*KojDD34e@|l${Re&TR{`asU!kuUU2l}fmkdqw@`=jGo`v}W<$HmZ6UR8V z5N2?R0zIFApd$G=zVc1hp^Xw{4Si&xo2)Lyk0o!RpIA5HeyDFow`jVF z_?dK(@%+k^k3h{fZ#-jz8Kooj^%Ln7ry5vsmX1=_fTC9WyBa&wb1n2-j& z#JWk1<3VYt_~glxt#JT!42>n6pDl%A24;-Weu#uP5S6QnCVh%5M0t6K%m$q*)Vhfx z`J^vAbn(^m%uOUCLoTuvbm)(EoPZ=V(t^;??B~2HOqTReDV#s z+@99!Gjh$9rVaw{nWjR@<^5lkhSf|L%0pKb^{9W>QO}!J9!OcjQk;zP$&Q?NxnX5e5G6L+Of%NBx+ zho&^fuJDy0bhix!6==)y#e1w$IQ5bYSyS!*>N2 zGbu1A6|VsghI8Lv-M-fXoDUN{WPg1yFTXmPmtP9G_umxm%W&G&fpjJ>#`E$s<=2*z ze8=F1S>ctnmJyYj)E|gZKZyt`Q8)t4VTw#YYNx{5&>bIXqR~ehD0)`w3~DD3jlUv| zK8+IPZHKAqmgR5hFrBLLvJcoujrL0^|G!t`oXEHs4K|I}2ZQpZ;vUH`!Py!HhUhAC zljsO~8QQoy@Sru!8q7Td%Z4_EeqBul=zGJ}AY^#)*1SPs7i8(`l1;Co0UkM|r+6 zF5-Oe>V2ZPls@ij%QJ(Pt3AqM<_=I*$CrnunEAia=XI-7}sBk*2&!vZgDhD&qFYEmv zj)8;X87gH!Vdf|^bB>Po%e{MtGD>#5B%fJ77^Rn&W3>s?pi<6n^qlV;mifWGvcX1q z0vswl%3n7y)grH94Qu$00o~-mH+Zkk7y5VA+5Gb8#=6M^_5}GBu%|I*tbUb!&Q7K8 z9Bj?YL*C-NL(q4zOCWhhrM^M9(L}3al{_JTf6 z=#M{%)$M3NiPOIA8-ikSAKh8rJYufGz=N+Uqto(lOif zb%6ev8KP75@#!=9`2lDAW8BUWiq(U7OCIDqefBt>`nL$TUHWQqGTh7IX{fh> z<-%JVJPkSH8V{|FyvYgkR;0cesWg=6Fic`5N9A=&6mn((#0QubZ%X2$37h47cUVSy zgL1OHQzkM@u6DO=lsr=hz}u50XX#SouW~vH8vkm?&^t_1M(>XElw&YH&_+2<<%!Y? zmBcec*kF~8CC{V7;v6!jL~)+dF|j=FTKT?EUJJuSgGi-xcpJ)xw?7ytIFE6fo{y*H zQq~E^2KBdaoKk;Tr-Xy{TO%lm5qZk?Wk~DvaX+ELq0Yq{IA$A-Q2|W+!@@|7P zK6pNGmQE%!^XV`p)6bMYWo{4QQr@d45?Hh%&)`ePS3uTd5526V(ND?%c$M=@$|;)h z7%MyqaV^y#0k^hwyJLn7`*rb*Cpca>9`iwkiS7YQ;BM4!ZTMqQ%o1ZSxub*qGThlI zBi(PDrYv=176&s)8z>{)s)aLF(6I|ZC|s1{Yv9&Q*06>(^uX3UUyf?vD}a4Zd71h; zj#K((UKa1EU;bO^CFmw;TzpgDxP6U5EQfuHqp8Y!m`n4%nT*T)3h&L^gZ|v~i!YT% z!4$Wcp6|fjZ=wYYeu)}GZ^^MQ9HzmCypE3;A)-x3u|5LT_@q8OjS{+FmgF~wDPyYJCj7kk60W%rL=j$9nH!zZJ z@;ArfH({13?f%;U{ms!3pUFn~10Msq1sJPm&!5!LcLch|js(@u5(Uh+P{&oCco_Ge zi|{hOtczGy$HArXQGI(lPjd{ljW0dLvrHAY0amK;?y2-5_|yL#;oka2em@D}Zre4c`$wP@_7MGWhSF#zXRT zfMN1FGe&vXhPsn~dtb^$y`z6r!_~9*t$|J;ou{iGUw9z}@AAt><*)Xx{DubPS$xy* za`CG~WGOBKO&Clxj8p24`h>5YYSgzV_oChxoY?)nvL9H*A{;k6^i=%5I8Ise^(r7;kAORUo!B3M zkRies-}&GJ+nJE}9v_|1b+gbVkCOG!>}>@?eTl=A$1Rrd$UG3D?q$6B#BLDBOPbh~?f;$95I#e$94rcR5I{yftOUOfS~iug;fD>`RMzm# zfR8MlsXzD+&o;{A*KnLN+w`FjC&E_&{ROi@KRJjnj*VQ_`fY(>i7!yIeFwAj8Yt88 zT6(18rhmO&G{bUiXyr{mPRi3cm?EkZsyyOj9MpW{+DF&~H?#jMk(%JM{qus6Jo zE+KkJ>SWMs9lzP>Cb7I-r!Oq)RvH}5P}gVG??8pAd+t>lg617w+&7iTj?xSRI<1G` zM`J!D60#mR1_YA#kf;n&H@Vgg=A%bVy{g31Ce zAT)wY;Y9K>ub)Jq$yX3Cub-D>9a3q&-MUB~P(UJXJ^BfddP%(CjjcYo<+?qdacbSf zNd2g8q_d%$u;S(T=s@@6rd(W(oQ7kmFVYa6==^-liTjyAyE&I`LObJr#aaJCcqs!3 z{^Cs6u!bKN&?f2Xch!ggho@Ee6+nCb$^Prj7^RKxEAPL55Mla{Z?d%iHsJg?Px+8{ z|6-VK@7bmLqNk6W&xA>FZyK^227>+ib7YFXYc>*2>}0+yG4AR!9(l!_SmyD`JbmcG zU&0C)hZ#qWF|J;Fe68cEZhUi?3e#bl$m&+Uc>jcf0Ubck2Vqv3@N#r%l3D5leK=+K zKX@aDUa^X=fLF(S4N#^vd_&MZdLSj92K8^Bl=8dNc%Z%tXjr#7PI&+?q-4=K{8DND z%lBFOuLtS$qWu2Li!#;&_%&I7YoI8c|F3jj^jjJX9T4i*I zD7ZQDmSdQZH3|a2l6<~Od$2e3{x9)`T4tsyk$^g-{xDqF|83$g2~&VLhd~VO#pP+j z6XW&dZn2FUoJf9F^y{IEUT{s2ps;axs-cu6~4JkiI#)!8Zl3%Ifvb zp+qb7*YlI_b%0f!poP;2F~5Q>%?hH=;2Z^c8BBhxj>#9jdE9N7=dZ|hJl7$Q z6lBIJFRI77rX|Oz;-elm%8laFdAgzTYQDK?1K2ZQvJPv#hK`b9VRv7AZ@T+Maaaih z4?tmcN*~9*czjPFVKKf1pFukU8AF$JlWT{0y&1a6j;egq<2dCw(crq6xmi!ViZ1A? zJY`9R%5RD9!#!FqrtyhYwi*Xb-Gn%V`sXY9JOW&Q>Lt2e)=L0np@Yp`f7~nLX%B1_ zG#n265z1}pYJ3cAcXwbXbE{9TTd+GAl$+_K9HR);Na~%~teVt$;)q)yGhKmKh?gQ> zndcgQ7@&K-_M3cjpv@g>O!&{I8|DA|q?A9N)reOB6UTC?{c5|Tuf{im&jiOMdyq1& zzBsuke|UW131V*xC<}HgJ{`say13f)ynX1-V^%*&gEYpNeQPDrRqKZ?8exPN=rJ#O zC4u)CD4M!R?=U6Iy~r25tc+>SQytGlGjx;CPnI2~=q5NwUkKfxOp8~&x?-&dD3hh| z3J<1UV!6^cdBs=2`a@9P1F&x&OX0>>dLZWUfdf9elmqfA@O4cF?|Y&cD&VpBLk;e~ z+P^CE^XFyv`m&t7I4zf>N%`GqD8;WH^cDag+ttNs*}eCm{AsimAFNX2uwwV7PO1Es zp*8E5sG$WST{h+(Bevtkz*6=;ox?O_QIuI`%ei3_hR=pBexX1M%}a*kkF=_cG)n9+ z)qU?Brp)5_5^ax0o5({T+J?3$>(L?ExhHCv-i#Gwg!2!Qi!$9qO8g^G~itn0A`3*xxM z?x%I~03G<`axAJim47bEo#s-`QL0r-0v>$H62iH|G{_1x{~ zdE$|~n$4&>$4w_J+gE+6f$Yf;-MXIo5xtRdM_sU#pDN+lnd*_EA&Y8Ex{N9Fb0sF_ zz=iJdN4gkh0Q+q(aS;`1D+}Z?YxrS+pM%P;;hO<%igw9NP+lzY!6&||kBpsKRslVL zS>ePDbTG^IKiHj@V^QlV8>4b`by{x57v<@*lk%tMlk#l7r*{7q^-J~7?2&yr-&UWz z;}6`SocI01n*_Q~I#81Y1**8oovsGl<#uRU{UN82EsT&JZG1oz^%J_u!uYT*Qsvf9 z2&0#zexl>hP3$C8AD%|ZVy`e6CE}lp_c&t;>On|@0$pMiNz=kgn>?K~an?(OeSUdd zk35LU@2CKlDG&4%;^0k%`fuTE{DfiP6R9}W5lgZ|pkF7cV}~U`jT6Rd5{)Bui93MY zmD;rp4$@}7j zevn1cO~91bICPU;QMM04FWC`pOSa9u5%to2P&{?SV}_Gu6XEgr= z+0>8UWIR!t8*e4Ft!HsV`pSlMmFX6Ho$6|Z95YayR}@)B-a&~Enb0z!&R}X>JYU=s zwj)CS*)&wg+o5XKISH#!t zt&b>-Zo*5EUmaYPtJ7y?cXm;ppPZGmi%I#zSZ#iwgl_>TKU)-CU!Ir2y@y`H|72YI zhPTzu)xUHkXa+jS@r9_DP(K;R4?I8WW*2cn4_B4OOT*A#=#NtuvF?)kh!9=G6ttd( zZW8)PzcLrUNv;lAc9;s2a>Ms@x6@zJBWW_7QRz%oW++=Zv9dPPRs2mE-TEP@wbS%_ z0vrysmZuXbG&W2&%BN@Q5cE*t5M6CZbO7lv1^LqLNBgDx)9?ONMjH502G7n%Wp8g- zUhF)KuYSKJAnUE|opQFZr$(}@IJ^m<{VhQ+NPdNybm=;_LEp%Gq;Ury28$cF}f&adZitTZU> z93IK65*ibb#39#yc5#w9h3eT3P_ZGZ#}c;C|3&~sG=2iumx|c}+bG5xd}}#N;jDe0 z6Y0sM+0>0>HtASKh-a1R-eHhjsVBz>*;0LAlu##joJuyMmxq^Zs(eSnGY#M;%6uYT z$ejpkS zQ#}fbvq6%mupOryBczXF$;^(BD#AI+*Yf##KE}n3jFnB@Na83ahRe0m40Nw|nZa{4 zE_*U$t~a;bSMgZ!I5)#XKf#L<7EhXp3v6M|(D>NgojrwmZxhRk4kQJy?{>?Ol|QT*BS({fq{ zW%KxbcROzjaB%SQW?T9RGXy!8`-L~v(7$QnmEL7An-0-su&kzoPpa-V!p4OWVoDet zM0^?~@j@5A>LB9V3K)zMbQ2xN(zl$!fnmZnI)0fe%94Cmzp&*_(+$kmaC4f9zx9Q# zI_k#PFvp3QPu=7;Bz^L9?i>RJ;L%T@ju+*oW*U;gXQ%F)9zg?@DA|R^AENjO6X0Z3 zhs~tP<(GglntW3%j991FPaemp((>?6&~CITQ$8>?9_xJ4O;p&MOh$F1)Fij*5q`+Xxy7(iZx|Z&RuI@=k zJ=0W_w44UpitRf>H&LBlP3<(@(S78r_`E{LQA!vch1sV#L2q<_?j7xy@ulvO1lL>J ziVp`VkANRDW8CX}*=tmM<3SatJs&m93*2XuxhFUM^0;_bKXCx1s{b{dKWkXS8UWe~ zHU}@Fa5%DRkT!_lgfR}AqzBq-?=u0>O&;!Cmw)=*XX=ZmWm{v)Xf#ouxl>MdzvlD& ze<9Ex@KWof?7EA~{^U&oeP2SbonQqVLpSJ91p*yrex~|yP(PF%S)z3js3J@&&rn7@ z6x-T<6A5B+S=_VGQ^IdTIN7>{FqQ09hbg)RJQcZL)V~C%4H4TC!j+fNcsHzSxi6wt?)meY?S}>oCmBX`U=1(;X^Aw`Q(H0 z$tUkiQ9zr0`>=heQU6W0_*cN!Re|GcB1ksm1~qIXSR)tVWz0su;6rhChp>WfID3@L`dTYFNL0ADr(GzN^8V3#XeqhWtbg;F?l7zSXsgmKmCUI2HJ0|v{+oOhiJ7Y`2_+4VMrLdJWQmGfP@xOj)0B67JHF?I zzF;uZ3G=wDfTcVtPi0|{s6H2I7V#Jyls#vb=FE+xOLb5w$_iPsRR2;B!pT&95g(t> z@pKC;(cjw}_zSfU9vqfq(f1x4+o_F{oV`y6v&%A6E=_r;)CNQkmMs8&B}D@jFMQ~) zO0b4Ctl_l)2kEZ*`DfFO@{gyR<+svN{?qe~^1r;0^18Cbo?Ttodn|!|00$2*anViQ zdw5U%>WatpZGe>9&7FZ)27ISL#{;R9aI#B0K)6Rl9S_sG`X1F!ugVw;?NAjpR+-00 z1sFGD_9^42P#xo9+^yrWcxG|1ET8fEiO}OY)MI-Mqnm8hfuxS}#$G4j8Gu^fsMz!k z#WgwM)%ZkYRSr*{eSVhR!uPaCW#fU2w*d-2)AgK)Wwj4ZVm^2^Rb8Zha;>=3-Pm4< z4|swMpXegY6b$`D^(t!Jq}DaMOS=z7-5cFiUc|Z*;O4R%Zb-R{Y7M9~gFxyn ztB~hvQDV4Mwx8lf6Eo#9uBBPS8rJYype9^~>c8=q{A1@gK{xq2pfAO5f^PD&pMF?A z{`kG6)dX)1)G2J?H~FqX{f_>VT?Bxa1QALJ-Eh)C#-ctP-8lzD7r)R&h+|v~T_pOy z#!C*hZUQ1x{dnwE{|(|m%_aHx4_=;OsuP+QMK|HiFr`42an=WvS?UT)Smmi_EXjqh zfb~q%cLW$@``M>VJ>M4p=>A zT)r)dHzz2@qB_QV*y~>A^zxX=A%#{H!-UO?iEl=Uc^yb;=m2Pbgw5+`sRJNwr9Bdd zqm_L^8BsDFugFbrL3K(-&WlBclMy)&BYlRkhDk;kn&G5W5*LrQim{4ZFcnpdFQ**} zuS@f+3e{&W&&LS|tp1YDr_qmT#+io+N|^h1srGQNzbD05hJ|Fb9qwZfo9bMrs?>)E zJKpmpd!E?b-8zW+%978-e#A(1tcO-sKJj>sh$>HU1;FEu6r@x z+Llquo4lw7?lq4RJo}(7-$Vwfy1&yTzsH2E6Vu!dIwZ3Z2Z8K<6o zIt~5;okVzAb(1eH>T-U@t*dD{Kff%Om*cXdab==@NUBMh5B8KHqru$-`j-T{QzR){ zr3r*dYg+jPvo($g;^>xZFuG_lrs~U}=pr^o;3Y!`Sz4Bl9s&}FTs-}tm%gd$J7V%cv8y<2pHmK4Fe&@|CoS=p0FNz_M2%94{PUt4gz8&kL$GZ5j+Q6=A z5PAHC#-{VB1u z|NY^-oJudjZ*q2aSq=~PZS(ORn90VlY_Mh64*}>y7bIXQun4;A1>r3SMCKs8nMHTL zz^aGzsGsnesB0H(vrMbpx(P^}`hTy^)%~-hRQ)sh36spwO_*fHhoyO$`!xL^_Gu(f zfs`3M+ZtLo5u#_Lza)=y`jmCZ@q2ZqX~v8GW_)4az3Fs1fu_8JG~Yj+*u<@voa z(mEPZkTj$vFHc?3g`~q2YnM?d(a%X9Q+X(1AZ1h5Zi-<))s$60c_%r=Kx`)*5u$uR zh)TzZuo7C+yebsh3I@l|-(RtaI>}HEyW}T&t5@?(P z1EtC-%H%ihuC zri{*5jDO=*FwElG8Vo$!>u|7HK9p|K>m?vfal)pK^h zwyqp1%&r=mdP(xuM-*7qO~N2SCs7#Qx`|L7o*kyThn``o!LN6ivRzPnnTx>zCCu%h z6J`@zrWDh`qJJo8WME;i%z?YtO%ln20XZG5F)&oD`G6do`JtOo8>B_IAP>s1O7$Pu z^Fkf!3ISvo`?*410mrExy|S&b!dX=eJ4ol|)XH-kgUNp!9vSf4PR+Q|@j&pwK=^PI zU$)=h+tvM)mY_)PqaS$=5RmRlddXzIRrXXbhbnUH$4;8ajAPof;e&KPMK0|i+>9+L zl(acZ71y@v5>->}!tKX#^%U`wbO~0%S@0-eK=Ry67q*jSp}DQ-CVDQH;)!b)H!lYY z?~6q*VQD_-m${W-7`@~k*J@7%AWe+f%KC7y`kFsPWkNdNqMlpQ$9Q% zF6kxgfyxWw{BZ5N+A!%d6N2poE8v)y(hFc}AZ6~33F)5|6ZPNvN7q$1bXakrpH$sM zRhKkh{@x zkZi;e2y{4ugdK1<&>Fd48f1J8J5KG(jx)j%m=}!>q3;~%4AepB7~YoL&{jp=0f@5f z3*+Qc9Rp6&Y?OgIv8fXJYq1ib{n6lYfD)e#pLBE{c?=Ca-=;um_?~L6cy}^7W>dY> ze4;!wVt`i~O>Pusncb#vOYv9^7)0cen0aF8@X*~B$2k<`^4!wtWO-Q*$A=|Yrq4`U z8*1u;Sr*7wYFV0}Q}SaeoOnI_uFtGn>Rn;ix$Z~CML3YXed*X(p3eu-PR}mO=H#;M z>UuY=kq7vr2{bPKgJwI#fr}DMGCFiVe8iXWS@Ont6cv50;yi%{6c6R&1iQ#Nol!!g zcpfg(8s~78HM~u>f`BWaOG{pvKd7=U=aW3?L_zULyqZq1|TT2c&=s4uwUD~!F4&7WyIr>=?nxCU=sx@ z&MU#mxoe#WnMQ>||3DYH8Vjp#axLDviSlGnWm$e6#{*{_B&o2SYb6Xa za50!s)_(O(QsE=vnaUGe2&HZ^FJo2c#z14)fK?EopIA51VanBY?0PjuJ##O7ZxR*G zdt}r>lj*FSG1KYtvTRL9WpKl%niN?9-2>;H4v#TR2(4`J70HwBanMcBQ8-zQ*+OLi z^|&rX6&&aQ#``E3G>)kcR)kZwL=*LsvR5JLsGM1!4!#SMrkywAQx-grM|?HE>L#MO z;)QFot*hg#pNO}9qB=omvwl+Rh}*oa$Q$V;c92?L^}CuT(RHtbSqX!an_0d?Jwy4i z8K(=@O!7_k3Lu_ian`Z|21ohVfi7naYgog#0NVWh-M&|i?%!YFKPlyl(^(lGeO!L^ zi=TM1+4E;7<&&fB@;C1-{3gFTx+$M*jmqBn6bZuf5dhba zIIu>z%c|iPr=JBM;q;HRET zPTXH5Rzl?H3aOi1O@lhEFm)62qKO>u?SGIfJ;*@w3RurHy`zxJPaj?HmrXr9r!UUS zv&T==Ip~SdLwK;iE3#2uoSYkRP#o*QcyhH<=39es9KC~p0<;RNqFa&(LdtKC01cXe zn}O(}kxSN58Zvw+z|qJC}`lx zSETXNaG7GBaX3JknSo)#*WExHFQDYizQ7paHM-LZtx>9gAO^^_Iu7rViZKe(@eAES z)bl8d&_YG20F~9+r~aE}nG{GKRB}@^!i*0!v4%q?bExcz=X5yUu2o?JDX809+d3VR zdQ_eDfrMc%<>AQm!6D-q_=*TIMp(}68LWaE^=TAuYksZEx>4us3$={5{v1X%ay(~3 z&JS^Xkd3`cag;Kvo26~UGkYUW3a!UM35$1LE|BtpIBmrSJ>P@mE<}ao^Tek5fvRk# z3<`kbgqDj@nT;8S`XOIXW^(L_^-K<7&N7WLBbLG0U=bfim}IKon3W;9Xc#G!?b=KA z@9%DwJw3;{EFZkQ9LWfo>YmTaOmsYE-&vl;dAYc_EXPt@4m8j)TgEdmR9EDi#tqKd z{*gxFHE=%+(BIkVo0KEjqMlMU%6-^Ko7-vZP%HK0pfmIzjY0HS7G)Nq3Nly{Ww z*6nsQL+E-I$nVx~!Y<67yVx@^c1e^Z`2dMXTRQuUIXO39mZfSg;wPz*Uf zWfghg5?8}i7?fG2B8Em`0x!hx={e698P(My<3 zg^$wefeyCrQTd?tSjQm>imNu@RTQ{QCaC3EqCM)7Fru5h6sI5Jbekhx4L2J6k%FFO zsxW#3S!lccY#|?D}!PjFH=7%N#J)h2FE4C`} zKwG5UUCwUG)A@n=_<4Eu;=G(bdFl^Bp_A={E)%UvVPEF7_Nz9@r(gK}}RRi2$*mg}AU^7!dV zxt1cphQ}X&^qxP;^4WB^Tr^xoF99KVT6Fp@(5?C!k~(k%h(pn+p0{1 z)s3E^hx=RQM)!E6$BOCcdc8Uh3%P z6qzFKGKMMtHk*`7lU{O((^Ndee>^jsP<&DsCc?cgf}HZ8SLtv&(lcGaDh0&X^E5so z`HWBG*73k*HZ4v+P@h~#8mCPpJoi>X2f|(P@iG^^WU-g2Raw#AamwRnC#fp5UwY5J zrK~byb=~%0Ti3j$eyMm*(Q_$y8`F{R3-wIhpqucqEw&Lt=^yAB-&S9Ct~%$Q#D1ov z&3i6{c1S$Xo{JU^%HF~>9ricnKC-0%bycHHGwmAIu!c7XYFInFdv52C)%CMFcW3{g zoL}QN8JFqiusnWxs>V5SAN|S4@0Z=Zz4GaFS8bhM;x2$Xs;`0?ovG-Sqkj%eHhF%S ze&lq5&_}92#e9UJsh3zsQHL42O88W)i&!qI!OOh*Idl_nv7I4K(^!^|ZW5ij62fOk zkIn#Ze}^*KR;Cn&!G(A`Md_SXC^}moqx4O`QBnpD>lx@4=o!)(>^BiFUF0{H8h6%C z(;pbLhzx?S@dGEoI;(5SI`Qv#E{_iThT(qw* zZ0`_t@`?__R^CA|$-A-Zhj8#}GgU^|%B#>0Q&4;~`sf70D9Oej4WC)2ye(lS2Mr(O zO$l#IqTzGHpejJ$kZmmJq?QXa9!Du@Xvj2v-l7oBG&V5MKtUNIbO2N4b&Ai=j<$G^ zLd$r-K}w!!5J`EA^DA#OSUMm-Gm?Gzl<9)v1$<=``0|Nl)d;~cIvker>_x~hST1UM z;!n;LCjZTHst)Mn`H2jWi}FmzJ(VHza4;x)GI;o)+4GZAe?a7LZ`TG!ewYE|8BRwU zMWYi7s#2=F7&Hg_L+_(UT8`mJzKrOO@8+t^Wc;vvpUcFUU}ggM?@YzS7#VrCql^us zuin%QCxV3vF-Qy!R|=DIF{)V)3=3Ea2>SGZ0(m}gHQXb&&Y-|*92ONPCk+oXGC$;c zbo9&~iTdMDqBcs9D?0Wvt%eCGJ`594)fM%HFWin(-G?+#Fg$K%({g`rvs~)oCw4L@&r1(0!8NR54Q~Q!DJi?OKoH6BxH8WY0&Rm#7+X;=x(tN(3bG1f_vs*iWPXy_!; zN8p7y%QSV9_*(u#H{oUOnRJPl_E-m-Ol3?brutON(o1EhDKa6mO;a~<9!g`~LIZ1} zw+X7cM+`K|x6@6$Twig_^gzz>gjp@aIl*2x;X=>OOF5N(K?O=@@C)1*Cn2|$MxKg8 ze<2;tQ*;zpnozn(k-mY$^+ffA5q+v-pDEo;y34+v&0QHzr>7U?i!Yx^Wx6hd?VU1Y zBX6BkrSNm!bQAH&8ZW$7nfSod;lZ9?CTyYCaGd_oP1pl`FY(IkK7ZYo5T!LXgW;mVEq?v2+vZBg`=6IP%;XhSLzcD);XnIXT_cA1~hB2C3pT==mN}z8r6jqXB#(KRs<-xPBNmq0~!;>B8Hp7zIK{ zi9RlL5%~0*u$O5Z-_J5-l3C~`n`NXv@*LheNQd;5eb{<~GD1D8e zA}WCOlIk-7$I=(4nj0K0ii1XMpYd9UO}Z` z(O!iU@h@m)G-et+)M5A<25oexp|c!lZxBoIk*Bc&djBwm@rHS(MmBmG8UAKF2FWPs zj?y^3%8jH`{D6GKPcb5d*B9zcly;jANcnBiap*kIsXCGwMg@oHSl-;w0r8OrX29M* zEaia)7vAjPgr&^K2N8dvyt$Svzm(B3QXXfL@9xNGJ}w_9?Y5Ls>7?b^=+bp}F`Jf4 zmUHV6*Q-uxto1#aT*=NEm&sJdh$6TjmzNV&Uwi<{_gTmGz!zu_WVGzcU^`U3Z0kDs z>LLpC3mGMBbwT^lzXwzh#T!MqDZ_dI!ghjHA<9A(Ii}2#yx&~2ZaSU8ml})lXb3;5Ie9CL|1R;1G zP95MJb)6`X_0sBw0cB@cPRCao5Y-}-j>$)5dr(gFNPTuO_i{qltB^vCE=RfqolgRb z1dWmq>ff&bC1`0Xqaqs}Z1MU2(wKKt(rU;9~zW20|RS3|y2My#)P)@}k61&ci+Z z==_)HJoVZ<8%1fxI`4(fxjQHyKR7P;j}FSFc_F zjls&$L<{4ZHmup2Dz=RF1VeQCXdm}*YcTdx}gJ*Tiq6(Om6%EJJKbx ztrJW2M?&rx#iPi8qWxnUY{RdD)p)|#^@n=w*06>(d=H?;zPZbI5d7BOe%Trf%g%%M z%O9uvA%DZbIPu1z_Dwxlv?>58LDs(S!yOOXBR@f_Q?-Wa2aO>zw(h&quh@rC;Mto4&lH*Ru`U|F4HhAtfoG)Z#JnY;@!!y}!EF3O3=Iqn8zp^QmllI# zt2$Jfj*erLH!RJNNmTgah4Mq29V)G4c8u0CQ+}6Gyl0sRk)f>i%tAsiiy^v8d8qdmfcIEpr z9#8#2A>InH#7#-!2ChIX*V-yO!&tJ9Ldw(%hfhr4@yxUOY7Poq;;VRqF;B`K`vGKUAxC1?}%K6+hawfUL3KGJN}yYgoe?-Zl*P zc0IfN^UIC$Z=aO%rG}tXrvDP4Z8NLy>f)^2@Ph9RLhUvJ99WVVnxrxibPxAAiAnU6 z)X;@V4{uCfjQJ((^%JlQ>*reG_{f6#T+!4`z^U+3*o+To3#Y82$8sUO@{XCFqR4o0 znyX>_`!n1lQ-Q@gg=9jJ;I~wE0<1$knVC-?l9+Fkx z%ZUwne(sDd6btU5* z_muvjD0)$(UF3&;bWbcFe`?NB#etz)bvl;PSTErks}s~OazX0H*zw4f#w%A;Pv|o2 zZ8((PalW-zKD{Vjs!Lk7i#j{K@b(NW(;rG#ME_)_s-pd48f^UZ*n`4NluV_%ge9OF z8m#8ChBd6=?StC+&f!rx+S@7r>BUC*PtU6S4FFx@i}6jFojxz~8FsctO8UpQ4DMD| zI-3kqrWP+`+*m~R>>}V}^yB`@JcMw_2nSv0D`B_Ci(Ech$+$=wR$%6bpYf4E<7I9s z=fXAswy|4+##cFGH_PxD=as)FmT^q#EC<6#=fOyN1zQ6(Jp@{L{3aflG7h{QDApQ& zsGw)(p`Mxl_~*0oA3uFwKKuNM^vsiZlD{F~bmc+!M|DmfORpWf0i2=~DZiiYOTp3k z{t|Gby$x37HQdCv9VZ!LW5&aDa>5o>bX+IndRL8=bd&7o6Y#HGi2aocOQ;`{)*6>7`rRk3<2;ngfaIEHQc#M15ne}1M9v4F=-se;Enk&uabCsp$g_D*k?A$1BHX1rk&@mdP4)JvgnXSRhlY56@ zoLFA3ol3@N(KVkc%}iqI?5XlNks&fsr?(;F;l*fFCQ@LjQzlwa=SKa^)cdk=H!3iW zQ)YDxciH6MCwLijJV?jQ-`T~u49itaGLf931q}m4rx9hd{+n{NGZ)hTh7!(fQ!d{M zyUOC_Va8DEQTAgw*|OvGz9_~@SXiQ5Od1`86A33e9$6pXg)@z3o6gGz;*TZU%QP(? zJwC*V;xMI5xh%iUK2g{Pig??bjSs`bjEgPvc* z8rJar0h0obH>c&%)6?>w{`kB+dHh8BEDo}74k+W`uKJ(hoTd6WS+t+r5{O`MUO$w%A1LJ24~7oh2S_x zKcObjSCCy?=opoO)i9JjuaSE2v0{Yh(oL>5=jBSW)9Iu6j{Zris38l17^b90xFe%ZgkUFn$I%*&8u;!fRcmU3LK>HoPs?% z4>qr@m+;}=d{+(T*o{-s4n|YP`3O^`EO}4IDYH$z9KPuq(4H4X*C0L-IkFblp=FAX z2i1DXLxn>((K(eSw(PI*Li7>zBXpC2(ox3LP15meM=1zzjBE9ystXU@M0r=*c;Z!S zATQ0ms>SuGW45=;?!lpAHp)Mq%*&&*D{mWhdV1#N`S%~*FBj5Ho=v3V>s;I?9W5q~ zuj~>y@5&o$fWs5usiFYf-wN|np-;PpHLT&g1={ejhPQwB>1p}@efqpSdh}GojmDa9 z0r*Ym3h|q4oP4R_Z0xb&grQI^{jXT|_a@;rvunw2NslPSl%0S{r4CyVVe^%)>L$sX z3K@d!G*ulleuiEm6rHK!XQG$tqtQ=l=UqGb%0rueBE-L7zlp|jcfO)HN>evsvYGuR zI(ZC!I#FG{lDY)ESFE6$pi5NUftUKag)GoazWn9R#3 zd-JkCeqR3d@wDu}|9;sV?nEfLqhwPRXqn=1P_h>oGeUV|LIbDqPcSw_;c<%gvpHDWMhAclhbKsS z(y|O6!vv$mGfaD|$B#}UJ@IrR?2&pY8BSKpgd;bXz~yWWI4GM7=tj8m+Dk?6%_;yRwHve}PnDx-qsZ`+&fQ5qkV!U4+C zdyuD1B~EC0`Bb&rHoI?z1@xSV7TFzQSNJH93ATV_+ss`ig*u{5qMwyF9Rr- zm$%Z6MBR>5;L}-Z2V~`A_U6KI${t-94HzgK69xvfN6C6r+U59FRJ@39m#Xcso(H2S z@{Z#%MvfGBD9Q}eq2!b=43jADVkSpkn^0NA;~K_>jS=bqTEiG7u0Iuael;sw-m{Hu z60%;yNWrGw&^>>0HYuN->%7CgI>U6ce0I6vFWx7_3>xxW1}=38x&*}0Hv3~J12Pak z@AVqiu!ip+_SL8EYFvAEdF8(2*!!4#GvMQW19enC+rKU!ZC;l9+q1HFbX=x8`!Y<_ z?`_Y^uce!Ov|GxD!qic4q|z1evA=T-XN>2s>>6I`cmiG_4#-F{6%w?l$`^bJ77^KJ zEuo^+HFvW5GFL+6iG(fF_23L*rA8Vip_>G<0w$b=ih$3sWl0s6`Ul7m>zSqM%-JlG zF!AUn=p<|hl!((5C#apG=qW;+p}Cp`9(n2}I6s+H>Y1eq^DKC)Am!x&j^paFp!FUh zvYd^I9>jj_=p7hN4~{$MsAL#dEYJ6gT!nq@6+Qcu3(~ddS$wYAdoG>h*<@TEOAk3! zWlyCH&Lrn*&&D!-MQ1nYBs1$Gd<7qakPk)aLd%5x+%@0~1_R%}_<0$0c7I6GA0(1) zbf{yH&GFI4g?4p36xERIb`7TUy_R-od#8i1v=`f>ZMVafqGF4#4!VGZ9C&<1xmugkyr z^HuqeU(U);hn<1)n!rrbQ|TZ-Q^$8Sd0zhE{#Ds|@PRs>nPK&*w+}0L#YJ)c2ZAkY8tnel}8LmZ9+v z@0D`$#h=UH{OYIW^Xb6LU0>)~``>*WdMOSjX14OY{`@fXP#mW?p$5|C{>6icV@8>m zyR4jB*)3=WZh_^fE+m#vO3Wjx0`sD7>@?yUX9GhN!^sWWGBs`~b#{)LS6ebKgjXEl zD>r&Ic3oJYnw^w(zDoOC$m|4H1d2S39Nw~5pr@59AsqlW#~PvvgdxJzayEXl;h`{% zJ&hF{nP7fQfu-~q5Hw}a0O8zRq~!FlyuEe_!^_uuR4i6-^4g6kX>bo||-|%HP}F@l1d#86|wIfe$ROw9QUD6`MYk zXA9m+vo9ui&xBM0zGi!%dhka7O27<%9HtoZdqVaV^YKc{zG73XPJpU$^<=*K^?wU> zzd@y@yWc0o{8(-ST{xGOX_p|+!4%uZ--3}rt(#Kb7t6$990`}zFu@=>P`W(@bB1aE zaRrPNJ4_Xyvt^rcqWoB9&)4ypWJFz=s!r;JoCUAJX{Kx0kwI0UgZ@bM?^nQDvly5uxwKq^i_qvIrsu+rDC4ma3=Yi2?13{gUwT!V~X z!y4A`y}^dYjk$D_!Tv!xIA&R#I^gNJjQOfHH|MH2wemR)B|;nAMJ&Xva5a!-x+;9POA4cq_Jd|F`azB5oG$6;~dlvx`hKZ zzR4j~4&l6n8?9yOsdW?(TcC!~NBnV0Q;jX4GVqdob$lSY316iJN4n0(qA%$qNpC|2 zNpuq&i-bvwC(F|YHQ=Coq{EaKu^1sU=_~n?x9KU;C;XLK#j~WI8d*f+(>0pK2zZf9rJWNEu+!2d>~`&Cr8KrVCA)};T!2Qhth-CBb-^H6c5+iKm#N% z18-DD~_HqjT|bC~ygK z57f+^lR-k*c-T#)Rrco5P2B2KE!;KdV_JDAU|PekLh2TZZla=o#7RVXIXYFlM9*M3 zK3fE^5+_!^fXgp)S+-AF&pH)FH(}p+9uGgR`T?z*=o||jrJ}-{(oLA1JJ{c|9`cfI zqV&6Z{-~ylO`Ph|C#Aj?|$Hv48n6`il`Cqf;NqF$v_A z(DOZ5{uK!cW*W*JJg<=!VW_)wsLGIG&n#8A=_TevW?nk{ z6r<$7{z%WJnh(or_xE?p7t@{cvGfbxfd5p6iO*5tNRJQs@fMs8;XN57Kb7G^8XT(` zcQMmLSdY;o{XAxV=*>J&LBgjkbb{9 zSfkS7Sz@38GmaUhq?g7xv(t66{LRr(xwp4h_UWjU=Z@m`mH$BJ0-05?t@>oIDHLTZ zusZqf?!a=ME0CfrkTk&)2MlERP5c#oDbqJs9+>vkNyalAiRcTttl50CT*xS4(2AV6 zT+v!Z+82-69;Ke{&Cqsm`PR2Ta)0ap)!==`=r){_=rz862y;Jfk1yrLO+J8t7bBAVpC6 z8ZZJCA;^PmX$V8r{RZXyjfUP~Uc#U;ye73VlDs-qOoHBF>LvNoDfnXkg%HQ7$9xce z6)mUJUXdr_*ku1O>m2mr7#}!7IkPH1U*Havmcg8KyzoWNOI`F61}O$Z>nY^NapHB~ z>=;d?9KIW%02%rNGhUB%^U*^Xka$YaY0*#6SC9i#l8RtC`UeA+D-U5k1|4Ky4*@y~ zmLAiDHnyZE@03FgW`A{bP#)^oq2hUwxFg(EemF_3nuTRafaSeMvXr(M3+Z>t|a!A1~JFZ(R3zPm(GPd$RMwcXFdP!!?o) zqMy89I5;i41ua+E2v`=Z^RMEdLS2gcm|gB|h+EZ>&l=XShVK{XJNDJl@XeM#o!ykZ z@e9A`%@?{1A#STQTmZd9t(hRJTz1r<{vUrve|=M)J~=7-hx_I6bjPc3afqUK0Q3u< zT&9i}9*WNdBn>iNnsKT_#qs@zuL2iGKUu6>p~fdN79?0!Bhr7um8GA=;{q~=p$nY^ z^w3%ny`#9*o8{++^Kzy} zNW;9GNr}-z$46Q|*}W<6?@P&0!~d^741>9}I28F* z=(m-3^p$jA*H&_wJ=$gv=sI|m0wse|cK!G&s(eSCkDJj+nY;-gP>W~tI*m6;lGgz6eq zw}b8&?n%-_`WTFtcE3zjTS+CedOaXw;(->ht_-@o1*_=PNOo0)Xz7>v~=qNZy8RSwoL2fUYf}RCJn0U$1OL(D+UZPW(&w-PNAZjd-{v6!|U4%gd zU=TuAVHFHINa`9H&z_>zWw-_v03Bq9o2>@~T?So+JdlxYZ@(Pw4$H?fkU!RWj&wY_ z$&T_n(6OwB87P16tga%Vn=l44woqDh6L?5xf`pR)Dx~Q7 zPzx{7InYPM<21z)>X*4fzrnAlX^poJzVG8BZ@yl~nU^q)d2l3-s`MmAaKVk06 zTmtr=We-?o6LCV)McRtW1N|iBd7n&4?{Hx9RLMe~bzQ^BuTajltMhP+XuG`R!Eu74 zWJJ?g!y4A`y#s9+$LUmq>iqemvi0Bt^}!ondHZ4-{einY{ai|4_{r{7c~1?QErWh_ zREks)1MyFvotB3WkG+-QH_=M~%E5%Q`x>79$hO}XXJymQTSa^WpsWclx9~QH=}T0o zE;y+As}>fY`iLii?cfHg`v?>$2XV0+?28 z^29!Eq6$XI8N6~2b@nW^-$aE$7hy)JdEzVDXTotLnU>#-e|D?WRA*enj|m>`NhvtK zufclL54pFfs!zd#T`3ZJ=FUz|%f@V?Mt@WOn~(Gi)p#D94?ehGE-pvq7l+q=UjGuf zU&iI$>_z$Mp7PRpSAj=Aembb(7AIUv(gkX?8@Qng2scskRRCd*q2&bh1I-R2u*y_s zD?LVa0ICnBonI+D;(Dl`)TW@uDx;#!cj;2Dj>Htt60=S{D^m@fhE2oAIKg>pBL(>? zs*`w$R>Z+d9$qR}Wq!Mo*riPasKp7re2zSb7qv#KGV(CcQ__o4Rz9|Xdg^OPR2r^T z$(??%tqxKhrgO##txi|Gs#ZpU1|-rbEn(`}A6*d7z3@jCrnAR6fc>hR$R%DdW-DX_#$*u>c=RG)g$iwk{b|gq^umfeO`Azr2!_ zpI@d&`G@yjVxsITit)gHVuwa4%)$pk_W9z&3~WzePr)mY{5Y07{LDSyh>t?O^!wzs>{@B?4~j0I;%jY!c- zBuAnol6p&e@BKbMQ)}s8d2YS+L{j98W-!3Odyj53+WWrVmUpM@`+g!b_Q|vBRNcDW zw=oU$iK;je8EJOz+&eQPW2c$kvrirmgDJMMAv<+q#y^HJctQR^_PbYL70mSBs!eS# z+Kd{^&bH@h&=Exr?gy;E9r{WCrL$x@S$M~`enMLtvp?J|fe&7E&7_}Tn2~NGWGf*C zD(l=3jW0BKm2cHILsjk_dPymR#?)PAbodO>j0{GY*}-ZT*Bw&tz8|xWQSqYaB%zlO zAGr^D2oo4#LykLS>fDeMpS+My@63eg0x?6?brZSi%=lpJTMme??mfxaXOx{ww}fe5 z*i^2R2Qw21yGOdn1n~?oaB@H;x=Ho$x&YB~)Q(5NjL6A}QJbC`bKQi#7$fZF=B90I zY{<708mgvtToj!KeFs0TPq<;Bf6!IfyBSQeuls#*kGkj5=ovbS zKNc^?@XJ*0Ev2);b;VQGfrN+hFq~v}5~Z-==QN`Wf-eDCW)A~p$KMxbvbDB%HKyA2 z{g!*sgC4wpfckxWw9kge$JG}u$w$OmHg=kjvt@4 zO|{(*kE*i23*b_-ed{*4xnSp5N_aQu(wrc2v3~X$Of#mR0PN0Ph zq*+4NuKZG*U9Jj_pYjaGX2u)})e>^pLT4qfWA+QBz8jycS*g;qe;50UvfK^CXc_y0 z`InMh;mZcVPlU_y!!H^TcpqHku#R;;+?i)jRW?ZWLmWt3`E$dm3d9w8+@eu<+#|D3 zeV~OKga6lA?KW%UC=#{03P7oBx$t2WI zHzXS@v19KsmeMg`8EvLz=Igp3GfYvs{n3af<-Dz+`>k=S{-{vy6NV9z0e~O6q+;?V z@#2|Xkp?L3K}rlLCP4W!Ksiz1F(C$31}`DQ$jWK?lZpdk9F3VAoKj2wJg#yY7BVnl zVB~`(VGK&3-Da4kWpCUgvpS$cxzj*I$bCEC9-NE~Hf(%I?TOOjIqfr;Iu^3xxd5e~ zdu9ly`?(}TIO?%!!|HF>f5i--rU@1_+cyo z4Njiz8?c?>?$*$z+HmUi4e2DDc#DpLZgQ{CYHeDhwQ3Jd588#3qrNJJ_6~@4Pze^lPr z2TCsVkGgUv-2^IKK{V+l7&oOyDBP&{^kKKqO+?W}&`AQ(Q9?h#jnOpXkp}6Z>u{ZZ z-N2v*9vuc#$>Bpcah)ot?w8k&duz`!m5h5WFm#bNPg$mwEsS?o^U9&nP5jjeq&zFW zcs~AY5(D22BF;Yl5Y#-vSfT9s`!T2sgLm$|x#~d=dhlL@8j_*or@hNy`?1%T(nOsK zREY=GpS`l)%z{p!O`4gRv@6$cCEeuqysfi;_B}#F~!;1;trD3_qxAg289RFZKuH6j=rW3{YGHRtDn4d#00DMo}op zGZ5WWjLc);D)P-v)ISWrbA!UiIz3eS$$SFaAco4ax{?>TS1(6OxJWQq)ktdXUW1zXA5pR4XB3=)A z(1Z6UVCVoVP+zsCmXO(~v%?rcvOELr2mLm){I=Cm`;5Q5cXiTjQ)|w0tAl{0&TaNvMYmT9y*n%@KgzbdgQAZFMdm0zbP(53By%@i zbNIol#oKq#g4$yCGhGrzPw@t^8;0%yqWs}5k+P%nKIoTbm@0MxH|Q0?GaqIQob$UF10n{fn6Z-NZXC zp?5AheMkL7R&a}w?3BW=!g6nG*FP?@7dfwFpZXE+KNXfNrM^8C5g%SL{4+b0)hp;K z)vQReC-i2T;}OV?eZh*F67PdvYhL_EqONhGUY#1x9W!bQGA zPl@|MAMyKymrsXoB6;W~j1*lj$?j^8QqiQ3BsV;I2W~gq%Aay|Kb3v*hj06r22+3i zluv0G44cJm+#6B^b z-38FPvfujR(yHqs=ozc4>pm`G?8(P9;4s|;JKdc-OMdwA*|R4+3w+RJ%SFbjRRe#I zKrD}$qod`x?g8S~58Z1;b-mC}$}J5;KdI{}w1?atds@fglx{cCt@_e@A@-7VaJGb% zuAz%dR$(PC!@w(?yT!W>qRuhwCg>*U9CReEiy)Jq8%1+C*Guq&3O6)<)j;;omLFE% z-CLgDgS!BGC5?=YNg-nzdUs$c+(QqZwuc@%W9J_@Wy5L=Ha0eWR>#W9nk_A@sdDKh zJp?XazF{X%%-8@LP=-e)_H4AZAY}@*U+;Dj+xGH8s(k?mWvl=ybU+!rY6#rX#%L%K zpAo(*5?WN5tWa+MVj{}&e7^xSq6+1vwgtMo@ayoGgUVl4WGX!kLu!3ed03Tc=ySZ=9o*OgYzVHKt-?~v<7`WDK)+vQpAiB{AriVL61}2rz`G4SKKA{HeUH>a&H(T87R1sQnHv$ z;WImgzEnRWGdozepO)@}YPSOwk6EK&%+~N(Adc<05zl9p3ddANT(_LT(Vl4nO@o!Y z8BD_<+EEUUQ6_1y5ICwtw_EGBv%YH6>bOQU>QPYn72$X~A>&c;tisPdUDzoTu*cx4 zv;^!C7DU_*>KKAHw*4|@FB&-dOZqVM5>~)4U|FN#3yg+P zZFr|%0^*n5rOc_WP#Qy#p_^dv^uZq)5oPviUH<@GCfsLGm791VX`-KmzJp$(=iZh`U6t)rCio1N)?-GUIex`DrOXta6Dklrg}Hlqi3G z&`sEDok1nKaezn5ad4E6qeRcD^0Fh{geCcWAf6m=`t_J8$@7dpnf{ls&g?z!{n7{A7#X^Niplj9$-~Hr{@^oDVBZEo8l?0{tgNit;^ImU+#ML- zUb%YHZ7u<{S&vQb+DL0LZL_HB(+}~ph27*X;6a7{;jeHfXmhZY{*eK;L^a_K?$%FN z)I|d6!(2bnP54Yx@-Ny({XktVhMNs{C4(>g+_q8Z2k0v31?UhUIt85`OZ6j686H~c zEZu=i_MitH!21VW*TCc`o%rd~vo49%$~kF@&k-#~K?pxw&X(57_s#gzBo9Nv2I_oTJh@h#@JLWlTS9zN+Ln{il$D zh?Gc2<g{w|hW4cYar zEt}IdSq4Y>t;-Gi)czDZh0l;=7`dfjtFs#D@6R)en0p~#!U{b~@CA}3W`S(9TDG>n zF5GZKDNFPjoNVf0G8>Vw43I-1?=&7t=7W+X$Kc5OSq@GZgrot0_=+Z@W-Nzu<0&Y2 z7*Fdsq|C&iB?chXKqTU3nJ@pB3_7Or!H?@E11STe#3z|h`6b_74W?P11}aIOXyRD{ zDpJT4M}onzaT^?;GL@>$PL0?^b3kb+E@3m4&!>7exVr#yNBy)`S8Q>0(+4F_P4C&` zQ)(mpa3>Gi2}Oe3L)S1p=s^#DZNO)js$OrX{kj|QL6(CT*oPh6gu@?c^A7`W*VJw< zEUeg_JBvPR6&T*xu;Y!@wr(Pv-d(kctwozwBVM*Gsefu?n<;1)sKORd=`b1SG7+Wz zFS(N_^@r|O`6Sd&rsyYpoJ8JkP=(~XY=9jzk6$#{rOby%Jb+9weuBPLkkB&;i;)w9 zp~|q-LC{^$2QaEua=D$#kL!7-qjXB$1Y;`C1M2!o)_c&6{3Eld>nQjah@W@Za@LVJ z=sc8Sd7s?F&W>Ht^%kUyY+@jn9KB>iGS^KAM^I?+WFrH530nv;<9U1A&trFp;1%kp zqC(eAHa2W+ZQb`*$5@ELls=R#v(}Ume=N#>(mzta+jh76ayK->E4&*Zl|k?KT?fcI zLDmb}A9XwR2-hnVrd+xo`o=z#uHs>WB2zpNUB~sE>`vPS3B_~WDqm3YsWKtoeotaB z2B#0zS?2c{JmrzffWlM~4qi?fS6FfWDiUa*|8=oVA2O$-iLSwm`h#e zd_o}kbs~U#2c30o*&ZI>vrnJcb7RISPU4I}2LSf`>3m>J4|>ppUr(T#s~NM)huc0K z7`L7|HEYw86TW(Y@he@>VL+Qi*lX9*)k7uW|K;JNS%*aXx5ZgjI*) zsY8XK4}{$WTN540Iv>v^Lw`V@sPqur3gc(UbO$cegC2B+U(V@e=AAnNFe_uEIc)O_ z%We>*Q3$}86#&1qw5sq!wz#z7hEtYBQ>o_Xmuz}!+|Erj+!*qt@Z7+fJ$QW7E=)DN zLEwbRq~vx&uBRQ)mKDC4r6QMr(`CY-4!9F>c~$vUN4@eF$l!#-7BKvE)viFV*ah`) zLfn-M%$2<|UKSVw6gNa>N}1G=hQw!T6f&R1p|rhmk-JJ4Ug(C?j4_z;MkVqCmhrNi z{Kn_1xc9gpu1|d413x56aXfwEdZF5a8mg8Xf~7=iu)8V$b#){yDWWX~9g0iI$8&(; zU21J?y0SbpJm`ayb-6hKA1EIIOB!~R4`!8OC}mLM%Ql4=O2@}WY;Z6wAz#_nGt>iy zkEL2kaR;TS!wVVL#h|1@1s3rE3W|T*NSOvFK7#^Yav!LOPnZT2KBy4-tPJGP%sYyA zS$45EosiRF`98A( zW7W)^xkc$J8Ue{4ce8KLE}UrEqZ3ItIn}>vr-rxf!toLRz&oLamF3tKkZzez@|{R$ z{(~2Vb~6u)=}>L+*_bjQqh_=QZVy6ymW(*s1q zAH4ze{$73+B3HRXnf(!R%Fd@iat*mX{fxNTr;I_4>l4JqEefEkRQW0R_|VJsJpXc* z9Sb@M$a_%fNs0$0j&NP?3A%~T?$mpnp-e-K5Yl6t2`oD!xEBmS(?Fuc_-Mab2#*$7MI1;-`GYgkk?^ z>-Q0;c==vkPs#V%G22#tO2Q9V;=ZR;<=vpF^c)8UZDVB8cBGq}Y_^|;f>ykvyAu;K z2lpsYI&Eul!8X^{{6or_zGYipS@U+pUx*xxAE%i~e1aUT2R-P)uPM+z&@Mf5I}7dx z3eUKemAcqXre`LyM*{kV0QjZlRiB-D=gxxNo?GDm>1i-ozc|j}v!`(?IQIp>3C*E}s zWTNmf(aiTVb<|JAhr5tPBkeT1gRdrY<-Wh7nRgvRJmu;(4Y}#(t9~DpoKB->H0{B? z0w>wdx1@aV9^M16N5|&owkk=A2w~IX+qW0&`t>_DH@E1g@1tlw`tUhBaeUhML?t|f zlu1>76r2F2v@@`wBC>pcW_Lvj*@o)J0U0aA)S=3mnQ%j+B9}?!A&G;SCq6gUq4O*ao1%TJ1RY>9|jIy(V@Wys$vK4TCXDez^@FG5zW&FAf-Iw7wMEp zSQ-|Tdm0cBZIpq91_IsV$&VSUgax=CAJl+^S04DBPF^WM@*C-@6R_s6oe@rq4BMy% zwd^U%;Ff2>Ua|~AHkB5$ejG8T>K$W{%hCo0#)PNnc&`|AfUV61E!n>I5&ZqrkvZa5`79R7qMkhEeDf*cG5-R0TsGHxv^^~rde6n>F3V}gN!(oM$F z7&Np82@ELU(;y=cEPQsUibusaSVLqUR$r&RrTldaNc66R zk<|TyuTX;yMU1ilhZKen2uji>^B#jSYa`CsSXSRNu17pFppbG`$Y1Gp*?vHV9|Ov@ z)is+M+_OiU8@gu(mm79{VZ-ih>{k1f0x6v^$o8NIJ@`$5Xe;g&&@Wig!gA>VKGx39 zFWYSmLRj&F{=q(DBkG49e&~#ikB$0a4Qw@(R>LI2OF&yrKXX(#eGo7@b@s8I?E4G$jj9k<%eB$3rRNtpm#&H?;RKobQmG`=>P?~ z;Z$Kzz$kAw6xRIFOVCgD=_X()D=>5ucm_D6>o+aj5|3U{h0i>BV5X@XKt;KS&_6;q z8S;)RrzJnq<9;=u9hWY0tT|-kdMBFFMLBGYK`u-5(?0jRSvT2o-Gr4^eB?zx!DveI zgvWU5A9eLUVSq%uEP{;^s44&5Y>dtfXJa(`hkO_<6d?w13V&`p$eYbouf>gV*3 z9;xI!R#Z`Ryo;);19~_7gRbO`iUR|WBNK-RQ-|&CU29=5wRM~5+w^x}X|-iamGko5pU!AxMDQKK<{5x(s*7xHsoZVNd~G zr_;<=?krF?Q*aXUhE(p1YWmaaT!hf<-$wnYZQtjo_B^>mMvG5sf#IfH3z>I9N)R2u z?Ixwac=QtVlLLUP^q>bF!1w^g<~nb6(*=W(RV>!lMjI z#+zP~!bpn2l-Z}{z@|AmVhc;F9*;(#Z*|VjjU~k|p#FLv{JJOT@UI2NS)uNM+lU~+ zS8lJUnHQqiR^KPwPd^c+a)+$sYwqeQRQkIh8lZn+!A+&F`QH`0#R*wXmsWyCgcrl7 z9(O^sSi;9(gs>DC0|(#hRQ}{ugAWEHK2RZ!->-t!D2E=n@l=gJGlT}D5i=;^JpeJJ z`qF%*;fI$A*xz(wtmz#PU*@)z4+b;aLgH_cFO?OBQr|QzUOH&pu(px1DUeK3;q$~`1m&Ub|>AB9T;6ZumPl$q$51|th9vvn03 zd;cZFX$m{6fLGT{<*IZ&PAbztAZDk!yYQ=I0%hAa`bTX>?ZcU=VLN$j!k66cjZWGv z8?%i)j;avk@D3#}h_rgpgC6|)0<*^^)qR}ken{FjR3k1I8@+ z`(ql6Jn+Cto17R^n@77x>zx4ODSZz>&&ZyY9C(>#sJ5(sYr|&L2GY)TfZT)+sPm<} z4t2k9)3xF#brKM8KCYQ*rJInqK%lEzKOMBdlv+U#KwlD1e8TCWbqjM>B;Fx$-5@HK z!4gJMJ%^O9$XlkK53w$Rfi8?fN6Hxch+Y%qd1JF4_Hv!p?-E|Y` zAs_=;!X!DfP5WIh8J`&Sz3D&eu-%`7sZS5R#bxr>9d3+ot&|e zi3#I$2I`?l^&cP!DrXOR(1YIyP!s2e9z8LY1xEzhnF;9|3ybY_{n$Wm+?bPIvFRVw z81EiGK5dUYa@NL1)vo9|Oi)X4M{RClDMeHsXqQHY)2d&92`2-qckKKWEo_1V+n=(d zEBMei0{ArRqCy@vpGqWm@W}^g_oc3*WYq1XOa<~&y1l_Y%q=YY{0=N->TsZR5MBLC z><;Q)deDP5sIK~#l2aqQ_W6@iV5DH&3-FbdFS-F#YQE5;T+SSuw3AXOIGn*>dcoZM zl1+?jfFe!j^r>U6aPpPq&fJn4TbZG{xw+|IpgiFd>e<<{irFfhs;3V$FUAi{W>PKwQgg*=$>0ZJib;86}(JbYj&7y4{c52N(6 zEK#{7b0e$@lrDlicwVZ!NhX@^LnuF}4@wGIX)sM?(k>(Jd3>nhWygv3QyQ3X*b+u( z45~c98|!Is;!F5lR2WKe7FYs?*h!^vcGP?i(+?jXu+hF98`kq<$?a~R2DyX7J`fFv zH0o*fpa(tp^#%;4tDAdvZfwt&qTLI`GJK4j0nO%!+L9q}*Ep2&^r=~2u>fEo?NcMh ziUf3%vGGy$J0t4ac6_zM&6{&>Y+YH~u$9$yUphy-_`vL#8)puJ4xd`EkAUXk9^1o^g8P`+$2L^4gU;0S_q)`W#b@S*!4|?!x z19UCRYD>JC=QJG&Xh&H6NFNXo#!&haW|5vcdCbQ=00vaHGMt^6^0wxr{Fv>| z2VIu!U%PR~Zr+~vk8?~^V{dlsCTG<6dHY2o`YD?ommL83g@5p6_>wOJRxEsWyMZ(# zZhA(iWTwne@Eue?(0!;MXh({{-woA}cjdwE(0)oi=z)~G#nzs+w)X5Z_h2w(>Nrd9 zS%%LSbWW%(XNyixP1u#Ix4fcb6fFV8lI7EcXF!6|iLvz3<(s}Q5HmxL&rZ8BHh8|U zoN7wh@`}RwTe;_B%CJ_a}lvLBV*9sZxboFr&p0U1@S`eFivH#Csi=5qa%@;Z8o zk*cR$b9cjfg%5YPcn5{8VV%B%?XJl&KA8nZPxSOY^T=*ClB592ACF3%c@mdbs_ z{a2_TsGyz8w5$q1G<}0#o&WoP*m9k?Wh`r9*{xc(-C16??UrrZ%bjf7IN7%GJ@3!s z_xl^}$LqeXC$EKIIdv#loTSa<3!LG5TB3Evh;o_@M^Y3ePdNB@g9-c}WHvu~RU|3! zkX%=pmj)<`ZBB&L_k$8!V-WEW6p~Yfg;Q_~`V0#23mj3{R&WC%?{o5nj8}TOWRDW+ zq@2vNHAfoY6I*ayg$xybW_kH0J_W87pR2Q;xAW6jBqPIem>hi@v~@4Z|N9$`k&jon8+j2tRKZC6! zty}GZl|av_e%rExJy4iWTfZ;edaQt$+uej*X4-)^jp=9aXuoFVs-M*XnDoB(sFzk4 zNJO7D-(cJ}B;q#Zc7-^%b{O9gj>Jzuh>LnlN*lu+NI`tJ=odb`%y)~W*yaCfnKO|kugOA?nz=7K%dqG>+U?W`|plWsZ(?9-nB9?RoBFfhjY1G!Na_>WO z#D4P8=B7I1RSSr5o%*|Vjm=pUKg&O3`EllGp|kJ-n)op)wa2Y@N214D*igxj|9ub< zUx49XlmIb77tsJ(uYQPN-tj4$Un(9<(RiPG_UG|WGUrBz+Bhz1&RbX4u`|{RdB5?7 zg(cP3Ad7NK-NqvlKg~Pj9<1nLYMfA10tty+u~2ehyung$Iv3`+DIYkBOi|kUBL-TJgPRm6 zAqF%DVMW@g$KhUqb}n(B)nH*uW-f&zu17Y>k}97f6oI&c0oBZ-$4kT!r+ChNxRwSL zcPCE(lD&K1iw z=>+)oG#~R_eIF9!WVP&KI@(&b7!mpDqa5w+X1w?%4Bx9CBOK9;ua<$!zTJQjnMk_m zrRLjvo^9SLu9DesarDXUam5R}W*a#4C)p{P*}jy%TRt!D_UqD@4%?Ll@-;$i8WBC46X zn*o@_g_a&ndG=+W^aEvA@lE0Qb&mFubV~B4ps?CF!+f+0$`s+(PyUUm1sB5cbpfol zcixdFhR4ZQce=px85pNB|P@Tk10l-MVdRznmJjRIz9;I!`H`%pS=Y%bIYFrT6Vd~ z++^IPk>VXOb9ayQT9SA7v*LJ9zNvB#XO3EF*dg8&mGK5E51>`(ZK2at4SxB_r~h_f z8lQ#Xzbgk98`=A)j~IAiY9dF|ZS?*%t#=%Q5LfZ_I^xc#=q&`+ zftDVpO9e#PXF3=1g1wr|OWHNnm%x<7X3{z(5|7)Ai(&8MIhI9P=9F4||Hhd1#S8f6 zu)I?bAad~wa;6Z_>?E+h0munW7ho>*xObVzo0Fja{^YN#7-_DqH8?}^|8`}zhS%Mp zEdFVox;hVs#&9b5LlZB@i)x$0pU`6CWURpD*kz8Ul>zAhi))jXFQvY@4PnCF=SkceA zvqx>?=e7nZtPL)4qX-*}dPgpRqifziZ!T}%E@hCl7wKMh~TvCz*mW&e;Eab>&qgp*r_J&Pve;-dx+>Mi!>s3e@=8(df$Uph zHq_>HODEajpai&t(WLyGHQBjJ$?Ou7@~<^fzpKnep>VOHmAzuop-6BkJViQss#&CV zz&!biE=KdY>9u5q$XY+dkHM3l%ehIN%LHM%rBdh_$Bc$k+Q=I3rooXllT2;y#t!of zYNqicaA)|LD*Q&I_XucQ;ru-dtL&6y*R#$YZHy;5#blR)H^}@81JiPNg+~J92xsrMDY2Ye6bsf`ilDL3}N-JIlH58s8 zrT^MYrMFlmuh{dwJd^i0`?I@m~@2f^zToUA}s7XM%HZo(voQ)}2QmSgxJG55hsW|B}gGj|Z!XoiEc zac<&nIW@lSel8x+f;!NPp!qq#nzhUhOUV0Q`Wih2?2$KV`wLubB@gOS@|pF6T{T|# z@6OfM+UpLvN$5cp_re^gChG_?L8m&C<+u8o0S%CX)N(cp8=2?BCd-UmbN} zU(UDG$u8IJD|oMkBW`xMjsjxFeJF$dC5R!%Gv5%+k_(AB#=Xh5T9qM(coJOJD=t@E zaRGm&yG5gZ_+@{H8%uOai*WI0AxB*`5^T&A)s9U(f0IuGqIP@e0{x+=j2j zyqLEaWzN}XBpo~z=v7m^k%I4iQu^FOw(O%NhwF~2-M zNxt;u559F#O`TD7^ca5+sqj1IE61vF%9#8mcS;^D0GV^jSOQNGSl0lU6^ce$UYGO0 zNzq80<`DlX$W!xfq`TWcA%#5wZ+SO4-9-@Yc08bz^B#4>6FufVaZ&G`SQ+epLh4?I zxIH*{EElUMpRx*@Y?z$cGX_xp@@EGfT7G6IBoexD13bUi8A8YgHmg2?G$uv8_x17~ zZ>|!p#B-Wh*y;!3wHMyjR#v%8L7MhUELJ4GKYxe#Z7wLz7T6~|d`Gqu{iFvGRJ>Pt z@!4$7mz69AzbrIb8dgtQTNj|Ah;b!=(b8i377E6GGaDO-K<)M+JG!XV&XQ7~D(JY0 zN7bGqd4TxUcfkNR?WYIm;Mw2kG1EIonN|R)8G{}c*Vmr2p)Sgrgkmz$5#oo0ELrahE>!u}sv&81XZ+hxlmYG~Bl=I$CTi0~vOKH_rq zlma1j%utBjL(#J+mt(kFEg^i^FeYtrRfC9=usP|1)!N9s5hcYC#r$?t9c`|+;f#Ny zGb12-ih3z8BsCxR$FlnE$b5PSUuF81qi6lmGh%TCYM{)FaiiP!oB1QuPp74{AheoVfN;c|_AaDVUR(i(})9sIdr zyc4C@L-Iq0o6AxfG(56j#VFaLv9jb$1d01>0GR)tPH(8FEK(zrTC26KEuYpES~5Fz zt_}JhgLt3U=9)}&KaIULoKWBTkue$Fo~&Qw`veM*`t0V`xi(+Iid3Ul-lDZ&=^s;O zf)MS3b5dP&OYDm+`q_81D#8&v=`MPtI2CcvKlAsE!bDtO)eI@MxOYY5`r>LxtytZ)!NdM=JdcZvtzzrFYd?I`e0S5x;JazgFMxbQ~joJY!cK_-OXeuWq z3Q_-Xgn&Q1Vb4%k3v<&mlH}&cl1tc?bw7y*xL}@TZ6~0v3%3>HmL_?2fva3OeHwOB z?>Avl7{)&s;01APV5ybrj3QI{RlhnlpD)-VFrB|o&?J8^MsBn;P#mpj)*qS`L`d!0F~qI-#V?;oEf z*=Q$8;eS?E*{qB=fTM&_yzMLu0;?13rVBi&_xNeA<4pI!V9*;|dOiZV3k1`gMn#hWfMX+jxY4LRbwbSYJEgRrP5cxP>R=^avS`b|?Ct#5JPa zpXJ^DW)uEdN{MOzy$t6Ez23K}x1!CE?2#klEMp$iW!{tlndN%(4wAVUc6x#gKioVD zf%HL@f#XYq@JeqNYJa1U#@Y_h%Ov-nGFGq~q5em9m47x#{Y{#KO6RAEgTlZSl+lZ+ zMUeiVTV(WHx{GFH#vCo?RTZY#PLN|bq>XVc*;JhuFtk?$-F14 zjWoJ^ulyBC;ap_!ZXp>D9m(FD5A(O+X`k7Hzk{U5Jd#N*)}$^ofWWG+==z|bT>--c zX3F3w#hC~qcSN?A9cQlra6#1Xsp}NXh>`Ne%A`#?SVMYU)fGn6by}AHop(me)dO8b z+Z}$fV77$IQo>y9vbXC-5mo@xhK>=fn~yuMjlS|f+|#KQ3IJsbW`4$F4wT!q>RZAL ztqiP5pYwALPc7*D0}i}Dhk@XqqDacjz#Hlu!}^90Hkq^aOM_76kRY+IrMI!qcTsUr zLi)s07)hT-MNhsSItPG_;6-^MFa6+)qv{TVZ4~&Lc7O1u>_OKq zl1dGGg?yL%cI-?^_hyLYaUX~ega0X_)N~F(WkeE#7CTQysv2qJGkc-Z?l}W2sS0T^ zo%q+}Jv>icwGrN!YzcOy@Bct6&`XRuk|(uY)<6sFGf(;E02ztuZYV!LI{Z?NWCwuE ztaKVv&-VKQ?Wk)63ZxpD58GZ;T;7wy=6ICGKI8wrvS(s;sS zQoTyOhiahOi+Z6Ku&t)R)7(Kz?pDTdGig5ddr@ckNfsHW`ZlY6S6m-r&d}2_U$T%! z!JWZ;gCCd~L+crYeXxhCL+Cvs7{#A5oAO)Dy#!<#KbZ?^1-3=;IXRFYh?IShgOXj4 zc5Nh{2r;6NN24X7uhMQ%hi~Tp8y_8z?*x|7e0!7#w(jYUttX(CC$1|kW!czC=$1UB z%uS!7K|ioTHWMVC+YC(PJEW?Y_1qLYSKuJtwu6H)hV*u$JdjLn6-z{}HGy;zSdB=e zZHepZBF{L|MBXhuyJSLroLYppid__A~cgRGPCO4NqbE~I> zr;k3XJbaDd&2SCRQw-KY>>6hv+n7}`w~ym-Hx$V<4w!H*DTN_vj2);#J+pdh4Yf3AO?nF4lc%!rqc{BK3mb8IN-aUS zlFPsR0&)=`SyMC#?k~a0SxgAov8maoUZ7fVP4bu8wT-|}m!!{o4R^u1ap&_@G{zUY|~3)5)BWm&`}DOU@KOnd111K+oSN89PB1vE_UL zE@=^Adk7Hwr|ECjwycIGT6Yp~w7ENZsYA)Hz!P2n_t1$qc*`K0*pt-PB{3CUU7g^5 zjG=wYh2{5Cuj&CQ8mANz&I@uq_o8Q z-yy{<#O~M?gQbd{E?Y^i460@?et}p1III%FB4YV>9vIgSjL5!>fx6&5w@0^^^mM)I0c-oWz zM`L^jYnFtQQ2ptjdUTiO3S@d3sA_aF*AspssD>QDG2Ma6@^x8|OHFNy0<8g;sn0Ti z=nc8n@Z#HVlS8XdV-H)v87TVmA8^ztzcSRfLMvapRf5m_5KDZDWgF;i{#%=y za}oZLu?Hmg`p?r-bZJOtjFy`utItH#VV59eleuQGm}3Hr2Lw|Rpf8|Zv&LN8YZq$t z$7nys-iN&l#v?FH>asSGE6>9;N$T12TW4}S2OR#xFfPapB>BXw*jZZi-Mb)u30A{vjn{LDz6?ANR3d!2@y|AOOj<;4kwko561yJh|ut<%Xm0&?_0% zp zOy`{wT<@Pe-vkcJ&RoEs0wA)vM3h(z7f`4_Qk_%*gxqpMVQ(vDgmN7h)#F`6_^E*Y zkc=7Xp3(SFVjk~YYC@P$d58Qs`Nc~5Vru{dQLrL!f$Dalf3MCb7JRL4IV){wh;UW! zB1hbb$~%&6QyX87y4H$&#RZvMp1abGs_GoDGv9>-_;iH2QjM7An5&vlVMX+&m*ZI`P#XI=p zxf4icDlf%zb9Tnq`tNT2^lmQTfh0!)r77tw@{Y{soE{HoRWInfopTvG!zEj=rr@l5p)fv_Np7xXj)5;R=b%V2 z6y3Z(0JjVV9P!JS2UdzEW0t{5GUicIvuOSN_xX7@_;|-niX5|RtJ61X z1`VdYaTxc(*oH}JEtr*-4H!+kbT^x=`PVeQY8oxdxSzJ<2KouBW11Aj@JjNkh7kp>pv>CdlQyr~@6ewr8EBJBSwdvYI^GFXI`&A?MVs zBKtIhp;;KcvfDL+Um@BcdU!W{i0u_p{pg_Pbp69p85{{8=RNVxiguZ8)1or|se-Eo zIn&$M$%|l2Lv3R;_vT( zi3<`qbd-|Hez(r1BSmll=I>YHqyN~$W=^wHOHC2fk2RBQ_at3{Wt}TOxL-0)o+{MGf4~{}XdN7H+u7LbTQ*kSr5MkkIX_df6w2R0*OaNW#jlw~l{t&+m zMpP^$GT=!Vj>e~eXIsWRA#&nLlwhJ-+wDQcdhxY7m**X+cf6G}d<*-{&`3s(eGC?I zC-mOqy7#AK_bhbMv$#=a54~|u(JmGeFNL?nYmDn{oB+;a6!Fx3k~`O(td5uHGs{3X z@Xo`NnNMKmayhKG_icfY*p{6BaGO0KKsy*U4M=3;767>i1m><9y%)F*Jh zA(vUfM@BOR0(T^S4FA+SV&DcyQq38foxr9hw^asERNRJ16*1H8=j6sGm_Ml7 zW!?r$R7b2P6|?=+%RNZxV|E3CC1)_ zix5$s@y-Y)6(C=>an~dB2dN_oa;EW6j9By|QC1BjrM5)!b9NAaE;;FYIQgo$kSLsV zlucsV3U#D4@)C?4W%c>}?T5Lbv7@2MWL|p2srAzK8Mk1~h`s~xf4_V<&sSU>{n{2V z@J_{p1JqzNDqY@j{5infi6(>YY;(%jh7ucu=uxNN<_ccm(CWC`;`IyAiUz&r{2>M* z2rV9*GZ!g;dRiE_Z6WsT z0^Utn@zPdaVqp<9w$&7bd(Oxwi%BlQR|(hK8GH3MmSSA6xXOi}c2SvX;{t!e7`L2L zM;CkXrCP+r&As(k!YI(mIEVkDl=dY#ZWWo&>v9o!JB>HK zrH@$wO5}TDFY|W0^8}^${Kg|(*nR{Bu;7e%Y_6p2&cD5&8WU@YKx5fGuI$$Ru3bAD zP%xim(_r-JpSdwGC$9@rbY`h}av0{~See^wG3Q-fZR{v|XlbCP{P#u(J4;H|FL^F^ z8go>P73=gH1$X5KwWIt<`eed?`w>yt0V@!vI?{aMS8?ktJh_~d;LK^8GgA8QFjL3_ z-+?Xng|}d!gTO{zvdBQ0e4{DH#638GF`DjBKaNEdn0W=KoH!<JLmA--QNo2RFy9#*A8wQK>kzoMw1=q)9`d3Se|6URhWDFkK`uhfZC-=7ZC z)`{0yW4a@{szKIGp>n)?Gd~&k^I6{rz4}1Z3B@#2@F?N_&Hix38vIELe+og&k?f?<6y7iT@R8Hg!N(*&C3^s zMfy9;Xa4oC#YCYbUY^qzvz_X=wR0E2e2&=3rVLL!&WBWV`)J1+IxyG8iHA4<~PLMhTChq6Y!LytN>7=kNJ}5E2%Uv&t#S?B3MLY%iI_pzR z(%-h_di5{_7iY=`kTG*yD>AkWS%T%Z4ShFvP87S!b7IsveP3hXY{)?h4E=+l;obQJ zC?yzNEVbqLCY%jSkcB4dH%$jM&GmEuv8RF`z`&x(ra9{4D$Hr)`(gJ@v6Z{~w~#}a z>7kOJb@N-*J=XTPQ&EnvyNBfR;}V>)Q9XY^N}Rw}vW*dn&n~|5`AuV{leKS-oRvu{ z=*ja_e)om+$M8swL&&#Z@G02w8*NE~E`tC67Qd{*>lJYSxakk>a9fol%>F0LmMP*3 z>xMhF*2aF};bLGQ7Un6xSu(uP)1oY>X#Ph1h=RMW(b03woe*<5Doo^`Cj_lZ9z$OS zkU+ZilT^7xvP-7HJ2S>Zs~p7OR1Xa&z#%}ow)AKEm(FJd|MYp`4W_rctwZ7B?<5yk z#oOyFmS$)Uw_dXAf_!%K#5l%WIRQEhAjf(^2~`cFZ~7}FVU^5$uZm{0j?Gs|?x;-+Pe%oebIIG@7Z!dD!T5nH zO0gPJ*r~8(2!)~X-3}HIt}M?BM^EIvTioL)FI?V@@Q`-V-n+3!$J7(3ts-1*kFrym zobL)3&EPa>JJKbrN6S#ZN#u_~d1mVnNlW|Gq=nkrk!9k=qk_Q;OrQ)5cTnHtK{|lV z)zUhx9_c#1{?q%w3X5yR%zG#c9+k4%>}?;k@XAZQM{@tegR0~nJPX0f>p2aprm!Bo z&W$$9znau6U0tWty9nV9sZQ}4+iL%$Z?mX@qxYWfO!j?EieVN3F!r0F@rUo&F{0W- ztlmk>*NVvinM8eqK&EYqwBYYix5dIiQml8aLYLyg7rp(if^s7TQUUkYm!$1G%wD_J zC7$e|OuNXskPJ0tx~CF(XwS6J3qRr(eIGci!;v|kAdd*|u{0yBu5QOu|3irGW-a=X zf#+plE*TAgy7YKh14vO{;H=Z0%oJlu zvjg>R?}+Vfo+u)Ee{_GE&&?PCR*0|7VOY1g!kc@+@{un2?+i{406|ZZCr^-hG(r8E zri=gS2A$E*k*YBJ5~+@wzTA3goTNR(qopOQ$H{kHeSkY7XFNm~r36L!W%BfEt?>g@*4NGm*nPNRM~T!cxH);;$j6-mJTBd-vxx4xs2>`fxNBF1PA zrW_RQ{z<-qm_<8F9dHBG&_j44t>aPo!&=DS}V*C$-**&L&BH~hcI(E_CX2b;;K z>sy;AB%fY>C%_!Uv+k5+iz*wN001U%HG!_d^Ez|kgaf5N!Z1TtR@8E^Sh2|1p`NEZ zKZF3i3M-|LiG+HKOMk;XaDRPfqIVxo*04c8_IA<=W^{$4WN;H97gO%F9ntYvWTU(h z4)gcFdnw0n!Yr&0bH@t@>^P`aS^Fs;JsZ%__vs8|i$xv}21qlPpjjGNGVqJ&((v>4 z;7B#x`1M_gVymgIIpC_lW>U2fs8L$b-{7@Gg_r~IJukOXz$jlbq^KC+F`ZmEBV1KA zaO8)|u`KAvfKp8d@=s&l^9D$o@JwS5u(AV6BjlrjbirkO%1@?Q%ye(&s4}=2Iy1i8 z^ZjXC*l@@Rv8f%P>Xbxm>;g>pFTP&B4zO(k_fLMfJfAl7vq>9s6UYyv zR(rVrTkRsb|*FTHila4PzD|bqZ6+wIT>O7yMoYWmtM4zqIB6rXZ3^hQ+9kl01E*l12A?F*NFN z?j$J5_F@I1{NmYtb{qVqoF!~P%Nv@sCABQrrrt(9TeI@CHi_c!%XxGMZ>I zTx>A~D7KwYUyK&OS3#qEcqh>U&In?f_zY4=KZmW+)y5_9h;QS3pJCc9Y)uf$xEDCL zr)Q$g?3!qnB*DnO(FJ$DP^#P>dyBXPxHK7RE~KjC3WVp)^6@U#9PE!-S5T{dA&n5M zzl~p;5?vt`9$N7}!l#V+>YG|Ti*K_g-(}0oKT}h9R{!n54GehcPL8oDhuLOUj>2(q zCk%nH^TN=CI6|S}%b-{Pp0O8uwvwvV5f-J_^e=8-hckYsY(;e4zpc=9-Ss2fZig+q z^Hb&ZNB|zc3aiK#%X1kv97OO)4rteRKdPS5Z{>U+^PX-Dhr0%{;>ilXsdzRcYof&Y zGnEp^&X=?ZpnEoV&*+Y{wsfBhjqpE0!NNr*Zqa&Z;5_ES%S%ggza}=j9)Z@Ub$Okx zQ*>QVp^M4MEe+%oT|*RpwTBpeGsD@7X@=Mufc+%um9nGesqR&NaQ&p*-7Dehabk!q zFpOzQ)?sD#%6AE(ReicOA}jz-6~RkC)k1*QZH;kQG@yZ6h>hhp7bl-owUX?yAH0jB7<3i*Dn{J8`+L=OhUR8qFKQGuB=0ETaMZ>YXm_z^317@K0e6 zAUGh`9<1ybA@ZewKEm0TCWs3=$8XV!T|op(+4=aCmREq+spKkNc`TXTcdIKip4#+u zD`aA680&|1jytD<#qV=8Q5u$|F?9&XlVyvu{iU{AgVmZsZ`>_>o2@A`e3K`IS9C7Q zciQFmqoM8gnKY5^1A3BsSiW}~AjD){@NlMfc8WNduRLzS*y)3Zu{W`Hrn&%6_bYT^ z@@;9X$qDJkU)}XX%8aawhXf3_HN(O7Vn4!{@({i4H_gkR;pu>4T!p={H^bv(9w*eb zo;6b*K`tXN^6{QdqK;!zJ9@eK4>ayB8?!@gAQKdfX>!PIX|{o)C@&r(I(STV#8uX?bHTTtzH;NZ7gwce`zx@@KS zea5p-=WlJdaS+1248^5&r&qUj z<8|7ftKj$EY9oRqC3?v{H$5)8I~^8CSJ+nsbF^{0oRG}k?M#1-Z0#aAW8Itu79BDp zifH&7!KKYe8b1E9ywFIuT=09QeK|xc%eJ;&gq6^Y%u!w|WLR_RaD;b;SNd;4xn6OT z9#tAUMYZ{cKv6F=ve9fA1T7stdjG64eAy&@5>`-MfPs}tRo@@G5iu4DzU~q@+p6kO zWn<@#Dl5qq{lR=hm~lw$I?`D27-gSOJ0+7r?KIM?m)Z-ioY_DoX4h-72xn#9^8GBA zVo;>Z5U@JaWh4SalCkUIm*;ln-y&1uV=MY?gdUE1J*SKibB|j>Q|%FYn7MwqSSi8{ z&5Dv6?sM36#gZYW7*2<>=6Ba^arbU@yOnb!UL&3I%B9wx3s1Gny?eh;-hqIuZhrvr z3L6}qz@hCJY=p=^;$jJ2Lml3|%D#lbU3qSQ?uzq&;mH?Ggpf8xN76lo_@gV#?{rdq zTjb+sYUGSTvp2>zgbALnh{u9)C!J@IisDm-6b?s>_F^G72YFoC<@^YHs38x|F5Bm= zRNak-sz5U;S9RKr|MV=B!&#ucv^L?Xv+J3j{)Pfk+_nJwJG~&IV3)&^;uC$mG`xxx zk>@Xn9}#T=WQzGSxKKw1^$afrg)Ef$aT<+V_8S?0Vaav8BlfexUGe%-LWz*yx_W@U zD9M>8?N@$V9F%8a1BgrO#c%Hpq{E3)JjQy*7&s-(`kO1r-p0-cvf?q>P2!2SjWKgk zpT_%Wi%%yOFr$=Ay*MXib-nPf*ed#bNqu-%Kcd1sa7EPB3z9uFCm&_2 zQZ1~`o+~c4poU~<2)~qlLw1?L3(Rxk&tIui5z{{Uinj{v&Fu9^n>tONt-8iA$DFvy zu{}?I9p!7fAU{ZdDQKeskyIf6s~;-KX724_A5R2o$X=QlsOFmi-S}yXR%>#KjgxG@{KfEE1W?#w-O;;TxIQU zsk&BZ=lIA-S;4@w_o|^v5k)tExec0C_$7AInXdRM^`&$DHr9+ljX0~7{SXYI%ymUtd1!=rOaHgaA$tIct_Yx|l1^lf414jj<*n7vV`1D)j&O?p+IXg!M20*d0_h#>7qmE#S=wZqjxGI)r^`-ZYTAvxT^-bGx#ZXg-SBV^U> zdQR;UD_Fb4la$=^u_>}-3cCtl!{}Xzp;yT6Z*)C9L-pUz5Xr6M06GB41I|N*NBDJ= z?PY>=Ppx-%@;S`i8sQVhB_WWz*_Xe;Rd&f=u3{2*ug{$s%~(PZng}gK;-MYt+8v#Z zeZ)Mh_W@g%|GS?*&0p|Ja4yiGDz0Vmg-!_zGyAy!&NR6 zF}Yc=J`CR^G4sqQb| zkO_!4+C3?@!6~%4Q)Qlp;;trH12aENXNJmrwF6U}z$AJrT!U-Qzw!)$9b;R8I-L0@ zR2f-JgcV0r2{b$i4_|P3!hCMUY_^CCJwg?%qd*T+k`PnOd(4dVoa@8I`BGJn4cP(S zA?AAYm!X^74JW<#L-2Z&aVK`w*@eAgGCX5V#K9J;THEe)bvf%m=WV@D5wmPxu7ycmSqtvVM+PRrfiMCHiJd|_bPNW=^$HP9q)WyY^L#pP| z@4nWxC5<>XdT*E##ik69SHk1x?sxuCr+wrZ5C9c$bjFM9?Yid`QmcD3GvJ6pgb>Jx zQ8H>aXof^5;L#Q0;m+k#F@8QXxoXhBq)Jj2oY;{Fh>!R2RuYIQI{nA}4idBFe4 zxY$3Asarj43lA5)&5RZ;baTxike0w-D1w{j_j$Il;#FqZFXgM!C7M|va}cXY_e1No zR7MY>##8(DqA{5|-2HLlM^5+#>Zq_}*qyBtq&GrKKqE{3or|Iv1lY@j0Er69NX98s z7j(IIi~XU7P66(LiYR^pg2P2s7eda^qEQto`zfADhwY~@8~QP; z{#0fb8d_s`;GVu-6EYR0ARL8e=>xO~@u%Hx;f7C)vr)og!z95-2a98#nN*$k>=51u zM0Tx}*HDyyFR7S<|ipxWMXdBO>#4diGAN=H;F4$H~kx>AfFtS z46DEeOjABdMV$2Z-knyK{=g9hUEmNVy%t<^6hwe^Y?jjW9DI0NP`gLe;yT-BYUs;R z^(Q7Hyw6Krm{lOcu1lBgh`8?Y)M^Vh>E%5liok7@mun2k70tmEyc9TRVgoq| zG^}`=5TLLq&IyE*EKT-JKzAP+Fjpv|a*0yZEzY}e`-)SfsezV${Ktn_-CrC#Uy@uBC3 z8Y!K=Jtck=egcq(-XVQ(E0Jfk1p8*Dv@}|AxqVyRZVo*(x;vD97U{H(LQM0Iz|f1;0u!)J6vb;z_pz6I5XPnh%c{yqea^U%?43^da8vS z=4_K1ekt?!V~b0`!G$|0WBE+EF+Do82ok%j6WLv0QUGhSC8RQ7zJd=_Qm*Wu>>hxm;d?L|VL;Y*3nvszO2n;`I z(MgShmP`yDl*E0ye`vMk9eCp@YeROMCo}ojB)ZG+hsVq&ER0BHWN=xI-`SSx)r-OW zSkvj<*Y@mMl9qmK&wKXytP=0;uzQ|1=4YHB+8izP$I{>1i4j$RtKoj+PnvFc#7pzH z=jYmU(+;3uC-|U_2iNrur5I8%0)}o6+^cipn29LiVN35lR)c%JEPg>VHgte;ME*(g z1^rA%X#V_3KYYV4C_h2<%(7W5U)I^Be)xLpSrro8wG%ochK>J&6LIntPggDH8Qh2l zW5NlpB4^dL&EC4TUXtZ>qkfiZ;@Zt0`|Fx?d?m&FIlmgGbYXg59W*5=b&2@V^4@{_ z*V~$K{lTbrO}<~%%}M&|O$%F9uD1bQyYM6+k#wo3ET~`2wj_afw%nCy$M4<9e?2cm zo)Vv>Y2lUe=0`D_dR&GA+dij0ERx0cL~k@kq$Uxj^=&aRl?fKh7YiN;Nu!j;m#J`v z47`K=}=h z)<)2QW-Q&pe`cQVLhYtAeGk>9!l+Zy0|UQaZATvPN9a5Z?)vjDE4bse1*em~*}B|2 zDw37Y@>=G9iZ?cXk@3KeABUNxi@Fydk|MbhXpCCkU|DnGEnkthF;xWY zldLfS35g|si6?d5q|N7kFDuircNVg6n|9`G)zDr4+}9p`grmQH)U=rNa+d5c7H;ua z`m7R!S%iIl{RhA6_J6Nu+CU>QA{yPsC3Sl1mood869UE~Do0ThNasdl$HFxZgnk$G zXaG=%=(rgdY4d)q?>Pmic`rxm&CKMG293{sn1$GyrsDSqao+nKi?hJUDN~SI#ozoU z?A0|`uEr_~C{tc)!YnExS8*4SgdJse`UvQ8?p<*j#sVP*P@@!`S{%D2aY~p5>tTWr zL3(SQkZp|K;CGR^*4t0+B33YX-HDv`bxJ5(wv;Rze@ShL(V{`CvAz8$tl?#4!W)yE zu(;%z3}{V{P8Vo|F? z@@8brJMOsbbNj~;$~yV8$&xZbLqo^@^Z6Uh_0MJiBy zY1=t;pz*7C+bY5E;UxcmT09qS2{rYvS-QGWT}P}&R?o{<+E&M>Uxj~9ORHNPOsAjp zacI(UVAj=~5LgM$Q4(G5FLI(+0u79-KUu1XJm&f0CR^I2Rjf(MqGCV+mq9DcZbocp|Oq;NMkHJuDp|IhIu)<^6) z<(r%ixWuK+N|`BFJ7I&|gl|sK3Z9>L;?!xsT2K`%Y}Bcp^fd+o``@-gg4c(Sp2Z%= zcuFZnyyEcF31M7Lit}iN`duEm6R&eTf*;&zbXH{G=cfj?s@L0cd_wpqo-Au_zfcLpd z+te*#8jkI{|E{}=;!XeT%i8up;KPs`LyF0K+Te~u182^E$ICxi2xUKPUE)OT{ZD>m&O*ERBQeR zk}bI{OeLAFS;#8w^RHtLZpZIv(UT_Wxos#Kg%#s%aiKiYc*9VL52;Aptx>2l%`UG{>s2nZSrA7VrVo$tJ38Q@WX zpJeD|;<^(kH_MNy+l(lp1zL35Zr#p0+ODxS(3DA!xa89$Q_PMQ!{*t^$4})JrQWR^)E9G5Tp@nt z;I65IINrZ28SGJIt)v-o`cY+4EX&SO&osxYxvAJ&~wE>H3X^gH&(*yx4yhOM8LqWg$3D9q1~xGQzh(C9jIHc0ym9 zQp{H`5s}uJLkDswdw%ts-uQ5)?T^U8`o8s28|+H8V&EjNG93xb$%`R>;$swZbRk9e zOr_z|Ac;u`{r!avj+E5;*qgRjR|Jl-HC!J}C}muj?3q-QAs~haf|)h;Rh_9-G(_wH z^a91t&pD!ceyx>O1lG5!Ip^7w=pra=x86}^pT>oZU0ha^68F=t!Gx!El6Nd39qL8r za!ZSYn60wf;H6rkME&0XW9h8_nttEEO(;mKh%^I{R!QjwMH-|;T3Wh$11UvHx`%YP zG#e!;-7!Y@Xhv?k_x{}9KVZM?@wl$nd7jtvJPvx9%GA9$IpBis5ED7WQ8KiW|+6GKSp{l@GgD=tWUh!dy2@uKkE+A2(>5kixH zU?$glAOJ<8m1tc>!OR$L-L*QlHJi`J^YXUyoW5OQ4doi&1-P~wZJ*e520F0*;W~No zUviH;gz>V+qp~4xb#USpcD^RM`ktGBfmAKcE6UNzm-BL}%#KE7LNz7D;6DEipY*J5 zX3={D(`x4;Y(kc89pI_gQVNev_emEtjEG%}J@js|`ZE6Z`ot$7-{PDuZ9Js~8+mgEyJE>tsgMY1lh&?To|9{ zQ-ah&=R8jniYIv_EV=A^ZIUlU2pnfM zDV6}7j5if9?+GPaT3%^Pnf#;={OljgQK*@pSYViv)R#lAFY@^{RH(1+BQNJ=f_P(( z=ZklT?ekGSKD#enS%&w*jA-`s_jqL1-k=t5m8f-tADR8-nk+qfLU$(rT=itIe3+zS z($z6i`6#}SFXXoR-c7eXSB0ed6)7~AiKCv)?8eq&>)$w125+~Ia9X3omOw`?zZ!lU zp;UKZzRI{2OuzV9T9?t_*<#jzHzh2jRU^BlzSg#Qdeq~)Cs9xtd}AXYawYCfdHBL; zAArp;XoF&$zf39@q~>NmnlQQE4cNCD!3%iFNtdt2QZ{-go9gvoK;g^N-@~5zGS+GF z2Db$5VUD%~hh7u_f7LDUvhpYrAiu@Up3yR)ix?%>Rj&9M>EHF9)nww;94IeciM&~| zcICIIjnBg;EOzG2iRe>XhbgIidx|6S_Rv7bo$|r(H}&c_Uj?LB8aC>uyzj3YDk~}s z%l{@6sDt-vOS%SD&7q)oV$u?YaziQtWs~#(DrCnd?bow1mVsnJ9BJ-`yDb%Ci|aX8 z?V+y1V7%=<9OGF34_yS4IEt)~o#C7KD)V%BN5x^e zP8K1?1+k>^-w67GU&ePS4eDH3YCS!|>oFhd>>*^xW7fAhVj*DWr{UuIVDTf?@o2Gm zGYESimse_mRQ{wIpX9&edJ*QAuFw;(GKW&8Ji&6hz`SE{CaoM@cA7TZ8H<|)5fiHb zhbdILUvGjK1;=0hsG7=64xb-e`C^Z~=o#0Dee(R`KUxrP2<1mkU6xB)0pXXY6#oRe zMQ!}{Vy}NWXZA_)$UGs0e)FNTP-K-pYfkNrte|XB=3w#2fo~q={@;0Ie7qJ%{A=!t zBp&eW_0Ymn+#ODt$=y)tf8ak{f>X!`xlVJ4^pemXd%p1NApB4+!RC|#kZYZExqQl7 zW(%9W1wjr+SG!KHr=IC{VDfKO5SCYx65XW&9|3{~xAG6)>?RRHeRN((5*YqrYxJ2RHqpE%YyN0X zD!4}F(?DoB>#fqsE@Pp_B-w=0S0S6UJeLO%XgRLr*6(+!r22ijgIZ`|A4mO%b8)zO zybP@axqPHWsHY;&Qi3!x{kcqdpPT{DaHHe?m^$N!s(hWh(?o9logYhFlIQLE#LZ~! zV{6npn0vX`5sgKDn)JUaXVRwHemt%BtzTO^mB$IqopGP+n78)E&bX-(@KR<>m9ZY0 zzwD;jrL;`mlJ-@#fT7BPp?}&o;#Ih+TTc-4`%^Pq+hOgIr60^(a?bStLE)`P;~5+C^gcU%kr@dkSyf zE9#%rC0uo3A7nwaO-nw{5u4i4MLwlDYn4oUvYlh7%MHot^a7)12DOUwXu~Yx9c+H4 zIpZ?!#DlTm^-sf6<Wa`J) zEiSj!YRw}$y96>Us?8DaZ0+P2whUjW1ZXLR6G1-iAC!!>+Q<-oQSD2Qt)^-rYXQd^>d^}~f`Y^n zyJOnQFP{O%W|wBVOB>ZRI^{Px+QChFvV8~bp>)m#mVkYCxA30LfZssBLMhKH=d`!Hxx7$UaH?o1la^qyPl0tP0YP7WCm^rrk=g4GxHJo=$NTUn8unfT zJ!B7)mF6h2wjoklM2gMM{_pmrA4x?|zUjHS^k7=gKsZpJzHl6m8nf7PhFc2wwn}tI zfXHxnvfYZ8yI#uJ3VIpZs6x)hv^TcjpG#<0gkSJ=*kENpRrrNJ=9(`4H^(o2)UH@}F#?&ue;+Qnl zrH7%lrdW`JSejO*{bFcP=kSOUGP8^{&MV#NbNBqGsiIz?czB${ zm-Y;4;ZgMEL4_61YRugEJV}1ue#X1R7EH&}e$&f`6j5gS3jH=m%k|}5Ow2PASZh~q zX%)fo)X3@77UK-_$xPT`?_uodLXp<;$pTqe7C09cEc$Z$v+xgZ1tFiu(l(AsAMih( zP5WTKryd(!xet8a_UN*0#3U0l6L3C@8WVb_L316w63oVsaNnG#Szg1Q+|N?@c2UH9 z1BE}!D-&I!WfOS8^`_Vt$@OCRG;-6NJ#tKRak*wdQ3B&6IBc~My})#%f!?lT`B?h@)&#j7fiysNXnH=Pq|_Q zP`yn(FtVwR>Gk1kySt1D`{Zd<7I%B`ulq&osdVs%az&^u-_cv0&ht$*^&C*^;G!aQ z4@%iOcqFLE2%jCReS#%!MT|Y8qh9Y1@T95XpwSBpF<&5J+ds=lK|JtK9x!mwB-I zeK_f?Mziyz?Z(hfyw$5QFawR6>Y3kZqj!a7OaS;|0e4TL=VL6^&BgYwGk7Q~G(}6@vF#&(HaW&@|cN0AI>Cd}^s>Ib%x3DL|H}5`+8K<;?LbifZb>-f< zvH6UzN}1YFV4J`-!D-m>L#^tG*S^0s-_k>#rS-g=c+0N))_2REf*j9u?IuPllkS$v zsu5dD1mo7LyHsTcl}Il&;4CufH}jo)=Kt9fRPBGC-kT(MNgY7U^E547MdDKq?G#z- z%y!k=_QypwFNln7g9!){Z?N@y$YfuQfC%Ha)MY)o1u|U$E-a%&Tl`GTo>=cW|HiW= z_64`LA67GtQ?E3?zZ$;j+SbA<2~e&xkBRd_nfZOMLcb+Bovhgu?Pvt4&kqYlK){ocxuXKt$H7)q8wVq0fOsp(D zqdVK2>wBdt^N`B5E0-yyZa7)ePH!#LTY-R)pSfkJQ!$BG=u+;-5ckBP4VFq!|Lk!c z_c9RO>}uzsR3i5`g^u|z<3td7sW#(tMho6r2#`LhP4gjay7P-ez*JubJ|xxtb58ZB zz0(MLUxbs%;N)uKtx^TZcVJYLV(}u4PU5X6X99obH|zIStXyZ~#?iTT2y92+r6fzZ zYrpD)bJk~u+d-+gT5Ij`sERhe%nG+aGr)Y_EOJ7$_voku&_DU27`ofs|6iwZ%v7RDgD*zN0jl3#%nXdmeQof3^2guqVJd z2{3cl&(hfLPKcXWkj@~mWVP-8{J$Bg@0@IA@F++%bh19*KH;y0tS_m%hsQAFi%78B z!o_qmcKCIJE~=P)$J_ON2wl=k)a;O`^B}m=z;8Ju*|z8n@Ac$km8H`~_nsxn-ru1o z8?BL5DeJRdzn=B^F%0QWzI!%)fPfNqzRFIs1iTg6A-#O z<9gIn5P84w+3f$H!uCwhZW(B0tgujnLU2g`W^WqQ*h|z087Ae6ZUA$S;F6O3hdK>mfqvFEMkb~fRYtv+Y%aOLW_1kSgE%#N zK3Eo;3;#@@mSiNMQ24cgNPrlt)pvq`ept~(bmH=OxS&N;|?#TXeZGURn zQ`%3{)?QY44?eES2CLso}2Xrd2Q1MB<(w4FPmn$OESI zj;@)AX?b$a7*2_z1Ir7?{UB|@E)!0ww#K<&)J_VR zO5jvd=X(Ff+x(2sk2l2=bdsY_#crX(TbzvINeAAy=3b|n;JQ;#9a{+67&c2So7AY4 zE0_+5uNZD|bX0G04TkzlvqHt3_u>w#O6oYssy&WA)LkT6kJFjm^t(h#C>Y)6;D#nx zza^lEK3Xh}J6_-jXNaHiuc^a zo$pOc4jvipcQq`akvgAUDscDt6%n>iJKAMu1yp4QH-}Q6h0~u%G6uK86Xk6(zHn~g zs5Fw&eO$13d1)O+wePGuppNXF!7s`poF4Qy{Ap__9Z*_qD+?+UNCiF}W7~U}ccgKe zCKcl*c+&(f&acb4NLc12X`za~Ux6w%<4MKj79>xdUtEStf4sbu-`pko?IC(>K~m91 z(e#V_#7ay#VJ9j_Jk3=ns;i*v~g$`o$o9U6q=lCMg1e;-yB)pcYE z;FYZ|c-`oYAZ;D|Ar(-THn>foqvy&FV(^~qDBqLs1~WYQ9|H!0hyA;$F}pU;8Sr-5 zd3X+_Yb(g-wV8ZZ3l7--31H8kb6rjIVWdNVwe(~0CC<)l!UpZ{Jy51Mw~RH8F0>?0 zWxQ%f(~)6jTlxVpZC^2L7eE0{ph}N+lVGk;EiNfhBwMB{DqnW+BbZT_1{FAnop+H0 z71WvS=IxR}osW4OxrXDGP*6vIBpy|(aR!|1I^%3Uf2T}t2+MhO z^hgwGqkIuAP#9HBf{$OrGz5(>E6`*tI65)HA;jaFS$F_581Fk zR}wu0crU{ZVz3i>kyXkqE_8iZ^k_A|t_@Um7#l{!^okD8wYp?K0kuY^O%d0>G_8MUWB&Ox+dp1_>sjNfNdLxT)UoB8m01-OS&XrL zqvS5syS>l@na(M6&Psu{EIf7g?^$}vxIBYn?P3&j7*Y4DF}Ng0v#U4+FKOpfZdKwn zQX<6FUI(9xs=wlKkK-9Uj{i}a`1k1MP|c$kl7U+q=sNs`){IUglz723uXO3u z_SL4vX?r(gkO#A&&0Q-0Uq3BN#3mGgx{&}^QQm&oBVW11=j&HK+NAb>R|rn3!;j~S z71J2F_y58$?66ksdIa_x3m~U6vrc1P-{eiBdQkoBL zdxn4ig`HE;xLmx2d6(AhFZ|I63+P4t0#X1~$zoDLE8L(UgSA$Re;(IGlV5PyWeI0t)fMeiTtn5lP$D{HU&AxKi% zmv=3sKIS$@4T}i(fnlWBB~`=mK%K_A!0%g0k*w}=ZI#5rgpM#s%An0fPvU-g|KFxN z#8WTr{*3l%+~rEX!he@|TGZ8^i4{hNQ!=dz|9u3>ADFt@q*pl?QfFD04?NYf*K)kQ zI4UT->5o-6geIvgo2;GgC-sCy?`<__LL!xVA|j_CPl8aWoE*t_rS@D5ADUmPqSp*C zi`_{lIDy?wjIVCmz`$IQ*}MC4<$+1#Q_`?s68E{>vE*W^4-+#x)OBby<^3-2eRJeq z2v__?h#Czr3Yy`PeG1j!l*kkWi$fkqw0%BGfxYrN56$tctkaH) zDE^vOm!+vrzQ)n$m>cyT(Xjk)(~g*)`-ERgA!So=<6$WGZYbqni`l*SI+?61BFhE( z;BNBNy-5U(fJ&sW9XwV3MHCEiQ`Dc&QpMS5z zVL07-DCHSgvP)XqziFn^U1ALiU?l?$lQdyioh?U3G--Qla}pB1)bl8apF+~`q$H|XvM=XgGxZb(DRd1X z|H5r5d&{3> z<3?f%8;tCrCNb9M*DRIm8=4@JEJA>7!gO`TK0Zr<)kks#q}Nq*`Ts!FVU|-41~)7f z&N!-#W_4-wyP}m_(z9uh3nj`N%B@7zB<0kf^30H3M1Iwa&O=}{iOKns%h#_SW+$3% zn7(V)P>U}93vNpUB(3iqjaqCyg2dkLxdMv7FE==MC%C05%JfHv&Auttn}vxHCoCoC zw@(fWQlETWDcGq9!r|qh+E1egsFnq)V%K_^dWp;IQ5qo^ZqubD1)0w54 z8!8FEulfRuoT!QUiIUalV5^|7_=%(Zi<{%JDZ5uo<0mzX+9ts@*8vI{UX=0810OVx zq)ruNl{QvmT*9E|^l4W=k# z+S;pCQzMl=SCYxlR+fu3|B9fQJi@Ae9k{01G&0lp{4>)SuwWp zG#^+m=P>I-vF+2>9Ecpx)4Q0|Vx=?3NgNy;D5+NOjo1#a(=u2*Cgtng?rsSgIoZ-* z)w#plO0mqG9Hh$Fo|}j>tQOtHa>Lbr?+i<)elw4_d1nNlzi?1f)0hu7T|K}`7tdzs zg{Aq|hIAQ+{PA?1`Sql@`1F9>uE;CEhlI7FU%5zjk#pL2y-Hb8J|f9!(S^hmsx&m* zFmC5|layLKG4W;GM^dL*pCY*NX>kSmcl$L#17z}~;(2nxK1s`(9a~-88gH3d$R=o# zu2X5>ax?cor z30w{_Fh&QbiiJ-eWI91sGcAt-f^3ZDE zG(Xt(Gw(FTW~!IdZa)7${CckEc4MENXEL%>T+zoC%B{wM*FFck?`#Fc`Iudk8;Y3| zN#9IW6Hp*z*hN*M$8vc8<;xQa%J1!9jO+3VsP8)*_1F_3JEXp(eZ7k8nq;z}& z%Md9S7gczg*(Y!4+S-#n-hfGU=cU5oIYiO@gnC3oWW|Kc>d}(NPvYXPfzDjsaLYmT z(0+tx{1W#3JJ+>0TBr_}OY2z4whqTnLV|23s<;>cu{SivfUMQL;i}GuEG`EBUNurh z7v11+GXJV54v|3axBDjC!xkmo;!x}){ zUPzXV_IoAD1NO$%!*-g^RQ(yr5f0nME-N<`EXUG@MDS%GQ2K26&~kw8cNzk??@*LBM!VUt_xjnh}gEx_Rwi0_Qo6VK#{TK+kXmDZOF zm0}XWz}efvOk=&~%%+_JA0fmakvA$=X-%22B;K~p6T*da#vR^MHa0fKfbMPgn|<}n zjEs+HaR=V2c+nY6WuA_1kd8s1^`EgetTLPc9R|m{Bc(=8WNGM*ob|^YM1GwLK zP=&~@9DV3#CCQ2Tr|ZnzraCZJ@@9KZJD1#tF*yVe<7ip$qqJJas@8@`A8~@Z!Tv_-zPkePIW&1V{fiY4`kV3PQbZ zD~iHgx&)3%BPS>pdN-RRZ_c6DbwQh@9FFp*!^AxS0HOW&MA?^Y@7(jbDrE_}ubE%^ z#wC&#J~Cly=lwbJYrEWV={&}=nf#RT)oG+gQvoYML zXjP#~)T?0TJVepFS@1O>9Y5bG?uTvKv}-jIi?A!v5F5cfoxHgisUXZWLWyR=v|K&`KA3JAWMM6tA6H;@@zrL(bH-?b)=BCNS>`P z_157asFA%)0;x3l{$;5zPLl3RaN5k>YbLhSKU>mf2{77fO4P3z>+h-})7Hv+io22^ zFT*c!-?=p2;%FC1SaI_{fl}L@ta)ejFwmX{^-4W_H{E6XsO5Y{^D(Lj^H@UEjCh6Z ze44H3`!aesGV$`7JBNB1!uU1cvnX5@UChlvDAwze7=pObpOMhe!?fw53vZG z<#u2X8p{=`1>B$PAScURZm|J>okV0`rpr<)W;+x4(@c^Vw)r;Td_?tQbflxB<1~Z? zwq7g~)Hj+Vh2XJ(ut{wy$=tTUW>+`UZFA}Ym}~pHn<;3+oN2(YGpyB;R}vE?b+`P} zd%d?}gekM}7>MCOj<^8fu_J0rdpi9(&<_tsUoy8I1ee{#*6dSHD2ryNEEFA4r}cqk4v-TqeYl^H1 zFQl5Hx3c9RM1+(A13c?2I3j!yu@?y~H}Bvs>FJjL3e1c@HJ~fs(l44$k<>f%vny4C zT$Y5Xk3V5FhA*SE_juG3A$0;SQ>Z2HuVs7h)BQ|ry}V537V9s!9y)vg(P~?Z2`@CT z>@8&e^q8Ih+~n2~tnih?=R&~!K)3vVF+F@sJ$CJOAr~}m5{0QwPY~JyiMhm}We(HL z+RdvW=oDCUhn*&H*X?ero_8K|lWJDGlM}FDn&5o4@8GgHy&1-snO%#4W6;z{)G?|T zh`Ey4aT)`me?n`k1GkpEZ~t-Kty4q4jzLfAf>dvZlgsB2$p$M85=}dZVKa0@5ZVJg zNn_IqLB|~PjHV)*WX_4`Y2O?MOvFx%H7pDvU}Awqin;LC_NbL#FAUbQG;hE6E9d>g zR`9#8-e?FQcVZhJiw&z2^B0vJc_8S_uxET{Wt;caC6BBUs$w}|wg><0L48hOf(*{MjX zo@M4K)30(H#K#~MyR$_m8Obu@l?<3^NQJ(4yOmP%p5wso<`R2+O1=} z=U<}@4&8=+YXP}myPcmK>SX*|{~pANy3tR|5vfmVPCgBh3J7!`172O2TJ!ydqJRw1 zXyCMUJ8z-Hu=p~|@R~#;Z36E^1x~yvE%}Qn2nlYxrdVNZ97-@#idu;|itT)ka{0{`qKxS7wuVG#F7nhVqYsAzamDh3I&EvhkSrLR3 z1UK}9eWz``0#OI>KlCEb3p>(xTx87B_H$M68kfL>0B@7J@bGuotojKu&n$*5=->K! z9ixP>CG>JIZb7*)e8qjOy9YTDC%NbJ44vgT%+fqXUf z7gAFDQdQ!@Xpk{TuK|Wg#y<(!C;7I`*TA~B!SY`E4^OKx4IYeU7gc*}q>U7LCzAfu zA8=IiD0Y2sN^TDKW%;$5geQK<(>Ew?l>DcCrqMb6J48>0nODavURc2}@TMwr^S&?W zI};@%<(F3vC)7C!8%g%h+mD;2zX7pmtsHyOZ(=xK9WsL`y`4Ub57O?j_ZQ8lI?r7R zz*3~Y!Gnomk&*tk?AYY^`Gms8O?*sd7B%yxSmQ4M8F*21NzTb%K3m>cSS9cIBUmJN<|@@RSN#41>sZ#v z7LsFU-`vgm&>GyD*ziLb-k3}FmDcUiNniV79-!6qj2d)9bvKy`wdRG~xAut#G_nNU zr1G|NGj5hw{S3U}f!CTzW6DmbVwxbF*;@z5%j&=>=XPXPHf@F2M5RwUQ}|&h!5_{&BqHKfRIdyVzxpSOMvgtvv&&#oM za2z(tpojuax(E+j`{=iTiWVJ9`pj`Wwr$u^ei@vDIFh_@@fdF1>>OUb**(sRM}cFFoxh5Tn=|+N-WCzCXQEhzr6djr*`s5l z=XYez-Hgn#u4wZD*RE0UyJ*w|{DyI2Y|+TYliyfJDY;Ku!T0b0PiBbZzlCz_!xAbsCF)p-MBGjgb$h+d{X^K z{K-4=cSEc+r(1@vfz6Eh-_9^=lR?)EI-F;obiwx3tKI%v)!b6(uE_S1`8Q*Mx@d9* zTXOo)1b6JKiTy(r{l4ldlb<`Bv!Rp|b|lbj&YW9nqOtIhs8U=pt{$oA;r zk38@Po^g0)>mkmKc8!s7>dbPN&)=*$as8`9bc^(6&5;idg=pz{_p7Hbm6o!9XC5-* zjgjYz){AkxJqa}T?9V}WQ5;rdZVwt8TfbW7tAoY*sOPavhWYa94kr+L$1I`ltmv&$ z#9N#dSA5hA_G|r@+U!sA7FDtrn0F_ecCY@xrNfyT?%QJ;c=WLC9=X)`XQ587Bb66= zk`S~(k3Bw;ci-r>SM-G`P~$zdc~2^PrQ8txk>3jo|Pk)dBII0ra^j_ z<}moB?&Psdu37+o0#iG{B5=UbKMY@+u5m%+OXwuyXZqLJ?@&`Q6KMYPfy1O;%3&h- z`a9|rfXPACdQ$4wETb*7*c_>I% zk|hdMy9}7I^$WZTkf{~X8{>h!41P&+AuN#9d>~|5f?xPg+evDA>3aDn0GtY=nUn{( zHCYN|$#1Fk$$CD$bQv_yAdPec_x$*iZ=6P|$lhFt&GDRYw&DqS{#5CgHT^QscKyT_ z?5s2S&BwA-fB~ySzaYlc@ci>12zGs-BAUt-?JL7?HiUPV;#~P>`nk)U@@?C-!+4Z) zH+L$dCuQ=v?utQn7oc^pc8@8obL@Mb;!fwMsEH)P zTg8F&|O5p%s2x zruV^mCUUqKWRbe!KWqxxqk^A(^>Z7{LGO(n?#Ki!LatEYYq_%XbCO9XQ|&fk^ClPA zFN|Ogc^^7+u4>T(>O1P3TQ7-8sCA-RB4{_m?NA)aP-rK|KIh!wrdj)cX&77iWIvBI zpDMDkag@9K6=x5vUu0Rl`oL*Cdm-s8^HVM2gkFM0)z34l=ao8A9S z4Se2z-<`*soRda#Mf^@vSXg@7OeHPmSL3&VACInI$n&iz+QhNvej!3>LDv{$f4M5HFXG^m-O}HZQNl`hq(+R3E}TX_^DDX`0hU13%}3M<7yXMr-;j6_tz;^nfNg?Bl>jP_Q!cr8-y zf}TsR7OYa7t3tak;6yO1W4zf5CZTDdaoYSJ_-to=EyNBQc*KVFt~8*2f==TOLAOny zeKRkYm1gVIH)elqfv4@26;%r|*MuNP3=)1%a%YC-#Z(5}Z)n=fR)l;{N>XC-8<##k zrN9cpMsE)VqRTmKY!B!EC7HDOPRyn}cltoFIz4EJ9TztgC$G@Em|j%3H`r6iAirme z`Sisqcllj+vkHq!I#xrG5yx|Z+lTgT-ZxQ|uSV|%S0($eSot_7{sT%t9^Qs4y^*xh z47#U;DBXh4=e+i-C#)E|pJ@I?$1;o-G%wcL*J|Fo(Xc}{lIGYO*fXK0I8W)Q$%}5h ztuOn$&M~&NWgW1UJXe@`Kl#SA_0V4f$AX@CgT|Rpuhs`fWu zMVKKLO)yK>s?0OO1cUuLN{=q4v{V>0S4l6+GEo{7C$c^al^ayb>=EW)xj-^hM(9Ms zKO+vrd#3GyguduyfxUM$SQ0tN;=1s=lMh$*aO^iXMy0d(^Cy1IJkQ;*9LA)!JHCHg zwQ)Xb(TOLjP0L-y;BVA6+Uu%K%^E&ksog$Af&WY<+EBZjIjA*5Qam1PzdKz@S(SQE zf!T*P%AoV%=W$|V(sy|-9^QyWuRB}J#qkpKW)8EAlDYXo5%5{v1N`_(tQO zKTa;t)1u?j>rRCoM2vx1lh>ZeE_>40-IEf^e-HQMC|0WZ3R;mT`EiQ?REJERfoZ@J zdJ1%#7lg`$&ox`lTt2pm&HGf6a!6 zaR@aWl5j8ZcDuf*<%*dj-Fu$%Uubzf5{I0s_acU#58irh{f!Ff5~>t76PF`WVxMnE+n-fR=hT41NQ} zm*sQwzF?Wl#Ze=`qUk?FX5SeKM|nCTRms8(0{NGHbbSFy&2?GJrB6PP;RK|Tb2^D+ zebWVMbAyC%?#PPSJ`N^ZaPtan9*s`(a|4S`lMBw22=wS?a0-%a_dltU95(B-{OrlE z`FPgBuuPzr4sJlzbi#Rk?IFE0n3pX>}?$+SY zih0ZP-h#fAv`CpLVzTTPl^JbyG8OrL3uL86#DLFxzeRbpehTDIO&nQ&+cj8W-=`~i z{!(**g-r5!cal5bqXLv2|nuq#A8G#K_EkczlAbuSXq&|Gm;7<=}`N^Uv&w{+TJ_a)V=q zoR7Z0#m1sjD1<&V7|Pr%@E-m&yKOaT_54f7@M@1yJB<(^Y1`zoTodEha(Q&5{NrY` zUuJ!Xyk31FC9KY>F_I}0-)XS&K;$rL@(VnRa8$-z#AUfbVy>EJxeB^*taKuNh5q-M z!hf~%U{G2YfIdk?a$sh_^I9I$KxDnGlb_#=ZJcR`caQT*>qeyRN;7acVh>!zk^SYu zir|szW%|1z$JpA5C-BU)%8-56ZS2gbAF~Us!5m=j;Y-KpQQLc*l2{}eJHzOX@Y`Ca zisgp322uOtnv=LjMimgp`m{Fr;?Gz#UmK4KNEyQ|{d!6hdzs}nuj%58UmhGDi*ZX9 zA?pRQTFG-iOkA}&f4pu1$ti%C85%b5ol;!m2>i_bu-*X*~O%uK$D+sY2Vn zyp~y3+N(NSehn`)6T$SPq0$)qar70sA3p2`fM|!=2h$Tr5M)7E4=TPQWNi`U%m^VYAx^ zfV3EQj=u!7X0zPvQ})j%$sO}zZ^4LfN6YEwJzS;dtO*nB3=+az9pR?G$r|XVqV8NU zBj82MnGA;K?r=vsc@v%a+qIK@@GUE8|{?7Z!5}_I-G5X4bR1kAEhmj5W1;U8jyEMrhpU0Q}0~3fWkWg>KBy*b{|P&Sax$ZJDFU=&08|3y*y9uyc*t|(_E+`g z=63IbV7KLvU})8RPg3b6{@3wICN{e7rGx3yZ2~OsDoW*sn+ei4SQUiDE98hd;N_(K zLYx+^>-dt%e{_c4>g4~4qU0&0IKgI-7kJHNBASI!|b_>{&tmTF>?nHSa|+?0LB7)iDu zbF~1kgJR6kzvxwHvf}$@%0-;iu}mO@wjhu;eljm;%SgKCzI%frASh_}w?|dL{fUxHQ+42_g!j#m z7x?C_82{RErIeF6iu5pmc+#6eB1O8_+)6#>bN9DOo2*vJu=vAR?|2=bVJh;FQ`|Z2 z)IFWuud?5uz&uUGZAt$RfAdo}`C2tzg(~o#cKs;1TIlA>syi;eI(L`whgT1<^fTVd zlIn}!k2A`iCOiLvy`h9suo{Ojy5ZMXZ1@i;Y$l6#Ke@@Ktb>YQg*tajwQA%AxWUxs z9Y2gQ(4NM%ScWPHvjOE>2S4ewMtM@EY)9rKcuM~sn)H$y(hu|}Z#b7swYoNiDHBW? z(Mz_i(+=^T7CI;Rf{Ns$dJNQb(R-F}%FWlMCP9&y-=9cSfvQ)(wEYf-eB^i&GhS_u z`V2x7DtwufRr|Wf{3yn~Bl!{)U_=R_*IurM)Hf0jNw*#RH5U{xQyg_#odr))HhEuH zU#Cb{j=auHb?ziIi7sK#jWq3gnTUXy?7guESPxmg->8zgMvW~{qgQXmG=$8@)GGd^iQZZFb3z;1?d621jx(Y1Zs-tsA9!qD%q~E=8j2*-U|J z@91k7!A^_+MO9XQ*EU&JOJcHut|VmQfo>yBhZ)&Y+rx+aj?$QARipt3HqI# zZ6Zh9Qlh4*>)j(l$NWs=R?ivfvo(&HW4o8XAwScz8d!j2n3*)AOW@b9-4vz0U~$q_ zcx5HNJOjcsjO>A_nMRPVxitVgdRlhsP(-on%9NU^2C<=RDDb$1~$lC}_VHy?SZiQXiUt`U`%u*_QY)dn^>kK7RSf$saEE{T>K z5PLTV%N}@-CVEy0#WReM@F?>QLK=auOWyXsmz3h(7vNm7 z@5|=V1dJE6$vHJ;D`x?&Tt6U#yrH(P(H;5#NZ%!5(b<_=vBQeN3D~isr20VrS;P>OSVv|miWz89Fv zmkbYxxpZjDbRYb59gtJEl&*HP?Y--|gR=+4UpAqJsG3*vnGW-J@PNggz3b99mjPxT z>3`g`i3u;yMwi=B*ZpJHN;Kq^*uBMbDJ-C>wFR+8KuBQX_d7-+zl*@>DQe3HdSz+w zQM5VM@arLApPG3(_Sv_N(k}F$@;S$^?#sZdbLdt8$l}3P z&poDWe$*8$I41VjH#W}(syM0J__0Su zpH0144=m%P4(sRmea(|P`G!*%8M8r35_6>pYZAkBaY$?j=qDJ znV*h(CBJxz$k)NB<{nKEY<;Vf<@@{0w|(?_)Pq%nqyX2$ROWY_Xi6ZpV!vyd>u(p& zlW^z(+dG{jjUi2~P#rNleL?GMi4qR2N1w`;xl zRv@FBP2EdnvO&qL&GJbTm%LZ&!3_&-`M~|}k>@7&JkZdSU?GaX&Tg$koN>`yJm|!G zWSc_TAW%fh$5w6$Mljg{4tDOICk);5+skw$dFTt%X$z4)oBUbbLhfc{$%_1c069U% zzFVg~`jh|S@Ay*P7hZV9)-^t2tB}iAZ}^O}<&_o1dDYt-!q84V{mgT=w6x@h)gfa% z#Q`&C)y8ouHwVW&e&Jzz^|iO`rI%mxc8?Fd&p-cy8(GhuIc;yg@rD~_KKjXz`}S(o z->a9e+D9}F>mM1_J4og0K@WOxRG^-Zsjt{xTeg>9cv*GwrZq=L?T^3kJNDFv9`gxj zt=5*$Hf4*APyN&C0xNh~75AugkiYkL|InHm)6gbhJE4v;IgQnF z92$jg!fE;Jf9f;U`}*xupZ=J}+UlqRiZ(8>=~rEk|3ICGidj;BM&A?u-5~iD3A-St zTj(Y($!U}_+PsKEGRQov%8xlG@UfDYV4EI^00rQ7l&AY;8c6e1@%jNnp7GB{H{9@C zKRv&(zOlInLr2d(ChO~K_UtN~nfIUv2gA%rzfBHHjojL_TT2@@)f}`_0~>bo_@tD( zR54bT*YqMvNthVpeRqC)d)MX`Sdz~n3sPpsMx|`_yAkZ-XPGQtT<}Lh5%v#wS+BZ+KHc;YWgxbACxdSk&G`? z%gak{Q03&>VRZo4Hu`K)uYz*o?@kOz+D20p?_4CA$Di=m*V4(fA3dgbF@1=0{}&ee zY+mmNVM6v!!PAI@4uE~$2ZisFj{~zNkGh|CONFpv>#}=w1DR=iiQ6a3(Dr&);IF3M zuW1b|hgCN=^}bOBSo(%60Aog@f4~O{U;D=Qd~mS6z3sD4fA9Bx+dlvKPrEUNEk@V_ zh<$=MsOg{nlfQ45E?%*p{`^_BQCmL9ed3A7+=$Ai>wiZI&$!w!4wGWm8nZZV-@fC9 zm=8U9!M^-A-?DFi`-k@MqYt|Ah5ZlNmgL+6XI%Mt_^}K2=|A{=o1QslKlsKs?6sF) zvETcnFWA)i3wr<5Zg7J==s^#T43laIriUA@n=G$w+F0L?Jv2RNNM)i zJVz-8R#(=2_Bs0((-%_zQJT}z*;TLmEY-)TF)%Rb?Z=i7{e{&qv>zT{Ze~^Ns=uT5 z(yclcJhQ%>s_pVN47qsr;l8xeu*)m$a7iC&BYH@pZ8v%byz3(FPWngaB}pe~%RzJ$ zw=1e4ZtEqI={~pA-)@Scn`}t7DtcR(rl^Y2fmXa|xS`<=s{giL0%jQq1PxH0I;ife zU4Vrf3hKTpodnc9?GTVr$AM)h2)kGZ-Z*Gr^-up)(z zxx3pfH=XP-TlWQ0L}UFp50cf_HSydzMO`KLSV^ExDKJtGI@%jNsRN>IouHZyl~ z19uD44w^X1yACeuBEMJQRpd2o>fM+aV#}aCygu{51cM><;~)QsANurP{>c~IX!^bH|J3(;<|EMOKK~i}%2&Rrc5cPaojW64NqYB4 z)Bf?F{!80bqw(sqzpx*C=lk|||G}TwsS8iperlMNmVLI}YT2#j zmQ9Tf+1dUzJ9%=(8w=VDCQmS4nV1+;EE*B)3fmf2ENZMVA}8m>jJgqYqqSjIF5j}V zXVbKG>>{)$=qzqGk$YE)1;*IQZnC}Q?GoumR~newtdx&%qgTN5o#g2|eYUFcev+kd z@CmaHBE&92JB5yd4pP}o6eih4+H&2R>n7+Um~?L700awMZ zsjZw-|Lh$k9j#;)4^_OxXR80Co8)k~E957^<+DrHY>r9?9FUGUpf*`~*wPrVXEg1> zJApLgFTq<&yY|4yuASPrVoyGH*3v$J-Qnu>J2tGBaAs!0U&0bze&ua@^pSJ^k^-tT z{?kGAO9h7Ki>p)IAqzgE4?3J?HiinM}wTXjJ}Gbh+{K%Aehix$;+o5oD_9 z<>15(rNOJ_Z_xlK&bG>|G@Qa?JS`2U&}Gpjibi~@`~@Esy`)rhcf$wj2MPr32D(Q_ zzzYB>bei3c!Hep?k~_=Ph@REJXuJr-RJ?u? zO~_{a>v}$4IJ0NRn@I*hpPlQox?WgU>W>5}BK;@kEoZq)&jg!Sywl( zPnHEDg_nc7>%w;coaw=HozNhJ0v4_Ok&QhfF|>QMXb`t{qkl=nbn)yAol$8BVBzY6o3c5sxmi zE4S+!>T9b(3H>fq{asr(VPKMZrQ2aRRsR`-m86>_x~evBQT&E@Z+y{9O6odD7pniZ zZj#-B2Z8cbQAhm*ulw`Da9%&**1fd(EXOLWxWBDDj*2qFv@)3L#$!)cjHVREnA%~f zBW^Hd1DFdTbk}BQ#?l8}-5Vctx3^lpQfg{))b~AAx8O!o4yB~+ zN8Jsi80sH$y{JHCo5L)5-#)2V@c|9T!f$c2VQ=XDSdngmJ0P(Ha^`42(PXydx`F#1 z9;6fQl9jBPbOh=Mzu$YmtnjSM3NLrG-R%G!VKS6u`c8qmNixh3rcNFo*|W!{l3#aF zY4}UgXRB-LcIC&eAJE|oAFgKp_}k{7|Zif zhpj@+ojIvG&K}Jxc4vOUuR~gs6JxHsu&q!m-)|~BTLl5MH@kx+CIC?9t> z)c>~BbS_J_D2m?F)o2|@#Vih%wBe?bz5d2!Rq*pRh_#FwS-@+rU$*n-PZ^t>(*Q8D)GK!c zgZDpV{5HJO0zOEQ196F7!JUTNY@yY#7Z+67R5`tYpmMuE6A$M@E)xPl z>!5q=pvu4V%4aU*#3Oeae0F>5meKs`_C$GYxzE;g zEiV$ep}a#FQN1|AUGZku^xkrM>BsUcQ)K$LHH{!&*89Q01-E+?(CIoHR6<7s1x#V@ z7K5u3CgmdK&)Kd}dDX%kD!+@YV)x0ipp#VK?z-?D00vXu&FP^%`|wPfWqLPA*Df!9 z#Ef{H{7k&q*DF4DU_?Ow z1^6#6tvWwFCEYmcvVugY6g+g3EYH*j7s?ABnK-)c0rh&G@XAWVUSCRjO~i8@Ml`~P zF5-UhY7ZHlvCvbx~GbV>c&Qe7y9<>l&&B9xAGC!m*oo^D!84E zZTaolcyq}05#KVX(n;F73C2;3rdwMr*FjuA8SYn6?76{|IfJK8Ou0^i9<#3NT~qtM zuEK5WC8A=yC>+ZVyD96ux3j~0_WNfg(`~q)C|d@-r1yj30EipV<_bWV!*+v1yxNch zC33eIDHk1i>5{R-{3~Z6zh@aBM~6ELI%S2s?s1R6bK^i!*4dqI?%8KfW{)F4`#Bzz z3Cg|Z=T80bG6WysFGvxmcux-WYrj;kdt6yFyR7zzcBo%6ACC!WdzcM&U!cfF4|?#M z0=&{urw7%z(;ozQUoLuGeROIGn9W$3)9{vAUOpW*U_m99q9-kzpCxGSV((G5G+9I(O7W!qU@ zuo2s`$?>Mmj1JiD@|>M$EZf+~kbkx0<-2s{rd_`=XKNdq{&n)=rE7NU_JS(Lj#rxI z=$PH~Sy(H!qQMHXG4?Q>TkrwO^2)l@&xVaOo4&;4)|~~LUtG4$?QKtwmw0}0#pdRh z{J<7o?%YPD1|dV5hn4{O@@B(cUQ{Jh#Y~VJ5I~IcMa2Qi^eWB4A@S{N&}6ka;-x&H zAdB&qDTUxSq5dSU>a+7IZ}Clq9h951mK>mt`UzeQkz)rh2b6m(X&~;pU&y@0Lnd0u z!W}YEHE;|%rsO^@KlTaR+cG<*YmX?tpUx{kW_B<@*<9UF%eP}A>Ig+7s?a{U^EiCDNc6?C0ySt-KWHT+x*9e9|GP618kmmGU$(px=aywO- zQ|!r|_^O@M4@Ob;y__CN?j%n$IeeC>3wc7}m#{6kJ4T#+SPR+?OFj?72$RBlyds^D zm;N1L;46nP*ixQJ$m_B;Q?mNaj<&1-xJ#QX%f(141wjam+A9HsDKkmaN8Pr55=K%E??Wd+=6mt)Y}@hK zNri2H%$3UQy7S^zX*5-Nmb_@<6LJf@3zO1`9-3&&K|biR=WU87)Ga$!Obvl<@{Eyg z2iAfGll+Tocf}O09p2eCW?3oha2Ae&EttE=05Ngh1j)Bk)&`e#^SB4#HDB4>^CkF? zPD-yV4tcsaP(oc1sL4W)DEU(6kolwd6>biyq|UQV2=8O)CLr$n1}b+h?a#djJ@^d) zUS}W6s$rjL_Ss--$+lM(Y*+*5>B%vh8d3i#U1fZC)h0&=t*?JTeF=LN-?AGw=WJtB zy2wb=-gxtp%}M8AmN|Vqc9W~jHkW>Z-2~a___*D;b;q|5TG2RrSCxsqQduo`6WxTv z<5X$USNKpoH@|Fm<`@0khOvop)xWS{v@2m*#i^gHaCm7kbO{&l2an!ak=sF&zK|fo z6g2%i53TDn4f^{kM4RiEA36zb)qvdCOVCXSzQqOgpD=jEgc1N5)OpE+&-iC2w%ndo z-_x{bH0{A%0pk>kAeH}T-~N`p@bjnb=G7~9;fcpp;fL%yU;dK)_y<3+R;y)a&YZTj z^-cTEcYkC*`PnlXRIIr{^DqDED|YG96?^OAWqb9tH|@;XGxi_;<6qiKFTd_5QNQ`t zWjlB7wEgJEPusV?{UgcV^n+VQRMEfjtsmGAfBbWM;l)?|#JPtadO&G5?JHmVuKnaE z&)CJw*X;4fAF&|}w$unJMFtM^;j~e{^n;xIhM}Si(}q+P_gC(KaF>loRPMH4{!cu= zPEgu%SjD4~!zYwN?e63c4>H7~5g4UH3pUZr^xsDPc!d|1v_$T;qzCb6LXKJHNcx2w zUge2?pFN7A#1u#N@msGqxHElveBkFIf#h#hGatfPK9!W3+W zUxtuZfl9WUEV%TaWo>X-_Io$LtIjFHBYGb`ePYi})6zp&{_*0^eq!JI#y5Pj!Ksrcq>pUa zv(LV0-}&B;ToGo8>UY2UV|!IP$lGsU@{hK28c=XR90#$y{>IxH#N2jc0jKVNQ@Y5D zFTLjb4fYQX*bjdAGyC56f8x3chb>IcOuLcvM?ZSTzWCQ)^Sx6!;9+EFSamzqZho1` z<=exk-g8(G{SA9nUXMc-98!ht-X_%iU?l21JSzCMEVTitZ}TX*QQ#My1flZ?olm+6 zA952_e=dq{!YE-_ysHI5PY^_(piy&PDdBb*R6ij4LdZ+LbUP(%4qt@}H)&;g4#S?M zGot7xqYB62PaOC(B08x&4Jy1FOhx&a>qs~$9TQFICfQ($fz%DB=p*PRSyw?n;iK8! z?zZbBW5f|{ZMIZ?yLSB8MAAtJn{|_xp2?E*lMcOPpN@iCX$y5H)>8iH8y*a!sbpI! z%Xtl6F~H`a>BpHi>!_c*Vl7SuHIJ@wkAU@bJgw4+yF*a0g{(s^>?#A0WqE?^o8@(I z-yG!KfLChWW7*@^9JsGdy>oiK)0pW!f^N^I2R-<823~1CmeDtitF!s( zx4vo5|NQ56>-shO*vCJr{&UB^{iVOQ=YIB6Key$<2hZD`xkdZI4}NSv`}wodOV({- za?<|&zyAxne(k2)P2PCxq92_7|M-9Yd+8!?+sm)KVV5|d_RJ~iFhBCWi_uqxhlkug z^5w65%YO8er`^WFVYC-6JmN;vFa6CoE4v8?YI|Spy-sEYYz@YNgX_{w_)z!ilEx?W zwHfGvQdr%oXlE5pu1XatbP~9932|9mx$|$BaJ^y3Y!2jUp@+CwR85lu-E!zD@I&GU z6;{o%^2v{cj{2ctgXexijtr!oLoWQYQ{9cGam^m|;7}N0)UnmFU;O+T+uq)`XP+duHrZC`!$bvL$7s?k99pa1-?eY*Pj^Jo3A1$Z_(ep>OFzW$3}JZJL@ zi~jBhu$L6G58qsA*z*ewdu~2WEywTzgtFxIQa|pj+)0703~j0R`Q31QITMn#P_26lGc$T%c^SU4hV7C0uH7M@k!kBRmP z)138!G71C3ukK%ktML^oLls}76*BQn(HYURLh>=G{E)Y%T2lrn9@;ZtB)_s}T<6(Dz2o;ecQ(S>REi7Kbzr#Qnh!NBwlejz9&w&p*RH zzYLYLkS8{N+vSwKD{yi4yB|QkUD(*O$EOb8yY$x)&X4ceBNH4Fkp(^IK@W}uwE4s8 z1eWLS*lRDpYHz;&meaYLH@%O(cJ;bF`^*QPXZE$Peb<%l z)6!dzq5s^zGiNWp^r{bFIIa5X)tk~EXe(38$+kckNMF-HBM!EHhDWvK2)|-qDe2wc^2+y^t9PZ z_u?OPB}*$|q<`q1*{`%b^r@S{w7;JvhG`2k_H4pHdTeIgrY4$pY--F#M~3tar1KC~ zX;Rk8o!fKM^C~bu-x2``aeZYCZt)BRdA7^aX|L+N@u2$gcsY*8FYzc)i{t4Xg!_XZ zj{50_WuOix?ov>&?kpUY3tbs8H zH~ma{#)~h$YAegDiofRuRQ4^MJto~`eB3rSx9sU>e(98R7_g0e?|VPC^ADbLU4uQ2 zrzWTDt6%-L{rR7N$tK3e?7{PAU5){8eZ6Hr`Kj`?Ue^Qy-u866pf;{S$IyGdUw<#mR(drGvnS4sno90UiL# zY7csFI53-|sWMMB|3mxN|HD7`!OdH5U(xk$*b`4Y>W8Yl_WIk#iPy~BSWv}h2|k07 zxt1C&-hWlNI(Ag_N|pv9E>rD@gM>}H=(ujpV@c92%CY7m6shSvQmByP}z4IzV& z)1nNHFq*cFrO8lAgB1gmWH4a63$BiRaiJpwt@k!1SnnQ1tAa1|!Ve$Z`fH@m1Z!MPRUC zJJP!sEYm2^p_|8Hm|>rneoCx7GE^e{RQ?%Czi_nKeFBF}99&%Z-7i?upm%mebs;qy zzj1J~nf7Sqo$f&odT=zLUl{7&vl~~hxK8r;lNY3t?AWzSm!#Y#1J=ot$9;ytm8;kM zkT(V!=poD=NP9~*Y3t`P2oAN)3HXHK6~A3k6& zy!eWpJaydu^k4oX=_mih{?R}Ddv^BBX}f&snk_Ca*^^H`=6QVk?aR9Up0(6TF;np3 zYWkQ19)<mvQfP=^~deU$GB;z1vp zuGyJ0X)|PW4El+QiE-&BkJ`sS{#5Ei^v5A_pa0yaYFm!Ea?fCg-6Z#giPwFLcIYY+q{(K9r~gZONf=I3|2(Jw z{!v$#Pxb}qu1_|rKI)>Ih=yJg#?x8p2WO=x!1rhUVV}*!vCumX0A;fWJvbat8re7O zg;_9tn`W8XFMs)>J^IK)UW*uf0MM6Te%-$GG41Iu@Bi0T5ERGxkI1zTC$v@7fV_S}4*&rIXegsl|R!;mmyQpHa^l|0GhmLmoy32|qc!cgHu zfldPyWVzDk1|T&AG=^z#;!D63hp#7ba8k@Vr4dMtfs}gDav(5~D?bAU1}PX&r-fBx zK!ulI)hKl1OLrwt@i5Rb@HrzqCwDTG(g@X!rEMcGbV&EGr#S2rmIfvA)BTRw!LWGBo`V)Ht@ZhGw(42=^E?0xzo}sc zt;}6ba?)TwIc4AdU6{e0AuHtf3}qSxMxNdY?n|$LO01uK;S1KWbab$p>m>W(K#%(a z=f=#&e}k2GPTOTa#`mxYd(ea5C}7X9-OUZV^w!(9wx$8c*)z7extZL{i(Z%bc+1L` zH{ZHsSFYZ0yN1F&U9X zk^lu15fX~0bSK@NF5h0*{p+pnp6#98y`YoCNvcPx?ds~D+1a_7uIiqinR1Rl5a8hL zwz$;}xACJRGiJ;vxie<{`c1T}u92!+que2h%8P;AIUd9vl1UY3cXf=-)`zhFa~B8^ zgCxavSgenPuQV5RjV}!koQiN>1_$A*S>U6kgM#0M3%l&&&A=)9aTfUeLXJZuCSjkC z6a%FgxWrv3!`U{9%Lj9ccp{I*#3r2j!gYff#JBmW=o~L{9&tx7Pzs&P@SV7TjPG|b zQZhc_Ja2yye>LvVk&YJsCKsFF+3LADY`5`=#ARF<9x#nW;{3O4mpq>3Z}uhjt=X6P z9N1t+4C)}yUqek@=C=G+&ZPX^d|m#&Ns+%XC%hTd$T3xAv$12>nU@S1aY{I!H0%N4 zb+Gu`)>p~2K1W(n*x;!)8)RhtHk;Ip(Upaf8uB68y$1RR8aHlSsB6HUWmq}cLag*d&gv2NC{VccxrkHJ* zZED6$%m6CJILr)G6JMmn9gr;W*DFf*;I`_nSSu}Gwt@!X1b=xkm6R6Ks+Fs0H=mri z9Uq;NDN`p&hhZh#=ggTA%q9gmVNN{Z7`o!}x6z3w9&O&9&lHyw@rjco&*d03as;1L z$wRWJut2V|?5?k;ChibnN_kUrD>XK@$e<~1^Iy1dDK|z%+_0>nP1U<)z)Q|vmw386 zp^?d?`zOA1JXps`E}ais$LWyZq?Z(V)A`6aa4Lg?R%dY?6a?C?5pY*eT;~LWlixK2 zt`Tq@6m&+)SukLV#sIg?qcIr4b#Y|{_6io)X~Cc>1UecLG#DsHq9xN)ReFd-(B1hm+$r)CUl@o<7K3!EkP0f4d#|N^Srq{?wH^;O;L(VLnwo#oW?sl zth7sKqmBQ@*nfCCzPwCyQNqiFWKYSoF8_N2qeqH4CF5tkg484p zvD@-}1!gNRuZ>W3t2G>i3@_w!u$a#^J~tFa=^nH<2&(IM?WFBnw#tins&-V#EYIqy zDyrVTUD|%cEQnWj?5L)urY5=2>Qh*lPe&g;hu(R`+s$1tdHKBVh}^1QT2>-6PcgG2 z*}m~PT2LT8UxP(6Py21oJy(k-|pS@w5@6S`yvDZjO)mH!^-;Fg&EWcMd@>_^0LxSbMj*X6IFT`}|g zd^~a?Q(O`jcOW>;E39bu%{*4Y23_J3W0yx7LPuNz zzs)w(Gq>ww?1A;pxQR_T5C88Eo)&YN8N)DR8g2j;<0Ru)5MRjTGqz#e1d>S*bLf;Sr*)pm^x(=AKZMDJ2+U~ zwX23|_(X1NYm-4%FmCK9y7=vHp_-annm>OLz4qGcTpp7=o&hpv&Mdjzf8MhTX#Rr5 z^vp9a(o$}8wsGg=uvyb-*379i=ZM+TaoOvCm>&ruQcVNPK4VF=1tf)gA96Duh; zD>(7}85}`_z^Ut;I6XM&5m1XHJ0#{-bdygGoI)s=b&5s+C%-?t!=3z?-GLMx3)fk| z>`ycX7zjmY1Dz5y2%HF*aRa3gOnt|8NTvWPh2~XI{cM^9@u$(BCv64Vi1#N8#tALK8a6^Naw@FBa)gpMdA|MLE%IO9G%b4 zwH*|>6NYUvSjn*oVgrdySa7iwF^R+_Tn{rs5t~R{!l?|Va_Zs|7n|T#dz7J`%p_%z z3%I;~nNiAl^BpEOk?-d97qZO_mSQ{eyX-ciLxpYUU5eSIc+^x8|7eL#tRODQW5JBm zE{;vwIacZ96wg*~Zf=$rKb4ghaNVfvFNxu>PkFy^BF7Bkmli(m@GO1ICWf0z{>|*) zC?#)1{?16e6md@}Zxy+q3I7y<*QXrFS}8PA$Ijn=K(B;zTwW=%6Iu;BUXJ9pMd?1H;nxQoqxJ}S5M zzy0lRrmfp{&@<1@m&s~)5jO@(+qh4C)KPP2{rXCJ{K@BN!Aq}5jDoQhJmdX1-j1cx$DEmCajx*(~288k%VnmAz`ZQzp{&+S;dc7t>}Fu;o2<)(7S1kdKcTWq&*r(`4Ba9cha z0KDyX8h1QeIdEP2%1XJtA9|F}Burbs?9vP9q!W&!;p4{Brp?>r3d^LaQ>m#dYG#}= zIB6x751YwCdTG*vMT66bbys3TI8(vmY-n(#ru^rBHjBmt89v`7FFFhAOGCpZOm>La zH^mt-1Crcs$lGg0;@qfkW0A``LqtE*8&f|^v?h225CvO*Sz2~izfyg4fA)gyM_pC4sm_{RUDlW{GnH}h03>#WTgDZ-u zqO4F-yi7r!VQL#p>6EZ89Y6l@yLQz{ioZSn#);fqX?WeVf9zkk50iPbkDV@An?ix^ z>Kmgg6V=p*IK?9<+sl%TOm(vge+1j?i>Jyl>E*JhDTpmw;XVZ4+0310oHN4;aUsXp z4@L&D`^7Vbn%J2uijo<${RPxXyDB$J++-mNS#M;}ror=n>cxRt=DxG=8NmRkxvSZh74)Akn%(!vX5y_`^ zTwKHt;E$jQ_1aQ)`&lpr?lXN^t8fySSaW)sjT=?*6Ugy@;{#2ZY2#7ue5|(@6 zC?8}}vwKr|BGWS2B$LtqjgXX_OT26*q}bNkpWqz9<8{WCTEjsKpIX$`6`^L0O%x?7 zc<;$zZV%SI`l`IN`t6rrLR01($uY%f+OlbrjGN$bh9#UHd-M^sZruiXZt00998K%j zZKhG9M$n{5<7w5ZwemvBHEY+)04D}R*Q{Abhs~ZYV=RbAUSGFS-tU5!TB2_}V)!tQ zac0OMEN;KY3n`nMTjb7|HjYu=edQ%|+_8t#s4-(`&Fh=wZr|y%W>Q^SS909Megw^E zuiH}-Cm1c|BT!vV+G(Vc2i9f^?D&Z9Go>)d!=GZ%H6=E&f_#)4E6HOSP9;X+xWtT| z*m!{jF$7ZBTs#7~dOF7r8Qz{BX>DsyK@Xu#njfXzJFBUqD^5imcn;wxH$OLzoobgHWO!c2&YiW?$;Z}^!GoxtI~Tze zaz6NQyBn^GAOOWP$11m0Q%g&X8-WI@C@+(BdZ+PZz0JQuZm=y2NJ6sHb&cZOqT8SRt=sTiD|E?CT@xRAg)Z!(@)BsSJj zj+Z(lbt9-FDatrtM;UJ->j`;W22#n}I?#D@CGF%gvkus7JuHXyLwM`E_;;c+)y0iO z0w*u)369hx<==xe4m-;61Fan?uP)G2U?czOq(Kolb&ZZ2q)j$NwsXWABsN|tmPNzH ze?sX%pp$?XA51PID#_;t2%QVAgsVZA#Zz8dAf1v9Zn!aET2z#0X0`Bg$pKQ+5y4Cg zH(&}Ib}Bl(d3@aA*>yD?c@!xhLQ&jGiSOq6(s*)e^pNl>d>smOQSFCI9U1dJX@-GE z>L!LZxch7hQr2CC{lNC-1f4c2L6i9SI@o!2ca*lb*z;CVlr-QsN^`m>x1&XFkIyeI zp`5~Einqt8vlTN&JE<%Wv(%&PU(Lm~($ZqWbJ@{}C@d%xpM^nD7Z>Eng}A8PJ%i2! z9uHJqT|-;9Ra0(WE-!;y_wiE8Qn>{Vvr6$e06cC8j|oD6-o?JE6dfX7erIC`Ro0mG zM+-}+Igv-rcFLf9C5wDBQZ|T5bR*)stpk@>K)u6ffi$mX8VkS}U%DXN9*VtV7`{tRrJ> zqR4+kNOyRuA(WtIhWGQ&5iMs;7GUik1#Oj`<`xXDqi1hroQJ`t}Gd-1SE7 zZABUQV9<0-X%02)s+LJTgN6;KCT=J2&Vss~RqUV5%e9B)W4t7neQGDiCAlSjlF>*Ln?Wm@FjzxybxJi}Vc8`}}Vw?r>Ob(X~A2yU??3cFh zsFLTG;t@rdaE4f6G_NDhzHWPKl(ukOgLMxYK9aU^tkTXt9zK`<2Pu}3m?I^hE{F}B zE^!I_Vm6sn^kiJ(VhY$yjA6$>M68V+b|=P@d-Or6MrDZ z_z1@VqC2}CS78Cr9d}=Xcjy$$9n<(5AuhxPQXMo^dIW)?cPyo_tvNxn2JwkV_0-(Z zNE0WFl1@oq*}kKOPySX3a_dH*o4V04B8^4Yv$*u4@_y z7OzYi0g+^5BFnq&;NLF|0B<`wDLCoz$B|A6ehrz7p}8$zW^%C9?5d;TL(8O7VxE^~22_I% z2`?`l6t>HH#pZQTSnzx}%s?J8oSj8m0k!aclYvq$!(rhDO??qNew)n$S5I{N;Zlby zcLdpx9b_=|8Q!&hCj0khDG8Z-+U}sdr;7Ul9Q!-CtvMZorU&U;YJJun1WucVcA{}boiriZAhE>Y!R7M&(!PM_fz|D9WZ%;y?I14Z=0p*nLSZsHGXXG0K!z>aeMFmVXmZ5-n2`xkqi__2+ti{F9)Nw)K5qEmvn!*x=OZc-7h zgZ+rqS7af3$b({AskDf!`aE@MI4iiFCi+W!*FY5S(zL`zOB9aYBoY^K!C^ZiNfN z4FJS-Mx=8Bn?1qZ37<^8M!@Ec4m<07mUC7b0(3Z%jQ|UNgXreWcLS;plzZ6#>3~4t z3eph~o6Gy15!Tr#x1B+FA=i1ppeY33fPu}4WkiFDbIk4bTyNK|S{gB|oQjL`&0uM$ zLxMD=Q<9>ab-NTVMW}8=Cn)=Xsj*>ek~Y~oRz$UBei|fJ2Z5T&CZy)xXk=^n1Ao3S zz1h;B&cOOv0s@W02Xmk?nB>`X2QwHjbuT7U6s2#(I3B2v#c52WiKZ5|$i>&PvSM4> zKQODco@0~dmR2gqi=y0sDZ{SPr1oPopTlb#lKCLv4?mUVL{G*g@biJ)*#h0f1%YnM z#D;i5bZh5)5L4LYTzulkBvQw9RM_U0adrH>S+85pmhrj~Nk}IJo6Ww~#3Nh=e}X(G z#y^>|FeneqoI$*S|A+%E^!GPaOaVU6Obn364(%L;nw@%g>f2HmMd?( z$Ig75o4sC3lQWzAI7SVgmDPGUd9&SNitSYUU3lMJR#o;aF{ip)zd#e2$!Nw5tsR7K@cL9Wae zOM4ci)^2oD7kV}^VV&+T<}Cmx%7_BG3IJsmsfmGAo>i zJ%Q!q`;y}(ZU7Y^mDogdR=j5IAMe5ox6%hq_s(BRIV8bV3IvQBHg2N{dpN^16Bxv= z=M%qjOEpcJG=@rxizT20-Z5=-{=ijzJM5QI!Ko>!S53|lC(f2u<_*Sibcw>!|qU);GL?wx|#TsMvngHTBK@ zF#8H`K{lNgv#;XZxxwHoUc!LKLcosw*~u+jQzsfg{#(Gt`yu6T#3DBD?gyJQI=AuW^@1$XEt{gQ3KL!&DJaJ|4Wybd< zbrD|3`9*hO6E+v01Tl+EVRJDFd~uHT=MtAV-!9_$dMoZ_QTZI7m=``q#kc44_DIaY zjhH-pRALbmUnFA<8++K;#EBoXKu^B;p4TVBI@XD}ggZn0wI(*&`5k$Mu7@Uqw!qI-GSUmSaIJkr+EDk7aI zyC1u_2ZkpvV4tV|jZ#JamYkp*xY$I>fGsy48FT=J#U>V)vl7a_QR05H=&42B64dh+ zKr)cPw&4*}_}kaFTce^VN*MNAEuGx%a}Tz#VFyi|Fq-`gHy(QdjGNTeHOfS@X;a1q z1EwI{W@4}qlS~7=b~PoncGLda64AM*!Q!z@dp!^KrlvOMB)No4lmcmxQUEua9a&A<0Kd_;dR*9#7Q=IHHxxl z>}*X?QM5}=0GyyW8Tt#JRf=2Twr#JGDeJ{J@x!b2@_1_{u39);k)-?)P9;I=wiRVr z#GUN!Bp1O+?R1ytv&iU9V6%gxwp;>kd$PMgJT)jcjevAISX?K?1@baT$sGX^ZUkiT z5<2Sgx}`DTpM#EsYZTne66A#owoz~$5Lf2vxdBoP#L9ZGKCBlF4}XD4jpVYRQzGBZ z+wB@F84zVDDlenX(m~Xgh{_9}@HX0!m}Od+8`PJEkj3o}vwut;Z>q(!ZR=`x)5eWk z<#}Nd?$}^Jx~dJcip`7_?DL?3w!*8CKeNlbzrEDs)aCs&NPHc5d81m*8H_O{`$kJo z1aKdrE zB}Rh>mr;3!^-84Z9a%ixT5jVHcqj=-E~Cd0;;tIu?k`Wlu4YxF$3!GdNGI^T;L7G zCL(@p!XojC6{(B3#7YpC$oHELk&B5CmzaTESB}(f8+2?F$CF)!CDh2VNpo|P#3p!t zX<13W#91yj3553*_KoZx)^Rbnp}tX`vA?5gr@Yk|`wtiHcgD7_%w)%N6f&fvza&q;>yu(2C)enOl)G~67j#*2O|z)AC9;r%BhP}-1vcsO^pAB z$k+txaZC_QIzw!NcmXNO`MVKM$e0IW3&a>+?2!%LBt_YCBC!@4I;5Nr{Qe(GXhiTF zj?G)DXxcP=Wk6Kl7p-)6cMsh#bPO_dg8~vFjSSr#gLHS7NTZarbay*+cY~CKZ+`#x z-k1Av?woVauC>?NXTDBPD{-se=0P+A4?CahhoJtwi`;VZeE)IC1m{Twf)dFJx~u^x zx&!_C`Njmg$$Xegzn3z9cy6gFb+p%i;5(dSSe_f9)SVFCy*$l#>8R|f2Pp&f3uCXo zaW--1fmw=Ea!u=AzYo`y9M7f6lQrs9lNh1ra^^ z)m|2ty4l^F<8g8vFR6**B-c)wr>KR?{#-(c=n7!`^j1L3tlO#ks=ZWN?x(||cVZ}r zY}K)tZ8U#oaZ$tNT+Q-S_76cvtm{xbrYPLb-Se+vT zsp%bLkf)C52Wy5*G?rU=q&_7#NAVU@#B4bMiJnes&MOtzW^0ex(L#zfI}xj;B`;{S zUt7o=M$fTJPVz+M)wLP={Yhf@l}w8L+=<<)8gX8@g1K~6Gvo&}RZ_@a3BZVym3r2w zGAbSV@&<9p1ck1p=I?tSuyz|18k+l^9EVDLnDQ^$pn7HHv8~%4uK05;dnyuIIznSb zq@t%Aq`ncj#5x!;$0A(W!x88+eL=bwIl_E%8KBYo$`=V1MWSk7#BR{Y>%Omd{yeA{ z>*Pu1f%Gv>(qF1SE}>Q`Qq>@I#MIatkiTSDj&GVkh2)Zqvkvc}qD|ZiwRFhiUcTz+ zuFyNVy^TP2njKn5fzXQ@YLk8Q?23kjZjfj8J5XpCD4#{7E)gvsDwJ@2%}gNC zN&md1;VL%60P#X9WlKq+3l+#cbggfgWUV8ZLr2ad$Ps}i?^|XNd-Pk6sxg^ShHU}^ zNn5QZqlNIzv6jT9iA*R7RxqyQOFPjv27pUE{sk*M>k5;qZviW~Mq#LApURwvgeNfq z%OdZeyn`-(F9n#7tp&cNI54_2N0}re+0|8Klsm~O7I2P!x$q)wRk^$uR1x3}`nZ@k zp$TQq;i(N*6CgOk?OG2^iB-@{9zjs|0m<{EQ=d-#?LYOQ5qy^_#r%mD2E7Y%()#7r zEXj%;$Qp8B=4tH|Y;GL3;=TeQSwei;`eRm=OQ@o)`%LEk$cLD>W)VF#Ch9y&!u+$X zLkJ6a7*abGUi;%#g6*8(a zeySum#BJ?NY}LU{{bLujD{%&lB+r4ZeKB4NY*@RdD(ss)v5T^>F0ZiI=AL&mHz$Zv zgwQ^5QYyo4543dMu;|cCgxr;~#svm8KJe@>ccI+1Kl+g;b>+SIF{E`6ljo>H1?u=Z zadobNDQdp`3o9GjHmk4b*YBkgd+v6e;@yHo==9MzBUO#t;Z53&DCg(Im1Wtt;d%yR z`Ak!MYimk59A49j@S+#+;w{p^oh?2gFBoAPxHHz)Am*mBPC1}&m=ign`b!pK+}kO5 zN=9Ix8D(wS(cAldF-Cne$iX<&^})O;CMbNe6ZYUa-wD7VH->uZEoeEIF#Y^FQ1S^K z+N`>h^-21bH1Zrf*Y~r4Q(Vu8gZi~@bxVpQ`yDgc)}FI~L`a;B+GsCpz1Y@czm>A5 zjv5m^tMmc1Fi&%S6BDyw_1yBF3Xwp11R5V5>3}T>l4`9FwbGWcrLM=IB;fS)X)r0e zsM`bC$cF_bz{Z=};uRTAyx9@g-|*y-5a^!^yVobE(H;#GKtm5Q<7tIcqcLyF>seIz zO%v>G*EXOH>l=eAW;?#sJ50H#%0Lro!|@<{)uFVlr{pXVS;+-!Je6to0~s0NpSs5= zL||=V)y68Q3Rbb6PQ907(3q8tko7p950Z={w5q123>dH9TZggC-0^HzSyDAtc^YYZR>cx1TiylzF{A@E=$&nd%q zyH5=0+_^f41PJ8wB>2Abag(HuUqSR0UW}+jd&my8on0qiixVWYT=0)&dW?CQ<o!J*WlFEz7 zY1M^AXZ+BZg|rE@n~&PscfuIagV~}$_Qppkv@J!hMNq_4K9^TF4T+HIUbIw2~V zSCWL}E{X|sai7rU`QdDk6p3*ABDRJm4FW?B;V*Zl{Qp` zfK6J`bOTTh6}$adjQRO_MnOq4O>aD&0X4yn9&NRvA45^cvFzYn7jWR`V^$9WO+{20 z0>adrh=$h5=)=1(c-~ou5*HjPb;Tm=VT=aW@XtN8MTXQ~Sm(FBq204~UJyc61|gYI zAy={9jQGyVhTRyHRb6yKJzAHyDT$0WgtZurU>!7_Z3&9Es${V}AGU zj={fWX0#1`;m-|ez$)U#s$G6e>|HaoG!C9X$-fvwpLag@KpgPEnelF2e+_DGm2M#Sb+scpi(1Oi|Y?l71P<0E-Z)^ zB$~W0t?WVJ)!7PU%qaf5uI=H&iJzNxK^$R@EG*v27>%Vxc=E6B)juHb6%r&jLn9`R zOihuQIK|8)xpa_GM<$h0s#6EV)&5<`Y}3+ABaWnnry zAJr86lTw`X2L>3osg@#2W!9&oXoxVd^nq*P-*LE22cb!L>8M~&_IM`l_NH_(|%1+=4)Ef&Z}=j^X{ zmoj1GIUTw6_F;2!D}_T2+DgzJQ#Adia89RNThtV>u@R6hFhigpK}*YWq@rHn?8%;tjxuB|uZU%g%mg-O5O-QjX@a3y-|x&DdE zkoE8wtSD_Vr3Qflr573%t)_+cLL&~C<$u!UFLk5p=jXS@Dqrp!<)qCY(R)k)$mV}i z7z`+)`pAGO+#CHg$QrnaVDzhes5JDBWLphZz$o-(JEoA2no&6TB97UCOIwL`0fLQNn|5*&@tSq0FN0ZnJ=fl7CmK?zc06h6{gulX(R}=zMpxrd z7&7$h3FX(uB#RVh4dS9dIp{UXXnXpgSs0kPM~{sA1&`qbI+VCSNK-GS4NG4mEK-+cverzKbp zehyE?u2+WI8sK6QR#BP=HGCkws#@GMC%r0Y!qu4v4GsW6)S(>*4eG5?NV!gAF0X5v zh8j8fg_7$*Vvv3bzgn(ArPk=;Q!z1=FaGpJ?1yxj${&pNn9&-i5*hY{d}hg)8+{}e znmuM!B!`6h(u{-HXU-ILM35`rJxHSK{0k!qalFw=G{1p&t(?U*l;VGWTg{6_e}xjI zo{18~t)&)OY@!{VTYhN~5QO%c3S;!6JOG9jv&Qi~#77O8_g>ANzpyZaXwVm}eltO{ z9Ru#3zQx~5IZ{B{A8~+m&$!Qko2N0X@iZF4_kqndMDR-!#$S62y&Guwgs1q`&+R|1 zZh-Y>idY=>`*vAyqy-Kig#P7;MG0GT>E3brN1_)=ShS@A##4#Hr5;PmBNH(G}OE&Gn|Dl?lXM z^AgleZ=Ggtj$rzCC%B-;A}k!YB5|qoXPm=qdgGsIQl&X7nOq)rXWwvQy6rgwm{hg^ z%z+Y}tSu9%?J6htpkB5F*PW^X=0D5o$B%I`*(E`Dwv7}?movjFd4)8=N=mQy>4R!F6!lvH_0xli=f)Uehz(J;46!RmTH^On0;qsB~#v-(Y zJm>0OS;9JvQP@R6r@rUoS2n*%*r&Z!JKHpZhu7(4(y#TijM5NO(;5F$41W6Sg8;!Qo_6Q4_&Vt_%q)T zL~;))#}Z|O#gTGFSb-~|wwV1AGYsE%f{AfLPv$KN^?$2r9$3|6_Pqa*Uve%n?wNhI z-9gg)Yc_Lf1GPswW>fC4-g%3Yv_M*q(cFNI_WlUPm~G-5rBNgyKx?ErLmPFNfhp;KM?E?y9{# zqc|LB?O}O`v3ldz0oWZX73EjGm47a@U@^-cH}KVVH|}|=S$9KMl-iRc`?mui zOOtWTnnP=y58p{|NwkQS4?jx8@W(Puk|N42%JW%_n8w8>lG!@&=9d6ccESW%)z?Pv zvYHmMZr`hx;Md!0VsOY5jYNlDe%$&;@%Faz;_Ci=ohSu2Si+tbw^w;X=f9pCn&Rbz z?o(n7qy>)2d-$nK@!j5gWcAy=KXAz1#(L6=0*mfk^8hgXfxI@`1gwx|!hVL!BgWGq z2S_5N2rRR|G?0Rssskf>)@v1O**cD=XfV7qa0IVJ$j6FGXjX#%B1rTE91fo1mQxWfDjn`OcSv4z~wnHlk z*=qY>H=R6A!DYoZ zc~+HdFGzxFH;fpRhS_6*TxA<|%0`N03r+4Lf~hMH)VDo5(ClrWdBU@;Z@5yzMEM06 zmEt+-alC@k1if$qJ4o^K2{VevufNYp+p0b&8nGKqK92fvAH905wx3e!g8P}jQ@80` zn#JlSU(Qf{>`t+8#ZSS%fHRtt#Xmpz`>#2#H9&A&d8++=i4&yvg(Z|R$YAAn4OvB@|A zr4{vxLXE5s-VEZd^0@CDs*;a3z3=++>)nm8g!j|u>f5L(KUgASU`KB<+iw#Ey*R#h zh7wvFhCA1dP+6!D*ceMI)i6d)lvGdgq6KDIN+R(_T7eTusIF^S$6_afg!q!%1issg>y*Zy=*hw?Gu%!>xhuxn zv?6pnKwT+8OIqi;#b0|PupM?Z&`@(cU06#{r<4ezRHALfKPe8kB{Ghgd*U8g(HUa6 z+bZWg^7$x36G|K#V&SM*x*E_*Hn_<~0USD*cFjM4hP;gF?)-aR(T>K8ym#u&+lUN{ zw7`%Ze0}??;)u$o@{Y)&C_lhu4N)spuanFefa-N?SQXzhmNS*gox? z`1T!}F3TS-;mIq}!)L{~(&Kz^HcI*ICEocPW4XVChtVbYcBww0B~}mwp=TdLD~A%_ ze)8HrULqezUGbJXe&Scw@wzn-uHg1MQR3NIw9t8exg@9Gz3T9YHCgbGx78IKVmzZx zf#Wct2)b@pzn^|lAk*)?^944<+SXDC*N(jY{2V>`L2C%9R1NO=QLaEHT%d3MTw4^c z-b)mYX+z_d*rJa0yiqqOS584&Z;b$T!#BUhpx$U?A6>BHcRPtqeHZEY4vmHm5CbEM z+5AvxSr>-`$R6^T!kKM#_i!mCtfva>qum0pn#hHB(?(lHS_qSuj=eQRI+1vzSGr${ zYzagZ*63gR%R>+E`i?-Yb5ces($4NcyyQ}59Y?MQA#<+I&A0x5pcaEZ5;?^c8;G^t zACrlws0>7UFjw`$Al>K z4N3l+HYh^d)3}F}epiMzPen~KW|h#wbgx^`KYizT^m%o<=?puuP7cEc{`D!5y)GtS ztGw%bvoKcL?GP6ESnE^fmRrGhNA+ozNJ{_PD}{sNx( z)s8XAKK5AKiLxCXscr$U+>_x5HeFmjRy}_a{cQ6dY&;UvQRx76pD8c9Lh!6vs?lC) zd#rE%L7_E` z5u1jW-ci_#Rq);c{3Z_Fx4F1Gu&oCMn#TQGmH%M!rpAjxy2kp&Rd7Vso~<8W(oW5e z`VyhE&6De>I2{h+J7RB-uM&P*znA3Lw-HAe>0p;h*_tY!sR<4!1J^U?d5#pAHC#^6 zJI8iIMp!+Rp?G~yn#YC3#pbPt`6(%!NM(66G;ngu9~x>)Dk{Q1`9~O^E30;7dF0+k zq>h0W=oa0EO6o^CvgRc`?_;OM-=jJq+OLX!j5m=mV;j}KQ9>V=yk3GA* zMB+LteEoBAKGOgpz~GxTSn!6DGNu0?L|y|gP%CpTh!Q5Mej;ihr5nL4d=b^fGex^c zSeBzwdb4$%O#g+kZHZKWzYIh;`+p%x0$F}VNFrjp545` za*!ozhJwW~eC=gW)n~}6KF2xx3-IAe8@CJsKau_@rdHa7t*uj+*_W~IF8X(%f8HHt zXmXzl{%HCezi4#-^h|subt&L6J&t4$t@_pl~yU%5C zD!AAOYX&ky4K|N>_|%oPC!>uNW@%AwCmNl0liF4W7Asg!+aBg=AZ(tUw5XH803GcHttgBx2hPZQTG-W#$8B2R;-oQ(>T`!P%Z zOif==J7U?cWms^M6aR1YdXKk6%t9q9;>=}H=q`oEO+`5lNsvMiv}DNd3Vhom7Tm+I zx?RSGM(B`-!7-sey}8PBr#X`>uym%s2|ou!vjss5du6N0kn+`2E&TohZ>My05Z={?cSF^C$FfjM^o>8lg5H6^z7 zx{bNBrjaJM0MaOZdPv0ZML6uG``u|^sJ9R4X+f;{KiUrTgDZXI7Dn9a^+wFMzyHa#1Doq=5xd{nIOaTG&op+AW^ijin#$|SASH!2fPm*^&tw9zK*{U?& z2`@B=>Jlvu@waeZR!K{T5O&iRpGS>%Q) z0Y0WMz0L;~pj_7)K=Uf$yj=z|cj%-w2<-s5ZxpiqLUvl@<&K=*HX-n>ahyWcxN0(z zZ1yP(cB{(sV}1JTf)-uh+@ltf^aX?C9Fm+Nl$J`ol>CZBR`+`q`N#0bjKe#o3f42Y zTvu1;1TSfiI8gUA3pvohoy#KKjRxoUCl_GJc8-adDn4DU)WSa_DQ?rvHe|-#G%!k1r7R=m$BnQnnRmSq2m+zY*+s#Z)4)Cj`$l4Pax|^?xbFT$}ys&F} zlqL7Y&^<|kCE{>Oj>Eu4w zHX-D2ESlBX(VVG6n}Ou-6p}JIv>P{50V2`#8e{m9t@gO<;lo*EGXENf=l?6QRx_{(A}$$eV~V(Anm*0>*q*GKOdt8;Xfe; zWL}73e1kGnWcFUHU;jt95Zp zsrLpM0!i~$6RxJm5G6x1tZhQWjGrs1>LVM>U7U}86P?QYd70kdM0)8wyV~{iGD0EZ z_Kso&YC!N2w`d^NV_^a-sqHX-ySca2#+JoFQjt#qEIXQ~)}lxS7#;SzFUt0}h4VDuq6Q{uUmJFMnz5zovO&&!UlA*eu%E)?E~ znK^li;X5D1Ft#+E=s^*ptXD428ETlQ<+5YM65@=UR?L3Hi0MaU>|xg~7i zQQuzUC&R73^JbMcs>JnT`Z1it@D#WagB2R0#~X;=zm)hPX%b^aAX=Z*%CMxf7H1{u zB7OcTaOu4aPGG}}0~Y|$4jO>ktjZ_3ESt_I!n*Qi{^uJoc}wyvT!>^fw0}JF3d2h+oL854KBI zRq3Tawr0>3G1%X{&l+E8L9R_!z7L?ExBQIBT%g`BWAw>n5YwQaPL0} zB*dA9Duv#|s=`Aq6xO2xY{@SElYcgWvAkftzHe$^(9McOSL26)%~)tr-~7b#20rC( zcfcAm5wFtQ*Gv(Ug+;i>vANeKGj}?F0{H;n4Y3cv3XH+#XtV0jgNSB9=jS!m)mw>1 zR;=ok2d!5BcAyT`Y%FNbt$A*HxhRy*HK+%6rQV2_j4y(-)bsKg9XDQU%;wlr@xvTznl+5E61H{7jE#}ij7$6er@GPsPPY(MTgL$>{!>)QS6xgsfy;mtTAUeP2ghc(N* zb!BfcvXh6CyOVDvuXoXo<`}RNB7kRmK$FI-qfXLv;4X*h=U0VctR{`Z_W7e>aj?>B zjcj4*ymqP-+5yOgmWMTKsWcLN*(-@14|Jmr#rk!7msM7Kw(IHWqMmBH4YMrlc*B8h zUe0kIqtF3E7JMYODh$aGKHIb)IiOkgjm=>;TU9L#3W*}~qY}IMH7AoLBCTo0l0y3+ zAw$A14Lf{q{DRFGm__5@eL4T|d3WjG*YRcM+x`R$W>aSiirh8>M#KCz2=LF@qe?+J zM9sN2vv7=c$ZjlLC0o)Co8-@x6_!8)$J?B`B7Qkx{#6xooTuQ+vr<5T5aWeD#jhI_=*mXmL8iG6!5#!Fen+T5QRRlSG)}8W``4d zn0y|EAZ3}WmKr*MKBtRhKRVkbTFzbBy_O}zGY>xu6UyR0zEaET z#b3ieZ3@XPIE;W6LNHNdJbwZX!?rN8`G;XmLSS3nn{}U5u1!+yrlc3(RJ*S<#l0?neE|dGQ_030k7Q{_+{VTj%D`Zqn2xSnpDGKB+FO zUbdNCIyZj41}R!OPHOrs`{fD7mOm*XodZcm#{8J z;e{OtD=v%|L>`0T>0^hsEoP7V-9DobTk(eW%r3?wt5?xen#ld}MQXOES-tZB9L{TF zM7u!hKL_Kc{_TJ8I)%i|ZLN0DiLAo-1WA#8MGGVb|Eo%15w+HsPD>HD+Zj9)`qW!4 z9hcLs-*kCJb1tx12fwR{sd3Eo4~+FP&Ni?P3ZWk+L%~hOz=qR0ug<`>83Me9NvGazDQ)>5L{?*E1x=!Z&D1xy~?0oMp*b zoCsgokY)Nw?!z0W8x604ax|$POq~ob54CkGW7a;)hHvNXDJS)Lgi}0rmow0K%^R6C zc-UGZ+ob-33tTOR?vOVZ(4rSYzw~VEgtOSnWwjQ+_`Xf8G`cVM(M}D(L{%RmX0Xa=c8$2QlA0$ z1U1B4u9qkbbtOt=A)mN~-AHZuclAxhjM4>C_R~%m{cYohvJadeZRzRdP)bqcC}9d~ zB{x;KO)%e}jzq*o*V6?%IYqMA%3p=JykP{|MGhRPGerShA)!&C6L|z5w98l%1unZ| z&zBcPO(g3>;F4Yq#mOv{)&OrZYycluc|2+giF0aS9BQD=$G(sI?G7_YZ)g9ZVFY;( z9Qmqb)5=&z3qQkM)68SR&#aDu((k{2qkOdKbs1SHwWbwX7!yz_=&qp^ZTfsnX$!x0 zL@#lp*|1b%h4I>04};RBS7Iq4j4Inq;-L?~Sp0UPgz1a9uC`%P(BwW=fnBCFtp>Qc zA}Nw!QfYnRZ9cg4>)Voe_KcNjW0M>_P2mgWlFnw_x-W}%`Anf_^($MW(0SfwPp;o_ zB^gvGQKv>rKc2T{6KOO3*Q{e5@ue(vQv*~E&Bn&WoKe+4s*0h23>I6W8Ye3XA%nsJ&Q zvw0uGdA%y;Z~WVXICEj(*eOkR8y6R46)wWbdwRH>a_@zF$lu15s@7!0;q8m14}L~r ze1I8ZIOn|#c#l%N)5j6GepFwR&l3hw z&p<&AE~ZP{AHEK+Fc; z17n=LQmDWW+RmYxF(DxUj)?d};G^mNOK#gm5W{FWt-fS`d!(aIuI;^TIENP zA`(ek&mKK11;u2%R%=-BunxDI=n1QsZ3EsQ&z6@~ZEM#Zf)z)7;?4^km%w+xVgMvR<(pY zxeSwxw=$4Xg}fxn8~Dgddk3GU)S4|N#K z12z(L`7FYnGDkNi#&0Ba`bl`Km1yRaXntP~$<@!OCl!}K(V`MK)wT5f&_qyw-RNcN z#7EHYr1PyR@M}?1Ybeo;EGHC3k{o`=9*c~xo~tp@vsbl8))}qGDj0H2E-R^RNQU4i zdU-OrZjT9+^2?gc(U$-TJ6i+{%WB}2*NMRPfr&{&^`j&E3CNPp>gDWt?O~{`%0^nv zrw|R!#P^r0i+cNC0jTo+xoOE{^@Ax@k-Bhu{z$E!R(b;X zWyBIL0rIDVV{>H(--BxH3(>-|3e;G#=Du?HwRLV89$?XPKj;!;+~@ZQ^F!K6Y+2nq9n*RN`;iK9QKyrAX6Tch=7WkH}0lZ6B1Ix zm%)}WxdXgHj`J+K`?#(?8B$PX&n%Ht0;ZJI8K}I#fR4JPiam(iJHqnFM zuq@Kb?#Fq#&J>gbe8(yM)DZ0LgSjE+>>La3rJkeTFxny(VQpVaw=hbBpl{ZjqF76W zPHu$&hd~?6YGf-V2kEN#`Qy%uv$*bqvIh@1H?|*zhm`*+G}fW8vxY2QmHvOONGEEA z77SFlQ=+0%1-R&I5`J41FVq8l6Z%c?TKA;ER}OH$tsJv(Py#oc0XTS+552klH|U(bRA)P^R&!}s&6g+}AGE*FU3L73?O_5zds8SR$1}4|Q ze6z1aL4$TcZ*A}qjW-4Q_sr93r*D(1j7^p@wbXm3kuHU}-riI%6Jb0)Pg@5r(owjO z_1`Qx;EYrm=WPlpliIFXcT@UdzqYY5Aq|==zT%RyNxCbVa%HtUsIX9ghh#x{!J_hk@Zhq1rkaGYhZm{k2`& z1Tx%t)1(UhbF@ILTk`Hc>NGKrab90WlyL9jg0@^Zk6ATFTx(1LbcUWLjPrD#+H2O> z6v$ivnqJX|Z+sJn%HrJQBDtX^+Uw}f(!{&+yK?8%AOKLzvxS?Qo*o$Gk-d_WKu23v zVbxNrD%2*#$opFlZb0XuJvVAqp3PSy;VvoXAqnK~`7U{k!w5tM>5@O>POyV0I728Z zCa|VWq+@6wZ0(6;XbCscweNROb22h}8^k1-sn&?uRX8$j#nWjPRE<{bOg(r8w*A9y z-%z`NJF{L_-OfbFAr`hwEL8p_B8a$R>@_@AJO%HX?Rm5pc*OYj=6q&>8}b_n6YotvVP z$|WoGdlWLczFZjm_?62}q@o|8I$|dz|2mL*hU_ZCgAjJFC9oFCi@3H|b51-Hve4%P z9Wi_4%YsB-D?oSZJDKFBE^5OOkj+bg@mcsex%}bfK+>YLcK9*J#ddx+pQiI#mTs!c zGp#&(WYHq$%+gLugdqnycK59uIsx2AR{o!ZpBCH=FsaYapRu`@s~;fvloKP?wsL_c z+ft5Ae7WdPZIJiHN^f~aX$Co5+t1n>oEwc>$QkO2Xh;(ok5`3kRb4WF##5k7RtFc= zY7CZ0vG-tX7>&&H{b4o$%zKxlKF#j@owxvn%M1XzmgYhV?mh6!O--d8LWEiCJmG%c zY=58QNry%9cdJ*;K_^;sTTy_t3p1J*Sl<5ltKOP57Kv3bv?oBMyTFW>QghQ`R4U;i zflY0i;O(|hW%)rH5`v2p!vQf z6fNkRihbL+kz_swcPgW@>=5>@g_6K^a%le{khf&_>Zs=TTa{h~FaPl++ zb#!@2LlWLX{x34>%WV_w&)a{3uRTOvsxb>y*8?+yNZ*IL26z0#fUhj;`gsevUEEGH z4U!ig8yBq4sxB};(vn}xoqE8L3uw+$2W34==iJ|_Sn@?d_YtWr5b< z7)z8oP=wBG9Vv%u*>WU$jTre|wRtu6pY{Db9-pbM80N9I7@YcLITyvjdhESlhRp?2 zLR!&64-R);D(jVNdnkt>+5!O63C>ohsy3>?;mS`>@ZrF5h+qm)9fqYG`^?DK*!aK_ zc&o{*ULLVbPlGni6G&+xVwQ`{8|v%x`%S>4FKNlbCSKQV@cHQj-#56J@Vw@?_vCgWh_%TOFC1n0QPuF|Evv2wmY?+`p7u&O2zUQGmF^i{ zzVwR+s@XoP{ZmhO&W6BR4e$|3OB@j{4%+WpcyV4=@opX6YZ{s|T=}MLSBeFKb^XT2 zp2%1_Wx~48BRTJlX8*b>f0Y`^Yp|ugl6;Bj@qKYOEKX?<&^ZC1I4RlHCC)H_J~}y| z&eWJ_<1+I(a}52X!d|`xi1an)+Ui<_nJ!a&s|31zGt$N-c5VlVQ=XY%j84Vr(3+wy zkT$>%U)i&4_CONG0a{-?pPk4T_IC!#V_p_S#_LPZ9Y4PfqAvpO#*+!%TG~1<6+iq+ zREkhKwtjFlLZjHQPNi2Kv#G~m_o*^8%G~sWtE`B6g6-OUAfpstUHk&WNc9x$eDd=3 zMnlld9jIG<#0dT;b6NOvPWpmGA*TD-Cu310(LRQ<*EId#VN<`nHg|(BzZdvkX9wvf zFV~W|pGu>?2wJN0Lw3kg)j}@cUc550yrU$Mk}8Kie-A;hg}bYwPqYV#Ml9&EXS+ak z(eey%utE=_rQb-I*vm68vTpy4Z;79~IuZ{?b=gav>cCCHJ_+stumd+CAe6H38}?}3 znjTeu=7JvhK#VCfXAIu=wsx9ucExxwd#HHF14c6!=V-{_xq+Oe=nzX;EVDSon}=j~ z4B9{2T^Dbt%Du`zgtdf=D)1YpvPe@sP6(U8t> z1_H`s`;ul@2sqdWTa;6{)lr5-&52@jsIenC$2VE?*4Xz829}}b|2eNFK1fQ(L# zP_>i=_EwCMG*+Z4@i)cgv+7ujhyl3XpGdE@E}3Igm7O&^5dBlP`^1WkOrM(47Ggu?X5MlFg2)MlTDat2Wppbo3d3wGc z8He|DchW1=)pd45G72=S?q5CiBVNTfF*XacGw6>=iLl|ou8zYXHB8nExN*KhpD$H2 z9z}d5GwDv2)8a~05VrVf;QRQl$>P4?lF6WMdow5z54)3_q|Syz3%*#s`_iJka`;rJ zgE&DTc5%}X(|iR}=_mpw&+NVek^6O|Xr5GC41D0#mvB5fh-%6vzSHi`zb}<+Qomm4 zsnVezu^-j#RkX*u^!yUhh9&AsiE|ou`kFyz$#_$wq|IzL^h?tq-EaDvj{?x^6f`wO zMb@-*Qf=lwN$Y!RUCH(zITjb)1NkOf1pptTeSz-`iFl;{c8POqBqaJX5m~;CM{(k& zuB(n-oHFR{{SPA)%tLW z9<)`2rImp4y{$QsPu54pFi*EGcyN$+W+;?SFJ#|a?8ar12@38&xxBogR?L>GHo3r=pk9>u!8Y9NoPox<-`inXqfE;-%q^f zF9~>wv(RC1<>^G6@ekJ!OAFX1tMfrwOtxnS;MvG*s|50N8h>P|B4 zKj?nmLeOQezM|QdU|+_!pA_? za5q+q1^lfohLjI+|HTmhRvh9=WFiEyMF9&+&Jk~BmD;jRdsC|fxIQl`rEi=nuJJN!9g~9w5l^7Kl&7g zY^*f95Pki&aF1>yE|&2Z=)D72_I*LCQjb+W!r(MmBH5j z+jcP`E@OjY(hyF}n4lKkPf^`KUTK5guC?rxXq(F)B?h|mTb%TX!CD~affBmpdJR=r zZiT7935lgv0P{r}Cw#doPCYp{E>yW!A5Q}WByHCCtNB1f&Jcm3l9j~2h4Ocp($!)2 z$()$PC%b;J>hu-XZ->d}*WP0M&|J(Kp%xgv1_3KjqTUH^k2buAPa4opb?3wXkgDo_ z)sOtMu~A1^c|WW4jaO(MpQMK2ei6-lq~8FVKes!cy#|NrV1hbw#wX?5Cj~^wuQwN; zM#6EkIewX|T7)W)vam(qmG18YIk<)okT{=`7AE7sMAq5M&qd*<6#liA%c@PosfGi1 zhwb**^seS*IY>vGS&IZpfUjkxaFhg9I2P6+{@>@ECEKPp+oULszyV~7v4I|aTJ;jQ zd`hLgo7k;`sVfbda~A%!xz?d&l?Yc*5XcRlZ>Mx7+tFx*CGw}LPqZ>uSPxcxWrP1x z0D{Zl;-F|8mt1Ue;eI-hgMCuk7L(60bPxAk|Hd{`%*9Wz^1vALKSM!h3eL3wmc;e{ zS#+Zp;odcY$DM&jMT~jfonx8wP+R2ti}=HaYjQDyUky6f48|^n1}NYO0IYg;f+(nyB;=1rY)1NC_p0)!-Yte!VA>bfPO+)zOO#Tp<1u@`5v3DGI&?(;Nk(c1cwUU((Mkr8{Y;bpk;u;GDS^a ze-1ysqQV-Y3o7aP)v(gRgZOrDYQ<4%fi z*k4_6XmReC+58B?Zv4B=|J9p`QU$u7 z+(xAP^5bK&O%}QgqDQWZ%P`(QWdAT{&aIBL(+8f^;trTw;nwvQ?|Uz^oQo={xRDk& z&CGX9<@5Y$`nQ%us`d<`mEqld_-BP51;Q4T&#$Kr+V3p4^$JcqH!J|#Wbk3+9J!0v zw$pr#C=e~F$D~AFQ~k)+zEYx4?zaDBdDg4X7R6pg#D1~f;hq{rqg)6NMU&HfmY+)b z?@UxY*ApG=6}e*Vz2F4M_M6;dI|7$|=@dZV0zmx+j|N7spzTrNg^Z$r=hm14~u!e0P8E!uRL7KQ&?0V z-yY5GRJxj_0e$Y=y?tXio`*i+d%`8eoAB4-iWONf-h9=55xd2QygZVL4GqbU!b|!> z_PR4q)LqKJZQ+@lG$>P8p3JkgV`c_8AK`=deBqbSG}ZA={hKOk9n?AJCy%f9?EShm z$yZw`px9`!mVOenAy?a1>hmV%$P=gRr}V_+g-4dh_Omoq@fvYOZr=tafK5c-4U2SX z!t1#d>!qcKf+xr;`|nob93QQU4Y%>o^9R<*ocbYOD^X~~b1>^&%O3Xm;I`*h*qj?= zvAMY?AqASO*#`nA+B|-GAn4MXh{+pjO)m%NLFUJ=bqGfRR`Rf<3R? zkCmpUw}p5Gb3T5wHf-{U^3V)m*b47*myUy~cd2dJ9A+QAJbM!Jy;l-}FIAYU-Je$Y z_1rB+I9G5hKM>hxLl1Ab#PaCd&cYCeDEYkXl*cE%=daE)6CJ?|US zIlJmkOGq3>7(VHf_2KcXs^uXIarhFPwvHgR*Y1Wqy)*9?jI68-DhBU4mgns3wysD6 zPOqQZIptgw-Fo};If`99J#+0XY$nv~bZ_RO)hg65>^`{y88i17$)q-y4W9d5Ih@M~ z1&)OrwtH1x*Egf-p5I*VkJDL-n`NpAT8IT|yYUKjK41)3AIERa^`jJ?&Ywt24C$P_ zi+FHywrt^Uw+1EwBaN!E-BG{7&6S52Ebks4`_|lCx}OfkxwO=EoKZisW^XYjbC`0Jnd{4klYT<$)3HC9s- zO&LDP{w5M3q+KgjEp?=#$X{cHDz)l}+8(-WY2uUf2iPqriL@Ib$g<&wyk)RC_R zpBLJ7$7Wl^&ByP*DV$KrKb1qrNF}6rZ5O098T0X~L+uJd&JQ0g*8*@Nqp6i5Ch&&= zWBX&zB%{^OJN}vE&*OBUO0o6y(S4>=4SmdP@KbpX4XNGQ2Rw_(mLkMo=vudVn zrl_&j*W0UoNkXdW=GF6p7B`x-5pVN_Zb{g!i^s6Pap+K4K$_CL0J!1ilJ=eXC>!M* zIzAzx?1qMRz~cPuy*0IHZ8+{yQ@@+N?t3@imfqfrK+oHu^DT2c=}!`2*h+ERqsJ*y z?h?(|pIqYWNein#*5wr`IiQ~;N{uxi$kYr}n-L`(XQ~v)Rg6+oFq7V<8Yb!N;+s2` zc7q$Oc4+$&+l|E{aoM(d4{d-OLMbi`AX%4;On9Ad(n>&xGH={a#u4^&yq?TbEa z@H*zN^4nFf3j8A)UVYbjWt$)TG#?w9YW`01qP0m~EUbI@P4V<|)q|+gA%^ulaDVrJ^9eNbxHg5M? zVcYTsW6;e-3n08K?Zr)Owf$dA(UlzI9mLEG;c{rz@E3 z3U>8$=T1%rs4b-Rb@%1IKjkcn)i-!(MX&VQB!4MLnazZqeQ3x)sP93~lGWZGWm`sO zrq)71PuAxfchxz9O5hnV5sfrorXJbli>9h;_tD6#+7IsFI$PfFjVGVd9;+{=-AV4$)WzO8mXn5@uT?-6xo;OuN&Wg#DYXWI%B$< z`7&$cp#ZoM&yTzZk$jT-h~~3*t9V<3?QQ~tVQqc_IECfj2~VENx9=|?0cg3;#5zIzBB*w@(;|bE|oiCjx=F-E(#xq`iD%6= zv(g(vda6rw59^+1dN~!mFSmY_C+Z?qkrx&oF3cs7=;r2THCt7gtK{6L@7MQX?=m%i zcz-i1mtJ4g_X6DJNWfUgY#MhRhyK`f9lw0`obU>S0!3a?df{~;)mP0qZx=5(l|{J# zIYSmjrbExq_|S^<&K0nxU8!ef?0alxmYLPMfqs82=H^ODL<37IRe;0eqI=CYiZ7MH zJgQXDXqke$6i-{qm1I_j=uGr7;8Ab?&Ig~N5UdC({eb3kA8>`yT6=)PE+Y zW;IuT=DPu@)$WNd75D1$U>5dUCdw3fb$GGJ*@c%5NEX*R6!2^z(`%dz)Dc2PPjA@# z&Q6zD_q1S7Jt!L-9_eaFYDO>Vr<=bj*6MMh2XZrg3`d10z$&i-k zGj)j)jh2YY+;j%W6ybQOrrF|`w*4w_z4;^Zw{s#PA@)Xm;zJcqI%cjv3cCNX(7@`_ zFxNO6Y60*{p(7(uFe*bT*f53FZlp#)@0olkM?C?AUCUv#`&kzz`UyA6UfY#5Jp0+w zmN<#GMW;L$_gK8g{Oc=|#Cwir!rdZ>19tS)cL%YNu^PG=*E`iU;^=ue2(EMEE;@^j zYc<(_J1a3GK$+b7O|e&h#ihPMU`D^XUud`Wn;T0cE<@Z9Uu}+(Tt$5AiIBYNg1dNBX~7YR(3bRoB)GHqayb-%JYu6^8tE?CiRnTfdJhPSZv#%PCaLc)O%u z!GeX*^xHYRXzM*(Sx)IG0U)AEV~umZDhVo93iFhX$^-``^kg!A^&dJ46F=C=Eh^0W z@Z@;gd(UWEv%KcT_}+>A9{Z7L)1@f_yQ)^kBkJl0yvL{S702%OPs~s!$l~s#yBr>S z9I3&(Tt6&i)irS*nT&3^>cT6b3SBc-gASeWs#-~R@Nb4)dC;yl%`b;5T@T#+h}k3^ zO;h;?!y^MZaE|=4GQr~FNv5wh;v^{HfQGrZW0>IGy(|5(TLJ+s?ZaP(!LLsTzV(x0 zl=y0xQPJme--5vU0znl$HK?FeM`Z9LDpd9uNqmjBEPsnzAErj2U&(Lj-}lKNA=T|z zS3+h-{pabJU$vc#PmE*oc{marL6TMtUl}{p^lcKUPI?=+1&bFeZgZ)kDQRcaDKi5j zyU3{%_S@h>utwpt65;>3^}BAW~#D~FB(>MHvV3GjR#8dIp-`{`Z7{GjMd2)Ted z1?}gF*!AKX-Oj8Q(YGJYBL`v&1|Mshnbf`Aqr3`$W;>7hdd6SpRzB%i`lKfGCo`gS z*OnKTyJma7>Ezlir0B1%`V$3?-{)|SW5-K8mbtg{)=J|=OKy<8QBCszN2NdlRdUHv3ufZaZ(Q=-_ zFE*KRE#f46xcU>{u{VC}jWg=0$F)?L1l{qT)47MoRGtDMrNdp@bxck4F1sWL`hIK%gkz2}_YEA*voPCO&Nn2-VytyQ-9Y08fNK_j;S~wv-#Sl)1R##m#^9g_VpN7(f{>ur7L(J zXu>W1C`NwszPxqf_<8rr9zcP-+rde$F8S5)F5|5f*0t5rZC^y1ZfTR5{ZUe~_`b_n zZ^dn;#iO4!-d7HiPg>xJOh3=G6E5Ynur!iU3Hi)+skepv=+l1IwyuX1Qnb- z{coa@w-8As zgga2G$H8UIu?-+f!9hvF;GqVq)vKGYZfygyFz#J;T9a(JvfFFn&l`^WDs9{z9j$fS$T+q5ifA@w4?$jj$~`87$Q}6y-Fv&;C=nJvy$^V(ytHrKxob;= z7k7dxqIcYl%cHiW+8**{Xr;DxTpkWfF6hW`6)b&O6UrdJ8yaVo14o&d0ba@fdIIt? zK=$v*?aoZtbyjNqdVBNx=JAANS>nW)2$|>c`<2xt9#D3{l&7Atp=R#gr#bo=nW_TR z2hTucWj+i`LA9sBH6O@l!n?a(C(QiXT?kSbmDQXWH?-^dl4y0Su%slG;dgV)@-)$# z4h6U8;=~o* zBRLt%yIKn~-%{E&)6E5bPKbmR*E(ja5)ZunR(C@dYdv;w=Ir(ff?ry?pT2sL#~ScM zj8kE$;lUo&lXEhMtz?pK!04yq#cm=wYTPEVkd-NNVetGAl&Z-2DaV z6+QljeVOW%P=V@^Pc<`Aiy^L9`{tdqHd;t){l2_BVixOGyUD#26tqxf?(NuB`Pjas z25s3yla^cO2$>M`6C-RM#yz$-^1qZTXDnZa`prg_S$dvgn54C~>DM*m68vYG}ky`RKx$_yud1 zZMcTVpHMg2+a6(Dhef}QCF0#+=&6}9p8pBoxhArTmycyZ>@{pPl0KpG9q1!ju=Ob^h~A{}<8AFj2N8*)lQT_Phk# z0vO}}`*<{g!VGIMQQ*Nxk8`D^U+Dg;cKmyjv`?o50}EA(#hvHYDQla@|9x<_3w0Cw zgqH=k2FHgpUftt}(bd;ad~9O_f80dLJ5d*@%|oYp{XO+?!i&8B4K>b&sEE1pQC8&& z^;@?W9BN%pG{v9P*Gu2*>0BCmtf?6t%KC6~10x(%V89fVALf%bAEqqqbG79a-$k;L za}9qrsQ-MAu6J)6E2pQdXn_uxq6S@uq1ES^#T_F&FN$fH@PR3mq-MlX@* z1z3eCG}3|oz}86>f|XjOQS>kCgG!IS{e2g(11k_hn2w`N=LqQV_Id30XRN#l&(Zdn&# zAtmA8wf@j@H2t)AaV9yQoo21mzTZH)@W}0E&&^Y6HNX<9&umX!?h599~efQNJaV|Ks^XyGjP1jGbr;guAD~{k#&Gv z$AqG_3SxfSS0xZsaJ#_(k)|(L=7vd`UJf2BpxdIg_&&s7J=cIAK}Rq?w|1z-#chqx z-Ae`Hl)C!7;b<;~`= z)cJA*9R)*15qI(1{m*^*3uiIX;xw23@MDe{m(iyh)X!+EoD81!HGlh3Q*A^h6aA+T z^-v2j&O2u7PT#y$+`*Uc&;qs$bvAmcRW_kG!6=Z^P&@NjlzoA8be&t?lS-pu z4N@T|Nm`7>7Iazrb?CSs`LEe^$94=h68&TdgoOp$PL-M5#*`x-c_=GXcvwXjMY<-} z%g&Qyi5VZgfn8Xes?cn80iRHkvSESyPgw9iyy*w&uz}`G>4|O zM!W~$#Dl`38{;6SR7vNT4rxw=^{Njs6eO85>2-Z4#K)2|!)AQUE@OR|b%?g02G0!r z^CNR0U#l8D`%`rM&y`lb20|{XpxE9i#|Y(q^|{H8X9M?9mnCK%l{~WpU#H0x5OB^} zD7aQVB9t>80ps-g#beDpG4BkEN8-cBvU_kZ1_W`<8}N*m4mAQb<6h^iSoQl4zgVsk zV1A70f0EX^zai3PzCZ{aCCtw5mRF^kc-{fJRi=^~0^PELxyF(DXiv=1^`9Wb;iJFYgNvEJHuP~OpsDp{8M~_g^RhwStL?(F@QfptYGdSsb zqeUc}p41{Ac;2B4s_QfJctIPusE=*gG%Mh8HfvMQ!*zrUYT?So=kK3f#`n)4OFwM! zHGV-JB*F$_G+7gd1FhGM-aUZTC2VO%7JPvhKMtG@GK0V5*IMx;1R)dl?ZJDQqZ}0Y zPJ6+8qZkr1VXF_8qZLmK(md%jUXbzIO~-$Y>42ebf^10{<|ya+%hH&>=Zh^1?D9a zrsnLdw65;%qUC6zewlVsGSQRHo4$5RAyfKvr78=`FL3hnITl?#$u#55&Q7dnt@}(Q zgC3KY^`2X$>oY|M5yHaWI%dUw1RcJeuILw(L0acroM?4g#(@fikT@JRH+M?R=c=u?9dCS({QKpfUb-gkTmpW3UJdgL zsGJznBc28v_ehWiPmI2Sw&{2Og0}~vrZ6%&+!z-o!n+bpoWK_yoz&}95odQ$)_INPuO(m;5BW6k_IMhQ#`4!auq)cuj5N?-Nds@vAksv?rOS{TTxvt%Qz8w^yqLw9rCAejq|6A7Q(;$y%;-`m@qz ze1t8uwXBLT@GQa+`Br`pUti^dS8O<5w8spyZ#F@C3ve5_muF!}%`H?(cb%0s^11XN zm}-17l%Ac$?KjUl(qC>>!>U`K#&93?Nl@04iCz;DAy~iTb6hc0A zCJc;VzFJs1Pt-&wAb^PL7kawtW##Oo=-sMQBS@~VK=!J3{W>PtousJc@pWYznG}uh zxUf||tqwYFy}o9fqy4F8c$s?O+K6{ zz48ov5JJl1W|i0rlzJzBd;}hM#p7+eK#aPqj@c9lxk&kdzFh1~CN!-KxkqEDxbB-g z(@%y0lA}7jg$h!ttQO|Cg>w5Qg%eHd=G<6t-N!>sP{(U#b*RRpt&rcl6~{#NRZAhs zuHS_%Fu&l2;_ZB`z#VeGV3gSAQMf=BB;AbziVv&D;+%~YYzS8Jf7%lA*zEz>P|O6v zoV;rX9riL>zo|t}a694TeJ?hzANtPA2vc6^_Ob64Tx_M{fH32eA>{N2xRzng0{Pqp@$$3dUn zBu*AZ%W-mvu=5VSx{G)P*})0n1=+pf%!No?@%CWlW|PpR%H9~lJdNK;8KS>RYwC%; z=&|rR7oCmlNvZp4dL~htu-{@fh@XDHaChn~xMbr>XSud}1ah6VYxCH8HZEc@*IP^@ zICuuGMc9`0TeDw5Ut6T)vmN@CxO&_%{EQfa(gLL+BTVZ^x50RIR5l`DH^!r{6jZ>q z5AP3#9NkZ^w5N8o{XIt$CfR6ytb`>V-AQ39DQFrH1KL@dWvxAqV?hwX1R~`~f3j7L zDZ`uX6#pnjDid=mZ_s1 z-J+-fZwLSIt)>M-znNOp!%X~q2nG#EniWE#5Rji!$rB2rw?s489J^hWsgo)Yo z9~E^BNN$sE5b)29T-te7Wz0?`pt#D8L5O~{V8O+7jcw96DHjn)us?+gRYpiCk9+MC z1+zF)Rc-2XKH!73h;gPq+as&%AOan9b=(TO$+!{UtqxI{AzgN8Ty0DDYE+cC-)PzO zc&$*Q|7WMxfIx()Iv%f)y35e8mc$UAv9H!}Z@aUKuii_%BUtou}#$wl^FJUnYpnM?$hBUAO@uyCo z&NzO^H@&MjUZI{l8lpcyfjsm*+2bj@J#L_O(80YBu|?bp-XN{q_y4kGCYdqqPO$P2 zw~|68Kr}&+Wq&N%IUoah(&F9ame0?jDKiWxXnJbUkEsLx>s06oz`SZVabsSlUp{aP zPTOx!k_^e=frS&HI?|3Nx+(+3Z;Blyy5GBGE?UdvyY#QX6d|X-j>Rh{9J@DESzvhi zhP5xbcJr|4f{8MzyZ*4RlHc`diA>O??t&i8$%C7<3zO5ce+3=YVXEPr{%ZY-b51v;r{fZGC0nCPI+oUQ7TB)F z{$Bjm&A{%-cMeQP*15^F4a4zzfT|~VK}=(e)N(0BB}pgP?`a-;ZdKz?bt{BYAPI}<)|MR zE|0CT{Ov}w<&a?_9@1O4r-UtAM=C|2To|Gr+DP=7M6G@7BK5}va%7_d2~WK8)UJCl zH*X_IITU858WE7d`%AxJZ;|dNw&8N_WO6!k;nTagkkKonU2;0l6mn&X3u!c)i!$D{ zN9HNy7d$RR3gMk84OIF_-mE5*_3xb;Ev2i?bYj^?CwtG6@kISejU=Pzvzu_z^wLMC zlm{<*9b}Ec2QJl4Yu5f~^?ET#2I5eu+#dfyHIa zxv^U~V|9Jl0SXI8cjOTW&oYY8Xku28$CwZ(Hw5WR&0c@9E>5@$MMeQS2IUIVoB&&3 zN4e1ut>0##wOM?75;L~ob|3o3!Bk` z`qHi4XO64c(3uu^DECZPtF$VjSTc1%+-*E@H3LNmN4mU-WXQm)G^|%s48{n_mkAow zCzy78n3+1T2)B_s+dAScQw&JZMH7?e{ov&BO_xRwRR@ck zpWl(6E$vtaX9S|PyfjQ9YKdriNAzyh!Yt&D3}(&{jqqPzL`>0^18r1p)9Z;J-}hVT zr@(+}Wff(FWMsG>?T%at_p;hCzkRxpRe5g;1caMzTxnlF_6D(hX{K7eQ@~*Tn!x3O zHd`Jni6KNIkq%r_0RvxW-;K#wlwbxBW{S?F`Px;)x?m2DLoPX*v>4@aR2!2WtA%=x zd?6Oz9>c7vn!bCEFn2>At-r0>_hTWn1jC~$t7!(^{^Rk7hXk4`uasnGYE6-WsMI-mH{Exs!P;*ZfqhPe;7V@ZaD7?~={rBVddB*mpwEsA<58k1-R%?$zvu@2@IJ zs$yao)0J&tv+{hTHct9Isu|kI~zEE1JW z#6`P`@21S4qhgS;y|UY{8w$5VuoLbYp9Wa(nw|=roLFwS$e+MG{@^lly3#7DP&0a4 z6VaJo=i4A&(oh?t6QUG%{(`;+B`JW;%vju$-b++Hm=q21vQ{Vu6}5%X&-;C8UDwfZ3}jSS{y#|FY(^=!~?v zqxpq3nM8qHP=?=i=&HF`X3^@7_vUVS!M(1Q(A}V3io-=pv&MZ!>}C=AcgO z%zfm7&6atx`9Y*v%YxGHP9sR9c4eaF=Y2xC zXXiJ%)~YM zf15S%n?ax+DZv7Z9Y}My=mHX9mW9Rrh(ZizBQy#aQrwqRlGWBS@ysUPJ%6yltSis{ zg!HP>oLr^E6jT=MIkPIFnz65YW8k`ie0eY;f2O>j#o8;cr06{-i#)2IqqvXIV!!~D z(TWrje|L9~Vg2#!ZMca^`q0>z3XoVM?l<(D$S>-&XVnPa(uer;}be@z+k=1dOfybj<7+q|FGz zFSLL8d*yDlsS@LJGp&`Ev4B0V0{50QQ3Iu*zj^bC4V}CwL&QK`d9GvBwKWR#*bTEb zysNkVdFpXeqYFv6|I~Zm!f!UAS{#$^oZFf~;G~8gDi)tEwJo;+89Quy4r2{b;o;#+ zJ;xZ~ACfgSHP#2g?9|kv>Y}FFMDnTy>Z&ye1df{V5tG9gsbJ?-uK3L>g$#fm1;qEl zIzm>tIX7T^C`P|SAh#8m%Ft^!|9>p@N?{I8LTlFJ7sZ?aYu3%BYZq&|E*yjaKj_N7e42R! z_)bOormK8^{wffo3Vi*~Cxi;D{nsV4nn#mTT>00O4HRJ-BAr=>Lqz|vhAX90A%(5_ z^-S{5?8}AcXW&Gwv*F^@4uaO`&#dW6F;AzpfXK+RM~C!Qo!OjeT!-lYhJgdoi@+^s z|M`!PEN7|X=9MOqI>6Nl27`;LtAW%8W~+#^+m>d3HsAK?9^TZ`)_yo(`{DZT#p*T- zar09HBmQ_R`&uK7zk|z0r^%1MAzz`Oq@?8Kq1d-Dmc9a49X`z5WZ49*RHY5B5D8-#ju3==mk@TDYY_PbX;Ki&}3BG&xHvVK4{iW+u zDTslA!BELRD=W=3*5D`u;%+NI4_xJdjrXpA`P*;{V5+&PvxS%W}Yh z;`M77Oy2M?15iA_O5iMzJT53!ne%pq)%w|F@@&Nw!+hS4TZp6x2YxO6BZs(eqDg6L z_}cwrtd?vvkW8XPD=(EeK0Z+zk9l94rtaD3jb29};I+-00(!=J%Bd312PyZ>a?}Np zZvo$iqlSu3fT7WZ?X+0mKzomo?cfJjk7Z`Kj*d>Y!1J5=kiRrjmX=P^x-l1M&RAVt zJ#ge|`81zH%Aj`uo*5WzXlS&0TAS92=Tr?iO%O1WhH(I)*yD!b6(k+NS%S|fov7LO zeSUuv3J41vb?(sEK(^Rl=CN{q8~umfds36p=R^qbmVxSMb# z6i;JVx$K#$zK3mE`8q78o+t=^USgV?Ny0W_$F!hvfk(~jKvlTU5>BJ{+1qDMi9#N| zsY2QI(|Da^dh%0+8y*)1n7lC~{D!_q z;)62nLUg2Wt!_&Xn;l}=+I)}yAYh4tO^bYnbr|~b=0^Di>2S)(J~_!uLDZgM5q^g& zrt_BdeTH1r=>dp$-L&a7@07>-Cg)M~7Lr6VA<3N#*`WBkkHp0#2B~4F=g5h7jy|Vh za4XhtWfLT5tpnM3WM2T0G%$kPg*MFQ@Yf6Y8rQH+paR7m3P7Vl#3Ox=DLkZ?y%M3llu&As zD(8PU-G6u$TMIjlHB2%3S#XbnKUXy-2hWj~di}S>_w$wI{;j>~55(P<#aSdg3Ku&f znKe)+$F!Jlt=3%+yDF^sS8I%jiisv}*&b}Wmm{}qquMZx5JHBB)UIu0Wv^^huQZ8i*}kZRRIydSG)0_lD7OmS%~aQrS3?FPjJr(p-7tu zG&Ssmo`8eV_McFvo^24cI%Q(Nh9vQwVDph;!{%Y5ZC4d9c8gz#(U*iT+nU3B_uI%H zn1kncq`!El^$>kGMhCFlGTWac(z0@MgMbqF(ZYzV&A1eAw4C?U6ZOQhER~3aUv6F5K_?0- zW3?OhkivhY(jYB^8=P9qOdhuyqvPwFT+Pz&d(tBWQ-&OE9f*Hq2mcCtw7S^cn$l|EG+?db0s;f&)j8-H8J?M&zZ(UdySb1R1K1ea z9h;OJoyDtrcOdV|vLKb}5nE~5w3_{JSuW`GC{a}AW=v(vecjqE*M;^$`b0Bj2!7Yw zR{JG00E$9qrRS!gq}>h<4RnE~n*R$s1qJzLQUk7k(2D=H%gtE}TN_!;nUk%U)ezlv2==ELvhUiX*!fYpRaGAz?RrO56FC3~*5D~aSQR2=X~DKi^o)!;x{)F=0@~9C zL$rKdNGr1w1$OZ>M|Ygu#o7mR63B=#URq|b!G-6ttb9}%?%@+Sb`=#B0F)EVVk*zy zTzYlB#lg;wH;_W(zw2ERm0{a;8f%7JX;^bWH6522FV9VL5~O{gY8kN+$gJV ziDQ!)(%}duWCs5TVfJ0jR{K&ElZdfk7Lo9AW*`xDWCw8OSdE_akoK8iPJk{^{2PRF zc+F#IN4Cn0wAF`Qt~J$MX+9A3m53wji+E365zzL;{sBPT&(q$U{`am&8ARl;P0liW zXBI0MGu}=Tcf9~zQqRmLovxs;36z3xBjPdWpP-HjfgIDD z_#earxue&PIb>-T#&NJTnb`Hs6w#oURy^r0Y?-aF0h@YW3R!=*=z~N#X;u7>54#JP zFA;)S_R}~K@cv{3rX>WF+jJ@mUjK@=9V-01mp*e$)LI2jI({-0o^&5JIqa_mEF47) z>XpO&mLn1^W8}iin)XBoL|h`4 zcX0*8DbXGTg;zL_F$M~sg_3-yN&*h$wa&E*bfR0R*8!ZIu@r(&JP<)S?Guoi3gbM=F%;SzJ5VIzJ!jN#l^*caSQl= zMC7RcPjvM^gL(dsSbSjk|4Z1;|LaX>U@pu@R`X0P8W>PJQ;WQQ+ZuiS3u<}7loelh z4?6;A?tjn!Uo^L%CExMp3?8}7mbHsZk{)x_8>VK_8{ueDQy~;uSBkSCRzc}{m{R>S01Ag9A+5PYFd}rjQ{bz5V zUH<#|f4wQ@ENYDNZ%`4BClEIVv=@qE7aM0d1KnLMYMh_1ja7KE0+Q>QI7_y&EMQ<| z(qMuN53ePsH@?BNP^>&N@|U3of#Z7RR;XCS3pv|p+M}3NR!~c_e#GNTReqc67G%N4 z#~yRRE9f0_B|GB#MBBwsI&rJ6J4PwJ-9kbI((cweuCC>al8(i39`iqUH(Dobw{o@m zds7U-yGNFoUtG)DcdmbS%LGuFpcSj8{H_%Eq>$@1tf^+%(=Vacb!{=sW8BU;=d?+- zsPg0HenzU+LPvCVWgj>S_wro;uJsg3gJa#_b1MbXiL^WqH2tt)@S@N@bZyhI10O$s zHTTDzdao9v-uV6Vb(SpaQVUq!pX8$Kec^8R=1*Ulo6{{VzLM7f+zKW`!^4mMGQD5t z+Q{%Tb#+R1|KB>pgD{JY*i4JeYFBq|b`cwibeA9H@65oT43HM|QvvI!)szxM-WlXF z^w&yTh|TYQ(f^|j(f>&y=)D0M0aqU*uW3}XnKd|g-47ksfnMy4y;HE;GP5*|=O{R7 ze`Mdukyt0;u|B+s#aL=RGX;)}rO8U$pP_TuuEC|M*?g6nf);0YXhk)uy4usa*|*6Q zp)vE#{Dz#|wls_AYvJaDQ}=w6EkQxo2}wU}VVu`wjO%ILom413n$K_Xb4O8AldP40 z#n}0p^&)s?ev$573Y6T$_Bbnck;1hX`3sh46_Cab+ZgbeELT-KO%%}V?&;}lFr#16 zwpy>*)YH?uzo`ho;M&|X4$t~0vDbBw=eny?jmUQlO-G^=w7Eb_iWF&R@mCw*c*CxhAO_0W z3b}r1$2Fht&7L@_LoUwO4qTIO=Sap&vAg~>=j~tuj~_&70M!6z_&VmbjB$Q|O2DZ`E#eL?B?n>!^rYtCOmtc@kq&-KSnTJQcI8yCde1UB-6HQfn}N8z^$o z=S;#)d5oG@-YH0W;0|`2^YY;9cwo?5T`xa2KJ)S8qZ7#qAtc68ueW1_v<1}`9G}N? z_;2t|t0wAvh-qCp-j)qP2^kq*U|;veJ=g!WD+7}s-yI8>^cq;u>dCE5hh>~{F#20n zwsuUOAY?G?`o^5)nG+mTqBa$cGxZirB_1PkxPhvoSgZb;;Dv9fnE+N37h1>7R32)ZZ8EdfSW`YECCEG9x8L5=_hvc+V87x_uHs+7U{kwCd5C6pI3MQ zCQo8NXA^a<2Jy4beQa{_sZt2lXHOD{;s;Yx&xZ-}ix(f9nsl%^T3@=I6o^*qP(K!7 z+mIB0p!O}gw_R$>b`BQ_f+T>Y-=3?x9&wPRR332r1ial;dH94vL5EF6B^XP@kurb( zFR*cN(x@QLN4sGIEU%CLfc`b1OZM6;8_xOdSG9hE=}I~waHbMnQn%;-Y5 z?ic0e-*zb=L~iJI2n4=9O>%7j%0VujngDtfVG)ih_^TW7$P>5?tJfYBftC+E*L|Vr z)g;U4n`Z9A$?yRzK;A=M@*?8S3hOEvh$v1tvO#5^oRA+Q*HH%|oL$PQqQ>-4S2 z05sR6GaYXr1ac^SGVBeze{jxPBXCd5jNu*4q~8oKTWe4YwrkXB`F(>JvRpxM9-5x! zxF2#LhdaH%{JPycV3T!*vE_SK--6cfT$!yC5COx3N`S`N`EJDaL3h`&ZHNG|Q5elv z=hlKAkAVrHPYRVqO|)foKsIF6OweIz4p2WpFkr&y_4mf&V#6*rrfaHA=UXD54tcw( z-QnT$+OWJluD!uk1?T2&6V*N$>kD|gb_@A1eg20culs@6=ORK|u&HsL;#aZo5&Rsj zNyn13xYGvH$t*=#yd#T9KoZqC3)JffbyI&w0e0A_$R43+_X$tD%Y><3WHMS>6wiPX zNoAjTx4?jRS`3{NEn$f51Y|9eqS8^wZ{qk11yg_K_rOc8vyrRl*E5^r_1y`FG1Esa z?tRj+y)w9`U44BkV6LL-QjLwV`6>tebD$c}zp&|~(_QF(7G%cd2K0Zm_nuKrb?v%v z6a^Il9~Dq(mIn|K5NS#T!~!Bs=^YfQp_d>n5fBv>Q0cw*UP1|kfC@nseUsF4uL>doDn*pIhRe@s967->rPIIoz^~ zAA#gp-vRM-dtBWQFyxxOZz-pGIeof)rBuU zJUHRZ(vhI$q1^si!&qH^)wk27VOqxzZvoNF6IPa=`#u=eW#Q@D3Y6lZoF=B)DyyFk zUw7O`0U2ZQT6;5NM*O|-E>mPb;<5MH- z08`9PYkjK9r=`j(`PQH`V8kThWw7E_N96BFG%?B4p8iJjIlt`lbM!rKrEGz~{iN;r zMmrm~(^Be^Ml3;PCTLjJ$cqx!gjChE%d?f0?9xRnT0Wa z`|jU}%Y1R>8m7PzmpO4}SD9XiXfq@a zI8NzTo%NEP5`#Vb!tI+jyNQz~=d)jzwK?yNYn{Ah zi;Ox#wclCK&_j8~O($ZK&K;>LazT=y1#e#-a%Wmo5fK&n+=7`R?vy#H%ie4~KQU=p z-B*i&2`f;i1CXnhKKK-H=Z+Dm=7iC^u21>gfgbdqJfGtk=jV^ICQN1U>DvR2N z??I0-3s+sLRS|m`wuYi8CsGIjeu-fCu@?i9-%IR_7^~AF(G$G9+ikbqdXLE8M(-?B zmO_XPDu*G{nKABsCvD@OyK(WEwO_YjEM4Kq6WHG#PotYc4)x`w`6|0m0@r`3E^ztDO`VpSzR?^Kldal(zT{hul=?pOx2eRRkKm-D);wrvUg+7gNokdXa38t&|aW89AHJ$N3>rsi>ERXew@v-nJRmq znVt0~w5g117ITeneKR#r{R*JAS#oLqT;}vt(VU?mT$&)&OLt3r15sYm zH;%o>#b3VFCgzow>T#2WoO|Z;@x~jVzH?jPm?i1wZEbRBhM=zypKXnmkgCmsLBdEd z`yu&e$+hWOcaW85PQplDl}1e9Q483cpeNlzUBd<6oJ$zH!KMoTo_y|2t5+NJF>|pH z*F1nObe^s@?sS{FV|(hWrM?SBsMaeaMMma%2-?ZT>A6y@Fq6N_Ck`f9{8P$TTHK2# z2C)OQSt*rEPvJ0X4sh!73}V!;j%xLk=T8h4{WQ^>F2ZI_pP?x zx;~soF03r{XN}W%0FtM8I%+|bS^vjf%p10(7v-cMSJ>llgl9EY=bR*576fD_?^M3f zZuwBO{#>Fu>Wt9Gs5rO!77XK+_pkHAH$l@AB22~hRU00P0RrdlyezNo0#3AT6*TIT zpAj(XTif%iPyc8-D_I^E=lGTVr__z~gq{eryRSn5VeHH7bKl#-Fgw|XZqTAPW}RZX z+{Ci@-bzJ+U!)x6m`Bre518HImmQw=u9jQs<(M^U?lyPgVOV6ThG+AQbj-=>CdWFX zuf6{g(RA$bflr^kO#G03Dx0y!0nhPY3;Yyx29^xi6 zZFYJrpZbbZ+yf4q6*6noI8?j#tCbxxR+_gwl=s*?&3&$YP_ven#3g2OkE18h%yuQ& zd$FLBm-!yCjtVCmEC_n-=5TkO{B&cvX0}iJ z@M_PqTR)D)^{j~bhAo_j` zqv;sF0|=PrCeXj?qt_qWUDW~z0K_SmEmLNTQ0s_c0xD&hgPrP_Hhc- z!}NtRxemWmWmY$!*Z0L-Y3DyAk!!PP(V16~fhX4&No%mOD<$-WTP#vS0)g9V zzC~1DT(SuDD0-tUiJ|tP?j-q)_AQmkh1oB&-R{TBa1R*`3bggP&EUME8Q=Qx^(3yw zx_A5mZl$!+D;#NJD=j~rgut^X->uX*ZjoO;5j;u}XsS^HJ-I{i4V<{q&L^g0VeweX zP9v%z;D+^uc9{ra-YM7HlCs@=;YcWr>A z)f)`hoyhGmG`)&~+GHM8k+hn1I~lK9c`%IHDBBU96)Mj4cnRWl*27IR6WqNVjNF75_6pexqdgWfClv~KVz#McJQKGW-LMKn;0i53OvjT`1S_jFv z`T57xX@IBtL#lQL9g|N>ke4i9epTR69u=1sN6usgQbf3x+@8y3Dp{RKpA$cJQjhF& zqg0707lakyzj0Kdgd1I=#FR=mhrvIKjXs%qd4M-FlJakeiJ%hIymGjQ3{s75y|NLUlh*&fy+a}4yuv-M!z1_DC+`u z{2OEY{o?;_SK)sbp7bb1GkCCCf1i$i^j!o%;>u`Cj4MY8YiHV}1qSi^ z64WY`4T_B(TDOO10A?T&{ZkNcPfTwKVVOYWZEbdasBaA3+}!*-l2}~knywsjEgyjh z=MS(KSD=3V5SX#ZGyK2yQm@FnUYljVJg_!sKxrH@CPkP+ck_9YAa<3=N6d{%ij4 z3`$ITnjpN?)x#A^^li_eNGNQogq6AgpkJC3u}0V1R^ZW#eef`5eZ3s zA0GZYB_7av=TqEhlD{cL=N=L0j|98qwnGl=DKBR$zG!>3E)Pd(XLm_7ynEwjmzR?h z%I~|ab`Ww8N_Mp&!;|s>UU~7Iqa);De?{Xe)@J}fK9t8AagR-!0yxER?8ZVj>RtzB zLCTuGSXgYID6v4P5T8gv0%0%Sm%?t7`ZYThT`ngXxobk|aFM)f$_Rw-NhNOff z4A$!2_9-PYh;)og1CY$;x!YJrkJ#UoMCmZoz73DA=34HPwYLddtn+4WKpKx`Z=R2t z`*F>Ln_+7W`_C$B5s0TY3$jSUY;8yVJ5L>erLqH{DG%{yZZ5rqgv`kEQj@Xdlf6By z>amk%r<1499d0gmmvzCvXtNdVyboO!aT>^l8t``|Ice!ZJ|C<)4!z4OzgjIfkOCOF zfXnlUv9W=vUL}cESFk~GfIc%H-FcU&u#ZMjLB*Mmr*1K_KdHQZ5@n@aIQUmZL$LQq z-}|FH4Y4EMoZe#ZPCSs$Wm5&yL7K1vbg`^-)X_jExZM*95x3!n1%*wIIb#*{t+fpB_3 zR-eNDoWR``9euXesl=pEzYGsGn46t#WGdLjPgkI*p`IgnF#%qcsJN&iz%ea!Ns(Wx z>06z+?>t3VDHH2}$@DzZ)_wjwll2*%;>}YJJ>)neoWmv=pEnLMeeh8H>m+af9tsueLz!vc-|rwoyIWJs9o%%pIW6@DGAFTWf%EOux2*6>!BnS_M zcdW=%71-0vKrT^|QesNl*m&xEA^MQA5W2IJUGHedTizuG!$p<1&_T);>0A!kLHYFu z;804Y(h&R%$02|E>XyCT6XTzgDC%Ep3hfM@a?&x)L!h0ICVsG%w>%OWm?;PF|ib zi@mpc^we428!FZ;>d?DG8TU;Q_7#z~eW@#*C8Xt|GSq76{y@35EZ^CO)|dJRF#EZT zT5J)EfUlV+uGgoQXBAj@Shf2W{<=64QbWlX+*@K&>s9*)Kx&AY_5R?j7GVTz*P72AXHh!5?6Qb!-p zX!Xc0V9G)ZqZ;XKR9HjKzIiF+w12OxOZR4K*CV=fhVv#=ozQhMObVs`?LOw2TH zd{J=X{rlm+uVBQg{^v5i&yFvIn+Ig9@%9^j;1YwDsC-+HMPTo#pNAOBL#KWG_UX^| zJi2Qy&`0Ffs_#Mm@*o@M)vu(jQ>?GBM9yfre)a)zYl;%BAU^|ZS28Vd4#V7*4%0iw zZCt)-$?$G0-gd*#GSftif3gl_%qLAL^MX}{> z`-adbwtKTsS;7vDksG0K(koL>wKjm@|LrP$IkUzY6yvNMgKx9mQQ0mgpOS zu)=rsS5WOUNPX7*#J@hnnp9U7702)k+-Y7mLv{~Lx=c<@uh6QzY3{1a<@b?}LGaGN zY7Z*oyuu=n_X_m&^G0}%ar~W~&~^;gQK{Kw8CD`wfXGxRq+-1yC^Vy=j(OJYulJg( z({C%udAvCe4djBt7`yfWS97VfSF~pozR`M)FTg5JQ!Hr$&Q!ynAp!z%e%JD;Rcs?j z?>bA`^_uZ5@Lea}$$JYv<29{Y|IlNhNIH{9aSm29_SVVGG^f7k_zdt3EU4g zg|)wA`TY5i8%QtuL79ak7OI4Su7sEBJEZaWiI%uqQ@&yJ4J~q6*7(u|@_O97$0D9% zJd9T4SH83ft*B3%j7<16`g5C{PB>z=OBFRbv$#>{a1c25}EUMlw% ze%;wJBTSA(z&6qXf7wv3G_Pwbc|Oap5Wk_(-#Pr-465|8fC!_ErKMfy4Vk5iJklEV z8(`{wm13*cFzh}p4o_UNe5RV&Q{-!=wng{nJ9N#_83wq?SL&FEJKb!&Hgx@oA2n5W zeY#b)nwXkr%jX^Z+}9zAwix~imaCCc8Zkp1P%IOvUX%pCQ`t+ZtyW8lNl-u_u8i2 z-H|dXF_957uQ8M0@WmXBM$?evq4`6(z5QDf>;u^yx@IT@JWlHxIYOBQy@@1GW~mL! zXK&jz+{r-;6C{g`D!#HY%Q$YIL%59StTwh=VGj`lcPduyZ%Yxu&3mBLNpHBJ91ws% z{q`ojKhCrKkUvu7`IDbuK1JNopck>x7ez5$VapWrDD zqgoeKs^8*6Ljk)|Y`V(~EXY})q%pR(?^(#L$<^BJrXi=hX=fO)k5rz;-lQ_SR2~8| zw0h0UY5nSyY8Vtv4wzKz9_niXx{>R!_t98>`TLyt6DRn$p+407o{f3s%L1(p7vWpx z0u66A@hvq}1e6Hz-#4-(^Hf!O&2F?`lay?sA9G;}HKs_9irs%jmrF0+ROyTC=UBoeTPN zow{d#;-8n7{);zHN2Np=n(66ffBkxR0mpq63|4pe_>~!yKM!QsVyf*oP74YF2Pny^ zv_5R@?C8;t`X~)A`Vw0{|J;9uWZ%+-hhLdOTxHte*Ua}!D-^i+l`ruXT>Krw~hnO zP($A8!JmAM8X2IM={K)QNH1&${L`CbmkxS^=_f%C*iGK;t zw0!cZ?7~P9wFqcIZgrYJZ93$Lq@5N(~J25OIS%? z(@tSGbPFdj>`&wv0-}YO&z~1llkQr;np9xqP)9$CP2||P;`ib-oPC>iRdqZ6`O=g5 z_8+(<>nyVJ~f2Xnf%JKptq+eYf@)oM8h%5Sn7@}HyjybNbJ7E`A_hL%CozP*7L z8dupi+)U35UsvQVYubpQq^7RTc(%c!U#^mBy$8eE3-pT?{TQKf7`ux*yk3NUEmc0> zI%W>vZ-M-W02y+A2&|K4f#~F9f{9;lj*L#pg%Mz?%rmER@gqg`me+N4bf!IYbTWa^ zs_?=L+1=eeQOc)D-p7du`(=jk3vXc5{OIWzX$$Akuhru7nZl6?88yyi(pc;ZbfRr` zo`|I6Q~wv)B61RaF?qSUg=3)#80%@zKB37^F$C|5=L6AFD4t>hp8VlDojTDtGN|*kTXay+qBh#4N`~J+4R@rAI`WwFfc) z*X||-#tf{68qNbJ2Hrnr-M-vmXEDqshsoXEmd?o?6?^J3G%t{cth6t-S?*4#8u`y+ z3bU2|O{1&+UKDh}{wf9EqRKxuUB87{RcQzpr}_+j8k-sRMTrk-SJ@VMuf(p&61Htw z%}Qjj<=QHR_ZwtOrw^hE9ZZA3FRfoEjmDFb8*l$O41Haw-}NRn{DQ2Txth~-d=96m zfnysm)jMcMk|T<~_IA%|{1_W`M;9f%qfhjFGH=NWbZ6Xe+u;Ogyo5fWs5w?@o`)YP zENEXAURnRfJ~(CxFS;P(Sl8qhyxE&FS@i51GehRGkajBG#B;P%zYB4lZ*S7nr2csh zELF;Ki<_3o#J)r@8AVK#AsS#?fUB$sE#??TC9NSuip`Kt^$kwL`5E|}(Gf{izJfs0 zTCYP67O+(E45aUL?X$qqz?}iNTFk@!TYaPqc{t;6ZAwL8@Ly@LwY^}%ct(l8h1t&) z1-Y6#u8eyl1-e}dYp)boSR31?GXhP~NAits->y%*>5Y_!I^h7beJ7f9(6^j%5OM&yc{r24hq_Om$fkYaBHgEhsLndJ=o6}Z@?!{~Z)OHmb5RfoI?vV>@R?!Wy<%esbX zq3F8N!nE)UB^-+9*7l;0Fs_a6ui<6T%X=%OgYK$6p3k&PCJ}mAe@pI{;JTV9NEC@r z17Z)%o)d>j;$aXJ!Z|SL)o-o6f}y-!4vBoz06W{@1D-ybr(7Sdq6BZb=ZzolO&N3v zj?MkIw?^u-FHv`XK%J<<)hqI-tM@$``Ve9{^gS$Ud*fZ7UYUzIpZiYBn%^8cDPL{| zrX2-KEvM`^$#p!>&<>u>Kw^)>uORE3km{gT})9Y^zj0R<)9a7>AEt{GI* z;P&b2WsB0BLe0?=2QHhT$(+h(p6&j@vtX0u*jy2jjtjRPt5rVo=12mPrmMBrz^YNC zUz7_-Ze2^dN;rSkD1f<`Ptj%RAW-`C-(B@tKuCuJUWI5)0$@+a`i!AagD|E`Akej} z9~^I5O{!mpojwya-SXW1X@!S}=g8kzda#bTn7BCH;r@%S*^ES=CKZ!_1#EhHI7CgY zW9{z1J>8=FK(rS9dFEE-Um#G-^sJzIOmgyU+sk(!J^((iGE6ZK#{?=Dt$b4LW#xET zOzpS^pxQt`BY!&yz^nh-RQ`uXHSC}pK)UZiV*KV7YjjFVPIX&2Z3G0;(`s#Pb@`_+ zXL)$C03T^#ez8zZB@wN!)@A70zbTWzIQ{DVaJrVaqGdDti?j-6@1kAxzmyf?qoa%K zZb7uq%<*w^T@w~oJ--}&g$MAuI>an0^*TC43Uvf$ia6#_*58ac=W%Ba-UX- z4wO8m8N~OuDA<%kakEa5?{=re?%eg4bnKZv{M@fA4(@+kz4DNQ7GE7ryrK%rcqRbH z$LaC1Y6#WrtLV35^a69yWqu@7`DMi?x zv6W9D4c8Q5U0Dldeci(=u1!VB$!6#yf1ZXjwEyh*As}f#-FJ&?N8M&5-@=?}k2LV9 zMSJ-xYwtjiImIxJ4qpC#CSv3p6LGM=MZ4%eRhBV25Gb=~+LHk8`{zmSJ_MxhnvsD) zY!lx;3auB5xQyB>>;jTcF`V4oxVYGA%8WmL4eX-d&b~_fQb~XvI9C7LhsO)`A<{l; z0q}z2`y98QV32&J@$u)-e1HA{`x!!B~WSQzXROBo%O20AgiV{ZDuEkG%$jsTc^%;cFEA0-cA)XY^75 z1#nGC3H$G7dH0{Kl$sG&$e1IUP!D`lPoj+estJOYBW4O@YWZ3EN9AhncSwjVk6R;` z7ZvyQ0WZVyuoVR8d_#xH8zA`jKb&q+K#7#4^8*J98ki*`^1?PESXpDDqOv}2w|x!= z0si`b=uta3oY0eIec=2zZ8NuoO(UF*TZ36J_NfOB0=dfJX6KlU=|5~U%!DE+Hh^4E0*+iZ>x79 z*MmI|@FkkyKdnh0w05fc#;Si8pXo`BeHd-vKq_vF3H-jnisiEOQO0wCG~KfwKSrwG zC5tiV@`0;|;NoZ_Kqg?v|Fi==a!>cC#EYzX^wt^+aw`=e>*4_MM7XZR;{E4j9&47Y z#QnL`N)-@k#$~SfruErV3hVvW3+#I@uHWG6FN-9PU-|aWST{!iOOST-Kv$rJQ%9ou z8XsBxvx1`zKK}x61dy&jFQRCjD=;;$(YMQiJ`~{_f5M)fsJ{{q!!x~CMpq&lnDKND zMY4J(m{uO*-Dgf8PFD{6*E)rB0Z*-6={Vv@LXp@5g6gsOH%Tr-bsJc!-~eCX@Mk1~=zZj$XcB%27)TaVAS40?2}-|ZllZ$SIU42h zNU`z1yJZ;!Xoes_sMQQD#|($;fH}zouZ?F7Q`#WMew!q~c{vQo3j0k!ACs2BchR)U z9};1`hlhB|8Xg0Nb?0ACCEEG|H_yq<$yrcdes_2GXlHM)4q%)aj-aW+y1H?a`6MM4 zT&*ZIBq4@94p%Z@<8j%)x(ndHI#j4LF#o1qibb+wCXElm!qnb}hd=#ajO_`~t4`5; zmZ&dZIJxas9iBJNeZ2=9(s=a>%KgO^V1?BKY}B>ew;uvzgg@z7qmR?MqF`FUJ>B%o z67vQvR2ixxC2`-bJSa;`e&ZJWc=ISAL?FW20g8WB>Ax4KJ_DlLW|y#mtpgKufN{M# zc=<<0iw}t+S_~qKA4tqrx{x^2zr)7p zbgp?~J;P8&@2U%S`x*9WhaqhnoZ|ONElB*tZ$wzB@f7{#pXYz_*D=kf1;g^|Y4YfH zC9m~Kk@rf2i;;%Z7jPR9U!rC1O5PspQ+lq0HP^Lv%gO87x-)RK`&fpKI{k~%Wmh9t zIu#cy-|0Uc2aSD0@qJ*uMUR1JhDOrV`${*t|2!?!`gLx;*_WaMlM=_mm~&<0Ci<9w z=hMt${L`i=@zsK@QeVBa;*AdD)Pjs&-Q_b{* z7@VpRQbZmqDnXBc)oC}yM)E~nN1NkHhn4(D!^V-}1C^J{UJic4?=I;g_rG|0X_YDZ zIWpRQEGE&i<=Xj5{k0%Ddc+DLJ1ra`xB4#Q^ppPjq zp*BfnCDcXTR~I9z6Vi~G}y`kE8Qi>SMToLnky70 zmE?TYO&tjr=o{-ABM&u@X|GFtCKX)mbJZhO6~ztri~N`0OEk7u&PypwQ!kKEb4p0Z z*KqisL5cxoh+IRvb1W~m(YL?q-rwF#p*n1`T8aphUYh&6>+(%gIL#*}r-U*RC-+wb z*$6&K44-Zdl)Mx`6SRfvW7hcei0KiDiqH&8d)fRJkx2Y5_nRdIN@>_!>A{z=3>o$z zZ*7i|egIn~DGNBJiju_Aa{4Z;6{s*Whi1>FL@$~z29~f`K$grY4^ex=3i9s57sIc= zbJ7VIM|+J8-QVsFOA>%oBreyPrVf7Mb{YH&3tKU1v2EJ=)TBsvCrYBy?IL!KIU>z; zXLny#!C6X@@y-+E%NS3Zg}m!eXZf56bJtgjN+KSpTJ65!Z)p!0z0bY%B7-EB;P9f7 z#^YJ~0j(j(twm)#wr0G9<@dPcp9JJ{c|lCO|B|z#D%Tg&g21o%N_zAnJ$JbeTez}k zQPiMhLEu)YdUC}gtwhH17Zb5QW)N?u zI=!R|d5Mz+juxMA649Ge*A}2_`9Bav1vV>qle$r{d|OiC=LCGgXLapotH?sF@b=5BuAE3HZNgBL5s7L|GOG8As|ayHiogN6xB z$}hEBd%QC6U5^wWO#wFZ#IquQoV5HS2i+3PE*|yqqz}z*Ejo4rW%v0u76Rqi(Mw9%bEA)w7-I$mQ$EB6beyLW6 zR>{z7k+5TUb^DU6(WXLNEVXMgJ%Pg_xBa@YW@%}-uI)}>;iAJ#@kpV$)_(Cqfez}k zyqRB|i-21#^Yop&uBkJH^IM-$PoiKV;7z@Iq@#&7&6Ydfu|mTiPrqN3?r*78ER7Q& z6x~;vo<8x%^|dlowSV79{88jRQ@)RnwPRjxF;&!QYsHwmCG=-j#hzTts3PW@3ADsFn9CPQ4d8L>e~QiaT3-}%wE$|9^5PqBwMmI_qYhNBALy118U-rwSB z#m)U6fV1IUsimxh%@ZgQ@tdZlB@;r|c#h#^1n>AEkn?KCkHa>y-+B)YR&BRPdPf%> z5p?Nup0d60gC`t9f`X#ry^}-VU$%#ac6M|;RYB6H!I;hNWLsLc;}DGg7WYqwff@BpH=YcJ)*Tg`jrc=9r8~Au2-C&;oy77>{jyBXaP_~#z8dKz7G?dJJ>1u z$EbnIy&u2M{nacM&!Ii=U`l-Qb;+64de&U~&MEOb9Dka%TB+~%f_$w>zY~9gl@)Wg z1o8J!L_#p`4o&{S8H?JS)jzj^qB(ikhabO%)bPIc&SAPk^Zr_Pe+Lmp-aGoZ?9UPg zoif)jfV#M6AGQ7$N(2OcbunDkM~7lh{a7^uSQduau2YiL&5DX7e~V+5aEJ>l2+E>N zuld6*`C^m)r~1j>H3hIB-vcg9r*d|duyd(Rrt`;v^6{Jdp#nfp9v|Ya>w9>-FVqX8 z;J>|$D*!;ExRaV&o0~B)2zOok3)L1U-)8>ur6C@_&5%9%tiYVvCU?6AKu=lmasXr0 zyml?0fy9v-ya$JfxZ; z@9iPsb}Bj1?Umy(twVqO{RZ#>1J%i)DMxa+u>HYdh=PTetzjA<njeyZWm9b{%d{`z;WPXqk6pOIrmE&);!SS&&RCGk`SkA#w2;)@dWGq8T_9V zXGaIeIC9_D8i}TzuQARgCJ4s@OEhc`pQW5Azvu4b(6s|GiaVifZz6vc0g|C5{xc<4 z3m({;7@fPF;tw%NAg^IeiA~f}EydjzZ2qqAdI18Jy<|gRmD|6*p?bkpg=4F>Ev>^s ziB&TTAYIC$ntOU(yw1{WdHN{cOP``b%(ob(;6Gi78VyBRwuE;H9ar}eyPoz^o~9L zY(iSVV+91!OY6m@_mV3t%jIVna}v)WDL!hhBWlh+B_7t=j(DJG+us;EYNCdvdOA8^ z0IXp8?8j6~zq5hXS;2>z*MxR{z55+E6{YjPI0&QGiW>*E%UIFwNURw*Y)=`!zpx)?a;CqQyw+MOLG3QZ&}bV)dgri?*Q(-rxUH-4V1IDb+Px87mnv zy`Sbi^n(MdV=&4LU$squz=upj(gtTO7Ynw6-Y#RuIM&CUMjIDk;^2#axmnswm$zg;SqLNh{r9vmdCpGXY<6=ih=|%fAOSS@5AnuQHGdD_P)pUO7 zc3v-bAi&aWEN#oiu2A>eicb$TJ!r9Ex-YYVX*R&XVfuEh6pXJC&OMVVgyVmtRnBapl?wdcDit)RFrYiJuw zL*5l=+|^0gbRO_Pv+v=no+0UPx}@D{=SE!nAH5X_%uMy0*TT5@YL{42k}l*Bf7PVi zbZFeO^a-2vTFTTHja_MjrxkHvd5h;5M2)e_+x=G}htAB*)h%~!=~qGd5X68_4KtOk z=%vLOl=N(f+%VEv*sw;h$}X1eQHfJe=K`=6TC^g}nTLoIiOvAg-_hIqwAjb$oZcr% z*sH{pl+{>(tnYq2970ax@R zCn77|trc|vbhEQ#GT(Rz?qvg>l*>|GdUe0Sp*f_lz+r3j@uSBEqi;0C%&YqqZKRcHn;sMI;ewTnQg3{L-M;Qf(U=~JIb5$6cHi8C)Pr1@5jI;HGC{1=tyWc4 zO*+x!PXC6*xKrFAN(se655s$Y0u-#(668!3YrPnws7b$a@ghNj&HKKqWTze);PgL z)iT#$tV8XsBkj%3>7W8N3A2Sh=aiZhByf_q_6THjaHhv(H^)@smY9OLkikgd$P*6_ z{n|#s-TK>m*udJQ2*o%Eaj|5i{3)_y- zI`Rp}?;YY$Vvf>@#P}46!Z$OfWXMII88S6Jhu%UdIN7SoY6UVmuG7#@7)RMFmLZ%w zlusb|yUev+7qhGwOp1J+txV@Oj;2*qrY;&^4zf<{IJkL(1Kq3+kjjb?v2X zPlM*fK-*XuV{rxw7 zb|z3C4Z8wVRI{j`nDE1qaG1aeXD=}Mg-;>vUF3|%n2c;C3|IQLe&BLdl^i~_eQoF& zX1}y_#@S`t#oBt&Pwv{jF}GRMGLkFP!pla0a<0&z=$FY4b~sVS$Fzk+P=k{P8Zgds z8j#GmRKI?OQB)EF8Y!4)wH?rqOdmSilX|-caRU)s-eX!bP)@PXmm&`C-3nh^acx5m zq|eRGVd!z}M<1jA(s;t<%m*S6WCK0x6TV=r$q3s#vvG}Nio!VoBHu+nme*uH2kZxT zcXCLEc{}rfs0T?S$WVfdo6|4Og3m!o-WLm;@b?h<^u6KFIQK`#K|4iG5QTF*+{D8} z>l?up72*WYAYK`)b^Y4)bnzn~!s(hk@oK+*p`tS(pSMaZst+tPo}C?a6f%(zlTyOf zL)mb>iG*233_43LP~3-B#*RBq+visre8&g(a;&`TwR2pZL@*{(lKe9pMda+Zu-qlZ z(qJ)cu)$RQv2jvyD8$xwUXS7Y*Xvx_$4$qzIyg+?#Vv02g=g=NezKePa5&SnuN)Q@ zwkA2w%HO!u()+~iyo&va^vV-WTfxK@s}m+;-~Dty`y8?VRS=p>z8?>MvW;)IIsr?s z@&&+Z!2x{B&*pw{v7-nW>Pj(0!nu&;8|jiakTzqeZ()8;1FB)~ol(TCATDj*AU=eU zMugIW58K$-6!=!7_|x|l(}c%M`|7F>{p>mAYkj1}{>AOW7q~FHi!P zGz~;18#SR9&zY&@K2qmNlGwznx%Oh-7+x$p*9<+T=sI;}$La96?7~RMXlGkz$lU82 zh7{u)cykk0UHm;zbLn+6ZWD+uyR2-6{{TLH2=YJ%*KupTsw% zhZfM&&qW`N3eBBCJ}OGIkFoLPhwVH=r44i+%@%ywWx(j^4|lvtXXXqCziHl69HlHSaM;(Wu%eNA%K^7UW~GcES4D=qcG2a*iv@UFj)Z4wq6U^|7}tvMt{E zfL#ZpD**vv!W8y+#}r|mHandZ8zbwNZw?Mh4|ezf*}UL|2F;{EjMXDkogxD<65y-5 zr+^)`ilgJ}mBZnC6Gsah9`EPG0Oa5ouIolmGPQ@&wV9JR#MK4dXfrnfDonrzoKw^1 zU?<1H8PjzfoKC-{C ztA<6WAin{SvuuR5RwM4s%rixJ^uJ)N`)=UnV_G|m+Pu^H;P_L)Bx(qA2X|?LtAY9ymBP3X`-g(klJz=5T2{P zqZn^Q5NH6CS1uMSZkhpX=z)t|27^t*FN{*+?!`7{%&e9T6osiSlZlr7f^0Mo!r4y3 zX=h+hQK`p?(=lg>63zP4T3xzT+@Zrs>^h3`rTuK=N$ttmPHzZs}f$o9S9%?-( Jy=N8tKLBzo3uyoV diff --git a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-26cc19c0-4c44-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-26cc19c0-4c44-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index e4ae3b6c6f..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-26cc19c0-4c44-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.browser_access\\\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":180,\"minLat\":-66.51326,\"minLon\":-180},\"mapCenter\":{\"lat\":19.94277,\"lon\":0,\"zoom\":1.06},\"openTOCDetails\":[]},\"gridData\":{\"h\":18,\"i\":\"26f3b155-53ad-40e1-a01d-e469c7193d9d\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"26f3b155-53ad-40e1-a01d-e469c7193d9d\",\"panelRefName\":\"panel_0\",\"type\":\"map\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"2b16dc24-ff32-475b-8dd7-cb51f5d93954\",\"w\":16,\"x\":0,\"y\":18},\"panelIndex\":\"2b16dc24-ff32-475b-8dd7-cb51f5d93954\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"ac107bfb-95e0-4f77-9aec-9674891d047b\",\"w\":16,\"x\":32,\"y\":18},\"panelIndex\":\"ac107bfb-95e0-4f77-9aec-9674891d047b\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"286696da-f87c-4872-b7c7-6a20f8584ea6\",\"w\":16,\"x\":16,\"y\":18},\"panelIndex\":\"286696da-f87c-4872-b7c7-6a20f8584ea6\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler][ZPA] Browser Access Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-26cc19c0-4c44-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zpa-5a0f9320-4c44-11ec-9023-a76a2cb41dcd", - "name": "panel_0", - "type": "map" - }, - { - "id": "zscaler_zpa-1b5846e0-4c44-11ec-9023-a76a2cb41dcd", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zpa-23d03780-4eb8-11ec-9527-b704eaaa5c53", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zpa-d8e44aa0-5992-11ec-b2d0-45019404f2e5", - "name": "panel_3", - "type": "visualization" - } - ], - "type": "dashboard", - "updated_at": "2021-12-10T08:26:57.853Z", - "version": "WzEwNjcsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-7511d7f0-4c49-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-7511d7f0-4c49-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 6025d8dff3..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-7511d7f0-4c49-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":85.05113,\"maxLon\":270,\"minLat\":-85.05113,\"minLon\":-270},\"mapCenter\":{\"lat\":1.7677,\"lon\":0,\"zoom\":1.06},\"openTOCDetails\":[]},\"gridData\":{\"h\":22,\"i\":\"5d6fd558-dee7-432b-9374-8d1e7eb8dbc9\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"5d6fd558-dee7-432b-9374-8d1e7eb8dbc9\",\"panelRefName\":\"panel_0\",\"type\":\"map\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"2b19f9ee-4ba4-4f5b-bddb-8be10b5d085e\",\"w\":16,\"x\":0,\"y\":22},\"panelIndex\":\"2b19f9ee-4ba4-4f5b-bddb-8be10b5d085e\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":14,\"i\":\"dc65087e-2242-4e8b-86a0-61e1c0da98f5\",\"w\":15,\"x\":16,\"y\":22},\"panelIndex\":\"dc65087e-2242-4e8b-86a0-61e1c0da98f5\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":14,\"i\":\"ac1bbf4b-b227-4d6a-812d-f6f682a86cb5\",\"w\":17,\"x\":31,\"y\":22},\"panelIndex\":\"ac1bbf4b-b227-4d6a-812d-f6f682a86cb5\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"d8929019-59a4-4158-b1f1-b769f1b8ed3c\",\"w\":24,\"x\":0,\"y\":36},\"panelIndex\":\"d8929019-59a4-4158-b1f1-b769f1b8ed3c\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"8f582a11-a96d-42ab-a4af-8723737dedc0\",\"w\":24,\"x\":24,\"y\":36},\"panelIndex\":\"8f582a11-a96d-42ab-a4af-8723737dedc0\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"f1106d4f-52b0-4837-bd41-a0ff1f3e13bb\",\"w\":16,\"x\":0,\"y\":51},\"panelIndex\":\"f1106d4f-52b0-4837-bd41-a0ff1f3e13bb\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"4b74af86-5ad3-4d2b-87e9-c98cb12c673a\",\"w\":16,\"x\":16,\"y\":51},\"panelIndex\":\"4b74af86-5ad3-4d2b-87e9-c98cb12c673a\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5fbfcc7f-07b1-4751-a569-04a0104a9806\",\"w\":16,\"x\":32,\"y\":51},\"panelIndex\":\"5fbfcc7f-07b1-4751-a569-04a0104a9806\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"savedVis\":{\"data\":{\"aggs\":[],\"searchSource\":{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\" \"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"bar_color_rules\":[{\"id\":\"4ac99360-4dd5-11ec-9c7f-599fe68d9667\"}],\"drop_last_bucket\":0,\"id\":\"81cebc93-9e11-4079-9241-baa103cd5db6\",\"index_pattern_ref_name\":\"metrics_429030c5-d674-4696-8aac-9385e886ce19_0_index_pattern\",\"interval\":\"\",\"isModelInvalid\":false,\"max_lines_legend\":1,\"pivot_id\":\"client.ip\",\"pivot_label\":\"Client IP\",\"pivot_type\":\"string\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"default\",\"hidden\":false,\"id\":\"a5e34d80-4dd6-11ec-9c7f-599fe68d9667\",\"label\":\"Application Setup Time (Time in microseconds)\",\"line_width\":1,\"metrics\":[{\"field\":\"json.ServerSetupTime\",\"id\":\"1c4724b0-4dfa-11ec-9c7f-599fe68d9667\",\"type\":\"avg\"},{\"field\":\"json.ConnectionSetupTime\",\"id\":\"5adf7740-4dfa-11ec-9c7f-599fe68d9667\",\"type\":\"avg\"},{\"field\":\"json.ConnectorZENSetupTime\",\"id\":\"6f1124c0-4dfa-11ec-9c7f-599fe68d9667\",\"type\":\"avg\"},{\"id\":\"7956fef0-4dfa-11ec-9c7f-599fe68d9667\",\"script\":\"params.a + params.b + params.c\",\"type\":\"math\",\"variables\":[{\"field\":\"1c4724b0-4dfa-11ec-9c7f-599fe68d9667\",\"id\":\"7ad8bcf0-4dfa-11ec-9c7f-599fe68d9667\",\"name\":\"a\"},{\"field\":\"5adf7740-4dfa-11ec-9c7f-599fe68d9667\",\"id\":\"80181f30-4dfa-11ec-9c7f-599fe68d9667\",\"name\":\"b\"},{\"field\":\"6f1124c0-4dfa-11ec-9c7f-599fe68d9667\",\"id\":\"81c5f640-4dfa-11ec-9c7f-599fe68d9667\",\"name\":\"c\"}]}],\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\",\"time_range_mode\":\"entire_time_range\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"time_range_mode\":\"entire_time_range\",\"tooltip_mode\":\"show_all\",\"truncate_legend\":1,\"type\":\"table\",\"use_kibana_indexes\":true},\"title\":\"[Zscaler][ZPA] Slowest Applications\",\"type\":\"metrics\",\"uiState\":{}},\"table\":{\"sort\":{\"column\":\"_default_\",\"order\":\"desc\"}}},\"gridData\":{\"h\":15,\"i\":\"429030c5-d674-4696-8aac-9385e886ce19\",\"w\":24,\"x\":0,\"y\":66},\"panelIndex\":\"429030c5-d674-4696-8aac-9385e886ce19\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"911a577a-4b0e-44e2-80c8-3a70407f8a22\",\"w\":24,\"x\":24,\"y\":66},\"panelIndex\":\"911a577a-4b0e-44e2-80c8-3a70407f8a22\",\"panelRefName\":\"panel_10\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler][ZPA] User Activity and Status Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-7511d7f0-4c49-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zpa-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd", - "name": "panel_0", - "type": "map" - }, - { - "id": "zscaler_zpa-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zpa-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zpa-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "zscaler_zpa-552331e0-4c4f-11ec-9023-a76a2cb41dcd", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "zscaler_zpa-76176ed0-4c4e-11ec-9023-a76a2cb41dcd", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "zscaler_zpa-e86c2d90-4c49-11ec-9023-a76a2cb41dcd", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "zscaler_zpa-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "zscaler_zpa-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "zscaler_zpa-82076ba0-4e74-11ec-ad09-d9f49962d407", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "zscaler_zpa-4cf30750-4d0a-11ec-ad09-d9f49962d407", - "name": "panel_10", - "type": "visualization" - } - ], - "type": "dashboard", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NjcsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa3c3c00-4c57-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa3c3c00-4c57-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 1cae7f82fd..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa3c3c00-4c57-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,74 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":89.78601,\"maxLon\":540,\"minLat\":-89.78601,\"minLon\":-360},\"mapCenter\":{\"lat\":0,\"lon\":115.86278,\"zoom\":0.6},\"openTOCDetails\":[]},\"gridData\":{\"h\":15,\"i\":\"d65f21eb-eb68-4cbc-abd9-d8ff48776d1d\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"d65f21eb-eb68-4cbc-abd9-d8ff48776d1d\",\"panelRefName\":\"panel_0\",\"type\":\"map\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":85.05113,\"maxLon\":180,\"minLat\":-85.05113,\"minLon\":-360},\"mapCenter\":{\"lat\":20.96631,\"lon\":-81.88323,\"zoom\":0.69},\"openTOCDetails\":[]},\"gridData\":{\"h\":18,\"i\":\"304163ec-bce7-4995-99cd-7892cf6e4277\",\"w\":48,\"x\":0,\"y\":15},\"panelIndex\":\"304163ec-bce7-4995-99cd-7892cf6e4277\",\"panelRefName\":\"panel_1\",\"type\":\"map\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"b32ccd6a-9edb-47f2-829d-d9e11ad3b850\",\"w\":16,\"x\":0,\"y\":33},\"panelIndex\":\"b32ccd6a-9edb-47f2-829d-d9e11ad3b850\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"a6f8c118-5b3d-4339-8037-21651b658e0a\",\"w\":16,\"x\":16,\"y\":33},\"panelIndex\":\"a6f8c118-5b3d-4339-8037-21651b658e0a\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"99a58fff-e3ec-42df-9f37-f69008909dc1\",\"w\":16,\"x\":32,\"y\":33},\"panelIndex\":\"99a58fff-e3ec-42df-9f37-f69008909dc1\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"f2952e7e-2165-4908-a9a6-6ebf385438e2\",\"w\":24,\"x\":0,\"y\":48},\"panelIndex\":\"f2952e7e-2165-4908-a9a6-6ebf385438e2\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"efcf0961-81c8-4e07-9bea-b0db4d0a5ec1\",\"w\":24,\"x\":24,\"y\":48},\"panelIndex\":\"efcf0961-81c8-4e07-9bea-b0db4d0a5ec1\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"b1fccb13-65ac-413c-b600-674dfb9b42d5\",\"w\":24,\"x\":0,\"y\":63},\"panelIndex\":\"b1fccb13-65ac-413c-b600-674dfb9b42d5\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"1d384991-def5-4620-b55f-31e9a8b3218a\",\"w\":24,\"x\":24,\"y\":63},\"panelIndex\":\"1d384991-def5-4620-b55f-31e9a8b3218a\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"cfd0d990-2314-4b7c-bad4-07b895bf4b55\",\"w\":48,\"x\":0,\"y\":79},\"panelIndex\":\"cfd0d990-2314-4b7c-bad4-07b895bf4b55\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler][ZPA] App Connector Status", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-fa3c3c00-4c57-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zpa-43836b20-4c55-11ec-9023-a76a2cb41dcd", - "name": "panel_0", - "type": "map" - }, - { - "id": "zscaler_zpa-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd", - "name": "panel_1", - "type": "map" - }, - { - "id": "zscaler_zpa-b0fa5650-4c55-11ec-9023-a76a2cb41dcd", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zpa-860071f0-4c55-11ec-9023-a76a2cb41dcd", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "zscaler_zpa-89a91550-4c5a-11ec-9023-a76a2cb41dcd", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "zscaler_zpa-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "zscaler_zpa-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "zscaler_zpa-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "zscaler_zpa-17759700-4c5b-11ec-9023-a76a2cb41dcd", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "zscaler_zpa-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd", - "name": "panel_9", - "type": "visualization" - } - ], - "type": "dashboard", - "updated_at": "2021-12-06T11:14:42.883Z", - "version": "WzQ4MTU1LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa5b1830-4c63-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa5b1830-4c63-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 9da279c5ee..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/dashboard/zscaler_zpa-fa5b1830-4c63-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,49 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"c61f1028-287d-427a-80dd-7530fe1d407b\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"c61f1028-287d-427a-80dd-7530fe1d407b\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"0c5e09b0-f4c9-41bf-9855-b6aedef7e49b\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"0c5e09b0-f4c9-41bf-9855-b6aedef7e49b\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"590bd39d-7ba8-475f-99a4-94d6fe3c7a66\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"590bd39d-7ba8-475f-99a4-94d6fe3c7a66\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"c779f9f4-69c6-4e08-af7b-b79fed7e1b9c\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"c779f9f4-69c6-4e08-af7b-b79fed7e1b9c\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":21,\"i\":\"b4f9406f-ee08-487d-924a-1012fa15442c\",\"w\":48,\"x\":0,\"y\":30},\"panelIndex\":\"b4f9406f-ee08-487d-924a-1012fa15442c\",\"panelRefName\":\"panel_4\",\"title\":\"[Zscaler][ZPA] Audit Operations Details\",\"type\":\"search\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler][ZPA] Audit Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-fa5b1830-4c63-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zpa-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "zscaler_zpa-f2e526e0-4c63-11ec-9023-a76a2cb41dcd", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zpa-2fffbd90-4d29-11ec-ad09-d9f49962d407", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zpa-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53", - "name": "panel_4", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2021-12-03T05:25:34.232Z", - "version": "WzI0ODQyLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index fdf33c4522..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"31d17945-828a-4b1e-9d63-5ff628cae1b3\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":19.94277,\"lon\":0},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_status\\\" OR data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-15y\",\"to\":\"now\"},\"zoom\":1.06}", - "title": "[Zscaler][ZPA] Users by region", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-1f09dc30-4c4f-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "map": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map", - "updated_at": "2021-12-02T08:37:35.859Z", - "version": "WzExMDE5LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-43836b20-4c55-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-43836b20-4c55-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 574fd1b6f2..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-43836b20-4c55-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"3099042d-0154-49b6-8c0c-f492730c5835\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"observer.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":0,\"lon\":-130.09157},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-50y\",\"to\":\"now\"},\"zoom\":0.15}", - "title": "[Zscaler][ZPA] App Connectors by region", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-43836b20-4c55-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "map": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map", - "updated_at": "2021-12-02T08:29:02.976Z", - "version": "WzEwNjk0LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-5a0f9320-4c44-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-5a0f9320-4c44-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 14a71b6d91..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-5a0f9320-4c44-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"44962ab1-9a18-493c-a7c4-4408f7df2ca7\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":-0.77104,\"lon\":35.52056},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.browser_access\\\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-5y\",\"to\":\"now\"},\"zoom\":0.77}", - "title": "[Zscaler][ZPA] Browser Access Events by Region", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-5a0f9320-4c44-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "map": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map", - "updated_at": "2021-12-07T14:31:15.512Z", - "version": "WzE0ODIsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 544f3b41de..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/map/zscaler_zpa-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"72f12276-ca0b-455c-a518-bf4493c7d673\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"observer.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"metrics\":[{\"field\":\"zscaler_zpa.app_connector_status.connector.group\",\"type\":\"cardinality\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":20.96631,\"lon\":-81.88323},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-15y\",\"to\":\"now\"},\"zoom\":0.69}", - "title": "[Zscaler][ZPA] Connector Groups by region", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-dff56dd0-4ce8-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "map": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map", - "updated_at": "2021-12-16T06:12:52.253Z", - "version": "WzIwNDUsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zpa/0.1.0/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 4b5fbadd6a..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "attributes": { - "columns": [ - "user.name", - "zscaler_zpa.audit.object.type", - "zscaler_zpa.audit.object.name", - "zscaler_zpa.audit.value.new", - "zscaler_zpa.audit.value.old" - ], - "description": "", - "grid": {}, - "hideChart": true, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.audit\\\"\"}}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "[Zscaler][ZPA] Audit Operations Details" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "search": "7.9.3" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2021-12-03T12:58:06.911Z", - "version": "WzM2NDQyLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-17759700-4c5b-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-17759700-4c5b-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 4787d83dd0..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-17759700-4c5b-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zpa.app_connector_status.connector_up_time\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\"},\"query\":{\"exists\":{\"field\":\"zscaler_zpa.app_connector_status.connector_up_time\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top 10 Connector with highest uptime", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"aggregate\":\"max\",\"customLabel\":\"Connector UpTime\",\"field\":\"zscaler_zpa.app_connector_status.connector_up_time\",\"size\":10,\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\"},\"schema\":\"metric\",\"type\":\"top_hits\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Connector Name\",\"field\":\"zscaler_zpa.app_connector_status.connector.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"_key\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top 10 Connector with highest uptime\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-17759700-4c5b-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-16T06:17:25.442Z", - "version": "WzIxMjgsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index d41e800a8a..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of App Connector Status by Session Type", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Session Type\",\"field\":\"zscaler_zpa.app_connector_status.session.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler][ZPA] Distribution of App Connector Status by Session Type\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-1b2c06c0-4eb5-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T08:15:40.723Z", - "version": "WzEwMzAzLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b5846e0-4c44-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b5846e0-4c44-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 0ed80ca99f..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-1b5846e0-4c44-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.browser_access\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of Browser Access by Exporter", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Exporter\",\"field\":\"zscaler_zpa.browser_access.exporter\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of Browser Access by Exporter\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-1b5846e0-4c44-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-06T10:33:40.004Z", - "version": "WzQ3NjY5LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-23d03780-4eb8-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-23d03780-4eb8-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 08b32acc4d..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-23d03780-4eb8-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.browser_access\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of Browser Access by Browser", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Browser\",\"field\":\"user_agent.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of Browser Access by Browser\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-23d03780-4eb8-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-06T10:33:52.939Z", - "version": "WzQ3Njk2LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-2fffbd90-4d29-11ec-ad09-d9f49962d407.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-2fffbd90-4d29-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 79d7fdef22..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-2fffbd90-4d29-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.audit\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of Audit Events by Object Type", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Object Type\",\"field\":\"zscaler_zpa.audit.object.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of Audit Events by Object Type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-2fffbd90-4d29-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T07:26:39.134Z", - "version": "Wzk0NDIsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4cf30750-4d0a-11ec-ad09-d9f49962d407.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4cf30750-4d0a-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 3b716c4832..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4cf30750-4d0a-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zpa.user_activity.server_setup_time\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\"},\"query\":{\"exists\":{\"field\":\"zscaler_zpa.user_activity.server_setup_time\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Slowest Connector Server", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Server Setup Time (in microseconds)\",\"field\":\"zscaler_zpa.user_activity.server_setup_time\"},\"schema\":\"metric\",\"type\":\"avg\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Host\",\"field\":\"client.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Slowest Connector Server\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-4cf30750-4d0a-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-03T10:15:04.677Z", - "version": "WzMxMzkyLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index e010a8e4d0..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of Users by Connection Status", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Connection Status\",\"field\":\"zscaler_zpa.user_activity.connection.status\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of Users by Connection Status\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-4ea78dd0-4c49-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-03T09:46:37.308Z", - "version": "WzI5OTg1LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-552331e0-4c4f-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-552331e0-4c4f-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 0538404258..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-552331e0-4c4f-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of User by Client type", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Client Type\",\"field\":\"zscaler_zpa.user_status.client.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of User by Client type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-552331e0-4c4f-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NjAsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-76176ed0-4c4e-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-76176ed0-4c4e-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index fe817b5960..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-76176ed0-4c4e-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top Countries with Users", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Country Code\",\"field\":\"client.geo.country_iso_code\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Zscaler][ZPA] Top Countries with Users\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-76176ed0-4c4e-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NjEsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-82076ba0-4e74-11ec-ad09-d9f49962d407.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-82076ba0-4e74-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 633846a8a1..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-82076ba0-4e74-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zpa.user_activity.connector_zen_setup_time\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\"},\"query\":{\"exists\":{\"field\":\"zscaler_zpa.user_activity.connector_zen_setup_time\"}}},{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\",\"key\":\"zscaler_zpa.user_activity.connection.setup_time\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\"},\"query\":{\"exists\":{\"field\":\"zscaler_zpa.user_activity.connection.setup_time\"}}},{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index\",\"key\":\"zscaler_zpa.user_activity.server_setup_time\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\"},\"query\":{\"exists\":{\"field\":\"zscaler_zpa.user_activity.server_setup_time\"}}}],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Slowest Applications", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"bar_color_rules\":[{\"id\":\"4ac99360-4dd5-11ec-9c7f-599fe68d9667\"}],\"drop_last_bucket\":0,\"id\":\"81cebc93-9e11-4079-9241-baa103cd5db6\",\"index_pattern_ref_name\":\"metrics_0_index_pattern\",\"interval\":\"\",\"isModelInvalid\":false,\"max_lines_legend\":1,\"pivot_id\":\"client.ip\",\"pivot_label\":\"Client IP\",\"pivot_type\":\"string\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"default\",\"hidden\":false,\"id\":\"a5e34d80-4dd6-11ec-9c7f-599fe68d9667\",\"label\":\"Application Setup Time (in microseconds)\",\"line_width\":1,\"metrics\":[{\"field\":\"zscaler_zpa.user_activity.server_setup_time\",\"id\":\"1c4724b0-4dfa-11ec-9c7f-599fe68d9667\",\"type\":\"avg\"},{\"field\":\"zscaler_zpa.user_activity.connection.setup_time\",\"id\":\"5adf7740-4dfa-11ec-9c7f-599fe68d9667\",\"type\":\"avg\"},{\"field\":\"zscaler_zpa.user_activity.connector_zen_setup_time\",\"id\":\"6f1124c0-4dfa-11ec-9c7f-599fe68d9667\",\"type\":\"avg\"},{\"id\":\"7956fef0-4dfa-11ec-9c7f-599fe68d9667\",\"script\":\"params.a + params.b + params.c\",\"type\":\"math\",\"variables\":[{\"field\":\"1c4724b0-4dfa-11ec-9c7f-599fe68d9667\",\"id\":\"7ad8bcf0-4dfa-11ec-9c7f-599fe68d9667\",\"name\":\"a\"},{\"field\":\"5adf7740-4dfa-11ec-9c7f-599fe68d9667\",\"id\":\"80181f30-4dfa-11ec-9c7f-599fe68d9667\",\"name\":\"b\"},{\"field\":\"6f1124c0-4dfa-11ec-9c7f-599fe68d9667\",\"id\":\"81c5f640-4dfa-11ec-9c7f-599fe68d9667\",\"name\":\"c\"}]}],\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\",\"time_range_mode\":\"entire_time_range\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"time_range_mode\":\"entire_time_range\",\"tooltip_mode\":\"show_all\",\"truncate_legend\":1,\"type\":\"table\",\"use_kibana_indexes\":true},\"title\":\"[Zscaler][ZPA] Slowest Applications\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-82076ba0-4e74-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "metrics_0_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-03T10:14:36.668Z", - "version": "WzMxMzYxLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-860071f0-4c55-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-860071f0-4c55-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index c5224befdc..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-860071f0-4c55-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top 10 ZEN with frequent usage", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"ZEN\",\"field\":\"zscaler_zpa.app_connector_status.zen\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top 10 ZEN with frequent usage\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-860071f0-4c55-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T08:10:02.798Z", - "version": "WzEwMDYxLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-89a91550-4c5a-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-89a91550-4c5a-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 7ea6fd33d0..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-89a91550-4c5a-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top 10 Connectors by name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Connector Name\",\"field\":\"zscaler_zpa.app_connector_status.connector.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top 10 Connectors by name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-89a91550-4c5a-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T08:10:44.274Z", - "version": "WzEwMDk1LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 4c03bc8062..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of App Connector by Session Type, Session Status, OS Platform", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Connector Name\",\"field\":\"zscaler_zpa.app_connector_status.connector.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Session Status\",\"field\":\"zscaler_zpa.app_connector_status.session.status\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Session Type\",\"field\":\"zscaler_zpa.app_connector_status.session.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"OS Platform\",\"field\":\"observer.os.platform\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"row\":false,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Distribution of App Connector by Session Type, Session Status, OS Platform\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-8ca8eb00-4c5e-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T08:23:25.330Z", - "version": "WzEwNTIxLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index c5360d5987..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of User by Session Status", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Session Status\",\"field\":\"zscaler_zpa.user_status.session.status\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of User by Session Status\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-9f334ef0-4c4f-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NTksMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-b0fa5650-4c55-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-b0fa5650-4c55-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index c3cb501590..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-b0fa5650-4c55-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Total App Connectors", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total App Connectors\",\"field\":\"zscaler_zpa.app_connector_status.connector.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"[Zscaler][ZPA] Total App Connectors\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-b0fa5650-4c55-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T07:57:25.973Z", - "version": "Wzk4MjIsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 99d665a027..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.audit\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top Users with most activities", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"User\",\"field\":\"user.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top Users with most activities\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-be0fc2e0-4c63-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T07:24:53.458Z", - "version": "WzkzMjksMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 1f2148e09c..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Total Users", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total Users\",\"field\":\"user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"[Zscaler][ZPA] Total Users\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-c8d009c0-4c4e-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NTcsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index c982d2f131..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of Users per Application (Top 10)", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Application Name\",\"field\":\"zscaler_zpa.user_activity.application\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Username\",\"field\":\"user.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Distribution of Users per Application (Top 10)\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-ccbe7ed0-4c4a-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NjMsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index a07cf30e57..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] CPU Utilization by Connector over time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"aggregate\":\"concat\",\"customLabel\":\"CPU Utilization\",\"field\":\"host.cpu.usage\",\"size\":10,\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\"},\"schema\":\"metric\",\"type\":\"top_hits\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"\",\"drop_partials\":false,\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"scaleMetricValues\":false,\"timeRange\":{\"from\":\"now-15d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"used_interval\":\"12h\"},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Connector Name\",\"field\":\"zscaler_zpa.app_connector_status.connector.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"_key\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"fittingFunction\":\"linear\",\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":9,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"CPU Utilization\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"CPU Utilization\"},\"type\":\"value\"}]},\"title\":\"[Zscaler][ZPA] CPU Utilization by Connector over time\",\"type\":\"line\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-d0c885a0-4c5b-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T08:13:27.959Z", - "version": "WzEwMjAzLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 47b4a9e322..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top 10 AppGroups", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"App Groups\",\"field\":\"zscaler_zpa.user_activity.app_group\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top 10 AppGroups\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-d124a2a0-4c4b-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-11-26T12:58:31.486Z", - "version": "WzU4NjQsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d8e44aa0-5992-11ec-b2d0-45019404f2e5.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d8e44aa0-5992-11ec-b2d0-45019404f2e5.json deleted file mode 100755 index dc8efb5fdc..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-d8e44aa0-5992-11ec-b2d0-45019404f2e5.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.browser_access\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of OS across user.", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"field\":\"user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user_agent.os.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"user_agent.os.version\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"row\":false,\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of OS across user.\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-d8e44aa0-5992-11ec-b2d0-45019404f2e5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-10T08:26:18.069Z", - "version": "WzEwNTMsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-e86c2d90-4c49-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-e86c2d90-4c49-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 6fb7949307..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-e86c2d90-4c49-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.user_activity\\\" and zscaler_zpa.user_activity.connection.status : \\\"active\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top 10 Active Users", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"User Name\",\"field\":\"user.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top 10 Active Users\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-e86c2d90-4c49-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-03T09:50:43.417Z", - "version": "WzMwMjYwLDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index 04ba639e45..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.app_connector_status\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Memory Utilization by Connector over time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"aggregate\":\"concat\",\"customLabel\":\"Memory Utilization\",\"field\":\"zscaler_zpa.app_connector_status.memory.utilization\",\"size\":1,\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\"},\"schema\":\"metric\",\"type\":\"top_hits\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"\",\"drop_partials\":false,\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"scaleMetricValues\":false,\"timeRange\":{\"from\":\"now-15d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"used_interval\":\"12h\"},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Connector Name\",\"field\":\"zscaler_zpa.app_connector_status.connector.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"_key\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"fittingFunction\":\"linear\",\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":9,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Memory Utilization\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Memory Utilization\"},\"type\":\"value\"}]},\"title\":\"[Zscaler][ZPA] Memory Utilization by Connector over time\",\"type\":\"line\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-f03d3c90-4c5c-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T08:14:55.427Z", - "version": "WzEwMjU4LDFd" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f2e526e0-4c63-11ec-9023-a76a2cb41dcd.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f2e526e0-4c63-11ec-9023-a76a2cb41dcd.json deleted file mode 100755 index a23e6ac8fc..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-f2e526e0-4c63-11ec-9023-a76a2cb41dcd.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.audit\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Distribution of Audit Events by type of Operation", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Audit Operation type\",\"field\":\"zscaler_zpa.audit.operation_type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler][ZPA] Distribution of Audit Events by type of Operation\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-f2e526e0-4c63-11ec-9023-a76a2cb41dcd", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T07:25:49.816Z", - "version": "WzkzNjMsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 1c607b57a9..0000000000 --- a/packages/zscaler_zpa/0.1.0/kibana/visualization/zscaler_zpa-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"zscaler_zpa.audit\\\"\"}}" - }, - "title": "[Zscaler][ZPA] Top 10 Objects on which most operations are performed", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Object Name\",\"field\":\"zscaler_zpa.audit.object.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler][ZPA] Top 10 Objects on which most operations are performed\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zpa-fc5f4ea0-4ebe-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-12-02T07:27:29.190Z", - "version": "Wzk0NjYsMV0=" -} \ No newline at end of file diff --git a/packages/zscaler_zpa/0.1.0/manifest.yml b/packages/zscaler_zpa/0.1.0/manifest.yml deleted file mode 100755 index 8f1a091f11..0000000000 --- a/packages/zscaler_zpa/0.1.0/manifest.yml +++ /dev/null @@ -1,70 +0,0 @@ -format_version: 1.0.0 -name: zscaler_zpa -title: "Zscaler Private Access" -version: 0.1.0 -license: basic -description: Collect logs from Zscaler Private Access (ZPA) with Elastic Agent. -type: integration -categories: - - security -release: beta -conditions: - kibana.version: ^7.16.2 || ^8.0.0 -screenshots: - - src: /img/zscaler-zpa-screenshot.png - title: Zscaler ZPA app connector status dashboard screenshot - size: 600x600 - type: image/png -icons: - - src: /img/zscaler-logo.svg - title: Zscaler logo - size: 32x32 - type: image/svg+xml -policy_templates: - - name: zscaler_zpa - title: Zscaler Private Access logs - description: Collect Zscaler Private Access logs - inputs: - - type: tcp - vars: - - name: listen_address - type: text - title: Listen Address - description: The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces. - multi: false - required: true - show_user: true - default: localhost - - name: ssl - type: yaml - title: SSL Configuration - description: i.e. certificate_authorities, supported_protocols, verification_mode etc. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- - title: Collect Zscaler Private Access logs via TCP input - description: Collecting Zscaler Private Access logs via TCP input -owner: - github: elastic/security-external-integrations