From 449540b35f6be28c04853f3791afb54730d2d819 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Mon, 27 Jun 2022 18:46:20 -0400 Subject: [PATCH] Delete packages from snapshot --- .../carbon_black_cloud/1.0.3/changelog.yml | 36 - .../alert/agent/stream/aws-s3.yml.hbs | 24 - .../alert/agent/stream/httpjson.yml.hbs | 52 - .../elasticsearch/ingest_pipeline/default.yml | 313 --- .../1.0.3/data_stream/alert/fields/agent.yml | 204 -- .../data_stream/alert/fields/base-fields.yml | 20 - .../1.0.3/data_stream/alert/fields/ecs.yml | 124 - .../1.0.3/data_stream/alert/fields/fields.yml | 218 -- .../1.0.3/data_stream/alert/manifest.yml | 95 - .../1.0.3/data_stream/alert/sample_event.json | 114 - .../agent/stream/httpjson.yml.hbs | 45 - .../elasticsearch/ingest_pipeline/default.yml | 132 - .../fields/agent.yml | 204 -- .../fields/base-fields.yml | 20 - .../fields/ecs.yml | 64 - .../fields/fields.yml | 39 - .../asset_vulnerability_summary/manifest.yml | 42 - .../sample_event.json | 76 - .../audit/agent/stream/httpjson.yml.hbs | 32 - .../elasticsearch/ingest_pipeline/default.yml | 93 - .../1.0.3/data_stream/audit/fields/agent.yml | 204 -- .../data_stream/audit/fields/base-fields.yml | 20 - .../1.0.3/data_stream/audit/fields/ecs.yml | 62 - .../1.0.3/data_stream/audit/fields/fields.yml | 9 - .../1.0.3/data_stream/audit/manifest.yml | 42 - .../1.0.3/data_stream/audit/sample_event.json | 63 - .../agent/stream/aws-s3.yml.hbs | 24 - .../elasticsearch/ingest_pipeline/default.yml | 587 ----- .../endpoint_event/fields/agent.yml | 204 -- .../endpoint_event/fields/base-fields.yml | 20 - .../data_stream/endpoint_event/fields/ecs.yml | 200 -- .../endpoint_event/fields/fields.yml | 239 -- .../data_stream/endpoint_event/manifest.yml | 48 - .../endpoint_event/sample_event.json | 96 - .../watchlist_hit/agent/stream/aws-s3.yml.hbs | 24 - .../elasticsearch/ingest_pipeline/default.yml | 293 --- .../watchlist_hit/fields/agent.yml | 204 -- .../watchlist_hit/fields/base-fields.yml | 20 - .../data_stream/watchlist_hit/fields/ecs.yml | 134 -- .../watchlist_hit/fields/fields.yml | 89 - .../data_stream/watchlist_hit/manifest.yml | 48 - .../watchlist_hit/sample_event.json | 130 - .../carbon_black_cloud/1.0.3/docs/README.md | 1047 -------- .../1.0.3/img/carbon_black_cloud-logo.svg | 91 - .../img/carbon_black_cloud-screenshot.png | Bin 83921 -> 0 bytes ...-7e095a40-e325-11ec-8642-e7f3d8b25a9b.json | 158 -- ...-869252c0-8d71-11ec-ac12-4bc77fa14e95.json | 42 - ...-a94cd3a0-962a-11ec-864c-3332b2a355f7.json | 97 - ...-db61a3d0-9534-11ec-8b9d-35e42c3f7fcf.json | 67 - ...-e226d530-9554-11ec-96f0-8de26c63c826.json | 107 - ...-3ea9c2a0-955e-11ec-96f0-8de26c63c826.json | 39 - ...-4272e690-8d71-11ec-ac12-4bc77fa14e95.json | 36 - ...-6494a7e0-9640-11ec-864c-3332b2a355f7.json | 39 - ...-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95.json | 37 - ...-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf.json | 36 - ...-0296fef0-955d-11ec-96f0-8de26c63c826.json | 25 - ...-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95.json | 25 - ...-0f420ad0-8d71-11ec-ac12-4bc77fa14e95.json | 25 - ...-10f699d0-8d8b-11ec-ac12-4bc77fa14e95.json | 25 - ...-11df3480-9630-11ec-864c-3332b2a355f7.json | 25 - ...-17537cc0-955c-11ec-96f0-8de26c63c826.json | 25 - ...-1b554010-8d73-11ec-ac12-4bc77fa14e95.json | 25 - ...-28323940-955d-11ec-96f0-8de26c63c826.json | 25 - ...-2be6ad50-962f-11ec-864c-3332b2a355f7.json | 25 - ...-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-2d324250-963e-11ec-864c-3332b2a355f7.json | 25 - ...-2eafd430-8d83-11ec-ac12-4bc77fa14e95.json | 25 - ...-3aa59c50-955a-11ec-96f0-8de26c63c826.json | 25 - ...-3afe1750-9630-11ec-864c-3332b2a355f7.json | 25 - ...-4dc9e690-955c-11ec-96f0-8de26c63c826.json | 25 - ...-52fde850-8d73-11ec-ac12-4bc77fa14e95.json | 25 - ...-53d65ef0-962f-11ec-864c-3332b2a355f7.json | 25 - ...-56130b90-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-5a5dad90-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-5c122d10-8d83-11ec-ac12-4bc77fa14e95.json | 25 - ...-5c6ce550-8d85-11ec-ac12-4bc77fa14e95.json | 25 - ...-5f690780-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-6496b680-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-68a6c080-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-6efc6240-8d8a-11ec-ac12-4bc77fa14e95.json | 25 - ...-6fcd17f0-955a-11ec-96f0-8de26c63c826.json | 25 - ...-70cdb250-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-71058370-e323-11ec-8642-e7f3d8b25a9b.json | 25 - ...-715f3ec0-955c-11ec-96f0-8de26c63c826.json | 25 - ...-750fefe0-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-76fe1db0-962e-11ec-864c-3332b2a355f7.json | 25 - ...-792a3310-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-7a6261e0-962f-11ec-864c-3332b2a355f7.json | 25 - ...-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-80778dc0-954a-11ec-8b9d-35e42c3f7fcf.json | 25 - ...-89932a20-8d86-11ec-ac12-4bc77fa14e95.json | 25 - ...-8af47260-8d87-11ec-ac12-4bc77fa14e95.json | 25 - ...-906f65c0-8d81-11ec-ac12-4bc77fa14e95.json | 25 - ...-928cff80-8d8a-11ec-ac12-4bc77fa14e95.json | 25 - ...-949c1d00-9628-11ec-864c-3332b2a355f7.json | 25 - ...-97ab53f0-8d84-11ec-ac12-4bc77fa14e95.json | 25 - ...-993b8650-8d83-11ec-ac12-4bc77fa14e95.json | 25 - ...-9a533f40-8d80-11ec-ac12-4bc77fa14e95.json | 25 - ...-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95.json | 25 - ...-a6d2a900-8d70-11ec-ac12-4bc77fa14e95.json | 25 - ...-a7ce1420-9630-11ec-864c-3332b2a355f7.json | 25 - ...-ae34ca40-962e-11ec-864c-3332b2a355f7.json | 25 - ...-bb323db0-955a-11ec-96f0-8de26c63c826.json | 25 - ...-c3786990-9555-11ec-96f0-8de26c63c826.json | 25 - ...-c6cfa8d0-962f-11ec-864c-3332b2a355f7.json | 25 - ...-cb70a610-955c-11ec-96f0-8de26c63c826.json | 25 - ...-cc2d3630-8d83-11ec-ac12-4bc77fa14e95.json | 25 - ...-d33296f0-8d79-11ec-ac12-4bc77fa14e95.json | 25 - ...-d49a3710-8d96-11ec-ac12-4bc77fa14e95.json | 25 - ...-de59dff0-955a-11ec-96f0-8de26c63c826.json | 25 - ...-ee2098d0-8d70-11ec-ac12-4bc77fa14e95.json | 25 - ...-ee670e50-8d89-11ec-ac12-4bc77fa14e95.json | 25 - ...-ee77a260-8d84-11ec-ac12-4bc77fa14e95.json | 25 - ...-f28910d0-9628-11ec-864c-3332b2a355f7.json | 25 - ...-f3f635b0-8d72-11ec-ac12-4bc77fa14e95.json | 25 - ...-f75eabb0-8d8b-11ec-ac12-4bc77fa14e95.json | 25 - ...-f7681be0-962e-11ec-864c-3332b2a355f7.json | 25 - ...-f93958c0-8d83-11ec-ac12-4bc77fa14e95.json | 25 - ...-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95.json | 25 - .../carbon_black_cloud/1.0.3/manifest.yml | 136 -- packages/cef/2.0.3/changelog.yml | 129 - .../data_stream/log/agent/stream/log.yml.hbs | 27 - .../data_stream/log/agent/stream/udp.yml.hbs | 23 - .../ingest_pipeline/cp-pipeline.yml | 380 --- .../elasticsearch/ingest_pipeline/default.yml | 177 -- .../ingest_pipeline/fp-pipeline.yml | 27 - .../2.0.3/data_stream/log/fields/agent.yml | 207 -- .../data_stream/log/fields/base-fields.yml | 20 - .../cef/2.0.3/data_stream/log/fields/ecs.yml | 380 --- .../2.0.3/data_stream/log/fields/fields.yml | 608 ----- .../cef/2.0.3/data_stream/log/manifest.yml | 104 - .../2.0.3/data_stream/log/sample_event.json | 122 - packages/cef/2.0.3/docs/README.md | 617 ----- ...-56428e01-0c47-4770-8ba4-9345a029ea41.json | 93 - ...-9e352900-89c3-4c1b-863e-249e24d0dac9.json | 109 - ...-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b.json | 98 - ...-db1e1aca-279e-4ecc-b84e-fe58644f7619.json | 89 - ...-dd0bc9af-2e89-4150-9b42-62517ea56b71.json | 113 - ...-5cede2d3-20fe-4140-add4-4c4f841b71a2.json | 39 - ...-68202a5c-c8f2-432f-8c08-04fbfacb95c8.json | 52 - ...-e6cf2383-71f4-4db1-a791-1a7d4f110194.json | 44 - ...-f85a3444-8a43-4e46-b872-4e44bc25d0f3.json | 55 - ...-013ff153-7b80-490b-8fec-6e56cba785ed.json | 26 - ...-01c3618c-9962-4fe9-b9c5-f73dfecc6eba.json | 26 - ...-0abfc226-535b-45a2-b534-e9bc87e5584f.json | 19 - ...-0f4028b2-3dc2-4cb6-80d8-285c847a02a1.json | 19 - ...-118af639-1f37-4541-a960-5a3ff0613e0e.json | 26 - ...-1204cf27-05e0-4905-bfa1-688aaaaaa840.json | 26 - ...-158d809a-89db-4ffa-88a1-eb5c4bf58d50.json | 26 - ...-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0.json | 19 - ...-1b521f56-8089-433f-88f7-56aba867e07d.json | 28 - ...-1b9cc5b7-7747-49de-96b1-a4bc7f675716.json | 26 - ...-249e2737-b41f-4115-b303-88bc9d279655.json | 26 - ...-26a65f68-d7a6-4b47-befc-c5a6819bb91b.json | 26 - ...-2726382e-638a-4dcc-94fc-0ffdc0f92048.json | 26 - ...-295986d4-d2ea-4541-8e82-7dc95c0cd830.json | 26 - ...-316fdc75-7215-4c6b-8e1b-70a097b34e28.json | 26 - ...-33747d52-ec4c-4d91-86d8-fbdf9b9c82db.json | 19 - ...-3c19f138-2ab3-4ecb-bb1b-86fb90158042.json | 26 - ...-499f50ba-2f84-4f7c-9021-73a4efc47921.json | 19 - ...-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf.json | 26 - ...-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956.json | 26 - ...-4fccee0c-7193-4aa8-919f-0b0b0a16d013.json | 28 - ...-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110.json | 26 - ...-581a296e-e34a-48f1-93e4-fc4bdadfc68d.json | 28 - ...-589fec8c-336e-4122-8fef-a450bddf84f6.json | 26 - ...-59ad829b-12b8-4256-95a5-e7078eda628b.json | 26 - ...-5bf6e4dc-4273-4e1e-a803-04347eebeb53.json | 26 - ...-5f187dc8-aa7e-4f91-a2d8-1186ce254d00.json | 26 - ...-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409.json | 26 - ...-677891a1-90c4-4273-b126-f0e54689bd76.json | 19 - ...-718b074e-3dd1-4d03-ba11-7f869cdcd703.json | 19 - ...-7454c034-c5f3-48fe-8fce-ef4385c80350.json | 26 - ...-74d2c072-6dfd-4249-8e63-dc7b0cf3c960.json | 26 - ...-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3.json | 26 - ...-76c088c3-486e-4420-8840-5ede667edffe.json | 19 - ...-77ee0e91-010b-4897-b483-7e9a907d2afe.json | 26 - ...-7e2b0659-0760-4182-8b29-3ee69f26bc6f.json | 19 - ...-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1.json | 26 - ...-86bd5f13-ca6b-43fa-b209-54e7460344bb.json | 26 - ...-89998099-9a39-44cf-beba-5b97f0524cf9.json | 26 - ...-8b31af8b-522e-41fe-b9d6-9a3451b54108.json | 28 - ...-8cd00d20-957d-4663-be4d-ea80b1609586.json | 26 - ...-8f6075c5-f525-4173-92a4-3a56e96e362d.json | 26 - ...-92aecea0-a632-4a55-bb56-50e4cdaca036.json | 26 - ...-9457ee67-895f-4b78-a543-268f9687a745.json | 19 - ...-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d.json | 19 - ...-a729c249-8d34-4eb1-bbb0-5d25cf224114.json | 26 - ...-a97e3628-022b-46cf-8f29-a73cf9bb4e26.json | 19 - ...-aaa80503-6d96-4a33-806f-b8a10aefe696.json | 25 - ...-acc915fe-b971-4795-9040-3fbfdf62abe1.json | 26 - ...-b1002b5c-08fc-4bbe-b9a0-6243a8637e60.json | 26 - ...-c394e650-b16c-407c-b305-bd409d69d433.json | 19 - ...-c5120e27-1f8c-41e3-83ee-78ec4d470c2f.json | 26 - ...-d02dd523-ce91-40e9-9209-83797f80ed45.json | 19 - ...-d061c7a9-7f92-4bf4-b35c-499b9f4b987a.json | 26 - ...-df056709-2deb-4363-ae7a-b0148ea456c6.json | 26 - ...-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9.json | 26 - ...-e513c269-350c-40c3-ac20-16c5782103b8.json | 19 - ...-e89a64e8-928c-41fc-8745-3c8157b21cdb.json | 26 - ...-f03d734b-b85c-4e99-9c0e-9c89716a81f3.json | 26 - ...-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d.json | 19 - ...-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0.json | 19 - ...-f5258de9-71f7-410f-b713-201007f77470.json | 26 - ...-f57734dd-0f32-42b4-94dd-5d597f6735e1.json | 26 - ...-fa8b26c1-6973-4381-adb3-bcde0d03a520.json | 26 - ...-fcf798a8-db8f-4492-827b-8fa7581108a9.json | 26 - ...-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60.json | 26 - ...-fff249b2-18b6-4b48-bcf7-dd4595d111e7.json | 26 - packages/cef/2.0.3/manifest.yml | 26 - packages/checkpoint/1.5.1/changelog.yml | 126 - .../firewall/agent/stream/log.yml.hbs | 38 - .../firewall/agent/stream/tcp.yml.hbs | 40 - .../firewall/agent/stream/udp.yml.hbs | 34 - .../elasticsearch/ingest_pipeline/default.yml | 835 ------- .../data_stream/firewall/fields/agent.yml | 180 -- .../firewall/fields/base-fields.yml | 20 - .../data_stream/firewall/fields/beats.yml | 15 - .../1.5.1/data_stream/firewall/fields/ecs.yml | 522 ---- .../data_stream/firewall/fields/fields.yml | 1626 ------------- .../1.5.1/data_stream/firewall/manifest.yml | 133 -- .../data_stream/firewall/sample_event.json | 64 - packages/checkpoint/1.5.1/docs/README.md | 671 ------ .../checkpoint/1.5.1/img/checkpoint-logo.svg | 159 -- packages/checkpoint/1.5.1/manifest.yml | 109 - packages/cisco_asa/2.4.2/changelog.yml | 110 - .../log/agent/stream/stream.yml.hbs | 20 - .../data_stream/log/agent/stream/tcp.yml.hbs | 22 - .../data_stream/log/agent/stream/udp.yml.hbs | 16 - .../elasticsearch/ingest_pipeline/default.yml | 2124 ----------------- .../2.4.2/data_stream/log/fields/agent.yml | 207 -- .../data_stream/log/fields/base-fields.yml | 20 - .../2.4.2/data_stream/log/fields/ecs.yml | 517 ---- .../2.4.2/data_stream/log/fields/fields.yml | 209 -- .../2.4.2/data_stream/log/manifest.yml | 175 -- .../2.4.2/data_stream/log/sample_event.json | 107 - packages/cisco_asa/2.4.2/docs/README.md | 332 --- packages/cisco_asa/2.4.2/img/cisco.svg | 1 - .../cisco_asa/2.4.2/img/kibana-cisco-asa.png | Bin 813426 -> 0 bytes ...-a555b160-4987-11e9-b8ce-ed898b5ef295.json | 53 - ...-14fce5e0-498f-11e9-b8ce-ed898b5ef295.json | 29 - ...-753406e0-4986-11e9-b8ce-ed898b5ef295.json | 29 - ...-96c6ff60-4986-11e9-b8ce-ed898b5ef295.json | 29 - ...-08ef4d90-499b-11e9-b8ce-ed898b5ef295.json | 22 - ...-118da960-4987-11e9-b8ce-ed898b5ef295.json | 22 - ...-5d0322d0-4987-11e9-b8ce-ed898b5ef295.json | 22 - ...-80d0c1b0-498a-11e9-b8ce-ed898b5ef295.json | 22 - ...-a3b5ab10-4989-11e9-b8ce-ed898b5ef295.json | 22 - ...-d05cdf60-498b-11e9-b8ce-ed898b5ef295.json | 22 - ...-fd89b1e0-49a2-11e9-b8ce-ed898b5ef295.json | 22 - packages/cisco_asa/2.4.2/manifest.yml | 39 - packages/cisco_ftd/2.2.2/changelog.yml | 97 - .../log/agent/stream/stream.yml.hbs | 20 - .../data_stream/log/agent/stream/tcp.yml.hbs | 22 - .../data_stream/log/agent/stream/udp.yml.hbs | 16 - .../elasticsearch/ingest_pipeline/default.yml | 1988 --------------- .../2.2.2/data_stream/log/fields/agent.yml | 207 -- .../data_stream/log/fields/base-fields.yml | 20 - .../2.2.2/data_stream/log/fields/ecs.yml | 582 ----- .../2.2.2/data_stream/log/fields/fields.yml | 149 -- .../2.2.2/data_stream/log/manifest.yml | 172 -- .../2.2.2/data_stream/log/sample_event.json | 156 -- packages/cisco_ftd/2.2.2/docs/README.md | 397 --- packages/cisco_ftd/2.2.2/img/cisco.svg | 1 - packages/cisco_ftd/2.2.2/manifest.yml | 34 - packages/gcp/1.9.2/changelog.yml | 152 -- .../audit/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 397 --- .../1.9.2/data_stream/audit/fields/agent.yml | 199 -- .../data_stream/audit/fields/base-fields.yml | 20 - .../1.9.2/data_stream/audit/fields/ecs.yml | 202 -- .../1.9.2/data_stream/audit/fields/fields.yml | 115 - .../audit/fields/package-fields.yml | 63 - .../gcp/1.9.2/data_stream/audit/manifest.yml | 58 - .../1.9.2/data_stream/audit/sample_event.json | 130 - .../dns/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 243 -- .../1.9.2/data_stream/dns/fields/agent.yml | 204 -- .../data_stream/dns/fields/base-fields.yml | 20 - .../gcp/1.9.2/data_stream/dns/fields/ecs.yml | 126 - .../1.9.2/data_stream/dns/fields/fields.yml | 48 - .../gcp/1.9.2/data_stream/dns/manifest.yml | 58 - .../1.9.2/data_stream/dns/sample_event.json | 100 - .../firewall/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 410 ---- .../data_stream/firewall/fields/agent.yml | 199 -- .../firewall/fields/base-fields.yml | 20 - .../1.9.2/data_stream/firewall/fields/ecs.yml | 240 -- .../data_stream/firewall/fields/fields.yml | 44 - .../firewall/fields/package-fields.yml | 63 - .../1.9.2/data_stream/firewall/manifest.yml | 58 - .../data_stream/firewall/sample_event.json | 120 - .../vpcflow/agent/stream/gcp-pubsub.yml.hbs | 27 - .../elasticsearch/ingest_pipeline/default.yml | 371 --- .../data_stream/vpcflow/fields/agent.yml | 199 -- .../vpcflow/fields/base-fields.yml | 20 - .../1.9.2/data_stream/vpcflow/fields/ecs.yml | 262 -- .../data_stream/vpcflow/fields/fields.yml | 11 - .../vpcflow/fields/package-fields.yml | 63 - .../1.9.2/data_stream/vpcflow/manifest.yml | 58 - .../data_stream/vpcflow/sample_event.json | 128 - packages/gcp/1.9.2/docs/README.md | 1157 --------- packages/gcp/1.9.2/docs/audit.md | 277 --- packages/gcp/1.9.2/docs/dns.md | 196 -- packages/gcp/1.9.2/docs/firewall.md | 253 -- packages/gcp/1.9.2/docs/vpcflow.md | 258 -- packages/gcp/1.9.2/img/filebeat-gcp-audit.png | Bin 507414 -> 0 bytes packages/gcp/1.9.2/img/logo_gcp.svg | 19 - ...-48e12760-cbe4-11ec-b519-85ccf621cbbf.json | 67 - ...-8a1fb690-cbeb-11ec-b519-85ccf621cbbf.json | 152 -- ...-9484a4cd-685f-450e-aeaa-728fbdbea20f.json | 152 -- ...-d88364c0-73a1-11ea-a345-f985c61fe654.json | 39 - ...-e1a359e5-543d-44c2-ab81-628138719e28.json | 11 - packages/gcp/1.9.2/manifest.yml | 64 - packages/github/1.0.2/changelog.yml | 71 - .../audit/agent/stream/httpjson.yml.hbs | 69 - .../elasticsearch/ingest_pipeline/default.yml | 155 -- .../1.0.2/data_stream/audit/fields/agent.yml | 114 - .../data_stream/audit/fields/base-fields.yml | 23 - .../1.0.2/data_stream/audit/fields/ecs.yml | 95 - .../1.0.2/data_stream/audit/fields/fields.yml | 17 - .../1.0.2/data_stream/audit/manifest.yml | 91 - .../1.0.2/data_stream/audit/sample_event.json | 64 - packages/github/1.0.2/docs/README.md | 137 -- .../1.0.2/img/github-audit-dashboard.png | Bin 481911 -> 0 bytes .../1.0.2/img/github-user-dashboard.png | Bin 331861 -> 0 bytes packages/github/1.0.2/img/github.svg | 3 - ...-8bfd8310-205c-11ec-8b10-11a4c5e322a0.json | 42 - ...-dcee84c0-2059-11ec-8b10-11a4c5e322a0.json | 62 - ...-871e5750-205e-11ec-8b10-11a4c5e322a0.json | 22 - ...-173f1050-20ae-11ec-8b10-11a4c5e322a0.json | 46 - ...-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0.json | 36 - ...-61f60d00-20b4-11ec-8b10-11a4c5e322a0.json | 26 - ...-78ec0aa0-20b4-11ec-8b10-11a4c5e322a0.json | 26 - ...-7b073f90-205e-11ec-8b10-11a4c5e322a0.json | 50 - ...-9638a6e0-20b4-11ec-8b10-11a4c5e322a0.json | 26 - ...-97737b60-20b5-11ec-8b10-11a4c5e322a0.json | 26 - ...-b50c62e0-20b5-11ec-8b10-11a4c5e322a0.json | 26 - ...-ba0ece10-20b3-11ec-8b10-11a4c5e322a0.json | 26 - ...-c803b110-20b4-11ec-8b10-11a4c5e322a0.json | 26 - ...-d7343340-20b3-11ec-8b10-11a4c5e322a0.json | 26 - packages/github/1.0.2/manifest.yml | 35 - packages/httpjson/1.2.4/changelog.yml | 40 - .../generic/agent/stream/httpjson.yml.hbs | 151 -- .../generic/fields/base-fields.yml | 20 - .../data_stream/generic/fields/beats.yml | 6 - .../1.2.4/data_stream/generic/fields/ecs.yml | 18 - .../1.2.4/data_stream/generic/manifest.yml | 340 --- .../data_stream/generic/sample_event.json | 36 - packages/httpjson/1.2.4/docs/README.md | 20 - packages/httpjson/1.2.4/manifest.yml | 22 - packages/o365/1.6.0/changelog.yml | 157 -- .../audit/agent/stream/o365audit.yml.hbs | 39 - .../elasticsearch/ingest_pipeline/default.yml | 1108 --------- .../1.6.0/data_stream/audit/fields/agent.yml | 198 -- .../data_stream/audit/fields/base-fields.yml | 20 - .../1.6.0/data_stream/audit/fields/beats.yml | 12 - .../1.6.0/data_stream/audit/fields/ecs.yml | 338 --- .../1.6.0/data_stream/audit/fields/fields.yml | 201 -- .../o365/1.6.0/data_stream/audit/manifest.yml | 103 - .../1.6.0/data_stream/audit/sample_event.json | 111 - packages/o365/1.6.0/docs/README.md | 374 --- .../o365/1.6.0/img/filebeat-o365-audit.png | Bin 432036 -> 0 bytes .../img/filebeat-o365-azure-permissions.png | Bin 301548 -> 0 bytes .../img/logo-integrations-microsoft-365.svg | 16 - ...-712e2c00-685d-11ea-8d6a-292ef5d68366.json | 54 - ...-dbae13c0-685c-11ea-8d6a-292ef5d68366.json | 24 - ...-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json | 56 - ...-fdc14020-6859-11ea-8d6a-292ef5d68366.json | 35 - ...-0be1adb0-6860-11ea-8d6a-292ef5d68366.json | 28 - ...-897d0c70-6869-11ea-8d6a-292ef5d68366.json | 33 - ...-8b033510-685a-11ea-8d6a-292ef5d68366.json | 28 - ...-d43c95a0-6864-11ea-8d6a-292ef5d68366.json | 28 - packages/o365/1.6.0/manifest.yml | 35 - packages/snyk/1.2.1/changelog.yml | 31 - .../audit/agent/stream/httpjson.yml.hbs | 63 - .../elasticsearch/ingest_pipeline/default.yml | 87 - .../1.2.1/data_stream/audit/fields/agent.yml | 114 - .../data_stream/audit/fields/base-fields.yml | 20 - .../1.2.1/data_stream/audit/fields/beats.yml | 12 - .../1.2.1/data_stream/audit/fields/ecs.yml | 34 - .../1.2.1/data_stream/audit/fields/fields.yml | 21 - .../audit/fields/package-fields.yml | 17 - .../snyk/1.2.1/data_stream/audit/manifest.yml | 97 - .../1.2.1/data_stream/audit/sample_event.json | 57 - .../agent/stream/httpjson.yml.hbs | 92 - .../elasticsearch/ingest_pipeline/default.yml | 200 -- .../vulnerabilities/fields/agent.yml | 114 - .../vulnerabilities/fields/base-fields.yml | 20 - .../vulnerabilities/fields/beats.yml | 12 - .../vulnerabilities/fields/ecs.yml | 67 - .../vulnerabilities/fields/fields.yml | 146 -- .../vulnerabilities/fields/package-fields.yml | 17 - .../data_stream/vulnerabilities/manifest.yml | 200 -- .../vulnerabilities/sample_event.json | 141 -- packages/snyk/1.2.1/docs/README.md | 346 --- packages/snyk/1.2.1/img/snyk-logo.svg | 1 - packages/snyk/1.2.1/manifest.yml | 62 - packages/tenable_sc/1.2.1/changelog.yml | 36 - .../asset/agent/stream/httpjson.yml.hbs | 83 - .../elasticsearch/ingest_pipeline/default.yml | 245 -- .../1.2.1/data_stream/asset/fields/agent.yml | 204 -- .../data_stream/asset/fields/base-fields.yml | 20 - .../1.2.1/data_stream/asset/fields/ecs.yml | 39 - .../1.2.1/data_stream/asset/fields/fields.yml | 121 - .../1.2.1/data_stream/asset/manifest.yml | 34 - .../1.2.1/data_stream/asset/sample_event.json | 103 - .../plugin/agent/stream/httpjson.yml.hbs | 75 - .../elasticsearch/ingest_pipeline/default.yml | 339 --- .../1.2.1/data_stream/plugin/fields/agent.yml | 204 -- .../data_stream/plugin/fields/base-fields.yml | 20 - .../1.2.1/data_stream/plugin/fields/ecs.yml | 27 - .../data_stream/plugin/fields/fields.yml | 212 -- .../1.2.1/data_stream/plugin/manifest.yml | 34 - .../data_stream/plugin/sample_event.json | 148 -- .../agent/stream/httpjson.yml.hbs | 89 - .../elasticsearch/ingest_pipeline/default.yml | 505 ---- .../vulnerability/fields/agent.yml | 204 -- .../vulnerability/fields/base-fields.yml | 20 - .../data_stream/vulnerability/fields/ecs.yml | 86 - .../vulnerability/fields/fields.yml | 258 -- .../data_stream/vulnerability/manifest.yml | 34 - .../vulnerability/sample_event.json | 207 -- packages/tenable_sc/1.2.1/docs/README.md | 811 ------- .../tenable_sc/1.2.1/img/tenable_sc-logo.svg | 87 - .../1.2.1/img/tenable_sc-screenshot.png | Bin 68096 -> 0 bytes ...-726dfad0-2c0d-11ec-b3e0-f3fd7c471f4b.json | 54 - ...-b9b277f0-2c11-11ec-b3e0-f3fd7c471f4b.json | 67 - ...-d340bc30-30bd-11ec-b7d2-eba3454d2335.json | 49 - ...-e23be000-8970-11ec-a56b-9fd8deec1ba2.json | 38 - ...-12120d60-2c0e-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-20a11b40-2c14-11ec-b3e0-f3fd7c471f4b.json | 32 - ...-2b883920-88c7-11ec-a56b-9fd8deec1ba2.json | 25 - ...-578e2360-2c0e-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-5bc40b40-2c16-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-5de3dfd0-30bd-11ec-b7d2-eba3454d2335.json | 27 - ...-68ce24a0-2c0d-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-773a1570-323a-11ec-b7d2-eba3454d2335.json | 27 - ...-7a7c8900-2c15-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-8b4a4cd0-30bc-11ec-b7d2-eba3454d2335.json | 27 - ...-8dd5b500-2c0e-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-8f3552c0-2c13-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-b1c8bb30-30bc-11ec-b7d2-eba3454d2335.json | 27 - ...-c16a8ae0-30bd-11ec-b7d2-eba3454d2335.json | 27 - ...-c7547240-2c0d-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-d27cc590-88c5-11ec-a56b-9fd8deec1ba2.json | 25 - ...-d4fe2930-2c13-11ec-b3e0-f3fd7c471f4b.json | 32 - ...-dc64f5b0-2ccb-11ec-af51-75b163cdcc43.json | 32 - ...-eccc5090-2cd2-11ec-af51-75b163cdcc43.json | 32 - packages/tenable_sc/1.2.1/manifest.yml | 110 - packages/tenable_sc/1.2.2/changelog.yml | 41 - .../asset/agent/stream/httpjson.yml.hbs | 83 - .../elasticsearch/ingest_pipeline/default.yml | 245 -- .../1.2.2/data_stream/asset/fields/agent.yml | 204 -- .../data_stream/asset/fields/base-fields.yml | 20 - .../1.2.2/data_stream/asset/fields/ecs.yml | 39 - .../1.2.2/data_stream/asset/fields/fields.yml | 121 - .../1.2.2/data_stream/asset/manifest.yml | 34 - .../1.2.2/data_stream/asset/sample_event.json | 103 - .../plugin/agent/stream/httpjson.yml.hbs | 75 - .../elasticsearch/ingest_pipeline/default.yml | 339 --- .../1.2.2/data_stream/plugin/fields/agent.yml | 204 -- .../data_stream/plugin/fields/base-fields.yml | 20 - .../1.2.2/data_stream/plugin/fields/ecs.yml | 27 - .../data_stream/plugin/fields/fields.yml | 212 -- .../1.2.2/data_stream/plugin/manifest.yml | 34 - .../data_stream/plugin/sample_event.json | 148 -- .../agent/stream/httpjson.yml.hbs | 89 - .../elasticsearch/ingest_pipeline/default.yml | 505 ---- .../vulnerability/fields/agent.yml | 204 -- .../vulnerability/fields/base-fields.yml | 20 - .../data_stream/vulnerability/fields/ecs.yml | 86 - .../vulnerability/fields/fields.yml | 258 -- .../data_stream/vulnerability/manifest.yml | 34 - .../vulnerability/sample_event.json | 207 -- packages/tenable_sc/1.2.2/docs/README.md | 807 ------- .../tenable_sc/1.2.2/img/tenable_sc-logo.svg | 87 - .../1.2.2/img/tenable_sc-screenshot.png | Bin 68096 -> 0 bytes ...-726dfad0-2c0d-11ec-b3e0-f3fd7c471f4b.json | 54 - ...-b9b277f0-2c11-11ec-b3e0-f3fd7c471f4b.json | 67 - ...-d340bc30-30bd-11ec-b7d2-eba3454d2335.json | 49 - ...-e23be000-8970-11ec-a56b-9fd8deec1ba2.json | 38 - ...-12120d60-2c0e-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-20a11b40-2c14-11ec-b3e0-f3fd7c471f4b.json | 32 - ...-2b883920-88c7-11ec-a56b-9fd8deec1ba2.json | 25 - ...-578e2360-2c0e-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-5bc40b40-2c16-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-5de3dfd0-30bd-11ec-b7d2-eba3454d2335.json | 27 - ...-68ce24a0-2c0d-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-773a1570-323a-11ec-b7d2-eba3454d2335.json | 27 - ...-7a7c8900-2c15-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-8b4a4cd0-30bc-11ec-b7d2-eba3454d2335.json | 27 - ...-8dd5b500-2c0e-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-8f3552c0-2c13-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-b1c8bb30-30bc-11ec-b7d2-eba3454d2335.json | 27 - ...-c16a8ae0-30bd-11ec-b7d2-eba3454d2335.json | 27 - ...-c7547240-2c0d-11ec-b3e0-f3fd7c471f4b.json | 27 - ...-d27cc590-88c5-11ec-a56b-9fd8deec1ba2.json | 25 - ...-d4fe2930-2c13-11ec-b3e0-f3fd7c471f4b.json | 32 - ...-dc64f5b0-2ccb-11ec-af51-75b163cdcc43.json | 32 - ...-eccc5090-2cd2-11ec-af51-75b163cdcc43.json | 32 - packages/tenable_sc/1.2.2/manifest.yml | 110 - packages/winlog/1.5.2/changelog.yml | 102 - .../winlog/agent/stream/httpjson.yml.hbs | 103 - .../winlog/agent/stream/winlog.yml.hbs | 23 - .../data_stream/winlog/fields/base-fields.yml | 20 - .../1.5.2/data_stream/winlog/fields/beats.yml | 6 - .../1.5.2/data_stream/winlog/fields/ecs.yml | 24 - .../data_stream/winlog/fields/winlog.yml | 612 ----- .../1.5.2/data_stream/winlog/manifest.yml | 109 - packages/winlog/1.5.2/docs/README.md | 284 --- packages/winlog/1.5.2/img/logo_windows.svg | 3 - packages/winlog/1.5.2/manifest.yml | 85 - 514 files changed, 51731 deletions(-) delete mode 100755 packages/carbon_black_cloud/1.0.3/changelog.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/aws-s3.yml.hbs delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/httpjson.yml.hbs delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/agent.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/base-fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/ecs.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/manifest.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/alert/sample_event.json delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/agent/stream/httpjson.yml.hbs delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/agent.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/base-fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/ecs.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/manifest.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/sample_event.json delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/agent/stream/httpjson.yml.hbs delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/agent.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/ecs.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/manifest.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/audit/sample_event.json delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/agent/stream/aws-s3.yml.hbs delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/agent.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/base-fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/ecs.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/manifest.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/sample_event.json delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/agent/stream/aws-s3.yml.hbs delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/agent.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/base-fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/ecs.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/fields.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/manifest.yml delete mode 100755 packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/sample_event.json delete mode 100755 packages/carbon_black_cloud/1.0.3/docs/README.md delete mode 100755 packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-logo.svg delete mode 100755 packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-screenshot.png delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-7e095a40-e325-11ec-8642-e7f3d8b25a9b.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-869252c0-8d71-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-a94cd3a0-962a-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-db61a3d0-9534-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-e226d530-9554-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-3ea9c2a0-955e-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-4272e690-8d71-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6494a7e0-9640-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0296fef0-955d-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0f420ad0-8d71-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-10f699d0-8d8b-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-11df3480-9630-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-17537cc0-955c-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-1b554010-8d73-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-28323940-955d-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2be6ad50-962f-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d324250-963e-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2eafd430-8d83-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3aa59c50-955a-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3afe1750-9630-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-4dc9e690-955c-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-52fde850-8d73-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-53d65ef0-962f-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-56130b90-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5a5dad90-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c122d10-8d83-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c6ce550-8d85-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5f690780-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6496b680-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-68a6c080-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6efc6240-8d8a-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6fcd17f0-955a-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-70cdb250-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-71058370-e323-11ec-8642-e7f3d8b25a9b.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-715f3ec0-955c-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-750fefe0-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-76fe1db0-962e-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-792a3310-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7a6261e0-962f-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-80778dc0-954a-11ec-8b9d-35e42c3f7fcf.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-89932a20-8d86-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-8af47260-8d87-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-906f65c0-8d81-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-928cff80-8d8a-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-949c1d00-9628-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-97ab53f0-8d84-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-993b8650-8d83-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-9a533f40-8d80-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a6d2a900-8d70-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a7ce1420-9630-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ae34ca40-962e-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-bb323db0-955a-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c3786990-9555-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c6cfa8d0-962f-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cb70a610-955c-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cc2d3630-8d83-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d33296f0-8d79-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d49a3710-8d96-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-de59dff0-955a-11ec-96f0-8de26c63c826.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee2098d0-8d70-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee670e50-8d89-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee77a260-8d84-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f28910d0-9628-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f3f635b0-8d72-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f75eabb0-8d8b-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f7681be0-962e-11ec-864c-3332b2a355f7.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f93958c0-8d83-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95.json delete mode 100755 packages/carbon_black_cloud/1.0.3/manifest.yml delete mode 100755 packages/cef/2.0.3/changelog.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/agent/stream/log.yml.hbs delete mode 100755 packages/cef/2.0.3/data_stream/log/agent/stream/udp.yml.hbs delete mode 100755 packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/cp-pipeline.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/fp-pipeline.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/fields/agent.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/fields/base-fields.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/fields/ecs.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/fields/fields.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/manifest.yml delete mode 100755 packages/cef/2.0.3/data_stream/log/sample_event.json delete mode 100755 packages/cef/2.0.3/docs/README.md delete mode 100755 packages/cef/2.0.3/kibana/dashboard/cef-56428e01-0c47-4770-8ba4-9345a029ea41.json delete mode 100755 packages/cef/2.0.3/kibana/dashboard/cef-9e352900-89c3-4c1b-863e-249e24d0dac9.json delete mode 100755 packages/cef/2.0.3/kibana/dashboard/cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b.json delete mode 100755 packages/cef/2.0.3/kibana/dashboard/cef-db1e1aca-279e-4ecc-b84e-fe58644f7619.json delete mode 100755 packages/cef/2.0.3/kibana/dashboard/cef-dd0bc9af-2e89-4150-9b42-62517ea56b71.json delete mode 100755 packages/cef/2.0.3/kibana/search/cef-5cede2d3-20fe-4140-add4-4c4f841b71a2.json delete mode 100755 packages/cef/2.0.3/kibana/search/cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8.json delete mode 100755 packages/cef/2.0.3/kibana/search/cef-e6cf2383-71f4-4db1-a791-1a7d4f110194.json delete mode 100755 packages/cef/2.0.3/kibana/search/cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-013ff153-7b80-490b-8fec-6e56cba785ed.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-01c3618c-9962-4fe9-b9c5-f73dfecc6eba.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-0abfc226-535b-45a2-b534-e9bc87e5584f.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-0f4028b2-3dc2-4cb6-80d8-285c847a02a1.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-118af639-1f37-4541-a960-5a3ff0613e0e.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-1204cf27-05e0-4905-bfa1-688aaaaaa840.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-158d809a-89db-4ffa-88a1-eb5c4bf58d50.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-1b521f56-8089-433f-88f7-56aba867e07d.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-1b9cc5b7-7747-49de-96b1-a4bc7f675716.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-249e2737-b41f-4115-b303-88bc9d279655.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-26a65f68-d7a6-4b47-befc-c5a6819bb91b.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-2726382e-638a-4dcc-94fc-0ffdc0f92048.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-295986d4-d2ea-4541-8e82-7dc95c0cd830.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-316fdc75-7215-4c6b-8e1b-70a097b34e28.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-3c19f138-2ab3-4ecb-bb1b-86fb90158042.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-499f50ba-2f84-4f7c-9021-73a4efc47921.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-4fccee0c-7193-4aa8-919f-0b0b0a16d013.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-581a296e-e34a-48f1-93e4-fc4bdadfc68d.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-589fec8c-336e-4122-8fef-a450bddf84f6.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-59ad829b-12b8-4256-95a5-e7078eda628b.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-5bf6e4dc-4273-4e1e-a803-04347eebeb53.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-5f187dc8-aa7e-4f91-a2d8-1186ce254d00.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-677891a1-90c4-4273-b126-f0e54689bd76.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-718b074e-3dd1-4d03-ba11-7f869cdcd703.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-7454c034-c5f3-48fe-8fce-ef4385c80350.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-74d2c072-6dfd-4249-8e63-dc7b0cf3c960.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-76c088c3-486e-4420-8840-5ede667edffe.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-77ee0e91-010b-4897-b483-7e9a907d2afe.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-7e2b0659-0760-4182-8b29-3ee69f26bc6f.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-86bd5f13-ca6b-43fa-b209-54e7460344bb.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-89998099-9a39-44cf-beba-5b97f0524cf9.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-8b31af8b-522e-41fe-b9d6-9a3451b54108.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-8cd00d20-957d-4663-be4d-ea80b1609586.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-8f6075c5-f525-4173-92a4-3a56e96e362d.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-92aecea0-a632-4a55-bb56-50e4cdaca036.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-9457ee67-895f-4b78-a543-268f9687a745.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-a729c249-8d34-4eb1-bbb0-5d25cf224114.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-a97e3628-022b-46cf-8f29-a73cf9bb4e26.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-aaa80503-6d96-4a33-806f-b8a10aefe696.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-acc915fe-b971-4795-9040-3fbfdf62abe1.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-b1002b5c-08fc-4bbe-b9a0-6243a8637e60.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-c394e650-b16c-407c-b305-bd409d69d433.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-c5120e27-1f8c-41e3-83ee-78ec4d470c2f.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-d02dd523-ce91-40e9-9209-83797f80ed45.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-d061c7a9-7f92-4bf4-b35c-499b9f4b987a.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-df056709-2deb-4363-ae7a-b0148ea456c6.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-e513c269-350c-40c3-ac20-16c5782103b8.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-e89a64e8-928c-41fc-8745-3c8157b21cdb.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-f03d734b-b85c-4e99-9c0e-9c89716a81f3.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-f5258de9-71f7-410f-b713-201007f77470.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-f57734dd-0f32-42b4-94dd-5d597f6735e1.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-fa8b26c1-6973-4381-adb3-bcde0d03a520.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-fcf798a8-db8f-4492-827b-8fa7581108a9.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60.json delete mode 100755 packages/cef/2.0.3/kibana/visualization/cef-fff249b2-18b6-4b48-bcf7-dd4595d111e7.json delete mode 100755 packages/cef/2.0.3/manifest.yml delete mode 100755 packages/checkpoint/1.5.1/changelog.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/log.yml.hbs delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/tcp.yml.hbs delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/udp.yml.hbs delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/fields/agent.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/fields/base-fields.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/fields/beats.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/fields/ecs.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/fields/fields.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/manifest.yml delete mode 100755 packages/checkpoint/1.5.1/data_stream/firewall/sample_event.json delete mode 100755 packages/checkpoint/1.5.1/docs/README.md delete mode 100755 packages/checkpoint/1.5.1/img/checkpoint-logo.svg delete mode 100755 packages/checkpoint/1.5.1/manifest.yml delete mode 100755 packages/cisco_asa/2.4.2/changelog.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/agent/stream/stream.yml.hbs delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/agent/stream/tcp.yml.hbs delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/agent/stream/udp.yml.hbs delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/fields/agent.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/fields/base-fields.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/fields/ecs.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/fields/fields.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/manifest.yml delete mode 100755 packages/cisco_asa/2.4.2/data_stream/log/sample_event.json delete mode 100755 packages/cisco_asa/2.4.2/docs/README.md delete mode 100755 packages/cisco_asa/2.4.2/img/cisco.svg delete mode 100755 packages/cisco_asa/2.4.2/img/kibana-cisco-asa.png delete mode 100755 packages/cisco_asa/2.4.2/kibana/dashboard/cisco_asa-a555b160-4987-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/search/cisco_asa-14fce5e0-498f-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/search/cisco_asa-753406e0-4986-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/search/cisco_asa-96c6ff60-4986-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-08ef4d90-499b-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-118da960-4987-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-5d0322d0-4987-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-80d0c1b0-498a-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-a3b5ab10-4989-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-d05cdf60-498b-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/kibana/visualization/cisco_asa-fd89b1e0-49a2-11e9-b8ce-ed898b5ef295.json delete mode 100755 packages/cisco_asa/2.4.2/manifest.yml delete mode 100755 packages/cisco_ftd/2.2.2/changelog.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/agent/stream/stream.yml.hbs delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/agent/stream/tcp.yml.hbs delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/agent/stream/udp.yml.hbs delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/fields/agent.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/fields/base-fields.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/fields/ecs.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/fields/fields.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/manifest.yml delete mode 100755 packages/cisco_ftd/2.2.2/data_stream/log/sample_event.json delete mode 100755 packages/cisco_ftd/2.2.2/docs/README.md delete mode 100755 packages/cisco_ftd/2.2.2/img/cisco.svg delete mode 100755 packages/cisco_ftd/2.2.2/manifest.yml delete mode 100755 packages/gcp/1.9.2/changelog.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.9.2/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/fields/agent.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/fields/ecs.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/fields/fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/fields/package-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/manifest.yml delete mode 100755 packages/gcp/1.9.2/data_stream/audit/sample_event.json delete mode 100755 packages/gcp/1.9.2/data_stream/dns/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.9.2/data_stream/dns/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.9.2/data_stream/dns/fields/agent.yml delete mode 100755 packages/gcp/1.9.2/data_stream/dns/fields/base-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/dns/fields/ecs.yml delete mode 100755 packages/gcp/1.9.2/data_stream/dns/fields/fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/dns/manifest.yml delete mode 100755 packages/gcp/1.9.2/data_stream/dns/sample_event.json delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/fields/agent.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/fields/base-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/fields/ecs.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/fields/fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/fields/package-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/manifest.yml delete mode 100755 packages/gcp/1.9.2/data_stream/firewall/sample_event.json delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/agent/stream/gcp-pubsub.yml.hbs delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/fields/agent.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/fields/base-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/fields/ecs.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/fields/fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/fields/package-fields.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/manifest.yml delete mode 100755 packages/gcp/1.9.2/data_stream/vpcflow/sample_event.json delete mode 100755 packages/gcp/1.9.2/docs/README.md delete mode 100755 packages/gcp/1.9.2/docs/audit.md delete mode 100755 packages/gcp/1.9.2/docs/dns.md delete mode 100755 packages/gcp/1.9.2/docs/firewall.md delete mode 100755 packages/gcp/1.9.2/docs/vpcflow.md delete mode 100755 packages/gcp/1.9.2/img/filebeat-gcp-audit.png delete mode 100755 packages/gcp/1.9.2/img/logo_gcp.svg delete mode 100755 packages/gcp/1.9.2/kibana/dashboard/gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf.json delete mode 100755 packages/gcp/1.9.2/kibana/dashboard/gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf.json delete mode 100755 packages/gcp/1.9.2/kibana/dashboard/gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f.json delete mode 100755 packages/gcp/1.9.2/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json delete mode 100755 packages/gcp/1.9.2/kibana/tag/gcp-e1a359e5-543d-44c2-ab81-628138719e28.json delete mode 100755 packages/gcp/1.9.2/manifest.yml delete mode 100755 packages/github/1.0.2/changelog.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/agent/stream/httpjson.yml.hbs delete mode 100755 packages/github/1.0.2/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/fields/agent.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/fields/ecs.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/fields/fields.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/manifest.yml delete mode 100755 packages/github/1.0.2/data_stream/audit/sample_event.json delete mode 100755 packages/github/1.0.2/docs/README.md delete mode 100755 packages/github/1.0.2/img/github-audit-dashboard.png delete mode 100755 packages/github/1.0.2/img/github-user-dashboard.png delete mode 100755 packages/github/1.0.2/img/github.svg delete mode 100755 packages/github/1.0.2/kibana/dashboard/github-8bfd8310-205c-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/dashboard/github-dcee84c0-2059-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/map/github-871e5750-205e-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/search/github-173f1050-20ae-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/search/github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-61f60d00-20b4-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-78ec0aa0-20b4-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-7b073f90-205e-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-9638a6e0-20b4-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-97737b60-20b5-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-b50c62e0-20b5-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-ba0ece10-20b3-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-c803b110-20b4-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/kibana/visualization/github-d7343340-20b3-11ec-8b10-11a4c5e322a0.json delete mode 100755 packages/github/1.0.2/manifest.yml delete mode 100755 packages/httpjson/1.2.4/changelog.yml delete mode 100755 packages/httpjson/1.2.4/data_stream/generic/agent/stream/httpjson.yml.hbs delete mode 100755 packages/httpjson/1.2.4/data_stream/generic/fields/base-fields.yml delete mode 100755 packages/httpjson/1.2.4/data_stream/generic/fields/beats.yml delete mode 100755 packages/httpjson/1.2.4/data_stream/generic/fields/ecs.yml delete mode 100755 packages/httpjson/1.2.4/data_stream/generic/manifest.yml delete mode 100755 packages/httpjson/1.2.4/data_stream/generic/sample_event.json delete mode 100755 packages/httpjson/1.2.4/docs/README.md delete mode 100755 packages/httpjson/1.2.4/manifest.yml delete mode 100755 packages/o365/1.6.0/changelog.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/agent/stream/o365audit.yml.hbs delete mode 100755 packages/o365/1.6.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/fields/agent.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/fields/beats.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/fields/ecs.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/fields/fields.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/manifest.yml delete mode 100755 packages/o365/1.6.0/data_stream/audit/sample_event.json delete mode 100755 packages/o365/1.6.0/docs/README.md delete mode 100755 packages/o365/1.6.0/img/filebeat-o365-audit.png delete mode 100755 packages/o365/1.6.0/img/filebeat-o365-azure-permissions.png delete mode 100755 packages/o365/1.6.0/img/logo-integrations-microsoft-365.svg delete mode 100755 packages/o365/1.6.0/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/map/o365-dbae13c0-685c-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/visualization/o365-0be1adb0-6860-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/visualization/o365-897d0c70-6869-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/visualization/o365-8b033510-685a-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/kibana/visualization/o365-d43c95a0-6864-11ea-8d6a-292ef5d68366.json delete mode 100755 packages/o365/1.6.0/manifest.yml delete mode 100755 packages/snyk/1.2.1/changelog.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/agent/stream/httpjson.yml.hbs delete mode 100755 packages/snyk/1.2.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/fields/agent.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/fields/base-fields.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/fields/beats.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/fields/ecs.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/fields/fields.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/fields/package-fields.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/manifest.yml delete mode 100755 packages/snyk/1.2.1/data_stream/audit/sample_event.json delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/agent/stream/httpjson.yml.hbs delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/fields/agent.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/fields/base-fields.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/fields/beats.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/fields/ecs.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/fields/fields.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/fields/package-fields.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/manifest.yml delete mode 100755 packages/snyk/1.2.1/data_stream/vulnerabilities/sample_event.json delete mode 100755 packages/snyk/1.2.1/docs/README.md delete mode 100755 packages/snyk/1.2.1/img/snyk-logo.svg delete mode 100755 packages/snyk/1.2.1/manifest.yml delete mode 100755 packages/tenable_sc/1.2.1/changelog.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/agent/stream/httpjson.yml.hbs delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/fields/agent.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/fields/base-fields.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/fields/ecs.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/fields/fields.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/manifest.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/asset/sample_event.json delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/agent/stream/httpjson.yml.hbs delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/fields/agent.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/fields/base-fields.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/fields/ecs.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/fields/fields.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/manifest.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/plugin/sample_event.json delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/agent/stream/httpjson.yml.hbs delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/fields/agent.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/fields/base-fields.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/fields/ecs.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/fields/fields.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/manifest.yml delete mode 100755 packages/tenable_sc/1.2.1/data_stream/vulnerability/sample_event.json delete mode 100755 packages/tenable_sc/1.2.1/docs/README.md delete mode 100755 packages/tenable_sc/1.2.1/img/tenable_sc-logo.svg delete mode 100755 packages/tenable_sc/1.2.1/img/tenable_sc-screenshot.png delete mode 100755 packages/tenable_sc/1.2.1/kibana/dashboard/tenable_sc-726dfad0-2c0d-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/dashboard/tenable_sc-b9b277f0-2c11-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/dashboard/tenable_sc-d340bc30-30bd-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/search/tenable_sc-e23be000-8970-11ec-a56b-9fd8deec1ba2.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-12120d60-2c0e-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-20a11b40-2c14-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-2b883920-88c7-11ec-a56b-9fd8deec1ba2.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-578e2360-2c0e-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-5bc40b40-2c16-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-5de3dfd0-30bd-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-68ce24a0-2c0d-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-773a1570-323a-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-7a7c8900-2c15-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-8b4a4cd0-30bc-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-8dd5b500-2c0e-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-8f3552c0-2c13-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-b1c8bb30-30bc-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-c16a8ae0-30bd-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-c7547240-2c0d-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-d27cc590-88c5-11ec-a56b-9fd8deec1ba2.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-d4fe2930-2c13-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-dc64f5b0-2ccb-11ec-af51-75b163cdcc43.json delete mode 100755 packages/tenable_sc/1.2.1/kibana/visualization/tenable_sc-eccc5090-2cd2-11ec-af51-75b163cdcc43.json delete mode 100755 packages/tenable_sc/1.2.1/manifest.yml delete mode 100755 packages/tenable_sc/1.2.2/changelog.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/agent/stream/httpjson.yml.hbs delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/fields/agent.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/fields/base-fields.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/fields/ecs.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/fields/fields.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/manifest.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/asset/sample_event.json delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/agent/stream/httpjson.yml.hbs delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/fields/agent.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/fields/base-fields.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/fields/ecs.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/fields/fields.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/manifest.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/plugin/sample_event.json delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/agent/stream/httpjson.yml.hbs delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/fields/agent.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/fields/base-fields.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/fields/ecs.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/fields/fields.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/manifest.yml delete mode 100755 packages/tenable_sc/1.2.2/data_stream/vulnerability/sample_event.json delete mode 100755 packages/tenable_sc/1.2.2/docs/README.md delete mode 100755 packages/tenable_sc/1.2.2/img/tenable_sc-logo.svg delete mode 100755 packages/tenable_sc/1.2.2/img/tenable_sc-screenshot.png delete mode 100755 packages/tenable_sc/1.2.2/kibana/dashboard/tenable_sc-726dfad0-2c0d-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/dashboard/tenable_sc-b9b277f0-2c11-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/dashboard/tenable_sc-d340bc30-30bd-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/search/tenable_sc-e23be000-8970-11ec-a56b-9fd8deec1ba2.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-12120d60-2c0e-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-20a11b40-2c14-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-2b883920-88c7-11ec-a56b-9fd8deec1ba2.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-578e2360-2c0e-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-5bc40b40-2c16-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-5de3dfd0-30bd-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-68ce24a0-2c0d-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-773a1570-323a-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-7a7c8900-2c15-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-8b4a4cd0-30bc-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-8dd5b500-2c0e-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-8f3552c0-2c13-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-b1c8bb30-30bc-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-c16a8ae0-30bd-11ec-b7d2-eba3454d2335.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-c7547240-2c0d-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-d27cc590-88c5-11ec-a56b-9fd8deec1ba2.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-d4fe2930-2c13-11ec-b3e0-f3fd7c471f4b.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-dc64f5b0-2ccb-11ec-af51-75b163cdcc43.json delete mode 100755 packages/tenable_sc/1.2.2/kibana/visualization/tenable_sc-eccc5090-2cd2-11ec-af51-75b163cdcc43.json delete mode 100755 packages/tenable_sc/1.2.2/manifest.yml delete mode 100755 packages/winlog/1.5.2/changelog.yml delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/agent/stream/httpjson.yml.hbs delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/agent/stream/winlog.yml.hbs delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/fields/base-fields.yml delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/fields/beats.yml delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/fields/ecs.yml delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/fields/winlog.yml delete mode 100755 packages/winlog/1.5.2/data_stream/winlog/manifest.yml delete mode 100755 packages/winlog/1.5.2/docs/README.md delete mode 100755 packages/winlog/1.5.2/img/logo_windows.svg delete mode 100755 packages/winlog/1.5.2/manifest.yml diff --git a/packages/carbon_black_cloud/1.0.3/changelog.yml b/packages/carbon_black_cloud/1.0.3/changelog.yml deleted file mode 100755 index 83c0fdd168..0000000000 --- a/packages/carbon_black_cloud/1.0.3/changelog.yml +++ /dev/null @@ -1,36 +0,0 @@ -# newer versions go on top -- version: "1.0.3" - changes: - - description: Add correct field mapping for event.created - type: bugfix - link: https://github.com/elastic/integrations/issues/3579 -- version: "1.0.2" - changes: - - description: Fix dashboard issues. - type: bugfix - link: https://github.com/elastic/integrations/issues/3462 -- version: "1.0.1" - changes: - - description: Change event.outcome value from failure to failed according to ECS - type: bugfix - link: https://github.com/elastic/integrations/issues/3407 -- version: "1.0.0" - changes: - - description: Make GA - type: enhancement - link: https://github.com/elastic/integrations/pull/3428 -- version: 0.1.2 - changes: - - description: Add "VMware" to the title to make it "VMware Carbon Black Cloud". - type: enhancement - link: https://github.com/elastic/integrations/pull/3196 -- version: 0.1.1 - changes: - - description: Captured domain from username and hostname - type: enhancement - link: https://github.com/elastic/integrations/pull/3106 -- version: 0.1.0 - changes: - - description: Initial draft of the package. - type: enhancement - link: https://github.com/elastic/integrations/pull/2760 diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/aws-s3.yml.hbs b/packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/aws-s3.yml.hbs deleted file mode 100755 index e02c596614..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/aws-s3.yml.hbs +++ /dev/null @@ -1,24 +0,0 @@ -bucket_arn: {{bucket_arn}} -number_of_workers: {{number_of_workers}} -bucket_list_interval: {{interval}} -access_key_id: {{access_key_id}} -secret_access_key: {{secret_access_key}} -bucket_list_prefix: {{bucket_list_prefix}} -expand_event_list_from_field: Records -{{#if proxy_url}} -proxy_url: {{proxy_url}} -{{/if}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/httpjson.yml.hbs b/packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/httpjson.yml.hbs deleted file mode 100755 index 2f738b21a6..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/agent/stream/httpjson.yml.hbs +++ /dev/null @@ -1,52 +0,0 @@ -config_version: 2 -interval: {{interval}} -request.timeout: 2m -request.method: POST - -{{#if proxy_url}} -request.proxy_url: {{proxy_url}} -{{/if}} -{{#if ssl}} -request.ssl: {{ssl}} -{{/if}} - -request.url: {{hostname}}/appservices/v6/orgs/{{org_key}}/alerts/_search -request.transforms: - - set: - target: header.X-Auth-Token - value: {{custom_api_secret_key}}/{{custom_api_id}} - - set: - target: body.criteria.last_update_time.start - value: '[[.cursor.last_update_timestamp]]' - default: '[[formatDate ((now (parseDuration "-{{initial_interval}}")).Add (parseDuration "-15m")) "RFC3339"]]' - - set: - target: body.criteria.last_update_time.end - value: '[[formatDate (now (parseDuration "-15m")) "RFC3339"]]' - - set: - target: body.sort - value: '[{ "field": "last_update_time", "order": "ASC"}]' - value_type: json -response.pagination: - - set: - target: body.criteria.last_update_time.start - value: '[[if (ne .last_response.body.num_found .last_response.body.num_available)]][[.last_event.last_update_time]][[else]][[.last_response.terminate_pagination]][[end]]' - fail_on_template_error: true -cursor: - last_update_timestamp: - value: '[[.last_event.last_update_time]]' -response.split: - target: body.results -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/1.0.3/data_stream/alert/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index f6f5fc171e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,313 +0,0 @@ ---- -description: Pipeline for parsing Carbon Black Cloud alerts. -processors: - - set: - field: ecs.version - value: "8.0.0" - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - ignore_failure: true - - fingerprint: - fields: - - json.id - - json.create_time - - json.last_update_time - target_field: _id - ignore_missing: true - - date: - field: json.create_time - target_field: "@timestamp" - ignore_failure: true - formats: - - ISO8601 - - set: - field: event.kind - value: alert - - rename: - field: json.id - target_field: event.id - ignore_missing: true - - rename: - field: json.first_event_time - target_field: event.start - ignore_missing: true - - rename: - field: json.last_event_time - target_field: event.end - ignore_missing: true - - rename: - field: json.severity - target_field: event.severity - ignore_missing: true - - urldecode: - field: json.alert_url - target_field: event.url - ignore_missing: true - - rename: - field: json.reason - target_field: event.reason - ignore_missing: true - - convert: - field: json.device_id - target_field: host.id - type: string - ignore_missing: true - - set: - field: host.os.type - value: windows - if: ctx?.json?.device_os == "WINDOWS" - - set: - field: host.os.type - value: linux - if: ctx?.json?.device_os == "LINUX" - - set: - field: host.os.type - value: macos - if: ctx?.json?.device_os == "MAC" - - set: - field: event.kind - value: alert - - rename: - field: json.device_os_version - target_field: host.os.version - ignore_missing: true - - rename: - field: json.device_name - target_field: host.hostname - ignore_missing: true - - grok: - field: host.hostname - patterns: - - '^(%{DATA:user.domain})\\(%{GREEDYDATA:host.hostname})$' - ignore_missing: true - ignore_failure: true - - set: - field: host.name - value: "{{{host.hostname}}}" - ignore_failure: true - - append: - field: host.ip - value: "{{{json.device_internal_ip}}}" - if: ctx?.json?.device_internal_ip != null - allow_duplicates: false - ignore_failure: true - - append: - field: host.ip - value: "{{{json.device_external_ip}}}" - if: ctx?.json?.device_external_ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.device_username - target_field: user.name - ignore_missing: true - - grok: - field: user.name - patterns: - - '^(%{DATA:user.domain})\\(%{GREEDYDATA:user.name})$' - ignore_missing: true - ignore_failure: true - - append: - field: related.ip - value: - - "{{{json.device_internal_ip}}}" - - "{{{json.device_external_ip}}}" - allow_duplicates: false - - append: - field: related.user - value: - - "{{{user.name}}}" - allow_duplicates: false - - append: - field: related.hosts - value: - - "{{{host.hostname}}}" - - "{{{user.domain}}}" - allow_duplicates: false - - append: - field: related.hash - value: - - "{{{json.threat_cause_actor_md5}}}" - - "{{{json.threat_cause_actor_sha256}}}" - allow_duplicates: false - - rename: - field: json.process_name - target_field: process.name - ignore_missing: true - - rename: - field: json.process_path - target_field: process.executable - ignore_missing: true - - rename: - field: json.process_guid - target_field: process.entity_id - ignore_missing: true - - rename: - field: json.vendor_name - target_field: carbon_black_cloud.alert.vendor_name - ignore_missing: true - - rename: - field: json.product_name - target_field: carbon_black_cloud.alert.product_name - ignore_missing: true - - rename: - field: json.serial_number - target_field: carbon_black_cloud.alert.serial_number - ignore_missing: true - - rename: - field: json.policy_id - target_field: carbon_black_cloud.alert.policy.id - ignore_missing: true - - rename: - field: json.policy_name - target_field: carbon_black_cloud.alert.policy.name - ignore_missing: true - - rename: - field: json.threat_id - target_field: carbon_black_cloud.alert.threat_id - ignore_missing: true - - rename: - field: json.policy_applied - target_field: carbon_black_cloud.alert.policy.applied - ignore_missing: true - - rename: - field: json.threat_activity_c2 - target_field: carbon_black_cloud.alert.threat_activity.c2 - ignore_missing: true - - rename: - field: json.threat_activity_dlp - target_field: carbon_black_cloud.alert.threat_activity.dlp - ignore_missing: true - - rename: - field: json.threat_activity_phish - target_field: carbon_black_cloud.alert.threat_activity.phish - ignore_missing: true - - rename: - field: json.threat_cause_actor_name - target_field: carbon_black_cloud.alert.threat_cause.actor.name - ignore_missing: true - - rename: - field: json.threat_cause_actor_process_pid - target_field: carbon_black_cloud.alert.threat_cause.actor.process_pid - ignore_missing: true - - rename: - field: json.threat_cause_actor_sha256 - target_field: carbon_black_cloud.alert.threat_cause.actor.sha256 - ignore_missing: true - - rename: - field: json.threat_cause_actor_md5 - target_field: carbon_black_cloud.alert.threat_cause.actor.md5 - ignore_missing: true - - rename: - field: json.threat_cause_cause_event_id - target_field: carbon_black_cloud.alert.threat_cause.cause_event_id - ignore_missing: true - - rename: - field: json.threat_cause_parent_guid - target_field: carbon_black_cloud.alert.threat_cause.process.parent.guid - ignore_missing: true - - rename: - field: json.threat_cause_process_guid - target_field: carbon_black_cloud.alert.threat_cause.process.guid - ignore_missing: true - - rename: - field: json.threat_cause_reputation - target_field: carbon_black_cloud.alert.threat_cause.reputation - ignore_missing: true - - rename: - field: json.threat_cause_threat_category - target_field: carbon_black_cloud.alert.threat_cause.threat_category - ignore_missing: true - - rename: - field: json.threat_cause_vector - target_field: carbon_black_cloud.alert.threat_cause.vector - ignore_missing: true - - rename: - field: json.ioc_field - target_field: carbon_black_cloud.alert.ioc.field - ignore_missing: true - - rename: - field: json.ioc_hit - target_field: carbon_black_cloud.alert.ioc.hit - ignore_missing: true - - rename: - field: json.ioc_id - target_field: carbon_black_cloud.alert.ioc.id - ignore_missing: true - - rename: - field: json.report_id - target_field: carbon_black_cloud.alert.report.id - ignore_missing: true - - rename: - field: json.report_name - target_field: carbon_black_cloud.alert.report.name - ignore_missing: true - - rename: - field: json.org_key - target_field: carbon_black_cloud.alert.organization_key - ignore_missing: true - - rename: - field: json.device_location - target_field: carbon_black_cloud.alert.device.location - ignore_missing: true - - rename: - field: json.device_os - target_field: carbon_black_cloud.alert.device.os - ignore_missing: true - - rename: - field: json.device_internal_ip - target_field: carbon_black_cloud.alert.device.internal_ip - ignore_missing: true - - rename: - field: json.device_external_ip - target_field: carbon_black_cloud.alert.device.external_ip - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true - - lowercase: - field: json.category - ignore_missing: true - - script: - description: Adds all the remaining fields in fields under carbon_black_cloud.alert - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.carbon_black_cloud.alert[m.getKey()] = m.getValue(); - } - - remove: - field: - - json - - carbon_black_cloud.alert.create_time - - carbon_black_cloud.alert.device_id - - carbon_black_cloud.alert.alert_url - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); -on_failure: - - set: - field: error.message - value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/agent.yml b/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/base-fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/base-fields.yml deleted file mode 100755 index 14fb618ea4..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module. - value: carbon_black_cloud -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: carbon_black_cloud.alert diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/ecs.yml b/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/ecs.yml deleted file mode 100755 index 7963c28eb9..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/ecs.yml +++ /dev/null @@ -1,124 +0,0 @@ -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: event.end contains the date when the event ended or when the activity was last observed. - name: event.end - type: date -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: |- - Reason why this event happened, according to the source. - This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - name: event.reason - type: keyword -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long -- description: event.start contains the date when the event started or when the activity was first observed. - name: event.start - type: date -- description: |- - URL linking to an external system to continue investigation of this event. - This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. - name: event.url - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - Unique host id. - As hostname is not always unique, use values that are meaningful in your environment. - Example: The current usage of `beat.name`. - name: host.id - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: |- - Use the `os.type` field to categorize the operating system into one of the broad commercial families. - One of these following values should be used (lowercase): linux, macos, unix, windows. - If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. - name: host.os.type - type: keyword -- description: Operating system version as a raw string. - name: host.os.version - type: keyword -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.entity_id - type: keyword -- description: Absolute path to the process executable. - multi_fields: - - name: text - type: match_only_text - name: process.executable - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - multi_fields: - - name: text - type: match_only_text - name: process.name - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: user.name - type: keyword diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/fields.yml deleted file mode 100755 index 3eca3a1515..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/fields/fields.yml +++ /dev/null @@ -1,218 +0,0 @@ -- name: carbon_black_cloud.alert - type: group - fields: - - name: blocked_threat_category - type: keyword - description: The category of threat which we were able to take action on. - - name: category - type: keyword - description: The category of the alert. - - name: count - type: long - - name: created_by_event_id - type: keyword - description: Event identifier that initiated the alert. - - name: device - type: group - fields: - - name: location - type: keyword - description: The Location of device. - - name: os - type: keyword - description: OS of the device. - - name: internal_ip - type: ip - description: Internal IP of the device. - - name: external_ip - type: ip - description: External IP of the device. - - name: document_guid - type: keyword - description: Unique ID of document. - - name: ioc - type: group - fields: - - name: field - type: keyword - description: The field the indicator of comprise (IOC) hit contains. - - name: hit - type: keyword - description: IOC field value or IOC query that matches. - - name: id - type: keyword - description: The identifier of the IOC that cause the hit. - - name: kill_chain_status - type: keyword - description: The stage within the Cyber Kill Chain sequence most closely associated with the attributes of the alert. - - name: last_update_time - type: date - description: The last time the alert was updated as an ISO 8601 UTC timestamp. - - name: legacy_alert_id - type: keyword - description: The legacy identifier for the alert. - - name: not_blocked_threat_category - type: keyword - description: Other potentially malicious activity involved in the threat that we weren't able to take action on (either due to policy config, or not having a relevant rule). - - name: notes_present - type: boolean - description: Indicates if notes are associated with the threat_id. - - name: organization_key - type: keyword - description: The unique identifier for the organization associated with the alert. - - name: policy - type: group - fields: - - name: applied - type: keyword - description: Whether a policy was applied. - - name: id - type: long - description: The identifier for the policy associated with the device at the time of the alert. - - name: name - type: keyword - description: The name of the policy associated with the device at the time of the alert. - - name: product_id - type: keyword - description: The hexadecimal id of the USB device's product. - - name: product_name - type: keyword - description: The name of the USB device’s vendor. - - name: reason_code - type: keyword - description: Shorthand enum for the full-text reason. - - name: report - type: group - fields: - - name: id - type: keyword - description: The identifier of the report that contains the IOC. - - name: name - type: keyword - description: The name of the report that contains the IOC. - - name: run_state - type: keyword - description: Whether the threat in the alert ran. - - name: sensor_action - type: keyword - description: The action taken by the sensor, according to the rule of the policy. - - name: serial_number - type: keyword - description: The serial number of the USB device. - - name: status - type: keyword - description: status of alert. - - name: tags - type: keyword - description: Tags associated with the alert. - - name: target_value - type: keyword - description: The priority of the device assigned by the policy. - - name: threat_activity - type: group - fields: - - name: c2 - type: keyword - description: Whether the alert involved a command and control (c2) server. - - name: dlp - type: keyword - description: Whether the alert involved data loss prevention (DLP). - - name: phish - type: keyword - description: Whether the alert involved phishing. - - name: threat_cause - type: group - fields: - - name: actor - type: group - fields: - - name: md5 - type: keyword - description: MD5 of the threat cause actor. - - name: name - type: keyword - description: 'The name can be one of the following: process commandline, process name, or analytic matched threat. Analytic matched threats are Exploit, Malware, PUP, or Trojan.' - - name: process_pid - type: keyword - description: Process identifier (PID) of the actor process. - - name: sha256 - type: keyword - description: SHA256 of the threat cause actor. - - name: cause_event_id - type: keyword - description: ID of the Event that triggered the threat. - - name: process - type: group - fields: - - name: guid - type: keyword - description: The global unique identifier of the process. - - name: parent - type: group - fields: - - name: guid - type: keyword - description: The global unique identifier of the process. - - name: reputation - type: keyword - description: Reputation of the threat cause. - - name: threat_category - type: keyword - description: Category of the threat cause. - - name: vector - type: keyword - description: The source of the threat cause. - - name: threat_id - type: keyword - description: The identifier of a threat which this alert belongs. Threats are comprised of a combination of factors that can be repeated across devices. - - name: threat_indicators - type: group - description: List of the threat indicators that make up the threat. - fields: - - name: process_name - type: keyword - description: Process name associated with threat. - - name: sha256 - type: keyword - description: Sha256 associated with threat. - - name: ttps - type: keyword - description: Tactics, techniques and procedures associated with threat. - - name: type - type: keyword - description: Type of alert. - - name: vendor_id - type: keyword - description: The hexadecimal id of the USB device's vendor. - - name: vendor_name - type: keyword - description: The name of the USB device’s vendor. - - name: watchlists - type: group - description: List of watchlists associated with an alert. - fields: - - name: id - type: keyword - description: The identifier of watchlist. - - name: name - type: keyword - description: The name of the watchlist. - - name: workflow - type: group - description: Tracking system for alerts as they are triaged and resolved. - fields: - - name: changed_by - type: keyword - description: The name of user who changed the workflow. - - name: comment - type: keyword - description: Comment associated with workflow. - - name: last_update_time - type: date - description: The last update time of workflow. - - name: remediation - type: keyword - description: N/A - - name: state - type: keyword - description: The state of workflow. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/manifest.yml b/packages/carbon_black_cloud/1.0.3/data_stream/alert/manifest.yml deleted file mode 100755 index 477667ce22..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/manifest.yml +++ /dev/null @@ -1,95 +0,0 @@ -title: Alert -type: logs -streams: - - input: httpjson - title: Collect alerts from Carbon Black Cloud - description: Collect alerts from Carbon Black Cloud. - template_path: httpjson.yml.hbs - vars: - - name: interval - type: text - title: Interval - description: Interval to fetch alerts from Carbon Black Cloud. - multi: false - required: true - show_user: true - default: 1m - - name: initial_interval - type: text - title: Initial Interval - description: How far back to pull the alerts from the Carbon Black Cloud API. - default: 24h - multi: false - required: true - show_user: true - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - carbon_black_cloud-alert - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: aws-s3 - title: Collect alerts from Carbon Black Cloud - description: Collect alerts from Carbon Black Cloud. - template_path: aws-s3.yml.hbs - vars: - - name: bucket_list_prefix - type: text - title: Bucket Prefix - description: Prefix to apply for the list request to the S3 bucket. - multi: false - required: true - show_user: true - - name: interval - type: text - title: Interval - description: Interval to fetch alerts from AWS S3 bucket. - multi: false - required: true - show_user: true - default: 1m - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - carbon_black_cloud-alert - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/alert/sample_event.json b/packages/carbon_black_cloud/1.0.3/data_stream/alert/sample_event.json deleted file mode 100755 index 67e2c63a32..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/alert/sample_event.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "@timestamp": "2020-11-17T22:05:13.000Z", - "agent": { - "ephemeral_id": "56053d91-103c-4c77-8f15-0a1006a80102", - "hostname": "docker-fleet-agent", - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.17.0" - }, - "carbon_black_cloud": { - "alert": { - "category": "warning", - "device": { - "external_ip": "81.2.69.143", - "internal_ip": "81.2.69.144", - "location": "UNKNOWN", - "os": "WINDOWS" - }, - "last_update_time": "2020-11-17T22:05:13Z", - "legacy_alert_id": "C8EB7306-AF26-4A9A-B677-814B3AF69720", - "organization_key": "ABCD6X3T", - "policy": { - "applied": "APPLIED", - "id": 6997287, - "name": "Standard" - }, - "product_id": "0x5406", - "product_name": "U3 Cruzer Micro", - "reason_code": "6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC", - "run_state": "DID_NOT_RUN", - "sensor_action": "DENY", - "serial_number": "0875920EF7C2A304", - "target_value": "MEDIUM", - "threat_cause": { - "cause_event_id": "FCEE2AF0-D832-4C9F-B988-F11B46028C9E", - "threat_category": "NON_MALWARE", - "vector": "REMOVABLE_MEDIA" - }, - "threat_id": "t5678", - "type": "DEVICE_CONTROL", - "vendor_id": "0x0781", - "vendor_name": "SanDisk", - "workflow": { - "changed_by": "Carbon Black", - "last_update_time": "2020-11-17T22:02:16Z", - "state": "OPEN" - } - } - }, - "data_stream": { - "dataset": "carbon_black_cloud.alert", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "snapshot": false, - "version": "7.17.0" - }, - "event": { - "agent_id_status": "verified", - "created": "2022-04-14T11:46:13.154Z", - "dataset": "carbon_black_cloud.alert", - "end": "2020-11-17T22:02:16Z", - "id": "test1", - "ingested": "2022-04-14T11:46:14Z", - "kind": "alert", - "original": "{\"alert_url\":\"https://defense-eap01.conferdeploy.net/alerts?orgId=1889976\",\"category\":\"WARNING\",\"create_time\":\"2020-11-17T22:05:13Z\",\"device_external_ip\":\"81.2.69.143\",\"device_id\":2,\"device_internal_ip\":\"81.2.69.144\",\"device_location\":\"UNKNOWN\",\"device_name\":\"DESKTOP-002\",\"device_os\":\"WINDOWS\",\"device_os_version\":\"Windows 10 x64\",\"device_username\":\"test34@demo.com\",\"first_event_time\":\"2020-11-17T22:02:16Z\",\"id\":\"test1\",\"last_event_time\":\"2020-11-17T22:02:16Z\",\"last_update_time\":\"2020-11-17T22:05:13Z\",\"legacy_alert_id\":\"C8EB7306-AF26-4A9A-B677-814B3AF69720\",\"org_key\":\"ABCD6X3T\",\"policy_applied\":\"APPLIED\",\"policy_id\":6997287,\"policy_name\":\"Standard\",\"product_id\":\"0x5406\",\"product_name\":\"U3 Cruzer Micro\",\"reason\":\"Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.\",\"reason_code\":\"6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC\",\"run_state\":\"DID_NOT_RUN\",\"sensor_action\":\"DENY\",\"serial_number\":\"0875920EF7C2A304\",\"severity\":3,\"target_value\":\"MEDIUM\",\"threat_cause_cause_event_id\":\"FCEE2AF0-D832-4C9F-B988-F11B46028C9E\",\"threat_cause_threat_category\":\"NON_MALWARE\",\"threat_cause_vector\":\"REMOVABLE_MEDIA\",\"threat_id\":\"t5678\",\"type\":\"DEVICE_CONTROL\",\"vendor_id\":\"0x0781\",\"vendor_name\":\"SanDisk\",\"workflow\":{\"changed_by\":\"Carbon Black\",\"comment\":\"\",\"last_update_time\":\"2020-11-17T22:02:16Z\",\"remediation\":\"\",\"state\":\"OPEN\"}}", - "reason": "Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.", - "severity": 3, - "start": "2020-11-17T22:02:16Z", - "url": "https://defense-eap01.conferdeploy.net/alerts?orgId=1889976" - }, - "host": { - "hostname": "DESKTOP-002", - "id": "2", - "ip": [ - "81.2.69.144", - "81.2.69.143" - ], - "name": "DESKTOP-002", - "os": { - "type": "windows", - "version": "Windows 10 x64" - } - }, - "input": { - "type": "httpjson" - }, - "related": { - "hosts": [ - "DESKTOP-002" - ], - "ip": [ - "81.2.69.144", - "81.2.69.143" - ], - "user": [ - "test34@demo.com" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-alert" - ], - "user": { - "name": "test34@demo.com" - } -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/agent/stream/httpjson.yml.hbs b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/agent/stream/httpjson.yml.hbs deleted file mode 100755 index 310b6e05d5..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/agent/stream/httpjson.yml.hbs +++ /dev/null @@ -1,45 +0,0 @@ -config_version: 2 -interval: {{interval}} -request.method: POST -{{#if proxy_url }} -request.proxy_url: {{proxy_url}} -{{/if}} -{{#if ssl}} -request.ssl: {{ssl}} -{{/if}} -request.url: {{hostname}}/vulnerability/assessment/api/v1/orgs/{{org_key}}/devices/vulnerabilities/summary/_search -request.transforms: - - set: - target: header.X-Auth-Token - value: {{custom_api_secret_key}}/{{custom_api_id}} - - set: - target: body.start - value: '0' - value_type: int - - set: - target: body.rows - value: '10000' - value_type: int -request.timeout: 2m -response.pagination: - - set: - target: body.start - value: '[[if (eq (len .last_response.body.results) 0)]][[.last_response.terminate_pagination]][[else]][[mul .last_response.page .body.rows]][[end]]' - value_type: int - fail_on_template_error: true -response.split: - target: body.results -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 94f7482f37..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,132 +0,0 @@ ---- -description: Pipeline for parsing Carbon Black Cloud Asset Vulnerability Summary. -processors: -- rename: - field: message - target_field: event.original - ignore_missing: true -- set: - field: ecs.version - value: '8.0.0' -- json: - field: event.original - target_field: json -- rename: - field: json.host_name - target_field: host.hostname - ignore_missing: true -- convert: - field: json.device_id - type: string - target_field: host.id - ignore_missing: true -- rename: - field: json.name - target_field: host.name - ignore_missing: true -- rename: - field: json.os_info.os_name - target_field: host.os.name - ignore_missing: true -- set: - field: host.os.type - value: windows - if: ctx?.json?.os_info.os_type == "WINDOWS" -- set: - field: host.os.type - value: ubuntu - if: ctx?.json?.os_info.os_type == "UBUNTU" -- set: - field: host.os.type - value: centos - if: ctx?.json?.os_info.os_type == "CENTOS" -- remove : - field: json.os_info.os_type - ignore_missing: true -- remove : - field: json.device_id - ignore_missing: true -- rename: - field: json.os_info.os_version - target_field: host.os.version - ignore_missing: true -- rename: - field: json.highest_risk_score - target_field: vulnerability.score.base - ignore_missing: true -- rename: - field: json.severity - target_field: vulnerability.severity - ignore_missing: true -- date: - field: json.last_sync_ts - formats: - - ISO8601 - target_field: carbon_black_cloud.asset_vulnerability_summary.last_sync.timestamp -- remove: - field: json.last_sync_ts - ignore_missing: true -- rename: - field: json.sync_status - target_field: carbon_black_cloud.asset_vulnerability_summary.sync.status - ignore_missing: true -- rename: - field: json.sync_type - target_field: carbon_black_cloud.asset_vulnerability_summary.sync.type - ignore_missing: true -- rename: - field: json.type - target_field: carbon_black_cloud.asset_vulnerability_summary.type - ignore_missing: true -- rename: - field: json.vm_id - target_field: carbon_black_cloud.asset_vulnerability_summary.vm.id - ignore_missing: true -- rename: - field: json.vm_name - target_field: carbon_black_cloud.asset_vulnerability_summary.vm.name - ignore_missing: true -- rename: - field: json.vuln_count - target_field: carbon_black_cloud.asset_vulnerability_summary.vuln_count - ignore_missing: true -- append: - field: related.hosts - value: "{{{host.hostname}}}" - allow_duplicates: false -- script: - description: Adds all the remaining fields in fields under carbon_black_cloud.asset_vulnerability_summary - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.carbon_black_cloud.asset_vulnerability_summary[m.getKey()] = m.getValue(); - } -- remove: - field: json - ignore_missing: true -- script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); -- remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_missing: true -on_failure: -- set: - field: error.message - value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/agent.yml b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/base-fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/base-fields.yml deleted file mode 100755 index e6791517a6..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: carbon_black_cloud -- name: event.dataset - type: constant_keyword - description: Event dataset - value: carbon_black_cloud.asset_vulnerability_summary diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/ecs.yml b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/ecs.yml deleted file mode 100755 index 536382d53b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/ecs.yml +++ /dev/null @@ -1,64 +0,0 @@ -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - Unique host id. - As hostname is not always unique, use values that are meaningful in your environment. - Example: The current usage of `beat.name`. - name: host.id - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: Operating system name, without the version. - multi_fields: - - name: text - type: match_only_text - name: host.os.name - type: keyword -- description: |- - Use the `os.type` field to categorize the operating system into one of the broad commercial families. - One of these following values should be used (lowercase): linux, macos, unix, windows. - If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. - name: host.os.type - type: keyword -- description: Operating system version as a raw string. - name: host.os.version - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Scores can range from 0.0 to 10.0, with 10.0 being the most severe. - Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) - name: vulnerability.score.base - type: float -- description: The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) - name: vulnerability.severity - type: keyword diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/fields.yml deleted file mode 100755 index a70b2974e8..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/fields/fields.yml +++ /dev/null @@ -1,39 +0,0 @@ -- name: carbon_black_cloud.asset_vulnerability_summary - type: group - fields: - - name: os_info - type: group - fields: - - name: os_arch - type: keyword - description: The identifier is for the Operating system architecture. - - name: last_sync - type: group - fields: - - name: timestamp - type: date - description: The identifier is for the Last sync time. - - name: sync - type: group - fields: - - name: status - type: keyword - description: The identifier is for the Device sync status. - - name: type - type: keyword - description: The identifier is for the Whether a manual sync was triggered for the device, or if it was a scheduled sync. - - name: type - type: keyword - description: The identifier is for the Device type. - - name: vm - type: group - fields: - - name: id - type: keyword - description: The identifier is for the Virtual Machine ID. - - name: name - type: keyword - description: The identifier is for the Virtual Machine name. - - name: vuln_count - type: integer - description: The identifier is for the Number of vulnerabilities at this level. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/manifest.yml b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/manifest.yml deleted file mode 100755 index b7bf78f84d..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/manifest.yml +++ /dev/null @@ -1,42 +0,0 @@ -title: Asset Vulnerability Summary -type: logs -streams: - - input: httpjson - title: Collect asset vulnerability summary from Carbon Black Cloud - description: Collect asset vulnerability summary from Carbon Black Cloud. - template_path: httpjson.yml.hbs - vars: - - name: interval - type: text - title: Interval - description: Interval to query asset vulnerability summary in Carbon Black Cloud. - multi: false - required: true - show_user: true - default: 1h - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - carbon_black_cloud-asset-vulnerability-summary - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/sample_event.json b/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/sample_event.json deleted file mode 100755 index c31987aefe..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/asset_vulnerability_summary/sample_event.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "@timestamp": "2022-04-14T11:47:25.371Z", - "agent": { - "ephemeral_id": "377d9292-c7d0-4c30-bbee-faf4848d30d8", - "hostname": "docker-fleet-agent", - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.17.0" - }, - "carbon_black_cloud": { - "asset_vulnerability_summary": { - "last_sync": { - "timestamp": "2022-01-17T08:33:37.384Z" - }, - "os_info": { - "os_arch": "64-bit" - }, - "sync": { - "status": "COMPLETED", - "type": "SCHEDULED" - }, - "type": "ENDPOINT", - "vuln_count": 1770 - } - }, - "data_stream": { - "dataset": "carbon_black_cloud.asset_vulnerability_summary", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "snapshot": false, - "version": "7.17.0" - }, - "event": { - "agent_id_status": "verified", - "created": "2022-04-14T11:47:25.371Z", - "dataset": "carbon_black_cloud.asset_vulnerability_summary", - "ingested": "2022-04-14T11:47:26Z", - "original": "{\"cve_ids\":null,\"device_id\":8,\"highest_risk_score\":10,\"host_name\":\"DESKTOP-008\",\"last_sync_ts\":\"2022-01-17T08:33:37.384932Z\",\"name\":\"DESKTOP-008KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Education\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.17763\"},\"severity\":\"CRITICAL\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"SCHEDULED\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":1770}" - }, - "host": { - "hostname": "DESKTOP-008", - "id": "8", - "name": "DESKTOP-008KK", - "os": { - "name": "Microsoft Windows 10 Education", - "type": "windows", - "version": "10.0.17763" - } - }, - "input": { - "type": "httpjson" - }, - "related": { - "hosts": [ - "DESKTOP-008" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-asset-vulnerability-summary" - ], - "vulnerability": { - "score": { - "base": 10 - }, - "severity": "CRITICAL" - } -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/agent/stream/httpjson.yml.hbs b/packages/carbon_black_cloud/1.0.3/data_stream/audit/agent/stream/httpjson.yml.hbs deleted file mode 100755 index 2693bd2bbb..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/agent/stream/httpjson.yml.hbs +++ /dev/null @@ -1,32 +0,0 @@ -config_version: 2 -interval: {{interval}} -request.method: GET - -{{#if proxy_url}} -request.proxy_url: {{proxy_url}} -{{/if}} -{{#if ssl}} -request.ssl: {{ssl}} -{{/if}} - -request.url: {{hostname}}/integrationServices/v3/auditlogs -request.transforms: - - set: - target: header.X-Auth-Token - value: {{api_secret_key}}/{{api_id}} -response.split: - target: body.notifications -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/1.0.3/data_stream/audit/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 55cc7106f9..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,93 +0,0 @@ ---- -description: Pipeline for parsing Carbon Black Cloud audit logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - ignore_failure: true - - date: - field: json.eventTime - target_field: "@timestamp" - ignore_failure: true - formats: - - UNIX_MS - - set: - field: event.kind - value: event - - set: - field: event.outcome - value: success - - set: - field: event.outcome - value: failure - if: ctx?.json?.flagged == true - - rename: - field: json.description - target_field: event.reason - - rename: - field: json.clientIp - target_field: client.ip - ignore_missing: true - - rename: - field: json.loginName - target_field: client.user.id - ignore_missing: true - - rename: - field: json.eventId - target_field: event.id - ignore_missing: true - - rename: - field: json.orgName - target_field: organization.name - ignore_missing: true - - urldecode: - field: json.requestUrl - target_field: url.original - ignore_missing: true - - rename: - field: json.verbose - target_field: carbon_black_cloud.audit.verbose - ignore_missing: true - - rename: - field: json.flagged - target_field: carbon_black_cloud.audit.flagged - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - allow_duplicates: false - - remove: - field: json - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/agent.yml b/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/base-fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/base-fields.yml deleted file mode 100755 index a14e71251a..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module. - value: carbon_black_cloud -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: carbon_black_cloud.audit diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/ecs.yml b/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/ecs.yml deleted file mode 100755 index faa249743c..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/ecs.yml +++ /dev/null @@ -1,62 +0,0 @@ -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: Unique identifier of the user. - name: client.user.id - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: |- - Reason why this event happened, according to the source. - This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - name: event.reason - type: keyword -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: organization.name - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - multi_fields: - - name: text - type: match_only_text - name: url.original - type: wildcard diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/fields.yml deleted file mode 100755 index 24af5d42b9..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/fields/fields.yml +++ /dev/null @@ -1,9 +0,0 @@ -- name: carbon_black_cloud.audit - type: group - fields: - - name: flagged - type: boolean - description: true if action is failed otherwise false. - - name: verbose - type: boolean - description: true if verbose audit log otherwise false. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/manifest.yml b/packages/carbon_black_cloud/1.0.3/data_stream/audit/manifest.yml deleted file mode 100755 index 929093a4ef..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/manifest.yml +++ /dev/null @@ -1,42 +0,0 @@ -title: Audit -type: logs -streams: - - input: httpjson - title: Collect audit logs from Carbon Black Cloud - description: Collect audit logs from Carbon Black Cloud. - template_path: httpjson.yml.hbs - vars: - - name: interval - type: text - title: Interval - description: Interval to fetch audit logs from Carbon Black Cloud. - multi: false - required: true - show_user: true - default: 1m - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - carbon_black_cloud-audit - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/audit/sample_event.json b/packages/carbon_black_cloud/1.0.3/data_stream/audit/sample_event.json deleted file mode 100755 index 4ecd8ed454..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/audit/sample_event.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "@timestamp": "2022-02-10T16:04:30.263Z", - "agent": { - "ephemeral_id": "6472e86c-fc7c-478a-a6fd-12ed19fe05c9", - "hostname": "docker-fleet-agent", - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.17.0" - }, - "carbon_black_cloud": { - "audit": { - "flagged": false, - "verbose": false - } - }, - "client": { - "ip": "10.10.10.10", - "user": { - "id": "abc@demo.com" - } - }, - "data_stream": { - "dataset": "carbon_black_cloud.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "snapshot": false, - "version": "7.17.0" - }, - "event": { - "agent_id_status": "verified", - "created": "2022-04-14T11:48:30.094Z", - "dataset": "carbon_black_cloud.audit", - "id": "2122f8ce8xxxxxxxxxxxxx", - "ingested": "2022-04-14T11:48:31Z", - "kind": "event", - "original": "{\"clientIp\":\"10.10.10.10\",\"description\":\"Logged in successfully\",\"eventId\":\"2122f8ce8xxxxxxxxxxxxx\",\"eventTime\":1644509070263,\"flagged\":false,\"loginName\":\"abc@demo.com\",\"orgName\":\"cb-xxxx-xxxx.com\",\"requestUrl\":null,\"verbose\":false}", - "outcome": "success", - "reason": "Logged in successfully" - }, - "input": { - "type": "httpjson" - }, - "organization": { - "name": "cb-xxxx-xxxx.com" - }, - "related": { - "ip": [ - "10.10.10.10" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-audit" - ] -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/agent/stream/aws-s3.yml.hbs b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/agent/stream/aws-s3.yml.hbs deleted file mode 100755 index e02c596614..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/agent/stream/aws-s3.yml.hbs +++ /dev/null @@ -1,24 +0,0 @@ -bucket_arn: {{bucket_arn}} -number_of_workers: {{number_of_workers}} -bucket_list_interval: {{interval}} -access_key_id: {{access_key_id}} -secret_access_key: {{secret_access_key}} -bucket_list_prefix: {{bucket_list_prefix}} -expand_event_list_from_field: Records -{{#if proxy_url}} -proxy_url: {{proxy_url}} -{{/if}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 3a6c8fc6df..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,587 +0,0 @@ ---- -description: Pipeline for parsing Carbon Black Cloud Endpoint Events. -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - ignore_failure: true - - date: - field: json.create_time - target_field: "@timestamp" - ignore_failure: true - formats: - - ISO8601 - - rename: - field: json.action - target_field: event.action - ignore_missing: true - - rename: - field: json.event_id - target_field: event.id - ignore_missing: true - - rename: - field: json.event_description - target_field: event.reason - ignore_missing: true - - rename: - field: json.filemod_name - target_field: file.path - ignore_missing: true - - rename: - field: json.modload_name - target_field: dll.path - ignore_missing: true - - set: - field: network.transport - value: udp - if: ctx?.json?.netconn_protocol == "PROTO_UDP" - - set: - field: network.transport - value: tcp - if: ctx?.json?.netconn_protocol == "PROTO_TCP" - - set: - field: network.direction - value: inbound - if: ctx?.json?.netconn_inbound == true - - set: - field: network.direction - value: outbound - if: ctx?.json?.netconn_inbound == false - - rename: - field: json.remote_port - target_field: source.port - ignore_missing: true - - rename: - field: json.remote_ip - target_field: source.ip - ignore_missing: true - - rename: - field: json.netconn_domain - target_field: source.address - ignore_missing: true - - rename: - field: json.local_port - target_field: client.port - ignore_missing: true - - rename: - field: json.local_ip - target_field: client.ip - ignore_missing: true - - convert: - field: json.device_id - target_field: host.id - type: string - ignore_missing: true - - set: - field: host.os.type - value: windows - if: ctx?.json?.device_os == "WINDOWS" - - set: - field: host.os.type - value: linux - if: ctx?.json?.device_os == "LINUX" - - set: - field: host.os.type - value: macos - if: ctx?.json?.device_os == "MAC" - - rename: - field: json.device_name - target_field: host.hostname - ignore_missing: true - - grok: - field: host.hostname - patterns: - - '^(%{DATA:user.domain})\\(%{GREEDYDATA:host.hostname})$' - ignore_missing: true - ignore_failure: true - - set: - field: host.name - value: "{{{host.hostname}}}" - ignore_failure: true - - rename: - field: json.device_group - target_field: host.os.family - ignore_missing: true - - append: - field: host.ip - value: "{{{json.device_internal_ip}}}" - if: ctx?.json?.device_internal_ip != null - allow_duplicates: false - ignore_failure: true - - append: - field: host.ip - value: "{{{json.device_external_ip}}}" - if: ctx?.json?.device_external_ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.device_group - target_field: host.os.family - ignore_missing: true - - rename: - field: json.process_cmdline - target_field: process.command_line - ignore_missing: true - - rename: - field: json.process_guid - target_field: process.entity_id - ignore_missing: true - - rename: - field: json.process_path - target_field: process.executable - ignore_missing: true - - rename: - field: json.process_pid - target_field: process.pid - ignore_missing: true - - rename: - field: json.parent_cmdline - target_field: process.parent.command_line - ignore_missing: true - - rename: - field: json.parent_guid - target_field: process.parent.entity_id - ignore_missing: true - - rename: - field: json.parent_path - target_field: process.parent.executable - ignore_missing: true - - rename: - field: json.parent_pid - target_field: process.parent.pid - ignore_missing: true - - rename: - field: json.regmod_name - target_field: registry.path - ignore_missing: true - - append: - field: related.ip - value: - - "{{{json.device_internal_ip}}}" - - "{{{json.device_external_ip}}}" - - "{{{json.netconn_proxy_ip}}}" - - "{{{source.ip}}}" - - "{{{client.ip}}}" - allow_duplicates: false - - append: - field: related.user - value: - - "{{{json.process_username}}}" - - "{{{json.childproc_username}}}" - allow_duplicates: false - - append: - field: related.hosts - value: - - "{{{host.hostname}}}" - - "{{{user.domain}}}" - allow_duplicates: false - - script: - description: Dynamically map MD5 and SHA256 hash - lang: painless - source: | - void mapHashField(def ctx, def hashes, def key) { - for (hash in hashes) { - if (hash.length() == 32) {ctx["json"][key + "_md5"] = hash;} - if (hash.length() == 64) {ctx["json"][key + "_sha256"] = hash;} - } - } - if (ctx.json?.process_hash instanceof List) { - mapHashField(ctx, ctx.json?.process_hash, "process_hash"); - } - if (ctx.json?.parent_hash instanceof List) { - mapHashField(ctx, ctx.json?.parent_hash, "parent_hash"); - } - if (ctx.json?.filemod_hash instanceof List) { - mapHashField(ctx, ctx.json?.filemod_hash, "filemod_hash"); - } - if (ctx.json?.childproc_hash instanceof List) { - mapHashField(ctx, ctx.json?.childproc_hash, "childproc_hash"); - } - if (ctx.json?.crossproc_hash instanceof List) { - mapHashField(ctx, ctx.json?.crossproc_hash, "crossproc_hash"); - } - if (ctx.json?.scriptload_hash instanceof List) { - mapHashField(ctx, ctx.json?.scriptload_hash, "scriptload_hash"); - } - - rename: - field: json.process_hash_md5 - target_field: process.hash.md5 - ignore_missing: true - - rename: - field: json.process_hash_sha256 - target_field: process.hash.sha256 - ignore_missing: true - - rename: - field: json.parent_hash_md5 - target_field: process.parent.hash.md5 - ignore_missing: true - - rename: - field: json.parent_hash_sha256 - target_field: process.parent.hash.sha256 - ignore_missing: true - - rename: - field: json.backend_timestamp - target_field: carbon_black_cloud.endpoint_event.backend.timestamp - ignore_missing: true - - rename: - field: json.device_timestamp - target_field: carbon_black_cloud.endpoint_event.device.timestamp - ignore_missing: true - - rename: - field: json.device_os - target_field: carbon_black_cloud.endpoint_event.device.os - ignore_missing: true - - rename: - field: json.childproc_name - target_field: carbon_black_cloud.endpoint_event.childproc.name - ignore_missing: true - - rename: - field: json.org_key - target_field: carbon_black_cloud.endpoint_event.organization_key - ignore_missing: true - - rename: - field: json.process_duration - target_field: carbon_black_cloud.endpoint_event.process.duration - ignore_missing: true - - foreach: - field: json.process_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.process_publisher - target_field: carbon_black_cloud.endpoint_event.process.publisher - ignore_missing: true - - rename: - field: json.process_reputation - target_field: carbon_black_cloud.endpoint_event.process.reputation - ignore_missing: true - - rename: - field: json.process_terminated - target_field: carbon_black_cloud.endpoint_event.process.terminated - ignore_missing: true - - rename: - field: json.process_username - target_field: carbon_black_cloud.endpoint_event.process.username - ignore_missing: true - - rename: - field: json.parent_reputation - target_field: carbon_black_cloud.endpoint_event.process.parent.reputation - ignore_missing: true - - rename: - field: json.target_cmdline - target_field: carbon_black_cloud.endpoint_event.target_cmdline - ignore_missing: true - - rename: - field: json.type - target_field: carbon_black_cloud.endpoint_event.type - ignore_missing: true - -# Mapping for endpoint.event.crossproc event type - - - rename: - field: json.crossproc_action - target_field: carbon_black_cloud.endpoint_event.crossproc.action - ignore_missing: true - - rename: - field: json.crossproc_api - target_field: carbon_black_cloud.endpoint_event.crossproc.api - ignore_missing: true - - rename: - field: json.crossproc_guid - target_field: carbon_black_cloud.endpoint_event.crossproc.guid - ignore_missing: true - - rename: - field: json.crossproc_name - target_field: carbon_black_cloud.endpoint_event.crossproc.name - ignore_missing: true - - rename: - field: json.crossproc_target - target_field: carbon_black_cloud.endpoint_event.crossproc.target - ignore_missing: true - - rename: - field: json.crossproc_reputation - target_field: carbon_black_cloud.endpoint_event.crossproc.reputation - ignore_missing: true - - foreach: - field: json.crossproc_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.crossproc_publisher - target_field: carbon_black_cloud.endpoint_event.crossproc.publisher - ignore_missing: true - - rename: - field: json.crossproc_hash_md5 - target_field: carbon_black_cloud.endpoint_event.crossproc.hash.md5 - ignore_missing: true - - rename: - field: json.crossproc_hash_sha256 - target_field: carbon_black_cloud.endpoint_event.crossproc.hash.sha256 - ignore_missing: true - -# Mapping for endpoint.event.filemod event type - - - rename: - field: json.filemod_hash_md5 - target_field: file.hash.md5 - ignore_missing: true - - rename: - field: json.filemod_hash_sha256 - target_field: file.hash.sha256 - ignore_missing: true - -# Mapping for endpoint.event.fileless_scriptload event type - - - rename: - field: json.fileless_scriptload_cmdline - target_field: carbon_black_cloud.endpoint_event.fileless_scriptload.cmdline - ignore_missing: true - - rename: - field: json.fileless_scriptload_cmdline_length - target_field: carbon_black_cloud.endpoint_event.fileless_scriptload.cmdline_length - ignore_missing: true - - rename: - field: json.fileless_scriptload_hash_md5 - target_field: carbon_black_cloud.endpoint_event.fileless_scriptload.hash.md5 - ignore_missing: true - - rename: - field: json.fileless_scriptload_hash_sha256 - target_field: carbon_black_cloud.endpoint_event.fileless_scriptload.hash.sha256 - ignore_missing: true - -# Mapping for endpoint.event.moduleload event type - - - rename: - field: json.modload_md5 - target_field: dll.hash.md5 - ignore_missing: true - - rename: - field: json.modload_sha256 - target_field: dll.hash.sha256 - ignore_missing: true - - rename: - field: json.modload_effective_reputation - target_field: carbon_black_cloud.endpoint_event.modload.effective_reputation - ignore_missing: true - - rename: - field: json.modload_count - target_field: carbon_black_cloud.endpoint_event.modload.count - ignore_missing: true - - foreach: - field: json.modload_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.modload_publisher - target_field: carbon_black_cloud.endpoint_event.modload.publisher - ignore_missing: true - -# Mapping for endpoint.event.netconn_proxy event type - - - rename: - field: json.netconn_proxy_domain - target_field: carbon_black_cloud.endpoint_event.netconn.proxy.domain - ignore_missing: true - - rename: - field: json.netconn_proxy_port - target_field: carbon_black_cloud.endpoint_event.netconn.proxy.port - ignore_missing: true - - rename: - field: json.netconn_proxy_ip - target_field: carbon_black_cloud.endpoint_event.netconn.proxy.ip - ignore_missing: true - -# Mapping for endpoint.event.procstart event type - - - rename: - field: json.childproc_guid - target_field: carbon_black_cloud.endpoint_event.childproc.guid - ignore_missing: true - - rename: - field: json.childproc_name - target_field: carbon_black_cloud.endpoint_event.childproc.name - ignore_missing: true - - rename: - field: json.childproc_pid - target_field: carbon_black_cloud.endpoint_event.childproc.pid - ignore_missing: true - - foreach: - field: json.childproc_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.childproc_publisher - target_field: carbon_black_cloud.endpoint_event.childproc.publisher - ignore_missing: true - - rename: - field: json.childproc_reputation - target_field: carbon_black_cloud.endpoint_event.childproc.reputation - ignore_missing: true - - rename: - field: json.childproc_username - target_field: carbon_black_cloud.endpoint_event.childproc.username - ignore_missing: true - - rename: - field: json.childproc_hash_md5 - target_field: carbon_black_cloud.endpoint_event.childproc.hash.md5 - ignore_missing: true - - rename: - field: json.childproc_hash_sha256 - target_field: carbon_black_cloud.endpoint_event.childproc.hash.sha256 - ignore_missing: true - -# Mapping for NGAV endpoint.event.scriptload event type - - - rename: - field: json.scriptload_name - target_field: carbon_black_cloud.endpoint_event.scriptload.name - ignore_missing: true - - foreach: - field: json.scriptload_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.scriptload_publisher - target_field: carbon_black_cloud.endpoint_event.scriptload.publisher - ignore_missing: true - - rename: - field: json.scriptload_count - target_field: carbon_black_cloud.endpoint_event.scriptload.count - ignore_missing: true - - rename: - field: json.scriptload_hash_md5 - target_field: carbon_black_cloud.endpoint_event.scriptload.hash.md5 - ignore_missing: true - - rename: - field: json.scriptload_hash_sha256 - target_field: carbon_black_cloud.endpoint_event.scriptload.hash.sha256 - ignore_missing: true - - rename: - field: json.scriptload_effective_reputation - target_field: carbon_black_cloud.endpoint_event.scriptload.effective_reputation - ignore_missing: true - - rename: - field: json.scriptload_reputation - target_field: carbon_black_cloud.endpoint_event.scriptload.reputation - ignore_missing: true - - rename: - field: json.device_internal_ip - target_field: carbon_black_cloud.endpoint_event.device.internal_ip - ignore_missing: true - - rename: - field: json.device_external_ip - target_field: carbon_black_cloud.endpoint_event.device.external_ip - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - - append: - field: related.hash - value: - - "{{{process.hash.md5}}}" - - "{{{process.hash.sha256}}}" - - "{{{process.parent.hash.md5}}}" - - "{{{process.parent.hash.sha256}}}" - - "{{{file.hash.md5}}}" - - "{{{file.hash.sha256}}}" - - "{{{dll.hash.md5}}}" - - "{{{dll.hash.sha256}}}" - - "{{{carbon_black_cloud.endpoint_event.childproc.hash.md5}}}" - - "{{{carbon_black_cloud.endpoint_event.childproc.hash.sha256}}}" - - "{{{carbon_black_cloud.endpoint_event.crossproc.hash.md5}}}" - - "{{{carbon_black_cloud.endpoint_event.crossproc.hash.sha256}}}" - - "{{{carbon_black_cloud.endpoint_event.fileless_scriptload.hash.md5}}}" - - "{{{carbon_black_cloud.endpoint_event.fileless_scriptload.hash.sha256}}}" - - "{{{carbon_black_cloud.endpoint_event.scriptload.hash.md5}}}" - - "{{{carbon_black_cloud.endpoint_event.scriptload.hash.sha256}}}" - allow_duplicates: false - - script: - description: Adds all the remaining fields in fields under carbon_black_cloud.endpoint_event - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.carbon_black_cloud.endpoint_event[m.getKey()] = m.getValue(); - } - - remove: - field: - - json - - carbon_black_cloud.endpoint_event.create_time - - carbon_black_cloud.endpoint_event.device_id - - carbon_black_cloud.endpoint_event.process_hash - - carbon_black_cloud.endpoint_event.parent_hash - - carbon_black_cloud.endpoint_event.crossproc_hash - - carbon_black_cloud.endpoint_event.filemod_hash - - carbon_black_cloud.endpoint_event.childproc_hash - - carbon_black_cloud.endpoint_event.modload_hash - - carbon_black_cloud.endpoint_event.scriptload_hash - - carbon_black_cloud.endpoint_event.netconn_inbound - - carbon_black_cloud.endpoint_event.netconn_protocol - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Remove duplicate values - lang: painless - source: | - if (ctx?.related?.user != null) { - ctx.related.user = new HashSet(ctx.related.user) - } - if (ctx?.related?.hash != null) { - ctx.related.hash = new HashSet(ctx.related.hash) - } - if (ctx?.related?.ip != null) { - ctx.related.ip = new HashSet(ctx.related.ip) - } -on_failure: - - set: - field: error.message - value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/agent.yml b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/base-fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/base-fields.yml deleted file mode 100755 index 9b3253d2db..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module. - value: carbon_black_cloud -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: carbon_black_cloud.endpoint_event diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/ecs.yml b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/ecs.yml deleted file mode 100755 index 67b02cba96..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/ecs.yml +++ /dev/null @@ -1,200 +0,0 @@ -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: Port of the client. - name: client.port - type: long -- description: MD5 hash. - name: dll.hash.md5 - type: keyword -- description: SHA256 hash. - name: dll.hash.sha256 - type: keyword -- description: Full file path of the library. - name: dll.path - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: |- - Reason why this event happened, according to the source. - This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - name: event.reason - type: keyword -- description: MD5 hash. - name: file.hash.md5 - type: keyword -- description: SHA256 hash. - name: file.hash.sha256 - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - multi_fields: - - name: text - type: match_only_text - name: file.path - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - Unique host id. - As hostname is not always unique, use values that are meaningful in your environment. - Example: The current usage of `beat.name`. - name: host.id - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: OS family (such as redhat, debian, freebsd, windows). - name: host.os.family - type: keyword -- description: Operating system name, without the version. - multi_fields: - - name: text - type: match_only_text - name: host.os.name - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - Full command line that started the process, including the absolute path to the executable, and all arguments. - Some arguments may be filtered to protect sensitive information. - multi_fields: - - name: text - type: match_only_text - name: process.command_line - type: wildcard -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.entity_id - type: keyword -- description: Absolute path to the process executable. - multi_fields: - - name: text - type: match_only_text - name: process.executable - type: keyword -- description: MD5 hash. - name: process.hash.md5 - type: keyword -- description: SHA256 hash. - name: process.hash.sha256 - type: keyword -- description: |- - Full command line that started the process, including the absolute path to the executable, and all arguments. - Some arguments may be filtered to protect sensitive information. - multi_fields: - - name: text - type: match_only_text - name: process.parent.command_line - type: wildcard -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.parent.entity_id - type: keyword -- description: Absolute path to the process executable. - multi_fields: - - name: text - type: match_only_text - name: process.parent.executable - type: keyword -- description: MD5 hash. - name: process.parent.hash.md5 - type: keyword -- description: SHA256 hash. - name: process.parent.hash.sha256 - type: keyword -- description: Process id. - name: process.parent.pid - type: long -- description: Process id. - name: process.pid - type: long -- description: Full path, including hive, key and value - name: registry.path - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/fields.yml deleted file mode 100755 index 199988ffb6..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/fields/fields.yml +++ /dev/null @@ -1,239 +0,0 @@ -- name: carbon_black_cloud.endpoint_event - type: group - fields: - - name: alert_id - type: keyword - description: The ID of the Alert this event is associated with. - - name: backend - type: group - fields: - - name: timestamp - type: keyword - description: Time when the backend received the batch of events. - - name: childproc - type: group - fields: - - name: guid - type: keyword - description: Unique ID of the child process. - - name: hash - type: group - fields: - - name: md5 - type: keyword - description: Cryptographic MD5 hashes of the executable file backing the child process. - - name: sha256 - type: keyword - description: Cryptographic SHA256 hashes of the executable file backing the child process. - - name: name - type: keyword - description: Full path to the target of the crossproc event on the device's local file system. - - name: pid - type: long - description: OS-reported Process ID of the child process. - - name: publisher - type: group - description: Signature entry for the childproc as reported by the endpoint. - fields: - - name: name - type: keyword - description: The name of the publisher. - - name: state - type: keyword - description: The state of the publisher. - - name: reputation - type: keyword - description: Carbon Black Cloud Reputation string for the childproc. - - name: username - type: keyword - description: The username associated with the user context that the child process was started under. - - name: crossproc - type: group - fields: - - name: action - type: keyword - description: The action taken on cross-process. - - name: api - type: keyword - description: Name of the operating system API called by the actor process. - - name: guid - type: keyword - description: Unique ID of the cross process. - - name: hash - type: group - fields: - - name: md5 - type: keyword - description: Cryptographic MD5 hashes of the target of the crossproc event. - - name: sha256 - type: keyword - description: Cryptographic SHA256 hashes of the target of the crossproc event. - - name: name - type: keyword - description: Full path to the target of the crossproc event on the device's local file system. - - name: publisher - type: group - description: Signature entry for the crossproc as reported by the endpoint. - fields: - - name: name - type: keyword - description: The name of the publisher. - - name: state - type: keyword - description: The state of the publisher. - - name: reputation - type: keyword - description: Carbon Black Cloud Reputation string for the crossproc. - - name: target - type: boolean - description: True if the process was the target of the cross-process event; false if the process was the actor. - - name: device - type: group - fields: - - name: os - type: keyword - description: Os name. - - name: timestamp - type: keyword - description: Time seen on sensor. - - name: internal_ip - type: ip - description: Internal IP of the device. - - name: external_ip - type: ip - description: External IP of the device. - - name: event_origin - type: keyword - description: Indicates which product the event came from. "EDR" indicates the event originated from Enterprise EDR. "NGAV" indicates the event originated from Endpoint Standard. - - name: fileless_scriptload - type: group - fields: - - name: cmdline - type: keyword - description: Deobfuscated script content run in a fileless context by the process. - - name: cmdline_length - type: keyword - description: Character count of the deobfuscated script content run in a fileless context. - - name: hash - type: group - fields: - - name: md5 - type: keyword - description: MD5 hash of the deobfuscated script content run by the process in a fileless context. - - name: sha256 - type: keyword - description: SHA-256 hash of the deobfuscated script content run by the process in a fileless context. - - name: modload - type: group - fields: - - name: count - type: long - description: Count of modload events reported by the sensor since last initialization. - - name: effective_reputation - type: keyword - description: Effective reputation(s) of the loaded module(s); applied by the sensor when the event occurred. - - name: publisher - type: group - description: Signature entry for the moduleload as reported by the endpoint. - fields: - - name: name - type: keyword - description: The name of the publisher. - - name: state - type: keyword - description: The state of the publisher. - - name: netconn - type: group - fields: - - name: proxy - type: group - fields: - - name: domain - type: keyword - description: DNS name associated with the "proxy" end of this network connection; may be empty if the name cannot be inferred or the connection is made direct to/from a proxy IP address. - - name: ip - type: keyword - description: IPv4 or IPv6 address in string format associated with the "proxy" end of this network connection. - - name: port - type: keyword - description: UDP/TCP port number associated with the "proxy" end of this network connection. - - name: organization_key - type: keyword - description: The organization key associated with the console instance. - - name: process - type: group - fields: - - name: duration - type: long - description: The time difference in seconds between the process start and process terminate event. - - name: parent - type: group - fields: - - name: reputation - type: keyword - description: Reputation of the parent process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. - - name: publisher - type: group - description: Signature entry for the process as reported by the endpoint. - fields: - - name: name - type: keyword - description: The name of the publisher. - - name: state - type: keyword - description: The state of the publisher. - - name: reputation - type: keyword - description: Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. - - name: terminated - type: boolean - description: True if process was terminated elase false. - - name: username - type: keyword - description: The username associated with the user context that this process was started under. - - name: schema - type: long - description: The schema version. The current schema version is "1". This schema version will only be incremented if the field definitions are changed in a backwards-incompatible way. - - name: scriptload - type: group - fields: - - name: count - type: long - description: Count of scriptload events across all processes reported by the sensor since last initialization. - - name: effective_reputation - type: keyword - description: Effective reputation(s) of the script file(s) loaded at process launch; applied by the sensor when the event occurred. - - name: hash - type: group - fields: - - name: md5 - type: keyword - description: Cryptographic MD5 hashes of the target of the scriptload event. - - name: sha256 - type: keyword - description: Cryptographic SHA256 hashes of the target of the scriptload event. - - name: name - type: keyword - description: Full path to the target of the crossproc event on the device's local file system. - - name: publisher - type: group - description: Signature entry for the scriptload as reported by the endpoint. - fields: - - name: name - type: keyword - description: The name of the publisher. - - name: state - type: keyword - description: The state of the publisher. - - name: reputation - type: keyword - description: Carbon Black Cloud Reputation string for the scriptload. - - name: sensor_action - type: keyword - description: The sensor action taken on event. - - name: target_cmdline - type: keyword - description: Process command line associated with the target process. - - name: type - type: keyword - description: The event type. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/manifest.yml b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/manifest.yml deleted file mode 100755 index 0f52e82022..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/manifest.yml +++ /dev/null @@ -1,48 +0,0 @@ -title: Endpoint Event -type: logs -streams: - - input: aws-s3 - title: Collect endpoint events from Carbon Black Cloud - description: Collect endpoint events from Carbon Black Cloud. - template_path: aws-s3.yml.hbs - vars: - - name: bucket_list_prefix - type: text - title: Bucket Prefix - description: Prefix to apply for the list request to the S3 bucket. - multi: false - required: true - show_user: true - - name: interval - type: text - title: Interval - description: Interval to fetch endpoint events from AWS S3 bucket. - multi: false - required: true - show_user: true - default: 1m - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - carbon_black_cloud-endpoint-event - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/sample_event.json b/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/sample_event.json deleted file mode 100755 index 958377158a..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/endpoint_event/sample_event.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "process": { - "parent": { - "pid": 1684, - "entity_id": "XXXXXXXX-003d902d-00000694-00000000-1d7540221dedd62", - "command_line": "C:\\WindowsAzure\\GuestAgent_2.7.41491.1010_2021-05-11_233023\\GuestAgent\\WindowsAzureGuestAgent.exe", - "executable": "c:\\windowsazure\\guestagent_2.7.41491.1010_2021-05-11_233023\\guestagent\\windowsazureguestagent.exe", - "hash": { - "sha256": "44a1975b2197484bb22a0eb673e67e7ee9ec20265e9f6347f5e06b6447ac82c5", - "md5": "03dd698da2671383c9b4f868c9931879" - } - }, - "pid": 4880, - "entity_id": "XXXXXXXX-003d902d-00001310-00000000-1d81e748c4adb37", - "command_line": "\"route.exe\" print", - "executable": "c:\\windows\\system32\\route.exe", - "hash": { - "sha256": "9e9c7696859b94b1c33a532fa4d5c648226cf3361121dd899e502b8949fb11a6", - "md5": "2498272dc48446891182747428d02a30" - } - }, - "ecs": { - "version": "8.0.0" - }, - "carbon_black_cloud": { - "endpoint_event": { - "schema": 1, - "event_origin": "EDR", - "process": { - "duration": 2, - "parent": { - "reputation": "REP_RESOLVING" - }, - "publisher": [ - { - "name": "Microsoft Windows", - "state": [ - "FILE_SIGNATURE_STATE_SIGNED", - "FILE_SIGNATURE_STATE_VERIFIED", - "FILE_SIGNATURE_STATE_TRUSTED", - "FILE_SIGNATURE_STATE_OS", - "FILE_SIGNATURE_STATE_CATALOG_SIGNED" - ] - } - ], - "reputation": "REP_RESOLVING", - "terminated": true, - "username": "NT AUTHORITY\\SYSTEM" - }, - "organization_key": "XXXXXXXX", - "backend": { - "timestamp": "2022-02-10 11:52:50 +0000 UTC" - }, - "target_cmdline": "\"route.exe\" print", - "type": "endpoint.event.procend", - "device": { - "os": "WINDOWS", - "timestamp": "2022-02-10 11:51:35.0684097 +0000 UTC", - "external_ip": "67.43.156.12" - }, - "sensor_action": "ACTION_ALLOW" - } - }, - "host": { - "hostname": "client-cb2", - "id": "4034605", - "os": { - "type": "windows" - }, - "ip": [ - "67.43.156.13" - ] - }, - "event": { - "action": "ACTION_PROCESS_TERMINATE", - "orignal": "{\"type\":\"endpoint.event.procend\",\"process_guid\":\"XXXXXXXX-003d902d-00001310-00000000-1d81e748c4adb37\",\"parent_guid\":\"XXXXXXXX-003d902d-00000694-00000000-1d7540221dedd62\",\"backend_timestamp\":\"2022-02-10 11:52:50 +0000 UTC\",\"org_key\":\"XXXXXXXX\",\"device_id\":\"4034605\",\"device_name\":\"client-cb2\",\"device_external_ip\":\"67.43.156.13\",\"device_os\":\"WINDOWS\",\"device_group\":\"\",\"action\":\"ACTION_PROCESS_TERMINATE\",\"schema\":1,\"device_timestamp\":\"2022-02-10 11:51:35.0684097 +0000 UTC\",\"process_terminated\":true,\"process_duration\":2,\"process_reputation\":\"REP_RESOLVING\",\"parent_reputation\":\"REP_RESOLVING\",\"process_pid\":4880,\"parent_pid\":1684,\"process_publisher\":[{\"name\":\"Microsoft Windows\",\"state\":\"FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED\"}],\"process_path\":\"c:\\\\windows\\\\system32\\\\route.exe\",\"parent_path\":\"c:\\\\windowsazure\\\\guestagent_2.7.41491.1010_2021-05-11_233023\\\\guestagent\\\\windowsazureguestagent.exe\",\"process_hash\":[\"2498272dc48446891182747428d02a30\",\"9e9c7696859b94b1c33a532fa4d5c648226cf3361121dd899e502b8949fb11a6\"],\"parent_hash\":[\"03dd698da2671383c9b4f868c9931879\",\"44a1975b2197484bb22a0eb673e67e7ee9ec20265e9f6347f5e06b6447ac82c5\"],\"process_cmdline\":\"\\\"route.exe\\\" print\",\"parent_cmdline\":\"C:\\\\WindowsAzure\\\\GuestAgent_2.7.41491.1010_2021-05-11_233023\\\\GuestAgent\\\\WindowsAzureGuestAgent.exe\",\"process_username\":\"NT AUTHORITY\\\\SYSTEM\",\"sensor_action\":\"ACTION_ALLOW\",\"event_origin\":\"EDR\",\"target_cmdline\":\"\\\"route.exe\\\" print\"}" - }, - "data_stream": { - "dataset": "carbon_black_cloud.endpoint_event", - "namespace": "ep", - "type": "logs" - }, - "elastic_agent": { - "id": "3b20ea47-9610-412d-97e3-47cd19b7e4d5", - "snapshot": true, - "version": "8.0.0" - }, - "input": { - "type": "aws-s3" - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-endpoint-event" - ] -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/agent/stream/aws-s3.yml.hbs b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/agent/stream/aws-s3.yml.hbs deleted file mode 100755 index e02c596614..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/agent/stream/aws-s3.yml.hbs +++ /dev/null @@ -1,24 +0,0 @@ -bucket_arn: {{bucket_arn}} -number_of_workers: {{number_of_workers}} -bucket_list_interval: {{interval}} -access_key_id: {{access_key_id}} -secret_access_key: {{secret_access_key}} -bucket_list_prefix: {{bucket_list_prefix}} -expand_event_list_from_field: Records -{{#if proxy_url}} -proxy_url: {{proxy_url}} -{{/if}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 1699bc69c1..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,293 +0,0 @@ ---- -description: Pipeline for parsing Carbon Black Cloud watchlist hit. -processors: - - set: - field: ecs.version - value: '8.0.0' - - set: - field: event.kind - value: event - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - ignore_failure: true - - date: - field: json.create_time - target_field: "@timestamp" - ignore_failure: true - formats: - - ISO8601 - - rename: - field: json.severity - target_field: event.severity - ignore_missing: true - - convert: - field: json.device_id - target_field: host.id - type: string - ignore_missing: true - - set: - field: host.os.type - value: windows - if: ctx?.json?.device_os == "WINDOWS" - - set: - field: host.os.type - value: linux - if: ctx?.json?.device_os == "LINUX" - - set: - field: host.os.type - value: macos - if: ctx?.json?.device_os == "MAC" - - rename: - field: json.device_os_version - target_field: host.os.version - ignore_missing: true - - rename: - field: json.device_name - target_field: host.hostname - ignore_missing: true - - grok: - field: host.hostname - patterns: - - '^(%{DATA:user.domain})\\(%{GREEDYDATA:host.hostname})$' - ignore_missing: true - ignore_failure: true - - set: - field: host.name - value: "{{{host.hostname}}}" - ignore_failure: true - - append: - field: host.ip - value: "{{{json.device_internal_ip}}}" - if: ctx?.json?.device_internal_ip != null - allow_duplicates: false - ignore_failure: true - - append: - field: host.ip - value: "{{{json.device_external_ip}}}" - if: ctx?.json?.device_external_ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.process_cmdline - target_field: process.command_line - ignore_missing: true - - rename: - field: json.process_guid - target_field: process.entity_id - ignore_missing: true - - rename: - field: json.process_path - target_field: process.executable - ignore_missing: true - - rename: - field: json.process_pid - target_field: process.pid - ignore_missing: true - - rename: - field: json.parent_cmdline - target_field: process.parent.command_line - ignore_missing: true - - rename: - field: json.parent_guid - target_field: process.parent.entity_id - ignore_missing: true - - rename: - field: json.parent_path - target_field: process.parent.executable - ignore_missing: true - - rename: - field: json.parent_pid - target_field: process.parent.pid - ignore_missing: true - - append: - field: related.ip - value: - - "{{{json.device_internal_ip}}}" - - "{{{json.device_external_ip}}}" - allow_duplicates: false - - append: - field: related.user - value: - - "{{{json.parent_username}}}" - - "{{{json.process_username}}}" - allow_duplicates: false - - append: - field: related.hosts - value: - - "{{{host.hostname}}}" - - "{{{user.domain}}}" - allow_duplicates: false - - script: - description: Dynamically map MD5 and SHA256 hash - lang: painless - source: | - void mapHashField(def ctx, def hashes, def key) { - for (hash in hashes) { - if (hash.length() == 32) {ctx["json"][key + "_md5"] = hash;} - if (hash.length() == 64) {ctx["json"][key + "_sha256"] = hash;} - } - } - if (ctx.json?.process_hash instanceof List) { - mapHashField(ctx, ctx.json?.process_hash, "process_hash"); - } - if (ctx.json?.parent_hash instanceof List) { - mapHashField(ctx, ctx.json?.parent_hash, "parent_hash"); - } - - rename: - field: json.process_hash_md5 - target_field: process.hash.md5 - ignore_missing: true - - rename: - field: json.process_hash_sha256 - target_field: process.hash.sha256 - ignore_missing: true - - rename: - field: json.parent_hash_md5 - target_field: process.parent.hash.md5 - ignore_missing: true - - rename: - field: json.parent_hash_sha256 - target_field: process.parent.hash.sha256 - ignore_missing: true - - append: - field: related.hash - value: - - "{{{process.hash.md5}}}" - - "{{{process.hash.sha256}}}" - - "{{{process.parent.hash.md5}}}" - - "{{{process.parent.hash.sha256}}}" - allow_duplicates: false - - rename: - field: json.device_os - target_field: carbon_black_cloud.watchlist_hit.device.os - ignore_missing: true - - rename: - field: json.device_internal_ip - target_field: carbon_black_cloud.watchlist_hit.device.internal_ip - ignore_missing: true - - rename: - field: json.device_external_ip - target_field: carbon_black_cloud.watchlist_hit.device.external_ip - ignore_missing: true - - rename: - field: json.ioc_hit - target_field: carbon_black_cloud.watchlist_hit.ioc.hit - ignore_missing: true - - rename: - field: json.ioc_id - target_field: carbon_black_cloud.watchlist_hit.ioc.id - ignore_missing: true - - rename: - field: json.org_key - target_field: carbon_black_cloud.watchlist_hit.organization_key - ignore_missing: true - - foreach: - field: json.parent_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.parent_publisher - target_field: carbon_black_cloud.watchlist_hit.process.parent.publisher - ignore_missing: true - - rename: - field: json.parent_reputation - target_field: carbon_black_cloud.watchlist_hit.process.parent.reputation - ignore_missing: true - - rename: - field: json.parent_username - target_field: carbon_black_cloud.watchlist_hit.process.parent.username - ignore_missing: true - - foreach: - field: json.process_publisher - processor: - split: - field: _ingest._value.state - separator: " \\| " - ignore_missing: true - ignore_missing: true - ignore_failure: true - - rename: - field: json.process_publisher - target_field: carbon_black_cloud.watchlist_hit.process.publisher - ignore_missing: true - - rename: - field: json.process_reputation - target_field: carbon_black_cloud.watchlist_hit.process.reputation - ignore_missing: true - - rename: - field: json.process_username - target_field: carbon_black_cloud.watchlist_hit.process.username - ignore_missing: true - - rename: - field: json.report_id - target_field: carbon_black_cloud.watchlist_hit.report.id - ignore_missing: true - - rename: - field: json.report_name - target_field: carbon_black_cloud.watchlist_hit.report.name - ignore_missing: true - - rename: - field: json.report_tags - target_field: carbon_black_cloud.watchlist_hit.report.tags - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - - script: - description: Adds all the remaining fields in fields under carbon_black_cloud.watchlist_hit - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.carbon_black_cloud.watchlist_hit[m.getKey()] = m.getValue(); - } - - remove: - field: - - json - - carbon_black_cloud.watchlist_hit.create_time - - carbon_black_cloud.watchlist_hit.device_id - - carbon_black_cloud.watchlist_hit.process_hash - - carbon_black_cloud.watchlist_hit.parent_hash - ignore_missing: true - - script: - description: Remove duplicate values - lang: painless - source: | - if (ctx?.related?.user != null) { - ctx.related.user = new HashSet(ctx.related.user) - } - if (ctx?.related?.hash != null) { - ctx.related.hash = new HashSet(ctx.related.hash) - } -on_failure: - - set: - field: error.message - value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/agent.yml b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/base-fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/base-fields.yml deleted file mode 100755 index 89df536282..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module. - value: carbon_black_cloud -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: carbon_black_cloud.watchlist_hit diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/ecs.yml b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/ecs.yml deleted file mode 100755 index dd43f31d74..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/ecs.yml +++ /dev/null @@ -1,134 +0,0 @@ -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - Unique host id. - As hostname is not always unique, use values that are meaningful in your environment. - Example: The current usage of `beat.name`. - name: host.id - type: keyword -- description: Host ip addresses. - name: host.ip - type: ip -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: |- - Use the `os.type` field to categorize the operating system into one of the broad commercial families. - One of these following values should be used (lowercase): linux, macos, unix, windows. - If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. - name: host.os.type - type: keyword -- description: |- - Full command line that started the process, including the absolute path to the executable, and all arguments. - Some arguments may be filtered to protect sensitive information. - multi_fields: - - name: text - type: match_only_text - name: process.command_line - type: wildcard -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.entity_id - type: keyword -- description: Absolute path to the process executable. - multi_fields: - - name: text - type: match_only_text - name: process.executable - type: keyword -- description: MD5 hash. - name: process.hash.md5 - type: keyword -- description: SHA256 hash. - name: process.hash.sha256 - type: keyword -- description: |- - Full command line that started the process, including the absolute path to the executable, and all arguments. - Some arguments may be filtered to protect sensitive information. - multi_fields: - - name: text - type: match_only_text - name: process.parent.command_line - type: wildcard -- description: |- - Unique identifier for the process. - The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. - Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - name: process.parent.entity_id - type: keyword -- description: Absolute path to the process executable. - multi_fields: - - name: text - type: match_only_text - name: process.parent.executable - type: keyword -- description: MD5 hash. - name: process.parent.hash.md5 - type: keyword -- description: SHA256 hash. - name: process.parent.hash.sha256 - type: keyword -- description: Process id. - name: process.parent.pid - type: long -- description: Process id. - name: process.pid - type: long -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: user.domain - type: keyword diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/fields.yml b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/fields.yml deleted file mode 100755 index 25cb25005e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/fields/fields.yml +++ /dev/null @@ -1,89 +0,0 @@ -- name: carbon_black_cloud.watchlist_hit - type: group - fields: - - name: device - type: group - fields: - - name: os - type: keyword - description: OS Type of device (Windows/OSX/Linux). - - name: internal_ip - type: ip - description: Internal IP of the device. - - name: external_ip - type: ip - description: External IP of the device. - - name: ioc - type: group - fields: - - name: field - type: keyword - description: Field the IOC hit contains. - - name: hit - type: keyword - description: IOC field value, or IOC query that matches. - - name: id - type: keyword - description: ID of the IOC that caused the hit. - - name: organization_key - type: keyword - description: The organization key associated with the console instance. - - name: process - type: group - fields: - - name: parent - type: group - fields: - - name: publisher - type: group - description: signature entry for the process as reported by the endpoint. - fields: - - name: name - type: keyword - description: The name of the publisher. - - name: state - type: keyword - description: The state of the publisher. - - name: reputation - type: keyword - description: Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. - - name: username - type: keyword - description: The username associated with the user context that this process was started under. - - name: publisher - type: group - description: signature entry for the process as reported by the endpoint. - - name: reputation - type: keyword - description: Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. - - name: username - type: keyword - description: The username associated with the user context that this process was started under. - - name: report - type: group - fields: - - name: id - type: keyword - description: ID of the watchlist report(s) that detected a hit on the process. - - name: name - type: keyword - description: Name of the watchlist report(s) that detected a hit on the process. - - name: tags - type: keyword - description: List of tags associated with the report(s) that detected a hit on the process. - - name: schema - type: long - description: Schema version. - - name: type - type: keyword - description: The watchlist hit type. - - name: watchlists - type: group - description: List of watchlists that contain the report of the ioc hit. - fields: - - name: id - type: keyword - description: The ID of the watchlists. - - name: name - type: keyword - description: The name of the watchlists. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/manifest.yml b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/manifest.yml deleted file mode 100755 index 7782458210..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/manifest.yml +++ /dev/null @@ -1,48 +0,0 @@ -title: Watchlist Hit -type: logs -streams: - - input: aws-s3 - title: Collect watchlist hit from Carbon Black Cloud - description: Collect watchlist hit from Carbon Black Cloud. - template_path: aws-s3.yml.hbs - vars: - - name: bucket_list_prefix - type: text - title: Bucket Prefix - description: Prefix to apply for the list request to the S3 bucket. - multi: false - required: true - show_user: true - - name: interval - type: text - title: Interval - description: Interval to fetch watchlist hit from AWS S3 bucket. - multi: false - required: true - show_user: true - default: 1m - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - carbon_black_cloud-watchlist-hit - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/sample_event.json b/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/sample_event.json deleted file mode 100755 index 0a5e6c32fb..0000000000 --- a/packages/carbon_black_cloud/1.0.3/data_stream/watchlist_hit/sample_event.json +++ /dev/null @@ -1,130 +0,0 @@ -{ - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-watchlist-hit" - ], - "input": { - "type": "aws-s3" - }, - "data_stream": { - "namespace": "default", - "type": "logs", - "dataset": "carbon_black_cloud.watchlist_hit" - }, - "agent": { - "id": "e0d5f508-9616-400f-b26b-bb1aa6638b80", - "type": "filebeat", - "version": "8.0.0" - }, - "ecs": { - "version": "8.0.0" - }, - "process": { - "parent": { - "pid": 4076, - "entity_id": "7DESJ9GN-00442a47-00000fec-00000000-1d81ed87d4655d1", - "command_line": "C:\\WINDOWS\\system32\\cmd.exe /c \"sc query aella_conf | findstr RUNNING \u003e null\"", - "executable": "c:\\windows\\syswow64\\cmd.exe", - "hash": { - "sha256": "4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22", - "md5": "d0fce3afa6aa1d58ce9fa336cc2b675b" - } - }, - "pid": 7516, - "entity_id": "7DESJ9GN-00442a47-00001d5c-00000000-1d81ed87d63d2c6", - "command_line": "sc query aella_conf ", - "executable": "c:\\windows\\syswow64\\sc.exe", - "hash": { - "sha256": "4fe6d9eb8109fb79ff645138de7cff37906867aade589bd68afa503a9ab3cfb2", - "md5": "d9d7684b8431a0d10d0e76fe9f5ffec8" - } - }, - "carbon_black_cloud": { - "watchlist_hit": { - "schema": 1, - "process": { - "parent": { - "publisher": [ - { - "name": "Microsoft Windows", - "state": [ - "FILE_SIGNATURE_STATE_SIGNED", - "FILE_SIGNATURE_STATE_VERIFIED", - "FILE_SIGNATURE_STATE_TRUSTED", - "FILE_SIGNATURE_STATE_OS", - "FILE_SIGNATURE_STATE_CATALOG_SIGNED" - ] - } - ], - "reputation": "REP_WHITE", - "username": "NT AUTHORITY\\SYSTEM" - }, - "publisher": [ - { - "name": "Microsoft Windows", - "state": [ - "FILE_SIGNATURE_STATE_SIGNED", - "FILE_SIGNATURE_STATE_VERIFIED", - "FILE_SIGNATURE_STATE_TRUSTED", - "FILE_SIGNATURE_STATE_OS", - "FILE_SIGNATURE_STATE_CATALOG_SIGNED" - ] - } - ], - "reputation": "REP_WHITE", - "username": "NT AUTHORITY\\SYSTEM" - }, - "organization_key": "xxxxxxxx", - "report": { - "name": "Discovery - System Service Discovery Detected", - "id": "CFnKBKLTv6hUkBGFobRdg-565571", - "tags": [ - "attack", - "attackframework", - "threathunting", - "hunting", - "t1007", - "recon", - "discovery", - "windows" - ] - }, - "watchlists": [ - { - "name": "ATT\u0026CK Framework", - "id": "P5f9AW29TGmTOvBW156Cig" - } - ], - "type": "watchlist.hit", - "ioc": { - "hit": "((process_name:sc.exe -parent_name:svchost.exe) AND process_cmdline:query) -enriched:true", - "id": "565571-0" - }, - "device": { - "internal_ip": "10.10.156.12", - "external_ip": "67.43.156.12", - "os": "WINDOWS" - } - } - }, - "host": { - "hostname": "Carbonblack-win1", - "os": { - "type": "windows" - }, - "ip": [ - "10.10.156.12", - "67.43.156.12" - ], - "id": "4467271" - }, - "event": { - "kind": "event", - "severity": 3, - "agent_id_status": "verified", - "ingested": "2022-02-17T07:23:31Z", - "original": "{\"schema\":1,\"create_time\":\"2022-02-10T23:54:32.449Z\",\"device_external_ip\":\"205.234.30.196\",\"device_id\":4467271,\"device_internal_ip\":\"10.33.4.214\",\"device_name\":\"Carbonblack-win1\",\"device_os\":\"WINDOWS\",\"ioc_hit\":\"((process_name:sc.exe -parent_name:svchost.exe) AND process_cmdline:query) -enriched:true\",\"ioc_id\":\"565571-0\",\"org_key\":\"7DESJ9GN\",\"parent_cmdline\":\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe /c \\\"sc query aella_conf | findstr RUNNING \\u003e null\\\"\",\"parent_guid\":\"7DESJ9GN-00442a47-00000fec-00000000-1d81ed87d4655d1\",\"parent_hash\":[\"d0fce3afa6aa1d58ce9fa336cc2b675b\",\"4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22\"],\"parent_path\":\"c:\\\\windows\\\\syswow64\\\\cmd.exe\",\"parent_pid\":4076,\"parent_publisher\":[{\"name\":\"Microsoft Windows\",\"state\":\"FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED\"}],\"parent_reputation\":\"REP_WHITE\",\"parent_username\":\"NT AUTHORITY\\\\SYSTEM\",\"process_cmdline\":\"sc query aella_conf \",\"process_guid\":\"7DESJ9GN-00442a47-00001d5c-00000000-1d81ed87d63d2c6\",\"process_hash\":[\"d9d7684b8431a0d10d0e76fe9f5ffec8\",\"4fe6d9eb8109fb79ff645138de7cff37906867aade589bd68afa503a9ab3cfb2\"],\"process_path\":\"c:\\\\windows\\\\syswow64\\\\sc.exe\",\"process_pid\":7516,\"process_publisher\":[{\"name\":\"Microsoft Windows\",\"state\":\"FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED\"}],\"process_reputation\":\"REP_WHITE\",\"process_username\":\"NT AUTHORITY\\\\SYSTEM\",\"report_id\":\"CFnKBKLTv6hUkBGFobRdg-565571\",\"report_name\":\"Discovery - System Service Discovery Detected\",\"report_tags\":[\"attack\",\"attackframework\",\"threathunting\",\"hunting\",\"t1007\",\"recon\",\"discovery\",\"windows\"],\"severity\":3,\"type\":\"watchlist.hit\",\"watchlists\":[{\"id\":\"P5f9AW29TGmTOvBW156Cig\",\"name\":\"ATT\\u0026CK Framework\"}]}", - "dataset": "carbon_black_cloud.watchlist_hit" - } -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/docs/README.md b/packages/carbon_black_cloud/1.0.3/docs/README.md deleted file mode 100755 index 62c93e153b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/docs/README.md +++ /dev/null @@ -1,1047 +0,0 @@ -# VMware Carbon Black Cloud - -The VMware Carbon Black Cloud integration collects and parses data from the Carbon Black Cloud REST APIs and AWS S3 bucket. - -## Compatibility - -This module has been tested against `Alerts API (v6)`, `Audit Log Events (v3)` and `Vulnerability Assessment (v1)`. - -## Requirements - -### In order to ingest data from the AWS S3 bucket you must: -1. Configure the [Data Forwarder](https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-F68F63DD-2271-4088-82C9-71D675CD0535.html) to ingest data into an AWS S3 bucket. -2. Create an [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys). - - -### In order to ingest data from the APIs you must generate API keys and API Secret Keys: -1. In Carbon Black Cloud, On the left navigation pane, click **Settings > API Access**. -2. Click Add API Key. -3. Give the API key a unique name and description. - - Select the appropriate access level type. Please check required Access Levels & Permissions for integration in below table. - **Note:** To use a custom access level, select Custom from the Access Level type drop-down menu and specify the Custom Access Level. - - Optional: Add authorized IP addresses. - - You can restrict the use of an API key to a specific set of IP addresses for security reasons. - **Note:** Authorized IP addresses are not available with Custom keys. -4. To apply the changes, click Save. - -#### Access Levels & Permissions -- The following tables indicate which type of API Key access level is required. If the type is Custom then the permission that is required will also be included. - -| Data stream | Access Level and Permissions | -| --------------------------- | ------------------------------------------ | -| Audit | API | -| Alert | Custom orgs.alerts (Read) | -| Asset Vulnerability Summary | Custom vulnerabilityAssessment.data (Read) | - - -## Note - -- The alert data stream has a 15-minute delay to ensure that no occurrences are missed. - -## Logs - -### Audit - -This is the `audit` dataset. - -An example event for `audit` looks as following: - -```json -{ - "@timestamp": "2022-02-10T16:04:30.263Z", - "agent": { - "ephemeral_id": "6472e86c-fc7c-478a-a6fd-12ed19fe05c9", - "hostname": "docker-fleet-agent", - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.17.0" - }, - "carbon_black_cloud": { - "audit": { - "flagged": false, - "verbose": false - } - }, - "client": { - "ip": "10.10.10.10", - "user": { - "id": "abc@demo.com" - } - }, - "data_stream": { - "dataset": "carbon_black_cloud.audit", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "snapshot": false, - "version": "7.17.0" - }, - "event": { - "agent_id_status": "verified", - "created": "2022-04-14T11:48:30.094Z", - "dataset": "carbon_black_cloud.audit", - "id": "2122f8ce8xxxxxxxxxxxxx", - "ingested": "2022-04-14T11:48:31Z", - "kind": "event", - "original": "{\"clientIp\":\"10.10.10.10\",\"description\":\"Logged in successfully\",\"eventId\":\"2122f8ce8xxxxxxxxxxxxx\",\"eventTime\":1644509070263,\"flagged\":false,\"loginName\":\"abc@demo.com\",\"orgName\":\"cb-xxxx-xxxx.com\",\"requestUrl\":null,\"verbose\":false}", - "outcome": "success", - "reason": "Logged in successfully" - }, - "input": { - "type": "httpjson" - }, - "organization": { - "name": "cb-xxxx-xxxx.com" - }, - "related": { - "ip": [ - "10.10.10.10" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-audit" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| carbon_black_cloud.audit.flagged | true if action is failed otherwise false. | boolean | -| carbon_black_cloud.audit.verbose | true if verbose audit log otherwise false. | boolean | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.user.id | Unique identifier of the user. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset. | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.module | Event module. | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| organization.name | Organization name. | keyword | -| organization.name.text | Multi-field of `organization.name`. | match_only_text | -| related.ip | All of the IPs seen on your event. | ip | -| tags | List of keywords used to tag each event. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.original.text | Multi-field of `url.original`. | match_only_text | - - -### Alert - -This is the `alert` dataset. - -An example event for `alert` looks as following: - -```json -{ - "@timestamp": "2020-11-17T22:05:13.000Z", - "agent": { - "ephemeral_id": "56053d91-103c-4c77-8f15-0a1006a80102", - "hostname": "docker-fleet-agent", - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.17.0" - }, - "carbon_black_cloud": { - "alert": { - "category": "warning", - "device": { - "external_ip": "81.2.69.143", - "internal_ip": "81.2.69.144", - "location": "UNKNOWN", - "os": "WINDOWS" - }, - "last_update_time": "2020-11-17T22:05:13Z", - "legacy_alert_id": "C8EB7306-AF26-4A9A-B677-814B3AF69720", - "organization_key": "ABCD6X3T", - "policy": { - "applied": "APPLIED", - "id": 6997287, - "name": "Standard" - }, - "product_id": "0x5406", - "product_name": "U3 Cruzer Micro", - "reason_code": "6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC", - "run_state": "DID_NOT_RUN", - "sensor_action": "DENY", - "serial_number": "0875920EF7C2A304", - "target_value": "MEDIUM", - "threat_cause": { - "cause_event_id": "FCEE2AF0-D832-4C9F-B988-F11B46028C9E", - "threat_category": "NON_MALWARE", - "vector": "REMOVABLE_MEDIA" - }, - "threat_id": "t5678", - "type": "DEVICE_CONTROL", - "vendor_id": "0x0781", - "vendor_name": "SanDisk", - "workflow": { - "changed_by": "Carbon Black", - "last_update_time": "2020-11-17T22:02:16Z", - "state": "OPEN" - } - } - }, - "data_stream": { - "dataset": "carbon_black_cloud.alert", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "snapshot": false, - "version": "7.17.0" - }, - "event": { - "agent_id_status": "verified", - "created": "2022-04-14T11:46:13.154Z", - "dataset": "carbon_black_cloud.alert", - "end": "2020-11-17T22:02:16Z", - "id": "test1", - "ingested": "2022-04-14T11:46:14Z", - "kind": "alert", - "original": "{\"alert_url\":\"https://defense-eap01.conferdeploy.net/alerts?orgId=1889976\",\"category\":\"WARNING\",\"create_time\":\"2020-11-17T22:05:13Z\",\"device_external_ip\":\"81.2.69.143\",\"device_id\":2,\"device_internal_ip\":\"81.2.69.144\",\"device_location\":\"UNKNOWN\",\"device_name\":\"DESKTOP-002\",\"device_os\":\"WINDOWS\",\"device_os_version\":\"Windows 10 x64\",\"device_username\":\"test34@demo.com\",\"first_event_time\":\"2020-11-17T22:02:16Z\",\"id\":\"test1\",\"last_event_time\":\"2020-11-17T22:02:16Z\",\"last_update_time\":\"2020-11-17T22:05:13Z\",\"legacy_alert_id\":\"C8EB7306-AF26-4A9A-B677-814B3AF69720\",\"org_key\":\"ABCD6X3T\",\"policy_applied\":\"APPLIED\",\"policy_id\":6997287,\"policy_name\":\"Standard\",\"product_id\":\"0x5406\",\"product_name\":\"U3 Cruzer Micro\",\"reason\":\"Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.\",\"reason_code\":\"6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC\",\"run_state\":\"DID_NOT_RUN\",\"sensor_action\":\"DENY\",\"serial_number\":\"0875920EF7C2A304\",\"severity\":3,\"target_value\":\"MEDIUM\",\"threat_cause_cause_event_id\":\"FCEE2AF0-D832-4C9F-B988-F11B46028C9E\",\"threat_cause_threat_category\":\"NON_MALWARE\",\"threat_cause_vector\":\"REMOVABLE_MEDIA\",\"threat_id\":\"t5678\",\"type\":\"DEVICE_CONTROL\",\"vendor_id\":\"0x0781\",\"vendor_name\":\"SanDisk\",\"workflow\":{\"changed_by\":\"Carbon Black\",\"comment\":\"\",\"last_update_time\":\"2020-11-17T22:02:16Z\",\"remediation\":\"\",\"state\":\"OPEN\"}}", - "reason": "Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.", - "severity": 3, - "start": "2020-11-17T22:02:16Z", - "url": "https://defense-eap01.conferdeploy.net/alerts?orgId=1889976" - }, - "host": { - "hostname": "DESKTOP-002", - "id": "2", - "ip": [ - "81.2.69.144", - "81.2.69.143" - ], - "name": "DESKTOP-002", - "os": { - "type": "windows", - "version": "Windows 10 x64" - } - }, - "input": { - "type": "httpjson" - }, - "related": { - "hosts": [ - "DESKTOP-002" - ], - "ip": [ - "81.2.69.144", - "81.2.69.143" - ], - "user": [ - "test34@demo.com" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-alert" - ], - "user": { - "name": "test34@demo.com" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| carbon_black_cloud.alert.blocked_threat_category | The category of threat which we were able to take action on. | keyword | -| carbon_black_cloud.alert.category | The category of the alert. | keyword | -| carbon_black_cloud.alert.count | | long | -| carbon_black_cloud.alert.created_by_event_id | Event identifier that initiated the alert. | keyword | -| carbon_black_cloud.alert.device.external_ip | External IP of the device. | ip | -| carbon_black_cloud.alert.device.internal_ip | Internal IP of the device. | ip | -| carbon_black_cloud.alert.device.location | The Location of device. | keyword | -| carbon_black_cloud.alert.device.os | OS of the device. | keyword | -| carbon_black_cloud.alert.document_guid | Unique ID of document. | keyword | -| carbon_black_cloud.alert.ioc.field | The field the indicator of comprise (IOC) hit contains. | keyword | -| carbon_black_cloud.alert.ioc.hit | IOC field value or IOC query that matches. | keyword | -| carbon_black_cloud.alert.ioc.id | The identifier of the IOC that cause the hit. | keyword | -| carbon_black_cloud.alert.kill_chain_status | The stage within the Cyber Kill Chain sequence most closely associated with the attributes of the alert. | keyword | -| carbon_black_cloud.alert.last_update_time | The last time the alert was updated as an ISO 8601 UTC timestamp. | date | -| carbon_black_cloud.alert.legacy_alert_id | The legacy identifier for the alert. | keyword | -| carbon_black_cloud.alert.not_blocked_threat_category | Other potentially malicious activity involved in the threat that we weren't able to take action on (either due to policy config, or not having a relevant rule). | keyword | -| carbon_black_cloud.alert.notes_present | Indicates if notes are associated with the threat_id. | boolean | -| carbon_black_cloud.alert.organization_key | The unique identifier for the organization associated with the alert. | keyword | -| carbon_black_cloud.alert.policy.applied | Whether a policy was applied. | keyword | -| carbon_black_cloud.alert.policy.id | The identifier for the policy associated with the device at the time of the alert. | long | -| carbon_black_cloud.alert.policy.name | The name of the policy associated with the device at the time of the alert. | keyword | -| carbon_black_cloud.alert.product_id | The hexadecimal id of the USB device's product. | keyword | -| carbon_black_cloud.alert.product_name | The name of the USB device’s vendor. | keyword | -| carbon_black_cloud.alert.reason_code | Shorthand enum for the full-text reason. | keyword | -| carbon_black_cloud.alert.report.id | The identifier of the report that contains the IOC. | keyword | -| carbon_black_cloud.alert.report.name | The name of the report that contains the IOC. | keyword | -| carbon_black_cloud.alert.run_state | Whether the threat in the alert ran. | keyword | -| carbon_black_cloud.alert.sensor_action | The action taken by the sensor, according to the rule of the policy. | keyword | -| carbon_black_cloud.alert.serial_number | The serial number of the USB device. | keyword | -| carbon_black_cloud.alert.status | status of alert. | keyword | -| carbon_black_cloud.alert.tags | Tags associated with the alert. | keyword | -| carbon_black_cloud.alert.target_value | The priority of the device assigned by the policy. | keyword | -| carbon_black_cloud.alert.threat_activity.c2 | Whether the alert involved a command and control (c2) server. | keyword | -| carbon_black_cloud.alert.threat_activity.dlp | Whether the alert involved data loss prevention (DLP). | keyword | -| carbon_black_cloud.alert.threat_activity.phish | Whether the alert involved phishing. | keyword | -| carbon_black_cloud.alert.threat_cause.actor.md5 | MD5 of the threat cause actor. | keyword | -| carbon_black_cloud.alert.threat_cause.actor.name | The name can be one of the following: process commandline, process name, or analytic matched threat. Analytic matched threats are Exploit, Malware, PUP, or Trojan. | keyword | -| carbon_black_cloud.alert.threat_cause.actor.process_pid | Process identifier (PID) of the actor process. | keyword | -| carbon_black_cloud.alert.threat_cause.actor.sha256 | SHA256 of the threat cause actor. | keyword | -| carbon_black_cloud.alert.threat_cause.cause_event_id | ID of the Event that triggered the threat. | keyword | -| carbon_black_cloud.alert.threat_cause.process.guid | The global unique identifier of the process. | keyword | -| carbon_black_cloud.alert.threat_cause.process.parent.guid | The global unique identifier of the process. | keyword | -| carbon_black_cloud.alert.threat_cause.reputation | Reputation of the threat cause. | keyword | -| carbon_black_cloud.alert.threat_cause.threat_category | Category of the threat cause. | keyword | -| carbon_black_cloud.alert.threat_cause.vector | The source of the threat cause. | keyword | -| carbon_black_cloud.alert.threat_id | The identifier of a threat which this alert belongs. Threats are comprised of a combination of factors that can be repeated across devices. | keyword | -| carbon_black_cloud.alert.threat_indicators.process_name | Process name associated with threat. | keyword | -| carbon_black_cloud.alert.threat_indicators.sha256 | Sha256 associated with threat. | keyword | -| carbon_black_cloud.alert.threat_indicators.ttps | Tactics, techniques and procedures associated with threat. | keyword | -| carbon_black_cloud.alert.type | Type of alert. | keyword | -| carbon_black_cloud.alert.vendor_id | The hexadecimal id of the USB device's vendor. | keyword | -| carbon_black_cloud.alert.vendor_name | The name of the USB device’s vendor. | keyword | -| carbon_black_cloud.alert.watchlists.id | The identifier of watchlist. | keyword | -| carbon_black_cloud.alert.watchlists.name | The name of the watchlist. | keyword | -| carbon_black_cloud.alert.workflow.changed_by | The name of user who changed the workflow. | keyword | -| carbon_black_cloud.alert.workflow.comment | Comment associated with workflow. | keyword | -| carbon_black_cloud.alert.workflow.last_update_time | The last update time of workflow. | date | -| carbon_black_cloud.alert.workflow.remediation | N/A | keyword | -| carbon_black_cloud.alert.workflow.state | The state of workflow. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset. | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module. | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | -| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. One of these following values should be used (lowercase): linux, macos, unix, windows. If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.name.text | Multi-field of `user.name`. | match_only_text | - - -### Endpoint Event - -This is the `endpoint_event` dataset. - -An example event for `endpoint_event` looks as following: - -```json -{ - "process": { - "parent": { - "pid": 1684, - "entity_id": "XXXXXXXX-003d902d-00000694-00000000-1d7540221dedd62", - "command_line": "C:\\WindowsAzure\\GuestAgent_2.7.41491.1010_2021-05-11_233023\\GuestAgent\\WindowsAzureGuestAgent.exe", - "executable": "c:\\windowsazure\\guestagent_2.7.41491.1010_2021-05-11_233023\\guestagent\\windowsazureguestagent.exe", - "hash": { - "sha256": "44a1975b2197484bb22a0eb673e67e7ee9ec20265e9f6347f5e06b6447ac82c5", - "md5": "03dd698da2671383c9b4f868c9931879" - } - }, - "pid": 4880, - "entity_id": "XXXXXXXX-003d902d-00001310-00000000-1d81e748c4adb37", - "command_line": "\"route.exe\" print", - "executable": "c:\\windows\\system32\\route.exe", - "hash": { - "sha256": "9e9c7696859b94b1c33a532fa4d5c648226cf3361121dd899e502b8949fb11a6", - "md5": "2498272dc48446891182747428d02a30" - } - }, - "ecs": { - "version": "8.0.0" - }, - "carbon_black_cloud": { - "endpoint_event": { - "schema": 1, - "event_origin": "EDR", - "process": { - "duration": 2, - "parent": { - "reputation": "REP_RESOLVING" - }, - "publisher": [ - { - "name": "Microsoft Windows", - "state": [ - "FILE_SIGNATURE_STATE_SIGNED", - "FILE_SIGNATURE_STATE_VERIFIED", - "FILE_SIGNATURE_STATE_TRUSTED", - "FILE_SIGNATURE_STATE_OS", - "FILE_SIGNATURE_STATE_CATALOG_SIGNED" - ] - } - ], - "reputation": "REP_RESOLVING", - "terminated": true, - "username": "NT AUTHORITY\\SYSTEM" - }, - "organization_key": "XXXXXXXX", - "backend": { - "timestamp": "2022-02-10 11:52:50 +0000 UTC" - }, - "target_cmdline": "\"route.exe\" print", - "type": "endpoint.event.procend", - "device": { - "os": "WINDOWS", - "timestamp": "2022-02-10 11:51:35.0684097 +0000 UTC", - "external_ip": "67.43.156.12" - }, - "sensor_action": "ACTION_ALLOW" - } - }, - "host": { - "hostname": "client-cb2", - "id": "4034605", - "os": { - "type": "windows" - }, - "ip": [ - "67.43.156.13" - ] - }, - "event": { - "action": "ACTION_PROCESS_TERMINATE", - "orignal": "{\"type\":\"endpoint.event.procend\",\"process_guid\":\"XXXXXXXX-003d902d-00001310-00000000-1d81e748c4adb37\",\"parent_guid\":\"XXXXXXXX-003d902d-00000694-00000000-1d7540221dedd62\",\"backend_timestamp\":\"2022-02-10 11:52:50 +0000 UTC\",\"org_key\":\"XXXXXXXX\",\"device_id\":\"4034605\",\"device_name\":\"client-cb2\",\"device_external_ip\":\"67.43.156.13\",\"device_os\":\"WINDOWS\",\"device_group\":\"\",\"action\":\"ACTION_PROCESS_TERMINATE\",\"schema\":1,\"device_timestamp\":\"2022-02-10 11:51:35.0684097 +0000 UTC\",\"process_terminated\":true,\"process_duration\":2,\"process_reputation\":\"REP_RESOLVING\",\"parent_reputation\":\"REP_RESOLVING\",\"process_pid\":4880,\"parent_pid\":1684,\"process_publisher\":[{\"name\":\"Microsoft Windows\",\"state\":\"FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED\"}],\"process_path\":\"c:\\\\windows\\\\system32\\\\route.exe\",\"parent_path\":\"c:\\\\windowsazure\\\\guestagent_2.7.41491.1010_2021-05-11_233023\\\\guestagent\\\\windowsazureguestagent.exe\",\"process_hash\":[\"2498272dc48446891182747428d02a30\",\"9e9c7696859b94b1c33a532fa4d5c648226cf3361121dd899e502b8949fb11a6\"],\"parent_hash\":[\"03dd698da2671383c9b4f868c9931879\",\"44a1975b2197484bb22a0eb673e67e7ee9ec20265e9f6347f5e06b6447ac82c5\"],\"process_cmdline\":\"\\\"route.exe\\\" print\",\"parent_cmdline\":\"C:\\\\WindowsAzure\\\\GuestAgent_2.7.41491.1010_2021-05-11_233023\\\\GuestAgent\\\\WindowsAzureGuestAgent.exe\",\"process_username\":\"NT AUTHORITY\\\\SYSTEM\",\"sensor_action\":\"ACTION_ALLOW\",\"event_origin\":\"EDR\",\"target_cmdline\":\"\\\"route.exe\\\" print\"}" - }, - "data_stream": { - "dataset": "carbon_black_cloud.endpoint_event", - "namespace": "ep", - "type": "logs" - }, - "elastic_agent": { - "id": "3b20ea47-9610-412d-97e3-47cd19b7e4d5", - "snapshot": true, - "version": "8.0.0" - }, - "input": { - "type": "aws-s3" - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-endpoint-event" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| carbon_black_cloud.endpoint_event.alert_id | The ID of the Alert this event is associated with. | keyword | -| carbon_black_cloud.endpoint_event.backend.timestamp | Time when the backend received the batch of events. | keyword | -| carbon_black_cloud.endpoint_event.childproc.guid | Unique ID of the child process. | keyword | -| carbon_black_cloud.endpoint_event.childproc.hash.md5 | Cryptographic MD5 hashes of the executable file backing the child process. | keyword | -| carbon_black_cloud.endpoint_event.childproc.hash.sha256 | Cryptographic SHA256 hashes of the executable file backing the child process. | keyword | -| carbon_black_cloud.endpoint_event.childproc.name | Full path to the target of the crossproc event on the device's local file system. | keyword | -| carbon_black_cloud.endpoint_event.childproc.pid | OS-reported Process ID of the child process. | long | -| carbon_black_cloud.endpoint_event.childproc.publisher.name | The name of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.childproc.publisher.state | The state of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.childproc.reputation | Carbon Black Cloud Reputation string for the childproc. | keyword | -| carbon_black_cloud.endpoint_event.childproc.username | The username associated with the user context that the child process was started under. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.action | The action taken on cross-process. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.api | Name of the operating system API called by the actor process. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.guid | Unique ID of the cross process. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.hash.md5 | Cryptographic MD5 hashes of the target of the crossproc event. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.hash.sha256 | Cryptographic SHA256 hashes of the target of the crossproc event. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.name | Full path to the target of the crossproc event on the device's local file system. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.publisher.name | The name of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.publisher.state | The state of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.reputation | Carbon Black Cloud Reputation string for the crossproc. | keyword | -| carbon_black_cloud.endpoint_event.crossproc.target | True if the process was the target of the cross-process event; false if the process was the actor. | boolean | -| carbon_black_cloud.endpoint_event.device.external_ip | External IP of the device. | ip | -| carbon_black_cloud.endpoint_event.device.internal_ip | Internal IP of the device. | ip | -| carbon_black_cloud.endpoint_event.device.os | Os name. | keyword | -| carbon_black_cloud.endpoint_event.device.timestamp | Time seen on sensor. | keyword | -| carbon_black_cloud.endpoint_event.event_origin | Indicates which product the event came from. "EDR" indicates the event originated from Enterprise EDR. "NGAV" indicates the event originated from Endpoint Standard. | keyword | -| carbon_black_cloud.endpoint_event.fileless_scriptload.cmdline | Deobfuscated script content run in a fileless context by the process. | keyword | -| carbon_black_cloud.endpoint_event.fileless_scriptload.cmdline_length | Character count of the deobfuscated script content run in a fileless context. | keyword | -| carbon_black_cloud.endpoint_event.fileless_scriptload.hash.md5 | MD5 hash of the deobfuscated script content run by the process in a fileless context. | keyword | -| carbon_black_cloud.endpoint_event.fileless_scriptload.hash.sha256 | SHA-256 hash of the deobfuscated script content run by the process in a fileless context. | keyword | -| carbon_black_cloud.endpoint_event.modload.count | Count of modload events reported by the sensor since last initialization. | long | -| carbon_black_cloud.endpoint_event.modload.effective_reputation | Effective reputation(s) of the loaded module(s); applied by the sensor when the event occurred. | keyword | -| carbon_black_cloud.endpoint_event.modload.publisher.name | The name of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.modload.publisher.state | The state of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.netconn.proxy.domain | DNS name associated with the "proxy" end of this network connection; may be empty if the name cannot be inferred or the connection is made direct to/from a proxy IP address. | keyword | -| carbon_black_cloud.endpoint_event.netconn.proxy.ip | IPv4 or IPv6 address in string format associated with the "proxy" end of this network connection. | keyword | -| carbon_black_cloud.endpoint_event.netconn.proxy.port | UDP/TCP port number associated with the "proxy" end of this network connection. | keyword | -| carbon_black_cloud.endpoint_event.organization_key | The organization key associated with the console instance. | keyword | -| carbon_black_cloud.endpoint_event.process.duration | The time difference in seconds between the process start and process terminate event. | long | -| carbon_black_cloud.endpoint_event.process.parent.reputation | Reputation of the parent process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. | keyword | -| carbon_black_cloud.endpoint_event.process.publisher.name | The name of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.process.publisher.state | The state of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.process.reputation | Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. | keyword | -| carbon_black_cloud.endpoint_event.process.terminated | True if process was terminated elase false. | boolean | -| carbon_black_cloud.endpoint_event.process.username | The username associated with the user context that this process was started under. | keyword | -| carbon_black_cloud.endpoint_event.schema | The schema version. The current schema version is "1". This schema version will only be incremented if the field definitions are changed in a backwards-incompatible way. | long | -| carbon_black_cloud.endpoint_event.scriptload.count | Count of scriptload events across all processes reported by the sensor since last initialization. | long | -| carbon_black_cloud.endpoint_event.scriptload.effective_reputation | Effective reputation(s) of the script file(s) loaded at process launch; applied by the sensor when the event occurred. | keyword | -| carbon_black_cloud.endpoint_event.scriptload.hash.md5 | Cryptographic MD5 hashes of the target of the scriptload event. | keyword | -| carbon_black_cloud.endpoint_event.scriptload.hash.sha256 | Cryptographic SHA256 hashes of the target of the scriptload event. | keyword | -| carbon_black_cloud.endpoint_event.scriptload.name | Full path to the target of the crossproc event on the device's local file system. | keyword | -| carbon_black_cloud.endpoint_event.scriptload.publisher.name | The name of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.scriptload.publisher.state | The state of the publisher. | keyword | -| carbon_black_cloud.endpoint_event.scriptload.reputation | Carbon Black Cloud Reputation string for the scriptload. | keyword | -| carbon_black_cloud.endpoint_event.sensor_action | The sensor action taken on event. | keyword | -| carbon_black_cloud.endpoint_event.target_cmdline | Process command line associated with the target process. | keyword | -| carbon_black_cloud.endpoint_event.type | The event type. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.port | Port of the client. | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dll.hash.md5 | MD5 hash. | keyword | -| dll.hash.sha256 | SHA256 hash. | keyword | -| dll.path | Full file path of the library. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset. | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.module | Event module. | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.hash.md5 | MD5 hash. | keyword | -| process.hash.sha256 | SHA256 hash. | keyword | -| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | -| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.parent.executable | Absolute path to the process executable. | keyword | -| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | -| process.parent.hash.md5 | MD5 hash. | keyword | -| process.parent.hash.sha256 | SHA256 hash. | keyword | -| process.parent.pid | Process id. | long | -| process.pid | Process id. | long | -| registry.path | Full path, including hive, key and value | keyword | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | - - -### Watchlist Hit - -This is the `watchlist_hit` dataset. - -An example event for `watchlist_hit` looks as following: - -```json -{ - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-watchlist-hit" - ], - "input": { - "type": "aws-s3" - }, - "data_stream": { - "namespace": "default", - "type": "logs", - "dataset": "carbon_black_cloud.watchlist_hit" - }, - "agent": { - "id": "e0d5f508-9616-400f-b26b-bb1aa6638b80", - "type": "filebeat", - "version": "8.0.0" - }, - "ecs": { - "version": "8.0.0" - }, - "process": { - "parent": { - "pid": 4076, - "entity_id": "7DESJ9GN-00442a47-00000fec-00000000-1d81ed87d4655d1", - "command_line": "C:\\WINDOWS\\system32\\cmd.exe /c \"sc query aella_conf | findstr RUNNING \u003e null\"", - "executable": "c:\\windows\\syswow64\\cmd.exe", - "hash": { - "sha256": "4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22", - "md5": "d0fce3afa6aa1d58ce9fa336cc2b675b" - } - }, - "pid": 7516, - "entity_id": "7DESJ9GN-00442a47-00001d5c-00000000-1d81ed87d63d2c6", - "command_line": "sc query aella_conf ", - "executable": "c:\\windows\\syswow64\\sc.exe", - "hash": { - "sha256": "4fe6d9eb8109fb79ff645138de7cff37906867aade589bd68afa503a9ab3cfb2", - "md5": "d9d7684b8431a0d10d0e76fe9f5ffec8" - } - }, - "carbon_black_cloud": { - "watchlist_hit": { - "schema": 1, - "process": { - "parent": { - "publisher": [ - { - "name": "Microsoft Windows", - "state": [ - "FILE_SIGNATURE_STATE_SIGNED", - "FILE_SIGNATURE_STATE_VERIFIED", - "FILE_SIGNATURE_STATE_TRUSTED", - "FILE_SIGNATURE_STATE_OS", - "FILE_SIGNATURE_STATE_CATALOG_SIGNED" - ] - } - ], - "reputation": "REP_WHITE", - "username": "NT AUTHORITY\\SYSTEM" - }, - "publisher": [ - { - "name": "Microsoft Windows", - "state": [ - "FILE_SIGNATURE_STATE_SIGNED", - "FILE_SIGNATURE_STATE_VERIFIED", - "FILE_SIGNATURE_STATE_TRUSTED", - "FILE_SIGNATURE_STATE_OS", - "FILE_SIGNATURE_STATE_CATALOG_SIGNED" - ] - } - ], - "reputation": "REP_WHITE", - "username": "NT AUTHORITY\\SYSTEM" - }, - "organization_key": "xxxxxxxx", - "report": { - "name": "Discovery - System Service Discovery Detected", - "id": "CFnKBKLTv6hUkBGFobRdg-565571", - "tags": [ - "attack", - "attackframework", - "threathunting", - "hunting", - "t1007", - "recon", - "discovery", - "windows" - ] - }, - "watchlists": [ - { - "name": "ATT\u0026CK Framework", - "id": "P5f9AW29TGmTOvBW156Cig" - } - ], - "type": "watchlist.hit", - "ioc": { - "hit": "((process_name:sc.exe -parent_name:svchost.exe) AND process_cmdline:query) -enriched:true", - "id": "565571-0" - }, - "device": { - "internal_ip": "10.10.156.12", - "external_ip": "67.43.156.12", - "os": "WINDOWS" - } - } - }, - "host": { - "hostname": "Carbonblack-win1", - "os": { - "type": "windows" - }, - "ip": [ - "10.10.156.12", - "67.43.156.12" - ], - "id": "4467271" - }, - "event": { - "kind": "event", - "severity": 3, - "agent_id_status": "verified", - "ingested": "2022-02-17T07:23:31Z", - "original": "{\"schema\":1,\"create_time\":\"2022-02-10T23:54:32.449Z\",\"device_external_ip\":\"205.234.30.196\",\"device_id\":4467271,\"device_internal_ip\":\"10.33.4.214\",\"device_name\":\"Carbonblack-win1\",\"device_os\":\"WINDOWS\",\"ioc_hit\":\"((process_name:sc.exe -parent_name:svchost.exe) AND process_cmdline:query) -enriched:true\",\"ioc_id\":\"565571-0\",\"org_key\":\"7DESJ9GN\",\"parent_cmdline\":\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe /c \\\"sc query aella_conf | findstr RUNNING \\u003e null\\\"\",\"parent_guid\":\"7DESJ9GN-00442a47-00000fec-00000000-1d81ed87d4655d1\",\"parent_hash\":[\"d0fce3afa6aa1d58ce9fa336cc2b675b\",\"4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22\"],\"parent_path\":\"c:\\\\windows\\\\syswow64\\\\cmd.exe\",\"parent_pid\":4076,\"parent_publisher\":[{\"name\":\"Microsoft Windows\",\"state\":\"FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED\"}],\"parent_reputation\":\"REP_WHITE\",\"parent_username\":\"NT AUTHORITY\\\\SYSTEM\",\"process_cmdline\":\"sc query aella_conf \",\"process_guid\":\"7DESJ9GN-00442a47-00001d5c-00000000-1d81ed87d63d2c6\",\"process_hash\":[\"d9d7684b8431a0d10d0e76fe9f5ffec8\",\"4fe6d9eb8109fb79ff645138de7cff37906867aade589bd68afa503a9ab3cfb2\"],\"process_path\":\"c:\\\\windows\\\\syswow64\\\\sc.exe\",\"process_pid\":7516,\"process_publisher\":[{\"name\":\"Microsoft Windows\",\"state\":\"FILE_SIGNATURE_STATE_SIGNED | FILE_SIGNATURE_STATE_VERIFIED | FILE_SIGNATURE_STATE_TRUSTED | FILE_SIGNATURE_STATE_OS | FILE_SIGNATURE_STATE_CATALOG_SIGNED\"}],\"process_reputation\":\"REP_WHITE\",\"process_username\":\"NT AUTHORITY\\\\SYSTEM\",\"report_id\":\"CFnKBKLTv6hUkBGFobRdg-565571\",\"report_name\":\"Discovery - System Service Discovery Detected\",\"report_tags\":[\"attack\",\"attackframework\",\"threathunting\",\"hunting\",\"t1007\",\"recon\",\"discovery\",\"windows\"],\"severity\":3,\"type\":\"watchlist.hit\",\"watchlists\":[{\"id\":\"P5f9AW29TGmTOvBW156Cig\",\"name\":\"ATT\\u0026CK Framework\"}]}", - "dataset": "carbon_black_cloud.watchlist_hit" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| carbon_black_cloud.watchlist_hit.device.external_ip | External IP of the device. | ip | -| carbon_black_cloud.watchlist_hit.device.internal_ip | Internal IP of the device. | ip | -| carbon_black_cloud.watchlist_hit.device.os | OS Type of device (Windows/OSX/Linux). | keyword | -| carbon_black_cloud.watchlist_hit.ioc.field | Field the IOC hit contains. | keyword | -| carbon_black_cloud.watchlist_hit.ioc.hit | IOC field value, or IOC query that matches. | keyword | -| carbon_black_cloud.watchlist_hit.ioc.id | ID of the IOC that caused the hit. | keyword | -| carbon_black_cloud.watchlist_hit.organization_key | The organization key associated with the console instance. | keyword | -| carbon_black_cloud.watchlist_hit.process.parent.publisher.name | The name of the publisher. | keyword | -| carbon_black_cloud.watchlist_hit.process.parent.publisher.state | The state of the publisher. | keyword | -| carbon_black_cloud.watchlist_hit.process.parent.reputation | Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. | keyword | -| carbon_black_cloud.watchlist_hit.process.parent.username | The username associated with the user context that this process was started under. | keyword | -| carbon_black_cloud.watchlist_hit.process.reputation | Reputation of the actor process; applied when event is processed by the Carbon Black Cloud i.e. after sensor delivers event to the cloud. | keyword | -| carbon_black_cloud.watchlist_hit.process.username | The username associated with the user context that this process was started under. | keyword | -| carbon_black_cloud.watchlist_hit.report.id | ID of the watchlist report(s) that detected a hit on the process. | keyword | -| carbon_black_cloud.watchlist_hit.report.name | Name of the watchlist report(s) that detected a hit on the process. | keyword | -| carbon_black_cloud.watchlist_hit.report.tags | List of tags associated with the report(s) that detected a hit on the process. | keyword | -| carbon_black_cloud.watchlist_hit.schema | Schema version. | long | -| carbon_black_cloud.watchlist_hit.type | The watchlist hit type. | keyword | -| carbon_black_cloud.watchlist_hit.watchlists.id | The ID of the watchlists. | keyword | -| carbon_black_cloud.watchlist_hit.watchlists.name | The name of the watchlists. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module. | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. One of these following values should be used (lowercase): linux, macos, unix, windows. If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.hash.md5 | MD5 hash. | keyword | -| process.hash.sha256 | SHA256 hash. | keyword | -| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | -| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.parent.executable | Absolute path to the process executable. | keyword | -| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | -| process.parent.hash.md5 | MD5 hash. | keyword | -| process.parent.hash.sha256 | SHA256 hash. | keyword | -| process.parent.pid | Process id. | long | -| process.pid | Process id. | long | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | - - -### Asset Vulnerability Summary - -This is the `asset_vulnerability_summary` dataset. - -An example event for `asset_vulnerability_summary` looks as following: - -```json -{ - "@timestamp": "2022-04-14T11:47:25.371Z", - "agent": { - "ephemeral_id": "377d9292-c7d0-4c30-bbee-faf4848d30d8", - "hostname": "docker-fleet-agent", - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.17.0" - }, - "carbon_black_cloud": { - "asset_vulnerability_summary": { - "last_sync": { - "timestamp": "2022-01-17T08:33:37.384Z" - }, - "os_info": { - "os_arch": "64-bit" - }, - "sync": { - "status": "COMPLETED", - "type": "SCHEDULED" - }, - "type": "ENDPOINT", - "vuln_count": 1770 - } - }, - "data_stream": { - "dataset": "carbon_black_cloud.asset_vulnerability_summary", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0", - "snapshot": false, - "version": "7.17.0" - }, - "event": { - "agent_id_status": "verified", - "created": "2022-04-14T11:47:25.371Z", - "dataset": "carbon_black_cloud.asset_vulnerability_summary", - "ingested": "2022-04-14T11:47:26Z", - "original": "{\"cve_ids\":null,\"device_id\":8,\"highest_risk_score\":10,\"host_name\":\"DESKTOP-008\",\"last_sync_ts\":\"2022-01-17T08:33:37.384932Z\",\"name\":\"DESKTOP-008KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Education\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.17763\"},\"severity\":\"CRITICAL\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"SCHEDULED\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":1770}" - }, - "host": { - "hostname": "DESKTOP-008", - "id": "8", - "name": "DESKTOP-008KK", - "os": { - "name": "Microsoft Windows 10 Education", - "type": "windows", - "version": "10.0.17763" - } - }, - "input": { - "type": "httpjson" - }, - "related": { - "hosts": [ - "DESKTOP-008" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "carbon_black_cloud-asset-vulnerability-summary" - ], - "vulnerability": { - "score": { - "base": 10 - }, - "severity": "CRITICAL" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| carbon_black_cloud.asset_vulnerability_summary.last_sync.timestamp | The identifier is for the Last sync time. | date | -| carbon_black_cloud.asset_vulnerability_summary.os_info.os_arch | The identifier is for the Operating system architecture. | keyword | -| carbon_black_cloud.asset_vulnerability_summary.sync.status | The identifier is for the Device sync status. | keyword | -| carbon_black_cloud.asset_vulnerability_summary.sync.type | The identifier is for the Whether a manual sync was triggered for the device, or if it was a scheduled sync. | keyword | -| carbon_black_cloud.asset_vulnerability_summary.type | The identifier is for the Device type. | keyword | -| carbon_black_cloud.asset_vulnerability_summary.vm.id | The identifier is for the Virtual Machine ID. | keyword | -| carbon_black_cloud.asset_vulnerability_summary.vm.name | The identifier is for the Virtual Machine name. | keyword | -| carbon_black_cloud.asset_vulnerability_summary.vuln_count | The identifier is for the Number of vulnerabilities at this level. | integer | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. One of these following values should be used (lowercase): linux, macos, unix, windows. If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| vulnerability.score.base | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) | float | -| vulnerability.severity | The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | diff --git a/packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-logo.svg b/packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-logo.svg deleted file mode 100755 index 180cc3d212..0000000000 --- a/packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-logo.svg +++ /dev/null @@ -1,91 +0,0 @@ - - - - -Created by potrace 1.16, written by Peter Selinger 2001-2019 - - - - - - - - - - - - - - - - - - - - - diff --git a/packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-screenshot.png b/packages/carbon_black_cloud/1.0.3/img/carbon_black_cloud-screenshot.png deleted file mode 100755 index 6fda3c108d8bc27de6f53b1f284b2714d41c07f2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 83921 zcmZsCby!qi)b1cs(jp-#Dj_M-T?*3O4bm;rEhSP)cXxL)2n-?qcRADW()!$W1v3)TJ-6Rpuh)` zld_~3sC<}w2e^1@E-EJq0#!v}-Ws6**BB0;wVXhp=ieUxk)UQ&ZXnP@p43NCRX6?p zJJ&?=skD3SQy4;Erf%fE^Kia}3#vD5O;$m`V@$R%t8ZwF%!TUTfsUu-_xsn==l#4} zOmE*(XZb0nrqV=kuuI3Bo~;W^5VUymp|!ydo$~WHzl~Ukh3pn1az^q>njio2N3JiL zTAFuRqPDnz1%YTmQ;I1|Mpg5+E_4$s-()7h*Eo|}zzxIBs|0PS|Gq|}J72H}kv;Zb z>s>oml#A;x_WGXddHwaVDG~2PnNc=#_)!QkAN9@g36LMZbsjn-Gjo*;+10tX2j@Ll zCU1^mh_6}v-muSt!n5`)yl%ZM797)86g@a?~M?1^Q9NQ;ftEJCx&0b^$x$=Wv6;@U; z^7n_{7wq_S(RajbBo=6Gq8G%b-p zhPrM7={^CW-tPv$VRwKP{>n*r6T7hFzM3E(oA+)u8uQKG0qB8k)MCfLQ+m< zv__EY_H^_I$+tOPt*O%JP22W|bcBoi1)L^lXVDt0cQaokA!Pn*TrbMa;9P}n_d5Le zPE-<#(UmxwQNd=}hlzV4+>coj-OZd}R5;w%zlp#Bfjm60Ilh>-Ph>qVgYM#8mI>MJOgVQ+dyn#SdJB0fRY3v~k z?5df)RdZd_MElA*zPojZwu-|#b~&%%S2Ui!JKj?&Q8Q;1DTYI5NYj-(| zEi5|P4-`TL*pl}}fYO^(VTcklTaRr6S$-g3nV+X&Qs zxw0ci-?fyO&A%a3eeJr?X3+cqMI3_7`;V=JtaW`y$6UULA3t1U6|q~EP-b|)^1r9| z%<%QgcioIQD>#by%=Q!oafV>18YBTbM*e3z+R<49QA5y zPALIbJPo_D7-MQ~j4O0z?)XK}3d#W2bXQt$puI}3ws~(|NpIs(Lb+YE-Y5RSf8^-$p{IG0uI{k$z=QFxRvtAbPvVvxr#wI+Pqz=)Ng|MQdLdx= z_d|ndPB%@JwWJ-D^pvFKg900xkk&XqzD%@ymcApGG%y;t-UBh{>5Y3iwHbjXFZ+=0 znzR$pE5S*}nz5U9nuqWe*ix;l7&&2Xay!2;Z$(pfPl!GL(&f>Uq8b88oK^SulTtN4 zgqES5-Y+IKUvJrd;tjw2GdZON-FM#p#HpX?0$akhZ-3{k`=(t&i^fiN12zP`Tu7q3 zQpa6lT=?6ubh3OF$X+c*nOTTSwLVGZ?cbX(p2BxFe&{=RIqrpP%erz)-m_`HlC=`xb3GVH>oRkuRRuMVCke@J7VL={vD)lVGe7HFMB-Q8}rCdo2mo~`fGA#J^TZZO`fxJ3Pxd%Op|OXK0E@YlQ} zFul%UeMtMa2adT)D+rFdx(KpO{jL7o-#~agB7N@L;r8g06Y1WULIuZHDgj+hS$D9+ z-JuQ3DptX(R`^l*idrz7Tiq|%MfHy|nT2&oh1|U>)mASx%)sc%oD5da7UKKo2|0V(3BntSKf zC-j$e@EE>NZgsA2Nq|v+w0!ydLvBIN>d=)V{CJ+qpQ>qb@l=0vhFa`5i+ZxiU6`Dw zeZ$EszvBDvm3kRPmR94L6xV=5-nZedBjgHeY>a0@oo(3N3@Cuz5i`wQgrC}Ttm2qU zSNtX@9PZ~HsTjV|A3GYc7q^bL8eO`S*Am)SbgdtDoYn$wh%fAOCsHgD+B8JHw>vKh z2S*sC2=3dCy8XOAY+u~sPoIr%3%pqQt~&2~54T!@4`>IL7G)D5<5{*!3N5{(Wm&o` z-Z0sBT?if>h7hMVuOo*0XO`g^F4?LuH%AO-5wOAQ*u$Kk z2*@r|8+e@u`;$-85`v<@zE9FT{qOJq-$!<>hR$PWiFPmZrF?HPbMVn}6k6{eWqV~0 zw|SF_gP|RcZFY4f*cP)5xI!83z2#;}=lmlI>I7T;(zP7cACYnoT5|R$cB29SSmb$5 zv2}h`pDORYgRwhDrI)t1w3{{TTKM)#zToJpSti0ps>qed!-};UXDrN~y%h$QMq~_y z?vPgkQ0Coen$kjUu#J;!TgzC>1GDQ_3*Js%yoD>U=Ghu9HQ11O@tS0o)xBgX%i%0- zSx1bk&r^!`+6H4l`C#7y_myZBp#nbL|a6?laGDvTz0Y0z_Sd z)Bm~}KZEtaxNTL$>MvhtoN!LSlA&J_CpPuzsooP*o?Efs+)kEr%qW@1xJ^rQ#xg6u zxj%^PYm|eR_`i`8v>mRac#%EbE<2x%y@tv$@JiE+UWU}a{4hP%;w=^I3cJ2YywtPZ z9?aKf)OjFK#h=sh-kw77dBDA=kX#T0`6*{rS!*;j6y8MIpQQ8t4zAz`0Zg)J;*D2? zpyJC9xhzR1i?X{B*s4zM_5ffbN5>*mYbcX^IT%^DDjPTk2T69jz4yGn%{RBDOb_|) z`iE$0_fxGhe!nNo(0FDas-P#DlG>hGC%cfbc?U5m%*#T*^xAPNeWdUQ33s(mTqk4aC%NG*gOwK%V^< zK=8FC-X$MYGjbv>yPw?>G7BZIAh7pIWNiQ3EhCVx`y1>p`+a!VyAsyH4#lDMA^K}4 zjQifN4;K7rrW(vqF*lABSi4^O$ZBOWuP|FIb>|O{=fD?7glJH`ltF&q4cXWT)fp-r?Y2JhsLdO#pf77c-H_tD^-l%n^ zWn_z0Z#F)S!)7jVa^+sy6c=`bKBgb0gQXyl$;iFa=km7m4UT-yIpSsB+aGJesO@aM z+)LjMIbk18qTpcIo2y~XwyER!!wFD7Uw}U;#O&BT)Y)=E#&bUE)^R*lm1&+Z^>m>h9#Y^)pg>;vi8`E zyB}%>jd++kqk-B&Th{AByx>;#zi(5?c%euK%Oz_%EUgb{50N>x)F6?f$|`I741bBT zJ5)Heytj97UoYgN`A(iw2-ktm{p51N#Y!HRq9k#n0*)>U3E26@2P?(Vh=6bck$)X& z5+?|$SRH79AuyF-4jtSvX)4>>NB9FI!4*i{IzlSD&KqjrW2}g3RD&>^0NzgWhn2m9 z-LA8h6(B;_SWSfHD*OBtaW`Owb%~=S+a>~$%kH4EPHKc-n%B_NayF+G%X6xiDu<5r z*y?G0sxt>=3e`j(THq~+%F_Od@_aVc7OLFhUGAk;4V&ucHe6RGa}cf+<`$g3bd5C# z`4a|D%n7;Nc!?$02NjRM8i~pC-dn;jmNNA;D^%=viS?_5J+TRGMX5Ta8`sCa$_0T? zI*g6IH53%=snm3$X=$kl2z;DfG(!j~6JjpgjLK@j8*`yJIG7#FB)j_*dw(hRN@07X z7tdS6%Z70P#)0hv#6}H7Wc!7!!k;pV=~G<0D6hV%yNGpuUD79L9(@pWXLapaZtBT7 zqlzEDD&`ygF1^DdDuzAq?^*5xw65*U`4veTZd`u&n#Q(sf2nl6 z8k6vNagfxpmilDtQx`3|)72tiUX14f_(7%WEjc?rV7amj6!4h~D4;AH;gLa#)6v0Csm2Ywl(6Tsr3!>l<(n zMr_ibJ09w@N&PPs$>`t4Ll@)&SP+v&aHGlEATT>I?t*aFv_pt3dTm|T%qzJ8b5wp> zGtM}5nm*q*?2SIKoK5oPb^ek}4fqCnU>mpBP<_2JgYba2Fuq4>$gq%C)Ja&VH*8v{ znK7V#4uM?>*O&hTv$E}X_7GlNyc`_tlH#Qy-kv&U{@pgzO7?KY=R*52Lv?9RqWUXi zoBf6k<%wV6fZ4h71j=p;B6j)D#eMOwuHm%NCk1EOjekK zxk!gr{v_OJ?@aKE<_fy%afq{Sm&s~x{-~cKProI=)adnB%?8Y++sa$}qZny%u1qxH zdG^tfhdLVwibDc$^jmmINSTp^sEv;hVN{ql#n_lQfF@bR+9uF0ri@ z>bkN5%4u;#7jo#%F0-C~c+)n8!@RB*=TG2sg@>* zsRr>|#+=(W>fVO5C<-B=GyW{4)7RI~Ul(4>=1)O^F;x%urgwX>cRim4(vR5l$ z-;wlkt6Y@)>KJy_R2VvH3j`%pk}ay5Lxo`199UczDKB6Rv0!@~syVl!iAyOXi}p}c zDKPeJgA!7GJXNPlZLTDk3pOHnn2|I(=ySM&Fx@Wn&H01q^{whiZhj@DK;?|S^lo1D z;-IAVJ}XB4n;G2WpsC2O-+~#y!e!J}1{4S)`6Xsbz)WLkriR9rqVPL$C_955`jvGV-8KX22rcZZW zHJ0z>y7|L#wkzTJz%Bs=D9;lk6Af<-+_)*Q5OP##Th~k##m2{{EaG6cKTc@hh8KcU zpwQWdTfoRGb1-M=2KbbV^s!cT=vr#!T?Sp?ziDx)%E>)GXZ{>v2!b~xtxD0g<|T27 zkaVCP8g7sgSk!nI@HcJ+*|KR7ySiu0bANcb(_3j=^~%fXiJrE(gUW(&YuZJSRSMuu zg*SiawNB#bY>f`%{&UmlL7t0LA+zRW#jL2_k(c2~V52NpMzmr3d{V+6M%#0Yd9#a% z(lhPWmgGAUb@&~|QLWwyxj%dTqmRY|vo$sRx)u`qYiRJ3s^5gnym6I6VOT2rTnfQu zC`AF)5BBzW842?_U3d;7==1%%@6C&p@dA|jLNm>|Wr-q94+=XxyFeJP>Noc#p#Q1# zF$pAnQ8|p`X}GM_aDx;sMc1Qa?yYb$;H;6HyT1VB z8s}5s82P7*^MBMl7k%H&i?KM?fq zSst-%yPD=r=NtG1pYjWsGiniBZsc?@jm7p4Su1IW_TuO}8&09nNM)h!xEnImRSm~x% zC8O@(U9mEU?@{2T_(IRK^`i-bs3X!44~3M&Nm&>0Lx;?woB54=JH0?1vug#s2=2Rk z1VC%Yko_N;0N%eQby>m1lCk^gvVSp`EbXh=NeMieEV`Gef?tq7WmDl1q zSle@ZC``*{Xm6{0x3LvWsIS@E#Y+3=TidR*d`Dox1~cMs{pxniyoR_pw75HQ{o&Sx z8fim^1&q19ib@X4iH9$4EQE+_xU9l(Vczf~VYIINmOmBF%ie#X?XCY_5K!guCaj!?wxeU=5VTpcu@fv`CovZa`Tk6I!w3JTVYxz4!aEfCe(?(RK zdBiL0p@)fcOc!UnJ9@76L{+x;$kF$c`kxrz7tgDy(DNytgbP)O*Xkz0C-YeQ+&HLHdtyW5w)tc5>8)Xf8 ze8Xvymq&;vRv(^1aZ=!4+198>tz%76{;HFGRj{4sh9TM(6(t2IZT1^lS3>j;j#SQJ zzcCIn@JVL)A-w7Bb#m}BqkH1OIQHes^iCF-j~Og! z*5iRPNrHRIs}mFR`OkB(4R8^=`>|V_rdS9r=EOX%MDLT&DQx%B_?ZC|!+~6$CqNUz ziaZ>#HhLwz5I%UNe|{xx3%!uM?l2(u^2EN(?}yGRw_*Z8DIE&vDWSS~=mk!j&wJYZ z&`5cA6he}$Vbo$#(vlj2k~eZMJ-N$Lb_An299Z1xzPD8L3^!(Q7X}%6jR=(+J-F@d zTLjE0^_ImfP!m|{irx``Ks`YXe^GyiiaNZcc0t4Ma7`UcIJ}3Z<|+xPqoU~aL3Ypmqi95s!SG&C%Y#x4nZSI44!aL9|HixjR%v%4_Go_kvK) z@EeKh6PrGOqJTtxqqDJL8+m#lEWg{G(1`r~Hx>0?XP4|Xb&%h#h%8oZ$b=`#k5`mG zIr-|-cNh0l7p?Ai!1&m30A;keWGy(|kUOZ%-YZ(v`EHHg*WVUr9iG^R+NVF~!U4Tk z*G!`cHeOBFhd@MH0yBr@zbrljDN_6hMFN5R`d&xqX~{0KyA6NDGWgffwaYX%4V8K` zdzh}zP|YFAef|9LL?)3V?ZyrQc|3;6H8jy^Pb87#1^Rb+Y#F!Z*TV~QB$EyL)V|;-;gJXjdf+>lmrd+^~XU#3+TONVg2j> zRz3Wgjcp0g0?;ZOtz^7P^iK>TNB`6GbA`>3``=;Ms~`XEz7zR>&c^%1^% zOJs5gGv%kt6hWr z=RtcAs5XMb3(#uzi_5>)EQI`FT}$>ZE~NWIg44Pct5(LKZ{tE-&aT+Cr& z;=XxNT-r7@gF6M~Q#WvEF5=103-7m6GSErs=28BQ0`kKMNF@14(CH}6(oit6pGnP# ztxgbjmSNU#IAk#&KVC_lWoIfow94LmouLu2x|4DMNW}yjMa(E(Cdf=&$#;(KE2| z*;-*__8cc`pq;4*tI%`I@>tp7S5+n=z|2$m#jt~hf)VypSv}s&<_O2NMuFo+Zr$E9 z4;`JsJC}wq`=7X8D43ulIzw4m6k;|ubYZTBnz_Y{nThC0b?00bdzDX{i{C$H9R*F~ zbz8PL^JZ`p861`}@4@%0v5&AHw+%q*Bbt0ef%%`Tz4rzshheOvR88~MG(|o;O;$#& zd@Q}s31CV$nw8+&la6_vD&`Gdy$H^HyMQi+@UOoqkTdP@2m%WKY+P(dT%4#+Ocg^h z-P6$6Q@GzwV#GPNM$*uNb1=iA8`Sj$)iW{{)juJ_X`R}qHrB}wkmuMyq-bnxKVGD% zt4R6wc1I?UkYc*3nzAxT<4Y$#N&8LKQp~ZIvrD#>EK_rKuGUj7)DqNA2?8||{0Q~` zo*Ct5^XfBlCri$qx}LAB&sG*AGa11iQAS%Ak{rQ%dNxN9VfxRSIxagRLqmz1C%5U- z(2h>o3Y_0;pxsB5;GBG{D;tSdoAP97So^cF>3m!#hL81AG&B_X#>i-V^CzR^?#c57 z21aa;t!22?F|rPb1KrpdPo5OjLuKBXzoa^-^TpIK<7WX)&%I(WxXWs_0*D|_9%cHR zbYR>s9^29u$JL~Pv!?peLVa&Hk<{oF=`(R+0!(lMaZBslh@NJxn_!o)-w`W<;zc|l z!^KgNu^n=kR->mtUG+z(=tl?a^tG9t6IIv53F#JL@M7!wey)!Ly96)>qNPgU)J8>0 z)PB!zVpyN`wMnL?4OfZ|GaZbwXnB0F(mOV8mkC%);CEW5hmGO+J5Fxshyq@5)Qzrg z>W!uMeZ(QH;IJan3#{{7f?C!zM8N1FfqvUDtfZF<>W&rtzBCz?A>a=;PU3+CFf0>!MeQ$i|>bbXIDjOEf+1itxqp5$)IVx@Q59_oUi%tKt-!JFMC*g zRuX(jUr}AZFP{2>ibq*fRg6HY&+=``Y_)B}(#p}2Z%bB{<-&y^R|+@ThZJVd3(C}+ zla$)|CMuS)(qglLr@s{<)4jZJWTR=XN|myRyL-w3S~ zZ&oB5PSiY1t`4IkefG7P)N|jgp31?}EfepjOn;%kZ`FcGiibtJOLdlF;|YDw5NYa` zuy`X(#F~NBPL(Q$4qBHYLy#(-C2h+~2lpc5=e2*DP8~y~ia4m3-de7%o14Qt%!f-V z+7Sf>_tFaz6B~qTsyP}JOCKL5I*Cf0;gTVm9cg#>Vt~3X6ns6om=#W0^}zkp0{Zbx zdhFK2opkA5kuXX^k7w%U7!b%S&00+?jq`KBDv4guV5&**mop4qwN_oJD>yYo%&36G z&djiY!n|g~mmq?Zypbf>UjllTxF5 z7}mB;Rfj)YXBN0w&g-1Ds^S$fDLdvS*(_RdB&(Osi?|93pF2OkmN67NvkC>@$CYr8 z_ktK2WfCe5w#i8;$JNK2q`IucNO2U>0cOh!$U5HF$>3z? zgHXDRs8G3F%aW;j%TsxESIZ=nFm<0s!zR^W#LW#cv(~4FiP|}1tvZjG^5%Fu<)qt% za9rR3eAbu)JT$l+-;ltHuJAEW60|v9U1&x_q8d$0m*dIg+=!5{B&S%hF-OLssmW*9n~%4Q z?*uPKRPtF2n$iVR?+et%WL@n4Y~*bjE7s}NesOk^VU(NU<`}Q-F#O_*-+7|ElK;KM z94=b4%*DkuV$k@VOCL7XX4CEAp`ZLt%>^dji&j!;59SP8BBubz(~r=OFBUZ6sQtNW6x73H~U?Lw#EoNmV##I#A zva8*022qmZd&;m@^3Sv_R4i*Oht4#!D+>edl4Wm2d_2(GF1jS;D^mh1)BE0+^DzQW zADwwW^*IoCsurS^7wh=j9HVE_Fteq9gl-Ho$}W}-G)*ckSW-B^E*b^SipY`m@U%-= zwg8We8K%5R_?CrUHs5lkU+KB(fGhm2vA#Y%`3!s)GSUmNUjWanIE*)bo7hY%-QLt~ z5nWq}oy3Y3lqR*UPAM4aQ4BR@w>)Zn_(QkZj1aei}_m91cAc1f9}J2+IFr5 zZfK+XJdR8|)XR&^!F{Lct%YB+ZLfaHP`$~FU04ippg!4i2RyDw<77{*;D8 zv%Gk~CH$xCr=u@hhPmQOS=#7Tv3a5=XJ{JK>a<&hnLvgwdemr&8f_M9P0r_s_ETiO zGYqt_Zz(0^e0?*O6FvTwAyzqdkfi9Q(m!{}4pwQ|qDqe8@hrJZonQK8+>rsYpvh*O zP4cgv;=uCei$5JX9MtPgopL*MFJ2H$yh=__7%Cu+b7WJ2P03A|g_+*<9Mp=<(~TEA zF%pb1(sfqH0fNVK3)#I3w~_eSNn1I_gZa2=yr0&ia>{w#kZ32&R(D4;^EBw@P*|QH z$S+eoNY@Q9M(&eArCK%4&XO`@#;~C3y7K@93o#^dh~#+|ZH_J1R7=yveMx>7!DX4; zzj7PIScq4h#L=0vVGkY5X?fBE`SK|*a+gs}v1oMMxb{7BCVlP-Be0N`@X4C>jV}(y(SM6 zmtky62tA!4jVa-;pPR)~DOT2d8*2+n@#YiHZTg0ETx}Ps67sKgsUE@l72hzK zcgcDcQuC?5xyg4hO=$rHpM-yC^FFt}7<(g0j4{~6HR^Dl&|8lxk`?vM`*H@U?jQ!4 zp6PWCIn?v8g}l}wjghoOn*&)Va(PMm`&nJRvp1ni@wjAwSAL(x#$2aP8qRsC zX}R6V-^M18Fq)M3Ga{5`i;z~?2wYqNuS#L-M-i1Y-`7^8PY<&-Qj(77L!9Remqx42 zOdig8{@R@@=#`I)jaSKIqG!tYEYb!7R()Ann$`7gUCLaPU*RbD=B7n;_~GQXL_zp; z90>V^e`Gil<8`a7kndRI^ov-kF|@D5WS?kh^kSBIO(w_tT<2NZOBJ-Ezji#90t}qi zkpp0|s#03!uu)Sfrg6sIStDOUG6EUp442ld%+mIWPeU(EUxddT6aA;K>cp#_p+y3^ zky7oNJ{yc*O;1a6#}#Yx^X-P3nFZUt$7{mDt*#Ltl6ABT+6BYzw;Is!;}fiETbFOd z7Zfl{b=!WYb1z#ry+H^IiGhV(+1dpel+$PcV#_ZkUNAV^tk+DQb=--;PbYlupl4^N z5H=*Z>YptV5Z)lI?3mR*J~q}DnPG}HK28!7N1a7E_C%E%meFvvCY~W};Bccs#q}%p zC$UaAp7E;RKhODg`<=yG{_~BUsQde(t_<>qxmF$e2%VPzzNCV#zv55`#mA<~k0d%B zY+j@xX06Fhua7_ckKcU40;}peLn_Z3@u+I`w3k>@Mk(lu?vHv@;@iU#aQej5sCmOE zNrEIgNH#JX%;jNy-9Bd_WMIs*?^+>>warf~Z4{Azhc!7@@GE{LfnZG{>)l91o_ zX&llwGCV3dp-tueoNbLD#c;rPvd+UsvM8|N=Jc+RG}?s z^G!|xQcw3oQM9`$RP@U61}Ds7zn+%Z)mFh4&no_dnvX0~QzOs$7jfzc^F=5wGkuPs zYIaK2f5AqC=$cY_z2nFxYtcAVyrMa}Twn@scQ~o(->?dDBX`TH-|~DN z_E(v5*$Pii5(Hc{gSw^YMDVJbQ@K5pfs`&ej*5;$hlGikFfY}LiD9pIOJ~`%^)b#3 z>miD&Q-#Q4;=I#}snv*zuuw`3IDRg+Iun<8JU`j(GF}}6jz*MU#<9l(=XP=hVpQ)( z2<@a5_{OE^uu#`LYqk`;-TBlUZhYsh;gxK4|1W?gzBqF!xb$r4@M+3+1t^Z`PhR+u zW_Wg@=1Es)E|8kqedB&f4jr&wUGFyhFqzm)Oq7QXuR;mxYsP005*fM!d};;wo`o?( zwXd*VX)Yh>eVhnGpt6=}2!_gW46ZaIgL7CyIa?CyI(w1wq3}^(K>H1qx<_6!J?pQ! zy7LhMZricwsWYb9*4yVUs`tW)4UmV~LMbuM^9ok5C{W2T@=Mdr2J##2@j7;9zHy^I z`k$dR2}A{Bcnx-$2`>Eo^dxD=MA8p3vsD@S(p{gpeD~@FY4SFpXn#qHqWh_=FZ40Y zmof@u^O8)o^dnoZ`T^7s<$PzI2jss@i04Sg-Y$ozdyQdT3L<~^a3wuhR@BbT~ z{Dt%GDCo$Z5fg<MNv;{uNvI$ZF5*AEE7A{;;q zF)c-Lo7&`znKN(RFp3`luox+PjhgbIYs24j`(9-btaP!7hN_%v-B zr?o>dRhsw&`@_FLBu%JB&Y;hzZi@$&ilhC}hQPVsxYj5d6}X(y0O+3*A;20wzhq$+ zmyvhBFfH~w^VRiwt|LP4r2Nv9dn3FSb?4oWRBP_(a+ufxE0#u3$_ZWG*x~n2jFu@o zgx>G%rF1;e%Hrc}>fcjOebeqEP!JknxB|Ed7iYr}O(&3GzZcqPi5fWA*={I^{bv8U zkRUj0%v7}(GI)8i$`xy_KQ%)}t{$~-bp;B?cd?uYAa(leIRLNGGx~&lwHI~`y><&3c z>G+iM6XW+JTdcYrJ^pXyCICLtnK@SK+mV-4+hKDnz{X|2G$hUZzwrV2b$f%e{W)hA zd&uu|P4AA+=D8>gwBNdY`B;d$LkKpMm+HH9P)wPp#CRiACU45{PFdi$wp_eW@w=eL<>9&P58qMBH@qFGpc zYkcO}|5UCW48;IyH#&?J&nS3QBhjqw<1bu~gh@uR3ZtKW`H!+Wpb1dI-_eq@xYA%- zJI$->7vcy17%NFOHr|Y0ox~iUzXGzQTkPpJa)KP66?KzK$idUW{@42iM*w3>QB zz|O6q+c!SbB4CFGbQHrFmc!}^>fUIa)M}~Uj~=xYH*MBQh*==;ry4*8y>+lN#`CiH zC}W}>wxl*{adq|ebe#UdsI+}IEHnx8XLJVO?8bTN>%}n9- zvGgqhOPZ<%vV*#6$-k$|YZ}Q}Qfo*+D1M2W184KhQnqRX(&K@VqztejLXGMcQbj4G zA1pvj2UYqd>SfuPTXki#^BHLt;!Keeux}C3QWmypjl)*X^zHDB*g(`z0l{Y1#v#wd>7sT+Eoj;g=E#*8MDI-zF2& zvYPYJL9ZGC<#rh&IVOyyD-oS*6t?8-MusLiovZ;hF4(SRedAS7B@##!$cByz@@70X z%@E%wjCYih9(&cCt_fK)S=G3)vTok}dJ014{}EazaVG*dj|hTqbYoC_2-gSl4%&M4 zi`k)Ddn}M515oVlO~Ca;UR_@;uXD6&6kDR05|bUw9nstyU^Un&W#_ZGg=2%zDS_fy z>a@_pSgCr}YM~l41QH#x_jRsLEA{G*3ABR3R^?Loep|R`fUw!1kQ87Q>DDZ^btG3X zGEk-fP_Z8N8;a9gYIvu#A&ECIB@cx6YK}K8B^|3@ufQ*W;yxM#;^)vTKwHAd)vi*= zxvQ?i#&)WBP)6h=JiPf-ghy1i6vawT5MgbHuE(O9$9`(8z)g5L$9!v#3sMA9*t*Dp zgRI}SQZ<(L5;58%q5{#R;h}xJ*T*g2c!7X&=D!eBN#bV+=y^?(0%{^tp?+?)-oW#f zlY}6K0~}%b4lo6rhOjm?5QrMsOfwsw%~py`P&!dDl%~5#Fkbefzq?zpCZRPt=eYY-=ir&k@6okV)EQ%yz0qn}S`s{o_W;_Uo$f{Sc*;=iK<=zeiq6a}B+K^2L{-yK_ zA01tPAGy*^9PjAKuYl$1rY6s-&jr8`p!d9Z1lD*iPaS0{&es7nH(E$D10HXwIn^rX zGO!!u2ONHA#;Lw+x!5kpNMo4HH&2nip-{gc27x}lfI#Lu*Z33CJ62nj=UUiA#S5r$ z=#7oPO4tn+kB6t0OQbA>cKt+3Bmwpu+_k~Bpx4)}r_HYw(+)U{3{Ij|@-R>!4g|uG zGh@fQq{{RyS8^?tCTYBy}m^H2xyxM3mB0@W2^n-9_M`X>K^@Le}lx>Y5jxa3pDziS3Hfn zEG|>uG1_m@`TNb=t+p;3XPN_G78XZ3}a)tKfz2>6q^b) zIti9191x^WvP@S%fwnKWlc>hO-5x|T3=lnBDqd>r52q)XmN+SgI|n+I78~p%a)^P` z3Lv3-j5$NHGVQnHwGH=t=Mf=32$DO6367A>iJa{!4$%^6nRbqixr73+K-zs&m_jx+ zo6ho%xqkLWpR4(>t(9F?(#n^IUdi-~8@_+Fq0e1FWvDoWVW(rzEGyYU3j+C`!tg=n zX8w8s#UctI&pKsX$?r+!;H`*zAepogl1sha$4Zfx8cICvcwI9mJE6K z{SNf%7EtHYC0b9fEFWi^i1*DCjXy$>n;UsJo64Tig^a&&_K?vEE2^L1|3ZO6ns$F! z^==%b_A}Iyqs6BC1_HZHJcb^$LCiAL}AD96ys<+W(egwxg<5sSW50DJShZU{C^~0O3`H0|P+GM=lHBDpV;xd5UW!f&g{ykzHUHNi4y;M4R zvXJxou~6YS`5USv*#2H?`zvPa6rdPD;%x8TQhK~6!T*tPwjTF(6 z013J38;zSseA27uC+9)VCM7+5cJO`k2ytteGf|>7b3t_l+4wrfF_d+EpQEBJk-R4S z%yjRi={IRia$(1to*~`p*4F5>P_aH>bVi(n-klQ&@ph2e6B>Mis6(LMhm8z%!28Gw z>|1pSNDe!2(8|k;@*V&oeoi*5+Xrgwg&#?=dep4Bs+JR}M||^6cB5K_q8D8DO{b>Y z@nk;5GpKrr^&1p`MR9FxZA~QU*(KgVq>$fE3&kZU)b0nF4IL1E#@PB=vBq~cDp$oSIeC^wBp?LCx;&lzpj%Uw7Mo4T` z^A7F;L@fwu(~%oD@{e9k)rQ z?xaFgT6T)+TA|S4d|P|9v?O=fPniM%#EA?Tv-UBY;I^Hk@y2Cf_39AZdD?yuP(0Pq zl@Y0&*#!{BQsY$0%cT70S!96@(T`yWZo6Us0VMKQM7ETRw7E3Htd2#H&L=zQ{xvOS z%jq)$1umjpTjX1BR8`S5=&G-B@>CV)8@+5vA-*m4Vs{IE%8bCYG0k_NAe!^8^Y*v%B`)2B6 z&e+E|<4b5%-mXNR6HrtgViq|0MJ(hp{Op=$pNL7j=u(eRq%g`PG*m`vHpQ`#QTzU9Y|2xw!D1KSwa%PVlRG6g7eas2S!Y_jxqzn{Y0WVW=X z^2oS~63aUuEo5cB8;>^UG^3dGcvH3uj*A)nGWQo zD9MM}Kwc{FhN5%dAd?W&c-4Yh#^6Cz^!q4WltkBc=WFsH4_p|O1rRXlZI0QI#eGdj zQ2|d<@=p*5frF(ZgSxcAY%g5P2ZE` z`DtR&6!G4%{8D12>3zw+ISUXKwd;? zmmdiQhXHjLd5d-$hjPTWVavtFr$F)5GRY@dftLi@jN5WQ47NbF-<=3bf(O#-YED)I z@3A|N8nXmy#xu9zpFkq-MS#)2k?ubti?@WJ$HpQ2HEnvX%ukgar>qIjdkic`|9oHt zd5w$dNGX^aB`M)QLg{uSr)C`8H9?0!%5G}>bv|m!WPMF0wyLG=%*~sg*xM1NMG53*0n@ znEXV-16&{ZFn7W;3gSR%_LdU=cHq^mH8dbt8#*ZwWr0^3 zZuKxhBy_+t0X{XSfAaEC3c6QbrUJ?qU&+pn4UZ&!+byC3cnTrAn>X%uRE>*FFP`v7 z;S+>(PMH!r+G>K#g4*PI5F{ z4KeKjNQyvO8yD5LtNT*rjVcn4J22E=EqBLra^Ue!MGE~iU+2& zYC@tw2k8SwgO}4)U&|x6o%Sl6$aU}QmCj4hdoBRg$xIY1n#5wj^z(9r8fW!L_jafv zZNO$eTw|kVorZ|MU~?=SIf-fJ`sTjeYg>?+zDP(KZnAZG#v6h`bX5F-LMM;<-Z*iP6g$N~%K^0ul@dE4uiYD`@|<-I-{=qcc^t3NaB zYKMmN0Jz4fp(3K~2EyAVABX|Cl`SGcE)Pgy4$$>&1dd-k04c6=S8j|YoWR{jCA$6} zqP{zx>i7NssBCe{%vKpGbRv5mQMP21`9_Ikm%R$fu7s0)j3^=5BT7akBYPg%d+&LE z*U_i%@4p@$uj_T)*L~gBeU0aJy`&Le0OCe*wz$YkkLt?katKCzU+|Ku=3MsVk~^aF zn1#iJf4KNBAYG#t*0DXnhG_Q3h)e5^#Xr^-u8_7rtR_WJk)jH8zVpqQMudx3o#lyq zt`>I7#WC69Xcd8B6EbKy8btw%(dT8EqZED}$5T%tX@j4*hTWWgz^PjRk^GJk2jVho zU0vuOXQkHJ+jr|m7*I|b#y4M?cJ{OkA0V#DJr6k-IkmZPG3GOxm*yKMD8`Ocv&P{f zsr+$H9_p)~UBlXb$Y*hye5i} ze;t4k|0HgloH#3s4GtbTg>pJ^P*s2_B|>ykTa3Q2aFUp0I8Px%6==Auev8}zuyG2Y z(U|#JT(Q&l=jUKczgJZ6J6CpnH#&y+4N6L8;a1_$y-7JFMU?=I+NxGYmYzW9f?;kO zDPOo_;CpA?PSV!H5`ox;Jy6N(Sq$f0v`A?sK zwL@Nqa3CClN8muzeeRCvI5@rmd_Q8%F6Ub3M?Pp~8Pcedfq@~k*C|>T21;kC=Emj% zM;NHGfP=;P{q1kX<@USNOA0zvX-uH~UuQPy#LfgovOR+kTJ__gzb{EPNSteQt>G+I z?um9n?4Mc*1QpyB$K0h$Z6%wHUd;v-Fi;hO-S`9GxOMWb0m0jA2u=#H6~4yyT1F{$ z6U4>`S8LDm=s$I#JPiuHFG89P@4|AHWExMab9R2Z`j#Chif9uBmgJZGEune?hVCy> z`qAJZm6crjDh~uQ2)0m;I_^HCq1tl3Er(%la{=JyvebfLR6;2d(Mb#jH@ZEKw&E1o z)y3MhaZyUa#N!A!S!0gnTEp|VJ@X8itiKYTlK|B%?|qU(>TeC#%eI6|p~-Z+`89As zSxXJ>-Ry82Ij<=n0k0DTZyZf}jO)CZ-rY^94^>HsR6S72g!NC0dZ_J}AI`!fd{DzN zZR|QO{|Ka#C_a?jL@$H(qdv!NVWH%ay~$8~D$(ayHk=-Xab>sYw#V{h+-`Gu5`%&` zLqywoIP5=jcMmsKiffUS%BmoA7sxU@$>p&l(%>0$%P*7sb|~^BiSSeq@g(@+@R;@~ zxQ>)E6@(r!Bhg>eH$1AoB2ra=G4kN1+_}pR4fp0=pSQ3eu7DCxdU=!>3nJ|VScR|F zj{*L6+tsROL@EQ4mXx@#sQ@c|YZ}EFc$oI;m;h)HtN7p|d-T}YuSuo* zk7~Cml(pgbKLTXs?_KGHCY3QFoG(IK8o2kbUv&1e=lJ!I!PA-P&MDf9ZD-00BrU~4 z`LqER7*Go?6SmSHN%ETCCR3r+h#J8R!Jc?3c44O~^4^qFpX9v|%kPSOEkn7pLte7Dy5Gu#(O)nNpYcdx5g7{0d+@2$fFQ~tdGCTxT-ao^cA?D1HG2-5kt3=`|MGpH~5hBpcWVOgSW;H zDK*1<#C4wnkMnvyG7d_JYk;-l{UK-)*(N7X);OBkVu%Yxv_WQ5@p;pN&Ge^-UtwSP zEiAbA6ch+@iEC_5phZxSpq!>Z_L}%u@$$d3P*VSJcequ{`pVWV(t7yyCOF|gkR3Wa zkEoHgs9jUj#FpOrfzt>W<>Qp?SSh2Nv-Z6!w!Z9Pk`6rT$jHDwcD9g{AB@LYRzZiV z4IBNOHZR2qSjLEb&aYa=Jb7YHp5)6rpL5Zr2rkw*mL}n5K~jgC2y4iTa-FZ1uVIbL zy#?-0%+l(sqF2?_xU{2Ow&Hc2n{jQA6_r51JIOZuBhBRg*~F-oy6KWPaWNU>KF0zb ztCFqx{zOn9PQn)I4!)l=V>GxJ{x&rY4vF{u$$I;opR*+iHtt^%7!W@}3HUxr3{B+n zV27Wn!u_S|{<$)w^dcgS7D9kA?F9j>m_J0!zgi@5c?g1E5|H@$QA*U z7zFkNa@A|y#QtZ&+&p3xEd4go7t_tRKA>#_7Yqd>9gmx#Mj8L5=iqE;`4??Iz+MER zy?r|?fSJWrAhfT-=AdDwjiwmZ8z_bWp6SZQ_8|iwBN!+|R>E@%!v8`M$Gzhi!KO)@ z@}Km?(gKloC}VsO~vy`m2k+qxv!qo}xsvBTIJb=6B@`Z<2@)~D&(yrIl-JAk60z6p_wSc98dG6!giBJj9Y-~ceQqzoWRBJ>Hl3MT|}u=@M{>s z-?)B~UJ#;^N09xMy*blT%cvC8aprf%Em2xi3x???wtbHL_%308CF)n~a(1SlimJ$0XzYewq?Dg-9 zdG|=^;9C6QlKIJCI?Y@cTyxKZBH0u%xg#RK0kdJ-BuH+@ie`FnQ{@RiDENgzdo7PJ z8^vRqVy9x@5Saq9*nZu#siijIEaDWL_`7gy?R-k^O}!5iWL6FWuKOtzvnb`7i3rmB z9b$Wd(NHY#vh?WtkMcfXYs586y}nFJdS?=Y>gm9~6+@0_%&^JB_5^1d{C*z7T#5tX za0bFp1N?>V=T6A?fvN;Odx8U>2R-);`K&R5{>^qReKz>E(W8bM!|}a_=HE}GL)PK< z;_9pQ2e(RD7~c@TBtfkN7Dx@%Ybaw~p4~hTTf3!mU*IR7wk%{uN5g(s>9M-Vl^k&qaI0L1kGin>HEz@~t{d13g8ReuMCi(NW#>js~N12vrck z4an%7X1*GD`B$~si#7|?vM9OydH}|Kl;BFT1zhY=DtI2E_Xm!|CF3UQYs_HJAm47B zKf~y0#bg3k?-M8%xhI^Ee+O5|^S+teCZ0E~ew<&q)gy~xgI z#J*$POiF~OgqlO-Y;!Gk_C7e(uOWbJp@yB`C*M;>v=3!V1j z(PPxyk)Ee$a~i-b2Y>GQq^M4H7D80=7q>GQckePq0J{;Or6ZU5Qg0(^DRr6F(X`Ky z%7dBp@2s){N_7xv&=55CZDB=Z>$VtgH~F{oN6$ouh23)YGJHWB@Ei<8)uRN~u-557 z*)z)Nu*|y_MwuOBleu&VZV2!GL{}JN571;Wf9fNdajHbm4Z$`iKV6%{OF1C z4^?GR@AE5B)x<9mkc^Y?%2AwtVg5Q4b6Z1DK=WJBy#Eyi^-Ed4sRq_nNOVxy+xgSJ zBNSU|q?zUU4awtXo}hKyzx!z2GAJP`xV{WSE&xKhgBmRFZn{%NRz zmZM6C4B`8t!M2$?Zu2K_bN#yUAm_B<#X#*hu^VoLzbyj(KO~k1DTZ|MSXk)6rFGip z+2jI)Ki~}9!&%EZFRg#O+z-BzDoy9$p9luTJ>ckL87l#u&`rUm`xcNGD{qhJY_~v+ z!%~^cLhGb&Q4Eex40wVjX1*R@Y^F{!`M1HDzf`o*7pTefUcRpGL9uyit44}Hkv7S5 z$T=q!qosn7{C&)~#2h{&uF-?2t{K|&{Dd2+jZC=`bZ{0Lq||+qSmZFo1ZmxV{$q|# z(mWd+h@39Vjh(8QW2q3gb+ALrjEZ#@63y*ZRqZeKA0mwcN*4`xA1|oe-F7r&WhU+^ zZ&dRYevIq!TOVMI;6-c)64Q6u-zO)+e%KgZcSkrth zySZ86x4mjG^Tcc?pF^f*Jldl=Mo!odU$Z~uW;5x=vAdQqaI5!Qiplay6o=o0P#ATK z)Qky_G#vXJ(A$OICN34HXag=k!E8tNCPLgryI&F$`saWKKM`Q5)Sk$T8(I(YtK5pP z`_Z2G?xNOV;}*O3(w~#A(d=lwXAG8NHY$cVqlW!d(ogp?uA|0V`9377%vDW!(R{K? zVoK%T?2bJyBo~3ls7D?}0o@6^&TP5x38OYfEf$EE^ zm~Dr>JlxiBYkS%HhCs-}CvvTQI}2vgvJ>B;CX@L*T#Qz=*b_wW;bi;yU6HETJ%9LXit-6KZA z)Z^02jXi!FgCE@Fe!j{V?gYsffbm@QG&H^usz5k=lI*Pu3B?C!8fn*{*P9@A8tIjO znPD&O8#h!$HPqTyhxhxI4hl_lsx!`qX-ury7<#&Yw6HMD@^_OJ7zJO8)NWSu=nFt-C0ODJ>}KC z??+A)3CKb&TuC9WzHWH8p4RMe_du(qZ|5*8=wY=qkFP}o&(eAe_FUMHp3?K)b6*?r z;x0{z>BQ~7ep`-~^QvM77!<-*CcPP@%+-fwak>g<30iF;h<^ z|Eb0c5rw7`bJ`YQv_q4OURXQ!5=4|{EzQ%iWJe#*8+e(2Ka~^PWHl*p#-9(IQfqhn z;k*YNw>dZ>!+HuZ+rJIs4y|SfISvo&4a6Egjs<06wv#@;5y8Ks*}Or1#qUqZt6($J z?e9hPegkew@e-cu`(P*hR_kp2ydCBe&nfbzzL3hpxG#pZ57!j$4%e&|5+r5DEIm`V z&h`$!6JX|daJ|Oo-hqeVqhlL+V8D zOogL7itIReXn?xne^fK}N-0r?LY)=>8Ls<1t@tmay7956jkuUH$v62_;?MnhEhn8y zly0<>-oQ?)mTz$$S|U4C7c1uS91iEVbkx-oR=^w>^plhz4q8S1Uvp@v<4FhmL%@Cy z@s#LELgM8W(Q{VjsE{pvGunQhz{`fv#`@=f;$nL))FvcnCO{R6#?sN&l*>#s`nf}8 z_Z@ErW_v?`9PC~BR2*xPo5l36`d?FV><2T^4w^=8k=#w=)2J1efmgokdvVEc{QQ$T zdxxFs>xA+oH)0$PmwBUVR@>HG4i75jEKw_JIdb?Ohl6pinm1Q`t}_d)wa<3oHy22& zx8}049JJ_LG+5s$hN!^(yBY8_up^?riu*WH6}*y`aUs*|^btylm$nisR?n-M^l=re zTE`H-JzV1k4IwdBxBo)iz(N~+=`**oM}?FOfS(;}b5=JdIC~(BP{6=O3X4CPhAZj0w$b91J~7@d%5!N*z)=Wq-mfW< zI82Z`7>X`*tHRr0rFjnPg@sM~98G^d<>p1w;%CeIgmPu;1#eF+B|H%{-wN_O*zMq$ zKlRjdX@ zualVV`nmI2dD1_ed$*`@spPR~I&UmhvPBer(i$1g%k5MDi4pqsT3;~bLR@Cvp||-m z^P^SXn2U9F=LgOoZjUhjv}|{YI89qf|B2YTxQL|0xg@B4?zH{S%s1&Zy({3mZJ7S< zDVN?hp?-eZFfs&y9fA7fT;YP0dm>I0k5idJ;terBaX)D68?&W(-X=uVRK85|99?ni z?nu>qbDh>pOAO_+@mbDe{N0vYv&1X8Cm2l0NF(g^V45Oq{o__QKh1Cb`29mgp?nDe zGoD9;MM3~XyDZFs^aS#O&{l4!kLGtTh?AG2{%iWZ>Hj#dp z=2Al2S#3_Ld(QLyxOB#ms2{V!u5szRGtSA5%8Sga;9-1j;^cP&?!ng?x%YxkckIsG zu|9KQCK)n0dP@XnQ06#NqKK6?A9|CDRLRUAd3=yfDZP(KBdV)AXW>>(V{C8wh-aKJ z-;x5gGOxAjyWcAkuh@P=NP3FL7j7EG)>aRv34(16=jPdDQ}$!0?cD zdTim0KN+?UQ&v=?XdQ*D&2}+0Py1mrmCH;>5V~IrO$fIgdk{3DJxym}v07fA;=K@D zb3izrjZqq2wg!^T9v08GDr6iM)-~0ttGP#vXk-r?-xy7@3cRq2WT)+D=DqKbMU3l> z=M%WRb!`Ujmi_x$)jPYBfhcwjX;pRU$Mrw{T`B9=LA4HNb4W+!u*{o5e1#tB#P+hi4!D$PaO zC40|5Aw4%PwB9RtN9WVdx+4 zjP6i>vP*W0cm;@;OhOlSyr)#L~5Q z`x&&4)(T2{4!_0K{3I!;>+#)Au$gOBY0?^ga~Q!Pw?Ecs=Hceo9e!LwJf7*<_j2Np zDWjk6IV1$E27Aa4vnoyJ_e(d-xjHgbuM6M7G@Ul*V&R@K^;lLF>sxic6Ud(;( z+O-OW8j#+xSoPvQE^8n^^JKk0Gq{7q%XWdYcJt%ZE2~ci!Ra9*OeXrTCd(rTZRBQ%VV_mF8qCEH|1gy+`w6-UsTm<8^gUR0L)Wow&S%Pk(z3+2?bD7c>RL9*v6g zAtfRGcAk$hKY)S}RiM28p@3{E332KgPyrYsS`Ab#pHQ2yJD&Ow{_@L+^HQ_5p}V9y zJn<6T9%b-vMvPr9IN%V0kh3P*8GjJgHizDT`W&GPPAS{fv`wJ(;HHs+?D(}a#4phSs1-tufCMxnfPjbKF(gGpn8R^EzlRqXc@+nxc)c#O(SPqdP?>fLc9U}h)*`l;4B za^+(@5>@c_(u}Pe*9DT7^0p`^9iy1GUCzMSkAta0O|kygfKt1me5W;(QhY3s2mG}Q z(9$)&RrH6nkduy+CwA#;`6g4zFK2(2kVYx?l4Ut=4$MRD+sGF2aH#mzq z%w39&?FH=`1_K3-00LI!|YI$u)oGkZkh+=Dk9?%0%#@esv9V_8E z&Twmfp6)Z1fp39U1jHl@*%?R4!CE+NkBqt-d&m_zv-Lq-&474_&}4B~Mx21Mne#(U zG2hqeY=j@Ga17xN3fsSR)xAsJU9)yWqOZOg=%_W4LWDv_!y}x0yuGI^oPiHk-4%%(77%=p za{ng&s_PRIEDg{Z#gl}kjXc!mJONTtG|6e}L(@Y>!`AmUCNLek@_uWo4_cteBB;^X zR}5mUmPu#`1q|tHP%KqE)*_DO0%o+||J09*F7-e>Jz-%%o;6Siy#@c{MZqb?73o_< zOKbMKhf)BD$R;!&R5c$bv;(*dvbV;($Hkyv%bvlODL_|3_Zv_5LQ>8fz)bc-7Nn

pbhsD0{cF?#N?2RbYO`M#Ac*%hR0-Fepb)3#66EX<9L=b@Jwu=xkL+#;jE< z8vj*!_4y#>5{WLK9LEOo2sq~fkcWYKd0)ti02%aIoY^p8z$OH}2Xi8tE9$ytMI(Q^ z?S^_H?xsM|RWhuh9nymdc&F)`rdSx{V5XPelp7dZ#B`zBzAOtVUa_8 zMW9e)+E#^a&FC)J@&sR9pCmCa5V5kw=uVId+6YA474_a>IhMx178aKI?Z0m!Ay=V2 zz;4%9p>|56zG~$-5-JqJ-F4j*Lzi?R$68DnJHw7!BqAd%4K;u-XegiE&okWB7l zr1IvRJk<-1)-zfEE>SBst%6m(0ZnuOj}|ZV8M4-ntce=J&TaESw(Y! z`aq==#^T@(i3p7z4wc5q;hz@i866KKn?cHjP)D^bW%gi%iBn*K9(ho(M4&k+i#aVU zn&bQKOs)QTVS(fUT1(v%WVux6Y}S6v(<31Wl+N@CZJr!{X+8?6m9v`@Q;v zu(wtR1jB!e93V^tQXvGWs4T++DC)*PR=9b^VIL95-qlzKl|5{T0-4?t;BRom2to>U zcu}NZ?9cAwc(9&UNr2nTy%Od|giwdneBFB{P{A-z!B2pIhZhGj0S)L@Lhn6AKKKgR zyCq^MY8gg_BnfJ%2RGyWNY2vwLv6*NthKcDNd(Ss%wS7_%}aA0XD<>Z6#9Xel> zG|GIFltKUQfw5UJMffArcQLoEjgjbxvdMsgb12jb7)s+B%>)9=P{f0f#X|`3 zWxUN@eco|o_i;ZM&{z}0#GhV(pAN5p0a!UIe@SHX1-Zd+Sd!evI{VfIy9+04F{BS5 zA8qIgFld4&a}M#JGjPH~Z6!*{cB%6@>|P#>1_IWx*M?9|Dt^IjpEv{ie@`lN6aPfd zp`1$LT*EfM2Nj(UAH)Fg%Huk)BClRGiY{*ZijIIy9us}D=Prbh=ey~q?p=_sY<&lb zUg*8MIOPL#`s6!6A`2H9Hs(YwSy)6=rk(fsa&Kyg2oWtmhH}b31H@rg%vI>|rfgZI zsr85Dz)Yf`SYocuNL>{VGlc(@Hcxf+Z!92?LJ&w9U?f?bnCQqzAefU$9sqg9f;^p~ zK{3t#@=%q|Z*;^1rc?jN-Z8}MCvPn+Mz3iOSOAS20u7jtMCm!;$V7*c1}d=a1jAs0 zb%hh;B$wMtV4NV2m9#WE>^%jt;xWL%;TRFAR7LEx4l3^%Nu;%<2y_5rWip#R0)HMY z--JRr{ka0#V*=VUC=g=+f&!5^sXug)3bKObyoN%&hZ|u%kJJb4iX6WDPb37WKp%iU z*Z^fI!cHqB6%5(~y)Mjd3g%Zp|H!!cBSXOaqYFV@Rhgq#7ZHeisY96FiA~+&gr0`~ zX+%R(62}%mp>XGb4upY5Z1z~&p!m}$R8e_S6?~HCZnij2%bd-re!4(yTV_^K_`_60 z5exibUKPo=+1ntTO2VR`2(`k(fusW(ZtDYqdGrs!iTc<#*jjlUfqoWhIhs+zkJSLF zSVg=`*dl{=D~-lFgNt4Urhu7*#eV~QB|}_*8wEn0uDPL(I_r9mIYWhh_67K9AEytH z2q|I&Isga}E~ErlRC6K}mjB0%l<{JQ1yp6k)6)p^Kfr*CChQHd(=0KOv|W!3e+E5qr&yijz34BK7RX58R)0zv2R3Y$KkyO~+G9Qh0=LAxp) zbaGziyQ~6>9xx$P#Qv^r8SeO{QwXv%AZGx~QrJ@`PGhT4W8lNN4H&Z(-ntEwdB(zrc25 z${IQaMEJoo`J_h;Tv(qzyqz)DtaEm z)%O7PN9QAFM)p;nNQYdcA#I>`g8rFG_ZozJ#&3J|!EOg5j;OD>Z$ZXCVlvN^1+rnz z!>M8%p~Lqxpit*8QhAn=Dxk=?fQi+wwRfV68sy>h-?AnGl};rtW+V zFDy?xKQ!vRoJZtO4k3N-tRv+Ce`h@WaHq3p66P7ALk#~KiKFF|%Lr7NAvoKuMR;7x z26s+AgI}fZ{;O`=(tnh0I~4t+u>z=AX-iO`|I5lkQmI^rl! z%J%=(_Q>N^Xk~0lK7+E9_ASB#qobXYw`i7_L7V%-Lrm-e^Q>g_m6W}D6+xe8<#R!wUmcm%5B0z6jyU2u z0)*&gUp+;uxN7ag4u|PTq2WN29qAG@&Jvh>sa%O#>3&UOo_+j?_ZER0a4mzr@B~1v zBLG^biUnaw?Ahf%jtmgU1_H3aqb-B3t3UrpY`%tyd^#J!UMaqkO*ON=pm^gi4T3x3 zOaA~6x-Vd0(n!+(1oNxv_K^b3w7h@#?_@3Au)FQ=LThUTf9owLH==u7^F0|)5HNDi z0PY7UalRPT@rZ#l8%UxDMzU1RS`~?It|%X+0Nr>l(jO7xmdVA_T>)w@AtiTsgYDn* zT7{0}Qn@g1^A!v~T+t-*Z%h4&asOh&7=JoYyD(3In>bVf1d+Vn0Kko-4JN>f%pz_n zJW+w;wCxUqf{q>sxUEMPLf%^Yp8B9|DVYWw%R7McS^+J;kv@cR9|r7&AG9W@_rj%;k`X0pY>xpB7D&zfK$TU4iYE%TM_5cM5J&&u=R*^Y&nHKX z_>VRmeng*)D%l4vqTir{U(C za)zDmX>};-@JemZW|Y*+R&av$`v zbxl!z7Vad(OPdD61hu3^7ot{zsx%2MsFSVp=O4541^t2S^bb0~N&UCn#bTqtw_x8t zK$+Y9--^%YJVseqERj}--9!LLX*3J#e?eOtj_Utr=^(K+Aft2&D)#m#dAGs z)=sESNpbvp%#Wz95PM>yf($QzE=oAueX}cxl?sY~Y&)UX&5J;u1tCZc*<&v#kX@aF zuEQ!@f(aMnk&PWH*#<|^t{ks(%Py<@$Kck@jmKECXYm_QCBejAp;=-=V93A`pbZ1# z+;YyqXj*GnyiI65Q@d%g+r-l67=jBOgF>N%h4ig8kZ8M#9R6Tf=QU>Fn>Vjm0Cb64 zjJumrl=&p}!2Od-=q#$@dFYTB7fl)nNM%xI1$jWTHd>3aYXO>0H3NqJbNTf%igs5g z`<`6h|F<2Gk^E~853ZKorq-r_6DwC4iMg#PC}WUxJ7ejL|=Ix@BkonMq>r3QID8 znKG^u#`8uiBoI9KAMX}vca5_3w@e;7SIDqU5@9KWUR1T|H2k|~AT;=E)bA&#{qqgH z3qE+&6GMs1&BS;iB3?GV*|(zL+H@G#d2nz5k}lc3~w4RyLIEENKTm)Ml#MIDZ=2+*VPb?oiFM2`V;=XfRKSX^1+yCD+%KeD%=5G;(Gmo z;+>p#jrKc5vS!mkT(1f4%hJbxZb$FTCK;QM?i-`%ISu{$QT6=miO8RyyE?*Q;3ys3 zs!SR3WN%<%@IT)}{n42PmeaF=BS_tdiT_6%TW{hw8 zOBset{G-fM!YxL2?rb(Sl&ju%BtYE5p*M`&H6xoK6qWSf)F1iFKs`!Gj8f*ZZt(TI zlD6Ser&P0PQLc3Z2bTZX2o@k0hhLwnB% zOla5yVj^`0vkejED0E5aO}r}XQc*IIIUczk`xD@vN7M(O)|GWT6N0mwaQ{gSvCldO z`7*u#vQGlQSc%`-oa=9pyD*_P>0kVyF)52x0P8rtw?hs#UY^KWk|*-VoUv=3Artf0 z>`iw~Td$Pd4>gvz>glm-L2bj3d%9zCQat4><~*23NW;YD8B7P87qJ-p@#&b{7-bR@ z=Yh6_0%~v>Ag<`0b*4B8k&Xf&4ky8tp^&d6oO9@yGIe4{6?hIN{LY@c>~>ot_<;kt zj8GsEbRX&9hG$mGK*7EQwmk%&(<3xKoPZ+h_hC$cw0p3J{ImcU>knwn^N51>VQpJ= z^-Gsj|3;j?I&n?^;(4anKy+V#ULZ?v%2a$A)pS1I5<4=!C&6f z`}SmH5ES4(p|J2xP?+cpNXN&EH|(;luWs}UT%TJDqGqhUnV7^8wI=^0HFW}m`BML% z-XB1TMtAjD7Em0V4|JoupNKG*uSYpKnN_yER80j zahQb;wN6&W`0T!nDXiJ4bHJCmoJm+~iE!~7ES~3eklp(AyLo;x#Z?I3?t|axGLu^# z4T|c$GTynicQ_YfDj@E81nL+3V68_BG$_y49YZELVQ;WTq8w z-f?Vc{l1iU#~R*sZNG!G=XdRTMn}Fkj{smz+sj(}9_ANKNuCpGEIr(7^^;%2FH+){|9mjO zRlCMc*3cE=6Qc0XtPY3q+Y~Y{1ooW=pKyGZoR|_e_1)_~Bg(4-b1y62=M!>Dgp}9H z6SZb^D^+^adb|Cul-2B9pr-Q`om1=jbR78IjyyKhvr- zjO?|^niv(a2`!CkM^_qpA#)xh-du%vMG|8!nNW5$O1W~kOt;E|)R>N2FYvox4%Tb- z3v@kp&~8IYwyC@^i>Eh39P^D!h#sPLND6x<T%prwssdR+$2 ziCiSZz8wTB3%Q=xPr5BfX(jB`T4n=RPKPtVFl^)Ddp4q5e!4y;({|rxq{Lce3Vg^T zDwAbOf|@cQmXloMJ z`WdTtQvCW0N3)jH4;q$yH=Jv~mVT1OA2jT&zfX}XR;*rqUY5<5SyXepCYCt*dK0Q( zXhxHN_O#@ECMEXrezad>!xLX@aNevb)z`aevG} zK5D11;jV=$JBA^>vAyBD*cZQOjPAwb(%w|33X!yhRB_!r0-R>T1176ix8;PQa~ln; zBpzlJTwT5++v{!9*#0x~pjE$?fh-gT3Vq7^yNQ_FH(v=BT_VG}O8@p(rFb0#sn4vY z=$qZ2N6`_N?>@ab5}UF6$}0MYxztTF&PT-~Za+s(isbEeEKbZ%3a32up8hr?_vUav z%G7H!lWB>oA^$wbVg0-TN8$#B6ovb2-)Fg$oz>R+RqN4WDSL;VymwsZla?51qaQ8h zPgbvV)M)sut^OdKO*j>s!@ipbOEO#A7cZoIBvuXy!Ow*Z9}cwoEhlC9U1#~i5ZhQM zQj&4iZ>}}!Q#j_wt5FV3uie%?12y3v@1{0=$J}amd50D1^3SuqZH5E3n+e;9HCUIk zmD?UIt=>FfOv#}444CKeonooMZ>(jx?z^s34sQ=BimWuznBr?cn`M$O0bGS|RNKPY z#>ud<>kBA0&y!d}y6slK#p&JqOaggT+8s6@Sw2LbfmQ?>3G;V#WKOx>Z~gKlbyQij z4Z|7UKDaoM-0qFvj|)wec8E#7(Odgc)W1Hz=yK(m%m1C+zHO)z3NVXyRm|#}TIE;s z9tY9JhKG4y$DYpk#ar3F(CSFHj{htfZ{-!zeD`8TeeY)xHo6X}_mJE^%9&S*r8QQ{ zlbyTBe?glWKx@!4^|silxHg-de;D$P5R8029@#q?N^m6%SbRSR)6|G9#4Xiq>UU3x z?CuU#co4MK(unbQ;(fV|Fxa`)r~r z;&R~&2K!)LeODV?01!FWlX9@JU+TNOdaK4{zqAxS$9I|*KizfT_w%0xj_Uo+e8#GJ z%@bTvA!gzWNryuf+`k0>qKsE019SU&Y%`sH~#Y#RYDWN&Kzw=?cK)|CL-YsYb;byQop9y zR&B?2Vf6J~@^{h(8!5uC9!?Zxz>s&Pj-u0CvTvJT@P2%BD^z15EaDSU(Rs?-eOGi* zLBz*oW4kZa*R9U@Q?LlXnhzNly8fy}RrN_eMRvl{n(EY0w4->|8- zz{2!Jm0-WZ>7?rh%^rt^Y;q|p?dNi=I;JC&Fxz*ALqg0{4#x>baQLv`lJwf%gx8X z;H6gmn_0LMF~J|9q35&5xy;?ej($nG0TJMMi-MMd+Q{)g;9_}5#-4B5INlzY#mG$r0JSmg-YKKK)2s^&1t)-7*x4r5#6ycbD4(BXY72Y=hnt`UsQvx zuEjbhjL>EL@pdL;oU}ow?;a6f*sVMK{883@-aD)9CJ&=~75DGaWJJ7XzbN*{(q>>B zS_)p>F$`azc!qDdk-!zqV99b>NBxpPujSYF8K*UPt9IHVrtD`g_tBM57vt>T4p8eo zZ_~zhmo7rzTsM4zqkQ9lr*iDB&&#%N%H1`|xP!JTv6SBG@gF`HIZS2Ox{BZfy5d`n zNlm_}DLv+x1J{*dYw@j?4HulS=7;39bc3uarm^Or;c}-#Eie5+e2<)L0em-%0LxW7 zv_Ftus-G(nw9o?MF*E7HTZ&(v$nq_mc4+mj@L0!SCc$tg$t7;C=TFsa42IYdSz45L zoTerS{&+(jes#zT@9EjY!WbpDjVl5m8vbC*Y*#o!8Zf~%bWJqez7mI=cJvVr_(QYm z<>gOrR`1o$RMpmvZ}Q_PVaOj;)S#sF>nA%l{~1Low#lNTGM03&LPhsfgO>=3Qho`O zNg*L*6!n_9gCg^4+m%bandBEJW3{4Je|7prpP0DFNOh#s$y<@1=ygKw4)FXitrkf+ z%(96W7FaO!z^cZB!ukD_1kb;l31#}-> z#_4lL^Z_}&N)e2!k`)@8YHY&%4Q6Bw8d2I~${s9X(SdyD=mxdjuI z4VD&h1GjQY$$YNre(I}`-ThWys!PT;Hcnq_{DYAs>IyX`r+wA!mrkbRt;lsgt{<80 z%3_(qN;mp)5CY1Sq=V?W!@Hhai_UaxNYov(P^LHybVd znp^cs#ITGARIRI7w@^d-qop;65%?YYun-%jot$z9Z*X@s)g*t#n(sE&jd!|u)vQ#S z{fOc@#8+=e)nL~8=NO~#t^G9B+qwBZ_f#4u`!9{{ zk`uo#+m(ErXm5JSGrslekj7j%^S?Ma1|@py^E%@KDMB(YGQ9fK0g}(*m=fM&1SqQ# z`an{ETKtrVW)HlaXyw`sh=-$H!9bdc5MwIP>846`F!K+PdM?Bgs=-_DPkhee#TAUF z)T~A1%k2MAE78+ zTjFqx;G@RX;O+X(go^#%-c;K<=%LICP71exz%nW?d2P$=@NC58GxLLW>o00phj*9c z@I)zIJtp|MML*xW6PIS5I2g?}(dtVhg;7)T4fehEBD%1`LH%lyk&)G%B6hPk6Cbbdv@+J3ZPGpD zF~YF(rAV0X%`*TnhYa;TD#VFi3aXq^d1j;p$d(X%YD-Wy>{}|`0`yQDy!Sk*-}vsC z1=c|?QYaC3@Xg@uzD0|z!%mC10$jI+sBx*DRvDMO9WZa{{^1hM zp>}A`A%G>VnV%*)6S`?#-iJzncmR;=7PfiJNc zaY6#3M1%@j1C9LjO&@hak^~Az*`9=Iz953ohuW*As%fjDG$Q4-LgIs~&sao=F6%#?*Lqs4E z9IZNNTmFlw`V9z`zaX#A1_c+bMLvYo&xFLxef>4rV6RqK|1p2JqOBAyP81iHvDLeL z>kd)`3908&DJoa&+_TWt?_CVLYFFd;0uPb3As$L*!L+miAF*(ibnJTneZj^e&%YPM zSv$;?+QFD`5?yUBdzJS>wx~CWn`0Zq=thc>6W&5XuGjTM0cdpsK*Hh0PTRG5SV1X+ zAqcV_M#AV2bX+#;#C=U9QZoY)^B>F`Fp~WX5QEQS9la|TC;A0IW2*2GkNYqx23ohx z>BGw?wdP)hRqpymmxo8e*dJErxuM?ZB-%4{Y-xz%q z%K6J0Dyah`fk&7+C_a1q#neqEHZ9!tq|V~iPlQs|oJjA_J*lHPaQbAtlhC~-}P_%H4AZ~jvrx0Kn_~m9Q35v=pTJr>bR^lJNfAb^SYsE-1H+a z$xGrlPLg!MIEzHcKhj3j)d7x{(heY#`VKIx?SII^diV%jfAgH9juN+uUu4y;Z}gB; zTDA7H4loBZOyLu70E+bI1W+XEKNoTtiSV+MCJco`#UIXV5Ec*~F)53iCnBR{4haFO zf5}(cS>aZX`ne_av%KybjvY%(zKv>_blap77j*3uu@&fxP-dm{?}W8mR4){FS)t3E;MWIeAIfYcyOHUkW@n7}K3<%Q0PO zL>RHXdy9;B=F_VpeM(Jrs;5*I7S9@8Dm(sTta!w9s;9AsV3~9DrjK(aRzdAa9KM?* z42@;2A~9q~Fx)jyL-zzyLI*y3t@UF&O~8T~Uj8L0W#*IlzQ@`n@gd)7Nx};t0}Rtc zjP0rH6Yc2DQ-Ds=z!5)Z6m#Qdh)NFys<8Q1)x2{`QbiXW_a6 zbrue?k#Und@m~!k5hK^60A)9HRz#8v`;##0Ld+dO2ZQmr29pQM9|KlKeCb-9^rOu3 zcLVJfsQH{~!AEbAnmCw@2A-WgjbPPrf{4f;m}v~@6NXT&FViozG6BjIO-g32Ej^$+ zT6cz5z8B!m>JRhE&K60LVdJF%)$|X0?Mcd-aC$EA6eCp>T=-3f>c=(r3c#fB205-0 z3Oa@!U66$bF)Rb%_~X?x_Z>sS!&+x0Pr3#)qrTX9!1 z8kz?%MYw(+idSC8 z;Pp3W9Pm3g;gf8W$2(GZGreYRy8TE^Xg5h8zW5IDmkZG>1k)x;x%|xZmeD-hb{GS3RHIYp=ETnsefi{>iUGo$4NTIcN^; zbRT?b_^r|<7d3d2E}$Fw3t&Q>FODwvr1&!IxKlW8z6XCtTEJy?*9Q^B7!rbRK6L3| zcCctymr#`!u$dJKyS0{$8gXpxO@ZRK<6JznF1oHFK!Tp?gdB_vO62wIzm#{fx*l?3 zbrX6n*fv~0#!3Uk>`vVe@g9TO#0R7|!4m~!+N|e0qN2=_P>`y;sg@0JCb`7uVUoJ%g?y9D*5fsF-|lbkQ<&}8dJQ;IdcW>wD=b(0R+gFdkJk7; zn&$gu_?bxFvTSjO0+RO;U>hiBXm9GG!PfMg3xF0WI*h>4M9N#4Tyww>&kjuhgV&Nr z6}2QaJ&~i2eZ`la@Y~MK!7;P~_^1^rp0_AQkmZdShr?e;FfjlsXpZ?{|0%#Nzd|ev zaP(!1Xf6`=sI`-sx=LMR^FonE<(qmFC~gdr6DB0kVfcWyql7N9B z^>G#+TE7=+`1u+Uf*<}iwRQa2@hN96pR4w7_sKuYJXvQ!oLc2wd+%TW9oCVbwWu#V zVf9tIGBLTlyW$XGdXwOK1Rg;|pD@mwS<$DQdK~-6SP6I3=+((oSWuYS1Ik!aq3%?&A0y-x9 z=arYTy;|+})+P5`t1T%GXB2IC#vEnHLA0TxPm|%uSS5Oi^u)L7YEY-R#055fp^ zB0&wfTcbF+TBy?1i)pLy(6+nf*mv(QejKk`-O|!hp#F}Lrdj+}0M22VMVy)%rdOWX z6or-XMfZca^hwd7c=G+}f24VKI1OSy#y_tT_U46Hap`Dj`A6Xvpju+v8qf6B4DiIx z5%8tY<*r(BS=An<{4tCm$`Acz*yi3crP8S@fS~V!hQU{?Hlg-!e|Rx;EJ0Hz>O^$Q ziY%nn>xM(cNmxOJ6g;p0r*`=34N&m^W#FHIQ=87lkujr?TWgxTC*sM^4-ak9+(p!8 z4iZd--3@CL-V_?S9t{fJ6{&LOlf$*Tgtw^@jw%pQ|B+|HGLz+^3o0{aJ(Jxs?yrnf z{Ype+Vv@{+%M}uRkVtfON!$L_Attjj1k39!bAYu>)7fV(ryrWnnOb?=V<$LvQUiws zV*Z>~t3y*(qQh6KLZjL=$JfD?#14o29~KE|-xI;;rtONho`zBON|oGgXU#uUy=);t zB1E8qldGsKhTj1q4(NUYQyV7eU9UJd%A-qob<$b^+Zci=7;%qdlLx-d{FyYh=3abQ zkf4Oy4dY0i>l}Rb+C@w6{MRoo=zSWT_FYKx+a&`lVb;XsA(q}iE-o3|_kfYyGzsZQ zudyR}TI$ao@Sm|7W}q!JGTxX>#Pn9`2-`b#^m%nD#@5&>WqP0&2CJd06M{e2k!nk` zJ`n?T&i}!^P+~P^T9=UrUp*F2OfPBE8Mmo=sWe86`IIsEryF2lS%H)jLc{@KZa}L2 zP+60I)_Umc`fRr!YpxCzzn@$RV+7d%gcdu>BLt+(WLXUm4L?!OB+zS%_e)OmSVmeP zW!NZ}?k2*I1;m!WE&BH2D=c!|`uJtiQ>)IC>^~oi$<#gfA#}DPpHk`WNR~-XVCcGi z^!0dO#l*x|C#Ec7;y3+<_Jb)2WRaD(vL!KmNg6bB?>RDdB$8=`Ln@P=>ypoP(fQO&e$fx&91u#vY{-x`&hpk*jjO#56ANssn6;8+b}X$Q_Lf=A@&R_8$p~=)CNF{ z+=_vCfR~V(KE-Cq3JRE0c|gI{>Cx(-PS!#Y=SH1wbg4cH-s2il{KOLvOg0r%5w=%t zC*TP-fa_}9;c8Ier~RK}-A+>zoq5s635TO2dwEv(mVv1%E`PO`NdX{@RsP6Iy=yy& zIcDS=4H&TfT*GorOpRi{4=%78rMJm=G&-jd8|8>?XKU=WD2E%jY?LfBS_5J0PLFG4 zkD;F$g-UbfvAusZEIW0XH<>33N=2~+cK(L|?EZJU-9A>c&jXh639g}))h@J72g}E8 zG8l)TV-dkh=A44_j0=MaAjX$LsFHOT`txw*xA{ybaAC7X!6@xnhu*W11-{K10KT}Y zyNczPk=;=c-FHR46F7gHnUsVY_D3Sgv_&(CUb}(GENy$~Pi$4n;orD{Zw`OoR>4%k zRkro*$-6t=SXLD?ZfPAOkeZx}TdzEH`*U}=^Oy+ZJc_oLC}B^qjxw3{=Wa|w9G-g` z0k+(uSRH}na|B9k9Ks0LWj{Fi*c%pY>k|eYDLz;L)zxNY`A7vfmVW8OKH?;mhgV*cV5-iPIFf4NX@gRcp4zxaJ6tpI zJup_TxEN`#(hIRnPfc+Qe(6R{E!^JpI1WMIrNCaMeu)KO0{47A40VX&{C~wQA02d!wP5knuVEv$@_M4fEH%;?#$%w$`)PsL z1CH)%bexWdHV4$EGzGUDu?R2#m7jD6;MpqM zB*a8Y&4pgf^Q#*uMc&WY*+w~Z4NL3+XhPn$^NsAYC}#xu-6Hj09KxX} z5kZTaQ!`)|rkAb}HC_DAutE^b0JjCK+HO5uDaY_?Rbt=F;9i1KBiK z_QnDTq9=RaWei3>02N7+b>)%7N9{}>9A3LWMK$UzW3NRo2bn>DpC~IBNFx{U2Ty68S@*E&m{&hc@ zj{F^HSb!@_-LZ>^Ly# zd=S83L3)uWm8i$okrfcF_y0M;nM&(9uwf!$U;o=fRn))oKb9w8f1VRy2)MK8pxY{* zP4tzBd!QSK>1oB;y1(??LZt?2CH9>?JTj(WxKu&?2c@xqofia1PLn)Tmr5@vpWqZI)v< zyibEk3C;|F!w&EPhR*@z%QQg1WsATK{~xPV@VwDNsu~9teDUecUs*YqFSX+)Q=m@Q zH5u>IFCfvjakJ)X>iDPw9WZPyy87_ZO*}M1o*%hMOt#!ZX^i)fDl8 znqVd4MR6OY1s&QFK-FqFHVPx^P4fahYCwJ5%u{h`bmO--0P6jQfDseqeL(p8AKO+z zN`zN4D)kJoA@qQGP@%v}0vRWWEEI&TXeB^T{T~7sI2z0;`5y`E%f+fAK+c8WBqGwY zR|0Ioz1nHYtc#3m{3Mp`OK=SmbHFe>Z+}n1MLMmIEp7uyxJKz+L>=lOh||&Y6YNKl zh0i10{P5%xJY~mKYu_r20VgOFB9R<#vTd8fM*!XFH4%;oWCi{ z`_0M-A**19mJS;LQ8d8}Yp}AFzfQ)`{}{}cPdzcoun=e!6^dho4CN)eT;f1W``V{r zQ*n}an(^kxQ@>kAknsR<_m{^doeJZx8A&-a0f}H zJOvD30H{tacS0n=71#4&ZdD{{x@7|khmmqXor@O`Ku30Z)vz0Gus_2pLeP5hCLXR~ zA~bY_*gpeq#SoNB_^=sJnF7GJkk2?BUz?;oqWRSzaR^{>^=MnJfVyQPp7`oH0w1P_ z6s8FJh62cd!=Cs_Ci z3gUN4fFPYX2fA?~+op|&_iSk`awY{He!q-u8G#Oau=2}pu==*TLth?(cnwgrUaTW&sJstbBiBtX4 z_?4EA9Acho0lvXTUf>}?7&ulvav9T5PywSXN!_^YTRXD3U9A(sj?=;EnbX|+uR9AS z77l_*fzXT;vBI~A44Vd~*cccE&2xgy#Ec%Ku1-Bysl>7^^2%nBvZ0KnNqw-^AhVEe z$G)_KA6N+h`7NG8_1t|;A%e)g5fex$qphgzzdjfvsQ(fChyZJis>AjP!FI_4m<=Zs z&Q);k=_x;gvmFD@_70D|t-nRav{PBL(;KU%VbFjz*i0LCC@p@-cUtoMva3=qk@h$q@6!zGn_dJNdH(~%Vy8oJ60gkl+m#h+wgHB0h7I9d zMFw$V`OjY_h`nmVVfSfa%1P1LY0#WLOjJFDYN{zxdDNPKDYXLc<5O&kE zta9LEFS}Bd4-j6;0$B}!)Mf5_7f)+(IteRyvTTRO5v7nfUWp@ zEER`qA{dexoz?118p-U(Uts-Arqb;7uL6}-Ypm{b!i&IsJmwa()?>`MCm9Gwlzc}5 z#?S=>WiLHam_L|k3bK)>Lsq)Z8l&h08Li{xnL>mXIRxGavaI}IRCGa(0=_H zlbNr|3{ht_D{WEtcErxe5P%&jf;q9?$>i5lIedjkf+PSwaF2mjNaT>^*`vwmhi*0a z#}i0d0YRKXL}&G{gze|4?~_B)AQK)wT>dP0=~$}%?C=Ss5Djpt(($#sTwGWij}@S5 z>J>6sa%!axDsAr5YLg&=+D*gm_^rSfz|@kavMT}Dwz5f$sYGJew&MVYJW-PXM&}|x z$Iav1$0O2N3&wyZg}%lf!`Sn>;gsGX0#XQy`(rzHo%!8$5gbxEB5ZGSyo1KS&y?$G z1^;Bjs;@p=!5N!{fmXypD>AI^iF^UcF15vp2Db>RNyKCU_~KqoGLW3qFu?=N)s$(h zeyzhlo&_84x3)BVLfW%<2^j-Mg8Hk$L@OelepLitd1<$EQwLBt2@xgYK!%kBRLW}@ zZ@`9$7=iN=3p4Ss*t!fB&+-1EXO}f;V820d$&b-#>T82)69{1h1*MJFK z9qf`Spt3TL)U#Xj3ALc>ai-2(`a8opV?KdW@Q{r0lnzK3*}q=)(rd&)K-OOyFLcpo z%@$7OtrtgYSY!+^A3Fg0+VMQ%gGdUzH^BR&9S8XI?-Cdin=@5%2!;nSh#F!5;A(a* zzCwWhgT&OE_G{RsCoSrlKToU<{fb7MlFr5Csz`l4ZU_H+3B%Z)r9(A9DorTerBMUi zmR$ts;||T(vt@ej_y0JD164_0lPEfzWX2%7fgn%-j06CVID`vsZKk`3H?9T-Q_H(S zvA?)9n5AQbMn%IOa!N=apcbzb0Q9Deg2g=0w@Ms*IXOBT3)EO&fRacx5xQ6n@R?aj z()h53!JmNw@Pkk2ft!GznL;QXo`!Zc@jl+Le|Pxanp8IiAkrWz;v{Gm>pfTHdh2W0 zxCqKk0WHAg2r%g4Kwz_Zlv9=&xi`Y0~qN0%uz7Bsvp9&l4_AE$I_pCQctC%kwlXexr`*0nsA(DXf zzDKdFNcx^K8wfzWC`UqQg)CE#Iym{eLammp(l}p4xev{6Zt%T~xSW}Y*T3&OLOlVL zYBmXz%p=o*#oC|%axQVt2+uE~-9hf&CpiS65+qOo$eyi_X8{6#1UPg~-zGl0EJ%a^t$%K(Vj%NxY^#IWo?0K!@d zJ&@}M$A!*9{Ul_o>0AeqCVh&BI1%RVnkazY{N8Koe|Bw)+JToeuQC89fouZRgtrJK z50GlcdYm)1x^4rwAv6l`Gx&^h^)ym7#zMIu%IsjdJ_Dy#XPjj$r?3uG*EltZu*yF{ ze0v3yW&r;6Fmd2(B-*EVY0D%Jfo2pr}TG$D4E>5R!-$8!7uAI?#FP~Zgw)G`*Xd2bA1kY zSaIr8_}T8CMevL(1;8T^W(d=!P~5b5MP6yU>ixL@0WKMux6>d!-Z-%OBp^X49twGu znsog7Ghnnw$b~2`x%*VPwc42Gc=|T;HfH6I+B#~97Pqk<$KZYXN!rK-;F`5sSR}K^ zA&3!8QS5d|sgmj;b3(+dt%0=7d^Q9@Ppp&#e4Q+%K)lbB0FU%P{(jib zDdO1@fdb)?iUi_etT>b3npzOGtB4~Gkje@06=6(V2%;5NAdFyo_$uU(;7vk(^0wkx zcZB@?#Q{X**6kh!B4#ew>c!ar%Uc3(G>oMwVZD@oAW49b9>8#Fm<7A$X%TiuCKq!Q z%f>eMD@u= zJh9V-yuBAm1#p`8ilGQ*xqu-d)SX)0AAz4+f=A-4t|jO7adHsQK9rCS@nNiP%$uA6 zVu1$nbgpq=_P}#5Fhbgvj$1z$i6oH#qkqKslJH!+azWhQ=P|UI^UDtgh;i9!khK`9 zK{AoS?8P8(J$FC=Ari#xErdv!qzDm-xR~;IV(Va}ToZkAP2Fh`U|PWaMBpt0HY|{x zbVF%H=uH43v{16p{#b(F@dK*& zlffxl+`*|~jqo|b*9TW`62V(M?Ol=ro{+ez!zIl4T5K%Tizu$bYM%ZR>KLq1E5P!Q{ z(fE`6A%qM_g}i?YFj$BuK2F+IP_3V=2%;LeF2GzcKEnzEQOzT#O9s3FAm59@Z+#Ww zO!S)A*TAes(8o^WzU%27BT8bxO5q41f@6N<3}BO>I$PoPOIk@k@`#EYqg z6l{z4Mk919wy6aXm;gtr5YWoFSNHf}07(NNOY-(HcrInu$z`?Tn@QWnHcR|3W~w|T z;zh^3K@rOXt)MdP2xf7AP_72dY&*~tFE~UD4*EudljxIy%sxq}nYqXPs`?lkz>tep$S;wb#xa&0u+GM<;`#apfucffYfT|Ln z6A{B`=&%RV31CieAcP=9yuQJV+;%}dl~l^ov5~n8DC_H;Z7(}49@YeL6DU3C2q*X; z2o_J9#^*@^03z041BEkjM4SQ8_&*mbpFKk>25N2_0`C$TTv-7H$;Ww(c}fUSZ=+Ro z`Qqjy8^pPW^#!2Eif7PS*?XkN`4Oi~`4xy-K}F0w79`9WA#V0%y>9Lw5vHEN4$qW= zdnlswl%TA6{>gv$Tc15(fvXoQe9GZ5ahL#s?1K|_NWe>q;1KK_?Y5EF(bpR5Yh zi;N*2%v!L4x*PyEV;quWk$0pJWHe4ABA4U3a;9d+`^W`kWTJ4$1I|$JZV;kz2uiI# zAu}s4=Q9`$_N)mI?!J+e;VYkYluT6c?GK;`KwK0ht4UZVu?J{xK}f^Guwx6^QNFuIm5GpS#1AaW`IruzRx$w(+PvN}H~BlzVP9lRld zRG{Z?fEuI=a07_2%Zupr=}WkwWzPP9e+mTp;pOf+PeWKB>SK?GIVH7Y1}e$rJ|b`dy^?&BjM+wGUf;97pv65To}% zVlFOO@u==Enz5yz3=l8_lt7)e_2z3`n8NhISuUnt=FMHd7N#MEk72Mrn30pcEY_h% zc}TQWbAN03cGd96Ym#@PGbI=B{}afY(i;R+a=~pF9UI`O4*PZuNC;vA0l9Yt{J={< zP}=7x{%*J)6sbOnX!EynN=D?)Xb?OTIsIG$w%5YgfwEvE@F1~LAk@YPZ^6(P6p2G_C25o2+qE`vbUa|8%G;>0>S1c_coLGvA=8OW#$TFUd z=@e23LM!VdMQJOYs{)=>B1o59Gy@Gog!EwAsXv@SQOJm-(rA)!WX;ds~LO#X1Kz%-RMet4V*8lc_6>p z>QC_38th@c=O4r{mcl+PUj69iBeCT)3bMoE<2&y-vzv=y>rF7b__NWrcSQnd^mn&L z?)Z;{$fBvzXrpt#uV1uWEG8aX@=T--aT|(yn{Td8euusE9dlGYah2wgYgKof{&&Xg zVJLP+f;)vOTL2QNh9{`p% zU}=BP>Be}bDaH@l`1;ZNsJ|dv;PYt7`lcUJ5uCTsyNNbA4~L&P{1r2|3H1}xWdSFj zO#PF%Hw2-r@7$pS#u~e|kZf3zz)v-|nL3NQ(wBMuPhU0F7Hsvw(dYc{b}z|`*A=pp z>MQpk4f-* zzPxZbqmhW&Y>Z^|pV3L1+^S+a(}awe%BKRt)N-W?1^>e3(nJ50{)`#z>Za%VCu1@M z@C1?=(Lxr>+LX8}#!PN7e#Q0ypGE6X>(-Y|QB{i-Ea|pv>camX4@k8TzT%|phB@Wg zS33AWCK5q8UH88!evi!r`(lcu(b{Kwl3|iFJ>=E7YsLn z_bu1tu+jP1H#_e=I1c4<>i8CrCEDnjEkPLIS)`ttKl`T)3@E~jBhj1)$MF}vkzQ2z zib6_fRpSfI6E!KGcE3NKaQuCiGZn~aSCYW9@X7jR!rcL>et3~Wabj(@$Dicnt5l+j zt(zH};sV9&sk%1SEoX-u4m`Y+y}nlbVJa| z{<2WqIc%7>8}_gaER=9Hoii^pvo+M)_X9tRi<*+3B$TbOT6XrKSErzn z2^g1#y~B!$MAhc^XiIjuUN8Ay2o&szCATEKo^p>?Z^da+=EjD}?R^6-zSfS%IhGST zgo4A86_F?kkk??M^}!mQ>sWY7`Ce+&Yb8zV7kF>dMi`U#aS){luKG|1hI7$>wm1p$ z(=DzjOkWOL%co`Q;-f;RMKcKpG}u~cZKa28{4r!_YjqyUb9OjK37bOW_>3y0-e%`w z_}e!Reu3RBc;HHZE6>7PE~0(qZXJ8xFv6F4-%JM2{0pDdEFY@CUeJt-V*8nvT=-`A zXG;xTgVbaTTaDe15R*{Q&Vw(HSg;BCbfbePp)t3aHa=cH$AiigSG=W-kb_@RS|=irFt0FOD%^a&IHtz5j82LlJsC1af^QQpO1)Fwp5=}FJVM4n zZB0!#x=$bbM;!Ppfr9&JU2;irfk^h0dwJ`}0BclpTvL;seRT9L3HEl5ylQU+t52J~ zahCMp&>qM-;Db+g!;-Y*V0~jdXHOl#iNJm`P$@Bh7CMwOI|Pvo;&MVhK)WuO=~Gh* zl;pDV)7DrL3w72+;d}*p63wu9B=>>YX781{CJ_;RQMy)mw%xa9R&weFc_Avqob25& zvX#RtSO(o%`6Nq~x>C60s3r6nQ$c}Bn+H-78rW9r-iBLpbpMJOB(lHP)GujN^yklZ zLVlBV!)Bg`%*#+WR!7W5Skad;%eBk`y46muM(Rz(fi^2WZt zH6Bh6F!)r%m~9aU9gBhfZ4G%vDF! z=OyXB;WYRxD?7Xws|l1&L*G84b0BfP?1l-d*zvaMyS+K7k;%1olez5L^`6KQ!{VZ! z2rTJd!(Js;S4xsxsjWD0Cx69;bo7A>YT!xNKCnKxQLL|-T;z>O9|KqRm$CiPcr9Wu zgRBCk6j(?OYMJ#{%<4+%l1rcK6SP{`S1D1brNCf=#3_E1LztpxU~XHH>dgT;;v(?X1k5rNge*1OilC;cZbPgqrI_A4iIBdMk z9{qk`YT|c@c3p;Zgt)XUH2)|?V#yE-GVA+SWQ;R%rhsq9bgnCG7CuqREiTabqnpC) zY=2tM~1NGvhYC68hp~TxzkF0_W{Hl-_!)#2AU#b)l%mDkuI&Kl9Q<@Ct@;JOb@J&hri6> z{b>W;>W?HLvT3i)`wsf$qtEBGRlSFghaVO0rs&U3X!B>M_M*5z@6UU%>j=IJc17=E zpG)wI1WtD)X&u?));N^6lzLau+0_>;na8G?UZOaKa&djUj(Kjd8TZ}CeS(N}Wp0OO zrg(YLIE>s5<->40He>{isETap5UIhVTp4mN*K6*xjHyxOiuJ{cV`V!+G`lKPiz&#;mLoZR?6~# z^@D-mSA)8^j=$?u!1aNvZxiMf%@_Xe-L-N=_Z7KKBTRCM3P0&wI$AsCX;JxJ;{Al) zuBN(t@l>qY*%T#AE-E~W-e5UG^K}TyQ{9rI1QHS=2KTN0su;oIrqrN6czdeozlpkG z%8!TYmmi)@h+UD#zbq~=lWmwUY4px%S16TgMM8u9xHgh6=*$lgK{<^9bLIA9^rDJu$%EzGof)*HusSx|)ec-gsKu9u06gPsudf7d8uQ_(w^&`kRNR6af5xq%hp4Uwx+3O zy8N%qLc6z{p;N3U)NN8-X)sR9Z$?i|bgE)D8?rqAD@m)ASe>Qc(sZC$*d*om(viWI zjaLqh#ZsY#Z$u~Xck0y)8_jK@Uc!B47)A*Se)7MIHA0bN{>CDM>xROC>x1Cbd&?@+ z1s3#g=i;U>KS@HaFWfIc5DksX&fbq$HLo&?{N43=DzS>c8_3gKyM4gAb5RX${T{uy693Q?8`O-%}q8=o?zjgt!; z2h4)Az%exScS-qHY&peJUQa_?b772KgoG0}L38|zBI_5S*0&<68y{M#6*A!d&}M%Z zv)v~WRo3dSt0xba$G~}RY>h^t3~h1H*_eQEikiQmH&>5jUtgR)J*>S>9-OVK64((_ zHIA>{fVYsklbzdPtuW0h`zWKxC8GjvWa8s>WbbCr>r)|Ad`h0jbt9{74_1&3j zx=LpukhO97ZkUN#Uop`~B}_FP?=zlRHQ^&wTU~>=CUEZ*HTDlsDv2#8^@5EnlcO`l zY!Mu6^62Ix&erft8*pWPOIUv4QlGmmgeLZio(x}!_Ch{O_h*m_mTMUAF*A}0&cWgA6`HN9w>cQXd<%Oc-jy_6hx0cV&-@D-xs64R=M0vimo^rO?4c9^+ z17X~;TuwDi7QwKwttzuK9@~;$%`#L*dbStOckCM6zB`pMZ)tof$ zBsOg=ls8r7h6Sm}SDU?I+EX)>*(0ux`W1A@x&vZR`)T3{(n|@6$kNK z#DVS#JoF-ozW-!z?G9f1Xl9&yx|(?X{rBeZJMxQmf(<9^HPRGdb!zjUOVn0naRDFU z+I@U=Y|t9&L|gs?5=x1-JpaF`$KOXq9&lHECq3Q_9!2AHwUTO@Z@bk^tFO(s4CYgC z-a2xV;z#mYscmVmMr9JJPt4<&a~)L<8;OZ9oZ4zLwb z`rdf;R_?&tVE6NQ$tv*~Kal}1A2@nWZcfL>V%*?ge&z!mU`r2dcg&P16*H{(rBU|E z(iPlLsdgL{b!71+xPj^NU}A_blq#4KrFz&ElPF6j^-Xq#X5M8V5jTPO39K+nb3t3L z$l~Eu?yyv)^HZd^6kPBW&oOTeSTT|5i>4i5>8Qr^HOsV*CxC_T(UAq_7Dh;8$bF58 zlPP@vZ)G)d5u5SBjf!jJj`QMli+4vLJ1IzIjmWJ7A z{{HI8Hn~-&|Ih9k`1-he-u0E7|Kh76LzA&C{05#Xmhj`@RhUUgKV9Qx`})I#kDjtN zoe)~w1@nEkUr1mv)5pJQj$2e;Ql4s8!T7?h&j14`e++5jA4&2g>$Sj?4|=s&LA5P9Y0y}E+1F>X zLlJKReWu;wDmwAbxum^y$PRZfxU0K-YSxSg%d!jXlF_#>IgAKGhfF!${AV3)BrfR2 z`xr-jD%PyuNvp@#PX5!RM5ai7IQ#|d+Z=_Lv>QsXcGT4+?iTtV>K20h6s)?z)o>K0 zFjxM1H3mg2IJ_ICTNmJatQK*e*;eGY^;t=Zq20>%J=nb5&+AaTZ00nYFMw13ukH|c z6LTWb3^;Z_Fnz34`fOGc-2tQ3xQ2UUy-G_a_TJX>5cb4tE(qKA-lQaTHuG?v=igh) zn|`)|yF)1@vQA^2uFqkIl|yz;&rQ1}taVsLeRxvGVGEZ^`r`;^rV`lM(#`4WgBX_+ zMq5gI#nZsEsN+$sjgf`%#Tm}P9aUQdc3gGh=rA{LS&NhC+d3(D z;K2H~05#GQ6-Wo-=qiwnBW$x#l9pTDOIF~s{L|+}Pr)*&XRz1Tp17)=1THx6 zcH(rKeDwGxav|9-{%;ffF5WL@rv`U%!MHK|hQs3u&Y_xkDjTN9EPJik{2=S$S+TYW zS5M^EcwfQM?_KoV&PwI5LuG4ZgpKQY1+xtCLRArsh1^N})7nWeKBvs0eM`A;fji*1 z*>oq&{1l1pA#GHOJ^wJJN-|sq_C>)rX9KY)t=4ih-Mjet{M^sQqjqM}x)EJE4oaN^ zX>O={6MA!c->-Bo@_@I&DLY((Hg?N)o}ChLaH%LN0bi6n9sXCl%VHJi?9dpDUT zEd?rj_P*_M7CyI6^B3I}*S-)=ec=2({_~XpPxmW++b;q`!Y##vrm=0O(g&0xOZbkJDpx@S53JyBc{?=cbS7bw1#BjRhr7LTZ8eN$AVz-UwAr8c9o)q; zdTtl3$tA#Q-8C#tWSOsKXsW)lVLusLCrxoUttU(oEGcbebB{GWe|rPL(~Sy8f+T%Y zFM0-zjPj429lHUMQ0czq%L|LakHG1=X57JxPIK)=y4Vkl_zG3irzrK{8#0Tm9%= z06X~^x>`x^|NkRI9C}yizfA@N*AV9x0vU+_MEUL~zuFsUHL7xYVBC5`RWYcL4LwVF zTkOx_s8EB{dC?ycdnRd^kYR?4)so3A>|Hq_BQj3y-wCe|3a(k8{&!Cu7&?lHAc2L! zJunk>_^1ufDRx+VsSwldE?4*a`z}GCvVG5f=smZr3p;6n~eY>9|a4qFtY5^wv8MJQaQENIFjCM6Lgj3i* zAhRNX`h0Nf<|nNp=rDb3Ui-q>9KH}ih^JpkDj5VKDbeCcSfT^v1OG8y5c9NyiyC2; z1w=2Kv2AHXAo*-~Utv1D4GGw-Nv(3FPGv!S8DHw%Q6WafFmKgT;pQeEaSpv8=~PZ# zG=;UrWc6z%5h6KQu|~_solSG$M-Z_wSn;UIQ-TtmZ(yKc^~m_n9iUmFT?Hn>EE-im zPfFdsp0Gk7D&GwML`+uytPgvN$D)1keT5x5xU;csZ)f9RZEt63Tkc?4TxNqeJ~n}? zNnDy=e)-utJS?nc{Fk+2=}Fx9!v2i1!OMu+TrJHA-h3^Gh}r^AD>6Z5=;4~1M#;bv zSzn5oNhZ%=6DP8XYDr1SEU5`sRqgRQ57+Q<%l$-mGng1-GQQ)zDvg7px4tr| zVyRIltdAe7{7trx;IL};`M8J2vbRY@h5mvmWIXm%UN}3CDs^wB^T3f5xv_j7nX=rGK874lNq%lrJncOf=#AKl;kaT%-pLg)O zewDnS+gdbo6tl&S4u5mlvB)wt?9f$}PDevSR&jvXN{dkXzobqZgrx%}*yRRY-Wseb z^j%r?)uzI7l9D_I_$|5Ew^fQ8R3=?bAjYg?qm&|HF_|tNJwJ(J%$Gb>i z{gagp4zMd8#Jia|*5?nWD`W+@V&5W{YLz8R^vDpDsLO2>!c10~1B_~!UlH_k*mwQY z9(pohdT3f!pegi~K}iIf^iUYkl)UU%X`uZbBwM{j9ZOgo?+Lw+6&s z!fFk{}Zlvd@ao;P=_HxY7EVe;h5zKZv&yrrIVWb^S;ORng+g3sh2?m9 zPy-(NdG3V|qr7ZzVx^2S8RdTgmAw74-^pDw)K%z0n>}p_7R}T1lVFOG(;N=^_6IVVCv>rL#wfP!87fI}Cg-lf?vO%G?8Mh5~V~LB76KGhMJ68=1DF^dIW| zg{#M2f9L@|0%-!JWw!1J%ME$USp0pDXLFbL6gNo%W%-*&I)U7EizYhwt78T{j9+^u z{M|`YcIpj&eNVujQBxM0w}Di`hNR^?irFt(A{)Vn#8GDNkFf|st$E@4OQ-29UX!wirIEs z!#9?yG&9_qhK%u0jvV7yE$5z6A?CjNFWl}_UaikAJA&jqh?wDR-D7Vu?q;(encfxd z);UAXrg^*9)EufBveV^x`zEK-DvZ0$%9=I48ge+?kku_*U2wFCj>1{Q;nM{Yn*T-_ zbmHkcnce+aJc|MxYqYiT=CB2C;~hh-W_?i_;Z%1YeRF&-4o;?b`j#8HyLq|MZ2Vr| z@~)ac0wn`rvsf>_nnU~B8jfy<;rC@kBr5RV&(8Fh5$nVz8-DxM+ z^{dXzF>*Bv^(ww>#d63urmTXC!;}a9-IV0^bl-eG&4REAL)N4^K=bE*n0xksnn&WZ zyW}j7DD2LCsgvg%4|eey)3lpbBRv+XTX|}P=#!O%{2ccG2>UfDXul}+ozx6UygZPg zJ~1uL07`+1y|_DzWO)SHy-QbmS6rEOZ}yC z8^J`wDFV*GI)M#J*qCco#Uk|R++MRpHP9*KOhHvK=?LlhFL$47~ilHBD z778=J3&|l53iwB?X~7t~e88{DaQQ8+EZ4Fd=3#HqWZD!@c&S1q{HpsiM%K&o*0V58 zVcIK9NtYnS1NZOCy;3|>-rKuF0X8RD*AWrd_$4rw{NDN>IWJmB$xm?6AP^I~AMc?! zGXQSZe8eB2Fm!U!>4R6FZm_>k8~HA%#L?rTZE+%H%9nJ0@5OPnlEX~fM*47lD4+1c zw2$j+$FtuY93=B^>V-{%S~}NS4RzeJMQV)k1Xr6B-~j})7d)PQVLQ-Qd}Q|FWpscw zO&`iHU`m+bzlu&?^*1Z`d^-Ia)Q4}jU!Uh+FY?{}3b7Wx`%Apn7I0Oz&+#=nfRvVR zP^UWXhN;bSAv>o}N%(L)jLP}k`l9dS*yv-pyQ%H^T%#4`48|jDbZP&wZ;|eMC|Qw2 zmqd+={5XaV%d0>6B+f0qica~NjCL-QDYrTO&fq&H?p-HpYyF$iV*tGi;Rv5Z``L}}T0;sC=SJ7I-mhmX7@xbP{TT}m7-5BvZzD^Vq1M)Z~l@4NI8zDx0-lY z`+Kh=Y-nAnh|Z>nX*|rS-0W)1QSYLkdG=KZ6>m?1(_G}8BuRFZtg`T3g5Pk%A-th6 zbkC=_x%GNnn!mlB+B1W|;}gZHAR6R(%P*_Fyi}IyMz3sg{zqK}18il71=)uY)=)`S zT#knUiK$Zre7b05LGA|@cY)fhDz_iGBy9_^#;N?CJ69-qEM4IWUH=+f%yfTW{rnnk z)d|PSDy!wnQ4+*_zCc5K zEw$<$%TLy+8F&42Fehb|$~4|LE$U?S(=AQo5?t=WOR7Cs<+hy5f!28JBw-o5oIJ(PbIdRO85ZO`|+k;2pI zLo9ujg@nD|&$2R%wVgdJ?Q1_74$nawDFyLY$!Q1Q$COle2nhK8ZbL=owU+a?WqSlGof84^H}Xr*4>k-tR6Mzwsi^&ZLB`;k(;jtTanh z*~_i2{2%r1>JNsLZRtd7m=-KqMQQkK+M0wL48=F%ezpo=UtGaDhAMh7ha6YSzE`wW zdiC#m5DA~gb6`6th4K@zoQhuj7;VP%F6-WoHsPje;3Av3SxP7Vtacos5bF?d8@ctO zw3E1))9YtqSK?qOpDMwMVfTKwwx!1kdOhJW8Ovw(rgfKvc{P&jqR@7-#&}Xe%O620 zF1o9#I2qK3uuiEu4+(KmDaSA2`zIV6jl(t`_34Jk`?M*CI}*Fe5bxq$Cmr0fvy&@gO(fP|kp`{CoSKJN61zAP`jxP2p zr@s<3Ep?aSO7`=$W=ES;z86%XcTR#WQ2uU>rYeOev#dip9CaZRf5WO{In?Zzu1v1h zZ-@CVDi1hT2>67=Q(%uxO>8bd4l$8)XZ^R@5&LhxhSZfvz*9RX?=}Y5GMaaPo(;Dw-I6}Z zk;1qUnZES(*jUHfW8riTitu^6QCfOp(PcQ> z-+Tc}mZqFayWZLGeU97nd;N!VKKH%Xy<*nP zteI=B^^-`&x-w7DsNc`%wJ*6Rdp_Tm)cxtP!aQjYDWV-i)x|+PErx5h!8x9cOEUFD zXN_Cl;&TUBXl-@u)mmHY$#J4oGB)1Lcvvs>=Ns9Ut@&v*C~p3ZcVHB+F?BS^-IZLo z9cE@bcH8`VM|6>T-zU2l-^|8O#}l}_gxoG(T3Ze^sqyjeGcdELu%DabY5vo7Q%Ecwi0%jd}naqBC5Mb!j8NfD!3N5}`? zOD)K%-*+P2OHNv%}3|+&Z^`H`$09g3W@z z=G+9@vNoiT#!heb?jE2hZI{B-dy6OZ>_w(~4YbvR(mcd^dwZIdY$kb#-Lv<w~>^6>KmQ<23!Clzbc?fb7H@7hMRbKsk1`j(j8*|h%It74MdUMM^r zN7Oe}GjS{^t zRkcxl8}~yS#mZi^$Q%3J(DucrUBAriUxz*MvAWH%n|=$;%WXs@Ec?e&yE>=)woG#k z8LuXk(Y-1p@Z@ks@G}2VyA9tLBb8TcwtJ1=^GLazMaH>QEEK#3)|>p9`^%SVmK{Fa zT-?rD24QVsWKx@6lE(jN1v#I1gRWU~P?t2UBil3JU2kC>6JGm{4{O46} zY&jn`;j%}!u#PXu74lr?Xj;5XG~#shP2it}A+B|D_?l;G{YPv`E~ z&7Jd%c+gjQ|84wrk`c3mK{NcI{d3v}`8F{^+hgC~(** z)v^BTa)`i8dH_%BKM2>imtr=(A2<*#DIctUAFipi-Br{Qo0fhlal7JH=zB^cAIVXy zAPDtSNn1(qZem?2ytwN=yE$}J;y|TTxb(oe_T4XLqrar7c6_x>quwJa*fv8W=lzVm z+KUErayYsbb}0nvqP0;tl=usDDz^36F1`*|QgTMk>ghjSA@a9t_mYWJv59G;m^xpP z@PMjjF1**t*lC&S61D7R!m%JQ_EHTK;~~2uXEUD0D$n7zE)L|=+6KRO5Iu;PoDRFy zJ>ON$WwpuvQgMPMeYAa1jU-sRW#^waTeDqPx>-4T9>z9=(~<3+kv-ZUGs(h6xIViZ z!fLi0yW-|x=x6Ux)NXn=^PfWl`8}^+*(UFbs=khVHnR7#YWJ$QAts&B;P>9X1E8nTzpWUlgyGuE!D6q;niah6NT&?l-A7gdl{lKu@I3gr=bM>`n=xY3LEwK{v9|dSg&mjxfW*$0!aoD!m70p6= zGQ@M($-GJ)nYShwH#vN0XEXmieo6L7J>~o$>uCDO1)KLRf1&EhuMrqfDZ3~beQz{9 zOGN(DJRVEH5y{%I@1LXy0E(cmiwH&5>@Ka#bwERkL>~NNT(6=RX3pQ)*KtE_IF4tV-2r z+1ZLgU`ktS$CHRQufV11=KxPFYfgD9#lfaYJZs-|hdD=~Zk6f{=jnAD$FW{AI&G7O zB1ZedSuH{j1}?0s^s1G8IS|Xqu{k=72r#{3$e=b%`!~f|ai?~#Uz7RUSPv?N*|egX zI2+tOlx{k^*B7dNZ|l3VpDsj3`Ge9@E2HQO*`Z8*?_l6jN480;A+9lnzp5!AnOZ!7 zD21gKT7&s61Xz&G(KHJe{pjs!yG-(I$0=7nwUJ%(KxXArql3)bHUV4g2ApV?GXw=I z`i2Syl)rb>X})$ zNNG=!+bH?K;@G#X#u+VE6B3I%DCFqfkCy4qFVeUD$Yd^?T2LSWB&a=dS{v2A(wZw& zY4HMCu=Z~64Uu#X%Ek7Z7q^{;+a_+)1Ji<)i6j+v=`S2Bb&QQzneHR%5=Pm#nI4x+O_??++1Y7I8?6p*5PJWyV<>~Ok%XspJpVj$kp8A866^ezcb)`wbHD9Ir8aX z&ZP@cWkY7RC^M$9@7C|j7HgTktScdPvk1tQ3TJ zJlOJO&Gro_^0`vdUtdfsPe9anx~F-X$71^j$zUZdO62S1l=s`Ww6zefqHj}>ol^Yl zX3LWE?)5cJ2gwcolKa~ULuL4v&TvQ$T1|y;MB|!h&)+)hd>&%+65rqTTj^q+w0i zo5+6%2hM#(i>fh(s8&~U_mV8_RlBdZD?Hp*sq1|l`(iH3vF)I7<+SK~rz>>B%V$kL zx~x1@Dag>16Wc4EDr-K?s*k)gTUG|TM@{R9gEAJM$8q*V5*?Zi?yL9jLDLB>@?czQbz^Y1Mw75p`|Z&Qj+(!Y;lVk{06ycF}T@H6_PI zR;KOXY+u%_x6|1TGRe+ZpDG8i5g(pBy*r|hPMTcyb-J#twPGf1I$mjb$m5ri8;9XXt>;*umw_UfL^jcSOU7-5;uKW-&&R{N=)9@Ke?Nv6h3H$hFxp zmYhKrpGDb+8yCJB_Z}L*q?^m}wc`j!6|nmDI0YRW4<%eALU;8K?hF(=11RCqsAg z*&;Z-C8=}#iy^J!KYX*Zi%4w=qj@6n;A{wYBe**|2kMW%RQd^~O!}k+0GB~~g8mP* zQO?I9Z`Zg9)|{R>BKlbP4T7+=)WN~`xU;TT8R4=VlkCm~8Gdwo)W=;zd_8X9YQ>|# zar2Ve*v6?mH&*n#oUc3nR$jV!+?dy8Ju~J+5tx>9@{gqhe^DeY0iF*gm z6Na5#eSI{t{9aY?lc)Pw4P&^)NG!#hE3dbIPKBL{cPSz|@*#NRrE9oDhCq;hJ!!ah zVlAUp;HbG)I`%u~^3%y`wwFWFts7p?j-)We#XTW#kph?@>1La?q99#2M<(X$|zLyrb3kwWgH z^3?(vUdpxsl|l}-qMNZE)~721Z6pshcN(qyj~uJVr1x`+6D4jF(hcl)J1~W*I2zr& z6@XK{w@JlsKff;5R=$1UK_xBL5_}`IJYhC|iSHJAD5(8f{jXoOQBPnLdfo#hgA|;+ zrEEOqY-*e71<7mg_^74|UBZV-8S{1)ekS{pkaovrs#v5c42fB-hT8&MREFlAiqRwI zRL%oH6`4LAH_2=rP;)u3ROy=-uKP#a|A%qdo3iT+HT7e@Ay|mDcgKsVBO;Ab#N>jTjhSXUPRp1sykiY_)Ql(x3UQ9opeW3~OfMn+1e_TN1f z3(V-Q?qRRs)4b#JE@)8_#9c694M)_P$l4Cu7@J8bk1a1_>CyeE!e+q2Tt8DyXQ(L6 zU?;J!HTv!|>BsA2fq=}(l*Y;Ma79m<*Yf|N{&}UeX<*QXz$XV ziQ^mPGs~3HaPl8B@SQPw-WD@hC@F>)Ks2gP@a`c8l658Acix>mf}#@eB?tX)#u$^r z97t6bs$GVOY9_Q_oI_Z=|G!z95bU{2A|UVU72C+mIqcBqYt#NW?5eA8{X5!q*Hkmv z7TOG5cAl!;e94qSI$u|K+0W}C2_-r6og0}qr4Hh0xq*PM0e>}No3sOy`!!i zT%O5(9t zHI%2da!9LYY(R!dMB?Rd%-#Nf#$W&hw@a|!q51tqr z!e_w1aK}oyyn2LrRB{<{Qz5sy=`Z3#(eV3x5yI|(QxAJ*T zUY#{ITEE*`FQWDpx+d}#F5$Typh(xmUL$bsoM9OONO966K*;zf*37mK4hd|WF4%<^ zgb%E(++Ueuj#Z&{;kG(a^AF)q4S|MW+DtCZr7Jcs3Nr8(Imx5&)6W#Fsqnt{x~`&R zdq0Mx^4Uj+ich%>?B~l#h3fB|apjs^-2-GA0G3PAIE^L6+_xc=R>AJwG~sMI;ITjv zt&=CRQD%~pyMZKd-Wj|A*$+*$@^@VUb;MFRKH{fG_9`j(a#14tyX0?XIb+M=wFBXt zsBF9F+1c?V}MnagjFa)oQt|*EKuwu8`o?S*8?u)i(0V z%T-3{Wb-O=f${dD_9gf7s)>1TwbrB=&azkJ)J~W)#MXb0@h9*O%~nlurSbGFH>akBn`g$IZf-}h%$vsDXB4@ zHOE_jyIH5He}fEdkXXOwc-5m#3j#3)Mpe_~J5RoKxa!B3PD?NEHF;1f;5{F!JWWdE zp`vt|_i}AVLa=dxqJ;z5JU;;s3ASem0MP(Fl{OX2MssBh85W(Bebm)6eCMOv!|(L; zj4q&*Sp^=ftcJ`H^H#2tZ3!g)ISQ<@0T*O-E_1fi!N<~Hi{C!gWqZj|`+0q9SVM)0 z-)$>WBvrFEE8G4E--`b1CwW^;cDU<}hs*w2EdSwrHgVSUe3WC#7}vMs5!ly+U#`k9 zn74{T4&|*p5YnPh)hfSWFF|gSb4?$Bk1L^p#15|n_^FmGajp^%I*)YEmP5bOy*t&J zS}szRVF%4$B|rO!vdsvOv8ZCJ`ps0BcW_(Ei2_>(K)P!<5%XScY?84X)kJ=#K+p%A zu*=NG@4Y6*pRc@5{%VjeGpIi7DquN>RrUTS-eyQdS@LSDRi3Xlk^k#sEm#K~6+CBm z5RYXx_lr)kzbE>~*TrvX`S)l;RW6beFQrw==*^xTesj(TOYg6GT1xC=1@|7RLR`a_ zx8L9}eby_YDDJ<~@2143*(KUfM%2{s4Fx4ifK=wg67Yye#OY!P$p@Z$SF;v#UF;<( z&l^siC;HSm8?Iy$e@$OZW|izx$+ICV_E?@OvO%nNnq&V4T?vXvhL?M`IQ`U?)LoL* z2e7rcjQzbPh>6d5)B;`^>Ns|X@ZD<>>+Z)RI-VB&<#)r0Sq;;iR_RkAc_5C4E`qmH zpfG6g>sMUya}5mMa&p}16#V`JOF>Ws-_HB{YY7tsj~1}A?iOvZT@CGQ3+EiXAha48 zQqlu(VaX+YmfL6IoPLi;BD#%vLwShg95Q>>6h85dHAnCH^N!qvU_Lw!L!7;uA;Akr zSgzI>yYZ5VY1J6+i{K4oPQ^;8Fc^-L9}I^qFq9-E#)N_F6%UstD*_KnYG4oWfq$r} z760ixfxJzhK%>5jjc6tOf)6GD>N+&&%fg2`e}$dmr{AV@N5rvWbgXJ-rHuFReQt$f zTX&`7EuFh4Q{IZ%qNAZDuf?5J0meQX@eTQsW&Ohejr}2Jn-{+7lsib&Y19jCCP$R7 z+-eFdRPE@24+4mH9)oNUo!aQP2i{nE=Z-~S8shZ`ZF2`V9&ZKferw&Lx>t0lOCC*! zZEls@1Ezet>1v9^F6Ltl0*<5N1ibXbX;RiBW9iOgMb3L!A2jv~+6JB4j&>*fe6)79 zLKn|6A2nwmx$h$rD)(B6G`8yqVx8$`q$`#~OnD1s`Gc~LEZ->=&ua$k>q}_C{yD)( zLS3CnPn=^cmaG1dA-j6k2N__f)N8`UrP4%lbo_+(p`3f?VoZ7#n_IGQ|&is z9H17~(xtmSrDN^kn~Mhqv4X!cAF`bG}Nbe9g-VvTuMzGgMK926`a^y~7k4b=|R ztR5}7jF6P<_qePT)m+KqRJC6^5ZLjcLKg3L1~LzCeX2a@{=|SE#@K7NQhC@n!kc>- zw@*@gtF9&uR!;F!N|IG~@xJF53(RQ(|9;Y@IETh-{ z3{-}KRXiTYd9h)y;)HL7bFy>0&p0ovR5ICb;f`#Nt_szzrlk8RGWKcQJUkaGxL%VS z6uYxA@YLs6_49VpQaA4I@(hgs;DY9 zzX!V5Zr3g`4z2JU9SV3KqK*#NrnQN(xfM$EOz$si64DtckkjvJ9If}Fmm#GndEaPk zMPsj7cbxtUXP-8i-yjSNb*?r=y29y@;BY+Kd2i&vLty8tqI1Dq<8oFF&bVA1OI^(v z4V4>8*f90m)W%x3wJVdI<7>6POw$`|71mkKa8}&ZUYa{!uLd+)5ink)Bj}CtARBrFF z($&|dG=;~oNbuyiTLx=5L z=>44s^EXlwm--w8|1@Q16;hb3*lnosx4Nj9cULR2+YTZ_b%FyNfRR1D3p|YLSRaa9Yh0} z`H5XBcKcOm^PYi>7&$GuJrG*?vwp%l~jyyltuZZz>JjAN4%~M?FVdm4`DLN9GShIX#Zx zB4+e1PFqr2t|(_%IlSZ{UaPTQyGN;hsJ|k>yN^O{9SPs|;+`0 zV{mxP#Xq>WKmkVoi--1QR>F=dyb6a;Yh{k!PQ2 zQ0_ecYrX0{Kp|1Nz%6h#PLmwYYc?)Rc}JT9`?^22!WJB7gg1`%s@EzvKWZFByBtv+ zEx2q;SFWg39w=%Y^nAxYpUo+|nS|qVZRv6Ou5b%_WU)hg1tc~a2Lq-8jp4THfdqm9 zU21fTrWJ^?OW33&T{&Lwl9NM0)K*sLoOixU$KGP1mkX`K@`cMvzxN(}8~68we>WAN z`yb-=sJ)L z*vodB>{%)ea@6#GiQ{wFCM4Y;ez>RMJW~?gH|pdoBH%Li({#Vv^ytNcv)w2zmHJ^2 zv*X0^pdo#^I~Ca`8e`ti3MElZK5_)?SKgaAxC&juj+k8e%lc)J$zucC1=RyGF<+E6 zz})(`c`5zx@krx0DQ4|WScq2~w%~*u`+S7(PXujty&gH&IwObo`*+;gEUe=GwxTl# zov%DdAF@lRjU9Z_;wjQZ5Z0*SD{(uxvJ`A)`HS_fEMDbnp*{i=(zS}U`Za+f4!8;w z>HowU(L%S>!6Sm;0u%&K>|I0P8O~chweGERm?|x~L1lspYhw%$h~}=V0pP6gMGFUdPhx{;wSfN3TEv+Gl;+sk`Rv zm~;@5*X)@>1+}Jyeaur%yKa9A|NXA;HLCZ;@%1aBvSYmD@0C>GV|LJ6 zvPPzm@UrneIz$Z_X2(v)3UFSp=+o=7jla*flBf@5`m~I<%a>)vc6|@ochvtum_dx> z---PDJ}D`;Rr+4RTC=A%kv8fwx{}=7GzjQDT#KtQy0NWmwmmFqs_x>BEm?EBt|rI$ zrJ1s*VrFsn?v3G}_=4q{5)$a?kwF`}sPx5LQz?Dby9VuIcfDB6npI??tSgYRq@=57 z!Y^Wb;=cC+Aid{JZ#b=c>OPxrB7bko4qKKCU1Hn&bb8(4Kvu8>2fJ$jIYz64+|Ee! z(JF0+w)RF{P2Nv9`q&t*Hmj$Y)15(Aum7I3ZA%nzLR^nQ0oH754?K+lRYZqk(G-LeeBapn4oF%5PXNeKy}wM2QR;H!HI#3^cv#^;76 zur!%iXlY><5^kcMYiHK$G0=@RaVTXZ!MD6=kPa}%9_ zaB7|xh7hey{A`I)3@2=pd+#-sWA*ZxTI>CZ=kOAoNB*6GHPm`$jAHAZ>oE|+Z8L@H z&wfYBiE4NY0q>c1&4+#cy!&=f5mmP_)}>0-V8)^%;OA%3XB~s}!2F}E5NuwEd|+pU5X@l37{AHs z#A_Y{N5FStpf0wC=I_x5+162vUcHLt8m{$Q0;{6>A_uZa6*?S&jK&#?#}1S=e9$lT zVu)$gAg4u{?!pXr*O$Oam^Cx>tkFy|O~juU~Uf`#TB_;<@y&Hw#Ki1DD6BZy4? z?&F9pptgA~?jtK(mKK6TfM|w*J8-gpYgoT2u&SK zVRVohK^f1X?!iX~<}QWV4_WI!lBEv>n?hu{LVk3ThJ}k`# zn6v2qmA0w$F1ZQyYZ&)5T0h?yZo#h-{yms8=NbK_cb6|LsfP7JOX~_@iHa%?$Gh>g zs|@CQAS~b8jnwLSdT4BcxTqayNx*B602YsbHJ!}LZsJg%aoWf0G{Abr*1nqXlk6b# zxLZ*0@q2@Di;>!j)x`l zk2Bu&Mka(gh+tr2{}~M~mF)k$l}X<+Z7~p1e+zLA zQ$s!7-tVYjfSyGIOH9Uk7U@LJKZtLby`rzYA#d5+8=@o*Ts=x)voq9-Rz3f6J&*al zMyd~+Q&yiR-v_s&-@?UZRt2NBENYF;@crIkT8FMryYwAG)VvCSZ(^aKiji79jD8 zY_Ibm?qH1YJ>69?`dZO0+kkvvg?g!(G?tWr1E1T9ikvsg8`vh);G^wmEfnfcHoVj-&_AtAA?Rm zd{EixU{IKgTb=l$0oquN(xDeJEyQAXVW6+l#XANlhy{YQ1h;6Zh*UD&AR4nm7CF+= zS`z56llEQn=88SCF>LHaXcEF9VOte`s-yj|9KXvb;2v=H7~5na1EKTKfx-a_1`YcO z+0B>qKVt5jEPO3G?kH+uhYbNoMY}cb1rW1=OvV=SWzOLGy9i{2qr|)=w@vxckK9X! zHuL+_2hk3~9{w>Ga6_2u0a$>RLsr=Bu0Qs%=#jx3*`4MvY7GUO=vCV@af))>(>1vh zhLx)YF1x!NRJ(Nt5Y4arsg-j}!%zEU@w8y25x4j&$2Y`HQ`l3__#`I5!c+idi6bbz zr`YXD4fQqZ*;|_n3F3Wg0%~H!9@ezQL+TYVrZdt^ucR@dgRs5 zXX3g8vIHwq-JtFl1dLZr*nN;31 ztm%$%Z7s1tb0!TZ>*@rY$~~eVoo!6zw)7m=XlpUL9Kc&4SlO~iYO0>H0i;RsKq7_& zzo7R_oB({80)I-J+0<5ht?c8o66%%ez$8P?-~GM{L|PLHc%MbR6Tw5Ci?4N0Jfl(x zWo+NbTwBpArIdlIu4F$~c%N6svj#`NX}{0Uk7=UG4C3z4dzohR*k2mj=NTkE>W98d zad)c6^M1jaZiBw3bQahz7-k#U-o1WT=>6KPI;53Ct1pz(-IFY4FR0gSTin?BAAbbNh^M}I(lnx6UMFRbK8aMcDcl+LHxhZprU<$?u8mp%wts&~S z#9V-=0q8X#-_%X8Nnp>1ZEY$Z+u5##)SN!JnPU8nYqIulV5n0o__F-qV^ZXp6vF;) zLpUcJ;~eC)){`nLm#8XNsvyLp_CvsB%Huex&K)9GgP}AKeT5N@U3y|BFU|TP@8nNr z8mrHcedQj${hKvZx3jKTI$KGxjkL+0;S|}^>yNyTV6S8Xp(VM^srE=1mGJ^aN}KBT z4s*JVQk8-J2bjO$q@SYPbc+$G;6HFN zilprEz!|y6@2NCQMr>c(nSBN8VG1g6{q%k#Hl-`SgtL)Wc8`kQO?^E*^D;i_9Qx?< zceNmS_3ut34ZL-mFD<^~G&*ovHrrT_S0t4m8v3!Ug)*#R(U|O2NYQ|-`1@E@{gL3B za?W9GiHvXk|0yTj;5)cA-5_p5T#{e-DFN6q}Fx zL@I+3m5=eSD!^P08(Pn99xh_H8Acfysv^vx@-;YvmEGF+fKhu@zl zY#VXn9UbfFUZsG{2$~kz>|izE_WAWB=vqoj{LpjOvT`*Y8_6)fl-wf#!IWKT_L%}Q z%iVb;@xMLj&a7)c*4FwsuwY`k^u4)}-*!6u+vt$4^pdiYj*JH^AY3zTvGJO4$y1M+T(CG()OfXfA+jjW^0fYcaUr>LwRm9!X9L;Ll5Rn{ zBb;oe6FD9{NKbZfT?R>z)d|TCQzorkI8t2{ZyOJ%8;K!YKy~loBJEQ)iS*t!`zXDml^Gji}_OFdeFo6QaKT8jdkOu2wa{jD2CJyPdxvLiuf^)!H z=D<4)5!{90JeQS@E`R>RX6Bf~u7jg>r2iHL@M1CVIGAFE;qq%8VD z=2mzuT4LIAbHA1~ZdCL`jXgzvS2xFBr?7H__n*o2+zkCrci9(XifVm5wtK>c`d+E&Z4=W4_M{FJMWl?nxDM7+`No{}<+f?y99mooRrf-# z0}I$G3Et~Uw?jKRye+2W{3!$|Viu&NAL?$EjAx*78&?}6d`fnVDb%!{%S$>b>tre2 zG|-X>Y70s>$DZdEN7D`5UXy2a3b%KOq_U-4z?Q&eG3E63;LghU`6jVWuFsr_)d z-7OXH9>8(XXSC8bA4k-}xIki&1(&ateY4B^a)ajj!>H$G`V)*osY*9jciwy&)lLcW zi+OyDF+22zm?In8UB%nC8M7ZZduF?8g}(KWg_Jmu znNS$hm+-X@kL6#%8IlxDiLbREZZG2~G9LSDvR1o3T&Zp0GcuX?FGPF(=lUAfAA=n+ z7Dj75l}B4vC3p2-jpue%j5w13)#oxw$n?<(%iDwdPcdrQ|Wp!>O;Kzrw{<;7h&p zp+-08P7Q&gszS)eXqz=_FCZ1^@8=Qdw|Tlx@4^k-+W$Mj#7PIaz|tE4r`M-zx3zmK zJ>4**P5T;rCXy7ST9+wt?*WuFHPC&CmTY8E$zTfOS(6>6^N<3hx>m!?+6+p1rxWm3 z=#%rYrFQ}%RTXSw=trG>!9EHi7Y|h)0~cHY&uu4m8^g-j+!`(lIJ zSY5J05uNS&^OYA*<$8Jt`w90a+s#-=Bb4bVvfMax&-Af23LD42;-GaC&ILJ7{yZR+ zZWsU?-S{JcOeQgx%Ef*lgnXaXe`dh-$Ed-vKX<2T7k|RWNYYdRPrd-4+tD@|Ny2v2 zum*CrxMhM>y*(NlBewK=xu3Hts`ciH{&QZAlV++k^}6)0-jRg))ZknS>H6F3 z5ztcqE6PHszceGiWss81luwAH4j5!nnlN#Xs6W$Y+vJW~pjCY7v7jY#G-{{@h_-C5 zq?mkKOPHA9-Q3#~GbdlLE*nxQT(ljnouG0te{@6In*!hCPhZaRJIUF>X;V30-$y21 z*LH>?(mf)4S_|cYZPT9IZxc&VK83L?_ec+o(+v%i?n)KS@&aQMUDW$w{%?uZGct$^ zL+D*oyPN)wfl0m5idzlN$wZa5S$XLye=Y_$(8Nv+Fvx3Pmo4c1fadPi3>vjmu`4Ml ztAD=4QUXlzCGyz7;=b_R;F$yW>nT{~)OxP)^Oeu=HT%J7A?P;}56$FSpINC(CJxyC z^-+WALgbG><0kFbz`s{K!0T%EtV8qU+N3d2>D}V(QdZYmoVD%+Hvd_sy@}b^+8m|B zaO`xUT|rAzYV+Vi*o9wCX$T3l4v1~D+5X-TdpO?*zL8fA4h}x$if#FSK9r)^$dsld zdM|`sQEhm{cJGDZ$LgOyX1-X3tDV5Ii8xBF)s37cz^s#!6|vGLLq>~!+f)>B&+xJ7 z^PZt0hy9w5j7t^F7pOd?LzrtIFY$Znr7BH6E!e{$WcXT!M)Ey1uke#f(&#k+x z2eP|9N)68+{*s+@w^-q4){&5)Qx*@=J&hn`OJdFWHfm&KFf%_ZCDu~@Ay|i9CHT*_ zIUwR(_AP<*@{jxhrGNvovCN>%mpyyRJmlT@d3jm&X2@a3S%s~v`EImHo6Ix2psfWN zBtbh_M4Sw$rUPde*~h!_-|Ev1XPtNU17mr2eLmGoIUva`-#}>L5tMJ7S*N`!Cf}{z zRpqHO3}FedPH-7QS$9u|PLZW@)CQj)86Mj0v6;$8I$x_mFM+<$j>v=QT}9p2%+AcLFEVoE;Kk8s+H8NU zz=k6n-v8Vm>vcrSBeSM*c<=Stl@%jO(huu^rZ+04j<~F(X*OfYYS1J%iebJlXkZgy z5eAk#VG!R4uw{P|LxRxz0kV|RS+W?yp-{2js4d{Y&Yb;gIe-ZKxjdze|Hu=WO;wnw zk%FWTTm~Q)vGROq19(({uQPHUTg|Q7&g^;K#+!JXrHM_BpsDBT&Ees~?6D8+)Ddwa zuqHHOrDl1{nMFkleGXqz>TTD1Q=1f54_>?ezoVI2zxO#=zi%3h=N-)D3|Q(i0=$YvWT3tJ3AB!0^2LXOPn;TWkq!@-9xgy>%Q+TH<-*XcA?w#0DmnvVstYcPYZbwI_ejW!Y zNZ8K{V~6E_jQXrGBw)Z~3JN$roUK&F*R%&61?5BG;o^L-iJDEc!1Jl)<}YM7=^Nb?vdEb;GMiZM(t2T#@@ zk9~^=E_Y#8Sa-3{v{2E3#FAVzdd`0&#n`*oxVodAN1Ri9d`QMjW0Be<`K|&+#>^o; zB*u(eP7eXbJ>T;J`hJKlwqgDO1+!0;nYB89xA++M$zwnKhuh{wVYzvsIva^XE$k}& zXtqY+X=H?$`E5%}OJ^7lUUsEb<}V!`1t}}Z=-{)JFROkh3oP|4US@$ndJO<6v4Bar zRbeJdSwlRprQ^=8&(mKf6bQ(X!yC>DP3dE3Efh4Z>hNwg5h3UU!UC=|p94XL^1&>T zG{4QH(JI{@LFGZKbxLQdBNt|%l)^r9KM+1bst3HS!|p1&0}QM0C0p1neCRouD`d5~ zt&xUsQpKBE3_qTpm2O$IE+t0mQl$)LCgqPd1;2*2_=`UTE9l*HUQHz_EiL=cQD4YV z{H}Z_b%!jP2KlMWnuLmol(cqG%TELRR-f$d2&utow8eoS9*E3fJgwXRMgjQ@T$0M* zh?tFTo&h+7UFWx*3`5KPe-vDN2wYX5PpF?OPcs8|$3T# zV}L13fMiZE-CqdhdmxTuEAt22?V$Tz)>m|69G-vN)?6BP(~AF7ty#jAA7X5b)W${S zoEvVXZ#s=9W}*u=s_k-yIHv(rz%%#HNsF~bU*`I4el5>M4ikD2)TA_$pfC?q5W#-| zqGH(*m@vL&h$~ePqNbP5Jt&*8duxWVuEw=c@(yii;^^Ax1+Ci%J=lN?Dgud=`}oGwGPDBi!(C^4WFdd9zC`w8(MPtqC2x1wzs!f#wOA87#}`=ro4oE_|_AxOB1~^dtr;$cc`qA!4qmxCNyy`!l0suLXZ;ZB9@f zj5lO0p0>67V`DsAU_0)ElCq-jiLj6om8mZJni}nNeZ6FAG`#zbicdyaK}KVw*tRdC zV2*>ET-ab3>9_r3q4~)$Q%fR|py*D1ehlGij~{O} zIC<#X^&Nf84`1hR$mV56w8PJSHy_}h2)ym+u_Fu0Z_4wM9lHS#Cx(FeF?>+a!-(JC zKoeLn4dq_?t-ePHemY5@9HX$-0sRwUpd&0?Y5?{EeIOCVKyFNT4#+D$y?dRyLmqTl za0)hp6m;+ZkPC6rd!)GX$4|j{VEIX&(<8+g8NQg1PyslcCbM@-9m&qo4~UKva$oS@;{$pFts-xfZ%C{i9F^8GNDZ>q3o zGClc`aN?*ePdW|0#JOpxCi-`RT4`()PM)S^ilQH$#&{SbCM26wpvWddO`Qp7(XPq0 zoBl2cWy}#+xbbhTCS2^g?d5r|59;HNL*^J$v@Er8>Et0?+JtT&=Xd*v*8Grk9Wmj= z25(6VU7xs z7#}Zri7Ua~(;cBmsdPPt(KNd!OKNUeVf_|@bHCc=O-_UWs+{#RJz1TcDecHo&x z-0{=LGa2}&U33wy6&NjCyRZ@ZZWhHjEFW5SBi_MHLZ{cn$81%80l} zC_`PCaWkoj>oad5)-+t1_CI+=JZ)B=x&?g;-bShf)ysHc@nIMcSMPiG@>52W4Tj+Z zJxPo9ewEuA+8 zYZ@>?|Bj>X;)g^?1U}89qkimZZckbxq-4i}-458z-(PBA{>xi3THHHOevFRVdkrvT zA9jF+yEDf>mp&TF@#2FbZQU}Fu#$L-%8p=4j;&qr_qPYq0ra>b;Rxo z2IvG_?sa8ovkR_`(}y;m?~&p5g6#a^Q?KckfszDNKV4zLd^Ym-)pMNA1!{otMm zs4QIEpr>o})Dc_i%x#5xyp7tI5bpYp66L7InRg|0X!Cnq+Q1?L=m+#Y9**9glSS{` z6UF&9E`U&c3G*2sFa(Tr-wpRS}X_gDr_VVaMQ^%;WnShORL1_a~GC=%Py&oc+M3CX4Fw zfyoi_gg?sHpAT6Tjim7MWBrnX^+zD$ptAZkmqkW_Fk3o=wwICu*B^^#qo?L0;uRer zp%4gky=T=R4BDjUS849;t{Ui7F;V7Aa+6b4r;m%<1^wZV1zZ&P{O_fg5AV4ERAAm5 z-#*E8HT)Qbc+8K1ex+e%%Ot%dEkcFx$6$W%2glShb-R0~syH!P5hD$3WaLYS8#s9q z?53kkdc+*uXhkX!U4ih3M6mq*yRYOyHFMHo#>V=| z2JRxldHs-+A1=bLdiuL&Y_c{fW|!v7aFd^&pR!uu4qDDAePXOlvm+*~ zEreRl9VbRCudxf*;ox-sZ$^1%%~sW|h4TjB`Y<$1>ccVW^?&uH&Djh{Npkx)dZEfH z5zlnzbfJH6?ccwTnF0F?H~7Fss|MvF!gr0}f{KY@(TRXF2#oT+aE*=+Kc~!$vYO>3 zi#_$w7b;PhFlh;BAv#a0xzRO%o;XR9i?H|8xJU>k%K&7yJGhC)5NjV}i2o-doKV{X z5NUa~S?UD+d_Y0}9IW+&GGHh=h5?~P?L3|1>#D=L0o;dp<(@awLP?TdSohHXAGjIb zK^Lc9m3o9)nI<2EyA0XZs1s7r_sasJ#tDXBe9Cnid{4wlMJ3AndE8hMT-r45 z{*t6D%B|dj!u8{Eb^dV$ZcQW<$R~-=r;S3t`{7o~A{_2uoC^qv6V{mH&t*Ll3S{^N z>>NUDM-bL@te%OD>E9WX9tj}=qMNi%Pv-!$tBw)6xda|z51s$Nrmj35%KiI4>PFoz zT143^lonEoBy=T-s1R9;n|;kXwh=c>L@7(wx+-Oxlzp3I#=a(5$1qv4jv33Cn3><1 z?yuYTuX(*@p64^4=d+yWe9n2F_dC#^fpyDdqnaCNA2*p8oR<@r+>gHWegKL(#@Y{! z-~A0a@jt_+dDORi;FDgDK#WaK)&UZ`1I@6{WG$UO4O_bqL(5^$7xqqh4%2U8r0ceDeNZn8nJ`LQpXivN;~2& z(;rFrh|TxEu4a(Z17bXWJVDKxn-M#}?EW0{%mR98!6AJ^-j4@mg5Bx$9q46BMjLNz zaKo%gX$LxZdC`yP(@SA?NwBg5Sw`Z&b7&-X>IAYz+*u8jkQI7ei-bS@cHz1?R-Vau z0`)WOE_NUlQ^}rp&uCUTD0p9J_@25gQ9|b7ypoy`L$y`XIugq9Q8BN z3nwTw%kr$YxSA6acV))#N%$@E6*C1AA@6PkeXk~p5E^KuQIuU0?7C0cc$x&dVp$1I zFJ+T!*90xjGV*(qfELno1IkKtC}Gu_MRh)$u_g0p+cofP!RdMu$@`;d;O9zG+a%RA z;RT=ulgoIA2BkOv!-wY#puoy4WaY1Cd5&c z5f5BNFpEb5$Kb3oHVen>?O-t^qSXoT|IpK~4=~0g)=du+GMjOpHk|#APwkFNr9+tJ z-tMBn_s2^?Lt51c;fRU;wB1xt#4E~?vOFo7l`Nq02Nf5Ds?B<|H9SyM-J9gT-tNv` z?an6~QnR6K7bPXydVMjtaLaht_4%ImuZ(l5fZc3 zo_%Y|&{mun_KL`n< zn4j!JW|Y_y+N3S=Y-@uc^*c(pJR_c4Vlo9K*xjjz*_s}`U(-o!hy6b)-;|;9EsOR6 z2{rviJs|a)&bpFf5$=r#C#!Wl>vcfQ$Wl@UvneTqMa?=eEEMcIF3+Y_($xbQuc!aw zcQdEEvs>&b!ZI998rp&Q6&6)}oyh4&T?_ioSoMM*b9&;mXGCVDQrY3cRimIOzYsPF zJyR^rrkkj*xm$k^t9oeH2g-(^YRB;8Lf)VIYHJhOvL9BYWa1Oo{PO^^z9_(@L*w2s z=u8ue6;8Wqbk^GAJ6m?^m>m?f^HPlId@cP;Q}%XDTwP1%#eubK(&}1QixxQ# zzb7Pk*=tmq{8hm~r`s7=I4}@(-3$Mu*BJ;nbhGxJWD4<25!w z(1%;Kz4x%(8$0{+0T8%!wEpV)qk!uIP>g9vj(C?_y7B*eTOsD<|KIk}(JQ$((Jn{E z;e3j_xoZt=Hxk&pN zs2%8r!`UIH-t|1D2hJ=Ic?SWlaW`JXOaDCw_C4zx>C-u}$VkvKQyeCEmjlFKn{obd zedXJ`8XxTZ`doZrMvi>?n<|IxnB2LQpd~0|apT1nvd#S#X}Nc0BhCM8w!(HydCO)x zeDp8H`j46ApL$ewe1om!t}RYgEr%1&r0Ew9eO*2jt$1$e4qvvePdT3VklS^}$}Vf# z8l~*ejsduBeO)yG^-t<5?Y{X9U8Q*k8&_vP%3WB~h^X?iCLM6qw}k0`aV>D;w8Y8o{;pGP0h&qJ-RtIQ(w(X?d-`Dy;Gms{|c&VaXxM?Z(Z#vclv!% zUi0LltnSWCpUzX??_flXhVsbuXMN=68Zle5DAO3{s>#Xrc`NE)(&7VTF7eF{>x>%~ z!?6Y8o+!{oPB9zUN0~GuQ~k{bRPauX^PL}SI9~jNDbIc@SzKA)!#v>++X*Nr(*!NE z@8MXx;`i0RNp5%a(wkilh|AP3C~*EZqZAypP}VnZQuFMnt(9KspqHHN;z-wtH&4rH zO+~k=291swT&k9`>cu3X*3{3Adnk{OW87e##0w6zzv!Edt$+1JQ@g{-j;DG)L(Mb$ zq+BAsVReF<7DmxzkFB9Hx=)tn6l3_+Igkg z#l;!}1I&S3uE!|S^T#Q;D)I!&fz&mT=u2H?F7=f+HWVj*{-PwV<{7dUxkexu2}%Q) zK6C|y@Zg}%0om4jocA0At-q~e3FKjsn-~7LSp!3J#H#$Bj6am?wN1YE?rSm;q#cg2x4G%6n6DJ-fovno)~Ptsj# zs^ypz{89H0=oc^jQ4o9Btt}7s zHhk%u-kIu<+=JMWM7w&uofcMc4S}=Xw8Xi(rt#4Z`H^A85y6i7KiC55d1iW#7o7EbaNz% zX8`o?=)2?6^%K$7YxVj6kU#y7DzDe`P$1+2b_a8y?5!0Rn^&cB^n{7ei?F{>4UaD~ zg4_%iTzM5&bcal~x{(eY*)9yfBRCi(Fj5EV_yj=hBG{1_zucOsl^VYvQFa zEeBZw`kA`UZjMPw2P(immOZD7E6d?dj}p>?+Gc|t-=9%C>-)uxUwmVBNsa7ebK|XI z!qLESAVZxgP3SlYo3YoWFd_mIPQLN|b9vF15`7fdz!B=;z%Yue*9>Opb4*%ujtV?7 zyc4#u$8Jn;{dx1m?2s!X=eS!yE}L-K-CJAzozb3 zHsShv56riG`I>ErZ_5wT3=^TSjwD8>np@}}U2 zKW=RFrMVO<5DuX&TP}ip;05t5U1!(gf&*sr{4oVD z)Afvvgif#nM*Cmr6;{2gP*b8*{CGQjR1s}Y59F&}9@aMZn+-cz`v55Fx#l!m?p$>scY1)^Gb=ik6?7>vQO@1oB(BUNGA>iyON}_U(pZY^ojECB zA~4k1eic(!U!`7YAxC{vb|QM5jL}sMmd(}=vK`JO?7TBvY)UM=%loyoI2tG%EM=p*D(H*S_sh-!d4pwG17elhAFFkhEC=cJDq1rY3BleMu*xG0u zXl^6A8%@X^y>y*-7GgaBm;=y}PbGIXSKE9ux8(C*KJijkuj`pUqp~!m;w+RCR50X_ zi=MPQWeR|Gm2~@`>*^#_1g~5$nS>R5dU}>_DU- z9SYa}AZOdB^L)GYIrL0w!fD;pW(t>|Yel@+_1rIa#%FLWa62LeNvNNfLOeP`RL$Uy zb`QK5rA5QT>K*^17c({ucv8uSNI`+~&&y>x=Y-dbUOE6j&%W4m=ln{b_y)jYkWa=* zZIX&T!KHELmw%gVbnm6Ty=5)n;qTr1BYNs1x$~+FWOY(i# zQ`J_Ujyl^Lo^`rIcop8+AVPb?ea3KJ6nS>~Kd+ce?~$US;x`}bZ?7$`rd1?w6r91r za!Sp;vlaN@(rZN)TIe8M3asexMnefIj)i+sTAof&YF;;aOXCj> zPWc}K48HIYl_@~sW{PI2lZv{g|#_aY2s2kCI; z7DOZdMbT2UHDf>>SI8jFD7jJ8J;r88K@N27wcwhO_RVgk4NhW3rg>0+Ff0#H5k9_w zu{cY)q&7RDNlAHc6-&WfWyZ7KnO$2C=jPxRN8(~LmG|oluBReM_sIkWh13Q_MsPE$ zCfPgi88f_ML+p*TGSHId;aBLgFmj&}QpzMBg^px3yW$RwM6JTiA5;mEb7lI1!o)UJ~TZcM7cS-|~J5esc zx0XDKE^f6cyl!+IJ^5TBQ`x6|%DdTqGm@O4(|~so-xzgY^_ELXYHX1}WCWop=eZQY zfV1#-$M+`Pmi9B^Eek*6iy#+(pYFlHlr+c!f3pC*NSp+Nup(9&j*Hk$_6(J60#1%&gQ)=SiQKYMZR=pZ~1g~P-| z{C>Hk`Yn`xzj}3>x%%jUx!E9oi`syfhSkCLl@GO9^xzrmQcB-ZH9pp5B-HUKq}1AM zk?yaLH+*_%z+&l+BljZt^u-Lm=-dFq+bjJm_kFb&lHJJ>58byT9~=OhQ|iKA z{q_b(jQfNICF1mlFU9J?a@I)hp87qicatA&jakJbhO}ZGVPkS1gKccrD7KLFv=S(> ztPbh(i^qhaJo6wDxx-|3W;{v1G~r~wo{gr3+D({C8vtX0i49PEpg>i;*1i?F;K``g zdezRnd=G-Qz@Dk>PyGY9ZGjmIAj|n8v-}r#bl*ave&GWD1`RKPbT|j zP6A&c<91N$SeDQ6sYB6x+XODX#Ro9@A!tS zoh|zfEAkZ4ts{w_bz*MVu$AMi{ve4yN~EtXh9G= zu1Fv$xuS{-rzpkPvu)#tKRo{Bo9}`bBgk>fBgw*klB?nbLF{2t-yINKFQ&~Bp3^JM zO%Gl((DgC)S3FYiuryar!u{yclYW6=-J^Tmzg^mhw01tB%jlOYs`w^Be>B2UriSrZ zB@eVX8$AKA$^jN7x%CtKj}lT3c?pVyd0k`1#O%LNr(>SG2m>qhROP6Z$=LEnBx)C* z3dGisvnf-_{+~+2U+@s^ z+Ul5{ZrZjC`$RM=f#4|dh1fWo1M~HmE|eItn-^kAPaX8CZm%_H8@!C-pH3YponQUS znNXUtlU=~fWvo8kdOVKAdTFdzpN-Dmz(#v)SIU@ocy&5GyW)BsL3A4S`d8s zf6J4c=!7*-?dWz8DeEF74%`TS_QnIql8p&dqi+h+oMJ@k_OS)2Nd-sS2CN>VUz987 zR<_@qcJMPD0(4Ax#M_o*Nb8xO!wZ~F!m^W_ki~Pt#pVTdla3{+Zu~{rK0Rs9SmiFW zfY(iLOGm%7SA+ps@^D^jFjOC<#K(+l$&T)&_%D)xqyTW3GnY@g`&EBQcx?lh&go5X&9ja1Qp@*B9<(LavL*I~ACz*A SV70^dh>n*2`GP-hhW#Hf7I2;b diff --git a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-7e095a40-e325-11ec-8642-e7f3d8b25a9b.json b/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-7e095a40-e325-11ec-8642-e7f3d8b25a9b.json deleted file mode 100755 index 4879b5460d..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-7e095a40-e325-11ec-8642-e7f3d8b25a9b.json +++ /dev/null @@ -1,158 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"c54d9223-56ad-42b4-9452-a44657dbcd6e\",\"w\":16,\"x\":0,\"y\":0},\"panelIndex\":\"c54d9223-56ad-42b4-9452-a44657dbcd6e\",\"panelRefName\":\"panel_c54d9223-56ad-42b4-9452-a44657dbcd6e\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"d3728fd5-5390-4448-8f26-277521569f30\",\"w\":16,\"x\":16,\"y\":0},\"panelIndex\":\"d3728fd5-5390-4448-8f26-277521569f30\",\"panelRefName\":\"panel_d3728fd5-5390-4448-8f26-277521569f30\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"f1a29b4b-19d4-4ce2-84ac-d82761bd0e2c\",\"w\":16,\"x\":32,\"y\":0},\"panelIndex\":\"f1a29b4b-19d4-4ce2-84ac-d82761bd0e2c\",\"panelRefName\":\"panel_f1a29b4b-19d4-4ce2-84ac-d82761bd0e2c\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5f57acd4-74a8-4d97-9e7b-d7b069efc867\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"5f57acd4-74a8-4d97-9e7b-d7b069efc867\",\"panelRefName\":\"panel_5f57acd4-74a8-4d97-9e7b-d7b069efc867\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"909c2914-4695-42dd-aa36-93e043a5c025\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"909c2914-4695-42dd-aa36-93e043a5c025\",\"panelRefName\":\"panel_909c2914-4695-42dd-aa36-93e043a5c025\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"c1ebdebc-a37b-48db-b2b1-6bcbcebea6d5\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"c1ebdebc-a37b-48db-b2b1-6bcbcebea6d5\",\"panelRefName\":\"panel_c1ebdebc-a37b-48db-b2b1-6bcbcebea6d5\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"9e320d15-f9df-4aea-9564-ac1c4257b51b\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"9e320d15-f9df-4aea-9564-ac1c4257b51b\",\"panelRefName\":\"panel_9e320d15-f9df-4aea-9564-ac1c4257b51b\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5eb1ba4d-7c85-44c2-9d82-0ff45b8a3d1c\",\"w\":24,\"x\":0,\"y\":45},\"panelIndex\":\"5eb1ba4d-7c85-44c2-9d82-0ff45b8a3d1c\",\"panelRefName\":\"panel_5eb1ba4d-7c85-44c2-9d82-0ff45b8a3d1c\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"7da33ed3-29d9-4fe1-87a9-4debfc7bdd24\",\"w\":24,\"x\":24,\"y\":45},\"panelIndex\":\"7da33ed3-29d9-4fe1-87a9-4debfc7bdd24\",\"panelRefName\":\"panel_7da33ed3-29d9-4fe1-87a9-4debfc7bdd24\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"ed2de824-c493-4240-a6b5-329889c40c43\",\"w\":24,\"x\":0,\"y\":60},\"panelIndex\":\"ed2de824-c493-4240-a6b5-329889c40c43\",\"panelRefName\":\"panel_ed2de824-c493-4240-a6b5-329889c40c43\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"a6d4e61e-57bc-413a-8c68-5f55ab59e16a\",\"w\":24,\"x\":24,\"y\":60},\"panelIndex\":\"a6d4e61e-57bc-413a-8c68-5f55ab59e16a\",\"panelRefName\":\"panel_a6d4e61e-57bc-413a-8c68-5f55ab59e16a\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"bf749130-3138-45fe-a010-5b30b4636e7b\",\"w\":24,\"x\":0,\"y\":75},\"panelIndex\":\"bf749130-3138-45fe-a010-5b30b4636e7b\",\"panelRefName\":\"panel_bf749130-3138-45fe-a010-5b30b4636e7b\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"44ed553e-d5cc-4841-85e9-0d8af122086a\",\"w\":24,\"x\":24,\"y\":75},\"panelIndex\":\"44ed553e-d5cc-4841-85e9-0d8af122086a\",\"panelRefName\":\"panel_44ed553e-d5cc-4841-85e9-0d8af122086a\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"cd3cb74e-b13e-4a52-a48c-82d13a59421a\",\"w\":24,\"x\":0,\"y\":90},\"panelIndex\":\"cd3cb74e-b13e-4a52-a48c-82d13a59421a\",\"panelRefName\":\"panel_cd3cb74e-b13e-4a52-a48c-82d13a59421a\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"42b64f1c-9526-4430-8f62-cc6596cf07d7\",\"w\":24,\"x\":24,\"y\":90},\"panelIndex\":\"42b64f1c-9526-4430-8f62-cc6596cf07d7\",\"panelRefName\":\"panel_42b64f1c-9526-4430-8f62-cc6596cf07d7\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"b2fe20be-cad5-4bfa-abd1-c9b069fd2494\",\"w\":24,\"x\":0,\"y\":105},\"panelIndex\":\"b2fe20be-cad5-4bfa-abd1-c9b069fd2494\",\"panelRefName\":\"panel_b2fe20be-cad5-4bfa-abd1-c9b069fd2494\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"ef6af3c0-10e9-46af-933c-a032464bdecf\",\"w\":24,\"x\":24,\"y\":105},\"panelIndex\":\"ef6af3c0-10e9-46af-933c-a032464bdecf\",\"panelRefName\":\"panel_ef6af3c0-10e9-46af-933c-a032464bdecf\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"f9aeff58-ece5-4b1d-80e2-83cc30cf4bbc\",\"w\":24,\"x\":0,\"y\":120},\"panelIndex\":\"f9aeff58-ece5-4b1d-80e2-83cc30cf4bbc\",\"panelRefName\":\"panel_f9aeff58-ece5-4b1d-80e2-83cc30cf4bbc\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"247ad399-6383-4bf0-910e-9cb6767781c3\",\"w\":24,\"x\":24,\"y\":120},\"panelIndex\":\"247ad399-6383-4bf0-910e-9cb6767781c3\",\"panelRefName\":\"panel_247ad399-6383-4bf0-910e-9cb6767781c3\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5c60fc1b-5ad1-4036-8adc-ce9adf455758\",\"w\":24,\"x\":0,\"y\":135},\"panelIndex\":\"5c60fc1b-5ad1-4036-8adc-ce9adf455758\",\"panelRefName\":\"panel_5c60fc1b-5ad1-4036-8adc-ce9adf455758\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"0a228399-6f69-4803-b4cd-65f30dca5890\",\"w\":24,\"x\":24,\"y\":135},\"panelIndex\":\"0a228399-6f69-4803-b4cd-65f30dca5890\",\"panelRefName\":\"panel_0a228399-6f69-4803-b4cd-65f30dca5890\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5b015940-3fee-411a-be82-661078ead366\",\"w\":24,\"x\":0,\"y\":150},\"panelIndex\":\"5b015940-3fee-411a-be82-661078ead366\",\"panelRefName\":\"panel_5b015940-3fee-411a-be82-661078ead366\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"655bc1d2-5c31-4a38-9759-ab72f88bdb92\",\"w\":24,\"x\":24,\"y\":150},\"panelIndex\":\"655bc1d2-5c31-4a38-9759-ab72f88bdb92\",\"panelRefName\":\"panel_655bc1d2-5c31-4a38-9759-ab72f88bdb92\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"8cdf7cdc-1858-4561-9e3b-5b5c73498586\",\"w\":24,\"x\":0,\"y\":165},\"panelIndex\":\"8cdf7cdc-1858-4561-9e3b-5b5c73498586\",\"panelRefName\":\"panel_8cdf7cdc-1858-4561-9e3b-5b5c73498586\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"2d6c60e3-32cc-4746-bc7d-3fa40b80447c\",\"w\":24,\"x\":24,\"y\":165},\"panelIndex\":\"2d6c60e3-32cc-4746-bc7d-3fa40b80447c\",\"panelRefName\":\"panel_2d6c60e3-32cc-4746-bc7d-3fa40b80447c\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":23,\"i\":\"bc34dc1a-ba27-489e-a950-90a978974351\",\"w\":48,\"x\":0,\"y\":180},\"panelIndex\":\"bc34dc1a-ba27-489e-a950-90a978974351\",\"panelRefName\":\"panel_bc34dc1a-ba27-489e-a950-90a978974351\",\"type\":\"search\",\"version\":\"7.17.0\"}]", - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-1h", - "timeRestore": true, - "timeTo": "now", - "title": "[Carbon Black Cloud] Alert", - "version": 1 - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-7e095a40-e325-11ec-8642-e7f3d8b25a9b", - "migrationVersion": { - "dashboard": "7.17.0" - }, - "references": [ - { - "id": "carbon_black_cloud-52fde850-8d73-11ec-ac12-4bc77fa14e95", - "name": "c54d9223-56ad-42b4-9452-a44657dbcd6e:panel_c54d9223-56ad-42b4-9452-a44657dbcd6e", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-f3f635b0-8d72-11ec-ac12-4bc77fa14e95", - "name": "d3728fd5-5390-4448-8f26-277521569f30:panel_d3728fd5-5390-4448-8f26-277521569f30", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95", - "name": "f1a29b4b-19d4-4ce2-84ac-d82761bd0e2c:panel_f1a29b4b-19d4-4ce2-84ac-d82761bd0e2c", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-9a533f40-8d80-11ec-ac12-4bc77fa14e95", - "name": "5f57acd4-74a8-4d97-9e7b-d7b069efc867:panel_5f57acd4-74a8-4d97-9e7b-d7b069efc867", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-1b554010-8d73-11ec-ac12-4bc77fa14e95", - "name": "909c2914-4695-42dd-aa36-93e043a5c025:panel_909c2914-4695-42dd-aa36-93e043a5c025", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-906f65c0-8d81-11ec-ac12-4bc77fa14e95", - "name": "c1ebdebc-a37b-48db-b2b1-6bcbcebea6d5:panel_c1ebdebc-a37b-48db-b2b1-6bcbcebea6d5", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95", - "name": "9e320d15-f9df-4aea-9564-ac1c4257b51b:panel_9e320d15-f9df-4aea-9564-ac1c4257b51b", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-5c122d10-8d83-11ec-ac12-4bc77fa14e95", - "name": "5eb1ba4d-7c85-44c2-9d82-0ff45b8a3d1c:panel_5eb1ba4d-7c85-44c2-9d82-0ff45b8a3d1c", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-2eafd430-8d83-11ec-ac12-4bc77fa14e95", - "name": "7da33ed3-29d9-4fe1-87a9-4debfc7bdd24:panel_7da33ed3-29d9-4fe1-87a9-4debfc7bdd24", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-cc2d3630-8d83-11ec-ac12-4bc77fa14e95", - "name": "ed2de824-c493-4240-a6b5-329889c40c43:panel_ed2de824-c493-4240-a6b5-329889c40c43", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-993b8650-8d83-11ec-ac12-4bc77fa14e95", - "name": "a6d4e61e-57bc-413a-8c68-5f55ab59e16a:panel_a6d4e61e-57bc-413a-8c68-5f55ab59e16a", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-97ab53f0-8d84-11ec-ac12-4bc77fa14e95", - "name": "bf749130-3138-45fe-a010-5b30b4636e7b:panel_bf749130-3138-45fe-a010-5b30b4636e7b", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-8af47260-8d87-11ec-ac12-4bc77fa14e95", - "name": "44ed553e-d5cc-4841-85e9-0d8af122086a:panel_44ed553e-d5cc-4841-85e9-0d8af122086a", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-d33296f0-8d79-11ec-ac12-4bc77fa14e95", - "name": "cd3cb74e-b13e-4a52-a48c-82d13a59421a:panel_cd3cb74e-b13e-4a52-a48c-82d13a59421a", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-f93958c0-8d83-11ec-ac12-4bc77fa14e95", - "name": "42b64f1c-9526-4430-8f62-cc6596cf07d7:panel_42b64f1c-9526-4430-8f62-cc6596cf07d7", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-5c6ce550-8d85-11ec-ac12-4bc77fa14e95", - "name": "b2fe20be-cad5-4bfa-abd1-c9b069fd2494:panel_b2fe20be-cad5-4bfa-abd1-c9b069fd2494", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-ee77a260-8d84-11ec-ac12-4bc77fa14e95", - "name": "ef6af3c0-10e9-46af-933c-a032464bdecf:panel_ef6af3c0-10e9-46af-933c-a032464bdecf", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-6efc6240-8d8a-11ec-ac12-4bc77fa14e95", - "name": "f9aeff58-ece5-4b1d-80e2-83cc30cf4bbc:panel_f9aeff58-ece5-4b1d-80e2-83cc30cf4bbc", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-ee670e50-8d89-11ec-ac12-4bc77fa14e95", - "name": "247ad399-6383-4bf0-910e-9cb6767781c3:panel_247ad399-6383-4bf0-910e-9cb6767781c3", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-10f699d0-8d8b-11ec-ac12-4bc77fa14e95", - "name": "5c60fc1b-5ad1-4036-8adc-ce9adf455758:panel_5c60fc1b-5ad1-4036-8adc-ce9adf455758", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-71058370-e323-11ec-8642-e7f3d8b25a9b", - "name": "0a228399-6f69-4803-b4cd-65f30dca5890:panel_0a228399-6f69-4803-b4cd-65f30dca5890", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-d49a3710-8d96-11ec-ac12-4bc77fa14e95", - "name": "5b015940-3fee-411a-be82-661078ead366:panel_5b015940-3fee-411a-be82-661078ead366", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95", - "name": "655bc1d2-5c31-4a38-9759-ab72f88bdb92:panel_655bc1d2-5c31-4a38-9759-ab72f88bdb92", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-89932a20-8d86-11ec-ac12-4bc77fa14e95", - "name": "8cdf7cdc-1858-4561-9e3b-5b5c73498586:panel_8cdf7cdc-1858-4561-9e3b-5b5c73498586", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-928cff80-8d8a-11ec-ac12-4bc77fa14e95", - "name": "2d6c60e3-32cc-4746-bc7d-3fa40b80447c:panel_2d6c60e3-32cc-4746-bc7d-3fa40b80447c", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95", - "name": "bc34dc1a-ba27-489e-a950-90a978974351:panel_bc34dc1a-ba27-489e-a950-90a978974351", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-869252c0-8d71-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-869252c0-8d71-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 129cd1c62a..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-869252c0-8d71-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.audit\\\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"table\":null,\"vis\":{\"params\":{\"colWidth\":[{\"colIndex\":0,\"width\":831}]}}},\"gridData\":{\"h\":15,\"i\":\"c8d90872-b3b3-447d-a9fc-ada6409efeb2\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"c8d90872-b3b3-447d-a9fc-ada6409efeb2\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"16128cf1-2134-46a9-9fd3-19889a2a6c9e\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"16128cf1-2134-46a9-9fd3-19889a2a6c9e\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"84a10ea8-959c-4fe7-852d-835b3786ed17\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"84a10ea8-959c-4fe7-852d-835b3786ed17\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":18,\"i\":\"cd3e5a79-3640-47ff-95cd-c54debb5ee2d\",\"w\":48,\"x\":0,\"y\":30},\"panelIndex\":\"cd3e5a79-3640-47ff-95cd-c54debb5ee2d\",\"panelRefName\":\"panel_3\",\"type\":\"search\",\"version\":\"7.17.0\"}]", - "timeRestore": false, - "title": "[Carbon Black Cloud] Audit Logs", - "version": 1 - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-869252c0-8d71-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "dashboard": "7.17.0" - }, - "references": [ - { - "id": "carbon_black_cloud-ee2098d0-8d70-11ec-ac12-4bc77fa14e95", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-0f420ad0-8d71-11ec-ac12-4bc77fa14e95", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-a6d2a900-8d70-11ec-ac12-4bc77fa14e95", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-4272e690-8d71-11ec-ac12-4bc77fa14e95", - "name": "panel_3", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-a94cd3a0-962a-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-a94cd3a0-962a-11ec-864c-3332b2a355f7.json deleted file mode 100755 index e3f216759c..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-a94cd3a0-962a-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,97 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"savedVis\":{\"data\":{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Event Type\",\"field\":\"carbon_black_cloud.endpoint_event.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"searchSource\":{\"filter\":[],\"index\":\"logs-*\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"\",\"type\":\"pie\",\"uiState\":{\"vis\":{\"legendOpen\":true}}},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"f19543f7-04f5-42dd-849b-5f2fd8ca15f8\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"f19543f7-04f5-42dd-849b-5f2fd8ca15f8\",\"title\":\"[Carbon Black Cloud] Top 10 Event Types\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"bee43023-c427-4176-ba31-2c4831cbc44e\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"bee43023-c427-4176-ba31-2c4831cbc44e\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"1727b9fb-4ba0-4f78-aa54-0d52db62b624\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"1727b9fb-4ba0-4f78-aa54-0d52db62b624\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"10a11498-6416-4b72-adc6-78a5d7937428\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"10a11498-6416-4b72-adc6-78a5d7937428\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"719006b6-32b2-4ed0-aecd-a1a1f37b471b\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"719006b6-32b2-4ed0-aecd-a1a1f37b471b\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"735f366c-91c5-4f33-961f-4db200acc05c\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"735f366c-91c5-4f33-961f-4db200acc05c\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"14a95a5a-61e8-459c-95bc-d1b11eed9054\",\"w\":24,\"x\":0,\"y\":45},\"panelIndex\":\"14a95a5a-61e8-459c-95bc-d1b11eed9054\",\"panelRefName\":\"panel_5\",\"title\":\"[Carbon Black Cloud] Top 10 Device External IP\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"3cc67760-3bba-4282-b91e-db120e8abe4e\",\"w\":24,\"x\":24,\"y\":45},\"panelIndex\":\"3cc67760-3bba-4282-b91e-db120e8abe4e\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"9df5251e-52af-4509-b30e-d62f8ef9a3a3\",\"w\":24,\"x\":0,\"y\":60},\"panelIndex\":\"9df5251e-52af-4509-b30e-d62f8ef9a3a3\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"04d664de-8814-4314-8f6e-2774b11ab572\",\"w\":24,\"x\":24,\"y\":60},\"panelIndex\":\"04d664de-8814-4314-8f6e-2774b11ab572\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"c80e4ab0-c5b5-4916-9025-d006a37aa7ba\",\"w\":24,\"x\":0,\"y\":75},\"panelIndex\":\"c80e4ab0-c5b5-4916-9025-d006a37aa7ba\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"f57a7bf6-bc25-433b-8019-6489124907b6\",\"w\":24,\"x\":24,\"y\":75},\"panelIndex\":\"f57a7bf6-bc25-433b-8019-6489124907b6\",\"panelRefName\":\"panel_10\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"c9984aec-8f3f-456a-aa80-b1fc314eb681\",\"w\":24,\"x\":0,\"y\":90},\"panelIndex\":\"c9984aec-8f3f-456a-aa80-b1fc314eb681\",\"panelRefName\":\"panel_11\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"3232147b-0914-4432-ba42-0c6c03414e4b\",\"w\":24,\"x\":24,\"y\":90},\"panelIndex\":\"3232147b-0914-4432-ba42-0c6c03414e4b\",\"panelRefName\":\"panel_12\",\"title\":\"[Carbon Black Cloud] Top 10 Effective Reputation of Loaded Modules\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"391470e2-57a0-46c7-86bd-f66c6eb2ed66\",\"w\":48,\"x\":0,\"y\":105},\"panelIndex\":\"391470e2-57a0-46c7-86bd-f66c6eb2ed66\",\"panelRefName\":\"panel_13\",\"type\":\"search\",\"version\":\"7.17.0\"}]", - "timeRestore": false, - "title": "[Carbon Black Cloud] Endpoint Event", - "version": 1 - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-a94cd3a0-962a-11ec-864c-3332b2a355f7", - "migrationVersion": { - "dashboard": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "f19543f7-04f5-42dd-849b-5f2fd8ca15f8:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "carbon_black_cloud-3afe1750-9630-11ec-864c-3332b2a355f7", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-11df3480-9630-11ec-864c-3332b2a355f7", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-c6cfa8d0-962f-11ec-864c-3332b2a355f7", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-2d324250-963e-11ec-864c-3332b2a355f7", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-949c1d00-9628-11ec-864c-3332b2a355f7", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-f28910d0-9628-11ec-864c-3332b2a355f7", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-76fe1db0-962e-11ec-864c-3332b2a355f7", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-ae34ca40-962e-11ec-864c-3332b2a355f7", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-f7681be0-962e-11ec-864c-3332b2a355f7", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-2be6ad50-962f-11ec-864c-3332b2a355f7", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-53d65ef0-962f-11ec-864c-3332b2a355f7", - "name": "panel_10", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-7a6261e0-962f-11ec-864c-3332b2a355f7", - "name": "panel_11", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-a7ce1420-9630-11ec-864c-3332b2a355f7", - "name": "panel_12", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-6494a7e0-9640-11ec-864c-3332b2a355f7", - "name": "panel_13", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-db61a3d0-9534-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-db61a3d0-9534-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index ee0df3955b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-db61a3d0-9534-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"table\":null,\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"604c7824-2086-4750-bd55-42ffffa9fc11\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"604c7824-2086-4750-bd55-42ffffa9fc11\",\"panelRefName\":\"panel_0\",\"title\":\"[Carbon Black Cloud] Distribution of Asset Vulnerability Summary by OS Type, OS Version\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"table\":null,\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":15,\"i\":\"bd12665d-43af-45c1-b05e-556ed72556fa\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"bd12665d-43af-45c1-b05e-556ed72556fa\",\"panelRefName\":\"panel_1\",\"title\":\"[Carbon Black Cloud] Distribution of Asset Vulnerability Summary by Sync Status\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"table\":null,\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":15,\"i\":\"fab676af-f870-4fd6-ac5d-3e17a224aaa8\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"fab676af-f870-4fd6-ac5d-3e17a224aaa8\",\"panelRefName\":\"panel_2\",\"title\":\"[Carbon Black Cloud] Distribution of Asset Vulnerability Summary by Severity\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"e3d4c200-17e9-4303-9073-b9dc8c95a790\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"e3d4c200-17e9-4303-9073-b9dc8c95a790\",\"panelRefName\":\"panel_3\",\"title\":\"[Carbon Black Cloud] Top 10 Hosts with Highest Vulnerability Count\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"table\":null,\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":15,\"i\":\"624500b9-5f23-4c1c-b84b-83c5f20b72bb\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"624500b9-5f23-4c1c-b84b-83c5f20b72bb\",\"panelRefName\":\"panel_4\",\"title\":\"[Carbon Black Cloud] Distribution of Asset Vulnerability Summary by Sync Type\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"0ec67461-93e2-49df-bcd9-3407fabd5832\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"0ec67461-93e2-49df-bcd9-3407fabd5832\",\"panelRefName\":\"panel_5\",\"title\":\"[Carbon Black Cloud] Top 10 Hosts with Highest Risk Score\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"66d4f664-5644-48c9-b179-ddd94e1a3e46\",\"w\":24,\"x\":24,\"y\":45},\"panelIndex\":\"66d4f664-5644-48c9-b179-ddd94e1a3e46\",\"panelRefName\":\"panel_6\",\"title\":\"[Carbon Black Cloud] Top 10 OS Names\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":20,\"i\":\"6e5579cc-cd91-4f7b-a221-e9bed77aa2b5\",\"w\":48,\"x\":0,\"y\":60},\"panelIndex\":\"6e5579cc-cd91-4f7b-a221-e9bed77aa2b5\",\"panelRefName\":\"panel_7\",\"title\":\"[Carbon Black Cloud] Asset Vulnerability Assessment Essential Details\",\"type\":\"search\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":15,\"i\":\"244dc3ee-7810-4f22-b915-bc0a8118fb2a\",\"w\":24,\"x\":0,\"y\":45},\"panelIndex\":\"244dc3ee-7810-4f22-b915-bc0a8118fb2a\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.17.0\"}]", - "timeRestore": false, - "title": "[Carbon Black Cloud] Asset Vulnerability Summary", - "version": 1 - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-db61a3d0-9534-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "dashboard": "7.17.0" - }, - "references": [ - { - "id": "carbon_black_cloud-56130b90-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-70cdb250-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-792a3310-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-750fefe0-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-68a6c080-954a-11ec-8b9d-35e42c3f7fcf", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf", - "name": "panel_7", - "type": "search" - }, - { - "id": "carbon_black_cloud-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf", - "name": "panel_8", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-e226d530-9554-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-e226d530-9554-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 94761c84e1..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/dashboard/carbon_black_cloud-e226d530-9554-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,107 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"8dc3cf12-046a-4901-b213-c29985291e77\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"8dc3cf12-046a-4901-b213-c29985291e77\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"savedVis\":{\"data\":{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device External IP\",\"field\":\"carbon_black_cloud.watchlist_hit.device.external_ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"searchSource\":{\"filter\":[],\"index\":\"logs-*\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"\",\"type\":\"table\",\"uiState\":{}}},\"gridData\":{\"h\":15,\"i\":\"4f7b5cef-a7e9-44a9-8769-44d5326a8df4\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"4f7b5cef-a7e9-44a9-8769-44d5326a8df4\",\"title\":\"[Carbon Black Cloud] Top 10 Device External IPs\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"savedVis\":{\"data\":{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Watchlist Hit Name\",\"field\":\"carbon_black_cloud.watchlist_hit.watchlists.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"searchSource\":{\"filter\":[],\"index\":\"logs-*\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Watchlist Hit Names\",\"type\":\"table\",\"uiState\":{}}},\"gridData\":{\"h\":15,\"i\":\"3d454d18-6baa-40de-aa94-4ebfaee9a759\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"3d454d18-6baa-40de-aa94-4ebfaee9a759\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"savedVis\":{\"data\":{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Severity\",\"field\":\"event.severity\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"searchSource\":{\"filter\":[],\"index\":\"logs-*\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Watchlist Hit by Severity\",\"type\":\"pie\",\"uiState\":{\"vis\":{\"legendOpen\":true}}},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"b0289aae-02bb-472e-8a22-07ff9f5d2372\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"b0289aae-02bb-472e-8a22-07ff9f5d2372\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"savedVis\":{\"data\":{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Reputation\",\"field\":\"carbon_black_cloud.watchlist_hit.process.reputation\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"searchSource\":{\"filter\":[],\"index\":\"logs-*\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"\",\"type\":\"pie\",\"uiState\":{\"vis\":{\"legendOpen\":true}}},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"d29f5a98-736d-4f47-877e-b4552d15f889\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"d29f5a98-736d-4f47-877e-b4552d15f889\",\"title\":\"[Carbon Black Cloud] Distribution of Watchlist Hit by Process Reputation\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"savedVis\":{\"data\":{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Parent Process Reputation\",\"field\":\"carbon_black_cloud.watchlist_hit.process.parent.reputation\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"searchSource\":{\"filter\":[],\"index\":\"logs-*\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}},\"description\":\"\",\"id\":\"\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Watchlist Hit by Process Reputation\",\"type\":\"pie\",\"uiState\":{\"vis\":{\"legendOpen\":true}}},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"ae5c96d5-b7d6-45f8-b57b-42cc190f990b\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"ae5c96d5-b7d6-45f8-b57b-42cc190f990b\",\"title\":\"[Carbon Black Cloud] Distribution of Watchlist Hit by Parent Process Reputation\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"f3ba83bc-4f34-4131-9a0c-bac18ec92ac0\",\"w\":24,\"x\":0,\"y\":45},\"panelIndex\":\"f3ba83bc-4f34-4131-9a0c-bac18ec92ac0\",\"panelRefName\":\"panel_1\",\"title\":\"[Carbon Black Cloud] Top 10 Process Publisher Names\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5271fb1f-64a6-461e-b2de-4abc76736af6\",\"w\":24,\"x\":24,\"y\":45},\"panelIndex\":\"5271fb1f-64a6-461e-b2de-4abc76736af6\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"9c2fdcbe-43cb-4070-88ef-03e6e5082636\",\"w\":24,\"x\":0,\"y\":60},\"panelIndex\":\"9c2fdcbe-43cb-4070-88ef-03e6e5082636\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"bc0503e7-6c6d-4edf-a76e-17a74f7d0957\",\"w\":24,\"x\":24,\"y\":60},\"panelIndex\":\"bc0503e7-6c6d-4edf-a76e-17a74f7d0957\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":15,\"i\":\"d02cda3a-ceef-4766-b25b-456733be2a66\",\"w\":24,\"x\":0,\"y\":75},\"panelIndex\":\"d02cda3a-ceef-4766-b25b-456733be2a66\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"5b66a72e-ce08-441c-8705-bb632b896745\",\"w\":24,\"x\":24,\"y\":75},\"panelIndex\":\"5b66a72e-ce08-441c-8705-bb632b896745\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"6bff08c7-8ffb-423e-87de-f7585aa6bc86\",\"w\":24,\"x\":0,\"y\":90},\"panelIndex\":\"6bff08c7-8ffb-423e-87de-f7585aa6bc86\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"437c123b-c447-476e-a28b-f3d965a50968\",\"w\":24,\"x\":24,\"y\":90},\"panelIndex\":\"437c123b-c447-476e-a28b-f3d965a50968\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"33d80097-0089-4b48-8fd9-5dcda9e58e48\",\"w\":24,\"x\":0,\"y\":105},\"panelIndex\":\"33d80097-0089-4b48-8fd9-5dcda9e58e48\",\"panelRefName\":\"panel_9\",\"title\":\"[Carbon Black Cloud] Top 10 Process Publisher States\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"gridData\":{\"h\":15,\"i\":\"50a006ac-7108-47e5-adef-876c15fc8b44\",\"w\":24,\"x\":24,\"y\":105},\"panelIndex\":\"50a006ac-7108-47e5-adef-876c15fc8b44\",\"panelRefName\":\"panel_10\",\"title\":\"[Carbon Black Cloud] Top 10 Parent Process Publisher States\",\"type\":\"visualization\",\"version\":\"7.17.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":31,\"i\":\"cfec84cb-87af-4b98-b855-17372eee70c8\",\"w\":48,\"x\":0,\"y\":120},\"panelIndex\":\"cfec84cb-87af-4b98-b855-17372eee70c8\",\"panelRefName\":\"panel_11\",\"type\":\"search\",\"version\":\"7.17.0\"}]", - "timeRestore": false, - "title": "[Carbon Black Cloud] Watchlist Hit", - "version": 1 - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-e226d530-9554-11ec-96f0-8de26c63c826", - "migrationVersion": { - "dashboard": "7.17.0" - }, - "references": [ - { - "id": "carbon_black_cloud-c3786990-9555-11ec-96f0-8de26c63c826", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "logs-*", - "name": "4f7b5cef-a7e9-44a9-8769-44d5326a8df4:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3d454d18-6baa-40de-aa94-4ebfaee9a759:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b0289aae-02bb-472e-8a22-07ff9f5d2372:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d29f5a98-736d-4f47-877e-b4552d15f889:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ae5c96d5-b7d6-45f8-b57b-42cc190f990b:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "carbon_black_cloud-3aa59c50-955a-11ec-96f0-8de26c63c826", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-6fcd17f0-955a-11ec-96f0-8de26c63c826", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-bb323db0-955a-11ec-96f0-8de26c63c826", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-de59dff0-955a-11ec-96f0-8de26c63c826", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-17537cc0-955c-11ec-96f0-8de26c63c826", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-4dc9e690-955c-11ec-96f0-8de26c63c826", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-715f3ec0-955c-11ec-96f0-8de26c63c826", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-cb70a610-955c-11ec-96f0-8de26c63c826", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-0296fef0-955d-11ec-96f0-8de26c63c826", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-28323940-955d-11ec-96f0-8de26c63c826", - "name": "panel_10", - "type": "visualization" - }, - { - "id": "carbon_black_cloud-3ea9c2a0-955e-11ec-96f0-8de26c63c826", - "name": "panel_11", - "type": "search" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-3ea9c2a0-955e-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-3ea9c2a0-955e-11ec-96f0-8de26c63c826.json deleted file mode 100755 index fde5382f93..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-3ea9c2a0-955e-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "attributes": { - "columns": [ - "carbon_black_cloud.watchlist_hit.watchlists.name", - "process.command_line", - "process.parent.command_line", - "process.executable", - "process.parent.executable", - "carbon_black_cloud.watchlist_hit.ioc.id", - "carbon_black_cloud.watchlist_hit.ioc.hit" - ], - "description": "", - "grid": {}, - "hideChart": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "[Carbon Black Cloud] Watchlist Hit Essential Details" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-3ea9c2a0-955e-11ec-96f0-8de26c63c826", - "migrationVersion": { - "search": "7.9.3" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-4272e690-8d71-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-4272e690-8d71-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index fdc104f3b2..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-4272e690-8d71-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "attributes": { - "columns": [ - "event.id", - "client.user.id", - "event.reason", - "client.ip" - ], - "description": "", - "grid": {}, - "hideChart": true, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.audit\\\"\"}}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "[Carbon Black Cloud] Audit Essential Details" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-4272e690-8d71-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "search": "7.9.3" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6494a7e0-9640-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6494a7e0-9640-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 800a5cb006..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6494a7e0-9640-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "attributes": { - "columns": [ - "carbon_black_cloud.endpoint_event.type", - "process.command_line", - "process.parent.command_line", - "dll.path", - "carbon_black_cloud.endpoint_event.target_cmdline", - "process.executable", - "process.parent.executable" - ], - "description": "", - "grid": {}, - "hideChart": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "[Carbon Black Cloud] Endpoint Events Essential Details" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-6494a7e0-9640-11ec-864c-3332b2a355f7", - "migrationVersion": { - "search": "7.9.3" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 1a37e59347..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "attributes": { - "columns": [ - "event.id", - "event.reason", - "event.url", - "carbon_black_cloud.alert.threat_indicators.process_name", - "carbon_black_cloud.alert.category" - ], - "description": "", - "grid": {}, - "hideChart": true, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "[Carbon Black Cloud] Alerts Essential Details" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-6e41bd70-8d8d-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "search": "7.9.3" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index c060c3bd41..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/search/carbon_black_cloud-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "attributes": { - "columns": [ - "host.hostname", - "vulnerability.severity", - "vulnerability.score.base", - "carbon_black_cloud.asset_vulnerability_summary.vuln_count" - ], - "description": "", - "grid": {}, - "hideChart": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "[Carbon Black Cloud] Asset Vulnerability Assessment Essential Details" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-dcc2d650-90a6-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "search": "7.9.3" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0296fef0-955d-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0296fef0-955d-11ec-96f0-8de26c63c826.json deleted file mode 100755 index bf6bf9170c..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0296fef0-955d-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Process Publisher State", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Publisher State\",\"field\":\"carbon_black_cloud.watchlist_hit.process.publisher.state\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Process Publisher State\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-0296fef0-955d-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 329118ed72..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by OS, OS version", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"OS\",\"field\":\"host.os.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"OS Version\",\"field\":\"host.os.version\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":true,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by OS, OS version\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-0a8f5e90-8d79-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0f420ad0-8d71-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0f420ad0-8d71-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index fb78529067..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-0f420ad0-8d71-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.audit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Client IPs", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Client IPs\",\"field\":\"client.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Client IPs\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-0f420ad0-8d71-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-10f699d0-8d8b-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-10f699d0-8d8b-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index edfb4ab922..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-10f699d0-8d8b-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Threat Indicators TTPS", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Indicators TTPS\",\"field\":\"carbon_black_cloud.alert.threat_indicators.ttps\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Threat Indicators TTPS\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-10f699d0-8d8b-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-11df3480-9630-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-11df3480-9630-11ec-864c-3332b2a355f7.json deleted file mode 100755 index e058315a1e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-11df3480-9630-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Actions", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Actions\",\"field\":\"event.action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Top 10 Actions\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-11df3480-9630-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-17537cc0-955c-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-17537cc0-955c-11ec-96f0-8de26c63c826.json deleted file mode 100755 index e9926e3521..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-17537cc0-955c-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Watchlist Hit by OS", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"OS\",\"field\":\"carbon_black_cloud.watchlist_hit.device.os\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Watchlist Hit by OS\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-17537cc0-955c-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-1b554010-8d73-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-1b554010-8d73-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 5c97a8d4eb..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-1b554010-8d73-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Severity", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Severity\",\"field\":\"event.severity\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Severity\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-1b554010-8d73-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-28323940-955d-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-28323940-955d-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 8bb3adabfb..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-28323940-955d-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Parent Process Publisher State", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Parent Process Publisher State\",\"field\":\"carbon_black_cloud.watchlist_hit.process.parent.publisher.state\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Parent Process Publisher State\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-28323940-955d-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2be6ad50-962f-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2be6ad50-962f-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 7bec55f465..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2be6ad50-962f-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Child Process Username", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Child Process Username\",\"field\":\"carbon_black_cloud.endpoint_event.childproc.username\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":9},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Child Process Username\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-2be6ad50-962f-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index e4b7fe64f8..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Asset Vulnerability Summary by Type", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Type\",\"field\":\"carbon_black_cloud.asset_vulnerability_summary.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Asset Vulnerability Summary by Type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-2d1eedf0-9629-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d324250-963e-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d324250-963e-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 6b1cb56ea0..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2d324250-963e-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Endpoint Events by Event Origin", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Event Origin\",\"field\":\"carbon_black_cloud.endpoint_event.event_origin\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Endpoint Events by Event Origin\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-2d324250-963e-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2eafd430-8d83-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2eafd430-8d83-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index c59f3f2623..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-2eafd430-8d83-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Category of the Threat Cause", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Category of the Threat Cause\",\"field\":\"carbon_black_cloud.alert.threat_cause.threat_category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Category of the Threat Cause\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-2eafd430-8d83-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3aa59c50-955a-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3aa59c50-955a-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 0a01e78828..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3aa59c50-955a-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Process Publisher Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Publisher Name\",\"field\":\"carbon_black_cloud.watchlist_hit.process.publisher.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Process Publisher Name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-3aa59c50-955a-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3afe1750-9630-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3afe1750-9630-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 682f389163..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-3afe1750-9630-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Endpoint Events by OS", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device OS\",\"field\":\"carbon_black_cloud.endpoint_event.device.os\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Endpoint Events by OS\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-3afe1750-9630-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-4dc9e690-955c-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-4dc9e690-955c-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 7af6d5ad55..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-4dc9e690-955c-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 IOC Hits", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"IOC Hit\",\"field\":\"carbon_black_cloud.watchlist_hit.ioc.hit\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 IOC Hits\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-4dc9e690-955c-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-52fde850-8d73-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-52fde850-8d73-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 1c116157a2..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-52fde850-8d73-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Category", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Category\",\"field\":\"carbon_black_cloud.alert.category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Category\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-52fde850-8d73-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-53d65ef0-962f-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-53d65ef0-962f-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 3ced47d3fe..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-53d65ef0-962f-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Process Publisher State", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Publisher State\",\"field\":\"carbon_black_cloud.endpoint_event.process.publisher.state\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Process Publisher State\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-53d65ef0-962f-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-56130b90-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-56130b90-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 60cf2f819b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-56130b90-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by OS Type, OS Version", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"OS Type\",\"field\":\"host.os.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"OS Version\",\"field\":\"host.os.version\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"row\":true,\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"Distribution of Asset Vulnerability Summary by OS Type, OS Version\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-56130b90-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5a5dad90-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5a5dad90-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 411603d6cc..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5a5dad90-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by Type", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"carbon_black_cloud.asset_vulnerability_summary.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":2},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":75,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Distribution of Asset Vulnerability Summary by Type\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-5a5dad90-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c122d10-8d83-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c122d10-8d83-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 811d8c6112..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c122d10-8d83-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Source of the Threat Cause", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source of the Threat Cause\",\"field\":\"carbon_black_cloud.alert.threat_cause.vector\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Source of the Threat Cause\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-5c122d10-8d83-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c6ce550-8d85-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c6ce550-8d85-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index e390c83ecc..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5c6ce550-8d85-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by IOC field", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"IOC Field\",\"field\":\"carbon_black_cloud.alert.ioc.field\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by IOC field\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-5c6ce550-8d85-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5f690780-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5f690780-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index bdd43d6d65..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-5f690780-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by OS Type", - "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.os.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":3},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"Distribution of Asset Vulnerability Summary by OS Type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-5f690780-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6496b680-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6496b680-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index a8622511b3..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6496b680-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by OS Architecture", - "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.architecture\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":3},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":true,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"Distribution of Asset Vulnerability Summary by OS Architecture\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-6496b680-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-68a6c080-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-68a6c080-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 02160d4bea..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-68a6c080-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Top 10 OS Names", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"OS Names\",\"field\":\"host.os.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"row\":false,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"Top 10 OS Names\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-68a6c080-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 6c64141f00..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Top 10 Hosts with Highest Vulnerability Count", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Vulnerability Count\",\"field\":\"carbon_black_cloud.asset_vulnerability_summary.vuln_count\"},\"schema\":\"metric\",\"type\":\"max\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Hostname\",\"field\":\"host.hostname\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"Top 10 Hosts with Highest Vulnerability Count\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-6bfd1770-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6efc6240-8d8a-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6efc6240-8d8a-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 630d474e6e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6efc6240-8d8a-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Workflow State", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Workflow State\",\"field\":\"carbon_black_cloud.alert.workflow.state\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Workflow State\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-6efc6240-8d8a-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6fcd17f0-955a-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6fcd17f0-955a-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 228daf684c..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-6fcd17f0-955a-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Parent Process Publisher Names", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Parent Process Publisher Name\",\"field\":\"carbon_black_cloud.watchlist_hit.process.parent.publisher.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Parent Process Publisher Names\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-6fcd17f0-955a-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-70cdb250-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-70cdb250-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 1bd12c5d2e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-70cdb250-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by Severity", - "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Severity\",\"field\":\"vulnerability.severity\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"Distribution of Asset Vulnerability Summary by Severity\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-70cdb250-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-71058370-e323-11ec-8642-e7f3d8b25a9b.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-71058370-e323-11ec-8642-e7f3d8b25a9b.json deleted file mode 100755 index 0919e5e20a..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-71058370-e323-11ec-8642-e7f3d8b25a9b.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Threat Cause Actor Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Cause Actor Name\",\"field\":\"carbon_black_cloud.alert.threat_cause.actor.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Threat Cause Actor Name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-71058370-e323-11ec-8642-e7f3d8b25a9b", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-715f3ec0-955c-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-715f3ec0-955c-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 0a3d26dad2..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-715f3ec0-955c-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Report Names", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Report Name\",\"field\":\"carbon_black_cloud.watchlist_hit.report.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Report Names\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-715f3ec0-955c-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-750fefe0-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-750fefe0-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 6e873422cb..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-750fefe0-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Top 10 Hosts with Highest Risk Score", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Risk Score\",\"field\":\"vulnerability.score.base\"},\"schema\":\"metric\",\"type\":\"max\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Hostname\",\"field\":\"host.hostname\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"Top 10 Hosts with Highest Risk Score\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-750fefe0-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-76fe1db0-962e-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-76fe1db0-962e-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 48a0ff614a..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-76fe1db0-962e-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Process Publisher Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Publisher Name\",\"field\":\"carbon_black_cloud.endpoint_event.process.publisher.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Process Publisher Name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-76fe1db0-962e-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-792a3310-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-792a3310-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index b549ad14a1..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-792a3310-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by Sync Type", - "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Sync type\",\"field\":\"carbon_black_cloud.asset_vulnerability_summary.sync.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"Distribution of Asset Vulnerability Summary by Sync Type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-792a3310-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7a6261e0-962f-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7a6261e0-962f-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 116934a90e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7a6261e0-962f-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Child Process Publisher State", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Child Process Publisher State\",\"field\":\"carbon_black_cloud.endpoint_event.childproc.publisher.state\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Child Process Publisher State\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-7a6261e0-962f-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index ebce21d74d..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Distribution of Asset Vulnerability Summary by Sync Status", - "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Sync Status\",\"field\":\"carbon_black_cloud.asset_vulnerability_summary.sync.status\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"Distribution of Asset Vulnerability Summary by Sync Status\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-7caf3b20-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-80778dc0-954a-11ec-8b9d-35e42c3f7fcf.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-80778dc0-954a-11ec-8b9d-35e42c3f7fcf.json deleted file mode 100755 index 8f11ac69cf..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-80778dc0-954a-11ec-8b9d-35e42c3f7fcf.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.asset_vulnerability_summary\\\"\"}}" - }, - "title": "Top 10 Hosts with Severity", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Severity\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Hostname\",\"field\":\"host.hostname\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderAgg\":{\"enabled\":true,\"id\":\"2-orderAgg\",\"params\":{\"field\":\"vulnerability.severity\"},\"schema\":\"orderAgg\",\"type\":\"cardinality\"},\"orderBy\":\"custom\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"Top 10 Hosts with Severity\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-80778dc0-954a-11ec-8b9d-35e42c3f7fcf", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-89932a20-8d86-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-89932a20-8d86-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 5d57824451..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-89932a20-8d86-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 IOC Hit", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"IOC Hit\",\"field\":\"carbon_black_cloud.alert.ioc.hit\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 IOC Hit\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-89932a20-8d86-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-8af47260-8d87-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-8af47260-8d87-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index dd5f86134d..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-8af47260-8d87-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Watchlist Hit", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Watchlist Hit\",\"field\":\"carbon_black_cloud.alert.watchlists.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Watchlist Hit\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-8af47260-8d87-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-906f65c0-8d81-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-906f65c0-8d81-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 60669ee962..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-906f65c0-8d81-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Threat Cause Reputation", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Cause Reputation\",\"field\":\"carbon_black_cloud.alert.threat_cause.reputation\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Threat Cause Reputation\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-906f65c0-8d81-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-928cff80-8d8a-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-928cff80-8d8a-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 19ad6bf381..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-928cff80-8d8a-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Threat Indicators Process Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Indicators Process Name\",\"field\":\"carbon_black_cloud.alert.threat_indicators.process_name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Threat Indicators Process Name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-928cff80-8d8a-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-949c1d00-9628-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-949c1d00-9628-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 7992c14128..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-949c1d00-9628-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Devices", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device Name\",\"field\":\"host.hostname\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Devices\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-949c1d00-9628-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-97ab53f0-8d84-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-97ab53f0-8d84-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index ebcc102bf4..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-97ab53f0-8d84-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Run State", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Run State\",\"field\":\"carbon_black_cloud.alert.run_state\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Run State\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-97ab53f0-8d84-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-993b8650-8d83-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-993b8650-8d83-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index bf3592d08f..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-993b8650-8d83-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Blocked Threat Category", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Blocked Threat Category\",\"field\":\"carbon_black_cloud.alert.blocked_threat_category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Blocked Threat Category\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-993b8650-8d83-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-9a533f40-8d80-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-9a533f40-8d80-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 1025e00226..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-9a533f40-8d80-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Sensor Action", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Sensor Action\",\"field\":\"carbon_black_cloud.alert.sensor_action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Sensor Action\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-9a533f40-8d80-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index c4ce665f33..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Device Username", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Username\",\"field\":\"user.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Device Username\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-a5d6fa30-8d8c-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a6d2a900-8d70-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a6d2a900-8d70-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 7db345ec9b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a6d2a900-8d70-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.audit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Audit Logs by Flag Status", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Flagged\",\"field\":\"carbon_black_cloud.audit.flagged\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Audit Logs by Flag Status\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-a6d2a900-8d70-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a7ce1420-9630-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a7ce1420-9630-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 37864260d1..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-a7ce1420-9630-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Effective reputation of the loaded modules", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Effective Reputation of Loaded Modules\",\"field\":\"carbon_black_cloud.endpoint_event.modload.effective_reputation\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Effective reputation of the loaded modules\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-a7ce1420-9630-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ae34ca40-962e-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ae34ca40-962e-11ec-864c-3332b2a355f7.json deleted file mode 100755 index cf20544145..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ae34ca40-962e-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Child Process Publisher Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Child Process Publisher Name\",\"field\":\"carbon_black_cloud.endpoint_event.childproc.publisher.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":8},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Child Process Publisher Name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-ae34ca40-962e-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-bb323db0-955a-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-bb323db0-955a-11ec-96f0-8de26c63c826.json deleted file mode 100755 index dd2d0ee97a..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-bb323db0-955a-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Process Usernames", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Username\",\"field\":\"carbon_black_cloud.watchlist_hit.process.username\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Process Usernames\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-bb323db0-955a-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c3786990-9555-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c3786990-9555-11ec-96f0-8de26c63c826.json deleted file mode 100755 index bb4fb20b4b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c3786990-9555-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Device Names", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device Name\",\"field\":\"host.hostname\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Device Names\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-c3786990-9555-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c6cfa8d0-962f-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c6cfa8d0-962f-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 3a76cb6cae..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-c6cfa8d0-962f-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Endpoint Events by Sensor Actions", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Sensor Action\",\"field\":\"carbon_black_cloud.endpoint_event.sensor_action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Endpoint Events by Sensor Actions\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-c6cfa8d0-962f-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cb70a610-955c-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cb70a610-955c-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 29d985b4d8..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cb70a610-955c-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Watchlist Hit by Report Tags", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Watchlist Hit by Report Tag\",\"field\":\"carbon_black_cloud.watchlist_hit.report.tags\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":75,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Watchlist Hit by Report Tags\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-cb70a610-955c-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cc2d3630-8d83-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cc2d3630-8d83-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 50933d86cc..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-cc2d3630-8d83-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Not Blocked Threat Category", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Not Blocked Threat Category\",\"field\":\"carbon_black_cloud.alert.not_blocked_threat_category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Not Blocked Threat Category\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-cc2d3630-8d83-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d33296f0-8d79-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d33296f0-8d79-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index bf02f82c2e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d33296f0-8d79-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Policy Names", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Policy Name\",\"field\":\"carbon_black_cloud.alert.policy.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Policy Names\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-d33296f0-8d79-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d49a3710-8d96-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d49a3710-8d96-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index bfebab9f24..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-d49a3710-8d96-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Reason Codes", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Reason Codes\",\"field\":\"carbon_black_cloud.alert.reason_code\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Reason Codes\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-d49a3710-8d96-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-de59dff0-955a-11ec-96f0-8de26c63c826.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-de59dff0-955a-11ec-96f0-8de26c63c826.json deleted file mode 100755 index 85bf297c56..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-de59dff0-955a-11ec-96f0-8de26c63c826.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset: \\\"carbon_black_cloud.watchlist_hit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Parent Process Usernames", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Parent Process Username\",\"field\":\"carbon_black_cloud.watchlist_hit.process.parent.username\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Parent Process Usernames\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-de59dff0-955a-11ec-96f0-8de26c63c826", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee2098d0-8d70-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee2098d0-8d70-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 2ad0964cbb..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee2098d0-8d70-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.audit\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Request URLs", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"URL\",\"field\":\"url.original\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Request URLs\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-ee2098d0-8d70-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee670e50-8d89-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee670e50-8d89-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index cb945df49b..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee670e50-8d89-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Kill Chain Status", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Kill Chain Status\",\"field\":\"carbon_black_cloud.alert.kill_chain_status\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Kill Chain Status\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-ee670e50-8d89-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee77a260-8d84-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee77a260-8d84-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index fc1c6812f0..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ee77a260-8d84-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Process Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Name\",\"field\":\"process.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Process Name\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-ee77a260-8d84-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f28910d0-9628-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f28910d0-9628-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 3c04444ca9..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f28910d0-9628-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Device External IP", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device External IP\",\"field\":\"carbon_black_cloud.endpoint_event.device.external_ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Device External IP\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-f28910d0-9628-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f3f635b0-8d72-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f3f635b0-8d72-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index a79db35e93..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f3f635b0-8d72-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Alert Type", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Alert Type\",\"field\":\"carbon_black_cloud.alert.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Alert Type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-f3f635b0-8d72-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f75eabb0-8d8b-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f75eabb0-8d8b-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index d3f393c0d5..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f75eabb0-8d8b-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Threat Cause Actor Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Cause Actor Name\",\"field\":\"carbon_black_cloud.alert.threat_cause.actor.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":1,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Threat Cause Actor Name\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-f75eabb0-8d8b-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f7681be0-962e-11ec-864c-3332b2a355f7.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f7681be0-962e-11ec-864c-3332b2a355f7.json deleted file mode 100755 index 84fedf340e..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f7681be0-962e-11ec-864c-3332b2a355f7.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.endpoint_event\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Top 10 Process Username", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Process Username\",\"field\":\"carbon_black_cloud.endpoint_event.process.username\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Carbon Black Cloud] Top 10 Process Username\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-f7681be0-962e-11ec-864c-3332b2a355f7", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f93958c0-8d83-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f93958c0-8d83-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 1c30c4f320..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-f93958c0-8d83-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Policy Applied", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Policy Applied\",\"field\":\"carbon_black_cloud.alert.policy.applied\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Policy Applied\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-f93958c0-8d83-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95.json b/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95.json deleted file mode 100755 index 4a17555983..0000000000 --- a/packages/carbon_black_cloud/1.0.3/kibana/visualization/carbon_black_cloud-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"carbon_black_cloud.alert\\\"\"}}" - }, - "title": "[Carbon Black Cloud] Distribution of Alerts by Target Value", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Target Value\",\"field\":\"carbon_black_cloud.alert.target_value\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"default\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Carbon Black Cloud] Distribution of Alerts by Target Value\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.17.0", - "id": "carbon_black_cloud-ff34eaa0-8d79-11ec-ac12-4bc77fa14e95", - "migrationVersion": { - "visualization": "7.17.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/carbon_black_cloud/1.0.3/manifest.yml b/packages/carbon_black_cloud/1.0.3/manifest.yml deleted file mode 100755 index d37f10abcf..0000000000 --- a/packages/carbon_black_cloud/1.0.3/manifest.yml +++ /dev/null @@ -1,136 +0,0 @@ -format_version: 1.0.0 -name: carbon_black_cloud -title: VMware Carbon Black Cloud -version: 1.0.3 -license: basic -description: Collect logs from VMWare Carbon Black Cloud with Elastic Agent. -type: integration -categories: - - security -release: ga -conditions: - kibana.version: ^7.17.0 || ^8.0.0 -screenshots: - - src: /img/carbon_black_cloud-screenshot.png - title: Carbon Black Cloud alert dashboard screenshot - size: 600x600 - type: image/png -icons: - - src: /img/carbon_black_cloud-logo.svg - title: Carbon Black Cloud logo - size: 32x32 - type: image/svg+xml -policy_templates: - - name: carbon_black_cloud - title: Carbon Black Cloud - description: Collect Logs from Carbon Black Cloud - inputs: - - type: httpjson - title: Collect Carbon Black Cloud logs via API - description: Collect Carbon Black Cloud logs via API - vars: - - name: hostname - type: text - title: Hostname - description: Carbon Black Cloud console Hostname. Find hostname in the console dashboard at the beginning of the web address (Add https:// before the hostname). - required: true - - name: org_key - type: text - title: Organization Key - description: Organization Key. - required: true - - name: custom_api_id - type: text - title: Custom API ID - description: API ID with Custom Access Level type. - required: true - - name: custom_api_secret_key - type: password - title: Custom API Secret Key - description: API Secret Key with Custom Access Level type - required: true - - name: api_id - type: text - title: API ID - description: API ID with API Access Level type. - required: true - - name: api_secret_key - type: password - title: API Secret Key - description: API Secret Key with API Access Level type - required: true - - name: proxy_url - type: text - title: Proxy URL - multi: false - required: false - show_user: false - description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. - - name: ssl - type: yaml - title: SSL Configuration - description: i.e. certificate_authorities, supported_protocols, verification_mode etc. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- - - type: aws-s3 - title: Collect Carbon Black Cloud logs via AWS S3 - description: Collect Carbon Black Cloud logs via AWS S3 - vars: - - name: bucket_arn - type: text - title: Bucket ARN - multi: false - required: true - show_user: true - - name: access_key_id - type: password - title: Access Key ID - multi: false - required: true - show_user: true - - name: secret_access_key - type: password - title: Secret Access Key - multi: false - required: true - show_user: true - - name: number_of_workers - type: integer - title: Number of Workers - multi: false - required: false - show_user: false - default: 5 - description: Number of workers that will process the S3 objects listed. - - name: proxy_url - type: text - title: Proxy URL - multi: false - required: false - show_user: false - description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. -owner: - github: elastic/security-external-integrations diff --git a/packages/cef/2.0.3/changelog.yml b/packages/cef/2.0.3/changelog.yml deleted file mode 100755 index 832135f9ca..0000000000 --- a/packages/cef/2.0.3/changelog.yml +++ /dev/null @@ -1,129 +0,0 @@ -# newer versions go on top -- version: "2.0.3" - changes: - - description: Format source.mac and destination.mac as per ECS. - type: bugfix - link: https://github.com/elastic/integrations/pull/3566 -- version: "2.0.2" - changes: - - description: Improve field documentation - type: enhancement - link: https://github.com/elastic/integrations/pull/3465 -- version: "2.0.1" - changes: - - description: Clarify scope of dashboards - type: bugfix - link: https://github.com/elastic/integrations/pull/3470 -- version: "2.0.0" - changes: - - description: Migrate map visualisation from tile_map to map object - type: enhancement - link: https://github.com/elastic/integrations/pull/3263 -- version: "1.5.0" - changes: - - description: Update to ECS 8.2 by modifying Check Point events to use the new email field set. - type: enhancement - link: https://github.com/elastic/integrations/pull/2804 -- version: "1.4.3" - changes: - - description: Add documentation for multi-fields - type: enhancement - link: https://github.com/elastic/integrations/pull/2916 -- version: "1.4.2" - changes: - - description: Add field mappings for several `event.*` fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/2808 -- version: "1.4.1" - changes: - - description: Append pipeline errors to error.message instead of overwriting existing errors. - type: bugfix - link: https://github.com/elastic/integrations/pull/2789 -- version: "1.4.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2386 -- version: "1.3.1" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.3.0" - changes: - - description: Change test IPs to the supported set for GeoIP - type: enhancement - link: https://github.com/elastic/integrations/pull/2216 - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2216 -- version: "1.2.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1950 -- version: "1.2.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1802 -- version: "1.2.0" - changes: - - description: Add CEF time zone config option. - type: enhancement - link: https://github.com/elastic/integrations/pull/1723 -- version: "1.1.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1652 -- version: "1.0.0" - changes: - - description: make GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1604 -- version: "0.5.2" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1469 -- version: '0.5.1' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1375 -- version: "0.5.0" - changes: - - description: Update documentation to fit mdx spec - type: enhancement - link: https://github.com/elastic/integrations/pull/1401 -- version: "0.4.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.3.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1255 -- version: "0.2.0" - changes: - - description: update to ECS 1.10.0 and adding event.original options. - type: enhancement - link: https://github.com/elastic/integrations/pull/1032 -- version: "0.1.0" - changes: - - description: Change syslog input to udp input. Add syslog timestamp parsing to Ingest Node pipeline. - type: enhancement - link: https://github.com/elastic/integrations/pull/898 -- version: "0.0.4" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/838 -- version: "0.0.1" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/418 diff --git a/packages/cef/2.0.3/data_stream/log/agent/stream/log.yml.hbs b/packages/cef/2.0.3/data_stream/log/agent/stream/log.yml.hbs deleted file mode 100755 index c9f24092e8..0000000000 --- a/packages/cef/2.0.3/data_stream/log/agent/stream/log.yml.hbs +++ /dev/null @@ -1,27 +0,0 @@ -paths: - {{#each paths as |path i|}} -- {{path}} - {{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- rename: - fields: - - {from: "message", to: "event.original"} -- decode_cef: - field: event.original -{{#if decode_cef_timezone}} - timezone: {{ decode_cef_timezone }} -{{/if}} -{{#if processors}} -{{processors}} -{{/if}} diff --git a/packages/cef/2.0.3/data_stream/log/agent/stream/udp.yml.hbs b/packages/cef/2.0.3/data_stream/log/agent/stream/udp.yml.hbs deleted file mode 100755 index 4d71aa0234..0000000000 --- a/packages/cef/2.0.3/data_stream/log/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,23 +0,0 @@ -host: "{{syslog_host}}:{{syslog_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- rename: - fields: - - {from: "message", to: "event.original"} -- decode_cef: - field: event.original -{{#if decode_cef_timezone}} - timezone: {{ decode_cef_timezone }} -{{/if}} -{{#if processors}} -{{processors}} -{{/if}} \ No newline at end of file diff --git a/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/cp-pipeline.yml b/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/cp-pipeline.yml deleted file mode 100755 index 8a53e9b0c7..0000000000 --- a/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/cp-pipeline.yml +++ /dev/null @@ -1,380 +0,0 @@ ---- -description: Pipeline for Check Point CEF - -processors: - # This script is mapping CEF extensions to ECS when possible. Otherwise - # it maps them to fields under the `checkpoint` group using Check Point log - # field names. - # - # [1] Description of Check Point CEF extensions: - # https://community.checkpoint.com/t5/Logging-and-Reporting/Log-Exporter-CEF-Field-Mappings/td-p/41060 - # [2] Description of Check Point log field names (sk144192): - # https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192 - # - # Note that in some cases the CEF extension name doesn't accurately describe - # its contents. For example sntdom/sourceNtDomain, which is used to store - # Check Point's domain_name, documented as "Domain name sent to DNS request". - # - # This script processes the `params.extensions` list below. This list consists - # of two different kinds of mappings, the simpler has a source ext `name` - # and a `to` field. It copies the given extension field to the target `to`. - # - # When the `labels` dict is defined, the target field depends on the value of - # the accompanying label field. For example, the field deviceCustomIPv6Address2 - # is mapped to `source.ip` only when the extension deviceCustomIPv6Address2Label - # exists and its value is "Source IPv6 Address". - # - # Also it can convert the destination value by simple mapping when the - # convert key exists. Values without an entry in the convert dict are not - # copied and the target field remains unset. - # - # The output of this processor is a single field, `_tmp_copy`, that contains - # a list of actions `{"to": "target_field", "value":"field value"}` that is - # later executed using a foreach processor. This is done to avoid complex - # de-dotting and other gotchas of setting arbitrary fields in Painless. - - script: - lang: painless - params: - extensions: - - name: cp_app_risk - to: checkpoint.app_risk - - - name: cp_app_risk - to: event.risk_score - # This mapping is a mix of [1] and [2] above. - convert: - unknown: 0 - informational: 0 - very-low: 1 - low: 2 - medium: 3 - high: 4 - very-high: 5 - critical: 5 - - - name: cp_severity - to: checkpoint.severity - - - name: cp_severity - to: event.severity - convert: - # This mapping is a mix of [1] and [2] above. - unknown: 0 - informational: 0 - very-low: 1 - low: 1 - medium: 2 - high: 3 - very-high: 4 - critical: 4 - - # Number of events associated with the log - - name: baseEventCount - to: checkpoint.event_count - - # Log type - - name: deviceExternalId - to: observer.type - - # Product Family (override deviceExternalId if present). - - name: deviceFacility - to: observer.type - convert: - '0': Network - '1': Endpoint - '2': Access - '3': Threat - '4': Mobile - - # Gateway interface, where the connection is received from in case of an outbound connection - - name: deviceInboundInterface - to: observer.ingress.interface.name - - # Gateway interface, where the connection is sent from, in case of an inbound connection - - name: deviceOutboundInterface - to: observer.egress.interface.name - - - name: externalId - to: checkpoint.uuid - - - name: fileHash - to: checkpoint.file_hash - - - name: reason - to: checkpoint.termination_reason - - # Possibly an IKE cookie - - name: requestCookies - to: checkpoint.cookie - - # Probably a typo in CP's CEF docs - - name: checkrequestCookies - to: checkpoint.cookie - - # Domain name sent to DNS request - - name: sourceNtDomain - to: dns.question.name - - # CVE registry entry - - name: Signature - to: vulnerability.id - - - name: Recipient - to: destination.user.email - - - name: Sender - to: source.user.email - - - name: deviceCustomFloatingPoint1 - labels: - update version: observer.version - - - name: deviceCustomIPv6Address2 - labels: - source ipv6 address: source.ip - - - name: deviceCustomIPv6Address3 - labels: - destination ipv6 address: destination.ip - - - name: deviceCustomNumber1 - labels: - payload: network.bytes - elapsed time in seconds: event.duration - email recipients number: checkpoint.email_recipients_num - - - name: deviceCustomNumber2 - labels: - duration in seconds: event.duration - icmp type: checkpoint.icmp_type - - - name: deviceCustomNumber3 - labels: - icmp code: checkpoint.icmp_code - - - name: deviceCustomString1 - labels: - application rule name: rule.name - dlp rule name: rule.name - threat prevention rule name: rule.name - connectivity state: checkpoint.connectivity_state - email id: checkpoint.email_id - voip log type: checkpoint.voip_log_type - - - name: deviceCustomString2 - labels: - # Protection malware id - protection id: checkpoint.protection_id - update status: checkpoint.update_status - email subject: checkpoint.email_subject - sensor mode: checkpoint.sensor_mode - scan invoke type: checkpoint.integrity_av_invoke_type - category: checkpoint.category - # Matched categories - categories: rule.category - peer gateway: checkpoint.peer_gateway - - - name: deviceCustomString6 - labels: - application name: network.application - virus name: checkpoint.virus_name - malware name: checkpoint.spyware_name - malware family: checkpoint.malware_family - - - name: deviceCustomString3 - labels: - user group: group.name - # Format of original data. - incident extension: checkpoint.incident_extension - identity type: checkpoint.identity_type - email spool id: checkpoint.email_spool_id - # Type of protection used to detect the attack - protection type: checkpoint.protection_type - - - name: deviceCustomString4 - labels: - malware status: checkpoint.spyware_status - destination os: os.name - scan result: checkpoint.scan_result - frequency: checkpoint.frequency - protection name: checkpoint.protection_name - user response: checkpoint.user_status - email control: checkpoint.email_control - tcp flags: checkpoint.tcp_flags - threat prevention rule id: rule.id - - - name: deviceCustomString5 - labels: - matched category: rule.category - authentication method: checkpoint.auth_method - email session id: checkpoint.email_session_id - vlan id: network.vlan.id - - - name: deviceCustomDate2 - labels: - subscription expiration: checkpoint.subs_exp - - - name: deviceFlexNumber1 - labels: - confidence: checkpoint.confidence_level - - - name: deviceFlexNumber2 - labels: - destination phone number: checkpoint.dst_phone_number - performance impact: checkpoint.performance_impact - - - name: flexString1 - labels: - application signature id: checkpoint.app_sig_id - - - name: flexString2 - labels: - malware action: rule.description - attack information: event.action - - - name: rule_uid - to: rule.uuid - - - name: ifname - to: observer.ingress.interface.name - - - name: inzone - to: observer.ingress.zone - - - name: outzone - to: observer.egress.zone - - - name: product - to: observer.product - - source: | - def actions = new ArrayList(); - def exts = ctx.cef?.extensions; - if (exts == null) return; - for (entry in params.extensions) { - def value = exts[entry.name]; - if (value == null || - (entry.convert != null && - (value=entry.convert[value.toLowerCase()]) == null)) - continue; - if (entry.to != null) { - actions.add([ - "value": value, - "to": entry.to - ]); - continue; - } - def label = exts[entry.name + "Label"]; - if (label == null) continue; - def dest = entry.labels[label.toLowerCase()]; - if (dest == null) continue; - actions.add([ - "value": value, - "to": dest - ]); - } - ctx["_tmp_copy"] = actions; - - - foreach: - field: _tmp_copy - processor: - set: - field: "{{_ingest._value.to}}" - value: "{{_ingest._value.value}}" - - - remove: - field: _tmp_copy - - - set: - field: email.to.address - value: ["{{{destination.user.email}}}"] - if: "ctx?.destination?.user?.email != null" - - set: - field: email.from.address - value: ["{{{source.user.email}}}"] - if: "ctx?.source?.user?.email != null" - - set: - field: email.subject - copy_from: checkpoint.email_subject - if: "ctx?.checkpoint?.email_subject != null" - - set: - field: email.message_id - copy_from: checkpoint.email_session_id - if: "ctx?.checkpoint?.email_session_id != null" - - convert: - field: event.risk_score - type: float - ignore_missing: true - on_failure: - - remove: - field: event.risk_score - - convert: - field: event.severity - type: long - ignore_missing: true - on_failure: - - remove: - field: event.severity - - # event.duration is a string and contains seconds. Convert to long nanos. - - script: - params: - second_to_nanos: 1000000000 - lang: painless - source: | - def duration = ctx.event?.duration; - if (duration == null) return; - ctx.event.duration = Long.parseLong(duration) * params.second_to_nanos; - on_failure: - - remove: - field: event.duration - ignore_missing: true - - # checkpoint.file_hash can be either MD5, SHA1 or SHA256. - - rename: - field: checkpoint.file_hash - target_field: file.hash.md5 - if: 'ctx.checkpoint?.file_hash != null && ctx.checkpoint.file_hash.length()==32' - - rename: - field: checkpoint.file_hash - target_field: file.hash.sha1 - if: 'ctx.checkpoint?.file_hash != null && ctx.checkpoint.file_hash.length()==40' - - rename: - field: checkpoint.file_hash - target_field: file.hash.sha256 - if: 'ctx.checkpoint?.file_hash != null && ctx.checkpoint.file_hash.length()==64' - - # Event kind is 'event' by default. 'alert' when a risk score and rule info - # is present. - - set: - field: event.kind - value: event - - set: - field: event.kind - value: alert - if: 'ctx.cef?.extensions?.cp_app_risk != null && ctx.rule != null' - - # Set event.category to network/malware/intrusion_detection depending on which - # fields have been populated. - - set: - field: event.category - value: network - if: 'ctx.source?.ip != null && ctx.destination?.ip != null' - - set: - field: event.category - value: malware - if: 'ctx.checkpoint?.protection_id != null || ctx.checkpoint?.spyware_name != null || ctx.checkpoint?.malware_family != null || ctx.checkpoint?.spyware_status != null' - - set: - field: event.category - value: intrusion_detection - if: 'ctx.event?.category != "malware" && (ctx.checkpoint?.protection_type != null || ctx.cef.extensions?.flexString2Label == "Attack Information")' - - - convert: - field: checkpoint.event_count - type: long - ignore_missing: true - - convert: - field: cef.extensions.baseEventCount - type: long - ignore_missing: true - diff --git a/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index ab067960c5..0000000000 --- a/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,177 +0,0 @@ ---- -description: Pipeline for CEF logs. CEF decoding happens in the Agent. This performs additional enrichment and vendor specific transformations. - -processors: - - set: - field: ecs.version - value: '8.2.0' - - - convert: - field: event.id - type: string - ignore_missing: true - - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - append: - field: related.hash - value: "{{cef.extensions.fileHash}}" - allow_duplicates: false - if: "ctx?.cef?.extensions?.fileHash != null && ctx?.cef?.extensions?.fileHash != ''" - - append: - field: related.hash - value: "{{cef.extensions.oldFileHash}}" - allow_duplicates: false - if: "ctx?.cef?.extensions?.oldFileHash != null && ctx?.cef?.extensions?.oldFileHash != ''" - - append: - field: related.ip - value: "{{destination.ip}}" - allow_duplicates: false - if: "ctx?.destination?.ip != null && ctx?.destination?.ip != ''" - - append: - field: related.ip - value: "{{destination.nat.ip}}" - allow_duplicates: false - if: "ctx?.destination?.nat?.ip != null && ctx?.destination?.nat?.ip != ''" - - append: - field: related.ip - value: "{{source.ip}}" - allow_duplicates: false - if: "ctx?.source?.ip != null && ctx?.source?.ip != ''" - - append: - field: related.ip - value: "{{source.nat.ip}}" - allow_duplicates: false - if: "ctx?.source?.nat?.ip != null && ctx?.source?.nat?.ip != ''" - - append: - field: related.user - value: "{{destination.user.name}}" - if: "ctx?.destination?.user?.name != null" - - append: - field: related.user - value: "{{source.user.name}}" - allow_duplicates: false - if: "ctx?.source?.user?.name != null && ctx?.source?.user?.name != ''" - - append: - field: related.hosts - value: "{{observer.hostname}}" - allow_duplicates: false - if: "ctx?.observer?.hostname != null && ctx?.observer?.hostname != ''" - - pipeline: - name: '{{ IngestPipeline "fp-pipeline" }}' - if: "ctx.cef?.device?.vendor == 'FORCEPOINT'" - - pipeline: - name: '{{ IngestPipeline "cp-pipeline" }}' - if: "ctx.cef?.device?.vendor == 'Check Point'" - - community_id: {} - - # Ensure source.mac and destination.mac are formatted to ECS specifications. - - gsub: - field: destination.mac - ignore_missing: true - pattern: '[:.]' - replacement: '-' - - gsub: - field: source.mac - ignore_missing: true - pattern: '[:.]' - replacement: '-' - - uppercase: - field: destination.mac - ignore_missing: true - - uppercase: - field: source.mac - ignore_missing: true - - # - # Timestamp parsing. - # - - grok: - # decode_cef sets @timestamp when deviceReceiptTime is provided. - description: Extract timestamp from log header when deviceReceiptTime not given. - if: ctx?.cef?.extensions?.deviceReceiptTime == null - field: event.original - patterns: - - '^%{SYSLOG_TIMESTAMP} ' - - '^%{ECS_SYSLOG_PRI}%{SYSLOG_TIMESTAMP} ' # RFC3164 - - '^%{ECS_SYSLOG_PRI}%{NONNEGINT} %{SYSLOG_TIMESTAMP} ' # RFC5224 - pattern_definitions: - ECS_SYSLOG_PRI: '<%{NONNEGINT:log.syslog.priority:long}>' - SYSLOG_TIMESTAMP: '(?:%{SYSLOGTIMESTAMP:_tmp.timestamp}|%{TIMESTAMP_ISO8601:_tmp.timestamp8601})' - ignore_failure: true - - date: - if: ctx?._tmp?.timestamp8601 != null - field: _tmp.timestamp8601 - formats: - - ISO8601 - - date: - if: ctx?._tmp?.timestamp != null - field: _tmp.timestamp - formats: - - MMM d HH:mm:ss - - MMM dd HH:mm:ss - - remove: - field: - - _tmp - ignore_failure: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true - - # Cleanup - - remove: - field: - - cef.extensions._cefVer - ignore_missing: true - -on_failure: - - remove: - field: - - _tmp - ignore_failure: true - - append: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/fp-pipeline.yml b/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/fp-pipeline.yml deleted file mode 100755 index f87d217328..0000000000 --- a/packages/cef/2.0.3/data_stream/log/elasticsearch/ingest_pipeline/fp-pipeline.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -description: Pipeline for Forcepoint CEF - -processors: - # cs1 is ruleID - - set: - field: rule.id - value: "{{cef.extensions.deviceCustomString1}}" - ignore_empty_value: true - - # cs2 is natRuleID - - set: - field: rule.id - value: "{{cef.extensions.deviceCustomString2}}" - ignore_empty_value: true - - # cs3 is VulnerabilityReference - - set: - field: vulnerability.reference - value: "{{cef.extensions.deviceCustomString3}}" - ignore_empty_value: true - - # cs4 is virusID - - set: - field: cef.forcepoint.virus_id - value: "{{cef.extensions.deviceCustomString4}}" - ignore_empty_value: true diff --git a/packages/cef/2.0.3/data_stream/log/fields/agent.yml b/packages/cef/2.0.3/data_stream/log/fields/agent.yml deleted file mode 100755 index d03a5f0211..0000000000 --- a/packages/cef/2.0.3/data_stream/log/fields/agent.yml +++ /dev/null @@ -1,207 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/cef/2.0.3/data_stream/log/fields/base-fields.yml b/packages/cef/2.0.3/data_stream/log/fields/base-fields.yml deleted file mode 100755 index 88e15e9046..0000000000 --- a/packages/cef/2.0.3/data_stream/log/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: cef -- name: event.dataset - type: constant_keyword - description: Event dataset - value: cef.log -- name: '@timestamp' - type: date - description: Event timestamp. diff --git a/packages/cef/2.0.3/data_stream/log/fields/ecs.yml b/packages/cef/2.0.3/data_stream/log/fields/ecs.yml deleted file mode 100755 index a2802bca93..0000000000 --- a/packages/cef/2.0.3/data_stream/log/fields/ecs.yml +++ /dev/null @@ -1,380 +0,0 @@ -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - MAC address of the destination. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: destination.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: Unique identifier for the group on the system/platform. - name: destination.user.group.id - type: keyword -- description: Name of the group. - name: destination.user.group.name - type: keyword -- description: Unique identifier of the user. - name: destination.user.id - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: destination.user.name - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: The email address of the sender, typically from the RFC 5322 `From:` header field. - name: email.from.address - type: keyword -- description: The email address of recipient - name: email.to.address - type: keyword -- description: A brief summary of the topic of the message. - multi_fields: - - name: text - type: match_only_text - name: email.subject - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: Primary group name of the file. - name: file.group - type: keyword -- description: MD5 hash. - name: file.hash.md5 - type: keyword -- description: SHA1 hash. - name: file.hash.sha1 - type: keyword -- description: Inode representing the file in the filesystem. - name: file.inode - type: keyword -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - multi_fields: - - name: text - type: match_only_text - name: file.path - type: keyword -- description: |- - File size in bytes. - Only relevant when `file.type` is "file". - name: file.size - type: long -- description: File type (file, dir, or symlink). - name: file.type - type: keyword -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. - name: observer.egress.zone - type: keyword -- description: Hostname of the observer. - name: observer.hostname - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. - name: observer.ingress.zone - type: keyword -- description: IP addresses of the observer. - name: observer.ip - type: ip -- description: The product name of the observer. - name: observer.product - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - multi_fields: - - name: text - type: match_only_text - name: process.name - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: A categorization value keyword used by the entity using the rule for detection of this event. - name: rule.category - type: keyword -- description: A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. - name: rule.id - type: keyword -- description: A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. - name: rule.uuid - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - MAC address of the source. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: source.mac - type: keyword -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Port of the source. - name: source.port - type: long -- description: Unique identifier for the group on the system/platform. - name: source.user.group.id - type: keyword -- description: Name of the group. - name: source.user.group.name - type: keyword -- description: Unique identifier of the user. - name: source.user.id - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: source.user.name - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - multi_fields: - - name: text - type: match_only_text - name: url.original - type: wildcard -- description: Unparsed user_agent string. - multi_fields: - - name: text - type: match_only_text - name: user_agent.original - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. - `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. - This field is an array. This will allow proper categorization of some events that fall in multiple categories. - name: event.category - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: |- - Duration of the event in nanoseconds. - If event.start and event.end are known this value should be the difference between the end and start time. - name: event.duration - type: long -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: Risk score or priority of the event (e.g. security solutions). Use your system's original value here. - name: event.risk_score - type: float -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long diff --git a/packages/cef/2.0.3/data_stream/log/fields/fields.yml b/packages/cef/2.0.3/data_stream/log/fields/fields.yml deleted file mode 100755 index c667ec5df0..0000000000 --- a/packages/cef/2.0.3/data_stream/log/fields/fields.yml +++ /dev/null @@ -1,608 +0,0 @@ -- name: cef.name - type: keyword -- name: cef.severity - type: keyword -- name: cef.version - type: keyword -- name: destination.service.name - type: keyword -- name: source.service.name - type: keyword -- name: cef.forcepoint - type: group - fields: - - name: virus_id - type: keyword - description: | - Virus ID -- name: checkpoint - type: group - fields: - - name: app_risk - type: keyword - description: Application risk. - - name: app_severity - type: keyword - description: Application threat severity. - - name: app_sig_id - type: keyword - description: The signature ID which the application was detected by. - - name: auth_method - type: keyword - description: Password authentication protocol used. - - name: category - type: keyword - description: Category. - - name: confidence_level - type: integer - description: Confidence level determined. - - name: connectivity_state - type: keyword - description: Connectivity state. - - name: cookie - type: keyword - description: IKE cookie. - - name: dst_phone_number - type: keyword - description: Destination IP-Phone. - - name: email_control - type: keyword - description: Engine name. - - name: email_id - type: keyword - description: Internal email ID. - - name: email_recipients_num - type: long - description: Number of recipients. - - name: email_session_id - type: keyword - description: Internal email session ID. - - name: email_spool_id - type: keyword - description: Internal email spool ID. - - name: email_subject - type: keyword - description: Email subject. - - name: event_count - type: long - description: Number of events associated with the log. - - name: frequency - type: keyword - description: Scan frequency. - - name: icmp_type - type: long - description: ICMP type. - - name: icmp_code - type: long - description: ICMP code. - - name: identity_type - type: keyword - description: Identity type. - - name: incident_extension - type: keyword - description: Format of original data. - - name: integrity_av_invoke_type - type: keyword - description: Scan invoke type. - - name: malware_family - type: keyword - description: Malware family. - - name: peer_gateway - type: ip - description: Main IP of the peer Security Gateway. - - name: performance_impact - type: integer - description: Protection performance impact. - - name: protection_id - type: keyword - description: Protection malware ID. - - name: protection_name - type: keyword - description: Specific signature name of the attack. - - name: protection_type - type: keyword - description: Type of protection used to detect the attack. - - name: scan_result - type: keyword - description: Scan result. - - name: sensor_mode - type: keyword - description: Sensor mode. - - name: severity - type: keyword - description: Threat severity. - - name: spyware_name - type: keyword - description: Spyware name. - - name: spyware_status - type: keyword - description: Spyware status. - - name: subs_exp - type: date - description: The expiration date of the subscription. - - name: tcp_flags - type: keyword - description: TCP packet flags. - - name: termination_reason - type: keyword - description: Termination reason. - - name: update_status - type: keyword - description: Update status. - - name: user_status - type: keyword - description: User response. - - name: uuid - type: keyword - description: External ID. - - name: virus_name - type: keyword - description: Virus name. - - name: voip_log_type - type: keyword - description: VoIP log types. -- name: cef.device - type: group - fields: - - name: event_class_id - type: keyword - description: Unique identifier of the event type. - - name: product - type: keyword - description: Product of the device that produced the message. - - name: vendor - type: keyword - description: Vendor of the device that produced the message. - - name: version - type: keyword - description: Version of the product that produced the message. -- name: cef.extensions - type: group - fields: - - name: agentAddress - type: ip - description: The IP address of the ArcSight connector that processed the event. - - name: agentHostName - type: keyword - description: The hostname of the ArcSight connector that processed the event. - - name: agentId - type: keyword - description: The agent ID of the ArcSight connector that processed the event. - - name: agentReceiptTime - type: date - description: The time at which information about the event was received by the ArcSight connector. - - name: agentTimeZone - type: keyword - description: The agent time zone of the ArcSight connector that processed the event. - - name: agentType - type: keyword - description: The agent type of the ArcSight connector that processed the event. - - name: destinationHostName - type: keyword - description: Identifies the destination that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the destination node, when a node is available. - - name: deviceTimeZone - type: keyword - description: The time zone for the device generating the event. - - name: requestUrlFileName - type: keyword - - name: startTime - type: date - description: The time when the activity the event referred to started. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970). - - name: type - type: long - description: 0 means base event, 1 means aggregated, 2 means correlation, and 3 means action. This field can be omitted for base events (type 0). - - name: agentVersion - type: keyword - description: The version of the ArcSight connector that processed the event. - - name: agentZoneURI - type: keyword - - name: deviceSeverity - type: keyword - - name: deviceZoneURI - type: keyword - description: Thee URI for the Zone that the device asset has been assigned to in ArcSight. - - name: fileType - type: keyword - description: Type of file (pipe, socket, etc.) - - name: filename - type: keyword - description: Name of the file only (without its path). - - name: managerReceiptTime - type: date - description: When the Arcsight ESM received the event. - - name: agentMacAddress - type: keyword - description: The MAC address of the ArcSight connector that processed the event. - - name: deviceProcessName - type: keyword - description: Process name associated with the event. An example might be the process generating the syslog entry in UNIX. - - name: baseEventCount - type: long - description: A count associated with this event. How many times was this same event observed? Count can be omitted if it is 1. - - name: dvc - type: ip - description: This field is used by Trend Micro if the hostname is an IPv4 address. - - name: dvchost - type: keyword - description: This field is used by Trend Micro for hostnames and IPv6 addresses. - - name: cp_app_risk - type: keyword - - name: cp_severity - type: keyword - - name: ifname - type: keyword - - name: inzone - type: keyword - - name: layer_uuid - type: keyword - - name: layer_name - type: keyword - - name: logid - type: keyword - - name: loguid - type: keyword - - name: match_id - type: keyword - - name: nat_addtnl_rulenum - type: keyword - - name: nat_rulenum - type: keyword - - name: origin - type: keyword - - name: originsicname - type: keyword - - name: outzone - type: keyword - - name: parent_rule - type: keyword - - name: product - type: keyword - - name: rule_action - type: keyword - - name: rule_uid - type: keyword - - name: sequencenum - type: keyword - - name: service_id - type: keyword - - name: version - type: keyword - - name: applicationProtocol - type: keyword - description: Application level protocol, example values are HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on. - - name: categoryDeviceGroup - type: keyword - description: General device group like Firewall (ArcSight). - - name: categoryTechnique - type: keyword - description: Technique being used (e.g. /DoS) (ArcSight). - - name: deviceEventCategory - type: keyword - description: Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. Example "/Monitor/Disk/Read". - - name: sourceNtDomain - type: keyword - description: The Windows domain name for the source address. - - name: destinationNtDomain - type: keyword - description: Outcome of the event (e.g. sucess, failure, or attempt) (ArcSight). - - name: categoryOutcome - type: keyword - description: Outcome of the event (e.g. sucess, failure, or attempt) (ArcSight). - - name: categorySignificance - type: keyword - description: Characterization of the importance of the event (ArcSight). - - name: categoryObject - type: keyword - description: Object that the event is about. For example it can be an operating sytem, database, file, etc (ArcSight). - - name: categoryBehavior - type: keyword - description: Action or a behavior associated with an event. It's what is being done to the object (ArcSight). - - name: categoryDeviceType - type: keyword - description: Device type. Examples - Proxy, IDS, Web Server (ArcSight). - - name: baseEventCount - type: keyword - description: A count associated with this event. How many times was this same event observed? Count can be omitted if it is 1. - - name: bytesIn - type: long - description: Number of bytes transferred inbound, relative to the source to destination relationship, meaning that data was flowing from source to destination. - - name: bytesOut - type: long - description: Number of bytes transferred outbound relative to the source to destination relationship. For example, the byte number of data flowing from the destination to the source. - - name: destinationAddress - type: ip - description: Identifies the destination address that the event refers to in an IP network. The format is an IPv4 address. - - name: destinationPort - type: long - description: The valid port numbers are between 0 and 65535. - - name: destinationServiceName - type: keyword - description: The service targeted by this event. - - name: destinationTranslatedAddress - type: ip - description: Identifies the translated destination that the event refers to in an IP network. - - name: destinationTranslatedPort - type: long - description: Port after it was translated; for example, a firewall. Valid port numbers are 0 to 65535. - - name: destinationUserName - type: keyword - description: Identifies the destination user by name. This is the user associated with the event's destination. Email addresses are often mapped into the UserName fields. The recipient is a candidate to put into this field. - - name: destinationUserPrivileges - type: keyword - description: The typical values are "Administrator", "User", and "Guest". This identifies the destination user's privileges. In UNIX, for example, activity executed on the root user would be identified with destinationUser Privileges of "Administrator". - - name: deviceAction - type: keyword - description: Action taken by the device. - - name: deviceAddress - type: ip - description: Identifies the device address that an event refers to in an IP network. - - name: deviceCustomDate2 - type: keyword - description: One of two timestamp fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomDate2Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomIPv6Address2 - type: ip - description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomIPv6Address2Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomIPv6Address3 - type: ip - description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomIPv6Address3Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomNumber1 - type: long - description: One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomNumber1Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomNumber2 - type: long - description: One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomNumber2Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomNumber3 - type: long - description: One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomNumber3Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomString1 - type: keyword - description: One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomString1Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomString2 - type: keyword - description: One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomString2Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomString3 - type: keyword - description: One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomString3Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomString4 - type: keyword - description: One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomString4Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomString5 - type: keyword - description: One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomString5Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomString6 - type: keyword - description: One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. - - name: deviceCustomString6Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceDirection - type: long - description: Any information about what direction the observed communication has taken. The following values are supported - "0" for inbound or "1" for outbound. - - name: deviceExternalId - type: keyword - description: A name that uniquely identifies the device generating this event. - - name: deviceFacility - type: keyword - description: The facility generating this event. For example, Syslog has an explicit facility associated with every event. - - name: deviceHostName - type: keyword - description: The format should be a fully qualified domain name (FQDN) associated with the device node, when a node is available. - - name: deviceOutboundInterface - type: keyword - description: Interface on which the packet or data left the device. - - name: deviceReceiptTime - type: keyword - description: The time at which the event related to the activity was received. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970) - - name: eventId - type: long - description: This is a unique ID that ArcSight assigns to each event. - - name: fileHash - type: keyword - description: Hash of a file. - - name: message - type: keyword - description: An arbitrary message giving more details about the event. Multi-line entries can be produced by using \n as the new line separator. - - name: oldFileHash - type: keyword - description: Hash of the old file. - - name: requestContext - type: keyword - description: Description of the content from which the request originated (for example, HTTP Referrer). - - name: requestMethod - type: keyword - description: The HTTP method used to access a URL. - - name: requestUrl - type: keyword - description: In the case of an HTTP request, this field contains the URL accessed. The URL should contain the protocol as well. - - name: method - type: keyword - description: HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - - name: sourceAddress - type: ip - description: Identifies the source that an event refers to in an IP network. - - name: sourceGeoLatitude - type: long - - name: sourceGeoLongitude - type: long - - name: sourcePort - type: long - description: The valid port numbers are 0 to 65535. - - name: sourceServiceName - type: keyword - description: The service that is responsible for generating this event. - - name: sourceTranslatedAddress - type: ip - description: Identifies the translated source that the event refers to in an IP network. - - name: sourceTranslatedPort - type: long - description: A port number after being translated by, for example, a firewall. Valid port numbers are 0 to 65535. - - name: sourceUserName - type: keyword - description: Identifies the source user by name. Email addresses are also mapped into the UserName fields. The sender is a candidate to put into this field. - - name: sourceUserPrivileges - type: keyword - description: The typical values are "Administrator", "User", and "Guest". It identifies the source user's privileges. In UNIX, for example, activity executed by the root user would be identified with "Administrator". - - name: transportProtocol - type: keyword - description: Identifies the Layer-4 protocol used. The possible values are protocols such as TCP or UDP. - - name: ad - type: flattened - - name: TrendMicroDsDetectionConfidence - type: keyword - - name: TrendMicroDsFileMD5 - type: keyword - - name: TrendMicroDsFileSHA1 - type: keyword - - name: TrendMicroDsFileSHA256 - type: keyword - - name: TrendMicroDsFrameType - type: keyword - - name: TrendMicroDsMalwareTarget - type: keyword - - name: TrendMicroDsMalwareTargetType - type: keyword - - name: TrendMicroDsPacketData - type: keyword - - name: TrendMicroDsRelevantDetectionNames - type: keyword - - name: TrendMicroDsTenant - type: keyword - - name: TrendMicroDsTenantId - type: keyword - - name: assetCriticality - type: keyword - - name: deviceAssetId - type: keyword - - name: deviceCustomIPv6Address1 - type: ip - description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomIPv6Address1Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomIPv6Address2 - type: ip - description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomIPv6Address2Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomIPv6Address3 - type: ip - description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomIPv6Address3Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceCustomIPv6Address4 - type: ip - description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. - - name: deviceCustomIPv6Address4Label - type: keyword - description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. - - name: deviceInboundInterface - type: keyword - description: Interface on which the packet or data entered the device. - - name: deviceZoneID - type: keyword - - name: eventAnnotationAuditTrail - type: keyword - - name: eventAnnotationEndTime - type: date - - name: eventAnnotationFlags - type: keyword - - name: eventAnnotationManagerReceiptTime - type: date - - name: eventAnnotationModificationTime - type: date - - name: eventAnnotationStageUpdateTime - type: date - - name: eventAnnotationVersion - type: keyword - - name: locality - type: keyword - - name: modelConfidence - type: keyword - - name: originalAgentAddress - type: keyword - - name: originalAgentHostName - type: keyword - - name: originalAgentId - type: keyword - - name: originalAgentType - type: keyword - - name: originalAgentVersion - type: keyword - - name: originalAgentZoneURI - type: keyword - - name: priority - type: keyword - - name: relevance - type: keyword - - name: severity - type: keyword - - name: sourceTranslatedZoneID - type: keyword - - name: sourceTranslatedZoneURI - type: keyword - description: The URI for the Translated Zone that the destination asset has been assigned to in ArcSight. - - name: sourceZoneID - type: keyword - description: Identifies the source user by ID. This is the user associated with the source of the event. For example, in UNIX, the root user is generally associated with user ID 0. - - name: sourceZoneURI - type: keyword - description: The URI for the Zone that the source asset has been assigned to in ArcSight. - - name: aggregationType - type: keyword - - name: destinationMacAddress - type: keyword - description: Six colon-separated hexadecimal numbers. - - name: filePath - type: keyword - description: Full path to the file, including file name itself. - - name: fileSize - type: long - description: Size of the file. - - name: repeatCount - type: keyword - - name: sourceHostName - type: keyword - description: Identifies the source that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the source node, when a mode is available. - - name: sourceMacAddress - type: keyword - description: Six colon-separated hexadecimal numbers. - - name: sourceUserId - type: keyword - description: Identifies the source user by ID. This is the user associated with the source of the event. For example, in UNIX, the root user is generally associated with user ID 0. - - name: target - type: keyword diff --git a/packages/cef/2.0.3/data_stream/log/manifest.yml b/packages/cef/2.0.3/data_stream/log/manifest.yml deleted file mode 100755 index 8383dac3ad..0000000000 --- a/packages/cef/2.0.3/data_stream/log/manifest.yml +++ /dev/null @@ -1,104 +0,0 @@ -type: logs -title: CEF log logs -streams: - - input: logfile - template_path: log.yml.hbs - title: CEF logs - description: Collect CEF logs using log input - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/cef.log - - name: decode_cef_timezone - type: text - title: CEF Timezone - multi: false - required: false - show_user: false - description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting timestamps without a time zone in the CEF message. - - name: tags - type: text - title: Tags - description: A list of tags to include in events. Including `forwarded` indicates that the events did not originate on this host and causes `host.name` to not be added to events. - multi: true - required: true - show_user: false - default: - - cef - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: udp - template_path: udp.yml.hbs - title: CEF logs - description: Collect CEF logs using udp input - vars: - - name: syslog_host - type: text - title: Syslog Host - description: The interface to listen to UDP based syslog traffic. Set to `0.0.0.0` to bind to all available interfaces. - multi: false - required: true - show_user: true - default: localhost - - name: syslog_port - type: integer - title: Syslog Port - description: The UDP port to listen for syslog traffic. - multi: false - required: true - show_user: true - default: 9003 - - name: decode_cef_timezone - type: text - title: CEF Timezone - multi: false - required: false - show_user: false - description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting timestamps without a time zone in the CEF message. - - name: tags - type: text - title: Tags - description: A list of tags to include in events. Including `forwarded` indicates that the events did not originate on this host and causes `host.name` to not be added to events. - multi: true - required: true - show_user: false - default: - - cef - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/cef/2.0.3/data_stream/log/sample_event.json b/packages/cef/2.0.3/data_stream/log/sample_event.json deleted file mode 100755 index 2921fcb328..0000000000 --- a/packages/cef/2.0.3/data_stream/log/sample_event.json +++ /dev/null @@ -1,122 +0,0 @@ -{ - "@timestamp": "2022-06-03T01:39:47.734Z", - "agent": { - "ephemeral_id": "167ce484-a1a1-4fac-aaff-607b859e3ddf", - "id": "69f5d3be-c31a-4be6-adb6-cb3ed3e50817", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.2.0" - }, - "cef": { - "device": { - "event_class_id": "18", - "product": "Vaporware", - "vendor": "Elastic", - "version": "1.0.0-alpha" - }, - "extensions": { - "destinationAddress": "192.168.10.1", - "destinationPort": 443, - "eventId": 3457, - "requestContext": "https://www.google.com", - "requestMethod": "POST", - "requestUrl": "https://www.example.com/cart", - "sourceAddress": "89.160.20.156", - "sourceGeoLatitude": 38.915, - "sourceGeoLongitude": -77.511, - "sourcePort": 33876, - "sourceServiceName": "httpd", - "transportProtocol": "TCP" - }, - "name": "Web request", - "severity": "low", - "version": "0" - }, - "data_stream": { - "dataset": "cef.log", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "192.168.10.1", - "port": 443 - }, - "ecs": { - "version": "8.2.0" - }, - "elastic_agent": { - "id": "69f5d3be-c31a-4be6-adb6-cb3ed3e50817", - "snapshot": false, - "version": "8.2.0" - }, - "event": { - "agent_id_status": "verified", - "code": "18", - "dataset": "cef.log", - "id": "3457", - "ingested": "2022-06-03T01:39:48Z", - "severity": 0 - }, - "http": { - "request": { - "method": "POST", - "referrer": "https://www.google.com" - } - }, - "input": { - "type": "udp" - }, - "log": { - "source": { - "address": "192.168.112.4:35889" - } - }, - "message": "Web request", - "network": { - "community_id": "1:UgazGyZMuRDtuImGjF+6GveZFw0=", - "transport": "tcp" - }, - "observer": { - "product": "Vaporware", - "vendor": "Elastic", - "version": "1.0.0-alpha" - }, - "related": { - "ip": [ - "192.168.10.1", - "89.160.20.156" - ] - }, - "source": { - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.156", - "port": 33876, - "service": { - "name": "httpd" - } - }, - "tags": [ - "cef", - "forwarded" - ], - "url": { - "original": "https://www.example.com/cart" - } -} \ No newline at end of file diff --git a/packages/cef/2.0.3/docs/README.md b/packages/cef/2.0.3/docs/README.md deleted file mode 100755 index 8dca26f060..0000000000 --- a/packages/cef/2.0.3/docs/README.md +++ /dev/null @@ -1,617 +0,0 @@ -# Common Event Format (CEF) Integration - -This is an integration for parsing Common Event Format (CEF) data. It can accept -data over syslog or read it from a file. - -CEF data is a format like - -`CEF:0|Elastic|Vaporware|1.0.0-alpha|18|Web request|low|eventId=3457 msg=hello` - -When syslog is used as the transport the CEF data becomes the message that is -contained in the syslog envelope. This integration will parse the syslog -timestamp if it is present. Depending on the syslog RFC used the message will -have a format like one of these: - -`<189> Jun 18 10:55:50 host CEF:0|Elastic|Vaporware|1.0.0-alpha|18|Web request|low|eventId=3457 msg=hello` - -`<189>1 2021-06-18T10:55:50.000003Z host app - - - CEF:0|Elastic|Vaporware|1.0.0-alpha|18|Web request|low|eventId=3457 msg=hello` - -In both cases the integration will use the syslog timestamp as the `@timestamp` -unless the CEF data contains a device receipt timestamp. - -The Elastic Agent's `decode_cef` processor is applied to parse the CEF encoded -data. The decoded data is written into a `cef` object field. Lastly any Elastic -Common Schema (ECS) fields that can be populated with the CEF data are -populated. - -## Compatibility - -### Forcepoint NGFW Security Management Center - -This module will process CEF data from Forcepoint NGFW Security Management -Center (SMC). In the SMC configure the logs to be forwarded to the address set -in `var.syslog_host` in format CEF and service UDP on `var.syslog_port`. -Instructions can be found in [KB -15002](https://support.forcepoint.com/KBArticle?id=000015002) for configuring -the SMC. - -Testing was done with CEF logs from SMC version 6.6.1 and custom string mappings -were taken from 'CEF Connector Configuration Guide' dated December 5, 2011. - -### Check Point devices - -This module will parse CEF data from Check Point devices as documented in [Log -Exporter CEF Field -Mappings](https://community.checkpoint.com/t5/Logging-and-Reporting/Log-Exporter-CEF-Field-Mappings/td-p/41060). - -Check Point CEF extensions are mapped as follows: - - -| CEF Extension | CEF Label value | ECS Fields | Non-ECS Field | -|----------------------------|-----------------------------|--------------------------|--------------------------------| -| cp_app_risk | - | event.risk_score | checkpoint.app_risk | -| cp_severity | - | event.severity | checkpoint.severity | -| baseEventCount | - | - | checkpoint.event_count | -| deviceExternalId | - | observer.type | - | -| deviceFacility | - | observer.type | - | -| deviceInboundInterface | - | observer.ingress.interface.name | - | -| deviceOutboundInterface | - | observer.egress.interface.name | - | -| externalId | - | - | checkpoint.uuid | -| fileHash | - | file.hash.\{md5,sha1\} | - | -| reason | - | - | checkpoint.termination_reason | -| requestCookies | - | - | checkpoint.cookie | -| sourceNtDomain | - | dns.question.name | - | -| Signature | - | vulnerability.id | - | -| Recipient | - | email.to.address | - | -| Sender | - | email.from.address | - | -| deviceCustomFloatingPoint1 | update version | observer.version | - | -| deviceCustomIPv6Address2 | source ipv6 address | source.ip | - | -| deviceCustomIPv6Address3 | destination ipv6 address | destination.ip | - | -| deviceCustomNumber1 | elapsed time in seconds | event.duration | - | -| deviceCustomNumber1 | email recipients number | - | checkpoint.email_recipients_num | -| deviceCustomNumber1 | payload | network.bytes | - | -| deviceCustomNumber2 | icmp type | - | checkpoint.icmp_type | -| deviceCustomNumber2 | duration in seconds | event.duration | - | -| deviceCustomNumber3 | icmp code | - | checkpoint.icmp_code | -| deviceCustomString1 | connectivity state | - | checkpoint.connectivity_state | -| deviceCustomString1 | application rule name | rule.name | - | -| deviceCustomString1 | threat prevention rule name | rule.name | - | -| deviceCustomString1 | voip log type | - | checkpoint.voip_log_type | -| deviceCustomString1 | dlp rule name | rule.name | - | -| deviceCustomString1 | email id | - | checkpoint.email_id | -| deviceCustomString2 | category | - | checkpoint.category | -| deviceCustomString2 | email subject | email.subject | checkpoint.email_subject | -| deviceCustomString2 | sensor mode | - | checkpoint.sensor_mode | -| deviceCustomString2 | protection id | - | checkpoint.protection_id | -| deviceCustomString2 | scan invoke type | - | checkpoint.integrity_av_invoke_type | -| deviceCustomString2 | update status | - | checkpoint.update_status | -| deviceCustomString2 | peer gateway | - | checkpoint.peer_gateway | -| deviceCustomString2 | categories | rule.category | - | -| deviceCustomString6 | application name | network.application | - | -| deviceCustomString6 | virus name | - | checkpoint.virus_name | -| deviceCustomString6 | malware name | - | checkpoint.spyware_name | -| deviceCustomString6 | malware family | - | checkpoint.malware_family | -| deviceCustomString3 | user group | group.name | - | -| deviceCustomString3 | incident extension | - | checkpoint.incident_extension | -| deviceCustomString3 | protection type | - | checkpoint.protection_type | -| deviceCustomString3 | email spool id | - | checkpoint.email_spool_id | -| deviceCustomString3 | identity type | - | checkpoint.identity_type | -| deviceCustomString4 | malware status | - | checkpoint.spyware_status | -| deviceCustomString4 | threat prevention rule id | rule.id | - | -| deviceCustomString4 | scan result | - | checkpoint.scan_result | -| deviceCustomString4 | tcp flags | - | checkpoint.tcp_flags | -| deviceCustomString4 | destination os | os.name | - | -| deviceCustomString4 | protection name | - | checkpoint.protection_name | -| deviceCustomString4 | email control | - | checkpoint.email_control | -| deviceCustomString4 | frequency | - | checkpoint.frequency | -| deviceCustomString4 | user response | - | checkpoint.user_status | -| deviceCustomString5 | matched category | rule.category | - | -| deviceCustomString5 | vlan id | network.vlan.id | - | -| deviceCustomString5 | authentication method | - | checkpoint.auth_method | -| deviceCustomString5 | email session id | email.message_id | checkpoint.email_session_id | -| deviceCustomDate2 | subscription expiration | - | checkpoint.subs_exp | -| deviceFlexNumber1 | confidence | - | checkpoint.confidence_level | -| deviceFlexNumber2 | performance impact | - | checkpoint.performance_impact | -| deviceFlexNumber2 | destination phone number | - | checkpoint.dst_phone_number | -| flexString1 | application signature id | - | checkpoint.app_sig_id | -| flexString2 | malware action | rule.description | - | -| flexString2 | attack information | event.action | - | -| rule_uid | - | rule.uuid | - | -| ifname | - | observer.ingress.interface.name | - | -| inzone | - | observer.ingress.zone | - | -| outzone | - | observer.egress.zone | - | -| product | - | observer.product | - | - -## Logs - -### CEF log - -This is the CEF `log` dataset. - -An example event for `log` looks as following: - -```json -{ - "@timestamp": "2022-06-03T01:39:47.734Z", - "agent": { - "ephemeral_id": "167ce484-a1a1-4fac-aaff-607b859e3ddf", - "id": "69f5d3be-c31a-4be6-adb6-cb3ed3e50817", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.2.0" - }, - "cef": { - "device": { - "event_class_id": "18", - "product": "Vaporware", - "vendor": "Elastic", - "version": "1.0.0-alpha" - }, - "extensions": { - "destinationAddress": "192.168.10.1", - "destinationPort": 443, - "eventId": 3457, - "requestContext": "https://www.google.com", - "requestMethod": "POST", - "requestUrl": "https://www.example.com/cart", - "sourceAddress": "89.160.20.156", - "sourceGeoLatitude": 38.915, - "sourceGeoLongitude": -77.511, - "sourcePort": 33876, - "sourceServiceName": "httpd", - "transportProtocol": "TCP" - }, - "name": "Web request", - "severity": "low", - "version": "0" - }, - "data_stream": { - "dataset": "cef.log", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "192.168.10.1", - "port": 443 - }, - "ecs": { - "version": "8.2.0" - }, - "elastic_agent": { - "id": "69f5d3be-c31a-4be6-adb6-cb3ed3e50817", - "snapshot": false, - "version": "8.2.0" - }, - "event": { - "agent_id_status": "verified", - "code": "18", - "dataset": "cef.log", - "id": "3457", - "ingested": "2022-06-03T01:39:48Z", - "severity": 0 - }, - "http": { - "request": { - "method": "POST", - "referrer": "https://www.google.com" - } - }, - "input": { - "type": "udp" - }, - "log": { - "source": { - "address": "192.168.112.4:35889" - } - }, - "message": "Web request", - "network": { - "community_id": "1:UgazGyZMuRDtuImGjF+6GveZFw0=", - "transport": "tcp" - }, - "observer": { - "product": "Vaporware", - "vendor": "Elastic", - "version": "1.0.0-alpha" - }, - "related": { - "ip": [ - "192.168.10.1", - "89.160.20.156" - ] - }, - "source": { - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.156", - "port": 33876, - "service": { - "name": "httpd" - } - }, - "tags": [ - "cef", - "forwarded" - ], - "url": { - "original": "https://www.example.com/cart" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cef.device.event_class_id | Unique identifier of the event type. | keyword | -| cef.device.product | Product of the device that produced the message. | keyword | -| cef.device.vendor | Vendor of the device that produced the message. | keyword | -| cef.device.version | Version of the product that produced the message. | keyword | -| cef.extensions.TrendMicroDsDetectionConfidence | | keyword | -| cef.extensions.TrendMicroDsFileMD5 | | keyword | -| cef.extensions.TrendMicroDsFileSHA1 | | keyword | -| cef.extensions.TrendMicroDsFileSHA256 | | keyword | -| cef.extensions.TrendMicroDsFrameType | | keyword | -| cef.extensions.TrendMicroDsMalwareTarget | | keyword | -| cef.extensions.TrendMicroDsMalwareTargetType | | keyword | -| cef.extensions.TrendMicroDsPacketData | | keyword | -| cef.extensions.TrendMicroDsRelevantDetectionNames | | keyword | -| cef.extensions.TrendMicroDsTenant | | keyword | -| cef.extensions.TrendMicroDsTenantId | | keyword | -| cef.extensions.ad | | flattened | -| cef.extensions.agentAddress | The IP address of the ArcSight connector that processed the event. | ip | -| cef.extensions.agentHostName | The hostname of the ArcSight connector that processed the event. | keyword | -| cef.extensions.agentId | The agent ID of the ArcSight connector that processed the event. | keyword | -| cef.extensions.agentMacAddress | The MAC address of the ArcSight connector that processed the event. | keyword | -| cef.extensions.agentReceiptTime | The time at which information about the event was received by the ArcSight connector. | date | -| cef.extensions.agentTimeZone | The agent time zone of the ArcSight connector that processed the event. | keyword | -| cef.extensions.agentType | The agent type of the ArcSight connector that processed the event. | keyword | -| cef.extensions.agentVersion | The version of the ArcSight connector that processed the event. | keyword | -| cef.extensions.agentZoneURI | | keyword | -| cef.extensions.aggregationType | | keyword | -| cef.extensions.applicationProtocol | Application level protocol, example values are HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on. | keyword | -| cef.extensions.assetCriticality | | keyword | -| cef.extensions.baseEventCount | A count associated with this event. How many times was this same event observed? Count can be omitted if it is 1. | keyword | -| cef.extensions.bytesIn | Number of bytes transferred inbound, relative to the source to destination relationship, meaning that data was flowing from source to destination. | long | -| cef.extensions.bytesOut | Number of bytes transferred outbound relative to the source to destination relationship. For example, the byte number of data flowing from the destination to the source. | long | -| cef.extensions.categoryBehavior | Action or a behavior associated with an event. It's what is being done to the object (ArcSight). | keyword | -| cef.extensions.categoryDeviceGroup | General device group like Firewall (ArcSight). | keyword | -| cef.extensions.categoryDeviceType | Device type. Examples - Proxy, IDS, Web Server (ArcSight). | keyword | -| cef.extensions.categoryObject | Object that the event is about. For example it can be an operating sytem, database, file, etc (ArcSight). | keyword | -| cef.extensions.categoryOutcome | Outcome of the event (e.g. sucess, failure, or attempt) (ArcSight). | keyword | -| cef.extensions.categorySignificance | Characterization of the importance of the event (ArcSight). | keyword | -| cef.extensions.categoryTechnique | Technique being used (e.g. /DoS) (ArcSight). | keyword | -| cef.extensions.cp_app_risk | | keyword | -| cef.extensions.cp_severity | | keyword | -| cef.extensions.destinationAddress | Identifies the destination address that the event refers to in an IP network. The format is an IPv4 address. | ip | -| cef.extensions.destinationHostName | Identifies the destination that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the destination node, when a node is available. | keyword | -| cef.extensions.destinationMacAddress | Six colon-separated hexadecimal numbers. | keyword | -| cef.extensions.destinationNtDomain | Outcome of the event (e.g. sucess, failure, or attempt) (ArcSight). | keyword | -| cef.extensions.destinationPort | The valid port numbers are between 0 and 65535. | long | -| cef.extensions.destinationServiceName | The service targeted by this event. | keyword | -| cef.extensions.destinationTranslatedAddress | Identifies the translated destination that the event refers to in an IP network. | ip | -| cef.extensions.destinationTranslatedPort | Port after it was translated; for example, a firewall. Valid port numbers are 0 to 65535. | long | -| cef.extensions.destinationUserName | Identifies the destination user by name. This is the user associated with the event's destination. Email addresses are often mapped into the UserName fields. The recipient is a candidate to put into this field. | keyword | -| cef.extensions.destinationUserPrivileges | The typical values are "Administrator", "User", and "Guest". This identifies the destination user's privileges. In UNIX, for example, activity executed on the root user would be identified with destinationUser Privileges of "Administrator". | keyword | -| cef.extensions.deviceAction | Action taken by the device. | keyword | -| cef.extensions.deviceAddress | Identifies the device address that an event refers to in an IP network. | ip | -| cef.extensions.deviceAssetId | | keyword | -| cef.extensions.deviceCustomDate2 | One of two timestamp fields available to map fields that do not apply to any other in this dictionary. | keyword | -| cef.extensions.deviceCustomDate2Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomIPv6Address1 | One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. | ip | -| cef.extensions.deviceCustomIPv6Address1Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomIPv6Address2 | One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. | ip | -| cef.extensions.deviceCustomIPv6Address2Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomIPv6Address3 | One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. | ip | -| cef.extensions.deviceCustomIPv6Address3Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomIPv6Address4 | One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary. | ip | -| cef.extensions.deviceCustomIPv6Address4Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomNumber1 | One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | long | -| cef.extensions.deviceCustomNumber1Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomNumber2 | One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | long | -| cef.extensions.deviceCustomNumber2Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomNumber3 | One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | long | -| cef.extensions.deviceCustomNumber3Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomString1 | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | keyword | -| cef.extensions.deviceCustomString1Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomString2 | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | keyword | -| cef.extensions.deviceCustomString2Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomString3 | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | keyword | -| cef.extensions.deviceCustomString3Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomString4 | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | keyword | -| cef.extensions.deviceCustomString4Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomString5 | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | keyword | -| cef.extensions.deviceCustomString5Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceCustomString6 | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. | keyword | -| cef.extensions.deviceCustomString6Label | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. | keyword | -| cef.extensions.deviceDirection | Any information about what direction the observed communication has taken. The following values are supported - "0" for inbound or "1" for outbound. | long | -| cef.extensions.deviceEventCategory | Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. Example "/Monitor/Disk/Read". | keyword | -| cef.extensions.deviceExternalId | A name that uniquely identifies the device generating this event. | keyword | -| cef.extensions.deviceFacility | The facility generating this event. For example, Syslog has an explicit facility associated with every event. | keyword | -| cef.extensions.deviceHostName | The format should be a fully qualified domain name (FQDN) associated with the device node, when a node is available. | keyword | -| cef.extensions.deviceInboundInterface | Interface on which the packet or data entered the device. | keyword | -| cef.extensions.deviceOutboundInterface | Interface on which the packet or data left the device. | keyword | -| cef.extensions.deviceProcessName | Process name associated with the event. An example might be the process generating the syslog entry in UNIX. | keyword | -| cef.extensions.deviceReceiptTime | The time at which the event related to the activity was received. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970) | keyword | -| cef.extensions.deviceSeverity | | keyword | -| cef.extensions.deviceTimeZone | The time zone for the device generating the event. | keyword | -| cef.extensions.deviceZoneID | | keyword | -| cef.extensions.deviceZoneURI | Thee URI for the Zone that the device asset has been assigned to in ArcSight. | keyword | -| cef.extensions.dvc | This field is used by Trend Micro if the hostname is an IPv4 address. | ip | -| cef.extensions.dvchost | This field is used by Trend Micro for hostnames and IPv6 addresses. | keyword | -| cef.extensions.eventAnnotationAuditTrail | | keyword | -| cef.extensions.eventAnnotationEndTime | | date | -| cef.extensions.eventAnnotationFlags | | keyword | -| cef.extensions.eventAnnotationManagerReceiptTime | | date | -| cef.extensions.eventAnnotationModificationTime | | date | -| cef.extensions.eventAnnotationStageUpdateTime | | date | -| cef.extensions.eventAnnotationVersion | | keyword | -| cef.extensions.eventId | This is a unique ID that ArcSight assigns to each event. | long | -| cef.extensions.fileHash | Hash of a file. | keyword | -| cef.extensions.filePath | Full path to the file, including file name itself. | keyword | -| cef.extensions.fileSize | Size of the file. | long | -| cef.extensions.fileType | Type of file (pipe, socket, etc.) | keyword | -| cef.extensions.filename | Name of the file only (without its path). | keyword | -| cef.extensions.ifname | | keyword | -| cef.extensions.inzone | | keyword | -| cef.extensions.layer_name | | keyword | -| cef.extensions.layer_uuid | | keyword | -| cef.extensions.locality | | keyword | -| cef.extensions.logid | | keyword | -| cef.extensions.loguid | | keyword | -| cef.extensions.managerReceiptTime | When the Arcsight ESM received the event. | date | -| cef.extensions.match_id | | keyword | -| cef.extensions.message | An arbitrary message giving more details about the event. Multi-line entries can be produced by using \n as the new line separator. | keyword | -| cef.extensions.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| cef.extensions.modelConfidence | | keyword | -| cef.extensions.nat_addtnl_rulenum | | keyword | -| cef.extensions.nat_rulenum | | keyword | -| cef.extensions.oldFileHash | Hash of the old file. | keyword | -| cef.extensions.origin | | keyword | -| cef.extensions.originalAgentAddress | | keyword | -| cef.extensions.originalAgentHostName | | keyword | -| cef.extensions.originalAgentId | | keyword | -| cef.extensions.originalAgentType | | keyword | -| cef.extensions.originalAgentVersion | | keyword | -| cef.extensions.originalAgentZoneURI | | keyword | -| cef.extensions.originsicname | | keyword | -| cef.extensions.outzone | | keyword | -| cef.extensions.parent_rule | | keyword | -| cef.extensions.priority | | keyword | -| cef.extensions.product | | keyword | -| cef.extensions.relevance | | keyword | -| cef.extensions.repeatCount | | keyword | -| cef.extensions.requestContext | Description of the content from which the request originated (for example, HTTP Referrer). | keyword | -| cef.extensions.requestMethod | The HTTP method used to access a URL. | keyword | -| cef.extensions.requestUrl | In the case of an HTTP request, this field contains the URL accessed. The URL should contain the protocol as well. | keyword | -| cef.extensions.requestUrlFileName | | keyword | -| cef.extensions.rule_action | | keyword | -| cef.extensions.rule_uid | | keyword | -| cef.extensions.sequencenum | | keyword | -| cef.extensions.service_id | | keyword | -| cef.extensions.severity | | keyword | -| cef.extensions.sourceAddress | Identifies the source that an event refers to in an IP network. | ip | -| cef.extensions.sourceGeoLatitude | | long | -| cef.extensions.sourceGeoLongitude | | long | -| cef.extensions.sourceHostName | Identifies the source that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the source node, when a mode is available. | keyword | -| cef.extensions.sourceMacAddress | Six colon-separated hexadecimal numbers. | keyword | -| cef.extensions.sourceNtDomain | The Windows domain name for the source address. | keyword | -| cef.extensions.sourcePort | The valid port numbers are 0 to 65535. | long | -| cef.extensions.sourceServiceName | The service that is responsible for generating this event. | keyword | -| cef.extensions.sourceTranslatedAddress | Identifies the translated source that the event refers to in an IP network. | ip | -| cef.extensions.sourceTranslatedPort | A port number after being translated by, for example, a firewall. Valid port numbers are 0 to 65535. | long | -| cef.extensions.sourceTranslatedZoneID | | keyword | -| cef.extensions.sourceTranslatedZoneURI | The URI for the Translated Zone that the destination asset has been assigned to in ArcSight. | keyword | -| cef.extensions.sourceUserId | Identifies the source user by ID. This is the user associated with the source of the event. For example, in UNIX, the root user is generally associated with user ID 0. | keyword | -| cef.extensions.sourceUserName | Identifies the source user by name. Email addresses are also mapped into the UserName fields. The sender is a candidate to put into this field. | keyword | -| cef.extensions.sourceUserPrivileges | The typical values are "Administrator", "User", and "Guest". It identifies the source user's privileges. In UNIX, for example, activity executed by the root user would be identified with "Administrator". | keyword | -| cef.extensions.sourceZoneID | Identifies the source user by ID. This is the user associated with the source of the event. For example, in UNIX, the root user is generally associated with user ID 0. | keyword | -| cef.extensions.sourceZoneURI | The URI for the Zone that the source asset has been assigned to in ArcSight. | keyword | -| cef.extensions.startTime | The time when the activity the event referred to started. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970). | date | -| cef.extensions.target | | keyword | -| cef.extensions.transportProtocol | Identifies the Layer-4 protocol used. The possible values are protocols such as TCP or UDP. | keyword | -| cef.extensions.type | 0 means base event, 1 means aggregated, 2 means correlation, and 3 means action. This field can be omitted for base events (type 0). | long | -| cef.extensions.version | | keyword | -| cef.forcepoint.virus_id | Virus ID | keyword | -| cef.name | | keyword | -| cef.severity | | keyword | -| cef.version | | keyword | -| checkpoint.app_risk | Application risk. | keyword | -| checkpoint.app_severity | Application threat severity. | keyword | -| checkpoint.app_sig_id | The signature ID which the application was detected by. | keyword | -| checkpoint.auth_method | Password authentication protocol used. | keyword | -| checkpoint.category | Category. | keyword | -| checkpoint.confidence_level | Confidence level determined. | integer | -| checkpoint.connectivity_state | Connectivity state. | keyword | -| checkpoint.cookie | IKE cookie. | keyword | -| checkpoint.dst_phone_number | Destination IP-Phone. | keyword | -| checkpoint.email_control | Engine name. | keyword | -| checkpoint.email_id | Internal email ID. | keyword | -| checkpoint.email_recipients_num | Number of recipients. | long | -| checkpoint.email_session_id | Internal email session ID. | keyword | -| checkpoint.email_spool_id | Internal email spool ID. | keyword | -| checkpoint.email_subject | Email subject. | keyword | -| checkpoint.event_count | Number of events associated with the log. | long | -| checkpoint.frequency | Scan frequency. | keyword | -| checkpoint.icmp_code | ICMP code. | long | -| checkpoint.icmp_type | ICMP type. | long | -| checkpoint.identity_type | Identity type. | keyword | -| checkpoint.incident_extension | Format of original data. | keyword | -| checkpoint.integrity_av_invoke_type | Scan invoke type. | keyword | -| checkpoint.malware_family | Malware family. | keyword | -| checkpoint.peer_gateway | Main IP of the peer Security Gateway. | ip | -| checkpoint.performance_impact | Protection performance impact. | integer | -| checkpoint.protection_id | Protection malware ID. | keyword | -| checkpoint.protection_name | Specific signature name of the attack. | keyword | -| checkpoint.protection_type | Type of protection used to detect the attack. | keyword | -| checkpoint.scan_result | Scan result. | keyword | -| checkpoint.sensor_mode | Sensor mode. | keyword | -| checkpoint.severity | Threat severity. | keyword | -| checkpoint.spyware_name | Spyware name. | keyword | -| checkpoint.spyware_status | Spyware status. | keyword | -| checkpoint.subs_exp | The expiration date of the subscription. | date | -| checkpoint.tcp_flags | TCP packet flags. | keyword | -| checkpoint.termination_reason | Termination reason. | keyword | -| checkpoint.update_status | Update status. | keyword | -| checkpoint.user_status | User response. | keyword | -| checkpoint.uuid | External ID. | keyword | -| checkpoint.virus_name | Virus name. | keyword | -| checkpoint.voip_log_type | VoIP log types. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.port | Port of the destination. | long | -| destination.service.name | | keyword | -| destination.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| destination.user.group.name | Name of the group. | keyword | -| destination.user.id | Unique identifier of the user. | keyword | -| destination.user.name | Short name or login of the user. | keyword | -| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| email.from.address | The email address of the sender, typically from the RFC 5322 `From:` header field. | keyword | -| email.subject | A brief summary of the topic of the message. | keyword | -| email.subject.text | Multi-field of `email.subject`. | match_only_text | -| email.to.address | The email address of recipient | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.id | Unique ID to describe the event. | keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| file.group | Primary group name of the file. | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha1 | SHA1 hash. | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| input.type | Input type | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.hostname | Hostname of the observer. | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.product | The product name of the observer. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.port | Port of the source. | long | -| source.service.name | | keyword | -| source.user.group.id | Unique identifier for the group on the system/platform. | keyword | -| source.user.group.name | Name of the group. | keyword | -| source.user.id | Unique identifier of the user. | keyword | -| source.user.name | Short name or login of the user. | keyword | -| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | -| tags | List of keywords used to tag each event. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.original.text | Multi-field of `url.original`. | match_only_text | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | - diff --git a/packages/cef/2.0.3/kibana/dashboard/cef-56428e01-0c47-4770-8ba4-9345a029ea41.json b/packages/cef/2.0.3/kibana/dashboard/cef-56428e01-0c47-4770-8ba4-9345a029ea41.json deleted file mode 100755 index c44bda0cc2..0000000000 --- a/packages/cef/2.0.3/kibana/dashboard/cef-56428e01-0c47-4770-8ba4-9345a029ea41.json +++ /dev/null @@ -1,93 +0,0 @@ -{ - "attributes": { - "description": "Overview of Microsoft DNS activity via ArcSight", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:cef.log\"},\"version\":true}" - }, - "optionsJSON": "{\"darkTheme\":false}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"1\",\"w\":8,\"x\":40,\"y\":4},\"panelIndex\":\"1\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"h\":8,\"i\":\"3\",\"w\":40,\"x\":0,\"y\":4},\"panelIndex\":\"3\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 18k\":\"rgb(247,251,255)\",\"108k - 126k\":\"rgb(74,152,201)\",\"126k - 144k\":\"rgb(46,126,188)\",\"144k - 162k\":\"rgb(23,100,171)\",\"162k - 180k\":\"rgb(8,74,145)\",\"18k - 36k\":\"rgb(227,238,249)\",\"36k - 54k\":\"rgb(208,225,242)\",\"54k - 72k\":\"rgb(182,212,233)\",\"72k - 90k\":\"rgb(148,196,223)\",\"90k - 108k\":\"rgb(107,174,214)\"},\"legendOpen\":false}},\"gridData\":{\"h\":16,\"i\":\"5\",\"w\":24,\"x\":0,\"y\":32},\"panelIndex\":\"5\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"6\",\"w\":48,\"x\":0,\"y\":48},\"panelIndex\":\"6\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"7\",\"w\":24,\"x\":24,\"y\":32},\"panelIndex\":\"7\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"9\",\"w\":48,\"x\":0,\"y\":12},\"panelIndex\":\"9\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":16,\"i\":\"11\",\"w\":24,\"x\":24,\"y\":56},\"panelIndex\":\"11\",\"panelRefName\":\"panel_11\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":4,\"i\":\"12\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"12\",\"panelRefName\":\"panel_12\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":16,\"i\":\"13\",\"w\":24,\"x\":0,\"y\":56},\"panelIndex\":\"13\",\"panelRefName\":\"panel_13\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":12,\"i\":\"14\",\"w\":24,\"x\":0,\"y\":20},\"panelIndex\":\"14\",\"panelRefName\":\"panel_14\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":12,\"i\":\"15\",\"w\":24,\"x\":24,\"y\":20},\"panelIndex\":\"15\",\"panelRefName\":\"panel_15\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"attributes\":{\"description\":\"\",\"layerListJSON\":\"[{\\\"sourceDescriptor\\\":{\\\"type\\\":\\\"EMS_TMS\\\",\\\"isAutoSelect\\\":true,\\\"lightModeDefault\\\":\\\"road_map_desaturated\\\"},\\\"id\\\":\\\"56b3b288-a0f1-416d-9d40-96a37c8484fd\\\",\\\"label\\\":null,\\\"minZoom\\\":0,\\\"maxZoom\\\":24,\\\"alpha\\\":1,\\\"visible\\\":true,\\\"style\\\":{\\\"type\\\":\\\"TILE\\\"},\\\"includeInFitToBounds\\\":true,\\\"type\\\":\\\"VECTOR_TILE\\\"},{\\\"alpha\\\":0.75,\\\"id\\\":\\\"d50cbece-4556-4421-bb06-fb015bfe7baa\\\",\\\"includeInFitToBounds\\\":true,\\\"joins\\\":[],\\\"label\\\":\\\"Top Sources by Events [Logs CEF ArcSight]\\\",\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"sourceDescriptor\\\":{\\\"applyForceRefresh\\\":true,\\\"applyGlobalQuery\\\":true,\\\"applyGlobalTime\\\":true,\\\"geoField\\\":\\\"source.geo.location\\\",\\\"id\\\":\\\"555cbeac-b098-4946-9498-6b700e745e8a\\\",\\\"indexPatternId\\\":\\\"logs-*\\\",\\\"metrics\\\":[{\\\"type\\\":\\\"count\\\"}],\\\"requestType\\\":\\\"point\\\",\\\"resolution\\\":\\\"MOST_FINE\\\",\\\"type\\\":\\\"ES_GEO_GRID\\\"},\\\"style\\\":{\\\"isTimeAware\\\":true,\\\"properties\\\":{\\\"fillColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"Yellow to Red\\\",\\\"colorCategory\\\":\\\"palette_0\\\",\\\"field\\\":{\\\"name\\\":\\\"doc_count\\\",\\\"origin\\\":\\\"source\\\"},\\\"fieldMetaOptions\\\":{\\\"isEnabled\\\":false,\\\"sigma\\\":3},\\\"type\\\":\\\"ORDINAL\\\"},\\\"type\\\":\\\"DYNAMIC\\\"},\\\"icon\\\":{\\\"options\\\":{\\\"value\\\":\\\"marker\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"iconOrientation\\\":{\\\"options\\\":{\\\"orientation\\\":0},\\\"type\\\":\\\"STATIC\\\"},\\\"iconSize\\\":{\\\"options\\\":{\\\"size\\\":6},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#FFFFFF\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderSize\\\":{\\\"options\\\":{\\\"size\\\":\\\"SMALL\\\"}},\\\"labelColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#000000\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelSize\\\":{\\\"options\\\":{\\\"size\\\":14},\\\"type\\\":\\\"STATIC\\\"},\\\"labelText\\\":{\\\"options\\\":{\\\"value\\\":\\\"\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#3d3d3d\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineWidth\\\":{\\\"options\\\":{\\\"size\\\":1},\\\"type\\\":\\\"STATIC\\\"},\\\"symbolizeAs\\\":{\\\"options\\\":{\\\"value\\\":\\\"circle\\\"}}},\\\"type\\\":\\\"VECTOR\\\"},\\\"type\\\":\\\"VECTOR\\\",\\\"visible\\\":true}]\",\"mapStateJSON\":\"{\\\"zoom\\\":1.78,\\\"center\\\":{\\\"lon\\\":0,\\\"lat\\\":16.40767},\\\"timeFilters\\\":{\\\"from\\\":\\\"now-24h\\\",\\\"to\\\":\\\"now\\\"},\\\"refreshConfig\\\":{\\\"isPaused\\\":true,\\\"interval\\\":0},\\\"query\\\":{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"},\\\"filters\\\":[],\\\"settings\\\":{\\\"autoFitToDataBounds\\\":false,\\\"backgroundColor\\\":\\\"#ffffff\\\",\\\"disableInteractive\\\":false,\\\"disableTooltipControl\\\":false,\\\"hideToolbarOverlay\\\":false,\\\"hideLayerControl\\\":false,\\\"hideViewControl\\\":false,\\\"initialLocation\\\":\\\"LAST_SAVED_LOCATION\\\",\\\"fixedLocation\\\":{\\\"lat\\\":0,\\\"lon\\\":0,\\\"zoom\\\":2},\\\"browserLocation\\\":{\\\"zoom\\\":2},\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"showScaleControl\\\":false,\\\"showSpatialFilters\\\":true,\\\"showTimesliderToggleButton\\\":true,\\\"spatialFiltersAlpa\\\":0.3,\\\"spatialFiltersFillColor\\\":\\\"#DA8B45\\\",\\\"spatialFiltersLineColor\\\":\\\"#DA8B45\\\"}}\",\"references\":[],\"title\":\"Top Sources by Events [Logs CEF ArcSight]\",\"uiStateJSON\":\"{\\\"isLayerTOCOpen\\\":true,\\\"openTOCDetails\\\":[]}\"},\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":90,\"minLat\":-66.51326,\"minLon\":-90},\"mapCenter\":{\"lat\":16.40767,\"lon\":0,\"zoom\":1.78},\"openTOCDetails\":[]},\"gridData\":{\"h\":12,\"i\":\"3cf2118b-5231-49f5-b685-0ff0e1f52c32\",\"w\":24,\"x\":0,\"y\":72},\"panelIndex\":\"3cf2118b-5231-49f5-b685-0ff0e1f52c32\",\"type\":\"map\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"attributes\":{\"description\":\"\",\"layerListJSON\":\"[{\\\"sourceDescriptor\\\":{\\\"type\\\":\\\"EMS_TMS\\\",\\\"isAutoSelect\\\":true,\\\"lightModeDefault\\\":\\\"road_map_desaturated\\\"},\\\"id\\\":\\\"5231e15c-d374-46ca-9553-3308d723ded3\\\",\\\"label\\\":null,\\\"minZoom\\\":0,\\\"maxZoom\\\":24,\\\"alpha\\\":1,\\\"visible\\\":true,\\\"style\\\":{\\\"type\\\":\\\"TILE\\\"},\\\"includeInFitToBounds\\\":true,\\\"type\\\":\\\"VECTOR_TILE\\\"},{\\\"alpha\\\":0.75,\\\"id\\\":\\\"8cdaae20-5dcc-4930-b105-802fc344fcb6\\\",\\\"includeInFitToBounds\\\":true,\\\"joins\\\":[],\\\"label\\\":\\\"Top Destinations by Events [Logs CEF ArcSight]\\\",\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"sourceDescriptor\\\":{\\\"applyForceRefresh\\\":true,\\\"applyGlobalQuery\\\":true,\\\"applyGlobalTime\\\":true,\\\"geoField\\\":\\\"destination.geo.location\\\",\\\"id\\\":\\\"88700fdc-3a96-46b8-b51f-3839111eb6ec\\\",\\\"indexPatternId\\\":\\\"logs-*\\\",\\\"metrics\\\":[{\\\"type\\\":\\\"count\\\"}],\\\"requestType\\\":\\\"point\\\",\\\"resolution\\\":\\\"MOST_FINE\\\",\\\"type\\\":\\\"ES_GEO_GRID\\\"},\\\"style\\\":{\\\"isTimeAware\\\":true,\\\"properties\\\":{\\\"fillColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"Yellow to Red\\\",\\\"colorCategory\\\":\\\"palette_0\\\",\\\"field\\\":{\\\"name\\\":\\\"doc_count\\\",\\\"origin\\\":\\\"source\\\"},\\\"fieldMetaOptions\\\":{\\\"isEnabled\\\":false,\\\"sigma\\\":3},\\\"type\\\":\\\"ORDINAL\\\"},\\\"type\\\":\\\"DYNAMIC\\\"},\\\"icon\\\":{\\\"options\\\":{\\\"value\\\":\\\"marker\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"iconOrientation\\\":{\\\"options\\\":{\\\"orientation\\\":0},\\\"type\\\":\\\"STATIC\\\"},\\\"iconSize\\\":{\\\"options\\\":{\\\"size\\\":6},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#FFFFFF\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderSize\\\":{\\\"options\\\":{\\\"size\\\":\\\"SMALL\\\"}},\\\"labelColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#000000\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelSize\\\":{\\\"options\\\":{\\\"size\\\":14},\\\"type\\\":\\\"STATIC\\\"},\\\"labelText\\\":{\\\"options\\\":{\\\"value\\\":\\\"\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#3d3d3d\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineWidth\\\":{\\\"options\\\":{\\\"size\\\":1},\\\"type\\\":\\\"STATIC\\\"},\\\"symbolizeAs\\\":{\\\"options\\\":{\\\"value\\\":\\\"circle\\\"}}},\\\"type\\\":\\\"VECTOR\\\"},\\\"type\\\":\\\"VECTOR\\\",\\\"visible\\\":true}]\",\"mapStateJSON\":\"{\\\"zoom\\\":1.78,\\\"center\\\":{\\\"lon\\\":0,\\\"lat\\\":16.40767},\\\"timeFilters\\\":{\\\"from\\\":\\\"now-24h\\\",\\\"to\\\":\\\"now\\\"},\\\"refreshConfig\\\":{\\\"isPaused\\\":true,\\\"interval\\\":0},\\\"query\\\":{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"},\\\"filters\\\":[],\\\"settings\\\":{\\\"autoFitToDataBounds\\\":false,\\\"backgroundColor\\\":\\\"#ffffff\\\",\\\"disableInteractive\\\":false,\\\"disableTooltipControl\\\":false,\\\"hideToolbarOverlay\\\":false,\\\"hideLayerControl\\\":false,\\\"hideViewControl\\\":false,\\\"initialLocation\\\":\\\"LAST_SAVED_LOCATION\\\",\\\"fixedLocation\\\":{\\\"lat\\\":0,\\\"lon\\\":0,\\\"zoom\\\":2},\\\"browserLocation\\\":{\\\"zoom\\\":2},\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"showScaleControl\\\":false,\\\"showSpatialFilters\\\":true,\\\"showTimesliderToggleButton\\\":true,\\\"spatialFiltersAlpa\\\":0.3,\\\"spatialFiltersFillColor\\\":\\\"#DA8B45\\\",\\\"spatialFiltersLineColor\\\":\\\"#DA8B45\\\"}}\",\"references\":[],\"title\":\"Top Destinations by Events [Logs CEF ArcSight]\",\"uiStateJSON\":\"{\\\"isLayerTOCOpen\\\":true,\\\"openTOCDetails\\\":[]}\"},\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":90,\"minLat\":-66.51326,\"minLon\":-90},\"mapCenter\":{\"lat\":16.40767,\"lon\":0,\"zoom\":1.78},\"openTOCDetails\":[]},\"gridData\":{\"h\":12,\"i\":\"07f92eca-2078-4aa6-8373-d27ca33595d6\",\"w\":24,\"x\":24,\"y\":72},\"panelIndex\":\"07f92eca-2078-4aa6-8373-d27ca33595d6\",\"type\":\"map\",\"version\":\"8.0.0\"}]", - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-24h", - "timeRestore": true, - "timeTo": "now", - "title": "[Logs CEF ArcSight] Microsoft DNS Overview", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-56428e01-0c47-4770-8ba4-9345a029ea41", - "migrationVersion": { - "dashboard": "8.0.0" - }, - "references": [ - { - "id": "cef-7e2b0659-0760-4182-8b29-3ee69f26bc6f", - "name": "1:panel_1", - "type": "visualization" - }, - { - "id": "cef-249e2737-b41f-4115-b303-88bc9d279655", - "name": "3:panel_3", - "type": "visualization" - }, - { - "id": "cef-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110", - "name": "5:panel_5", - "type": "visualization" - }, - { - "id": "cef-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3", - "name": "6:panel_6", - "type": "visualization" - }, - { - "id": "cef-fcf798a8-db8f-4492-827b-8fa7581108a9", - "name": "7:panel_7", - "type": "visualization" - }, - { - "id": "cef-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d", - "name": "9:panel_9", - "type": "visualization" - }, - { - "id": "cef-1b9cc5b7-7747-49de-96b1-a4bc7f675716", - "name": "11:panel_11", - "type": "visualization" - }, - { - "id": "cef-677891a1-90c4-4273-b126-f0e54689bd76", - "name": "12:panel_12", - "type": "visualization" - }, - { - "id": "cef-26a65f68-d7a6-4b47-befc-c5a6819bb91b", - "name": "13:panel_13", - "type": "visualization" - }, - { - "id": "cef-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0", - "name": "14:panel_14", - "type": "visualization" - }, - { - "id": "cef-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0", - "name": "15:panel_15", - "type": "visualization" - }, - { - "id": "logs-*", - "name": "3cf2118b-5231-49f5-b685-0ff0e1f52c32:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "07f92eca-2078-4aa6-8373-d27ca33595d6:layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/dashboard/cef-9e352900-89c3-4c1b-863e-249e24d0dac9.json b/packages/cef/2.0.3/kibana/dashboard/cef-9e352900-89c3-4c1b-863e-249e24d0dac9.json deleted file mode 100755 index e740d26d0b..0000000000 --- a/packages/cef/2.0.3/kibana/dashboard/cef-9e352900-89c3-4c1b-863e-249e24d0dac9.json +++ /dev/null @@ -1,109 +0,0 @@ -{ - "attributes": { - "description": "Operating system activity from endpoints via ArcSight", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:cef.log\"},\"version\":true}" - }, - "optionsJSON": "{\"darkTheme\":false}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"Count\":\"#64B0C8\",\"Destination User Names\":\"#E24D42\",\"Event Types\":\"#EF843C\"},\"legendOpen\":true}},\"gridData\":{\"h\":12,\"i\":\"3\",\"w\":24,\"x\":0,\"y\":28},\"panelIndex\":\"3\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"h\":8,\"i\":\"4\",\"w\":40,\"x\":0,\"y\":4},\"panelIndex\":\"4\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 55k\":\"rgb(255,255,204)\",\"110k - 165k\":\"rgb(254,225,135)\",\"165k - 220k\":\"rgb(254,201,101)\",\"220k - 275k\":\"rgb(254,171,73)\",\"275k - 330k\":\"rgb(253,141,60)\",\"330k - 385k\":\"rgb(252,91,46)\",\"385k - 440k\":\"rgb(237,47,34)\",\"440k - 495k\":\"rgb(212,16,32)\",\"495k - 550k\":\"rgb(176,0,38)\",\"55k - 110k\":\"rgb(255,241,170)\"},\"legendOpen\":false}},\"gridData\":{\"h\":12,\"i\":\"5\",\"w\":24,\"x\":24,\"y\":28},\"panelIndex\":\"5\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"7\",\"w\":48,\"x\":0,\"y\":20},\"panelIndex\":\"7\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#447EBC\",\"/Failure\":\"#E24D42\",\"/Success\":\"#7EB26D\"}}},\"gridData\":{\"h\":12,\"i\":\"8\",\"w\":24,\"x\":24,\"y\":52},\"panelIndex\":\"8\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":24,\"i\":\"9\",\"w\":24,\"x\":0,\"y\":40},\"panelIndex\":\"9\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":12,\"i\":\"10\",\"w\":24,\"x\":24,\"y\":40},\"panelIndex\":\"10\",\"panelRefName\":\"panel_10\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":4,\"i\":\"11\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"11\",\"panelRefName\":\"panel_11\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"12\",\"w\":8,\"x\":40,\"y\":4},\"panelIndex\":\"12\",\"panelRefName\":\"panel_12\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"Destination Users\":\"#E24D42\",\"Event Count\":\"#64B0C8\"}}},\"gridData\":{\"h\":8,\"i\":\"13\",\"w\":48,\"x\":0,\"y\":12},\"panelIndex\":\"13\",\"panelRefName\":\"panel_13\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"14\",\"w\":16,\"x\":32,\"y\":64},\"panelIndex\":\"14\",\"panelRefName\":\"panel_14\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":24,\"i\":\"15\",\"w\":16,\"x\":32,\"y\":84},\"panelIndex\":\"15\",\"panelRefName\":\"panel_15\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":12,\"i\":\"16\",\"w\":32,\"x\":0,\"y\":80},\"panelIndex\":\"16\",\"panelRefName\":\"panel_16\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"17\",\"w\":32,\"x\":0,\"y\":100},\"panelIndex\":\"17\",\"panelRefName\":\"panel_17\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"18\",\"w\":32,\"x\":0,\"y\":64},\"panelIndex\":\"18\",\"panelRefName\":\"panel_18\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"19\",\"w\":32,\"x\":0,\"y\":92},\"panelIndex\":\"19\",\"panelRefName\":\"panel_19\",\"type\":\"visualization\",\"version\":\"7.3.0\"}]", - "refreshInterval": { - "display": "Off", - "pause": false, - "value": 0 - }, - "timeFrom": "now-24h", - "timeRestore": true, - "timeTo": "now", - "title": "[Logs CEF ArcSight] Endpoint OS Activity Dashboard", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-9e352900-89c3-4c1b-863e-249e24d0dac9", - "migrationVersion": { - "dashboard": "8.0.0" - }, - "references": [ - { - "id": "cef-59ad829b-12b8-4256-95a5-e7078eda628b", - "name": "3:panel_3", - "type": "visualization" - }, - { - "id": "cef-158d809a-89db-4ffa-88a1-eb5c4bf58d50", - "name": "4:panel_4", - "type": "visualization" - }, - { - "id": "cef-77ee0e91-010b-4897-b483-7e9a907d2afe", - "name": "5:panel_5", - "type": "visualization" - }, - { - "id": "cef-0f4028b2-3dc2-4cb6-80d8-285c847a02a1", - "name": "7:panel_7", - "type": "visualization" - }, - { - "id": "cef-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9", - "name": "8:panel_8", - "type": "visualization" - }, - { - "id": "cef-2726382e-638a-4dcc-94fc-0ffdc0f92048", - "name": "9:panel_9", - "type": "visualization" - }, - { - "id": "cef-92aecea0-a632-4a55-bb56-50e4cdaca036", - "name": "10:panel_10", - "type": "visualization" - }, - { - "id": "cef-677891a1-90c4-4273-b126-f0e54689bd76", - "name": "11:panel_11", - "type": "visualization" - }, - { - "id": "cef-76c088c3-486e-4420-8840-5ede667edffe", - "name": "12:panel_12", - "type": "visualization" - }, - { - "id": "cef-5f187dc8-aa7e-4f91-a2d8-1186ce254d00", - "name": "13:panel_13", - "type": "visualization" - }, - { - "id": "cef-316fdc75-7215-4c6b-8e1b-70a097b34e28", - "name": "14:panel_14", - "type": "visualization" - }, - { - "id": "cef-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409", - "name": "15:panel_15", - "type": "visualization" - }, - { - "id": "cef-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf", - "name": "16:panel_16", - "type": "visualization" - }, - { - "id": "cef-acc915fe-b971-4795-9040-3fbfdf62abe1", - "name": "17:panel_17", - "type": "visualization" - }, - { - "id": "cef-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956", - "name": "18:panel_18", - "type": "visualization" - }, - { - "id": "cef-8cd00d20-957d-4663-be4d-ea80b1609586", - "name": "19:panel_19", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/dashboard/cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b.json b/packages/cef/2.0.3/kibana/dashboard/cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b.json deleted file mode 100755 index 3fa223db88..0000000000 --- a/packages/cef/2.0.3/kibana/dashboard/cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b.json +++ /dev/null @@ -1,98 +0,0 @@ -{ - "attributes": { - "description": "Summary of ArcSight endpoint event data", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:cef.log\"},\"version\":true}" - }, - "optionsJSON": "{\"darkTheme\":false}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"1\",\"w\":8,\"x\":40,\"y\":4},\"panelIndex\":\"1\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}},\"gridData\":{\"h\":12,\"i\":\"2\",\"w\":24,\"x\":24,\"y\":32},\"panelIndex\":\"2\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}},\"gridData\":{\"h\":12,\"i\":\"3\",\"w\":24,\"x\":0,\"y\":32},\"panelIndex\":\"3\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"5\",\"w\":48,\"x\":0,\"y\":12},\"panelIndex\":\"5\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":12,\"i\":\"6\",\"w\":24,\"x\":24,\"y\":44},\"panelIndex\":\"6\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"h\":8,\"i\":\"7\",\"w\":40,\"x\":0,\"y\":4},\"panelIndex\":\"7\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}},\"gridData\":{\"h\":12,\"i\":\"8\",\"w\":24,\"x\":0,\"y\":44},\"panelIndex\":\"8\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"columns\":[\"cef.extensions.categoryDeviceGroup\",\"cef.extensions.categoryTechnique\",\"cef.extensions.categoryOutcome\",\"cef.extensions.categorySignificance\",\"cef.extensions.categoryObject\",\"cef.extensions.categoryBehavior\",\"cef.extensions.categoryDeviceType\"],\"enhancements\":{},\"sort\":[\"@timestamp\",\"desc\"]},\"gridData\":{\"h\":20,\"i\":\"9\",\"w\":48,\"x\":0,\"y\":76},\"panelIndex\":\"9\",\"panelRefName\":\"panel_9\",\"type\":\"search\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"10\",\"w\":24,\"x\":24,\"y\":56},\"panelIndex\":\"10\",\"panelRefName\":\"panel_10\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"Anti-Virus\":\"#EAB839\",\"Database\":\"#629E51\",\"Host-based IDS/IPS\":\"#E0752D\",\"Operating System\":\"#BF1B00\",\"Security Mangement\":\"#64B0C8\"}}},\"gridData\":{\"h\":12,\"i\":\"11\",\"w\":24,\"x\":0,\"y\":20},\"panelIndex\":\"11\",\"panelRefName\":\"panel_11\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":20,\"i\":\"12\",\"w\":24,\"x\":0,\"y\":56},\"panelIndex\":\"12\",\"panelRefName\":\"panel_12\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Informational\":\"#7EB26D\",\"/Informational/Warning\":\"#EF843C\",\"/Success\":\"#629E51\",\"Anti-Virus\":\"#EAB839\",\"Database\":\"#629E51\",\"Host-based IDS/IPS\":\"#E0752D\",\"Log Consolidator\":\"#E0F9D7\",\"Operating System\":\"#BF1B00\",\"Recon\":\"#BF1B00\",\"Security Mangement\":\"#64B0C8\"}}},\"gridData\":{\"h\":12,\"i\":\"14\",\"w\":24,\"x\":24,\"y\":20},\"panelIndex\":\"14\",\"panelRefName\":\"panel_14\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":4,\"i\":\"15\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"15\",\"panelRefName\":\"panel_15\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"attributes\":{\"description\":\"\",\"layerListJSON\":\"[{\\\"sourceDescriptor\\\":{\\\"type\\\":\\\"EMS_TMS\\\",\\\"isAutoSelect\\\":true,\\\"lightModeDefault\\\":\\\"road_map_desaturated\\\"},\\\"id\\\":\\\"de084257-24da-4ea9-922e-a2d7565ebcd6\\\",\\\"label\\\":null,\\\"minZoom\\\":0,\\\"maxZoom\\\":24,\\\"alpha\\\":1,\\\"visible\\\":true,\\\"style\\\":{\\\"type\\\":\\\"TILE\\\"},\\\"includeInFitToBounds\\\":true,\\\"type\\\":\\\"VECTOR_TILE\\\"},{\\\"alpha\\\":0.75,\\\"id\\\":\\\"741ceaa6-5b51-4959-9935-c5961b12f539\\\",\\\"includeInFitToBounds\\\":true,\\\"joins\\\":[],\\\"label\\\":\\\"Top Destination Locations by Event [Logs CEF ArcSight]\\\",\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"sourceDescriptor\\\":{\\\"applyForceRefresh\\\":true,\\\"applyGlobalQuery\\\":true,\\\"applyGlobalTime\\\":true,\\\"geoField\\\":\\\"destination.geo.location\\\",\\\"id\\\":\\\"ba850a09-c635-4855-b68b-de16dd200d6f\\\",\\\"indexPatternId\\\":\\\"logs-*\\\",\\\"metrics\\\":[{\\\"type\\\":\\\"count\\\"}],\\\"requestType\\\":\\\"point\\\",\\\"resolution\\\":\\\"MOST_FINE\\\",\\\"type\\\":\\\"ES_GEO_GRID\\\"},\\\"style\\\":{\\\"isTimeAware\\\":true,\\\"properties\\\":{\\\"fillColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"Yellow to Red\\\",\\\"colorCategory\\\":\\\"palette_0\\\",\\\"field\\\":{\\\"name\\\":\\\"doc_count\\\",\\\"origin\\\":\\\"source\\\"},\\\"fieldMetaOptions\\\":{\\\"isEnabled\\\":false,\\\"sigma\\\":3},\\\"type\\\":\\\"ORDINAL\\\"},\\\"type\\\":\\\"DYNAMIC\\\"},\\\"icon\\\":{\\\"options\\\":{\\\"value\\\":\\\"marker\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"iconOrientation\\\":{\\\"options\\\":{\\\"orientation\\\":0},\\\"type\\\":\\\"STATIC\\\"},\\\"iconSize\\\":{\\\"options\\\":{\\\"size\\\":6},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#FFFFFF\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderSize\\\":{\\\"options\\\":{\\\"size\\\":\\\"SMALL\\\"}},\\\"labelColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#000000\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelSize\\\":{\\\"options\\\":{\\\"size\\\":14},\\\"type\\\":\\\"STATIC\\\"},\\\"labelText\\\":{\\\"options\\\":{\\\"value\\\":\\\"\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#3d3d3d\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineWidth\\\":{\\\"options\\\":{\\\"size\\\":1},\\\"type\\\":\\\"STATIC\\\"},\\\"symbolizeAs\\\":{\\\"options\\\":{\\\"value\\\":\\\"circle\\\"}}},\\\"type\\\":\\\"VECTOR\\\"},\\\"type\\\":\\\"VECTOR\\\",\\\"visible\\\":true}]\",\"mapStateJSON\":\"{\\\"zoom\\\":1.78,\\\"center\\\":{\\\"lon\\\":0,\\\"lat\\\":16.40767},\\\"timeFilters\\\":{\\\"from\\\":\\\"now-24h\\\",\\\"to\\\":\\\"now\\\"},\\\"refreshConfig\\\":{\\\"isPaused\\\":true,\\\"interval\\\":0},\\\"query\\\":{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"},\\\"filters\\\":[],\\\"settings\\\":{\\\"autoFitToDataBounds\\\":false,\\\"backgroundColor\\\":\\\"#ffffff\\\",\\\"disableInteractive\\\":false,\\\"disableTooltipControl\\\":false,\\\"hideToolbarOverlay\\\":false,\\\"hideLayerControl\\\":false,\\\"hideViewControl\\\":false,\\\"initialLocation\\\":\\\"LAST_SAVED_LOCATION\\\",\\\"fixedLocation\\\":{\\\"lat\\\":0,\\\"lon\\\":0,\\\"zoom\\\":2},\\\"browserLocation\\\":{\\\"zoom\\\":2},\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"showScaleControl\\\":false,\\\"showSpatialFilters\\\":true,\\\"showTimesliderToggleButton\\\":true,\\\"spatialFiltersAlpa\\\":0.3,\\\"spatialFiltersFillColor\\\":\\\"#DA8B45\\\",\\\"spatialFiltersLineColor\\\":\\\"#DA8B45\\\"}}\",\"references\":[],\"title\":\"Top Destination Locations by Event [Logs CEF ArcSight]\",\"uiStateJSON\":\"{\\\"isLayerTOCOpen\\\":true,\\\"openTOCDetails\\\":[]}\"},\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":90,\"minLat\":-66.51326,\"minLon\":-90},\"mapCenter\":{\"lat\":16.40767,\"lon\":0,\"zoom\":1.78},\"openTOCDetails\":[]},\"gridData\":{\"h\":12,\"i\":\"c9fd3ece-2bef-4cdc-9f83-ed689b35a17a\",\"w\":24,\"x\":24,\"y\":64},\"panelIndex\":\"c9fd3ece-2bef-4cdc-9f83-ed689b35a17a\",\"type\":\"map\",\"version\":\"8.0.0\"}]", - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-24h", - "timeRestore": true, - "timeTo": "now", - "title": "[Logs CEF ArcSight] Endpoint Overview Dashboard", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b", - "migrationVersion": { - "dashboard": "8.0.0" - }, - "references": [ - { - "id": "cef-9457ee67-895f-4b78-a543-268f9687a745", - "name": "1:panel_1", - "type": "visualization" - }, - { - "id": "cef-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60", - "name": "2:panel_2", - "type": "visualization" - }, - { - "id": "cef-89998099-9a39-44cf-beba-5b97f0524cf9", - "name": "3:panel_3", - "type": "visualization" - }, - { - "id": "cef-718b074e-3dd1-4d03-ba11-7f869cdcd703", - "name": "5:panel_5", - "type": "visualization" - }, - { - "id": "cef-c5120e27-1f8c-41e3-83ee-78ec4d470c2f", - "name": "6:panel_6", - "type": "visualization" - }, - { - "id": "cef-7454c034-c5f3-48fe-8fce-ef4385c80350", - "name": "7:panel_7", - "type": "visualization" - }, - { - "id": "cef-118af639-1f37-4541-a960-5a3ff0613e0e", - "name": "8:panel_8", - "type": "visualization" - }, - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "9:panel_9", - "type": "search" - }, - { - "id": "cef-74d2c072-6dfd-4249-8e63-dc7b0cf3c960", - "name": "10:panel_10", - "type": "visualization" - }, - { - "id": "cef-f57734dd-0f32-42b4-94dd-5d597f6735e1", - "name": "11:panel_11", - "type": "visualization" - }, - { - "id": "cef-295986d4-d2ea-4541-8e82-7dc95c0cd830", - "name": "12:panel_12", - "type": "visualization" - }, - { - "id": "cef-5bf6e4dc-4273-4e1e-a803-04347eebeb53", - "name": "14:panel_14", - "type": "visualization" - }, - { - "id": "cef-677891a1-90c4-4273-b126-f0e54689bd76", - "name": "15:panel_15", - "type": "visualization" - }, - { - "id": "logs-*", - "name": "c9fd3ece-2bef-4cdc-9f83-ed689b35a17a:layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/dashboard/cef-db1e1aca-279e-4ecc-b84e-fe58644f7619.json b/packages/cef/2.0.3/kibana/dashboard/cef-db1e1aca-279e-4ecc-b84e-fe58644f7619.json deleted file mode 100755 index 153645a090..0000000000 --- a/packages/cef/2.0.3/kibana/dashboard/cef-db1e1aca-279e-4ecc-b84e-fe58644f7619.json +++ /dev/null @@ -1,89 +0,0 @@ -{ - "attributes": { - "description": "Suspicious network activity overview via ArcSight", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:cef.log\"},\"version\":true}" - }, - "optionsJSON": "{\"darkTheme\":false}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"Destination Addresses\":\"#E0752D\",\"Destination Ports\":\"#E24D42\"},\"legendOpen\":false}},\"gridData\":{\"h\":12,\"i\":\"1\",\"w\":32,\"x\":0,\"y\":28},\"panelIndex\":\"1\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":12,\"i\":\"2\",\"w\":16,\"x\":0,\"y\":40},\"panelIndex\":\"2\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":12,\"i\":\"3\",\"w\":16,\"x\":16,\"y\":40},\"panelIndex\":\"3\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"5\",\"w\":48,\"x\":0,\"y\":20},\"panelIndex\":\"5\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}},\"gridData\":{\"h\":12,\"i\":\"9\",\"w\":16,\"x\":32,\"y\":28},\"panelIndex\":\"9\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"11\",\"w\":48,\"x\":0,\"y\":12},\"panelIndex\":\"11\",\"panelRefName\":\"panel_11\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"12\",\"w\":24,\"x\":0,\"y\":52},\"panelIndex\":\"12\",\"panelRefName\":\"panel_12\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"13\",\"w\":24,\"x\":24,\"y\":52},\"panelIndex\":\"13\",\"panelRefName\":\"panel_13\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":12,\"i\":\"14\",\"w\":16,\"x\":32,\"y\":40},\"panelIndex\":\"14\",\"panelRefName\":\"panel_14\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":4,\"i\":\"15\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"15\",\"panelRefName\":\"panel_15\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"h\":8,\"i\":\"16\",\"w\":40,\"x\":0,\"y\":4},\"panelIndex\":\"16\",\"panelRefName\":\"panel_16\",\"type\":\"visualization\",\"version\":\"7.3.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(255,255,204)\",\"100 - 200\":\"rgb(253,141,60)\",\"200 - 300\":\"rgb(227,27,28)\",\"300 - 400\":\"rgb(128,0,38)\",\"50 - 100\":\"rgb(254,217,118)\"}}},\"gridData\":{\"h\":8,\"i\":\"17\",\"w\":8,\"x\":40,\"y\":4},\"panelIndex\":\"17\",\"panelRefName\":\"panel_17\",\"type\":\"visualization\",\"version\":\"7.3.0\"}]", - "refreshInterval": { - "display": "Off", - "pause": false, - "value": 0 - }, - "timeFrom": "now-24h", - "timeRestore": true, - "timeTo": "now", - "title": "[Logs CEF ArcSight] Network Suspicious Activity Dashboard", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-db1e1aca-279e-4ecc-b84e-fe58644f7619", - "migrationVersion": { - "dashboard": "8.0.0" - }, - "references": [ - { - "id": "cef-fa8b26c1-6973-4381-adb3-bcde0d03a520", - "name": "1:panel_1", - "type": "visualization" - }, - { - "id": "cef-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1", - "name": "2:panel_2", - "type": "visualization" - }, - { - "id": "cef-f03d734b-b85c-4e99-9c0e-9c89716a81f3", - "name": "3:panel_3", - "type": "visualization" - }, - { - "id": "cef-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d", - "name": "5:panel_5", - "type": "visualization" - }, - { - "id": "cef-fff249b2-18b6-4b48-bcf7-dd4595d111e7", - "name": "9:panel_9", - "type": "visualization" - }, - { - "id": "cef-d02dd523-ce91-40e9-9209-83797f80ed45", - "name": "11:panel_11", - "type": "visualization" - }, - { - "id": "cef-589fec8c-336e-4122-8fef-a450bddf84f6", - "name": "12:panel_12", - "type": "visualization" - }, - { - "id": "cef-86bd5f13-ca6b-43fa-b209-54e7460344bb", - "name": "13:panel_13", - "type": "visualization" - }, - { - "id": "cef-1204cf27-05e0-4905-bfa1-688aaaaaa840", - "name": "14:panel_14", - "type": "visualization" - }, - { - "id": "cef-677891a1-90c4-4273-b126-f0e54689bd76", - "name": "15:panel_15", - "type": "visualization" - }, - { - "id": "cef-01c3618c-9962-4fe9-b9c5-f73dfecc6eba", - "name": "16:panel_16", - "type": "visualization" - }, - { - "id": "cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db", - "name": "17:panel_17", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/dashboard/cef-dd0bc9af-2e89-4150-9b42-62517ea56b71.json b/packages/cef/2.0.3/kibana/dashboard/cef-dd0bc9af-2e89-4150-9b42-62517ea56b71.json deleted file mode 100755 index 9c26408568..0000000000 --- a/packages/cef/2.0.3/kibana/dashboard/cef-dd0bc9af-2e89-4150-9b42-62517ea56b71.json +++ /dev/null @@ -1,113 +0,0 @@ -{ - "attributes": { - "description": "Network data overview via ArcSight", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:cef.log\"},\"version\":true}" - }, - "optionsJSON": "{\"darkTheme\":false}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"1\",\"w\":48,\"x\":0,\"y\":44},\"panelIndex\":\"1\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"2\",\"w\":48,\"x\":0,\"y\":68},\"panelIndex\":\"2\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"5\",\"w\":48,\"x\":0,\"y\":12},\"panelIndex\":\"5\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"6\",\"w\":48,\"x\":0,\"y\":60},\"panelIndex\":\"6\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"},\"legendOpen\":false}},\"gridData\":{\"h\":8,\"i\":\"7\",\"w\":40,\"x\":0,\"y\":4},\"panelIndex\":\"7\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}},\"gridData\":{\"h\":12,\"i\":\"9\",\"w\":16,\"x\":0,\"y\":20},\"panelIndex\":\"9\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"/Attempt\":\"#0A50A1\",\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}},\"gridData\":{\"h\":12,\"i\":\"11\",\"w\":16,\"x\":16,\"y\":20},\"panelIndex\":\"11\",\"panelRefName\":\"panel_11\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":12,\"i\":\"13\",\"w\":32,\"x\":0,\"y\":32},\"panelIndex\":\"13\",\"panelRefName\":\"panel_13\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0% - 17%\":\"rgb(255,255,204)\",\"17% - 34%\":\"rgb(255,230,146)\",\"34% - 50%\":\"rgb(254,191,90)\",\"50% - 67%\":\"rgb(253,141,60)\",\"67% - 84%\":\"rgb(244,61,37)\",\"84% - 100%\":\"rgb(202,8,35)\"},\"legendOpen\":false}},\"gridData\":{\"h\":12,\"i\":\"15\",\"w\":16,\"x\":32,\"y\":32},\"panelIndex\":\"15\",\"panelRefName\":\"panel_15\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"colors\":{\"Anti-Virus\":\"#EF843C\",\"Content Security\":\"#7EB26D\",\"Firewall\":\"#E24D42\",\"Integrated Security\":\"#962D82\",\"Network-based IDS/IPS\":\"#1F78C1\",\"Operating System\":\"#1F78C1\",\"VPN\":\"#EAB839\"}}},\"gridData\":{\"h\":12,\"i\":\"16\",\"w\":16,\"x\":32,\"y\":20},\"panelIndex\":\"16\",\"panelRefName\":\"panel_16\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"17\",\"w\":48,\"x\":0,\"y\":52},\"panelIndex\":\"17\",\"panelRefName\":\"panel_17\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"h\":16,\"i\":\"18\",\"w\":24,\"x\":0,\"y\":76},\"panelIndex\":\"18\",\"panelRefName\":\"panel_18\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"19\",\"w\":24,\"x\":24,\"y\":76},\"panelIndex\":\"19\",\"panelRefName\":\"panel_19\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":8,\"i\":\"20\",\"w\":8,\"x\":40,\"y\":4},\"panelIndex\":\"20\",\"panelRefName\":\"panel_20\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":4,\"i\":\"21\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"21\",\"panelRefName\":\"panel_21\",\"type\":\"visualization\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"attributes\":{\"description\":\"\",\"layerListJSON\":\"[{\\\"sourceDescriptor\\\":{\\\"type\\\":\\\"EMS_TMS\\\",\\\"isAutoSelect\\\":true,\\\"lightModeDefault\\\":\\\"road_map_desaturated\\\"},\\\"id\\\":\\\"c6a1fd07-de0f-444b-8814-902cbf2d019a\\\",\\\"label\\\":null,\\\"minZoom\\\":0,\\\"maxZoom\\\":24,\\\"alpha\\\":1,\\\"visible\\\":true,\\\"style\\\":{\\\"type\\\":\\\"TILE\\\"},\\\"includeInFitToBounds\\\":true,\\\"type\\\":\\\"VECTOR_TILE\\\"},{\\\"alpha\\\":0.75,\\\"id\\\":\\\"c1643919-b9de-4588-826f-93710a159e2b\\\",\\\"includeInFitToBounds\\\":true,\\\"joins\\\":[],\\\"label\\\":\\\"Top Destination Locations by Events [Logs CEF ArcSight]\\\",\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"sourceDescriptor\\\":{\\\"applyForceRefresh\\\":true,\\\"applyGlobalQuery\\\":true,\\\"applyGlobalTime\\\":true,\\\"geoField\\\":\\\"destination.geo.location\\\",\\\"id\\\":\\\"5183bb72-a077-4cf0-8aba-561a15b012cf\\\",\\\"indexPatternId\\\":\\\"logs-*\\\",\\\"metrics\\\":[{\\\"type\\\":\\\"count\\\"}],\\\"requestType\\\":\\\"point\\\",\\\"resolution\\\":\\\"MOST_FINE\\\",\\\"type\\\":\\\"ES_GEO_GRID\\\"},\\\"style\\\":{\\\"isTimeAware\\\":true,\\\"properties\\\":{\\\"fillColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"Yellow to Red\\\",\\\"colorCategory\\\":\\\"palette_0\\\",\\\"field\\\":{\\\"name\\\":\\\"doc_count\\\",\\\"origin\\\":\\\"source\\\"},\\\"fieldMetaOptions\\\":{\\\"isEnabled\\\":false,\\\"sigma\\\":3},\\\"type\\\":\\\"ORDINAL\\\"},\\\"type\\\":\\\"DYNAMIC\\\"},\\\"icon\\\":{\\\"options\\\":{\\\"value\\\":\\\"marker\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"iconOrientation\\\":{\\\"options\\\":{\\\"orientation\\\":0},\\\"type\\\":\\\"STATIC\\\"},\\\"iconSize\\\":{\\\"options\\\":{\\\"size\\\":6},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#FFFFFF\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderSize\\\":{\\\"options\\\":{\\\"size\\\":\\\"SMALL\\\"}},\\\"labelColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#000000\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelSize\\\":{\\\"options\\\":{\\\"size\\\":14},\\\"type\\\":\\\"STATIC\\\"},\\\"labelText\\\":{\\\"options\\\":{\\\"value\\\":\\\"\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#3d3d3d\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineWidth\\\":{\\\"options\\\":{\\\"size\\\":1},\\\"type\\\":\\\"STATIC\\\"},\\\"symbolizeAs\\\":{\\\"options\\\":{\\\"value\\\":\\\"circle\\\"}}},\\\"type\\\":\\\"VECTOR\\\"},\\\"type\\\":\\\"VECTOR\\\",\\\"visible\\\":true}]\",\"mapStateJSON\":\"{\\\"zoom\\\":1.78,\\\"center\\\":{\\\"lon\\\":0,\\\"lat\\\":16.40767},\\\"timeFilters\\\":{\\\"from\\\":\\\"now-24h\\\",\\\"to\\\":\\\"now\\\"},\\\"refreshConfig\\\":{\\\"isPaused\\\":true,\\\"interval\\\":0},\\\"query\\\":{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"},\\\"filters\\\":[],\\\"settings\\\":{\\\"autoFitToDataBounds\\\":false,\\\"backgroundColor\\\":\\\"#ffffff\\\",\\\"disableInteractive\\\":false,\\\"disableTooltipControl\\\":false,\\\"hideToolbarOverlay\\\":false,\\\"hideLayerControl\\\":false,\\\"hideViewControl\\\":false,\\\"initialLocation\\\":\\\"LAST_SAVED_LOCATION\\\",\\\"fixedLocation\\\":{\\\"lat\\\":0,\\\"lon\\\":0,\\\"zoom\\\":2},\\\"browserLocation\\\":{\\\"zoom\\\":2},\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"showScaleControl\\\":false,\\\"showSpatialFilters\\\":true,\\\"showTimesliderToggleButton\\\":true,\\\"spatialFiltersAlpa\\\":0.3,\\\"spatialFiltersFillColor\\\":\\\"#DA8B45\\\",\\\"spatialFiltersLineColor\\\":\\\"#DA8B45\\\"}}\",\"references\":[],\"title\":\"Top Destination Locations by Events [Logs CEF ArcSight]\",\"uiStateJSON\":\"{\\\"isLayerTOCOpen\\\":true,\\\"openTOCDetails\\\":[]}\"},\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":90,\"minLat\":-66.51326,\"minLon\":-90},\"mapCenter\":{\"lat\":16.40767,\"lon\":0,\"zoom\":1.78},\"openTOCDetails\":[]},\"gridData\":{\"h\":24,\"i\":\"49de47fb-1382-4009-89d2-b96a4161e12d\",\"w\":24,\"x\":0,\"y\":92},\"panelIndex\":\"49de47fb-1382-4009-89d2-b96a4161e12d\",\"type\":\"map\",\"version\":\"8.0.0\"},{\"embeddableConfig\":{\"attributes\":{\"description\":\"\",\"layerListJSON\":\"[{\\\"sourceDescriptor\\\":{\\\"type\\\":\\\"EMS_TMS\\\",\\\"isAutoSelect\\\":true,\\\"lightModeDefault\\\":\\\"road_map_desaturated\\\"},\\\"id\\\":\\\"c2329af2-2183-45cb-9f40-d0f2e984c5b3\\\",\\\"label\\\":null,\\\"minZoom\\\":0,\\\"maxZoom\\\":24,\\\"alpha\\\":1,\\\"visible\\\":true,\\\"style\\\":{\\\"type\\\":\\\"TILE\\\"},\\\"includeInFitToBounds\\\":true,\\\"type\\\":\\\"VECTOR_TILE\\\"},{\\\"alpha\\\":0.75,\\\"id\\\":\\\"1fc250c2-4990-401e-b709-61e1f4824005\\\",\\\"includeInFitToBounds\\\":true,\\\"joins\\\":[],\\\"label\\\":\\\"Top Source Locations by Events [Logs CEF ArcSight]\\\",\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"sourceDescriptor\\\":{\\\"applyForceRefresh\\\":true,\\\"applyGlobalQuery\\\":true,\\\"applyGlobalTime\\\":true,\\\"geoField\\\":\\\"source.geo.location\\\",\\\"id\\\":\\\"e1eda4fd-94b9-4c31-9615-70334517a966\\\",\\\"indexPatternId\\\":\\\"logs-*\\\",\\\"metrics\\\":[{\\\"type\\\":\\\"count\\\"}],\\\"requestType\\\":\\\"point\\\",\\\"resolution\\\":\\\"MOST_FINE\\\",\\\"type\\\":\\\"ES_GEO_GRID\\\"},\\\"style\\\":{\\\"isTimeAware\\\":true,\\\"properties\\\":{\\\"fillColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"Yellow to Red\\\",\\\"colorCategory\\\":\\\"palette_0\\\",\\\"field\\\":{\\\"name\\\":\\\"doc_count\\\",\\\"origin\\\":\\\"source\\\"},\\\"fieldMetaOptions\\\":{\\\"isEnabled\\\":false,\\\"sigma\\\":3},\\\"type\\\":\\\"ORDINAL\\\"},\\\"type\\\":\\\"DYNAMIC\\\"},\\\"icon\\\":{\\\"options\\\":{\\\"value\\\":\\\"marker\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"iconOrientation\\\":{\\\"options\\\":{\\\"orientation\\\":0},\\\"type\\\":\\\"STATIC\\\"},\\\"iconSize\\\":{\\\"options\\\":{\\\"size\\\":6},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#FFFFFF\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelBorderSize\\\":{\\\"options\\\":{\\\"size\\\":\\\"SMALL\\\"}},\\\"labelColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#000000\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"labelSize\\\":{\\\"options\\\":{\\\"size\\\":14},\\\"type\\\":\\\"STATIC\\\"},\\\"labelText\\\":{\\\"options\\\":{\\\"value\\\":\\\"\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineColor\\\":{\\\"options\\\":{\\\"color\\\":\\\"#3d3d3d\\\"},\\\"type\\\":\\\"STATIC\\\"},\\\"lineWidth\\\":{\\\"options\\\":{\\\"size\\\":1},\\\"type\\\":\\\"STATIC\\\"},\\\"symbolizeAs\\\":{\\\"options\\\":{\\\"value\\\":\\\"circle\\\"}}},\\\"type\\\":\\\"VECTOR\\\"},\\\"type\\\":\\\"VECTOR\\\",\\\"visible\\\":true}]\",\"mapStateJSON\":\"{\\\"zoom\\\":1.78,\\\"center\\\":{\\\"lon\\\":0,\\\"lat\\\":16.40767},\\\"timeFilters\\\":{\\\"from\\\":\\\"now-24h\\\",\\\"to\\\":\\\"now\\\"},\\\"refreshConfig\\\":{\\\"isPaused\\\":true,\\\"interval\\\":0},\\\"query\\\":{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"},\\\"filters\\\":[],\\\"settings\\\":{\\\"autoFitToDataBounds\\\":false,\\\"backgroundColor\\\":\\\"#ffffff\\\",\\\"disableInteractive\\\":false,\\\"disableTooltipControl\\\":false,\\\"hideToolbarOverlay\\\":false,\\\"hideLayerControl\\\":false,\\\"hideViewControl\\\":false,\\\"initialLocation\\\":\\\"LAST_SAVED_LOCATION\\\",\\\"fixedLocation\\\":{\\\"lat\\\":0,\\\"lon\\\":0,\\\"zoom\\\":2},\\\"browserLocation\\\":{\\\"zoom\\\":2},\\\"maxZoom\\\":24,\\\"minZoom\\\":0,\\\"showScaleControl\\\":false,\\\"showSpatialFilters\\\":true,\\\"showTimesliderToggleButton\\\":true,\\\"spatialFiltersAlpa\\\":0.3,\\\"spatialFiltersFillColor\\\":\\\"#DA8B45\\\",\\\"spatialFiltersLineColor\\\":\\\"#DA8B45\\\"}}\",\"references\":[],\"title\":\"Top Source Locations by Events [Logs CEF ArcSight]\",\"uiStateJSON\":\"{\\\"isLayerTOCOpen\\\":true,\\\"openTOCDetails\\\":[]}\"},\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":90,\"minLat\":-66.51326,\"minLon\":-90},\"mapCenter\":{\"lat\":16.40767,\"lon\":0,\"zoom\":1.78},\"openTOCDetails\":[]},\"gridData\":{\"h\":24,\"i\":\"9d097034-9ebb-4f53-ad39-e42e625b541c\",\"w\":24,\"x\":24,\"y\":92},\"panelIndex\":\"9d097034-9ebb-4f53-ad39-e42e625b541c\",\"type\":\"map\",\"version\":\"8.0.0\"}]", - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-24h", - "timeRestore": true, - "timeTo": "now", - "title": "[Logs CEF ArcSight] Network Overview Dashboard", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-dd0bc9af-2e89-4150-9b42-62517ea56b71", - "migrationVersion": { - "dashboard": "8.0.0" - }, - "references": [ - { - "id": "cef-f5258de9-71f7-410f-b713-201007f77470", - "name": "1:panel_1", - "type": "visualization" - }, - { - "id": "cef-0abfc226-535b-45a2-b534-e9bc87e5584f", - "name": "2:panel_2", - "type": "visualization" - }, - { - "id": "cef-a97e3628-022b-46cf-8f29-a73cf9bb4e26", - "name": "5:panel_5", - "type": "visualization" - }, - { - "id": "cef-499f50ba-2f84-4f7c-9021-73a4efc47921", - "name": "6:panel_6", - "type": "visualization" - }, - { - "id": "cef-d061c7a9-7f92-4bf4-b35c-499b9f4b987a", - "name": "7:panel_7", - "type": "visualization" - }, - { - "id": "cef-b1002b5c-08fc-4bbe-b9a0-6243a8637e60", - "name": "9:panel_9", - "type": "visualization" - }, - { - "id": "cef-df056709-2deb-4363-ae7a-b0148ea456c6", - "name": "11:panel_11", - "type": "visualization" - }, - { - "id": "cef-e89a64e8-928c-41fc-8745-3c8157b21cdb", - "name": "13:panel_13", - "type": "visualization" - }, - { - "id": "cef-a729c249-8d34-4eb1-bbb0-5d25cf224114", - "name": "15:panel_15", - "type": "visualization" - }, - { - "id": "cef-3c19f138-2ab3-4ecb-bb1b-86fb90158042", - "name": "16:panel_16", - "type": "visualization" - }, - { - "id": "cef-e513c269-350c-40c3-ac20-16c5782103b8", - "name": "17:panel_17", - "type": "visualization" - }, - { - "id": "cef-8f6075c5-f525-4173-92a4-3a56e96e362d", - "name": "18:panel_18", - "type": "visualization" - }, - { - "id": "cef-013ff153-7b80-490b-8fec-6e56cba785ed", - "name": "19:panel_19", - "type": "visualization" - }, - { - "id": "cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db", - "name": "20:panel_20", - "type": "visualization" - }, - { - "id": "cef-c394e650-b16c-407c-b305-bd409d69d433", - "name": "21:panel_21", - "type": "visualization" - }, - { - "id": "logs-*", - "name": "49de47fb-1382-4009-89d2-b96a4161e12d:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9d097034-9ebb-4f53-ad39-e42e625b541c:layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/search/cef-5cede2d3-20fe-4140-add4-4c4f841b71a2.json b/packages/cef/2.0.3/kibana/search/cef-5cede2d3-20fe-4140-add4-4c4f841b71a2.json deleted file mode 100755 index cf5b2ee7e4..0000000000 --- a/packages/cef/2.0.3/kibana/search/cef-5cede2d3-20fe-4140-add4-4c4f841b71a2.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "attributes": { - "columns": [ - "cef.extensions.categoryDeviceGroup", - "cef.extensions.categoryTechnique", - "cef.extensions.categoryOutcome", - "cef.extensions.categorySignificance", - "cef.extensions.categoryObject", - "cef.extensions.categoryBehavior", - "cef.extensions.categoryDeviceType" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Host\\\" OR cef.extensions.categoryDeviceGroup:\\\"/Application\\\"\"}},\"version\":true}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Endpoint Event Explorer [Logs CEF ArcSight]", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "migrationVersion": { - "search": "8.0.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/search/cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8.json b/packages/cef/2.0.3/kibana/search/cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8.json deleted file mode 100755 index dad033d27d..0000000000 --- a/packages/cef/2.0.3/kibana/search/cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8.json +++ /dev/null @@ -1,52 +0,0 @@ -{ - "attributes": { - "columns": [ - "priority", - "message", - "source.ip", - "source.port", - "destination.ip", - "destination.port", - "network.application", - "message", - "cef.extensions.categoryBehavior", - "cef.extensions.categoryOutcome", - "cef.extensions.deviceAddress", - "cef.device.product", - "cef.device.vendor", - "cef.extensions.categoryDeviceGroup", - "cef.extensions.categoryDeviceType" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"query\",\"negate\":false,\"type\":\"custom\",\"value\":\"{\\\"terms\\\":{\\\"cef.extensions.categoryDeviceGroup\\\":[\\\"/VPN\\\",\\\"/IDS/Network\\\",\\\"/Firewall\\\"]}}\"},\"query\":{\"terms\":{\"cef.extensions.categoryDeviceGroup\":[\"/VPN\",\"/IDS/Network\",\"/Firewall\"]}}}],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"version\":true}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Network Events [Logs CEF ArcSight]", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "migrationVersion": { - "search": "8.0.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/search/cef-e6cf2383-71f4-4db1-a791-1a7d4f110194.json b/packages/cef/2.0.3/kibana/search/cef-e6cf2383-71f4-4db1-a791-1a7d4f110194.json deleted file mode 100755 index 9082a5e861..0000000000 --- a/packages/cef/2.0.3/kibana/search/cef-e6cf2383-71f4-4db1-a791-1a7d4f110194.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "attributes": { - "columns": [ - "cef.device.vendor", - "cef.device.product", - "message", - "cef.device.event_class_id", - "cef.extensions.deviceEventCategory", - "source.user.name", - "destination.user.name", - "destination.domain", - "cef.extensions.categoryBehavior", - "cef.extensions.categoryOutcome", - "cef.extensions.sourceNtDomain", - "cef.extensions.destinationNtDomain" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\"\"}},\"version\":true}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Endpoint - OS Events [Logs CEF ArcSight]", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "migrationVersion": { - "search": "8.0.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/search/cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3.json b/packages/cef/2.0.3/kibana/search/cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3.json deleted file mode 100755 index 74d6b3c820..0000000000 --- a/packages/cef/2.0.3/kibana/search/cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "attributes": { - "columns": [ - "cef.device.vendor", - "cef.device.product", - "cef.extensions.categoryBehavior", - "cef.extensions.categoryOutcome", - "destination.ip", - "destination.port", - "destination.domain", - "cef.device.event_class_id", - "cef.extensions.deviceCustomString1Label", - "cef.extensions.deviceCustomString1", - "cef.extensions.deviceCustomString2Label", - "cef.extensions.deviceCustomString2", - "cef.extension.deviceCustomString3Label", - "cef.extension.deviceCustomString3", - "cef.extension.deviceCustomString4Label", - "cef.extension.deviceCustomString4", - "cef.extensions.deviceEventCategory", - "event.severity", - "source.ip", - "source.port", - "network.transport", - "source.bytes", - "url.original" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"cef.device.product:\\\"DNS Trace Log\\\"\"}},\"version\":true}" - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Microsoft DNS Events [Logs CEF ArcSight]", - "version": 1 - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "migrationVersion": { - "search": "8.0.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-013ff153-7b80-490b-8fec-6e56cba785ed.json b/packages/cef/2.0.3/kibana/visualization/cef-013ff153-7b80-490b-8fec-6e56cba785ed.json deleted file mode 100755 index f7372f962e..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-013ff153-7b80-490b-8fec-6e56cba785ed.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 20 Source Countries [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"source.geo.country_iso_code\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":26,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"square root\"},\"title\":\"Top 20 Source Countries [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-013ff153-7b80-490b-8fec-6e56cba785ed", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-01c3618c-9962-4fe9-b9c5-f73dfecc6eba.json b/packages/cef/2.0.3/kibana/visualization/cef-01c3618c-9962-4fe9-b9c5-f73dfecc6eba.json deleted file mode 100755 index e4e3fbc58d..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-01c3618c-9962-4fe9-b9c5-f73dfecc6eba.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Device Metrics Overview [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"8\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Devices\",\"field\":\"observer.hostname\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Sources\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Destinations\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"7\",\"params\":{\"customLabel\":\"Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"30\",\"gauge\":{\"autoExtend\":false,\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"gaugeColorMode\":\"None\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Metric\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":false,\"width\":2},\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":\"12\",\"labelColor\":false,\"subText\":\"\"},\"type\":\"simple\",\"useRange\":false,\"verticalSplit\":false},\"handleNoResults\":true,\"type\":\"gauge\"},\"title\":\"Device Metrics Overview [Logs CEF ArcSight]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-01c3618c-9962-4fe9-b9c5-f73dfecc6eba", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-0abfc226-535b-45a2-b534-e9bc87e5584f.json b/packages/cef/2.0.3/kibana/visualization/cef-0abfc226-535b-45a2-b534-e9bc87e5584f.json deleted file mode 100755 index bec9522083..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-0abfc226-535b-45a2-b534-e9bc87e5584f.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Bandwidth Utilization [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color\":null,\"bar_color_rules\":[{\"id\":\"23db5bf6-f787-474e-86ab-76362432e984\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"kuery\",\"query\":\"\"},\"id\":\"ec53a1d3-213c-4b0f-a074-5005a84cdb83\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"bytes\",\"id\":\"d27f09dc-b07e-493f-a223-a85033ad6548\",\"label\":\"Inbound\",\"line_width\":1,\"metrics\":[{\"field\":\"source.bytes\",\"id\":\"9ce9ec3a-2f11-4935-91b2-531494d2a619\",\"type\":\"sum\"}],\"override_index_pattern\":1,\"point_size\":1,\"seperate_axis\":0,\"series_drop_last_bucket\":1,\"series_index_pattern\":\"logs-*\",\"series_time_field\":\"@timestamp\",\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"terms_field\":\"observer.hostname\",\"terms_order_by\":\"_count\"},{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(244,78,59,1)\",\"fill\":0.5,\"formatter\":\"bytes\",\"id\":\"b1ef2c75-5916-469d-8790-5b213367a5a0\",\"label\":\"Outbound\",\"line_width\":1,\"metrics\":[{\"field\":\"destination.bytes\",\"id\":\"11b1852f-9b62-4e96-8128-522e6c5bf16d\",\"type\":\"sum\"},{\"id\":\"2a6b00bf-1658-4d02-b4e2-61ad6e4c3a9b\",\"script\":\"params.outbound \\u003e 0 ? params.outbound * -1 : 0\",\"type\":\"calculation\",\"variables\":[{\"field\":\"11b1852f-9b62-4e96-8128-522e6c5bf16d\",\"id\":\"c57067f2-2927-41d8-97f4-9f47b3b3bcae\",\"name\":\"outbound\"}]}],\"override_index_pattern\":1,\"point_size\":1,\"seperate_axis\":0,\"series_drop_last_bucket\":1,\"series_index_pattern\":\"logs-*\",\"series_time_field\":\"@timestamp\",\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"steps\":0}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Bandwidth Utilization [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-0abfc226-535b-45a2-b534-e9bc87e5584f", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-0f4028b2-3dc2-4cb6-80d8-285c847a02a1.json b/packages/cef/2.0.3/kibana/visualization/cef-0f4028b2-3dc2-4cb6-80d8-285c847a02a1.json deleted file mode 100755 index 702933c209..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-0f4028b2-3dc2-4cb6-80d8-285c847a02a1.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Outcomes [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\"\"},\"id\":\"74716d29-91c6-4095-bc7d-7f6700f12b1f\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(244,78,59,1)\",\"fill\":\"0\",\"formatter\":\"number\",\"hide_in_legend\":0,\"id\":\"932c5de4-f841-4f27-99e4-60d95d3aa16c\",\"label\":\"Event Outcomes\",\"line_width\":\"3\",\"metrics\":[{\"id\":\"4c263b6d-8117-43c6-b83f-5c4145f43cfc\",\"type\":\"count\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryOutcome:\\\"/Failure\\\"\"},\"id\":\"94371b84-a7aa-4824-b4d1-217ecbe725a5\",\"label\":\"Failure\"},{\"color\":\"rgba(104,188,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryOutcome:\\\"/Success\\\"\"},\"id\":\"31564794-9278-4f2e-bb20-557f5cfbea79\",\"label\":\"Success\"},{\"color\":\"rgba(251,158,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryOutcome:\\\"/Attempt\\\"\"},\"id\":\"10c0f919-0853-41b5-94b4-2e39932e7aa0\",\"label\":\"Attempt\"}],\"split_mode\":\"filters\",\"stacked\":\"none\",\"terms_field\":\"cef.extensions.categoryOutcome\",\"terms_size\":\"3\"},{\"axis_position\":\"left\",\"chart_type\":\"bar\",\"color\":\"rgba(104,182,204,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"c9eca9d0-c2e0-45e6-a3ce-f158c40fdd74\",\"label\":\"Event Count\",\"line_width\":1,\"metrics\":[{\"id\":\"6d8513ca-cc72-4b27-91b6-6b689558cdcb\",\"type\":\"count\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Outcomes [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-0f4028b2-3dc2-4cb6-80d8-285c847a02a1", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-118af639-1f37-4541-a960-5a3ff0613e0e.json b/packages/cef/2.0.3/kibana/visualization/cef-118af639-1f37-4541-a960-5a3ff0613e0e.json deleted file mode 100755 index bba67eb563..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-118af639-1f37-4541-a960-5a3ff0613e0e.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Outcomes by Device Type [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"/Failure\":\"#BF1B00\"},\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"cef.extensions.categoryDeviceType\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"cef.extensions.categoryDeviceType: Descending\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":75,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"value\"}]},\"title\":\"Outcomes by Device Type [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-118af639-1f37-4541-a960-5a3ff0613e0e", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-1204cf27-05e0-4905-bfa1-688aaaaaa840.json b/packages/cef/2.0.3/kibana/visualization/cef-1204cf27-05e0-4905-bfa1-688aaaaaa840.json deleted file mode 100755 index 1f0e2fde5c..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-1204cf27-05e0-4905-bfa1-688aaaaaa840.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Destination Ports [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Addresses\",\"field\":\"destination.port\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Destination Ports [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-1204cf27-05e0-4905-bfa1-688aaaaaa840", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-158d809a-89db-4ffa-88a1-eb5c4bf58d50.json b/packages/cef/2.0.3/kibana/visualization/cef-158d809a-89db-4ffa-88a1-eb5c4bf58d50.json deleted file mode 100755 index ec2f257b88..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-158d809a-89db-4ffa-88a1-eb5c4bf58d50.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Endpoint OS Metrics Overview [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total Events\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Devices\",\"field\":\"observer.hostname\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"7\",\"params\":{\"customLabel\":\"Event Types\",\"field\":\"cef.extensions.categoryBehavior\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"8\",\"params\":{\"customLabel\":\"Event Outcomes\",\"field\":\"cef.extensions.categoryOutcome\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"30\",\"gauge\":{\"autoExtend\":false,\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"gaugeColorMode\":\"None\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Metric\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":false,\"width\":2},\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":\"20\",\"labelColor\":false,\"subText\":\"\"},\"type\":\"simple\",\"useRange\":false,\"verticalSplit\":false},\"handleNoResults\":true,\"type\":\"gauge\"},\"title\":\"Endpoint OS Metrics Overview [Logs CEF ArcSight]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-158d809a-89db-4ffa-88a1-eb5c4bf58d50", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0.json b/packages/cef/2.0.3/kibana/visualization/cef-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0.json deleted file mode 100755 index a3f9d219f4..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Direction [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.device.product:\\\"DNS Trace Log\\\"\"},\"id\":\"be556a57-cd1c-496c-8714-0bd210947c85\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"bar\",\"color\":\"#68BC00\",\"fill\":\"0.2\",\"filter\":{\"language\":\"lucene\",\"query\":\"device\"},\"formatter\":\"number\",\"id\":\"9aae7344-9de9-4378-b21d-296cb964f93b\",\"label\":\"Inbound Requests\",\"line_width\":1,\"metrics\":[{\"id\":\"1cd0b964-45cf-408e-a7e4-e26955f8a3b0\",\"type\":\"count\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(0,156,224,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"deviceDirection:\\\"0\\\"\"},\"id\":\"f860f6e0-fbd4-4949-8046-6300322dfe84\",\"label\":\"Inbound Requests\"}],\"split_mode\":\"filters\",\"stacked\":\"none\"},{\"axis_position\":\"right\",\"chart_type\":\"bar\",\"color\":\"#68BC00\",\"fill\":\"0.2\",\"formatter\":\"number\",\"id\":\"ed1abe18-e01b-4202-9db4-06fda10692e0\",\"label\":\"Outbound Requests\",\"line_width\":1,\"metrics\":[{\"id\":\"cfbcfc79-394b-4ec0-a2c2-7a47177d6469\",\"type\":\"count\"},{\"id\":\"6bc37118-ddac-41ec-85b3-9db7e1b3636b\",\"script\":\"params.outbound \\u003e 0 ? params.outbound * -1 : 0\",\"type\":\"calculation\",\"variables\":[{\"field\":\"cfbcfc79-394b-4ec0-a2c2-7a47177d6469\",\"id\":\"f73f4f22-03d5-446a-b031-04eee531e3cc\",\"name\":\"outbound\"}]}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(211,49,21,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"deviceDirection:\\\"1\\\"\"},\"id\":\"a9c50e1b-8f11-4bc2-9077-bb8870ed0b62\",\"label\":\"Outbound Requests\"}],\"split_mode\":\"filters\",\"stacked\":\"none\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Direction [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-16aef3e9-e33b-4bab-b32f-d8c5b1263ac0", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-1b521f56-8089-433f-88f7-56aba867e07d.json b/packages/cef/2.0.3/kibana/visualization/cef-1b521f56-8089-433f-88f7-56aba867e07d.json deleted file mode 100755 index db7522dd38..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-1b521f56-8089-433f-88f7-56aba867e07d.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top Destinations by Events [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"autoPrecision\":true,\"field\":\"destination.geo.location\",\"precision\":2,\"useGeocentroid\":true},\"schema\":\"segment\",\"type\":\"geohash_grid\"}],\"listeners\":{},\"params\":{\"addTooltip\":true,\"heatBlur\":15,\"heatMaxZoom\":0,\"heatMinOpacity\":0.1,\"heatRadius\":25,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapType\":\"Shaded Circle Markers\",\"mapZoom\":2,\"wms\":{\"enabled\":false,\"options\":{\"attribution\":\"Maps provided by USGS\",\"format\":\"image/png\",\"layers\":\"0\",\"styles\":\"\",\"transparent\":true,\"version\":\"1.3.0\"},\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\"}},\"title\":\"Top Destinations by Events [Logs CEF ArcSight]\",\"type\":\"tile_map\"}" - }, - "id": "cef-1b521f56-8089-433f-88f7-56aba867e07d", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-1b9cc5b7-7747-49de-96b1-a4bc7f675716.json b/packages/cef/2.0.3/kibana/visualization/cef-1b9cc5b7-7747-49de-96b1-a4bc7f675716.json deleted file mode 100755 index 6c04dc9028..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-1b9cc5b7-7747-49de-96b1-a4bc7f675716.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Destinations by Size [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destinations\",\"field\":\"destination.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Bytes\",\"field\":\"source.bytes\"},\"schema\":\"metric\",\"type\":\"sum\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Sources\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 10 Destinations by Size [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-1b9cc5b7-7747-49de-96b1-a4bc7f675716", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-249e2737-b41f-4115-b303-88bc9d279655.json b/packages/cef/2.0.3/kibana/visualization/cef-249e2737-b41f-4115-b303-88bc9d279655.json deleted file mode 100755 index 3b90350ff6..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-249e2737-b41f-4115-b303-88bc9d279655.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "DNS Metrics Overview [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threads\",\"field\":\"cef.extensions.deviceCustomString1\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"OpCodes\",\"field\":\"cef.extensions.deviceCustomString2\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Activity Types\",\"field\":\"cef.device.event_class_id\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":false,\"addTooltip\":true,\"gauge\":{\"autoExtend\":false,\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"gaugeColorMode\":\"None\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Metric\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":false,\"width\":2},\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":\"32\",\"labelColor\":false,\"subText\":\"\"},\"type\":\"simple\",\"useRange\":false,\"verticalSplit\":false},\"type\":\"gauge\"},\"title\":\"DNS Metrics Overview [Logs CEF ArcSight]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-249e2737-b41f-4115-b303-88bc9d279655", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-26a65f68-d7a6-4b47-befc-c5a6819bb91b.json b/packages/cef/2.0.3/kibana/visualization/cef-26a65f68-d7a6-4b47-befc-c5a6819bb91b.json deleted file mode 100755 index 401dfbed0a..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-26a65f68-d7a6-4b47-befc-c5a6819bb91b.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Sources by Size [Logs CEF ArcSight]", - "uiStateJSON": "{\"P-11\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-13\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-2\":{\"mapCenter\":[-0.17578097424708533,0],\"mapZoom\":0},\"P-3\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"P-4\":{\"mapCenter\":[-0.17578097424708533,0],\"mapZoom\":0},\"P-5\":{\"vis\":{\"defaultColors\":{\"0 - 18,000\":\"rgb(247,251,255)\",\"108,000 - 126,000\":\"rgb(74,152,201)\",\"126,000 - 144,000\":\"rgb(46,126,188)\",\"144,000 - 162,000\":\"rgb(23,100,171)\",\"162,000 - 180,000\":\"rgb(8,74,145)\",\"18,000 - 36,000\":\"rgb(227,238,249)\",\"36,000 - 54,000\":\"rgb(208,225,242)\",\"54,000 - 72,000\":\"rgb(182,212,233)\",\"72,000 - 90,000\":\"rgb(148,196,223)\",\"90,000 - 108,000\":\"rgb(107,174,214)\"},\"legendOpen\":false}},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Sources\",\"field\":\"source.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Bytes\",\"field\":\"source.bytes\"},\"schema\":\"metric\",\"type\":\"sum\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destinations\",\"field\":\"destination.domain\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Count\"},\"schema\":\"metric\",\"type\":\"count\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 10 Sources by Size [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-26a65f68-d7a6-4b47-befc-c5a6819bb91b", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-2726382e-638a-4dcc-94fc-0ffdc0f92048.json b/packages/cef/2.0.3/kibana/visualization/cef-2726382e-638a-4dcc-94fc-0ffdc0f92048.json deleted file mode 100755 index 1697d134c5..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-2726382e-638a-4dcc-94fc-0ffdc0f92048.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 15 Event Types by Events [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Event Types\",\"field\":\"cef.extensions.categoryBehavior\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":15},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Source Users\",\"field\":\"source.user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destination Users\",\"field\":\"destination.user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Source Hosts\",\"field\":\"source.domain\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Destination Hosts\",\"field\":\"destination.domain\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"listeners\":{},\"params\":{\"perPage\":15,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 15 Event Types by Events [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-2726382e-638a-4dcc-94fc-0ffdc0f92048", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-295986d4-d2ea-4541-8e82-7dc95c0cd830.json b/packages/cef/2.0.3/kibana/visualization/cef-295986d4-d2ea-4541-8e82-7dc95c0cd830.json deleted file mode 100755 index c52b647746..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-295986d4-d2ea-4541-8e82-7dc95c0cd830.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Source Countries by Event [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total Events\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"source.geo.country_iso_code\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":35},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Source Addresses\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destination Addresses\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Destination Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 10 Source Countries by Event [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-295986d4-d2ea-4541-8e82-7dc95c0cd830", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-316fdc75-7215-4c6b-8e1b-70a097b34e28.json b/packages/cef/2.0.3/kibana/visualization/cef-316fdc75-7215-4c6b-8e1b-70a097b34e28.json deleted file mode 100755 index 63e38a3cff..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-316fdc75-7215-4c6b-8e1b-70a097b34e28.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Sources by Destinations [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Host\",\"field\":\"source.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Destination Host\",\"field\":\"destination.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":true,\"legendPosition\":\"bottom\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Top 10 Sources by Destinations [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-316fdc75-7215-4c6b-8e1b-70a097b34e28", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db.json b/packages/cef/2.0.3/kibana/visualization/cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db.json deleted file mode 100755 index 5ec0797be6..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Network - Event Throughput [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color_rules\":[{\"id\":\"3eadd451-5033-423f-88e3-814cc5e50b50\"}],\"bar_color_rules\":[{\"id\":\"8d4596c5-49ad-429b-af54-5451b1c2e8d4\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceType:\\\"Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\" \"},\"gauge_color_rules\":[{\"gauge\":null,\"id\":\"4d957654-cc7e-4ef3-8b29-61c0aeadd51a\",\"value\":0}],\"gauge_inner_width\":10,\"gauge_max\":\"\",\"gauge_style\":\"half\",\"gauge_width\":10,\"hide_last_value_indicator\":true,\"id\":\"73968651-c41e-473e-a153-a025f49d1a1b\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"90d7621e-3265-4fe8-8882-8df9605ea659\",\"label\":\"Event Throughput\",\"line_width\":1,\"metrics\":[{\"id\":\"ba1830b9-9ce3-4bf1-8f4d-f7478b7f1bba\",\"type\":\"count\"},{\"field\":\"ba1830b9-9ce3-4bf1-8f4d-f7478b7f1bba\",\"id\":\"ca3a65d0-9f3d-42a9-9f4e-16f9e24cba19\",\"type\":\"cumulative_sum\"},{\"field\":\"ca3a65d0-9f3d-42a9-9f4e-16f9e24cba19\",\"id\":\"6db67bc1-7fff-47e7-a931-f797b1f76732\",\"type\":\"derivative\",\"unit\":\"1s\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"6db67bc1-7fff-47e7-a931-f797b1f76732\",\"gamma\":0.3,\"id\":\"92bc1447-2b30-498c-ae8a-c67904fc82b2\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"value_template\":\"{{value}} / s\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"gauge\",\"use_kibana_indexes\":false},\"title\":\"Network - Event Throughput [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-33747d52-ec4c-4d91-86d8-fbdf9b9c82db", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-3c19f138-2ab3-4ecb-bb1b-86fb90158042.json b/packages/cef/2.0.3/kibana/visualization/cef-3c19f138-2ab3-4ecb-bb1b-86fb90158042.json deleted file mode 100755 index 563c47bef0..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-3c19f138-2ab3-4ecb-bb1b-86fb90158042.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Device Type Breakdown [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Firewall Types\",\"field\":\"cef.extensions.categoryDeviceType\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":false,\"legendPosition\":\"right\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Device Type Breakdown [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-3c19f138-2ab3-4ecb-bb1b-86fb90158042", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-499f50ba-2f84-4f7c-9021-73a4efc47921.json b/packages/cef/2.0.3/kibana/visualization/cef-499f50ba-2f84-4f7c-9021-73a4efc47921.json deleted file mode 100755 index a2085e9b19..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-499f50ba-2f84-4f7c-9021-73a4efc47921.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Outcome [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color\":null,\"background_color_rules\":[{\"id\":\"2fddda5e-d6fc-4581-bbb7-574e1017ae8f\"}],\"bar_color_rules\":[{\"bar_color\":null,\"id\":\"23db5bf6-f787-474e-86ab-76362432e984\",\"value\":0}],\"drilldown_url\":\"\",\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceType:\\\"Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\"\"},\"gauge_color_rules\":[{\"id\":\"3ed9a6b9-fd2e-4e0d-bd83-7ad467b3c8a4\"}],\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"gauge_width\":10,\"id\":\"ec53a1d3-213c-4b0f-a074-5005a84cdb83\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(211,49,21,1)\",\"fill\":\"0\",\"filter\":{\"language\":\"lucene\",\"query\":\"(cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\") AND _exists_:cef.extensions.categoryOutcome\"},\"formatter\":\"number\",\"id\":\"04c44192-1112-4515-a8d9-e9e13215aecf\",\"label\":\"Events\",\"line_width\":\"3\",\"metrics\":[{\"id\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"gamma\":0.3,\"id\":\"c43af7e6-3f06-48a4-a7c3-7ba8bd6214f9\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":\"0\",\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(254,146,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\"\"},\"id\":\"4c7aac7d-2749-41b6-8136-40dc8636a7e7\",\"label\":\"Firewall\"}],\"split_mode\":\"filter\",\"stacked\":\"none\",\"steps\":0,\"terms_field\":\"observer.hostname\",\"terms_order_by\":null},{\"axis_position\":\"left\",\"chart_type\":\"bar\",\"color\":\"rgba(104,188,0,1)\",\"fill\":\"1\",\"formatter\":\"number\",\"id\":\"29d6131a-5143-4a64-b597-9538692f0269\",\"label\":\"Moving Average by Event Outcome\",\"line_width\":1,\"metrics\":[{\"id\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"type\":\"count\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(104,188,0,0.35)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryOutcome:\\\"/Success\\\"\"},\"id\":\"cb1ae397-13a0-4b6f-a848-bcdc96870f05\",\"label\":\"Success\"},{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryOutcome:\\\"/Failure\\\"\"},\"id\":\"ef021c15-1b95-4334-bc3c-e2950e9b0f6f\",\"label\":\"Failure\"},{\"color\":\"rgba(0,156,224,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryOutcome:\\\"/Attempt\\\"\"},\"id\":\"2ff1e859-b178-4824-a0f2-69a115932b98\",\"label\":\"Attempt\"}],\"split_mode\":\"filters\",\"stacked\":\"stacked\",\"terms_field\":\"cef.extensions.categoryOutcome\",\"terms_size\":\"3\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Outcome [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-499f50ba-2f84-4f7c-9021-73a4efc47921", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf.json b/packages/cef/2.0.3/kibana/visualization/cef-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf.json deleted file mode 100755 index 0614970e4b..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Destinations [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Hosts\",\"field\":\"destination.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":60,\"minFontSize\":10,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Destinations [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-4a7c10c7-4abd-47b4-b4c3-dee33377fbdf", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956.json b/packages/cef/2.0.3/kibana/visualization/cef-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956.json deleted file mode 100755 index b0e9b3c257..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Sources [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Hosts\",\"field\":\"source.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":60,\"minFontSize\":10,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Sources [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-4e25b5ce-53c3-46fc-b5e5-71d3c52f1956", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-4fccee0c-7193-4aa8-919f-0b0b0a16d013.json b/packages/cef/2.0.3/kibana/visualization/cef-4fccee0c-7193-4aa8-919f-0b0b0a16d013.json deleted file mode 100755 index 86b518c893..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-4fccee0c-7193-4aa8-919f-0b0b0a16d013.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top Source Locations by Events [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"autoPrecision\":true,\"customLabel\":\"Source Location\",\"field\":\"source.geo.location\",\"precision\":2,\"useGeocentroid\":true},\"schema\":\"segment\",\"type\":\"geohash_grid\"}],\"listeners\":{},\"params\":{\"addTooltip\":true,\"heatBlur\":15,\"heatMaxZoom\":0,\"heatMinOpacity\":0.1,\"heatNormalizeData\":true,\"heatRadius\":25,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapType\":\"Shaded Circle Markers\",\"mapZoom\":2,\"wms\":{\"enabled\":false,\"options\":{\"attribution\":\"Maps provided by USGS\",\"format\":\"image/png\",\"layers\":\"0\",\"styles\":\"\",\"transparent\":true,\"version\":\"1.3.0\"},\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\"}},\"title\":\"Top Source Locations by Events [Logs CEF ArcSight]\",\"type\":\"tile_map\"}" - }, - "id": "cef-4fccee0c-7193-4aa8-919f-0b0b0a16d013", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110.json b/packages/cef/2.0.3/kibana/visualization/cef-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110.json deleted file mode 100755 index 5c7272c0cb..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top Destinations by Traffic Size [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 18k\":\"rgb(247,251,255)\",\"108k - 126k\":\"rgb(74,152,201)\",\"126k - 144k\":\"rgb(46,126,188)\",\"144k - 162k\":\"rgb(23,100,171)\",\"162k - 180k\":\"rgb(8,74,145)\",\"18k - 36k\":\"rgb(227,238,249)\",\"36k - 54k\":\"rgb(208,225,242)\",\"54k - 72k\":\"rgb(182,212,233)\",\"72k - 90k\":\"rgb(148,196,223)\",\"90k - 108k\":\"rgb(107,174,214)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Bytes\",\"field\":\"source.bytes\"},\"schema\":\"metric\",\"type\":\"sum\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"filters\":[{\"input\":{\"language\":\"lucene\",\"query\":\"deviceDirection:\\\"0\\\"\"},\"label\":\"Inbound\"},{\"input\":{\"language\":\"lucene\",\"query\":\"deviceDirection:\\\"1\\\"\"},\"label\":\"Outbound\"}]},\"schema\":\"segment\",\"type\":\"filters\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"destination.domain\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"colorSchema\":\"Blues\",\"colorsNumber\":10,\"colorsRange\":[{\"from\":0,\"to\":null}],\"enableHover\":true,\"invertColors\":false,\"legendPosition\":\"top\",\"percentageMode\":false,\"setColorRange\":false,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"color\":\"#555\",\"rotate\":0,\"show\":false},\"scale\":{\"defaultYExtents\":false,\"type\":\"linear\"},\"show\":false,\"type\":\"value\"}]},\"title\":\"Top Destinations by Traffic Size [Logs CEF ArcSight]\",\"type\":\"heatmap\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-566d8b4e-ec5c-4b8b-bd68-3cc9cb236110", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-581a296e-e34a-48f1-93e4-fc4bdadfc68d.json b/packages/cef/2.0.3/kibana/visualization/cef-581a296e-e34a-48f1-93e4-fc4bdadfc68d.json deleted file mode 100755 index 5d58895fd2..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-581a296e-e34a-48f1-93e4-fc4bdadfc68d.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top Sources by Events [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"autoPrecision\":true,\"field\":\"source.geo.location\",\"precision\":2,\"useGeocentroid\":true},\"schema\":\"segment\",\"type\":\"geohash_grid\"}],\"listeners\":{},\"params\":{\"addTooltip\":true,\"heatBlur\":15,\"heatMaxZoom\":0,\"heatMinOpacity\":0.1,\"heatRadius\":25,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapType\":\"Shaded Circle Markers\",\"mapZoom\":2,\"wms\":{\"enabled\":false,\"options\":{\"attribution\":\"Maps provided by USGS\",\"format\":\"image/png\",\"layers\":\"0\",\"styles\":\"\",\"transparent\":true,\"version\":\"1.3.0\"},\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\"}},\"title\":\"Top Sources by Events [Logs CEF ArcSight]\",\"type\":\"tile_map\"}" - }, - "id": "cef-581a296e-e34a-48f1-93e4-fc4bdadfc68d", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-589fec8c-336e-4122-8fef-a450bddf84f6.json b/packages/cef/2.0.3/kibana/visualization/cef-589fec8c-336e-4122-8fef-a450bddf84f6.json deleted file mode 100755 index bb3e848ce7..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-589fec8c-336e-4122-8fef-a450bddf84f6.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Source Addresses [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Addresses\",\"field\":\"source.ip\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Source Addresses [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-589fec8c-336e-4122-8fef-a450bddf84f6", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-59ad829b-12b8-4256-95a5-e7078eda628b.json b/packages/cef/2.0.3/kibana/visualization/cef-59ad829b-12b8-4256-95a5-e7078eda628b.json deleted file mode 100755 index 38ac936b78..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-59ad829b-12b8-4256-95a5-e7078eda628b.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Source Users by Event Type and Destination Users [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Users\",\"field\":\"source.user.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Event Types\",\"field\":\"cef.extensions.categoryBehavior\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destination User Names\",\"field\":\"destination.user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Source Users\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"},{\"data\":{\"id\":\"3\",\"label\":\"Event Types\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-2\"},{\"data\":{\"id\":\"4\",\"label\":\"Destination User Names\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-2\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"},{\"id\":\"ValueAxis-2\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"RightAxis-1\",\"position\":\"right\",\"scale\":{\"mode\":\"normal\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"Source Users by Event Type and Destination Users [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-59ad829b-12b8-4256-95a5-e7078eda628b", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-5bf6e4dc-4273-4e1e-a803-04347eebeb53.json b/packages/cef/2.0.3/kibana/visualization/cef-5bf6e4dc-4273-4e1e-a803-04347eebeb53.json deleted file mode 100755 index 558660d19f..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-5bf6e4dc-4273-4e1e-a803-04347eebeb53.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Outcomes by User Names [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"/Informational\":\"#7EB26D\",\"/Informational/Warning\":\"#EF843C\",\"/Success\":\"#64B0C8\",\"Anti-Virus\":\"#B7DBAB\",\"Host-based IDS/IPS\":\"#629E51\",\"Log Consolidator\":\"#E0F9D7\",\"Operating System\":\"#3F6833\",\"Recon\":\"#BF1B00\",\"Security Mangement\":\"#CFFAFF\"},\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"exclude\":\"Network-based IDS/IPS\",\"field\":\"cef.extensions.categoryDeviceType\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"field\":\"destination.user.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":false,\"legendPosition\":\"right\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Outcomes by User Names [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-5bf6e4dc-4273-4e1e-a803-04347eebeb53", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-5f187dc8-aa7e-4f91-a2d8-1186ce254d00.json b/packages/cef/2.0.3/kibana/visualization/cef-5f187dc8-aa7e-4f91-a2d8-1186ce254d00.json deleted file mode 100755 index 0a393d6652..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-5f187dc8-aa7e-4f91-a2d8-1186ce254d00.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Events by Source and Destination Users [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Timestamp\",\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Source Users\",\"field\":\"source.user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destination Users\",\"field\":\"destination.user.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Timestamp\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Event Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"},{\"data\":{\"id\":\"3\",\"label\":\"Source Users\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":3,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-2\"},{\"data\":{\"id\":\"4\",\"label\":\"Destination Users\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":3,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-2\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Event Count\"},\"type\":\"value\"},{\"id\":\"ValueAxis-2\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"RightAxis-1\",\"position\":\"right\",\"scale\":{\"mode\":\"normal\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"Events by Source and Destination Users [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-5f187dc8-aa7e-4f91-a2d8-1186ce254d00", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409.json b/packages/cef/2.0.3/kibana/visualization/cef-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409.json deleted file mode 100755 index cc03e710d3..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Source Users by Destination Users [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Users\",\"field\":\"source.user.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Destination Users\",\"field\":\"destination.user.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":true,\"legendPosition\":\"bottom\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Top 10 Source Users by Destination Users [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-6437e9bb-9ed1-4e2d-bb10-e63ccd35c409", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-677891a1-90c4-4273-b126-f0e54689bd76.json b/packages/cef/2.0.3/kibana/visualization/cef-677891a1-90c4-4273-b126-f0e54689bd76.json deleted file mode 100755 index 834908bc67..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-677891a1-90c4-4273-b126-f0e54689bd76.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"query_string\":{\"query\":\"*\"}}}" - }, - "title": " Dashboard Navigation [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"markdown\":\"[Network Overview](#/dashboard/cef-dd0bc9af-2e89-4150-9b42-62517ea56b71) | [Network Suspicious Activity](#/dashboard/cef-db1e1aca-279e-4ecc-b84e-fe58644f7619) | [Endpoint Overview](#dashboard/cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b) | [Endpoint OS Activity](#/dashboard/cef-9e352900-89c3-4c1b-863e-249e24d0dac9) | [Microsoft DNS Overview](#/dashboard/cef-56428e01-0c47-4770-8ba4-9345a029ea41)\"},\"title\":\" Dashboard Navigation [Logs CEF ArcSight]\",\"type\":\"markdown\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-677891a1-90c4-4273-b126-f0e54689bd76", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-718b074e-3dd1-4d03-ba11-7f869cdcd703.json b/packages/cef/2.0.3/kibana/visualization/cef-718b074e-3dd1-4d03-ba11-7f869cdcd703.json deleted file mode 100755 index 9518a579c1..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-718b074e-3dd1-4d03-ba11-7f869cdcd703.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Device [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Host\\\" OR cef.extensions.categoryDeviceGroup:\\\"/Application\\\"\"},\"id\":\"fd1ffeb6-678e-4163-9421-6a164fd59048\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(254,37,37,1)\",\"fill\":\"0\",\"formatter\":\"number\",\"id\":\"6a10f77d-4e26-4b27-9c19-f1b0029b075b\",\"label\":\"Events\",\"line_width\":\"3\",\"metrics\":[{\"id\":\"845b9164-65f4-4599-b9cc-8d91b6ba8d83\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"845b9164-65f4-4599-b9cc-8d91b6ba8d83\",\"gamma\":0.3,\"id\":\"59675e84-1a8e-41df-9f63-875109bd795a\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\" \"},\"id\":\"d9a580c3-eb83-4d20-a391-0934d7df8837\",\"label\":\"Operating System\"},{\"color\":\"rgba(254,146,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\" cef.extensions.categoryDeviceGroup:\\\"/IDS/Host\\\"\"},\"id\":\"9ce8be14-6191-4c9a-a679-e3992fdab8d2\",\"label\":\"Host IDS\"},{\"color\":\"rgba(252,220,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Application\\\"\"},\"id\":\"262ecd54-a042-4bfb-b489-d7db8431c36e\",\"label\":\"Application\"}],\"split_mode\":\"filters\",\"stacked\":\"none\"},{\"axis_position\":\"left\",\"chart_type\":\"bar\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"92e98952-8e25-472f-abb5-05a7d9b830ea\",\"label\":\"Moving Average by Device HostNames\",\"line_width\":1,\"metrics\":[{\"id\":\"3df841a9-5997-4a1a-ad8f-69620d23e65b\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"3df841a9-5997-4a1a-ad8f-69620d23e65b\",\"gamma\":0.3,\"id\":\"9765367a-0fc2-45ba-88a8-e87991210edd\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_mode\":\"terms\",\"stacked\":\"none\",\"terms_field\":\"observer.hostname\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Device [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-718b074e-3dd1-4d03-ba11-7f869cdcd703", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-7454c034-c5f3-48fe-8fce-ef4385c80350.json b/packages/cef/2.0.3/kibana/visualization/cef-7454c034-c5f3-48fe-8fce-ef4385c80350.json deleted file mode 100755 index c978cbecff..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-7454c034-c5f3-48fe-8fce-ef4385c80350.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Endpoint Metrics Overview [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Devices\",\"field\":\"observer.hostname\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Source\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destination\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Port\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"30\",\"gauge\":{\"autoExtend\":false,\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"gaugeColorMode\":\"None\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Metric\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":false,\"width\":2},\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":\"12\",\"labelColor\":false,\"subText\":\"\"},\"type\":\"simple\",\"useRange\":false,\"verticalSplit\":false},\"handleNoResults\":true,\"type\":\"gauge\"},\"title\":\"Endpoint Metrics Overview [Logs CEF ArcSight]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-7454c034-c5f3-48fe-8fce-ef4385c80350", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-74d2c072-6dfd-4249-8e63-dc7b0cf3c960.json b/packages/cef/2.0.3/kibana/visualization/cef-74d2c072-6dfd-4249-8e63-dc7b0cf3c960.json deleted file mode 100755 index dc2ddd1c89..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-74d2c072-6dfd-4249-8e63-dc7b0cf3c960.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 5 Source Countries [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"source.geo.country_iso_code\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 5 Source Countries [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-74d2c072-6dfd-4249-8e63-dc7b0cf3c960", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3.json b/packages/cef/2.0.3/kibana/visualization/cef-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3.json deleted file mode 100755 index 09e0d6ff6a..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Event Types [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"cef.device.event_class_id\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":50,\"minFontSize\":12,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"square root\"},\"title\":\"Top 10 Event Types [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-759e8dc3-0fdb-4cb6-ba47-87a2e2ff8df3", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-76c088c3-486e-4420-8840-5ede667edffe.json b/packages/cef/2.0.3/kibana/visualization/cef-76c088c3-486e-4420-8840-5ede667edffe.json deleted file mode 100755 index 7ba2b39a50..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-76c088c3-486e-4420-8840-5ede667edffe.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Endpoint - OS Average EPS [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"bar_color_rules\":[{\"id\":\"ce9549a0-3af0-4070-b169-4b6d145d4c39\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\"\"},\"gauge_color_rules\":[{\"id\":\"03a2fd72-fc9c-4582-9133-20af36217180\"}],\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"gauge_width\":10,\"hide_last_value_indicator\":true,\"id\":\"94161c6c-4f48-4beb-9d78-f79f29c02a34\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"b4373ffd-9660-4206-afd6-d4867ac7dbdf\",\"label\":\"Event Throughput\",\"line_width\":1,\"metrics\":[{\"id\":\"b1a48389-d799-4eba-8b98-7ee8ef0bb440\",\"type\":\"count\"},{\"field\":\"b1a48389-d799-4eba-8b98-7ee8ef0bb440\",\"id\":\"89f8286e-4aec-4cb4-83ad-b139692edf3d\",\"type\":\"cumulative_sum\"},{\"field\":\"89f8286e-4aec-4cb4-83ad-b139692edf3d\",\"id\":\"1df39e5f-3e98-4ed7-ab08-47f3ca2ee915\",\"type\":\"derivative\",\"unit\":\"1s\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"1df39e5f-3e98-4ed7-ab08-47f3ca2ee915\",\"gamma\":0.3,\"id\":\"f46a6e6e-444f-4c7e-b5eb-e1a59568f2eb\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"offset_time\":\"1m\",\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"value_template\":\"{{value}} / s\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"gauge\",\"use_kibana_indexes\":false},\"title\":\"Endpoint - OS Average EPS [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-76c088c3-486e-4420-8840-5ede667edffe", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-77ee0e91-010b-4897-b483-7e9a907d2afe.json b/packages/cef/2.0.3/kibana/visualization/cef-77ee0e91-010b-4897-b483-7e9a907d2afe.json deleted file mode 100755 index fa5dcd2adc..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-77ee0e91-010b-4897-b483-7e9a907d2afe.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Behaviors by Outcome [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 9,000\":\"rgb(255,255,204)\",\"18,000 - 27,000\":\"rgb(254,225,135)\",\"27,000 - 36,000\":\"rgb(254,201,101)\",\"36,000 - 45,000\":\"rgb(254,171,73)\",\"45,000 - 54,000\":\"rgb(253,141,60)\",\"54,000 - 63,000\":\"rgb(252,91,46)\",\"63,000 - 72,000\":\"rgb(237,47,34)\",\"72,000 - 81,000\":\"rgb(212,16,32)\",\"81,000 - 90,000\":\"rgb(176,0,38)\",\"9,000 - 18,000\":\"rgb(255,241,170)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Event Type\",\"field\":\"cef.extensions.categoryBehavior\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Event Outcome\",\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"colorSchema\":\"Yellow to Red\",\"colorsNumber\":10,\"colorsRange\":[],\"enableHover\":true,\"invertColors\":false,\"legendPosition\":\"right\",\"percentageMode\":false,\"setColorRange\":false,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"color\":\"#555\",\"rotate\":0,\"show\":false},\"scale\":{\"defaultYExtents\":false,\"type\":\"linear\"},\"show\":false,\"type\":\"value\"}]},\"title\":\"Top 10 Behaviors by Outcome [Logs CEF ArcSight]\",\"type\":\"heatmap\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-77ee0e91-010b-4897-b483-7e9a907d2afe", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-7e2b0659-0760-4182-8b29-3ee69f26bc6f.json b/packages/cef/2.0.3/kibana/visualization/cef-7e2b0659-0760-4182-8b29-3ee69f26bc6f.json deleted file mode 100755 index 86943ae981..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-7e2b0659-0760-4182-8b29-3ee69f26bc6f.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "DNS - Event Throughput [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color_rules\":[{\"id\":\"3eadd451-5033-423f-88e3-814cc5e50b50\"}],\"bar_color_rules\":[{\"id\":\"fa374805-d1ca-4261-b723-9b482a7dd43a\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.device.product:\\\"DNS Trace Log\\\"\"},\"gauge_color_rules\":[{\"gauge\":null,\"id\":\"4d957654-cc7e-4ef3-8b29-61c0aeadd51a\",\"value\":0}],\"gauge_inner_width\":10,\"gauge_max\":\"\",\"gauge_style\":\"half\",\"gauge_width\":10,\"hide_last_value_indicator\":true,\"id\":\"73968651-c41e-473e-a153-a025f49d1a1b\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"90d7621e-3265-4fe8-8882-8df9605ea659\",\"label\":\"Event Throughput\",\"line_width\":1,\"metrics\":[{\"id\":\"ba1830b9-9ce3-4bf1-8f4d-f7478b7f1bba\",\"type\":\"count\"},{\"field\":\"ba1830b9-9ce3-4bf1-8f4d-f7478b7f1bba\",\"id\":\"cf3e6b1c-4136-4868-913e-0e82d88a8c9c\",\"type\":\"cumulative_sum\"},{\"field\":\"cf3e6b1c-4136-4868-913e-0e82d88a8c9c\",\"id\":\"0e407985-9ae4-4c1f-bb0e-16cd9bef7611\",\"type\":\"derivative\",\"unit\":\"1s\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"0e407985-9ae4-4c1f-bb0e-16cd9bef7611\",\"gamma\":0.3,\"id\":\"48026f85-83c8-40e6-aff4-71f3bd6c77c9\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"value_template\":\"{{value}} / s\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"gauge\",\"use_kibana_indexes\":false},\"title\":\"DNS - Event Throughput [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-7e2b0659-0760-4182-8b29-3ee69f26bc6f", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1.json b/packages/cef/2.0.3/kibana/visualization/cef-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1.json deleted file mode 100755 index 899b95824b..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 5 Sources by Destination Addresses [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Addresses\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Source Address\",\"field\":\"source.ip\",\"order\":\"desc\",\"orderBy\":\"2\",\"size\":5},\"schema\":\"bucket\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 5 Sources by Destination Addresses [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-82f3fae3-1189-4f04-8ea5-47fde1d2e7b1", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-86bd5f13-ca6b-43fa-b209-54e7460344bb.json b/packages/cef/2.0.3/kibana/visualization/cef-86bd5f13-ca6b-43fa-b209-54e7460344bb.json deleted file mode 100755 index 34d704fef6..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-86bd5f13-ca6b-43fa-b209-54e7460344bb.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Destination Addresses [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Addresses\",\"field\":\"destination.ip\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Destination Addresses [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-86bd5f13-ca6b-43fa-b209-54e7460344bb", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-89998099-9a39-44cf-beba-5b97f0524cf9.json b/packages/cef/2.0.3/kibana/visualization/cef-89998099-9a39-44cf-beba-5b97f0524cf9.json deleted file mode 100755 index dd63b9809f..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-89998099-9a39-44cf-beba-5b97f0524cf9.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Outcomes Breakdown [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"/Attempt\":\"#3F2B5B\",\"/Failure\":\"#BF1B00\"},\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Time\",\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Time\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"area\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"value\"}]},\"title\":\"Outcomes Breakdown [Logs CEF ArcSight]\",\"type\":\"area\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-89998099-9a39-44cf-beba-5b97f0524cf9", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-8b31af8b-522e-41fe-b9d6-9a3451b54108.json b/packages/cef/2.0.3/kibana/visualization/cef-8b31af8b-522e-41fe-b9d6-9a3451b54108.json deleted file mode 100755 index 08b966f09b..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-8b31af8b-522e-41fe-b9d6-9a3451b54108.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top Destination Locations by Events [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"autoPrecision\":true,\"customLabel\":\"Destination Location\",\"field\":\"destination.geo.location\",\"precision\":2,\"useGeocentroid\":true},\"schema\":\"segment\",\"type\":\"geohash_grid\"}],\"listeners\":{},\"params\":{\"addTooltip\":true,\"heatBlur\":15,\"heatMaxZoom\":0,\"heatMinOpacity\":0.1,\"heatNormalizeData\":true,\"heatRadius\":25,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapType\":\"Shaded Circle Markers\",\"mapZoom\":2,\"wms\":{\"enabled\":false,\"options\":{\"attribution\":\"Maps provided by USGS\",\"format\":\"image/png\",\"layers\":\"0\",\"styles\":\"\",\"transparent\":true,\"version\":\"1.3.0\"},\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\"}},\"title\":\"Top Destination Locations by Events [Logs CEF ArcSight]\",\"type\":\"tile_map\"}" - }, - "id": "cef-8b31af8b-522e-41fe-b9d6-9a3451b54108", - "migrationVersion": { - "visualization": "7.10.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-8cd00d20-957d-4663-be4d-ea80b1609586.json b/packages/cef/2.0.3/kibana/visualization/cef-8cd00d20-957d-4663-be4d-ea80b1609586.json deleted file mode 100755 index 1f8c398abc..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-8cd00d20-957d-4663-be4d-ea80b1609586.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Source Users [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Users\",\"field\":\"source.user.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":60,\"minFontSize\":10,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Source Users [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-8cd00d20-957d-4663-be4d-ea80b1609586", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-8f6075c5-f525-4173-92a4-3a56e96e362d.json b/packages/cef/2.0.3/kibana/visualization/cef-8f6075c5-f525-4173-92a4-3a56e96e362d.json deleted file mode 100755 index f4f5f6eadc..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-8f6075c5-f525-4173-92a4-3a56e96e362d.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Source Countries by Events [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total Events\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Country\",\"field\":\"source.geo.country_iso_code\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Source Addresses\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Destination Addresses\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Destination Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 10 Source Countries by Events [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-8f6075c5-f525-4173-92a4-3a56e96e362d", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-92aecea0-a632-4a55-bb56-50e4cdaca036.json b/packages/cef/2.0.3/kibana/visualization/cef-92aecea0-a632-4a55-bb56-50e4cdaca036.json deleted file mode 100755 index ab180b299a..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-92aecea0-a632-4a55-bb56-50e4cdaca036.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 5 Vendors by Product [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"OS Vendor\",\"field\":\"cef.device.vendor\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"OS Product\",\"field\":\"cef.device.product\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Top 5 Vendors by Product [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-92aecea0-a632-4a55-bb56-50e4cdaca036", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-9457ee67-895f-4b78-a543-268f9687a745.json b/packages/cef/2.0.3/kibana/visualization/cef-9457ee67-895f-4b78-a543-268f9687a745.json deleted file mode 100755 index 3da6c90cb1..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-9457ee67-895f-4b78-a543-268f9687a745.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Endpoint Average EPS [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"bar_color_rules\":[{\"id\":\"85a1c642-9781-430d-b84b-b28cb2a42fb4\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Operating System\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Host\\\" OR cef.extensions.categoryDeviceGroup:\\\"/Application\\\"\"},\"gauge_color_rules\":[{\"id\":\"03a2fd72-fc9c-4582-9133-20af36217180\"}],\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"gauge_width\":10,\"hide_last_value_indicator\":true,\"id\":\"b7a85957-123e-4e25-9e8e-ff7992c9b2b9\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"b4373ffd-9660-4206-afd6-d4867ac7dbdf\",\"label\":\"Event Throughput\",\"line_width\":1,\"metrics\":[{\"id\":\"b1a48389-d799-4eba-8b98-7ee8ef0bb440\",\"type\":\"count\"},{\"field\":\"b1a48389-d799-4eba-8b98-7ee8ef0bb440\",\"id\":\"7c5c44cc-17bd-4206-a100-b8996cd3d11a\",\"type\":\"cumulative_sum\"},{\"field\":\"7c5c44cc-17bd-4206-a100-b8996cd3d11a\",\"id\":\"215c5225-5368-40e6-8fcd-2b0026babba0\",\"type\":\"derivative\",\"unit\":\"1s\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"215c5225-5368-40e6-8fcd-2b0026babba0\",\"gamma\":0.3,\"id\":\"f4dfe09a-e397-4287-ab99-3206516cded3\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"value_template\":\"{{value}} / s\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"gauge\",\"use_kibana_indexes\":false},\"title\":\"Endpoint Average EPS [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-9457ee67-895f-4b78-a543-268f9687a745", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d.json b/packages/cef/2.0.3/kibana/visualization/cef-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d.json deleted file mode 100755 index 001000873c..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Severity [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"bar_color_rules\":[{\"id\":\"0ca18a89-9c81-4bee-835a-85e6103aec37\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\"\"},\"hide_last_value_indicator\":true,\"id\":\"c39a76e5-f613-41a9-8335-c442747791e0\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"0.0[0]a\",\"id\":\"da3b92b4-2c24-473b-9102-fb5a343a96d9\",\"label\":\"Event by Severities\",\"line_width\":1,\"metrics\":[{\"id\":\"0d189776-3f7c-4a92-95b1-73c379a341fc\",\"type\":\"count\"},{\"field\":\"0d189776-3f7c-4a92-95b1-73c379a341fc\",\"id\":\"1b1c931c-a09b-4980-af81-6f9c3db56401\",\"sigma\":\"\",\"type\":\"sum_bucket\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(104,204,202,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"severity:\\\"Low\\\" OR severity:\\\"0\\\"\"},\"id\":\"ebe970ac-5cc9-4c4a-af60-82affafc667c\",\"label\":\"LOW\"},{\"color\":\"rgba(252,220,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"severity:\\\"Medium\\\"\"},\"id\":\"0c4ff16a-b53d-4ce4-af76-d6b74d8788db\",\"label\":\"MEDIUM\"},{\"color\":\"rgba(254,146,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"severity:\\\"High\\\"\"},\"id\":\"e142c55b-6ee5-416a-8bd3-d10398044864\",\"label\":\"HIGH\"},{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"severity:\\\"Very-High\\\"\"},\"id\":\"4b05b562-c419-4214-b814-d4c242251521\",\"label\":\"VERY HIGH\"}],\"split_mode\":\"filters\",\"stacked\":\"none\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"top_n\",\"use_kibana_indexes\":false},\"title\":\"Events by Severity [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-9bef4db9-a8b2-4be8-b2b0-6ea02fab424d", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-a729c249-8d34-4eb1-bbb0-5d25cf224114.json b/packages/cef/2.0.3/kibana/visualization/cef-a729c249-8d34-4eb1-bbb0-5d25cf224114.json deleted file mode 100755 index 8ec3a53f1f..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-a729c249-8d34-4eb1-bbb0-5d25cf224114.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Devices by Outcome [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0% - 17%\":\"rgb(255,255,204)\",\"17% - 34%\":\"rgb(255,230,146)\",\"34% - 50%\":\"rgb(254,191,90)\",\"50% - 67%\":\"rgb(253,141,60)\",\"67% - 84%\":\"rgb(244,61,37)\",\"84% - 100%\":\"rgb(202,8,35)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device Host Names\",\"field\":\"observer.hostname\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Event Outcome\",\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"colorSchema\":\"Yellow to Red\",\"colorsNumber\":6,\"colorsRange\":[],\"enableHover\":true,\"invertColors\":false,\"legendPosition\":\"right\",\"percentageMode\":true,\"setColorRange\":false,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"color\":\"#555\",\"rotate\":0,\"show\":false},\"scale\":{\"defaultYExtents\":false,\"type\":\"linear\"},\"show\":false,\"type\":\"value\"}]},\"title\":\"Top 10 Devices by Outcome [Logs CEF ArcSight]\",\"type\":\"heatmap\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-a729c249-8d34-4eb1-bbb0-5d25cf224114", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-a97e3628-022b-46cf-8f29-a73cf9bb4e26.json b/packages/cef/2.0.3/kibana/visualization/cef-a97e3628-022b-46cf-8f29-a73cf9bb4e26.json deleted file mode 100755 index a5448711e4..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-a97e3628-022b-46cf-8f29-a73cf9bb4e26.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Source [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color\":null,\"background_color_rules\":[{\"id\":\"2fddda5e-d6fc-4581-bbb7-574e1017ae8f\"}],\"bar_color_rules\":[{\"id\":\"23db5bf6-f787-474e-86ab-76362432e984\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceType:\\\"Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\"\"},\"gauge_color_rules\":[{\"id\":\"3ed9a6b9-fd2e-4e0d-bd83-7ad467b3c8a4\"}],\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"gauge_width\":10,\"id\":\"ec53a1d3-213c-4b0f-a074-5005a84cdb83\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(244,78,59,1)\",\"fill\":\"0\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\"\"},\"formatter\":\"number\",\"id\":\"04c44192-1112-4515-a8d9-e9e13215aecf\",\"label\":\"Events\",\"line_width\":\"3\",\"metrics\":[{\"id\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"gamma\":0.3,\"id\":\"e5a48d9d-7834-4da7-8d78-7d4528136b9b\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"sigma\":\"\",\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":\"0\",\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\"\"},\"id\":\"0c929603-fc92-4ebc-a963-fe2795417d89\",\"label\":\"Firewall Events\"},{\"color\":\"rgba(254,146,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\"\"},\"id\":\"7798827b-87ab-436b-9e62-9fe36143eb9b\",\"label\":\"Intrusion Detection Events\"},{\"color\":\"rgba(252,220,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/VPN\\\"\"},\"id\":\"490f7ad7-8218-45f9-85a9-a4dd9ed7da13\",\"label\":\"VPN\"}],\"split_mode\":\"filters\",\"stacked\":\"none\",\"steps\":0,\"terms_field\":\"observer.hostname\",\"terms_order_by\":null},{\"axis_position\":\"left\",\"chart_type\":\"bar\",\"color\":\"rgba(0,156,224,1)\",\"fill\":\"0.5\",\"formatter\":\"number\",\"id\":\"29d6131a-5143-4a64-b597-9538692f0269\",\"label\":\"Moving Average by Device Hosts\",\"line_width\":1,\"metrics\":[{\"id\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"gamma\":0.3,\"id\":\"87e21aaa-12eb-4213-bb37-41cb19219240\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_mode\":\"terms\",\"stacked\":\"none\",\"terms_field\":\"observer.hostname\",\"terms_size\":\"10\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Source [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-a97e3628-022b-46cf-8f29-a73cf9bb4e26", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-aaa80503-6d96-4a33-806f-b8a10aefe696.json b/packages/cef/2.0.3/kibana/visualization/cef-aaa80503-6d96-4a33-806f-b8a10aefe696.json deleted file mode 100755 index 42a376cff4..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-aaa80503-6d96-4a33-806f-b8a10aefe696.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top Destination Locations by Event [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"autoPrecision\":true,\"field\":\"destination.geo.location\",\"precision\":2,\"useGeocentroid\":true},\"schema\":\"segment\",\"type\":\"geohash_grid\"}],\"listeners\":{},\"params\":{\"addTooltip\":true,\"heatBlur\":15,\"heatMaxZoom\":0,\"heatMinOpacity\":0.1,\"heatNormalizeData\":true,\"heatRadius\":25,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapType\":\"Shaded Circle Markers\",\"mapZoom\":2,\"wms\":{\"enabled\":false,\"options\":{\"attribution\":\"Maps provided by USGS\",\"format\":\"image/png\",\"layers\":\"0\",\"styles\":\"\",\"transparent\":true,\"version\":\"1.3.0\"},\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\"}},\"title\":\"Top Destination Locations by Event [Logs CEF ArcSight]\",\"type\":\"tile_map\"}" - }, - "id": "cef-aaa80503-6d96-4a33-806f-b8a10aefe696", - "migrationVersion": { - "visualization": "7.10.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-acc915fe-b971-4795-9040-3fbfdf62abe1.json b/packages/cef/2.0.3/kibana/visualization/cef-acc915fe-b971-4795-9040-3fbfdf62abe1.json deleted file mode 100755 index 71eae19918..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-acc915fe-b971-4795-9040-3fbfdf62abe1.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Destination Users [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Users\",\"field\":\"destination.user.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":60,\"minFontSize\":10,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Destination Users [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-acc915fe-b971-4795-9040-3fbfdf62abe1", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-b1002b5c-08fc-4bbe-b9a0-6243a8637e60.json b/packages/cef/2.0.3/kibana/visualization/cef-b1002b5c-08fc-4bbe-b9a0-6243a8637e60.json deleted file mode 100755 index 8a888d067a..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-b1002b5c-08fc-4bbe-b9a0-6243a8637e60.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Outcome by Device Type [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Firewall Types\",\"field\":\"cef.extensions.categoryDeviceType\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Event Outcome\",\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":3},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"rotate\":75,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Firewall Types\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"orderBucketsBySum\":true,\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"percentage\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"value\"}]},\"title\":\"Outcome by Device Type [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-b1002b5c-08fc-4bbe-b9a0-6243a8637e60", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-c394e650-b16c-407c-b305-bd409d69d433.json b/packages/cef/2.0.3/kibana/visualization/cef-c394e650-b16c-407c-b305-bd409d69d433.json deleted file mode 100755 index 6601533058..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-c394e650-b16c-407c-b305-bd409d69d433.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"query_string\":{\"query\":\"*\"}}}" - }, - "title": " Dashboard Navigation [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"markdown\":\"[Network Overview](#/dashboard/cef-dd0bc9af-2e89-4150-9b42-62517ea56b71) | [Network Suspicious Activity](#/dashboard/cef-db1e1aca-279e-4ecc-b84e-fe58644f7619) | [Endpoint Overview](#dashboard/cef-c10ce1cf-f6b8-4de4-8715-2cb5f6770b3b) | [Endpoint OS Activity](#/dashboard/cef-9e352900-89c3-4c1b-863e-249e24d0dac9) | [Microsoft DNS Overview](#/dashboard/cef-56428e01-0c47-4770-8ba4-9345a029ea41)\"},\"title\":\" Dashboard Navigation [Logs CEF ArcSight]\",\"type\":\"markdown\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-c394e650-b16c-407c-b305-bd409d69d433", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-c5120e27-1f8c-41e3-83ee-78ec4d470c2f.json b/packages/cef/2.0.3/kibana/visualization/cef-c5120e27-1f8c-41e3-83ee-78ec4d470c2f.json deleted file mode 100755 index 4860454ee5..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-c5120e27-1f8c-41e3-83ee-78ec4d470c2f.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Destination Port [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"destination.port\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":18,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"linear\"},\"title\":\"Top 10 Destination Port [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-c5120e27-1f8c-41e3-83ee-78ec4d470c2f", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-d02dd523-ce91-40e9-9209-83797f80ed45.json b/packages/cef/2.0.3/kibana/visualization/cef-d02dd523-ce91-40e9-9209-83797f80ed45.json deleted file mode 100755 index bf65f0baac..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-d02dd523-ce91-40e9-9209-83797f80ed45.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Source Addresses [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color\":null,\"background_color_rules\":[{\"id\":\"a0bf5a1d-8ebf-49d4-a347-738a6ce20562\"}],\"bar_color_rules\":[{\"id\":\"23db5bf6-f787-474e-86ab-76362432e984\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\" \"},\"gauge_color_rules\":[{\"id\":\"42f84a0a-ee13-4ca8-b61d-3de482ae4ab0\"}],\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"gauge_width\":10,\"id\":\"ec53a1d3-213c-4b0f-a074-5005a84cdb83\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(211,49,21,1)\",\"fill\":\"0\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\" \"},\"formatter\":\"number\",\"id\":\"04c44192-1112-4515-a8d9-e9e13215aecf\",\"label\":\"Events\",\"line_width\":\"3\",\"metrics\":[{\"id\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"gamma\":0.3,\"id\":\"117fde19-e227-4fcb-8019-e82e6677c340\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"sigma\":\"\",\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":\"0\",\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_mode\":\"everything\",\"stacked\":\"none\",\"steps\":0,\"terms_field\":\"observer.hostmessage\",\"terms_order_by\":null,\"value_template\":\"{{value}}\"},{\"axis_position\":\"left\",\"chart_type\":\"bar\",\"color\":\"rgba(104,188,0,1)\",\"fill\":\"0.5\",\"formatter\":\"number\",\"id\":\"3ffe652e-43c2-4a1d-ad8a-f7ab10f09f2b\",\"label\":\"Top Source Addresses\",\"line_width\":\"0\",\"metrics\":[{\"id\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"gamma\":0.3,\"id\":\"b753ad38-c3ed-4463-8f6d-176f4d477897\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_mode\":\"terms\",\"stacked\":\"none\",\"terms_field\":\"source.ip\",\"terms_size\":\"10\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Source Addresses [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-d02dd523-ce91-40e9-9209-83797f80ed45", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-d061c7a9-7f92-4bf4-b35c-499b9f4b987a.json b/packages/cef/2.0.3/kibana/visualization/cef-d061c7a9-7f92-4bf4-b35c-499b9f4b987a.json deleted file mode 100755 index f56ace942b..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-d061c7a9-7f92-4bf4-b35c-499b9f4b987a.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Device Metrics Overview [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"8\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Devices\",\"field\":\"observer.hostname\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Sources\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Destinations\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"7\",\"params\":{\"customLabel\":\"Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"30\",\"gauge\":{\"autoExtend\":false,\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"gaugeColorMode\":\"None\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Metric\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":false,\"width\":2},\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":\"12\",\"labelColor\":false,\"subText\":\"\"},\"type\":\"simple\",\"useRange\":false,\"verticalSplit\":false},\"handleNoResults\":true,\"type\":\"gauge\"},\"title\":\"Device Metrics Overview [Logs CEF ArcSight]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-d061c7a9-7f92-4bf4-b35c-499b9f4b987a", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-df056709-2deb-4363-ae7a-b0148ea456c6.json b/packages/cef/2.0.3/kibana/visualization/cef-df056709-2deb-4363-ae7a-b0148ea456c6.json deleted file mode 100755 index 6cf6e86635..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-df056709-2deb-4363-ae7a-b0148ea456c6.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Destination Ports by Outcome [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Protocols\",\"field\":\"destination.port\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"rotate\":75,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Protocols\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"percentage\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Destination Ports by Outcome [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-df056709-2deb-4363-ae7a-b0148ea456c6", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9.json b/packages/cef/2.0.3/kibana/visualization/cef-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9.json deleted file mode 100755 index 20bdf88f92..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 20 Behaviors by Outcome [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Event Behavior\",\"field\":\"cef.extensions.categoryBehavior\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Event Outcome\",\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":3},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Top 20 Behaviors by Outcome [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-e06d85f2-2da4-41e2-b2ab-f685b64bb3f9", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-e6cf2383-71f4-4db1-a791-1a7d4f110194", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-e513c269-350c-40c3-ac20-16c5782103b8.json b/packages/cef/2.0.3/kibana/visualization/cef-e513c269-350c-40c3-ac20-16c5782103b8.json deleted file mode 100755 index cb732f40b3..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-e513c269-350c-40c3-ac20-16c5782103b8.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Device Types [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"background_color\":null,\"background_color_rules\":[{\"id\":\"2fddda5e-d6fc-4581-bbb7-574e1017ae8f\"}],\"bar_color_rules\":[{\"id\":\"23db5bf6-f787-474e-86ab-76362432e984\"}],\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceType:\\\"Firewall\\\" OR cef.extensions.categoryDeviceGroup:\\\"/IDS/Network\\\" OR cef.extensions.categoryDeviceGroup:\\\"/VPN\\\"\"},\"gauge_color_rules\":[{\"id\":\"3ed9a6b9-fd2e-4e0d-bd83-7ad467b3c8a4\"}],\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"gauge_width\":10,\"id\":\"ec53a1d3-213c-4b0f-a074-5005a84cdb83\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(211,49,21,1)\",\"fill\":\"0\",\"filter\":\"\",\"formatter\":\"number\",\"id\":\"04c44192-1112-4515-a8d9-e9e13215aecf\",\"label\":\"Events\",\"line_width\":\"3\",\"metrics\":[{\"id\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"c5dbb050-fc10-4a0d-abe0-bc093db6cf0e\",\"gamma\":0.3,\"id\":\"e5a48d9d-7834-4da7-8d78-7d4528136b9b\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"sigma\":\"\",\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":\"0\",\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"cef.extensions.categoryDeviceGroup:\\\"/Firewall\\\"\"},\"id\":\"78bfdf07-ec02-4dd8-8ff4-b7e250c561c2\",\"label\":\"Firewall\"}],\"split_mode\":\"everything\",\"stacked\":\"none\",\"steps\":0,\"terms_field\":\"observer.hostname\",\"terms_order_by\":null},{\"axis_position\":\"left\",\"chart_type\":\"bar\",\"color\":\"rgba(251,158,0,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"29d6131a-5143-4a64-b597-9538692f0269\",\"label\":\"Top Device Types by Mvg Averages\",\"line_width\":1,\"metrics\":[{\"id\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"type\":\"count\"},{\"alpha\":0.3,\"beta\":0.1,\"field\":\"dc74afdf-64ad-47d6-bbed-114e09d12255\",\"gamma\":0.3,\"id\":\"87e21aaa-12eb-4213-bb37-41cb19219240\",\"model_type\":\"simple\",\"multiplicative\":false,\"period\":1,\"type\":\"moving_average\",\"window\":\"10\"}],\"point_size\":1,\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_mode\":\"terms\",\"stacked\":\"none\",\"terms_field\":\"cef.extensions.categoryDeviceType\",\"terms_size\":\"10\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Device Types [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-e513c269-350c-40c3-ac20-16c5782103b8", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-e89a64e8-928c-41fc-8745-3c8157b21cdb.json b/packages/cef/2.0.3/kibana/visualization/cef-e89a64e8-928c-41fc-8745-3c8157b21cdb.json deleted file mode 100755 index 5387593733..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-e89a64e8-928c-41fc-8745-3c8157b21cdb.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Devices by Bandwidth [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Device\",\"field\":\"observer.hostname\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Source(s)\",\"field\":\"source.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Destination(s)\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Destination Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Bandwidth (Incoming)\",\"field\":\"source.bytes\"},\"schema\":\"metric\",\"type\":\"sum\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Bandwidth (Outgoing)\",\"field\":\"destination.bytes\"},\"schema\":\"metric\",\"type\":\"sum\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 10 Devices by Bandwidth [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-e89a64e8-928c-41fc-8745-3c8157b21cdb", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-f03d734b-b85c-4e99-9c0e-9c89716a81f3.json b/packages/cef/2.0.3/kibana/visualization/cef-f03d734b-b85c-4e99-9c0e-9c89716a81f3.json deleted file mode 100755 index 4c21032237..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-f03d734b-b85c-4e99-9c0e-9c89716a81f3.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 5 Sources by Destination Ports [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Event Count\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Source Address\",\"field\":\"source.ip\",\"order\":\"desc\",\"orderBy\":\"2\",\"size\":5},\"schema\":\"bucket\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"Top 5 Sources by Destination Ports [Logs CEF ArcSight]\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-f03d734b-b85c-4e99-9c0e-9c89716a81f3", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d.json b/packages/cef/2.0.3/kibana/visualization/cef-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d.json deleted file mode 100755 index 827c7905e2..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events Types by Severity [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.device.product:\\\"DNS Trace Log\\\"\"},\"id\":\"db54ebce-9dd2-4a1e-b476-b3ddb9a9024e\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":\"0\",\"formatter\":\"number\",\"id\":\"81da76ca-1112-4d91-82f4-c66cd3156a84\",\"label\":\"Cumulative Bytes\",\"line_width\":\"3\",\"metrics\":[{\"field\":\"source.bytes\",\"id\":\"521d560c-321a-4410-9eb3-2b2bf3f4efee\",\"type\":\"count\"}],\"point_size\":\"0\",\"seperate_axis\":1,\"split_color_mode\":\"gradient\",\"split_filters\":[{\"color\":\"rgba(244,78,59,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"(event.severity:\\\"2\\\" OR event.severity:\\\"3\\\" OR event.severity:\\\"5\\\" OR event.severity:\\\"16\\\" OR cef.extension.deviceCustomString4:\\\"SERVFAIL\\\" OR cef.extension.deviceCustomString4:\\\"NXDOMAIN\\\" OR cef.extension.deviceCustomString4:\\\"REFUSED\\\" OR cef.extension.deviceCustomString4:\\\"BADVERS\\\" OR cef.extension.deviceCustomString4:\\\"BADSIG\\\")\"},\"id\":\"3f31a7e4-acf3-4f2d-8b7d-e30522325b2a\",\"label\":\"HIGH\"},{\"color\":\"rgba(254,146,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"(event.severity:\\\"1\\\" OR event.severity:\\\"4\\\" OR event.severity:\\\"6\\\" OR event.severity:\\\"7\\\" OR event.severity:\\\"8\\\" OR event.severity:\\\"9\\\" OR event.severity:\\\"10\\\" OR event.severity:\\\"17\\\" OR event.severity:\\\"18\\\" OR event.severity:\\\"19\\\" OR event.severity:\\\"20\\\" OR event.severity:\\\"21\\\" OR event.severity:\\\"22\\\" OR cef.extension.deviceCustomString4:\\\"Error\\\" OR cef.extension.deviceCustomString4:\\\"ERROR\\\" OR cef.extension.deviceCustomString4:\\\"Warning\\\" OR cef.extension.deviceCustomString4:\\\"WARNING\\\" OR cef.extension.deviceCustomString4:\\\"FORMERR\\\" OR cef.extension.deviceCustomString4:\\\"NOTIMP\\\" OR cef.extension.deviceCustomString4:\\\"YXDOMAIN\\\" OR cef.extension.deviceCustomString4:\\\"YXRRSET\\\" OR cef.extension.deviceCustomString4:\\\"NXRRSET\\\" OR cef.extension.deviceCustomString4:\\\"NOTAUTH\\\" OR cef.extension.deviceCustomString4:\\\"NOTZONE\\\" OR cef.extension.deviceCustomString4:\\\"BADKEY\\\" OR cef.extension.deviceCustomString4:\\\"BADTIME\\\" OR cef.extension.deviceCustomString4:\\\"BADMODE\\\" OR cef.extension.deviceCustomString4:\\\"BADNAME\\\" OR cef.extension.deviceCustomString4:\\\"BADALG\\\" OR cef.extension.deviceCustomString4:\\\"BADTRUNC\\\")\"},\"id\":\"7949d31b-8aae-433a-b7cf-6939a8728cc9\",\"label\":\"MEDIUM\"},{\"color\":\"rgba(252,220,0,1)\",\"filter\":{\"language\":\"lucene\",\"query\":\"(NOT (event.severity:\\\"2\\\" OR event.severity:\\\"3\\\" OR event.severity:\\\"5\\\" OR event.severity:\\\"16\\\" OR cef.extension.deviceCustomString4:\\\"SERVFAIL\\\" OR cef.extension.deviceCustomString4:\\\"NXDOMAIN\\\" OR cef.extension.deviceCustomString4:\\\"REFUSED\\\" OR cef.extension.deviceCustomString4:\\\"BADVERS\\\" OR cef.extension.deviceCustomString4:\\\"BADSIG\\\" OR event.severity:\\\"1\\\" OR event.severity:\\\"4\\\" OR event.severity:\\\"6\\\" OR event.severity:\\\"7\\\" OR event.severity:\\\"8\\\" OR event.severity:\\\"9\\\" OR event.severity:\\\"10\\\" OR event.severity:\\\"17\\\" OR event.severity:\\\"18\\\" OR event.severity:\\\"19\\\" OR event.severity:\\\"20\\\" OR event.severity:\\\"21\\\" OR event.severity:\\\"22\\\" OR cef.extension.deviceCustomString4:\\\"Error\\\" OR cef.extension.deviceCustomString4:\\\"ERROR\\\" OR cef.extension.deviceCustomString4:\\\"Warning\\\" OR cef.extension.deviceCustomString4:\\\"WARNING\\\" OR cef.extension.deviceCustomString4:\\\"FORMERR\\\" OR cef.extension.deviceCustomString4:\\\"NOTIMP\\\" OR cef.extension.deviceCustomString4:\\\"YXDOMAIN\\\" OR cef.extension.deviceCustomString4:\\\"YXRRSET\\\" OR cef.extension.deviceCustomString4:\\\"NXRRSET\\\" OR cef.extension.deviceCustomString4:\\\"NOTAUTH\\\" OR cef.extension.deviceCustomString4:\\\"NOTZONE\\\" OR cef.extension.deviceCustomString4:\\\"BADKEY\\\" OR cef.extension.deviceCustomString4:\\\"BADTIME\\\" OR cef.extension.deviceCustomString4:\\\"BADMODE\\\" OR cef.extension.deviceCustomString4:\\\"BADNAME\\\" OR cef.extension.deviceCustomString4:\\\"BADALG\\\" OR cef.extension.deviceCustomString4:\\\"BADTRUNC\\\"))\"},\"id\":\"d2627211-5f9e-4c65-8a47-1cd6f085939d\",\"label\":\"LOW\"}],\"split_mode\":\"filters\",\"stacked\":\"none\"},{\"axis_position\":\"right\",\"chart_type\":\"bar\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"a5fda184-fdd6-4221-ab59-492eab162f0a\",\"label\":\"Count by Event Type\",\"line_width\":1,\"metrics\":[{\"id\":\"e147ba1c-b13a-496f-9841-b99ddee81c5a\",\"type\":\"count\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"terms\",\"stacked\":\"none\",\"terms_field\":\"cef.device.event_class_id\",\"terms_size\":\"20\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events Types by Severity [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-f0e60404-ddf4-4b46-8e45-e28c4fb6d60d", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0.json b/packages/cef/2.0.3/kibana/visualization/cef-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0.json deleted file mode 100755 index 5b23c7fb8e..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Events by Size [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"listeners\":{},\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"drop_last_bucket\":1,\"filter\":{\"language\":\"lucene\",\"query\":\"cef.device.product:\\\"DNS Trace Log\\\"\"},\"id\":\"6e634117-6b30-411c-b74c-75510befe42f\",\"index_pattern\":\"logs-*\",\"interval\":\"auto\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(0,156,224,1)\",\"fill\":0.5,\"filter\":{\"language\":\"lucene\",\"query\":\"deviceDirection:\\\"0\\\"\"},\"formatter\":\"bytes\",\"id\":\"28b1fb5b-0f16-4519-b901-4dd2dcc39915\",\"label\":\"Inbound Bytes\",\"line_width\":\"2\",\"metrics\":[{\"field\":\"source.bytes\",\"id\":\"f613f33f-6459-4e46-a3a0-c36c48c46b2e\",\"type\":\"sum\"}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"filter\",\"stacked\":\"none\"},{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"rgba(244,78,59,1)\",\"fill\":0.5,\"filter\":{\"language\":\"lucene\",\"query\":\"deviceDirection:\\\"1\\\"\"},\"formatter\":\"bytes\",\"id\":\"5a5c2529-4990-4006-b039-c94069ff6b7e\",\"label\":\"Outbound Bytes\",\"line_width\":\"2\",\"metrics\":[{\"field\":\"source.bytes\",\"id\":\"b69501e7-56d5-4c38-81d1-34d778c81e11\",\"type\":\"sum\"},{\"id\":\"0aaab374-5845-44ab-94f5-ac4fab25c287\",\"script\":\"params.outbound_bytes \\u003e= 0 ? params.outbound_bytes * -1 : 0\",\"type\":\"calculation\",\"variables\":[{\"field\":\"b69501e7-56d5-4c38-81d1-34d778c81e11\",\"id\":\"23b8c41c-0e98-4ace-8bca-3593e46cd955\",\"name\":\"outbound_bytes\"}]}],\"point_size\":1,\"seperate_axis\":0,\"split_color_mode\":\"gradient\",\"split_mode\":\"filter\",\"stacked\":\"none\"}],\"show_legend\":1,\"time_field\":\"@timestamp\",\"type\":\"timeseries\",\"use_kibana_indexes\":false},\"title\":\"Events by Size [Logs CEF ArcSight]\",\"type\":\"metrics\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-f3c573ad-2c16-4de5-9ec3-0a47141d4fa0", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-f5258de9-71f7-410f-b713-201007f77470.json b/packages/cef/2.0.3/kibana/visualization/cef-f5258de9-71f7-410f-b713-201007f77470.json deleted file mode 100755 index aed8102339..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-f5258de9-71f7-410f-b713-201007f77470.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Top 10 Application Protocols [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"network.application\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"maxFontSize\":72,\"minFontSize\":26,\"orientation\":\"single\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"scale\":\"square root\"},\"title\":\"Top 10 Application Protocols [Logs CEF ArcSight]\",\"type\":\"tagcloud\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-f5258de9-71f7-410f-b713-201007f77470", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-f57734dd-0f32-42b4-94dd-5d597f6735e1.json b/packages/cef/2.0.3/kibana/visualization/cef-f57734dd-0f32-42b4-94dd-5d597f6735e1.json deleted file mode 100755 index 74a61138dc..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-f57734dd-0f32-42b4-94dd-5d597f6735e1.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Device Types by Vendor [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"exclude\":\"Network-based IDS/IPS\",\"field\":\"cef.extensions.categoryDeviceType\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"exclude\":\"\",\"field\":\"cef.device.vendor\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":true,\"isDonut\":false,\"legendPosition\":\"right\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"}},\"title\":\"Device Types by Vendor [Logs CEF ArcSight]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-f57734dd-0f32-42b4-94dd-5d597f6735e1", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-fa8b26c1-6973-4381-adb3-bcde0d03a520.json b/packages/cef/2.0.3/kibana/visualization/cef-fa8b26c1-6973-4381-adb3-bcde0d03a520.json deleted file mode 100755 index 32a6dda32a..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-fa8b26c1-6973-4381-adb3-bcde0d03a520.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Unique Destinations and Ports by Source [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Destination Addresses\",\"field\":\"destination.ip\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source Addresses\",\"field\":\"source.ip\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Destination Ports\",\"field\":\"destination.port\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Source Addresses\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Destination Addresses\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"},{\"data\":{\"id\":\"3\",\"label\":\"Destination Ports\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-2\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Destination Addresses\"},\"type\":\"value\"},{\"id\":\"ValueAxis-2\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"RightAxis-1\",\"position\":\"right\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Destination Ports\"},\"type\":\"value\"}]},\"title\":\"Unique Destinations and Ports by Source [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-fa8b26c1-6973-4381-adb3-bcde0d03a520", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-fcf798a8-db8f-4492-827b-8fa7581108a9.json b/packages/cef/2.0.3/kibana/visualization/cef-fcf798a8-db8f-4492-827b-8fa7581108a9.json deleted file mode 100755 index cce501f750..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-fcf798a8-db8f-4492-827b-8fa7581108a9.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Event Types by Size [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"Count\":\"#64B0C8\",\"Total (Bytes)\":\"#E24D42\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Event Type\",\"field\":\"cef.device.event_class_id\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Total (Bytes)\",\"field\":\"source.bytes\"},\"schema\":\"metric\",\"type\":\"sum\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"rotate\":75,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Event Type\"},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"},\"valueAxis\":null},\"legendPosition\":\"right\",\"orderBucketsBySum\":false,\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"},{\"data\":{\"id\":\"3\",\"label\":\"Total (Bytes)\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":3,\"mode\":\"normal\",\"show\":true,\"showCircles\":false,\"type\":\"line\",\"valueAxis\":\"ValueAxis-2\"}],\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"},{\"id\":\"ValueAxis-2\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"RightAxis-1\",\"position\":\"right\",\"scale\":{\"mode\":\"normal\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Total (Bytes)\"},\"type\":\"value\"}]},\"title\":\"Event Types by Size [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-fcf798a8-db8f-4492-827b-8fa7581108a9", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-f85a3444-8a43-4e46-b872-4e44bc25d0f3", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60.json b/packages/cef/2.0.3/kibana/visualization/cef-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60.json deleted file mode 100755 index 0907dbbef8..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Destination Ports by Outcomes [Logs CEF ArcSight]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"destination.port\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":20},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"destination.port: Descending\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"defaultYExtents\":true,\"mode\":\"normal\",\"setYExtents\":false,\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"value\"}]},\"title\":\"Destination Ports by Outcomes [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-fe7b63d1-dbc7-4376-af7f-ace97a9f2e60", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-5cede2d3-20fe-4140-add4-4c4f841b71a2", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/kibana/visualization/cef-fff249b2-18b6-4b48-bcf7-dd4595d111e7.json b/packages/cef/2.0.3/kibana/visualization/cef-fff249b2-18b6-4b48-bcf7-dd4595d111e7.json deleted file mode 100755 index df5b0a6e9f..0000000000 --- a/packages/cef/2.0.3/kibana/visualization/cef-fff249b2-18b6-4b48-bcf7-dd4595d111e7.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[]}" - }, - "savedSearchRefName": "search_0", - "title": "Outcome by Device Type [Logs CEF ArcSight]", - "uiStateJSON": "{\"vis\":{\"colors\":{\"/Failure\":\"#BF1B00\",\"/Success\":\"#629E51\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Firewall Types\",\"field\":\"cef.extensions.categoryDeviceType\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Event Outcome\",\"field\":\"cef.extensions.categoryOutcome\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":3},\"schema\":\"group\",\"type\":\"terms\"}],\"listeners\":{},\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"rotate\":75,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Firewall Types\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"orderBucketsBySum\":true,\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"percentage\",\"type\":\"square root\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"value\"}]},\"title\":\"Outcome by Device Type [Logs CEF ArcSight]\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "8.0.0", - "id": "cef-fff249b2-18b6-4b48-bcf7-dd4595d111e7", - "migrationVersion": { - "visualization": "8.0.0" - }, - "references": [ - { - "id": "cef-68202a5c-c8f2-432f-8c08-04fbfacb95c8", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/cef/2.0.3/manifest.yml b/packages/cef/2.0.3/manifest.yml deleted file mode 100755 index 5bcae7fa17..0000000000 --- a/packages/cef/2.0.3/manifest.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: cef -title: CEF Logs -version: "2.0.3" -release: ga -description: Collect logs from CEF Logs with Elastic Agent. -type: integration -format_version: 1.0.0 -license: basic -categories: - - network - - security -conditions: - kibana.version: ^8.0.0 -policy_templates: - - name: cef - title: CEF logs - description: Collect logs from CEF instances - inputs: - - type: logfile - title: "Collect CEF application logs (input: logfile)" - description: "Collecting application logs from CEF instances (input: logfile)" - - type: udp - title: "Collect CEF application logs (input: udp)" - description: "Collecting application logs from CEF instances (input: udp)" -owner: - github: elastic/security-external-integrations diff --git a/packages/checkpoint/1.5.1/changelog.yml b/packages/checkpoint/1.5.1/changelog.yml deleted file mode 100755 index 8c46c1e29a..0000000000 --- a/packages/checkpoint/1.5.1/changelog.yml +++ /dev/null @@ -1,126 +0,0 @@ -# newer versions go on top -- version: "1.5.1" - changes: - - description: Update Checkpoint logo. - type: enhancement - link: https://github.com/elastic/integrations/pull/1 -- version: "1.5.0" - changes: - - description: Add TLS and custom options support to TCP input. - type: enhancement - link: https://github.com/elastic/integrations/pull/3317 -- version: "1.4.0" - changes: - - description: Update to ECS 8.2 to use new email field set. - type: enhancement - link: https://github.com/elastic/integrations/pull/2803 -- version: "1.3.6" - changes: - - description: Fixed parsing error when logs have trailing spaces - type: bugfix - link: https://github.com/elastic/integrations/pull/3035 -- version: "1.3.5" - changes: - - description: Added link to check point documentation. - type: enhancement - link: https://github.com/elastic/integrations/pull/2926 -- version: "1.3.4" - changes: - - description: Change mapping type of checkpoint.source_object to keyword from integer. - type: bugfix - link: https://github.com/elastic/integrations/pull/2951 -- version: "1.3.3" - changes: - - description: Add documentation for multi-fields - type: enhancement - link: https://github.com/elastic/integrations/pull/2916 -- version: "1.3.2" - changes: - - description: Fix field mapping conflicts for `checkpoint.icmp_type`, `checkpoint.icmp_code` & `checkpoint.email_recipients_num` - type: bugfix - link: https://github.com/elastic/integrations/pull/2895 -- version: "1.3.1" - changes: - - description: Add Ingest Pipeline script to map IANA Protocol Numbers - type: bugfix - link: https://github.com/elastic/integrations/pull/2470 -- version: "1.3.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2387 -- version: "1.2.2" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.2.1" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.2.0" - changes: - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2231 -- version: "1.1.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1951 -- version: "1.1.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1803 -- version: "1.1.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1653 -- version: "1.0.0" - changes: - - description: make GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1605 -- version: "0.8.2" - changes: - - description: Convert to generated ECS fields - type: enhancement - link: https://github.com/elastic/integrations/pull/1470 -- version: '0.8.1' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1376 -- version: "0.8.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.7.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1256 -- version: "0.6.0" - changes: - - description: update to ECS 1.10.0 and syncing module changes - type: enhancement - link: https://github.com/elastic/integrations/pull/1033 -- version: "0.5.2" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/839 -- version: "0.5.1" - changes: - - description: Change kibana.version constraint to be more conservative. - type: bugfix - link: https://github.com/elastic/integrations/pull/749 -- version: "0.1.0" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/220 diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/log.yml.hbs b/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/log.yml.hbs deleted file mode 100755 index 24ecbba6d7..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/log.yml.hbs +++ /dev/null @@ -1,38 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- add_locale: ~ -{{#if processors}} -{{processors}} -{{/if}} -{{#if internal_zones.length}} -- add_fields: - target: _temp_ - fields: - internal_zones: - {{#each internal_zones as |zone i|}} - - {{zone}} - {{/each}} -{{/if}} -{{#if external_zones.length}} -- add_fields: - target: _temp_ - fields: - external_zones: - {{#each external_zones as |zone i|}} - - {{zone}} - {{/each}} -{{/if}} diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/tcp.yml.hbs b/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/tcp.yml.hbs deleted file mode 100755 index cc8e682ac4..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,40 +0,0 @@ -host: "{{syslog_host}}:{{syslog_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -processors: -- add_locale: ~ -{{#if processors}} -{{processors}} -{{/if}} -{{#if internal_zones.length}} -- add_fields: - target: _temp_ - fields: - internal_zones: - {{#each internal_zones as |zone i|}} - - {{zone}} - {{/each}} -{{/if}} -{{#if external_zones.length}} -- add_fields: - target: _temp_ - fields: - external_zones: - {{#each external_zones as |zone i|}} - - {{zone}} - {{/each}} -{{/if}} -{{#if tcp_options.length}} -{{tcp_options}} -{{/if}} diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/udp.yml.hbs b/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/udp.yml.hbs deleted file mode 100755 index 79ed0fc89d..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,34 +0,0 @@ -host: "{{syslog_host}}:{{syslog_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- add_locale: ~ -{{#if processors}} -{{processors}} -{{/if}} -{{#if internal_zones.length}} -- add_fields: - target: _temp_ - fields: - internal_zones: - {{#each internal_zones as |zone i|}} - - {{zone}} - {{/each}} -{{/if}} -{{#if external_zones.length}} -- add_fields: - target: _temp_ - fields: - external_zones: - {{#each external_zones as |zone i|}} - - {{zone}} - {{/each}} -{{/if}} diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/checkpoint/1.5.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 6de6cf8bbd..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,835 +0,0 @@ ---- -description: Pipeline for parsing checkpoint firewall logs -processors: - - set: - field: ecs.version - value: '8.2.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - grok: - field: event.original - patterns: - - '%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) - +(?:%{IPORHOST:syslog5424_host}|-) +(-|%{SYSLOG5424PRINTASCII:syslog5424_app}) - +(-|%{SYSLOG5424PRINTASCII:syslog5424_proc}) +(?::-|%{SYSLOG5424PRINTASCII:syslog5424_msgid}) - +\[%{GREEDYDATA:syslog5424_sd}\]' - - kv: - field: syslog5424_sd - field_split: "; " - value_split: ":" - trim_key: " " - trim_value: " " - prefix: checkpoint. - strip_brackets: true - ignore_failure: true - exclude_keys: - - flags - - layer_uuid - - originsicname - - __policy_id_tag - - version - - rounded_bytes - - db_tag - - update_service - - remove: - field: - - syslog5424_sd - - syslog5424_app - - syslog5424_host - - syslog5424_msgid - - syslog5424_pri - - syslog5424_proc - - syslog5424_ver - - host - ignore_missing: true - - rename: - field: "@timestamp" - target_field: "event.created" - ignore_missing: true - - date: - field: "syslog5424_ts" - formats: ["ISO8601", "UNIX"] - if: "ctx.checkpoint?.time == null" - - append: - field: event.category - value: network - if: ctx.checkpoint?.operation != 'Log In' - - set: - field: observer.vendor - value: Checkpoint - - set: - field: observer.type - value: firewall - if: ctx.checkpoint?.type == null - - set: - field: observer.product - value: "{{checkpoint.product}}" - ignore_empty_value: true - - rename: - field: checkpoint.src - target_field: source.ip - ignore_missing: true - - rename: - field: checkpoint.client_ip - target_field: source.ip - ignore_missing: true - if: ctx.source?.ip == null - - rename: - field: checkpoint.xlatesrc - target_field: source.nat.ip - if: "ctx.checkpoint?.xlatesrc != '0.0.0.0'" - ignore_missing: true - - rename: - field: checkpoint.dst - target_field: destination.ip - ignore_missing: true - - rename: - field: checkpoint.xlatedst - target_field: destination.nat.ip - if: "ctx.checkpoint?.xlatedst != '0.0.0.0'" - ignore_missing: true - - rename: - field: checkpoint.uid - target_field: source.user.id - ignore_missing: true - - rename: - field: checkpoint.administrator - target_field: source.user.name - ignore_missing: true - - rename: - field: checkpoint.source_user_name - target_field: source.user.name - if: ctx.source?.user?.name == null - ignore_missing: true - - convert: - field: checkpoint.client_outbound_packets - target_field: source.packets - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.server_outbound_packets - target_field: destination.packets - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.client_outbound_bytes - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.sent_byte - target_field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - if: ctx.source?.bytes == null - - convert: - field: checkpoint.server_outbound_bytes - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.received_bytes - target_field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - if: ctx.destination?.bytes == null - - convert: - field: checkpoint.service - target_field: destination.port - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.xlatedport - target_field: destination.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.checkpoint?.xlatedport != '0'" - - convert: - field: checkpoint.s_port - target_field: source.port - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.xlatesport - target_field: source.nat.port - type: long - ignore_failure: true - ignore_missing: true - if: "ctx.checkpoint?.xlatesport != '0'" - - rename: - field: checkpoint.mac_source_address - target_field: source.mac - ignore_missing: true - - rename: - field: checkpoint.src_machine_name - target_field: source.domain - ignore_missing: true - - rename: - field: checkpoint.destination_dns_hostname - target_field: destination.domain - ignore_missing: true - - rename: - field: checkpoint.dst_machine_name - target_field: destination.domain - if: ctx.server?.domain == null - ignore_missing: true - - rename: - field: checkpoint.src_user_group - target_field: source.user.group.name - ignore_missing: true - - append: - field: event.category - value: authentication - if: ctx.checkpoint?.operation == 'Log In' - - set: - field: event.kind - value: alert - if: "['Prevent', 'Detect', 'Quarantine'].contains(ctx.checkpoint?.rule_action)" - - set: - field: event.kind - value: event - if: ctx.event?.kind == null - - set: - field: event.outcome - value: success - if: "['Accept', 'Allow'].contains(ctx.checkpoint?.rule_action)" - - append: - field: event.type - value: - - allowed - - connection - if: "['Accept', 'Allow'].contains(ctx.checkpoint?.rule_action)" - - set: - field: event.outcome - value: success - if: ctx.checkpoint?.audit_status == 'Success' - - set: - field: event.outcome - value: failure - if: ctx.checkpoint?.audit_status == 'Failure' - - set: - field: event.outcome - value: success - if: "['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.rule_action)" - - append: - field: event.type - value: - - connection - - denied - if: "['Drop', 'Reject', 'Block', 'Prevent'].contains(ctx.checkpoint?.rule_action)" - - append: - field: event.category - value: malware - if: ctx.checkpoint?.malware_action != null - - append: - field: event.category - value: intrusion_detection - if: "['Detect', 'Prevent'].contains(ctx.checkpoint?.rule_action)" - - append: - field: related.ip - value: "{{source.ip}}" - if: ctx.source?.ip != null - - append: - field: related.ip - value: "{{source.nat.ip}}" - if: ctx.source?.nat?.ip != null - - append: - field: related.ip - value: "{{destination.ip}}" - if: ctx.destination?.ip != null - - append: - field: related.ip - value: "{{destination.nat.ip}}" - if: ctx.destination?.nat?.ip != null - - append: - field: related.hash - value: "{{checkpoint.file_md5}}" - if: ctx.checkpoint?.file_md5 != null - - append: - field: related.hash - value: "{{checkpoint.file_sha1}}" - if: ctx.checkpoint?.file_sha1 != null - - append: - field: related.hash - value: "{{checkpoint.file_sha256}}" - if: ctx.checkpoint?.file_sha256 != null - - rename: - field: checkpoint.from - target_field: source.user.email - ignore_missing: true - - rename: - field: checkpoint.to - target_field: destination.user.email - ignore_missing: true - - set: - field: email.from.address - value: ["{{{destination.user.email}}}"] - if: "ctx?.destination?.user?.email != null" - - set: - field: email.to.address - value: ["{{{destination.user.email}}}"] - if: "ctx?.destination?.user?.email != null" - - append: - field: email.from.address - value: "{{{checkpoint.mime_from}}}" - if: "ctx?.checkpoint?.mime_from != null" - - append: - field: email.to.address - value: "{{{checkpoint.mime_to}}}" - if: "ctx?.checkpoint?.mime_to != null" - - set: - field: email.subject - copy_from: checkpoint.email_subject - if: "ctx?.checkpoint?.email_subject != null" - - append: - field: email.bcc.address - value: "{{{checkpoint.bcc}}}" - if: "ctx?.checkpoint?.bcc != null" - - append: - field: email.cc.address - value: "{{{checkpoint.cc}}}" - if: "ctx?.checkpoint?.cc != null" - - set: - field: email.delivery_timestamp - copy_from: checkpoint.delivery_time - if: "ctx?.checkpoint?.delivery_time != null" - - set: - field: email.message_id - copy_from: checkpoint.email_message_id - if: "ctx?.checkpoint?.email_message_id != null" - - set: - field: email.local_id - copy_from: checkpoint.email_queue_id - if: "ctx?.checkpoint?.email_queue_id != null" - - rename: - field: checkpoint.usercheck_incident_uid - target_field: destination.user.id - ignore_missing: true - - rename: - field: checkpoint.service_name - target_field: destination.service.name - ignore_missing: true - - rename: - field: checkpoint.mac_destination_address - target_field: destination.mac - ignore_missing: true - - rename: - field: checkpoint.dns_type - target_field: dns.question.type - ignore_missing: true - - rename: - field: checkpoint.domain_name - target_field: dns.question.name - ignore_missing: true - - rename: - field: checkpoint.dns_message_type - target_field: dns.type - ignore_missing: true - - rename: - field: checkpoint.tid - target_field: dns.id - ignore_missing: true - - rename: - field: checkpoint.loguid - target_field: event.id - ignore_missing: true - - convert: - field: checkpoint.sequencenum - target_field: event.sequence - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: checkpoint.severity - target_field: event.severity - type: long - ignore_failure: true - ignore_missing: true - - rename: - field: checkpoint.action - target_field: event.action - ignore_missing: true - - rename: - field: checkpoint.packet_capture - target_field: event.url - ignore_missing: true - - rename: - field: checkpoint.start_time - target_field: event.start - ignore_missing: true - - rename: - field: checkpoint.first_detection - target_field: event.start - ignore_missing: true - if: ctx.event?.start == null - - rename: - field: checkpoint.last_detection - target_field: event.end - ignore_missing: true - - rename: - field: checkpoint.app_risk - target_field: event.risk_score - ignore_missing: true - - rename: - field: checkpoint.file_id - target_field: file.inode - ignore_missing: true - - rename: - field: checkpoint.file_type - target_field: file.type - ignore_missing: true - - rename: - field: checkpoint.file_name - target_field: file.name - ignore_missing: true - - convert: - field: checkpoint.file_size - target_field: file.size - type: long - ignore_failure: true - ignore_missing: true - - rename: - field: checkpoint.file_md5 - target_field: file.hash.md5 - ignore_missing: true - - rename: - field: checkpoint.file_sha1 - target_field: file.hash.sha1 - ignore_missing: true - - rename: - field: checkpoint.file_sha256 - target_field: file.hash.sha256 - ignore_missing: true - - rename: - field: checkpoint.dlp_file_name - target_field: file.name - ignore_missing: true - - rename: - field: checkpoint.user_group - target_field: group.name - ignore_missing: true - - rename: - field: checkpoint.os_version - target_field: host.os.version - ignore_missing: true - - rename: - field: checkpoint.os_name - target_field: host.os.name - ignore_missing: true - - rename: - field: checkpoint.method - target_field: http.request.method - ignore_missing: true - - rename: - field: checkpoint.referrer - target_field: http.request.referrer - ignore_missing: true - - rename: - field: checkpoint.service_id - target_field: network.application - ignore_missing: true - - rename: - field: checkpoint.ifdir - target_field: network.direction - ignore_missing: true - - rename: - field: checkpoint.bytes - target_field: network.bytes - ignore_missing: true - - rename: - field: checkpoint.proto - target_field: network.iana_number - ignore_missing: true - - script: - lang: painless - ignore_failure: true - if: ctx?.network?.iana_number != null - source: | - def iana_number = ctx.network.iana_number; - if (iana_number == '0') { - ctx.network.transport = 'hopopt'; - } else if (iana_number == '1') { - ctx.network.transport = 'icmp'; - } else if (iana_number == '2') { - ctx.network.transport = 'igmp'; - } else if (iana_number == '6') { - ctx.network.transport = 'tcp'; - } else if (iana_number == '8') { - ctx.network.transport = 'egp'; - } else if (iana_number == '17') { - ctx.network.transport = 'udp'; - } else if (iana_number == '47') { - ctx.network.transport = 'gre'; - } else if (iana_number == '50') { - ctx.network.transport = 'esp'; - } else if (iana_number == '58') { - ctx.network.transport = 'ipv6-icmp'; - } else if (iana_number == '112') { - ctx.network.transport = 'vrrp'; - } else if (iana_number == '132') { - ctx.network.transport = 'sctp'; - } - - rename: - field: checkpoint.packets - target_field: network.packets - ignore_missing: true - - rename: - field: checkpoint.layer_name - target_field: network.name - ignore_missing: true - - rename: - field: checkpoint.app_name - target_field: network.application - ignore_missing: true - - rename: - field: checkpoint.client_inbound_interface - target_field: observer.ingress.interface.name - ignore_missing: true - - rename: - field: checkpoint.client_outbound_interface - target_field: observer.egress.interface.name - ignore_missing: true - - rename: - field: checkpoint.ifname - target_field: observer.ingress.interface.name - ignore_missing: true - if: ctx.network?.direction == 'inbound' - - rename: - field: checkpoint.ifname - target_field: observer.egress.interface.name - ignore_missing: true - if: ctx.network?.direction == 'outbound' - - rename: - field: checkpoint.type - target_field: observer.type - ignore_missing: true - - rename: - field: checkpoint.origin - target_field: observer.name - ignore_missing: true - - rename: - field: checkpoint.origin_ip - target_field: observer.ip - ignore_missing: true - - rename: - field: checkpoint.endpoint_ip - target_field: observer.ip - ignore_missing: true - if: ctx.observer?.ip == null - - rename: - field: checkpoint.outzone - target_field: observer.egress.zone - ignore_missing: true - - rename: - field: checkpoint.inzone - target_field: observer.ingress.zone - ignore_missing: true - - rename: - field: checkpoint.security_outzone - target_field: observer.egress.zone - ignore_missing: true - if: ctx.observer?.egress?.zone == null - - rename: - field: checkpoint.security_inzone - target_field: observer.ingress.zone - ignore_missing: true - if: ctx.observer?.ingress?.zone == null - - rename: - field: checkpoint.update_version - target_field: observer.version - ignore_missing: true - - rename: - field: checkpoint.process_md5 - target_field: process.hash.md5 - ignore_missing: true - - rename: - field: checkpoint.process_name - target_field: process.name - ignore_missing: true - - rename: - field: checkpoint.parent_process_md5 - target_field: process.parent.hash.md5 - ignore_missing: true - - rename: - field: checkpoint.parent_process_name - target_field: process.parent.name - ignore_missing: true - - rename: - field: checkpoint.matched_category - target_field: rule.category - ignore_missing: true - - rename: - field: checkpoint.categories - target_field: rule.category - ignore_missing: true - if: ctx.rule?.category == null - - rename: - field: checkpoint.malware_action - target_field: rule.description - ignore_missing: true - - rename: - field: checkpoint.malware_rule_id - target_field: rule.id - ignore_missing: true - - rename: - field: checkpoint.app_rule_id - target_field: rule.id - ignore_missing: true - if: ctx.rule?.id == null - - rename: - field: checkpoint.objectname - target_field: rule.name - ignore_missing: true - - rename: - field: checkpoint.rule_name - target_field: rule.name - ignore_missing: true - if: ctx.rule?.name == null - - rename: - field: checkpoint.malware_rule_name - target_field: rule.name - ignore_missing: true - if: ctx.rule?.name == null - - rename: - field: checkpoint.app_rule_name - target_field: rule.name - ignore_missing: true - if: ctx.rule?.name == null - - rename: - field: checkpoint.dlp_rule_name - target_field: rule.name - ignore_missing: true - if: ctx.rule?.name == null - - rename: - field: checkpoint.smartdefence_profile - target_field: rule.ruleset - ignore_missing: true - - rename: - field: checkpoint.policy - target_field: rule.ruleset - ignore_missing: true - if: ctx.rule?.ruleset == null - - rename: - field: checkpoint.rule_uid - target_field: rule.uuid - ignore_missing: true - - rename: - field: checkpoint.dlp_rule_uid - target_field: rule.uuid - ignore_missing: true - if: ctx.rule?.uuid == null - - rename: - field: checkpoint.url - target_field: url.original - ignore_missing: true - - rename: - field: checkpoint.resource - target_field: url.original - ignore_missing: true - if: ctx.url?.original == null - - rename: - field: checkpoint.http_host - target_field: url.domain - ignore_missing: true - - rename: - field: checkpoint.web_client_type - target_field: user_agent.name - ignore_missing: true - - rename: - field: checkpoint.user_agent - target_field: user_agent.original - ignore_missing: true - - rename: - field: checkpoint.industry_reference - target_field: vulnerability.id - ignore_missing: true - - date: - field: "checkpoint.time" - formats: ["ISO8601", "UNIX"] - if: "ctx.checkpoint?.time != null" - - rename: - field: checkpoint.message - target_field: message - ignore_missing: true - - rename: - field: checkpoint.reason - target_field: message - ignore_missing: true - if: ctx.message == null - - rename: - field: checkpoint.subject - target_field: message - ignore_missing: true - if: ctx.message == null - - gsub: - field: checkpoint.sys_message - pattern: ^:" - replacement: "" - if: ctx.checkpoint?.sys_message != null - - append: - field: related.user - value: "{{source.user.name}}" - if: ctx.source?.user?.name != null - - append: - field: related.user - value: "{{destination.user.name}}" - if: ctx.destination?.user?.name != null - - script: - lang: painless - source: "ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes" - if: ctx?.source?.bytes != null && ctx?.destination?.bytes != null && ctx?.network?.bytes == null - ignore_failure: true - - script: - lang: painless - source: "ctx.network.packets = ctx.source.packets + ctx.destination.packets" - if: ctx?.source?.packets != null && ctx?.destination?.packets != null && ctx?.network?.packets == null - ignore_failure: true - - rename: - field: checkpoint.action_reason - target_field: checkpoint.action_reason_msg - if: ctx.checkpoint?.action_reason != null && ctx.checkpoint?.action_reason.contains(" ") - ignore_missing: true - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - if: ctx.source?.geo == null - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - if: ctx.destination?.geo == null - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - # Handle zone-based network directionality - - set: - field: network.direction - value: inbound - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.external_zones.contains(ctx.observer.ingress.zone) && - ctx._temp_.internal_zones.contains(ctx.observer.egress.zone) - - set: - field: network.direction - value: outbound - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.external_zones.contains(ctx.observer.egress.zone) && - ctx._temp_.internal_zones.contains(ctx.observer.ingress.zone) - - set: - field: network.direction - value: internal - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.internal_zones.contains(ctx.observer.egress.zone) && - ctx._temp_.internal_zones.contains(ctx.observer.ingress.zone) - - set: - field: network.direction - value: external - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.external_zones.contains(ctx.observer.egress.zone) && - ctx._temp_.external_zones.contains(ctx.observer.ingress.zone) - - set: - field: network.direction - value: unknown - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ( - ( - !ctx._temp_.external_zones.contains(ctx.observer.egress.zone) && - !ctx._temp_.internal_zones.contains(ctx.observer.egress.zone) - ) || - ( - !ctx._temp_.external_zones.contains(ctx.observer.ingress.zone) && - !ctx._temp_.internal_zones.contains(ctx.observer.ingress.zone) - ) - ) - - remove: - field: - - checkpoint.client_outbound_packets - - checkpoint.server_outbound_packets - - checkpoint.client_outbound_bytes - - checkpoint.sent_byte - - checkpoint.server_outbound_bytes - - checkpoint.received_bytes - - checkpoint.service - - checkpoint.xlatedport - - checkpoint.s_port - - checkpoint.xlatesport - - checkpoint.sequencenum - - checkpoint.file_size - - checkpoint.product - - checkpoint.severity - - checkpoint.xlatesrc - - checkpoint.xlatedst - - checkpoint.uid - - checkpoint.time - - syslog5424_ts - - _temp_ - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - - set: - field: error.message - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/fields/agent.yml b/packages/checkpoint/1.5.1/data_stream/firewall/fields/agent.yml deleted file mode 100755 index 79a7a39864..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/fields/agent.yml +++ /dev/null @@ -1,180 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on." - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier." - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime." - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes." - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider." - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine." - - name: id - level: core - type: keyword - ignore_above: 1024 - description: "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`." - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: "Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use." - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment." - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/fields/base-fields.yml b/packages/checkpoint/1.5.1/data_stream/firewall/fields/base-fields.yml deleted file mode 100755 index 6bdf832a14..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: checkpoint -- name: event.dataset - type: constant_keyword - description: Event dataset - value: checkpoint.firewall -- name: '@timestamp' - type: date - description: Event timestamp. diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/fields/beats.yml b/packages/checkpoint/1.5.1/data_stream/firewall/fields/beats.yml deleted file mode 100755 index e272492dea..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/fields/beats.yml +++ /dev/null @@ -1,15 +0,0 @@ -- description: Type of Filebeat input. - name: input.type - type: keyword -- description: Flags for the log file. - name: log.flags - type: keyword -- description: Offset of the entry in the log file. - name: log.offset - type: long -- description: Name of the service data is collected from. - name: destination.service.name - type: keyword -- description: Source address of logs received over the network. - name: log.source.address - type: keyword diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/fields/ecs.yml b/packages/checkpoint/1.5.1/data_stream/firewall/fields/ecs.yml deleted file mode 100755 index 506553ea2c..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/fields/ecs.yml +++ /dev/null @@ -1,522 +0,0 @@ -- description: Unique container id. - name: container.id - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: destination.geo.name - type: keyword -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - MAC address of the destination. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: destination.mac - type: keyword -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Packets sent from the destination to the source. - name: destination.packets - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: User email address. - name: destination.user.email - type: keyword -- description: Unique identifier of the user. - name: destination.user.id - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: destination.user.name - type: keyword -- description: The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. - name: dns.id - type: keyword -- description: |- - The name being queried. - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - name: dns.question.name - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - The type of DNS event captured, query or answer. - If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. - If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. - name: dns.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: The date and time when the email message was received by the service or client. - name: email.delivery_timestamp - type: date -- description: The email address of the sender, typically from the RFC 5322 `From:` header field. - name: email.from.address - type: keyword -- description: The email address of recipient - name: email.to.address - type: keyword -- description: The email address of BCC recipient - name: email.bcc.address - type: keyword -- description: The email address of CC recipient - name: email.cc.address - type: keyword -- description: A brief summary of the topic of the message. - multi_fields: - - name: text - type: match_only_text - name: email.subject - type: keyword -- description: Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message. - name: email.message_id - type: wildcard -- description: |- - Unique identifier given to the email by the source that created the event. - Identifier is not persistent across hops. - name: email.local_id - type: keyword -- description: Error message. - name: error.message - type: match_only_text -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. - `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. - This field is an array. This will allow proper categorization of some events that fall in multiple categories. - name: event.category - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: event.end contains the date when the event ended or when the activity was last observed. - name: event.end - type: date -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. - This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. - doc_values: false - index: false - name: event.original - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. - `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. - Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. - Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. - Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. - name: event.outcome - type: keyword -- description: Risk score or priority of the event (e.g. security solutions). Use your system's original value here. - name: event.risk_score - type: float -- description: |- - Sequence number of the event. - The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. - name: event.sequence - type: long -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long -- description: event.start contains the date when the event started or when the activity was first observed. - name: event.start - type: date -- description: |- - This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. - Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - name: event.timezone - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. - `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. - This field is an array. This will allow proper categorization of some events that fall in multiple event types. - name: event.type - type: keyword -- description: |- - URL linking to an external system to continue investigation of this event. - This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. - name: event.url - type: keyword -- description: MD5 hash. - name: file.hash.md5 - type: keyword -- description: SHA1 hash. - name: file.hash.sha1 - type: keyword -- description: SHA256 hash. - name: file.hash.sha256 - type: keyword -- description: Inode representing the file in the filesystem. - name: file.inode - type: keyword -- description: Name of the file including the extension, without the directory. - name: file.name - type: keyword -- description: |- - File size in bytes. - Only relevant when `file.type` is "file". - name: file.size - type: long -- description: File type (file, dir, or symlink). - name: file.type - type: keyword -- description: Name of the group. - name: group.name - type: keyword -- description: |- - Name of the host. - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - name: host.name - type: keyword -- description: Operating system name, without the version. - multi_fields: - - name: text - type: match_only_text - name: host.os.name - type: keyword -- description: Operating system version as a raw string. - name: host.os.version - type: keyword -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: Name given by operators to sections of their network. - name: network.name - type: keyword -- description: |- - Total packets transferred in both directions. - If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - name: network.packets - type: long -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. - name: observer.egress.zone - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. - name: observer.ingress.zone - type: keyword -- description: IP addresses of the observer. - name: observer.ip - type: ip -- description: |- - Custom name of the observer. - This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. - If no custom name is needed, the field can be left empty. - name: observer.name - type: keyword -- description: The product name of the observer. - name: observer.product - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: MD5 hash. - name: process.hash.md5 - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - multi_fields: - - name: text - type: match_only_text - name: process.name - type: keyword -- description: MD5 hash. - name: process.parent.hash.md5 - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - multi_fields: - - name: text - type: match_only_text - name: process.parent.name - type: keyword -- description: All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - name: related.hash - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: A categorization value keyword used by the entity using the rule for detection of this event. - name: rule.category - type: keyword -- description: The description of the rule generating the event. - name: rule.description - type: keyword -- description: A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. - name: rule.id - type: keyword -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. - name: rule.ruleset - type: keyword -- description: A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. - name: rule.uuid - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: |- - User-defined description of a location, at the level of granularity they care about. - Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. - Not typically used in automated geolocation. - name: source.geo.name - type: keyword -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - MAC address of the source. - The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. - name: source.mac - type: keyword -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: User email address. - name: source.user.email - type: keyword -- description: Name of the group. - name: source.user.group.name - type: keyword -- description: Unique identifier of the user. - name: source.user.id - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: source.user.name - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - multi_fields: - - name: text - type: match_only_text - name: url.original - type: wildcard -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - multi_fields: - - name: text - type: match_only_text - name: user_agent.original - type: keyword -- description: The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] - name: vulnerability.id - type: keyword -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/fields/fields.yml b/packages/checkpoint/1.5.1/data_stream/firewall/fields/fields.yml deleted file mode 100755 index a389420a0c..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/fields/fields.yml +++ /dev/null @@ -1,1626 +0,0 @@ -- name: checkpoint - type: group - release: beta - fields: - - name: action_reason - type: integer - description: | - Connection drop reason. - - name: action_reason_msg - type: keyword - overwrite: true - description: | - Connection drop reason message. - - name: additional_info - type: keyword - description: | - ID of original file/mail which are sent by admin. - - name: additional_ip - type: keyword - description: | - DNS host name. - - name: additional_rdata - type: keyword - description: | - List of additional resource records. - - name: alert - type: keyword - description: | - Alert level of matched rule (for connection logs). - - name: allocated_ports - type: integer - description: | - Amount of allocated ports. - - name: analyzed_on - type: keyword - description: | - Check Point ThreatCloud / emulator name. - - name: answer_rdata - type: keyword - description: | - List of answer resource records to the questioned domains. - - name: anti_virus_type - type: keyword - description: | - Anti virus type. - - name: app_desc - type: keyword - description: | - Application description. - - name: app_id - type: integer - description: | - Application ID. - - name: app_package - type: keyword - description: | - Unique identifier of the application on the protected mobile device. - - name: app_properties - type: keyword - description: | - List of all found categories. - - name: app_repackaged - type: keyword - description: | - Indicates whether the original application was repackage not by the official developer. - - name: app_sid_id - type: keyword - description: | - Unique SHA identifier of a mobile application. - - name: app_sig_id - type: keyword - description: | - IOC indicator description. - - name: app_version - type: keyword - description: | - Version of the application downloaded on the protected mobile device. - - name: appi_name - type: keyword - description: | - Name of application downloaded on the protected mobile device. - - name: arrival_time - type: keyword - description: | - Email arrival timestamp. - - name: attachments_num - type: integer - description: | - Number of attachments in the mail. - - name: attack_status - type: keyword - description: | - In case of a malicious event on an endpoint computer, the status of the attack. - - name: audit_status - type: keyword - description: | - Audit Status. Can be Success or Failure. - - name: auth_method - type: keyword - description: | - Password authentication protocol used (PAP or EAP). - - name: authority_rdata - type: keyword - description: | - List of authoritative servers. - - name: authorization - type: keyword - description: | - Authorization HTTP header value. - - name: bcc - type: keyword - description: | - List of BCC addresses. - - name: blade_name - type: keyword - description: | - Blade name. - - name: broker_publisher - type: ip - description: | - IP address of the broker publisher who shared the session information. - - name: browse_time - type: keyword - description: | - Application session browse time. - - name: c_bytes - type: integer - description: | - Boolean value indicates whether bytes sent from the client side are used. - - name: calc_desc - type: keyword - description: | - Log description. - - name: capacity - type: integer - description: | - Capacity of the ports. - - name: capture_uuid - type: keyword - description: | - UUID generated for the capture. Used when enabling the capture when logging. - - name: cc - type: keyword - description: | - The Carbon Copy address of the email. - - name: certificate_resource - type: keyword - description: | - HTTPS resource Possible values: SNI or domain name (DN). - - name: certificate_validation - type: keyword - description: | - Precise error, describing HTTPS certificate failure under "HTTPS categorize websites" feature. - - name: cgnet - type: keyword - description: | - Describes NAT allocation for specific subscriber. - - name: chunk_type - type: keyword - description: | - Chunck of the sctp stream. - - name: client_name - type: keyword - description: | - Client Application or Software Blade that detected the event. - - name: client_type - type: keyword - description: | - Endpoint Connect. - - name: client_type_os - type: keyword - description: | - Client OS detected in the HTTP request. - - name: client_version - type: keyword - description: | - Build version of SandBlast Agent client installed on the computer. - - name: cluster_info - type: keyword - description: | - Cluster information. Possible options: Failover reason/cluster state changes/CP cluster or 3rd party. - - name: comment - type: keyword - - name: community - type: keyword - description: | - Community name for the IPSec key and the use of the IKEv. - - name: confidence_level - type: integer - description: | - Confidence level determined by ThreatCloud. - - name: conn_direction - type: keyword - description: Connection direction - - name: connection_uid - type: keyword - description: | - Calculation of md5 of the IP and user name as UID. - - name: connectivity_level - type: keyword - description: | - Log for a new connection in wire mode. - - name: conns_amount - type: integer - description: | - Connections amount of aggregated log info. - - name: content_disposition - type: keyword - description: | - Indicates how the content is expected to be displayed inline in the browser. - - name: content_length - type: keyword - description: | - Indicates the size of the entity-body of the HTTP header. - - name: content_risk - type: integer - description: | - File risk. - - name: content_type - type: keyword - description: | - Mail content type. Possible values: application/msword, text/html, image/gif etc. - - name: context_num - type: integer - description: | - Serial number of the log for a specific connection. - - name: cookieI - type: keyword - description: | - Initiator cookie. - - name: cookieR - type: keyword - description: | - Responder cookie. - - name: cp_message - type: integer - description: | - Used to log a general message. - - name: cvpn_category - type: keyword - description: | - Mobile Access application type. - - name: cvpn_resource - type: keyword - description: | - Mobile Access application. - - name: data_type_name - type: keyword - description: | - Data type in rulebase that was matched. - - name: db_ver - type: keyword - description: Database version - - name: dce-rpc_interface_uuid - type: keyword - description: | - Log for new RPC state - UUID values - - name: delivery_time - type: keyword - description: | - Timestamp of when email was delivered (MTA finished handling the email. - - name: desc - type: keyword - description: | - Override application description. - - name: description - type: keyword - description: | - Additional explanation how the security gateway enforced the connection. - - name: destination_object - type: keyword - description: | - Matched object name on destination column. - - name: detected_on - type: keyword - description: | - System and applications version the file was emulated on. - - name: developer_certificate_name - type: keyword - description: | - Name of the developer's certificate that was used to sign the mobile application. - - name: diameter_app_ID - type: integer - description: | - The ID of diameter application. - - name: diameter_cmd_code - type: integer - description: | - Diameter not allowed application command id. - - name: diameter_msg_type - type: keyword - description: | - Diameter message type. - - name: dlp_action_reason - type: keyword - description: | - Action chosen reason. - - name: dlp_additional_action - type: keyword - description: | - Watermark/None. - - name: dlp_categories - type: keyword - description: | - Data type category. - - name: dlp_data_type_name - type: keyword - description: | - Matched data type. - - name: dlp_data_type_uid - type: keyword - description: | - Unique ID of the matched data type. - - name: dlp_fingerprint_files_number - type: integer - description: | - Number of successfully scanned files in repository. - - name: dlp_fingerprint_long_status - type: keyword - description: | - Scan status - long format. - - name: dlp_fingerprint_short_status - type: keyword - description: | - Scan status - short format. - - name: dlp_incident_uid - type: keyword - description: | - Unique ID of the matched rule. - - name: dlp_recipients - type: keyword - description: | - Mail recipients. - - name: dlp_related_incident_uid - type: keyword - description: | - Other ID related to this one. - - name: dlp_relevant_data_types - type: keyword - description: | - In case of Compound/Group: the inner data types that were matched. - - name: dlp_repository_directories_number - type: integer - description: | - Number of directories in repository. - - name: dlp_repository_files_number - type: integer - description: | - Number of files in repository. - - name: dlp_repository_id - type: keyword - description: | - ID of scanned repository. - - name: dlp_repository_not_scanned_directories_percentage - type: integer - description: | - Percentage of directories the Security Gateway was unable to read. - - name: dlp_repository_reached_directories_number - type: integer - description: | - Number of scanned directories in repository. - - name: dlp_repository_root_path - type: keyword - description: | - Repository path. - - name: dlp_repository_scan_progress - type: integer - description: | - Scan percentage. - - name: dlp_repository_scanned_directories_number - type: integer - description: | - Amount of directories scanned. - - name: dlp_repository_scanned_files_number - type: integer - description: | - Number of scanned files in repository. - - name: dlp_repository_scanned_total_size - type: integer - description: | - Size scanned. - - name: dlp_repository_skipped_files_number - type: integer - description: | - Skipped number of files because of configuration. - - name: dlp_repository_total_size - type: integer - description: | - Repository size. - - name: dlp_repository_unreachable_directories_number - type: integer - description: | - Number of directories the Security Gateway was unable to read. - - name: dlp_rule_name - type: keyword - description: | - Matched rule name. - - name: dlp_subject - type: keyword - description: | - Mail subject. - - name: dlp_template_score - type: keyword - description: | - Template data type match score. - - name: dlp_transint - type: keyword - description: | - HTTP/SMTP/FTP. - - name: dlp_violation_description - type: keyword - description: | - Violation descriptions described in the rulebase. - - name: dlp_watermark_profile - type: keyword - description: | - Watermark which was applied. - - name: dlp_word_list - type: keyword - description: | - Phrases matched by data type. - - name: dns_query - type: keyword - description: | - DNS query. - - name: drop_reason - type: keyword - description: | - Drop reason description. - - name: dropped_file_hash - type: keyword - description: | - List of file hashes dropped from the original file. - - name: dropped_file_name - type: keyword - description: | - List of names dropped from the original file. - - name: dropped_file_type - type: keyword - description: | - List of file types dropped from the original file. - - name: dropped_file_verdict - type: keyword - description: | - List of file verdics dropped from the original file. - - name: dropped_incoming - type: integer - description: | - Number of incoming bytes dropped when using UP-limit feature. - - name: dropped_outgoing - type: integer - description: | - Number of outgoing bytes dropped when using UP-limit feature. - - name: dropped_total - type: integer - description: | - Amount of dropped packets (both incoming and outgoing). - - name: drops_amount - type: integer - description: | - Amount of multicast packets dropped. - - name: dst_country - type: keyword - description: | - Destination country. - - name: dst_phone_number - type: keyword - description: | - Destination IP-Phone. - - name: dst_user_name - type: keyword - description: | - Connected user name on the destination IP. - - name: dstkeyid - type: keyword - description: | - Responder Spi ID. - - name: duplicate - type: keyword - description: | - Log marked as duplicated, when mail is split and the Security Gateway sees it twice. - - name: duration - type: keyword - description: "Scan duration. \n" - - name: elapsed - type: keyword - description: | - Time passed since start time. - - name: email_content - type: keyword - description: | - Mail contents. Possible options: attachments/links & attachments/links/text only. - - name: email_control - type: keyword - description: | - Engine name. - - name: email_control_analysis - type: keyword - description: | - Message classification, received from spam vendor engine. - - name: email_headers - type: keyword - description: | - String containing all the email headers. - - name: email_id - type: keyword - description: | - Email number in smtp connection. - - name: email_message_id - type: keyword - description: | - Email session id (uniqe ID of the mail). - - name: email_queue_id - type: keyword - description: | - Postfix email queue id. - - name: email_queue_name - type: keyword - description: | - Postfix email queue name. - - name: email_recipients_num - type: long - description: | - Amount of recipients whom the mail was sent to. - - name: email_session_id - type: keyword - description: | - Connection uuid. - - name: email_spam_category - type: keyword - description: | - Email categories. Possible values: spam/not spam/phishing. - - name: email_status - type: keyword - description: | - Describes the email's state. Possible options: delivered, deferred, skipped, bounced, hold, new, scan_started, scan_ended - - name: email_subject - type: keyword - description: | - Original email subject. - - name: emulated_on - type: keyword - description: | - Images the files were emulated on. - - name: encryption_failure - type: keyword - description: | - Message indicating why the encryption failed. - - name: end_time - type: keyword - description: | - TCP connection end time. - - name: end_user_firewall_type - type: keyword - description: | - End user firewall type. - - name: esod_access_status - type: keyword - description: | - Access denied. - - name: esod_associated_policies - type: keyword - description: | - Associated policies. - - name: esod_noncompliance_reason - type: keyword - description: | - Non-compliance reason. - - name: esod_rule_action - type: keyword - description: | - Unknown rule action. - - name: esod_rule_name - type: keyword - description: | - Unknown rule name. - - name: esod_rule_type - type: keyword - description: | - Unknown rule type. - - name: esod_scan_status - type: keyword - description: | - Scan failed. - - name: event_count - type: long - description: | - Number of events associated with the log. - - name: expire_time - type: keyword - description: | - Connection closing time. - - name: extension_version - type: keyword - description: | - Build version of the SandBlast Agent browser extension. - - name: extracted_file_hash - type: keyword - description: | - Archive hash in case of extracted files. - - name: extracted_file_names - type: keyword - description: | - Names of extracted files in case of an archive. - - name: extracted_file_type - type: keyword - description: | - Types of extracted files in case of an archive. - - name: extracted_file_uid - type: keyword - description: | - UID of extracted files in case of an archive. - - name: extracted_file_verdict - type: keyword - description: | - Verdict of extracted files in case of an archive. - - name: failure_impact - type: keyword - description: | - The impact of update service failure. - - name: failure_reason - type: keyword - description: | - MTA failure description. - - name: file_direction - type: keyword - description: | - File direction. Possible options: upload/download. - - name: file_name - type: keyword - description: | - Malicious file name. - - name: files_names - type: keyword - description: | - List of files requested by FTP. - - name: first_hit_time - type: integer - description: | - First hit time in current interval. - - name: fs-proto - type: keyword - description: | - The file share protocol used in mobile acess file share application. - - name: ftp_user - type: keyword - description: | - FTP username. - - name: fw_message - type: keyword - description: | - Used for various firewall errors. - - name: fw_subproduct - type: keyword - description: | - Can be vpn/non vpn. - - name: hide_ip - type: ip - description: | - Source IP which will be used after CGNAT. - - name: hit - type: integer - description: | - Number of hits on a rule. - - name: host_time - type: keyword - description: | - Local time on the endpoint computer. - - name: http_host - type: keyword - description: | - Domain name of the server that the HTTP request is sent to. - - name: http_location - type: keyword - description: | - Response header, indicates the URL to redirect a page to. - - name: http_server - type: keyword - description: | - Server HTTP header value, contains information about the software used by the origin server, which handles the request. - - name: https_inspection_action - type: keyword - description: | - HTTPS inspection action (Inspect/Bypass/Error). - - name: https_inspection_rule_id - type: keyword - description: | - ID of the matched rule. - - name: https_inspection_rule_name - type: keyword - description: | - Name of the matched rule. - - name: https_validation - type: keyword - description: | - Precise error, describing HTTPS inspection failure. - - name: icap_more_info - type: integer - description: | - Free text for verdict. - - name: icap_server_name - type: keyword - description: | - Server name. - - name: icap_server_service - type: keyword - description: | - Service name, as given in the ICAP URI - - name: icap_service_id - type: integer - description: | - Service ID, can work with multiple servers, treated as services. - - name: icmp - type: keyword - description: | - Number of packets, received by the client. - - name: icmp_code - type: long - description: | - In case a connection is ICMP, code info will be added to the log. - - name: icmp_type - type: long - description: | - In case a connection is ICMP, type info will be added to the log. - - name: id - type: integer - description: | - Override application ID. - - name: ike - type: keyword - description: | - IKEMode (PHASE1, PHASE2, etc..). - - name: ike_ids - type: keyword - description: | - All QM ids. - - name: impacted_files - type: keyword - description: | - In case of an infection on an endpoint computer, the list of files that the malware impacted. - - name: incident_extension - type: keyword - description: | - Matched data type. - - name: indicator_description - type: keyword - description: | - IOC indicator description. - - name: indicator_name - type: keyword - description: | - IOC indicator name. - - name: indicator_reference - type: keyword - description: | - IOC indicator reference. - - name: indicator_uuid - type: keyword - description: | - IOC indicator uuid. - - name: info - type: keyword - description: | - Special log message. - - name: information - type: keyword - description: | - Policy installation status for a specific blade. - - name: inspection_category - type: keyword - description: | - Inspection category: protocol anomaly, signature etc. - - name: inspection_item - type: keyword - description: | - Blade element performed inspection. - - name: inspection_profile - type: keyword - description: | - Profile which the activated protection belongs to. - - name: inspection_settings_log - type: keyword - description: | - Indicats that the log was released by inspection settings. - - name: installed_products - type: keyword - description: | - List of installed Endpoint Software Blades. - - name: int_end - type: integer - description: | - Subscriber end int which will be used for NAT. - - name: int_start - type: integer - description: | - Subscriber start int which will be used for NAT. - - name: interface_name - type: keyword - description: | - Designated interface for mirror And decrypt. - - name: internal_error - type: keyword - description: | - Internal error, for troubleshooting - - name: invalid_file_size - type: integer - description: | - File_size field is valid only if this field is set to 0. - - name: ip_option - type: integer - description: | - IP option that was dropped. - - name: isp_link - type: keyword - description: | - Name of ISP link. - - name: last_hit_time - type: integer - description: | - Last hit time in current interval. - - name: last_rematch_time - type: keyword - description: | - Connection rematched time. - - name: layer_name - type: keyword - description: | - Layer name. - - name: layer_uuid - type: keyword - description: | - Layer UUID. - - name: limit_applied - type: integer - description: | - Indicates whether the session was actually date limited. - - name: limit_requested - type: integer - description: | - Indicates whether data limit was requested for the session. - - name: link_probing_status_update - type: keyword - description: | - IP address response status. - - name: links_num - type: integer - description: | - Number of links in the mail. - - name: log_delay - type: integer - description: | - Time left before deleting template. - - name: log_id - type: integer - description: | - Unique identity for logs. - - name: logid - type: keyword - description: | - System messages - - name: long_desc - type: keyword - description: | - More information on the process (usually describing error reason in failure). - - name: machine - type: keyword - description: | - L2TP machine which triggered the log and the log refers to it. - - name: malware_family - type: keyword - description: | - Additional information on protection. - - name: match_fk - type: integer - description: | - Rule number. - - name: match_id - type: integer - description: | - Private key of the rule - - name: matched_file - type: keyword - description: | - Unique ID of the matched data type. - - name: matched_file_percentage - type: integer - description: | - Fingerprint: match percentage of the traffic. - - name: matched_file_text_segments - type: integer - description: | - Fingerprint: number of text segments matched by this traffic. - - name: media_type - type: keyword - description: | - Media used (audio, video, etc.) - - name: message - type: keyword - description: | - ISP link has failed. - - name: message_info - type: keyword - description: | - Used for information messages, for example:NAT connection has ended. - - name: message_size - type: integer - description: | - Mail/post size. - - name: method - type: keyword - description: | - HTTP method. - - name: methods - type: keyword - description: | - IPSEc methods. - - name: mime_from - type: keyword - description: | - Sender's address. - - name: mime_to - type: keyword - description: | - List of receiver address. - - name: mirror_and_decrypt_type - type: keyword - description: | - Information about decrypt and forward. Possible values: Mirror only, Decrypt and mirror, Partial mirroring (HTTPS inspection Bypass). - - name: mitre_collection - type: keyword - description: | - The adversary is trying to collect data of interest to achieve his goal. - - name: mitre_command_and_control - type: keyword - description: | - The adversary is trying to communicate with compromised systems in order to control them. - - name: mitre_credential_access - type: keyword - description: | - The adversary is trying to steal account names and passwords. - - name: mitre_defense_evasion - type: keyword - description: | - The adversary is trying to avoid being detected. - - name: mitre_discovery - type: keyword - description: | - The adversary is trying to expose information about your environment. - - name: mitre_execution - type: keyword - description: | - The adversary is trying to run malicious code. - - name: mitre_exfiltration - type: keyword - description: | - The adversary is trying to steal data. - - name: mitre_impact - type: keyword - description: | - The adversary is trying to manipulate, interrupt, or destroy your systems and data. - - name: mitre_initial_access - type: keyword - description: | - The adversary is trying to break into your network. - - name: mitre_lateral_movement - type: keyword - description: | - The adversary is trying to explore your environment. - - name: mitre_persistence - type: keyword - description: | - The adversary is trying to maintain his foothold. - - name: mitre_privilege_escalation - type: keyword - description: | - The adversary is trying to gain higher-level permissions. - - name: monitor_reason - type: keyword - description: | - Aggregated logs of monitored packets. - - name: msgid - type: keyword - description: | - Message ID. - - name: name - type: keyword - description: | - Application name. - - name: nat46 - type: keyword - description: | - NAT 46 status, in most cases "enabled". - - name: nat_addtnl_rulenum - type: integer - description: | - When matching 2 automatic rules , second rule match will be shown otherwise field will be 0. - - name: nat_exhausted_pool - type: keyword - description: | - 4-tuple of an exhausted pool. - - name: nat_rulenum - type: integer - description: | - NAT rulebase first matched rule. - - name: needs_browse_time - type: integer - description: | - Browse time required for the connection. - - name: next_hop_ip - type: keyword - description: | - Next hop IP address. - - name: next_scheduled_scan_date - type: keyword - description: | - Next scan scheduled time according to time object. - - name: number_of_errors - type: integer - description: | - Number of files that were not scanned due to an error. - - name: objecttable - type: keyword - description: | - Table of affected objects. - - name: objecttype - type: keyword - description: | - The type of the affected object. - - name: observable_comment - type: keyword - description: | - IOC observable signature description. - - name: observable_id - type: keyword - description: | - IOC observable signature id. - - name: observable_name - type: keyword - description: | - IOC observable signature name. - - name: operation - type: keyword - description: | - Operation made by Threat Extraction. - - name: operation_number - type: keyword - description: | - The operation nuber. - - name: origin_sic_name - type: keyword - description: | - Machine SIC. - - name: original_queue_id - type: keyword - description: | - Original postfix email queue id. - - name: outgoing_url - type: keyword - description: | - URL related to this log (for HTTP). - - name: packet_amount - type: integer - description: | - Amount of packets dropped. - - name: packet_capture_unique_id - type: keyword - description: | - Identifier of the packet capture files. - - name: parent_file_hash - type: keyword - description: | - Archive's hash in case of extracted files. - - name: parent_file_name - type: keyword - description: | - Archive's name in case of extracted files. - - name: parent_file_uid - type: keyword - description: | - Archive's UID in case of extracted files. - - name: parent_process_username - type: keyword - description: | - Owner username of the parent process of the process that triggered the attack. - - name: parent_rule - type: integer - description: | - Parent rule number, in case of inline layer. - - name: peer_gateway - type: ip - description: | - Main IP of the peer Security Gateway. - - name: peer_ip - type: keyword - description: | - IP address which the client connects to. - - name: peer_ip_probing_status_update - type: keyword - description: | - IP address response status. - - name: performance_impact - type: integer - description: | - Protection performance impact. - - name: policy_mgmt - type: keyword - description: | - Name of the Management Server that manages this Security Gateway. - - name: policy_name - type: keyword - description: | - Name of the last policy that this Security Gateway fetched. - - name: ports_usage - type: integer - description: | - Percentage of allocated ports. - - name: ppp - type: keyword - description: | - Authentication status. - - name: precise_error - type: keyword - description: | - HTTP parser error. - - name: process_username - type: keyword - description: | - Owner username of the process that triggered the attack. - - name: properties - type: keyword - description: | - Application categories. - - name: protection_id - type: keyword - description: | - Protection malware id. - - name: protection_name - type: keyword - description: | - Specific signature name of the attack. - - name: protection_type - type: keyword - description: | - Type of protection used to detect the attack. - - name: protocol - type: keyword - description: | - Protocol detected on the connection. - - name: proxy_machine_name - type: integer - description: | - Machine name connected to proxy IP. - - name: proxy_src_ip - type: ip - description: | - Sender source IP (even when using proxy). - - name: proxy_user_dn - type: keyword - description: | - User distinguished name connected to proxy IP. - - name: proxy_user_name - type: keyword - description: | - User name connected to proxy IP. - - name: query - type: keyword - description: | - DNS query. - - name: question_rdata - type: keyword - description: | - List of question records domains. - - name: referrer - type: keyword - description: | - Referrer HTTP request header, previous web page address. - - name: referrer_parent_uid - type: keyword - description: | - Log UUID of the referring application. - - name: referrer_self_uid - type: keyword - description: | - UUID of the current log. - - name: registered_ip-phones - type: keyword - description: | - Registered IP-Phones. - - name: reject_category - type: keyword - description: | - Authentication failure reason. - - name: reject_id - type: keyword - description: | - A reject ID that corresponds to the one presented in the Mobile Access error page. - - name: rematch_info - type: keyword - description: | - Information sent when old connections cannot be matched during policy installation. - - name: remediated_files - type: keyword - description: | - In case of an infection and a successful cleaning of that infection, this is a list of remediated files on the computer. - - name: reply_status - type: integer - description: | - ICAP reply status code, e.g. 200 or 204. - - name: risk - type: keyword - description: | - Risk level we got from the engine. - - name: rpc_prog - type: integer - description: | - Log for new RPC state - prog values. - - name: rule - type: integer - description: | - Matched rule number. - - name: rule_action - type: keyword - description: | - Action of the matched rule in the access policy. - - name: rulebase_id - type: integer - description: | - Layer number. - - name: scan_direction - type: keyword - description: | - Scan direction. - - name: scan_hosts_day - type: integer - description: | - Number of unique hosts during the last day. - - name: scan_hosts_hour - type: integer - description: | - Number of unique hosts during the last hour. - - name: scan_hosts_week - type: integer - description: | - Number of unique hosts during the last week. - - name: scan_id - type: keyword - description: | - Sequential number of scan. - - name: scan_mail - type: integer - description: | - Number of emails that were scanned by "AB malicious activity" engine. - - name: scan_results - type: keyword - description: | - "Infected"/description of a failure. - - name: scheme - type: keyword - description: | - Describes the scheme used for the log. - - name: scope - type: keyword - description: | - IP related to the attack. - - name: scrub_activity - type: keyword - description: | - The result of the extraction - - name: scrub_download_time - type: keyword - description: | - File download time from resource. - - name: scrub_time - type: keyword - description: | - Extraction process duration. - - name: scrub_total_time - type: keyword - description: | - Threat extraction total file handling time. - - name: scrubbed_content - type: keyword - description: | - Active content that was found. - - name: sctp_association_state - type: keyword - description: | - The bad state you were trying to update to. - - name: sctp_error - type: keyword - description: | - Error information, what caused sctp to fail on out_of_state. - - name: scv_message_info - type: keyword - description: | - Drop reason. - - name: scv_user - type: keyword - description: | - Username whose packets are dropped on SCV. - - name: securexl_message - type: keyword - description: | - Two options for a SecureXL message: 1. Missed accounting records after heavy load on logging system. 2. FW log message regarding a packet drop. - - name: session_id - type: keyword - description: | - Log uuid. - - name: session_uid - type: keyword - description: | - HTTP session-id. - - name: short_desc - type: keyword - description: | - Short description of the process that was executed. - - name: sig_id - type: keyword - description: | - Application's signature ID which how it was detected by. - - name: similar_communication - type: keyword - description: | - Network action found similar to the malicious file. - - name: similar_hashes - type: keyword - description: | - Hashes found similar to the malicious file. - - name: similar_strings - type: keyword - description: | - Strings found similar to the malicious file. - - name: similiar_iocs - type: keyword - description: | - Other IoCs similar to the ones found, related to the malicious file. - - name: sip_reason - type: keyword - description: | - Explains why 'source_ip' isn't allowed to redirect (handover). - - name: site_name - type: keyword - description: | - Site name. - - name: source_interface - type: keyword - description: | - External Interface name for source interface or Null if not found. - - name: source_object - type: keyword - description: | - Matched object name on source column. - - name: source_os - type: keyword - description: | - OS which generated the attack. - - name: special_properties - type: integer - description: | - If this field is set to '1' the log will not be shown (in use for monitoring scan progress). - - name: specific_data_type_name - type: keyword - description: | - Compound/Group scenario, data type that was matched. - - name: speed - type: integer - description: | - Current scan speed. - - name: spyware_name - type: keyword - description: | - Spyware name. - - name: spyware_type - type: keyword - description: | - Spyware type. - - name: src_country - type: keyword - description: | - Country name, derived from connection source IP address. - - name: src_phone_number - type: keyword - description: | - Source IP-Phone. - - name: src_user_dn - type: keyword - description: | - User distinguished name connected to source IP. - - name: src_user_name - type: keyword - description: | - User name connected to source IP - - name: srckeyid - type: keyword - description: | - Initiator Spi ID. - - name: status - type: keyword - description: | - Ok/Warning/Error. - - name: status_update - type: keyword - description: | - Last time log was updated. - - name: sub_policy_name - type: keyword - description: | - Layer name. - - name: sub_policy_uid - type: keyword - description: | - Layer uid. - - name: subscriber - type: ip - description: | - Source IP before CGNAT. - - name: summary - type: keyword - description: | - Summary message of a non-compliant DNS traffic drops or detects. - - name: suppressed_logs - type: integer - description: | - Aggregated connections for five minutes on the same source, destination and port. - - name: sync - type: keyword - description: | - Sync status and the reason (stable, at risk). - - name: sys_message - type: keyword - description: | - System messages - - name: tcp_end_reason - type: keyword - description: | - Reason for TCP connection closure. - - name: tcp_flags - type: keyword - description: | - TCP packet flags (SYN, ACK, etc.,). - - name: tcp_packet_out_of_state - type: keyword - description: | - State violation. - - name: tcp_state - type: keyword - description: | - Log reinting a tcp state change. - - name: te_verdict_determined_by - type: keyword - description: | - Emulators determined file verdict. - - name: ticket_id - type: keyword - description: | - Unique ID per file. - - name: tls_server_host_name - type: keyword - description: | - SNI/CN from encrypted TLS connection used by URLF for categorization. - - name: top_archive_file_name - type: keyword - description: | - In case of archive file: the file that was sent/received. - - name: total_attachments - type: integer - description: | - The number of attachments in an email. - - name: triggered_by - type: keyword - description: | - The name of the mechanism that triggered the Software Blade to enforce a protection. - - name: trusted_domain - type: keyword - description: In case of phishing event, the domain, which the attacker was impersonating. - - name: unique_detected_day - type: integer - description: | - Detected virus for a specific host during the last day. - - name: unique_detected_hour - type: integer - description: | - Detected virus for a specific host during the last hour. - - name: unique_detected_week - type: integer - description: | - Detected virus for a specific host during the last week. - - name: update_status - type: keyword - description: Status of database update - - name: url - type: keyword - description: | - Translated URL. - - name: user - type: keyword - description: | - Source user name. - - name: user_agent - type: keyword - description: | - String identifying requesting software user agent. - - name: vendor_list - type: keyword - description: | - The vendor name that provided the verdict for a malicious URL. - - name: verdict - type: keyword - description: | - TE engine verdict Possible values: Malicious/Benign/Error. - - name: via - type: keyword - description: | - Via header is added by proxies for tracking purposes to avoid sending reqests in loop. - - name: voip_attach_action_info - type: keyword - description: | - Attachment action Info. - - name: voip_attach_sz - type: integer - description: | - Attachment size. - - name: voip_call_dir - type: keyword - description: | - Call direction: in/out. - - name: voip_call_id - type: keyword - description: | - Call-ID. - - name: voip_call_state - type: keyword - description: | - Call state. Possible values: in/out. - - name: voip_call_term_time - type: keyword - description: | - Call termination time stamp. - - name: voip_config - type: keyword - description: | - Configuration. - - name: voip_duration - type: keyword - description: | - Call duration (seconds). - - name: voip_est_codec - type: keyword - description: | - Estimated codec. - - name: voip_exp - type: integer - description: | - Expiration. - - name: voip_from_user_type - type: keyword - description: | - Source IP-Phone type. - - name: voip_log_type - type: keyword - description: | - VoIP log types. Possible values: reject, call, registration. - - name: voip_media_codec - type: keyword - description: | - Estimated codec. - - name: voip_media_ipp - type: keyword - description: | - Media IP protocol. - - name: voip_media_port - type: keyword - description: | - Media int. - - name: voip_method - type: keyword - description: | - Registration request. - - name: voip_reason_info - type: keyword - description: | - Information. - - name: voip_reg_int - type: integer - description: | - Registration port. - - name: voip_reg_ipp - type: integer - description: | - Registration IP protocol. - - name: voip_reg_period - type: integer - description: | - Registration period. - - name: voip_reg_server - type: ip - description: | - Registrar server IP address. - - name: voip_reg_user_type - type: keyword - description: | - Registered IP-Phone type. - - name: voip_reject_reason - type: keyword - description: | - Reject reason. - - name: voip_to_user_type - type: keyword - description: | - Destination IP-Phone type. - - name: vpn_feature_name - type: keyword - description: | - L2TP /IKE / Link Selection. - - name: watermark - type: keyword - description: | - Reports whether watermark is added to the cleaned file. - - name: web_server_type - type: keyword - description: | - Web server detected in the HTTP response. - - name: word_list - type: keyword - description: | - Words matched by data type. diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/manifest.yml b/packages/checkpoint/1.5.1/data_stream/firewall/manifest.yml deleted file mode 100755 index f3ae072599..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/manifest.yml +++ /dev/null @@ -1,133 +0,0 @@ -type: logs -title: Check Point firewall logs -streams: - - input: udp - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: udp.yml.hbs - title: Check Point firewall logs (syslog over UDP) - description: Collect Check Point firewall logs using udp input - - input: tcp - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - name: ssl - type: yaml - title: SSL Configuration - description: i.e. certificate_authorities, supported_protocols, verification_mode etc. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- - - name: tcp_options - type: yaml - title: Custom TCP Options - multi: false - required: false - show_user: false - default: | - #max_connections: 1 - #framing: delimitier - #line_delimiter: "\n" - description: Specify custom configuration options for the TCP input. - template_path: tcp.yml.hbs - title: Check Point firewall logs (syslog over TCP) - description: Collect Check Point firewall logs using tcp input - - input: logfile - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - template_path: log.yml.hbs - title: Check Point firewall logs (log) - description: Collect Check Point firewall logs using log input diff --git a/packages/checkpoint/1.5.1/data_stream/firewall/sample_event.json b/packages/checkpoint/1.5.1/data_stream/firewall/sample_event.json deleted file mode 100755 index a375c48028..0000000000 --- a/packages/checkpoint/1.5.1/data_stream/firewall/sample_event.json +++ /dev/null @@ -1,64 +0,0 @@ -{ - "@timestamp": "2020-03-29T13:19:20.000Z", - "agent": { - "ephemeral_id": "7c0059da-6518-4067-9e8d-0f1b316dfef5", - "id": "ba9ee39d-37f1-433a-8800-9d424cb9dd11", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "checkpoint": { - "sys_message": "The eth0 interface is not protected by the anti-spoofing feature. Your network may be at risk" - }, - "data_stream": { - "dataset": "checkpoint.firewall", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.2.0" - }, - "elastic_agent": { - "id": "ba9ee39d-37f1-433a-8800-9d424cb9dd11", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "network" - ], - "created": "2021-12-25T09:18:51.178Z", - "dataset": "checkpoint.firewall", - "id": "{0x5e80a059,0x0,0x6401a8c0,0x3c7878a}", - "ingested": "2021-12-25T09:18:52Z", - "kind": "event", - "sequence": 1, - "timezone": "+00:00" - }, - "input": { - "type": "udp" - }, - "log": { - "source": { - "address": "192.168.32.7:52492" - } - }, - "network": { - "direction": "inbound" - }, - "observer": { - "ingress": { - "interface": { - "name": "daemon" - } - }, - "name": "192.168.1.100", - "product": "System Monitor", - "type": "firewall", - "vendor": "Checkpoint" - }, - "tags": [ - "forwarded" - ] -} \ No newline at end of file diff --git a/packages/checkpoint/1.5.1/docs/README.md b/packages/checkpoint/1.5.1/docs/README.md deleted file mode 100755 index fc59623876..0000000000 --- a/packages/checkpoint/1.5.1/docs/README.md +++ /dev/null @@ -1,671 +0,0 @@ -# Check Point Integration - -This integration is for [Check Point](https://sc1.checkpoint.com/documents/latest/APIs/#introduction~v1.8%20) products. It includes the -following datasets for receiving logs: - -- `firewall` dataset: consists of log entries from the [Log Exporter]( - https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323) - in the Syslog format. - -## Compatibility - -This module has been tested against Check Point Log Exporter on R80.X but should also work with R77.30. - -## Logs - -### Firewall - -Consists of log entries from the Log Exporter in the Syslog format. - -An example event for `firewall` looks as following: - -```json -{ - "@timestamp": "2020-03-29T13:19:20.000Z", - "agent": { - "ephemeral_id": "7c0059da-6518-4067-9e8d-0f1b316dfef5", - "id": "ba9ee39d-37f1-433a-8800-9d424cb9dd11", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.0.0-beta1" - }, - "checkpoint": { - "sys_message": "The eth0 interface is not protected by the anti-spoofing feature. Your network may be at risk" - }, - "data_stream": { - "dataset": "checkpoint.firewall", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.2.0" - }, - "elastic_agent": { - "id": "ba9ee39d-37f1-433a-8800-9d424cb9dd11", - "snapshot": false, - "version": "8.0.0-beta1" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "network" - ], - "created": "2021-12-25T09:18:51.178Z", - "dataset": "checkpoint.firewall", - "id": "{0x5e80a059,0x0,0x6401a8c0,0x3c7878a}", - "ingested": "2021-12-25T09:18:52Z", - "kind": "event", - "sequence": 1, - "timezone": "+00:00" - }, - "input": { - "type": "udp" - }, - "log": { - "source": { - "address": "192.168.32.7:52492" - } - }, - "network": { - "direction": "inbound" - }, - "observer": { - "ingress": { - "interface": { - "name": "daemon" - } - }, - "name": "192.168.1.100", - "product": "System Monitor", - "type": "firewall", - "vendor": "Checkpoint" - }, - "tags": [ - "forwarded" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| checkpoint.action_reason | Connection drop reason. | integer | -| checkpoint.action_reason_msg | Connection drop reason message. | keyword | -| checkpoint.additional_info | ID of original file/mail which are sent by admin. | keyword | -| checkpoint.additional_ip | DNS host name. | keyword | -| checkpoint.additional_rdata | List of additional resource records. | keyword | -| checkpoint.alert | Alert level of matched rule (for connection logs). | keyword | -| checkpoint.allocated_ports | Amount of allocated ports. | integer | -| checkpoint.analyzed_on | Check Point ThreatCloud / emulator name. | keyword | -| checkpoint.answer_rdata | List of answer resource records to the questioned domains. | keyword | -| checkpoint.anti_virus_type | Anti virus type. | keyword | -| checkpoint.app_desc | Application description. | keyword | -| checkpoint.app_id | Application ID. | integer | -| checkpoint.app_package | Unique identifier of the application on the protected mobile device. | keyword | -| checkpoint.app_properties | List of all found categories. | keyword | -| checkpoint.app_repackaged | Indicates whether the original application was repackage not by the official developer. | keyword | -| checkpoint.app_sid_id | Unique SHA identifier of a mobile application. | keyword | -| checkpoint.app_sig_id | IOC indicator description. | keyword | -| checkpoint.app_version | Version of the application downloaded on the protected mobile device. | keyword | -| checkpoint.appi_name | Name of application downloaded on the protected mobile device. | keyword | -| checkpoint.arrival_time | Email arrival timestamp. | keyword | -| checkpoint.attachments_num | Number of attachments in the mail. | integer | -| checkpoint.attack_status | In case of a malicious event on an endpoint computer, the status of the attack. | keyword | -| checkpoint.audit_status | Audit Status. Can be Success or Failure. | keyword | -| checkpoint.auth_method | Password authentication protocol used (PAP or EAP). | keyword | -| checkpoint.authority_rdata | List of authoritative servers. | keyword | -| checkpoint.authorization | Authorization HTTP header value. | keyword | -| checkpoint.bcc | List of BCC addresses. | keyword | -| checkpoint.blade_name | Blade name. | keyword | -| checkpoint.broker_publisher | IP address of the broker publisher who shared the session information. | ip | -| checkpoint.browse_time | Application session browse time. | keyword | -| checkpoint.c_bytes | Boolean value indicates whether bytes sent from the client side are used. | integer | -| checkpoint.calc_desc | Log description. | keyword | -| checkpoint.capacity | Capacity of the ports. | integer | -| checkpoint.capture_uuid | UUID generated for the capture. Used when enabling the capture when logging. | keyword | -| checkpoint.cc | The Carbon Copy address of the email. | keyword | -| checkpoint.certificate_resource | HTTPS resource Possible values: SNI or domain name (DN). | keyword | -| checkpoint.certificate_validation | Precise error, describing HTTPS certificate failure under "HTTPS categorize websites" feature. | keyword | -| checkpoint.cgnet | Describes NAT allocation for specific subscriber. | keyword | -| checkpoint.chunk_type | Chunck of the sctp stream. | keyword | -| checkpoint.client_name | Client Application or Software Blade that detected the event. | keyword | -| checkpoint.client_type | Endpoint Connect. | keyword | -| checkpoint.client_type_os | Client OS detected in the HTTP request. | keyword | -| checkpoint.client_version | Build version of SandBlast Agent client installed on the computer. | keyword | -| checkpoint.cluster_info | Cluster information. Possible options: Failover reason/cluster state changes/CP cluster or 3rd party. | keyword | -| checkpoint.comment | | keyword | -| checkpoint.community | Community name for the IPSec key and the use of the IKEv. | keyword | -| checkpoint.confidence_level | Confidence level determined by ThreatCloud. | integer | -| checkpoint.conn_direction | Connection direction | keyword | -| checkpoint.connection_uid | Calculation of md5 of the IP and user name as UID. | keyword | -| checkpoint.connectivity_level | Log for a new connection in wire mode. | keyword | -| checkpoint.conns_amount | Connections amount of aggregated log info. | integer | -| checkpoint.content_disposition | Indicates how the content is expected to be displayed inline in the browser. | keyword | -| checkpoint.content_length | Indicates the size of the entity-body of the HTTP header. | keyword | -| checkpoint.content_risk | File risk. | integer | -| checkpoint.content_type | Mail content type. Possible values: application/msword, text/html, image/gif etc. | keyword | -| checkpoint.context_num | Serial number of the log for a specific connection. | integer | -| checkpoint.cookieI | Initiator cookie. | keyword | -| checkpoint.cookieR | Responder cookie. | keyword | -| checkpoint.cp_message | Used to log a general message. | integer | -| checkpoint.cvpn_category | Mobile Access application type. | keyword | -| checkpoint.cvpn_resource | Mobile Access application. | keyword | -| checkpoint.data_type_name | Data type in rulebase that was matched. | keyword | -| checkpoint.db_ver | Database version | keyword | -| checkpoint.dce-rpc_interface_uuid | Log for new RPC state - UUID values | keyword | -| checkpoint.delivery_time | Timestamp of when email was delivered (MTA finished handling the email. | keyword | -| checkpoint.desc | Override application description. | keyword | -| checkpoint.description | Additional explanation how the security gateway enforced the connection. | keyword | -| checkpoint.destination_object | Matched object name on destination column. | keyword | -| checkpoint.detected_on | System and applications version the file was emulated on. | keyword | -| checkpoint.developer_certificate_name | Name of the developer's certificate that was used to sign the mobile application. | keyword | -| checkpoint.diameter_app_ID | The ID of diameter application. | integer | -| checkpoint.diameter_cmd_code | Diameter not allowed application command id. | integer | -| checkpoint.diameter_msg_type | Diameter message type. | keyword | -| checkpoint.dlp_action_reason | Action chosen reason. | keyword | -| checkpoint.dlp_additional_action | Watermark/None. | keyword | -| checkpoint.dlp_categories | Data type category. | keyword | -| checkpoint.dlp_data_type_name | Matched data type. | keyword | -| checkpoint.dlp_data_type_uid | Unique ID of the matched data type. | keyword | -| checkpoint.dlp_fingerprint_files_number | Number of successfully scanned files in repository. | integer | -| checkpoint.dlp_fingerprint_long_status | Scan status - long format. | keyword | -| checkpoint.dlp_fingerprint_short_status | Scan status - short format. | keyword | -| checkpoint.dlp_incident_uid | Unique ID of the matched rule. | keyword | -| checkpoint.dlp_recipients | Mail recipients. | keyword | -| checkpoint.dlp_related_incident_uid | Other ID related to this one. | keyword | -| checkpoint.dlp_relevant_data_types | In case of Compound/Group: the inner data types that were matched. | keyword | -| checkpoint.dlp_repository_directories_number | Number of directories in repository. | integer | -| checkpoint.dlp_repository_files_number | Number of files in repository. | integer | -| checkpoint.dlp_repository_id | ID of scanned repository. | keyword | -| checkpoint.dlp_repository_not_scanned_directories_percentage | Percentage of directories the Security Gateway was unable to read. | integer | -| checkpoint.dlp_repository_reached_directories_number | Number of scanned directories in repository. | integer | -| checkpoint.dlp_repository_root_path | Repository path. | keyword | -| checkpoint.dlp_repository_scan_progress | Scan percentage. | integer | -| checkpoint.dlp_repository_scanned_directories_number | Amount of directories scanned. | integer | -| checkpoint.dlp_repository_scanned_files_number | Number of scanned files in repository. | integer | -| checkpoint.dlp_repository_scanned_total_size | Size scanned. | integer | -| checkpoint.dlp_repository_skipped_files_number | Skipped number of files because of configuration. | integer | -| checkpoint.dlp_repository_total_size | Repository size. | integer | -| checkpoint.dlp_repository_unreachable_directories_number | Number of directories the Security Gateway was unable to read. | integer | -| checkpoint.dlp_rule_name | Matched rule name. | keyword | -| checkpoint.dlp_subject | Mail subject. | keyword | -| checkpoint.dlp_template_score | Template data type match score. | keyword | -| checkpoint.dlp_transint | HTTP/SMTP/FTP. | keyword | -| checkpoint.dlp_violation_description | Violation descriptions described in the rulebase. | keyword | -| checkpoint.dlp_watermark_profile | Watermark which was applied. | keyword | -| checkpoint.dlp_word_list | Phrases matched by data type. | keyword | -| checkpoint.dns_query | DNS query. | keyword | -| checkpoint.drop_reason | Drop reason description. | keyword | -| checkpoint.dropped_file_hash | List of file hashes dropped from the original file. | keyword | -| checkpoint.dropped_file_name | List of names dropped from the original file. | keyword | -| checkpoint.dropped_file_type | List of file types dropped from the original file. | keyword | -| checkpoint.dropped_file_verdict | List of file verdics dropped from the original file. | keyword | -| checkpoint.dropped_incoming | Number of incoming bytes dropped when using UP-limit feature. | integer | -| checkpoint.dropped_outgoing | Number of outgoing bytes dropped when using UP-limit feature. | integer | -| checkpoint.dropped_total | Amount of dropped packets (both incoming and outgoing). | integer | -| checkpoint.drops_amount | Amount of multicast packets dropped. | integer | -| checkpoint.dst_country | Destination country. | keyword | -| checkpoint.dst_phone_number | Destination IP-Phone. | keyword | -| checkpoint.dst_user_name | Connected user name on the destination IP. | keyword | -| checkpoint.dstkeyid | Responder Spi ID. | keyword | -| checkpoint.duplicate | Log marked as duplicated, when mail is split and the Security Gateway sees it twice. | keyword | -| checkpoint.duration | Scan duration. | keyword | -| checkpoint.elapsed | Time passed since start time. | keyword | -| checkpoint.email_content | Mail contents. Possible options: attachments/links & attachments/links/text only. | keyword | -| checkpoint.email_control | Engine name. | keyword | -| checkpoint.email_control_analysis | Message classification, received from spam vendor engine. | keyword | -| checkpoint.email_headers | String containing all the email headers. | keyword | -| checkpoint.email_id | Email number in smtp connection. | keyword | -| checkpoint.email_message_id | Email session id (uniqe ID of the mail). | keyword | -| checkpoint.email_queue_id | Postfix email queue id. | keyword | -| checkpoint.email_queue_name | Postfix email queue name. | keyword | -| checkpoint.email_recipients_num | Amount of recipients whom the mail was sent to. | long | -| checkpoint.email_session_id | Connection uuid. | keyword | -| checkpoint.email_spam_category | Email categories. Possible values: spam/not spam/phishing. | keyword | -| checkpoint.email_status | Describes the email's state. Possible options: delivered, deferred, skipped, bounced, hold, new, scan_started, scan_ended | keyword | -| checkpoint.email_subject | Original email subject. | keyword | -| checkpoint.emulated_on | Images the files were emulated on. | keyword | -| checkpoint.encryption_failure | Message indicating why the encryption failed. | keyword | -| checkpoint.end_time | TCP connection end time. | keyword | -| checkpoint.end_user_firewall_type | End user firewall type. | keyword | -| checkpoint.esod_access_status | Access denied. | keyword | -| checkpoint.esod_associated_policies | Associated policies. | keyword | -| checkpoint.esod_noncompliance_reason | Non-compliance reason. | keyword | -| checkpoint.esod_rule_action | Unknown rule action. | keyword | -| checkpoint.esod_rule_name | Unknown rule name. | keyword | -| checkpoint.esod_rule_type | Unknown rule type. | keyword | -| checkpoint.esod_scan_status | Scan failed. | keyword | -| checkpoint.event_count | Number of events associated with the log. | long | -| checkpoint.expire_time | Connection closing time. | keyword | -| checkpoint.extension_version | Build version of the SandBlast Agent browser extension. | keyword | -| checkpoint.extracted_file_hash | Archive hash in case of extracted files. | keyword | -| checkpoint.extracted_file_names | Names of extracted files in case of an archive. | keyword | -| checkpoint.extracted_file_type | Types of extracted files in case of an archive. | keyword | -| checkpoint.extracted_file_uid | UID of extracted files in case of an archive. | keyword | -| checkpoint.extracted_file_verdict | Verdict of extracted files in case of an archive. | keyword | -| checkpoint.failure_impact | The impact of update service failure. | keyword | -| checkpoint.failure_reason | MTA failure description. | keyword | -| checkpoint.file_direction | File direction. Possible options: upload/download. | keyword | -| checkpoint.file_name | Malicious file name. | keyword | -| checkpoint.files_names | List of files requested by FTP. | keyword | -| checkpoint.first_hit_time | First hit time in current interval. | integer | -| checkpoint.fs-proto | The file share protocol used in mobile acess file share application. | keyword | -| checkpoint.ftp_user | FTP username. | keyword | -| checkpoint.fw_message | Used for various firewall errors. | keyword | -| checkpoint.fw_subproduct | Can be vpn/non vpn. | keyword | -| checkpoint.hide_ip | Source IP which will be used after CGNAT. | ip | -| checkpoint.hit | Number of hits on a rule. | integer | -| checkpoint.host_time | Local time on the endpoint computer. | keyword | -| checkpoint.http_host | Domain name of the server that the HTTP request is sent to. | keyword | -| checkpoint.http_location | Response header, indicates the URL to redirect a page to. | keyword | -| checkpoint.http_server | Server HTTP header value, contains information about the software used by the origin server, which handles the request. | keyword | -| checkpoint.https_inspection_action | HTTPS inspection action (Inspect/Bypass/Error). | keyword | -| checkpoint.https_inspection_rule_id | ID of the matched rule. | keyword | -| checkpoint.https_inspection_rule_name | Name of the matched rule. | keyword | -| checkpoint.https_validation | Precise error, describing HTTPS inspection failure. | keyword | -| checkpoint.icap_more_info | Free text for verdict. | integer | -| checkpoint.icap_server_name | Server name. | keyword | -| checkpoint.icap_server_service | Service name, as given in the ICAP URI | keyword | -| checkpoint.icap_service_id | Service ID, can work with multiple servers, treated as services. | integer | -| checkpoint.icmp | Number of packets, received by the client. | keyword | -| checkpoint.icmp_code | In case a connection is ICMP, code info will be added to the log. | long | -| checkpoint.icmp_type | In case a connection is ICMP, type info will be added to the log. | long | -| checkpoint.id | Override application ID. | integer | -| checkpoint.ike | IKEMode (PHASE1, PHASE2, etc..). | keyword | -| checkpoint.ike_ids | All QM ids. | keyword | -| checkpoint.impacted_files | In case of an infection on an endpoint computer, the list of files that the malware impacted. | keyword | -| checkpoint.incident_extension | Matched data type. | keyword | -| checkpoint.indicator_description | IOC indicator description. | keyword | -| checkpoint.indicator_name | IOC indicator name. | keyword | -| checkpoint.indicator_reference | IOC indicator reference. | keyword | -| checkpoint.indicator_uuid | IOC indicator uuid. | keyword | -| checkpoint.info | Special log message. | keyword | -| checkpoint.information | Policy installation status for a specific blade. | keyword | -| checkpoint.inspection_category | Inspection category: protocol anomaly, signature etc. | keyword | -| checkpoint.inspection_item | Blade element performed inspection. | keyword | -| checkpoint.inspection_profile | Profile which the activated protection belongs to. | keyword | -| checkpoint.inspection_settings_log | Indicats that the log was released by inspection settings. | keyword | -| checkpoint.installed_products | List of installed Endpoint Software Blades. | keyword | -| checkpoint.int_end | Subscriber end int which will be used for NAT. | integer | -| checkpoint.int_start | Subscriber start int which will be used for NAT. | integer | -| checkpoint.interface_name | Designated interface for mirror And decrypt. | keyword | -| checkpoint.internal_error | Internal error, for troubleshooting | keyword | -| checkpoint.invalid_file_size | File_size field is valid only if this field is set to 0. | integer | -| checkpoint.ip_option | IP option that was dropped. | integer | -| checkpoint.isp_link | Name of ISP link. | keyword | -| checkpoint.last_hit_time | Last hit time in current interval. | integer | -| checkpoint.last_rematch_time | Connection rematched time. | keyword | -| checkpoint.layer_name | Layer name. | keyword | -| checkpoint.layer_uuid | Layer UUID. | keyword | -| checkpoint.limit_applied | Indicates whether the session was actually date limited. | integer | -| checkpoint.limit_requested | Indicates whether data limit was requested for the session. | integer | -| checkpoint.link_probing_status_update | IP address response status. | keyword | -| checkpoint.links_num | Number of links in the mail. | integer | -| checkpoint.log_delay | Time left before deleting template. | integer | -| checkpoint.log_id | Unique identity for logs. | integer | -| checkpoint.logid | System messages | keyword | -| checkpoint.long_desc | More information on the process (usually describing error reason in failure). | keyword | -| checkpoint.machine | L2TP machine which triggered the log and the log refers to it. | keyword | -| checkpoint.malware_family | Additional information on protection. | keyword | -| checkpoint.match_fk | Rule number. | integer | -| checkpoint.match_id | Private key of the rule | integer | -| checkpoint.matched_file | Unique ID of the matched data type. | keyword | -| checkpoint.matched_file_percentage | Fingerprint: match percentage of the traffic. | integer | -| checkpoint.matched_file_text_segments | Fingerprint: number of text segments matched by this traffic. | integer | -| checkpoint.media_type | Media used (audio, video, etc.) | keyword | -| checkpoint.message | ISP link has failed. | keyword | -| checkpoint.message_info | Used for information messages, for example:NAT connection has ended. | keyword | -| checkpoint.message_size | Mail/post size. | integer | -| checkpoint.method | HTTP method. | keyword | -| checkpoint.methods | IPSEc methods. | keyword | -| checkpoint.mime_from | Sender's address. | keyword | -| checkpoint.mime_to | List of receiver address. | keyword | -| checkpoint.mirror_and_decrypt_type | Information about decrypt and forward. Possible values: Mirror only, Decrypt and mirror, Partial mirroring (HTTPS inspection Bypass). | keyword | -| checkpoint.mitre_collection | The adversary is trying to collect data of interest to achieve his goal. | keyword | -| checkpoint.mitre_command_and_control | The adversary is trying to communicate with compromised systems in order to control them. | keyword | -| checkpoint.mitre_credential_access | The adversary is trying to steal account names and passwords. | keyword | -| checkpoint.mitre_defense_evasion | The adversary is trying to avoid being detected. | keyword | -| checkpoint.mitre_discovery | The adversary is trying to expose information about your environment. | keyword | -| checkpoint.mitre_execution | The adversary is trying to run malicious code. | keyword | -| checkpoint.mitre_exfiltration | The adversary is trying to steal data. | keyword | -| checkpoint.mitre_impact | The adversary is trying to manipulate, interrupt, or destroy your systems and data. | keyword | -| checkpoint.mitre_initial_access | The adversary is trying to break into your network. | keyword | -| checkpoint.mitre_lateral_movement | The adversary is trying to explore your environment. | keyword | -| checkpoint.mitre_persistence | The adversary is trying to maintain his foothold. | keyword | -| checkpoint.mitre_privilege_escalation | The adversary is trying to gain higher-level permissions. | keyword | -| checkpoint.monitor_reason | Aggregated logs of monitored packets. | keyword | -| checkpoint.msgid | Message ID. | keyword | -| checkpoint.name | Application name. | keyword | -| checkpoint.nat46 | NAT 46 status, in most cases "enabled". | keyword | -| checkpoint.nat_addtnl_rulenum | When matching 2 automatic rules , second rule match will be shown otherwise field will be 0. | integer | -| checkpoint.nat_exhausted_pool | 4-tuple of an exhausted pool. | keyword | -| checkpoint.nat_rulenum | NAT rulebase first matched rule. | integer | -| checkpoint.needs_browse_time | Browse time required for the connection. | integer | -| checkpoint.next_hop_ip | Next hop IP address. | keyword | -| checkpoint.next_scheduled_scan_date | Next scan scheduled time according to time object. | keyword | -| checkpoint.number_of_errors | Number of files that were not scanned due to an error. | integer | -| checkpoint.objecttable | Table of affected objects. | keyword | -| checkpoint.objecttype | The type of the affected object. | keyword | -| checkpoint.observable_comment | IOC observable signature description. | keyword | -| checkpoint.observable_id | IOC observable signature id. | keyword | -| checkpoint.observable_name | IOC observable signature name. | keyword | -| checkpoint.operation | Operation made by Threat Extraction. | keyword | -| checkpoint.operation_number | The operation nuber. | keyword | -| checkpoint.origin_sic_name | Machine SIC. | keyword | -| checkpoint.original_queue_id | Original postfix email queue id. | keyword | -| checkpoint.outgoing_url | URL related to this log (for HTTP). | keyword | -| checkpoint.packet_amount | Amount of packets dropped. | integer | -| checkpoint.packet_capture_unique_id | Identifier of the packet capture files. | keyword | -| checkpoint.parent_file_hash | Archive's hash in case of extracted files. | keyword | -| checkpoint.parent_file_name | Archive's name in case of extracted files. | keyword | -| checkpoint.parent_file_uid | Archive's UID in case of extracted files. | keyword | -| checkpoint.parent_process_username | Owner username of the parent process of the process that triggered the attack. | keyword | -| checkpoint.parent_rule | Parent rule number, in case of inline layer. | integer | -| checkpoint.peer_gateway | Main IP of the peer Security Gateway. | ip | -| checkpoint.peer_ip | IP address which the client connects to. | keyword | -| checkpoint.peer_ip_probing_status_update | IP address response status. | keyword | -| checkpoint.performance_impact | Protection performance impact. | integer | -| checkpoint.policy_mgmt | Name of the Management Server that manages this Security Gateway. | keyword | -| checkpoint.policy_name | Name of the last policy that this Security Gateway fetched. | keyword | -| checkpoint.ports_usage | Percentage of allocated ports. | integer | -| checkpoint.ppp | Authentication status. | keyword | -| checkpoint.precise_error | HTTP parser error. | keyword | -| checkpoint.process_username | Owner username of the process that triggered the attack. | keyword | -| checkpoint.properties | Application categories. | keyword | -| checkpoint.protection_id | Protection malware id. | keyword | -| checkpoint.protection_name | Specific signature name of the attack. | keyword | -| checkpoint.protection_type | Type of protection used to detect the attack. | keyword | -| checkpoint.protocol | Protocol detected on the connection. | keyword | -| checkpoint.proxy_machine_name | Machine name connected to proxy IP. | integer | -| checkpoint.proxy_src_ip | Sender source IP (even when using proxy). | ip | -| checkpoint.proxy_user_dn | User distinguished name connected to proxy IP. | keyword | -| checkpoint.proxy_user_name | User name connected to proxy IP. | keyword | -| checkpoint.query | DNS query. | keyword | -| checkpoint.question_rdata | List of question records domains. | keyword | -| checkpoint.referrer | Referrer HTTP request header, previous web page address. | keyword | -| checkpoint.referrer_parent_uid | Log UUID of the referring application. | keyword | -| checkpoint.referrer_self_uid | UUID of the current log. | keyword | -| checkpoint.registered_ip-phones | Registered IP-Phones. | keyword | -| checkpoint.reject_category | Authentication failure reason. | keyword | -| checkpoint.reject_id | A reject ID that corresponds to the one presented in the Mobile Access error page. | keyword | -| checkpoint.rematch_info | Information sent when old connections cannot be matched during policy installation. | keyword | -| checkpoint.remediated_files | In case of an infection and a successful cleaning of that infection, this is a list of remediated files on the computer. | keyword | -| checkpoint.reply_status | ICAP reply status code, e.g. 200 or 204. | integer | -| checkpoint.risk | Risk level we got from the engine. | keyword | -| checkpoint.rpc_prog | Log for new RPC state - prog values. | integer | -| checkpoint.rule | Matched rule number. | integer | -| checkpoint.rule_action | Action of the matched rule in the access policy. | keyword | -| checkpoint.rulebase_id | Layer number. | integer | -| checkpoint.scan_direction | Scan direction. | keyword | -| checkpoint.scan_hosts_day | Number of unique hosts during the last day. | integer | -| checkpoint.scan_hosts_hour | Number of unique hosts during the last hour. | integer | -| checkpoint.scan_hosts_week | Number of unique hosts during the last week. | integer | -| checkpoint.scan_id | Sequential number of scan. | keyword | -| checkpoint.scan_mail | Number of emails that were scanned by "AB malicious activity" engine. | integer | -| checkpoint.scan_results | "Infected"/description of a failure. | keyword | -| checkpoint.scheme | Describes the scheme used for the log. | keyword | -| checkpoint.scope | IP related to the attack. | keyword | -| checkpoint.scrub_activity | The result of the extraction | keyword | -| checkpoint.scrub_download_time | File download time from resource. | keyword | -| checkpoint.scrub_time | Extraction process duration. | keyword | -| checkpoint.scrub_total_time | Threat extraction total file handling time. | keyword | -| checkpoint.scrubbed_content | Active content that was found. | keyword | -| checkpoint.sctp_association_state | The bad state you were trying to update to. | keyword | -| checkpoint.sctp_error | Error information, what caused sctp to fail on out_of_state. | keyword | -| checkpoint.scv_message_info | Drop reason. | keyword | -| checkpoint.scv_user | Username whose packets are dropped on SCV. | keyword | -| checkpoint.securexl_message | Two options for a SecureXL message: 1. Missed accounting records after heavy load on logging system. 2. FW log message regarding a packet drop. | keyword | -| checkpoint.session_id | Log uuid. | keyword | -| checkpoint.session_uid | HTTP session-id. | keyword | -| checkpoint.short_desc | Short description of the process that was executed. | keyword | -| checkpoint.sig_id | Application's signature ID which how it was detected by. | keyword | -| checkpoint.similar_communication | Network action found similar to the malicious file. | keyword | -| checkpoint.similar_hashes | Hashes found similar to the malicious file. | keyword | -| checkpoint.similar_strings | Strings found similar to the malicious file. | keyword | -| checkpoint.similiar_iocs | Other IoCs similar to the ones found, related to the malicious file. | keyword | -| checkpoint.sip_reason | Explains why 'source_ip' isn't allowed to redirect (handover). | keyword | -| checkpoint.site_name | Site name. | keyword | -| checkpoint.source_interface | External Interface name for source interface or Null if not found. | keyword | -| checkpoint.source_object | Matched object name on source column. | keyword | -| checkpoint.source_os | OS which generated the attack. | keyword | -| checkpoint.special_properties | If this field is set to '1' the log will not be shown (in use for monitoring scan progress). | integer | -| checkpoint.specific_data_type_name | Compound/Group scenario, data type that was matched. | keyword | -| checkpoint.speed | Current scan speed. | integer | -| checkpoint.spyware_name | Spyware name. | keyword | -| checkpoint.spyware_type | Spyware type. | keyword | -| checkpoint.src_country | Country name, derived from connection source IP address. | keyword | -| checkpoint.src_phone_number | Source IP-Phone. | keyword | -| checkpoint.src_user_dn | User distinguished name connected to source IP. | keyword | -| checkpoint.src_user_name | User name connected to source IP | keyword | -| checkpoint.srckeyid | Initiator Spi ID. | keyword | -| checkpoint.status | Ok/Warning/Error. | keyword | -| checkpoint.status_update | Last time log was updated. | keyword | -| checkpoint.sub_policy_name | Layer name. | keyword | -| checkpoint.sub_policy_uid | Layer uid. | keyword | -| checkpoint.subscriber | Source IP before CGNAT. | ip | -| checkpoint.summary | Summary message of a non-compliant DNS traffic drops or detects. | keyword | -| checkpoint.suppressed_logs | Aggregated connections for five minutes on the same source, destination and port. | integer | -| checkpoint.sync | Sync status and the reason (stable, at risk). | keyword | -| checkpoint.sys_message | System messages | keyword | -| checkpoint.tcp_end_reason | Reason for TCP connection closure. | keyword | -| checkpoint.tcp_flags | TCP packet flags (SYN, ACK, etc.,). | keyword | -| checkpoint.tcp_packet_out_of_state | State violation. | keyword | -| checkpoint.tcp_state | Log reinting a tcp state change. | keyword | -| checkpoint.te_verdict_determined_by | Emulators determined file verdict. | keyword | -| checkpoint.ticket_id | Unique ID per file. | keyword | -| checkpoint.tls_server_host_name | SNI/CN from encrypted TLS connection used by URLF for categorization. | keyword | -| checkpoint.top_archive_file_name | In case of archive file: the file that was sent/received. | keyword | -| checkpoint.total_attachments | The number of attachments in an email. | integer | -| checkpoint.triggered_by | The name of the mechanism that triggered the Software Blade to enforce a protection. | keyword | -| checkpoint.trusted_domain | In case of phishing event, the domain, which the attacker was impersonating. | keyword | -| checkpoint.unique_detected_day | Detected virus for a specific host during the last day. | integer | -| checkpoint.unique_detected_hour | Detected virus for a specific host during the last hour. | integer | -| checkpoint.unique_detected_week | Detected virus for a specific host during the last week. | integer | -| checkpoint.update_status | Status of database update | keyword | -| checkpoint.url | Translated URL. | keyword | -| checkpoint.user | Source user name. | keyword | -| checkpoint.user_agent | String identifying requesting software user agent. | keyword | -| checkpoint.vendor_list | The vendor name that provided the verdict for a malicious URL. | keyword | -| checkpoint.verdict | TE engine verdict Possible values: Malicious/Benign/Error. | keyword | -| checkpoint.via | Via header is added by proxies for tracking purposes to avoid sending reqests in loop. | keyword | -| checkpoint.voip_attach_action_info | Attachment action Info. | keyword | -| checkpoint.voip_attach_sz | Attachment size. | integer | -| checkpoint.voip_call_dir | Call direction: in/out. | keyword | -| checkpoint.voip_call_id | Call-ID. | keyword | -| checkpoint.voip_call_state | Call state. Possible values: in/out. | keyword | -| checkpoint.voip_call_term_time | Call termination time stamp. | keyword | -| checkpoint.voip_config | Configuration. | keyword | -| checkpoint.voip_duration | Call duration (seconds). | keyword | -| checkpoint.voip_est_codec | Estimated codec. | keyword | -| checkpoint.voip_exp | Expiration. | integer | -| checkpoint.voip_from_user_type | Source IP-Phone type. | keyword | -| checkpoint.voip_log_type | VoIP log types. Possible values: reject, call, registration. | keyword | -| checkpoint.voip_media_codec | Estimated codec. | keyword | -| checkpoint.voip_media_ipp | Media IP protocol. | keyword | -| checkpoint.voip_media_port | Media int. | keyword | -| checkpoint.voip_method | Registration request. | keyword | -| checkpoint.voip_reason_info | Information. | keyword | -| checkpoint.voip_reg_int | Registration port. | integer | -| checkpoint.voip_reg_ipp | Registration IP protocol. | integer | -| checkpoint.voip_reg_period | Registration period. | integer | -| checkpoint.voip_reg_server | Registrar server IP address. | ip | -| checkpoint.voip_reg_user_type | Registered IP-Phone type. | keyword | -| checkpoint.voip_reject_reason | Reject reason. | keyword | -| checkpoint.voip_to_user_type | Destination IP-Phone type. | keyword | -| checkpoint.vpn_feature_name | L2TP /IKE / Link Selection. | keyword | -| checkpoint.watermark | Reports whether watermark is added to the cleaned file. | keyword | -| checkpoint.web_server_type | Web server detected in the HTTP response. | keyword | -| checkpoint.word_list | Words matched by data type. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.packets | Packets sent from the destination to the source. | long | -| destination.port | Port of the destination. | long | -| destination.service.name | Name of the service data is collected from. | keyword | -| destination.user.email | User email address. | keyword | -| destination.user.id | Unique identifier of the user. | keyword | -| destination.user.name | Short name or login of the user. | keyword | -| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | -| dns.id | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| email.bcc.address | The email address of BCC recipient | keyword | -| email.cc.address | The email address of CC recipient | keyword | -| email.delivery_timestamp | The date and time when the email message was received by the service or client. | date | -| email.from.address | The email address of the sender, typically from the RFC 5322 `From:` header field. | keyword | -| email.local_id | Unique identifier given to the email by the source that created the event. Identifier is not persistent across hops. | keyword | -| email.message_id | Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message. | wildcard | -| email.subject | A brief summary of the topic of the message. | keyword | -| email.subject.text | Multi-field of `email.subject`. | match_only_text | -| email.to.address | The email address of recipient | keyword | -| error.message | Error message. | match_only_text | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.id | Unique ID to describe the event. | keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | -| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha1 | SHA1 hash. | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| group.name | Name of the group. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| input.type | Type of Filebeat input. | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.flags | Flags for the log file. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| log.source.address | Source address of logs received over the network. | keyword | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.name | Name given by operators to sections of their network. | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| process.hash.md5 | MD5 hash. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| process.parent.hash.md5 | MD5 hash. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.description | The description of the rule generating the event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| source.user.email | User email address. | keyword | -| source.user.group.name | Name of the group. | keyword | -| source.user.id | Unique identifier of the user. | keyword | -| source.user.name | Short name or login of the user. | keyword | -| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.original.text | Multi-field of `url.original`. | match_only_text | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | -| vulnerability.id | The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] | keyword | - diff --git a/packages/checkpoint/1.5.1/img/checkpoint-logo.svg b/packages/checkpoint/1.5.1/img/checkpoint-logo.svg deleted file mode 100755 index aa73ccdd7f..0000000000 --- a/packages/checkpoint/1.5.1/img/checkpoint-logo.svg +++ /dev/null @@ -1,159 +0,0 @@ - - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/packages/checkpoint/1.5.1/manifest.yml b/packages/checkpoint/1.5.1/manifest.yml deleted file mode 100755 index 6f13d1654a..0000000000 --- a/packages/checkpoint/1.5.1/manifest.yml +++ /dev/null @@ -1,109 +0,0 @@ -name: checkpoint -title: Check Point -version: 1.5.1 -release: ga -description: Collect logs from Check Point with Elastic Agent. -type: integration -format_version: 1.0.0 -license: basic -categories: [security] -conditions: - kibana.version: "^7.16.0 || ^8.0.0" -icons: - - src: /img/checkpoint-logo.svg - title: Check Point - size: 761x341 - type: image/svg+xml -policy_templates: - - name: checkpoint - title: Check Point logs - description: Collect logs from Check Point instances - inputs: - - type: logfile - title: "Collect Check Point firewall logs (input: logfile)" - description: "Collecting firewall logs from Check Point instances (input: logfile)" - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - - name: internal_zones - type: text - title: Internal Zones - multi: true - required: false - show_user: false - default: - - trust - - name: external_zones - type: text - title: External Zones - multi: true - required: false - show_user: false - default: - - untrust - - type: tcp - vars: - - name: syslog_host - type: text - title: Syslog Host - multi: false - required: true - show_user: true - default: localhost - - name: syslog_port - type: integer - title: Syslog Port - multi: false - required: true - show_user: true - default: 9001 - - name: internal_zones - type: text - title: Internal Zones - multi: true - required: false - show_user: false - - name: external_zones - type: text - title: External Zones - multi: true - required: false - show_user: false - title: "Collect Check Point firewall logs (input: tcp)" - description: "Collecting firewall logs from Check Point instances (input: tcp)" - - type: udp - vars: - - name: syslog_host - type: text - title: Syslog Host - multi: false - required: true - show_user: true - default: localhost - - name: syslog_port - type: integer - title: Syslog Port - multi: false - required: true - show_user: true - default: 9001 - - name: internal_zones - type: text - title: Internal Zones - multi: true - required: false - show_user: false - - name: external_zones - type: text - title: External Zones - multi: true - required: false - show_user: false - title: "Collect Check Point firewall logs (input: udp)" - description: "Collecting firewall logs from Check Point instances (input: udp)" -owner: - github: elastic/security-external-integrations diff --git a/packages/cisco_asa/2.4.2/changelog.yml b/packages/cisco_asa/2.4.2/changelog.yml deleted file mode 100755 index 916ddeb3b1..0000000000 --- a/packages/cisco_asa/2.4.2/changelog.yml +++ /dev/null @@ -1,110 +0,0 @@ -# newer versions go on top -- version: "2.4.2" - changes: - - description: Map syslog priority details according to ECS - type: bugfix - link: https://github.com/elastic/integrations/pull/3549 - - description: Extract syslog facility and severity codes from syslog priority - type: bugfix - link: https://github.com/elastic/integrations/pull/3549 -- version: "2.4.1" - changes: - - description: Ensure invalid event.outcome does not get recorded in event - type: bugfix - link: https://github.com/elastic/integrations/pull/3354 -- version: "2.4.0" - changes: - - description: Add TCP input with TLS support - type: enhancement - link: https://github.com/elastic/integrations/pull/3312 -- version: "2.3.0" - changes: - - description: Update to ECS 8.2 - type: enhancement - link: https://github.com/elastic/integrations/pull/2778 -- version: "2.2.2" - changes: - - description: Change visualizations to use event.code instead of cisco.asa.message_id. - type: bugfix - link: https://github.com/elastic/integrations/pull/3146 -- version: "2.2.1" - changes: - - description: Add documentation for multi-fields - type: enhancement - link: https://github.com/elastic/integrations/pull/2916 -- version: "2.2.0" - changes: - - description: Add community_id processor, update 805001, 304001, 106023 and 602304 message parsing. elastic/beats#26879 - type: enhancement - link: https://github.com/elastic/integrations/pull/2820 - - description: Add user.name field to ASA Security negotiation log line. elastic/beats#26975 - type: enhancement - link: https://github.com/elastic/integrations/pull/2820 - - description: Change event.outcome and event.type handling to be more ECS compliant. elastic/beats#29698 - type: enhancement - link: https://github.com/elastic/integrations/pull/2820 -- version: "2.1.0" - changes: - - description: Add parsing for event code 113029-113040 - type: enhancement - link: https://github.com/elastic/integrations/pull/2535 -- version: "2.0.1" - changes: - - description: Clarify configuration option documentation - type: bugfix - link: https://github.com/elastic/integrations/pull/2649 -- version: "2.0.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2389 -- version: "1.3.2" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.3.1" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.3.0" - changes: - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2236 -- version: "1.2.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1952 -- version: "1.2.1" - changes: - - description: Relax time parsing and capture group and session type in Cisco ASA module - type: bugfix - link: https://github.com/elastic/integrations/pull/1891 -- version: "1.2.0" - changes: - - description: Add support for Cisco ASA SIP events - type: enhancement - link: https://github.com/elastic/integrations/pull/1865 -- version: "1.1.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1805 -- version: "1.1.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1782 -- version: "1.0.1" - changes: - - description: Adding missing ECS fields - type: bugfix - link: https://github.com/elastic/integrations/pull/1732 -- version: "1.0.0" - changes: - - description: Split Cisco ASA into its own package - type: enhancement - link: https://github.com/elastic/integrations/pull/1583 diff --git a/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/stream.yml.hbs b/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/stream.yml.hbs deleted file mode 100755 index 1190ec3f3c..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,20 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- add_locale: ~ -{{#if processors}} -{{processors}} -{{/if}} diff --git a/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/tcp.yml.hbs b/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/tcp.yml.hbs deleted file mode 100755 index 169989f2d7..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,22 +0,0 @@ -host: "{{tcp_host}}:{{tcp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -processors: -- add_locale: ~ -{{#if processors}} -{{processors}} -{{/if}} -{{#if tcp_options}} -{{tcp_options}} -{{/if}} diff --git a/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/udp.yml.hbs b/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/udp.yml.hbs deleted file mode 100755 index e01f113448..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/agent/stream/udp.yml.hbs +++ /dev/null @@ -1,16 +0,0 @@ -host: "{{udp_host}}:{{udp_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -processors: -- add_locale: ~ -{{#if processors}} -{{processors}} -{{/if}} diff --git a/packages/cisco_asa/2.4.2/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_asa/2.4.2/data_stream/log/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index f5412496e7..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,2124 +0,0 @@ ---- -description: "Pipeline for Cisco ASA logs" -processors: - - rename: - field: message - target_field: event.original - ignore_missing: true - - set: - field: ecs.version - value: '8.2.0' - # - # Parse the syslog header - # - # This populates the host.hostname, process.name, timestamp and other fields - # from the header and stores the message contents in _temp_.full_message. - - grok: - field: event.original - patterns: - - "(?:%{SYSLOG_HEADER})?\\s*%{GREEDYDATA:_temp_.full_message}" - pattern_definitions: - SYSLOG_HEADER: "(?:%{SYSLOGFACILITY}\\s*)?(?:%{FTD_DATE:_temp_.raw_date}:?\\s+)?(?:%{PROCESS_HOST}|%{HOST_PROCESS})(?:{DATA})?%{SYSLOG_END}?" - SYSLOGFACILITY: "<%{NONNEGINT:log.syslog.priority:int}>" - # Beginning with version 6.3, Firepower Threat Defense provides the option to enable timestamp as per RFC 5424. - FTD_DATE: "(?:%{TIMESTAMP_ISO8601}|%{ASA_DATE})" - ASA_DATE: "(?:%{DAY} )?%{MONTH} *%{MONTHDAY}(?: %{YEAR})? %{TIME}(?: %{TZ})?" - PROCESS: "(?:[^%\\s:\\[]+)" - SYSLOG_END: "(?:(:|\\s)\\s+)" - # exactly match the syntax for firepower management logs - PROCESS_HOST: "(?:%{PROCESS:process.name}:\\s%{SYSLOGHOST:host.name})" - HOST_PROCESS: "(?:%{SYSLOGHOST:host.hostname}:?\\s+)?(?:%{PROCESS:process.name}?(?:\\[%{POSINT:process.pid:long}\\])?)?" - - script: - lang: painless - source: | - if (ctx.log?.syslog?.priority != null) { - def severity = new HashMap(); - severity['code'] = ctx.log.syslog.priority&0x7; - ctx.log.syslog['severity'] = severity; - def facility = new HashMap(); - facility['code'] = ctx.log.syslog.priority>>3; - ctx.log.syslog['facility'] = facility; - } - - # - # Parse FTD/ASA style message - # - # This parses the header of an EMBLEM-style message for FTD and ASA prefixes. - - grok: - field: _temp_.full_message - patterns: - - "%{FTD_PREFIX}-(?:%{FTD_SUFFIX:_temp_.cisco.suffix}-)?%{NONNEGINT:event.severity:int}-%{POSINT:_temp_.cisco.message_id}?:?\\s*%{GREEDYDATA:message}" - # Before version 6.3, messages for connection, security intelligence, and intrusion events didn't include an event type ID in the message header. - - "%{GREEDYDATA:message}" - pattern_definitions: - FTD_SUFFIX: "[^0-9-]+" - # Before version 6.3, FTD used ASA prefix in syslog messages - FTD_PREFIX: "%{DATA}%(?:[A-Z]+)" - - # - # Create missing fields when no %FTD label is present - # - # message_id is needed in order for some processors below to work. - - set: - field: _temp_.cisco.message_id - value: "" - if: "ctx?._temp_?.cisco?.message_id == null" - - # - # set default event.severity to 7 (debug): - # - # This value is read from the EMBLEM header and won't be present if this is not - # an emblem message (firewalls can be configured to report other kinds of events) - - set: - field: event.severity - value: 7 - if: "ctx?.event?.severity == null" - - # - # Parse the date included in FTD logs - # - - date: - if: "ctx.event?.timezone == null && ctx._temp_?.raw_date != null" - field: "_temp_.raw_date" - target_field: "@timestamp" - formats: - - "ISO8601" - - "MMM d HH:mm:ss" - - "MMM dd HH:mm:ss" - - "EEE MMM d HH:mm:ss" - - "EEE MMM dd HH:mm:ss" - - "MMM d HH:mm:ss z" - - "MMM dd HH:mm:ss z" - - "EEE MMM d HH:mm:ss z" - - "EEE MMM dd HH:mm:ss z" - - "MMM d yyyy HH:mm:ss" - - "MMM dd yyyy HH:mm:ss" - - "EEE MMM d yyyy HH:mm:ss" - - "EEE MMM dd yyyy HH:mm:ss" - - "MMM d yyyy HH:mm:ss z" - - "MMM dd yyyy HH:mm:ss z" - - "EEE MMM d yyyy HH:mm:ss z" - - "EEE MMM dd yyyy HH:mm:ss z" - on_failure: - [ - { - "append": - { - "field": "error.message", - "value": "{{ _ingest.on_failure_message }}", - }, - }, - ] - - date: - if: "ctx.event?.timezone != null && ctx._temp_?.raw_date != null" - timezone: "{{ event.timezone }}" - field: "_temp_.raw_date" - target_field: "@timestamp" - formats: - - "ISO8601" - - "MMM d HH:mm:ss" - - "MMM dd HH:mm:ss" - - "EEE MMM d HH:mm:ss" - - "EEE MMM dd HH:mm:ss" - - "MMM d HH:mm:ss z" - - "MMM dd HH:mm:ss z" - - "EEE MMM d HH:mm:ss z" - - "EEE MMM dd HH:mm:ss z" - - "MMM d yyyy HH:mm:ss" - - "MMM dd yyyy HH:mm:ss" - - "EEE MMM d yyyy HH:mm:ss" - - "EEE MMM dd yyyy HH:mm:ss" - - "MMM d yyyy HH:mm:ss z" - - "MMM dd yyyy HH:mm:ss z" - - "EEE MMM d yyyy HH:mm:ss z" - - "EEE MMM dd yyyy HH:mm:ss z" - on_failure: - [ - { - "append": - { - "field": "error.message", - "value": "{{ _ingest.on_failure_message }}", - }, - }, - ] - - # - # Set log.level - # - - set: - field: "log.level" - if: "ctx.event.severity == 0" - value: unknown - - set: - field: "log.level" - if: "ctx.event.severity == 1" - value: alert - - set: - field: "log.level" - if: "ctx.event.severity == 2" - value: critical - - set: - field: "log.level" - if: "ctx.event.severity == 3" - value: error - - set: - field: "log.level" - if: "ctx.event.severity == 4" - value: warning - - set: - field: "log.level" - if: "ctx.event.severity == 5" - value: notification - - set: - field: "log.level" - if: "ctx.event.severity == 6" - value: informational - - set: - field: "log.level" - if: "ctx.event.severity == 7" - value: debug - - # - # Firewall messages - # - # This set of messages is shared between FTD and ASA. - - set: - if: 'ctx._temp_.cisco.message_id != ""' - field: "event.action" - value: "firewall-rule" - - dissect: - if: "ctx._temp_.cisco.message_id == '106001'" - field: "message" - description: "106001" - pattern: "%{network.direction} %{network.transport} connection %{event.outcome} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} flags %{} on interface %{_temp_.cisco.source_interface}" - - dissect: - if: "ctx._temp_.cisco.message_id == '106002'" - field: "message" - description: "106002" - pattern: "%{network.transport} Connection %{event.outcome} by %{network.direction} list %{_temp_.cisco.list_id} src %{source.address} dest %{destination.address}" - - dissect: - if: "ctx._temp_.cisco.message_id == '106006'" - field: "message" - description: "106006" - pattern: "%{event.outcome} %{network.direction} %{network.transport} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} on interface %{_temp_.cisco.source_interface}" - - dissect: - if: "ctx._temp_.cisco.message_id == '106007'" - field: "message" - description: "106007" - pattern: "%{event.outcome} %{network.direction} %{network.transport} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} due to %{network.protocol} %{}" - - grok: - if: "ctx._temp_.cisco.message_id == '106010'" - field: "message" - description: "106010" - patterns: - - "%{NOTSPACE:event.outcome} %{NOTSPACE:network.direction} %{NOTSPACE:network.transport} src %{NOTSPACE:_temp_.cisco.source_interface}:%{NOTSPACE:source.address}/%{POSINT:source.port} (%{DATA})?dst %{NOTSPACE:_temp_.cisco.destination_interface}:%{NOTSPACE:destination.address}/%{POSINT:destination.port}(%{GREEDYDATA})?" - - dissect: - if: "ctx._temp_.cisco.message_id == '106013'" - field: "message" - description: "106013" - pattern: "Dropping echo request from %{source.address} to PAT address %{destination.address}" - - set: - if: "ctx._temp_.cisco.message_id == '106013'" - field: "network.transport" - description: "106013" - value: icmp - - set: - if: "ctx._temp_.cisco.message_id == '106013'" - field: "network.direction" - description: "106013" - value: inbound - - grok: - if: "ctx._temp_.cisco.message_id == '106014'" - field: "message" - description: "106014" - patterns: - - "%{NOTSPACE:event.outcome} %{NOTSPACE:network.direction} %{NOTSPACE:network.transport} src %{NOTSPACE:_temp_.cisco.source_interface}:%{NOTSPACE:source.address} (%{DATA})?dst %{NOTSPACE:_temp_.cisco.destination_interface}:(?[^ (]*)(%{GREEDYDATA})?" - - grok: - if: "ctx._temp_.cisco.message_id == '106015'" - field: "message" - description: "106015" - patterns: - - "%{NOTSPACE:event.outcome} %{NOTSPACE:network.transport} %{NOTSPACE} %{NOTSPACE} from %{IP:source.address}/%{POSINT:source.port} to %{IP:destination.address}/%{POSINT:destination.port} flags %{DATA} on interface %{NOTSPACE:_temp_.cisco.source_interface}" - - dissect: - if: "ctx._temp_.cisco.message_id == '106016'" - field: "message" - pattern: "%{event.outcome} IP spoof from (%{source.address}) to %{destination.address} on interface %{_temp_.cisco.source_interface}" - description: "106016" - - dissect: - if: "ctx._temp_.cisco.message_id == '106017'" - field: "message" - pattern: "%{event.outcome} IP due to Land Attack from %{source.address} to %{destination.address}" - description: "106017" - - dissect: - if: "ctx._temp_.cisco.message_id == '106018'" - field: "message" - pattern: "%{network.transport} packet type %{_temp_.cisco.icmp_type} %{event.outcome} by %{network.direction} list %{_temp_.cisco.list_id} src %{source.address} dest %{destination.address}" - description: "106018" - - dissect: - if: "ctx._temp_.cisco.message_id == '106020'" - field: "message" - pattern: "%{event.outcome} IP teardrop fragment (size = %{}, offset = %{}) from %{source.address} to %{destination.address}" - description: "106020" - - dissect: - if: "ctx._temp_.cisco.message_id == '106021'" - field: "message" - pattern: "%{event.outcome} %{network.transport} reverse path check from %{source.address} to %{destination.address} on interface %{_temp_.cisco.source_interface}" - description: "106021" - - dissect: - if: "ctx._temp_.cisco.message_id == '106022'" - field: "message" - pattern: "%{event.outcome} %{network.transport} connection spoof from %{source.address} to %{destination.address} on interface %{_temp_.cisco.source_interface}" - description: "106022" - - grok: - if: "ctx._temp_.cisco.message_id == '106023'" - field: "message" - description: "106023" - patterns: - - ^%{NOTSPACE:event.outcome} ((protocol %{POSINT:network.iana_number})|%{NOTSPACE:network.transport}) src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST:source.address}(/%{POSINT:source.port})?\s*(\(%{CISCO_USER:_temp_.cisco.source_username}\) )?dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST:destination.address}(/%{POSINT:destination.port})?%{DATA}by access-group "%{NOTSPACE:_temp_.cisco.list_id}" - pattern_definitions: - NOTCOLON: "[^:]*" - CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?) - - dissect: - if: "ctx._temp_.cisco.message_id == '106027'" - field: "message" - description: "106027" - pattern: '%{} %{event.outcome} src %{source.address} dst %{destination.address} by access-group "%{_temp_.cisco.list_id}"' - - dissect: - if: "ctx._temp_.cisco.message_id == '106100'" - field: "message" - description: "106100" - pattern: "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} %{_temp_.cisco.source_interface}/%{source.address}(%{source.port})%{}-> %{_temp_.cisco.destination_interface}/%{destination.address}(%{destination.port})%{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '106102' || ctx._temp_.cisco.message_id == '106103'" - field: "message" - description: "106103" - pattern: "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} for user %{user.name} %{_temp_.cisco.source_interface}/%{source.address}(%{source.port})%{}-> %{_temp_.cisco.destination_interface}/%{destination.address}(%{destination.port})%{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '111004'" - field: "message" - description: "111004" - pattern: "%{source.address} end configuration: %{_temp_.cisco.cli_outcome}" - - set: - field: event.outcome - description: "111004" - value: "success" - if: "ctx._temp_.cisco.message_id == '111004' && ctx?._temp_?.cisco?.cli_outcome == 'OK'" - - set: - field: event.outcome - description: "111004" - value: "failure" - if: "ctx._temp_.cisco.message_id == '111004' && ctx?._temp_?.cisco?.cli_outcome == 'FAILED'" - - remove: - field: _temp_.cisco.cli_outcome - ignore_missing: true - - append: - field: event.type - description: "111004" - value: "change" - if: "ctx._temp_.cisco.message_id == '111004'" - - grok: - if: "ctx._temp_.cisco.message_id == '111009'" - description: "111009" - field: "message" - patterns: - - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}" - - grok: - if: "ctx._temp_.cisco.message_id == '111010'" - field: "message" - description: "111010" - patterns: - - "User '%{NOTSPACE:server.user.name}', running %{QUOTEDSTRING} from IP %{IP:source.address}, executed %{QUOTEDSTRING:_temp_.cisco.command_line_arguments}" - - dissect: - if: "ctx._temp_.cisco.message_id == '113019'" - field: "message" - description: "113019" - pattern: "Group = %{source.user.group.name}, Username = %{source.user.name}, IP = %{destination.address}, Session disconnected. Session Type: %{_temp_.cisco.session_type}, Duration: %{_temp_.duration_hms}, Bytes xmt: %{source.bytes}, Bytes rcv: %{destination.bytes}, Reason: %{event.reason}" - - dissect: - if: "ctx._temp_.cisco.message_id == '113040'" - field: "message" - description: "113040" - pattern: "Terminating the VPN connection attempt from %{source.user.group.name}. Reason: This connection is group locked to %{}." - - grok: - if: '["113029","113030","113031","113032","113033","113034","113035","113036","113038","113039"].contains(ctx._temp_.cisco.message_id)' - field: "message" - description: "113029, 113030, 113031, 113032, 113033, 113034, 113035, 113036, 113038, 113039" - patterns: - - "Group %{NOTSPACE:source.user.group.name} User %{USER:source.user.name} IP %{IP:source.address}" - - grok: - if: '["302013", "302015"].contains(ctx._temp_.cisco.message_id)' - field: "message" - description: "302013, 302015" - patterns: - - Built %{NOTSPACE:network.direction} %{NOTSPACE:network.transport} connection %{NUMBER:_temp_.cisco.connection_id} for %{NOTCOLON:_temp_.cisco.source_interface}:%{IP:source.address}/%{NUMBER:source.port} \(%{IP:_temp_.natsrcip}/%{NUMBER:_temp_.cisco.mapped_source_port}\)(\(%{CISCO_USER:_temp_.cisco.source_username}\))? to %{NOTCOLON:_temp_.cisco.destination_interface}:%{NOTSPACE:destination.address}/%{NUMBER:destination.port} \(%{NOTSPACE:_temp_.natdstip}/%{NUMBER:_temp_.cisco.mapped_destination_port}\)(\(%{CISCO_USER:destination.user.name}\))?( \(%{CISCO_USER:_temp_.cisco.termination_user}\))?%{GREEDYDATA} - pattern_definitions: - NOTCOLON: "[^:]*" - CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?) - - dissect: - if: "ctx._temp_.cisco.message_id == '303002'" - field: "message" - description: "303002" - pattern: "%{network.protocol} connection from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}, user %{client.user.name} %{} file %{file.path}" - - grok: - if: "ctx._temp_.cisco.message_id == '305012'" - field: "message" - description: "305012" - patterns: - - Teardown %{DATA} %{NOTSPACE:network.transport} translation from %{NOTCOLON:_temp_.cisco.source_interface}:%{IP:source.address}/%{NUMBER:source.port}(\s*\(%{CISCO_USER:_temp_.cisco.source_username}\))? to %{NOTCOLON:_temp_.cisco.destination_interface}:%{IP:destination.address}/%{NUMBER:destination.port} duration %{DURATION:_temp_.duration_hms} - pattern_definitions: - NOTCOLON: "[^:]*" - CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?) - DURATION: "%{INT}:%{MINUTE}:%{SECOND}" - - grok: - if: "ctx._temp_.cisco.message_id == '302020'" - field: "message" - description: "302020" - patterns: - - "Built %{NOTSPACE:network.direction} %{NOTSPACE:network.protocol} connection for faddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSDESTIPORHOST}/%{NUMBER}\\s*(?:\\(%{CISCO_USER:_temp_.cisco.destination_username}\\) )?gaddr (?:%{NOTCOLON}:)?%{MAPPEDSRC}/%{NUMBER} laddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSSOURCEIPORHOST}/%{NUMBER}\\s*(?:\\(%{CISCO_USER:_temp_.cisco.source_username}\\) )?(type %{NUMBER:_temp_.cisco.icmp_type} code %{NUMBER:_temp_.cisco.icmp_code})?" - pattern_definitions: - NOTCOLON: "[^:]*" - ECSSOURCEIPORHOST: "(?:%{IP:source.address}|%{HOSTNAME:source.domain})" - ECSDESTIPORHOST: "(?:%{IP:destination.address}|%{HOSTNAME:destination.domain})" - MAPPEDSRC: "(?:%{DATA:_temp_.natsrcip}|%{HOSTNAME})" - CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?) - - dissect: - if: "ctx._temp_.cisco.message_id == '302022'" - field: "message" - description: "302022" - pattern: "Built %{} stub %{network.transport} connection for %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} %{} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} %{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '302023'" - field: "message" - description: "302023" - pattern: "Teardown stub %{network.transport} connection for %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} duration %{_temp_.duration_hms} forwarded bytes %{network.bytes} %{event.reason}" - - grok: - if: "ctx._temp_.cisco.message_id == '304001'" - field: "message" - description: "304001" - patterns: - - "(%{NOTSPACE:source.user.name}@)?%{IP:source.address}(\\(%{DATA}\\))? %{DATA} (%{NOTSPACE}@)?%{IP:destination.address}:%{GREEDYDATA:url.original}" - - set: - if: "ctx._temp_.cisco.message_id == '304001'" - field: "event.outcome" - description: "304001" - value: allowed - - dissect: - if: "ctx._temp_.cisco.message_id == '304002'" - field: "message" - description: "304002" - pattern: "Access %{event.outcome} URL %{url.original} SRC %{source.address} %{}EST %{destination.address} on interface %{_temp_.cisco.source_interface}" - - grok: - if: "ctx._temp_.cisco.message_id == '305011'" - field: "message" - description: "305011" - patterns: - - Built %{NOTSPACE} %{NOTSPACE:network.transport} translation from %{NOTSPACE:_temp_.cisco.source_interface}:%{IP:source.address}/%{NUMBER:source.port}(\(%{NOTSPACE:source.user.name}\))? to %{NOTSPACE:_temp_.cisco.destination_interface}:%{IP:destination.address}/%{NUMBER:destination.port} - - dissect: - if: "ctx._temp_.cisco.message_id == '313001'" - field: "message" - description: "313001" - pattern: "%{event.outcome} %{network.transport} type=%{_temp_.cisco.icmp_type}, code=%{_temp_.cisco.icmp_code} from %{source.address} on interface %{_temp_.cisco.source_interface}" - - dissect: - if: "ctx._temp_.cisco.message_id == '313004'" - field: "message" - description: "313004" - pattern: "%{event.outcome} %{network.transport} type=%{_temp_.cisco.icmp_type}, from%{}addr %{source.address} on interface %{_temp_.cisco.source_interface} to %{destination.address}: no matching session" - - dissect: - if: "ctx._temp_.cisco.message_id == '313005'" - field: "message" - description: "313005" - pattern: "No matching connection for %{network.transport} error message: %{} on %{_temp_.cisco.source_interface} interface.%{}riginal IP payload: %{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '313008'" - field: "message" - description: "313008" - pattern: "%{event.outcome} %{network.transport} type=%{_temp_.cisco.icmp_type}, code=%{_temp_.cisco.icmp_code} from %{source.address} on interface %{_temp_.cisco.source_interface}" - - dissect: - if: "ctx._temp_.cisco.message_id == '313009'" - field: "message" - description: "313009" - pattern: "%{event.outcome} invalid %{network.transport} code %{_temp_.cisco.icmp_code}, for %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '322001'" - field: "message" - description: "322001" - pattern: "%{event.outcome} MAC address %{source.mac}, possible spoof attempt on interface %{_temp_.cisco.source_interface}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338001'" - field: "message" - description: "338001" - pattern: "Dynamic filter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338001'" - field: "server.domain" - description: "338001" - value: "{{source.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338002'" - field: "message" - description: "338002" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}" - - set: - if: "ctx._temp_.cisco.message_id == '338002'" - field: "server.domain" - description: "338002" - value: "{{destination.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338003'" - field: "message" - description: "338003" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338004'" - field: "message" - description: "338004" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338005'" - field: "message" - description: "338005" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338005'" - field: "server.domain" - description: "338005" - value: "{{source.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338006'" - field: "message" - description: "338006" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338006'" - field: "server.domain" - description: "338006" - value: "{{destination.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338007'" - field: "message" - description: "338007" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338008'" - field: "message" - description: "338008" - pattern: "Dynamic %{}ilter %{event.outcome} black%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338101'" - field: "message" - description: "338101" - pattern: "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}" - - set: - if: "ctx._temp_.cisco.message_id == '338101'" - field: "server.domain" - description: "338101" - value: "{{source.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338102'" - field: "message" - description: "338102" - pattern: "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}" - - set: - if: "ctx._temp_.cisco.message_id == '338102'" - field: "server.domain" - description: "338102" - value: "{{destination.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338103'" - field: "message" - description: "338103" - pattern: "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338104'" - field: "message" - description: "338104" - pattern: "Dynamic %{}ilter %{event.outcome} white%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{}" - - dissect: - if: "ctx._temp_.cisco.message_id == '338201'" - field: "message" - description: "338201" - pattern: "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338201'" - field: "server.domain" - description: "338201" - value: "{{source.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338202'" - field: "message" - description: "338202" - pattern: "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338202'" - field: "server.domain" - description: "338202" - value: "{{destination.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338203'" - field: "message" - description: "338203" - pattern: "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}source %{} resolved from %{_temp_.cisco.list_id} list: %{source.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338203'" - field: "server.domain" - description: "338203" - value: "{{source.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338204'" - field: "message" - description: "338204" - pattern: "Dynamic %{}ilter %{event.outcome} grey%{}d %{network.transport} traffic from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})%{}destination %{} resolved from %{_temp_.cisco.list_id} list: %{destination.domain}, threat-level: %{_temp_.cisco.threat_level}, category: %{_temp_.cisco.threat_category}" - - set: - if: "ctx._temp_.cisco.message_id == '338204'" - field: "server.domain" - description: "338204" - value: "{{destination.domain}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '338301'" - field: "message" - description: "338301" - pattern: "Intercepted DNS reply for domain %{source.domain} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}, matched %{_temp_.cisco.list_id}" - - set: - if: "ctx._temp_.cisco.message_id == '338301'" - field: "client.address" - description: "338301" - value: "{{destination.address}}" - ignore_empty_value: true - - set: - if: "ctx._temp_.cisco.message_id == '338301'" - field: "client.port" - description: "338301" - value: "{{destination.port}}" - ignore_empty_value: true - - set: - if: "ctx._temp_.cisco.message_id == '338301'" - field: "server.address" - description: "338301" - value: "{{source.address}}" - ignore_empty_value: true - - set: - if: "ctx._temp_.cisco.message_id == '338301'" - field: "server.port" - description: "338301" - value: "{{source.port}}" - ignore_empty_value: true - - dissect: - if: "ctx._temp_.cisco.message_id == '502103'" - field: "message" - description: "502103" - pattern: "User priv level changed: Uname: %{server.user.name} From: %{_temp_.cisco.privilege.old} To: %{_temp_.cisco.privilege.new}" - - append: - if: "ctx._temp_.cisco.message_id == '502103'" - field: "event.type" - description: "502103" - value: - - "group" - - "change" - - append: - if: "ctx._temp_.cisco.message_id == '502103'" - field: "event.category" - description: "502103" - value: "iam" - - dissect: - if: "ctx._temp_.cisco.message_id == '507003'" - field: "message" - description: "507003" - pattern: "%{network.transport} flow from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} terminated by inspection engine, reason - %{message}" - - dissect: - if: '["605004", "605005"].contains(ctx._temp_.cisco.message_id)' - field: "message" - description: "605004, 605005" - pattern: 'Login %{event.outcome} from %{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{network.protocol} for user "%{source.user.name}"' - - dissect: - if: "ctx._temp_.cisco.message_id == '609001'" - field: "message" - description: "609001" - pattern: "Built local-host %{_temp_.cisco.source_interface}:%{source.address}" - - dissect: - if: "ctx._temp_.cisco.message_id == '607001'" - field: "message" - description: "607001" - pattern: "Pre-allocate SIP %{_temp_.cisco.connection_type} secondary channel for %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} to %{_temp_.cisco.source_interface}:%{source.address} from %{_temp_.cisco.message} message" - - grok: - if: "ctx._temp_.cisco.message_id == '607001'" - description: "607001" - field: "_temp_.cisco.connection_type" - patterns: - - "%{CONNECTION}" - pattern_definitions: - TRANSPORTS: "(?:UDP|TCP)" - PROTOCOLS: "(?:RTP|RTCP)" - CONNECTION: "(?:%{TRANSPORTS:network.transport}|%{PROTOCOLS:network.protocol})" - ignore_failure: true - - dissect: - if: "ctx._temp_.cisco.message_id == '609002'" - field: "message" - description: "609002" - pattern: "Teardown local-host %{_temp_.cisco.source_interface}:%{source.address} duration %{_temp_.duration_hms}" - - dissect: - if: '["611102", "611101"].contains(ctx._temp_.cisco.message_id)' - field: "message" - description: "611102, 611101" - pattern: 'User authentication %{event.outcome}: IP address: %{source.address}, Uname: %{server.user.name}' - - dissect: - if: "ctx._temp_.cisco.message_id == '710003'" - field: "message" - description: "710003" - pattern: "%{network.transport} access %{event.outcome} by ACL from %{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}" - - dissect: - if: "ctx._temp_.cisco.message_id == '710005'" - field: "message" - description: "710005" - pattern: "%{network.transport} request %{event.outcome} from %{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}" - - dissect: - if: "ctx._temp_.cisco.message_id == '713049'" - field: "message" - description: "713049" - pattern: "Group = %{}, IP = %{source.address}, Security negotiation complete for LAN-to-LAN Group (%{}) %{}, Inbound SPI = %{}, Outbound SPI = %{}" - ignore_failure: true - - dissect: - if: "ctx._temp_.cisco.message_id == '713049'" - field: "message" - description: "713049" - pattern: "Group = %{}, Username = %{user.name}, IP = %{source.address}, Security negotiation complete for User (%{}) %{}, Inbound SPI = %{}, Outbound SPI = %{}" - ignore_failure: true - - grok: - if: "ctx._temp_.cisco.message_id == '716002'" - field: "message" - description: "716002" - patterns: - - "Group <%{NOTSPACE:_temp_.cisco.webvpn.group_name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> WebVPN session terminated: %{GREEDYDATA:event.reason}." - - "Group %{NOTSPACE:_temp_.cisco.webvpn.group_name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} WebVPN session terminated: %{GREEDYDATA:event.reason}." - - grok: - if: "ctx._temp_.cisco.message_id == '722051'" - field: "message" - description: "722051" - patterns: - - "Group <%{NOTSPACE:_temp_.cisco.webvpn.group_name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> IPv4 Address <%{IP:_temp_.cisco.assigned_ip}> %{GREEDYDATA}" - - "Group %{NOTSPACE:_temp_.cisco.webvpn.group_name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} IPv4 Address %{IP:_temp_.cisco.assigned_ip} %{GREEDYDATA}" - - grok: - if: "ctx._temp_.cisco.message_id == '733100'" - field: "message" - description: "733100" - patterns: - - \[(%{SPACE})?%{DATA:_temp_.cisco.burst.object}\] drop %{NOTSPACE:_temp_.cisco.burst.id} exceeded. Current burst rate is %{INT:_temp_.cisco.burst.current_rate} per second, max configured rate is %{INT:_temp_.cisco.burst.configured_rate}; Current average rate is %{INT:_temp_.cisco.burst.avg_rate} per second, max configured rate is %{INT:_temp_.cisco.burst.configured_avg_rate}; Cumulative total count is %{INT:_temp_.cisco.burst.cumulative_count} - - dissect: - if: "ctx._temp_.cisco.message_id == '734001'" - field: "message" - description: "734001" - pattern: "DAP: User %{user.email}, Addr %{source.address}, Connection %{_temp_.cisco.connection_type}: The following DAP records were selected for this connection: %{_temp_.cisco.dap_records->}" - - dissect: - if: "ctx._temp_.cisco.message_id == '805001'" - field: "message" - description: "805001" - pattern: "Offloaded %{network.transport} Flow for connection %{_temp_.cisco.connection_id} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})" - - dissect: - if: "ctx._temp_.cisco.message_id == '805002'" - field: "message" - description: "805002" - pattern: "%{network.transport} Flow is no longer offloaded for connection %{_temp_.cisco.connection_id} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} (%{_temp_.natsrcip}/%{_temp_.cisco.mapped_source_port}) to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} (%{_temp_.natdstip}/%{_temp_.cisco.mapped_destination_port})" - - split: - field: "_temp_.cisco.dap_records" - separator: ",\\s+" - ignore_missing: true - - dissect: - if: "ctx._temp_.cisco.message_id == '434002'" - field: "message" - pattern: "SFR requested to %{event.action} %{network.protocol} packet from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}" - - dissect: - if: "ctx._temp_.cisco.message_id == '434004'" - field: "message" - pattern: "SFR requested ASA to %{event.action} further packet redirection and process %{network.protocol} flow from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} locally" - - dissect: - if: "ctx._temp_.cisco.message_id == '110002'" - field: "message" - pattern: "%{event.reason} for %{network.protocol} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{destination.address}/%{destination.port}" - - dissect: - if: "ctx._temp_.cisco.message_id == '419002'" - field: "message" - pattern: "%{event.reason}from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} %{+event.reason}" - - dissect: - if: '["602303", "602304"].contains(ctx._temp_.cisco.message_id)' - field: "message" - pattern: "%{network.type}: An %{network.direction} %{_temp_.cisco.tunnel_type} SA (SPI= %{}) between %{source.address} and %{destination.address} (user= %{user.name}) has been %{event.action}." - - dissect: - if: "ctx._temp_.cisco.message_id == '750002'" - field: "message" - pattern: "Local:%{source.address}:%{source.port} Remote:%{destination.address}:%{destination.port} Username:%{user.name} %{event.reason}" - - dissect: - if: "ctx._temp_.cisco.message_id == '713120'" - field: "message" - pattern: "Group = %{}, IP = %{source.address}, %{event.reason} (msgid=%{event.id})" - - dissect: - if: "ctx._temp_.cisco.message_id == '713202'" - field: "message" - pattern: "IP = %{source.address}, %{event.reason}. %{} packet." - - dissect: - if: "ctx._temp_.cisco.message_id == '750003'" - field: "message" - pattern: "Local:%{source.address}:%{source.port} Remote:%{destination.address}:%{destination.port} Username:%{user.name} %{event.reason} ERROR:%{+event.reason}" - - grok: - if: '["713905", "713904", "713906", "713902", "713901"].contains(ctx._temp_.cisco.message_id)' - field: "message" - patterns: - - "^(Group = %{IP}, )?(IP = %{IP:source.address}, )?%{GREEDYDATA:event.reason}$" - # Handle ecs action outcome protocol - - set: - if: '["434002", "434004"].contains(ctx._temp_.cisco.message_id)' - field: "event.outcome" - value: "unknown" - - set: - if: '["419002"].contains(ctx._temp_.cisco.message_id)' - field: "network.protocol" - value: "tcp" - - set: - if: '["110002"].contains(ctx._temp_.cisco.message_id)' - field: "event.outcome" - value: "dropped" - - set: - if: '["713120"].contains(ctx._temp_.cisco.message_id)' - field: "event.outcome" - value: "success" - - set: - if: '["602303", "602304"].contains(ctx._temp_.cisco.message_id)' - field: "event.outcome" - value: "success" - - set: - if: '["710005"].contains(ctx._temp_.cisco.message_id)' - field: "event.outcome" - value: "dropped" - - set: - if: '["713901", "713902", "713903", "713904", "713905"].contains(ctx._temp_.cisco.message_id)' - field: "event.outcome" - value: "failure" - - set: - if: '["113039"].contains(ctx._temp_.cisco.message_id)' - field: "event.action" - value: "client-vpn-connected" - - set: - if: '["113029","113030","113031","113032","113033","113034","113035","113036","113037","113038"].contains(ctx._temp_.cisco.message_id)' - field: "event.action" - value: "client-vpn-error" - - set: - if: '["113040"].contains(ctx._temp_.cisco.message_id)' - field: "event.action" - value: "client-vpn-disconnected" - - set: - if: '["750002", "750003"].contains(ctx._temp_.cisco.message_id)' - field: "event.action" - value: "connection-started" - - set: - if: '["750003", "713905", "713904", "713906", "713902", "713901"].contains(ctx._temp_.cisco.message_id)' - field: "event.action" - value: "error" - - append: - if: '["750003", "713905", "713904", "713906", "713902", "713901"].contains(ctx._temp_.cisco.message_id)' - field: "event.type" - value: "error" - - # - # Handle 302xxx messages (Flow expiration a.k.a "Teardown") - # - - set: - if: '["305012", "302014", "302016", "302018", "302020", "302021", "302036", "302304", "302306", "609001", "609002"].contains(ctx._temp_.cisco.message_id)' - field: "event.action" - value: "flow-expiration" - description: "305012, 302014, 302016, 302018, 302020, 302021, 302036, 302304, 302306, 609001, 609002" - - grok: - field: "message" - if: '["302014", "302016", "302018", "302021", "302036", "302304", "302306"].contains(ctx._temp_.cisco.message_id)' - description: "302014, 302016, 302018, 302021, 302036, 302304, 302306" - patterns: - - ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.source_username}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} from %{NOTCOLON:_temp_.cisco.termination_initiator} \(%{CISCO_USER:_temp_.cisco.termination_user}\) - - ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.source_username}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} from %{NOTCOLON:_temp_.cisco.termination_initiator} - - ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.source_username}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} \(%{CISCO_USER:_temp_.cisco.termination_user}\) - - ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.source_username}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) \(%{CISCO_USER:_temp_.cisco.termination_user}\) - - ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.source_username}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} - - ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.source_username}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) - - ^Teardown %{NOTSPACE:network.transport} connection for faddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSDESTIPORHOST}/%{NUMBER}\s*(?:\(?%{CISCO_USER:_temp_.cisco.destination_username}\)? )?gaddr (?:%{NOTCOLON}:)?%{MAPPEDSRC}/%{NUMBER} laddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSSOURCEIPORHOST}/%{NUMBER}\s*(?:\(%{CISCO_USER:_temp_.cisco.source_username}\))?(\s*type %{NUMBER:_temp_.cisco.icmp_type} code %{NUMBER:_temp_.cisco.icmp_code})? - pattern_definitions: - NOTCOLON: "[^:]*" - ECSSOURCEIPORHOST: "(?:%{IP:source.address}|%{HOSTNAME:source.domain})" - ECSDESTIPORHOST: "(?:%{IP:destination.address}|%{HOSTNAME:destination.domain})" - MAPPEDSRC: "(?:%{IPORHOST:_temp_.natsrcip}|%{HOSTNAME})" - DURATION: "%{INT}:%{MINUTE}:%{SECOND}" - CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?) - - # - # Decode FTD's Security Event Syslog Messages - # - # 43000x messages are security event syslog messages specific to FTD. - # Format is a comma-separated sequence of key: value pairs. - # - # The result of this decoding is saved as _temp_.orig_security.{Key}: {Value} - - kv: - if: '["430001", "430002", "430003", "430004", "430005", ""].contains(ctx._temp_.cisco.message_id)' - field: "message" - description: "430001, 430002, 430003, 430004, 430005" - field_split: ",(?=[A-za-z1-9\\s]+:)" - value_split: ":" - target_field: "_temp_.orig_security" - trim_key: " " - trim_value: " " - ignore_failure: true - - # - # Remove _temp_.full_message. - # - # The field has been used as temporary buffer while decoding. The full message - # is kept under event.original. Processors below can still add a message field, as some - # security events contain an explanatory Message field. - - remove: - field: - - message - - _temp_.full_message - ignore_missing: true - - # - # Populate ECS fields from Security Events - # - # This script uses the key-value pairs from Security Events to populate - # the appropriate ECS fields. - # - # A single key can be mapped to multiple ECS fields, and more than one key can - # map to the same ECS field, which results in an array being created. - # - # This script performs an additional job: - # - # Before FTD version 6.3, the message_id was not included in Security Events. - # As this field encodes the kind of event (intrusion, connection, malware...) - # the script below will guess the right message_id from the keys present in - # the event. - # - # The reason for overloading this script with different behaviors is - # that this pipeline is already reaching the limit on script compilations. - # - #******************************************************************************* - # Code generated by go generate. DO NOT EDIT. - #******************************************************************************* - - script: - if: ctx._temp_?.orig_security != null - params: - ACPolicy: - target: ac_policy - id: ["430001", "430002", "430003"] - ecs: [_temp_.cisco.rule_name] - AccessControlRuleAction: - target: access_control_rule_action - id: ["430002", "430003"] - ecs: [event.outcome] - AccessControlRuleName: - target: access_control_rule_name - id: ["430002", "430003"] - ecs: [_temp_.cisco.rule_name] - AccessControlRuleReason: - target: access_control_rule_reason - id: ["430002", "430003"] - ApplicationProtocol: - target: application_protocol - ecs: [network.protocol] - ArchiveDepth: - target: archive_depth - id: ["430004", "430005"] - ArchiveFileName: - target: archive_file_name - id: ["430004", "430005"] - ecs: [file.name] - ArchiveFileStatus: - target: archive_file_status - id: ["430004", "430005"] - ArchiveSHA256: - target: archive_sha256 - id: ["430004", "430005"] - ecs: [file.hash.sha256] - Classification: - target: classification - id: ["430001"] - Client: - target: client - ecs: [network.application] - ClientVersion: - target: client_version - id: ["430002", "430003"] - ConnectionDuration: - target: connection_duration - id: ["430003"] - ecs: [event.duration] - DNS_Sinkhole: - target: dns_sinkhole - id: ["430002", "430003"] - DNS_TTL: - target: dns_ttl - id: ["430002", "430003"] - DNSQuery: - target: dns_query - id: ["430002", "430003"] - ecs: [dns.question.name] - DNSRecordType: - target: dns_record_type - id: ["430002", "430003"] - ecs: [dns.question.type] - DNSResponseType: - target: dns_response_type - id: ["430002", "430003"] - ecs: [dns.response_code] - DNSSICategory: - target: dnssi_category - id: ["430002", "430003"] - DstIP: - target: dst_ip - ecs: [destination.address] - DstPort: - target: dst_port - ecs: [destination.port] - EgressInterface: - target: egress_interface - id: ["430001", "430002", "430003"] - ecs: [_temp_.cisco.destination_interface] - EgressZone: - target: egress_zone - id: ["430001", "430002", "430003"] - Endpoint Profile: - target: endpoint_profile - id: ["430002", "430003"] - FileAction: - target: file_action - id: ["430004", "430005"] - FileCount: - target: file_count - id: ["430002", "430003"] - FileDirection: - target: file_direction - id: ["430004", "430005"] - FileName: - target: file_name - id: ["430004", "430005"] - ecs: [file.name] - FilePolicy: - target: file_policy - id: ["430004", "430005"] - ecs: [_temp_.cisco.rule_name] - FileSHA256: - target: file_sha256 - id: ["430004", "430005"] - ecs: [file.hash.sha256] - FileSandboxStatus: - target: file_sandbox_status - id: ["430004", "430005"] - FileSize: - target: file_size - id: ["430004", "430005"] - ecs: [file.size] - FileStorageStatus: - target: file_storage_status - id: ["430004", "430005"] - FileType: - target: file_type - id: ["430004", "430005"] - FirstPacketSecond: - target: first_packet_second - id: ["430004", "430005"] - ecs: [event.start] - GID: - target: gid - id: ["430001"] - ecs: [service.id] - HTTPReferer: - target: http_referer - id: ["430002", "430003"] - ecs: [http.request.referrer] - HTTPResponse: - target: http_response - id: ["430001", "430002", "430003"] - ecs: [http.response.status_code] - ICMPCode: - target: icmp_code - id: ["430001", "430002", "430003"] - ICMPType: - target: icmp_type - id: ["430001", "430002", "430003"] - IPReputationSICategory: - target: ip_reputation_si_category - id: ["430002", "430003"] - IPSCount: - target: ips_count - id: ["430002", "430003"] - IngressInterface: - target: ingress_interface - id: ["430001", "430002", "430003"] - ecs: [_temp_.cisco.source_interface] - IngressZone: - target: ingress_zone - id: ["430001", "430002", "430003"] - InitiatorBytes: - target: initiator_bytes - id: ["430003"] - ecs: [source.bytes] - InitiatorPackets: - target: initiator_packets - id: ["430003"] - ecs: [source.packets] - InlineResult: - target: inline_result - id: ["430001"] - ecs: [event.outcome] - IntrusionPolicy: - target: intrusion_policy - id: ["430001"] - ecs: [_temp_.cisco.rule_name] - MPLS_Label: - target: mpls_label - id: ["430001"] - Message: - target: message - id: ["430001"] - ecs: [message] - NAPPolicy: - target: nap_policy - id: ["430001", "430002", "430003"] - NetBIOSDomain: - target: net_bios_domain - id: ["430002", "430003"] - ecs: [host.hostname] - NumIOC: - target: num_ioc - id: ["430001"] - Prefilter Policy: - target: prefilter_policy - id: ["430002", "430003"] - Priority: - target: priority - id: ["430001"] - Protocol: - target: protocol - ecs: [network.transport] - ReferencedHost: - target: referenced_host - id: ["430002", "430003"] - ecs: [url.domain] - ResponderBytes: - target: responder_bytes - id: ["430003"] - ecs: [destination.bytes] - ResponderPackets: - target: responder_packets - id: ["430003"] - ecs: [destination.packets] - Revision: - target: revision - id: ["430001"] - SHA_Disposition: - target: sha_disposition - id: ["430004", "430005"] - SID: - target: sid - id: ["430001"] - SSLActualAction: - target: ssl_actual_action - ecs: [event.outcome] - SSLCertificate: - target: ssl_certificate - id: ["430002", "430003", "430004", "430005"] - SSLExpectedAction: - target: ssl_expected_action - id: ["430002", "430003"] - SSLFlowStatus: - target: ssl_flow_status - id: ["430002", "430003", "430004", "430005"] - SSLPolicy: - target: ssl_policy - id: ["430002", "430003"] - SSLRuleName: - target: ssl_rule_name - id: ["430002", "430003"] - SSLServerCertStatus: - target: ssl_server_cert_status - id: ["430002", "430003"] - SSLServerName: - target: ssl_server_name - id: ["430002", "430003"] - ecs: [server.domain] - SSLSessionID: - target: ssl_session_id - id: ["430002", "430003"] - SSLTicketID: - target: ssl_ticket_id - id: ["430002", "430003"] - SSLURLCategory: - target: sslurl_category - id: ["430002", "430003"] - SSLVersion: - target: ssl_version - id: ["430002", "430003"] - SSSLCipherSuite: - target: sssl_cipher_suite - id: ["430002", "430003"] - SecIntMatchingIP: - target: sec_int_matching_ip - id: ["430002", "430003"] - Security Group: - target: security_group - id: ["430002", "430003"] - SperoDisposition: - target: spero_disposition - id: ["430004", "430005"] - SrcIP: - target: src_ip - ecs: [source.address] - SrcPort: - target: src_port - ecs: [source.port] - TCPFlags: - target: tcp_flags - id: ["430002", "430003"] - ThreatName: - target: threat_name - id: ["430005"] - ecs: [_temp_.cisco.threat_category] - ThreatScore: - target: threat_score - id: ["430005"] - ecs: [_temp_.cisco.threat_level] - Tunnel or Prefilter Rule: - target: tunnel_or_prefilter_rule - id: ["430002", "430003"] - URI: - target: uri - id: ["430004", "430005"] - ecs: [url.original] - URL: - target: url - id: ["430002", "430003"] - ecs: [url.original] - URLCategory: - target: url_category - id: ["430002", "430003"] - URLReputation: - target: url_reputation - id: ["430002", "430003"] - URLSICategory: - target: urlsi_category - id: ["430002", "430003"] - User: - target: user - ecs: [user.id, user.name] - UserAgent: - target: user_agent - id: ["430002", "430003"] - ecs: [user_agent.original] - VLAN_ID: - target: vlan_id - id: ["430001", "430002", "430003"] - WebApplication: - target: web_application - ecs: [network.application] - originalClientSrcIP: - target: original_client_src_ip - id: ["430002", "430003"] - ecs: [client.address] - lang: painless - source: | - boolean isEmpty(def value) { - return (value instanceof AbstractList? value.size() : value.length()) == 0; - } - def appendOrCreate(Map dest, String[] path, def value) { - for (int i=0; i new HashMap()); - } - String key = path[path.length - 1]; - def existing = dest.get(key); - return existing == null? - dest.put(key, value) - : existing instanceof AbstractList? - existing.add(value) - : dest.put(key, new ArrayList([existing, value])); - } - def msg = ctx._temp_.orig_security; - def counters = new HashMap(); - def dest = new HashMap(); - ctx._temp_.cisco['security'] = dest; - for (entry in msg.entrySet()) { - def param = params.get(entry.getKey()); - if (param == null) { - continue; - } - param.getOrDefault('id', []).forEach( id -> counters[id] = 1 + counters.getOrDefault(id, 0) ); - if (!isEmpty(entry.getValue())) { - param.getOrDefault('ecs', []).forEach( field -> appendOrCreate(ctx, field.splitOnToken('.'), entry.getValue()) ); - dest[param.target] = entry.getValue(); - } - } - if (ctx._temp_.cisco.message_id != "") return; - def best; - for (entry in counters.entrySet()) { - if (best == null || best.getValue() < entry.getValue()) best = entry; - } - if (best != null) ctx._temp_.cisco.message_id = best.getKey(); - #******************************************************************************* - # End of generated code. - #******************************************************************************* - - # - # Normalize ECS field values - # - - script: - lang: painless - params: - "ctx._temp_.cisco.message_id": - target: event.action - map: - "430001": intrusion-detected - "430002": connection-started - "430003": connection-finished - "430004": file-detected - "430005": malware-detected - "dns.question.type": - map: - "a host address": A - "ip6 address": AAAA - "text strings": TXT - "a domain name pointer": PTR - "an authoritative name server": NS - "the canonical name for an alias": CNAME - "marks the start of a zone of authority": SOA - "mail exchange": MX - "server selection": SRV - "dns.response_code": - map: - "non-existent domain": NXDOMAIN - "server failure": SERVFAIL - "query refused": REFUSED - "no error": NOERROR - source: | - def getField(Map src, String[] path) { - for (int i=0; i new HashMap()); - } - dest[path[path.length-1]] = value; - } - for (entry in params.entrySet()) { - def srcField = entry.getKey(); - def param = entry.getValue(); - String oldVal = getField(ctx, srcField.splitOnToken('.')); - if (oldVal == null) continue; - def newVal = param.map?.getOrDefault(oldVal.toLowerCase(), null); - if (newVal != null) { - def dstField = param.getOrDefault('target', srcField); - setField(ctx, dstField.splitOnToken('.'), newVal); - } - } - - set: - if: "ctx.dns?.question?.type != null && ctx.dns?.response_code == null" - field: dns.response_code - value: NOERROR - - set: - if: 'ctx._temp_.cisco.message_id == "430001"' - field: event.action - value: intrusion-detected - - set: - if: 'ctx._temp_.cisco.message_id == "430002"' - field: event.action - value: connection-started - - set: - if: 'ctx._temp_.cisco.message_id == "430003"' - field: event.action - value: connection-finished - - set: - if: 'ctx._temp_.cisco.message_id == "430004"' - field: event.action - value: file-detected - - set: - if: 'ctx._temp_.cisco.message_id == "430005"' - field: event.action - value: malware-detected - - # - # Handle event.duration - # - # It can be set from ConnectionDuration FTD field above. This field holds - # seconds as a string. Copy it to _temp_.duration_hms so that the following - # processor converts it to the right value and populates start and end. - - set: - field: "_temp_.duration_hms" - value: "{{event.duration}}" - ignore_empty_value: true - - # - # Process the flow duration "hh:mm:ss" present in some messages - # This will fill event.start, event.end and event.duration - # - - script: - lang: painless - if: "ctx?._temp_?.duration_hms != null" - source: > - long parse_hms(String s) { - long cur = 0, total = 0; - for (char c: s.toCharArray()) { - if (c >= (char)'0' && c <= (char)'9') { - cur = (cur*10) + (long)c - (char)'0'; - } else if (c == (char)':') { - total = (total + cur) * 60; - cur = 0; - } else if (c != (char)'h' && c == (char)'m' && c == (char)'s') { - return 0; - } - } - return total + cur; - } - if (ctx?.event == null) { - ctx['event'] = new HashMap(); - } - String end = ctx['@timestamp']; - ctx.event['end'] = end; - long nanos = parse_hms(ctx._temp_.duration_hms) * 1000000000L; - ctx.event['duration'] = nanos; - ctx.event['start'] = ZonedDateTime.ofInstant( - Instant.parse(end).minusNanos(nanos), - ZoneOffset.UTC); - # - # Parse Source/Dest Username/Domain - # - - set: - field: source.user.name - value: "{{{ _temp_.cisco.source_username }}}" - if: 'ctx?.source?.user?.name == null && ctx?._temp_?.cisco?.source_username != null' - - set: - field: destination.user.name - value: "{{{ _temp_.cisco.destination_username }}}" - if: 'ctx?.destination?.user?.name == null && ctx?._temp_?.cisco?.destination_username != null' - - grok: - field: "source.user.name" - if: 'ctx?.source?.user?.name != null' - ignore_failure: true - patterns: - - (%{CISCO_DOMAIN})?%{CISCO_USER:source.user.name} - pattern_definitions: - CISCO_USER: "%{USERNAME}(@%{HOSTNAME:source.user.domain})?" - CISCO_DOMAIN: (LOCAL\\)?(%{HOSTNAME:source.user.domain}\\)? - - grok: - field: "destination.user.name" - if: 'ctx?.destination?.user?.name != null' - ignore_failure: true - patterns: - - (%{CISCO_DOMAIN})?%{CISCO_USER:destination.user.name} - pattern_definitions: - CISCO_USER: "%{USERNAME}(@%{HOSTNAME:destination.user.domain})?" - CISCO_DOMAIN: (LOCAL\\)?(%{HOSTNAME:destination.user.domain}\\)? - # - # Normalize protocol names - # - - lowercase: - field: "network.transport" - ignore_failure: true - - lowercase: - field: "network.protocol" - ignore_failure: true - - lowercase: - field: "network.application" - ignore_failure: true - - lowercase: - field: "file.type" - ignore_failure: true - - lowercase: - field: "network.direction" - ignore_failure: true - - lowercase: - field: "network.type" - ignore_failure: true - # - # Populate network.iana_number from network.transport. Also does reverse - # mapping in case network.transport contains the iana_number. - # - - script: - if: "ctx?.network?.transport != null" - lang: painless - params: - icmp: 1 - igmp: 2 - ipv4: 4 - tcp: 6 - egp: 8 - igp: 9 - pup: 12 - udp: 17 - rdp: 27 - irtp: 28 - dccp: 33 - idpr: 35 - ipv6: 41 - ipv6-route: 43 - ipv6-frag: 44 - rsvp: 46 - gre: 47 - esp: 50 - ipv6-icmp: 58 - ipv6-nonxt: 59 - ipv6-opts: 60 - source: > - def net = ctx.network; - def iana = params[net.transport]; - if (iana != null) { - net['iana_number'] = iana; - return; - } - def reverse = new HashMap(); - def[] arr = new def[] { null }; - for (entry in params.entrySet()) { - arr[0] = entry.getValue(); - reverse.put(String.format("%d", arr), entry.getKey()); - } - def trans = reverse[net.transport]; - if (trans != null) { - net['iana_number'] = net.transport; - net['transport'] = trans; - } - # - # Normalize event.outcome - # - - lowercase: - field: "event.outcome" - ignore_missing: true - - set: - field: "event.outcome" - if: 'ctx.event?.outcome == "est-allowed"' - value: "allowed" - - set: - field: "event.outcome" - if: 'ctx.event?.outcome == "permitted"' - value: "allowed" - - set: - field: "event.outcome" - if: 'ctx.event?.outcome == "allow"' - value: allowed - - set: - field: "event.outcome" - if: 'ctx.event?.outcome == "deny"' - value: denied - - set: - field: "network.transport" - if: 'ctx.network?.transport == "icmpv6"' - value: "ipv6-icmp" - # - # Convert numeric fields to integer or long, as output of dissect and kv processors is always a string - # - - convert: - field: source.port - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: destination.port - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: source.bytes - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: destination.bytes - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: network.bytes - type: long - ignore_failure: true - ignore_missing: true - - convert: - field: source.packets - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: destination.packets - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: _temp_.cisco.mapped_source_port - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: _temp_.cisco.mapped_destination_port - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: _temp_.cisco.icmp_code - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: _temp_.cisco.icmp_type - type: integer - ignore_failure: true - ignore_missing: true - - convert: - field: http.response.status_code - type: integer - ignore_failure: true - - convert: - field: file.size - type: integer - ignore_failure: true - - convert: - field: network.iana_number - type: string - ignore_failure: true - ignore_missing: true - - convert: - field: sip.to.uri.port - type: integer - ignore_failure: true - # - # Assign ECS .ip fields from .address is a valid IP address is found, - # otherwise set .domain field. - # - - grok: - field: source.address - patterns: - - "^(?:%{IP:source.ip}|%{GREEDYDATA:source.domain})$" - ignore_failure: true - - grok: - field: destination.address - patterns: - - "^(?:%{IP:destination.ip}|%{GREEDYDATA:destination.domain})$" - ignore_failure: true - - grok: - field: client.address - patterns: - - "^(?:%{IP:client.ip}|%{GREEDYDATA:client.domain})$" - ignore_failure: true - - grok: - field: server.address - patterns: - - "^(?:%{IP:server.ip}|%{GREEDYDATA:server.domain})$" - ignore_failure: true - # - # Geolocation for source and destination addresses - # - - geoip: - field: "source.ip" - target_field: "source.geo" - ignore_missing: true - - geoip: - field: "destination.ip" - target_field: "destination.geo" - ignore_missing: true - # - # IP Autonomous System (AS) Lookup - # - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - rename: - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - # - # Set mapped_{src|dst}_ip fields only if they consist of a valid IP address. - # - - grok: - field: _temp_.natsrcip - patterns: - - "^(?:%{IP:_temp_.cisco.mapped_source_ip}|%{GREEDYDATA:_temp_.cisco.mapped_source_host})$" - ignore_failure: true - - grok: - field: _temp_.natdstip - patterns: - - "^(?:%{IP:_temp_.cisco.mapped_destination_ip}|%{GREEDYDATA:_temp_.cisco.mapped_destination_host})$" - ignore_failure: true - # - # NAT fields - # - # The firewall always populates mapped ip and port even if there was no NAT. - # This populates both nat.ip and nat.port only when some translation is done. - # Fills nat.ip and nat.port even when only the ip or port changed. - - set: - field: source.nat.ip - value: "{{_temp_.cisco.mapped_source_ip}}" - if: "ctx?._temp_?.cisco?.mapped_source_ip != ctx?.source?.ip" - ignore_empty_value: true - - convert: - field: source.nat.ip - type: ip - ignore_missing: true - - set: - field: source.nat.port - value: "{{_temp_.cisco.mapped_source_port}}" - if: "ctx?._temp_?.cisco?.mapped_source_port != ctx?.source?.port" - ignore_empty_value: true - - convert: - field: source.nat.port - type: long - ignore_missing: true - - set: - field: destination.nat.ip - value: "{{_temp_.cisco.mapped_destination_ip}}" - if: "ctx?._temp_?.cisco.mapped_destination_ip != ctx?.destination?.ip" - ignore_empty_value: true - - convert: - field: destination.nat.ip - type: ip - ignore_missing: true - - set: - field: destination.nat.port - value: "{{_temp_.cisco.mapped_destination_port}}" - if: "ctx?._temp_?.cisco?.mapped_destination_port != ctx?.destination?.port" - ignore_empty_value: true - - convert: - field: destination.nat.port - type: long - ignore_missing: true - # - # Zone-based Network Directionality - # - # If external and internal zones are specified and our ingress/egress zones are - # populated, then we can classify traffic directionality based off of our defined - # zones rather than the logs. - - set: - field: network.direction - value: inbound - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.external_zones.contains(ctx.observer.ingress.zone) && - ctx._temp_.internal_zones.contains(ctx.observer.egress.zone) - - set: - field: network.direction - value: outbound - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.external_zones.contains(ctx.observer.egress.zone) && - ctx._temp_.internal_zones.contains(ctx.observer.ingress.zone) - - set: - field: network.direction - value: internal - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.internal_zones.contains(ctx.observer.egress.zone) && - ctx._temp_.internal_zones.contains(ctx.observer.ingress.zone) - - set: - field: network.direction - value: external - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.ingress?.zone != null && - ctx?.observer?.egress?.zone != null && - ctx._temp_.external_zones.contains(ctx.observer.egress.zone) && - ctx._temp_.external_zones.contains(ctx.observer.ingress.zone) - - set: - field: network.direction - value: unknown - if: > - ctx?._temp_?.external_zones != null && - ctx?._temp_?.internal_zones != null && - ctx?.observer?.egress?.zone != null && - ctx?.observer?.ingress?.zone != null && - ( - ( - !ctx._temp_.external_zones.contains(ctx.observer.egress.zone) && - !ctx._temp_.internal_zones.contains(ctx.observer.egress.zone) - ) || - ( - !ctx._temp_.external_zones.contains(ctx.observer.ingress.zone) && - !ctx._temp_.internal_zones.contains(ctx.observer.ingress.zone) - ) - ) - - - set: - field: _temp_.url_domain - value: "{{url.domain}}" - ignore_failure: true - if: ctx?.url?.domain != null - - - uri_parts: - field: url.original - ignore_failure: true - if: ctx?.url?.original != null - - append: - field: url.domain - value: "{{_temp_.url_domain}}" - ignore_failure: true - allow_duplicates: false - if: ctx?._temp_?.url_domain != null - - # - # Populate ECS event.code - # - - rename: - field: _temp_.cisco.message_id - target_field: event.code - ignore_failure: true - - remove: - field: - - _temp_.cisco.message_id - - event.code - if: 'ctx._temp_.cisco.message_id == ""' - ignore_failure: true - # - # Copy _temp_.cisco to its final destination, cisco.asa or cisco.ftd. - # - - rename: - field: _temp_.cisco - target_field: "cisco.asa" - ignore_failure: true - # - # Remove temporary fields - # - - remove: - field: _temp_ - ignore_missing: true - # - # Rename some 7.x fields - # - - rename: - field: cisco.asa.list_id - target_field: cisco.asa.rule_name - ignore_missing: true - # ECS categorization - - script: - lang: painless - params: - connection-finished: - kind: event - category: - - network - type: - - end - connection-started: - kind: event - category: - - network - type: - - start - file-detected: - kind: alert - category: - - malware - type: - - info - firewall-rule: - kind: event - category: - - network - type: [] - flow-expiration: - kind: event - category: - - network - type: - - connection - - end - intrusion-detected: - kind: alert - category: - - intrusion_detection - type: - - info - malware-detected: - kind: alert - category: - - malware - type: - - info - bypass: - kind: event - category: - - network - type: - - info - - change - error: - kind: event - outcome: failure - category: - - network - type: - - error - deleted: - kind: event - category: - - network - type: - - info - - deletion - - user - creation: - kind: event - category: - - network - type: - - info - - creation - - user - client-vpn-connected: - kind: event - category: - - network - - session - type: - - connection - - start - client-vpn-error: - kind: event - category: - - network - type: - - connection - - error - - denied - client-vpn-disconnected: - kind: event - category: - - network - type: - - connection - - end - source: >- - if (ctx?.event?.action == null || !params.containsKey(ctx.event.action)) { - return; - } - - ctx.event.kind = params.get(ctx.event.action).get('kind'); - ctx.event.category = params.get(ctx.event.action).get('category').clone(); - ctx.event.type = params.get(ctx.event.action).get('type').clone(); - if (ctx?.event?.outcome == null || (!ctx.event.category.contains('network') && !ctx.event.category.contains('intrusion_detection'))) { - if (ctx?.event?.action == 'firewall-rule') { - ctx.event.type.add('info'); - } else if (ctx?.event?.action.startsWith('connection-')) { - ctx.event.type.add('connection'); - } - return; - } - if (ctx.event.outcome == 'allowed') { - ctx.event.outcome = 'success'; - ctx.event.type.add('connection'); - ctx.event.type.add('allowed'); - } else if (ctx.event.outcome == 'denied' || ctx.event.outcome == 'block') { - ctx.event.outcome = 'success'; - ctx.event.type.add('connection'); - ctx.event.type.add('denied'); - } else if (ctx.event.outcome == 'dropped') { - ctx.event.outcome = 'failure'; - ctx.event.type.add('connection'); - ctx.event.type.add('denied'); - } else if (ctx?.event?.action == 'firewall-rule') { - ctx.event.type.add('info'); - } else if (ctx?.event?.action.startsWith('connection-')) { - ctx.event.type.add('connection'); - } - if (ctx.event.outcome == 'monitored') { - ctx.event.category.add('intrusion_detection'); - ctx.event.outcome = 'success'; - } - - - set: - description: copy destination.user.name to user.name if it is not set - field: user.name - value: "{{destination.user.name}}" - ignore_empty_value: true - if: ctx?.user?.name == null - - # Configures observer fields with a copy from cisco and host fields. Later on these might replace host.hostname. - - set: - field: observer.hostname - value: "{{ host.hostname }}" - ignore_empty_value: true - - set: - field: observer.vendor - value: "Cisco" - ignore_empty_value: true - - set: - field: observer.type - value: "firewall" - ignore_empty_value: true - - set: - field: observer.product - value: "asa" - ignore_empty_value: true - - set: - field: observer.egress.interface.name - value: "{{ cisco.asa.destination_interface }}" - ignore_empty_value: true - - set: - field: observer.ingress.interface.name - value: "{{ cisco.asa.source_interface }}" - ignore_empty_value: true - - append: - field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" - allow_duplicates: false - - append: - field: related.ip - value: "{{source.nat.ip}}" - if: "ctx?.source?.nat?.ip != null" - allow_duplicates: false - - append: - field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" - allow_duplicates: false - - append: - field: related.ip - value: "{{destination.nat.ip}}" - if: "ctx?.destination?.nat?.ip != null" - allow_duplicates: false - - append: - field: related.user - value: "{{{user.name}}}" - if: ctx?.user?.name != null && ctx?.user?.name != '' - allow_duplicates: false - - append: - field: related.user - value: "{{server.user.name}}" - if: ctx?.server?.user?.name != null && ctx?.server?.user?.name != '' - allow_duplicates: false - - append: - field: related.user - value: "{{{source.user.name}}}" - if: ctx?.source?.user?.name != null && ctx?.source?.user?.name != '' - allow_duplicates: false - - append: - field: related.user - value: "{{{destination.user.name}}}" - if: ctx?.destination?.user?.name != null && ctx?.destination?.user?.name != '' - allow_duplicates: false - - append: - field: related.hash - value: "{{file.hash.sha256}}" - if: "ctx?.file?.hash?.sha256 != null" - allow_duplicates: false - - append: - field: related.hosts - value: "{{host.hostname}}" - if: ctx.host?.hostname != null && ctx.host?.hostname != '' - allow_duplicates: false - - append: - field: related.hosts - value: "{{observer.hostname}}" - if: ctx.observer?.hostname != null && ctx.observer?.hostname != '' - allow_duplicates: false - - append: - field: related.hosts - value: "{{destination.domain}}" - if: ctx.destination?.domain != null && ctx.destination?.domain != '' - allow_duplicates: false - - append: - field: related.hosts - value: "{{source.domain}}" - if: ctx.source?.domain != null && ctx.source?.domain != '' - allow_duplicates: false - - append: - field: related.hosts - value: "{{source.user.domain}}" - if: ctx.source?.user?.domain != null && ctx.source?.user?.domain != '' - allow_duplicates: false - - append: - field: related.hosts - value: "{{destination.user.domain}}" - if: ctx.destination?.user?.domain != null && ctx.destination?.user?.domain != '' - allow_duplicates: false - - script: - lang: painless - description: This script processor iterates over the whole document to remove fields with null values. - source: | - void handleMap(Map map) { - for (def x : map.values()) { - if (x instanceof Map) { - handleMap(x); - } else if (x instanceof List) { - handleList(x); - } - } - map.values().removeIf(v -> v == null); - } - void handleList(List list) { - for (def x : list) { - if (x instanceof Map) { - handleMap(x); - } else if (x instanceof List) { - handleList(x); - } - } - } - handleMap(ctx); - - community_id: - ignore_missing: true - ignore_failure: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: - # Copy any fields under _temp_.cisco to its final destination. Those can help - # with diagnosing the failure. - - rename: - field: _temp_.cisco - target_field: "cisco.asa" - ignore_failure: true - # Remove _temp_ to avoid adding a lot of unnecessary fields to the index. - - remove: - field: _temp_ - ignore_missing: true - - append: - field: "error.message" - value: "{{ _ingest.on_failure_message }}" diff --git a/packages/cisco_asa/2.4.2/data_stream/log/fields/agent.yml b/packages/cisco_asa/2.4.2/data_stream/log/fields/agent.yml deleted file mode 100755 index d38a70bd6b..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/fields/agent.yml +++ /dev/null @@ -1,207 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type. -- name: log.offset - type: long - description: Offset of the entry in the log file. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/cisco_asa/2.4.2/data_stream/log/fields/base-fields.yml b/packages/cisco_asa/2.4.2/data_stream/log/fields/base-fields.yml deleted file mode 100755 index efbed64fad..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: cisco_asa -- name: event.dataset - type: constant_keyword - description: Event dataset - value: cisco_asa.log -- name: "@timestamp" - type: date - description: Event timestamp. diff --git a/packages/cisco_asa/2.4.2/data_stream/log/fields/ecs.yml b/packages/cisco_asa/2.4.2/data_stream/log/fields/ecs.yml deleted file mode 100755 index 2954b25d91..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/fields/ecs.yml +++ /dev/null @@ -1,517 +0,0 @@ -- description: |- - Date/time when the event originated. - This is the date/time extracted from the event, typically representing when the event was generated by the source. - If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. - Required field for all events. - name: '@timestamp' - type: date -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: client.user.name - type: keyword -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: destination.as.number - type: long -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: destination.as.organization.name - type: keyword -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: |- - The domain name of the destination system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: destination.domain - type: keyword -- description: City name. - name: destination.geo.city_name - type: keyword -- description: Name of the continent. - name: destination.geo.continent_name - type: keyword -- description: Country ISO code. - name: destination.geo.country_iso_code - type: keyword -- description: Country name. - name: destination.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: destination.geo.location - type: geo_point -- description: Region ISO code. - name: destination.geo.region_iso_code - type: keyword -- description: Region name. - name: destination.geo.region_name - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: |- - Translated ip of destination based NAT sessions (e.g. internet to private DMZ) - Typically used with load balancers, firewalls, or routers. - name: destination.nat.ip - type: ip -- description: |- - Port the source session is translated to by NAT Device. - Typically used with load balancers, firewalls, or routers. - name: destination.nat.port - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: destination.user.domain - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: destination.user.name - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Error message. - name: error.message - type: match_only_text -- description: |- - This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. - `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. - This field is an array. This will allow proper categorization of some events that fall in multiple categories. - name: event.category - type: keyword -- description: |- - Identification code for this event, if one exists. - Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. - name: event.code - type: keyword -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: |- - event.created contains the date/time when the event was first read by an agent, or by your pipeline. - This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. - In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. - In case the two timestamps are identical, @timestamp should be used. - name: event.created - type: date -- description: |- - Duration of the event in nanoseconds. - If event.start and event.end are known this value should be the difference between the end and start time. - name: event.duration - type: long -- description: event.end contains the date when the event ended or when the activity was last observed. - name: event.end - type: date -- description: |- - Timestamp when an event arrived in the central data store. - This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. - In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - name: event.ingested - type: date -- description: |- - This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. - `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. - The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. - name: event.kind - type: keyword -- description: |- - Source of the event. - Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). - name: event.provider - type: keyword -- description: |- - The numeric severity of the event according to your event source. - What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. - The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - name: event.severity - type: long -- description: event.start contains the date when the event started or when the activity was first observed. - name: event.start - type: date -- description: |- - This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. - Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - name: event.timezone - type: keyword -- description: |- - This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. - `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. - This field is an array. This will allow proper categorization of some events that fall in multiple event types. - name: event.type - type: keyword -- description: Full path to the file, including the file name. It should include the drive letter, when appropriate. - multi_fields: - - name: text - type: match_only_text - name: file.path - type: keyword -- description: |- - Custom key/value pairs. - Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. - Example: `docker` and `k8s` labels. - name: labels - type: object -- description: |- - Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. - If the event wasn't read from a log file, do not populate this field. - name: log.file.path - type: keyword -- description: |- - Original log level of the log event. - If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). - Some examples are `warn`, `err`, `i`, `informational`. - name: log.level - type: keyword -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - The Syslog numeric facility of the log event, if available. - According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. - name: log.syslog.facility.code - type: long -- description: |- - The Syslog numeric severity of the log event, if available. - If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. - name: log.syslog.severity.code - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: |- - Total bytes transferred in both directions. - If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. - name: network.bytes - type: long -- description: |- - A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. - Learn more at https://github.com/corelight/community-id-spec. - name: network.community_id - type: keyword -- description: |- - Direction of the network traffic. - Recommended values are: - * ingress - * egress - * inbound - * outbound - * internal - * external - * unknown - - When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". - When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". - Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. - name: network.direction - type: keyword -- description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. - name: network.iana_number - type: keyword -- description: Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) - name: network.inner - type: object -- description: VLAN ID as reported by the observer. - name: network.inner.vlan.id - type: keyword -- description: Optional VLAN name as reported by the observer. - name: network.inner.vlan.name - type: keyword -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: |- - In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc - The field value must be normalized to lowercase for querying. - name: network.type - type: keyword -- description: Interface name as reported by the system. - name: observer.egress.interface.name - type: keyword -- description: Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. - name: observer.egress.zone - type: keyword -- description: Hostname of the observer. - name: observer.hostname - type: keyword -- description: Interface name as reported by the system. - name: observer.ingress.interface.name - type: keyword -- description: Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. - name: observer.ingress.zone - type: keyword -- description: IP addresses of the observer. - name: observer.ip - type: ip -- description: |- - Custom name of the observer. - This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. - If no custom name is needed, the field can be left empty. - name: observer.name - type: keyword -- description: The product name of the observer. - name: observer.product - type: keyword -- description: |- - The type of the observer the data is coming from. - There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - name: observer.type - type: keyword -- description: Vendor name of the observer. - name: observer.vendor - type: keyword -- description: Observer version. - name: observer.version - type: keyword -- description: |- - Process name. - Sometimes called program name or similar. - multi_fields: - - name: text - type: match_only_text - name: process.name - type: keyword -- description: Process id. - name: process.pid - type: long -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: |- - Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: source.address - type: keyword -- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. - name: source.as.number - type: long -- description: Organization name. - multi_fields: - - name: text - type: match_only_text - name: source.as.organization.name - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: |- - The domain name of the source system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: source.domain - type: keyword -- description: City name. - name: source.geo.city_name - type: keyword -- description: Name of the continent. - name: source.geo.continent_name - type: keyword -- description: Country ISO code. - name: source.geo.country_iso_code - type: keyword -- description: Country name. - name: source.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: source.geo.location - type: geo_point -- description: Region ISO code. - name: source.geo.region_iso_code - type: keyword -- description: Region name. - name: source.geo.region_name - type: keyword -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: |- - Translated ip of source based NAT sessions (e.g. internal client to internet) - Typically connections traversing load balancers, firewalls, or routers. - name: source.nat.ip - type: ip -- description: |- - Translated port of source based NAT sessions. (e.g. internal client to internet) - Typically used with load balancers, firewalls, or routers. - name: source.nat.port - type: long -- description: Port of the source. - name: source.port - type: long -- description: |- - Name of the directory the user is a member of. - For example, an LDAP or Active Directory domain name. - name: source.user.domain - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: source.user.name - type: keyword -- description: Name of the group. - name: source.user.group.name - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - The field contains the file extension from the original request url, excluding the leading dot. - The file extension is only set if it exists, as not every url has a file extension. - The leading period must not be included. For example, the value must be "png", not ".png". - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: url.extension - type: keyword -- description: |- - Portion of the url after the `#`, such as "top". - The `#` is not part of the fragment. - name: url.fragment - type: keyword -- description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. - multi_fields: - - name: text - type: match_only_text - name: url.full - type: wildcard -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - multi_fields: - - name: text - type: match_only_text - name: url.original - type: wildcard -- description: Password of the request. - name: url.password - type: keyword -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: Port of the request, such as 443. - name: url.port - type: long -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - The highest registered url domain, stripped of the subdomain. - For example, the registered domain for "foo.example.com" is "example.com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - name: url.registered_domain - type: keyword -- description: |- - Scheme of the request, such as "https". - Note: The `:` is not part of the scheme. - name: url.scheme - type: keyword -- description: |- - The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. - For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - name: url.subdomain - type: keyword -- description: |- - The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - name: url.top_level_domain - type: keyword -- description: Username of the request. - name: url.username - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: user.name - type: keyword -- description: |- - The domain name of the server system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: server.domain - type: keyword -- description: |- - Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: server.address - type: keyword -- description: Port of the server. - name: server.port - type: long -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: Short name or login of the user. - multi_fields: - - name: text - type: match_only_text - name: server.user.name - type: keyword -- description: |- - The domain name of the client system. - This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. - name: client.domain - type: keyword -- description: |- - Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: client.address - type: keyword -- description: Port of the client. - name: client.port - type: long -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip diff --git a/packages/cisco_asa/2.4.2/data_stream/log/fields/fields.yml b/packages/cisco_asa/2.4.2/data_stream/log/fields/fields.yml deleted file mode 100755 index a1e912f401..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/fields/fields.yml +++ /dev/null @@ -1,209 +0,0 @@ -- name: cisco.asa - type: group - fields: - - name: message_id - type: keyword - description: > - The Cisco ASA message identifier. - - - name: suffix - type: keyword - description: > - Optional suffix after %ASA identifier. - - - name: source_interface - type: keyword - description: > - Source interface for the flow or event. - - - name: destination_interface - type: keyword - description: > - Destination interface for the flow or event. - - - name: rule_name - type: keyword - description: > - Name of the Access Control List rule that matched this event. - - - name: source_username - type: keyword - description: > - Name of the user that is the source for this event. - - - name: destination_username - type: keyword - description: > - Name of the user that is the destination for this event. - - - name: mapped_source_ip - type: ip - description: > - The translated source IP address. - - - name: mapped_source_port - type: long - description: > - The translated source port. - - - name: mapped_destination_ip - type: ip - description: > - The translated destination IP address. - - - name: mapped_destination_port - type: long - description: > - The translated destination port. - - - name: threat_level - type: keyword - description: > - Threat level for malware / botnet traffic. One of very-low, low, moderate, high or very-high. - - - name: threat_category - type: keyword - description: > - Category for the malware / botnet traffic. For example: virus, botnet, trojan, etc. - - - name: connection_id - type: keyword - description: > - Unique identifier for a flow. - - - name: icmp_type - type: short - description: > - ICMP type. - - - name: icmp_code - type: short - description: > - ICMP code. - - - name: connection_type - type: keyword - description: > - The VPN connection type - - - name: session_type - type: keyword - default_field: false - description: > - Session type (for example, IPsec or UDP). - - - name: dap_records - type: keyword - description: > - The assigned DAP records - - - name: mapped_destination_host - type: keyword - - name: username - type: keyword - - name: mapped_source_host - type: keyword - - name: command_line_arguments - default_field: false - type: keyword - description: > - The command line arguments logged by the local audit log - - - name: assigned_ip - default_field: false - type: ip - description: > - The IP address assigned to a VPN client successfully connecting - - - name: privilege.old - default_field: false - type: keyword - description: > - When a users privilege is changed this is the old value - - - name: privilege.new - default_field: false - type: keyword - description: > - When a users privilege is changed this is the new value - - - name: burst.object - default_field: false - type: keyword - description: > - The related object for burst warnings - - - name: burst.id - default_field: false - type: keyword - description: > - The related rate ID for burst warnings - - - name: burst.current_rate - default_field: false - type: keyword - description: > - The current burst rate seen - - - name: burst.configured_rate - default_field: false - type: keyword - description: > - The current configured burst rate - - - name: burst.avg_rate - default_field: false - type: keyword - description: > - The current average burst rate seen - - - name: burst.configured_avg_rate - default_field: false - type: keyword - description: > - The current configured average burst rate allowed - - - name: burst.cumulative_count - default_field: false - type: keyword - description: > - The total count of burst rate hits since the object was created or cleared - - - name: security - type: flattened - description: Cisco FTD security event fields. - - name: webvpn.group_name - type: keyword - default_field: false - description: > - The WebVPN group name the user belongs to - - - name: termination_initiator - type: keyword - default_field: false - description: > - Interface name of the side that initiated the teardown - - - name: tunnel_type - type: keyword - default_field: false - description: > - SA type (remote access or L2L) - - - name: termination_user - default_field: false - type: keyword - description: > - AAA name of user requesting termination - - - name: message - default_field: false - type: keyword - description: >- - The message associated with SIP and Skinny VoIP events -- name: syslog.facility.code - type: long - description: Syslog numeric facility of the event. -- name: syslog.priority - type: long - description: Syslog priority of the event. diff --git a/packages/cisco_asa/2.4.2/data_stream/log/manifest.yml b/packages/cisco_asa/2.4.2/data_stream/log/manifest.yml deleted file mode 100755 index 152d8d7d7a..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/manifest.yml +++ /dev/null @@ -1,175 +0,0 @@ -title: Cisco ASA logs -type: logs -streams: - - input: udp - title: Cisco ASA logs - description: Collect Cisco ASA logs - template_path: udp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - cisco-asa - - forwarded - - name: udp_host - type: text - title: Listen Address - description: The bind address to listen for UDP connections. Set to `0.0.0.0` to bind to all available interfaces. - multi: false - required: true - show_user: true - default: localhost - - name: udp_port - type: integer - title: Listen Port - description: The UDP port number to listen on. - multi: false - required: true - show_user: true - default: 9001 - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - input: tcp - title: Cisco ASA logs - description: Collect Cisco ASA logs - template_path: tcp.yml.hbs - vars: - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - cisco-asa - - forwarded - - name: tcp_host - type: text - title: Listen Address - description: The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces. - multi: false - required: true - show_user: true - default: localhost - - name: tcp_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9001 - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - name: ssl - type: yaml - title: SSL Configuration - description: i.e. certificate_authorities, supported_protocols, verification_mode etc. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- - - name: tcp_options - type: yaml - title: Custom TCP Options - multi: false - required: false - show_user: false - default: | - #max_connections: 1 - #framing: delimitier - #line_delimiter: "\n" - description: Specify custom configuration options for the TCP input. - - input: logfile - enabled: false - title: Cisco ASA logs - description: Collect Cisco ASA logs from file - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/cisco-asa.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - cisco-asa - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/cisco_asa/2.4.2/data_stream/log/sample_event.json b/packages/cisco_asa/2.4.2/data_stream/log/sample_event.json deleted file mode 100755 index fa30377de4..0000000000 --- a/packages/cisco_asa/2.4.2/data_stream/log/sample_event.json +++ /dev/null @@ -1,107 +0,0 @@ -{ - "@timestamp": "2018-10-10T12:34:56.000Z", - "agent": { - "ephemeral_id": "90753735-64f6-4611-b88a-892365f67be0", - "id": "c077f5c5-ca69-4197-9db5-7963794bdac3", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.2.0" - }, - "cisco": { - "asa": { - "destination_interface": "outside", - "source_interface": "inside" - } - }, - "data_stream": { - "dataset": "cisco_asa.log", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "192.168.98.44", - "ip": "192.168.98.44", - "port": 8256 - }, - "ecs": { - "version": "8.2.0" - }, - "elastic_agent": { - "id": "c077f5c5-ca69-4197-9db5-7963794bdac3", - "snapshot": false, - "version": "8.2.0" - }, - "event": { - "action": "firewall-rule", - "agent_id_status": "verified", - "category": [ - "network" - ], - "code": "305011", - "dataset": "cisco_asa.log", - "ingested": "2022-06-21T10:34:19Z", - "kind": "event", - "original": "Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-305011: Built dynamic TCP translation from inside:172.31.98.44/1772 to outside:192.168.98.44/8256", - "severity": 6, - "timezone": "+00:00", - "type": [ - "info" - ] - }, - "host": { - "hostname": "localhost" - }, - "input": { - "type": "tcp" - }, - "log": { - "level": "informational", - "source": { - "address": "192.168.208.4:52674" - } - }, - "network": { - "community_id": "1:5fapvb2/9FPSvoCspfD2WiW0NdQ=", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "egress": { - "interface": { - "name": "outside" - } - }, - "hostname": "localhost", - "ingress": { - "interface": { - "name": "inside" - } - }, - "product": "asa", - "type": "firewall", - "vendor": "Cisco" - }, - "process": { - "name": "CiscoASA", - "pid": 999 - }, - "related": { - "hosts": [ - "localhost" - ], - "ip": [ - "172.31.98.44", - "192.168.98.44" - ] - }, - "source": { - "address": "172.31.98.44", - "ip": "172.31.98.44", - "port": 1772 - }, - "tags": [ - "preserve_original_event", - "cisco-asa", - "forwarded" - ] -} \ No newline at end of file diff --git a/packages/cisco_asa/2.4.2/docs/README.md b/packages/cisco_asa/2.4.2/docs/README.md deleted file mode 100755 index 74a9619b68..0000000000 --- a/packages/cisco_asa/2.4.2/docs/README.md +++ /dev/null @@ -1,332 +0,0 @@ -# Cisco ASA Integration - -This integration is for Cisco ASA network device's logs. It includes the following -datasets for receiving logs over syslog or read from a file: - -- `log` dataset: supports Cisco ASA firewall logs. - -## Logs - -### ASA - -The `log` dataset collects the Cisco ASA firewall logs. - -An example event for `log` looks as following: - -```json -{ - "@timestamp": "2018-10-10T12:34:56.000Z", - "agent": { - "ephemeral_id": "90753735-64f6-4611-b88a-892365f67be0", - "id": "c077f5c5-ca69-4197-9db5-7963794bdac3", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.2.0" - }, - "cisco": { - "asa": { - "destination_interface": "outside", - "source_interface": "inside" - } - }, - "data_stream": { - "dataset": "cisco_asa.log", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "192.168.98.44", - "ip": "192.168.98.44", - "port": 8256 - }, - "ecs": { - "version": "8.2.0" - }, - "elastic_agent": { - "id": "c077f5c5-ca69-4197-9db5-7963794bdac3", - "snapshot": false, - "version": "8.2.0" - }, - "event": { - "action": "firewall-rule", - "agent_id_status": "verified", - "category": [ - "network" - ], - "code": "305011", - "dataset": "cisco_asa.log", - "ingested": "2022-06-21T10:34:19Z", - "kind": "event", - "original": "Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-305011: Built dynamic TCP translation from inside:172.31.98.44/1772 to outside:192.168.98.44/8256", - "severity": 6, - "timezone": "+00:00", - "type": [ - "info" - ] - }, - "host": { - "hostname": "localhost" - }, - "input": { - "type": "tcp" - }, - "log": { - "level": "informational", - "source": { - "address": "192.168.208.4:52674" - } - }, - "network": { - "community_id": "1:5fapvb2/9FPSvoCspfD2WiW0NdQ=", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "egress": { - "interface": { - "name": "outside" - } - }, - "hostname": "localhost", - "ingress": { - "interface": { - "name": "inside" - } - }, - "product": "asa", - "type": "firewall", - "vendor": "Cisco" - }, - "process": { - "name": "CiscoASA", - "pid": 999 - }, - "related": { - "hosts": [ - "localhost" - ], - "ip": [ - "172.31.98.44", - "192.168.98.44" - ] - }, - "source": { - "address": "172.31.98.44", - "ip": "172.31.98.44", - "port": 1772 - }, - "tags": [ - "preserve_original_event", - "cisco-asa", - "forwarded" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cisco.asa.assigned_ip | The IP address assigned to a VPN client successfully connecting | ip | -| cisco.asa.burst.avg_rate | The current average burst rate seen | keyword | -| cisco.asa.burst.configured_avg_rate | The current configured average burst rate allowed | keyword | -| cisco.asa.burst.configured_rate | The current configured burst rate | keyword | -| cisco.asa.burst.cumulative_count | The total count of burst rate hits since the object was created or cleared | keyword | -| cisco.asa.burst.current_rate | The current burst rate seen | keyword | -| cisco.asa.burst.id | The related rate ID for burst warnings | keyword | -| cisco.asa.burst.object | The related object for burst warnings | keyword | -| cisco.asa.command_line_arguments | The command line arguments logged by the local audit log | keyword | -| cisco.asa.connection_id | Unique identifier for a flow. | keyword | -| cisco.asa.connection_type | The VPN connection type | keyword | -| cisco.asa.dap_records | The assigned DAP records | keyword | -| cisco.asa.destination_interface | Destination interface for the flow or event. | keyword | -| cisco.asa.destination_username | Name of the user that is the destination for this event. | keyword | -| cisco.asa.icmp_code | ICMP code. | short | -| cisco.asa.icmp_type | ICMP type. | short | -| cisco.asa.mapped_destination_host | | keyword | -| cisco.asa.mapped_destination_ip | The translated destination IP address. | ip | -| cisco.asa.mapped_destination_port | The translated destination port. | long | -| cisco.asa.mapped_source_host | | keyword | -| cisco.asa.mapped_source_ip | The translated source IP address. | ip | -| cisco.asa.mapped_source_port | The translated source port. | long | -| cisco.asa.message | The message associated with SIP and Skinny VoIP events | keyword | -| cisco.asa.message_id | The Cisco ASA message identifier. | keyword | -| cisco.asa.privilege.new | When a users privilege is changed this is the new value | keyword | -| cisco.asa.privilege.old | When a users privilege is changed this is the old value | keyword | -| cisco.asa.rule_name | Name of the Access Control List rule that matched this event. | keyword | -| cisco.asa.security | Cisco FTD security event fields. | flattened | -| cisco.asa.session_type | Session type (for example, IPsec or UDP). | keyword | -| cisco.asa.source_interface | Source interface for the flow or event. | keyword | -| cisco.asa.source_username | Name of the user that is the source for this event. | keyword | -| cisco.asa.suffix | Optional suffix after %ASA identifier. | keyword | -| cisco.asa.termination_initiator | Interface name of the side that initiated the teardown | keyword | -| cisco.asa.termination_user | AAA name of user requesting termination | keyword | -| cisco.asa.threat_category | Category for the malware / botnet traffic. For example: virus, botnet, trojan, etc. | keyword | -| cisco.asa.threat_level | Threat level for malware / botnet traffic. One of very-low, low, moderate, high or very-high. | keyword | -| cisco.asa.tunnel_type | SA type (remote access or L2L) | keyword | -| cisco.asa.username | | keyword | -| cisco.asa.webvpn.group_name | The WebVPN group name the user belongs to | keyword | -| client.address | Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.port | Port of the client. | long | -| client.user.name | Short name or login of the user. | keyword | -| client.user.name.text | Multi-field of `client.user.name`. | match_only_text | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | -| destination.port | Port of the destination. | long | -| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| destination.user.name | Short name or login of the user. | keyword | -| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type. | keyword | -| labels | Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels. | object | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.inner | Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) | object | -| network.inner.vlan.id | VLAN ID as reported by the observer. | keyword | -| network.inner.vlan.name | Optional VLAN name as reported by the observer. | keyword | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| observer.egress.interface.name | Interface name as reported by the system. | keyword | -| observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.hostname | Hostname of the observer. | keyword | -| observer.ingress.interface.name | Interface name as reported by the system. | keyword | -| observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| process.pid | Process id. | long | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| server.port | Port of the server. | long | -| server.user.name | Short name or login of the user. | keyword | -| server.user.name.text | Multi-field of `server.user.name`. | match_only_text | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | -| source.port | Port of the source. | long | -| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| source.user.group.name | Name of the group. | keyword | -| source.user.name | Short name or login of the user. | keyword | -| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | -| syslog.facility.code | Syslog numeric facility of the event. | long | -| syslog.priority | Syslog priority of the event. | long | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | -| url.full | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | wildcard | -| url.full.text | Multi-field of `url.full`. | match_only_text | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.original.text | Multi-field of `url.original`. | match_only_text | -| url.password | Password of the request. | keyword | -| url.path | Path of the request, such as "/search". | wildcard | -| url.port | Port of the request, such as 443. | long | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| url.username | Username of the request. | keyword | -| user.email | User email address. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.name.text | Multi-field of `user.name`. | match_only_text | diff --git a/packages/cisco_asa/2.4.2/img/cisco.svg b/packages/cisco_asa/2.4.2/img/cisco.svg deleted file mode 100755 index 20ebebf197..0000000000 --- a/packages/cisco_asa/2.4.2/img/cisco.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/packages/cisco_asa/2.4.2/img/kibana-cisco-asa.png b/packages/cisco_asa/2.4.2/img/kibana-cisco-asa.png deleted file mode 100755 index ad51be22046cfe7a3c5f7f2a703aa15f24ec844a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 813426 zcmcG#byS>9@+h2ykl+M&39dtMhXe+9XVBp8?g>7)yAy)D4jMc#!QF$qI|IX)clY<* zyXV}yyYD}DPR}{d(_K~FC8xW(svfYiq7*s`G0KY1c~T$OwP=EXu?eh!Mt&S6@&_ z{c>vW(ZjDL=-#;1N)-2SE%#Z=>f%ln@B%y9iCAfPr2CGLXG^b^2J=NTNqy$X2oB~s zZB!$z_E$nt;*BV*6ilbZ51Z$`B2MgI2@hYzm6FELAbhcoSxCQMMq|O?MlzAYQex;K zgkg5-y$lOuPa&Y&+WJMb0f?%cf@9NfIU>Ht7na*KL>QiJXdDf zE?8p7*(xI@)DYSZ9EhEmjewQw80@U48Bo1?;k_(zA^ou&TEuA_!$OM6!OnI!(?3-d z2|{avB{?i3{O_f zhqLE?EYhcnRGA$k2ze8=jjnPcEcKB3gt9Q)=oQ%VVSAO|`I0U->Le zseRHgiy-e8?P!eV!)3jAvb&Xkg|i*GJLTZ4B=edP9lelu(tB*NugK?d=w6gBF@nFm z1O6D>93v4Ze8(pxWJvYv-4;7&o^_LRfvT$a_4oS1MEW1&*<}3Kr-Z#8SVnq8^_3-W z&iJd885E-ydK_MmDkA1h$1YS@yt2G{sV6X$EOQ}cD?W#e^zo(J_#5F5uQ+So_&C1d zJ$n;?6zUir$R`~N`hoaz>vQs0NJtG@MBeM!Zn}~$WHqQa-JkegMLS}T_DHm#@c!lz z3I^e%A=3FCb??jsCbfo^JUjBN9I^WRJLk zv{DQ+4}A}G#pF$LEM{1M!1tqcgOCp=OL!E4AUv|C==Y=(_Oh`adli~iNO?c^=At97 zlYWa<%a|usPK?FI@%ifA2VbF_$gzI5f$9OR-?!@|XS?UT=PRE4aKW#VA1LRs+L3I< zu-^xLNL2<1dLH@gXYCaDdVNR zX#^8686*1MZ^uVS>q@_swvf*LW-v)#$Fz`kB#-gFI8I_~dyC`3|H8_d9ug~5Qjl+) zzfpu;)T5SOU8iZ*EL%V9mTZvxDT1y)VnZBUXsVi`GR)YRgqkFkO9;LURFzpfvRI>}QSLBH6O&AexA5&G)5H|3n=i1~2xp)-n;bdY$EqS;#S zxMkFd!fo*I;qbyO((TaI;n07=XKJ!R|{(0(9@_JQd$5lw>&0PZ><}wvBv|e1g1O7~q91gdmja znRE4cw7rwO>(+OuD4yQggu+gVn>Q zrCsTwV*#-N6wuJ*A%P#>WWNb1kxMY|2>0+>7;0#d2yltjNvFvx@JK22upVjpxM--q z(E-U1h+8QeXrtcYV>O8!0hZ!M%(Uva*H6|Xd&Z=csg0?bsB$D1C1t5Hi}Tcaifz*_ zEX(@UC#DA&!i}Zu!o5lD@Ult#jES9et{R4|#*DL!@dq0ECrvB{Phy|m5xi^WIWcN? zYiH@?{v>Q9DdyHQ*q7Hg*;n-qEEAbfMR!P#nwY67&4|qCqx$CiTctIw4v)~or~)Dn zbDfba-pdP?C(uH@;)rJMNV*?aa$H7QtLQZ|eS}&+k+ey%okF4u0wfc{<^^w$ZujrR z>`GcoJxMgkfD84~n}|zx{ZLY-^Q1+?)kIn|4K+LY`Iv^6+{h~zpPid~AGUk|S&F{c8hZ=|vI<*n3mcxFlU6G2e_IJaHcj@C{9}zf%$K5SI}vQ5En3y7L|3jh4H{rcR3+v$W=ND5+Nfbp2Kb zA~VozonfjVfK4CnFR>A^Bi7qf6e27d3|ChBrb)xt+BWI49Yb+0iV|RJxLs!rEj#UR z-(aSVp*5p5)N;`>ydT;xzR1P3nVf5=cGGS1BXi2OT*li{vYEyLV590$f6Sf!$R5_enR+1n;3IqEyTrV>)W~MOc5i)q zaPag7HaDBcU6%nz;KW$wBXq4Po$YkDAS^%>OUEa}x%I4JL%uuxE4~x7 zyq?IyN5`UBL@3quWcJ=_cZm(C*W${)wE^MLTuPS{NmVqsY4v@K7)%~0x7Q-6f*6!P z&s@(vxHsQ~9-ho)+Iy~Ao}?{1wN6!E9*yK>5;)X4=ywQTyANjH3ErNJwk)~DdYs-r z9l;#Pw?qkjTduIyRnASK2hEhwa@3#9FLm`(b>~V?@=k1&Omanz)^FM$^&en!t34JC z7G{0}elug)xw%J}`(5Y850R^>8>vCn5%BRxlS7-sxk32V^JRvR%qmRsLh{`GTCl^z zXHCg_P2ipI*_QZdSa)oH?v=NpC}HPme|%eHM`@7Dix>E`fBj#|sM4Ihc=76u zmAba8wt~EXiGv-$$kf5u4B%FVkzz{cj` z;Q{dA1UNWbu(9*=^Rs>6VB_Fm{R6@3;$`n@nv%m1+The5W#M%dT^AK3nHXs%Y~{|4=^k$F~wf_Z`mzU>XQU7J= zUr_&Ai-3}|mDwLL{Ur<$b|JR^qwjy?;pL0pa`-3FCB}ZJc034(!Kh0psZ82fLEfXeD(pKx{i>}xmc+xqd_e)K5XN_Z4C_EhL@2l!2;^PEzFcVsY=Pt0l!&+8^*=&VAcNX^RSE2;M zMu|aL&c3L1r2HmYnvIHkdJgQclqaK58U62BLf+@sR5TlGN%9&W*gysP7a0oDIuNY* zT6TyOwmGt?fA+6Y@l`$!Y@)UVl?rn++-iMLFsIdpKdwv((zBb9`i~Z=A}U*H>0dN| z!%8W?wj%>AOilTm%0IkHMK)b3X6qh+Q@n4r!TW5ZGrOWO%7LyrDqf}w%6IPO7>U7g zavTQWl4v5#P>9f;k{^qs&Xuz`eURWgk(IgWg9hZIPfV~g5aDbJk(>ss^SH|V4Rdge z!wHW`+G{V6ji)unn(AOG&`Ci^m_ps2l?heB`njAOF%QsCd20F;UaD%|6+!Om{T+BU zvRs3o%Le+=)oeRZ)u2A-Ku?Yz@uj$^jKWLWQn?H*rdk7YaMt0diV+(h8&ID3Uw4Hc z?`0`lr9-|)$(zziZ{>vtrH9}mVG+HDMtq09C)Nn1*zN0D`Pz*4H;Lbe? zBWn~EC^u=d<3b}YE*JMq75N(rcOJ%$bz)Nt2m~onZCp2YaQ5WPV z>nM=_oef8tlI_)m7ZL6^J;ZVr($?PRgmF@LThSfZ#8#br$B^SqdAlfRAA4di* z+t-pb%WuORh5U(NKlf?XXRi{QuDA8kA8Y5eUE{kfQrRRcRg2h5WFnuKGA7robN;(L zULYTJy^gT=n{hM4A{?@>II}=)G z#~F+y{(5vK41r}%#*OHktFNVWt+q3CeR#1FGqPswND?C~pNFN#9APi;Yjoa^P{$Qu zLcUNd&6to;l5FDC+WBA;&z2tP9Z58!F8FIcvmt-`US#t0-Ohe_FuWyO7v(w+l=PwLX@%7)w+& z?~xY4B_t)OScShCBUSN?+>?_ms2`c&n8}rt1A4Cl`znR+;b*U&hs=AU< zRfhBW&teL*(M4nF9BJ|r0Cj|4W-)~%4gAjTr>$wZFNsQYe#>=qeScgor))yB|JkM9 zeJ8u;@b%=glK1YYDGkku7&q3yrR+LkE01aH_PD{7oZRuRuxwrZk>Jo-V8|FJ?_EwYzY+=E;YF5nRp>g+)-iQv(9hcuGj}!*Xr#PnzOL3&NX@Ih=-y;* z-!k8FQ9xFBTN&ulgsteBmqHkEoIbe7aYQth$1rJ;hW*@N|B3sanX2wHl{De$`}*wN zR}n1l$?zySshHl?(jw4LiHY1A>AIV+dUx7m3lPxV6D2{^$LdQcHzAZwUaOuIL|gs5 zww!gHnb;mQ5JOJjE|zeKzx&B@NZ;|&3LCC^MJyOB331+DPL=bYFCDo#7JSDF-N0w7 z>dHIo!!Ng)Gg=~LaP(UXJC*r;b24dDpR;qiQY#W_)0Vu%&d5l_Sjxzt*6PYrt$cjf ze2Iy)oxezP@^U?++s-fCs+HhV7npKEtK5 zxUK}2c^*k0FUN#P-L-MjtJnN;70CpR&whVx+5UdW?*I7u@$?4fv>5lb!eb84$+C3?kg$3{{8HHXJ{sxo8JGCenz0$Bo&0uYc~ggz8_LbQl@h8Q-4a$RP|{LtX69> zs0aiTmLY&*ooMCqG)IU_GzwewcB5EOw;dcVj*9LNPt)gHtWaYF>QE!_B9nQ72OoC7 zSxGA@erm4Den(9;`!()6oEssNr+;&ARTyR3{HZ_{UocTsrBgoZu#6q`X6d5qd0k3~ z-S}HDqgJ0%z^@1AA{THw`qI*Z4M+eIsKZD;*Xzy1}t`PE!vG{LA2{!iFoXm!&Qsq@--`UESJ6~EzaL zVeZIN^xrz-^AyOw_cOeF=fQBk0w0Pj|HXG)mdaz?ocawk=#Jz3-3$}l#wNzglLZ~# zWFcz<(Swb1dW_K6lRgDry~99%+mjFK6p>tkA7ssSBIQg9s0!mt>#GuIBuAf$dyHDM ztg28<0Hu?R6O34lAGZ%<#ci)IK=DBkHkn-wkq;s(;@EV8rV8_HN+c z64~VXSgc~7J^_1J0{I`GJO~74$iJFm;jcd5kNM9C8ws`fuFK=Z_A z*}4>d&|!%RxY-`|HMwGuFW)8Ak|-igKDaxuCq#b|7e$_v&8=K9T(XpbmCrQ(N}&Y~qmVQ$9A))2nDzFJ5Iovx>sT#y%T#Socov^)ZJ<7~i82=97@$xu|ZQ53Et-`5(uGE4&$&8qD{vy(qy}L+LLxR;J>3vrpyu%}ll-OB!FG zITyl?n0zWi?!;>CgVWu4_EQ;MMEO#kZpL*wJWN@qU_Ze$!6z{|SkcS$^~NsS$F|5Z zsc*pcPxQy)hdlhPCtlF_>s-UVgqnV1lkp-oxh$8RcUWWXL#M2|%|??+UFZGHUB*Lo z8ZGyWa?atwJbNAE^DEiSzK3bg0(|H8JhU`a^|D2E?u;8-_O+lx*m_FR&w(U$rJvI% zpLCyv8Dd^LU3TuB7Ae%Yd<>H5cEG-q8yoIp!y=SPQ9rMX%(~VNxq`Rc z{dl*pduqt*P>hX*+Tc&IgEB#i@80*4xDjVm?B58UetPyF6sI0NTG+297*4*vYj&8! z{}VZpWVfo9jI*BHV^OHB1yL2XEsn7KWGZ0 zWYUtBpLTT$bv~vDvQ+z`)5eWe&8^oJi@a&Z*S?SjmFqJPt%-5Bhr3H_c;)Md-1x|90_zl)G zll*8gjgBV659XCMJco@bh){0PJ-JIR#LE$_5?`446a~w4wHA&IZxa-L9@xRQXh`>O z&jHG>0g+!uCXcfNGM}gLh#eru2F=4DtA&Vzz)Lpw%hQoew@-rrGRN(r-Hig&P>5ZJ ztH}MPQfJ@q#5V z0z;RepPe=^lJJVk8y;t30U`EI+~e=71c>`IB$M|Nen!Q7Jh(V6afGTctTdLso7(HC zN$6k2LI;&QVlsY%`kHzBF@uUYWFwtPv`VR%xb31M6o}Ucq1EDzie!2;Mmnkq@>ILH zA!2R32l;X?BO_HhS1hWks@ZpHMRk(5UGsd;}q=t`jq-wXF=VFm@O^ zY8+j3JFGS8ebe0Ml*JOZSYs4qJHf}!u97q7JY5As-_MTi+31(c{;gglOUsM#EA~Od zFk{tgSDzlkz-gwj`y8FFiHjLjzshQ?x82o6BU4%2Oqg{} z)QT0!EF8Ao4Si-eDBF(L729`F<+Hemqz!@qQdyy0yH!7O>)MM@eznq6-p{%F-z?0P zfV#*|T8_;d?3NZG!t%4@CyU!i1dzMck~yc2;9ift@zI(3b55rXngtridLVLc445+| z;#r2!v*2OOM!{~scQl!b?*=$V?bC7^t?W0!bKo)_;HzdPD!t;Pwp1P;CqT#Ttd0nb zPEzk~woYa`;otXZH67ykbBiAK&?2IL$fzmnfy^o;3G zlsM%VCFcY#%cKr{7CuNQNY3DuNSsm{C=-PPuQBYfO5+7M_*v?^?wz!xGYh)H6m<@_ zn&A5o9|_Yy9s1kYBd6CpYezn(p6DM*J4fcs8ShaQUk<$!$YBDBdG=zYSJV=yI zzB|<OC=r?o=1-z}^9wGzRh?1u1ACzDj8#c7L)PJLz;oO8#k zx49-g(+k?I_RI&GtdWsnIa?{n8u*9`543eAS{!8>HwCaO$ky$C=8wGg*W&K7iRa}q z{ff^6CDz3S8%$V_tv4b>+)SyxcWa&Q6G1!BEXzN!sQcf&vFCT;1ZTHNYkCtu5*1V5 z9dz<-Myb(SPe%IIwPx}-3@}%BevLGPs3^=FH1-$mqIa968f^7p`(O-Tmlo&ry08U& zxofP?KCZcB>jqim?A&Bbq4`y{8eGCoW4o6MMf+mc{7#P4TZp}Pz%37DP*co-vWp{& zLaEy-?8aHCzFq07W1oupsSd;?aEqDYs=FRF6yy)z)>f~Yku8`3IBw*1;CQQd-&Sxc z4Mu@nYAw&PvBFi!dQkzbD58F%B$otH5{U!RKwH^fUc=b_OSaBXicZ+Cm3pxe&6b@> zPN$jV)QDVX#n&@VkGEGu7qNX)p3f`1S^AMY`V(Ca4tfB+gW1Z&C-Tbpp94~6)xE`r z_yL0W0!wO2f^X*{r57M-QgZ}{VIt5+8k0`rZP}>%D-zd}N%Y>(>>#&8-i-wd$)EMD zFIaWGPwP-}t*8q2YqcxFJ385m{FyW>DE&OitV-F2a)MWV?Ci7wR7+vGzCi$C3=jBR zxc2jv+Sn!)5h`m2FVr8yylYpbE0-httXPy~9Cn`=BZar)(6uQ7J|YEoZQqx9md4iz zn=o1ph2N6<3*o0&-X11Kac;wS%y9QEL1YyimaA}W2h(W`aj6{ZOsYqwmux( z3KN+$%UC|&iayf#xZb!o>jT#OEVBF|64n6me*=qcHNi95nIUzW0Zxa}QeC~`Xh9+U&&R^UgRba&aTOa)6t7r6= z*|9VH!0d9k`w^yn8znl%_&4VFH=^h2dj9vc3j)ETHa3&q6B8%M)P4$<(4ceiRgD|-LmCv ziRwIQcBqZNAEJri_ku@Cwuhe*7!S!|U)F+-RVi}d`&(@QC`htkVAdCgFlkmgfJF5A zUM3`>=}O_}?ydo1?fJl$Inm=nNvHiEP2f9C)=Yt~X6FfbqsIdZ=bn4u__PlaH$wt8 zlm-Di?n1u18j6Ho=gAXwv6}7W)e~RXI^clWij{B@Gtu_BoK^&0J$~F=UqSLy|Fd+Q z(&>B@4HBM#&BC$44Iq}3q{zAGvgh_f9mT47`@?M5d`ip8ik9Jg2bOK6)lmNdoa4M~;MTn2$Vk{ym!RD%zR4c6rMVm!S!=)mcu-}W-`#ZsQ z7`*tTf5yLz;d(DT_3X((&1tms>1?*%|)pIiXk;xxjGB84PtDs=EBs; z5Ui?yYe)(F#VbwEp*L}?>uZMoM7beA0n&)z(v^kfI+lmubz zwgjpwZ&=`Fxusm)0YTi&3Y=v_IoB)O+Drvf(1*3lu_FR|l%roPeaB~g1tYwipvRto z%z&8-B|B36q)5c64gFD@*KW}ae4bdNeD^iDO7#0HyB_awl-i_O>;@IVHQrYfSSNE> z^f$*bV_kQueaUlYJBJQ@PUern;01rffK59zGVc`NJNusU>JIRq$T6wDU~`W+=5mmh zf!E5yOtqHQ>l{ppZ~(1J6{Dxq7W3UhW-UNW3Eefya?+_trm%}H<{2wUX)k2wf*C_$ z5zwe+B(IjqQ~6=%srl?Tf=8PrPo-|FsZ)ckE-TD0UC0aN&HhDI9m}O);c9XKX=g9x z{#drha)d<=*?yk}-rL;~-7lP@kYC`S+tu55BBYn#@WYX_z1~}syGCB>PXkG-0hc?T z%f8TTPwzgHma~e@Gx%GI_0hJ|!7z&UAT`A{!g`D6%|*+npT`i0qN$(u^DfkRh_g64 zF}!ng{F{u4(TW@k$BKxjb(!6`x@Jng-EzzOlwY}lsfJz%I5a4ZnLsNYuaJv6u14Ta zKV)0N<1$+`Kx9Y$8G#;yPq82&)AW8V1Vr`Qs_x;0YAcMu$Xcbu`t;dFV~fAHou);v+-J_mZF;(4w1d z98b9JiVjMulA+9Hjg{@&*nb zog9jMPF+3AV-ajcNoLmgfdZDy6tQ3rHS`tmmZgdPJ`hdJXCz@5DBtXx0~jI%E9hdI z<@QF_6<%W`n(5&*9sdZ+jY%$P;-;Ga3GB$zWOq_~zx0Dto`;AzRHND40<=avj8^jD+!jdj7}kv%q#gaHo{c6t zSWt;-Q2lYDo7GwVr%I(L3?fOc3pLx1Q~I%^mM4PsQ;z*Oe-UuYlA4;a*GValC_SODMu7 z)NubMS*=S!;@kehr6++-<+b{cD)mzAlg?fLt5k-H7_!B3qQxON*hJ(GIbbY}T5hTO8SVLi5# zbfTF`WekdYMpeA@z)OUO*2_OBs#gEK#R+1g5-caS$TS7u-zQ5SBY$GNPZ7j18t{%;VP%?5zi~`1okcKI!US0lF=__I?;r8<%Q^|4xwzq z%%^4*ZCd`K4bO`yY-VF(3a!tk@~#ay$k*P#q;l8$aA0lHd}N}FU77anlBFFvvl3Qq6?^eeY*UsjcQxEdfO0|iY zFs8*;rvWpRJg(entOFBrilHB&8Dg(5c11%Z*h<$dH%W0zYxIl{IYc_b&iC8+<^-5j zh2<|O3113z!Z&(ZZY)|)ll}c-#e?2lFRz9h%Dvt@D`%5}-Pmp4&jv*VfG@-m^>sW~ z+wYwzK!Gi?{NNYa`zZpmNd2^+XG@RN5)Fk117WYzZF|uHPDRlfKLX26=jopde-1gZ z!TQ4j{15T}J}-V`^2$E2S@~AI|b&&lFY*(k7 zIFsdN6Hv$y@AP9g@)316Ye_uG3482UxJE?GtAP@x2W3C<3_}X;#UzO?fP}k`Vv@!1+HEy zLr|r~uKvC=zj0wm!x#|=s&=5$Qk*rt<_4l)ZVngg)W6xE^lJikx!~;Ul=!%701V%B zDWx5}X+kk49+~MVCkV0Lh`(SqY~mv3tvK~PKrNaOW6j`}>{-eUS5DizxJEAFQ?9Zt zwS7Nfn>n-^7v^CJ4%lIfx2&Zh@Z-LjD{Z-%oXX-WIi7~?Z~0c|teh?GvDN6MyjK6J z40E~2^FJZCE)*+~6b0ziktWL$qzbPk=%;hcGj?L0P7lnS_q}n5txd1r%~#8mqzd$W zm4?DcTr{VXVp*Zv*19zJp&ZA)r9>JF09wFU2&f5W87eC%;esNQtRHM8pVn5w=T6d^wFG5lrVjNOT)0ilij3y@Z z9sc+$Ls%=vCJ-k`iCpO2LouVls>D-rD7>t|EVDIDcy6gn8Jb`g%Ri_{_&wrtp$v@R zKn`^KV%pSa91{5>?0mwO9tj1PO=;D>BmSH5MInlU=;KxW(pW8Msy9p9YZHC0#rH|O z!4eECfXDEV#Q?kf2O&3>ZR*N@^myBL*K@ht>Gg1!U>E@Fol#>S>H9>c>j#uS68vrI zd)ezrU%-p&#M~vbRJQ4rel&46;A2>rd#CbMS?y4h)oFrOYa=-|r*~PmN{aqIOvbM9 zPkivS{TiE2q4V9E^y}*q_O*?U2?uL#w79tYx2IjbPpSiihvac=KQA&6-e4>o8v-}} zT!KieJ1$(nAs{+3Il3Z8<36Ydh{D!M3OyK zmC|<2^Iul15vmN2>QxZS4bMN1E z-DH$6LqrBO%I7|30z=BiOJoM?=$cQ>XXl-W9{)pW72jth&#%gHKVmPcM#?}*QPIE! zj@4Nsfo5WPo;6||oa4Ys_o1vJI(_Q~o#cqR}=ez@U#O!%al(fpr&->!dLy3r0gM`<*>uLNk2ul7DWu zWOEQl)htXL3$(ed13QRj#&gujsgY{4JM7acJxD^Df zmMaw&Bti83a-J|c`{f3H?X9ZDW1YDHJT(+GREx+>EG7Y9SQMZbo8S{m%^RueKmJVX>F+R<5 z9Yl1J>HcOzzo=;J?N;7b>)&M5YD_kTz!67GK0Kq&KGX+37F4^zqVxh^l}~M!UAsO- zH%-BpyC(BZI5@T!l9`uqIL&{#Ld(mZH$Xn> za7Jj-4%55V^?Jlc>zTgEqUy-s#PlNV3?Iojn|PWtyr>m)GdPn|g(;?{Iw;62Wt^Qk zc!ugK@wQgT9fw2aoBR_$CZ9IBK1pdwY&2f@CYbIO@nJkk{P6RbKAf-dM<`RTiju+U z9MsUtqBph@U#6Qar)gE`Dik5&B<5Xp&0I23t<%pCF-c(wfQ5uF)vt(D*rX_?`r26` z&i!!?i0#*$0AUpW!5@E%^i`Vo7Vy>0X14WXDFd>56kM6ZtFkzbl9$pN`EIYshDN%jt(}Y zt|b-S8LQN*`OuT6>l<_oSL+-2!?T_JoL8qCZ?qE8Rij_YN-s0Udvfc+6N;ctW4&WT z+2j*>s~EKsm7uto=Vk#kL4FH%`zw;E&ua8c zzbli4-#D~+1p5p~xgUo650Y&^)T^ebwx6DB)rDYP8u=dS#4-_EP3OTuxeb*M#ZW$- z%ttq|Y#SFm@wx`3khp|8U>V&AlzY2g?>3&9Ud8%>Kwx|4XJOSV%$k=$itXec%kDwC zvJ;WcNl)0c)?6SefUfk`H#(f;2GQ;$s#j5TPn{})W-ac29483en7;E{8DELng&{K5 zsXA#@3ayav)wqf0V{O=YnLcKg(*d~U_C$B3gTnhxhQ+X%GPBvap4_Vvv&qZ(*M5)l=AoQqNQ>&cyi^rMMV26GUr%&yl*$Y7piCpB(Ri z=!Oa^0;+~(^R{foB!D(4!$#<3PuIS7!#BRDq(@Ua5Yc@N2F=l-M^uD*f zY<$<#iTVxSnxKy`v~4a>3VyVN+kFhXlZXYxASA5hS@HgfN$IIu91+BH1Ac3tvTdzU zF*WkFa3xnlp?nvABy+zTx#WSYxb#!dn-coxmelHrSEBGM=0$VX>?Ikv!iNdxhbs{F z`W`FDcb0$m_t&Nt}=DK2KoDo}3nH;*(@C z3{IF}C!G8iB0q&szL#@6SNastdz#~Mv8%l`-@I#ZFebUu={No~d#Eh-I@lGf=mI9x zgN)0c^(;l87^=c8k#H>)OANa09m5&VciTMTb}fc;qb^~4{Dv=uLAM~ySvj*);W=)) zt`xjuu{R!V!2Ov&S+gg%_@^dpQ*cK!&BakRW|w<>Ft?57?LevkQlh&{BC_v7o=gA1 zwSD@J$s(>+rBw9m6nGZD#d~7jk`U}Vf&u{IV!fBb!ds{4OKYmw8<~)J3FusbMKea# zQ8iILRu?zc?W%Xkk;NQc8{UCWKJYzp>`~wka0JTr;p~rZrS+zuUkZwP>MB&SCq>Zg zvXXa2SRo*?3GtSRtZO7w%zjfWapSsM3bbYCG3avELxqBJU9?K&Pat(0hMRh~s+t|h zT_rI>oIYoKEqf^pa7#pO93w&!kilnFw$%J#795$AC#X*~{O6mp620T*6Q%p}G?l&S zS_E&`(}U`h*KMjB^})a#))ZPriU3W&$ET7 zy1uhkzXIOK)oB?sTR&dvGkAS&HG;&UW$c)@#73@pe;g+__6gw@wSE#CToEL;)_Z?R z(84e>P-mDAP%AzCSuGkseY%0dg)Nz)IV{Q-pz!?mI-`N$yrR`?*Q+7GSF=KIKLtzJ z=yxffM_;(-4a2g_+%f-2;Y2@o z{bF2=T_*F?O(&h$J~&9Rcbt9<>23`iYl_*^yygqa*>&?m3N|n`%Lw;odS?xL8uIby zzkJ;8c8TV(pU=biu4oue9ecEsg3e8Xch_vYa**OYbE~7~29k9h|IK+eGM{S--kL0# zYYBo$DE0p-^E&uZcz#~IW(<);O0{Hw<<9bI5sDfGX3;}M!U~;E#yRUR?bzmyUT(@> ztif%igx>%As$mA2m)WVPyt=ufb4*AEe(Rs*)A+FbVuTk*GDTfa(fN+sNorjcrPQnR ztYY~UvK?lp%cc9$bOFW>PvJTC1 zR>00?W3$MQz#<#Riyxcysf5wd(UKKF_(EOMVjOTG=q&Tp|5Lp{vYu(;&PWnE?YLzAJ&LKA}Vv^*Ec>ch*d0CawQwN$(Cc(G#g6Phyi!|9v&2tJ?Uq=xbo>D z6s(!N@lE}C#{CzBj`CXV&-<9z5Wcw;Nkf5X(#MNT3M_i6Pmwzc`ua!I&NG#* zC9TXX#VOO3#YT)NR&@K`r*eWtjsVDw#D?er&nE6b^lV@00=$vYH(95=6R7R+;r)thef5$qR@=_Ecp z0#lr`c)ao*6aDb&6Y6GZg|z?%$2VW5j`Dt(dOgTtuE3P0aFjZNQw{vl56wU_*OhXa zo%gd0Lh!A~s>dCYD(5l%5KX)Qx1_QcrKh94u|n@n+ByF!OtmQARP3)$nnr7|om*xf z4{uj{bDO-)`rJ+8&`AyZZRaMEBI|k*l8WX5^#CNA`6fRhBRmL*GI3RE*G_Ji{(M@6 zQ5bLBQG75}Hf*LaDDj6xe8t2Oq?b?IlZ_Ew%*;h(eu_Z*#BnV9DsAp5L$o-vJn6}u~&MZ@I)LTXLyOou!4;v<-nhkeE+fjwVTa$CEm97L6R zJ9?{o?|a!KO{0LqG7l!#&O$VDU>-2zP6`qFD!sq?a2Roj?qr{He?efy6X|8~E zjwoNZB;6DCPkmvHb;YX}8izE_OeoE06rq4Hp9y#CrSBRp?N4wmPuD&Re>6)(I)vp)$I zbf<&3Jcl*ei9cf8CRlae=uu}{&y)mG1i*00XDh^EJggrqR>dA42Dx1AJqTkCCi)@D z>y~GE{@QiEc;rOqD2fMbOW;s7cm~)ZAS2j@O>pX3JUWxtW+Ue|vN|T^A$vtNd2>L? zy~hB&Q7fJJ1m&_KU39l9j`)~zBy2lXh8T*r2lg27jqb-*m@f5WF6|-~eHQ6IR!D1E zSu&kI*mjr4dv2w%DCKhy?LAsg)h+s%PQbYvZNjShUMdmbk)b<``^mn$?z%*ab0ykM zONy$QD}5{!o#gWsiBkS!SAd6REv^H#g%8_0$m@SW@euC7PSR=N14@_+A#b3L8&*5o;* ztf#&nus!fKeZrkstUB3ZKs}GBu=~EY+$37*t&)#{$AjnPTU~cOU3G#2ZqSurJB~@V z-u@bGz1ZR~chKNp5^+QT<5?2Srpt+zjV=4|kom&97TdLuwgxqxW*W>EyAs9H2g8x6 z3g+86-)H7LnGv zGwC(0x?E+k8UE(5@fN#@*s`&K@64YcxZ>up%DAx^BwVudd{XU-67w9zemt>mq0W7o zXQG#ZCJO&DlGJRwwoK5}9pOwfW+|A?uKKBqN4ur-@X)Q{wZ(F8EZ{wZ_oL`)gw<}l)9~O&p>Z^S zb~wXX<@geX6q(~WH5%_KZ}T!eMrAW5eMNjxa^(jl5@C?X&G`Vo+eVDO3C^6YE-#=r zVDRx!M80#@2PG-t1zInLUb_()>x9{C-;&RM!^RfA0toIuv^ntI)Yx#@j1W!h{;Q{#uMI9xW-Kw3}^v>B7ZTc%%97?RDgrdd}TjbPAt!o4t#|A}kIm z`a;jyO#x0Bjb>-ZNrzNM84SwheS;7lM~%Gv*70-I0^&++LrG zftiuX6S#R7brOcs-h9hVHs>Ub&TUgg(kY`X0WP8jpnZ`b+=MM~IMTL34`0QHfiaSL;x+K)x7Am{Vn%G0_&-k+_}(9lqN3=zQXh)@9^Pu^aOv{T_W z=Rwcg3op83P|d+m=y{K;Ob&pYhvswSt~!d9@wZ_Pdc3XT3|m)er{iq@^aZ;`BK-j6 z%c-}PomV)y-kP5G^L$p`Wl_HoPDVG*ve*dU6P?-eH*EJ zErb2xbnqUyPk)jJQsiG_cz54hDl|k7?^Nbq^~zn`Mls4#%|qXTE(;2Xn|%r z`k)c@N+h1f|M1$dMEtg|KdjVAN8q(+NYC_G=x?j}7yaxv1!H6JJf)=i*3C|*)rMN0 zcDAEpPB)N=7hd!JBjc9XG8zOBHJ15N1q&MiJ^*_A;wnfpxF)4#V+Ro>4 zpE;dfm=UTq+Fap|=c;Hcnh3(HyE>GK^TRD0F-fCq-R2ur zShy)=QSld1qTJ!PGmV}v9IHGoe9hy&T7zOlGAS`3(ppL~6scHaWUr+3yt!soYYAQ8 zRvM?iUB%5xWU`&mDC(esE(PGhweR*`zo)-ZcSTW-qVi#0sg#*SneNAG2+-?6;*RCX zuH(+3OD2xedV}23alY%^%~vzDe%93-7V*bk3s`~GQfRhRzr{H**RE}HAspSQJgq=^ z%&z&dI;iLE{t%l&&TN9FpxLgHuu<~iz0!PUdjy;*l5Y3;6VU8R@U3T_-mH|wT=>_A z9!)(3c~Nfu*FZ=Q`HA7NrmG)Vy_I?s5i{THP7mfWy>d2uE<_&43&)-BkDMAKzgE%Y zm${FQ59%eI__%Bc^II-9z;>orG76XAQgnITn6`Y&I_E!ZxdSQkVuapCHg)2$wtMep z`?{3LVl>mLSEu^enWf&v_nRrzi#|yj7oR_XMTTedqGE>i zny%L%^=YZ4L+q(TW@%G^#01FaiMOpg{9jhw2e{5#?NJ01iNBbV70?p#uv8-nN!5Dl|fZ2urukRn$i z*47+cG<)A)QNdJ~rd4R`x|}6{tc6n&dVQ_wd=9DH<@mFd(W8)55cpk|s^E1$tww3( zC$z+R20bDL8Rga$j?24`3XW5V-DBU{h(XQI0y+wUbs)Mpq1VL+@mJ)?4+407T!-K$WqsOSZ zY;BySaV=TB_>Zk3)!f^J+yg_Sv4?Bc%Jg{=2Mt-$WV^1gk2#s{FVVecRCnbvR&3gg7R`k)z0J{{_%b5aZeT zvzGLNsa3(!ab0DY&wWHtgR-E5gTpz{JDsU=dz&;iCeH5%p-}L#-oS*OQzggO0Z+%WpEzk0Qp<6Yoh@eqbU_;M)RJ(Aao|p{=ttvaD|X39vwHeaOdf(%e9m3!`QgplpJ)y-qQuZ!{g}&1e1+56dF!0S^tpxo)mEt zBz1$+seZY9s?}s3bD-xgxxme^mCR77*u|5-mo;b1(cA9jW%GVLPM7F&xo%qU)b_;Q zv1ecGo}8?)TI@%cydZG(JrjJ$5$z_Eq!! zo*ZkU&kg)X!L=>0cJm(QU;Cy9^w3T$m|-w#1d`vvm3UTET~<}s}DhYaz-x(Y1S zUnu0?;d)*LU|37uLab^!aP=??Mj2RP?hYA~AfMfP|@;Mw`&h^)$waL=IhzbdKVX@5H}z z;P89PfVrRwt@0$ouTH{x0eC!k+wf^oO{2zlzlMQQJnYv+$}dXB7rj;WnbsyteoTS@ z;~cgK&c8WR{Ev>g|L4q~mJA<5s0F@s&Bq!0U=AP*8l~(|Cih3{S*f$+G%Utgf$Q1w zp@*^CT$%Dpm5}K#eP1?zl5nC%pUrl+lL%N#_Wb(-&i=t`#Q$^nPcevc zh9po9Yy_mF7^-k7=bU&t54Xjc)NLv=N)~AW6QxgzD8#vslA?o=7EQXHPGkZuyGRsG zv1d=0o2D_l*L+zlQVQeHWTNo^25rb3yhR%OA8OV-t@NZ4*CmbxvI;s-wGMpY2QE7f z^|1MsAgu*fwdDeC5dhGT1gMxGh4}*WD6Uc)2KtA|6oT*)`whd_ovyhY%UD7sFH1!y zl`~z=g&7Q(W>|YJUJ<3s_|^ks2eKf`S1Z(}n6uEGIqn>Q?Kjhycz3h_G}5uBQ+3m# zGZJV2si#uh-AK7svSpV}>J235*e<5tLCI+)*ozo6h4K8P4<*!awi@$k_Eee{$WuJx zSwF6NR_ns&VZ5Tjik>oRIf|m|FeKv5@~bdt|j6s3VwK^;#Ni%d_35w((-f z&v;qH(=H$4GbS82GjrG7c3b?5{4!*f%EkB$mTM?SI5={S4cAlgF}=d5#u)8B?XHzo zgeM+fZCYN|+cGioEgAGQMgKQWGJhdc)$@OS^HC+fP>`fRJ!UTdi6?}a7|&o;?uCj; zu$F(LGSxkm{qI|V|7in-C<7tvL+;-7@gUXM`MGBL1#iJ;P~oD#q^XDBr#bYWeqeKo z1X+iG1^oTlT2}(TOM^&`zU4;-3eKlZS{R`a@Y7I7Y`C#`3b8drZhH^3SvV zLFk{`joSJCaIT}0jU?;VNqI?4X55g>hY~O!OJ@&pl`0 zReiSmy}y8${5Pz`{}=MIo5-tyOmhnHXR1Eiy_r~fw= zIB~!8q<=ze<-MFPIsN;+@xT5We+aa%)l=A=47L3}dj1ew0uqyW{~JFte7-L%NUhbP zW~PMh(F}Yh%8p l*fM!24;>=u?U8@W9TM;BPdy{|n9o}X>O3N^*2&_*%Qj*M@2>bbm8oiL!4x2Q2*!nP`Le4f16ZFCGW$He3yI} zG@$!K9w;O(F76t(^oha|^Rc&_C^bDfCQFifvEHWSmVXv)!duGDKkNJeqtQx{1o3<^ zi3G@trrq$|mBX1a@z0^`{}w9b`j_FC=7^zWFnh{*KJ7jSbH9QdMOxkFkBsE>P^8e| z7Zy!drHTlt$DBixC4-y!_e=4%$9Qa>BfSu`F_yv{VG|Hx{{6$7AR4LMw6D6`~;j(yHO#FitA}?j5_78=%%m%v^tp~@AvCdMoIcN%$MY7Uh-s$ z^kjiC`SGqRLAlJy(@H+bvV=Od#-q1BSH1~`q9^);kF&!d?Sm&1$*=oE=j6DlSi$F7 zsuO6y@27dWYIh=tw7k@`Ar55UE8%Zjdh#jPyYA$Q>8<`*@N48)oYu!Y=40fw%2>E-8P*5-5uOt!Up(Y_sDWZkv5vLIU++Yg zG(2kQ4ng|W2k8MWfgHV#RcMXVe6pq|x@S*EH7#aG=b5j|XVvjHe~wp}%`Dz)0`BgX zm1=8zwHx4;HP$*~_G#VcJd+O|wtx*zyw7Kq-GogxmIb35llFIfH^pa6;C>vNug4;chb*IiRKIyub*kcSWd>uW{ zR}J;vCxA-!-qvwO7Qx%S z@4Xt~x%pispS$2k(+0=?lt?P+ULXo9MpU`@kh0!yf z!}0ShZGr|E7x)FZc>%xdrBI&otS&)MLK;nedN`MJAl!1QU{7?m)!0dQw(21;wIQPN+$<%Dma}K?;CZ*$L)~=@6wQGgsR&$Es{|@g_+VSY~Wqcx*;BD`nuLsG` zm&*(MH}k3J_SiKcEbo@Arml1a0BI9}xzY1?-vaMmP2Qav#?MOcJ=SKAUwls5_Ex6H z0ztkjtJaltiCsN(8rh(?*FErVyZQ<>{`vq`%)^c`torcVbqEH!=2f4)_p;oeGHmGE z3ed^NYRMWzW>6JF?Ne>nr$!4J5f}~KMbQ|CC*ZX&; z3Of(iMsI#Cz01RvI;Vy@D}JqPf-0FBc1Rq^v$>(`(^8Ko*C2)Or$OsNOaJcYjFq)U#rw6>~F-Frhu4vc*ZQO7`{%Jo%Z-q z<^0EO00#v;ph=BoRjevL)}h~?##B%0z(!VJo0a(wl64{kSfpr zwaNb73;(wyp+=6=sR)Xj#?>F1rmW(9f&c&@*DyC8CEkmUy}d_(tvT|az{9^V$bGVq zv;9X`my2`m94j-M)R*4FQYsV}05TdWgdrJZ-{(D?`mBG>-C!^)|C^rKlPWx@d8^=l zDLg=jynmlDi_^bD&PTAq-@cLNyiJl-|Is$R{h0p~8@lJ)7K z=H6=~3-3N1{i3R`cThbzkM-VrwQ&o=8D%t>_EvvyYA_(=JITLBJ6?af%KDa}&`l3K zhK^M`7fg>9WNf*~^||C}X@8;~uj%PLy`}**mqr)c1GqT9shLUuXV-l~Znl6AIWHHe zU~7(76VK|=4R!Frm0A1^YYR&gd@^*6lP8>C(H)!S%d79}LAL56Fkms{LFtzK-Sr80 zC)aD$(XnsELb0yu?nT=IXnj^AXC)-P(E6K$C*YgQ+mmNCwa&M<=Ip(5dD@1Z z^Iriu!T%a{g@8?7x%N%ZcG3)EY{7eZ`uHifEvZbmme2j{A!)^GVh*mC|CfY+j_efbqJpMx~}S?KGP*;fjz*_A2xv?C)r+(^k@S9ip(4} z)8Wh_$PUP25h&VvR76TGpK`6hrKNALA!)6?h)cI83Oea^w2nSL@> zp{}nscq~qL8=wDgEHB@X4!bE9#*WUhdHq%nEnVJ__LhCkjlLzw6O7yC3y`0!@2iJv zwS??4$M~$3U$>ssb&3}^6%KsZsX0n&#vbJT(G*kH6S}H>kipF$aQ4x7OF! zb>$PQYe6SQvxkxoLU6iWQ+pD;0o~<5^Y5w^H>=qWE8MXIpD`yHG#KYxM8RNYpO_pO zmOh$fwbp`mhLr_bJwH_xd59MQpP#UE708YC)KrhJ{Afl)P zcc{5qep1;*bf=jb83lh4;^{*rPyi9Q3XSm!qtCB?)>-M)u8V3u3z0cZ~yb-VS!p_|)hP@YLiMp58>w0*tS@X`^v?MgNC=kH** ze_-fuVm#s04T(}M@$@j)1k>u?<}*oR$}`ngX%zobwLK;CrP_M5i0hpV*;VPis+9!h zr<^8Sim>Kr+5)ZMUyJdHG#(YT0Cn7SP)*qL{5aDXrJ%wGIUWYsjFN1Ge^1Cx0Li2{SH-E z8u6n?y;@7!efqVa#zb_=$3e_ku?DE5>0EJ51PdpC4#t2v$_Uu^A>;^-GgoHR=y0l$ zMhY`hxP9@7tE&fFIW<6>fh}FUXlRr+ zgNGeF`GynqBQj37($x%_8n<6$@H1b5V14nsvv-|2UM;hjiXn>J*a)o(Gp3t!RSa!N zqsU%8xsG!()UTLlLxF5RCmg~TeLNlglB_W8&~=uWF$VE3<#*by+tG|>fZN2T)COXh zA3yF0Rh~2&OI6^poNI!eo|}aRSq9@X(`9{C_`Fj zGpbF;`uprDdWcEwZk8jgOg|`s39|`|@hVRwGoSY4pR*cBU>Mhy^#%^Euh)=0t=le` z9O?{}NuXBQ6~CkTKas|YiQ$x7!SFiFTRH9WB9v;n5^Hf*N1&oMb<%PpNOM{XYgzKp zsL};rlTcW8{9TjiKe96+L};cEcHYgZ2aMajw~y=mPX1KB5qx=4wAh^^`Kn%Ey-0e) z++pcmw2}gttRe56IO-hTIqe1cAUEsbnqkeEC6c0Ot<4QJD@N4F58qTNd}JSa{vY4=oCCkJ=5G^qPt z_Y^7IbD!7X7v?WCp_j)bVGJtb94Y1X$Z7lQky1noWQMC@7&*v*aH*7OFeB9|H;2h# zS}#hHH0m8F341E>%10i5#FtiF5ANMrVn=EyMm0?wk4N`ZhAipX_qsm6oFY)|wNj2- z^U^1L+-jZO>IHjn^xmJIH8o2N_OfTVZHC1AZNDvL5HU?vi94{JX)KAUOlmd|B(xN7 zw##E}=gfz@KjxDvRI4yQyo;XPRO3aS7Zu=#81UA=*g@CioHcEAhh+8?(rtAm~g zoAU2X>Hf8=KtubB*dg`NT@mFH?>@1qil#PjL-u>l4;E22B~S^=mpbML&Z&(G5AtVu z#U`6j(r@&*r7s^|`*TcJo20V|Dh8sO2r~IesS=Y;82|8-oOF^$Mm-}R5D3>Y9oN&M z$3T7^|EkqZXyeCnR?{pFNq8dN-Zj>*XaB7=HYeY0gKsY4)VZ)sdP zr|YEQ;du$~zB-pgHhsp6vN0~`%M9(t6L7t4iH;Ki6_UHa*v)J*Gwtc@bbXE6%hW#U zwcw~m6Ur^EP8TD85g&1M+!jFIuH_>_-O3OH=n`(2N<IQ!jffaW zrWgtkOtu>=TsoPmHo=E_un45?sTnM$Um>Qz&SWaD7~td(50^b^d%TNPF*ZApoZjZ9 zI2lCX$|Zkx{>6?nXfA?>B+EgUkLCBOVC`LF{32g1J=!4ltFU$MhYZ zn^w7HD^g#bSdy+H<0SUlAfhQu)<;C z-*0S$AQ>zpUC!%Bln~gJE4XACUQ$XsdT6 ze(_2ujK zh(Dn?!9&EGl6#(aG`1NR^HBIIhh9_D>?nXUV*WLL4F<)wtAk?a_xb2h zuI%Sxl``MJL=lk#)FXX2*&kw#GE@wLtq9cuHa{!vhAq4ZD)d)&#ap*dg-0ec0!nCgcSiBEX7&U!GOjs3Sca(0F z^>Zc+@;caHir-2LV`(B?<8dSLF3OY38#Qp@GaTe8HdfkEL3ujXg1&+t+)y3QPzM%ujVVy;OssYe_JbZIxXS7h*)IECp-?kr^?EclD0(1Xk?#(> zwJ~3ld`%d>r=Ss)pb|XX&>Ug4_0dDVwUh6(w3Ve^4vQPxGKxAnQ&IfcWpDp1=?L~Y zb*Jo+$S+CuEd8IN{=ct>7i@n8z|T^*li$_o8i*o900S3`4$EgNz~P;!&JdkJixPQr zObAnP)pA_)$%S?pq6GPt0<*zj1Xj#qjf|G38ez4EW1UPEc65=E`6b?0w*pPNglr2) zBRU*TLl_2cyYN<$h;gmt*8*Z9YJAC!>b`>%q=C3>`e?<-p^2&`$j6P2hO5Q7iJ$IN zI1hu^%tT~C+kNj74xl#Ze3N`u-Q$@#I-Q3R5`4EzY@}q<&1w0Cu)*)ncC=XiBG3SX zbc&Gl8@(q2S_@I>l%~DIGIYl8vTECV2|PQibzM>TK-TC&X^?F{ea+-=ELvmw9{B1# z%Ii8hKSl@hfVL?_UYnM4s=6*&b^-hsj7f2}(+GO&HYzoB&16UPINA11X z)0~6u6-(4wX>Rg?+{5`~Dyi&Hm56Bj_3e`V; z-_u#_s69!DU}+9j{w^4H8|aZcGApJt;dW9t*&KSo+S*mtHn2E$U45*)tq|`MTR7(3 z25WSBCeS`#m@oqS?8@3E+rxE$F_n9(e4fs{I0rn=p4r-#ct1KArn` zab%}=Ln7Dc&HD8R|1jc0yr_jm(zPdgc9CRz%OdRBF)P|GQwMF8k4K<<>&AT$==uH} z!?gJv|LbB^6YuhIum6uqHrsPulrwW2KLu!{K$(*pq@1nuo322U>wVgaov_Otd3gl- zFFvqgyhX=??*qWS8mHCeevgqqRhAAReNqBq_jxP@&i?FRrW>M+vF5BVi_2b$M(*1T ztnTi!UbgBsaJYTrrXQE?#hrEChk66xlDd{OK-}j88zzgWuKyliiwF0t&HPXAff`36|T_XIKQkpA_OM} z9^)Ig1fI+%1A?nMjp+~Shd^DpxIWiEw8^^n&aEP#8 z;qRdTx-+YVVR4bO#f>E8WgqHCbGq6IU<>MICZLQu4V$dm87#%JjSA+&I>l?Y&Xxr{ zVglRT%p&6@``|v#Vuzwhu4YeFWWa#-0yzG=bd=U%eKC7T+i|jNb7H3`dCU)&U5j8hH6>(LH80oumy4v7Ci_2n0} z?O(vpyaGQA73K3@FLfQ)S=9OA6bm6MmQ8P@5nKD!8-{7ufK!n-ZlsJEd-};ytVXq3 z4Uh$@SsKYUB(cz4Ip)g!4x^Xa>PU96K^c{>L#I=gJll#Ree>DAS0|$LeZb&(K*H&2 zt}xo18UzxQa2dE1ppS1ShX%gYq6&`jgz)NRhsW9qU{`ssw?z-~G8vlVcWbuJFIMOD zRP-=I`EmmIO^f$8s|05pYBNJ`f@`$Jw{<|GHzZc;`_1=J|p-COC|Jq)acg2_7u;KhU?e0uoohRh!4SGxMwiEeBG5=`_)rOa`MN95i$AR}YrAhYR)>b0apXquz@e8@4SO-IcDzk_8x z*dDb}sjKkI1c6C1G8(>j!t6GsY5ser#bbnt&_+vfu5@&PTxaVHS+r`|*F+5V|2ZBrD&BHGVXP^tIWD*SuyT*e=jLdp5V`()d6$MSF>Bo2aOkNo0E~WfHPaDnvsyg<7S7R1y(RuL)Gw$qCGn_qDgTE#`jI5*j3qJ4z&d=~$I{SlNA}JJGcl*iR&Bi>V zaOViCg1X$Qq_ii`t(R_%uD%w^Y3-SJ7JcgaajNV;iNybw-*0jHi$c;5(34ym@w-_{ zqn!ioL4KX6kGST?&^JlYxngUi#NATRvYGM(1QvtdBL7%&-w1U`81oB zz*nk)*^Mfpk^!bdGVz@&zgVV-K-?6Cs@0h}ktEYEH!A?8n`T@j6KD-9wfsA#xb z2}gJezqBK|v(gPKu@Uz0khXqsBm7N)^RI<<=|(hVKp138x)GG)+v{Ma8@wZq@OzY! zAav!!i&U%G+#dmt!(e*5$o=LF$zhxTX=fhmJ#?!diRJU=`Rg4FPn<)()LWzEVWtZ+h;1V!H8GbXG2WQS zI?!LK@&&C8D)S4gNeQ;Q60Ssg(=rzUc}XxlT5M53pV2Fuez8a5eJsJ0(gJm)Scv;q z7E!SfLzRz(-)&FDGq`Vt4MQuNd4-192bE{>in^glePonmTJaz9=*zd(TQm92( zBWr&Y6Bqf%iNl4kEphvbLIaFx5}Rfh_qV#V@*h8^si_{z2TF>3!3CJ_9#4@F*68s< z2+HUOhC6X=t+}*4dMI-E>Sfd4@K*Q5>ux)ol<`kIJL@3D`-?Nm`FT8s6(5oh348v$ z;+xWNmH9Ac4zd+?@Qu$DVeXT9vxwUhOrxI31ko`cCWiahDRi>Jam|;?IHjj4M?q|1 z?XeaM!|R7OMfAsu@TR&Po97l1r)Im(VveBKi?Lu>=j@x)T8WvCXazNPiUq;(GUFC` zcR}oM?gDNW&djq8D}yylPWl@iL4v0#na|A{Tc-xy1#7NACB(ckZ6cP%@h7;RO=t;qg3u{%uuX%<$(RKDW0pSwYWy zl?=S2V!rHVHKBD)9+}Hfg1IO0EFr1+(lvm+*kJ`{4W#ApIGkA4TOi_Vwt~pcX@+c2 zGd2>6O>Q1TsNeI9{>Ct3UwqC^AQeF@g?oouFc7z~me`@WfTGh-^_NwH^wlk7R3?U_29~23&-~NAE+;8l4ZLEQO;0$>Ya^a1F&OO!hwHZ>kGlW z@_!98DKiWpknuhHSnnIe$_{n-<`;q%BdE6E1Q&0CCw=wu&57yq_ou_PjudPJ`QKo5 zeFzF^$W|AUKp##?*0Mq1^iXLt-p(ppdnK}bRRt8qR;%<1?oKSbk>mL7P~D_T**q$O z28YDXS!vgrTE!sQ^3`+qns&bI2}Wvn(OESo_yEy@GG8uc^`yk*q@$)t?H6fQ*g<6`{2eT_ zO;E>BhNoioko0n=qbOy)bR7N3pEi*InIde`S#DgO?vO}78ZIBQJB~#EsRjR`W(X_r5&AzK z+tV8eP15!xitl;YYl_@CW6-4Ee}1vpd#)Aj(Gm1LmAU3mB`>F^{mV}bs-_`AePSbN zraYs=wM7hw-6En7#hDc9pNX6i)`v+8!V6zsul7;gKSGOA8+@U=brK?r^s7-o-!%&u z81OH$z5aSMvT+$OQU;53Qk3iz{tHVidGM5(4`Gd z8e0-z$;iqXe4|3^m#%lGVW2}2uEidZ8icdxz^1lfHOd~!-(WFf@QiE1l5akpV!AR% zC&m+{f0~UO*qr;lRK{fU1c;XLc{5Dg(m4TQnaAa0nS4}Fm>`1ovDsTc%V~DvaCUJ+ zYjf;xm86|S`NwU`xex@#OxU$_7pD%@Mk!caq|2^2yp6M7E?Hk;kE4rNfHX4a>rf`S zi9W$`>=_Q$TlZHeN$&~Orp1`FXPr7}Q@!OY$e9Eo0V*>yhy<0cP|@-VcQyXdCa_aj zR9gT1?HMENJ*BTfs&t0};7skW$9arXv1gNB#_XFA<`|j5u@C zVj>f^F=dHsfHwhEE3677pMOw0W}W^&9*6$FU{ip2A@hf&RpeLQz=fWjon^j1EVz2Y z(#P8&g1+ZglePOctW4E+^%~#mD7i!Qkt+6=FD%Y{sZ+1ViMrvV~}^o<1Jy;Ag2y zz>~P)PnHvGF`yW(czd%&KnDZ&*AtVfc3u{z_;!;H_q(d0{V4CuyM^!0Rx9Xl1G!0L zP$C?bE?U)dBJ5JdAAvnitcre!L9lsVBi3&uSSZsTG` zXsKLpfAB@bOul|K1@6*SRBpILN$d=7~3~dx*s63Q6C1X#Z0&~n*dW;f|+%(Vk;uF5t z2ZU4x@!F&#$dN_GAaSG8a)VYY@+>uOpFmIZgD2}58gGhh-%#h+;U)lYfpUkb`7#%- zBum#xm)&HaS&tddP_6E~WYqjf)2?g2gUpw7aVS9FHOZ={Fl8oNap=V=m(|48>ZO*q znz{HmZshH9L*?i48UWb~<{i=*HDMWR^Jd!<4wuBjDc)*BQCc6%NVfWs+1BwPiyUP6Qf+4cKo2%z!5Aod#q#JMAiGRI6XMt?W#y!H88BQ~-|@jw62yr@8L@cZZ= zeNcZ#_!-jr$2p9}UjB0!^HiG8aAde<`iOJvjD`%_j!t`JmxPDs>0V^-C8cIhwT;S; zrlEpmjx?7%XcQ2}tKPy;MiUu=P5ST{kJTvG)>O6oZJ+=0>?>2ufcA$f~N4A9FSVzT`Ox^gMiX4k_O0xG=NutfHkj2YEXXH$k-uB0`# z(!ggXZepbcp-2v8J_fBi97vC+q1n1JY-S!Z@kqSn5xZ3e@kWJ4+x?Li%qNAkXXp2N zdX{M8Y8kJi8{=E_3w%!!S;)_Wkd+=)q)V>Z9rQ=sTu1Fk*j_+qI-Rz8?66i-l9I+k zVQR{rFJ+F^7LU=%clUjROk&n@el^{CGDY|$Oj!-K9hrEWnJCm;=Wz^#WrTq8~7 zDOCwgq=TCWsg79`?(8doWZBOKj!xX5?eDFYvxxo6+?$4wF%18V0oM zUGiDQOv!gTYAOi{(jn^d+`Z-z|7a(h!nam(zSwytS0eGqFAOAVkB%T-{fH~m#ldGK zw%Q32Iy1IR`?-_umo<2j1R9x<G07<4s_VB?lv8wGh)${5LeOs zK;^Fez-H#o-CF(=vLd8ctg0%ulk^XrrCdXpM;+_q8f2?4uSW-9M~LkPWP*u1Q0u+s z;9p(z^ei))g0!OW^smFnczBU3)g8z^a_L4fpZ8c{ydKR!%U=`@aiuwP7opt5)!TX9 zqTKC-q3&M79QNPc4h-ty7lB&oA(ZPm(Pq9YQ47p03KwJ2Ni6UBnl0S7i3c=6fsbst z_GgV58?T=w)&w9^y7}Pz=;S%qZNOyUS_2cFK23#Dxq$($N-q~He_!h9`ea@1^W^pk zy>>D9uX~R^PilM|wgT(gapAGen52^}&EP^s89^;cPkVZs-0k_Y+0>??!&i2YHU}s& zbpQPdmacy_38(eG2#4!7S<>9?poXQZuo9Zm(ES6Q_3j8nTYtH^(ooCH55neFw;mZ< zv-{JR+EJX_Zz5y~6UzMuMYPIIG|) zr{!RKe3Z6M4PMv6=(R}kzMIq3Afys&r0M=S>=Uirf*2i!fRT1$`)E#iIR!-G)}62j z;GhtDc8a^A*|6wx^S172DcJq40`k$M%YA6{Ha_V&TE3;N(Hcj<=hl(eP=gmh=Vk1Q zoBed@W{pxj*CrYj-O?q1R&bFTg$Q~NqObQQKu}P{4RrfVTBDsjuN0LipE*MiIV;Vq z4{!V7YYHon(W>*T&11^277;td*qa3W2$^4jt#y{*W*}HWU{>53Iy70?>$xu^6hSoi z&z2>b7LFQ43hQ-f)=_8Mw#5XlN(iO~vZv{EuweJUG=DF|9yaG=U5|+QrK@H1{A<_D zhrTac_t$ib4PCMg*2Or;%y2qgrlEUh{|{g1<&t-luRX43=4JGp-~_hONkT?XK=)W9 zT8&V4ji8#bLGdkn@~B@!(Aw>wcCD*4;$c=6^0(*)D6)*x7CD(gXhAxb6A#;@_nZ3` zxT~N_k)`jQ?rU$MeZ|=CS8qE!Nz9JAEp~L6x@~@MEM^6XS+>tHiq(GqLtFK~;|Qru zJKhtPX4W7%K@KUwdk) zQ_ilJ)+PycOb|$QqqKv2b-fedJ1JU;O1TYIjZ)KbYTDqqO7Fmw1Q#+N@1u3>BtYUU z)^`0>A|L<>%@I40ys9L#Oefy_>bUBu0t@wEX#(#+pf#}dKI^q}XlA-~!p?hnSD@^W zIpUY5M+L=jwTuQVvzt5$7foCK<-%k`Pb2Z^M2ULjHlojH?ss$RO{(+i+dS^;O}~k| z-?b+jihN7>kr>scXXrNneSdJ*KtJ^Yb`(^k|3R8^$M(hrLoYwt!q$q1#UVCU2u_-q zMg}7-Y{b=VQG;i$l~e%r1Q7$31kKZr&AJcxAA2k~j8U%+;^n^Y_Rr$DZOdO9)F;oQ z`@dxqW1gbQc<#Hw|A-L{z_z0pNsKYz-CNaVD&_u|(=` z5$k_?0a(dl!ZD8uE17bKj5ue@XD&m6x_i(;er>QhKYFal#fNax1{Z0-zCjG3vF}T0 zx>}qZXN|L}o+s@q!+o)L|A(=!42!c_+DrlgLeSs@O9&F&T?2#!4;mOGSa6rY3Blb5 zf)m``-3FK7Ffh0dZUYRmb9TS?eDCge_Bw|jbMdSD>FVn0x~r<|7O<5zYkfCWu7BI5 zS~?KV%awV9@FXS1*o$l56rYZiZ=Atkr!u`N_Imf|LAC2JWDzlWDo=DDq3u#vvKPY<&6cz-4&Nj2_26})uF zIn{Yfs+04*Wm7=J`6D~U`?&$(^GQyh!wP|3Eil%s7Ta^w@zqw>$+Ft<du|F zdTZmy9_*YWA7IRV$?CG$ZWKlXun-qKS$tc9dKxEEXvN)nvW#|D%R<1ueDkuLIweB3 zoYe4^=U9~d-yNxMEA%u{=hy_u0ziBc2DQu2S&}jS$9w?+0qec-y%$8eaTG?1`G^&BWeZ*fCdv;-U!TMg20yk>9^`e-JxoSy2) zV<{cJwiPsmK9G=#f9>AxCh)m6qH6;j?~x^&it2?VbnrGE`cQt;-)Zp-S2?0n^H&we z2!A5AXtNG~l!WJdZq*11`s@7-3ISO5pC7zgvhoUTHUj#0-`{K64ED*UVsZ!wq4v9k z^i=r+HflN76N$(y(H;fq_VE27hG7c+x4tW^yi<%ygd0nS>zoOA)S<&sM`5w|kdSP( zS#83KF;WY8@gga?)>?=QPLowD2Hm}mg;hW3^xADmh-I9qcbZbzAuC~}$XkR>sG2$G zbq;PMw`BL*fl|>={%Z*Fite)uFR#WtJSl0PZwP@j-e!U*ib*Knm;7@qNjW(}k5BjW z!AK6-cKtM{i$V>CHI~CHJI^nXh`TUXr+#v83yk~wF2+`VLqX!QQSf3b*BzT$I8G?8 z)cHqFf$!g}(!9*gctB1{QiN@bDMRFuq3>fu5{uN^{M4+1>JsG8z zURsC)fmWETE+60E^RA0coT}Xgu`bdE9P^cFQuK5uENvJks;G|4@0QXR1MLitucfvp z#NH=+YYFJzdT14l1L*>wK}oi71e@Lww?SWh{g;Y)Xa| ztNM|LETvA6P7!mB*Kt0}HQ7}j6?*4Gwq3Cjg_{=vHNq2X)~MB0v$0>?WpmW;QS^o- zQZh66!2=8jzkDK=ZMTi6B-(CAh0=4Gu!05lP(bnwoEJ(R?x-2JCQr9tY|Ko`=FzU! zoqMkTPzr6_x?I?uqbKib_r&^DAOA2XSI$nZN;XeS{-QtX;OCA>`sg^4GcKViZy@%P zN^r&|;X>B9m1pu+_TM3lD~)H8)yM~B9+azBu>wZ{Qx1KmBx@nGIFLSxPqAFuD3Mzp z!`n#KW1pysjvJ~+_+mIVm{*h=LhATC=Pf=l)i(dEJIt8*n@FHnkP>-*@kKoxUJ}<&|>1jWA}{o=hq@ z^iPgM!n8li<9ZRD|3f~DpwWV+m{coHP49KWy9{j}TTUp5*$BMaG_^z5$4ipOl=uur z^%f0%e~g(?GNlwnizXh_ly#R8 z0(q&FmiD7o&*tMJ$jqM6%@wp$q!lWkt8W3xeH^$Sl^sr~F z2{+o;4yw?dn;7${IqpFA3gs(@?YVy+D-rWUoIneA`Mjt1wTF~XJx7txQ+Di&1H>m zw!};@)TY?n5hsr}zn*_TOFcVpHGsi*JWSi2i1pNOf4e-oj9T<9<%Yj;tIrNHlEwgjA@B>*Jr+pdIIi%)F<6R=-2uQj= z)PQ?ZADvoGnLMt$JQdPrv{tYyO3)3xlPYfiouBZRAKqyoNi%IzS`v+^LXGXWR$abA z`PfE=E|{E3*g)~biuKA!hVBmY94PW)Q0EG(Q? zVD{KqhHu;hA92Hp*^6cpauIK>%WD3eLi|;=b6xTxfKUDTPygOej2QvJgDyaLp>5~0M+1CbJ(Z$-&MGkG-q~%&CKpr7ilL#>C z)qIb(E~oe3|C=(B|BlV5;G$j$<92&|%V+vaJ^xaizxML~weFo_@-%LlWlfs8|Ea<= z`Uw%tALo-UH%%FCLZ-=*zyJTn{_hX_uUQdXe)qOvf3j$HoNxFLXH8Sh%>Uuq{%cMR z+-@N_{^063dQauGX97ep@}h3;+b} z2qK{!Bw?X6RPMWcyNp0S{GDvAJ~9R{ye28M)udNR8SS@Gbg?gJfg^D`q`|$>bbjhq zK!@o;=bng@$Obdv`<5kun)!IS*#+W#JewNauL({E3!n{ynKwjTbJIKOK9?xv*EciD ziei-(01ALBL-sIi+l9sa=R+HjB}enA--pW-y)?L{yLiw%p=mi`9lUvf!Tq7E2*n0K zYDGCjbksn@eR>!##J@!W-X3oZf6x(im1lKbX~9Q_^e3bS~)X*oNXp z6>`D`1s4Z}nl8_=XInMZu2!a{RKvZgw$X4CtKs5s93T~3%*8FbOdrfWJxy%q<7wRx zMZ9B|C6H=6bujzdF8Xkmx!(;)0VgXi@zvl`8XLM@a&YYsTGk8#0Na*MT|4qGik;nH z$1@vZS3@2yXmYsf;tfivN6}vL*L@q6jo#J(y@2R#8d>If42fpR}g))996{Jin>hwt9h}%tY<|BAe zTRT&D>`1Esf|NPi6r~;9O0GgKxFJ$s^vJlPRLd;uLgLa1R=amphFm&OC(D~zYX;oH=@ZGs#`^ zMN>0sxA0RyVDOuF^A7n~y>C^P+W*Lv<^790?!XRJ;G24C)^T%Pb}rZ7Dtiir{T9Wd zXEeB}&wuvvkP;KC&XqD%pt`=PTye+Kc~Y-Ls}t=+0(WW70Tmxum-ygaFnVmz*0Jw0Jz3OULdBJ0`jc0)px20(S^o`bjO}2@8CT%;f zEaUx}%d>p$QA!eXaTSVl&Uu~|7bD>PuyfG<{#ttwg@tT~Fg1L+c?rSSAsmIMS4f?s zg7CDM3i*rH0~k~vZjb8dJ9bUuOW9~Q5XR>VWx{2}-a}k&mrWaGVsJhcs+@t#{-KuN z#Y@=lV3AJLE$}i`Fz0;zSF)DN42Fi%K}O%wQcoDj*h`}e^qO&bA9=zAuZE7Ia8em2 zX6py_d;$4D*x0dB&FQq^h7CoujeU~g#t4WjV?{D`Je?uNHvVYPKuy1b3XmjsDwfVS zX1frr5LeJXZD@KhyI*E2uZ;#2c0Y&&!kh~hytfVQVGcVEs?7W5(I_@HVl6Jis9{b> zb6Qrq+`MqJu|!rp4;)_fZZRc3;%uY11Y)J^0 zq9o)t+W54TMWypsAm%g0W0VXiwn|D$0O+P<3KYmP)bUK>EOG8pw34Zo%X}@DgQ%VM zqM!;k{q!qj1=cLs!OB1B=|>8TgYYvcVV>JRvt4#yLTHYGNDB2e z!Pa_dcOJS938(#9$iwf4EGmSQ&GeKtC?z-qOY9x_9E0j^4`0ATBKgEx5e=NZW^gOh+(v&iepr)+|~Nk$^k;rpQCn zlMouuw_SoIB9f0-{T(zx2rNI+MFF57-`JqWO$BSeEpx%_+JJXkRb;s*aox0LM+H6js}cw_5W&q8FSCM2QZa*4-!=NA*xrl^k;oVTKKwv!2!) zO)hd3-;O~pSMRsXD`FOT3xqQjUFJd^i2Np%Di6z<#PcY$fzt8#Koz9{n~R}J8URSqssC97b&!F74)6(uQ<|m=6|XepT0-5r>3U*r=?N2ugtJd z!1oDC64n0soa^fSGiRao^RMRSg`_5Bf@b3>5~7CLZw8oIx;(|%x|rkDI6bAPR8;B1 zmS=H5S~FEGY*8FO!cPZFw|5p}Y@F@=IX?jUzrHYvSXldOC zZZCeIp@pdB{pZCXaZgY=Zk(3=hLv^n zeW%Uvg8$p1RQcRL0@t08nv>NA*hGU2Y7pN}DZZDAp`?arW#g1}U~$~CzuZyWjNTDj zXnBZeVhNM4qRnMKK-AT$WLLEQ)UV!lq4?@ov;`J#I(h>RgRBg6aTB<+P*>`>r-eud zqT|;MKwn#CkHSM2iC4s@sQ-|%# zI;2qJ*VN`PP?_b*wo?H_;J9As*Z!ns0fU<_ug45kI&D*jw2n`Fvxv;W(7-=$+rpSqWpD{A$8(+e%~vcWh2mc+mU)l+S=|Lz0*1*I(?jyDb9%#;=Nh2F|33b|kLb0c=Lan^<+iv;4 zI)Tfmy8bG>WzVTkyyp^qk8KNQmHsxYC%a#IJ9^ozXDw!&g-m3i{jp8$taT>cKOC<` zlI#>V6(vqNJE@1Me+k0A+0k{f4=uA-Y&WJ1q3Nnh8TgdE$^ZPfO)d2M;SD+yHGl2} zEtZsV8PxQ4;Y!Iz-It?r9u2}GBuV;R+DajLwzATe^M~Uro0ge^I)>3(+G6Vp-gmFe z6~VpDAGF;6Ce8l_xR)|NsQm9L>iv#ewwE)t4`_ZM=o;(8)c?LZxz0DM-h}5=bFUfT zD7tO$HDnO){U-7wjaBs7l!`BHCZVZ*L*dGjl75_ov)e*-$MT*|@wK*p`~H9K%Ht~z zHRXlvxpkSjkVXU7CWCOVdW`>DyBaa>EXGxj&;_(^noCe!{UywGt*32GAn=+55MfTK zLek|Dd_1@QufWw`cHGw+S*jU@q|NR%O=S8ur<#awMbc1&>>?N!;i? zS3va)Px2wKtF~#sW{gY=F2#h<kz`~aOK~h#C=? zdo1@5R$2G(H=z|`KOH|;v8g_Qaec{_WPA?^ja#lPn@}a7d=-Ev1k_-Ovx!LhmA3Pa;M?TY9jd%TzRVo@TV8+t};P% zkwm)Qp^eN2Sa5TPO)v=&hT?ZIZk_963)yhFghb+SHxNm&n5c$GHxh-*RLJJ2^vVQe zNko{l0D;eH{s<%+=tMOM4{?;r5T<<6?>AxIF`UyVEZ1`Na~OB!(o)4 z3($>2dH1Ll^}yE9Q>{Ja7SF)k65MEby?`BRW&_%HZv)D;=KVlUM(@ zMfXd=n7B5DzTE2LnDDGQ4I`lQqI4*Lc-h|TlcjFAGJNtOb6BW>j}IMx{w|Rx6zEl9 zM5oIRRsxg^n^+xMzo#aDo5MdTu+7B6)E6NG!z+Q3cnJHG#~9hf|gTJL*%Za#U)Ar zam(T&uaXu`n^>r2#B_`1sd9AHCC;>1>UU@LbTKQJ=SCJ&&uoBY zb{uxtPkYL%9hHh-U763vw^C^!HnT+wx+GiSn#-vC1t}&av#M}HfUU;;%+2y0?1;7A zr`}X!W-4E})qez?0|`N3#lzbO?)nFx$xb+MI7=u>Gw85fsho-J=q{n?2xd^gWgEv=^0){?(=z?)#ZX|Gs=?wpG2T^J@S0FWbGa43Exzde$@dM=2B&{y zO+WA6jc@^gI6M1I%aWPA{1&r1`~_rKqVlL7de@w-pid0XRX#Kwo!b9z)B2C2?AJm0 zv>hBcgz*6n-H>jAd5rQp!me$d)L`9{!BC{57$+7^49t2{s^ILl0_gT~q~KwV_icI9 zQS0ZA5DII77{PC%;^VbY+oNM;bUxw)rC)H*DhNIuP3g^&MsuA%`p6mUb~^Rke36lY z-@qBq(dlKM1VKddE`~7=R&O7us=~IXCv7lAfLvt?VX0>V3lE<1O&3Djhg{vyfV5Iw zzb;4sob(0+akF85%*n7IyZ&-O|Q3@IlqGDpX&#HOS2x1um7V>(S6GrO~{^ zg$x<#+mT1N&AHN$0d*BGw`trY^y?Zws{m<&W?Sa;v^uQKw_bps4K~A$p}>Yd@VTyi zWxJ!c$PCd=iI8^cHnch|CI+vmU$a+^)6s6Zr9XhlvIXIJFdLOr@08K%-4^$q7VyWn zII%3jVI0TJXX$>{JDoGK>%L`hL*hQ*v<`b3)@GnF!>~W;%Lr=^lIxoq@XV}+Qv$Ta z=n`feye7NWE2}(O0dU?;#dE4uWnby^Hs9v)r>3y(;Sz}F!3@!ELx6j0nx&^*)lL>4 z(rveCC}W0RM_(wC0B#=z4+Vn>hROS$exKBwYbpl!p6N5 zzv9(?P6TimAJm>Dy0v95dyj`3)`@OE3IQsd(>!HC%0XL2BF0{xkz)xz(5P*sTtn>OiNO zYTqPQ$Vf1j7*?LmsPy;m^q82Kctk{j`HHDDMNM9TOsg!ZZAHsh!SuAoulZ~je_kCf zW_`(-zh8gqYA1xNL-IGnk30k_fM;GC>z!WPQ6E?Usi6s*0=071o4zZn%w*`L#ARa= z+gD!iLODz2A^G4>q->`*eWqXQnXqq+FgD=*+4yU_36rRb8*iCklWzq&Z3VI9nr-FC z221mVVe zTSZ;*M2T;UBYyiv6)j=cUh8Fx>}BMl zysA4Jh}9tU5CRL6rnpkv~MS> zWnSJSsqdv!9*_6+(S5D6#ICm)PB`m{NlS~EEz>!8EANhjQD8eCP+MEJ3(a}`R)&AW zrb*cGtkS4Yj!bHRMCt=$oU|6A{ymtZDjtP{R~KWtr;|^e#F86t^se5vl)oQ?&juQS zq~II8{+KHsx$!A5u-nR;i7QaDG0h*u3ius(!evZ7Go5<-t0Om;uw=GO_T$H(KM)p9 z{P*w6@+ciMPsyekhpQOLt4LS@K?esmlO#X!saHt#nw_~kih1n`GMAVIUF$4{HLVvL zU-b3Km`~;wUHl?M_RzaVw5t*KH~t*GS*$h_fL46|=2-F$kdd8=(E2*+=6d9cp>G@fwEx992J)HDg)$WzXx5o4>5 zQ(_)|h)+pjf-i~mg84qA^1U~wSSgGvrOctrxOquTHkK|7jI$aiORa0>vtF{kHPY5D z8jv2kZx>DBv(Wvl|#lfk>J=2FSI zBq3dozfs~R+FjHL?(b_gu1^}U=VP@Z#{P`8F(LalIBj($TD_W-klUi0L_d>Gni+Mg zp9^~HPRxe&t;}TaqSK^}ag2g+INsxAX9;xyNm(-wEv)=Dz*3e^9T$|ivTSQksCCYe zKq)dIqpFzUEfl)Mtfbe&7ifK>DiO^o%wN$WouU3vDJv^GCgh{`}3C#E2lspL<#B@2CTbV^+r*I?dd;JL~BQa@Zc8+lg}EnNdR((ZWn@M2m1De{_s} z?t6o)oW%d|ZKTO6*L{1(IrU|q`SqmP%aemmp4I4Q?rZT4e#F@VJ|=3qE?&S0iV2WG zz?n=p7G^7_kKoax5i7B{w?K2lXAUU(c3*zf=(ccwCjLOsv0)LwDZ=5T&RA$Qq{}Ao zGe><0y5TYYiqYw`@q~K5CDR-B*yza6&e3tDk7{HJOZ{_rd~a$QG(=I&xZS# zr1nZUU%4k4j+Gjmz;cU7-yhd`Y1JNwDBUwxBi~CIPm$Tde{ClkQ%scs`_kNBPITB& z>pJcwx~-qeM!f0AItl+{c{;h(cv#jp6v8P|ZFZnedXjdnhn zG&IF;$H46ceCg7l!);uw=d{-tZZuseHL}WTdUMoaEXxMF4@lh&&{ z6jI?UM()*JWsFK=SZ{Pzp7dAyTvJih|m)$PwZF=lw&iA7L(7cK=0 zj8$3{)VJ2uG;APwZ%cY(!ZN&%=+Zooki3{gHp%h8s@jcoAhe&3B=eX(T=>!R&O+Dz zLC}1u(IIhXY1X(~xnng2X4}7hqjoQJ)Qotl>(JNH`;`&Sn<*I=6lK?bPo<^nEzDPu z3QM{_ri8B!F|);YJ%0Dm_WgY@f8O>9OCPv`zyo`qy zgN3hjHO=OidfwhGY^jGn1q!24&5!r8#Di!K{#qd|c=eiK zyjPxGj7~{>bi^*XjX$PHc;4-`*?;YQjRU?B#U^=8rq7k&m>|qK0&&fq=6LoZKeI}i z+w0**OW-DV*u*YJa61!O9)n)qdSjL zUGtSW{C2`N9C5`iNTF``&pQrGwe-VZS9GA=C9i<&j^hb@(|<~BWt?XMjywI~E37CN zINbXwV#a*7jeD*N=@)GVa~5X$KLEDvRNfxct8-h*7YCIOt^AWu>SZF-oVG_2apg5h zgE8{y23+Rq09q6RS>kb~5siHMzDi()prP73I=QmVZ|fLdBI+L&iPhbib`@Twv7tX3fK-)*9)^LPp*kx zH0~D}aI&|l++rX?8Sxs&G}K;t5MC?~Dd-D&?ev>Ap4afkxXa{qEv`k- zdSn4w^4(4w#~QEO`bg(lp7D&ygkIW2meMA-Ylu)5MTZ$lO|WxzFSVGnV1WW|xa*Cr zJ4`H;3rT6h9j3#berOB-Kr!Z|5u@PF#h%v>V=JSr(iLHdeM1m6SxrI|Af^i90kl&3 zb1=&fEzq+?M||^JcNgGzL(!*-gYD7&wTCmEDmk^O{`b3qM?8RY!zM=W_3Z9dH4`3X z{M@i-fC;B0l)(ct*xr4Pk$5ZrlYy$Yb#Xg6ObP)l^fxQ;^Ka8W3r|Pi`YvcZt9!#m zuiAd~o{KWB@4WxKg_?LBQjy6izF5(E)+{o;6asnh#64<9bZooPzywcx40bes#l{PR~V?XU1#r-6K@$WFrxUV{%c^dj3&mP+#g_5*6% zf8Mg8t}Jn2c?;8}gt5KyH#$aVcnSzRnI}uxJ6>MD1b)L zAw;+=M1RO-?{Fx7JLH+5AU?x5bZ507LZzHO{ha!~8BB_CFIPOj_Jc*7d<&swgD&IN zo*aE_jqLf7tSY0S=$u^IHJ^ug(u#Nxpm69lJkwvvo$O?Wft@(K!C0I)Y#$4bP$K7| z0R@+6RmZhn;};%rC!+BNDd&_R@5m_&E;rHpuTPH`K+t%{wOoV&WyDUu6s~xbAv!i+My#F?kWfmZh>V6WP~%dTY2@}# z&h9Bg2ACFiIXoKd9hM=AD-q>Z-g*j#2w0C~CkrBQk)>+m1>B$3S9*E13_|ZVP7<&_bL2_4;}@CpyyM1Oz$i{md1kkNezDfEFE^*!fM>d{r3)^?mJ%Z;9yncLN-y;ZVEA#cXu}LRp*S5X=)KH$z zq_=XZ5v7HD?9B?fjK%#dx9O$y0e-ZsaAPY7MaRSpKi$AxAEZqA84w@Y9D&a*HL34$YO&${ ziM>`PoY;71+M@C7Og;}YbbXD~wAg4UQA~N`AS7q(aJ01>))SFIZdz}($78JX1w>ejKq#`*JivbnzVIx=X1NaV?-f> z9esEFxd|T0>GDg!;T7BcP9R1+=jHjhFl4DeIf+_&Lg0D`dBn1%f(QDE>8{tqEAp1& zPY>Z64x9MKDz+IdX}9i=lQ{`%!xim`p7L>bYzfKD2}AYn=iB*8P!V6au}A;t(wCpi zeN#uiS`nRL(>9IUTiT=@Jb-PAL^EtxDJUTnfKsay!W{f=BURC8;+6kf0ylP}+w!)$ ztIfAJlqxwi5qLei?WE0G--%b#=7_TjO3CIM$X}|QN9=#KHLF_WNfMz4(WEgF+XfWpp&D}!oVI%jlVlCa2*skf$}(VH8|i|3oNT1m<327+Z}DF?Tr;%zoqg+^{5IT^ zGS24#?F`^P%%Bgx_!9Sy`jyFW%`~v2@?8s_p3$a1mc?;KH zHU8xMDfzWoG7JlBk#4mgMdn-5^%- zHc8@IEPV5&iFWu_@FPxNa@XNO@C4~n39koGv3q9xKFHW0BRr8ZCEK_J%$V>Lt-Z^1 zAgenAZMJUG(<;yZ$)c4UZcHB~9RWwS3bcXGcF;B7GC{h%=4wAB0{fL&`!w8i6+tM9 zIq0wqw#gr@`m;7LGA3J#wW?0?Rk8d_-50F5(N{(zPZTv!a`i>Mlp$%c;mL&@yQ+)vVDkF!=DIi99B*MIm3!YXchW;(wj;Fc208ZjDN zY4}r;xby=h^~H;eNhW@7WSKGn<@mwDx5?N1eyFQE;BoRZnTO(>%+yBr+`lj38ltWMC z$ehA!Ylh#X@><##q{(Hv{j$P4@^gHCNRop1l)jR<+vp7LT0P_#ypTAuQ<7qz;wPV+bm1$$OH6>()*%X3w*AmRI(yU#^C6oDIV5YcZnZ%<_nm}BfBxL* z2hz8nWHdB-R=WJ%RyJ6(A*zuPG!FD z7aRIDbJV(HNWpvc?li1zW<`0|qQ705b^^&!9PBTPgCd?@#K{pKaNLfdlKBH;0NSsFJweEBiPjbHo+lFXK@p9-0wGX1PC63t`( z$M~XdZiR!IYr^X2=gToC=ag6J;?w<}V&muB<842+dI1+1p45aW8*YzHW};ss?fN|V zg>Bv(wV$&(jpqd&=?QP-G-M>=a^Qd!`Stv_jc9U}u4vJ=YwpAQ>ygFLH8>2Jo;jp? z6Qdn%H=8981+;tO^*Q*4Y2~e%GaWW3%1kZHGWo9 z97Olv?3;hDt7MTK99xrG+&IO3=$xA3+py-myO)~1F=jWUHh(uBl7kN9SZ~_;ebAyF zf$u)HA3O05XBk3I(>+&^!fO?vam>;aOKEg+Rfl5#4NiPC3>ZR-BArGv6Xi#7?=v-j zYelX!&e$E#;N1DVA1gU#tSLG$ZzK|3Ixi^tr-*5~!SgW&O5caz$kc>NKNSnkRC>PteD zj`_6(mz9CSq?g@lT7}l{hrH3CyEi@E!4^OfYE`)N+BdaM+Xut@`tVo|rTpz&hnU0c zH&HgU6;_Ylu{Y}>n!fdZU`Zd!i&40^;n0QPc5snXFd>DIBSsK5rAfZ>8ZLz|&m?!> z4`B=P{IO)(so31`KkS%N=$GL69B{~MUnjKt};&-p&eGQ^^ zsGD(UgR%K=H9H2TQ3&WC=+%-<-sEY#MZ?~uW%r{s9m3!7s>Y5qdfPXU8hGNK~wT7YnFd{>(6piu8tQ+{K&$PMU&mwVo;zuRJ6};* zo)JF{{~@#5B_Uz<`8u0Mj;I#s2CA@VEtBAG$H3x1A)~?)jD*Tj!KPQ8-_&_KtC4miZFG? z6zrEDD4B(U51w`7H`J^nVIZcQ589X?a=uPyts@gRLrFQ{&o#u6TLskH9}NTVxTDr8 zI_}?W&_BEd@Uz4+@lp}9B_m0nvoZGs?N%xsazvJQ=*ak-vr2>CR*SPJF{u~fdKmMx zXKIHG1y;6-iZ+WE`C3fo2MRYPy~%9+?f4SviJ7ZarqApG;|Iy%U8$i-WOG-1i4nW* zi@NqC32P}=`IHaleS~-N^j;JYsxY=b1IF`O%}&TCap2}ZNiJt7(ZWpR=>5IX_L0}J ziPjPCXotMW@#Gcpw(3~dKk5j$KcV3~NDDceGdw@r@>4Brwf-Pd|E;$or}Lp;#mrw! z7!>b%2rU!7d~;z|(Gt85z}#NH(;%XkD9A)7^T@O{13OXiu0B zaQMcJZ-{T`U9$M+b;6i0xiRI+u0L0WGMi~x0{d3fpWHGDF3ue*Eefl%*)% zg}t$psidM~EncDKuD~DS0-OC~JcRAWhIe|EBBp~gG|F+Q)OYQ(w$`uSl_Kuz!+42_ zELiIPaHe53EBPKh9DP+mS+h6h#)*b)^zj9k+0EJ$KJPtCRt7@LeBe)=|c5ihMAerDf_NT z1xXx~c4vVj^PyaZOXg&!T@01Qup{r0kmoDWMOk0-UATDThqf%BVr5iX5oyX_FP1cR5?v5SR93uTa#dFt5r0z5LcnWo$n>SZYtu?uT#- z?j7MEs;r)R`!8T*l6WhWFFnt#%7`iRoxYctTmmDTvgooFI0B)sXP*DTT1un52~6j| z&_G&KNO5O8Y|dH2HZ(~c75X3e;)yUFs{dA~?)ciI`^UBqa-x}Z7O z0Bmjz$)`)GaxopxkQAbFVo4S?%NTMm(I^WGd=*9H5bVmzc||z+oJ4)SDm|fUXDIPy zxYf3m!G-_`L$kl4{i>eFtG0c}J^g_Qms1Yq+xvaS7uvH1>n*2eTj3#UEdZtj=5oza z3IjLgn~e2_wAe%h^D#UP-Fe-`j$jXAH@7^S`fNpi7)LK|Z=48a`$aA{A(GmCFo|lY z7NZrBjhmpx5&aTdf!=!&6knU+7LX6^s1FzfGUFML90{;L?fFV4ZhtC_&K&vfN%-Ka zzMkKNjLWE}c;_Zg#PZ8o2&@yK<6cv;x#lbpUET`KI$POBYgt|C{TG%A!>oe%@~w8^ zaa`^QT|rVG{g3yRa$#N1s#HTM9En$wYd}Z6U)}YH?F8S%3B9=u;70Zsir3$GrKH!W zmly>Dt_cyNwom5=Bp}VbBB0e)oFzngt?6ZqrRj%n+G*Ni$11wT(O=)({5f7EQDj(7 zNeqxNezwpEOSYc(QD^)4an$im95-Vkmbu!;?Za!etDd2lJFYLBpQg9V=TUMBxhsvZ z6Ug)Y>Ev(!7h7i))@InX*+N^~-QC^YDH=35#kCZ7f;+{X;1qXvcef&i;_e>Yhj0F| zYi15}nv>_UY9)##Yhp)9iZwY(?u!BV*CQ^|lM;)q}SB1iMFU`l_(@1x@ z!ZxBmz;D6E{_)CRncWU@n$-rC)w}E zv%zCzpv#fGw?9ruj**PxSge0s=2RGM?Ox<57t@Ofv9N*Wd#54+Z%L7S=b7OBh_j?< zJZ`oKG8hN-L~MFNOrqJYlrYQBFI!$lny88{B_ujs=;lV!U(+v?tgs{^nCnm`3fzd zIJ}#|2vYv0m(pv<1hzU+8fTpbCwrl=Sm66;R5${PNIP^^>VMQ; zlF%tISmNTaS`xQ{x95N-^Ns*4O`S~|@h6HyY+P`ohCV7I!CB-wiDOUkN)sdq;Y&(1 z3ZpI?=p%z_L@o9)I`lgjA7Xf$H&q%w+WC=9h z4*;nB~IpDCt&IA^-CbaAmU+4%qZblnR;SVPsP{n3b(1-hdRU0{24sFB(dd>jk9rR1koC^6EdrN1E<0_* z+tCTHhY|Gf92zVMQ_EVGkn`Q32$nJGT}Zvt-2{GR`q(eBmO#_y{4mlXX(!s^Zt?8R z+B;`M&NBqb)9OHnxgRlUVSC!FdtWI2MC4BTJRz zG)sAR@E{vVo%`H1427sFr?JltDzNcll- z{pEoWl&i(4!IV76-4?-vh$=mU&MZO7HYSoAidKb?cWV8MdkCJKUS7qPyW8zJ8RQUXWe7rppaED zV>RyTV8`zFezt|A3R2;D5p7rz6X0)09E@1{(7h%bD)Wyir!|SAk6`(C^$Z+X^R0UN za=rmHE`?{xT6LppnV4U3nDnTsy9MyAkp|1vcT{ce4=`D zXR{VAf8)H*RjD5804x5pL5ae8`6eKR#8?U(GX zt+Hd1QvvN^ZetTCD8w?Lxg5*aYqNyM^1IOpeak|Vsa+?W14sNHaJjMyU-t|uDp!SCT34J;PtCvl5~6j6Y-Pa?)dd!#euo7d zL8o!84EYpaCdAV2anOLETc01Da%!x|xG7RNH*4Q(`6O!U0s8x5n z7?8ljJ8W7-W3hK-VWgeXi&HOA;||mmSZ)D-%k}ZLzQR# zD*+svNxbQc7t2x9suf&!wF$jwdGKo{6TGQZo8Y(8An^%(9mus`rogLV#j21Vw1t4K1{CGNy*z% zl2;fb2w)=q{D+5w$kSMQPV?6yVhH3~7=8SAN!?hJ`9K+%mG*_E@VC)Kw3D}$la%az z%%stjp;m&)Eryz>Hhc`hb3RN|aRywBubu`b3@+PrpKh%z`9Xge=zvw11(Q}0>?@oT zH%!3Ov)iwOJreu2MXEe7*5(8(^|rD|zQnXFaJz-f7HOz;h6#b;6Pr;*a{P@(+g-8o zrkBkA@8`J&?&TS-yRr$rNf~ zO^Ulm2ExMZU$Z)-OUm#sC7&{J2@5lxv)Nduaaq*SH0gZI&z3F!YGk`PB&~Is;+kYL zCs0{kKQ=-*T)#DQ+nNe9?1udDxxqEGx)X4t4v21=H?=QOHG!_^{32?pzV`FF66^Kp}A`W zUE>^ztPx>Ydm82aMb(E*Vb#*Cz6!fdAMg_Eec3J?H~-V~R;Hd;7bL`vVv;yaAPH3` zx9oPx{Q4|Xno`n%>o=uO4mj}1uX0)&qm=}IcNb22R#6oXIs1(pCRabaBJrrLKCI)O z*7DEtJ%Ys%>T_~%(9?Yqswg4jg_x>rh;e{-Yd+mf9;09T!K8B%sU3M~ob|(x&quE= zsC4QGf)`k5yV}>v13VssWw4A@iY@Lj)JXQ2&+CpY&OUW3a~y{u2S&z+bU(|qsu{Z9 zA^BS3BOOug&3^YA9H22S(C*fgfhNB%p~!^X`u#XuX}{&fJ;61Va<;^*nN+5jP^6-9 zDh#N@Q-{Rp91Uq;zG2F zxW`lHiCl~{b_qZV(>Zm&B@5F_O9$7-{$eq=e7;Iw?HR0tv^V*S7;`Q*LY-Ds{P468 z4lYiCKf**oIN}LyFCL;s2f+7=kMOPeJ$m`mfl_m>Hg&T-+;H4p+ei{oh0~zrI)U_V zj+Ew=&W|~Z@}m1bGzOQZT2dGSW@kH?deVP4@U#7eMQ+VoXllAyWCxY)H?A~=oKj`o=XnX4SJy;x^hPM}k2%XcrX7{#KKpncjd^u+c zO^nKRF_5gqie8P;AzKsrPw4AaHgRTwjL)W)EThgFlCc4cK62jn*MhDSQT?-d%jl)w z$-xYZR3HgCFk_dQEPNp)#`Cyo8vA-KQa2-Nw)>ER!3q-Nz?Cx!AZz)6gkaoLZ;HO;IkAJYoiFuZxV?goXaWHjMVw7O}C+y`CGRpl0bDyj? zLy7ap^~_Jr#w+s?vus3^BBF{z)bw&VL(;n#1tL)xJK_aElMP&3I2aRl+VMfVz^Ufl znYHi0$=db4=dWmI4nCE>rwFTaF>E=j9jDlxXP2>!e2cqMSpM z0`NJvtc++L6~2S(WWFpk+<>IwhoeZ#qiQXy5OmwdtU&7~tVnWCga2ph{a-_Hk1fS-wO0RNG?dc?JPM3du|B0t@VGX%A`}9);ft>&Q?Dty z7B!VCML6nKpxjhu9Ed2F=z0#}0AZhCvDKbqXl4Np#{{6XG8|rf&UdW^Ay^r>`!h+! zEZ?X6Z6vp*p5X_5oFHXIHOol6sij7#3Yj|%Kbo7aQl>z)rU5zs>=98^;K;uPnO=j( zKAl}wI{5M4gt!M+>%bP*p6|>sJ-oPnEZSaTWuo1((zi@hS%lb<`TpD?y0w*bP0_LB zq|BhcSYj=$AFLgG-#k$~WPaGDi1>IixBkRt)_V)^za`J|Y8#!wD3N%q<2ZVDTyHH4 z$4$Y|)P_YN4oX(x!wM!hFa~BVH-7BV^qiy@4YJ+eR=FYTk}a@IggoAO2z~cvn~0LT zle`8C9;z~1&^LQp>v7R5cYpdp*2td7Akf6SW z6UrGKeBLZ~M0)v8*8?H7Ov}WgVnl1G^`B$13>sy0li!=>9xUk5Ory`=505V+S%=3g zbG#!v#C4VDbtz)|`pK}Q#v(#S6*w*5=(}I|RGY+7l^I15${Dq)=roL$WLuHcG_~v0 z2lCE8RGuEEqJ|A$8Q-)P$Lq881J@wj`|js+Sp2)?afg%pXe3N?->RD^X>5Rd%oJI z)o)ZOw7)2Kc!21mmdp62SK_O($eOq9m0R!s?ne*M{P_u~S@6-WIyV0#6N-c7&G-^XFv#AZ-sy z!A41?Qn!?3@;PSeG&%!~4fBwOR-E>3u*~)ML35ZQqBD(&J33|RrMq+YhVh!r>Bb79 zD7cB0T<7GKjd<;xYIl7lbNNv_Mh+RHH{tnsxUi@s5wo;pbEo0#9Ie1M1b!w==8IGh z(j}Y}Q>UpgC{$X~6$!2Ku2FhiW!*+^B7{D7b2gJ!5majO%C!65!+fu5sJN>jKOt6^ z`lAdaX|Mb9$ieE&2Xo-JstX zEotTA*RR7yL&D&52T^S_eogjeX>%qjC%0LIHla?vP!L8yg{ zFI5Uhz_J1%?}rkFrz1-cIwEmN&*^MyzR9NA>N|OOUgwm@mgsnpw`RMDW>=w9N5`(p zO%}hG>dH>6<@&;@+ztT626XY5y{UG4{hNTpyw?qM7rO@JQ3JM)B)hOvquNbaJgH`9 zPVpw%&+HMRjQ%0z8My^`SX|AHU>(xsCH9nEt#l>-Bkl}0b%CK1NQ0OuGly)YJMUas zmtD>!j*O=+({6HbOJWq~r#~s{`_r)MoA7^LEFuePvy(N5^_n|XQMV(R>ltUXVn@VI zR^aFSJ=FlecOnH_K$4WG!}+B|aK`NxajdM;xbFQAecF?Ii-MpBN-fboc4n^|T|kl7My(bsx^LBeFpTK^0}H+xar3 zq4#UFdYLY6dGAx1oY1r=lHoJgg?$*9)yIreyE@mf+Ku~5=s8X4WuO^g^x|l)SVuuC zey^ttxk~|`%Hw_iu}wZUVDzzOgLUsWM-VAwLPJ^oklRY#uq>#URxmqsP9!Du7xGDQr1m=Mx>{EQ%O+(+ExPl;ST1SsfV61lm9bJY zbnc_Gm*}b-En#39%^jWpW8b#_ATH$&o?dT+P{#i_?*1RIS^z8(l)@O;)b%Dz@p^<` zVfHz8l|qNJC@IBNVvlqJSDg@q0q)>Psfm>+3|_a?0ezM|Txi!R#Up{UNn=T~!3d3-fl^v^n<(P@N|(cV{lFl} z-wJ_V3^@b*_iwLZyVc#AM(w2XrNkWO3r_GGxGZ~&*#2mXI$L)8_v!|0Yx4dVYEns( zka3Z8)CD#G_#HY#@goh~k^{L%VzF0Exd@6#4{*q4lsX5i#}y&ZW2Sz9!Kt+SjPqmL$)jRVEotX{W;4 zoAS;M+_!-vmIwj5IC3D9cCD0nf7_OdRBbCIzT0nCQQ*>g{MDP7s={ve1ZCxv<7e|Z z`J0!K)W|n;g*lpNGvbbKJ})y~4x;djIU|d;l3vls{|?fM3#K{KHMR>U5Tk}9f4p_J zl`5oD#cMhCbV=Wb#}o{VD&vRO9-b_f=bWy9fJMr0n&x~%W#M-2G8Ca}j6tw@@5<`# zx$xrFq!m`MLhp4+RkN}StT{!Iv(X8Cxg?JOUmej-ai5zRT8^h{RP*B-(Jh3U5^(p( zs(bTr+dtUF*G{>jX&nkHV6XfDXBXjE$CPu@#TSXtBpO%wC9lnr3hhQE3CZg;8^^BB zFH1OkrmUSp-_{AP8XJE8gGK)pMxBj?+7-N;Qh`MUFT9^vK*Wn#o)8pYB!j5& zhjlMXv(?lY$U#M`iY!h91S!q?lyy}(%F%+`BxBYjnf*h?c%{K)R($Nr;})!BSIkJv zwN>C{LpjpSp}k`oM(`d#&!2_ou)9-knz>bA zDC26vo@INCAK`wyJRrn()YDDPtpInX?UF?RQd;Bv(32IZi$(eam;Qiwin_`t$|eI2 z?PhVGTsxUptoBFsUE4*GVWg;!>eUUof%Yic50WCu!l5<|ZUcRsH*EAKnzqm_JIVWq zzI%f7lh)2-y^Jp1H4)}U*hC7FtsK0r=cXRyMOyRxls|eF9ojrA`y>+(dLdAhq%t3} z-|^@b9J!GCkX6l>-A%#jdkem?)%}J*K?2%$q2G;{Z{<=>)WzMs&RG~sO_r%0V@`nG z_QAN_zrm~F{0;TESc^z49Gg7*t32nu8A0NpX&pg&F}hWw39ssEpIFF6(}3`<$@et9 zH|9Hv#CZTK46v+byJw;xh^uKg!S{)`V(`d?F1RJ1VsCR_bR)@rcpl{Gsujk6SRa_EjyjH(qNXqvElckeGK|RxOi$+q}bd zypHI<*7O51&0y~+ykKiy8}J|RULX}$ELLy`+2pd{gR68Bwxo9z|08cW*CV+H@_qbE zD<&+;!U>X?>Np+e`NTh7)YfS$uOI(=Hu9JHuSex267Dj?aP#Nkk-Ye9t)t^@LEXAT*Nxz#q>beoRNzI`M$iPZ5JPmfq`1H`>0?sWxeCQMi%Sk7}8;n&s2drsrg)UCGy zv80vg47>}Wp0VvbtjsT_CPMXsaxTNNTY5)-ChCsY2!I6g5>xHj!PHx0$gqVAJ=Bmr zPN@RZ{yeA8LNDLP#OHWS#evXQn`4?4l~qs2f6FNa-OrP()O>+bX)HJ)6f;>RpB@p{ z{TbA4zt*_*5}e426ZNfioB#4sdT;Xvzkc3zt^U<8j$|!IJ(7cE zsL&yG!F;LCJl?q4j~Q1~Y?YN%7abkllSU3>Sai zyNi|fFPr7lU|nN9p`sBU75Xpb>NlKi3k7|&j@wjm=z4M3);zsuWjnfwPUr|tnA@!1 z_gxHhpicIuwBh@9+MBwF$}j)BF{prlWwrAHLIWPi+qYi>>h{R@E+m! z(ABkpj)Pc8<@usC%4*F?`U1^~Z7!(44yatql4=OfXt_5V8Iag}566-tq}CH@|? z<1e~%YcD=59MrGIu-OZq3hf>fPotP?_r6zqi;&|uu-R&`{T6n4in}q)^`M5yS`rku zH3SZ4V-aF7 z$-bkUISFIEgt7cS0%k=t9gYFp=?hXC(j2{e1o6{z=CamT(^DTz zWWCgNuoMJ9N~{-^fMqUn`Zr>Q`q@IQ)PhfY_8(VxG@FpK|uH^H|&;Ich zrlq!IM4{hUqX`fX)+IOPxW{R4k1ET3X;t^KlqDDBeo7HUx>k-GeZPXfm!hK#EGO2Ll4uOa2LZF)H2VtU=kuv2m`{$CtG#N37rGN&XYr$TGu zDYhtJV^g>A;LT3II{^@6W*=2RrJIO+5#q~ql zIFJmng7#`P`n$8jkgWk(v{O-%?qE=XM->+k?uwYRSdry*B_%#Y&~o%G{}&;FFya(8 zDkb}VWOz)@$-6yva4i%k59r0{I8(wnhWlrVuQ{vc5O;#a*K5IYN1@=QE&ksek5K>= zcHy*6qaXzeK4Y@U zk{qmiI5xn-|G8xQuZQFp=NFeL$G0|h76K}IG*;G6enBfK35Et)tgKNw%$V8bRV+c; z#^;+zapN>8IXLGjFXZ@SM88;vDOmtVU>v|?2mS6!0JquW25jyoKcx@sK}Z~`!8fuR zHfLl?qyQqQ@=8i6bc=P&a%s@MXYE*|Lf4WhCoOjaau^n$Q&+vkocQC-qN0OOl5D83 zhSZyGv!S%|5<@S3;yB}4`A8Dz`|fbabAj3U{A|7yzT|#W^FR>75U`A@f~9anmtjXM zWc2A3clSg@s_>OkiUe+tj1VU$f(GuRifp0TU90i!c%dixxvlJCpxJUfd>F5f#{f^*FpZE>TS zaXqTgaW;ydQ9kJGxS$!Fm!UtmAkEc~`Ru`e{IaX|%a7+14m-X2QvYK;`j?YD^CejG zS=G^a;mGV_Xn($`jBeS$z{uXO^ufup=bkg>g%o6&AQL?m1=V}2$*vwR-9_hpRL#=t(AvIFYFj()Gc~C&k1C!0rJ0Urv&mS-qT{qDI!?&IFYVCK zgzAd*kTa&?rc}3DqH7Mt%!kUhZ?A_ts#vGUfDguiDqIQN3PCDcBxk!%$M%6}$*0)mZnvd+9$g};1 zo*1K3-Cj7uV`-_^0Y(XUZ<4jVaAX%0D~gsQvWacp`2fX7RAy z$}1G$(FmbP$PG~t@P#BPJlx^7aNFfA1axT*?4}uPaZreyRjoa5LLMkqwJhQo{+=9Z zYkYvVm#3?YJ6n@XTAcS6zH{Ps_NI8=x&ziq|d>b1Dr=^>VK1v0II*gz!{c9&$7&2X)MzmUkQT z;2Fkbc2!W<8?mpKs^RV}zM=!UkjE%0MV&Q{_u=9uehIgHUaaw*R)z>4c@gQDo%qr{ z1kK5X_E2%0Rht6oWPs7)Bj)bkDXQdF{&1E3Lh2_XBWD=Tq{y9Tj?-)+ZKvZzl^%h9 z$rAC^Xw#ZxBE2assvXbJ8VR+}G*v}Prm*f1_0kT;^~t|LMMSk@p8A8$TSh$mH7I{# zXLDRMpQuCa%Y;m;j!s`}TesH4M-D-;$>0WQoyieWn!uxsPKQytOJ4*(joOfY@f>WX zhQ4_XM?B+cSK4LaL{_s(XtyAS<0FfyhN@2s_fipyIN!s1^}xEE)XK?)A9MGc2r+51 z7JHgf0i!KnNf@yp`3bMxAgne9Je({PI7_b3BmSihs}=#3NGR_G7&P7O>OlSUA>xjU z(A}iAK%z+V)mLX1c|=hj(A&+H5a4A|<~&4$vT+7bt7j_s?d@8Em!iW(US^${c7G~Y z-F$ET$!sEu0+eDLUsaw!igmO8e4}7x6g<7b<&(oq7iQr=qmVzBSqg&$i{Vxk_}2$mQC=8D((Xe;8Y(`w_ORvps88tX{v z%zq|7_{6nO0uIKO7$TA~pFgZ76MK^rc{rqYy*g|d@BMRRo>^=VAoiNaRiXh^JBR>4 zh;_Qe3r=n5VN_@OcGSim9_fQ1b~F^dK&1}Df!|6ZjO`=n81<2E_HoUc>eH5C^D1wx zn#!2TY2^cJ5(|6XCU0FJ1^KTZ!3s1FyXL>pYgUw)jc98BN9b$WiT=|nda&3q3%X4f zhnR)!VlKmL%| zo$Be`?2UzNV7*WkCfJ!WTPb6YFY=;@OxeGH-=VNVueIC&BE)hj?)1slo@uj!F`21V z0BTzR`9~Ts5R8h0`(EYiwHPM5*Ap3_1eY%*It&A(zGCJ)lcHl*01i+fqn7#T9L41ey>G_Hvr&#O`PunG972@; zNhyf%**w@N5;x$MPM6^SSLJ%`RYhcWt>7)>Ir$Tsx6{z~D*Qi;Wu5Ju9SF}S+XuBX zTr_+4RPAwk;ObWd8Ut+F59SV&qns8)M@z{(CV!r1hRR?=uN@yyi>e^rr_)7&$9^_3 z%2C>ZZ`UJWp^!ICPM2UJe zS0;UE{)}=WxCJ8i>(DRRDG}I=hu3?CO4hnN4VFU_OTc_jY@Ifj*4gcU61sEfsE~`l zh31O_*qIr?Ef-g7e3ebn<3(GU*e0RR$F}JHfStI zQI36+Vo<9RtZ6XgkEtDShOV$XQcB%1DMqn%t=QqTxa0sSODv7n4r*JN2R_ePseGGG zeT<$Mcs7E0!z;g8+@JyI(is7;7{4$sm;UP1m9M2kGXH*!b7nS=Yf7FWTyeA1B#8%> ziGI>e@9AUJs?tjbn+|ln!v5x3E1z!1hm9pd2IInX=HY+|d8U#mLJ$*#FZf2T!cr6N zi3QyOQYeYlmW&FQ|c>Z#q?%+8z&@5LXqpHw1z%-4imet}V{vqK<%L&H51|5PjS)ThCNq zxA&w((BpzW4{*tCk8k_n?p6+8%g4W@nV&W&9=b%yco1&X_+DI@(OaiF7HY1&ghj=iKcq`jT-Yu;B8p}Y2p`Gu)qUW38PQ-i)OF2j6hMUWCf3| z&?ukQsvDmM{|dg(l#K7X5+N(b{jcM5+4gYSG*bp3v1iS$%%k1mgRzk!wM8`6%QhQ+ z54rU!T#6loGRh64Qr5{abD7iqYmO2rRs5OawvLrTBokta`A>_;)UmASKX6xMm~IJ2 zl%I93U*+K+H`4-c4KzK=1J?8}UN;BzH!ANG!+2M|@7;Fdta(M9aoV~-9xkBXrlec7 ze)pr&)4=qx0P{FR_IZytQ;F^P6}Az?o=WzIE814Ma9?a%mram06|op~wXbnUa%2n> zj34+`>#kV&LEFJO!25G7$L)Rz>eZcCP4FW?^F+pq{^1zK|2t-r_0?>0o$)x!(P|U? zYRqhuXm*3mx{86%HRa=GVs*hxzN^uCj%Fnqt#U?ma-|oV%Ysg2lJIv;pQYE!xeFi( z<7!L7L3OgV`T5Hpo1~15^rGTs|4&V;G#uwl&k|2_I=bf3gOA+qqTAk@zSVm7oEJFU z!ZeP86tos`^Slg+1= z5+ST0`3@B~VOI`gjB_$#G_w4YEwyDJF1zncu6`9q&U+OGDrwzOqm{WW0 zi|Mn;OA#Ch!LwbZc6flz#Pu+Aol>8w#2)n8)p@k(i#p`Ow@9h?{=F9-PSyRgT<_;| zs4e{cc-jAv`AFqtCiht@vQ!M|ETBh3dFlouLAY`%moJt%K~xsuAV>;|5EnMQMO7{p zx60sgc))alR7QhtQt(x^mog;wfzq(mIYc&girMS|)^x9Ll(CEn@P(W(aSQA$UF457 zTHuf?@yl;szs$5t2PW|P8h1+4>MrQz;Z?8nPDS-X*wicS{EJ4IOfl63x>nm_<#zxy zCvHk_HIf?mXT#;c4)e&HV8K5k4$eA62trdq^!~*rKR)O^_?_HaiHf3m6-^aK4EhTP zrY*V~-?IBp@XSCZ=IkG;PUz4My1c6X*dWmZtp63Or4>Myigk_U;p)xg;tzc)B*pb`DC0Z{zGXiTiA zJ~9lNrHrmW7iV8)UcZ>TF&VjCtmkV=d?;}7MUyLKg=_u?Fry?b{{%gDQ@K0}@J-ZR zHO9w}<}7zw_?M61y4HlA%EJ~hztHqkACM~)1fC1eHgAZH#tTLx{L!k=E4-(G!fI)N ze^^Vp_+4*9f&}15^+S{pnCmvrdYnb zg4(^x2>*3YSAAU`WNX<601 z@4=KlWWHXKn#vF#)DmFYDB$-dQHn}UyB06<7qd!3l{cBA(uiHV*nm>ovoNsEga(VL z;g5d^LejB%n|g`Ld5S!>-#uB8^URtgL&94shuZr4i{R1h6S~!0Sz6nutLSI;nXcE9 zeUN*TH_kYi6&A7K2{JstG+XQJJPKy5#-F{#->Uz)+~ccrmJ3tULRenA^TVnIQL`z? z&Ms!(Tnsz4jH`%@NZI5+9 zTTdF-44l%_=e`)!yD?{1Tkb|TuZKw4lyr@U=L*&ek)xoXq#$k)ZbEK;v!wi3Y-&Uz zd_ zR;IGrM*3rU5`!JCz$GF6{;FfsCZwR`zrnQz3CqP0wT|HauqU*O!3US z8a7WJ=j)wbcJb-%rRB0$$$uuloO@C3J=@co2%XY;52HM`? zScSB#fNN!|c0B0b{=`NW0V=KLUNrcfPs@b9i-z4;Y3T01HOd%dw)0GV`;N zxG0)o#NMbsUo`yQzavD*+O`jcc=*hFCW8K72E%6D5bT7z zQB>9D*=}^q5c4#q>}o~o&%f_Di_;JTbIs2}8 zIE)4BmAK04*_1rSh>}MvmhYOObcwvKvxZF6C*LypJu8`k%cpxI{57B!Zn@d2igo0u z9%pn_im^fTsuzANN$KgvhW2lny2=8d(ZOi4TK2_?hRCx?-iNRTVD`he z6Hh*O*O$5ZdrFwoLXoDF%&Y^(7}O?4%Y$DW@X`(!Fn+71Rj{GF;^_YfOB=2bUaRjV z_x2>Lf*qX6n+{M4E$QxWjyZpNflLS?s55l$rJ zA=^f20hUuIK=!EwBiP!n;*}OF;v=ls)1q_g1{KN%w21V?YXkXmFgbz->wU$9?E#U) z8J?)`)kps`3qTI&v0N|1>k5{)CS$NUgq*j&k&gNwd@qwBrToVcqTsh$2P&`76~RU5 zgUnW6aJHN#Ojzv`{jzL?3tUbTP`2ObLJnSpCx5tLz393Q-7nE8j%RC9kEaO1;)R?j zsbifjH|ehQUJp=zy2=mj62LQ-orNBrT0bQgxQ)YwMMfJ_{paUxb(IPML!&`N7jEG3 zp+hK=?Zn~iA?KIIz;-uR9n_0&$&6Y_($Pfjp~;NkFlf6f!Lh15V-@T9TT$huVg?7l*k5DmYw{+-&-5 zM~+)Ea?;j?&!?~AUUW9Vqt_T*)?5Z-y6VF_Gg|!PQT;pxWDOL}Qs7MekKS5n_Sfhg zGR*$fD12V{7fbL)F>}(DsWgc0o1I7yM<_y{nF`n4`D;=e$?58|>wkd8bp>G~9eION zS*@|`=kYF!*|NVew>#NBVTHCQIQtFmEA7*t=(Vb%)|KysH=d6tJ-~tmimk-`H$)-W zvzW1efz5eI-)C(1I*GzOa#E}G-5qiv%$!X6q}DHNt5tUreneH%@kd@-WElb;coILU zw&kn8_iy+rdfwy1eXZt1xn3SY6$wbND;rwdWp_68$9VsDm8iPGI5qhFExpV534!xk zST$eT)#GbM;6DeS-FjtFhaXgvjNLuZXR355H(9$!TC_%)Y>qErg1cYSUvQW4bV^Gz zrwJm!{>wxZhU$a%O>>@ZAXycTxY zJ!EIH;G@-Ji<33qBno;*9}0YNULZQUx7oHS8sT%F+!aT*pKVdxEouv?k{|g z5>D?Hen67P{q0xu#5MpV5;f09%JP#fvyi7ij5V0O7phisob(kNBr_B?TM;Th-p0*J z5cnj5XrqQcpi#l;S*g&w>M!57Sy6gBJ>N*oA{(ZtP0fjt1D4lG1T-7E$rE@#ivqbx zJFE)kMHAf*deu10Cgl0O?+`Q%q*xsC&4plXKf~uBLWb<64-#OpB>U>Xnh@mB~ShLGN*J4m7tVN}qZ5fP=H!y8gX z?}z5_RhIv4A&5vZJx}$n$PgNk2@`T>k(lZ`5YiGHht0b*hFp4Djyjlj-%Dq=anu z%U0*TXwPx=2r74&rqCl4;|Rgd&f1^S!4%(W!E9i;4&+`d!Z#y4#qF%wz;~ZRBqR@DiV6 z8DC-8M1njY5{&%qd|ey^hjEE_P}&kpBVUMyhv#&50iO$vf6_Ut8ST-6XeIr>5i#H)FX!VZO-nYOtysz25>E6mp_8RD@}%SNuPLXY3=fnKZwy5ghi-auGj=Za^E7d3Oeju&kii$hy;NXzG=jCjUNEK^&+YFJHn6U} zbyMC)zX^mmBnRz8LdWSiMq5LYEe{kVq#3cT*qHBc$Lno2xsHO4C1Oh|<%h%2zn}!H zyERc-xr;OD>?Bf0)=?_@XU#mjDY2PhSoh~|;|g=*R_y>I9%9RQw!axQ5`qchH`%Px zks`X>>;E)E=*#y9(}`|*+aiQ4WxmjWtTP2G=`%!be)sTdo}p^>B0<>!~msOcOU?q?{c)8E|Me$MFCZs zMp!MWFS6bFU?%psH%8ocP~9kfNDO*SlWt?4CbEvS=J3CTUI&oy=06SJrn3n?Pz=yQ zI*;5{A?=VPXXaZkucd*nPByJOYFkzc6!5DpSsqb#j$ndzB(?a*==K>WztraLi(~pN z+5ih)*3A|ghE@HNk4rLZS%fo8D`J#Ji&Htc+pI?}C$*IM(NntcC7oZ={fGqV)H5Ks@^~T*~r<)7H*-%Y(pGAo=WenJd9O%(cVBP zKus5+8+{y<(s$!TZ9vndXZftuEA|T>pmK zYqyzRjOI;q7}XP9VTWb>PBe!j`VyX};`|m99KOYJ58vbY)5FzI8i^S_TRrm+-Oir9 zO>}l|96f3d{0MzUrdZ#8nDb%%1gQ|S?03p4qF^^QZ`_eXF}@R{XAX{Ra{Ii2cpVZe z7bn@R|5=@n-vACiFOvLg!y_qXWhv4DzLlr6nn?Ua6gmJKiquFbK@{9IO4NCbb`5RY zM--lK@OpWR$LpEh%IXq1TR4Z7e=E1S?b;@r#Go?ufNo+dR!w3%LhNq&Ju; zZ!Cq24*d8{K7%Z6XE5qri6-R8(HxB0o!74dTRNW1P_i=?Gr;ST@;0iRSkkwg>&`oh z+|r4}YfC=8 z0OeOM{neO4$Mx7DdmqLxcr6i#zN0KO2;A#==jV4H5O$egvV0~lGVSQB2t5l4HCmvN zvjotD_pqk>COwIo87!m^CC28m%|2%V0JF`{lQK|i zwGQINfp?+grZ8k7WbQ}3tQ3Ms(Q5F{!mP|@b;itIwbk0C(fk?j?LNjvKfSa*A#UrM zLn1W~p~o(3`_(ARh=Sikt31()^c?=R@pwsF?cpd!sQTie! zis&`{edFEJ8OU6-p{s~=p0__8WF1+v)cOg|9ZA1Ro0w*4b(p(8K1AvZv_Acv;MXYR zkm)Nuv?a>td6Owr|>=M9a7-pYRI#Bb{(8#Cj?K1f2!-fp1Z<9vLVs4wdmJKjy7_mN%uX$Q3xw%q5P$4xOqM(r*M z2b3ny9=o(I*P3dc?p#M<52lOKG^TJZsGL1(&Oq@^CiMaJ+}hT~>pQ;*+S3ee@XxS(t7wYULsg9X!M4obwR9wI&Vg#=zeIe}Xa`*H1g z=k>IVg~zyHMiBQ|g{8&{XS^X+QX=`6IutZSxz4}_NwB@Tp6K^enl@V!k(d%TwDn!BR@R zy|A*Vl&bQL&lDk9Sb)xd{zsFh4iNEZ-tfhSaU4`yZ z#-Pr};#pX2=q}_e%qNg11V^8Y3HTxFehAqez`RLVkjt3+4wZUVr^fO*?KPM5)!ahA zF6P}&J6Xp-5*AQC#;q}#nChHhGaZlSVMgT|(%P?b%NQWwwDg(ShCntYdN|ZdJNWpV z8xEZ45zfSgeyLoefi#ind%c0sx5Msydn6bWO)=&2TOW4pImhQ?U-|J3oq_2y5Sk-_ z3cqv1VO;zGuUA3id1=OT#muxgvK)fi`Az>PQb!H;Sq5RU*;k2g^vs%@t96F6X?5OGfBd>4JfhplR_;!byBVM<9HPQc&G~yz(p1O}XY;0!=0lUS;(21UnNW-VB9r z9K12YGb?!AJ{5I_cXUky4Xj&!<^?#mXmLK9;`S2q<0G?r2@O6m&}=$SIfX?f{Q4%e zi`))Z#n-`ksFI?K+rBtOc9`Ggu_L7KW$UR9;97~cQ6t_EmZF~~dpoXP4O{dG>Dpqo zYTW!P#7!5@+Pw*ZFt;{N#Sm!QPP1~Ov8emn?|moq@nIFoN@TYBQm=f91hbs5NyS0` zkx~3*8{4n_x1zV$5x3{akE-`M4Jone?Z(F!zMyZZAm+Vy=41GlOoU|qdSo61Ed6=wYVFH%5Uu9iFPHqoO#X z%0GKZUS_1q0+u*3N~Uo`TzZ zRX&iekzQ27HsESg!hz1r?F28w%I7=u+5<1dw`y|9Wc#NpeW(=EEkT(T9{0%6RohhE zZNK2o{K!J8KR|Jhe(#TVHtzq?A3{sisO~{N(4|w6ZmKrk+34!ASwqWZ-||^l2&He^d-7>?Omez}@S zBp~gs#Ia?WxD^4XHxD3uH|xg~8@C4?JvI#1gohP~JL?@+qh2Zdu0-BrCmdvkE zqw*e#Ir>q`nkO@onGi7O7rgFj*4rm<>9~p;YOSG&hjXoo|35hr{sX=(18cxLaXk-Q zfor97l<3pB)7Qe$kUt<<^>b}lb7P2Q z&fwU`gr`H|{JvBswo#6D?lFEEvgnmri6@awr1|^~P)UC;)Y*>l_}f5%zYw7}DOB;x z)7PLG?LVp9mwEOr*wJ5@Cka$1kl(K-G}o}`)#wp_{lWl?j?cE&Xg>eSXtWb^ z5o3I6tqT^Np5<^GlRmh8096Y-7P>1}L{a$KF)JOiM{`*?F&L`I8BN5?jqA2jy=Egt zR~yR=1p7>?-SzX41hc=7;69U+tE2vV(1t_x7>QV4ze7d}h7kN%ew9_ul4H|x%W z0RO+&6&neJMw7~09acvP!e!yVT=TsD$;KmkEu|iOiFk^<5`XwE_**J1Le|2}6{-Ou z>2R?h_8?OVC*USkWW!eBa=%oY@|yL%)QbrNC3)$4(+UkTN~MChY#_wd?rTa=5W-Mm zRpe+ow59h&_0dB(3(ue2?Vrd!{;%Tx2iJ!;Jl5NVkDTI7ieY%fv*H@Dw zvWSJ_MJho4)0eao0gB*H_K_Dz;jGN0q~B18G^p#2IDg3WK7e#qH|$=Z^&A@iGsJxD zpw1UA*zCebgVgc+p^g377p{*0x4$UdDg(?-%%Rn%+TAm17+Ydr=GVv|n%xke=2{fp zCDwBirI-W!=xCAmeR{|4=8^k=!S}t{`iv{TJ!{Q;*y!km>m=z7(w(C)NG4UfBd9h^k{d1+rVRg#Pw@^AWn`gdfET z&^TDC_byd$Q3=6jD4qBEur-hnB=d@hjvFz;*g_Uy+r>FhYW5+tTz<_2lsVhisf-zj z@p!lyK~}@s8%ooBUBs(k;TPvZD|%f|(i99^R{DRo%lT7h?sWk5Y2dgn)PAI>-8BAa zDH0eD8sWa}Knf~b`{%XX&JN$-P^!x>I9rj(Jl3!4yl4rprUj0S8r|VjGP6ER(a)OZ z)|)*9Gl-huhmW#FkL9b?>MH5{lu9ekF|2Ti(gDgvZ6}#u#;aHyX_X3OO7@T` zJnn041=NEN)I$!M6M!v-fA3wfy}dBr%Ib{~&Rbe1r13I1w_Gni{^h-%bxCa|1j;2B z>xPeB;1cVjZV|ojY^4@UIZHLlLbO_4#GVuReh%rjdCK`rn?_>2doSZ_hxL>D4poI3 zAJDAH?ecW*$WUXow$8c}hm!|bq27uXJIleCA>UDV$18BuH2BNo{z<$+_OQ%d;bsv> z|Cdwl+sJJ~qNI;Qz!zkri%0jfz|15AD?c9C^+-B0(z; zM;7Nv8%>=sA?T?&oWMkvl?BaH9zsV?<`3KpS4I?f)bGBm{bsbEtC*esN`xU~ z=MQVao#Q_1+j7Se;#LzLq3m!Cgu=gFH=VkeKm2u0Uco&uUQtq?BL8*4Wm*0HK+lZX zF>dx_V~Be?pGLo~XI?(NoL23 z^lE{ZE5dYSyc);Dsl82QBVv)BjpN#Pk6&NvT#U5&T7i`gjnwLssk?+>c^9_&N*pr0sfXNWpT>C~P~t}|BjP@L#m1*Q zN^XC2x^k!3vl6)a?Dj|LPQYn1;q-=@ zkPQv*f)xCaJ$SZ9DS$-BS!3U<;f5o9Dth#AIMn{`Y;qH8YcqB`it6k`pty2t8hz9g zZ8eGx%VW~=*wgi@R6*tb!Vbr7WB9Zu@iqwBXx}r#;y!|>lQ@Kw(SS_xP52kw5UKBU z4=vUH;&IEJ#NMC<*E){KKpQ32d>3Nd{&mp)=a?Qt<<-v>2B@O3#`Y6AI!1Ikslj|U z%Y%mVXY#{1ELW*JRlK2Hz2_zoNkf_eClJCUw~ZZp8<6XG-@8M*<(_;o0}-p#`>SHR ze1`q3{nz+Pe`RPpOMjgE*CxX5>d8Fkp_IRJ&5@(RHW3(@%n-IS;&#UOh88thq)Aww zxxsL7T85DzL0)HV2lYV9B154qy*HKYPt8=YbvL-;nA-wJ;z^T3rB+ z@>yp3B7m+V6WF=0c{~Cg_{M^M1mF?zj2k~6veYY98M3f$6(P5{`iW2rR&4wpxZB^c z^L$z(K>aveu-SFRU_TaX-=MkT_Yq~Hbacj=FZ|Xn$S_clxX~ zX0ZFSshUBgASaO70-fOz>J$=E|0$csGYDJ$3*#FSAY^p^)GZydY!ZljS*3CL5&zLv z-0Tk}Y7mP2>nOojsiP~>NOncCOX}3=ml>*kE>SS|%@j2uf~4>5THL3W_vtiOvYK&< z1p#tmp;lSkz;m^qwM}@6Tx%<3O%;Fi$KpPR`;SdG*KwhKLws0@3uF9jD`GOdOg_emq(x48g|Cg zdF@3irl?NBJu8P7m(PAwPGxfHUX{7bJ0b7wHyIt%dv2fo*mg`}_wj~Gke9BU={d}i zake8-JfhqKp;eXw>1Lvm`&bV|y+$c_obm!_Tr}aGKGOT>ZD-*)MLcJyGtA}hnOh`L zc?)KMq6^q?paL0Ya6`Jgx{MnBs<`hJVK;}~_|)|se!j{6wn2MPLT*oLcOB;?FYXpztj$u=EzRYU zxnI;dFK))WJ@mMKq&dX0KMdyXsMDNN*W%I~=B-X77*(H5!q3>YjG;uma1yH*b5mbpSH?Y73{lQ{qc)69q$G(o_DWrgp zhwHk9zF)OuY~(sbj|tX+Dc^JE4SLt6FItJp1+NI;ElNLc_Fwbj-W|Awl!&XRtP5S5 zwJvUS$TJNWWxeH2_`z)=soG>d`*Ep8GpV!`pjJ@nK=l^w*R?6yvLK?{aa9W6^BqR@ z5o3?>D6gUMU1gT{*DFbUvTY)3a_+BgH-y~hl^8q4y4v&woTtRKFWdL-VAiMW1#TS7 zLz9s|>%Mi#@1Mtd1%pxyX&D&eLPA2$byljXQpn+T*gizQ`O8+S0Haoneb`)+DYs1~ zG{z|0lhM>2+wF?ul}SglYPnGU-1e5I)KIlThsb4dov{^ph2k5`e{5*fzxjUW^X0a; z|3n3R1d6ZukmphQ+jV=s+wr!&G`2Zf9*wO8K&Jh7sIfU^SZ^io#q^;h@X5f{`iD4#BA& zd(L@{YJxjF{Pb!XEu)%^qWFgdxd31iW&)-RnWtNwQNQ#7lS5XiT9pRYN9nY=1`=@8 zC~#?xr1EdPPzS=r`Q2`&AH{74 zk$V9e(-kEp2?5H!t-QANTCX{0kYm#lQFD$ujA~w&uJ!fpBI1~(^}TJ^(cYuzSmhM_-XS-5Wqw`xyZ9`)NJM#*~n-~qD1Kt@+E^alUM_YDx15X=< ztR-V893g$-u0uDIK(C`5C&NDp;Oy(D-y#NsTf}zf-mLoFqD{N?9g^z;9y`@^o{WKJ z-RDbDIXhL<8FA%n&BL13ZRG16clg|oL2Wy`2`^;i;>Y1h`G$V-bZv{fTqKOm0k7qU zY3b+^l9PGloHi4_llQLsT6SIWch=yBI^60@Nk!d@Tg!0T|5JDTqhIs@AM}tTNK%Jq zRIIJUTAF+~+|109Hb8Pef7WfH%17?DfdN*(nVJQjx#F1auWg?Hp{9GcMnOnQw4EQy)1#q zFFl+R@#yHt_;A*Y)ovCEvL%y~=kZ{t9Tt0d`5tF*GR--byxp$QvSH21hZpCsihc<4#%=jXB}4wC$t2H%YKaF7M

oY1hwrTSo!yc~{FKSo__wT+w=LVbsOqFq%T@MylG~Bj%Vibl}RvV!$FaPVV&j zmxO7SgdZREC6}8nSB1rWJ8<2FSCxJ-8Ek%e>rt!t_((2wWnQncpA)*${~!=h$HpmF zAxN&!PW(sF@);~JZKU(Gzmf|UAV%WU$=ESu)lC7->EKxJR}bZd4g}xYLxoLMO;)#_ z@j@x&JXupjT5qai90ZyV+D0E08*a|@*yU#?^eALJ$2bLRtmIL77c-6AnC$wP)8-T@ z+?>lAOaya=YUu;!@-IBrZ(M5u&vJm|YRjQBQUh`-X#vB|@jX2bqooiK0I+C4e|EOg zWRR56H@LWmL1q}P!U)o8&R1mRKf|bFI|D5MQE$Vd!_+iwA1plv70+AD&-C)Kl<(0q zBwj1TGh4@qI`XNQv>LSm-8vdUOKK;8w$bIA^p*XYop$+<&Ffz&;dA-7|F;>B`J8g< z+3+$o{uvDt1bs(SppiC^*Na}Lfolo58KeXRxVcz`lTiA;Y{jmdn3yjwH z7yO2Wg(Y1D-q6qr%MoU49^`zm&?cI1scW7uL$a99KU$;c(6aY!J7BwHml971PJyP1 zswA~98MVrx&)IU{(>R^jdgKCl0$-chIsA+aVVUA2i7_RBca7b<0#jKXJ+u?SaP^Dx zLX%UfMN#8TkOWCE0GJgLf{eEUlO~!iTy-M39HIZ#Kzto4O*Uci=oP94P7KNp>}>Vm zOIB`k!NcT}kGvHlccxc(>a)`I6KYAs93dGw2cMC3wzqp90^JlyYQD(Q3|B(=lmRanrUxu@tZcwvzP8nOGPmqngL& z-f~Fcs7q8}_ZTU9joEHHnSgknn;`Y=Cmy9~Q>GgEH9S)9lCWB=toK(cLvP0x4z*k> zE>9?QXEc#h@=pp)?IVsDOj-kQLZHyZNYnexheUAcPi19Hd2vzU3J#?9oVg>ET>K}n z3Wgn4-H(zc#8g+bwQXa2z?dSQg%ZW@7pCr*4~Q2*Z`UBn8Yz7uGQStu;4d$<30B;< zjBC_WV9AJKLV*4m=PTGx)f~5UfnKomLW_0w{^Eb0{pwbz1<$!M%(nm)q67Y6?Ig*JnNDp@ zJE-Y9U%PFy|LC$7vN{YIL0ruqJ%wTNzSJuGs>rJCC*w2jh$ z*PH?-KU%|7^LL-f>Tu`9!_{=sbJ=)j+k2lfYgnf0fmBOEAcGqd0;wve-(HHd+AkGj zPe0fTbYIv;1$?@E#CVoIWXZU`x1LaI>cK|kkO+rMcuw#fna&8!)n|xktGFR{)wF)c zeJ^#RWA!X`;U4C)at~hb4;>l%)Dz$mg0;l*7Ks`1a@re5<3Wt$OYg+?HilytN zMB0w2>*a*WyS8w+jK(%7kf3HH-uSR({z|CN$9_JI{M6zh8aiiKe2VR@joYKwJ!0()dd zjZjd&6>t-oa}o+2*sWwCT9#tTd^L)r2L0QlI<1Kr38pb!RJ2Z7=|&g{P=RI6{0z1& z4HkkU(~^{$P>_Y~W20>f1<|AB_`EovU1x6>Ol{@c&g8_Pk}`hlv2s)f*zT+7+5wL* zV`J1YUEoe8jaquFFIQf&kTrO66784-a)w-&MdT)NtF13^MvP4y(MQZpsuR@3<>Fcx zn%ZvFjSU$HSp!Pi6tn``nLN`?jsTW?mlvG2x{JNW^IU0tRm=UXyt+O8M`anH@IDD- zH{C6kHWWaG1g}7PgAlJyYg?aB_|P`s^7iuT6$>>a7mv9<;H|ydKQcOR`ADd5`s9)( zXIjNjezu>?d+dI(4dhL0zVqpWsXw{8BB#%N%t2Tt{G~SzR6gVz6G>C?!ji zO!OHW=&xJeQAt@n+^{4ndvbjBq0BW-t(-*Wm?ZE|jr{jC-l6mD*7cJEE0IZ{1H}ge z*U$sUUvB)%oB<77DUD3`VDL)P>Wa&Yi@UY80GRkB_f9}QIy@n%tgnhCrQ}mjNQ3{! zD*D%^MfZ&3kgz3WEOjlsGVASJEcg5J>4XI)xOojewUz?vZZBDDxBCXh@^1yeR6|^h zH39~ifWAHBi_!6g%4^r7l<>al<*gLd9V#}0*?iDZ>uST;z)A{uK#YJ>$5bE^m}cFB z+Gk`-@~5@qKrRBG@)R{`jI#U^qUAKHeqsN6bby^`rybxi3nuo!Op%x!X?4{knP^~} zPh#v?RNoLLz!s{8J0s)cG_&+Tv5rywQE8>>F^IakQG&n&3m@$q?0WD>L z4B9VvruRHKGFDZRShk#Oz1ABz%`pYfw3-KbTsd?vUwOz}Otzn<>Tyl1S+;nX6sCnt zSY$z-eC-F{a}q&)Tn~-ow^JxLhhZ;QG*Q={y)^x+i^I!=EX&bNzP4G!EIhzvt%L7V zD$UMiA5pz@*I&NX8kJv>{lgsozjqeh5iH&Jf#s$*@k6&mv)3%Sl-3Ipmi-j}@4x($ zm5oQA)Gka>{W8MneA#>$@5%Q^;y;78e?)QrbEmTC)8erc+HzCbksJJG{*BP)^?!>R z|Mt)l9~SXge=ntfcgGfMl_wFNBKdEx`)?;Li(xrCi2PCxd54ZZ|F7PP55cnjLpO3= z6f@tptq5}b0D(Nle>#@`&kelCQaVjiNLRmGyJ>s0v9q5C2NHyE4g7DUFesNvb8IsL z5CI^4$Yp0*Y!Y#!rDKTyqYhe?UKEaXApie7_CJ66MF}G&sl_6-D9vuD-&yaLAZ<2@ z--58hEQm|q%lMa|{J-_ke;jrOP*pCSzP3Nmb1O&@lS-fKN+M-D>aX$q-~N^26HQP= zyX+6Zay4>Y5^Asz6+G9;1bRip-}vvpgu}mK+a+NU+a+Umwf-y4{YPN;cRTapZ!r9h z`a$6T8rJ+z1^dUDbN|nkO9H+&9_=z;>p2eo%=^IX87@%Y)&-YYE8g>mM0ktolK)w% zAvnBSs!L)5{Od+!)*)clsgU*uBapJFX=x=U8WopWEYh=(Z3e7r%7h4Xvq-P*Zl+c+ zfOE3DVXFK9A|ld<*9C=z;h99}{yaLmZRrLNG-2$j;90NAkzq;%HZ)VU>|w zqMar$&-jN9SOuF=i$0LZHE1-EMM>JhSzlXQyOPU`#9qnFkXpx9(Yy8H+0?F=Nn$un zp*4fecE5s`;({IHcIv7RGN&6JJ%yk1{ULGyNmNpRQC*Q?9r}a>nNY+K5wr>vi1yqN z-0PVzdeIGw?I{QTj950!rPpbe2B)wq+^5|%KAyI-{3w$Wc~p74s;C$udEsZg%K}{_ zsLsj!l*^Tn#s1gd_g(hCTP+QNT8`=Lui4d=l?UUELm9F$DOPuBvd>1vmi&4p=fH0o zN4}^6(Nh)e#nlXXt)&!C+(ipY5=V}KoBhd!Vld;0dDLsN?-n!*rCR2aCEaey@F1&= zaMeFBTqMF5HC!F7=;~)C0=vF0rUW7ee+_GLFs^&NodZJBm~M3qQ7X+G6hWN$HA1HZ z9pCCtv_IWX2?zo>u@?Ksy`OjA=k|0awz;mBX)^jc*qsiB)3}4zyF&-=#psf%t z(j}fCFiY8?7;yj;ACEa42Bh2BckW<-KbsYa5VVOz$qE*RAJBal&}TY&L^eXfEi$b5 z@M*n~$Wr~keYk&fsON!3v#f=ILDp0oAsTfIyy#PPT+j=5IGk1V;u&eXeUf2(?s}2R z5b($qcgFY(4fNY^9{(!W?y-kzyf~Sqf4lKY2;*S7`FY7Sqs_-!d#yi-LKFrw>FaU( zNW*WLsMFaL=n^_~m%!e5;`wCvn)|2zK6vWEijMYp(jr<-#-GT?KiTFw4~;WUEZNeM zZ$T+8D4fW*&sDaNiA)Qa6?<6T$E;uBC+f@||0~)$n2IPPqg|MBwWER1qw^cB;w4Yo zL?obPWVj^)sfGB{+YbZ7)t}8&i?=tXb1X9+Pp+F-ORe2#r}nYT@!1I#i^G|jj_ty9 z-x(ZDk{uxM9_xvAv7wG(Z&qE-vV9PD|JR1!`}$kvFaF*~VLwsVf;>2hkoZIU!*s6; zEGXnzHyWb@n5Yl~hhHUO&xz?o#yb9INXieG;cdFy^o9lg_pJ*v}LX z>`~Y^i00opkT2DKY8O-q#Gnc$k)Q+Iju$oWuS;X=%`qrh0q>_Q$$C&aovB8nq6`Hw zii%?3Mv8aS3j`4$Ik$M3XWG7e0+l7_?{G=%&(dP8gHsF_J`Q4$70Fa zq>Uf1@?4D$;iqLXG#g(k8DK~#;1kM9qY}VR$^vOM^c3XqsDHk+pd5Ze_r4qL-0Q1i zGd|t=vgE9$3-p4x1221)AbDx7LkR)bNFR2?51uCW+wzhBrP;*+b(%Q${%LL(ll&F; z%g*Lz6$;tSnTUlab{CcZ`n+gkx%ZlWX#|B}Rrg_g^o&>kkVDU&wTLdNt`_#ZZ7IoX zF4l0pKEy*0QhnYk*c_bF7jce%$37KA6i6V_#er?cY5|@$=RWG6vKwV=+hLc3=;P=J zz)6)CC%XcV>+q&Ks+Hvh9U?JRREPYX<)Y7sT4di}oltNfUmy6bf0Qdsa~`pP^d`c6 zO<^A<6yQ`ZU#zH*49wOmP(o~Zz-B0kwm2msU*PBG9~M4j6ojt8Hr=GGNPDfFz_)Nn z=Y0IoMDhak30o{GYZY+ITXmiYoYnzR@Y_|qO|I3XG=1CwG#w3RRgaL$p>bj#Uy1l! zm4WsKjc?_n+Zt$Na7^iAc)@C<`^2^WVT(-_u}6(Hdlivq>wFr-?!a_OQ+{D=!}9W& z3_`ANj8F6B)AIZ3+6mF7;8fb%c3uUPNu%v`-DGlzPWbB8O84u$!)lMbBta_2zY@!v z52f%hdU=xvxWP+cRfxqJ*a~0gk-@)2HGu79|T=tOeAj@v>HV*RFGYJe>K%w z>oUI9F+%-7O7Su3BjIF6#;X0@NQ!FeQS`mG<^tCbM`S- ziQ{51OIvCY&*cxmuyU7)4}*1hJWo3>yq&Dhl|grA|2+!9s%FH?_AhSR0eQRUg+Q4q zsu!MGrl_P#_PcrG<`%`6Fg#USMgHhCY7!nbXY8BEHBT;$^0fv~s_PCK|9EY9>=9m` zjN|@>^%+o;n6N{Q_^D5)dLM;9Ph}r+ZjZ5>eYBo%a<4p08+e8$fRyG?if6AnR7|`J zIlYFL0*&u(HY)Qae3B@r{@XF%Uru)3Q~e$&1H|W17U5EyAtE6eFG1p(?avjV(?M;y z9xZkro?6p7v=DD<(__V1OI+#(6x73+zfwfqqfS-CHHPF`30X z)Po8pf5i@=@XpB+dnt{Y0uEim-0xlXNFyFatBXZ5E>+dF(9oUwl0Wv?!(AMAXtmVp zg~$FU7r<&K)`$9As>6%ynBv_@Z3mppc>NW}gtUedgcd|q6=Sbus2dM7;N|4rbKab0m}$a2!$vCUS_;S;)@-D~k4zv=yyW9oG#yae1Q+S%sHh+8Tme749l$G`b zVu^cw$vv?L0-T_euTP>boV>>M>5dW?e~ zxK7CJ{QBjk<=r*ZbKf_w4wV@dCe&#&7&IuK+SHwJJf)3d&*uKEwc#@1y;B3iM zLRxd}r%T_i;Czmlj4=AKg)YCwv*U}1-4ls*e8=iDwMT%yt)$V@(KGz+H5WK;UqT1Z z()Re*74_q(A{$9J&S-+p^OSu#u#|V1jabyXklRtW{;`U+@#Q*x}lNW%T8(N zWse~TnFfgy<@g*0Ui!%GsUJ71R>oxk0fO-qtK5BD?Uc4JKm=yu?2ToGlq7B6wYc%7 zUEQ3gu`w`mDJnI&Vg|}ycdY~gY=^3oHwE*kUfk!m1BB5lrISY0i-Tv0DeYE?wngJD ze3YCu^QpBX9E`l%y-JLaz;XIGX1qb&i}>&ACSH?JK05yE0C5r#R-l2%Pg29bH;zg& z@@iR6Y(T`UG<#g5eXCKLAE+eHy-U%wQ>?k`kE0X24dSH|O=1T|6S{ABl5MK~)Fy}) z1UNKooa>A15)|lsX;{@F2aL!V9o8n<%{wb3?5BH4WymecIrq#3Y`^jsXUFtS<(4>@ zYD5V%R5Zbo8ITGE5qS;rn_(UHE`|$J>{XJVSMt}#4!!*Ol-|eXHf7Gey|=Ja+U7cZ zpu0q7*+uu|OQaRiN`UD-)F{1AT=?=}!8E9rZdThf4{}jze89b-Hu3KL&%rS!uP+0~ z9e}T=HLc2mKFtKyRaA&QS_}k*Z&k~tdo{~We^`FhDUxu@?yxid8M*mKfln9h-nhg( zWpUZv9bn7KD!KX_PwX_ld9x<;!j{mYz^*L-3mLLHaT`_U>WI)n8ZH;?`Tcx!=rnCP zKs&Jc6DCMHY&aQXn4hukf7R_8{6e_s)X99bv!W{XFa*cR_gYT!WZb^63iU&~WT=;_ zEk!f=QaxKz(_STI-Q?@I~`W4Y}e8`9!G^HqwzrUD*koBWU|6sCYhyl>7k>M3Ba~d)bX=D#M<9_}0{IWAs+Tp1 zhm&rtCi?vke$K1$f&L-?1}{>KdF%A9R_Qfy{3n~7Nt!q97qc} zo&SjU?Zmm5W`-z?lJz-8tU9|`XW63r(}1VX)I-c3?M{CVKMSucv(wrIx9Ns{?H*G3 zTex6lz8IFDs%TC^PBUvD*19hg;kIFgOc*BgQ~QMRAJR2n>w-#}<`>lM`L)vh6K>)k z(;xqBr&0&uk9dJYvq9SX%AFz8%l#p;j#lA}x_sW|+FpCo%AUkmF0=%YU^>l=>FA_i zB$YR(viiVCo#?_U5XtDww}Z0bWp{$ra&cTgkfi*&^IZqMVA~cp-sNi$caP;qE`Yw)OAC8z|B~d~;`VpE zC+t1X8LHt}rczoV+>8!DU=8!lB|s1T3b|Sno2xc(EF1pJy@%$duo+Z!u9*DQu|3Sw zxGL4QQ)LtCcEYi#s;)v4*E~|5CSZ8psr_IUT_Gvn&W~X=t>C=s;jw;dx8#*SIFmy? zV&HMQIh_0+x^AJg3r}7kW1KM^`J*S1=+&7sp`KDV2yn;{<6TFMYW|@7$-~5Vd$#-{ zi+P|zD4os937PON))xtw>Oj#;8Tc>ud?9(^{MZVb846@y%a^;MS^ zGiu#Ndbb(f32E<2c)eDrl~1LUQJwQYaxpuWU3!L??xr5;B7UqYK^w?+QlyfTKxNxQ z`qys45)G!T-WTlyAqBrp?XLZ$i3R$H=={ED-x8Iwc)E&amGXzRIrHzNOl^S85_YO*-I`1GZuX&1f0Qju&Dma7G9X zmV6M#TkNpF%~in&Ula=dL5;kLFz#D_Let@D*X({7Da7hhGHy2%%scWfqy3A7)=e@Y zpFwo21OX!Xp{7uvfaT;TZMYgC`67fFpaC2qkPjKkYtOYoV$SLWIh+FJPTg6zy z8OgFL_~}eG31o^NpsivQ$iU=T%wUIDq6R)=0UJ3vmuxl8h# zJ;(%tew5tnG%KAKZu0Lw5`Yun1>9A}*BdGx@2|9tOVY6*3uh;cJrzK)0BzczZ-B(9F$k_!e<@TV0i;}&%FykG^2Zv$g$c^%X|R;==w2LGG+0P)PhXs0p`;Xz=m z-h!%fsrW>Haaq}ip|0EYm+#^cuJXi>w>@M+YHEc;xC~MssxyD}C2-70Kw&}U`QP@{ zH8eiIg51sSONHbp<_=KW4MF@r1d^F0!S0s~MMXvN7GBp%OZF3M*FeWUeH_xSe%dj~ z=ZE036cjBYr}$kqUu1p5V0OYyV1Ja$4QaG*Q;=ATFadj4%S-1tWXz*}GR>RlU8wK~ z%3*JmWG~x;=hIl)PN8kHZ)KK%*7)Q}^9X#x88uTIzg+&PHZ4|j%o)4{a&)@~&k&<# zZA{k_51j6?Ng5g|s8ICr3$RE^z5pd6I1(^EM$kR36fC+VUYAq2> zkG;*cf{)R}X~T0|%~Yc$GR8@(_bX(qMk(d4Wn|Pe3&ag+nDLke7^%q3Es$7pr&zG| z%E-|$fH z&Ddrgk)N1@$2Cs9JJ&gc^*Q`e($#{Pm6fquC(bM(R zoM-27Y0{Ymm5BW?1$R?!s=ES4Msn3+zTJ%W?)3{9piWG?Ij=sjTK++Up63MXFOZfa zkw%gBrrH)M@_fQSE)7G^jXcb`7gpE)Nw>~(;IL$RwzeB6*h+JB+BJA@?}|)<+J^4M z@%HY|hGQ}Yx#DI$w`+}P{pJE0h5 zW!h^BFn09#np`J3&^uM=WcjNsB25{MWV3SRQ{OSO^XN)HD|duP_{ye-zgHQ`r~G{T zQi(TDT^yNuIy5I&Jl`!(e`(5&;&_hf`6K-=j9u*)Zc!9W3agejQti8`1G7W!3V8!o9sx;Fsns`BA;p zk?i*lX~-DU;qFVw4hgyd?`fmRSCcE8j>kIpm;b}qcSpmyu5a%|5=2W8gdhn)HX(@7 zM-VMqMD*T!?+lV?NtDsssL^{FCE5tW=tLWJl)>nu4@UXkbJq7;-~R3Mt#$UFv(~Jc z_kG%Z-S>T6*Yo`#udz`VeBqur=pU2j-HytI?U0v_V_%vMdTy(V9~q?x*d+q|t-6s0 zH!GiuNWqmzFK{f(sge7N)ZSW=Xrlke%MQN}Wk~Dq+SLxq^`Q4<=ThxIVkqo?Qs?Ps zQcY%w-UPJgcLkM?pVYPB3pYO$`Mu1m;do1D+7C)CE3vb*Z^nwqq?^4;9Jsr;`N|~e zTV#T{)ulXjv0^gql4-0bMKbNTBZr;n#pxK*P6!L9{6DF~cHI3p*K;gJUQ(yZRHm?` z*lxKCcFC$`-~)r~wuSL|?;cA!@<@m6a22Hc#-{lk%ebz!5jNdO<@yjt({fSbtMco= zbDC0Wb?1ayXpqvb>+$L;iGUiVPc`tEbA7a+fSmqE`mFcn-22~%76{=mE{`&W{e_UG z+tM%9DR#GTAc{h22(rOQ+mc+6azu;1<77^H^2ZT5r=#c+RsqS7oB6E2)X0 zhf}p?1<$5UyfQYFca(xSN9=@dQ|o{j?km(ozD@bfSie=ih}&8q5(Y~|Iys3%3<&gd zuEDy3Ox(9^XhHv{z+7~Q8u)-`2voO zNXSUt?NCeiT;`Y#@wLZLroIw85M}R^hKgmA)}!gG4Wb3Vw%m1(CMg~@a7-8Rh&H;~ zp!Hq0sES|bUx}uiwn$oZUG+)oRg+_UZqT&mcH$0uxC|9LOFmzaOX^!mGN6xwzjNWyekKh z0s1hkW?c~p*bKk7fbG&fOMt9LuGboCQW`lH8=Ne9J0mZQ6}!`fD;^r=OawX^e-d!@ znYQowtaij2wl*aC)(UWxJ#8DQy2?>BZ!KhGyeCXc4D^yojsE*&0CV$L^j~{>(p*l% ztU$d$h41W$m(Td8rby6jpyx@(UllxQBKL?Vuz5#|&-52~{h=prLL=a?BYgBi)9KY< zSr0@{h@_mTiMh&*eA{=9Mq6#lFyIufxICEyjmAVt$n^Fqt{?)%SmuQftfx%E7+FQ6 z)R~P7Zhn1l_PhQ0aO8ilmH@9Y@$GfVGZI)tv7F$=Ff$nyOI=_W}iwfIIMi}~eene_&=^MzAhZtfc| z#X7rK>O+K$**{pcz&II;-?L6l*9-fUnl`KR?#?}vgoFpK6Dd}ucgOFUc}E$&ml`&= zte5?$dB+&Bne!@_UTOrcn53fIzA4+m*3-uJ*7F}thcVGzj!N^{#wgTsx5@xQ$8~5) zFVY1v0}aQBsC7XDRS{l0A%^1{+iV98oof!c%0Iwjal==;LccYG```Wdbno@`7i{m$ zzc$mzbuT5yT0@y)Kgma(=DdM1!1MEE(GLj$iQPuzE^erk&L6i2WBUNaQfiCo+Bi;hXKTf=^ z%rJpMDXOW}%`6 z|1Y*K?TiuCuMYqHFa|g=lewfdhM(WT9px81tY=glMOK>jaY-3TY8a%fT=;bpvbwDY zcJKG%LdbHR>UYW#AKN#Exx@uH`MCU}Nvpi|36wf!C%NGmDYR(-Fgu7ZSg}0%-$fbz zN1;#v<#UL{XkG}}|D)Cav+GUPc!uN}&z~7?HRPa?G1MEyZj<6IBOZ|gA5gc~K8ld$ew_^diS$)fkWzC34T#f^%tJ^f? z5x}F1%RWA~#M(`2S0&q()blR6ltR5Zz=$JdT5@`a^Am8Llb@d*jQMQuM|4W-xM3*h z+j{Iq_tTCUsLAmj9U3`}?wT(27dtFt?F{8+ZkWnGhAjDycG|(Ex5>JWI|-6ZD5Qh` zyir(Ej)O>em`im6D??lx67nLylb4|ae{Ai?Z0Fa?ngYe0vYt-Stzx#7EkOX$k2oD* zRGKSb$~GYb^Uwr4F*sb57I1MRNP$?9)0CN%#TD3X=xO#=ktC%S|LnntZ7jbhAw)*54_W?VA40x*! zM9fU=>cm{nD*@;Ai$fADt;}BI!aKwI?UgJqezZVIXT0Z;QZx3$QM98v+ed8DkxR(0 ztSMS>fv-5dnWdjyraBBBpeB2fZp=*=H7?C&#(3ewhVvznU)7tHE|@(Gcxr1A>ws}- zM$cqN#yXtK&m0QCpgN}~YzMV?LA{cJLHp9o?Z$z@RUCn4w2#XWWH381Gerk5MGqwB zfv50?%P>My$}*QR786kf*rQrhHuN-^+}~))bu&kncfJr+!5DB;Nw8U%! zq(_D75b|f>O!?FlqBHaa^4pAWI=~XvD~Ve+v~(z01lX4Y!W$Mz(wPHDLKh~5d&kMG zYI@6_d{d7RYUjy@_YYsUpkZfbv~Nj|G~q3+J6VH8_LMr+6)J~;4)=JM{3lb$x4n7O z$6dtFhOdj{j?7W4~u@;8DF+KxUuQpRrP^0x3yb5!#C#B$L! zB(drN^E@+Id4NgD>`@~uVKFNcDkC#u{aq+D*wN|&Vt;3J%OAp1FBCl`;HMY&kQ0t~ zjq{NJ$b(Pdr^%|Z+>W%&eGo31Ej38Ly~yOL_gc=cZ5EsA*{)B@Bl=2CBFuf$`3IP@ zx+$G>D7RzWSiLu*uE9G6FT-%tlT9`DCJR2+oUAsn9ZkJ|4DNIvaptuzpV!kFzCp*5OUemK_g0?8EVqJ~BGh`N^@ha^&49k9^?3|H{ zjo?l~4|NhcS3psnQjD2NC}4p=jUc7na2p7~us73VOd=p^`8{Bvp`jn_*ys5c1<@0q zWfTu}!oG`=D2|Gf%q%GH<3_tg{RbodK_LHlL-*fj(B${u62$C}3X7qN@x>duK&2w- zEHs`PHKrgb`Dyi5%H#7#=zEk3{~!ccUL&>lB$b*mZL~kN)hU*+07?^;S?}UP$`Ruo+=WAFhD*942K`g=n|wr8C(PZa1tcb=+EYWGi^X#y*sXHeiv z3!}TGljp<`O$PxMd8#{)a`A%;G)%41quc`!yKrrq4ip;MSGJ85)LY}qUoQ(CtdBc8 z?dG~=8-L;*Q?stUit(6`-8MTx)Y~|UIoUZ#l;iQPlU;;W<_dtxjqWlEbL!|ivqoNI z^FKUP=-fQ8A<$LIRk@Th2J0Bwlb6KxD`7DmgMAMDxtoG|V}{Ux_f;-g@E;Sh>A859 zi{@tLX^z!Q>X}1@y;%2Xojr_i;3(1#4(%&*I;aU4fef&LGde*nP!k6y%!TsK_ORn% z*CB}Q44hb7CadIRccC9pS>>{Hyq1#;W)dAK7tZe~t2@ZN|C*K;)A@o1`c5E2$GU;Ybu*+x z%b=;A{=6W9O*$Po?t{yckeHM~(=+fi2MAwC+u|$AGc*x}~$!vo?=oZgXIS;)7mb6JoR?{puy>G2YY5_K8euvewx~zrP`_2QTH;#r{tzNqUsL< z&>-|N7@RmDT3-Ky4T|KKfK^QC&3EnAc2-WiBXBc@(7Mj3nG^6dn#N%i#$7JRz#}-b z+I3hpK;!bRnbLm^ppN_bh~3(PR3!s?fgVgPDg`=azUkLc>o(B0lr77v2Rz0r1M`P1 zsp(1C>B^3t`Erp#lEh*deM)DU_|ES zW@vGn|Bm3W^nVL;%6rV$`~X2wJ{0A`c-Fwd00F;HZRVfwlQdRu$De-6 zAYFmyg9|=9@27ECbNkmZ-a{i2?%=Xymink}kIv9iq$Jy}eAx~*z|H-CwH{G`)`PJn z6@BjC?=1%3yR_CLhu71&q$jbjKZeug%SkZJyBDhUBbQ+Q`dETBp?c~W$@bE}pcgV6 zBtKJK-Oo?*pwU#|{=`4SaXoiANaXAsU6T?nK68cB$M!`&w1k7wk97VSYRi|+dR&`g z(P=-kl7B3_@B5F=v&YQWVcV4LkcHvUe{?K^1b~(_WxMh=H?78ohG3e1pNvYMyWOSfTa8CtNo%bhx?!>|7iST6{4D*c ze;<)pk~fU_Kn>gb}`A4m|-gJxJCx*Iw=lwf?rEo$re^~QdH*WN9mQkTs@ zmC#M)&}l&4VU8ZEH=*UpAJXh#5~2Pj*!0+XD`(pS-9<=+j-v<75y!saL@fsF(`dFL zC%&;&T0DRXx&R^nGyo7QPLcjC{&k+CcVqp~f>TdfLSDRua0B7XuI>k0ePfYUev)#g zvSWrz%TZY<0PT+X!ZCJER&|AK*F>nz?$t-ur0~Lz+hP`k{uui3bX$5gs0LaWN zbEt~5e+=ivT;>POelutS05btr+91Lt3Tx@CqxW2eIb5=-8f6(4_f|%=4!cMtWH9LmqkDjo)8-6%Xj)T`9J901VEP*CUrKf5EvhF`t$%Q)oKaHe z!sQ9lYho%fu|fn~A{=-zo*-GV#8X}S!=e1EHK&@!oFc1b(EB6BJwbDT|% z;^DWJAvGRC2{fjR!l^>>+v?HO^eXmK(>G{&X7Z{`T!R0KMLPV)og4 zJuP;CbCO&6E`;mvC*JGpb~45Xig!Sc_4YeE@3$TWQ|y={OS6FYT~D34=GZy(3Ly*E7o^GMY{{}2~0f7@}cqA5PnK0tAL zU@ND+@7ezzHEq=!-&|j`PmCsKI!$&(1`gn^Mn$zf@@qYg_yYHCuTM0zxNnbv`{!s1 zGI1f!?thOICrfvKsz^TKnXd4nP2n>`a2e@5OW5waDHq9BHfn!yv-O#x7OCfB$~BZS zz-s=&Aj(g5ezH`x5b^gHSvUanA85xEJK`raS=!c1Q#2(dwo*-sa*C82i{HI{S^l#X z^*WryxMjSqlvOO;xdDu2B$eW7u2ku(LrY!1I~0r?DKao~9gcdoa#kwibUpoV(HCTQ z{l(imPd{l^P=z7Cb2kKA7$_yMhNt86YFloir@5VBIcTR_ig|Fx>*me z%S`PI_OEJbq3%S@MbKDRO7(qvw(-5wFgK{*e#zm)NAIvjx!Fl%Oii+yO0F-ST8>mK z&Z^{vaPrsa0lv2%r$4`fJy`kAmGpxB%hC7QkSUzrxN4Sk@O#m4&#|`Sxzkc)7&`X~6sZQNp z+N;@btNBw~d4-ZN%g9uQ5a0hC^4S}QJ)gDx)>UhgURKxTns^#4sRIxb%p@@8M#K9W%8E@ zt_~TNZ)W{fRc1U#5{!e>KQ&n&Ra&UkyV=z$h}ETf6^yar3vZvT`<;3tZoq=rA3_;@ zy41=bjn)^#H9eUQxGZZ}?S6pT1c8`N`Rb3<5C?eF7P1>PPpDM>UkhrAgxW%#weLXx zY{s_iio@t)e!zP*dCUdFb+0zEP6 z<0%ad4O`LkzbgJF?MW6y?T>4X4oX_Kva0>BKn*_A__gZ>(w*3Q^#YkEUi0>zY(rSl zMxbiQfIBGV<&mhLNDenJdar+Ok)3Dulsn+v5>Cyo-_ODHWN+Ko?G)Q+*_6*}IAuy7 zuI~areXsJDx2{~j$I*-JvsvAT^Gx*L+Pm%kdssJcOK$%Ui2?sphXBjpSv+soyqp{yr+bt%B!Xun$#2e{WL*eDd~#YDdsNG#DH;DneN`YUP!#;jF8mZ3 z{Re`VkZZh3Xjb-A{%Qkpm~W_BO$9mlo*+nd<`Mp#6~z6N2yLeqhRv)Hrx$>665s%& zC?n&?463OrKUt1@zStx*t>;jiSK~Av5Q(dy@v9BMb$YFUBH8;UBhyYY^m7F5kGDs) zdVAkW_qVrSzc8Fv1va0uUhPj| z0q(BT2-OSmh~n+=rQftYkG!^-R%dJ0XdeVaPZ&&Xfr1|iE~#8D-!B^Vumhep7wF9D zV4V)?T3M*qtbT%7lI>(8!H7R;ikng!z1z!UB!z8g zl#KM0C1(9fGG?Xu<}Rm~!VRvRw7u-}4KYtEB2dogX z>+B%gwWwvN;4CZE?A1_>?{HT7a+=#%ZaoKoo%@cC{I8!xT_3l?6_b;`deHE~N8^(qH`fD#zu zfSm?x9+WMnQsuSJ)dkg9fU|Fu3o)U5vz3^=XMxxU>7$Hu_NadO_x&dX$rD zhRovceUG>9PHfakbI;JxurSRmMbRInK@J#z_6`!vp`8icF_R@ zN#*hm)9-bAY8crmVERR8Up8J{5<-@B;iwAcg57$OdKwTVS`f^32Gsu-s!cm@KP=5; zh^I9K9OGsPd8jPOLLN})5wq`_NyEbDgHl*|7_Pb?EnvE*ae`2HX^`y@2P^U?hlLL; zZu6R%_p+-Wu}vYWQHFl`^Qt#MGl!3-cdMfFs096egMKJ0A^)nU{z)73Q+MZaKjM#$ zq_?w+Uqqi??W06jkP?lB8YB>WDcQ<5PVRA0ke>n|cpc>_b_}+*^mfQMZw-Ef6nk2} z7#2cKbNvVZVOto}_?uzlqQcVndNjnKE6QImJ-*$PSakMy=E^t)>|pxEZS1$vxF|ce zc)P^)c*;t_Lpf64Il$7S(tZ7X1A!Ueo3-r~&7CgVv-Z29JNN7T`}c!ERn^ti!?XU- zmRvKWO5^KqDv4!9MG1rHA{&g!D<*rNWH@M4IFxB_NXGiK`K9LyHlS8GrQP8J5!AJ@ zp3!xra+j~?B?A*fL(Bk6l+HoPcyau!UhhoZ=o`+RR}Lgi6X-|$;Mt?w;^;8%J=7lt zbqzi~vqdVt3p(egS z55v_6JK`f+_g5?f61xV`3P(7|R!mv`;h^}&y23lNY@3l-Zjz^%Eci`bBBJuqT-S{(kJDSFe&DMwNK9cMV+CrDYF1i zMs9s;Hh+`>ZAz!=Hxs*3hcmoFMb5eJpFPN>san9EM4L0~aBWJ9yJ4BnXWus@NEUiR-Wx0JUK;X_Ys5U0KN`fw<+4!qiM1PWS? z>$yLYN!G38>7954?21{3o?A)J|+59HK{3aFmKiV z^##_*Sxx?qRFse3%&-ll%C36){fPp|unY7TD#K6O@SnQipqGTs#c-B;swYd4%L|G* zMoBM@gyQuTTI_${Av0QY$z6^?Le!&#SBWCW<#4M?DoPgNajZiv%S!v!4dh;hDk-Xwl0RykcgK z3xd;wDBm_ya?}@$II(psiI>-sd_om2DlTMWv_xyjS&+jsIEwkoP(IXids@bG%EDWF zb|GpS2vJ6f)=z8d+2U?d&Z+dC)E&P%3C44Tb(nrmUN>fWKY<=lqua`5YgRxD>@>ZtT?A>sTRMjrpv1z+q z$a;n_okbhc$r^Rsu(rhf*2E>mzJ7bc70Xy3g10%^&~U}32aa~muecs43wAGtF&2}q zT`YU}U+p&iIGWJw1I^eob|LkVhyzD&qk6!_^44=Z>aDR~M@eggbBsrhE9geiaheMN zS&%gjrlv7{_cChD@%p~h0$z>|B9ew-@jM9aK~dbS^PAz(M!Jh>7o&vjTiYBc1H9;z zEcTs&`iq3d*A>OOW#KbXjiXiI8ke}Xk_rS{N&I*;qu20|uFe|9O$c&QxeH$Km;BC1 z202G8e0c)d`FS(b>|DjaRN;WzcX{hLs6HuU!w%Q*BDy1FKjbf|mvJ1s@w{qP_-0HP zb3%2UfkpeTqQ=2V$;;ia`97+E-3w=P76kh(m>e^iQh<9;-hK}A#Y;$Li?$P@qlbkI zJ48M&05Ed#7>mBdKFpQR`|WUx{rHr|iFI!LoEJ0$?OKE;5n{by6d>IfHA9aa&2vl{ zpl%B^f~`mMUpuyLtEN(Krm2YdN<@UgHY#)OAafHF6N5c|eY{50?q!hnHb`C5S?oDN zP-}ytSX=A0roKM4W7p-oq_GlM^xbl_kzs0*Etv#~b+0-<&f z-Y`i|Hb1JhUL=V_h^j!PFW!VwFcg0sU9%p>yGOwf_Z|w_K5(mIk>tHKVJIIkh4&7( z^Joq5Pv{Fg%AfRG{!Ye2V%mSrV(Od56SdH~iEEtDXuc~)@WPfaRA^wnrDc5F1p!R)UtCdUA4@E?z3*u z&aoSGosvcgJnMZn(6on8`gJzoR8E=sdkS6=L&n{#eF^YV_g7&~J$D;R_E`)hxb^Ck zP-vp|#z$tQ6O&Gey~J|Sl6L({%1#kViz+6Ri0iW3+0+zxHke{+w&B2h_J_;asZr4Z z8vKYcTzE?VT}NPhFzKQ=4&X{{z4Ruw7~ypY68c|tH>20r&n$Q<-W#YV=~fl9)w+7@ z4}H@ZFPa9lK^O(~!x;ii(F$kD`;FM*;v%QtLmRdp6Rta_^Qz)!Cvn-4$x~fn5Dg87 z%08?G`g3Q|lpAe+BDY>qfWUKoqeFG(jq&l?qH%g0yg~6jv&tn`W^|iu>u#8C-0SBT z`%wu>8?%5ZvVrgVRmd@d5Fng41eZtpZ4?y*J@OoqxRTN>H`-S>>uQek#imz1HxSER z(K2##sFb)mCwuRO_R+Gg#|?|-DU=wSVRCX5emo{%CtkuD-_XF;-PX#{Gk%hF8u&Ki6F?en&bqGl)`{E03&WfiQ>5cwnBS?`pF) zlq#S|=#=zaRzv2}9|ks_sBAY9z>=X=?=t)@eYUl3q;zge7{9YUT+<4=Os_Hp{9)6GYDR6GE`fmq~twH{{Y73J2~q$FQE?NDS;_{X8da+N}=)-ku;FnBqXpH zCtRe_n9*_8H(?>r_@nf9E$f*^q#gW0BNGINQB@C5Dknd1(Dz+QYbv8K^j%-s6?cJ( zAFEvK7aJ8&3NP;tw_aTmk6xbjw~Z}^G2dO*?pveyY%_;sR#j@bJYy(I;g?YE1D~zs z9D1ojuwsk9D#8#<{Pgzr_U@(P4%0O?RER6KgnD#+rBNu8^!h>N!%UUE~3?HUiS zt2B*y5)p@i(ERa8=D??ioT7Mz^~eZG06@dlkpV|1kL!hVK$-IwJB?X0HU%cne+BO} zAMhxdY?~ja(ver$M^c>HRkSjh<2MLj17yOOo|jhqT(Xk5l9@)C8kae2dgv*B!UExz z!QSt9T13EQ>DL&7z~1qrtrL{C*rC!pa|Ka-DYD;P@vnT1W}2tvFb(YH z>^to=a5@lTDEPss_ z*M$;J1;SDjhgQAlVsei=R8jba*eq||JXqXGggGLf%|8E@p82Ec{!OoI-{aR9i#R4v zy+)P2HqKjL0ITrFPOyHd*Ml8ucUnXDs&fr!+<5Nyi1Yctjwp~pZZOvS=Rz&2GR|3T zQaH?ta|b~%+&>n@cp#S#t&wvu9Hpz=|9Ao9NT>PZ8M8(2CUqwrc{9hXxGsjw(;9St zVWYR$h$nR&*J!=%#Wu}dw?OR|XgX(X%9Adl(L0Yr=vACDFHZAf11~o(cS|D-Jg}zq zOnSFQ1<_yVmgt!SPCh;EaAQu~U`&}8Ieq1WPZwNPYME#~U#a*`YIJH(lkxS3-Ve+@ zFYWJJ%?B^juWq{j(xQwx7;JqFosRHaS-*ZC+x&(5(ERmP!2Vt^)$+2s3K@>r^Bp?y z>Y}l4k5_nkxMSrjdq%v()oH~OG+>-;6o;qr+WW4Q!Y45HG*2XK&057EImE7guAM#O zq&ADW0LQ#T4ZaM~He=R^TkR8hj|<)Y6-yQuO8bdAFAUItlVf$f5MG~x{M8iJF3cr<&EjdonPBQ9f(t1P*F9g>OMk(&8L8)3?G zGvvW{LC)Seulf5E9D%2OjJ~C-K_+u%^QVjN3+I#e=FS9LPt(iqI+EEH!>-)Jt*hUP zc&+CRiJm7KcC0zSm%l2@!Or>@H{mP$QRe2pV^eN`t)%CVYzQvxz+KQFW!432u-~;= z(S29$(X&*sG2BW0EpaBdz0jTa(xi6%vSVMu_sA18aIcv&zw;^%4 zS85NV93o4@VLvO85m#OY%7BsCpw}4P?gJ704eODl>?B%IA4*^e@2sQv=U^&&U zJYh%ttf!OKfa7YU_Sst-n;K2s2GfQN68EGu$bOM4(#Yv{!G5#oPKR-j0M&$n#7Hg0 zH@3tM{ojL?*5>8aK-sdd<4mcanCYaRsl~U5$%7CLxnP*TJ=9QIS~`3*+2fo*%z0C(oePN}KdotpPjPXTW4pNFUt z*ugF3mUz{2Xo>a@^`=&hga?<^?sEd zF5yC!`~C32af~EQNN)H|@zeOxmDG}o5gF_G$7gTuLvTH_X!^VXVG|zoJma za$!!C60?&j?>oWr#pMnvwr-sv2&zQNl~^u#`YFnm@cC-Jzvv0C_u+53o2^zEr-8?V zMBwrzU5wmF@pR$~yyHWLAl~FC-htO^q}kFR-$_%DUW=uTmAiKx_;iOPefY^C+Q^=W zdy<+V$Yy6QG2DD=V+3(9FgFDV8|oEGE+eN}+^hy`u3DA^t%mwj@Q1nu+zOsC;U9eH zL_I}4!m5*^HqCr6M_O;RI71U60Acyl&GE9roqm3c#SQa;-p*?M2NU)lOcDpiVI~5rX!^#BxTjlRqPV_;)y3F>sKAwa4JHpN*wjP;$ zQiH;q9~xE?VG()>fL+5BM`M&T4`#`|Hsijq+gVs@d_gl0pRC@GBS0|;9rwT@i$4aG z+@4U$@1AWi>b^;9$OYiuCbh(gV!zSOaD1?p-b{03pL`w&-23~9$jTs-t>-!&N zjtyXs>#TD&PxfYd=F2baat>LbT!P$yR~U`s#*SpecAcKm$g?EmJp9O=WfH*%R`Tf@?0 zYxjp`pe0HzLKTd@-IB#QN@+sB*TPGOYP|~h-gG+Vyh@k4 z0CH>2cmZUYg2{;HqY2Ud`yL@hP4q_x4NU5luywss-`@ocm#zsqr6(IDJbgKhKRlMZ zO}_xPk2=?|+HqEyJ|nqlz&dixVk-JWntrwdQHT{9eCJO_<~{`8B=-TNmE!_-we&nZ zBUm)*(WdjFPeD-(4!61%Ea_X?Nkk=9)}?9HwzV~t+3VQ&h5AgaJw}cxUu64M10E69 zf8o+-yvOG+XZ!(ONT%r2vSKOl4s1`Od+X4eB=}~y*2d@20uMDzRj*0}8EPQUPB~*o zTR`^1?5qniy|MCuHO_Hf!!4*{xT#fhe(oT^#Zl;COx27NvnSQ$Fu>&6Djr<@pF>Tp$D z>lN6?ATqeIY3$L(A5$@%(*3_FyagA)c%Ib@Zt|*p@X z;T3Iqe8X&BOyImoQOzxsNb@65-OJfuz7OryG`M*(>o$}OM;ZQRgpgo7XElZ#wN2t< z9p@g&tY&&ilyV9V@mf*+?8X{;*cL@RxTw2j^j-1!&WmAQ+uZ~X9){oJsYGekXy8vDQOLtV4IF}zfTVwH4 zP0qrcOC=t+s^gpPTO^m71Lk?oY#rysBZK(N(!VhQq4P3$d|+m)=A=LD?2 zlltvmi7thFVAGDT8yn-~!lN&azK-d0NA)-aA(dVt10V`3?fw zQxAGQX&E=By)ylsf4iv}zRCphY{{WtlhTwD=gtp>oU?l1M&6(n-{V*HaPS3NX(i@# zA?S~1blLARDIzLz4wb&$R}qs*IJxTP6KGz7Ag?ZIy9{G4@H47Iv4!yk83AfqZIm%y z^FBjqzpsJ4Gf3J}@40zCMKc7?c`=koM4eC8ILy3yXme7HW74dBN`1^RmYyKjUqMr-6NUv#W1Gm)_G66lazvN zSn21#l=>cT-zZ&O`Y?MVp}$^EyYh>HD~Zr3h1H^oVYu5|wwrMqGkI`w*zts0X_fr; zQaDfix^E~WIj7hBLG%t~-zzj1Skr*Q&5N!%!~fVuojreHm~`Rm8~l@vf)8F_l|fd) z4A(L%LdcSe9X<1Qni-xQ6>q+7ZEvQvB9U^cloa=)CrW6UXU`R+re5w-_4vdAtXITw zBDZ(58ZFLDm;SR{biamG~E*@B}09k zPobx2?jt?2RHu7TC|{#^a9iibA-%v8p1|ne;x0s%1!<79y+8IB!$$kRzom=4lV4I* z+}y0+vc|=W4?ADWs%#q?V;C_~$`A18+vGI+*nSFqc?S(Z)n32vg)?g7!dM2-#QkrL zl;dts11q*Ro+%#f4oP^qkDs3P-$|QiR2o||`(lFqe)O~2{*+IrAZ?*@_1Aq>6#OP_ zG2$}jk=HD5F{dz&jAlhsQo~+R%x~St;dLje$8fs?BdY_3Om(OQA!6A_7&H#ee?m%J~G+T=orThQt?8yoVpl=#ehgZGcwPubf5v+^_nDT zp0lF)36j|_IIT!@oC&fE_L1{?BGL;_Hpm}-mbDO}xiT4QSK%@H&CqYofvqR1ZPl-0 zj|tTkY2n(#6Zp_GbK`}bC(7bMj~ug#rp)D)JAV2t%XJHqw#M$@_s91&;(sT-er&9n zt!ZEO@|Ifn6nM2raxnB`W3*)DmUE}~-BLy6X2CEf&q7|x)}!N@{j*J{bvG^P?11vd z4d{1lNOyK)J8j#aP@!P-EGjWMp~5-OEa5H3LPg7Eeh+T6pn_NPd#i-#3ai=UU`|$X zvf<^;hv8>~5wD0xyl`q+J4UTB_oE~R#c0J9rM1NI!&q3sE##j9Tv%&Dl&MZuSBJN# zi1Lc^rE3Noc>~D_@AU{JvBRuArBc853pHCwFN|Jj>AQSAm@U5< z6E6a;OQuV7M4q2p&UzJnOWO__gPb$gPQy1w=BF6HFvetVluL;ds~T#d3V|YV+Nr+J z3NCW7ccvRM0~K+gx8%iuvTH=TXd` zF2h2KUtXHF?E?*D79g%7Z17D^*pww;SALrHKy5F2&EkCMCI2^q*1LWU_ok*uT%b5j zMa*t2Z;@YJB3iTn!K2}erW@Jgl~{uH@-Nq<_p^Ai=2efra3W#5AA!_J$B73K2I;7-7t zmBY--S>IKKJl*G||Cu{WD=vVzH*oA3)rS9mPeCrCPN~|BklI|xGelH#TQy#3jZJQD zEIvNIFq=~@QnvBFM&ETR%{eKTppgTVgb}whu{&YgYh9Sug3tYg1MW(rG5H{$K`>#x z_pNxnl$OnB%;7qJKS8Ma$7C~Xe0*?Fs*lEE+w7%Hww!5-6KVS0Yb#_W$@PV>r_J{R z&pQ%UXCqjmL^Kn*&SdjdF1qQ0=Y}3wX)Tq;;aUlrm&I6{*-N}$o;KlAz@nJ+%Qr%c zzc3xWm2)wIKKs<8UdyVfHLX(`NhvAMkc@8e5OEy;T&?hI8a@m{=Sa(?Z%yvFU^P#? zHSGqyUtJZ1HR+@wUlH1`qb`q}U+osA^{%M8=N;&=NQi0Nom19QVfLD>$}ewlYkh_F zIc6S~Fn#xn?B`$o+lC!Uw8eXW)3eM~9~{fS-RJGsP~$oL2zaujeg;fjN?lf{h-g;p zj7rd+D2bg9_3>9RwVRiYG`vg|;VXA`T5tgd#$MGrfafyiuJNJdN5SYL2GH6mN;Q>W z;K^7)HpVRwe)X~-qW~=r#2*Tu^-k2bVNgwdO;3WYLM%xyRw!EWOK9t z8q-1B47YFEuB+Cey@@!i#ys60mZszj&E!qJ9L;1Z*=~Jmc|Q7ZKkh60Q@z?2!`cYO%*(yJsdo{A^0*2 z82vSe-FDY2=|RWduZ?hWGWor>&)Re)Opvv^&$Vy@Boi!O8um_m`9;D;CwT&Ws<;!+ zU(>8db?;=mkz^~H)U&sXdFY&VcTgo8I1Z;|tDEj|&bB<&Hrogtadq3e-pu&q=Kxzo zQe45{ha6gTq@yg={Es%_t~S?NIqIK(2%EGA_?9A(e_mzqPMWYY(YQWcuqL4!Fa1Ac zeFaohUE8*VG|~+MDxh?CigXInEeuHa&|QKw(%n6D4J9Dm9Yc2x(hdJS-}`<4t3GS7 zSckQSIeVXd_Py`8?&|^t>SbO&aKPWj$E&{iM(Azpq}#|ClsdrxYLp*UTG2azRK&Ev z2!ot+U$Xc;kK#4P25XrnfG^9Cm3Ab=?od<8yK(ffk363-e!IH2GpQt^rq}et^;QdpYjbDOHq}k}T)5XYa7U^)bO*yp z?eD+|Av|80W>>hh)a&X04scoE@#|v;=iP>eg5`AV6F(}z?F^JNYBB7zU6!?Y4zT1k zK0PZA`lz&}%$^l@GYlsE^`rNZ2KfLAX6usdYhn?kWyt_$TXEP$50sopK8bP5>9tuE z7stvd3BARWg1rb=3lMpeqn|TNoa>6CzbHgRv)RH-J*z6=ze^8oLr~f9V-qi|!tQM( zsz-me4&|+Yz64q&XTUTfHn3oT8p>E$S40q>E;&-Cp?EyG-PlKmNHDTiy;T#R0NiN^ z<)d+p!|@G~{*Q7#yyN}$d%hM~Tysr{>$Rz;{U+SZq%+Fk5cSAcSRK$$0c;oo&mV{v z&Tz|4lkx|c{A=VGPlwWLE*-YYc??vI7wRRAe$M;BYM1FTA*r9rILWmHRhFU-zW}qS zjn{=eEL)T{V)=u`%6u2S4_*BR@e%Jf+1dR~i6|FZWw3-On}+Mb@LVQ&KLgO8(-koL z-bO@6(8zi9n&4~2Q}SC?F1kak_tk4tKjPZA(RjaYJgi>X%|2=_?o6XWe(CC4+*DMg zJW7?8ztJR9sf}k;1YUvV_+M`ZT&;XGhL-mP?Y>tVddvzIM6?U(08xp|E;iq28&ieH z5Ys@{PVwOwoYCe|Jn%H3|s^wY<#V|9|T3Te#1oPpg8qg8*Wp_Z}pSz}d$mq_d3| z11s(a6yRnc=w5M&XUS>fqTt0{gN4nX&eS#{tB9k2E5Bo#T{Ruggi)VBbqpt+>5iv? zH{a;4f%HRA#uo5b2Xc@^l{6O8d&I*Qe!0<0fxAP4K3LI|vAt!}C;Y(c5OjODLK(Xr zGm_Ko<>a?<8+)O>gRlBRN{XC3MfEjYPqoX6J%-dA0ELAu=}fYRc&{S;czr*?el(`a z(PpzR=Ct>zRd%$neYr6SWB--nAz><87vIb}u@K8k@XJmZaHasM^U7p*6^`BWcq!tf zKniQ9OClKKr3tX&h!t4Y6asa>sF+r)}_KszzKC6CG zFhxZIhw02m`q6_ILg8Gek-It+>wev(FeS`pDE=WeIuR3Ru-TN`s#r*hH&x`>){)Ji z&{dl6n=`91WMcO04am;r!_~@QCg`?i{vxaf5l7#9&rJ_eK=xv!HQdJIpqwYwi5NMN zQSTMJ$FxAzkku=JgFh>k3>5bwOa-o|32^PZt)H~l5#+_0LqqrNo@*3zZCDrn* zcyjPsT_@RrnS2(^%@Ea2(3!QW-=r0q?Ip8=E$NG7LqiY5ey!c#L4Bywut);iVeR*E z6{Ru(VEFO8?DqOm>AUItMAGD%5&qfDQryo_I%tiL@{(T)r%opQdvLV3bzm%SqT1kh0!zB~XHn3?cmIqTbXbg$jnwm&dmPtO{J z96Q(9R_2*_T|d^%>hoL}%e#Argtp%;d#rgvq^{IP2{|3EwOdUi2DU@CrgzOw4;^(H zzkF2II|)3q78(^iD~r*o`V8Pb-byrJGrtC3E#JN0bL)s8qlg4ga58>#hoRQVJ~eQ4 zz;Z}@^b~F|1czf~ZQ0P2S*Av#L&PrH%&I=#rS&K1f@KAdC)GC?9#-gPbJA!Y)q@gy ziXg9mU*}3yNd#}C!B}uDFfKskzVb&O47z%@c0VAyb3Bv41rK6@&@MabB$oF&JbZW( zF+BU#Q1fwx%j4nH9yCcT0uCDaFnhaHj8WX={A?xP5vwD#9ap(HI^Gmy?b?x#}* z??Ogd`6f*-uH^gQrKP@b!2|W{9gYfC8_+e789rr}e)1aG2XNJ0l!)+ywbZ0}AUU_I zEywDJJn`0C54Fy&0@jn+JG$OCwq0jkm}K0XZ<$751zw!ukaG=;JFj>= z1r&KM&bep0t{2Gb8S{*1y!v&Ykz=uV`N@DDv!E^mz&}O25RJHi#}T(+PHV z{yt0LyXF8(KDQO0ZbTIZO?qFHt_0ozdaW+(U3{$W{n44xm^CZMri^{?Dla15z9bOb z@0CKn&=rfby9zX>pP@~=P?}P7Q5g#K0VLNyF0H9eMr_z&X=ejN3s#_2X@GzNiaIGDj~}sY4M~b1-w$9XFpvqR(6lOy(pt_nW4E>oCT7WsAiw{9PNGG&Vm+)U;J6(W)dJHDTxc&q3i7TzwV& zcBHrHktI$k;;Zqcd{YzxsnH?6p6P}M$^LS~yr<4YGpii|3d>;UgCS7iG&l@r&ucmY z1Gw(2szGlj(d2$%q52ZadSV|U>-@1v^33_vRyP%cl=E$gLYjS}mL523IU8&|de<^- zRm$*8V-HjpRvAueC{J>@*>!^tG|Q$aq$daK*yr1e!T8QJQNw^sViBg>_b6rRKY6R- zaIFm)R|D*S=tY*-)Yg9T)~pn@aEd?tiqkb5DXvDZ#!bAA&$(mfyNz9rRceyRq+`0j z4{6BcON2XWJ`fi|Xf;77;RKD=%HfoEbFLr2|4cc@+@g=_3 z>j*s~48e2+igpTNk1&4<8c9?2Q%ggcEBMlrKJ{z8NzRdVPhKtvo+DdR zV@#N(lpd4Kt?EJZG49?WRH|+1PFf7#`ClPjU6_EvB%LQA0Y&nB+D;WQ2 zNmSv1!i^Ss#bCv<1e^f1-f_3$+=OB?)CjUx<#wvlr{t!Ub%F!H?vGb{YG0ec?{FQ- zlgK`gpe!Mr*$o+3qcl{wkEt(lCFb`EiWYW|&nH7F*l)Fx_dg-GtgU~ONomXRv(G2h-TVFH8n0RncW3hPLaEf8Rp`>qUe<~1bu7b z+7C=s7NB)`NKy)*bi&vbBz~fw<|v`hKKP1X`nWbjz-rJtBDIU(S}Pwj(y$iaQ%;xV z6^Luy{AtTxk#Boz%pmJE208B!SA9SIBj_N^2kBJcS;`V1qwBjnZZ8Lfb>1jOjPRU) zIqxbLSa8o0UniGv?dnL%E~NIw%XogC4L_ZFSFHHeJNJbSVK1*Q^10D2A+f+|g9Sg( z=+%p*a;41W?T7aQuJx-3T096XO5ccB)D>y8VXfwge)JrjeK{ho%!Ynf@HUFW0%dz+ z)?-S#Cy{GSqP;K~hhjJGG4mFFbf-7rSPzp8x(EI*-j;+s4_7pCR)YlFBR3ysSLb_1 z-0QjA>e=4_3Tz4m-RVqw^K!qtXGEK?e(XyX@v4^DVnvDJr#y7=FFVeZP_| zc3XC$@0Yq2?oRxB!!Q3!KaBJ-FOvcxDSW~cg0mYde z{Rm|MUN`*ldOl=pn#ygHthYEmAbtV z(m8PDstD9Ce3TOXu#avOBA3jejmAi{k3?wZ49J^+|?f%dKkvH@a`$J%ds&{U7c)d1O3kN;p1xd2c;T zjKyp2g`UO|BT4)|uL=1dBTM86M)4Swi@n5RA|qc#irju!f{^5T98e%t^7*ZK2hntHnCw z@E4XASw7jXa=T0!NNTOVgjHnvVB<0nQ3&2)P}i%P5b7Q-_fi@h;2wm*HE1Z6Qkh2& zNaAP?)RP_GxXc+@efQqfaB1<@ar3x15N{C_aVz+vA}#_CCr~91vIM3;>C%lxP!0{I zbTatXFx=c1Op0d+fGALvB+eD?Jv)+y;kWa70;Nt(`38V@g-wvJI=to`jdj_w9UuOjQ^g&N0w1sNV`#_$~OXRGt8VIec%h_6%$Ud~z0MYk(^)ixM}w{*#NwX%$V?1-p|V#|?~)Ra@#eg{^&RXvE$ubB%m#V5RC-A)xUBfl z74B)Ba~BP2osc5Ogs?+}=Qwq(b)sd0vo(;MS$|hAa*~JTZGUn-vXXCgDoO6dN|q0( zYmn1X*kz@$?}^r|k1EycU$7LZA51?4XS5yB#X4voX1JBeYLBTh_v;-0T-IS!Z{wkW zodRc8;8t!P$_v+nU&{~}-Qx{+;|4dTMmzuggcXU45VuW*H@oz=tH&P8!I_=5o>Fv& zj~9Et)ao#Zq!wSkp;SCium@b%5vchTm6b{leWBlKsa}?Cy=inowrvw&Q5V!FX%`gX z?k{jV=o0#)s=h-t=4v|2+by8d?v|&6sT-w63 zRPnMR+*;rzvMouwyR}f2Nz98b9C%&Oa;{X+r{b%u`+N9#?WkUdd6bTc3w5$(aAGiKdLe{gI-zWATgSU|6o7*3R z-}^m0(0b9Hn^HlPk{UzfdhVGq0j7F_8=&yt(TKvQhl(y>1p2~@ z8+v)A_n>WsXJ#@Bfww|ke5lC7+AeRKRJ626fc;+xPz0)i=-2Yh^Md?yee0FC%Kk+f zB2D!UzA9X5Mwhr5*TT7KzEFMww0&m(G7f6u%K^Dr`9t%Vk6KVKlKcF3qS4 zW#4fY9s$+r8gZbENwH#LdODLEA6&65N>W`;q@VIAb02OmW^s8IS4C*u_{(pXtocNh^+K{?rvDh!^1glvsI!-m$nwO0$;r2o zUznEzQa`VK|A6@1M!G7oQg)+#$)0E4{G7PBxLiq2#OO;P!>5I(iAUzD-&N`V=RtkJ zh3nd&nh6q;{Z(a`1HwF#SPmn_j@|KeU2-Jy-YhSIYW%oaX?&HU!v5H^9-5yq zJGM%UrgxjBwPtSV&;Y?^r+URAEBxj#p>8V`256jI1Z!se1`vTUaKnDG%n>Vnr+9u! zU&aGo{d)|uh<1wxi5RFFnY8%3v2(m%ehV1?v)XisMYVNt$Q?GnA33mVCsFuhHVsQ) zWyhQ5#wlh+g}0f?SpjgLUH&#KS$cTBxP&@5mT8l``FdDU>AzD${IgVkzzb0v z-Pf^t0x9Ptf&J=pgaLrm-)+o4*JCm$ADmR)8Zk=@5p*jHHKd!IlOz2-r&>%u#jVer zBthdKwz}D*IXtwVjQtpYPm9X$4eE!M1yNMTcb`FTOHLPQwFJ8Vz0vMb-dIx&4ShP( zVJGBmSJ$S-1c@t9;?>3Hs3+&R=FB83{b?uu&%*yTa%)+tJr0x_b`Bc32ge1D`-R$B z;fOBhFH{Vu9%f;ZBlz83?mch*J;o%&Psxtwpz8&V`^BU>j(~ry?vD^rTtcowd<;9j zc`dMB?%xk7TGRpYQ%9|Pdh;`HNL}vB5aR zYK*d!jw_8DZ@1c9dY8DsTP^HRm>!9a@Qp_UD*KJfkjo9@FrI`6JSXiSpTs#;_H>t$ZmGvI!qd__b zW~yK5_@|GqfW-&dye{gM;*qA?J-5((y9Tp^>Wkai5NK}edEMR-!XJ(X>_waqr}FLh z5X^rqG+f)R{mR1Z?m(wn$U#Klio>Z8(nwMvCswyt&s5>CGu+_N@-LG$i0wNA-xZr% zF6M6;C#5s#bftEQmB%hefF(ECOKDciXdd{t*qq&^FF)yfVExeBEETKdZL+3j& z-XVbG0em^0=pR_Hf1YxjBb$JS8Dx>~gC||Kpu}^y9-_iYKwr_=;NT z?10lWo!sDn$>F83iPAKkV|A{x#AN^2Y~oql$JP@$R77}5V6(MUGC5>Bfk_8&JER2I ztKMS&GA252o7tMDG1{q|8d>FV5(|(l0E4xG%jRi^ZIJ6C{>3A<-&t(_v3CxL>|~^* z+Mr9IreldLz+}nzjwD>IElYIS?m+0YW7B-1-InrZ8}j@#@c{Y>U=_5-h~GACIn$q6 z(Ja1gsehcKe|lV~A4`|vEw;bE-^n1e;^h;j>-?Y>o0#~TfFR!C=4qMHvHgBwGnWbJ z@6Gka4W2^h>Ma99qLQf(HP0e2Q~uGeU|;vb$i%kop-tE4E})0E(a5-1*X_c(=PL@_ zuJzc_BXCj#5S$Q#bG*eP9PP7wXIorW7B(?h#*E^1#N*Q_Q@`&&e!r-D1Ism{pY!V& zSX-yx-<|Ai#?TqSgqA!?L5<3fS1Ayai2aaAYE`G0J^Guo73g;fxdb^SuJxt6Up1$T z=oK>J;RhSHMF%qt=Kiq;E*JxE~`DV<21 z4zy7zA}Uqf+O%)>texY58KTR)god`6q63YGiMNU@+TyJd{b?sfOR;y|1yFRJTMlx6 zj(`7FV+;KL4BURN?oN0)Mo@x0c+qgLTHwhmK5}~_Q-D{|dXs@cGNm*+pEvA2)rI75!=&X|}*6BTUl< ze^0mdg?w?FFoe*zx(1hA_!^`Vpeq zs1o&EOa76dEb#pJQR(Iik7b}fS5h|W;nhxm^-ZzsO{rCgk2=gmouWvHb%7;6P zY>r)0Wh$JWqsrF%n*jr|4JxRkqhq*=T0Te{o1TFIa4J=^6}S<}+0)^^#Dq4R9d|h| zA*_*@gTl%lNiM7jR8QpOKCHRQsJ1aq{sF-B_egyAeZrMe)z{!}^AybqH_aAq)w?M6 z1ykFjIOYHfsfaiB_ADyXX&*mK>8kX;_Vx>30yf&`?-Ad8@OD~lJMGFL=-H5iiQ2Y^ zxCN8@3>o$Ce!YXUFci4`C39K@MhWszsr9QyfeEB1avg9FJl-j=UR`&-AHxwx?rW)N zV>9P48;udinwum>&K?DrA;WZJu;Q?U(*Wlm4p;B2pbZXFM#!WaR3<$(4dvvOSFSe} zj|~Mc8lWw%C+z)$!!KCqgMLsWQ&KU^eovApY|P~Ls!#J={AUUIE9U<7`0m*sP>nS;OF|*ICRIW*tj%(eFj3oc^p;Tz2&Eu25%K^vW zsnhBAmK)3n2+%a1yuI??WBS=K-0qVd4>YW>#0H3?&C)un2Gr10`r~(ix)^6_nAOX) zEhp?Ge{y#R45O(x#)|zQ!9lnsl$qZi-d=tPx}sU`Wg6uDbIU$M&HEHIXxW~T)Z=b1quLD zoOi%SYR!#}=ne#cUccmI!4dMQMzOtZ>N@rIq1fVUr&+ciI>S8*`KCkp03DNGS#Y$Y z`%4dZS8)pYI(aHl)j!x^oZtAnIWyjpNCtd-eC(!EC|V6R;=IF>>wD=iXXx}V?<1Pu z?-@Sa)lZQNdVWn*OB%Uq$h$B)Elc;GS#xV+cW&;=_qG*nFh%vPfi+~M??&PwNk{{O z4g0d=R^%d-(}oQ;H?XEP!Z;)z7CYMw#G*wKQ@YQQAXXT)4r;y>GZ{}wHSrWdSq6Xk zhX$LabH*+~kHLRQ0so})mG~<8O4~Nnpy*+%(^xLS-NPQZ%;(O1exxFlT1mAs9#aOz z6k^hF2B8TVWA8jyKPc2`n;uN7B55u6{00Sub4PTFCROb88f#=t?-(V0Amc^GhO_SU z-Fe|BnlSLqO3hdgpq4*QGmb^adw5nCIb0%@qx4JJxXX0OelFL;Wt^agyMJoB)x*zl z{2gJry85iF=!GgGLqY|Zx<@k?s#;oVS*u9VP^wS-F*_>f1>*T=!crN!dUl+)spOA~ z_)^Jn=mOnerq{0kXV<|DTidxu-}rNYXzfcv)!K4)L-G%E&WRLTtwhI@@fl<=@|TRb z5K1p~=B8anwN-GkTFUaH(exKAwN31-wDQ@rH`rzC&$r4IBcgBs<0h#rjZ8sC69Wt6 zi?&PP>AWt{F9d3-qklb9Sg7gS^aS%8a?aroBLl_@ii+Om`$-;{#t0CH8M0PW$KnZe zZ`XEnfqm>y_jfgeguun1Pex!wAyl~LJ&OZUCwl;h?cB)E6tG)_@;b|43}U!hv#qK_ z7;djm?Zj;vjc`ZL_2Xi1W)fd2m34?(Ge9T6UX9*DdMFW%3%B!#?sg5a(13N_dG>ie zEA1=IR#5YP!k`9-4RFXuQ`DdWd8>>-iQ(7e?%ldXy*Kr)=WS9H+csi2!z3w};LOxa z%F?%b@3i71BJM27g+P1k<7A=FT{Eallf*L4?0Cptfmy6Z-`1mNgAsJphp{JKVg$E_0OcTv6 zF`)ah_=x=cf&+CeSV2A>gM76y*N?ryY2L!ou!ZY3`*0yvWo0@^JQyQptt(`((x@v( zSUltfmsh28EuH$|Uks|E?x>;-zM!=SLpJIFu>wV?4ObgH%qZw334G-u3QQ6>r zgtS*~{KKXvBj|aF6o_ZOe)u2E)ly=N`= ztW?#&?SZ1{s-w4SfZV;-beMln_0t!1lh0iHZFs<#hUH`{e)J#=&p*MN1cGv;f9q|4^J=Q9XaQ-*w?&g@E!DDwk6wF*L%QCY*l0Qnr(6k*cE@AnPW|; zqEcTkWSn6zvb2ljkp?D86^=vekS2e*`h9(%)Eak*hS$Xs?#=#zZ5L7lNv3DP&ecT> zwYw=LhEIrm3Kh)7^BDn&GU^hQY&|uPnS29rUr-HRbPhMww)Q=jC*?o0^KgZQ#4S%Qx!=u-^^y{%;G(Y zV*xa?<;s(Wd(N4EWpz*eZ2UcqS?aHj<9!!l2AtIe~+wwaNG#IY~{j^qf41 zekp&p!X*lbfcVf8Fg%?e@Z`O(rqyT{^F6^Pwx4n&`i{~^i<$o}uTq64%ZJkKFj)ft zBc%j)It2(8F-yCU3TQ_P?1$VKa8Pd=grBpAW0!o;pkM$ew-L4P?-}lI6Y?+cuiukf|+O?@pXDq z9i+=-+ja#LxLm}MoDDQf+z%^1y{@U)vlw(Yp7XeGYS;>s8%dxRM@j}=9L#DgyPAcO z;_S!)B!UD_ug_GbN<-2-JIA**QHT$qKG*MzsmO&&G+hpy6CqIV_oVwJCgbb*4tMPt z-yIbnLgnWyc~mKZu-#fGtM7Rsm(AG4X9nd zv?~d$+0DDG>leJZx(h@swFOV&R47ZbCcp?+Zxc8||ERlD`7ytL22RfOMoPS&!3(7f z!%*Y&hxXTJDx1mcG-OXTN_B`q=SzxKS>5PFyD&<~2+c0`3#!XiwDqZtrTD^hJdBLu zNAm~O`{eb!v~!^5cB1#p8@>I^0>@v#=736i$A$2DQ-b|p*#TRt2v;0vDX_TNkxm&| zz1Fn&lGkWd53rM-MiE>b?lNBu0Q=X5@HzgRNtbmS_$yW6gaOaH0*{Wk1b!2)smb`& zks0@SDNC8QMu}vn1qoXbk8a}b3xV%W7=a@>3QOVzI6v*Tmt+4IF^~^sw5AAMuqgM0 zWCAR%Z|}dkIh;pfX#f_-Io9CMH}*37u0$Bwn-4D4#g`*D>Us2PwpQVt_N6AL4K?Tk zkg=izXpc&fxOU`WzFc1h5W3}XMCrq{QA<8Bl+I&d>ccNJ%3d~^9sn5>_Bb~B?xRCF zB9tcRoC3wr%?_@GR<8)-IpOTusS;vt%s*7xRmsn$`|32P%i5o?Cf7cF$Ypp%nE`+{ z?$|eN6qM%KX1*$(-4QU}E?i5GZiZIpLP-~&=d781%z=s*dUJ};l<8I2hLQ*iPRmph9CuhMaC zIF$!o`10$saFW}381+{8BhEKC%)ly)z%kK__Dc(@@C(t_z02n^+)E6J145XA#bY^) zf0`j(_&rW+n~w-ZROp)x^q^X~q{dWs}#Oglj=;p2_IQK63V`>vG z+a&DW1oA8cD|GJ)2lEWtg;66uSM56%Hg9~i-p4|{Hi8Roiz*yVCEN#== zgL213K)_$9oU{x@b8tQ4N)b1PrrJ& z{5X?HiG%jNf_g!Vx(4Q#;-K#9-F26)^Fx0nn0H?xmf5WCQubpm>{3f|YFGR!;uhAH zs`YdzuPggL-ChM%xIH7SQ_UxsHIg}&Z1YZtLGLuwUjKe2B-Oe<=g~uTyQ!U zEzI}|+MPk@vJMu7a37Uyz$7)%fvDhsc$q0$SY6m9l~xbJF}hf|0^6>?j{+dwzU&@waV8r!1Ui0iW%`U2Xkp)+Du5Jq*7)WUPX6DDx zpZCvl#Pik18E1M`rJ1Y9h*N4JCFjx%wJL9GkVq}(;{NNK)BQvp6SeEXe%MH22Sjxs z(DF}vS2xR$z!H=9elt*e0UH)+9?_%gy-LeJp39gRit9OAl;U>N5tZ?0o`01`f>1bB zWhTx#gk&|*FYu;2vA;k(){D(H!3VYp~7r7{@zSdsC2F7X9YFvy(P&n813tA+p0Pg42SzsA1*0Cpr0%lW<9OP09~eaew~;ToKi2YolUBv!T+iiOY*PT(V%J)@m!{0Antla z-Uc0ieO1tp`u@Ei;#TsXRP3;Sq)2?`RJ+(-9Vi=C-+_)E7p;VDj{E6_0R! zcH|<`S4EdeS4!wZjYkJH$MAbCMJT7QpTVfvs5~$@xOLaf0Dxh|V~7mgB_ajaS#R#o z_}DMHqVjTbRG8a#JxSP2?6iTn3tYvh>Emzkzq|k@{Pmtt`6bY;lCK%oWoaJG-y2>J zU2DdMPLzKm(=DH8F(P4PRinP3z{7R^u3LBco9@Nteg-_v{3em^{|0z1n+j+&aSMBI}WZ=#w3x!X!9P6Zg0!t#3G zF5|ptp-eD)_^W_}Yq0fr4>B>tb9# zRh4LvAF(A&py{tVWGxoFrm_WaH<@AGo04lQXfp+3X^CGuJ9RJ_`4gqe@iV?5`yWT! zKmRW(4{r_;`_jO^y}d1a0>s<=`uas8I*XveOoahUvR3j$c~|ZALp0f z49%+R^_Rn)t_mUr1JPX#vPnib%fy;YlGxl_ zBafk|k1dA?4l2_f)wSKlG?Ul_Pq1nG`!nFi&2Nv7k z_DZ+n?}((YgyGDKqLxxc6@$wjK(Zr^?gH}%zH1X%J)J{CGi*OT9)&&VCjDuGkK%oE znQ9|PqUjNKi6!Y|s|`yRGGY%^Ex$f5Tc2C(c~+U7-O>1b$?HnbWMC@FiO#UqWDhEq z_gVyIkV;BQ^T7p@Xw5D>SSUx@*QpIQY?4jTCA2pT9CCy#+OI_T9AZgHs!}U&c8oY( z!Wne{u8iMu^D;zcyT%bqyb-80GSS&5@FE)N^E^gFajl}D};vbk)7*q24N#b4^ zc*9#!VGGBAcOiQ%TOcxiY%LEWxErCRQ+W5s!cqC1LqqZFHyjX&6+@e}0rE z8i~KnxhzkpMjOF1#>Stry!?Hw(BZP#;K6)F?5iZ{{z1gxm?+g?ZF2mUuKn3b+UVBW zJIX!|jYqzHxM}lbeGNSr<%R=bYxs$EYc-{|zJBKCAFwr;?z99|{rW0*R<`r8m)ynM z)(gpSFX&_Q2DHj;auPx`GlPUUgzmdT+WY>ijfDPp^<$ICWpF{f#YIPz*l#oNQ~4b<1*-E{NH{m^(*;aEKdfpiKIPjzJ0ucw8|mqoEG09MerO7tn=gc@9LGDa}5v z8Qtl-rsxg&n2=!0jn!J1L6elt&PUy~296-xyfw>+)){%q-`w7m-YRz?;}a;dmWqN= zQMD^^Thqtq>gu5GpT+FAbi)m^9YFGQSn_0inT0O%O|~PP}4Cp{=;@h^TYM- z&PouK1qEZWMDuCQ$EGJ!ToUflgmyRbXIOOn4Hcd3}c& zeHO*HOpI-x@%()R^hJy1rIf>&8&T>VmdKMl6FAvn?4?KYT}J>inaAlmjog%IBRXba zFxnr;p9!%aAooQTbtWu55sd-vPcl>jlf=58r&qFiezw?XokH4=nfRK@^HzWE%j50= z!!zae-`R?Qd5ax)XND?b&ur$!fXkM4r5WOhKkeS;pp|Nv)%A$|sIuSLkGE=9e-E+U zfeYbu7yeT$`imLjtLDiPla8M5wcP0;c?ic+5BcnPFFU~L_;dg0i0#ReV|fJnMi=rR z@yRHQC_@#y_YG4*0Tz`MX5u^vT)&EVmVxg{bsMz~yv1(#jLdx=#GJI!L#-VjoB|}u z<+ZizPGLtye8mviyt6H10|e&UkZ35j-UezIC?)e~xDX+2{)qNtRaK~Wb+b#L{v9>= z47C;!20C^`a&VGNF9s=AXRTg0tPeF!TOt+I0pXX2`Wt=Z_LPPPCSDxO4bkaeRJv{d ze1=`2OL|7W#dd>c+#I6N78yy!ch?oq{#1k8&(w!|c!^*PBC-UWMP?p=(A}@ z!c`x2;1yiPWVQv_m=-9woRhi?{ms$HlEeMsq+M7Vzu$Jc1W*N7S_hfzjqr+W5VySf zyrb<+WiY}d*iDQw?9_s%=(1r>a&oHuNa3J;ao$YK$)B(E{_o!3l}B`1CSsG_JLGQ*VqNH&80vSmG;)HeuIZ$mWOHC!ZMfN$ zj@;-Rz~#a8G!Ga6GnNN=Uo<19W_!G)wdP5xjqD>1+uC!*>n_gZfxE;Xk#8Jjfzsc9 zKcT)Lz~d~zcB8_y(5il|84zo{)y#tG6APzsoK3Ij9F?2j;tRKWz0dAP2A$(6pAQt- zoS!a5YHKf8tA{I+)z+g>gIn+KJ^9X~5w;F0+EHg43(Dl(H@8yn2KFs(K0j#VRcPES z1R13AzMSmPcoIXqVC+nMw5yZR0b4bZyZzE_v0A?1FC>B0+K0P}T5&SJ^ z+TBIG#}^PNh~B~XumnjTu&PdJ29Flu>?x2x^fRPD?-o+r-?5a+fVCNg84vT(c!1Kt z(`bUe@6ZSMSc4>*3+EB>&LW(eTq!|@XzC?oM1K6Zz9`^bD$shori$=u5C)B_O{M*z`UJWoBB2`(8%5ZuCUJ z(%-hPQ$dslzbeaLS<@^2+VbYZ{R*77dWMfLW8+vB#jsj68ieUriZeqZvCItjkFmD{q%3geOJyeS zk+`V1A8|UFrcYTuScKJa*)Nn%ir7ZAUX5>$Cs5+){0DURpWk0H5f2w@-s^dLHydS} z93(qL>~zJn@$BaDi$v4qx<_&Dj7m7fe&fnWq}2euQ#m?qaCv5@w6p;inmCJ3#iUzM z=PE@gL;EtiF7ZZ2TW^7dCAk*nG=DHoP98CeLWdzUaJoWJ!UIrpgZYre4p|Q?kVHJO z(N0fI?vsw>$r0wwA#AiZ?ZH@-v{6DQX;V{EvWkj8?eE@q%L}E}rQ-zfx2LqkV735jSl0s~KMte!fd%iaL2$`pl*f{-?*r_g3WPj40|~IXw~pvv+L zLJc9gnr1i{v7|ex-~B9@Ye27=qN4QXNb5!eUmFMOqx43=Ky9A=XUS zddAnrOJTrUHvyzMLVC-C)`)9?uyA(VZ&xpB^^fO%2cn5eQ9mOSzbb?8A05Cu#I5Zp z!AMf;YV+;3VlAk<(gKQC>K8Dk(;m>z$SD@sWQDPb^(4{n({C2$Mn-!t-4+QiboSOY z6&xnmOSLRqb?UPPC)7G?TE*9?-O9_IKLnHyE`bwsULF)4|M&q#7}82u)^)UHxEPjC zBbJ^W{CqGEb}k)yIB%~8<$YjoUYEUrHH=21;z{-YL~S0-L!eC|=s0c@(GpJPlH#^m zrVpX0ZGe$YJpfjHAKC9}_}Hx%7~Kvcl(w$%u3}*Hh-&Uv0~#**2e?shBtl*1RLjEF z|NGoT;r0A{M-eBQwMW_RwGgu2+nc9xV-<1Rmdv=>w}PNfh>L2kX#{&`Q{9~zk`1t< zp+WoAB58iwDY%PFT=|}ZiGI}6`Ga@dUrc^=N5lI?b~2nw#WnUuf9)%L7LfD%jnZR$ z6|u;M+OxcQG8A6XOl}sD6d~;5%^hi~>oE^DlqJ9u3+48h^cI@Z_Dz3J9oDcu)wI^Q zCyh$nq01bpt+#@>knbu7Pdz`_49KVK4<1n1f5BszQL0mFpBKH}(rXqaFi(t9jya;| z?1-82PZZ@tzBis5l6Lm(+t$!o#rKtmTa08_psE7HTycmbGqJRtgEM%DqnBJDYRuQ& zTCu6AuP4ohVtH2FHDD#_zP@!FhetQFJ{Z9P1Ba>iE0-0=_Q!0~zF%vR-&C%Cq>{NH zT$K;59jA8x`~qLxh!w`%FYw>(wJVC~NgK_JH!>2i^xB^G9EzX5APzUpUwLPJN`?*? z`5rNm8%2+x9pa;G^iWZsBc}K`eL3M3vRv}=i-)w8gXp~G5m(d1Igxxx>hN0hBXfgp z#2%@cin5LkvAsplO7zNGBa!20?U0`&BsISW!3$(?Qe^wj_+$LVSrACHOdE_Np{{`^ z9OQ@CP9tggrlW#~U!5vsG12Qqe+szuwjM<_@Ku!Yw9_2p)mqma5$K)F%1=OK1nC4d z?n1fm`K{-@dEKBd-EVQ}24C-aq^cuOd!N6h-=}d|_O4m`TB)`6^n?-gITq+WzacP&t&3|BqSm*`A;Nj`G+5KH%_=OtxyJHK^$A}XZ zD@pI&X%mjD)%PHjN|{UI-{Q6iTHZr>^!&T||M;PxR@0@x_pW$2`q#2|%w?qi|j1H4!l@IDq8=DV^2+dWu+~Q@~ zk7c5({{P$alfY&2xn++jznxjHBz0!KK|E$v zo@frhzH(jnuI_J`((Rus=b0r;yrc*mrm&Dp?8V}_luBu|4tkvXd_UaHv@p${+8j|= zda~~N|JMRc1(zQ9Swzjr?o-5WZ9~`fAv>xm zq<6JwVV1KMcT7R^|L+R3Nc=Q@J$OAmU4h|JBjYo%vr>ZHWDVm(_$!Y;%{gNULb+ zYeW-T_<;gQ(o3sZ(PPM`nT|~_g#JIWzA3!2b!j)YZFX!M9d~Ry9dvAWjE-&Fwr$&1 zCz-L?Cu{$Et(EGaP=_5)@h#@mpNjr#J(36lgX)Ju~6T^1R z8<`wU+<-X$vQY~gUVg!HbHBxoC2JFpG#L`vpD0zj@q0A)yfxjI(fqdk8!Ye^I{c54 zl!Sk&M?q6^B&mbn<3_Sa%jLa?fC<11g%-2DAIh+5Urwvn9V~VV$y1=lYy~4v`Ua4Z zAxzHQMr^J(av)>FW-H|4ZS1+GCP}19m2CCWu?1nw_(jEqtJ`%KVrxX2+8S4!#7a@VZ?v}hQiD@JYymc-PL#y!wb#R}! zSV1)k9}Rnt)R4xecUE_S)t`{Kcbp|)?VwK@Ehxjb_Y0yJ%wnOYrHV-fp~kYRvR`WG zj3zuWbetg#Jf8h+#vX#LKC1?6oM0@flmJs#y~#cKSG#&B_*`@$35A+LZXVULuH-Uu z?k9G(1g{mG4dd6@^(R?8t6oNRB^`#jO+Au?1h&|il11S)4I5--i_!0+zT#G-EpEU{ zn>33!4m_!;adEx##j3N1C-An?fCt>58Nbc*Q7?UpW)Y8rr@0F{&97>vGrz4 zc}7^{efeAy-V_UoE*V zcuv*0bv3hFg0Tk6+WC$O_O2R^u4-&P|HqfLg==$D$8UqbyHwfC z)N}Sfru$&vJTQkSP|J)s3qdb$?N*ZKlBX`z5|68x)7%y^||R zB{?yTJ}{>&`7{5|Cw(+DLO4BWC@E#d62rA!r(&e?*9CiR)putngV3b?i_38e;Y#&R<@RE%*Vdgi#T!*RDuXs`RbOORcA+ zZSrl4N{43u_~=yeZjB{O9dY;cSdpca-<8IuP0PNJOBpnY38SFi&x-Dd6KqEygC{CM zqpDUFNp>E0344<(o4*V?GqtPz?n4!SQIvh>n!R)SS{FB6>~mhqo548Pm;LU8B*_3s zBYhh>l+@(_@ZLfNTjPV~Y|bBZq5JN?pzCPeCR@JDFkhWpLVH9|tiAHSs21gt3NB(7 zoaOaVU$t$=n|oDhd}h=HkBIb-;-JOy3~foUhlgV$(9`y7o~Dk!9lGxeh69mGTM1X7 z9o)q#xp2yM{QA8sRFPBQm&fOR8_X#j_FdGFZlTF!DU9AdXc53|q!JAz4gf53?G(l$ zL65CMjfzBcP$evnrk7o`q0pf`RF;f6?y0V3vgAEB9Ys3lcOsjMyK4geX;l+!h5o`) zBqv6`@n$~u?AU&QYfe@q9)tsBgvifABixv{@J;xqL;Pu>oLHK!qPP6CPV60RtB$n3nyC0)E~kV!*@AKN4Hnm^io;9Ut_`K7yBO} z_<$*r`?PqG_-ExIiq!i_&>kGB6OnypNz`6uPB|G)_C3@IKvP${s_K*NclN%JKR^Cj-_Y@l{H3COeY`Yrzf8 zh8L@76|GcuOJXC#ZV0t$I(Al}qG(ZGS%CpCUsg+IYt;c6UmCf6JA1$2PvnRzu+#JvV~nxORb=qwO#3vl zdyV^(@O;2l1$@cJv6N_0kfZu%CkB>uycH+N$l}k>3snhQu{=gEv@pZHHylm%y;OCz zL5Urs)5if4_|Udrh9l?qFz0%ylEi({hR&B9x#wB|2)zMQz#votJC6LRkxFW%W&S*q z!^=wlIzwCJUu?eN3Fp)>blEk@dZ}gddmxqLg<=XncE8c1(FCy3G!7TuC7=vXhM!WS z!Cs!6;^cc6M8e^(uvC_paK54&MSpXeOKeb6K8Xy*4Z;3V>1cnTLe15K^%hQ#_Y*Tu zLb;aC*J9U{P^BK4-d)%^dgnFLWv#@A#a_Ea%;$zRY6 zB-kMXXx4^78TjJp;touOH!+zah6=`WKliN2Ww&r@?h_-HnyM}3;r$uYxc|I{5*2;@ zBT5XD^gy$7gA*{Y3s3napQO?K_mphgBSKN@ZsTtD;i_kT%bx1s1&$UyddFDRA-xL( zF`9Iq+4GETQQ&6&^gu@6|K2YUf%?K?z^WR#9QQ0?d>qMEAv33QHd-54a6Rv|^=&F= zWmX>3BU{54Zl%6mHL_h_eOM4ni`_jS;sB>eBD^jC#IJLq>?RM3)&6N0WF9J zYINyNIWM++3c8j}_NIzz^Ku4-+R;*#VtmQprj&=rwMVK4B()P~9Alrsjw1+21VwlR zBzTIL{h5Vs2$xem@krHFOb#24>=&BjWSuXmj=)W!s8yhw?aK1vBknZUxAW9BnftCy zH5TC+dzDj?2Elo#>+#+-MujUu_JWy{$j1_KRsV^w(RZfYY zP@yUbl80=jG9(UWQ(-*TfI@c6dp7iDJ=TB>bA0}H)tSL!((ItF_FUcMa85_;BsKn3uk|Z-8lo_MD`@E~Q-GuGW zJ+XpIMsVHxBP5F!}GIyHrK_e+KgAf^if9?`}B>i50t&qDEx z2UMJD6@Jrlf^KThfbn~M#gxWrNe1x>+|4%t)U3i_)`^^niIHN-V-ggFJ}d(pJfoMw3R}vIYI* zf&!eRz8kPLKY-^-&KB0l#3=kiR<=LW3+9M~%tdH?UCm!&1wCT>3Fg_vTU6z~DDro1 zCd8E{L(jm+ldoG?mjlXx1 z`nY%oAqgs{-zZ|ZQB`gQ;d2P&A&+(iIdHZ4EyB1 z_Yj+vfXQzEmC$!%Lc1Z2QA}k~ZLHJ(A$kKMQm%Gy0;w;#Z&Zl{i2sTI+xg~~VdpUR zP^}Fz;fR31l?^fuQt@qb)os!#tt*=;GJ^5jvrq-nA^i# z!!dQCK0ZVwBp{(AFvY)q3-_{sjVuMYPT-DNY6$qO2HmLLyWPJ`tQvVA4qPw@djW_Vgy-s1Fl z29fU6OVb2WrMs<}A(uykh0WbqsAjBvC5g#Zd zU=l&FUp`SjquGkmqyfxJ3WV*Y%}9kx8+k@HfI?6na$z9Ml5nnI9aOw9;;AZI8VrLo zeMB^S@OcC@@s>>?Lakk9fTn%VZV=Dx1Xa#Oj)pQo=!YEQoS zE4D;zr#`p&F(&(Wv8KI0yyT$#CELIM&G&?eh%n9+)w|@)crMgcwdPEPkzfg0VVM8r zH;H;kRRxnDb^Ls{ZJ0rTmI(G>t@9!vg<$Oni)m{N){; z-se9f^JTJ8ly;?{E0({&7T9z5w)Uv*o5}qv9bgjqBQQgT?tW}Fu_#rgGk8m_04b&; z*Znt&?G$u|8`HfVD>{Gn_EForY0bxVv0z--0ENLB3Cqr}$iEW{F0`$gKG3 z(p6d~BbDV=7afW;*X$X8jA3Ba>9U|Lqx<>dT7XPyKnz6+R!Vx0hv>-`Z=OROD7(uF z(I63{qx{E?{(IK*#J-%MgPh#hdGOk|3cr-b12l29^c_1vx$Uj)&xAw^usujUVu|?U zNGJ&Ot7gdqu}CJe;pJ!*xFxL<0&;mvmWG@#)#Uh?`9|6^UGJpA2EI-hRU6_?dgqKq zQZqeabfF-*C3JUibH}-%zkCt?SB$=?K;j@!J`XfwqgOY)D6VKD!7( zCsYYz{gluc!AL{tv(nq}2py+P=@|H2SU}(l$;%MOP;=^03ZIu#PSd*4Sb|L62$Lli zHL~wuHBHm6!TpBe{?o}c7dwaV$_IGVDdea3*a15mX;e4L5jPyLLkeW%yQN{CU+r7j z6|Io4|L2^dQ7E^tRA=gPlk0so(R)*tEvSZ&oZ(s<>X|y5TQws|0;Kw=R$>c(&Fqua zBGcuWf3`Yc5`83jJVEMEa0QucobR$7(ql}hhb}eH98u&AgBO}i0WY#0>|&PJ8mXO3 zD)1^T^G_0RiLWq1+R?p94K-PVhT^|Osmgfw0@`m_oYQNcc6LBsPjmkC{zT;OZN}Ik z<*|l+0W{Fm*RwjvNhQ+zpISF#FW%h>#k^^@#9ZkvtwHK>-ha$4+JT$=X={sg-ua++ zSrtrp9 zWz!6MzAI59b^7_yV}wmF51)IaT?JXhxt4#or8mZFS!>sKTg!OpX7g?X?Yu8A%I@+; zs(iiKGI$E6*>)Jh>p@qo(1b_ieML)m1yC5w7bA3XhJ}Ud=wu}JSX911uHSWg@60oJ zK`d6D`ra_S(s|y*1220_J!$h7chMRrBGqt?QObN)aZ(~&!O_tSpi6Q4PAcJk8@8EB zPlE0G${1B>_F--94kE2d<}MxGT?S|Blpn-j?$yJ8IGM@H%oQ)vXL|9{A*rdCXY1l;PNv|SWfc|Enjh!OH45Qrk*D)x{CZiHVqB@=hw`VEt*~E73;eK zuG(s;^XL(&fiIKCZGT)050h7u5W)>M(H%-8D1owJFr>)G8`#IbC5OP zacw)b4mv0>POoL$9!K1^e4zK*Dh3t~3&}GvP+!n#)OwbgbbMY4q>}pT?}`M)#d+E` zitPptX{tIAw5*w7O(xT=uhzeBipgWOfN#2c09)2PktbTAb$7yT;s~Aiu@%Sv7Z&{` z4Ysd>?7a5ukt1O6UsaSdOk#_eLT5b^hVVs1>G8GqED;MAtV*RIJSszH8_APzW1y!O zGeNb%;;o*vL0M(-{SGHpQ+_G7Jc8TzLFJXfb7~W}t5WfzkbI6r#Xmr zR;y>ZCeQ83gOD~zJkt|7G1G&o%iKXnj?nY!Cd+TbWg}&2uMT=Ciy2vSg#~sX*FbHF z5^L)A3P$vT9D}0cAbE)U3B)iOBH@#jWa~mOh<$F#)uV0;|2vK7K#{z(m;XQgrWVw)}qK7 zplRZpMTGue(B|t324E`52sNdWrt#FqEBrA(GBiKa%JwD30Mpp4H6K5EYBo(B4{&i2 zJU98sp8j+o*Yhy-M8AK-g@uK+9rkU_ripIbV(_E$#rxf$+VzTs@yBfcI0p0z4#pOV z95Pz5pYEV2pLTNJ(nQk+xE$XfYVFs)I#=A7Ke9ZQptzIEKqfUbU|L#Q+aX1n{(qjX zY_?sL$a~hg>awev2sKkT^gvh-ZlcH7dZ#a=fyb^~W^zU4DbdOY1YbdXVf_95 z$=o9IN%15I;iw4fb8*F*es)Ma}*!O{Ig?+>*e-s{H2`!GhC ziJ+DiZu;AXgTX{;MZ15xm@M zP&Z}8LSymc2e8FdC2zl{lmo0D>n)W$@Q1noof4S`3O>FPiO~#9V3Cyqzk`H+88xPs zrRlB*joIF8}L8#}tBg%R4N+{&=!0CEYV!9oG8tJcP^8(6y|A>0&ANB`?<9#pdb+j%{ z_7U%OuW-$kQDZPc#zM+QMLXwd*gMOIW$F*Qw&Uh;^~}1)t7^_L;wdJbE=-wf#bM7* zf_HO-!PFPP@#)@ijnPoIg$;dx6Cd9pCTRBoCW8*Jk$OhW%8-PM3x{+vW6#6K-YwoP zV@tbyvyocJVH2Pa_h`vz-%>rEwzo)z|Ra`%o^SN$( zcea>86wpriDLC%$IkDhKNF^W3SRmWKyM4pZ4kz%kpmMnuHsxp4xS2l2!5(UD<%4U} z3hH$^Hambc5){`qLwH^8L4x2Wa)@RJI=4hmTza#0oKSM#M_ptc~$&%5DWPH^Y zg2AHuC?*;A8Q$H1EsDz4oT2{5r$op1nGA`w9gZ57BEM>8Btq2xcBCcndUZR_TB> z@|U%eoW$-p*INkV1uKiT&a{Hih2#xOfPiVgYo|~e-n;hXn;=^ z#9F5C`^$r|Td#Avo<%gdHKr9@blwo!E^R#2mQ4@#fn(|bW9r&MRC%19x#;`0?`6`|DeZcBu&#_-j_b{~+U1kA)f^?d)Ai?!X_Yvelm9m43C0}q8(Wh|nHER@ zXlOd;K8ulZ{1Ug-FUJ5HVhjg{rc6f}@(UfHP;7(jR4D7H4HtigpLX<~Pf`@!i&{3| zA4@MT4F0?!7;{_fXqkFpB5*yTG7e+3c-@`S>{QDU^jqzWI?axeg8G-{^hVxCM4+Mk zJqv)H^I?tR27_3D*DOXONB;X1G2YY|M>0G5B;SjLrSCmm>JuOdg zn3@*R*vdR(ckmo_&Qv~AjCA`G?8`V<2H!s~Pl2|(Az8tBk=*GG`M{c5T90+7?~V%# zwo^J&eG6(j*7Zms7ul6ZK4+)u&dt_5&hSOjE3U43RZ(QTe4= z4aMweECi?qB@F)#g&#~4C5Laef|k67db;LRFcfS4Dbw_?c1EL{o=B;K`HLYv6ug`^ z*385;F%g8JJE4BbUw)%&H*WB-W1WSnPV{~eN(po}Z3F2eToWk9lf#dAleAE!n6+P> zHko6Rp6XAnf^wxF?aoCr#xtXx8iB{sJHA*#Y3S-rx^=N2N&ai_3v%68Ml?T+Y;AY( zNN?&L`bie{(PjT5(f@cnh@CW}Andq>kL zX`ChaD86S-K=t1J^u`8!7XJy9^~uM+7~hVERZ#1XMKsIN8>`oi;)K3*rc=Hp8-sMr zPOnrWBvQ_Rkr--?5-8$7LVC99vRoS89PBt0`Q`k}wF)@m6ypR7pW$;U6eR+!f1$uv zb7Z^hUe0Rs!`Fd-OjBhpy}t))p2Gl^|$viL^QpZ$ICrXJ&x+hN56C{U1^E zZEd0Cy#n4Cn>^Mz3+E=!ptYLydR{AZ>M&BZQVp*2Lte%6i=%KC_x7l!2dAfr+Jq;} zu=>swQR|_z_&R=G?gY~`({C0OHWUmTpgJYhJv)_GSXo)U&S2)M1xDoL7#uoKJ#6q< z(}v?L?9?Hnfqu>wh+=_ox6Eu(sZ)1XcO=lKYp?(w0g@O>AmWB_&yy!EJDo0sL5{Pa01isyG;1)_hag3+%!LqOH=UtACd4WRWRWr1=d1AkA zZ?5GWWUg)B@SMTCSk~c76Y$V)jQE*X0nNJ;*hm?SZ$5!hhi+~xNGc6xYj}*y@))MZK8SUpF zH#gh#+YTv3Mc_QY5G8f^rib6_CVCnPf|48|s^f|p&*d)R^1AJ!yVHRq&}Hh4s(h-F zsQ>xr!wT%X*Pehu)P?|zQPH@M!;}DWr{gSi`_H*SIiKK82Lf&PHJQs5fj6A(L}=SN z)5u`|#Jt?&4*^2GC-!Q;&athkKr8G4 zqC-7cN@>z|N%JUW`NM@;0%dHTg8eJTI{#=^o#xyk++Gs_tQEf7yDJcKipmsBHJ__# z^!j)9oyh|@PpLvQI9eVu8T62_~Pes`Pgsuc|j1wd}Jv)?I1Z-w#0^R}i~EGj#H{r@WtVwI6TBc1RL!tk^1x z(bNR(!Jj|HePB9}P*Slh^+!%tPOz*P{Ti$S&cgdCLL;nFd2~zM$fxgCmilT)wZYlP z(r12JsXCYgosHx8u{@aTzkVsQ#^_HDd8rTAqhi?xQ9xYZ6iWM-Me!3%uG|Rn$20>9 zyZYvA+6TS9nz24k3-beawY;Kmo=kVF)Im@A;Jq}ESi>gK`(|yq@~uCw&)Ke?zx4D` zq=VdWYz8bruki|dQ-=cG$%r~Zg8%!<-$e!4O%fA$_Mlz^Q!Tl_QJ=}D*(cg{~si*nUO z(GYJgpUl3MfTcvTYp9~ZSC`}2gUk0_#2r+^HO#?CeE3tDOsFBxXQU5xX;u8x2wmj z)`csOEdRSiGM@!GD+fnU59HYt#?4@DV8>B2y!Jl&T5sS*&kaLY&rj!?K)!bK%ly5l zARa@}oW_J0#g#g!%DURyIb<#O10$$G-mcI!he&w7T__Iyp+CQY+OFcNpt z?9!HIk*yW|gd0CXO+6Ht4Ck~@`T7su@7H^14h1TJR;m-oLVSls zZodbM?^9t8UDe}HwWlrZVyCkx5$g8{&Uvn0X0fpMD!qzV!jjr>X`Sz1T(3)xfULz8;lgd1LP^IFSkY1W^YTKBu+>- zF;P8G=&-%@Kwj*-3KP zQpXYCvZ>RLN#^11{!}4tI=S3k%M{ATVYl`{Rh-(i8zlsifz2_dXjb)IXvgbG63REo zhOdhMpYWVSv-4^A$(%6mv|48!9jIj%Idb!JzQhw0qO?gd*hUq2rh;1H<>z)_Zs`Cm z@w*ZNI6deAb!P~+&j#YXb}#r)9Dg1RIImj;dQ>y=cG4g{@jeu?kLJ7+pI+;dT)X<< zzWQ?9!C4|o+N5yTk3vYFFHB zr^8MaVml?P>lqbISPsUSs8lq~JWgx?9hw_#aW-4})%-@5Tc~(HunXm}sEg|PzD&B^ zcJv4D+-(~f>wB0TY58kYp1#@*JUo2eK+{ZR_0^MSbMmhn%cG#C7rc!HggkEU za>I6z>a^pk)8idu!dlUO{6-GzQ>w>ZL%c$}82gP@r|H$%erxg7@q;UN+2$RgJqw#o zP}e}>RkXEW8r9k|^r4#aI5$x5AR>Omnxdj8I!*+}G&*h3M*skC;Pp<}`wtKtQ<_fR zYBHiTdU?yi%0k4R1`iX#MUa}R`&uNkYhZ!;?d{3Dux@olaHAsb-xm5^2q>6kk{I4) zmu9%Xp;TeREz6_6_+%jZ=1B;x6{61(Ow&P@wzeJdi&yz^9a(ryE3?>TWtYMo{mw7A z)mSjh9Bj>r@zy-Yqy1KUF1~drr0!?~pz3 zJOHq)wFf~?&!&#;&LV=~i>+t5$E8*_+W~8jz864f&o`sN-b)GO_dCFx?Fe5}U&L5q zxAD!x_k%$Ov^aKUR_G&D&s-{)?=NuAdWWT}V*|am4Nd;L6#puMAf@k@Jz;jJfvmO` zj?+WxbHf;6Z-N9U_#EuosI_0s?!-BlrC*!_E0^=WN_%A63G{fUr}m&sD*mMwR1CA5 z$@BFA&KNg}W6luJcHt-E$nuMY`x0*QZnd=TTI~LXU)V#=dQFAyYr$LA&YKC@Q+V+2 zmz^jmtHFD<&OL$tT37uDC_;q1Uq{>vWsDNvZ1w3&!F)2nVwHA#F9@X~J?!pnuj%gh zY@JL1@)rVrz{+Ep8tY#oA1}Ge8si#}hkUzw;*I-Cz8R5}YR_0iuP#YC7dD~BT%AE)$WlgPFl`K`$7BmzC)qw(N*LNG*EWcp`Z_U zLvlVw_bY__S1~#}T?}17UF{FDkGDEa-NtPI;NXi^NWA(R&t>nI41HTOB(a)-elKUK z1g+(TK!J`6+200n1uQOGkn~&bTEEYkA!^O$lKUTbm*|l|O;tp>+*M#37?M=C=J~12 ziT?>R@(W;&kg=14%sO4%e@54-4rE`@*Y9fV%~&U)I4X6Oqk$vfC}A2&zy=5k(vS5k zu9M6Mi>Y+q@3E0Z@HWmFpFm>UC@IyfDEoQuSB~@oD6)QHd%5>C>3`&C?LX!UWdi4> zI+2{$t#Lmp&5pwd4wuAjDo5^d6dGY>V@Xv$OnGhPE!FB@EUc^o7c4yV&sLp$)PC=< zb8-$_-?hLTTGbOzxkTZ@N+taqo*U%a0Ne zuBn;!gdSqCk`Pq3l1tbK%h7IczjB>W{f@RLE3`ah=*4B%D}uGfmpR7uCws$qEb+>e zgL}+^kM4OlWq_eqSc)K+NhSk;(AN_cK2k#?q=r}#D9pZ|#ef8}p=l~|_IJZTHv~$G za5dj@NqvTSM8TYMW(%J`?t6oH;*P9Uge{kzl?bM&^2_*wp|2fb44PJuzZ;(CZdn*# zn5}?w*!1ZXCoBQi{TEl`D@ewx_PXueE*(fIwTkU2lJ@&|5B<$2)4l^lKA^3Qi#^*v zO`VY9fKJR0t_+vc7a27`xtG<0ul7deKoL4L9O*MlInVApJX552W8sl&CXMt|ceC6J zng$inb-Cj4+Ge-#qkynRx9YLrjm(R1p~egw&840B6idawFQZxXO#AkMr_r+AOe!yM zYBP<=s`bwRs-@Cb>yk?DDl-nh)^pJdf}EOyE1acJPn*QCfRbvaU$<F;Z=Ayu1)8}>E)E>2MIrv<&Jzf$%MgP z0h8FBoVwzG+`+IZyCifj_Z+E8KRS6jwjVH6{IQg zUyLN^59F249UQ}ZMmt@tA~_R{)SbKzbzi&8 zw$ufEKp9~>=KcGDsOMzYOaF-Ngu+lSy8}m%iNkImCU^?LY79q4TI3tWwMBr0?{cMu zEb@!St=j}!B#y{GaBdzNnEj-`hQcF)6$}yV$rBW^XcD+IXV9sj%X>d`oP4Xz4#I=k zxO(USmWaMA$TU z$%H!Ttsk}9s{uj>e#uH$>aIbIvN`@F1)OAVjaXLN+(>jadsNGe+;DGXt|`pojGb2IsqVr14ZX{~_0D@dv*uua}~a7J-%O6>{9Zz9?RV2mV*M z*Y{#!H$MKTiyDedgDGG@(2BHa7oT&$*6TUW<2|;XpR@DbCgC4XP_5TA7~H9hiG!vs z6WHe6Qrw+E?@fr8i#Evi2@F(kr-Q9+z+9y16h3Pvs_V3`$8|HgOe&C4VL4>erWc}T zvpu|J!+^>9pya(}k7u-5%oMMrJJ7E{~v9lM?2fWL9e^ASDl#lunoIm_ko$l?#e zsmw``%#l^UvEMt^7R~kxiw9!)X-kn?J1Har%oMKOq`t4j-lnH$mdHBF+uu}$JPVjI z|4YAkp&9Gc9^pm1FjVt{u9J&ZPz%z~CbbPeEp=9TRd){EUrivT#Vjvk-z)5c-D2un zXHcARP!u;iq?U`}DDBNh$`06Mf0}B3>!aAGu}yW%Kd}EcG?YS%6goT*0M$om(1g{a zM>x5r&#isAvbW=K(FNJ@_Op7RoNKWpxQX~Hz9)pRD(+xx#$9=CrDa=g77dSN=;ult z3do}|4Q?<71Pq`RPFf0LOS+PA{M?r5`_?Rcl`{=owbpUXRoNApvkzkZlr%d;@&aKJ z1QxXIF`bY=;5!H!ByP?xwastrmMgY$UpFyAbTtR)tlTIY4-Ghjr}tIG)y3g!3VJ+E zQQKlE13K14!g0I>-(#^%ER?}9>Epf6Mms zYXy2s^mv09ki4#=qlEPS0Hr%GBCc>vL*Y(kBIv!09z9v{&K&iJpl0~81-@I9aa&3ldO1n(=RRU3~9!CQZ33M>&ep-@|gx>JfWpin6s9a28Fego0B z-%>Z<7Mb2?`FR}&Om*9MKVUwda7>vtA>sRGG;QJWzm@nuEqMNRm@H4Z++dOQp?P-% z{aBh3u|Bv`^fQxz(U9-@v47}3*a^U%XPW+Iv^a=2p2~#YdDVcrl55Ojiq6^uN4+5T{a!E5UJ+$KKFJdhb4SeJUn{i+msWPnrQ0e5f5r2%@?o4rjGCQ*e=n+wAQTJ z$UfR{c<-e<3D`NTx2F&+nJ=>a9qiL#FPf&TtH;C}{dMp0x+WFyeWq~G)>he0v-3L8 zO~x59;I6Q}D6$-BJr9S4v%9^v8B-7Jdf+*BP^(5?1_F<|ahzXf78fy0=3I4i)b-8H zNBb1S@!$w~^ljd0dnYRurhBcALj=|bT%Vtp5#2d55l-cFqSgkEC^CN@su|p!G^`K( zp2^Uje9Gv3jRF9zS$BYIfdO{Z*qy6~B7Y^zSJu_}>-oCQ??Co2wo%(VsuelGsvvWy zWeWgK&#T3_%|56n&`593R?E)933c7bP zxKM{zls=qfk2F~{e<+DU53_5tdYKfeq0999fUNM&@S>uqogY{eZ{Ac4=bze)-~p1^ zFo)2~x?QwsQ~7t{x#=JdmiqVH;i?5t~HVKJ~8 zzMzZUy%NbX8)uB}VbB0BeSo+JF-t6-Rx?&6GhB3bNZBuX*&4#F# zsCWnIkI^ToR|o(K-w*GXE7zSHDrYTC1scn1-m&clJJQ@~XPr8#7tQYGh{n51S6hNA z=ZNkj24uE`#-RZw&qQ4pmpb%Rb@e_YsI`!@0dTgO;-EYA&Ed(hkIg-4e5W?FZLv12 zOPFDjcJ9U2s zBXIlX9*3wHVAfVOf%P`s^D+h#K6=Wi8i{aoBk%1&794KJ)&$x9mfNThkbsEN6Oqh- z1Q7^RAws!y%k&X!nlaqlJYV3kdUANcx=gVX;${r@zTgTthH;pt)CG>Z(GRP2cUK)F)jJ7H0LZ1h$?+82?!R&hI)u2U0Ck~9he4tf z6)PyWRUYX1^QRq4vVy;z%oh?O2o-LzNAdFKqw>~#StOX+-|E~SLyW^_8roO`wPOb< zW)52VnDFL)C$P$Kq$%GRaU`Z z(*7xI7fXR~ZnIRb_w*3ANd!ls;&Z^>DHvdewk%ml^UaG|I9Fgj;VRW3I{=w`$=SfH zsbxIj835y;nMnIW!7Gh+^?}n`Vh&Pmsh88rdcNx2>T4Jd_;k|<>p(k2MGNalC<8i; zt|^mibqG?I&x|X)?!?AchtB7r_$*)<0ToIUYN%+75)g%u$WWD|jCriPB6i~5oJKk4>|S$Z<0FXLln?ng2Udi% z|E(cF`u+yaXIirJioULYaac5%NpdWGrdFcvo~f~kk?X6$iYp7)i-Z497HkBRI|;xY z%c4YtnmrLy8e9&fw8aI!0~VEaxi)u;P})jSoxOy9f=MUG|Iw1};YN-%FX_RRcA>PmjT__-|9(B1RF~6L08x-}}=@pB_R1@)P(T)^&E3a0S5VEdF$UYa@pg=G{2D=j%;vqwijby`348}byd{VC%32k4G=qMXhDj0 z*;uI37*QQKv9m+sUD#R!LG3PHKh-=IbQLD+jJxLk5<;?zM5%b9^>vv&$rp9aRkR>h z_H~c75RZSa{~Pz;PUhoGtDzso!<{oo3n&k#t7EAU?daMjMP?PO{SLYMBsi?zY+1{G z-<}n&Bt36BU5-}ZevHbcE9n9kic|T*j28Vd!n-3isiKX6$GlU##P{##o`ebRH#5Qo z2h~c&)6qx3q2&x?B#S+EP-KA084-=zNR2||lM2%UIWQm8B4Z>q(KqHU$%|~hs+d(4 zK$A~qf#r!G<;dGMPE>b=cwBu?s^oc$F%yX6nAy^Q@@&0FWQ}jj1YV8{R=@@hXmBfqD489GsHxJDeq$B0C zf-Zc@x;k!3iNk5Ees`EU6Gua`*1V?hk9KCBhfV}fi^d$J39GVjTEmaea3Ur%?&1ZpXmwah0sl#nz`7$Z z0@?z;xO-s73ks6q9N*X|zm;xCVp&C18u(_^@vRM$tqLkzLol!1T7jn+C+4)dFvS(* zAc6cL2?s|w$I1M%TNcsO7z9M~_x#hVI3focQh zy(2w(#~JxYIM$7yGd%X)m?Uptl>8w?u!gSSNsW78h!FRi?lCNwN%3hU@6J{C0*5Yj zBD*(7fdKAU>P>f=qMv>n8*6}s0Pl(84E*3 z{jR5e8K^L$SnR7gk8B(kGwPJF?&DBRP`Pxs5$7Wq=*6oum0h546ak|N`-J}seF+;4 z1{wIf_(7>)g8cQpuP_yra?k~jy51pFfMfA|hJimTg$Bxo6*AhsI(EjUAkZK$ajgLX z8#j=Rg}}VS?LRGhsNoT?^t(pV@`VjrtBo=@d6t0D=oW?kpWFA1co(1a+dT-L4oM9h zD)0(DC{xQ^N-p}9v{@Lx7{$fOIK|EenDj@`f_j7OibajrVbd^B#Rzo`3rBHLpmf%U z!>^Szd?qIE*^?KDeGE2;u%?Lizz zVoE};8Bk~^!7?S-!<}Z{^y`~$YIQ3 zV(3;}*UN6IW@~h{`Znqr{v!{V%5t6T{xDk}3Sb3MSK=&lLhgnD)j@kB(7oGYRjXeB zO;Wv!_g&$&h#gv}D;(tNUa=+MvHr&arJ(1S7DSArzgH(jp{$?>&EEu)2gp`iR8JyQ zCxAge9OV?dM|%|B9(Ui7T&Fml1V#BWrpj*k-uePAVjEgy4yUXtvzPw;y-VEwH-^2C zF)4N0oC@r9bJeLbH7Y&{5ZZ&rHqBg3J1EBN2W{VM6Fg_PvoyH=CyD58%Q7 zKYUb`>w6=f5H#uzR^1*j=^qtF{_B<-KNQGcdPHs+6Z?`Dp8vujXLM+$B)^8XS-Aoj z9`2z~$09U@lT}NmjU~VHS~Hj(7D; zet8oC47N#whIVRb6lK2GCqSS&PPRMUjf@}NU=&KXjF3H3%I&8)TZIZ$s9&!jU|2%` z?HoW0DBOZYDMin|9#&G`o2?7AFK#RFdw4pTTu&1A@zsN;69=l^I!#vc_>*M<~ zNQio-=F&;mdcO^WCL{D^@DP4bE_LOzsbn3SdBRplbua$_Y!sjQDAs5J zrdmV2vO>!vJBg+lv&vz-!enNZC8PSz&#FC2M?lQdO4SmC#b~jEQT`QNEb-MGt-3I( zf(k%j00BT|g>?u_Lu=d@FoP&qOu8OgkSX`sZM$IKOT_9bfhs*ha>9D}e2 zC*A3cEMqx8s!4A!x5VNzSxf2=gtc<9)Y(=!M5Y<%Y`l@Qx%xVL0r&@sqNpc{!Ufpr zY3(CH$8p)*z|2xv6p{ovJ`!PX;0Up;W;*$y~8Xpo`#(cN#~^<>I*7H)2P(M zLdp6%j+@9ycp3-Yezestgs(@Hx|r?;zFzw$iJ_65C?SyobK}3yZ3xgh5UH)>B)5@2lsw)`l?Q zJleSQnT?U|6Zhf)neAK@EL0i;Tpl{YzBI%kd2Q~R8U1IQN`G~QWYvk2XMAt`WA59! z!c;`=@{Ees*GE$}*fRe!xaU;7%2zt_Cj2HX^%)3XC z{B$b?$5d;EBAvz3&du56N?{QyzRqN=WrC>l&oNB; zz_c$UFJ#EXFp{mKV$voKZrX0%oq^J^@87;rj%kVa^@Cq1Ual~5%0WY$nIWkkQ$6A! z+F6N`s2v~4Me)37+yEZAua$KJ=+kA^fSyWU8eSdX(0vKYzi!-bUF;o+{s6LEBq$to z$>aC!Flwk=T1*-1GYRerctmi_H2EbJqg;da&b$L!1`?QyXXHE*MNLJ6 zOBF55#NPq*|FKCby#9R-?OL24hix%5-pYwL!{&_3^R3JnERf$iK2hft9Fb5tF2I1{n^-7f_ z#?H|1yIhENN9%J$xjZ;5F&u3hXH>CLBPx;Wkq+JBY$8g!T6PIUG)-8&SnM2In?*Nm z4HY`|Ft>)(Jyw!dY5FtpqfFm+R@R4kG9_0UDUg_NCy75%I6jHB=mBKSUyxjQivwu6(n<X%RhX=}r;Z1NE%Y*$tK!kB_$u`D`E&SqUs75O)V6l;GX7CqXLQo4eamStwIa( zp3_*LAK$z7rP^y6>3eBDo(<3wlhXX`di=nPxiP(KKr?gb2-pcjjDLC?0YGIHEX0aY zG9#iGHuzOKXlUc)Lh8h0~F{)AiQ@Cvz_`C#>|!tK1_wd39!^9hF$nVMd7~Ndq~gLWw^?uYyt~2)p7>#)R))5>y-_(WA3| zS8{&~fUbp)B8~U16`lZc6Ody4jwP!~+89gLUdzf}o|4x+WiNNVv5e5fxMIr?9I-^n z$D-6UxxGTb(|!W-HEu4>&isM!R)`I)O@mCEmi@?pf*;H3`hm}aFP}KlIT0zo%)Iz) zCa-`Rc8j`TfH+ijy{*u=f7BPxEu=KoNHquHLF+^j;Lr^$Ve8iYe8MJFM(9l<`%m(z zi1pjYo3uzvsml!3PfmV;-In=!Wb``TdT7`NjK=K{ScZ{)YF%6<5}C(q9r4lK5cij% zzMoqzwWnHA_*hKo!oChJIvhmkrA ztT~sZWvDL;eEa@;kA~|p6BG2|aX{DY7xL4#o1KsB{HmTOe$2~5c%8{l8m^bV?Y#lm z-K?5 zL>hViobjL7FI0^>hlBYoxclcP4XS`b42JUrb8JQIyj08h$=Z%1WY=W_P*3)lI$E%7 zQO0wL>{eJRV0I@!Mu*dbSt&?et{ z9g&&m;0^T6+B9ey@Hcr3qa)R%HF@5QiP|h&fGv7+#8DGZebt zCoi#sRv0BUabI6wcbAmq&D4SQ}P;{KG9=-gLGN0EDzVzjEUVkdhePT~z_Qu)t z1@GY43A^Q_BeOAJ6A2f4U?x&5+NXm)yo;Xec3_Q4AH#qe%n2OyIm)rK3_3P@zGrBR zinjh2O-Gu@Ywh}LqWW6qbC|K3FqshT5y=(NR5;8J=VLma24T6S7}hbUWK~=cKI^)R zN5ourt>ux>eR2Q<$n&kdU8=JV5(qzFpCp9+m(|{R>Tigj5U%DlwgbK#d#S5~q~KV~ zOCX^${74e5&Za)ZfqGU_8Nlv?8ss-MJ$f_E{;9@9a=g?+5Lt&-b?XnDg8X9itQ31O zq^}!}ZFlL9=v+a|3H$eQavO}vK;Z#31?vz_9Xb(DZCtPGtb4;}(3p^BS-qeOySDiV zlg4R|;8_AEiY=$#zPo<0_y~y@UfJ=h`2 z&bqBN75cV9MN#>Qi2Bq2XLMV@@hI#LM)#P2+bb;SC21(SR<5w?{f$xZ-ab>)vDR8? z!moA{S%nDTh1ww9B?t{^W;}aQkrNc6$&CBRV>shf>u|9@rxbuT_xe>?_pH|`Y9&kS z3qd>*)1YnB4$k-depP3^&H_YlV?^QeLfC#>`|h@b+x4p>@Su$}xtTObm92JT(c35i zpjh|(shZ``|KpHAC~TAvHUu*p6#Uh+%1x0G8QbTIsVF~BrT!n*xXg@hljay0*nhVw z{u#tX625IvVZUF@qf1@7YVzY(JuCK2zgnZj;(kT;*8oG4=R#9NiagR2E=MEPIN8Q8 z6fr`Kw2vGzL@hC1)`T9+rM!S4shS~AQ1&KLI zd!(LFkGRHu$sKs2?}@JSvZZ`82d%$1A`y!X-+A3qImzU+yHB!rd`Tm6!eJM9Wn=B>(j^GaP2@;c%rgC+2_6~Y?@+hkW0xwRU)w9{HrNe@CJ)wj#`l#p}m|A71}Le z@JQ+JI?o~+ay3bwv@2pmWkO3@P68kFro>mfW4eh&SxgE*uuD+Y*0M|4tdPReUw9Q& z{UOs!lZ@mq26kDgg+5isS<`mH`TI`(?AHXLq)x7ntcnQOd8{ATRgr$46G#<$LX=`c zVvNAt`881?Mk-LJR@}^hSmx5FX=Fx*$x<&4Lh$upvmvL z32Nbg4~m6=#VI`MTxQ@;Au^Tc^}>J!q&cl9YB{OH;u&Zxb;SB$L7n%=Z{!BSvXSvm za=)W5Eh&s;U+5JA+@+JDRM`C;5l|-1IxBdi11JI5$azi+pevw5iH}f_=7Y{AE)9+k zMCU^SYgQq}rcPDgOM>znwCzd-+jP3k;PHCb)tGGF!LS(6+zWGjUNuh%TEX!=x1{SV z=8g11dfr}N_ap_|p(y0DKKb_EQs~9-=vLd z!(70bTm6ip#fhVKcTAp@L8ih;tnYY4(svyERBu+Q!vZ8hk&`g#(Dj9O(;A9@uNYee z{$pT}#y?6o5~5B~jju84U3IAs|GsSg1OKNgU3Y;U`GdC4DPFjLrb?L5Lonq~7|`io z$ra)WtG@}KNvD=qP7^g7xyaoVuoa%WY+N~36{VH9^$sFkyykaIm41s)^Dl`wlN=`M_F4?sD1sRJw9KNj7;UlP{*qYUpZhXxm8T7dU?P{3xgr{DR7(jH6f| zh2JQH-u$ZI7UFNOdwC7cHUvj_ZnbkkPep`Q0NP$1H(_9T_ANo=-JEA^|0Jz`=#v*N znq-74Qw-WjoufTF9`^}R8n%77 zR$FZaRE=Al%vNmHvm3#el{@YkYLC2>K=lG8cDCz~Ip%b`tjXaJ5E_ODK&aqw)zJ$s zcju5Eo}LDYw8etZ$RDazOl4ht81uCz=j+HRu_2AC|Bym}v7@UvR=DAd`0^%iHt@kle z_Z3)UCHZ>lyXxb|wOT)x?xRm+;&rRTU=uu!nXUbiOe2m-b%QXG6UIuLF~1{s*IlB! zn+{(9XAe^|v%9Fsn@l=*A=3D$2CH9ri_rn=#DI0AI(Z!0{6onvT1F_*V7U?~;55LW znn)SoF8?ZT3sfQidvjJ>jmJq;J6&%vPQXc03%l(k_p5P%4>=1fNlWC9Kk_EJ1rBBC z4Wr~q=m4!rV!{u4w#-$+^RC4xQ&pAHIaw-WcXqK`Se2ZTsq& z1LdW@kQ^EOpg#8f+$mFfo8O-ykZU6zF+OSw-=#Ghu6W-pws# z1WL3hjBy$c*4tTI`=!JnKOOLfewMQSpdnR=o_nV-N+SE^pNHIBaj?)L&&aXNu@sWg zK*#fs769IiptXQ2&DpI2u5%gs5y@O1#>X0~=2WZ2ecK_g*R=t34#%W1M7X36X{QL% zuTNmUkO3}KgW_{vSW+kA5gK`Ux?ApSEGCtrZ36g zy84GFN!}z|F{fJ?$G*WM^`WM70E;x5P@(3WL}G_fl`|(qR*FCHPdCl%s;zS4FYqF8 z`669%1OZ(XIh4wi%LMqc_2{J8b+@ z#NOh{M!mJZ4~^Bu!7C{IQh3|64;40$OLZOVxF7X1KL_qrvdYl6SzuzIR1iVBj7D7$ zzRk)i+NG#}nVdkP_VhJMyL@IhDY>B$Ejny~fU=0@Y!2GC2dIL=ZhuQd&0Vk7m8(nH zuI|mvM)bBWqVolLU`daepY}19A(t>9C#0dei(}6}yqy5#JJJK*e`QqwRhE+7RYO9~x% z-A}mRC$G|w7AOs4A4>u^SEFO5z&u_qpBCUR^<2AE&?Rw9x>>L3x^nPQq%q>3dVq-~ zcT6wxUAG4g!|O(1>vk&frZ@H%ZqDyx?huBz0TJu!YMYx@V38`DstcgJ?4X=VV*x*w z&mQq9PYDfp;ShtO+$!XD#t&aY3rmv4`l91fU)O4K=J;~)-8Mur*PS3EBh#Q(*UfJb z;TKg?YqP_mJNsnd?+-+sx7JOdYLN?*U17TY<$P`s_F}1KtD|naBm4VNE$6^stN^6k zrTQ`C4^~2iUqc{s3r6osNR*d`nPKFgL(Us0>n!%Pung2;#CEb%UCjNr6Rh74T~G0* zZ842=P}e1;2*QMHP>@dMc7;H8e9hqx9rv!&0|4i8+4JB(ORQ_tFh43RV+niUjD4?} z=zQGh*=U%=bK1Q?Kd0{u??5iU=2fIA)L|ntA#l7`c727$RSSms9tl@#gsm>X1B17@ z*9oEb72UPS3EOP*ZK}co@pHgv5q4Th8yx~)s%&fWQo5~rDuU=ljy*95XEt|0{U_qz zKZFQKUSW7q4>MFm!APLR@buiP8gm)NGs4jnJZK$(AgB0|L};-d%2cKl6MAAB;7)h< zcH)a>H|T0Y%Y*S;Q`FELIXcjN9-zvy?5GZs4!*u84xDs|G|8_zIwajmeQR*k?ZyEL z>opC$kNtu4t1P91!hTtCy!fnPjHJA_1}#@w#EP##sDPGls3u9p6Mb5guGwnpCO?`K zx18<#ny>(TNpLz>3uU=hVHy!B^ay@dAffZ-}7B zr?wgSwv#2hzGlQNSizoqvo^a&7%r>CYJ)rlzi@o~8F$puVJ-E;vlu{?FUb*#WRcyc zFGxB~xOjL0KqS1Sg&}O9;M@Fqo%^^_+e52*Bcl@T9;+n51iawSherDkarHir?*iBy z8LY6jFQe5rg^|9XzddKL=YRqUyR0O>-ovVOW;TfLhwpYbm2ix0H>+K@lK2jFO7@Dd zVKNdjL_wn&^Myu?Sv>a=T6mNq1qsh1x1a1sAMN^Nf9ru4cHAqV&Enoc%;0hWhW#P9 zZoBAT0L0Zu--s1+piWVkb~x?*Z(e2fgPUm~*F;oFe|sfr4&1ktQ$v>OH}Go{sk||V zOsUbQL^5uv(On1UdLL1r=B&d76CdJr?FATIpBt`O&O+NCj%Px^DpCXYUj|VR4FuQe zgEGcCXO71cU=pYFLyUz-=7IF|CPv;K)r4x6fyb6Of$L4nN)B}unl*IP4pV1S$XgAM zA{7m<(FOCAaU1a!Mq|{*CE4Py^QA?K$ihWSDM+kF)-+;X`b7;ew>y+37W(604+uK^ zU!^o1o0J;<1~Bc2nO1aso( zpqQQQe~k9lv_`E#Tj^Q6Cbl=Tla)gahgpWtn+zY_U}HE?q|$%RV1xeQbHwd_+#P(g z1g-BcIl~9Z@UjKHvY*FFlm)k+`B7AVuxk}c0K(~e;k(;hn+tA3Pj7$Q-P(5vZ^kt& zo60aej?u|3VNXb>2e6}m`6S@7HflH!WV`0o=wUyB8SDQ>=#`|8AJz)r{V}q+H<>F4 zckF8d$>6kQ9($-S&kuY&ed}$Ku@@p%@Seu&XVL7yt8yt23_k5&o9jil<#^I-02I`G z5h=P0b-a8ssSO)Vzcm7d%o*u+H_YbE_7*$yw3vz&iqYlTSR1IJv*_>sojllajBN44 zdRKkphKlA&m)e_6)fjn}JzIU5t?C$*U7p0t?(3Cx5QJ+?a879Th)0H<`86*FF0U!N zVn8qF$=Y=g&N@Cy;Lc)IgW5<|cg7}`ua~I#CRFD{#0(`*7z^<(zi#(Ws#0r%0+yU{ZS#hBE}GwDwLvlAMyc%NPJ1*psDJ`r=Fc!0biP|$@RP|VY1)Wbcb zvS?(0P}$^cskqkp;^%SQt7XmEJT982at%$;`k2Aq(`jsu<4FqR&26^)I1#aNMV$Ao zreeZlDwP2j$v}ee<0ZYMi#)s^Ps76fJ_x-STlJb*J;oY>*z!?dDD!?lvdNF11ybaSMF3S`%J-Hpglm<>N+{Hy*i%@Yg21|$Frf=Ggl>E zv_UVpO&Mh+YyzWddf39nT>J8_E%b-?< zs^4jzx*c9z=wGt+WqYtGVl&cIsZ3gNp#MKJ5T0o$l*~Q}&CGm~1A$}A!?H>gi^=t@ znND)tl3*&JzAa2lWl^0yW8bWbhnOM*oU?E*kX+&C#QHs*uhsb$lg}R+?r%nw_ z6m(^p%Hadw(e23^ZE-x3d0EW;4M?Q;95jf)n~1-5tt49-Q~Qn%p_fWWm-Mk1>Tc8G|+-PvV|Wng#6vlk_6kV+1;|JooM5yBtXE zCu>vKfa>W>C6<=(;m~l@(LwE4{=rG$AXYOs>d5sbLNp0`*!F_Q?1Ad^;^Kg1MsOgc z@pIAOdC=$b=lyAu?G2E&r+`(%fssoNm%zKlx_JIx%c}*$wJT+1gSYL{6rQcLkEufJ z?*{IROoqMdHzc8^K3!aQNmX!wHl}Wiel3olY#46Qv99x;`}nZ;bkiT0A(2d9e<{vw zgj|ET`>0Fsp7X<867!8ptOX=H2y}#p5s0TRNrKs`vnL*uA*K4ASfn?O#Tl!kG@PJ6 zRbdAqraq<5lCTxsFzTlry^170qP~T;Qe|@$2l7vHp47=plf)5#cmZFR%bu-h8lWs! zjawNFXuvlWt~RrPy$H^ytj3R$%x~J^o2jI+N*uVAn|tfs#?xM5C`3b+3io4nmm1dy z!`>cTOIlTh4Hwcv=N_dJM_M>-sO@vu&#c7ki}*;6vt#S=y!|FF!4*2mer%9AuI*k) ztuGBW;n7ua9W~;W9K`jNZvSl>y_pL@LwEu&ZpWj4#3=lGi)ecgHW#OFSx?=@b015|_?3q9_U>(c7hO9}p9wDPY0=UIwC7xGEn*QJ(`~Lp zB13jmzh06q^=r_$SQ+Sl#O&ljOGMik!P4%`up`1?@L550z9#VFR&l?p%Oo$$BloT| z*xeTdpr0!`s^n6G=n%b+CfD}wgY(ZV1iMAs)`+nG=B%>(l+ zTCf1z%9FTZjy59WYiCPAr5*dwYZJW>#^$gJ)Y|Ki^!N3Q`tPWMuUUjL+drstoG7{f z*z=IkegqaEf~MUBOAJ4mQOK@%^U!plk?UKpUS%&kOsF>-vKJaHPN}VEVb8_$X{QGj zV#GBSIHQDqE_{Q9%Wn!^GZ=nW#@k%mk4b{epq#{8YbdtC^QeRcAdlKveph`#ytMBs z>8jCco8Q%1&l*Z#5JyUBT%f#xT};to1rEvA0mPlSil2~f@v(jr6h9CrNa6$ByCkw! zg^#NS`AP&@zhXn*37P5v+Fn+d*Zo+=c3t-$ zeBlHCv$5Io8QlhMY{Z!af0J$kl~V=L&1N&8WqlvKu{dq%^sPm7y^1^1k4dTvgzi41 z*_~^dFTL=Bo)F>sY8iSXyqP%q9Dr)vwGd+K4nU31zCI$fh!LYaiUP(kn(9u3zO|Cerqm4&8y3d?ls5Mp@EOofE7{TC`Lutmc@SxB zSf|0H=ffHx51Q)GliNlKvOiXT)ZMZmVAB2c%L6&F{RAZJ<$a+CCI3fdUVsuxpRL7M zee4*-L2%D7WXXLhpF5>E-Ke>I18PkYaYAhpw8C{U)DkFaEfg4E?%Duv%ysuk!q@?~ zipg*L{5m7SUZo)w#FCr)O?RsYJT&C!)x;Pk429^Y>Mv%gtm+g(tUiibDT@t-8wo{( zHhg;T#vq9IIvXp%wYx^AtO{mle+vl#;*3MPF6qWDkeAd%2~ZUkdS+Tl{_=_Bj=w#q zp3FjmMD<<3&pWbjCvq*8D^Ng3gP*~G>%=-7FTv3j%!r^CxX-^5B9$>lZPog9ERok| zdo}r+8xnv(#N|6!34057s7-@^WG^(n0i0h(UZ>rnQ!#}VqVDp{DI3K3CrHD3=NkSU zU?dG#ATd&Uk?^hHjLukq-*4Di_6yWZrW0s-q42UB zT$9pSV(!03>(eS?G_Xg++XZzV)is(-xU=rFYx~O-@l$dYv+}gP({u-yQBsoYzl#_+{Vw(*k*tgxkqKNSQ zIqCr1bL_Rx83}1rNg-P_DnV7qZ)SjwcbqS9>OMSHCW_=oQm!Cf?De%5GxMYZ@I4u* zu-W-nh>Uitq38cQP;A|&sVW8&KsIlS=~3VpQExHgIHCjMwSxFQ$l2P z$RM-GsIWZrbc8lmjBclMq<|by#CScIuMeDfj2DIs{U%s0^DRB4(O1=&qJ4rGXzph$ z$7zB=(Z}+T$T!R7hvg!#5o5F$pHHZxE`RVqkQgKv*Py)aK!ZbXy4+8|i zI-K(^%HaIbWnC;HrB6k@5JNDmHZg+@B7s5Ph1P$;yKKGIi!+~{%H(!}s2%BOcQPAH zMBJXTjc>;QQmCPHv$MV8sofPrDwB^95pWK-WKl)KFb@M;$=){wZ3F+zE@po3tgZvK zGS|=pLEkF|@H%ZQWSv;O-u?J@-F&-1%e^Ok^ z^i#AQJ$ddfN)iBm{Q|Y$hHvfT(4Gng4mljK&Goq!N%#~go(j4$o?j?}T5)toZIxSX zA3t?AMB*bwj1IOz+ti$Bgo9@@5zw$0zSi*A($TCrMn~wzD~(9{J>t4%yZ=0&1}J}4 zlRH`#?(@dza9W-Zn21Fg#jddfVY*nW%ZTKfpwg@ci|QFUY20}#ZOu1-L^{m8ah=YQ z=gbV9tmv}heTizJZjLA88DdfC;_L@OESTu7;Ykx=qmmL%H0k+J!}^@)3HPj?Ux zI$4cWMERMc6G3D&r0bZB@+3XJsV0js39LKpww=0D*39QI?0mo7Yrc?WHj93W#XMmi z{IhQ>0m{Q~N>>n?u&2w#a+tY%ZyazA@~FpzhnlY+A!5K+m(Xyy1U(0hz=Nq7?9&7? zmiH!@&QR~rEjs0SD5fddk0U!s7b#UaKR_Xa>@rXFPIImxm(5dS%3>qpOS&OZI-! z78(A?4UzkA@&_v#iKc-X zZ$rk#v|rk9d1b-=U^ng#1fqP^K1kfEpjV}8Wj~~KS*W;TTPSgh_Gn>&Kx`w%q;3zz znI~XhLVhs8RV2<*p*Obf=?$;FnyJ(<9JJ;5BWtxpM&NAYvp_jWGSRR|o`!S($#M9! zX6P9mCggl67Hn8|SYgJK*L*lQpZU{g_ru&&2Q&BYHl6?h!1nfbmvr`JN+D&gI~<oIFyKqIRIieWozZ4WJI#f<1Psk?`DqiE+g|l3FXY@5^Ck7B1%*u&LM|GDn zF7nhEi;2)YO693Q>Xg5m%!e-Hd2aAw!4AZ8EG1nHU*@G*{@9(D(h3xAJ$jw?;2p`V z)n{39Oirw(iNSpe`xJmz+uDNx8%s!fkGiG7s^66Kzb$Iji^D@XZv_Aehx)dw@sLF4Sq)LmqH{Dy`H z`*TP>XKWkcNZR}tBmjKWfacywg~KZjk#4_vr=0xxEUBWa$y$*!Q%cseD``cWV@SpZ zJw2FkQmlE&TjT=|>}Hp4lvqP1xA@^mNLKo9qzDn<7MjY(ojPJTRcd|mDM2F79`}bux zWEVN7i=fYr=ksH0H)d_?dMCrhPNxI(8dn<1XIKQXk2!4s@jDSTSrXDNVtz1~)Mu*v zl1~UDey|K{5L?}PZk|`otIv|%9k_jq|oJ{d#oU5FK`SB7tg3Z=&~+RY@~(A!ndf8e2@{GowXDwkIo8D5O%46B|h~Le9wGNI*(2I|dYO2LI1CGR7_3AY2X~PaGMmWPq{kZDEa9kuwux? zWnFa5IqPT4ppG0lrqd#L#~yskMYQe_yG*c>+?;;ZhYmWs40>}Z{)7Z|2+4}k@IZ>x z#Sdf96RlrZ%~eLS?nn};Wr|=*v1e$!cQ>uC^$92)N)bnC$K|<7aLytZ7$EI7WpKn% zVW^8VUb+^p65|$`PD<8HiWp}5z9@){_s@K|<)E69pHN_v#6aTI7=)A)pBgT?m7sgNo(5U8J%%;h2HL1MEpwRukp zzl^tX?z)L3ZhBHOJo57B1dFPD358|Q21kF7p-MG8Hfr$7hI7l97ay6|1#1u^+H@FW z*L0YKtVL&C)%eikSkx;l29s^;<~Oxxvp7oLvn-s9Y9h?nqr#?6#LpK2VZ`k0iWJI$ zVzXS7;iI_Y!aJ#crWaK(>E0Mk?a)PiqOrs%fvKHFdLQ zz%rkzO$?MCHv_jLPjDl2vNvC4^*n2P!ORx6%nNRd1+m zSGh!7V1l#<-=ruDMm}VaZz}2EFUdNRKSug(?Vp=V(^@>mgx}WF@VVdHp8hDjZrLw^ zc2qA0eX_v~{gJ~!Pr*%-(_`{k>nk$Lf^*Zic8&ftj7Ex@&3!o&p3m^4Lg;0^2J)W{cgPEecoaI7$_@m;{r^fb3f*)h0C@WSEd{GM6fDw;XIRA^Z#XD7K%{tj=lk@>ys z?)0X6b${E`X1)37kW#`g!&u}*HusLogq&dK5;Zy;)666iRwl3M7qbP9$-rJNH6QU| zP1zKb0ysI|BG0mLx7p$9xXXhP3DL?dS?3ef5rwKI@h`WsiDDdTKnZ1S-t8JLVM7Qt zF7IUjXP|u z1A{A6e}q?t7DLtorxq)>t3?j2VdZE0c2!HIJxE<#oF{#dR(b&g=Ww+czs_l@Ue}-b zn0m57JRX`-4&^OCcvDGlV+;C+Mku?}CYglXD9PkfUzJTX^H_wDpCeR`po@}TnQZil zXmMTZ4h+0X_`o}lMOOvY{7HiNW;ec019NbAsy391D9f~%CI$g&JBh@Kut(&g-xNcH z>sf|)UkOgvMswLghKFJd3C^bR35_(LxDYz0#53%vc3vWIF>Zv>7?f}4pFol)+VmQe1IA=)Pk?Iu9mqV;R{u8shYFhtUo4?;Ja4Kqa9G#Q_X zn;qI)x4X{r38u_><(}Mdog-CU+)tPIyh7OsYG(4mn$o852^BBz>#lpde+XBi(D+nt zUz!4$g&Jkxg_~a1lKB}L`R$FyBqjzlAIQ?lqbtu*!5*JY%a=q8ieXU)PE-#hv|(|l z@Gf%nmTi>65r?7<>V{w}T3Z2wD%7t6nEM!`G1FMYGmBJ76fDh(A}iLe?y6e^=+h&Y zbE?a@8y!%mr$@_99MOt37Bzg@o8l}Zi6ZAS2Ukjar{+DzV-eaAlRtyXSS`R}u_sdJ z)I`}0Y5JR_;zx-;BqElvJ=tZr`=j$3*s{l_@(2slFie~~G!f!aK$f+C4<+a&*B~g1 zTtvu52^l{3w@j~%ZZ;%iMXaFP;FzdWPR~PpzED1q)APyJk(@;bc`9I(;bL+{@_8AW zHIOics^Eeu+u*qsaVp}0358<_L2pD955px=87_~vxYV(7zXU%yqT@vS9GXu87ssuH zFURTw9wC+Sh6k=y&BxgMNqk-0{U}n`|bgwM{Q}kV-Aq?9#a$ zIFzFE_)4VT_$CGXLG$;rcK((Y*-M?M%}%H#UV!xqQO=?3HC70uZ!i3}*N!etADqEc z73oHB$dGRa+vBioWoV8iJ%XFUXsXF_5)qs>I(X5xxR3?WI}N?sq8vTLMwx~rz&fHLg^-b@Z1l=MvC{6t^UhEjy*Eiku%d~^$M&Z!X<;ENYk>lO zivLP2_YE2pRCb5wv!_u(&Vym$V=Q0O1UEl&ix$ORP%%>4Dq_LG%UEIm1gh(8osuWx zDk({c0PWg<9n^1-0CQ>qkLs^G*tz%fmv$cN1;f|E^!#7jzv_&RSsHO+ECrQt@1QUs zxesEYrCAn%q+V^|eUT#)*e^_ID6L6HJZpODC55P{jQ5Om?i_iNXzuB|IAot_g;=N! z5?~t+ZO}aLqPdLnu!N1P2u5>rEwPlxZ6ORT!|;gc0Uo%98Sf)hrGax@R?CD9rr(SU zmm#!ErsX+e{p6z84BFq#wiZ3I^#azLov?a7VnPk}q`R4zE1q-IAlG}n0W;rz7F>b` zO=D4+Hxh!B+em3*QegToki=D1n;Nzp)ejl>T8%4eS=fL{)+}VqgW#Iu;^BJs8CWo? zY8Mf}|HPXT?*snj5tHol)P-epU89FO@%;2{EQdW%&JxoGVqz*YJ6z7>ig`<&&*0z z$q6}P-cq{qsIG1o0!f(M3LYhmi5mtvv%+*SSk~6n5=*KpbpL^FRr+7*Z72+J=U?6r zoIPfl#MN4|>3Ey0yKHi-?w_r->c!Ou*KL-0yz-Ij${}#A^Cea^u$~(m8$r#gtNZ4% zU{pqjTjajR0P;WvY6$##`n7U5L~t8I%b>8=n_D4Du|z*Bt64Kt?-kt_6hVbmQ>q4| zuO*IT8fUS~OD{7%c%H4jhtXji&ufJVpcpy7V;0cIcG8dIcE#JF>P$ctUF(zyiL(qZ~t+7%*f0h~p;RwWKuv zG->)=84B_HmB%x`wUN@$uMV^#?Ci(b8{Jr!TpH=JAToQZ7tm4J8GCBXZycaA6 z=wb%gB`|1q`Jz_^JM;cg)1ta06!{wMW=T(_&q@x-GFH9h62I(A)WAS2cSK~WFIJFZ zTv)gx?B1gecm+{!VMt&qJEY%lnD$v}m6z>9E$5e0zk#7u&y71Fk0JY0<6!~sMuZ(; zU*8$^PT74+{kCq@RAT#>WS3;l7J1A~ukoDSq%PPpJ$V_W)1JDgN2GBesT?C-^lPI` z+*lEf8ylv75!7x2h#@MB@=mZfN}-=zKsyVjKOJ%&LLG8u+IQyF0k-Ki?-UD;|6}SL z+$w#ecb{$Bwr#s6+s0(uwrv}e?Iuk%HMw?8*3LW5>HGU#=UnG{|ATiw&wkgs*XO<$ zZL(cTV8JbaJAe7oyLSGX&AtD*kPEtPEu4?L$jjVfw}S`v4EyaeltP25Z3kxX-0&n` z{j_J>eSo@8mfE*R1`5Wjg8AcY`fQSH@4GAmbIm`Km**z56HACmVm7MKIK>=<)^pcU z_KqcFnrpF&8mfXJl+Xh^B;SIOB9&4#F?qqtAG7k;hvbBNlo(}0^lPt59e%&3hgsLB z%=|R3y)@v#mv8Fu&b>I??EAbLSoAn`=Z2Y2lyo}-ydpgtR+9^fHjqU^$Fe_EcWxpj z+8f}l$}lIVb|QDUZwo=xBDXynIN7u25>Vc|@KSMbgAJ~VG_8&;rFd#8mfsQG{pM5J z(qIm>w>D~pWRbD8zA3oUMxSn5LUvwn7X>lQv&%91($sI14p{;lSO ztQAYbqq4~bR@FUu+aSygugZFL7Ch^3bWwkmg=!l}>@meSIpjr~t?$5~YLc3E^@c@x zB||nl#(Hvl00YN-c(s2E_lxWMZI(z9T?hu3hjZ)*eSz>a3Ep^;7AjvXCmg)S_Dc6~ z2t}{3kL}91IMl)T9nmXb7-_YH{7s7|Jdv!h2UtMC1 zP&6kn_GjUl|IU_ZBAx3{!g^W z)ztlgXNl~XAmf997R&2jqwfcSc>erqiMUoVXEj8u!vgu5x@E3He->TKNZ5%pG$0aB z0vM2{)&h%{`=`CGWmya`x4MnpWOxRKnW&M?q;STNeVIPmBM1oqrt?IhCCX5-)=yO< zj*HkUhI7a`G1|OSB~3_Vt#mU&ZX%Ot)VibPb2*%cIwe?CEJCF*k{$jx3Wjtl7*&ib zOY#kxIF{iNC0nX~e|kBDL&c*Ajvp~JoTbbO9@?O6k+3M?OxrDYTXQ=CzS6gCr z)7sD(B7Ab8<*z_qFVwjU*%JQ=5^|a2xk-P$umWD3-zCG^_tmYV1xMncA7{g>X7oRb z=o@l##=j#Q&Crx*;B~~QA=G|^t}^U)m6E>W9r*X5>ALEL3JbIM#Xbz~Z(|A4J2)b> zI%>_ZdNy0E7@8qU61q>QxpTNyi=g@oI$Rx{+^HvlnE4zB>g?<|o{kusEDTd>1pW|& zG?lUmMfp*{c!;iy1nuck(HpZ5gcH2b=uw%e(=h$7JL>ohTPjAFICL(QGgsec`L7;E zd78LqhqC0%X-k-CA=n8D6rK!#JOrLX3a-y{c<#h9!y^jz3G7c}9{Zz4V2tRmG8>2i zeieV}uQ{FM#E1O9M+{LW1ZFrWaF*C*Ou1_WG!9kZ^%LIZHu6NwSrt{uT#r@++V^-v z8F=Ur1i$F$N3zyn44-Y}M?P1`nLkgXxdYmJ+3ExIn(QEzTUfZPozad#pA^GqDnN@) zgxmr15&fU9!yTGFu(zLwVRA&BQTjpBxWi_2Iz$NuLx6AHPrZbuZ%IZj2e-0g(zpeP zE7i!-Y(%1=UV9$*SHKH{8&f|Pz8j@uS=u15B8yJP9hiUKSC2qox$5wpWcFw!Yd;u@ zUN0YAb=}8@(eucUp?>(NXxaS)4b=!l6BnL`2M<}c`6Z}x{~zbyiSx=c`56CGcm8|w z$RLn?)wS>{$Z;z@wC;gLWu>T6oi|)Th7!cvB$L~p!4L{CO4AQRN%xF%v z*qQEJ?d$oquipJ_Q?NzKUYDgxqCw87f{T>zZRXzx#OH^gXq30%BSTJ&HbBwjgGA`x zyLI<@VzX6v_@d|#^zL)1>c~blDXdQar8AVNt9QZi9zP~R{6!5m4{fYc^B?_j~|K($K`4|IUqXuAz z{F^}?uFIU&i?MY9LXv(m8Qw0(@6WBMgx$RF(*hqRm4Q#ZL!rp)w|sXaGo=3>1VD@b zdU1B2Y?{MTQ@?@MZ3Yo;0^cqG@9vA1tbJD-?YJUOwX7qfzV3izV?X$9zo{F5v*@QU zXnn6A7Khnzcznm}%^4s``p?E^G2aB*-Fh*MHTa`XEIiKH=L0(xKf|zVi;*HF$doRJ zBW>BEGSfzL%fpd+B6OU<(3;Dr``p?^7*b!Iu-1TyP~4TNid}+I_snsc06hPYTX7XL zdD>=UBd$TuNa>`VlOb98;kIQuOIjBrSrf-L{j>}@bqlh!#M-WnV?->HIMgJrEd&eG zZamW#aYz)-Lzjl(-Fz>t`3z87+T{$XOqy=(O7`RWSL%AJ^+iD}hCwchNj99)K^L7} z7RjC_qOL2!)eF3waAu*R{CauaNG^6x&Sg~7_kesq^+f8I)mVDGf^T2BefCj26;VI5 zB~Kh`I-=_A@x-csN|zXa6-iP@2c6xgrfP@*MYd~l%C_d;5Zr&xXl0l3R#p&fbgC0| zq7(E08AR0&l({N>2T%PiSiJ9#8-XAHUisg5V0U3Il0?F!t=Um>KHj>5paflxcei`m z0VjOr-{;S*fLZm%$&dksE+Dh|ec|B8Z=kE2n-P4k6E+eSXVe9x_b1dKgd6`i(lJs) z4-&@wFE?NRO|vNENs+q%lTjNSi4Tz6XTNmn3t0SM%a8O~hMyWO8h8T)yQJLgIKOc| zxox6;UJ!J@FW>KT>-1;L==OS`_rt=XFZTQs=Q|rebfGz*BJ3#dPC?y!|KtY#34X!h z19X?;7g>K8eH8wSv`FSh_>W`YeShWQ@xLu}_J>45Mj2f?y`cTPjR($NI7f*F&42Cm z9Q@#e^F{7IQEm>KW$DS8$r1EM>A(0W4nbTHM9g9~!1xW#=m;vl+p6P$@>JgfcG4j` zemAGo@^qJ7?iwrtr{3XjcGWLKiSsBcdeo~RRml>7;CXZiKiX^qx)^VtSmIJ)XV2NB z{}xYWi_NgN!$@A}hANuA60f_P1Y3`4V5|4M<<{J{MmvYl>LOUh|9dI~!CgxrqA;G> zX3T!Fgfq<`AdZgi7{Af9Oe^)xT&FZYRmQ9&eddW7cE74v7+RPwUzJx^_S18pL+Q{$ zOSjvSpde_3bGKe8W-r#k~nGs*OKHG9IxJL25pKb1*UFZTg*F_erG5u zv=mJ`oWJ5sZcUvd2U6HFNs2Ao!0Dvz6?)v$BgY=Q<*H%BFbuajeX@1mmQ$yX;F)y! zy}rYgbM(T6gVT?rADxr$J|j}Mw+nA(KYM!!bLL?;;C`+In5LW{kK>7V_eYZkBCU}G z(Ge0=gmyBZ^b>pjB>+uF??QeA4zLLbAbf>%^DdP6LlY7;93YL2jDUB8plwE-ulu9t ze_foPBfwnpIQgMO$xiNr4%eW)8gyHcl0?j*QINiyLPmIhUK@As7ig^Slg&_m#=Foj zq6R(`?>FisQv9P6x&z7hJTm@EnJGDv%w{r%Iw=ZbVnKc7BP9FlNJ%Z3Xg$_j zz6K?rD*OTk`coeaX5b1#hK#nnT$()q6yo8NyR&`y?Y&dkU zPoS>@OGV?j#F!H(>!XYS}VdUaDeulsqHaiSQlNRd^t#nJ_uMo%L z9||t3>BfZ{;)p>-AuFqG#>-4a9*sume~~zk-|Uxv^YDimqR}e^?h|gNH?j+BVs}YI zL zaB0J|C{onJ2xn{ZxPkf2%|obuy?w5F3xzHIizGSGv*rsqBFypwp7_rWK0a8m(DlIi zn|HLPo@;F)zWU*xNAa$m`=p1an_wtwiNk}Cuz(b5#9WjGZ@7iizO$^oHa%ayL0m^l zz7js~HLe^^8*QjgI)g5g3jjT@BPoHm0o5HJqJMnF>T8_#(XYGXgNw_>c)|T8pe_HXw`C*?o(Q*BQ56RmzXWj};p)M(-$cZNet~Yr548xS%Kay@wz}+dlb@ZkWChvB-irJLa-|J)bLvIZ zM1+ylu({*9LL!RSz1*WQg{ewAN({!X=^$)h%5~twG;C@All`5Ba+FLRpAFhe4hP z_ITr>0z8vazd|fX7gQ>khxZ>@ zNft+hydg_IHw4yAMV#i$yqc^ba%{bdmRW}Y%nq?pjy7WbJ{SPboF+YM^4rF-tvb~2 z+e|TW9&PR;rSeOXp&2s5Kh3X$?({o1+rigNV%OYZ@W zUpyu2_@Nv?1H0Z<0!lp&+VX;C06$_>I_RSJ+}HZTp1-TQ5!)*0a7*79`$(BtAMMY` zGfgL=F1g+4MncXx9`j4=jTsHoiTtzas%yWI&QL?{yi=T$olPE34c|o#E*hrE_;0FC zXbo50DIZejf!w$*ob4nerW}^CE8R!eV&$z+dX^?~#K;b8Pl1?4=^68H5U2zW{sVIr zt2`C#uoUNskR*V(8Am>e^qko(Tl{A@J;`BMw<6yse$ZuhQ`AZ4Wk?_&ndb_#_i)or zpV{?gZVUSC;O!OZNc8SM6r%BS6qv6WHe^#5?$D|?6U)Dsxaca%+gDl6<#Tst6T5#n zFc=2&R8^V?2?^P4Xph<+e)~d4Ktx=!kvFj8I0=|O#ao$&Wjzy&enTaLd9lO1$gzfB z2CEV>NO@1S8|=-yv297dEd5X=`QUfl?t*{q^>h8y!J}QG6A+Q1kp;w!{X;{^1AS)q-7D9wU2on=9Z_5)Y8CLiziu{X*T zownxW)sR#`G2KNI8o1S4@AsrN zbbXQLBU?p%-t8i>o-aVbE%1gR@_zWAeRnRkvpX{~x*2zG72-ti1X6(&=`iEA7ZV$S zfsUQK;yme&3zzsnP`YY6$HITHD1c`uT&VWDQ^Bx~$H&L9wJU$qi_R-1RZ*_+o3AB) z){2$tK^w~xpu`bcx*3=kTUE#aNWN~laEEqaerWljMT^a%F#`e&Ij_jQ5Yw=gugwt=ez5B$ zhfTt;rku+lneYNs(N`*zw1vZp;jCOv8;U^kxnfb#J6`8qp?8@>vR_@;7rm~uOK|r2 z9ZXb#iVJV`ZTMzfj7snMq7;eYI+68sR5}J<~g58DS%%i8#g~ReZw3*JE{K`GTL3}-`}072-CPA?So_IimdZ= zHByN-p-gsac8Rj@f*xgb;Sx>rd-pO$(=)zkR8*LHd4s=pzxkuk7v)0b!1QVYs$??a z+Mjv~9eV2;m3;mlIz@7TdZIQop(kSR#D&{BYlTEf zHi@=kzNQuy&g~B66L~*S$f|9qZMulEF#25TDHn@5W-k5nli5ZQx+1;RCtz}WQY=zK zIz7RO9R|nAjK_E0x@n2K78jwn7`R=&_iKsm=&((i1v=4nMl~c! zpc^L3TMwFX&p#~pi zBvh#Pv-|IX`@U$f3o@ZcdFb#7uX7~n`wc7Ll2gS@h^wXB;)JDu+6PU$q>(X;In2cH z--X!O&2=wsQD6`uk^2LBg4Zkk)YxK>C#_IYcmmfnZye|I;J%!cf1%O)YkRw>vcx@6GbJ05TWlm1Z!KE0W{&*`ygTptVkbZT?1bDJ zfFT06qB;saCueN$S@(NRcn(9%a9PlM2|rKrF4%XcEQrCF^gF=Th+8p&KH~}Ti-N8P zPlDFJkWrWSR#{lCqF=%h)oyLEQ`v_O11F7H59$V$LT^)>?kR`AO;zuQDDpEBGj9Kz zdi3{K2(KC(WN8;oZx2Uqvkvldtzs-}MwHr8&uJH{%L$@~hd{$q-n=ju@s438I|)o; zexAM`IPs0;IKW{P>_7ETrqEV3Bz1!gE;^-Rs#!vX*~4S_ox!Bwao)xRFfn786QN7M z@t&YV=eVLPNGRxivmWfA()}r8dGXW3!~EDP=%1X9e8SupXZHc$y9~!48VXqcNja*{ zcWE_I$w)`X!@!@X;Zl+A7H2!;jP^=?MC;=ep#iS1qNC;pWv|Z7PAxU<)?szj4qsL= z_T=OgyCc&+)(e+`AF9u*Y^a4rY7Kb)-kCTW9N;K?xhIU0N%G!_icQCpXXRrmi>+NK z02h2)%YQk78@{B40$ApiVjXB&0+cZvZTKN&=+F7}}cs&^&|y6<}g z0*3rJ7nmNh)`Z^XGyq*gL!`U+pF`2hnx!x^St76ufT62>8ip40ZDoTpWQrxUcDR z`pvlnh{__w3cNmI^+gZ(OF9Tf`r4;DmL`1<$P&Ds*vP~k+Z@y3L}KoHeF^?V1>JWI zfoGBW!S%l+Hb(@%zpuKGqEICrc%$9;0@**qcs4La-V69jB!S65tzZxQpyyjf;APc38=;Nz=jE#)AkaBjcrITs+KkRR0CS~4 z#M-NC0MSEQs2e2*u|hxI%DY(u z#vY3l2`*wV{bWbO1znKEL#PuWTjA5yFO-~|f)H+ZZE+KC(gnsR#?U{Jk>6pJW5up> zj&V}VOBffh!Rv~EX=HkuS#?xJc*Tj!mg#ZyiTF8m+9=rts+L*dX4RXRh2vwh?}&&+ znX7R;KmU-Cs1DOhM0)7=fGI2E&?~CpU=n`m`D0YEE%m?{(@*I;xFst?C`Sr0T%}4A z$79D+o=>b$WYjAn+3HquJ&y>S<1?`YWkfcPJVK7~-A%gg%TwBjpawx_zSk~zZk91L> zx}~Tf%pEDASyt}Qr?sE84LNidXvcNowJ;tfF8vV{zfu;HSsA^_sz_q1xOz!K?THGx zP9;}mOxzgn1G+tKB}#6oB~4| za82CM8}xnYSS((#Hh&>D4;)msn7@!KA-{-X4&j4#y^SVd_PhWb)i;4tnJ#nevH*^X z0VGL9SCRizhYtti$vaunA2=d!u|r|eJVFqdr&IB)J!or0oeU|md)NMtj3z&=A-``v z2oZUX16;7~{?p2l^)X!7ClAYm?@xeWC?H}XzA(t->XF{^BsgpS>y3eEW+MUrEZ$R} z1-)tjFUrXn=BXs?0$;#R{YlFy$#v=@=PNW^1JnX`_wO^v`k12U3 zj00Q$bU8HG)4N5g*#GE;JE2w8%T6-Z&Zu4HvCi#tnN}(1a9Hi>2VeMkKwWD5R3^Z3h3yDeRFD&P&PQ`P6op?L zKQhi|{t+tDOHE`bjQOgq@(hE-9bkybi1OfO{}ltZE+vNPK!}dA#ei=6VKGA}Q!5?l z+v@l;CT*$7q(++Z+xfl|*G;%{C9q&Tv-|f+W^*r65b)5XCEIU7_``<}0P=L1ZR{FT zPW~RQ`aa(mHp28W$X#te88p5*7WxUAyqS>4t*llpj+*r-8jas5%37{C66FQ76}q3y zjp}*tni4PB`KrGj<})>`pM_y28BBdzA|1i2ay~DJ-Y^-@JsHvlCcCcQQQQ7eW2^Du zTTrSH9h?z3Gl=I(SKH=`vdu7VvqXP8#OqzVYudW= z_#YZ2|9(v^oDSeho6fK5zBxOODrzE$M4neY7=$fKIqZl99C0;|zvEi@xL$_rHW{DZ z5a=MG`5n}-R=?JGXzLc5M%y$^kvkBAukrYN_;4EdfS$4+V0XNSX z(2IE&a>r71T19A%KEPcGP6q1?BMJY6#lw7nXDNpMQI)_ODKPQurqT=6yV9FwHcIWj}KMSuH{)&gVL_& ztk$XYRuV`J^;1cV4I1cTCL=)g77u|0hBRDXTTw`p6=PHqlsKd`B_imvZYw}TKKFkj z6|+1SufrkzZ>!L4$laL1Dbdxy&vK*!oK)&lZbn4M!0G7;dtzjZ zZZChj(qDpABEv7(oCJol)s6I>sKb z7ps_mSr4I=~(zo77eJ&$%-F_`xlf`J+L z$QESeA`|v)Q>Bq=+sXnR?Qj;sA_7lQj*MyQK2Y~u9T_dOL_aKImkv@cA=gJrBntD_n46$Mi|+TBA+^2v`P%MLEXtztvgl8FaHQ2g{9H52$S#NrV(Q!OKk;5h=hek zHvLMYPq|>yuC48y!BEGi0Q+0C?7fR#V>P*psR#`{Rx7_8`>`MDibq&`FjoK2tu`bP z?kLIGZ}p=shl`yZUh>|rv@cs!?9k5_YCuR>vHn2^NPw7~G_nz5>995ylZ9tBo8YEZ z2B^rg#6-sSQA}_%kSb9;Nd}u-jpPZ&%U72`W-!(!Kf!iAL>ojU|F8KtAgWb!%;CU3 zag7;*DX0rt3{j4HFYtaPL~m$Q0o zGBJPu86lXLJ7+sr3C;pD3)xSg)Z2HQ5PU z?q$&?y{%#)&&d02eL5%YL!*oQJ|sbB%JgPk94c$G%O2IsWIZNJ5 zo<1p7kpgdq1ERL$6#w2>HA5ggWv^T50CFYx^zs%i?C z6UUXnlR>wYKK0_*WPqqb#nn}7xo!1|NxU!Z>l*p@v6ar|6a<|O{7Zh=n66*f1&Cv6 zaejj;aNVHj-lt{+*ZK9c!}CGY^tIPlZR7?n3Rc_@iDjjG0af z`9N9E8c65M92&$g-MG|00eqW_CiNu}d3NTkWW{cHwPjX1)SUI2A#GI_r$aIf_?r~HHK~W z+tK=!NE#nJwY7U$Tmvchfr0f~+aZKnI{lBk`~hd|ysHxE)e_!KBweqPLs^SpV%ZvLC&fhFPv-ekwAIB0E??}GKJzVz;6!(j;!@s&G@vMm&>#Wt7(1W z`yf0yW!WjL%UyPebkNr_I({*^kyzq|c6Baa}g9V(j>EW`+Rx=z4YK zofvv2vSuUSEwoisLah5>ttX(HmLB7;x^yic>woTSx@UhD(kl3pRgy-^KH=9+syiK= zOx?KP%#UCzvS98B@Q08u|Cc2 zWxpnvpAU&TqZ+Et5t7-&qu)EE0E}6r2zwuEI=B9)v$qClw8LlBg>m78yV2{?1&X}i zp-vANUQIh)owz%d2F)uV6F)It*9xY}TI~e(J6IquU@Z^FzBSu!>;d~3IAOz@__FD7QIM+#oJB#E-` zE+=_)Zw&&ubWhpi6BiY|0SQA2s8#M>Ob@2XB%xHIFtG!KoG6i25|@Cm?0r!#35WZsQ@o>Vja#M@cfd+*jSc2l%(^n_kJ&TL9hg+iUpARg!<~9PfVErOrItXW$G%SrU>{M=qX=ba#1o(l z4eOA29#;#WQ58kotabd3q5d;2iUuo|&1$n^2pR95?&sJn(lj%fOL;;>s^@<$8+PU7 zS$}2ypBUwrr49c=ANIC`X!~zINReP*Ut)8GsJm?0QefakKh73MnY*?pVc^dCV0?*J zq?S_^W5hsWolt;Bj59%LLHp|8BpXMy$GVnI8__8<1bEn)UGtNu>8xiF^6$HO)?b+t z!&R{c!iWMT&N9U|ii+A~J=UIn_vYju$LT4_1{{^-Z60`P?!EyZDxk9=p(AGOxV_62 zCv3;~#a(`+8&H?0V@Qg1=dxQVmF&G?SZvwT?9afZ9tykZIZb(8lYs?c+2$_~OP<-n zvT+W3HLOkHxkH3;)D2<7aE@qVW1yZkNScIyQ)dM=P9G?N!$Bqku4QB>PZR zG_7`uk5ru`cxHb+b(Lwr`-X(gyxq?-A0sgz(%Vb-d@~}Q9bNZzh7$2%Kq`9x zd}Um5@97kNq~d-NEJ@_Y8|wKupI@JJ2!W{t=HXQx{^;`7Dzdwu^{5!`Lehj8*6La) zuI3J3$npw4i%mWr7)Dx9N}VP*Ds$;4r3%QEEz;fCK> zYSaHaWeng7^SMFDJ6yS4;g_;}lZlEVTlPF2IQ!rl1=Gc{{+Ew}IJ6`#EW+3_tCQ@W zjT@#nfN?I>zJ30Mn##&*Yn9>dTe^qbSJ9c~dT~Rv^a`07Fi?Uawv6az3k-+pY%M+^-*i1{ipiL63R0xxaBemuJ>};(3y6S)^mW{x%T2P|W;`%(~@dMrtW?Z*xjD?_M60{`1A@ zbN*>$TwS3&r^FXlZ4`vJXirmG(9|}V513555{A&jZ&KbTT}(Su$Ke-h>S%E>h=PGN zeHCNf9twhFGU|nkf_Ve_4M5tSEk%?1BfP%(nQnHBaJe>ZONU5@YzhR^$Lg2;5xM=N zm?Jv_)jUimr(ehw!ojXJ;ji_+g0~)_&I<3%_{AYdoZ^TjRw1Pa+m>Hi~r`vZXZ=dkg%s zpbcw@0yhxxHhsYrM=WZCog1y!59NFRi`V+YyEdQOyn=4OPw8T|j)Bqu zWrr@5Pd#;4%?}@Dm|%Ld)#mhwjCsr=2nD+1caMYLg}Sv&owc^?Y8U9;TLI1orD`Xa zBech{2Xpfs4q%6XI>FVe=9<4WPO~< z{zFD}^1&N?D-4bn4^T{Z=5mnlQZD8}R^fk<0s)?f;P*a0lT8T+C*&a`b^8 z`qiVj$F$SsNu)C12wvbH`&_f;&p+b7U*!*@aAMu*$ozvH%h+o+_7sh!qjbLEl#DJI=iSs4ogg^0FUq`G{-PnSqUHjv*>ca(pCh-nu z54}41yq}$zwhZA;@;XNYme~1j*M9)3bp{c>pe6h@>kv-)E=Gp~xE${0ca+WZ+uKgZ z7i29tTR2KAuhl#$S2T0+J@*P_GWrz&nfrzgMH>5DFU;#L%RiTi6b7MI8%iWi;Dm$n zNwP_MboeTIfEl-$Zz|TGaXA zUt-6U7<<@{hyG{g$a%8AkcnSRRA{rwhY<)QD>@AWOG`uJGF$;+(CHXSEa)YngUdo( z2Y*d92)?_sf^1XhN|2DOI{X^VBNiMi`imDK-?JP)rDF!N5Q~+hy+3okp>@W-Yo^pL zjD1OUPpO<+(yj-aM?x;_tQ#BKv`C;4B~R;U5$Y2EH1u=KW@H2ae_Ey&CjT?WhJYmQ zGdvyu3Ca{(7AO33azrsShs1Pq)x7UIflq;^Oe0Ei& z7{2B#6dv-q5B1?L#_x3ZyGm@G4UZxWcCUp7V}jIGUGB{e{GwoR&0;OpN(*>fN5C}F zbO(;hu#Pj*(~WLSz^M}*4ZyFDFvOpw0Wx;~gvin)LsBqWAha_7J{wLE1wy@F!R~^q ziu9lt?e$~7C6oL|!8aJW(rz% z4duQr@O*9uFu9kVpugu=wm2!FGVA3aF6@A@GM4zsaE0(46`}=$2EB1O zL1(d)H8lf9k1`35P6qC;G^QWXD(TR1%w5h=1!o<;28O+l51!ZMCZsG$Yu1RZSPIW8 z382{UMS$-P1i8*u<)Q|ejcl<;Km|2$wgV0;Gr570cyEm|I`+H+8GO6jHBv45 z7;DOwn8LmBz|O0_2>Wk5RQz@_JHV5-NT&2bOq0|)kZa693^Q>bR>vjBbtHh*4O6+K z9UqCSJLYf2@pzW~_=u}HF>&MQ^WYuX|T$hAtgPp1+fIE>R#SOOnKQgp5Q5j#MAp=B+QzUEHI=vs^ae z2fQ3O&L3SPa2!E&76=vyJa7RIyQn>?kIH^BIcekdrffLuWUl#*4U zg$5hj5UzkL8#?ek-UJhM`jLE)pSgIU$z+=&vO&&kA^a zGT0Bk=1)iaC8XJ#`Jy0e%x(WYKfaf73qZn(YSOla$mh5QF#gMg!P`ISiEX1x%Oz`}u7~R+JM_3C% zxuf{Z9xLVBEzY;!V_J4S@Te`&$4j7b$Q$OZY|p#q%Q1RyHudokvpEvMeh}!pVVMX= zGbG_G|9tADY{Yz1fAunhML}6+3W#F7^}uVDEN1syg~R=3F@qDH)}1EZL|0&TNM7SwxhPGWFIk80@y_MCggSP z-o@28cBFv+hA}thf`b4k{$}O=NKVr1s-R9;l36u=53UfS!*9lRH9 zx$SWR{$Oo@dR;i+W9iw9pIvX*1H$zKCxQ`8J`ajVzsWX6A}|l+wR3R7R^sEeYf5o~ zDqC9nx-k7<`%1!4nLWd$JbtZ!ea&N9tI;aS&DdI10pvSvcA^W01;enlyTh2(?$)~> zDI^351;RF9QPvTAN`Jd2_uN(Im@_TR#_?-f|H}ASS+gQBO$dwZuNAJ;kmSV4D{&p| zH(437ogNd30~71&kWyZ5ZLhWPy##VuAeafk&tYmHt%BtxF@3=2*+@EqZl{-V*PlF} z1cZ>E0v_YbSGMKQ_hm`;wl=c1uN@6UhlYBOc!wehoqH2^;s;)+X-6J&2H$pJZ>2*S z-msvM(UJ}j8{>}`!${u$Ms68GDN&GhYHxMgQHX}o8-d$l3dh-cr_g~FOA$?7ma29#I zB;|D*Ygw76ehk=y_2u$jo^=3gU#i6u8Scl$m+j(D5I`@duL_pNrH6Y*=9X}mAO7ZZ z6y9aMm;Z8o?%pd*Mb*`#2ZyftxtVRCOrJ2*=N+{n4;t1w8Gr~GhQ^^comTi;h5`G1 z5GTlHc8e-Rl{x6-Vx}<(D&re2!Wb6SO1Gt1Wv{CNI{Gw5pge0_iAdZli_yR@yX-39N^MI--Y{_`_s9M8xAoY(1miLdulQehIM3Fd}LURWWrnNSRm` zYw3hy9C-@O++)+tt@SD_8nhn6(BJCv8vnTXcJ@tmq0Qb>n}fp`+Rk|pGchSk7i7!pi9}AEDOk%f&*lMo;t6P>Q=BBbS&S@G-xOj)lqbIO z2U^E55987K^ar{k>LaPXVI#y;oGD_RQUOxibcb?EXi0cYGT@VgISyXaUf=fntqygE zv0Pc%%W;eUrs!7~XNAbBVd4Jod@%ClTkHheY%vSr=p!3P1Zs-W%T#mZYW-rER=v)! zG_LXV?r6oxuyTIaaFLVXegby11(hw#Zz{)tV|*lq-{M~fwn}+%B8y?w;1?gY#UUo2 zB#@m)tQ#*It@6<8Lo&IQT6SZe^;M-Ej@M}eUbew#-a15ix$8X7jYsWpTzCniA>v%b z(8bXbgT@tp3aIvXfZ>O@(&6yjUvR@GFN&#YgEI0&o%Jn~&>q=`;kg&#OMg`X#53}* zfJ?)+#4KlrxWw~LJ;z4~0j&uGIeqJlwthQ5X#i`lRG<^qO2A+gN@l_GM62Zwm4HIZ zkVg^zu)x9K@5m-R2Z3RGY%Pn;=Eb6`GJ!#b4pronHG6*U(GK)1LqMLIP&^ z9ar5zAb%6oMd2aj@Bel_Tt?X)_U{x;hOM!d)5a=Vo4c|Dvs-YV-v@b`y{2xytor|B z)-Ms%@|%1fZ>k2Q7AA{Vwqxw}DHsV_(E>T8Ip3=ac-4a-e3H)@8cveGG*#8sA&%`h&dpO@{9HbJ#5e0szG# z&?Xt6V{iY?!>M{}J4Zr;x*sA>0LZ5} z-G^PzqoLuHpw>6{l4ewA9#^%DO>Sm-KRlEYlEA+N$N7XrOx1DW3uuSJC+{z8fqu~0 z7|YL0nyA7cwH|-)&e?v05~1c2x0f?;Icysg?OVPI(H$Ach*ejnKayW{U)f1Bm>YM> z=m!eiL|^1$b&kZQyJs6tSPKWtaV0gugcjEr$ru_u;>M-K3KF+YL1Iv#Du5~FY-$+^ zO+T7Am>U-B@nvBB9%_wzj%&w3s$3= zfa*c7ZUF?@#YuUnjvfapR+Q^M|C_uK0=NEucsd97xY{<_$F^HD2?uK5S{Tzk*#`&su|zvWRqX7C-`*jHTwJQs_z&BrYq2}Kp>h2*fi zG%@67;HO&W?Ktod>UMm54EWvA4@|KJKOf;s7<86tL8CZe{M|&<20S2HIUka24<3Mg zylrrgFn{+6pj}cFlu-qBX?=+||Nfo0_w4B21h^x}MEL{$RxxI0_=={FrcCH~L&d?= zs6)f)Gm>#JQX+n^#(i?{{&>Ls`5Rfx0_3OR@GlYj3}xK>ugM7{=EC*hV{Z+EKhiD^CcXz*d2!P!2=Q3z#G%M(RGJ&DRSj1K2Z)mC zxI;)~!;ofY7T*f0=NLq{4xN4LSh^L;27m=6e3Ra=TXx~`bwMpU%Ow=1%QxsVSQPXc z%moc`b@z~^&utC4+V?GYE$uxF8~-~w7WOL7WsoOOWGpO`ipZQ_!k zPQ#^;9dpk!Y6PwXg!L2;F$Vt!>tSgh!^vvc1X0m*fP&&g3A?7I5i&{q<1v2zXXseY zEgabM%nnHn@B>&C29ou6ZiPOVpab{qyM@Vt-O%NiUGr@V#$~i_C-vyTX}`<+k>{Pu ztc;6EtW4$ks?scIbyZ_>`&qNzqCV0U3b?Is3M!G*d`~k zp9Dm7r;0lW!3}kQNOVO$j5`upe(W)pemE1L)rk1?VVy zY)UVYJGx-9q=Ix67llH@Xgffa(r7CXwQ(un6RWQ@M^$?7+(G{kIFWj;7B0i%ee|Lb zQ5cpM(*vexbuDVwL0cCi|A;tG)&0WJ}4Z>X=QF~7n4pPTagRN)tO{%|VcNpu#wF91=oZjz!7 z7JfjY0l~q60`Z=`;vs_=1qGidHkzc@@`n)fqi!OIwIQ9-G3cutt9RhNX6Kupa8PBz z-l&kjuu45!AzeC?ci;@tOX&==WoQ&G6E8=O-8ZIML`eZuIx!h35>u){2v~-4jxQI# zF|v92KO^*~<^Bt(SnmvVpx=@f>3^a0Z;+Rx%@01Sx`?e8kc(=cONRX5k%ytj`g{3K zu+Dv84Eo4#@RC2~us|4e^Lg)Eb!5znC~)3Q?>puH%NR4G0WXApuPxyRF>>tN6hz-N z30O!u5o0hj16tRpJ4t(3SR=KvG^`$U^h81<{QjMh^A}kbD`F;$QkJNU2T#Pz$rA$} zOaQe8Zihl0)FEJYibAlIdTx?xR9Z&YN6f!Y?OB)L6mtv`WgYYd26Zrdr=ONwM8n2k zX4{*l1C_TiY0SZ75r&BU-^fRnZHOOfJDetG7$-%=ij}yK!cR4yK|++k)r-ncYo`8+ z%7pKc-PHBt1S@IE-i~Td>Xoyj8f2lbDm4wgmQ7bKZ@PKANG;t<0`Xb zh}o$Z{P$co>;yp{6mW;Dt=(-7J6p&d8GZ2VCVQu^6Dv(p?i1~hS42ecotBhqr;WuY zZi)s{N_2VV!1%)4gPUs_DU01!q7uWd6R&Xg^XQ!;)`DPRWv_yB`huB~pz zi;<*{q&nNSi_vs$K}}ajRrE|XD}^L*om&j@K6ceVp(b8Lb;r~t0kzGvFV+Cr=_k>H zn1O8Z|5pBE_&{F9DEVFVIS!AKF#te~BvYJKO`aB3R`XR z`fEPwpm=c;dY^&(>qVh?JKuu#L!cb z6;`>hR2Sh1%(WEh?)W(eO^CUu?Fw5`P^&P%US;Pj!Jq*(pFA&-sp1}b)JSj%Hxr=# z1JgDgZZj}(@tRx9q3!}Jzd6O<9`D*14uf~mS@w|gSPZ9_I|Rc|0wc~@(Z4Wfab^DzZK$V@*?%*g9o&BF@T{1& zHY>G|%51cPsM-b~#eBN*$JEFLe)9#&3qxAMe^I?ZqAL%-pt%OAJ}f^PcKr?$_IKeo z4F2Nt*q^BKn9kAhyw|CjJWij?#YY-=G?V01b;7R2eC2c*{*5q5!DyJ-1J1~n++wG zOt(ouG5}c;?15skGPLw?N;GID(`_w=X)+YQ)ke#7qoabzar47fe4((u1qqg-MxxSO zh-vz%tE#sxTcS))pN(G-3w@zJQD;(~?7y{pQDXkgRG~DkOx48}BEhU|3fh;r-fV_% zcl-&v0`Kimo0u2;4XS6eNU&P#Rdl}`S2qqk`h^YLD5Ggvksa<< zkK@6C?MrlKFtE`6?hY z*JtD5`u+#f?<0j_aA>3>kwXXP5ypXVdZPf|yzkez_M8M>jxu#&PmCBj#FXcWpT4je z>~E|?u{gqvDXNd!!ICz#akOJ4WfgL%MqHoR6ZhVL0B~Ld_Ec|%yBEXmW>2_T1G!F+ zX0>c;-}YzXeq-XUdq$Hf+O$AP|S~`*GzA^I*z9w|BA2xd z-jKb&D48vZBe{dvVR*Hwy{YaxgcN;#@C+ESo*8DrsOhU0PH;MGqdYu%9?wpNI*-va zg+kt+N}7l@u>6I{{vo$M>RC({R<4kB?;W0J^lvn_ z#Ch`uqx254cH$cz^pV(-5O?{VD;LGv!K=D%W^EnDn8K>%5TqW#5ZO&o2eqC-zdIPT z9szL(42OSN{zr!U5eK4C-eQy#*VN!@2X*rx(mtwlj4{=#t?8piC?4I-;6bv(AMWFy zu>&V>D?V*$#nn(pw5F-2Nq>J2>99I&g7n*OA89&=U^2pTW%+jGCH|d|-)ji`k~qSu zFaT+#$0hpC<>@sto4w+YtrUK9@bL8SBY%_aNpaK1qBwwU;oU#17!TSm9Y$tO#Z$f) znW_qU!bonjO)pUei+GNn1x__hde()-18@Z;&G4`?{f<3fHHc1Iu068$Vt$RiU#T`zw7~&ZR9r7xJ5P0h@b>RxPQ1fWG#oRb3@vkgQ8<0}iY4=oRcF zr4+{bay2SWZNiYZ2N|X`2;T&f`?J|}5&NWSv!SB&O zvWw`@?*-X_7i#i7WHqkGmQkX6HdE}-D@=EpJ9%BOM$ zrt0dv0dMX_1HMjIxI*J|@b!hQ|e9zT%G`Zr>vPHiYLLMNa3lDI(d^9Bd#zLq+WZ2-zYlJSNY3wvp02uhg9YNqMuHCFp+1kG!=(SMZl z`nRf((=H6r$+~XoqgHuHCiN32GG#UY#jJuYc7O&bS&3;M{oz>y%5E~=SRMUL?IPq6zQ;ei=#hqi*$f8OZ zK4RGrB(G&;?P-)!&WQ3YE)fRHfpnbN*FZwISVWXgQZ0q(pMeV>_&3hsrzVkVA8Zjut_{;a$-HTlb&!NuXV5kkcg#zhrl z${cxVX%nOqLncEWyzob%-Qly>F0y#%4vmJDl@;~X{&x^1fk49EgWgtWmf^ni8W;;p z)eK*93rRv-h3}f=Y<>>YGKQAyO!%4A29$@31_bZ$R1dcu>gEo=@PR*Q-pr&p*pGhe z{T3S*hsOtX9W@^B&3JZv@MH5*44-8cb$*SgZ=}hdJ0JO(Q+IZk!HkAYw2}3^+K}M- zYmL!aH^_0D_%oqiufb(r&j4v~O-3$_qRL_X_TAdA3Hz#2J=S zro0`DsOlmnpuT6igKzzL4|wBzJ<(gdTP}9iMxZ|y`N&c(I5i1b#pDPCdarR+;9BYD zQ9xrj5x+c+0#)6TT2FyFf?7-%_I&K>w=t@bWirw&QF-qc7KiF#A~M`3N;pS1MOk0> z5Jm5g+&&Qruy4*rI6+e%7^mdg^*s@gu;aLLi$idnscFA3v|Dk*!gok6N^C_dzakCn z%Whx(FqUuGl%Z%r>(%@o&%FtYUvP}D5eIh$*7*(c1fs-0JU_XQvsd!d1v#K!g>N1MQpjnxLvNVkVNJviyDHVP45rFsy*s6o8 zF^cRfy~u#CI@7tae*?W;Rp7Rk7YN{rk|C)losx zNoE()P*`ff91R&N%y#BYV%|45_K*n$io$VwB;>J(YWH)Z;kPsi`zPD9-{#AV@^q6} zI`(`1p*iUr^*F+Rp^Dc8!88TNs68L)Ar+^`-78Un{;Wez<^i04^fm2XYf=QHh|rKx zz4{|tw9ccMG3-2WJ7lBqtXCT{10Q;6ku4hW$P=#X9}B(p9BIU|(WYbW5NSz=0{(>{ zKj`Rm3)1heEzqjrU;8^BHEiHQGii{mCWZ5h?4g|L@8GFrOsFquAQs6=sIYE^~RtI4K&p% z%_DC?K0vMUiMXvC#-xFaj!lmJB`{I_#A+W$;(Y!u!+T-@43<8O*+3n}GT}sw zAnOgC4OMwVoUn;PxN<#+BzTkn#Mie&?r?OsI_^p;GOxx`m5e!*qZ-A-^INqr=F}$U zTzre0(U|Bom9fRlbV?CKM{;QJBQm8yqYKx-LvD0soYFEK(^$PEutBkdQ^-l45g}{g zNByEn^qO)?#yDg1yFMK8sb622wA#pKKYD$DWUaw!YGP!+r>k)4!aW##A|Ei|Zp7r| zPJA=yFb=m3459%lxD9xzQ|6PQBB(=5$7Bc6B(C04Z1Gqn5XWhfa;BxcYu-;7`|+Fw ziGNH{iNM@3vNWo{_jZm{bgrvtGR&mt<()FpM?*!NZOe72;C`Ax7a*-FyZ14VW$Cnk znAX*WW0cC^1jn?tk6*;F>!+xkj{Mwz@YQbi*Ku|lU3hen1p@j1iP%Xf!J0m%SqCNbuBguc_cMtf{3K+s+}bzp z-M`_<4&z{TVNp#bM8v|z2et8a1m!R8LA>Yhc^F^ewYg}lPmSm5Yz~nibmYwQxr)A} zSoH?lyj48D-(TcZ6^;KYuhyY~f9sroH`l0LafE53A0b08z}QJi@xvBOA!$*J9MZ)* z56xuJyv3!sDTr0Zngd1~+*%#R>fqhlMs>b`Tvj)J+SZbTmhStb@A8ocWr>+-_iX2z zFPKLf3r{|@cS}55gg?YWkEA<3oOnU?1%~>Bi>$T&HktoK$n$l7p3-QXBA6fRh_X9O zES~47;=(ZC%jIm;!UmoDYPI%Q&H2g(-gsUAqoRH>k@}9)%|uQntpQR%R18)P)u9nx zosFQri_Cae&K!!@=|qSPeLz%edMu~F28iXw$V~2}PQ{6xu$py1P*}abR2r|6>+)@{ z1hUCpfvIPxGS29(-uUeu@+Lo2th=hzRjgM*3`}YHH4G}Lx8j?f#m|kEZ^Gb(FINLY zcjfmk>6rm6z+)2+kHGN!Nss4EIP>>MJwWq70Q1Ac0}CvdkPMwcJ0=;5lQU}L=#!{2 za>76w%SEWa3z3~%V~f%ARy-tLFM+(wr~zX z-svtIUWwH>PM{(YPXdi-_MawU3ObEwhFu{cll2sTz|v10WQ1XAFiis{>ws^aCV_6_IBx;^uKu$2K_s;Wo{A7Rs5kZKAX%CR97r*aYUTa}u^KHkVBu5qvhcPnCb7iBc%}tyg|4S#6kUM1Q3kJrygkbOmN%AaqunJJ5_+4*N?SvIT-|mF4riokXWw0(5RuPEQ#56AD&=~H38Q@erKaoar|dFz895X1F%{3UxPb_d zJsaNfv1MoS)!XImm>&jAfWryD-Fk?GhAlYk!Odhc#>2a$J;jR1-J|{F5&eH>-l?b# z3$u0#LUp-dIny&uITslF7K~R(!pQ3HYz6nX0pOkcA{Av)1_Mh6b9s0UM{zUq2qD=ZgBm<)mZt&#<-JyVpqXUfl$Q?_ z?pfzpVf}!}71XipW;$g!w9H(fa=$G&5Qq#SJM0dW?qLz9dm%P5SFu9a3NziHxN6Wq zQpyDd=wK8$gcVtyRlZGE*n%2CfjL^ z?C`b%7*`#+lB6;*zX|riW;Wvn!!Pg=tvBe*b-scWN~x1&=S;NM|2&-E-v=-J`1n4^ z-{@<>BGTz`$@Oxj)eoL&=*{9@ONMMJN(z#7;{j5&(olv z5J2|j9l4({VO&%y^(lG6(=u!-@n4{L2G=+w3@b-9Nn8YLJ&0Q7><@cTRW>jAeys{! zjbNmlT)Yh@dkzMsyN+xL$7i561s_$#OkCrC>TP_nE_>8O2D5Tix~@#{_mDH(i{O6F zR%3T}v`j*H%GAmo*WZvw{4NKo{ZAQbqDB3&U6n_DDB*It+6n?3)t>YsI4{5cGRO5^#p*ol;@ zY)ow@qoG0R<#QzWz(K1oXZOrw5ZodP0(sHkNPst0)YUnXD zW!xLd(deAn!!p$Xkl!n>F){Vd(T|rwU)zE3DFDT5 zo?1T@08H3S+S-{$A*)4WIpgf3XDxGmij{FHSh z`(MQRxUHE`s71_>ryxpBESCg>u6YJZaVYGHmNZQIQa{`N;ADhtJ?Y2_?C=2P+DFPC zki^rw@ClniMRJo0VTausFQZ2kk*mY1>W~T*ok78r5Bf)(Hfa+K|K7)Q!zsvP^x;sy z3_qu5Oj>jwEsI}Fk%+1dfq+0N{ZAkgj9Ta}a9kYQ zvgTOc>Km>5McTuJC@q~E{Et5}vL=IS6(bhY^Mst#B+Ez&BPz#yh}+fG0b~hT4v?Ei zk^!DJ%cDIxbRL0f0;f8Pyb0%n7>vvpkNcj!<{XSRe7wQ(8An1kP^2s2o@-2GE#-9mRNYfMYv@$oMSd)I55ENBC-W3r4m9cyli^IU~7w%ZJgM$Ogjuzq!mW+ zSqcM~dtj;Uy(vW*T+IyKUgFX-G_tTgroQ{ON>kv7ne&Is#0#^s=U~NYK_oSRavnR+ zjcu=x(e(##0+J-LkI9Lu0)gbzjhB*QQj~-m!qraEx9e=dx=VC)$g!}~*INn6QZ7(l zWq4e6_WT`fbIjEe0q=$jMHwM1-)DJ(`l_81INPu(xz4~kJ=3^MJCk-#N2C-hXwhPV z6b=Bk{-suymWCDOOVm&VlQyhHsg_BQ>!5y*Q(z#(AZDdAut=q0sabM2vgTFs!N(&A zI!+LT>%YtY8+t!46wY``Yi57_znsb;OiM z$YZyTK;?^8Sp_uWXT7`VECD%x!_gDO=v4ymacYNu8+tH_z8}$Yji?axmbKZE2XwPx z?&VMs2-w1xpn)qSMP+PIP;c5dGGn*)@lB{GLtLyK*zOp*){=uh#%Q=|#5Snp7$zL- z5-}h9rHsCBk3UdtZDcSZ($UJ`^vHYIELbq?f!g7K)=a1-%po93ILSkqM6eK#qA745p~6t4oQRhb?>$2vi1fLujtA7@JB_^; z!!5!wM>6Pu4D`HIq8~-_^KRg&R@&46ZSpTinBS|%!QS` z#aK+{Shj@=Dj$*~So<6gy^7cQ{I(F@&WL=5A^lvKx1oyXiiq0V6W11w`z^V?+&$Kkd|K(%zd%~k=C8FksuO6C| zT4t