From fa8d4bdcc7010b8d357c9ba06979bbbc5f76211f Mon Sep 17 00:00:00 2001 From: "tirthraj.chaudhari" Date: Wed, 3 Sep 2025 19:07:56 +0530 Subject: [PATCH 01/10] Add crowdstrike-fdr integration --- .github/CODEOWNERS | 5 + .github/workflows/config/labeler.yml | 2 + crowdstrike_fdr/CHANGELOG.md | 7 + crowdstrike_fdr/README.md | 121 + ...ike_fdr_account_and_privilege_changes.json | 2087 +++++ ...trike_fdr_authentication_and_identity.json | 3448 +++++++++ ...ution_monitoring_and_threat_detection.json | 4311 +++++++++++ ...dstrike_fdr_file_and_malware_activity.json | 6758 +++++++++++++++++ .../crowdstrike_fdr_network_activity.json | 6150 +++++++++++++++ .../dashboards/crowdstrike_fdr_overview.json | 1106 +++ .../assets/logs/crowdstrike-fdr.yaml | 573 ++ .../assets/logs/crowdstrike-fdr_tests.yaml | 96 + crowdstrike_fdr/images/IMAGES_README.md | 41 + crowdstrike_fdr/manifest.json | 65 + 14 files changed, 24770 insertions(+) create mode 100644 crowdstrike_fdr/CHANGELOG.md create mode 100644 crowdstrike_fdr/README.md create mode 100644 crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_account_and_privilege_changes.json create mode 100644 crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_authentication_and_identity.json create mode 100644 crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_execution_monitoring_and_threat_detection.json create mode 100644 crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_file_and_malware_activity.json create mode 100644 crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_network_activity.json create mode 100644 crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_overview.json create mode 100644 crowdstrike_fdr/assets/logs/crowdstrike-fdr.yaml create mode 100644 crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml create mode 100644 crowdstrike_fdr/images/IMAGES_README.md create mode 100644 crowdstrike_fdr/manifest.json diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 9d5318128bf81..399a84a898e94 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -619,6 +619,11 @@ plaid/assets/logs/ @DataDog/saa /beyondtrust_password_safe/manifest.json @DataDog/saas-integrations @DataDog/agent-integrations @DataDog/documentation /beyondtrust_password_safe/assets/logs/ @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-integrations-reviewers +/crowdstrike_fdr/ @DataDog/saas-integrations +/crowdstrike_fdr/*.md @DataDog/saas-integrations @DataDog/documentation +/crowdstrike_fdr/manifest.json @DataDog/saas-integrations @DataDog/documentation +/crowdstrike_fdr/assets/logs/ @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-integrations-reviewers + # To keep Security up-to-date with changes to the signing tool. /datadog_checks_dev/datadog_checks/dev/tooling/signing.py @DataDog/agent-integrations # As well as the secure downloader. diff --git a/.github/workflows/config/labeler.yml b/.github/workflows/config/labeler.yml index 50999edddba6d..1a7f9f17c806a 100644 --- a/.github/workflows/config/labeler.yml +++ b/.github/workflows/config/labeler.yml @@ -177,6 +177,8 @@ integration/cri: - cri/**/* integration/crio: - crio/**/* +integration/crowdstrike_fdr: +- crowdstrike_fdr/**/* integration/databricks: - databricks/**/* integration/datadog_checks_tests_helper: diff --git a/crowdstrike_fdr/CHANGELOG.md b/crowdstrike_fdr/CHANGELOG.md new file mode 100644 index 0000000000000..f65d605fe1077 --- /dev/null +++ b/crowdstrike_fdr/CHANGELOG.md @@ -0,0 +1,7 @@ +# CHANGELOG - crowdstrike_fdr + +## 1.0.0 / 2025-09-03 + +***Added***: + +* Initial Release \ No newline at end of file diff --git a/crowdstrike_fdr/README.md b/crowdstrike_fdr/README.md new file mode 100644 index 0000000000000..8eac3008d4593 --- /dev/null +++ b/crowdstrike_fdr/README.md @@ -0,0 +1,121 @@ +# CrowdStrike FDR + +## Overview + +[CrowdStrike Falcon Data Replicator (FDR)][1] is a high-fidelity data export solution that enables organizations to securely stream raw endpoint telemetry in near real time. FDR delivers detailed event data through a data feed in JSON format using S3 (Amazon Web Services Simple Storage Service) and SQS (Amazon Simple Queue Service). + +Integrate CrowdStrike FDR with Datadog to gain insights into Authentication & Identity, Account & Privilege Changes, Execution Monitoring & Threat Detection, File & Malware Activity and Network Behavior events using pre-built dashboard visualizations. Datadog leverages its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, integration includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security. + +## Setup + +### Set up data replication from CrowdStrike FDR to a customer-owned S3 bucket + +#### Configure CrowdStrike FDR Feed +1. Login to **CrowdStrike Falcon** platform. +2. Go to **Support and resources** > **Resources and tools** > **Falcon data replicator**. +3. In the **FDR feeds** tab, click **Create feed**. +4. Provide a feed name. +5. Set the feed **status** to on. +6. Select **Customize your FDR feed** in **How do you want to create this feed?** option. +7. Click **Next**. +8. Include only required **Event name** from the **Primary events** tab. +9. Click **Next**. +10. Click **Create feed**. + +#### Setup Custom AWS S3 Bucket +1. Sign in to the AWS Management Console and navigate to Amazon S3. +2. Provide the details as mentioned below: + - **Bucket name**: Enter a Bucket name (must be globally unique and begins with the prefix `crowdstrike-fdr` to comply with integration naming requirements). + - **AWS Region**: Choose a region. + - You can only use your S3 bucket if you're using the US-1, US-2, or EU-1 CrowdStrike clouds. + - Ensure that your bucket resides in the same AWS region as your Falcon CID where the FDR feed is provisioned. + CrowdStrike terminology for cloud regions differs slightly from AWS, as shown in this table. + | CrowdStrike region | AWS region | + |--------------------|--------------| + | US-1 | us-west-1 | + | US-2 | us-west-2 | + | EU-1 | eu-central-1 | + + For example, if your Falcon CID resides in US-1, the bucket must reside in AWS's us-west-1 region. +3. Click **Create bucket**. +4. Once the bucket is created, click on the newly created bucket. +5. Go to the **Permissions** tab. +6. Click **Bucket policy** > **Edit**. +7. Replace the 2 occurrences of the **** placeholder in the below policy statement with your own bucket's name and add it in the **Policy** section: + ``` + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Allow cs ls", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::292230061137:root" + }, + "Action": [ + "s3:ListBucket", + "s3:GetBucketLocation" + ], + "Resource": "arn:aws:s3:::" + }, + { + "Sid": "allow cs all", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::292230061137:root" + }, + "Action": "s3:*", + "Resource": "arn:aws:s3:::/*" + } + ] + } + ``` +8. Copy the **Bucket ARN** of your S3 bucket. +9. Click **Save changes**. + +#### Raise Support Ticket in CrowdStrike +1. Log in to the **CrowdStrike Falcon** console with an account that has **Administrator** privileges. +2. Navigate to **Support and resources** > **Support portal**. +3. Select **Support** > **Cases**. +4. Click **Create Case**. +5. Provide `FDR to send data to a customer-owned S3 bucket` as a **Case Title**. +6. In the **Description** section of the support case, be sure to include the following details: + - The Falcon Customer ID (CID) where your FDR feed is provisioned + - FDR feed name created in `Configure CrowdStrike FDR Feed` section + - The ARN of the custom S3 bucket copied in **Step-8** from `Setup Custom AWS S3 Bucket`. + - Confirmation that the bucket has been set up according to the specifications outlined +7. **Customer ID (CID)**: Provide Falcon Customer ID +8. **Preferred Working Time Zone**: Select any preferred timezone +9. **Product Area**: Select `API and Integrations` +10. **Product Topic**: Select `Falcon Data Replicator` +11. Click **Submit Case**. +12. Wait until CrowdStrike Support confirms that provisioning is complete. + +## Configure Datadog Forwarder + +- Please refer to the [Datadog Forwarder][2]. + +## Data Collected + +### Logs + +| Format | Event Types | +| ------ | ----------- | +| JSON | Primary Events | + +### Metrics + +The CrowdStrike FDR integration does not include any metrics. + +### Events + +The CrowdStrike FDR integration does not include any events. + +## Support + +For any further assistance, contact [Datadog support][3]. + +[1]: https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/ +[2]: https://docs.datadoghq.com/logs/guide/forwarder/?tab=cloudformation +[3]: https://docs.datadoghq.com/help/ +[4]: https://github.com/CrowdStrike/FDR \ No newline at end of file diff --git a/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_account_and_privilege_changes.json b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_account_and_privilege_changes.json new file mode 100644 index 0000000000000..81719debb4f55 --- /dev/null +++ b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_account_and_privilege_changes.json @@ -0,0 +1,2087 @@ +{ + "title": "CrowdStrike FDR - Account & Privilege Changes", + "description": "This dashboard provides visibility into account creation, deletion, and privilege modifications, highlighting user account lifecycle changes and group membership updates.\n", + "widgets": [ + { + "id": 80178177366926, + "definition": { + "type": "image", + "url": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "url_dark_theme": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "sizing": "contain", + "has_background": true, + "has_border": true, + "vertical_align": "center", + "horizontal_align": "center" + }, + "layout": { + "x": 0, + "y": 0, + "width": 4, + "height": 3 + } + }, + { + "id": 8149798550171738, + "definition": { + "type": "note", + "content": "**[Crowdstrike FDR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/)** enables continuous export of raw Falcon security telemetry to AWS S3 storage. It provides scalable access to endpoint, network, and identity events for integration with SIEM.\n\nThis dashboard provides visibility into account creation, deletion, and privilege modifications, highlighting user account lifecycle changes and group membership updates.\n\nFor more information, see the [Crowdstrike FDR Integration Documentation](https://docs.datadoghq.com/integrations/crowdstrike_fdr/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.", + "background_color": "white", + "font_size": "14", + "text_align": "left", + "vertical_align": "center", + "show_tick": true, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 4, + "y": 0, + "width": 8, + "height": 3 + } + }, + { + "id": 7267362965047160, + "definition": { + "title": "Overview", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2466150292933626, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserAccountCreated OR UserAccountDeleted OR UserAccountAddedToGroup OR UserAccountRemovedFromGroup) $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6196921441792935, + "definition": { + "title": "Events by Type over Time", + "title_size": "16", + "title_align": "left", + "show_legend": true, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserAccountCreated OR UserAccountDeleted OR UserAccountAddedToGroup OR UserAccountRemovedFromGroup) $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 909297324441431, + "definition": { + "title": "Top Events by Sensor IP", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserAccountCreated OR UserAccountDeleted OR UserAccountAddedToGroup OR UserAccountRemovedFromGroup) $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@aip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 5, + "height": 4 + } + }, + { + "id": 1004081264383228, + "definition": { + "title": "Distribution of Events by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserAccountCreated OR UserAccountDeleted OR UserAccountAddedToGroup OR UserAccountRemovedFromGroup) $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 5, + "y": 3, + "width": 7, + "height": 4 + } + }, + { + "id": 456590734648831, + "definition": { + "title": "Distribution of Events by Platform", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserAccountCreated OR UserAccountDeleted OR UserAccountAddedToGroup OR UserAccountRemovedFromGroup) $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@event_platform_value", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 4420170519543391, + "definition": { + "title": "Event List", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:(UserAccountCreated OR UserAccountDeleted OR UserAccountAddedToGroup OR UserAccountRemovedFromGroup) $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "@evt.name", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 12 + } + }, + { + "id": 3270829661625478, + "definition": { + "title": "UserAccountCreated [Windows, Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1687313470434377, + "definition": { + "title": "Total User Account Creation Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountCreated $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4883964334670148, + "definition": { + "title": "User Accounts Creation Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountCreated $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1851357477669596, + "definition": { + "title": "Created User Account Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountCreated $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.id", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 6196397683460352, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountCreated $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 5442834990775544, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserAccountCreated $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 7, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 11 + } + }, + { + "id": 727232022555499, + "definition": { + "title": "UserAccountDeleted [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1200716828751596, + "definition": { + "title": "Total User Account Deletion Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Win $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5207245887188629, + "definition": { + "title": "User Accounts Deleted Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Win $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1806648475757561, + "definition": { + "title": "Deleted User Account Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Win $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.id", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 1050185246057293, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Win $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 8226688041090208, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Win $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 7, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 26, + "width": 12, + "height": 11 + } + }, + { + "id": 2606390002009462, + "definition": { + "title": "UserAccountDeleted [Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 3310928348361096, + "definition": { + "title": "Total User Account Deletion Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Lin $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 8338255921366460, + "definition": { + "title": "User Accounts Deleted Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Lin $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 2677784329548793, + "definition": { + "title": "Deleted User Account Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Lin $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.id", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@UserIsAdmin", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@UserIsInteractive", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 7451274086265163, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Lin $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 5582017858132740, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserAccountDeleted @event_platform:Lin $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 7, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 37, + "width": 12, + "height": 11, + "is_column_break": true + } + }, + { + "id": 1947465556702641, + "definition": { + "title": "UserAccountAddedToGroup [Windows, Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 7751217725852835, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountAddedToGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 7351822732109, + "definition": { + "title": "Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountAddedToGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 2446288389923632, + "definition": { + "title": "Most Active User", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountAddedToGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2810269601395221, + "definition": { + "title": "User Account with Added Group Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountAddedToGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.id", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@GroupRid", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3544997426938395, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserAccountAddedToGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 48, + "width": 12, + "height": 10 + } + }, + { + "id": 7511612428988413, + "definition": { + "title": "UserAccountRemovedFromGroup [Windows, Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2545457229693486, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountRemovedFromGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4479892942813728, + "definition": { + "title": "Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountRemovedFromGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 5769082301262073, + "definition": { + "title": "Most Active User", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountRemovedFromGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1248555582228125, + "definition": { + "title": "User Account with Removed Group Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserAccountRemovedFromGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.id", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@UserGroups", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3200781741525137, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserAccountRemovedFromGroup $Event-Platform $Event-Name $User-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 58, + "width": 12, + "height": 10 + } + } + ], + "template_variables": [ + { + "name": "Event-Platform", + "prefix": "@event_platform_value", + "available_values": [], + "default": "*" + }, + { + "name": "Event-Name", + "prefix": "@evt.name", + "available_values": [], + "default": "*" + }, + { + "name": "User-Name", + "prefix": "@usr.name", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-IP", + "prefix": "@aip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-ID", + "prefix": "@aid", + "available_values": [], + "default": "*" + } + ], + "layout_type": "ordered", + "notify_list": [], + "reflow_type": "fixed" +} \ No newline at end of file diff --git a/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_authentication_and_identity.json b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_authentication_and_identity.json new file mode 100644 index 0000000000000..831963312f9c4 --- /dev/null +++ b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_authentication_and_identity.json @@ -0,0 +1,3448 @@ +{ + "title": "CrowdStrike FDR - Authentication & Identity", + "description": "This dashboard provides insights into authentication activities and identity-related events, highlighting successful and failed logons, SSO attempts, and suspicious token usage to enhance visibility into account access and potential compromise.", + "widgets": [ + { + "id": 80178177366926, + "definition": { + "type": "image", + "url": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "url_dark_theme": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "sizing": "contain", + "has_background": true, + "has_border": true, + "vertical_align": "center", + "horizontal_align": "center" + }, + "layout": { + "x": 0, + "y": 0, + "width": 4, + "height": 3 + } + }, + { + "id": 8149798550171738, + "definition": { + "type": "note", + "content": "**[Crowdstrike FDR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/)** enables continuous export of raw Falcon security telemetry to AWS S3 storage. It provides scalable access to endpoint, network, and identity events for integration with SIEM.\n\nThis dashboard provides insights into authentication activities and identity-related events, highlighting successful and failed logons, SSO attempts, and suspicious token usage to enhance visibility into account access and potential compromise.\n\nFor more information, see the [Crowdstrike FDR Integration Documentation](https://docs.datadoghq.com/integrations/crowdstrike_fdr/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.", + "background_color": "white", + "font_size": "14", + "text_align": "left", + "vertical_align": "center", + "show_tick": true, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 4, + "y": 0, + "width": 8, + "height": 3 + } + }, + { + "id": 7267362965047160, + "definition": { + "title": "Overview", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2466150292933626, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserLogon OR UserLogonFailed OR SsoUserLogon OR SsoUserLogonFailure OR ProcessTokenStolen OR TokenImpersonated) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6196921441792935, + "definition": { + "title": "Events by Type over Time", + "title_size": "16", + "title_align": "left", + "show_legend": true, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserLogon OR UserLogonFailed OR SsoUserLogon OR SsoUserLogonFailure OR ProcessTokenStolen OR TokenImpersonated) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4448876311598086, + "definition": { + "title": "Top Events by Sensor IP", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserLogon OR UserLogonFailed OR SsoUserLogon OR SsoUserLogonFailure OR ProcessTokenStolen OR TokenImpersonated) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@aip", + "limit": 15, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 15, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 5, + "height": 4 + } + }, + { + "id": 1004081264383228, + "definition": { + "title": "Distribution of Events by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserLogon OR UserLogonFailed OR SsoUserLogon OR SsoUserLogonFailure OR ProcessTokenStolen OR TokenImpersonated) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 5, + "y": 3, + "width": 7, + "height": 4 + } + }, + { + "id": 1352122462872190, + "definition": { + "title": "Distribution of Events by Platform", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(UserLogon OR UserLogonFailed OR SsoUserLogon OR SsoUserLogonFailure OR ProcessTokenStolen OR TokenImpersonated) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@event_platform_value", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 4420170519543391, + "definition": { + "title": "Event List", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:(UserLogon OR UserLogonFailed OR SsoUserLogon OR SsoUserLogonFailure OR ProcessTokenStolen OR TokenImpersonated) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "@evt.name", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 12 + } + }, + { + "id": 4201045603797366, + "definition": { + "title": "UserLogon [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 5804566218816333, + "definition": { + "title": "Total Logon Attempts", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6481570755463242, + "definition": { + "title": "Logon Attempts over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6093431178846966, + "definition": { + "title": "Top Users Attempted Logon", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "dog_classic", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 6577839288761685, + "definition": { + "title": "Top Logon Domains", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@LogonDomain", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "dog_classic", + "scaling": "relative" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 7761000860849803, + "definition": { + "title": "Total Remote Logon Attempts", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win @RemoteAccount:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 7, + "width": 3, + "height": 4 + } + }, + { + "id": 7310955606094398, + "definition": { + "title": "Total Logon Attempts with Admin User", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win @UserIsAdmin:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 3, + "y": 7, + "width": 3, + "height": 4 + } + }, + { + "id": 3858714531766437, + "definition": { + "title": "Distribution of Events by Logon Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@LogonTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 7429701032067846, + "definition": { + "title": "Top Admin Users Attempted Logon", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win @UserIsAdmin:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 11, + "width": 4, + "height": 4 + } + }, + { + "id": 2398850757207584, + "definition": { + "title": "Distribution of Events by User Logon Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@UserLogonFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 4, + "y": 11, + "width": 4, + "height": 4 + } + }, + { + "id": 174343667576868, + "definition": { + "title": "Top Client Computer Name", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 8, + "y": 11, + "width": 4, + "height": 4 + } + }, + { + "id": 1101881947952494, + "definition": { + "title": "Logon Attempt Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@UserIsAdminValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@LogonTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 15, + "width": 6, + "height": 4 + } + }, + { + "id": 1120705128667904, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 15, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 20 + } + }, + { + "id": 3139408458799220, + "definition": { + "title": "UserLogon [Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8862603832523147, + "definition": { + "title": "Total Logon Attempts", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 1487051426894255, + "definition": { + "title": "Logon Attempts over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6715848764360490, + "definition": { + "title": "Top Users Attempted Logon", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "dog_classic", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 6004505766678937, + "definition": { + "title": "Distribution of Events by Logon Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@LogonTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 5474017710967283, + "definition": { + "title": "Total Remote Logon Attempts", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin @RemoteAccount:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 7, + "width": 3, + "height": 4 + } + }, + { + "id": 1695822274466177, + "definition": { + "title": "Total Logon Attempts with Admin User", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin @UserIsAdmin:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 3, + "y": 7, + "width": 3, + "height": 4 + } + }, + { + "id": 8590114229240641, + "definition": { + "title": "Top Admin Users Attempted Logon", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin @UserIsAdmin:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "scaling": "relative" + } + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 4771269823961447, + "definition": { + "title": "Logon Attempt Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@UserIsAdminValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@LogonTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 11, + "width": 6, + "height": 4 + } + }, + { + "id": 2317811672825485, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Lin $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 11, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 35, + "width": 12, + "height": 16 + } + }, + { + "id": 5961432931722764, + "definition": { + "title": "UserLogon [MacOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1870866988194704, + "definition": { + "title": "Total Logon Attempts", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4294468972010148, + "definition": { + "title": "Logon Attempts over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4080550972682970, + "definition": { + "title": "Top Users Attempted Logon", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "dog_classic", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 6600948870472205, + "definition": { + "title": "Distribution of Events by Logon Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@LogonTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 554736989232608, + "definition": { + "title": "Total Logon Attempts with Admin User", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac @UserIsAdmin:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 7, + "width": 3, + "height": 4 + } + }, + { + "id": 7864469053565878, + "definition": { + "title": "Top Admin Users Attempted Logon", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac @UserIsAdmin:1 $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 3, + "y": 7, + "width": 4, + "height": 4 + } + }, + { + "id": 7433565290326523, + "definition": { + "title": "Distribution of Events by User Logon Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@UserLogonFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 7, + "y": 7, + "width": 5, + "height": 4 + } + }, + { + "id": 3234543876441361, + "definition": { + "title": "Top Machine Domains", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@MachineDomain", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 11, + "width": 5, + "height": 4 + } + }, + { + "id": 994339396617414, + "definition": { + "title": "Logon Attempt Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@UserIsAdminValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@LogonTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 5, + "y": 11, + "width": 7, + "height": 4 + } + }, + { + "id": 632775291646614, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserLogon @event_platform:Mac $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 51, + "width": 12, + "height": 19 + } + }, + { + "id": 6689306872551860, + "definition": { + "title": "UserLogonFailed [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8221818976105374, + "definition": { + "title": "Total Failed Logon Attempts", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogonFailed @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 2831344479667338, + "definition": { + "title": "Failed Logon Attempts over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogonFailed @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 7105250767486538, + "definition": { + "title": "Top Users from Failed Logon Attempted", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogonFailed @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "dog_classic", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 2015361464776534, + "definition": { + "title": "Distribution of Events by User Logon Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:UserLogonFailed @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@UserLogonFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 4 + } + }, + { + "id": 3028604607236328, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:UserLogonFailed @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 7, + "width": 12, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 70, + "width": 12, + "height": 12 + } + }, + { + "id": 2134771881623149, + "definition": { + "title": "ProcessTokenStolen [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8055454057655, + "definition": { + "title": "Total Process Token Stolen Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessTokenStolen @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 7624471094261936, + "definition": { + "title": "Process Token Stolen Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessTokenStolen @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 8200669562844440, + "definition": { + "title": "Top Target Processes", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessTokenStolen @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "dog_classic" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2599998409014325, + "definition": { + "title": "Events by Token Object Check Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessTokenStolen @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TokenObjectCheckTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3297614087988152, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:ProcessTokenStolen @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "host", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 82, + "width": 12, + "height": 11 + } + }, + { + "id": 1420943732898579, + "definition": { + "title": "TokenImpersonated [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 6122899079659718, + "definition": { + "title": "Total Token Impersonated Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 1722362226494751, + "definition": { + "title": "Token Impersonated Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 5518406362602483, + "definition": { + "title": "Top Impersonated Accounts", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImpersonatedUserName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3675952662010022, + "definition": { + "title": "Top Source Processes for Impersonation", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ContextProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "scaling": "relative" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 8915543281415743, + "definition": { + "title": "Top Original Users Performing Impersonations", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 8039403971093358, + "definition": { + "title": "Original vs Impersonated User Comparison", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@ImpersonatedUserName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 5178254792331585, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:TokenImpersonated @event_platform:Win $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 93, + "width": 12, + "height": 14 + } + } + ], + "template_variables": [ + { + "name": "Event-Platform", + "prefix": "@event_platform_value", + "available_values": [], + "default": "*" + }, + { + "name": "Event-Name", + "prefix": "@evt.name", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-IP", + "prefix": "@aip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-ID", + "prefix": "@aid", + "available_values": [], + "default": "*" + } + ], + "layout_type": "ordered", + "notify_list": [], + "reflow_type": "fixed" +} \ No newline at end of file diff --git a/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_execution_monitoring_and_threat_detection.json b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_execution_monitoring_and_threat_detection.json new file mode 100644 index 0000000000000..68b9ede3ccbf5 --- /dev/null +++ b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_execution_monitoring_and_threat_detection.json @@ -0,0 +1,4311 @@ +{ + "title": "CrowdStrike FDR - Execution Monitoring & Threat Detection", + "description": "This dashboard provides insights into process execution and injection activities, highlighting blocked processes, DLL injections, reflective loads, and suspicious privilege operations.", + "widgets": [ + { + "id": 80178177366926, + "definition": { + "type": "image", + "url": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "url_dark_theme": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "sizing": "contain", + "has_background": true, + "has_border": true, + "vertical_align": "center", + "horizontal_align": "center" + }, + "layout": { + "x": 0, + "y": 0, + "width": 4, + "height": 3 + } + }, + { + "id": 8149798550171738, + "definition": { + "type": "note", + "content": "**[Crowdstrike FDR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/)** enables continuous export of raw Falcon security telemetry to AWS S3 storage. It provides scalable access to endpoint, network, and identity events for integration with SIEM.\n\nThis dashboard provides insights into process execution and injection activities, highlighting blocked processes, DLL injections, reflective loads, and suspicious privilege operations.\n\nFor more information, see the [Crowdstrike FDR Integration Documentation](https://docs.datadoghq.com/integrations/crowdstrike_fdr/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.", + "background_color": "white", + "font_size": "14", + "text_align": "left", + "vertical_align": "center", + "show_tick": true, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 4, + "y": 0, + "width": 8, + "height": 3 + } + }, + { + "id": 7267362965047160, + "definition": { + "title": "Overview", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2466150292933626, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(ProcessBlocked OR InjectedThread OR DllInjection OR ProcessInjection OR ReflectiveDllLoaded OR SuspiciousCreateSymbolicLink OR SuspiciousPrivilegedProcessHandle) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6196921441792935, + "definition": { + "title": "Events by Type over Time", + "title_size": "16", + "title_align": "left", + "show_legend": true, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(ProcessBlocked OR InjectedThread OR DllInjection OR ProcessInjection OR ReflectiveDllLoaded OR SuspiciousCreateSymbolicLink OR SuspiciousPrivilegedProcessHandle) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 3273330789820094, + "definition": { + "title": "Top Events by Sensor IP", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(ProcessBlocked OR InjectedThread OR DllInjection OR ProcessInjection OR ReflectiveDllLoaded OR SuspiciousCreateSymbolicLink OR SuspiciousPrivilegedProcessHandle) $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@aip", + "limit": 15, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 15, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 5, + "height": 4 + } + }, + { + "id": 1004081264383228, + "definition": { + "title": "Distribution of Events by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(ProcessBlocked OR InjectedThread OR DllInjection OR ProcessInjection OR ReflectiveDllLoaded OR SuspiciousCreateSymbolicLink OR SuspiciousPrivilegedProcessHandle) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 5, + "y": 3, + "width": 7, + "height": 4 + } + }, + { + "id": 3576637390403318, + "definition": { + "title": "Distribution of Events by Platform", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(ProcessBlocked OR InjectedThread OR DllInjection OR ProcessInjection OR ReflectiveDllLoaded OR SuspiciousCreateSymbolicLink OR SuspiciousPrivilegedProcessHandle) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@event_platform_value", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 4420170519543391, + "definition": { + "title": "Event List", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:(ProcessBlocked OR InjectedThread OR DllInjection OR ProcessInjection OR ReflectiveDllLoaded OR SuspiciousCreateSymbolicLink OR SuspiciousPrivilegedProcessHandle) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "@evt.name", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 12 + } + }, + { + "id": 3270829661625478, + "definition": { + "title": "ProcessBlocked [Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1687313470434377, + "definition": { + "title": "Total Process Blocked Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4883964334670148, + "definition": { + "title": "Process Blocked Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1851357477669596, + "definition": { + "title": "Top Blocked Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4708026408185685, + "definition": { + "title": "Top Blocked Executable Path", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4333497918283370, + "definition": { + "title": "Top Blocked Commands", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@CommandLine", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 8323538711195646, + "definition": { + "title": "Top Blocked Process IDs by Avg. Duration", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin -@ProcessEndTime:\"\" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@ProcessEndTime" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@ProcessEndTime" + }, + "storage": "hot" + }, + { + "name": "query2", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin -@ProcessEndTime:\"\" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@ProcessStartTime" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@ProcessStartTime" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1 - query2", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + } + ], + "sort": { + "count": 20, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 2143598844776761, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 13 + } + }, + { + "id": 8153227717853580, + "definition": { + "title": "ProcessBlocked [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1837814517271047, + "definition": { + "title": "Total Process Blocked Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5734023965398847, + "definition": { + "title": "Process Blocked Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6302331598728257, + "definition": { + "title": "Top Blocked Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5242129807116562, + "definition": { + "title": "Top Blocked Executable Path", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5675093955681431, + "definition": { + "title": "Top Blocked Commands", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@CommandLine", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 6459732001973344, + "definition": { + "title": "Events by Integrity Level", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@IntegrityLevelValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 5403110561756473, + "definition": { + "title": "Top Linkname used to Launch the Blocked Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@LinkName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 6, + "height": 3 + } + }, + { + "id": 5041840760235656, + "definition": { + "title": "Top Blocked Process IDs by Avg. Duration", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win -@ProcessEndTime:\"\" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@ProcessEndTime" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@ProcessEndTime" + }, + "storage": "hot" + }, + { + "name": "query2", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win -@ProcessEndTime:\"\" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@ProcessStartTime" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@ProcessStartTime" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1 - query2", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + } + ], + "sort": { + "count": 20, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 9, + "width": 6, + "height": 3 + } + }, + { + "id": 1954369709948770, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 28, + "width": 12, + "height": 16 + } + }, + { + "id": 1284038981952628, + "definition": { + "title": "ProcessBlocked [MacOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8346897339119291, + "definition": { + "title": "Total Process Blocked Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5163582905333999, + "definition": { + "title": "Process Blocked Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6161700545262786, + "definition": { + "title": "Top Blocked Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 315703491939842, + "definition": { + "title": "Process Blocked Events by MachOSubType", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@MachOSubTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1570812465394343, + "definition": { + "title": "Top Blocked Executable Path", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 8563949593981021, + "definition": { + "title": "Top Blocked Commands", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@CommandLine", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 925325372439791, + "definition": { + "title": "Top Blocked Process IDs by Avg. Duration", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac -@ProcessEndTime:\"\" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@ProcessEndTime" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@ProcessEndTime" + }, + "storage": "hot" + }, + { + "name": "query2", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac -@ProcessEndTime:\"\" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@ProcessStartTime" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@ProcessStartTime" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1 - query2", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "second" + } + } + } + ], + "sort": { + "count": 20, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 6, + "height": 3 + } + }, + { + "id": 2562506659035232, + "definition": { + "title": "Top SigningID Associated with Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@SigningId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 9, + "width": 6, + "height": 3 + } + }, + { + "id": 3876615284265950, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:ProcessBlocked @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 44, + "width": 12, + "height": 1 + } + }, + { + "id": 7591971481607930, + "definition": { + "title": "InjectedThread [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 5049893473142831, + "definition": { + "title": "Total Injected Thread Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:InjectedThread @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 127053034099838, + "definition": { + "title": "Injected Threads Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:InjectedThread @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4837172579958217, + "definition": { + "title": "Top Targeted Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:InjectedThread @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4660419681882108, + "definition": { + "title": "Injected Thread Events by Injected Thread Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:InjectedThread @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@InjectedThreadFlagValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1320384493363992, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:InjectedThread @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 45, + "width": 12, + "height": 10 + } + }, + { + "id": 8632792199258679, + "definition": { + "title": "DllInjection [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2315335639375156, + "definition": { + "title": "Total Dll Injection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DllInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4246645475240956, + "definition": { + "title": "Dll Injection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DllInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 5934275320180010, + "definition": { + "title": "Top Targeted Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DllInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1132500131439455, + "definition": { + "title": "Injected Thread Events by Injected Thread Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DllInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@InjectedThreadFlagValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5527975187523115, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:DllInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 55, + "width": 12, + "height": 10 + } + }, + { + "id": 1241887993188384, + "definition": { + "title": "ProcessInjection [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 544332403330403, + "definition": { + "title": "Total Process Injection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 1807388941959975, + "definition": { + "title": "Process Injection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 7240362393050743, + "definition": { + "title": "Top Targeted Process", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 6340864543052684, + "definition": { + "title": "Process Injection Events by Payload Classification", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@PayloadClassificationValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2814356560638900, + "definition": { + "title": "Process Injection Events by Thread Execution Control Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ThreadExecutionControlTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 2812360132046666, + "definition": { + "title": "Process Injection Payload Classification Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetProcessId", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@PayloadClassificationValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@PayloadClassificationFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "bar", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 583233378662749, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:ProcessInjection @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 65, + "width": 12, + "height": 13 + } + }, + { + "id": 5709055988835585, + "definition": { + "title": "ReflectiveDllLoaded [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 6969920052469678, + "definition": { + "title": "Total Reflective Dll Loaded Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ReflectiveDllLoaded @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 3378338615240360, + "definition": { + "title": "Reflective Dll Loaded Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ReflectiveDllLoaded @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 5798912383459767, + "definition": { + "title": "Top Executable Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ReflectiveDllLoaded @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3124431522518749, + "definition": { + "title": "Top Commands", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ReflectiveDllLoaded @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@CommandLine", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2745264212077257, + "definition": { + "title": "Top Reflective Dll Name", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:ReflectiveDllLoaded @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ReflectiveDllName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 5837454711799013, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:ReflectiveDllLoaded @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 78, + "width": 12, + "height": 10 + } + }, + { + "id": 7658483581735235, + "definition": { + "title": "SuspiciousCreateSymbolicLink [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2261177595357126, + "definition": { + "title": "Total Suspicious Create Symbolic Link Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 696565099704957, + "definition": { + "title": "Suspicious Create Symbolic Link Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4422770684262111, + "definition": { + "title": "Top Suspicious Symbolic Link Name", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@SymbolicLinkName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5589187124515499, + "definition": { + "title": "Top Executable Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5072243463826363, + "definition": { + "title": "Top Commands", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@CommandLine", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 8497725297520743, + "definition": { + "title": "Symbolic Link Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@SymbolicLinkName", + "limit": 100, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@SymbolicLinkTarget", + "limit": 2, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@DesiredAccess", + "limit": 5, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "bar", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 7524908043617764, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:SuspiciousCreateSymbolicLink @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 88, + "width": 12, + "height": 13 + } + }, + { + "id": 4684157701462849, + "definition": { + "title": "SuspiciousPrivilegedProcessHandle [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 5894577951448539, + "definition": { + "title": "Total Suspicious Privileged Process Handle Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPrivilegedProcessHandle @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6511603929159169, + "definition": { + "title": "Suspicious Privileged Process Handle Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPrivilegedProcessHandle @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 7173999660354349, + "definition": { + "title": "Events by Suspicious Handle Open Reason", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPrivilegedProcessHandle @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@SuspiciousHandleOpenReasonValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5732414936697229, + "definition": { + "title": "Events by Integrity Level", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPrivilegedProcessHandle @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@IntegrityLevelValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2959005470220456, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:SuspiciousPrivilegedProcessHandle @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 101, + "width": 12, + "height": 10 + } + } + ], + "template_variables": [ + { + "name": "Event-Platform", + "prefix": "@event_platform_value", + "available_values": [], + "default": "*" + }, + { + "name": "Event-Name", + "prefix": "@evt.name", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-IP", + "prefix": "@aip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-ID", + "prefix": "@aid", + "available_values": [], + "default": "*" + } + ], + "layout_type": "ordered", + "notify_list": [], + "reflow_type": "fixed" +} \ No newline at end of file diff --git a/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_file_and_malware_activity.json b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_file_and_malware_activity.json new file mode 100644 index 0000000000000..9d35dd21a02ef --- /dev/null +++ b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_file_and_malware_activity.json @@ -0,0 +1,6758 @@ +{ + "title": "CrowdStrike FDR - File & Malware Activity", + "description": "This dashboard provides insights into file creation and modification activities, highlighting detection of suspicious executables, scripts, and high-entropy files, as well as ransomware behavior and quarantined malware for proactive threat monitoring.", + "widgets": [ + { + "id": 80178177366926, + "definition": { + "type": "image", + "url": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "url_dark_theme": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "sizing": "contain", + "has_background": true, + "has_border": true, + "vertical_align": "center", + "horizontal_align": "center" + }, + "layout": { + "x": 0, + "y": 0, + "width": 4, + "height": 3 + } + }, + { + "id": 8149798550171738, + "definition": { + "type": "note", + "content": "**[Crowdstrike FDR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/)** enables continuous export of raw Falcon security telemetry to AWS S3 storage. It provides scalable access to endpoint, network, and identity events for integration with SIEM.\n\nThis dashboard provides insights into file creation and modification activities, highlighting detection of suspicious executables, scripts, and high-entropy files, as well as ransomware behavior and quarantined malware for proactive threat monitoring.\n\nFor more information, see the [Crowdstrike FDR Integration Documentation](https://docs.datadoghq.com/integrations/crowdstrike_fdr/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.", + "background_color": "white", + "font_size": "14", + "text_align": "left", + "vertical_align": "center", + "show_tick": true, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 4, + "y": 0, + "width": 8, + "height": 3 + } + }, + { + "id": 7267362965047160, + "definition": { + "title": "Overview", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2466150292933626, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NewExecutableWritten OR NewScriptWritten OR PeFileWritten OR FileWrittenWithEntropyHigh OR QuarantinedFile OR RansomwareCreateFile OR RansomwareOpenFile OR SuspiciousPeFileWritten OR SuspiciousRawDiskRead) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6196921441792935, + "definition": { + "title": "Events by Type Over Time", + "title_size": "16", + "title_align": "left", + "show_legend": true, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NewExecutableWritten OR NewScriptWritten OR PeFileWritten OR FileWrittenWithEntropyHigh OR QuarantinedFile OR RansomwareCreateFile OR RansomwareOpenFile OR SuspiciousPeFileWritten OR SuspiciousRawDiskRead) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 5906846390023499, + "definition": { + "title": "Top Events by Sensor IP", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NewExecutableWritten OR NewScriptWritten OR PeFileWritten OR FileWrittenWithEntropyHigh OR QuarantinedFile OR RansomwareCreateFile OR RansomwareOpenFile OR SuspiciousPeFileWritten OR SuspiciousRawDiskRead) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@aip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 5, + "height": 4 + } + }, + { + "id": 1004081264383228, + "definition": { + "title": "Distribution of Events by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NewExecutableWritten OR NewScriptWritten OR PeFileWritten OR FileWrittenWithEntropyHigh OR QuarantinedFile OR RansomwareCreateFile OR RansomwareOpenFile OR SuspiciousPeFileWritten OR SuspiciousRawDiskRead) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 5, + "y": 3, + "width": 7, + "height": 4 + } + }, + { + "id": 3515557125559613, + "definition": { + "title": "Distribution of Events by Platform", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NewExecutableWritten OR NewScriptWritten OR PeFileWritten OR FileWrittenWithEntropyHigh OR QuarantinedFile OR RansomwareCreateFile OR RansomwareOpenFile OR SuspiciousPeFileWritten OR SuspiciousRawDiskRead) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@event_platform_value", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 4420170519543391, + "definition": { + "title": "Event List", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:(NewExecutableWritten OR NewScriptWritten OR PeFileWritten OR FileWrittenWithEntropyHigh OR QuarantinedFile OR RansomwareCreateFile OR RansomwareOpenFile OR SuspiciousPeFileWritten OR SuspiciousRawDiskRead) $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "@evt.name", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 12 + } + }, + { + "id": 3270829661625478, + "definition": { + "title": "NewExecutableWritten [Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1687313470434377, + "definition": { + "title": "Total New Executable Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4883964334670148, + "definition": { + "title": "New Executable Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1851357477669596, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4068459128520852, + "definition": { + "title": "Top Largest File Written", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@size" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@size" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "byte_in_decimal_bytes_family" + } + } + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5442834990775544, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 10 + } + }, + { + "id": 5251822653643302, + "definition": { + "title": "NewExecutableWritten [MacOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 3154203372596818, + "definition": { + "title": "Total New Executable Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 3213141122942833, + "definition": { + "title": "New Executable Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 2072282227058894, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 3 + } + }, + { + "id": 3888667748507840, + "definition": { + "title": "Top Largest File Written", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "avg", + "order": "desc", + "metric": "@size" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "avg", + "metric": "@size" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1", + "number_format": { + "unit": { + "type": "canonical_unit", + "unit_name": "byte_in_decimal_bytes_family" + } + } + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 4312415787489543, + "definition": { + "title": "File Activity Types", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@VnodeModificationTypeValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 7812465049432126, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 25, + "width": 12, + "height": 13 + } + }, + { + "id": 2090244704966392, + "definition": { + "title": "NewExecutableWritten [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1640475609607569, + "definition": { + "title": "Total New Executable Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5239411349935952, + "definition": { + "title": "New Executable Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4025926992666336, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 8731897937256818, + "definition": { + "title": "Top File Quarantine Status", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 4, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 200562893040620, + "definition": { + "title": "Target File Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 8, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 6022113372282066, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NewExecutableWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 38, + "width": 12, + "height": 10 + } + }, + { + "id": 563247365701756, + "definition": { + "title": "NewScriptWritten [Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 5230445046332871, + "definition": { + "title": "Total New Script Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 2560698033542571, + "definition": { + "title": "New Script Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6982890311636703, + "definition": { + "title": "Total New Script Written on Removable Disk Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 3, + "width": 3, + "height": 3 + } + }, + { + "id": 897727516284576, + "definition": { + "title": "New Script Written on Removable Disk Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 3, + "width": 9, + "height": 3 + } + }, + { + "id": 5923957971089924, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 8495813500684727, + "definition": { + "title": "Top Target Filename Written on Removable Disk", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 5535061828078287, + "definition": { + "title": "Events by File Category", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 8, + "height": 3 + } + }, + { + "id": 4212956821624627, + "definition": { + "title": "Top Username", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 8, + "y": 9, + "width": 4, + "height": 3 + } + }, + { + "id": 2208641503292726, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 48, + "width": 12, + "height": 16 + } + }, + { + "id": 6516674072368826, + "definition": { + "title": "NewScriptWritten [MacOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8337242578528464, + "definition": { + "title": "Total New Script Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 3539372843242224, + "definition": { + "title": "New Script Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 3250042802575334, + "definition": { + "title": "Total New Script Written on Removable Disk Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 3, + "width": 3, + "height": 3 + } + }, + { + "id": 6002933476578220, + "definition": { + "title": "New Script Written on Removable Disk Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 3, + "width": 9, + "height": 3 + } + }, + { + "id": 6703480529897577, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + }, + { + "id": 8401064382625853, + "definition": { + "title": "Top Target Filename Written on Removable Disk", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + }, + { + "id": 6519017099490260, + "definition": { + "title": "Events by File Category", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 12, + "width": 8, + "height": 3 + } + }, + { + "id": 4841223625299265, + "definition": { + "title": "Top Username", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 8, + "y": 12, + "width": 4, + "height": 3 + } + }, + { + "id": 6611417320998884, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 64, + "width": 12, + "height": 19 + } + }, + { + "id": 1824592176339239, + "definition": { + "title": "NewScriptWritten [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 3115183523524313, + "definition": { + "title": "Total New Script Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4472945551467328, + "definition": { + "title": "New Script Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4128085600179141, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4513573601138332, + "definition": { + "title": "Top File Quarantine Status", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 5034666598614125, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NewScriptWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 83, + "width": 12, + "height": 10 + } + }, + { + "id": 1715830769425771, + "definition": { + "title": "PeFileWritten [MacOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8039211648343805, + "definition": { + "title": "Total PE File Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6551135555045116, + "definition": { + "title": "PE File Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 2285863328199263, + "definition": { + "title": "Total PE File Written on Removable Disk Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 3, + "width": 3, + "height": 3 + } + }, + { + "id": 5460398492742484, + "definition": { + "title": "PE File Written on Removable Disk Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 3, + "width": 9, + "height": 3 + } + }, + { + "id": 1968458590658488, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 4712093618788553, + "definition": { + "title": "Events by File Category", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 5839362655549315, + "definition": { + "title": "Top Username", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 4, + "height": 3 + } + }, + { + "id": 4207818987261610, + "definition": { + "title": "PE Files Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@FileSourcePath", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 4, + "y": 9, + "width": 8, + "height": 3 + } + }, + { + "id": 2514206753168600, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Mac $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 93, + "width": 12, + "height": 16 + } + }, + { + "id": 95009616970066, + "definition": { + "title": "PeFileWritten [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8913954299511324, + "definition": { + "title": "Total PE File Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4360280775764889, + "definition": { + "title": "PE File Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 5799194910102234, + "definition": { + "title": "Total PE File Written on Removable Disk Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 3, + "width": 3, + "height": 3 + } + }, + { + "id": 8363925034901136, + "definition": { + "title": "PE File Written on Removable Disk Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 3, + "width": 9, + "height": 3 + } + }, + { + "id": 4806025194461770, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 1583531179628637, + "definition": { + "title": "Top Original Filename of PE", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win -@OriginalFilename:\" \" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@OriginalFilename", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 8047295008735892, + "definition": { + "title": "Events by File Category", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3861259492245212, + "definition": { + "title": "Top Username", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 4, + "height": 3 + } + }, + { + "id": 2766891000165076, + "definition": { + "title": "PE Files Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@FileSourcePath", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 4, + "y": 9, + "width": 8, + "height": 3 + } + }, + { + "id": 1827104185424900, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 109, + "width": 12, + "height": 16 + } + }, + { + "id": 7035510288476297, + "definition": { + "title": "PeFileWritten [Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 3742227756038517, + "definition": { + "title": "Total PE File Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5897662464282242, + "definition": { + "title": "PE File Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1601851943354946, + "definition": { + "title": "Total PE File Written on Removable Disk Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 3, + "width": 3, + "height": 3 + } + }, + { + "id": 5055156130242219, + "definition": { + "title": "PE File Written on Removable Disk Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin @IsOnRemovableDisk:true $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 3, + "width": 9, + "height": 3 + } + }, + { + "id": 4690499409549852, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 8062757830081900, + "definition": { + "title": "Top Original Filename of PE", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin -@OriginalFilename:\" \" $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@OriginalFilename", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6692946517833420, + "definition": { + "title": "Events by File Category", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 8901938059268895, + "definition": { + "title": "Top Username", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 4, + "height": 3 + } + }, + { + "id": 5879447959581121, + "definition": { + "title": "PE Files Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@FileCategoryValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@FileSourcePath", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 4, + "y": 9, + "width": 8, + "height": 3 + } + }, + { + "id": 421373511265259, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:PeFileWritten @event_platform:Lin $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 125, + "width": 12, + "height": 16 + } + }, + { + "id": 2027521984764510, + "definition": { + "title": "FileWrittenWithEntropyHigh [Windows, Linux]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 7749221497313303, + "definition": { + "title": "Total File Written with Entropy High Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:FileWrittenWithEntropyHigh $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5994651648784406, + "definition": { + "title": "File Written with Entropy High Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:FileWrittenWithEntropyHigh $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 323965379237228, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:FileWrittenWithEntropyHigh $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1991202083718937, + "definition": { + "title": "Top Target Filename with Highest Entropy", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:FileWrittenWithEntropyHigh $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "max", + "order": "desc", + "metric": "@ShannonEntropy" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "max", + "metric": "@ShannonEntropy" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1526678800224842, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:FileWrittenWithEntropyHigh $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 141, + "width": 12, + "height": 10 + } + }, + { + "id": 8597877908911019, + "definition": { + "title": "QuarantinedFile [Linux, Windows, MacOS, Kubernetes, Vmcluster]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 4313155558720968, + "definition": { + "title": "Total Quarantined File Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:QuarantinedFile $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6894566494685166, + "definition": { + "title": "File Quarantined File Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:QuarantinedFile $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 7399377899529851, + "definition": { + "title": "Top Quarantined Executable Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:QuarantinedFile $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 6792232538632417, + "definition": { + "title": "File Quarantine Status Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:QuarantinedFile $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4894322802305437, + "definition": { + "title": "Top Quarantine Status", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:QuarantinedFile $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 7762761898575798, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:QuarantinedFile $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 4, + "y": 6, + "width": 8, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 151, + "width": 12, + "height": 10 + } + }, + { + "id": 3653098979316927, + "definition": { + "title": "RansomwareCreateFile [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 5159061494649666, + "definition": { + "title": "Total Ransomware Create File Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareCreateFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5566226032822671, + "definition": { + "title": "File Ransomware Create File Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareCreateFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 8766209135628154, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareCreateFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 6284161795126153, + "definition": { + "title": "Top Executable Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareCreateFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 4, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 159807045834215, + "definition": { + "title": "Top Quarantine Status", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareCreateFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@StatusValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 8, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 4911151947546423, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:RansomwareCreateFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 161, + "width": 12, + "height": 10 + } + }, + { + "id": 5766198756846418, + "definition": { + "title": "RansomwareOpenFile [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2243197185038581, + "definition": { + "title": "Total Ransomware Open File Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareOpenFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 3609529915885895, + "definition": { + "title": "File Ransomware Open File Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareOpenFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 8182968995306806, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RansomwareOpenFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 7421756309015966, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:RansomwareOpenFile @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 4, + "y": 3, + "width": 8, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 171, + "width": 12, + "height": 7 + } + }, + { + "id": 7563965460157433, + "definition": { + "title": "SuspiciousPeFileWritten [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 423375464769202, + "definition": { + "title": "Total Suspicious Pe File Written Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 3233273482826216, + "definition": { + "title": "Suspicious Pe File Written Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6841504921549909, + "definition": { + "title": "Top Executable Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 5608126315705158, + "definition": { + "title": "Top Commands Executed", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@CommandLine", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 4, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 6042788084014287, + "definition": { + "title": "Top Target Filename", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 8, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 1285307474671955, + "definition": { + "title": "Top Username", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 1698558464367626, + "definition": { + "title": "Suspicious Pe File Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@TargetFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 4, + "y": 6, + "width": 8, + "height": 3 + } + }, + { + "id": 8401164917490098, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:SuspiciousPeFileWritten @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 178, + "width": 12, + "height": 13 + } + }, + { + "id": 6817925950646259, + "definition": { + "title": "SuspiciousRawDiskRead [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1096486948208689, + "definition": { + "title": "Total Suspicious Raw Disk Read Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousRawDiskRead @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5946230698629977, + "definition": { + "title": "Suspicious Raw Disk Read Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousRawDiskRead @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 2956064478011039, + "definition": { + "title": "Top Raw Disk Targeted", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SuspiciousRawDiskRead @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ImageFileName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + } + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 8698868939369394, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:SuspiciousRawDiskRead @event_platform:Win $Event-Platform $Event-Name $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 4, + "y": 3, + "width": 8, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 191, + "width": 12, + "height": 7 + } + } + ], + "template_variables": [ + { + "name": "Event-Platform", + "prefix": "@event_platform_value", + "available_values": [], + "default": "*" + }, + { + "name": "Event-Name", + "prefix": "@evt.name", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-IP", + "prefix": "@aip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-ID", + "prefix": "@aid", + "available_values": [], + "default": "*" + } + ], + "layout_type": "ordered", + "notify_list": [], + "reflow_type": "fixed" +} \ No newline at end of file diff --git a/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_network_activity.json b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_network_activity.json new file mode 100644 index 0000000000000..a83593f27b774 --- /dev/null +++ b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_network_activity.json @@ -0,0 +1,6150 @@ +{ + "title": "CrowdStrike FDR - Network Activity", + "description": "This dashboard offers insights into network connections, blocked attempts, HTTP and DNS activity, brute force detections, and sensitive system queries to spot suspicious behavior.", + "widgets": [ + { + "id": 80178177366926, + "definition": { + "type": "image", + "url": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "url_dark_theme": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "sizing": "contain", + "has_background": true, + "has_border": true, + "vertical_align": "center", + "horizontal_align": "center" + }, + "layout": { + "x": 0, + "y": 0, + "width": 4, + "height": 3 + } + }, + { + "id": 8149798550171738, + "definition": { + "type": "note", + "content": "**[Crowdstrike FDR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/)** enables continuous export of raw Falcon security telemetry to AWS S3 storage. It provides scalable access to endpoint, network, and identity events for integration with SIEM.\n\nThis dashboard offers insights into network connections, blocked attempts, HTTP and DNS activity, brute force detections, and sensitive system queries to spot suspicious behavior.\n\nFor more information, see the [Crowdstrike FDR Integration Documentation](https://docs.datadoghq.com/integrations/crowdstrike_fdr/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.", + "background_color": "white", + "font_size": "14", + "text_align": "left", + "vertical_align": "center", + "show_tick": true, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 4, + "y": 0, + "width": 8, + "height": 3 + } + }, + { + "id": 7267362965047160, + "definition": { + "title": "Overview", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2466150292933626, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NetworkConnectIP4 OR NetworkConnectIP6 OR NetworkConnectIP4Blocked OR NetworkConnectIP6Blocked OR NetworkConnectIP4DetectInfo OR NetworkConnectIP6DetectInfo OR HttpRequestDetect OR DnsRequest OR DnsRequestDetectInfo OR RemoteBruteForceDetectInfo OR SensitiveWmiQuery) $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6196921441792935, + "definition": { + "title": "Events by Type Over Time", + "title_size": "16", + "title_align": "left", + "show_legend": true, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NetworkConnectIP4 OR NetworkConnectIP6 OR NetworkConnectIP4Blocked OR NetworkConnectIP6Blocked OR NetworkConnectIP4DetectInfo OR NetworkConnectIP6DetectInfo OR HttpRequestDetect OR DnsRequest OR DnsRequestDetectInfo OR RemoteBruteForceDetectInfo OR SensitiveWmiQuery) $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + } + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 4263293745683280, + "definition": { + "title": "Top Events by Sensor IP", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NetworkConnectIP4 OR NetworkConnectIP6 OR NetworkConnectIP4Blocked OR NetworkConnectIP6Blocked OR NetworkConnectIP4DetectInfo OR NetworkConnectIP6DetectInfo OR HttpRequestDetect OR DnsRequest OR DnsRequestDetectInfo OR RemoteBruteForceDetectInfo OR SensitiveWmiQuery) $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@aip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 5, + "height": 4 + } + }, + { + "id": 1004081264383228, + "definition": { + "title": "Distribution of Events by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NetworkConnectIP4 OR NetworkConnectIP6 OR NetworkConnectIP4Blocked OR NetworkConnectIP6Blocked OR NetworkConnectIP4DetectInfo OR NetworkConnectIP6DetectInfo OR HttpRequestDetect OR DnsRequest OR DnsRequestDetectInfo OR RemoteBruteForceDetectInfo OR SensitiveWmiQuery) $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 5, + "y": 3, + "width": 7, + "height": 4 + } + }, + { + "id": 2950917754155747, + "definition": { + "title": "Distribution of Events by Platform", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:(NetworkConnectIP4 OR NetworkConnectIP6 OR NetworkConnectIP4Blocked OR NetworkConnectIP6Blocked OR NetworkConnectIP4DetectInfo OR NetworkConnectIP6DetectInfo OR HttpRequestDetect OR DnsRequest OR DnsRequestDetectInfo OR RemoteBruteForceDetectInfo OR SensitiveWmiQuery) $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@event_platform_value", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 4420170519543391, + "definition": { + "title": "Event List", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:(NetworkConnectIP4 OR NetworkConnectIP6 OR NetworkConnectIP4Blocked OR NetworkConnectIP6Blocked OR NetworkConnectIP4DetectInfo OR NetworkConnectIP6DetectInfo OR HttpRequestDetect OR DnsRequest OR DnsRequestDetectInfo OR RemoteBruteForceDetectInfo OR SensitiveWmiQuery) $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "@evt.name", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 12 + } + }, + { + "id": 3270829661625478, + "definition": { + "title": "NetworkConnectIP4 [Windows, MacOS, Linux, Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1687313470434377, + "definition": { + "title": "Total Network Connect IPv4 Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4883964334670148, + "definition": { + "title": "Network Connect IPv4 Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1851357477669596, + "definition": { + "title": "Events by Connection Protocol", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ProtocolValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4068459128520852, + "definition": { + "title": "Events by Connection Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 6335296854889464, + "definition": { + "title": "Top Connected IPv4 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.client.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6728441897032279, + "definition": { + "title": "Top Remote IPv4 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3763832200362610, + "definition": { + "title": "Connections by Direction", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionDirectionValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3187263493875862, + "definition": { + "title": "Geo-Distribution of Source IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "hostmap_blues", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 7874403666078457, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 5442834990775544, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 14, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 15, + "width": 12, + "height": 18 + } + }, + { + "id": 2850555069646170, + "definition": { + "title": "NetworkConnectIP6 [Windows, MacOS, Linux, Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 3829081285934626, + "definition": { + "title": "Total Network Connect IPv6 Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 2282822114809284, + "definition": { + "title": "Network Connect IPv6 Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1725035082200197, + "definition": { + "title": "Events by Connection Protocol", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ProtocolValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2345700898865098, + "definition": { + "title": "Events by Connection Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 8189382267650998, + "definition": { + "title": "Top Connected IPv6 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.client.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6828979960153327, + "definition": { + "title": "Top Remote IPv6 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6069594120996104, + "definition": { + "title": "Connections by Direction", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionDirectionValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3578208597809683, + "definition": { + "title": "Geo-Distribution of Source IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "hostmap_blues", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 8848160362164170, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 8167776466373419, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6 $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 14, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 33, + "width": 12, + "height": 18 + } + }, + { + "id": 1323537511694331, + "definition": { + "title": "NetworkConnectIP4Blocked [Windows, MacOS, Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 4929714316686713, + "definition": { + "title": "Total Network Connect IPv4 Blocked Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 6396692608111402, + "definition": { + "title": "Network Connect IPv4 Blocked Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 3611416135056030, + "definition": { + "title": "Events by Connection Protocol", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ProtocolValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 6762144768392144, + "definition": { + "title": "Events by Connection Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 114554911598746, + "definition": { + "title": "Top Blocked IPv4 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.client.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6390304593936163, + "definition": { + "title": "Top Remote IPv4 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 2537346783496265, + "definition": { + "title": "Connections by Direction", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionDirectionValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6742321263746781, + "definition": { + "title": "Geo-Distribution of Source IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "hostmap_blues", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 7372201791182092, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 7842212429535172, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 14, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 51, + "width": 12, + "height": 18 + } + }, + { + "id": 769023850239457, + "definition": { + "title": "NetworkConnectIP6Blocked [Windows, MacOS, Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8847858442548835, + "definition": { + "title": "Total Network Connect IPv6 Blocked Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4912231593150984, + "definition": { + "title": "Network Connect IPv6 Blocked Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6571626154482881, + "definition": { + "title": "Events by Connection Protocol", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ProtocolValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1966324103136464, + "definition": { + "title": "Events by Connection Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3247673491934942, + "definition": { + "title": "Top Blocked IPv6 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.client.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 8260051584075408, + "definition": { + "title": "Top Remote IPv6 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3539297736366175, + "definition": { + "title": "Connections by Direction", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionDirectionValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 4415040986290670, + "definition": { + "title": "Geo-Distribution of Source IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "hostmap_blues", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 0, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 4714701523222258, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 9, + "width": 6, + "height": 5 + } + }, + { + "id": 6268178615295838, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6Blocked $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 14, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 69, + "width": 12, + "height": 18 + } + }, + { + "id": 6844072259742161, + "definition": { + "title": "NetworkConnectIP4DetectInfo [Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 5684084883348775, + "definition": { + "title": "Total Network Connect IPv4 Detection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5312549692156286, + "definition": { + "title": "Network Connect IPv4 Detection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1209381275037215, + "definition": { + "title": "Events by Malicious Connection Protocol", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ProtocolValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 4932000303805882, + "definition": { + "title": "Events by Connection Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 2337853721431053, + "definition": { + "title": "Top Malicious IPv4 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.client.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 4032782219647527, + "definition": { + "title": "Top Remote IPv4 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3728529749458726, + "definition": { + "title": "Malicious Connections by Direction", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionDirectionValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 310770573887363, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NetworkConnectIP4DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 87, + "width": 12, + "height": 13 + } + }, + { + "id": 1598940263864927, + "definition": { + "title": "NetworkConnectIP6DetectInfo [Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2972285124877977, + "definition": { + "title": "Total Network Connect IPv6 Detection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 7379702054771820, + "definition": { + "title": "Network Connect IPv6 Detection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 271613205350629, + "definition": { + "title": "Events by Malicious Connection Protocol", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ProtocolValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 3820687724922579, + "definition": { + "title": "Events by Connection Flags", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionFlagsValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 8201855948829810, + "definition": { + "title": "Top Malicious IPv6 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.client.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3280582243261091, + "definition": { + "title": "Top Remote IPv6 Address by Port", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@network.destination.port", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 100, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 3783728501059595, + "definition": { + "title": "Malicious Connections by Direction", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ConnectionDirectionValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 8, + "y": 6, + "width": 4, + "height": 3 + } + }, + { + "id": 6894007333939371, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:NetworkConnectIP6DetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 100, + "width": 12, + "height": 13 + } + }, + { + "id": 5943602804859649, + "definition": { + "title": "HttpRequestDetect [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 773050457239193, + "definition": { + "title": "Total Http Request Detection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5065513995563459, + "definition": { + "title": "Http Request Detection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 7223310724302092, + "definition": { + "title": "Http Requests by Internal Source", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@HttpInternalSourceValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 212635529248151, + "definition": { + "title": "Top Http Request Method", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@HttpMethodValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 676902861851639, + "definition": { + "title": "Top Http URL", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@http.url", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 2861363140550948, + "definition": { + "title": "Http Requests by Users", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 6, + "width": 6, + "height": 3 + } + }, + { + "id": 8354168674370142, + "definition": { + "title": "Http Request Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@http.url", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@HttpMethodValue", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@HttpPostBody", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 10000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + }, + { + "id": 4768222548109767, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:HttpRequestDetect $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 12, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 113, + "width": 12, + "height": 16 + } + }, + { + "id": 4483640142739549, + "definition": { + "title": "DnsRequest [Windows, MacOS, Linux, Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 1643102868666865, + "definition": { + "title": "Total DNS Request Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DnsRequest $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 2249265655282070, + "definition": { + "title": "DNS Request Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DnsRequest $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 8975442192208714, + "definition": { + "title": "DNS Requests by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DnsRequest $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@dns.question.type", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "table" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 8558100511610895, + "definition": { + "title": "Top Queried Domains", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DnsRequest $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@dns.question.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 8738204330987807, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:DnsRequest $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 129, + "width": 12, + "height": 10 + } + }, + { + "id": 8900643805486233, + "definition": { + "title": "DnsRequestDetectInfo [Linux, Android, iOS]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 3074166832812590, + "definition": { + "title": "Total DNS Request Detection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DNSRequestDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 7195877760885246, + "definition": { + "title": "DNS Request Detection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DNSRequestDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 1889202226248431, + "definition": { + "title": "DNS Requests by Type", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DNSRequestDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@dns.question.type", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "automatic" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 8128525308323150, + "definition": { + "title": "Top Malicious Queried Domains", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DNSRequestDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@dns.question.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 6466946002188476, + "definition": { + "title": "Top Resolved IP Addressed", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:DNSRequestDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@IpAddress", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 8, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 1500112857950716, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:DNSRequestDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 139, + "width": 12, + "height": 10 + } + }, + { + "id": 355893413861606, + "definition": { + "title": "RemoteBruteForceDetectInfo [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 4642266536569827, + "definition": { + "title": "Total Remote BruteForce Detection Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RemoteBruteForceDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 4900453542963378, + "definition": { + "title": "DNS Remote BruteForce Detection Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RemoteBruteForceDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 6688247319641227, + "definition": { + "title": "Top Brute Forced Remote IP Address", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RemoteBruteForceDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.ip", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 1880510628930043, + "definition": { + "title": "Top Activity by Users", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:RemoteBruteForceDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 6, + "y": 3, + "width": 6, + "height": 3 + } + }, + { + "id": 680696046634104, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:RemoteBruteForceDetectInfo $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 149, + "width": 12, + "height": 10 + } + }, + { + "id": 7989723882009670, + "definition": { + "title": "SensitiveWmiQuery [Windows]", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 8255693385725935, + "definition": { + "title": "Total Sensitive Wmi Query Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 5548077239228454, + "definition": { + "title": "Sensitive Wmi Query Events over Time", + "title_size": "16", + "title_align": "left", + "show_legend": false, + "legend_layout": "auto", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 8911831159564328, + "definition": { + "title": "Top Sensitive Wmi Query Executed", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@WmiQuery", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 500, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 2049416586238098, + "definition": { + "title": "Top Client Computer Name", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 4, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 7406022237231045, + "definition": { + "title": "Top Users Executed the Query", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16" + } + }, + "layout": { + "x": 8, + "y": 3, + "width": 4, + "height": 3 + } + }, + { + "id": 2732696264660150, + "definition": { + "title": "Wmi Query Details", + "title_size": "16", + "title_align": "left", + "type": "query_table", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@WmiQuery", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@usr.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + }, + { + "facet": "@ClientComputerName", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "sort": { + "count": 1000, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + }, + "formulas": [ + { + "cell_display_mode": "number", + "alias": "Count", + "formula": "query1" + } + ] + } + ], + "has_search_bar": "auto" + }, + "layout": { + "x": 0, + "y": 6, + "width": 12, + "height": 3 + } + }, + { + "id": 6426181178285371, + "definition": { + "title": "Log Details", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr @evt.name:SensitiveWmiQuery $Event-Name $Event-Platform $Source-IP $Destination-IP $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 9, + "width": 12, + "height": 3 + } + } + ] + }, + "layout": { + "x": 0, + "y": 159, + "width": 12, + "height": 13 + } + } + ], + "template_variables": [ + { + "name": "Event-Platform", + "prefix": "@event_platform_value", + "available_values": [], + "default": "*" + }, + { + "name": "Event-Name", + "prefix": "@evt.name", + "available_values": [], + "default": "*" + }, + { + "name": "Source-IP", + "prefix": "@network.client.ip", + "available_values": [], + "default": "*" + }, + { + "name": "Destination-IP", + "prefix": "@network.destination.ip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-IP", + "prefix": "@aip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-ID", + "prefix": "@aid", + "available_values": [], + "default": "*" + } + ], + "layout_type": "ordered", + "notify_list": [], + "reflow_type": "fixed" +} \ No newline at end of file diff --git a/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_overview.json b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_overview.json new file mode 100644 index 0000000000000..d1b0f7ff6dee2 --- /dev/null +++ b/crowdstrike_fdr/assets/dashboards/crowdstrike_fdr_overview.json @@ -0,0 +1,1106 @@ +{ + "title": "CrowdStrike FDR - Overview", + "description": "This dashboard provides overview of Crowdstrike FDR logs.", + "widgets": [ + { + "id": 4237338628322930, + "definition": { + "type": "image", + "url": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "url_dark_theme": "https://static.datadoghq.com/static/images/logos/crowdstrike_large.svg", + "sizing": "contain", + "has_background": true, + "has_border": true, + "vertical_align": "center", + "horizontal_align": "center" + }, + "layout": { + "x": 0, + "y": 0, + "width": 4, + "height": 3 + } + }, + { + "id": 1113853058278555, + "definition": { + "type": "note", + "content": "**[Crowdstrike FDR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/)** enables continuous export of raw Falcon security telemetry to AWS S3 storage. It provides scalable access to endpoint, network, and identity events for integration with SIEM.\n\nThis dashboard provides overview of Crowdstrike FDR logs.\n\nFor more information, see the [Crowdstrike FDR Integration Documentation](https://docs.datadoghq.com/integrations/crowdstrike_fdr/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.", + "background_color": "white", + "font_size": "14", + "text_align": "left", + "vertical_align": "center", + "show_tick": true, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 4, + "y": 0, + "width": 8, + "height": 3 + } + }, + { + "id": 1202908198989736, + "definition": { + "title": "Overview", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2575397951084048, + "definition": { + "title": "Total Events", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "response_format": "scalar", + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "formulas": [ + { + "formula": "query1" + } + ] + } + ], + "autoscale": true, + "precision": 2 + }, + "layout": { + "x": 0, + "y": 0, + "width": 3, + "height": 3 + } + }, + { + "id": 3327420910537369, + "definition": { + "title": "Events by Type over Time", + "title_size": "16", + "title_align": "left", + "show_legend": true, + "legend_layout": "horizontal", + "legend_columns": [ + "avg", + "min", + "max", + "value", + "sum" + ], + "type": "timeseries", + "requests": [ + { + "formulas": [ + { + "alias": "Events", + "formula": "query1" + } + ], + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "timeseries", + "style": { + "palette": "dog_classic", + "order_by": "values", + "line_type": "solid", + "line_width": "normal" + }, + "display_type": "line" + } + ] + }, + "layout": { + "x": 3, + "y": 0, + "width": 9, + "height": 3 + } + }, + { + "id": 3757203530651964, + "definition": { + "title": "Top Events by Sensor IP", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@aip", + "limit": 15, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 15, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 0, + "y": 3, + "width": 4, + "height": 4 + } + }, + { + "id": 2777594530466196, + "definition": { + "title": "Distribution of Events by Platform", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@event_platform_value", + "limit": 10, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "style": { + "palette": "datadog16" + }, + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "type": "sunburst", + "legend": { + "type": "inline" + } + }, + "layout": { + "x": 4, + "y": 3, + "width": 4, + "height": 4 + } + }, + { + "id": 6979240058634019, + "definition": { + "title": "Top Events by Type", + "title_size": "16", + "title_align": "left", + "type": "toplist", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@evt.name", + "limit": 15, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 15, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "display": { + "type": "stacked", + "legend": "automatic" + }, + "palette": "datadog16", + "scaling": "relative" + } + }, + "layout": { + "x": 8, + "y": 3, + "width": 4, + "height": 4 + } + }, + { + "id": 3262782634910946, + "definition": { + "title": "Geo-Distribution of Source IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.client.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "hostmap_blues", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 0, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 7982363848518165, + "definition": { + "title": "Geo-Distribution of Destination IPs", + "title_size": "16", + "title_align": "left", + "type": "geomap", + "requests": [ + { + "queries": [ + { + "name": "query1", + "data_source": "logs", + "search": { + "query": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP" + }, + "indexes": [ + "*" + ], + "group_by": [ + { + "facet": "@network.destination.geoip.country.iso_code", + "limit": 250, + "sort": { + "aggregation": "count", + "order": "desc", + "metric": "count" + }, + "should_exclude_missing": true + } + ], + "compute": { + "aggregation": "count" + }, + "storage": "hot" + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "query1" + } + ], + "sort": { + "count": 250, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "style": { + "palette": "Plasma", + "palette_flip": false + }, + "view": { + "focus": "WORLD" + } + }, + "layout": { + "x": 6, + "y": 7, + "width": 6, + "height": 4 + } + }, + { + "id": 5498469764700517, + "definition": { + "title": "Event List", + "title_size": "16", + "title_align": "left", + "requests": [ + { + "response_format": "event_list", + "query": { + "data_source": "logs_stream", + "query_string": "source:crowdstrike-fdr $Event-Name $Event-Platform $Sensor-ID $Sensor-IP", + "indexes": [], + "storage": "hot" + }, + "columns": [ + { + "field": "status_line", + "width": "auto" + }, + { + "field": "timestamp", + "width": "auto" + }, + { + "field": "@evt.name", + "width": "auto" + }, + { + "field": "content", + "width": "auto" + } + ] + } + ], + "type": "list_stream" + }, + "layout": { + "x": 0, + "y": 11, + "width": 12, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 3, + "width": 12, + "height": 16 + } + }, + { + "id": 6749069399249452, + "definition": { + "title": "Datadog Cloud SIEM", + "title_align": "center", + "background_color": "vivid_blue", + "show_title": true, + "type": "group", + "layout_type": "ordered", + "widgets": [ + { + "id": 2669453942025527, + "definition": { + "type": "note", + "content": "\nDatadog Cloud SIEM analyzes and correlates **Crowdstrike FDR** events to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security). ", + "background_color": "vivid_blue", + "font_size": "14", + "text_align": "center", + "vertical_align": "center", + "show_tick": false, + "tick_pos": "50%", + "tick_edge": "left", + "has_padding": true + }, + "layout": { + "x": 0, + "y": 0, + "width": 12, + "height": 1 + } + }, + { + "id": 7807184494327826, + "definition": { + "title": "CRITICALs", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#bc303c", + "palette": "custom_bg", + "value": 0 + } + ], + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [], + "search": { + "query": "source:crowdstrike-fdr status:critical" + } + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "custom_links": [], + "precision": 2 + }, + "layout": { + "x": 0, + "y": 1, + "width": 2, + "height": 2 + } + }, + { + "id": 8477221122830774, + "definition": { + "title": "HIGHs", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#d33043", + "palette": "custom_bg", + "value": 0 + } + ], + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [], + "search": { + "query": "source:crowdstrike-fdr status:high" + } + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "custom_links": [], + "precision": 2 + }, + "layout": { + "x": 2, + "y": 1, + "width": 2, + "height": 2 + } + }, + { + "id": 8130492050674924, + "definition": { + "title": "Critical Security Signals", + "type": "toplist", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#bc303c", + "palette": "custom_bg", + "value": 0 + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [ + { + "facet": "@workflow.rule.name", + "limit": 10, + "sort": { + "order": "desc", + "aggregation": "count" + } + } + ], + "search": { + "query": "source:crowdstrike-fdr status:critical" + } + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "custom_links": [], + "style": {} + }, + "layout": { + "x": 4, + "y": 1, + "width": 8, + "height": 4 + } + }, + { + "id": 5114018124063844, + "definition": { + "title": "MEDIUMs", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#e5a21c", + "palette": "custom_bg", + "value": 0 + } + ], + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [], + "search": { + "query": "source:crowdstrike-fdr status:medium" + } + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "custom_links": [], + "precision": 2 + }, + "layout": { + "x": 0, + "y": 3, + "width": 2, + "height": 2 + } + }, + { + "id": 7706141644714544, + "definition": { + "title": "LOWs", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#ffb52b", + "palette": "custom_bg", + "value": 0 + } + ], + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [], + "search": { + "query": "source:crowdstrike-fdr status:low" + } + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "custom_links": [], + "precision": 2 + }, + "layout": { + "x": 2, + "y": 3, + "width": 2, + "height": 1 + } + }, + { + "id": 3333092277874393, + "definition": { + "title": "INFOs", + "title_size": "16", + "title_align": "left", + "type": "query_value", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#84c1e0", + "palette": "custom_bg", + "value": 0 + } + ], + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [], + "search": { + "query": "source:crowdstrike-fdr status:info" + } + } + ], + "response_format": "scalar" + } + ], + "autoscale": true, + "custom_links": [], + "precision": 2 + }, + "layout": { + "x": 2, + "y": 4, + "width": 2, + "height": 1 + } + }, + { + "id": 8900760810147026, + "definition": { + "title": "High Security Signals", + "type": "toplist", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#d33043", + "palette": "custom_bg", + "value": 0 + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [ + { + "facet": "@workflow.rule.name", + "limit": 10, + "sort": { + "order": "desc", + "aggregation": "count" + } + } + ], + "search": { + "query": "source:crowdstrike-fdr status:high" + } + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "custom_links": [], + "style": {} + }, + "layout": { + "x": 0, + "y": 5, + "width": 6, + "height": 4 + } + }, + { + "id": 1025143997993518, + "definition": { + "title": "Medium Security Signals", + "type": "toplist", + "requests": [ + { + "conditional_formats": [ + { + "comparator": ">", + "custom_bg_color": "#e5a21c", + "palette": "custom_bg", + "value": 0 + } + ], + "queries": [ + { + "data_source": "security_signals", + "name": "query1", + "indexes": [ + "*" + ], + "compute": { + "aggregation": "count" + }, + "group_by": [ + { + "facet": "@workflow.rule.name", + "limit": 10, + "sort": { + "order": "desc", + "aggregation": "count" + } + } + ], + "search": { + "query": "source:crowdstrike-fdr status:medium" + } + } + ], + "response_format": "scalar", + "formulas": [ + { + "formula": "default_zero(query1)" + } + ], + "sort": { + "count": 10, + "order_by": [ + { + "type": "formula", + "index": 0, + "order": "desc" + } + ] + } + } + ], + "custom_links": [], + "style": {} + }, + "layout": { + "x": 6, + "y": 5, + "width": 6, + "height": 4 + } + } + ] + }, + "layout": { + "x": 0, + "y": 19, + "width": 12, + "height": 1 + } + } + ], + "template_variables": [ + { + "name": "Event-Platform", + "prefix": "@event_platform_value", + "available_values": [], + "default": "*" + }, + { + "name": "Event-Name", + "prefix": "@evt.name", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-IP", + "prefix": "@aip", + "available_values": [], + "default": "*" + }, + { + "name": "Sensor-ID", + "prefix": "@aid", + "available_values": [], + "default": "*" + } + ], + "layout_type": "ordered", + "notify_list": [], + "reflow_type": "fixed" +} \ No newline at end of file diff --git a/crowdstrike_fdr/assets/logs/crowdstrike-fdr.yaml b/crowdstrike_fdr/assets/logs/crowdstrike-fdr.yaml new file mode 100644 index 0000000000000..8c68276122e27 --- /dev/null +++ b/crowdstrike_fdr/assets/logs/crowdstrike-fdr.yaml @@ -0,0 +1,573 @@ +id: crowdstrike-fdr +metric_id: crowdstrike-fdr +backend_only: false +facets: + - groups: + - Event + name: Event Name + path: evt.name + source: log + - groups: + - User + name: User ID + path: usr.id + source: log + - groups: + - User + name: User Name + path: usr.name + source: log + - groups: + - Web Access + name: Client IP + path: network.client.ip + source: log + - groups: + - Web Access + name: Destination IP + path: network.destination.ip + source: log + - groups: + - Web Access + name: Client Port + path: network.client.port + source: log + - groups: + - Web Access + name: Destination Port + path: network.destination.port + source: log + - groups: + - Web Access + name: URL Path + path: http.url + source: log + - groups: + - DNS + name: Question Type + path: dns.question.type + source: log + - groups: + - DNS + name: Question Name + path: dns.question.name + source: log +pipeline: + type: pipeline + name: CrowdStrike FDR + enabled: true + filter: + query: source:crowdstrike-fdr + processors: + - type: arithmetic-processor + name: Convert `ContextTimeStamp` epoch to milliseconds epoch + enabled: true + expression: ContextTimeStamp * 1000 + target: ContextTimeStamp + replaceMissing: false + - type: date-remapper + name: Define `ContextTimeStamp` as the official date of the log + enabled: true + sources: + - ContextTimeStamp + - type: attribute-remapper + name: Map `event_simpleName` to `evt.name` + enabled: true + sources: + - event_simpleName + sourceType: attribute + target: evt.name + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `UID`, `UserSid`, `OriginalUserSid`, `UserRid` to `usr.id` + enabled: true + sources: + - UID + - UserSid + - OriginalUserSid + - UserRid + sourceType: attribute + target: usr.id + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `UserRealName`, `OriginalUserName`, `SourceAccountUserName`, + `UserName`, `sAMAccountName` to `usr.name` + enabled: true + sources: + - UserRealName + - OriginalUserName + - SourceAccountUserName + - UserName + - sAMAccountName + sourceType: attribute + target: usr.name + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `LocalAddressIP4`, `LocalAddressIP6`, `SourceEndpointAddressIP4`, + `SourceEndpointAddressIP6` to `network.client.ip` + enabled: true + sources: + - LocalAddressIP4 + - LocalAddressIP6 + - SourceEndpointAddressIP4 + - SourceEndpointAddressIP6 + sourceType: attribute + target: network.client.ip + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `RemoteAddressIP4`, `RemoteAddressIP6`, `TargetServerAddressIP4`, + `TargetServerAddressIP6` to `network.destination.ip` + enabled: true + sources: + - RemoteAddressIP4 + - RemoteAddressIP6 + - TargetServerAddressIP4 + - TargetServerAddressIP6 + sourceType: attribute + target: network.destination.ip + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `LocalPort` to `network.client.port` + enabled: true + sources: + - LocalPort + sourceType: attribute + target: network.client.port + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `RemotePort` to `network.destination.port` + enabled: true + sources: + - RemotePort + sourceType: attribute + target: network.destination.port + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `HttpUrl` to `http.url` + enabled: true + sources: + - HttpUrl + sourceType: attribute + target: http.url + targetType: attribute + preserveSource: false + overrideOnConflict: false + - name: Lookup on `RequestType` Field + enabled: true + source: RequestType + target: RequestTypeValue + lookupTable: |- + 0,UNKNOWN + 1,A + 2,NS + 5,CNAME + 12,PTR + 15,MX + 16,TXT + 28,AAAA + 255,ANY + type: lookup-processor + - type: attribute-remapper + name: Map `RequestTypeValue` to `dns.question.type` + enabled: true + sources: + - RequestTypeValue + sourceType: attribute + target: dns.question.type + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: attribute-remapper + name: Map `DomainName` to `dns.question.name` + enabled: true + sources: + - DomainName + sourceType: attribute + target: dns.question.name + targetType: attribute + preserveSource: false + overrideOnConflict: false + - type: geo-ip-parser + name: Extract geolocation information form client ip + enabled: true + sources: + - network.client.ip + target: network.client.geoip + ip_processing_behavior: do-nothing + - name: Lookup on `ConnectionDirection` Field + enabled: true + source: ConnectionDirection + target: ConnectionDirectionValue + lookupTable: |- + 0,DIRECTION_OUTBOUND + 1,DIRECTION_INBOUND + 2,DIRECTION_NEITHER + 3,DIRECTION_BOTH + 4,DIRECTION_UNKNOWN + type: lookup-processor + - name: Lookup on `ConnectionFlags` Field + enabled: true + source: ConnectionFlags + target: ConnectionFlagsValue + lookupTable: |- + 1,RAW_SOCKET + 2,PROMISCUOUS_MODE_SIO_RCVALL + 4,PROMISCUOUS_MODE_SIO_RCVALL_IGMPMCAST + 8,PROMISCUOUS_MODE_SIO_RCVALL_MCAST + 16,IS_LOOPBACK + type: lookup-processor + - name: Lookup on `event_platform` Field + enabled: true + source: event_platform + target: event_platform_value + lookupTable: |- + Win,Windows + Lin,Linux + Mac,Mac + Android,Android + type: lookup-processor + - name: Lookup on `FileCategory` Field + enabled: true + source: FileCategory + target: FileCategoryValue + lookupTable: |- + 0,OTHER + 1,ARCHIVES + 2,OFFICE_DOCUMENTS + 3,MULTIMEDIA_FILES + 4,DESIGN_FILES + 5,SOURCE_CODE + 6,EXECUTABLE_FILES + 7,VIRTUAL_MACHINE_FILES + 8,EMAIL_FILES + 9,DATA_AND_LOGS + 10,ENCRYPTED + type: lookup-processor + - name: Lookup on `HttpInternalSource` Field + enabled: true + source: HttpInternalSource + target: HttpInternalSourceValue + lookupTable: |- + 0,HTTP_INVALID_SOURCE + 1,HTTP_WFP_NETWORK_EVENT_SOURCE + 2,HTTP_ETW_WININET_SOURCE + 3,HTTP_ETW_WININET_CAPTURE_SOURCE + type: lookup-processor + - name: Lookup on `HttpMethod` Field + enabled: true + source: HttpMethod + target: HttpMethodValue + lookupTable: |- + 0,HTTP_METHOD_UNKNOWN + 1,HTTP_METHOD_GET + 2,HTTP_METHOD_HEAD + 3,HTTP_METHOD_POST + 4,HTTP_METHOD_PUT + 5,HTTP_METHOD_DELETE + 6,HTTP_METHOD_OPTIONS + 7,HTTP_METHOD_CONNECT + 8,HTTP_METHOD_TRACE + 9,HTTP_METHOD_PATCH + 10,HTTP_METHOD_WILDCARD + 11,HTTP_METHOD_ACL + 12,HTTP_METHOD_BASELINECONTROL + 13,HTTP_METHOD_BIND + 14,HTTP_METHOD_CHECKIN + 15,HTTP_METHOD_CHECKOUT + 16,HTTP_METHOD_COPY + 17,HTTP_METHOD_LABEL + 18,HTTP_METHOD_LINK + 19,HTTP_METHOD_LOCK + 20,HTTP_METHOD_MERGE + 21,HTTP_METHOD_MKACTIVITY + 22,HTTP_METHOD_MKCALENDAR + 23,HTTP_METHOD_MKCOL + 24,HTTP_METHOD_MKREDIRECTREF + 25,HTTP_METHOD_MKWORKSPACE + 26,HTTP_METHOD_MOVE + 27,HTTP_METHOD_ORDERPATCH + 28,HTTP_METHOD_PRI + 29,HTTP_METHOD_PROPFIND + 30,HTTP_METHOD_PROPPATCH + 31,HTTP_METHOD_REBIND + 32,HTTP_METHOD_REPORT + 33,HTTP_METHOD_SEARCH + 34,HTTP_METHOD_UNBIND + 35,HTTP_METHOD_UNCHECKOUT + 36,HTTP_METHOD_UNLINK + 37,HTTP_METHOD_UNLOCK + 38,HTTP_METHOD_UPDATE + 39,HTTP_METHOD_UPDATEREDIRECTREF + 40,HTTP_METHOD_VERSIONCONTROL + type: lookup-processor + - name: Lookup on `InjectedThreadFlag` Field + enabled: true + source: InjectedThreadFlag + target: InjectedThreadFlagValue + lookupTable: |- + 0,NONE + 1,PREV_MODE_KERNEL + 2,START_ADDRESS_IN_NAMED_PE + 4,START_ADDRESS_IN_SYS_RANGE + 8,SYSTEM_THREAD + 16,SOURCE_PROCESS_IS_SYSTEM + 32,TARGET_ANALYSIS_FAILED + 64,CONTEXT_ANALYSIS_FAILED + 128,START_ADDRESS_IN_NTDLL + 256,START_ADDRESS_IN_WIN_DLL + 512,START_ADDRESS_PRIVATE_MEM + type: lookup-processor + - name: Lookup on `IntegrityLevel` Field + enabled: true + source: IntegrityLevel + target: IntegrityLevelValue + lookupTable: |- + 0,UNTRUSTED + 4096,LOW + 8192,MEDIUM + 8448,MEDIUM_PLUS + 12288,HIGH + 16384,SYSTEM + 20480,PROTECTED + type: lookup-processor + - name: Lookup on `LogonType` Field + enabled: true + source: LogonType + target: LogonTypeValue + lookupTable: |- + 2,INTERACTIVE + 3,NETWORK + 4,BATCH + 5,SERVICE + 6,PROXY + 7,UNLOCK + 8,NETWORK_CLEARTEXT + 9,NEW_CREDENTIALS + 10,REMOTE_INTERACTIVE + 11,CACHED_INTERACTIVE + 12,CACHED_REMOTE_INTERACTIVE + 13,CACHED_UNLOCK + type: lookup-processor + - name: Lookup on `MachOSubType` Field + enabled: true + source: MachOSubType + target: MachOSubTypeValue + lookupTable: |- + 0,UNKNOWN + 1,EXECUTABLE64 + 2,DYLIB64 + 3,BUNDLE64 + 4,KEXT64 + 5,EXECUTABLE32 + 6,DYLIB32 + 7,BUNDLE32 + type: lookup-processor + - name: Lookup on `PayloadClassification` Field + enabled: true + source: PayloadClassification + target: PayloadClassificationValue + lookupTable: |- + 0,UNKNOWN + 1,ANTIVIRUS + 2,GENERIC_MALWARE + 3,RAT + type: lookup-processor + - name: Lookup on `PayloadClassificationFlags` Field + enabled: true + source: PayloadClassificationFlags + target: PayloadClassificationFlagsValue + lookupTable: |- + 0,NONE + 1,KNOWN_BENIGN + 2,SUSPICIOUS + 4,KNOWN_MALICIOUS + 8,ENABLE_VISIBILITY + 16,LARGE_VISIBILITY + 32,EXPERIMENTAL + type: lookup-processor + - name: Lookup on `Protocol` Field + enabled: true + source: Protocol + target: ProtocolValue + lookupTable: |- + 0,IP + 1,ICMP + 2,IGMP + 6,TCP + 17,UDP + 41,IPV6 + 47,GRE + 58,ICMPV6 + 255,UNKNOWN + type: lookup-processor + - name: Lookup on `Status` Field + enabled: true + source: Status + target: StatusValue + lookupTable: |- + 0,STATUS_SUCCESS + 259,STATUS_PENDING + 3221225506,STATUS_ACCESS_DENIED + 1611792386,STATUS_NO_EXISTING_CREDENTIALS + 1611726866,STATUS_DEP_DISABLED_APPCOMPAT + 3221225533,STATUS_DATA_LATE_ERROR + 3759013928,STATUS_PROCESS_CRITICAL + 3759013929,STATUS_PROCESS_WHITELISTED + 3759013930,STATUS_PROCESS_MICROSOFT_SIGNED + 3759013931,STATUS_PROCESS_APPLE_SIGNED + 538181633,STATUS_COMPONENT_ENABLED + 3759407166,STATUS_COMPONENT_DISABLED + 1611923478,STATUS_COMPONENT_STOPPED + 1612251168,STATUS_HTTP_VISIBILITY_ENABLED + 1612251176,STATUS_SMTP_VISIBILITY_ENABLED + 1612447779,STATUS_PREVENTION_NOT_NEEDED + 1611530273,STATUS_MASK_ADJUSTED + 1612578852,STATUS_ALREADY_BLOCKED + 3221226347,STATUS_DRIVER_BLOCKED_CRITICAL + 3221225541,STATUS_INVALID_PAGE_PROTECTION + 258,STATUS_TIMEOUT + 3221225473,STATUS_UNSUCCESSFUL + 3221225609,STATUS_RESOURCE_DATA_NOT_FOUND + 3221225611,STATUS_RESOURCE_NAME_NOT_FOUND + 3221225524,STATUS_OBJECT_NAME_NOT_FOUND + 3221225760,STATUS_CANCELLED + 3221225492,STATUS_UNRECOGNIZED_MEDIA + 3760521403,STATUS_NO_ACTIVE_RPC_THREAD + 3221225738,STATUS_PROCESS_IS_TERMINATING + 290,STATUS_NOTHING_TO_TERMINATE + 3221226138,STATUS_POLICY_OBJECT_NOT_FOUND + 3758096423,STATUS_PROCESS_KILLED + 3221227780,STATUS_FILE_TOO_LARGE + 3221225485,STATUS_INVALID_PARAMETER + 3221225659,STATUS_NOT_SUPPORTED + 3221225653,STATUS_IO_TIMEOUT + 3221226029,STATUS_RETRY + 3758358545,STATUS_FEATURE_DISABLED + 3760849112,STATUS_NON_CROWDSTRIKE + 3760914656,STATUS_LFO_UPLOAD_FAILURE + 3760914657,STATUS_LFO_UPLOAD_CLOUD_FAILURE + 3760914660,STATUS_PROCESS_LSASS + 3760914661,STATUS_PROCESS_CROWDSTRIKE + type: lookup-processor + - name: Lookup on `SuspiciousHandleOpenReason` Field + enabled: true + source: SuspiciousHandleOpenReason + target: SuspiciousHandleOpenReasonValue + lookupTable: |- + 1,HIGHER_IL + 2,NETWORK_SERVICE_ISOLATION + type: lookup-processor + - name: Lookup on `ThreadExecutionControlType` Field + enabled: true + source: ThreadExecutionControlType + target: ThreadExecutionControlTypeValue + lookupTable: |- + 0,THREAD_INJECT + 1,THREAD_INJECT_MASQUERADE + 2,THREAD_HIJACK + 3,PROCESS_HOLLOWING + 4,WINDOWS_HOOK + 5,PROCESS_OVERWRITE_HOLLOWING + 6,REMOTE_APC + 7,REMOTE_ATOM_BOMB + 8,PROCESS_HOLLOWING_APC + 9,SET_WINDOW_LONG + 10,SET_PROP + 11,LOCAL_CLASSIFIED_MEMORY_OPERATION + 12,REMOTE_CLASSIFIED_MEMORY_OPERATION + type: lookup-processor + - name: Lookup on `TokenObjectCheckType` Field + enabled: true + source: TokenObjectCheckType + target: TokenObjectCheckTypeValue + lookupTable: |- + 0,CAPTURETOKEN + 1,CREATEPROCESS + 2,CREATETHREAD + 4,USERLOADIMAGE + 8,PEFILEWRITE + 16,ASEPUPDATE + 32,NETWORKIOCTL + 64,OPENPROCESS + 2147483648,DELETE + type: lookup-processor + - name: Lookup on `UserIsAdmin` Field + enabled: true + source: UserIsAdmin + target: UserIsAdminValue + lookupTable: |- + 0,False + 1,True + type: lookup-processor + - name: Lookup on `UserLogonFlags` Field + enabled: true + source: UserLogonFlags + target: UserLogonFlagsValue + lookupTable: |- + 0,NONE + 1,LOGON_IS_SYNTHETIC + 2,USER_IS_ADMIN + 4,USER_IS_LOCAL + 8,USER_IS_BUILT_IN + 16,USER_IDENTITY_MISSING + type: lookup-processor + - name: Lookup on `VnodeModificationType` Field + enabled: true + source: VnodeModificationType + target: VnodeModificationTypeValue + lookupTable: |- + 0,CREATE + 1,LINK + 2,OPEN + 3,RENAME_FROM + 4,RENAME_TO + 5,TRUNCATE + 6,UNLINK + 7,WRITE + 8,SET_FLAGS + 9,SET_MODE + 10,CLOSE + 11,EXECUTE + 12,DUP + 13,FCNTL + 14,MMAP + 15,DELETE_EXT_ATTR + 16,SET_EXT_ATTR + 17,CLONE + 18,SET_ACL + 19,UTIMES + 20,EXCHANGE_DATA + 21,COPYFILE + 22,SET_ATTR_LIST + 23,SET_OWNER + 24,GET_ATTR_LIST + 25,FS_GET_PATH + type: lookup-processor + - type: geo-ip-parser + name: GeoIP Parser for `network.client.ip` + enabled: true + sources: + - network.client.ip + target: network.client.geoip + ip_processing_behavior: do-nothing + - type: geo-ip-parser + name: GeoIP Parser for `network.destination.ip` + enabled: true + sources: + - network.destination.ip + target: network.destination.geoip + ip_processing_behavior: do-nothing diff --git a/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml b/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml new file mode 100644 index 0000000000000..84cdb47a3abf3 --- /dev/null +++ b/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml @@ -0,0 +1,96 @@ +id: crowdstrike-fdr +tests: + - sample: '{"ContextBaseFileName":"sample.exe","aip":"10.10.10.10","event_platform":"Win","EventOrigin":"1","id":"53c53746-44bd-424c-952d-953d77e2c6ce","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1755599833469","LocalAddressIP4":"20.20.20.20","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1755599832.823","ConfigStateHash":"1148659614","ConnectionFlags":"0","ContextProcessId":"580375981794","RemotePort":"443","ConfigBuild":"1007.3.0020006.15","LocalPort":"50966","Entitlements":"15","name":"NetworkConnectIP4V13","aid":"d45b8541202f4b43bdac05234d906ff1","RemoteAddressIP4":"30.30.30.30","RemoteAddressString":"52.123.145.14:443","ConnectionDirection":"0","cid":"2cc98db1a47b4c98b913s46d43bfab70"}' + result: null + - sample: '{"UserIsAdmin": "1", "LogonTime": "1756189673.714", "ContextThreadId": + "237842773747", "aip": "10.10.10.10", "LogonDomain": "ZEROAD", + "RemoteAccount": "1", "UserSid": "S-1-6-18", "event_platform": "Win", + "UserFlags": "0", "ClientComputerName": "Test-Computer", "EventOrigin": + "1", "LogonServer": "", "id": "e48d75d4-ec11-4bbf-b628-14c82b98815f", + "EffectiveTransmissionClass": "2", "event_simpleName": "UserLogon", + "ContextTimeStamp": "1756189673.714", "UserName": "demo-user", + "ConfigStateHash": "1293256420", "ContextProcessId": "60249910548", + "LogonType": "0", "PrivilegesBitmask": "130778398648", + "AuthenticationPackage": "Negotiate", "AuthenticationId": "999", + "UserPrincipal": "381$@abc.local", "ConfigBuild": "1007.3.0020006.15", + "PasswordLastSet": "", "Entitlements": "15", "name": "UserLogonV9", + "UserLogonFlags": "8", "EnabledPrivilegesBitmask": "130471291024", "aid": + "3dd1ca6a3428444615ccf1070a8b37e2", "UserGroupsBitmask": "794753", "cid": + "2cc98db1a47b4c98b913c94d43bfab70"}' + result: null + - sample: '{"aip": "10.10.10.10", "UserRid": "461523EA", "event_platform": "Win", + "EventOrigin": "1", "InterfaceGuid": + "14521485-1234-ABCD-EF00-0123456789AC", "RpcClientProcessId": + "60621531269", "id": "29023678-56e0-42f8-ad6d-f719c1c38cdf", + "EffectiveTransmissionClass": "3", "timestamp": "1756295097838", + "LocalAddressIP4": "20.20.20.20", "event_simpleName": + "UserAccountCreated", "ContextTimeStamp": "1756295157.763", "UserName": + "test.user", "ConfigStateHash": "3973064497", "InterfaceVersion": "65536", + "RpcClientThreadId": "249100854834", "ConfigBuild": "1007.3.0020006.15", + "RpcOpNum": "50", "Entitlements": "15", "name": "UserAccountCreatedV1", + "ComputerName": "Test-Asset", "Attacks": [{"Tactic": "Persistence", + "Technique": "Create Account"}], "aid": + "3dd1ca6a3428443399ccf1070a8b37e2", "RpcNestingLevel": "0", "cid": + "2cc98db1a47b4c98b913c94d43bfab70"}' + result: null + - sample: '{"aip": "10.10.10.10", "UserRid": "461523EA", "event_platform": "Win", + "DomainSid": "S-1-5-21-367788025-4070750832-749663698", "EventOrigin": + "1", "InterfaceGuid": "12345778-1234-ABCD-EF00-0123456789AC", + "RpcClientProcessId": "60621531269", "id": + "4e5079f3-9e6a-47d3-b465-4539a26f5f85", "EffectiveTransmissionClass": "3", + "timestamp": "1756295097839", "LocalAddressIP4": "20.20.20.20", + "event_simpleName": "UserAccountAddedToGroup", "ContextTimeStamp": + "1756295157.878", "ConfigStateHash": "3973064497", "InterfaceVersion": + "65536", "GroupRid": "00000221", "RpcClientThreadId": "249100854834", + "ConfigBuild": "1007.3.0020006.15", "RpcOpNum": "31", "Entitlements": + "15", "name": "UserAccountAddedToGroupV2", "ComputerName": "CLW381", + "Attacks": [{"Tactic": "Persistence", "Technique": "Account + Manipulation"}], "aid": "3dd1ca6a3428443399ccf1070a8b37e2", + "RpcNestingLevel": "0", "cid": "2cc98db1a47b4c98b913c94d45bfab70"}' + result: null + - sample: '{"IP6Records": "2620:1ec:29:1::37;", "ContextBaseFileName": + "SearchHost.exe", "DnsResponseType": "2", "IP4Records": "13.107.253.37;", + "ContextThreadId": "239862140703", "aip": "10.10.10.10", "CNAMERecords": + "azurefd-t-abc.manager.net;shed.dual-low.s-part-0020.t-0009.t-msedge.net", + "QueryStatus": "0", "FirstIP6Record": "2620:1ec:29:1:0:0:0:37", + "InterfaceIndex": "0", "event_platform": "Win", "DualRequest": "1", + "EventOrigin": "1", "id": "3cfd46d5-297c-413f-a75e-fcf8ab3bae24", + "EffectiveTransmissionClass": "3", "FirstIP4Record": "11.11.11.11", + "timestamp": "1756295094926", "LocalAddressIP4": "20.20.20.20", + "event_simpleName": "DnsRequest", "ContextTimeStamp": "1756295107.850", + "ConfigStateHash": "3973064497", "ContextProcessId": "60324656129", + "DomainName": "fp-afd.azurefd.net", "RespondingDnsServer": "40.40.40.40", + "ConfigBuild": "1007.3.0020006.15", "DnsRequestCount": "1", + "Entitlements": "15", "name": "DnsRequestV5", "ComputerName": "Test-PC", + "aid": "3dd1ca6a3428443399ccf1070a8b37e2", "cid": + "2cc98db1a47b4c98b913c94d43bfab70", "RequestType": "28"}' + result: null + - sample: '{"FileOperatorSid": "S-1-4-18", "ContextBaseFileName": "abc.exe", + "FileCategory": "6", "Size": "10284624", "ModuleCharacteristics": "34", + "ContextThreadId": "248921612527", "MinorFunction": "0", "aip": + "49.14.164.179", "IsOnNetwork": "0", "FileIdentifier": + "5cf3cfb451d67f43ba2c2a51a8fb10cbf411010000000b00", "event_platform": + "Win", "TokenType": "1", "OriginalFilename": "mini_installer.exe", + "ImageCheckSum": "10306457", "EventOrigin": "1", + "DiskParentDeviceInstanceId": "aiuhfrf", "ImageSubsystem": "2", "id": + "570156ed-dc8c-46ad-8d9f-91b57a7178db", "FileObject": "0", + "EffectiveTransmissionClass": "3", "timestamp": "1756295116394", + "LocalAddressIP4": "172.23.168.94", "event_simpleName": "PeFileWritten", + "ContextTimeStamp": "1756295176.875", "UserName": "demo-user", + "ConfigStateHash": "3973064497", "IsTransactedFile": "0", + "ContextProcessId": "60612242429", "IrpFlags": "0", "ImageEntryPoint": + "17632", "SHA256HashData": + "b6690ed4e4304a1258d610b4b50fd6b0a085f7ee50c0e195b6ea880b8131974b", + "AuthenticationId": "999", "ContextImageFileName": + "\\Device\\HarddiskVolume3\\Program Files (x86)\\abc.exe", + "FileWrittenFlags": "0", "ConfigBuild": "1007.3.0020006.15", + "FileEcpBitmask": "0", "MajorFunction": "0", "DllCharacteristics": + "49504", "IsOnRemovableDisk": "0", "ImageTimeStamp": "1756060583", + "Entitlements": "15", "name": "PeFileWrittenV22", "ComputerName": + "test-pc", "OperationFlags": "0", "Attacks": [{"Tactic": "Defense + Evasion", "Technique": "Masquerading"}], "aid": + "3dd1ca6a3428443399ccf1070a8b37e2", "cid": + "2cc98db1a47b4c98b913c94d43bfab70", "TargetFileName": + "\\Device\\HarddiskVolume3\\Program Files + (x86)\\{uhfirhfruihfr}\\139.0.3405.119\\abc.exe"}' + result: null diff --git a/crowdstrike_fdr/images/IMAGES_README.md b/crowdstrike_fdr/images/IMAGES_README.md new file mode 100644 index 0000000000000..443f3c45e3385 --- /dev/null +++ b/crowdstrike_fdr/images/IMAGES_README.md @@ -0,0 +1,41 @@ +# Marketplace Media Carousel Guidelines + +## Using the media gallery + +Please upload images to use the media gallery. Integrations require a minimum of 3 images. Images should highlight your product, your integration, and a full image of the Datadog integration dashboard. The gallery +can hold a maximum of 8 pieces of media total, and one of these pieces of media +can be a video (guidelines and submission steps below). Images should be +added to your /images directory and referenced in the manifest.json file. + + +## Image and video requirements + +### Images + +``` +File type : .jpg or .png +File size : ~500 KB per image, with a max of 1 MB per image +File dimensions : The image must be between 1440px and 2880px width, with a 16:9 aspect ratio (for example: 1440x810) +File name : Use only letters, numbers, underscores, and hyphens +Color mode : RGB +Color profile : sRGB +Description : 300 characters maximum +``` + +### Video + +To display a video in your media gallery, please send our team the zipped file +or a link to download the video at `marketplace@datadog.com`. In addition, +please upload a thumbnail image for your video as a part of the pull request. +Once approved, we will upload the file to Vimeo and provide you with the +vimeo_id to add to your manifest.json file. Please note that the gallery can +only hold one video. + +``` +File type : MP4 H.264 +File size : Max 1 video; 1 GB maximum size +File dimensions : The aspect ratio must be exactly 16:9, and the resolution must be 1920x1080 or higher +File name : partnerName-appName.mp4 +Run time : Recommendation of 60 seconds or less +Description : 300 characters maximum +``` diff --git a/crowdstrike_fdr/manifest.json b/crowdstrike_fdr/manifest.json new file mode 100644 index 0000000000000..70d2d624ba7d4 --- /dev/null +++ b/crowdstrike_fdr/manifest.json @@ -0,0 +1,65 @@ +{ + "manifest_version": "2.0.0", + "app_uuid": "34c50cbf-c717-48ba-9eab-32c0b8049f1c", + "app_id": "crowdstrike-fdr", + "display_on_public_website": false, + "tile": { + "overview": "README.md#Overview", + "configuration": "README.md#Setup", + "support": "README.md#Support", + "changelog": "CHANGELOG.md", + "description": "Gain insights into your CrowdStrike FDR logs.", + "title": "CrowdStrike FDR", + "media": [ + { + "media_type": "image", + "caption": "FILL IN Image 1 caption", + "image_url": "" + }, + { + "media_type": "image", + "caption": "FILL IN Image 2 caption", + "image_url": "" + }, + { + "media_type": "image", + "caption": "FILL IN Image 3 caption", + "image_url": "" + } + ], + "classifier_tags": [ + "Category::AWS", + "Category::Log Collection", + "Category::Security", + "Offering::Integration", + "Submitted Data Type::Logs" + ] + }, + "assets": { + "integration": { + "auto_install": false, + "source_type_id": 56275072, + "source_type_name": "CrowdStrike FDR", + "events": { + "creates_events": false + } + }, + "dashboards": { + "CrowdStrike FDR - Overview": "assets/dashboards/crowdstrike_fdr_overview.json", + "CrowdStrike FDR - Authentication & Identity": "assets/dashboards/crowdstrike_fdr_authentication_and_identity.json", + "CrowdStrike FDR - Network Activity": "assets/dashboards/crowdstrike_fdr_network_activity.json", + "CrowdStrike FDR - File & Malware Activity": "assets/dashboards/crowdstrike_fdr_file_and_malware_activity.json", + "CrowdStrike FDR - Execution Monitoring & Threat Detection": "assets/dashboards/crowdstrike_fdr_execution_monitoring_and_threat_detection.json", + "CrowdStrike FDR - Account & Privilege Changes": "assets/dashboards/crowdstrike_fdr_account_and_privilege_changes.json" + }, + "logs": { + "source": "crowdstrike-fdr" + } + }, + "author": { + "support_email": "help@datadoghq.com", + "name": "Datadog", + "homepage": "https://www.datadoghq.com", + "sales_email": "info@datadoghq.com" + } +} \ No newline at end of file From 082f497b7d54699e21fe41a1bc05593031e36580 Mon Sep 17 00:00:00 2001 From: "tirthraj.chaudhari" Date: Wed, 3 Sep 2025 20:30:55 +0530 Subject: [PATCH 02/10] Add images and test results --- crowdstrike_fdr/assets/crowdstrike-fdr.svg | 3 + .../assets/logs/crowdstrike-fdr_tests.yaml | 801 ++++++++++++++++-- crowdstrike_fdr/images/IMAGES_README.md | 41 - ...rike_fdr_account_and_privilege_changes.png | Bin 0 -> 505464 bytes ...strike_fdr_authentication_and_identity.png | Bin 0 -> 395296 bytes ...cution_monitoring_and_threat_detection.png | Bin 0 -> 448853 bytes .../crowdstrike_fdr_network_activity.png | Bin 0 -> 401255 bytes .../images/crowdstrike_fdr_overview.png | Bin 0 -> 527404 bytes crowdstrike_fdr/manifest.json | 22 +- 9 files changed, 726 insertions(+), 141 deletions(-) create mode 100644 crowdstrike_fdr/assets/crowdstrike-fdr.svg delete mode 100644 crowdstrike_fdr/images/IMAGES_README.md create mode 100644 crowdstrike_fdr/images/crowdstrike_fdr_account_and_privilege_changes.png create mode 100644 crowdstrike_fdr/images/crowdstrike_fdr_authentication_and_identity.png create mode 100644 crowdstrike_fdr/images/crowdstrike_fdr_execution_monitoring_and_threat_detection.png create mode 100644 crowdstrike_fdr/images/crowdstrike_fdr_network_activity.png create mode 100644 crowdstrike_fdr/images/crowdstrike_fdr_overview.png diff --git a/crowdstrike_fdr/assets/crowdstrike-fdr.svg b/crowdstrike_fdr/assets/crowdstrike-fdr.svg new file mode 100644 index 0000000000000..7e4cceb0db4a0 --- /dev/null +++ b/crowdstrike_fdr/assets/crowdstrike-fdr.svg @@ -0,0 +1,3 @@ + + + diff --git a/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml b/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml index 84cdb47a3abf3..e09c5fc62c017 100644 --- a/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml +++ b/crowdstrike_fdr/assets/logs/crowdstrike-fdr_tests.yaml @@ -1,96 +1,709 @@ id: crowdstrike-fdr tests: - - sample: '{"ContextBaseFileName":"sample.exe","aip":"10.10.10.10","event_platform":"Win","EventOrigin":"1","id":"53c53746-44bd-424c-952d-953d77e2c6ce","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1755599833469","LocalAddressIP4":"20.20.20.20","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1755599832.823","ConfigStateHash":"1148659614","ConnectionFlags":"0","ContextProcessId":"580375981794","RemotePort":"443","ConfigBuild":"1007.3.0020006.15","LocalPort":"50966","Entitlements":"15","name":"NetworkConnectIP4V13","aid":"d45b8541202f4b43bdac05234d906ff1","RemoteAddressIP4":"30.30.30.30","RemoteAddressString":"52.123.145.14:443","ConnectionDirection":"0","cid":"2cc98db1a47b4c98b913s46d43bfab70"}' - result: null - - sample: '{"UserIsAdmin": "1", "LogonTime": "1756189673.714", "ContextThreadId": - "237842773747", "aip": "10.10.10.10", "LogonDomain": "ZEROAD", - "RemoteAccount": "1", "UserSid": "S-1-6-18", "event_platform": "Win", - "UserFlags": "0", "ClientComputerName": "Test-Computer", "EventOrigin": - "1", "LogonServer": "", "id": "e48d75d4-ec11-4bbf-b628-14c82b98815f", - "EffectiveTransmissionClass": "2", "event_simpleName": "UserLogon", - "ContextTimeStamp": "1756189673.714", "UserName": "demo-user", - "ConfigStateHash": "1293256420", "ContextProcessId": "60249910548", - "LogonType": "0", "PrivilegesBitmask": "130778398648", - "AuthenticationPackage": "Negotiate", "AuthenticationId": "999", - "UserPrincipal": "381$@abc.local", "ConfigBuild": "1007.3.0020006.15", - "PasswordLastSet": "", "Entitlements": "15", "name": "UserLogonV9", - "UserLogonFlags": "8", "EnabledPrivilegesBitmask": "130471291024", "aid": - "3dd1ca6a3428444615ccf1070a8b37e2", "UserGroupsBitmask": "794753", "cid": - "2cc98db1a47b4c98b913c94d43bfab70"}' - result: null - - sample: '{"aip": "10.10.10.10", "UserRid": "461523EA", "event_platform": "Win", - "EventOrigin": "1", "InterfaceGuid": - "14521485-1234-ABCD-EF00-0123456789AC", "RpcClientProcessId": - "60621531269", "id": "29023678-56e0-42f8-ad6d-f719c1c38cdf", - "EffectiveTransmissionClass": "3", "timestamp": "1756295097838", - "LocalAddressIP4": "20.20.20.20", "event_simpleName": - "UserAccountCreated", "ContextTimeStamp": "1756295157.763", "UserName": - "test.user", "ConfigStateHash": "3973064497", "InterfaceVersion": "65536", - "RpcClientThreadId": "249100854834", "ConfigBuild": "1007.3.0020006.15", - "RpcOpNum": "50", "Entitlements": "15", "name": "UserAccountCreatedV1", - "ComputerName": "Test-Asset", "Attacks": [{"Tactic": "Persistence", - "Technique": "Create Account"}], "aid": - "3dd1ca6a3428443399ccf1070a8b37e2", "RpcNestingLevel": "0", "cid": - "2cc98db1a47b4c98b913c94d43bfab70"}' - result: null - - sample: '{"aip": "10.10.10.10", "UserRid": "461523EA", "event_platform": "Win", - "DomainSid": "S-1-5-21-367788025-4070750832-749663698", "EventOrigin": - "1", "InterfaceGuid": "12345778-1234-ABCD-EF00-0123456789AC", - "RpcClientProcessId": "60621531269", "id": - "4e5079f3-9e6a-47d3-b465-4539a26f5f85", "EffectiveTransmissionClass": "3", - "timestamp": "1756295097839", "LocalAddressIP4": "20.20.20.20", - "event_simpleName": "UserAccountAddedToGroup", "ContextTimeStamp": - "1756295157.878", "ConfigStateHash": "3973064497", "InterfaceVersion": - "65536", "GroupRid": "00000221", "RpcClientThreadId": "249100854834", - "ConfigBuild": "1007.3.0020006.15", "RpcOpNum": "31", "Entitlements": - "15", "name": "UserAccountAddedToGroupV2", "ComputerName": "CLW381", - "Attacks": [{"Tactic": "Persistence", "Technique": "Account - Manipulation"}], "aid": "3dd1ca6a3428443399ccf1070a8b37e2", - "RpcNestingLevel": "0", "cid": "2cc98db1a47b4c98b913c94d45bfab70"}' - result: null - - sample: '{"IP6Records": "2620:1ec:29:1::37;", "ContextBaseFileName": - "SearchHost.exe", "DnsResponseType": "2", "IP4Records": "13.107.253.37;", - "ContextThreadId": "239862140703", "aip": "10.10.10.10", "CNAMERecords": - "azurefd-t-abc.manager.net;shed.dual-low.s-part-0020.t-0009.t-msedge.net", - "QueryStatus": "0", "FirstIP6Record": "2620:1ec:29:1:0:0:0:37", - "InterfaceIndex": "0", "event_platform": "Win", "DualRequest": "1", - "EventOrigin": "1", "id": "3cfd46d5-297c-413f-a75e-fcf8ab3bae24", - "EffectiveTransmissionClass": "3", "FirstIP4Record": "11.11.11.11", - "timestamp": "1756295094926", "LocalAddressIP4": "20.20.20.20", - "event_simpleName": "DnsRequest", "ContextTimeStamp": "1756295107.850", - "ConfigStateHash": "3973064497", "ContextProcessId": "60324656129", - "DomainName": "fp-afd.azurefd.net", "RespondingDnsServer": "40.40.40.40", - "ConfigBuild": "1007.3.0020006.15", "DnsRequestCount": "1", - "Entitlements": "15", "name": "DnsRequestV5", "ComputerName": "Test-PC", - "aid": "3dd1ca6a3428443399ccf1070a8b37e2", "cid": - "2cc98db1a47b4c98b913c94d43bfab70", "RequestType": "28"}' - result: null - - sample: '{"FileOperatorSid": "S-1-4-18", "ContextBaseFileName": "abc.exe", - "FileCategory": "6", "Size": "10284624", "ModuleCharacteristics": "34", - "ContextThreadId": "248921612527", "MinorFunction": "0", "aip": - "49.14.164.179", "IsOnNetwork": "0", "FileIdentifier": - "5cf3cfb451d67f43ba2c2a51a8fb10cbf411010000000b00", "event_platform": - "Win", "TokenType": "1", "OriginalFilename": "mini_installer.exe", - "ImageCheckSum": "10306457", "EventOrigin": "1", - "DiskParentDeviceInstanceId": "aiuhfrf", "ImageSubsystem": "2", "id": - "570156ed-dc8c-46ad-8d9f-91b57a7178db", "FileObject": "0", - "EffectiveTransmissionClass": "3", "timestamp": "1756295116394", - "LocalAddressIP4": "172.23.168.94", "event_simpleName": "PeFileWritten", - "ContextTimeStamp": "1756295176.875", "UserName": "demo-user", - "ConfigStateHash": "3973064497", "IsTransactedFile": "0", - "ContextProcessId": "60612242429", "IrpFlags": "0", "ImageEntryPoint": - "17632", "SHA256HashData": - "b6690ed4e4304a1258d610b4b50fd6b0a085f7ee50c0e195b6ea880b8131974b", - "AuthenticationId": "999", "ContextImageFileName": - "\\Device\\HarddiskVolume3\\Program Files (x86)\\abc.exe", - "FileWrittenFlags": "0", "ConfigBuild": "1007.3.0020006.15", - "FileEcpBitmask": "0", "MajorFunction": "0", "DllCharacteristics": - "49504", "IsOnRemovableDisk": "0", "ImageTimeStamp": "1756060583", - "Entitlements": "15", "name": "PeFileWrittenV22", "ComputerName": - "test-pc", "OperationFlags": "0", "Attacks": [{"Tactic": "Defense - Evasion", "Technique": "Masquerading"}], "aid": - "3dd1ca6a3428443399ccf1070a8b37e2", "cid": - "2cc98db1a47b4c98b913c94d43bfab70", "TargetFileName": - "\\Device\\HarddiskVolume3\\Program Files - (x86)\\{uhfirhfruihfr}\\139.0.3405.119\\abc.exe"}' - result: null + - + sample: |- + { + "ContextBaseFileName" : "sample.exe", + "aip" : "10.10.10.10", + "event_platform" : "Win", + "EventOrigin" : "1", + "id" : "53c53746-44bd-424c-952d-953d77e2c6ce", + "Protocol" : "6", + "EffectiveTransmissionClass" : "3", + "InContext" : "0", + "timestamp" : "1755599833469", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "NetworkConnectIP4", + "ContextTimeStamp" : "1755599832.823", + "ConfigStateHash" : "1148659614", + "ConnectionFlags" : "0", + "ContextProcessId" : "580375981794", + "RemotePort" : "443", + "ConfigBuild" : "1007.3.0020006.15", + "LocalPort" : "50966", + "Entitlements" : "15", + "name" : "NetworkConnectIP4V13", + "aid" : "d45b8541202f4b43bdac05234d906ff1", + "RemoteAddressIP4" : "30.30.30.30", + "RemoteAddressString" : "52.123.145.14:443", + "ConnectionDirection" : "0", + "cid" : "2cc98db1a47b4c98b913s46d43bfab70" + } + result: + custom: + ConfigBuild: "1007.3.0020006.15" + ConfigStateHash: "1148659614" + ConnectionDirection: "0" + ConnectionDirectionValue: "DIRECTION_OUTBOUND" + ConnectionFlags: "0" + ContextBaseFileName: "sample.exe" + ContextProcessId: "580375981794" + ContextTimeStamp: 1.755599832823E12 + EffectiveTransmissionClass: "3" + Entitlements: "15" + EventOrigin: "1" + InContext: "0" + Protocol: "6" + ProtocolValue: "TCP" + RemoteAddressString: "52.123.145.14:443" + aid: "d45b8541202f4b43bdac05234d906ff1" + aip: "10.10.10.10" + cid: "2cc98db1a47b4c98b913s46d43bfab70" + event_platform: "Win" + event_platform_value: "Windows" + evt: + name: "NetworkConnectIP4" + id: "53c53746-44bd-424c-952d-953d77e2c6ce" + name: "NetworkConnectIP4V13" + network: + client: + geoip: {} + ip: "20.20.20.20" + port: "50966" + destination: + geoip: {} + ip: "30.30.30.30" + port: "443" + timestamp: "1755599833469" + message: |- + { + "ContextBaseFileName" : "sample.exe", + "aip" : "10.10.10.10", + "event_platform" : "Win", + "EventOrigin" : "1", + "id" : "53c53746-44bd-424c-952d-953d77e2c6ce", + "Protocol" : "6", + "EffectiveTransmissionClass" : "3", + "InContext" : "0", + "timestamp" : "1755599833469", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "NetworkConnectIP4", + "ContextTimeStamp" : "1755599832.823", + "ConfigStateHash" : "1148659614", + "ConnectionFlags" : "0", + "ContextProcessId" : "580375981794", + "RemotePort" : "443", + "ConfigBuild" : "1007.3.0020006.15", + "LocalPort" : "50966", + "Entitlements" : "15", + "name" : "NetworkConnectIP4V13", + "aid" : "d45b8541202f4b43bdac05234d906ff1", + "RemoteAddressIP4" : "30.30.30.30", + "RemoteAddressString" : "52.123.145.14:443", + "ConnectionDirection" : "0", + "cid" : "2cc98db1a47b4c98b913s46d43bfab70" + } + tags: + - "source:LOGS_SOURCE" + timestamp: 1755599832823 + - + sample: |- + { + "UserIsAdmin" : "1", + "LogonTime" : "1756189673.714", + "ContextThreadId" : "237842773747", + "aip" : "10.10.10.10", + "LogonDomain" : "ZEROAD", + "RemoteAccount" : "1", + "UserSid" : "S-1-6-18", + "event_platform" : "Win", + "UserFlags" : "0", + "ClientComputerName" : "Test-Computer", + "EventOrigin" : "1", + "LogonServer" : "", + "id" : "e48d75d4-ec11-4bbf-b628-14c82b98815f", + "EffectiveTransmissionClass" : "2", + "event_simpleName" : "UserLogon", + "ContextTimeStamp" : "1756189673.714", + "UserName" : "demo-user", + "ConfigStateHash" : "1293256420", + "ContextProcessId" : "60249910548", + "LogonType" : "0", + "PrivilegesBitmask" : "130778398648", + "AuthenticationPackage" : "Negotiate", + "AuthenticationId" : "999", + "UserPrincipal" : "381$@abc.local", + "ConfigBuild" : "1007.3.0020006.15", + "PasswordLastSet" : "", + "Entitlements" : "15", + "name" : "UserLogonV9", + "UserLogonFlags" : "8", + "EnabledPrivilegesBitmask" : "130471291024", + "aid" : "3dd1ca6a3428444615ccf1070a8b37e2", + "UserGroupsBitmask" : "794753", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70" + } + result: + custom: + AuthenticationId: "999" + AuthenticationPackage: "Negotiate" + ClientComputerName: "Test-Computer" + ConfigBuild: "1007.3.0020006.15" + ConfigStateHash: "1293256420" + ContextProcessId: "60249910548" + ContextThreadId: "237842773747" + ContextTimeStamp: 1.756189673714E12 + EffectiveTransmissionClass: "2" + EnabledPrivilegesBitmask: "130471291024" + Entitlements: "15" + EventOrigin: "1" + LogonDomain: "ZEROAD" + LogonServer: "" + LogonTime: "1756189673.714" + LogonType: "0" + PasswordLastSet: "" + PrivilegesBitmask: "130778398648" + RemoteAccount: "1" + UserFlags: "0" + UserGroupsBitmask: "794753" + UserIsAdmin: "1" + UserIsAdminValue: "True" + UserLogonFlags: "8" + UserLogonFlagsValue: "USER_IS_BUILT_IN" + UserPrincipal: "381$@abc.local" + aid: "3dd1ca6a3428444615ccf1070a8b37e2" + aip: "10.10.10.10" + cid: "2cc98db1a47b4c98b913c94d43bfab70" + event_platform: "Win" + event_platform_value: "Windows" + evt: + name: "UserLogon" + id: "e48d75d4-ec11-4bbf-b628-14c82b98815f" + name: "UserLogonV9" + usr: + id: "S-1-6-18" + name: "demo-user" + message: |- + { + "UserIsAdmin" : "1", + "LogonTime" : "1756189673.714", + "ContextThreadId" : "237842773747", + "aip" : "10.10.10.10", + "LogonDomain" : "ZEROAD", + "RemoteAccount" : "1", + "UserSid" : "S-1-6-18", + "event_platform" : "Win", + "UserFlags" : "0", + "ClientComputerName" : "Test-Computer", + "EventOrigin" : "1", + "LogonServer" : "", + "id" : "e48d75d4-ec11-4bbf-b628-14c82b98815f", + "EffectiveTransmissionClass" : "2", + "event_simpleName" : "UserLogon", + "ContextTimeStamp" : "1756189673.714", + "UserName" : "demo-user", + "ConfigStateHash" : "1293256420", + "ContextProcessId" : "60249910548", + "LogonType" : "0", + "PrivilegesBitmask" : "130778398648", + "AuthenticationPackage" : "Negotiate", + "AuthenticationId" : "999", + "UserPrincipal" : "381$@abc.local", + "ConfigBuild" : "1007.3.0020006.15", + "PasswordLastSet" : "", + "Entitlements" : "15", + "name" : "UserLogonV9", + "UserLogonFlags" : "8", + "EnabledPrivilegesBitmask" : "130471291024", + "aid" : "3dd1ca6a3428444615ccf1070a8b37e2", + "UserGroupsBitmask" : "794753", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70" + } + tags: + - "source:LOGS_SOURCE" + timestamp: 1756189673714 + - + sample: |- + { + "aip" : "10.10.10.10", + "UserRid" : "461523EA", + "event_platform" : "Win", + "EventOrigin" : "1", + "InterfaceGuid" : "14521485-1234-ABCD-EF00-0123456789AC", + "RpcClientProcessId" : "60621531269", + "id" : "29023678-56e0-42f8-ad6d-f719c1c38cdf", + "EffectiveTransmissionClass" : "3", + "timestamp" : "1756295097838", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "UserAccountCreated", + "ContextTimeStamp" : "1756295157.763", + "UserName" : "test.user", + "ConfigStateHash" : "3973064497", + "InterfaceVersion" : "65536", + "RpcClientThreadId" : "249100854834", + "ConfigBuild" : "1007.3.0020006.15", + "RpcOpNum" : "50", + "Entitlements" : "15", + "name" : "UserAccountCreatedV1", + "ComputerName" : "Test-Asset", + "Attacks" : [ { + "Tactic" : "Persistence", + "Technique" : "Create Account" + } ], + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "RpcNestingLevel" : "0", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70" + } + result: + custom: + Attacks: + - + Tactic: "Persistence" + Technique: "Create Account" + ComputerName: "Test-Asset" + ConfigBuild: "1007.3.0020006.15" + ConfigStateHash: "3973064497" + ContextTimeStamp: 1.756295157763E12 + EffectiveTransmissionClass: "3" + Entitlements: "15" + EventOrigin: "1" + InterfaceGuid: "14521485-1234-ABCD-EF00-0123456789AC" + InterfaceVersion: "65536" + RpcClientProcessId: "60621531269" + RpcClientThreadId: "249100854834" + RpcNestingLevel: "0" + RpcOpNum: "50" + aid: "3dd1ca6a3428443399ccf1070a8b37e2" + aip: "10.10.10.10" + cid: "2cc98db1a47b4c98b913c94d43bfab70" + event_platform: "Win" + event_platform_value: "Windows" + evt: + name: "UserAccountCreated" + id: "29023678-56e0-42f8-ad6d-f719c1c38cdf" + name: "UserAccountCreatedV1" + network: + client: + geoip: {} + ip: "20.20.20.20" + timestamp: "1756295097838" + usr: + id: "461523EA" + name: "test.user" + message: |- + { + "aip" : "10.10.10.10", + "UserRid" : "461523EA", + "event_platform" : "Win", + "EventOrigin" : "1", + "InterfaceGuid" : "14521485-1234-ABCD-EF00-0123456789AC", + "RpcClientProcessId" : "60621531269", + "id" : "29023678-56e0-42f8-ad6d-f719c1c38cdf", + "EffectiveTransmissionClass" : "3", + "timestamp" : "1756295097838", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "UserAccountCreated", + "ContextTimeStamp" : "1756295157.763", + "UserName" : "test.user", + "ConfigStateHash" : "3973064497", + "InterfaceVersion" : "65536", + "RpcClientThreadId" : "249100854834", + "ConfigBuild" : "1007.3.0020006.15", + "RpcOpNum" : "50", + "Entitlements" : "15", + "name" : "UserAccountCreatedV1", + "ComputerName" : "Test-Asset", + "Attacks" : [ { + "Tactic" : "Persistence", + "Technique" : "Create Account" + } ], + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "RpcNestingLevel" : "0", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70" + } + tags: + - "source:LOGS_SOURCE" + timestamp: 1756295157763 + - + sample: |- + { + "aip" : "10.10.10.10", + "UserRid" : "461523EA", + "event_platform" : "Win", + "DomainSid" : "S-1-5-21-367788025-4070750832-749663698", + "EventOrigin" : "1", + "InterfaceGuid" : "12345778-1234-ABCD-EF00-0123456789AC", + "RpcClientProcessId" : "60621531269", + "id" : "4e5079f3-9e6a-47d3-b465-4539a26f5f85", + "EffectiveTransmissionClass" : "3", + "timestamp" : "1756295097839", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "UserAccountAddedToGroup", + "ContextTimeStamp" : "1756295157.878", + "ConfigStateHash" : "3973064497", + "InterfaceVersion" : "65536", + "GroupRid" : "00000221", + "RpcClientThreadId" : "249100854834", + "ConfigBuild" : "1007.3.0020006.15", + "RpcOpNum" : "31", + "Entitlements" : "15", + "name" : "UserAccountAddedToGroupV2", + "ComputerName" : "CLW381", + "Attacks" : [ { + "Tactic" : "Persistence", + "Technique" : "Account Manipulation" + } ], + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "RpcNestingLevel" : "0", + "cid" : "2cc98db1a47b4c98b913c94d45bfab70" + } + result: + custom: + Attacks: + - + Tactic: "Persistence" + Technique: "Account Manipulation" + ComputerName: "CLW381" + ConfigBuild: "1007.3.0020006.15" + ConfigStateHash: "3973064497" + ContextTimeStamp: 1.756295157878E12 + DomainSid: "S-1-5-21-367788025-4070750832-749663698" + EffectiveTransmissionClass: "3" + Entitlements: "15" + EventOrigin: "1" + GroupRid: "00000221" + InterfaceGuid: "12345778-1234-ABCD-EF00-0123456789AC" + InterfaceVersion: "65536" + RpcClientProcessId: "60621531269" + RpcClientThreadId: "249100854834" + RpcNestingLevel: "0" + RpcOpNum: "31" + aid: "3dd1ca6a3428443399ccf1070a8b37e2" + aip: "10.10.10.10" + cid: "2cc98db1a47b4c98b913c94d45bfab70" + event_platform: "Win" + event_platform_value: "Windows" + evt: + name: "UserAccountAddedToGroup" + id: "4e5079f3-9e6a-47d3-b465-4539a26f5f85" + name: "UserAccountAddedToGroupV2" + network: + client: + geoip: {} + ip: "20.20.20.20" + timestamp: "1756295097839" + usr: + id: "461523EA" + message: |- + { + "aip" : "10.10.10.10", + "UserRid" : "461523EA", + "event_platform" : "Win", + "DomainSid" : "S-1-5-21-367788025-4070750832-749663698", + "EventOrigin" : "1", + "InterfaceGuid" : "12345778-1234-ABCD-EF00-0123456789AC", + "RpcClientProcessId" : "60621531269", + "id" : "4e5079f3-9e6a-47d3-b465-4539a26f5f85", + "EffectiveTransmissionClass" : "3", + "timestamp" : "1756295097839", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "UserAccountAddedToGroup", + "ContextTimeStamp" : "1756295157.878", + "ConfigStateHash" : "3973064497", + "InterfaceVersion" : "65536", + "GroupRid" : "00000221", + "RpcClientThreadId" : "249100854834", + "ConfigBuild" : "1007.3.0020006.15", + "RpcOpNum" : "31", + "Entitlements" : "15", + "name" : "UserAccountAddedToGroupV2", + "ComputerName" : "CLW381", + "Attacks" : [ { + "Tactic" : "Persistence", + "Technique" : "Account Manipulation" + } ], + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "RpcNestingLevel" : "0", + "cid" : "2cc98db1a47b4c98b913c94d45bfab70" + } + tags: + - "source:LOGS_SOURCE" + timestamp: 1756295157878 + - + sample: |- + { + "IP6Records" : "2620:1ec:29:1::37;", + "ContextBaseFileName" : "SearchHost.exe", + "DnsResponseType" : "2", + "IP4Records" : "13.107.253.37;", + "ContextThreadId" : "239862140703", + "aip" : "10.10.10.10", + "CNAMERecords" : "azurefd-t-abc.manager.net;shed.dual-low.s-part-0020.t-0009.t-msedge.net", + "QueryStatus" : "0", + "FirstIP6Record" : "2620:1ec:29:1:0:0:0:37", + "InterfaceIndex" : "0", + "event_platform" : "Win", + "DualRequest" : "1", + "EventOrigin" : "1", + "id" : "3cfd46d5-297c-413f-a75e-fcf8ab3bae24", + "EffectiveTransmissionClass" : "3", + "FirstIP4Record" : "11.11.11.11", + "timestamp" : "1756295094926", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "DnsRequest", + "ContextTimeStamp" : "1756295107.850", + "ConfigStateHash" : "3973064497", + "ContextProcessId" : "60324656129", + "DomainName" : "fp-afd.azurefd.net", + "RespondingDnsServer" : "40.40.40.40", + "ConfigBuild" : "1007.3.0020006.15", + "DnsRequestCount" : "1", + "Entitlements" : "15", + "name" : "DnsRequestV5", + "ComputerName" : "Test-PC", + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70", + "RequestType" : "28" + } + result: + custom: + CNAMERecords: "azurefd-t-abc.manager.net;shed.dual-low.s-part-0020.t-0009.t-msedge.net" + ComputerName: "Test-PC" + ConfigBuild: "1007.3.0020006.15" + ConfigStateHash: "3973064497" + ContextBaseFileName: "SearchHost.exe" + ContextProcessId: "60324656129" + ContextThreadId: "239862140703" + ContextTimeStamp: 1.75629510785E12 + DnsRequestCount: "1" + DnsResponseType: "2" + DualRequest: "1" + EffectiveTransmissionClass: "3" + Entitlements: "15" + EventOrigin: "1" + FirstIP4Record: "11.11.11.11" + FirstIP6Record: "2620:1ec:29:1:0:0:0:37" + IP4Records: "13.107.253.37;" + IP6Records: "2620:1ec:29:1::37;" + InterfaceIndex: "0" + QueryStatus: "0" + RequestType: "28" + RespondingDnsServer: "40.40.40.40" + aid: "3dd1ca6a3428443399ccf1070a8b37e2" + aip: "10.10.10.10" + cid: "2cc98db1a47b4c98b913c94d43bfab70" + dns: + question: + name: "fp-afd.azurefd.net" + type: "AAAA" + event_platform: "Win" + event_platform_value: "Windows" + evt: + name: "DnsRequest" + id: "3cfd46d5-297c-413f-a75e-fcf8ab3bae24" + name: "DnsRequestV5" + network: + client: + geoip: {} + ip: "20.20.20.20" + timestamp: "1756295094926" + message: |- + { + "IP6Records" : "2620:1ec:29:1::37;", + "ContextBaseFileName" : "SearchHost.exe", + "DnsResponseType" : "2", + "IP4Records" : "13.107.253.37;", + "ContextThreadId" : "239862140703", + "aip" : "10.10.10.10", + "CNAMERecords" : "azurefd-t-abc.manager.net;shed.dual-low.s-part-0020.t-0009.t-msedge.net", + "QueryStatus" : "0", + "FirstIP6Record" : "2620:1ec:29:1:0:0:0:37", + "InterfaceIndex" : "0", + "event_platform" : "Win", + "DualRequest" : "1", + "EventOrigin" : "1", + "id" : "3cfd46d5-297c-413f-a75e-fcf8ab3bae24", + "EffectiveTransmissionClass" : "3", + "FirstIP4Record" : "11.11.11.11", + "timestamp" : "1756295094926", + "LocalAddressIP4" : "20.20.20.20", + "event_simpleName" : "DnsRequest", + "ContextTimeStamp" : "1756295107.850", + "ConfigStateHash" : "3973064497", + "ContextProcessId" : "60324656129", + "DomainName" : "fp-afd.azurefd.net", + "RespondingDnsServer" : "40.40.40.40", + "ConfigBuild" : "1007.3.0020006.15", + "DnsRequestCount" : "1", + "Entitlements" : "15", + "name" : "DnsRequestV5", + "ComputerName" : "Test-PC", + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70", + "RequestType" : "28" + } + tags: + - "source:LOGS_SOURCE" + timestamp: 1756295107850 + - + sample: |- + { + "FileOperatorSid" : "S-1-4-18", + "ContextBaseFileName" : "abc.exe", + "FileCategory" : "6", + "Size" : "10284624", + "ModuleCharacteristics" : "34", + "ContextThreadId" : "248921612527", + "MinorFunction" : "0", + "aip" : "49.14.164.179", + "IsOnNetwork" : "0", + "FileIdentifier" : "5cf3cfb451d67f43ba2c2a51a8fb10cbf411010000000b00", + "event_platform" : "Win", + "TokenType" : "1", + "OriginalFilename" : "mini_installer.exe", + "ImageCheckSum" : "10306457", + "EventOrigin" : "1", + "DiskParentDeviceInstanceId" : "aiuhfrf", + "ImageSubsystem" : "2", + "id" : "570156ed-dc8c-46ad-8d9f-91b57a7178db", + "FileObject" : "0", + "EffectiveTransmissionClass" : "3", + "timestamp" : "1756295116394", + "LocalAddressIP4" : "172.23.168.94", + "event_simpleName" : "PeFileWritten", + "ContextTimeStamp" : "1756295176.875", + "UserName" : "demo-user", + "ConfigStateHash" : "3973064497", + "IsTransactedFile" : "0", + "ContextProcessId" : "60612242429", + "IrpFlags" : "0", + "ImageEntryPoint" : "17632", + "SHA256HashData" : "b6690ed4e4304a1258d610b4b50fd6b0a085f7ee50c0e195b6ea880b8131974b", + "AuthenticationId" : "999", + "ContextImageFileName" : "\\Device\\HarddiskVolume3\\Program Files (x86)\\abc.exe", + "FileWrittenFlags" : "0", + "ConfigBuild" : "1007.3.0020006.15", + "FileEcpBitmask" : "0", + "MajorFunction" : "0", + "DllCharacteristics" : "49504", + "IsOnRemovableDisk" : "0", + "ImageTimeStamp" : "1756060583", + "Entitlements" : "15", + "name" : "PeFileWrittenV22", + "ComputerName" : "test-pc", + "OperationFlags" : "0", + "Attacks" : [ { + "Tactic" : "Defense Evasion", + "Technique" : "Masquerading" + } ], + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70", + "TargetFileName" : "\\Device\\HarddiskVolume3\\Program Files (x86)\\{uhfirhfruihfr}\\139.0.3405.119\\abc.exe" + } + result: + custom: + Attacks: + - + Tactic: "Defense Evasion" + Technique: "Masquerading" + AuthenticationId: "999" + ComputerName: "test-pc" + ConfigBuild: "1007.3.0020006.15" + ConfigStateHash: "3973064497" + ContextBaseFileName: "abc.exe" + ContextImageFileName: "\\Device\\HarddiskVolume3\\Program Files (x86)\\abc.exe" + ContextProcessId: "60612242429" + ContextThreadId: "248921612527" + ContextTimeStamp: 1.756295176875E12 + DiskParentDeviceInstanceId: "aiuhfrf" + DllCharacteristics: "49504" + EffectiveTransmissionClass: "3" + Entitlements: "15" + EventOrigin: "1" + FileCategory: "6" + FileCategoryValue: "EXECUTABLE_FILES" + FileEcpBitmask: "0" + FileIdentifier: "5cf3cfb451d67f43ba2c2a51a8fb10cbf411010000000b00" + FileObject: "0" + FileOperatorSid: "S-1-4-18" + FileWrittenFlags: "0" + ImageCheckSum: "10306457" + ImageEntryPoint: "17632" + ImageSubsystem: "2" + ImageTimeStamp: "1756060583" + IrpFlags: "0" + IsOnNetwork: "0" + IsOnRemovableDisk: "0" + IsTransactedFile: "0" + MajorFunction: "0" + MinorFunction: "0" + ModuleCharacteristics: "34" + OperationFlags: "0" + OriginalFilename: "mini_installer.exe" + SHA256HashData: "b6690ed4e4304a1258d610b4b50fd6b0a085f7ee50c0e195b6ea880b8131974b" + Size: "10284624" + TargetFileName: "\\Device\\HarddiskVolume3\\Program Files (x86)\\{uhfirhfruihfr}\\139.0.3405.119\\abc.exe" + TokenType: "1" + aid: "3dd1ca6a3428443399ccf1070a8b37e2" + aip: "49.14.164.179" + cid: "2cc98db1a47b4c98b913c94d43bfab70" + event_platform: "Win" + event_platform_value: "Windows" + evt: + name: "PeFileWritten" + id: "570156ed-dc8c-46ad-8d9f-91b57a7178db" + name: "PeFileWrittenV22" + network: + client: + geoip: {} + ip: "172.23.168.94" + timestamp: "1756295116394" + usr: + name: "demo-user" + message: |- + { + "FileOperatorSid" : "S-1-4-18", + "ContextBaseFileName" : "abc.exe", + "FileCategory" : "6", + "Size" : "10284624", + "ModuleCharacteristics" : "34", + "ContextThreadId" : "248921612527", + "MinorFunction" : "0", + "aip" : "49.14.164.179", + "IsOnNetwork" : "0", + "FileIdentifier" : "5cf3cfb451d67f43ba2c2a51a8fb10cbf411010000000b00", + "event_platform" : "Win", + "TokenType" : "1", + "OriginalFilename" : "mini_installer.exe", + "ImageCheckSum" : "10306457", + "EventOrigin" : "1", + "DiskParentDeviceInstanceId" : "aiuhfrf", + "ImageSubsystem" : "2", + "id" : "570156ed-dc8c-46ad-8d9f-91b57a7178db", + "FileObject" : "0", + "EffectiveTransmissionClass" : "3", + "timestamp" : "1756295116394", + "LocalAddressIP4" : "172.23.168.94", + "event_simpleName" : "PeFileWritten", + "ContextTimeStamp" : "1756295176.875", + "UserName" : "demo-user", + "ConfigStateHash" : "3973064497", + "IsTransactedFile" : "0", + "ContextProcessId" : "60612242429", + "IrpFlags" : "0", + "ImageEntryPoint" : "17632", + "SHA256HashData" : "b6690ed4e4304a1258d610b4b50fd6b0a085f7ee50c0e195b6ea880b8131974b", + "AuthenticationId" : "999", + "ContextImageFileName" : "\\Device\\HarddiskVolume3\\Program Files (x86)\\abc.exe", + "FileWrittenFlags" : "0", + "ConfigBuild" : "1007.3.0020006.15", + "FileEcpBitmask" : "0", + "MajorFunction" : "0", + "DllCharacteristics" : "49504", + "IsOnRemovableDisk" : "0", + "ImageTimeStamp" : "1756060583", + "Entitlements" : "15", + "name" : "PeFileWrittenV22", + "ComputerName" : "test-pc", + "OperationFlags" : "0", + "Attacks" : [ { + "Tactic" : "Defense Evasion", + "Technique" : "Masquerading" + } ], + "aid" : "3dd1ca6a3428443399ccf1070a8b37e2", + "cid" : "2cc98db1a47b4c98b913c94d43bfab70", + "TargetFileName" : "\\Device\\HarddiskVolume3\\Program Files (x86)\\{uhfirhfruihfr}\\139.0.3405.119\\abc.exe" + } + tags: + - "source:LOGS_SOURCE" + timestamp: 1756295176875 diff --git a/crowdstrike_fdr/images/IMAGES_README.md b/crowdstrike_fdr/images/IMAGES_README.md deleted file mode 100644 index 443f3c45e3385..0000000000000 --- a/crowdstrike_fdr/images/IMAGES_README.md +++ /dev/null @@ -1,41 +0,0 @@ -# Marketplace Media Carousel Guidelines - -## Using the media gallery - -Please upload images to use the media gallery. Integrations require a minimum of 3 images. Images should highlight your product, your integration, and a full image of the Datadog integration dashboard. The gallery -can hold a maximum of 8 pieces of media total, and one of these pieces of media -can be a video (guidelines and submission steps below). Images should be -added to your /images directory and referenced in the manifest.json file. - - -## Image and video requirements - -### Images - -``` -File type : .jpg or .png -File size : ~500 KB per image, with a max of 1 MB per image -File dimensions : The image must be between 1440px and 2880px width, with a 16:9 aspect ratio (for example: 1440x810) -File name : Use only letters, numbers, underscores, and hyphens -Color mode : RGB -Color profile : sRGB -Description : 300 characters maximum -``` - -### Video - -To display a video in your media gallery, please send our team the zipped file -or a link to download the video at `marketplace@datadog.com`. In addition, -please upload a thumbnail image for your video as a part of the pull request. -Once approved, we will upload the file to Vimeo and provide you with the -vimeo_id to add to your manifest.json file. Please note that the gallery can -only hold one video. - -``` -File type : MP4 H.264 -File size : Max 1 video; 1 GB maximum size -File dimensions : The aspect ratio must be exactly 16:9, and the resolution must be 1920x1080 or higher -File name : partnerName-appName.mp4 -Run time : Recommendation of 60 seconds or less -Description : 300 characters maximum -``` diff --git a/crowdstrike_fdr/images/crowdstrike_fdr_account_and_privilege_changes.png b/crowdstrike_fdr/images/crowdstrike_fdr_account_and_privilege_changes.png new file mode 100644 index 0000000000000000000000000000000000000000..f7a9fb080d91736aff9ef7394bc1fa5fcb07b232 GIT binary patch literal 505464 zcmb4rcT`i&_O^(kD8h@NbdW9(q=R%tdX><74ZTR062OA=-n$3^=@2>zgd#N*3B4=5 zBQ-z>eDS^Oy6*kG_n+^qmBl$(nK^rA_TIDS+0Q2YwYtKCd(`)C+_>>TNl_Mf;|8Jm zjT^V+?-Jm?p{5Mx!~MbY04m7bs2HN%#68@yeW~{H#*OOO``U#praM?iPjbDC z_51$iNA^+!lQk3P$IZjy>t|WMwmbI2ujPDZbGDudjJnKeIm1f3Pqlsfwd62{-{lMO zmJ=Qblk4<`v`@`Naiq(DKJ%JKM1oZKDJ-6)@GddM-FR1ZE8)cx!gn7(=K4s+HwpOc zMfFB0LR@}f%1_KbhtZK@9*gr^T^~*RjE#@0SXt#8H@tJR7J2dbx}&xdnYYRYW|6uni^_if{l)j&Xl}td$Q7Bvx?Uo?;ouS zJbGg2#8-c`e{jD%BNX*NEo&gR@b`y#dYPz&zlRV2RQ3PS=7!SV*-p(cXt5RRzS2u7 z>a|r%aeI5ID-tz5%`rbej~X5QfOr2N&Dui6ua1kP`zlOeEl>5?)yI@@lT=$@-=EB- z2M6695ANds9}}`UcW}@{Q&3iBOicUyNnKqX>ihQ}+^^oAAA($|I&cHCYPb(n7UD&1Ky;Rq$B zOSrg5M2(HHq&_oAh>1}j4)*#f6A9NjHu7D$6Wecw?ZVALc-3EPzGx(K~KRm_NY_zYy$1%q2M8UE2v zux2M6LqHW!*!e=X^~^Fi+drqSBDhHa_($)JI*nGF zC{PaG_R%nMrR^QQ!2|vC$N%Gpl;!6CLq~c^hl5Xgq$@Nit77O%lWS~;l^q?q{@I*T zSZc=iWj8$F#nnk{Yh2KY{%x6f2v`9VcM560`A;>9dd^n)HT4=>1X~TloD(-KpJ%)G z+`qf}dELhktcXcCEpC4T#Vc(t@oVb{{_XDm>w0Nd%Oo^l4wvyAJrZw`5~7U%A7;#_mJ0qG5_~>yl;5T z^V(5iyyiN3IU1OOqE;&Ww)Jb+S}6SO30wL0XVlK_g|YbBNO`JlZg#z==9 zI;9J7FG@wraQJxRwe2ca*3y?J^>>^4D7f5;mJE0EC{vyLxrhJfb(E&m2>ah+^6Hzn z$$Ws2TD4Js{e%n#eKEsUSnqz9ZQrs_=@(L2+02z-@(E%W4&U1pU$!2w;_3h9BOTA| z?3>ZXaA3`6e&W*~AANtducsSnf;RLzX;D~dx3xt=QDmr@W%?uyb;Xg+YR3hk1~#wB zFn)8oxM>neCM%hZO`*Z?e9m>qz6kX-$|?O~PmDv_Pty-Y^knl^jtb^@AOz}kgjc-p z9ZT(JD54&@y3Jk+S(qp6RPc``A5M$oXInV=Kmqc$uOT{n>}tra0mGt3mk(FQruqF> zi-6O-zxW!8JPjrGdHNNc_ZGfdQ~Ljh3vau-dYmrr>vifXv3YIbd0;0ohRZg z+1TDsB|9lX-D-IJ0n~P}FdGV7*;8m}mB%gKqT#{S9hV$}+ho|SPNASAtp~PuMDOWV z3c3K2`0C@IDlYOQl>AkgI-)^xSDL> zLFTM?R{Dj}QM_r6Md!{o#P>&{Ujr`~6#$nnp%$N~`|%31$`#(~REya9oay8_vdBK@ zB?R=Uk|!4NR$g@e$=o|&PF2OZRl!n`ckP2F3B9s;l~}eg`BeI7I#s2)T_+pfR4Mn^ z`Rl>7h?w9CLD?#DK|?@w)rjG7rTdZK)3gmeTk2uoARfb3_qZ?SUdpR;J&9ykv?Qz6 zByF6Z5aH&H=|wI&=Lf(hn>>m0U-*X`8IgO0E}HL&^ar6k;crdmF^#J8Z)K=wtq4el zcQk`u2$utr4i^2DBVuNIx}HOS#lxxc#fZxjr;l`1K#?_8AE~S8v&|T1RX%_eE|k&= zO|P^KXP>c+y{!e-r&c6>Ddy>?MBep4-_KP9x8X~=RpdTXh1ndyMy=s|iE{$FduV~d z2e%bcdnqe5(%tn|+6#PO9x@U1)LcG8Up;+3u6zkNmVry==ridM;%irqA+ELI!$iDa zv^#=N8p(CoF}~QVd(*AHb*k9&vy~}{zm6QQ<)*LpoH%Bt;wTa=eoXzR6OyM?h@I?H z5imusO|7-mOeJ2KHEg!NLxEioPESoaLj=|p+vgzAfKFo3xrACHI#VGzwt-njeBa~% zara`ZyQPcv$w*J8^=|iII70ditKbf?3U-CVGOQ;j9{M`&(Q>4TYAkRr03ZrR2?Pnu zto#Kc)>&t?Jl*Lp7Ge)_XQ>&xV+#qX5b)~cMp-{jBx{2gZ64tGXP)xWZNG>}k- zPkfixk1Cs>jGCilH^r)MeZ>`Zdb{+;$J25b-$h%q4Npg-g63is-AW%cT`F3`8(E#W zzN&;y(^&^;Xf>2wkE%E2H>wRG)kN#XGpo1Yv|6sa;iFO*`Or^u!8)3z@iuAw4X3;F z>uVgY0hrx}g%wzMVBOgV5;Bb7)jo`R`6J}MTfOJwJ>ju8A zSNzj5dt=%4DpHDC4v93RTsUHQ;xPhs{<{3f^H&i+z?zDbRmS;*S3Ew_QtD$Jm#L2t{~s>OtaZjU%8H8$n~Uiv&QI(@@$OUg73Y@$%+RVbwGHb z>_Udg)5M7hc9eNr#Ly>cXO%Rqwbqv2ObVeaSNr6}Rv4ffQ7h4tI^vwn-(Vi0`qsG^ zfSz$F2L!q1NT9a}is^n5l&wYRBQk%<^Y3?Ytsy-Ui+Vra7B3K;WbjzOMNp<106zOl z;pVz+yXs!G7AAt;r>?4%7Rg5ZILBY`^RXXl*Kdw3OTM{_Ke~pzIm#1}s{Hb09zdF3 zk)TYAW~E8V130LgibgJ_t3U!i&WpV2`zmPu$SmP#A>AK@7(Y1%#E`RJ5L23?5J9Et3-wIiWSA6!<7BDXf}3v(gtlK1v_^tp@SZa9OkUOJXJ? zbE$p*mq19kyr4SUp5n0WSC90&+UTg{Vqd|G&@V8VoC78^d$a9iHJ(+=`jNmnfP#0| zESIdbQtf^P8On}n0rUkn8u_cfr4|??IF0WAo~OA6JltVZ{LZCwBs623;yoO;30p3x z60?I75C^emyElHIr%Bz^3%p1jd_4|EK6{Y~7{%kVK`) zmG6aPxcAXA5??30*QREzWtYn2%Nuuao@$y+dO6YQBJ=m)aUaieRTO{FT1^=UNt`a^ z8=-2bmD%e0y)8JIa5OjHZq0Q~MMLA;ImzfLS1E*9D|bj_K@!N+6!p1*KYt|nq$al5w!u=etG)f>jwk}{@zR<-KT&!?&(^NktOo zVi1Sb+9c49D>G>tk6lbu{w)X>|_n1yW@)-I*#|WQcP4g7TgYh0CNxW zAu=|Y)5Sa111hEEkaH)QdVg~>AuPttx9DX-(G^+xS(--f7^@Z%80{cA&b2z?=3>g- zvp!%t;tv@JWHKcga_c&2VS2!2<&|D8@kdYJ%zi#{_7Lc?p}HtN&?EoI>2iT9}j0SceRp6ih(AXq66yG z<{FMZ#mrOFITr71k#AOTDoG<0U`YrOg~Cb=>bhncPEgaP|BQ4t`lOC#>3qK=`N2UT z9IlL9w`w~~X*Z%Vn;F^NuXdzxkxEo`ect@?p6W`$)!0=Ty7PVcIEwZXc}d!1Yqq1B z*+aq=eUllrPMsj8^0H8cj^u2NO|iCN1VW@I1Qat-&T z+y}e2tQQ*ZZzftP3@gRQR&zRu84-S%*tRj6v-YZ1o7hH_b5EecqN^`+T%xcorwLhm zO&sImyB@m8`O=h=OP+(^`3mt zA1R>LBwz9s<#Bmhe(t^rTqAj{=?mU7TDVcd@Kn%UXI9QfuuomVwx~hsqzGijLa?Gy zAGF4Hzm5NS2%q1X1>0J#KDWZd!klXN$wme1fmgA;^8)3>-wl}MG}4rg?yT(PswNf- z*doVp5h#{Wp!cn>JD6YI0vF(0&F*t0l&qvbWKkuwK*5iTA8{9H_1hZChlH9Xg=eIu zha9euSZ?kI7QfE9yg$EB$^7tBcr||@sJF{8bE0qb_j#;4{Zi_Q&-NmrT8iaSI+tg* z4e!f>bnXPtoisX;w&+ybdWeF)az;&-pAscoH}V^ueeM{4+aDxDOV&P^eCA8>WQiFIGR5GPHr}vhSX`;+%6R~t95qq2}6td z2?o=ROv8<>DCjUODtz&S%k=n-=L?i<2m$qOL;=>KUNzv{~pqW1<)W4?>JN&r2J32K-+4MT+fZt2+F!e^XBU{fNmq0~;ZI)LhZg8gh6sTZU zRE?weWuRicTu%j4lXT$jcdHkFF+R{=6<7ux2$@GG7mHI{r&F1!`Sz&Af!O?|PO^9} zK*ruRdcrNV()-9q2YiB^Q;Cpy4|+2(F3=KM&0qS7)e`o{W^PpM$p`=31fP^{Wa6e2 z!#i2uCNfs;Kc1;z8Hd5h7bWqeF_D>a$CnV9G7fJDIH!=qt7U{~zs8q*5CXQcJ$__+ z@Dgb~s>O`7rCIj;N~F)ZffI!GZ?;d|@*>GLCKz&IeCw?S5!WK8j#G~2wHE!1na z)GyjlG@#Z{7?8SIulK<_a7xZToyyXo0Ens~nI&)P%HMLraGCciC3Te*o$dTBgbl`D1*1OcF zWxeOJZoOXLcdQfw1X5sXFpA--8G0|dpKJ#p@L<70%tIcfJ#0f8VDtJBgoZrGdoK~IhewUi8o7P<4N#B*Rksg;0 ztfBAyBk`Njw#=lH+Mwf^$_RKcCnpvGTinQ8n|lAoV6!rLHL*yseNFpAF3*9Y!EI!H zpVaQ~9WIEzns#MM@6T`Le>sk>+YBeZZ=xxfQ_ zV`LJkK;~>cHfX6-J2i%LOuByE?&a4FQCoL#4BZfO9S7OWiWawWxVNso4QP6a%&NPB zZshMyr5;GIU8(0(eijy9Fm`EXDMi=yZsj|~HRF0Hq^=4q)GU=Lz`%H5tIcysN9?mJ z*!gu3wr|@saCj1@i1PQm>wD>UKT6I+<%Vl2hzx5;;UR zHgaUto$u6wSshg%Y??DYl{K;NKl7~c6YFk8QnA}8a-OFw(GMN$jnqERPab+$$T%zc zxpD?OJ4(hiTIrhU9>A2#+Mk&>Ut@KG!MP4w8;P9WQLG0^!I-PMHSIEy?#G67Z-WFc z&+E?Sxi9sOAFhE3fxkUcbh527wma>!AXRsc>Tb@_87f`yeo#<`lRH9h2K%OMSF-kN zo^tNIMU;*v>JJ_rEPXCyz8U3E2MAPK->@u9>g3-1#5mlTV8i)~ul($_j)WW=U?w+! zVwZ}vu-BtYsF>75;?*GSblhS7jsVnqjojBIEcy;UXi;yRe|gZ%fAz9!%uLz7OI;*< z=fWMKnsti&m<|z3Wo5yLgUqU_l?%TOI4Kwv41*E$m98TF>9$XxDJI)funvK|BypRD znYs}EpW}n>z+E{VhW?LA4E<6^?r^tEa#hawhiX>oO>hY52PO|HD&sG5VdFhbER zI&;1EWBTlp^qEV-16S4f%^2VHl|oTdS=K?=!|k3BsZVvh;3m2Hfx3&ORps<;s~4&n zU6$(uc7imw?Z`zY&4tz*_8a@)&fe4}h61C9nf4#ID3ptK48?GR|Eik3xK)WB2u>7E zt7cj#993Sal1wKP@q=W_WV7Bi!JjC8aF_);iyUDO)q8Y7SvptE-y00UHmhb}RRg$G zwc9A?7qC?34zw%;mVcv$5*|8nM0?&we#B^a`wUOynD(TbQs5faggK|2iFHXkAY8@@ zrR)?dHw2B=u^5GL*)%GrEz}r4y+c$Qv;Goar zWOG&OOuDOI?N|uG@K1b5*jys*P!}=WJXIN)&SVmS6+CSn^f8d#H=YD}F+nHWaJc3D z)Jo4@*T>IJ2}ZxjsT7oMmt?XqgTyVjwMwNHtC92BAuF=J7c72?4-+rM_)J-J_U@3q zLW=nc=Iq(~DAnGYNYD>gxD>dz;53CMkS@F}0_6Sw1i_<6Ed|aaf0$C!ZU)p!CJWNk@8399*hIAMV5Yq!?_2 z=3YN0&+g@P{Ur&qs56=3XH&J$2>q<0kM=GJXSar7PIO3SgFz{+D(p>BCH?`eMEZX5 z_`tNV)&kN(`qb(3i=>qC;Bl^#efDUN;{?9pNXn5>9HKnnAupBU*GLk<^ zl4?eB{eaa1=!r=S87H|jxA1BpV)2@>w7Ng7a>4B6jt|A3ZC>`tJ^=u7oguh44{&YC zQ*kR!x2+j7q<=Kr$ln0qc8_hCAFf6D3>x7nfD~>W{))OAGty7_{t8sC-4%OZB9OfL zq{iKM4N`2H-71C=0eaL5vs!+yNi0%2A9{x%*^_E8n`jkbpYXnYWbK?i{?-&coXEXL z8)7A<6zlS6ePd?jARDvFjZ9if|2$?~w5}}s!6D&+fPgH&do*|Ja}}$J;`1(9ZlGm+ zL!oQ5S*Q5Ar$HcZ-M%O7>rQ>t@lrCM#SFC1ylsmQd>-YL=2#R?0|I#DIleyHvONSC zRMmNFbBk}df4S0*XxchXKc*hT8ImO1!@P@-hubtYoG3l47`&UlXvx`dhu}>(%`y{p zl_lx$L}8&O+|IS4niG!4#p<4=01wC&f}E~u&B{z@Tv2|-bNnpJZ{9M>R8+^H%g)T- z6{S20s^fcpJ3Z2Lio-QWJ=*D!uu1bN(joiBP9uv(Yn7Hw7Ti929e2!cUz%%LL47>% zT)n z>!+=>INP|T2ZNC@3Iz!T#n*-yZ@uw1kh6TU&}3T)6TgM?nvyNt=9b0`38hN}?~{}+ zJ)H!)PTz`Mv)+>1T8yUBgKwC?Yo#Uz? z)iU>q&E`*g=m0x)yn-ygZlTzq-TOC#kL%AlxeufAZ?PHuC=I5$Y z=g%w*xNFtsp892!m5yu|9W3#@l3(cNnE7bX6U}v(9Ot9F+)WlYjd`P|s}_e@<y~?V(^8!P_{Mi69}c|60+G>^RuO95uEi3 z-m7u2@xt^%hJ$eHy&G9-?mM=Z5^C<}ZE3|^7LA8Q2D-HsZw~O0{!g~gXu8C`09z^ygi4O>sH8-eGf&}ci04FX-DCa9)O2>n$w#;`gyW@fJP|% zTqd6)y5E$Zcks=sT(&ZGeu5ZJkCT;7f#*wH2Ck(_>&j_WlmqsaK#;U)n!P6`ClTR+ z`uK>TEN&z8qtD`Xw$Bkl3eD}~L!Ik%4dBxc@crCBPnQrtU4=^{;@LQ{S_Jo57rcIG z6Va21{EIDRg)6~YDH_i_i+rzvxu_uH?n7kb^xC_RKN-Qr&E!z|!tl{Wt`nFp@*BJA zx3aYEfigvrBb*h3Dn_H&?#?<{aF3?A_0<-R^Dl_6;raU6mymv&a3X^Y@WE~i;BqrB z{haEPL!iu>&!@C%DhMKn_S{C9O7kF9~DkRu^-@+m(-9I=Q9BGY2I08oU}_9{42zCVtlLN zU9%5dq6ON$zVN_6LD^iAJyj&YGkSC={3|e4am3AE;ZrsH*ZDiVtsi%{32R(pb|vSM zF5Nz$RU6dwy8|FRlz+VY6Y=hyzpTxBZQA-ho%Ai^1J+bFAybPl*FKQr>js?HDU~`D zbl%%a@Gf(d4O^DG4^4@r8MG7p+^}H6Svu*gSVrsF3ekBC@HKn<%!IMrx!Px1PfTnz z8^i^=@<*GN=;>M|_7*fU&6(OKCfjkhUhKfz}3a zPt#pVLHdY`B{+nKjCAO7hO0@k1dr=Yfct*sJL;+>bfww(rwrWP z9P8~nu7n-U`qssfsi2eA6!P5>|MH?&Hg7kVkPl}xib_xR1Ju+#5H53l;R7n&+^#Z#d>7Wx)# z5n;q7qc%fsB1M`W$7!kFxD3`_#a$NWm(hexEC$r?5-*BB3Xh(p+cirk7ey2P_?q~P z6w7WOpqL?-K>86Fb%TnCrkIlXWxc18A2kA~Ke3d<^l?t!AZrPHc>W+8@oP7w>^^MxlY~?i!gga(m}+kw4~KLmYA)~PSfq3K zQv=8*mVu3n7k{NvmM(RF=ha8gn=D&uPIn^&jS7ddxV6^HQ`9gt1U|BqGPoogQnk!h7zRe|}LM1S=6X0Oc`)Qvlw(oi~@lr%gX zmKcGMBId6spsbP@jew2K3r*JvX5n$w&zst~9FKTjy$4*q*nVasGa~wZdlKI)&L1Nf zt%TU|L8PwTw^xyr?G$=rUAAAa$x{E#(EVKEgKYq`!T(bk38dD^UK!@C{p@6bhsKkt z5x|zAU-0F86UoGh<%Y^d3%CRw5vhAvzj{>;$i-m@47C;C8D>+$;vT(tE$uxhR()m0 zq*EVWb{$ow^C8Y^V{@uSkqut0M(lWAjB9Fn<($0&y;1S5r4C~=s%OHQ1y9+xBa+R|<4aPI< zE~(nQd=%?4KCAc+3?IJP{_pIz8GMLm5 zetxc|BaELCucyF>Iw!=}y)~9y{-LD$(Q_2X=IvslZ%yAkThHeXf zpdY>=^V9PhR&3Myga4e&sgRH<05%^%P{w?JxsV01VU2wN-6=YN;O*1#Xf30)m;6Y0 zs+rz_7++o0kU?XT+Wd$kJd+vub-T9-YB4vuQ>(z>C%cjf`UqdgCFFRsT9CWXAL7Xi z0s_k~5dk|8Y6Dmu&>>SCk}ptL-+cD)qpo1VlV#-yJg(M{`ae(Kj(u)bFXlF4yxr_% zM2W8(6q)o`EuOG4xwm4?vD)LhyeDstd}K5aE_RrXQWSeN^z)HL*6mH8t#^keTvm$!D#83f1_I z+mS1x()nq&Pcm5}(e;WAd)qiiLBK&L zlPclQMAH>15V4*d6R!yX@q5fO8imNY@)MM|8b%}6)2F`oCv+?BDF57|ma;11I8a%( z$$k6>RnCgB767O<2lvFvL|!_z2R1FAP;;D#Js#xf(#OT)!Egx&2)wubAZ~f&FB!E<>^p*Gn_3H7=_Yj9b4eH`H~*7IL}mlDJc?khj@JcViWP z;m~)4OPs>;s-LHGep#hxZrJH6RjDUoSF(d$X^Ql9UB;YYfs@aN%j_%Zz$^Yi1xFPJ zDw%sY`)QqO>7jXz{bFe1pi%eHVLHdxz68z-lJ7tL%A!gzgu|ly1dClYr39qjk$@!W=6FcCwuLT_d?As;kGXYduWZBx{;zOzmBPo??6uVb1E{D84!{-== z7e{BI0bd81!@s^F;Ym{F;!G`NR!LO3Gb8`G3JIlhH+cVDw)cL^EsKaIE^Aoo?GrQ+ zc9!kKI}V>$F^{qV8&g*V=TAv@UEr$5O)R8*Tt;9>9OLygAuf37c4HMSWQz*y83f0> z*bM~C2YWNLojt6tWWTU@of*v}?2OeGcA4ID`Aro5`w9lg3Tqn3O4a{PDW&B&WThED zt(llmG%5t$+TBfQ&uij$X*?VfGP$R#qcYo`@P+`eIzz=_lBfBm?2>#Se(A$25j5Xx zV(lPqM3%rX5+khotikuA1t`eo%OagP=A64ZUe&ig- z2|IYdH9PF--o$1T48?SO@>2qL(Hpt&Vzb;jRc20aT+BcmcA3&wsI(HmHmJ)7z(-ZG zW={4U9EWp;h}<}{#6%E-@;i^#_X!yr1b`;CIvPu7yDf{o2?6)R8egeTeUF5ui+ zR$jww+vJ?lED6O^v7hF-Z(37v-W>|vt~th(!dyHY76eU9An-@1V2IthO>sQ3?6+UM@D}<8kY(GtP!0{G_G=j9~Y8g;UUURw6XC&KjJoCxazPeIQG+o?g z&6?lrczgLa6^*K5$DU)l451ApU!RojUJfp~JgDBSgk>QV(6;P*5p;8u>Q!Qf!T`S+ zy16?z5_qX4aIlz}R*M$6`;k9|)`ZE*T}b{GW#6ZTU{Lm}{L{2BTaB`mi(2om@g10( zLn2RZ5>XlS+GV(ZZTO-INjqG!7T4>@@;1wJVo2C$>|5m<&A%_I9}mT4^(rD#r(5*i zPYH>eDp+7@9?=0lFIe7!sHE_Xf>Q+FHDe`TUDx-SoA=KLgXHcEcsfN8a#gT*$Wulp z{!8s67Sqf}w5VgBoPB>dGF%$&?c3DBjxs6SCYaxEiscD!&FPY81UrNY|Jh)IjWT-K zI3u%S$L(I47Nk4ko1Jn7R_wjY>RsuHyy6#|{#E2mxcqIdfue8PW0B=F`#%UV9V>|> zV3TUam-rw96!W^j7wN~yPVo~r)qbY4G*`Gxyru!n%t zPNmq>eSi^1XbkONp`3 z-9Ew}N_7}7vTw+E@xz>#lSp6G5pg+)>9NxMj5=LSaEUwFWIeYX1&8R znWL&f!K3#}bQzPXUF39q#OgP2Aj?u_9D>JnvnDYAC$_M+_)`rOapCA&WB1bXNA|_V z&bMnXX9pom9ILY&jjks1+AC)Io*s4lMbo&SsaXT6y2bw84(K+jWuBCGMc~UWRh%ol zxoE~g*0Riy>ND|eP~WEb<$bHhM#sIa#`9%T4rKv2y1y`Wd9tsH)@VGyiYVMAN|93f zX6lmwO)2Guu%5d{Md_-4yU%xse_(zCej}4T zzH5eNWmmiYxoEVqf`41JWHxGss;W}FQ|jOT^#-Ne6kCaLQX<}cg4-r^b|Z($;pZc< zQVT2POx9OdKhO+)$;3W|_vIf=mVnw!w<8Qal|-}#YPYAhC6?Q+V(Un z1+eAEKPH6D=Pxd5%IOvo!pA|Im`_HORZO4pcfJ)PlFs+JHHaFw!gSahfb~`l5_*5# zH#v_iuJn@!V6W?k@96hsC-Wa*l)coe>N|6oWM1ET)qzKV+k+kkN5Su6cPP+8IiHV^rbXrC| z@ZnaYf36nY zosrCb0Q4H;|7)6{m_0=?`H|*Wev3?Di~weIFp7|Dv_+#&{6yUh9wTsH%PNWsRd=_;6f$(CV3ev|2`vk7CO z=lS=0J~#I!Zs1RBj9}I;R*w5rpnhhF15aJz;i8ET500Ymm)t9^1h#g}mHEh4p#*Nb;!_4*gaPf6a(N zA(=^g0y5cdk7MN~XKxQU6CEaU}+4sJ}H&J(28V)!QV*(j*~1+2kNr8iP~oM zhuy)+mckb!%DMGOG8@9dwhbAnV}@U5t>wQ732h~j`v%UBG;)FKdkMbiXpO>HG^Vz7 z>{qyiJyFKYVvyxU+4$lIChF-=nf~-~Fq|N4xI?(c^|vUFWzZ7lK7PvTz;~RZp-OA! z0$IZ81@{*urB390e@)|Z8P%R*iD)I`aDPTqJ$dvnP9XZ(*N@vjCUaaH{2j{iF{)cm zkH2kNco314ve}%zkIw3$=y@8@FiB!H91A-RKufWb6?OM`qNOwdh)u04*_HwYSykEB zN8;>%^e0MjE=;%So;-bS3YZb{NPK>fcgrsI5K^ z;<*nZLx7 z3vq~pT3(dTz-^^2BJ!@Da;py2t)jmWpZMhTo43Q6rWZEINW0>AInQ{c?G$Ba?nNXd zf7YW`iClS!G+x^jkL?xUa)hs**K3SB7uy6+(B0P>WUrtP)U-)0RG?7)KKi5!p(x~C zV9fkCOT}7TA?O3ZzhlKGPrE7IxiTKa!@A8Uhoi79+XgTx1Uz^XXf14gD}E#xBA<`r znJ`7mK4xOb!;u*2sGLEH_-e9-ld55>tWU*^Zk+6Q&o2LDb^mrnJ248FU2l16H5a%8 z@!Hetnp>Ab|H#HM&qH7VOjyqe#e=9KOL+?MmW&J=J;nUlAOH?Vvfd(-LL)nQlt-R< zIj3L!JRScX-bcPGE(*++*v(K807zyiJ4O9sAY+K*8-A9w`{0z)DzlzGPC-xjRxJJ} z!1=IhuNV*-O-O&55ErW$KkM_*y4fWRBZ(ts#;VYW_w;AScID6!b|(4f8mas!DeJn#+CC@eAJTNP#l06-Li*(aoBL~sx3I+FW zBoo83^3=Ld-9(c*OO_RT9kM`FD<7s#y2c|5JrVdGB`(3=Rjxjeyelw}Ay146;vR0QrP}v>$iF zd+TzW0nF$lk?WH4((Z*{V9{j5;e+3;f@i}@qE!mujOO7TIRqSm76E{Z@fKVm2)E0h zl=$zSg7Yi}kat#al}0h1_zz_8<4!qtjm`;vmnF41%brJ_9lpoukrn;FtY1rqM=cJ9 zAY1eq#!(7N2+*(pQ<`AL<@{`lm7wcQmoMgdmz(F=rn#urWY@ooPUhrm_w=7?T$vls z*{$aPW`J&~qj~?kx$R+u-!Sj8Tt`P(i2L|ab+6t`YOTftg1=|VMd899lE3?<)^KaX zo9w^Vn23kETro8YGbw!`b2V=D=&oGKDc$a?52WY)!T&62y75HeKgwYKNU(DEpS4>z zf@$0TSz~o0j`=^zNd9!-e(RsbTsL0C{O{T^qW@7ADf<5ZPgqLOvC`22wLN^tC05Z4 zHby_i=-8m!|8vc8&-9N}|GEi&jT57B{&}mxJse_Oiz6sD5r#&3bC@}-JLkab3W4h0 ztmxFCOeSP(0sW(BZw~GZro=VZl*9Sif@AI6%o|H%E^jdXv>f_|9L_EsKRdREj|x`o z{Ae5&D0W!}QJ?wjs&}yamgzF0X=kp7LZuCgzD-Jw>$p56?qzWfSD-uU|jC zeI%W9_~{s9T>ymHo4OCA)48H+*C&|_s=N?_Y&j%<1joi#yOcale*0^)mZAC!aRnZTQ0s*8cAkpA_{ z?fKOnZN^+rPfoLhlIS8^@#|1i_CYTrp%}p^T|H(Dv9`+i2-~J`VOp!Y z{amXe+W;W`5Jv}Gg`9K_n~$^5*igUvG<=owxLA_%FarxlxmlN!s~WO6dd(g@R!aJU zOe&Wr&Q-}C*mo?B1v4I|JS$59FSs?+TDG7;g&1S!t&@`(1?;d;#$7=^dr8`;WJ!>R zN{jY*9sAZ8#%LRnArI7hn}u4L8nq@PHchRkkuB1 zM#i?o(s{93bjEUG?o9nzDzKF3Kurnm9dpvs8J*qND%c-p*`_?9pjI}Ja=?u_i-YT- zx~WN85bJ$2&^mtmL*O*1=)gBG9&W0pjELmc$(U`SnzB_O^D~1t8>lzWIxnF==!tl7 z7w_72i#w_cqF>!~or|8t;^wDnyX4w%sa26G@sUTRul@1aXWMrg2%@)vLXORGJfHtq z&3mdeJfy($mTEQX8tf0OqSA#w`W4Q6&kGZdZX#@BgZ^}=75 zL=^RwMNHKlU*9h&^DGkX^^n`#pT%|gLd+gw^n`%on%KV+Krk74GSkB`*m%g4%aD_!+N$wk+GFljEq`Y`Awv zPHtRbQEBe1A7a~;4Xu%LPw;gUozg@Ua0OOt-0T}B9wULSGK>2eJ)X1u=ZA9zqK7Fi zv!*lxA#XvMtR9g zau4Dy$6P&h{p}co%9HjM7`u*aeXZ&UMfOfYnOdZm(XS4e(gp2P$TL%)JBwSV#H2db z?uj4|(QAD-$*KW3WB#_Exf*HH_i=Kf-(vL9v8hqBfiU@_?i?H!cq+Cwkm~qyt1>mg zehA6@ZxsygB^n6!dOJwYF-809*=%=DFl4_YN98=eT8QFHsoy2?-t-doyTnzeej>o7 z&CtJJOnao)NI?WyHmSU{zjhoD0<Ccf@dFKzr^vfbb;8~wsERCDy&$3 z?)6Ee*yJgz*F_JN0mcDWQh6moZr_*m-#nzJC|xf(9G zovFM;EpViz-t4hm`cV3V{7}Js70Xa(T++@bC{d;H;AhiP27o|l`>Iu!8CmqG|M1lT z2G!zfa!g?<(9ji~EjpJueX;YjQy@|8Ujz*k^@2)bXBt?`3G3iM0oC9(3AJXwnCf6- zVFet^f#_CQg49HNxDUco*_^`=5{G+2r6vM#6Fk^%k63;GJB$1OUe6mAl%Mgqmc=)5 z(Sn!)E_{f8Pc;has5Pj*9-aeSOsFk}H1#-qo~*GSx%sWQNkvwK^ig9brF#xRS2 z9kfidd01g;AN|0gYf0q@w&&2_|2#n!7iG5XehSo71oTnpSyHu50fV~dtUFfy2=478 zzcCpYf#~!O@>G=rp2y0yK_3X&o9WK+aNxFp`DqTioQkg0wg|NXjkG*7iF=@q0*)LD zC+F<+GBmCr+XR;yn|a$RY%2n8GK+#E=2uHC322W(dIWBMV|HXc;43)G;(DysJuJw3 zIKmSZ4!W_dT&A{9nUK*SMo_9Jodn!&1k(UMBu|n=8?eQU>h7hEw>lP9dMft_A)kX{ zHeLUwUv>;zJ`+X1bspVQX)Z7XNIO#KW59>Y$&#y+%6w#+2b$O*i4N2!hf){s-X%SO zG<*f#-^NbNesdy5j^E;MN|~^iZ|m#j4@cXa&avOHiyZT&iG>S`^S>#f_N+_3%<~xC z&8Ejjy1>eYeA#;sF&>Q~H7C=WVb4Yy9Xo*>PhSiC6c(jokgs#qFl_4Ff{jDHTLl(G z3AkJ{`AX|_`sdzr0IQrbX@!^H{Xg#BIxecVdmoht#UcbnN&))Z5_r2o2 z*R`${tPZyURo~zA_MZwGTO#$%x&k^uIYp1`bWbIyz-h{LdYl0q#+kVT{XX%bsBu_Vz~KI#%ZRvbaA3l zo$cjfN?*Gg%|`1MNm0+nJEbMD#KOo$AC6X=b%M8`P1gN^y_(*;k=K^tZK1Pu_7)O}q4q1Hb1=Jg8|Y_CW&xY2 zJ1KksJ%Q)Q!iz(>DP?-xDW(B^d?EL3-Dp9s$JhSUvRko9wLD@j)k<#L65JApnT>Xd z;F3Eysx+aa7974^)?wuRL}e|V=hr%V0+x&zmlR@;29d11w2d8sxIpx!z2+TBh-^uM z`>S*B?Tq|hMA`Xz{VM%C0_CIQk(C%wv=eOq1$6A5O%nXM)##vq(<_txlxjPfkMMCT z*zy<8G9o9-0_pI@oFPl|VM1LQBfVFP)@VEt0*m~aARx@Q(7s1 zW~FRecvd?DFbx!R3$iy3PA|3$&h9-b__U>Fo!hBf6pTh*T-@6g>&?%pY!!bF6nWcA z-+oNn(z&?Mf?4O}NOQRz7sz8!sDX0v6!pd;a%|viqM@xuzbBU>Yd76c8X0c=%$nv0 z$FhWpPezCsXho^D#jXvr>Wx=#NAWyxe1g4mnvmO{zxocShhS5-1lIq3Ts*JzXt#ItGC zV<|mLO`j1mVXIYq&E+maOv1Gmnoq&7cu>&luuUB=I9&dZqYk&U@Za1?NDT*pUM zk@#d^Q^2l;OP8NjSkmc?irumG)qzob6i*fmp9lohSF@0kwC;AcE~+JOP?pbqVTsK1 zRkus(P{QXo?eZVkTMMq_bd(9%GulenTEz1-Q=AeXG2ZXv#TZ#x$c)@cNqB_@t-e}S zIsKzZ`tEb~gYZJb?yJ&1TkNBL@%g$0oIp81&B97_Fp4$?kJBJ);I_<2=KaWhl*c5( z9ZjVtF%?3-Hh-|Oa5o1(10ZQi!T+d1yp149W$ z7!ruF`rd2uRSo0ZCxVXl4qHImG*UchMaS5dqV#iIXxs{mjl~hycEf@TogU|vD?96V zxiH#ZKOeTV8^oH%$;V{z8?iL+d`uAOoZoa^CFx(-o)<5&tdK9xA`KUjE;I$g<}bVh zq1ad(CyxQ3jLJ@XL-MAZF7DE$psT*LtIq6*=#Ro{n$HKsR@a+Wx2OezMt@ld&R~Z{ zh7ZEYuG`cD_5roh5$BGd^infY53{7VyTZB;r;iMBU4TIJgUN%u64kR8-@losE7H6AAI1`CKD~u|!Vj6^ z(tFxqGBMciq}s|Wj~?s|k~@Os@f~!TPian?wzOTQB%5jW_?0d(ARD9LqET$)eZ^O0?nW+|+$r5AgIvrOdLIorE%w1)lJ|cbNRp zR{@P+nl^PU(GHsrISizF4>-uyjVU3kM+98kP&rG^+((g*NB3^lEW1`+UUX?AbTeR` zMpoC@*1ZBM+|AKHYCpxZ{JXs zC#d*}3=zKccDwg$xF}85U`;tYq4v(|!|KO3_D?z3B48Ow$F3Rk9##&5EB;$Gi#M~3 zLZkfvb=S6|@uk1B&g)#4snqh}+-DTb-trb(+RsOSKTO0ObFd|J9EvC>TE4wU=mg>X zb5RAvhRGjK&}BTndxXpNejq(KwjfcaWMUDh_0x5eP9x90^(D6v<(XNb@$}rwQTKsE zpmg~2dk}OFdnYM%YS}E@$CA>1A>NE>QD&L}e5W|}ryi4a)=lL(BHdIa29w9PrbG#H z7(d@4dA9u7JF2enkeU8xyg!e{8N=|gZ*UR5Ua_mBbCHLEH!sK^ImXJn@HF6yZ3Q~bq6Rx|XT zd7GfPy_ac5e^`MaIF|2e`_EhZc#ln};KLJjcdJ)^(Eszs9cp89Kh~jhG`=}cQgwji z*4cNyAa)HD@m)rG62z;1g@o$BKGQ|Uf86ux+Wr9x7^k3glQEiYlY*I>kVIpO4XocQ zJtqC-jC6Q#AEB5stE_tad+iuHKusM`joWU)fx%aG5!Vqf8M#Cymv1uXH(NEwE|MD zgakg#iB=h6g|b1ehR4QSwG>)r1W&bF@L}HI-3+>S)cf@jd~Qw_a>fQRTO@^@WaqyB zMh~WuQ@V)_KKhgBE5P8*2lsnMI%WAODe^_t!0|C(<25f3mXvwZl%EXqA)?zyR!Jh6 zP#(l*+8!fAM|H0NJ)Oq3Nyp3`A(>rml2FYjDGSMAgV3KnJ^OQ*uQ_k+MJ+tBQAmx2 zRD+Sgp>t07hn0A`e-o^q;VVeuE_Vsae>bm*lMH_#`2Ut5u6gx1mWs{x3hBcv@h%07 z$PMrIMYBOp3M4$IW)r@)waaX=m}D=Sjn-n?L1Tnf( zXiuCI2b$(47v=`xvTt7c>ShLDpJmq7v;4MbK`(v_y#$FNQT}5<9@p~eV2zzn1M>l$ zE_5P1*?c0{;0N!Sm3ol9D1*$i+>=?C1uB&_Fr>^S0*9M&ncvnT0W1=o^dtkWsP!Nh zphkIV@+^Cqk&v+?z%^$f{hma<35a)|ecEjUimyPk_ypb7@qQ^WNv6^fNh{_#K1mfxf}zqZ>>nF_f>WV(Z8rKrD4^FbIhVN{q?D*9q-QFxLAR=U22qked7(AzikD4 z1T;uai6+p|tRNI6uYsaIno7%UX;D1}bvzPsD*S7?2gJ&sORi1mX~vg2qa?0rrYtmU zdlwB#IqYZhgv>$!m}=tfP1eO6_j3v^+E{)PDIRq-BQ~U)u;S2DI8RO4*_UvEo!J|Z z2uXE+4FoiAs8BTn8+y+%e(K&?=SuRTq2b%paLooMH?C;u6qYLVm}1Y<@u3f+oRI*& ze*?m8G|SXM=g-|?HQlpWTUE^3T4IDq+_!^?nnAVLTw%HWgoqH6wv@yWh?!LnDuL- zDIYV<-T!9Q_G!lbfrgG*NZeItqeS`FQ=0lLa5%QXJ$v!<-c|0R@QKhZWgaM{%v^k7hjzy?8a5s|m$LegfX-8Q|LuCpxh#J#v#34{eQ_MY@T zB7zh`T@ zyF6R@b#~wBs|a1I{2%AWY>G1Cri^NWNLbv&>-`@uJ=bRil+HNtH2Pqtf7y9?>c`s; z4e_~=eg^m$V$4%M2T%0IzdwA>ZcsDxgvA- z(D+X72>$5aQJd6w$PtajjJJz`IWu{9lEr@vfhuyJS1C9#7r*0#XWv93sQ)w zcKdJRdAg{+T+lTBQJ7G82;7xUdtp?3()g&5D{ZHK#&bxQs_EN@ByF+7xs;)_Buk?bo0o`8T_~y`|Gy54mChqqrGv%;l}l}Xg0zsy!Fa^ z9J4%WC;i&(P)aWW>T=nmv@weslfhiEa(jg6__XChDFK7JuIxG^KmJ4@X9DP_^@*S5LlL3EJ`i7lVI5Q?X{AF)6 zD{ovh8ZP~bQ1`iWPhZ9%Ho0V`^=kMjLE)#`bRO`6wdc>w3d~;ZUI<?E!JxPI@&ziohmf-URm?ArEAawjx zz*5YHy_V)SClS7+vrF+_pb$c>TI9LCc4KAm&p9f3PHa2Lla;mR=AMh1=hPV-?}K`~ zAw-Pw%6-c2J#^Ny_n7<)O9q;I{3n?I(- z_UNekUcncxR)d|E;-jfL3%(oI(5L)Q^6ko!=DGFQi)uHafkZgV%}PzNr~ZmyX+6&H zq+%#ODX2;2^xCZ7$584h}hx%zw(-VZ?Ajxe4|cw(u((Ku@B!6cU7Y16rd{CUmUig>$7R~QO!Joq8DK% z{!9io?j%J3DPp&7!>&S6{I0^|cNscB*(qn3q&n0$iYwy_e@Y;kkn)Z?U5tc(YC5lt zA@#@lsoS3Qms)w$De1DYlhk3Rf?xQ%jrm7#L18qrpc6%HkMU6qSu^^-69u!&EfHHRnjXV})S-W{+%Ng*+M0BQNmH!NA7dUSM; zz2r;mNce(6g3qhTnRV;?Y^8Y0?ZMmd4?ARy66tbp9DFr!v zy`QUX&GFE<--{g`C~^8&qd~mImKd2um#7@N&}a^+-Hr>i;!)Jvy&~po0ku7CHWaZE zFl|7G-42ha(NUw386PLW`XJrJVmuzq#N0H2BD;r*7Qcw5=D!qk`(P+yKg(;im+WA$ z)HboHIbteRF%^wiE&=RoQXnRB|EaZjvLV3^YGhGtnx_^#nj((H6cMa~S)wC|5nDtn z`Fgu^N$XN6QiCH$iU%Z62wj*Kp)RY1x6;Q54fK%@QH35*!TKX`>PF&G;H0LZKKoMB zMBi8sts>FNT82%fN;<#smQV5U%_hC(1=;UY>>iMwzS#xZ*!=mEv8IW<#P?2Tz!B+I zO5&U_oCJJ$7wm}$?l7L*bE+hqu-}*raXr^EYKv6Y)}wp3!tPf>X2F2RhgDiE5VOzvDq648 zz`7#rVq$%2tH>Hpp5$8^hJZoSLWVS5*V1as;7V)JbaD5|B`h|#p$LQR7T(tBS{d-+ z{n(=;mWH??irb9IKDF^=wSR{W0vDmfXh33nfa|N1vc;aEJH5)tTI9r#8*)Om6$)h; zh{;l?2H|V3QyW#-2Ez^7E@x<#?!KQ#JH5j7ARV{EF&ZznL}{7Vu0|u1d&0gW&$@7-Jmb*5 zZ_B9B2irfK;xw|A_jNi6J*e>pY>?roPn)aFw}}NQCN=cg+-G+~?%a=d_#!;*&-@`M z5%VEWV$D|c9h{YHl@@B{5{g9KV9zW>@1oj&|LnRB9O+d{|=AE_Eq!~qM zF<;@VF9OrMN+39X(D^pbY?Od1tJ)aEjbpHD0B<@8glq z#;LR2jy^jDwsV>+!J661-2>05h;;pscjgitS}HLG_1KMq_@Ua31oKeWH)AfYdc;r% z=zxN7w$AZA6JgeD17ookEfHGDHSXE^*2%Hww(LF0^d$yrTT?t)R{gg27Bq^km&R%6 zX#m}u38*QT*N2l_S90y-1kh&6*I$<$CaCRRPh5L9x;MBKG)nj&bAm{n8aI5J?UU== z#J#>a;@yo9ge86a2(TG8pv4D$>LVXMrY$k{UfNqJvKU#BSX}5T%H{gCOHRlzxy6o~ zLmYf#IzM4p9~osc&@PSRCWm1r5VK@-+Vo6VTPx=Cy%VzjR;EuaktPXX!gLJa~>c2pUT2jSlAjBT2q? zN=UdRJB&KOO*nU8R5nEi@lfYZ7*Jj3YB*8w4AQyM+3Z9)d-zN;>?xVBRgIhYa(==B z?KzAu*2zY%F?r4DYvh@>S@K6TWBV$&X=F-CaT{EZQS~B#4M6 zUlk|jj#X&Q>8{?v{AgBR48bidE+{Yhp6=`$UV|j3-tG7ihYP{9xUOa=%06y?5`sTC3px&$CwRu7O z)!jEMoy>wH*6Z=`ZF*YUguR{|ta|Gp^QWpiKue1$RCnk3C9-0uRdvn29vGREFs3`$Yx;92-Ia8%#bIDWz;fsb;L`{v2GiMRh%s?KNK0WiqE!^s;z%8o@wj?WHl znk{g8ox%IiSrdS*nwuK7R$twqjL&f*nwy`Gj<*V%8o!mL5}|f{Ib5OjqCZd}XTVj)S!sojuQjVtc?UHpkUDA(wbj6@_tWN~lyOdI0n}meAmf-8V4M%@? zBZRm_T@npUMIqhM3jq>LHHqGqjOf?)?fZxEiB3#iU!F6{MFV>vt7qM0U9%H!O6_QP z?KX6-unUzW?S!uP6W-?EL%+a1`<_Q$puwSe&A~ zijxRfrKv)^qB`8C*`u)dQ|(;R49j9sMuOtsLD!StK^H;s1N@0^+!&N#yoK@mD)_gX zDZ=Rl#SicINXJeNfymOrom4o#tt3_skXz=@8E7oA>n&%pUcS#gP*I?e&5}mIo>eAK zfn-`%7?Ok7hAH%~Z6$Q)tS_cGnrr2FyXqjGMM?^7$)&*Mb>5_KM}v+-B#$~7omOO& z7ek!EfjSP+B`V?CWAz-ao>KEJZnCW5e9A1#vg%a{WdJ2JHPL!zg}^ceK&#w*JSTki zqSn^^5BV=eGfafK)T;d-eO|haCfl`9=XiSjl4Gxo)SCR6{S3lX#;j>+eD%;B;TAaq zTW*hVj!nW_uW)o)fiGAbN2uRk5+x`W$}wt_w0&ECDEp{!Q_FX4w26g)OU~c$cxcpQ zch22P-)*3o^UPyc#2p=Q&Fd=N(rgp`5A32sa&_tIbpS{&V7fow%-))O^yzp9U|cDE zBvi62Itn+vu-H@tT;VjEM3p$_X+vhz{5TuVJ;76>vNmBm!EQ;y66wYonVL%$RFq6_ zvrD>*$9b0=A?S`}x3|Eks7{F8&XudfCI>e{@`AZxc zJ=r3SX+Yl2iLNqTwf&%NrZ_HKd9d!Fkja7TYeGGlg+J;g`6hTu;q0j!_ z<0f3}aUpF$eg73Zhbh)wc_26W*gKNT`!VB-6wjs}u);9iP^S1jEWOqZ~u9Wq_}#IDt-3vXD? z>?bJx`jxo7r+yD?zG~ZWHU|(aMtl+QT-E3}9;Df3&6C#k@T^Vp?N=)s;~h8OU?#5m zN>%Rjhq8yVmbhI?`17-7m=vhhA8TX$W^KhECnd*M;RB0@HUR>{Z7TL*sEzxAaWHF^fC`3as`3Qk?zR|oj|cWMgZ z%-4IAzMYQAIMM6FI~2`7(5YP<^2V4DObvn)4#MN^I+=g4qrN!meMT^)cH>_Lr|yqG zV^MO8>Lcq6NnHOky*-$B|25zpXS2MJH@gWL@Y8j`X`C3=v*jX6h%?0OXNHM$DAfg3 z{+8k`m(7WN-aLgiurf3pPnpplCSM3Hkis#w48*>VW>V3bI|CRmIYc#Xv=eX*72Hi; zx%8ywjhxT*C!%4`o=UxBgsC<=sN1@UDNWj-!Qw+xA6of5FXwLas#mgh92?@Uc zc5NYX6GO)q3{1WUU4zxWpDo+|eb@C1sMjREBaN@EyPHUMzUi{(E&7S6cs+S_t5gV> z!;_P#=vkvT?*=o1>5`P@1SnQlJEiS&t|~V>GO0AKIC^Kb+bV*MkMn56#9ucK7{rC zzb8gY-&`nZ7nIt^a&&TRa|d=^AsY|LHA~@V%TzXDdG>%v|B)Oa{!bqF2KnzTcg+@vG zX4sG-D6{5dU`r^2}U5xkn~O1)Trq} z@H#cDqzHZUdS0Vf1%2)1kD=P*&Vz!2zQ$$y*$5`>m* zVG1><<}T<}6@aGtudO+fxG$xYW(PAHQv@h4+>NCWugPnO;;CjE9g$#vu1kWDLxSR$lOX@lJKGM5@?dN6TLy23jZeAv zn&Sj@&I`2`M0G4i^u<-TT7aGz`Y)I0KYpokA%5-sjZt8ErRa7ZGqf9(SXsRHPNMp;=^>B0RMmD8%r~NfL$FE9WW;J|~LBTOSrrX{>w_CB(cw zo4{Lf+2p()>B)5MQ_!dFh?1GHS@uW;>DXwu6sJxi-9ylW1q#|2?J^KAc&Q^lUF7wb zDoqwIbaYl-tIm0n#HzbX#acn-LGVJ+(nv6EY@x*4m0R%M7l$C8_Yyo_D{Bz32Xd(n zHYvSh4ZSZXh1|`G&)mCls#aCcS|sT0)4|k#(C8Fi-(hE;DqGn~oH$XoIEL#bO%Qsk zU+(XF(S{%r&LPa3wC4LW-PSJhc#?q25)H+X;erqW&ws9QO&;hqlohhw(7>3{lvnqQ z)Z%e|!h%ENfb1f9yn|8PPm*;}1oY}BpmmBXfWei6NHbf5I{2CiiZfqMp6M0Z&SVqh z*ViT~b;aIv8V|cRHclyO=m`N^PNN5$YOqfm@sy$KxF@5z3Kf`oKOpPEqYO7*r4=)y ziEkY2gIZ3U@)GxnQqbfwsC=ar)%q?#jf>RUwVk`A$6`7##fa6>CMs<)JaVV7Y049$s%HEUq(K z_DUbuC`I@q7byQ_?C__&kGS*&x=a@2r_J!5!FWTp?RU+)xARpFqvCg}ICJ^C^vFdi z^p-M#E-{r|{yz~1on(`DME95mrMDj;Dj>VQv@(`$`f&|Jgex~- z3MiB+w=1Ep;6z_u;eyss4am-@jj0FS7f&J`<247AIr8(CBykk2zHkmX@0oMZ&I8wM zeVGbybDe3fFz|x0Gx>|9-Wizr!vqy>=M@eKm{TV8QJkmGFr-JQW9~Mdb0v^-!N*UM z?!LA}U7mpOy~;r4k-gY1VhZ0wtXIOSRlK|dBNH@2;z-ObP?e1UtqadzX16{TVOug= zKB;VuIGhW6aroNAsZT*92w*k&b&xmnlfkr$K?_T!?##&d`0|m1$4IR}hH{SizK2G6 z&^4{A*v33D6Nk(}sDjfPBlbhS-~lIItJ~p$Q9_i8nK>hBG!yHSSk>d%%AREfCQI0wwdfJffEHUS!QLB{t!IQa1HqNe;jZC%3vU!LE z=etVWoAt42)GBLGeUh}!Cj>ez3%(%}Rsm*|xH2#vd07SfowW0h9mF>slI{RFsRyAUtYRe%}LmV{URf-s)K&co7FhgN6~bsXlDek24c-P z`2iiXNQ;JL#@mda1FqDO?~w|J_;aYwOK4}ZyGkc75$}6>-#*`lzK>P7i131f+3fBx zb1%}Z(ftW*u)p$l&N1D_UR{tsQX8Td6dAw<^88rL_ci#0k>;#dyN)9YkF!juS0Xwx zzT;%;fOODw?)I$^YCGT!ZdUYH3bulua18ju4B zO<2KRrL1#+zXi76|Cf?6+-`_{X+d3rswAXIRzgkaO_XlW8U{#&1=M zV<3v8W}0%Lc(~}%?7$`33;b4~qOt+>8Qtm2FSFTv)vvs5{v5veU&H6I`wI@vr}^#v z?Ms&;n4CPX&U;lTe@ki^T>?E(uY#d z2qBVr_6zWN8iiq-MVpehWEg!dT|#PGYGl2mXqR$I{*s?ON3;2pYxF|th#m=#$i`gd z`OOkgn%n8L9F90sXuCb4P}Bj5TI#|C3)3vAPa|@V z!{L?gXY_!BQ;W)Y$jGYZ$H+>Py0kZW7xKzBQE+8yaYK{>RYJrdKpj>z|l8M}zXt zA^A`Dqkm^_W7hUR9&>T&$9q5v#sB;zr#l2(|6z2%#Rv_`^8Y#P^SiJq{D1hMVQzNc z;P-z&*xsmNJ1_{SO8@(#;evQvCDA|LN4jA)UsxMD6DRz(?t6BAHmJM z0>-Sq&_(KsnL~Aa@_&j{DBH4MXPF}6C=+aw=j!H)Oaz+V&Wx}F9Ha0<-GANx$&Z7? z!zjgha#uIc?Wn!`njIm+AuX(g|G45+CnCxZwwJR&IW&Qk`SZ~wS~ zB;2PLPVoDEejLQ(r065amWwitw@(sIopv;FmRM;&zsrBi@?$Z|UFk@zZx^JeOxn2p zksuq7254aTb%Ft{6l?oEpl6Hh_S5I)WszC?_1C>0`kh;PS{ww zwtN2yAnHq(a$}IWij+J37g}2n?^|k;cUoqG@^Ld!hpmu4v-e~arHR%xDjRRXrC z`3@WX_M$_mX0N3tQ-sIMi|^0OEnosByw@T?@tH)PTcBkD5gn4zE$~;#@k3Jto z+Q&Tw2K8@4Ujod_`Orhf*~zqjzu;Hx_T;h%0_3j*B4HEwK@mgB!+mI=^|k2+D+jQr zFqt;be|3{K5%JYlfc@EaI6^&zZ@CB}xWbe~C**0+&hfY4 zG4vM#UzE+bbDi_|V&R)|%u%5N$WndF`IkB2d8bAGoB;1x{K}0yZ%=B%1KNUvB*y;4 zf_dS8leN#abLArx(_oeB2(!8fAR^qxOfA!jBk+{@S-4Kz`6>oVCFsnezT1-W4DWBte^$o{;W05&Y9A|EX&9tZTW7y1y+>z(@#n@mm$` z$3TTokE~_=fKC{X#4DQeIlWqxDp}ZnBQ^OkMOYrAGyt1=8x`82$Y(<3GWj^tXFqtK zX4dFq=#dey2>^_&OZfVLAm%vC*)b#5am!E0tGbDGC#5Xsz~|^xBQJB5C$t5|Ju9yh|z`+&#!XaLYd{V(g#R46Vyg#&7CC?ALAF!|S-(|j-d{++6* zlTcNy^p4o$MFXt0vlsOpqr&~Q*D?b@BN@wGF>L8jh1hznkZA_gXg2f(Yr%BJI<|NZ z#oIJdk5ee0Fieb+ol}5N0qbrSb759wfd1zH(#D)v!~SOt_ZD6ZIu<3DCHzZ9pUPRH z%2(yX^cRbAtytw3V8^L%?d9N38ZB$5+Fo9z$g5i|^#G)k%ZtYisB0gM9#ZlYH63Tp zetf_5^&wGG_M8kB0M+&-9e5nkpe=Vew@yg`TL4&p`8Ve#x-I6mt0q(NZ&Tm)iitw- zIZsc0{R*Z1?)aOvGD~bQbLHml4Mr2jCsPRfsa^K1wx9ukzrZ&HYdfM=HYRs0By7ED-3B*0GgK*=D=wL-{f{2b7DA4#|YtdlYcq5pO?RiNx4t2E~) z<@qvnj%TJXxQbpNh~1fMAaF6mvAJJcxd zv-V^BcN==T;iGZ&J>XiQD`QJa*os1l^)LPC>L|T$^YVElxZ3L% zip}_^Yx#$LHWhl&uio(LK|Q*L(PY5S#%!tv<7y=Bwl$gNbPDyy2Bk6G(P*_H%*Rt6 z&xF5+rN3Bj9tWkSfF`Cq)| zD^0dW;AeT_DOlGsa?8G+cRL7XF(1Je+>7AjpDPsc{&j}2ba{!~-Yv2%iDk84R)>1O z>r2oTrq802own#4S~;wIZ~Jpv+3+HEORqDhed{%j8{l6_NLRO~t1DF=oKsBa=u5QM zJ66La)7iJIW${GWRU=-ufst8zh@Mv01FM4de&4oMQ1j6~@@&9Q%+QesLU?3Xw9!Zz z9kLv(1)V=RAurt3BN(=+`^;U)!lLeqLEvTiIaaB+OwEz{kYG9H3AntKWLP^=e52u> z#-PI@#xg=HhUNC{RM*OSe$Ug)?(o9ylKEO?qik-RC0e{EAmrSo4_^bKTp(0%%2o?| zNB(E9G!kytb_5X6Hc9*?Sj)8XJfANKwevsD4u@(q9hpRmBC$8<-#tA|9C#GVZ4~e0 z*R^pgmS!HTuC5X^R-mO?37ZA`SDEM!9)g4IG995MRfH5K_ctB;xlbyKn1svvEcb*O zV~v~CK#G!X-j?Au1Q-`%H%q=)7>~)92h8)oD4&t-^{r?>E8VtVt?gIj_qtd0bO`H) zt;opY3d(s(P@Hzs=LN@>>`~rMZ5POy%;S(|pegs8dtkt$-?LqPNR&&Gi|%n(F3aBw z%`7!8w5dbxmW*vi(FAKon1Q~yHdM;!Z-}pN#W#kZu$~~nd&LK9qo;}2pZK&UN+oK40n3yxaF`^G|+94=;hF`pO&igzcU$^BJ2TAom4an zoWPy?4D)&-U5@E@!a2EOc4t|wK2O}x#`_26Er25tdWd-Wp*L=;?!ME6t;4pWFe!YJ z$zi)8;YBX?TgxKKp)fC}@s7EA7z8O0>@l+eZJgr7xb=y7w&b$!r%F308p-q8-^G^J z5Sk&sxhzy=@HUKa8i4yNttysQT&Nmkk0NK;N$XoURONM1meXLjI(>~=z^2Q7cUZD@ zb!MoLZLSVlBUF!e5}{?G!8PdKg+$dSBWbShb*i21VZi zy?b(Mg)4xL4Y|2B5-+U@(}KU+XU?b^iV)dOe2Na5wL0~zmrjwZP~C)w_?bx z6Bp~C*-sBrj)SEyfHC*xFo7?#Y6!n2@}%5L=8gSqNi}%3%UJmk`{O{^8CDnIk$e9+UtC~@Rvd=1YAAE zd6metDY~j9dZ5?6u~kj9qJl4!oSgHsZ`A)*Ij7SAPbeRTrwr(%-@aqGQ-1}&k?i5L*-GWkKC`~Pa-57;RyX+%Ia!2x))}0|Z{IdHN4+U;O+Qbdl zjECm7CuCTvR5bMlltHU;mXscJEduK5SJ1ig(Bd5$9ZpGVVf@)~%tcTxJ*Q_zO_S zYq47y;h048jxgAI>`S{$oNa=!n5aMaAkR^Y@LxlC- zb#aqgfneapXr8@2yt>$>aUjr@KsNiMK+jsN)wgX>S%iVATr<1WvU@0CY5HaCQHr$( zp>B&O$xIeE2~{bT4*1SPX6`3OPmO0z!+}tZsO%qsh&)12hBcRD;$AF(abX&Ld5RdV z{66kfTBz4@B7#K$xC88X3Q!?uZn<-nuCa;Wy%v$xlJv>`yeI06)A|w)d3J=4^>4*V z4bAXT{$RqyB^Hrwny>GhoK4tpF8$bPOz;ht)?G^BwvM8`DHQyCV=7+pY-*+sK>TfD zuu(>Hi~EZ5(}wFt>(VqDs5$F<5*n-|CqG%wsdAfc+B1qvG%fmr&f-LkPn%kgX|RKV zB+3h-s`izn@2PE9T2AbzlJilUjnZ6oyOc2wM@P7&f$S?7!}dLTVQGcOSzSje6IN7& zAavPbuQz8HY%!Wf6C~K9XMG}0pIzvHCW;1!9^x9zv0P2?Y`F==6-^F3C2 zK{z~AoQNa7>{m-=2ZYW1D8h3~`~KWN4G*)WyyXA>quc5&kRppe)gDuc5D|7P{m@2$sm zcTRrh4|$N5bT~;w;K{rPN&EBfKgUk{A6Hm~@h?`*6GU2>Q333a!nZytiHF7V=@8)b zkJ7QNr=usBSx0}~$a$t|6&wQSr`A`mkQt-A36;5@b6$bldNl3-Q{`J&YVY>R+&tn8 zyW+nJL-T)~k2x)tx@ENv=px2` zY??>aCqgaIa_ioj9m$Rw#A!P0qGiYzS?0dvuTB-mXS~)^?e{nt*Plm~u`8-FJa+xs zr}vgG9Iw-uY(#Xswql?(p3CxdiXlgOKzFf z{Z7AmX6&&Aw*eavh~!nKQX0+vLBQ42za?BlH@y%xSG9a*1X=+j!>9evcXQwV5k!r@ zmKJpRzSk;+b?HdgIvx?n=3$%D3#6F^{RK@j{jub{pW4qSTKi;`082u0OtJl|pnwVy zb;LhLP~70ai^uBZ>b_~-b~G|N z28{_wHjm<=yNk$Yk>2V4Q|KNpgiS z)NyLbjS@d7-sf=oO_Wtmdq539XkHc}Gs1cmr*EBbRCe}DTGD)M&6P&;V0Hd%d9D?M zG0pK^+QM~vvJ?-sDB9&4nQR^QYd0DVc&N8N)N46Bl->j7Oc^$hfxb)U2Qja?N5)!T z9AgJ*6JZ>cF`l26!?yEaV)1c#ORwXHJPm6QI-${&-5#-CC7&%_K|NTu;bXI+u14cB zTWm>_bROMSRfKXR^t+`Lw9@6nlHSY9#K?Xe^kKhb;y1Y1$>r&I>?$LaKw+k?y?*l{a|H z2&96I)puc7t-ypN?%M#&Wb|DnzbQn&DRcZatebN-KR$!nv%{27x3=%`s7>0BgR>p= zR>d)+Ta6~`y2#x4k}amPBu|AUsBy+Cz43c@6SPM}p2g1u)18diC`i@KO5ZUr7#2Z! zWu47Al||$a3FXNhTo*90K-OiWg|Xu{Kp!-Y3MNgKjRhf-R0WBnWMhMAWn})!KC_E9XmT?BWwTVdVXgj0w(s;71Ps7VV7!|YHdbNry}Cmv5Js13 zRbswrzNKq5yd>+7*^nLD_z9f|{Zedb5_b*52VIt9KayQQw5rVgLGzPMgK zH)mYd+PH5$H9l+K-TR^Wov^7K74MAq%x0OJX9C|ojjNAyMcK!p%iO_9J(1eU%5>E| zw4=mc_7rwBI8Ys~<N5lF?_mFTV3|ilW!q$Zq&=6Y1&RDZB2MjKlT5h?k&TjY`eB$5fzaZ1?iHKj-f-k zK|+uQ=@`0O8l*uQh7OS)25FFzl4fX>t^s9+uJ6?AzOUzc-{<}A=lyk4(3_7fj3nAesleS;aNvFT@S^gA*%#xGctL^f9q zvIM}J#~E7&GtILF;Vd{u_3<17TR3nFr6~8Sed^+{#Cb@#ln4>lWe5R zm}dAPb+$t2P$WW$jc3A9_>*4%i&cew>&3N$da~cEg|rEyDnZ6slMmnyiY2A$x&4Nb z&z_kUn}=kNckGcGL**<-zjD*Xst*(ERezr5A`wSsTNmdDbQR`J!OE2knE{`v){eHV zk5kh|iUZv&a+Sqc`ayLglN9J|dGO@J*iPVRbOrl^41Jc7|Zp|?_?lcY?WX7GVUAr{0gT4;f!_eYk#WLCpS)Z&QNHwi61n}n3YOLcqbvo3vzV@i ziA|3xkIMmHS2BK;joNA^;CxPPlHsA76@17A#MXoIoUH7 z_l_@o#6%DM@kCcuGFcpleTCIMG#i`!igJfWBlEzO>fiN z){jj}3xhE`4uRtvc-MW8mkv&7vN-$RGp&U!Y$*qV`fYu8oJsF%U}|*dng|Z5l#Fw*MO6dU)+Omb zeVRAG6_BEAwKQ6{OZ@-NaCV;$k43rVJek52jCD!GA+%8}PEKagsaBA#8IR)2VV%L0 zCHy5-$g+6r8Sk^>E-0l^N@#o0sQQ_i6m6~g=7g#hQ!mHd0P0uVxTHKoqM1rc;})zJ zKkd5P1iH1g2S9@dPyVNIR<|QH#>b%D)B?g$QW~kkS36B^chyFSeHMYXG;LQOm9+|$ zEslBgn-);6UkJqmyM&EKOf28Rm6LW)0=*F`j&HR_Z3>*P_lY?!WhY)8nRaT#)T%6e zNr8_BS)}~{BDon74X&X#^Mqr1Mxe!629lPz-=j1HjOa*gvgQfvH(Oz*Tgq#Kj;n8w zj-2Q0Uhdij%TqD=mc$5R;nRI31-mScFY62G3X9g1dX5>iCeuJWe-$IU9s=PP?*&T` z6ZE5@rN?%1eDf#XVQG#Fp0#1PwSbF|JkrboviBzY8>(Ui$5MG7x5Lc}~oy1Uv)Esu_1yq3Z z!EZ}J2(jbixhQZZG01ht9c%`f35#=V)+!?@#oo*eU?3p|MeWX(Tkss`Ta0sGZ$;d4 z(O+o4%4xAC+kW;j94Ge1Ob)?S!t0wASE(mvwmo4L1pdUemYew*wamTAAewf7W4w0Mq|bh#b?-#Mw`JwbM0v`gEki72;2F7FWsSecL$g%wQ3XPr zq4v`!6vW`<4>OG?uPGRz2T+F?^>IJ328iRPV1XG_mf5Yad+E{NDXO|+rG9q>!=N8U zYpbtyTY(|WBaR${I*1#HTyd!y?xD?zZh>00`|EEd9S*;?tq)UsJyI&MH}TY}4U)Q} z;`w%l@|rHH+V+iyKA1y40m}Q;d83_Q=jl_E%k-|A-&{3}<|gSV#B7T9no~YGRb5)v z`(4GViQb<{-0Z(irv$(E{Pb1Io7ZFq)Ohx6T(8|hwFr|}ZRtwer}?s|3MNYb=tIZR zBF5_R9^AvF5YRF=^-m43VE9Z-8t>H6>d{|@Its7sr=?!Jw;7-51Me%6R<8EU59_rb z5pkP%yYF~%piqNV2&?r7jNz7!Gtf%w^N0}I4sS(}R7nOQ*YAusY5qUxD$;LO;ThSe ztnaAqXM9(*_|G)sg_+ArFmt4}l0Rft#+b@7F1Z(|F)q1vuGpDtmBkYM*<^9Oj6?MvZV2FF3*D>?yeHArvqai`fg?Zt6Lh0v?H60N6>c!?=JR2-;pvb za$o*{Wt=ahj4a0MiO;h$s7WBq&2}XV9d^8ImHJPquMY4$u^;YMhcg{#l|#(QR))_U z$xaOnG_xc|hDl=;(k?WEFY>yevBoPdNSnbYDW`d;gQjEGAmN$a+hYZYuff*C$MxBLPt|gC&O~&GN3A=#`1jN6$UXsCdQyO@a z_QW;xrgA~0C0*#KLerDhc-&)ZqX>#X`3dP(jB^`Eg=O~cZ-b)CS>Qk4s)GOS#Wx!FF0GD5(p#d%1Bam%)tugems{@E2agGBg!cx2wTGmN0~dv3Qu zKbWcmsy_JC{DBM7Hno4^ri>tkcRq$<=PRCTTu0z)DKpsaB0-<1-tQxk8Krae|@1q55A~)TpYl2OxW>jM7E!B z5@Q582)fx7gjP*GH$Sy8yikwlafg)Sy=Zz?V}LBBVQTYrAS4)gmZo(P2+vzvjpGQf zasLrVZ`vQ02g7~=X<52LSdmVF9jH((j6AV;eLu}sT`^S*wdyQNw=92NpS=jvCL;B6hQ+x-~?W$9|>#dpS#_8NrVprSo%So!u zm@i@jxspn0Np}2N}hjQq-5As!a>$3!tMhWUrV2}I%R`Pn|zHx8{&vR z5WL#uW&)?U>>OXuf8(eY609C_x*pv!KH4?D>;;B2p~pIHk_$;3!YXVB246EL+6+&a z%(tI#$19cu*d2ftu2!vVc`g@kwsZpMCqZCkAvn|9!}`mJtO)9>`IqAtMz;gnqu9k} zdmLNC$Uf_l(oD8}lyGjomQF?Jm4Lg~c{DRpn0BU%%u+o-;h(6@ z(z+;&u}$~BAo_oslS}B5!;MF*k*w=V03d7>Zi7nrb6U5ovhQsZzZ=BsaFyLz3rHVz zJF%kDhhff(D4}>FGY>$c9w^0;4pL~`RPN7M>dk_+L|rlNECqWg{(tFpcwH!fn;K?m?ZSkH30L2AzyUCn`hK0`S&%xOj|)p1b32RMUJ)-Ah5 zEtvw>oQc|37n$!#pH00g9f}o0bwj*1v0JiBRxV^Bozp}#34>PJC@glk=qKCWnhoQ5 zi1Vj&P4a2qn{Ik<9H>4eQn)e6wMa>LHIY@O1GIKj)%AFVEZ&@q=XXTzKF=DU&BA=X z>t&j@g6LpZ-{sfLy1!&6QT78_>6zv;ieEoma8k($P6O{_0{JU8nY41{X#FbXo$2RA zr$u6(P{(cmLV{%OA8|6jeb32I&6?yZ!7mQ{*9>K&^Pl~>7d%4P_sSp@P+U+YSEI$3 z!)*17&s3J)1HY+CZ*Y0O3gpB5$pe4f?c>e%HYR%7ytl?`Lu)hjRGVV(_AEB;Rcq>h zI-cF^l&StgG2LbaoeBLE8$FBP1TBz6=>~cg{1@pFV7XmqDKt=F`5^XZ;RC`D)xMqe zbX6yo3}po&g-@4ml9dgJf<~2ixPtkT11*Tj(z}c5x_V2b`$I-LKjAyl25Cmbew5*Y zU(psXVHiVFcn-%%^+0{sXiCuzP<9tIXa1rh!~U4ZBm;cH9Vx_RJ?J3!erzLT5pz^o z_FfCFfmvv*v2KH*=fT{T%$y6dD80FcF$QQs^EEKwjH(S`%Y-G#7z9e1YB{`RuN2`s zc-{~zn&>#Vqxz5x8DUp8b~R_o-Mc=}o+^A!&bJaUe2x%4YP>yLgIavS&ZKH9b#s}= zGsEUok|#m=+1{&5OL74WN<2gX0AYvZRo-8KtL+(Rdd!le+$M&@W1eY4gD}h(MF--v z+*>0pRxEs7Iaf2cw2|+x-%k$Gp1WS`eTEaOezeyuw~>1}omcx}oKd->p`TOc&>6%y zKV)8B+f%(X%A1Q+mb1j<>qW%#WgI*u6HUv^ze;tP^qmoV)kZ7fXKI1ho=3NBryQC`#ao(E zy}v`~_jScv;|g*rg_c-63Z>rMTbITiOg~erF08K^9F2jT(!dNL0gx&D{>(Mq-_S7i z)t+>t-L>uYUY(|`$fQCKbpdG&Kx^eYq>k`t(8ZGF%MF!Z8YG9PcJ6wB;>)6X@FpWr zK1gDYG{?+Q-{bt`Y9Avr4Hw38@P3pZPkBW$)E7_7cMEPo0`c)k(&?zmm&6HeCeKuT zya$5b+#bk@D-6{GhR3i%s=kJxKlI%?IhuiQ$p}vjn2i+LE%H3;PF$9=)gDKFw2{Bm zStwRocIH{WYS5uHoEX`MiORa4n}h#kg_qfmo$d zY+fFX?*#>f3g)kl0inG9>ogw$oQDqpvlCDZJB{fI-e zEtqus-4o7E2W*UpC>`xdEx^|AV1Uf^@r&=O=A2wWPw+;POC|$8`cI}SjquETt1!}} z6S=7}2h(1t!D{7@6`PDB9k8?mxQmUnI5_z)`-cTooQ7^1_s3FCW~q#M5y9B6E}YW= z>t9rdRb*)Hy@ALGh1-yhlmZyaA{ED09_|C@l1Ek^K6|_N>gSosm=NzViFr~TX0!IJ z*g+CoL3$HELSBbq@I&0M040XZQCbH#Rxk@_XwT{~vULn7kaB~t6=wV$kN~FwI2!r? zln~oK7vXXHqQiJ(P#CxSfq#>M;T3Q$p7`_anrHd9lA5_Ga0zq213z~u+}(a&<^Wgt z0%Qc$>~(k{fQCDRlcU^?ge+$aiY%7JiB&bYp)a z%b*Wli(299Wj!y2!=sF4_9Sns-OY^kaU2gTnN-R59#02thQwSWP%>t5=J>{UH~K+U*BvZ5MqawTW?- zD|X*w582|+&tY4cKRu>&+S61aW0=s#Z@z^XWoEi8ewKs$RK|}s(!Z=;f`C>4IYH4P zM*zd!UZA-cqHv3Mi)Z6lI6{Bx0YGY#Qrf!~DHeXU7T1=F%i*(c;;pv*R5Mv_s=lBx zYIF4QG(i{`@NA3!^~o>k)1BEu_wN9qJEd@SczumGnL5k6iA#~iZe**5T4-|YVBxq? za`Bt=vlBFQ4PFr_3x5Whn>{<0BO7U1DqT8h9B+3R&Xujc{`mE>>MajIu&-_^EokE~ z%%?4)Yy+lw4@4cm9cHp#aULJWsqm@yVKrV|D34j&do0;dsS~ErC|}ExtQcJ7>e_M| zXtxR#JKC;f3c0E(3VpcF)&~5rTs*uuMeee0`8{d5HT475UIdi~gp+`}n>DTUUaXa3 zdh^e{et_zw2W+viqE-Rt&51kI5b@PeXnA%mx?HWJefKT)D+z)!gW#&)c_sFXrg6i! zW4*DDtP2dz*(g4x^SRRL?TB*UbclaQ692HN8=Kbn2+(Vq{IkgE9Nz~5S2{vVeB z_>_a=|3v}EoksruWZ!_w_H$0t{1RIwF^7V&F{H&#t8l}%#Z3WNndTPmg5$j7abOt^ z6zSl0o!c^(GD>#(WjAPaWNnVeH`AA1yosY+mkW*^A5MmJfCdq!s6y~LAkfNn`&3|9 z_#Z1IVneNDkzqu-+O2veBUc|vfr;m7nS~9^eYpH1!Nn}C-~{2PEho=+H9@Bc&*H-R zNfo|b0gnPz%8MUrzq>91-JRcypS`+SISd%xb8LL9SJiPDUQQ_@zcDAF9yQf6%*roQNaa+6`p=sZK&9&T!!R@uxs5dDt zonDI7Q*$ezE&f&3t(UPRa#?qk;T`LL+>!3<;Tp!_-^wL^wTs)9Lo!C7mIzR%thBcb zXQAL=4&{s=3b)leN2d2)(IxGAteK1uoCBm2akWFgUtlY%Ub{w>@!_wNassO8Rh60%VkFYfGFOkl|!$eUCl_y~RGJ9p+Giv>`S;>ZzTd^2f$o0DxTuy^pN zcYMt~|KK+N?Q_^=rG4k4g+QReM=`-#03g2tq%Sa4x^Di}78@Jg2%vVeRbiE84@OczmPs0sd>_{gST+!z6HzoH8st z5OSV}uW*d2=JM?_E#`g1`~Q-Pm>0w&iR0@Fq06olsow*2#tOJtA6XCQK<|H-0%(}^*2bZ|_b9FtMY zJL){}9iCXDl>3I3hu!fvOvj~UB0On|X*c5{%GugX`r<5U6VW-#JTqhdh)gR!FYtl> z@w)m6VZs@*;aZ+garfHH@=dFc!}!j^Ql1hjuO{BWdQmPH#O`J ziL?I78HRhTXy|Pg8@4%wI8xPLhQmT;Lcq^abi-WpuuLkjj!NnIm{0Ag9o0`4^M3t8(d=FEnpQWz#Pme~WLLpd(Ol$i#~iuOj!NwZxfsfF6ju3|i^2KbOTF za86*UJnb`Oml5fAQN3xX(vqp8DRWhn-{R*M&98HzZ2RymW3k}~;y2ai+pHJV-wE1?Jlez+|N&lXz zPa-qISrFT_uei*e%wibkd>Jnh4@YhT`khR1P|zhw&5^tK&W$mLm)gxpTj0iYgAp8B zefjB;;^lFonbGB505MwyOvi3P##1L)*RVfJqk2=Ux8kPV~Qi=W-f=PH+;1stASU05v{ImS3~?742N#CZ%+4$ zR!(njB9@!}B3bO#F4(sFUR5T|jcV0MKq7faQP{_nlLy5CbX>o+ zvR4p*12+;9E#0*1%j$?ThzFWa4;`;|wC;Y8K)&5Y0OK}VB7D-<0s*lEvA^V`T`sSq zPd58~%dc8$(YkRH&@kACP17F}c&#oZt_kd;>jeaksOH!e-qQ3)>=j-}nsdBZB2)72 z%I)-N8_bOnsnW7=KIUh0gDq5RU&>{1(>tYu&S=+7ZZ@xtEQf=xdsB27^GctzXH4)} z4t%3)V0;We;*o1>ED#v)KnaXQ7~R%$BpsXYsv=Q`H%E?-ua)98rQVAU9D2qYTw11F zKG(cvDxt~{u@>yO4Y@s#nXVsAWd3c^3$v?_H`@niZh1`Orp=TWY;PJk$e>_%UA~b< zc3;bt3cXX?SDdrQ_CO~o%hf4kpWFG<)HsUx+kNlRuWyZwM=KC-vl73=l{>7|^^=J9 zp-e^NPjq673b$t~Pn(Pu45W(9{NJGFeQ+t_8$?ya8rY38fB8hK)9V`#P8|qYUf<67 zBAHk|@*+;Fd=IHWey>ISmahH%bvy&L8>U|yhG+|ZzlTdN@FR3J2%UZ-@)5l)X7Lkw z=ICI0T!HU*%9s>?+<6gsH#nF!I64pe(WA&=d2XfL`a_?Sfz$Okevh8HMDL?@g`@Mz zWA?9+6uxn@1m|Ms4xa+61h5f7kv*Q|?uowB6jYw%T%(4G+Vebc#?D};2WA34t9+Hd z38t}*7LT=$91YKGpQEEZ`mGrYtaIJRH@MKW1rHfx8WxAR9l01e`B8cwQcfDm9p^8o zAD3a}N_jERBr)|wi7Ae#4>M;YH)6N*N{yXrN6>AYV?~ffm0uU0mW0PR&-*7H&pmR= zNue24+c9fgK5#`}!!)hM%C#t?3)Pbk{8>v;dFK--@mN3PF6+MlAblJo+<`+%@Msa?p9#dx>`8?U#30r5z7j@AME>mB~$<7uY^5u9EP@SoChJ#LND{ zjVJw+E-%hOFrCp!i%u`%JDGSZe{-CRO$E!_l=kjfQ|$XOY;lDF8XShQW}B8@{U1+= zbH`Kfx)qMeUrO%1vHc{O%O>Uq!K6WoW0C|uyf4ig;v8oy% zD-`cd}3Z{oH5lUTf&3MAbEP z>f}nL^NUGtGUYmZ%}Ai0k80haS*eZ}sY>V1?SDphnn4YAAHt(BQ>Zw6A1OM-<}uGz9V^tG1CRJ#sDq!4hApz=f{ckm5?OZha`_E`R!gEhF)6Jmu25& zF~+Z15@)CjTrMBnMoiAJ!5O3PJkF2}<+RQsdYMu%1#$}Q&ZyqgeFXXb-0jLKmdM`v z*PWOCuQ)uH_qYc|`Huy{QEC$+kN>&x3db|Z6%3e|>md)?=_6XCA2g3zLxogdG;n<@ z0oZYOT3nYz-v`I&y1C`ekcnI#AKbkY^ZOQd`47jCTyE@WOO({3#g|khrh%zGw-!HN z2`?vc^ihZpk;}K>ac*v#c?T4Wx-K=S(I$hm{5HDzar6DNHZl-Wr~I4Qjt5a^UvtDa z+95$|TKC;rCMQ;xCyyl!{cXa=1b1ZDuIOz7+w#^-R4 zRoW#;>Q@J@7`M9}j{s3bJSiC2J;M{}@s5dtUEwb4Rm@kKNLX=~Af)CYt{#;&Mh`~g zihqZ@ld;DL&I}1_oP0Stc^s+1)+5TIPnyjJ=E%n(g`~J{kV39lU^AtqzXuCl_S|U? zkUYnK`k5eN(UtaFP{^~mw^5&IaJ>bRe*n!>$63Us)(a$r4I@|rWOKM=9c~BH2Sl73 z`@a~3y^?$X090J1P*IAtDSVGGee__~E19!-D7BS{l;wX=8$qBzSr(9yh2Q5p@*~KmA1PAjU~P=}*Dkm!!QyjN=be zym5g9L9H?Z#L!|gF4@OP2QDfl(1`wU0DrzPV>~edN*u}sbaQC)wZV1|q;Y3IKKRDZ z&;1ThfYzP&ITb!)aqL#Rr2%_C&XxHA4`$N8l}iRpUkx^i4k?oac?Oq$ysk7dMwi93Hd&`=@?!>QpxF@V7WiL}||n zBC?a4t-C%DnWGuT-OS0v(+8XguJlslKjw`1Ueh;QkP}%{=cI06u$ttdq9=O)p_UU) z_J+>&F9w#9FEg(?L=pSxV_g&-?tA=i-re66hh2thUQWYH=fMrX_mslVe{%)O@yJl2 zog;VOx`H7hw_A%0B?a%dvB}$}@^l3((p&FlAKXeNgtl&YEhx<27~=ZmfDdkK9yR>qVHHZ-AMh(had3Le(^tqRe& z#o7K|f&qhZN%mR^sfY|V5Qq<~VSG8CnL=dl58G|RD_R!&Q3CAZHLFdm`SncRo!=E? z|JueB^hY(o_gdMXR1;rS^ns+v&DzWEvx{-PB%O`htTM%0C=)WvrE-j?7d-j#%(Icq zB@y8xE&tt>^)3NMSK^)!uDj2i#vtRfF@l=!+p!a~ZIu|Q@bSBtAT$S zW>MX73#{hby5VA|2*L3q@8$*EK_chRj^q3e_jsA%j4#IZi+6=u={*gJ8_&d~( zi3&O_^0`LoCEz>=BlxI2RdaR`o0$LIPry;TW8=4Rc_gohRdbSWOr0P}b_{!$$?7__ zw2F_!4HjxDwP5K^@Kro*`)+5ap_evhRk3~ud%cTTxX~7e1O=o*W$Oa$UIoegdxP*L z2hr}o0obV*s@kRUWv|yVX%Zq?j_TTfU!7d4$uFJRF z-`iiVxw1C*yB9r<3^yPMiDWg1D7_awn;g|p^s0I?S4`JO>a);p*b_5jpE+4o-ILx&{x1klNo~@qN~z=g5z0hpnwev0 zThK_kK_q6)7{@jQ3T=*Ib)BR~i7`)$-+`ZPCXS5>1#7HTK>k1?-OUc!c@a|$8akZ;-#d=f)5nGh2dS#1`71yf1qYtE<+<>bri~r$Y&?$B;t5 z$-Gvy6B6Iwc{IIcldcZ#z9`?yZIonh^*keQTkVnazrbysoIy9kL?euAk}N3-xLZcI z>oeXwzW3Z3 zu6H+tuJcSDM~lz$6=7108Cy>(RkvGu94>=%w&9Cj^$01pPRY;@5GtP-1Qm+#;*QyS zpZov?i=c$2@&Ok}(J>xA7v3hpJwun3IFi#O-HzIypRmf!%4;8a!_MTJtLwf65>H_i zkPN@G>T7%Bm)d^&!;j}^XUkr&)6@74#6M4uGAmjASIt6&$&rpR(sp{U z&VTe{fp33Y+n+4r*^6zHi7*;x3ALrG{&rIphwX2!=C*KrU>En^m~@rC2e;K8v-go7 z2Y<%xM_m^Fk3I{um5H`R)g$h--4b3#_1NOUTWkTukC$$fou=1mT~hDAy`nO%GO%dG zcCGFvdgHX;{Fcrh$@t~2j=`P&#k~Aexk0hIwG7M6eL(`Qq|sWY?N(>e>@=sNrk%tU zBq786g~I%rFvKzJk&t7NOuLgyGdN^Yi~M6kD|ivL9FlU%hDP%qr(-1-L>dr+4X-O8-F#p zYqN$+@F=cHz3NV`omcz$Ju~?TpFHvbLjT+EYibX~UH$!|{Sq;H*zphUpsG276O?{~ zlImRD+&NNXK`-`~Pc~-=MtO(jL<0x?#q-&iv@2pS+~FDx~J#T^z`o%D1R91{U2axXq7Gq4oHYE3~9c$?O1w zN;mf%5PH>pidV3qe+$SuEa}bT!h`mdMD^>xw{VbN*sIVD%{FTP$5nA2DRZbPk0I)*BjEqtgX$TwYH~I0jCV>+ljH&(^<>6Lz-YJY$AWr+}In4&cUgLv5xZ+caIJwg~#mPS*SE6Yj|DJ0ZXK!woE`^a2z=M@22XGU;@7ebV;MKZyJ_5bwbxYV7&W=|JznmqvHw_Liw z5%QjX2?QCHS*f(0v_-|i$FG+$13WD_G&SpAGtv~X{zm}2mZ@&|vgeLEA@;c3M+#|K ziO?s}91m@B?90nd&6y=L@msOJ=iE6ZrBP9sam4w9eE$W7I-6xo!Dw4m_ zflvqF`FV@)V7cdyTW>%ehjr}uGB@n_h;9tkIR&+^0+%|B1;vR+1leu;&YQf6;;Wga zXpA^Wf#fAoaC^9H;kX{mU(?UidF3@qSn=1Ad|UnJLm{9x?oi~SHD%zG68Pl&r+=^f z_qi(K_b$)i*ngpOJ$@jZ&eZz@1rz!RnsdWT=>9yGv}Tp3!ard9TBgLGO_bmJdsF4z z3IBif`OGBnLSxo38Gq*de74wM;P+$brxnsa5hl&F%C-+_X53$UrP8!a&-}lzk1?VR z4VyDGr|Adq>w!n^dMtF1fN$B?mj|1B4ST5akL$_3O2biBhSnv@f%=f>Ux15C?~WHA z`DEB=1bKA#OC{bW2j_2MVTb3thh1TRyNPzSuH7hy0kp`A{5Jptv2^GmM7QSCxB7{P z(obesefNRGtB?~x#dg+HLdNTsKBu8ss7CmE0Mp})41cf%*G=y&M# zmyI=S8t_ne?vA%q3j#5Z<>aO#YA0!bzF{H8&(dDqNfYrBiUgjsuSZyl%5RF?ZCGIw zDJxX*qIVH*D+@y5q9xsvG6m~;V)1kAtza451j4tIV6)Ae zN(fXYxA|fM1Qq>bZ_|qZJ}e2l3~r)0Dsq3!EwaSmFzFu*z)TVxJJN9;5>S=V@l(_P zc#a_q7ArV`imJgOIbmvu|7cpZ~u-$fDf?SemcZHv=-$hbI16Vn~X5|9)H+ zmo5)ie~e`tBQNg)!_#}&9c#H5_EWSEt&RNsZJ$#qAP3i(0Z^R$JoEf*ucGTIdi*T- zAR)ru7lSaBUEgS!D)D2&34r?Nn3V5~e|Dlg@3ia?AAJ;dPx`F+=z?q{04$siU_$FX zmUB8s`w&KN%rfyFscVcS3#7qGZ*;l<6SRYOZ^n@`xkQ=AZVDDrhP7J~&!KmuTN}sZ zdITlu<+TA5q7h9L+~8~Gv*C~ALnb>LB5hwQn&{x75$$?O-Rh6jmgbnvfFoB3Bcb80 zv#SYzvGV)izx`slgCu-%%GL$yb>kcfTd&UKSmfUMN%0s`Y!g1R!Og_v{j0=O@KluDSzkk+M z{ylh?TIeygWpK>{ZzZ8C-;=|ZtVxc~vok6|@)*Z{2fdius4#Ah=8tK>a9TU~Tr*9e zXI3j#^|sAup=ue~QJ-_RXJZ#qCMxMdDVOO`u0w3t;C4$t8q8XRwa0-&D@5UEFQ*T? z<2?5iep2g>qDXU=%)pnGn0+$AH`TT<4bOy-PgTtl6(M-OpG3;5ATP2U=lG z$M3R6z6Mfx zM%LvIKNiyN4h6*X-^*h&@W+5yaF;obeHmy}?r)LN6g~ONeZA}r?dU<*7Y2-2I?d)%~!?rLLun>IH9y~)fwi?ef05o=`Nr3sM0n#htWmT zlIkd9rwg5RapLQub;^G2Kqf4LJcH+tUq`4K4)>{KA!=E#izS-yi)ez0UwTKH98bB9 zE(F$6(2QMYG=RnOKXBktd9Cb-e&=H;3cfxVG_oAn8ltsP#H{g4)jB0M&M@z%biMPE zHGKOmt-O*g<8QJ{UJ1AzWnD3AQUltDTd(HH=y7&l;J~(T8jZ=#Z&lFUeZhlSiQ-VF zF5%lxr^}6-H|j4z?+!6g^?q^*0uypoDn4eJv9Gd;?hB-hou@wa+j2wPU|g!q8k}9I zvLcpgLZub-)eIF&7fgthb1fOz7W34m>OE>Rc)c@qYqTL{lpbslGX|Ahv(%Z}`ABoi zMqMGhOp3k8w#LOz70eOVwhbf!C;66;dO5N{ky}ekAMs1!-rUJ!Oqr$Y@BH7oHW^JR z`<45Ek4^3wO#WIv51$v7d>Ey9VaSdB4>SOjlF%sx6^E&cNvJ2?QR>l1Gjt7E+Em3B zU;8YbAZZkN26d2v;{D`_vqK|-?RU@ki{V#dekor#Y!}ziP8#c%q3R#)5V>mH1a3{* zopo~90HL#1>dnNJLpv=~b)w35_m(4P&b?Ff6Hnht3YoCqM}BewBR^El+i z(A~U8^ML^@>du_wP_h#xZrNf}BBriZ##uZ!Ya(l?br#afldD3Igm8apt)bebmh*BD z84*_l@gRB2P-z{5U-9eiCwHu@R}Y^FjqXjHS5}ZLkM(`XaT$$ImAnv%i=S4WybO{W z5i=weQB#q z;E?0upHWLrB~py?2DXE1Vhci1XT3gU@(Nfreg*V`TQEVTKpT7+tZ^uHO%nJ4O>>gG zKIb~RdTI+Bq*{3?T%+ILJ2dE&%6?=!dJH%piXVQ=sM8wd1a$RkYw-uH?rqkrsj@lf zXG~H4hA9cD$}^6!n~zOwNLeHae##Lc)WjRrzr>9-L*3AbE_UKF4kZ8hnD3> zW-2#R*oi-o8+Y+j!KS9t=MG2fS9k$s(Erg?vmj{cu(hgSj)d4 z&JaX4oVx4F#u%FLG4H=GeK?T>J?8JFe~v~ZE#1DB38aNl(Kbo6Cg&51J=^3S z+=p31ZSba%Qrpaj~WGI8C9oTt}Q8|9(v%$EO(zw)hCnG$(O#euVyyf zVzuGB4=qPa*{wH(wK3n#dMnPbMNl02(sq(}l909${USZ>F=hRZJA2|Sd+F%0V2xj> z4TKZV&;$HpDnBKUK^vapO-aLRi2ks$rC2)fLtwz?DdU!29WV6ASUFM>2m#J+p0K*LZ-X~LqM_{7h ze@qk0C0>y>px~ z{iYF*>#|XpeWJge+nr32;&g-H(M2!CsS8$3`y9|CccM6J$L$CGCU97yhw*ZV>{n{L z_n!PoxY#fQ*Q_<>UDnpZABHF50n;U){Yh@(%>*#0YtGC%^xtpw8oZkVT(MQ$u9xMy z$TF9lC=cIJWui85TKL17pH)$(uTu7A(ACRIM*T{?{vY<G=v7Yw^<@?PL>u6dNu9qWNf_<9XDk*6Ln{cxFj5O*r z+^+a6O%c9w;#v5ka^?+Dc-E$h*Lu74Hj9v^OzNb6kA3Z0LDym!cN#ONFNuZ=ibIo&~kIZ-L4OQL~2PLamf08%nn%v+}^YSaZA<>9l%y+hQm%SFiNKFM#tsd#j5ntomoB8`*37Y=na ztuCkGi*jSXg#(}Oax0i=07No=rKWZ5zcf8MM&?DD*9yjqjlwoB-ugxfsGK;c4*T)7 zDc0Tk`wYlg??q;N?|t!-0)Lnztlb6iP1Z7%QF_(?u(^F$yy$z<*S&3;sv*JZ!mW+z zi$q9lRTihyqRgD~U=B*y?<%>ysvNhjAin(xI?`UGsvc@QLr9WEmj|d@ri$VDC?pY^ zU91-!pKPDcm$j0m#AsiS6(>rG8b80pqA&D$a?SbZFJR~|!b#vPeViP1+V@DZt`l~* zG3}(oAm%gE>pNWK^pBATE)Rvgq|RXm^+<=y!Ktq*QjMKM3Zf__GGTlzv$lHY%o0@G zv;j5!Hw;wWWgygKa96h=p>UYEssApX+tfgo(}lAb`1jp_XHBTT1$XhD&~fK?9GV+Z$0mb|@AeMoQZY+Z6G|cJV*AiB ze?93pv1j5!+n}G6mk*kThc13G`aWEK2v+{ux_?PK!j+t+L#CFlgmsRt597tC#@=rB z88$S+pTZnZ{H=CxEE$uA(rPjgZe+>uI9#j)_D$flC}sD28B&<&(#a&d{)HMKjiIMvJ#9i~ z_b%P0d8RHbD$I??xl&62+9p!6+UVQ<4+}g7cGyR=^AWIUxNYbyFgb3I?G>sQ4_8y~ zHWE*mwY7NOzHQF|$*9L6ZV|bjr{WV!T=&R*3}{msCb^+PfQ@~BkAx@mXRXDK6^hCgqtVvtqI7wBt)iWxB=Vw2;z zw2K!@^AiL2)WoO|C+Qz=hZpVn+Hk?#)Wd6|)6oaWHS38$w_!<-;6lrnFQ}_8=|?I= z^9;qK6*EbU&$|7Pc5@G{J4+%h$Ilk))H#tx)fR8(T_rJ?9P}1Tp+7 z7#M>u;%qfKl*|uPW&p^AL}ZVRPh~FQaO@Y^l+V=|?Y+IWR`Pmju&%kY*s;jWvuKVU zpUe7Pvrv6b(OuTal-bS-$?M=qC)z(CV;%Uf2A~om3u15H9|0bFy91r{SACc_(kQ{@ zON=>BX;eN%7V8*DqLNkw&7$WgGJ%g@HY#{A>`3RjKTC-$3)ffP#tDM4nLWiom#e^% zXTaNXIxgfSGx;${NsVi%yb@uF4vVL&dEF?jikM?UP3Dq7*90lhOVPXgg~lC&YMSjR zc;C5lOfb6Y&k>2GRd$$aw~?Cp&5P`3SOml3j8T(~@#E7Y!3VAg=9$awpj|eV6YRK# z>*cCN!=*%rh0059dbHOjzV*2(`E|-!HODH`EeIYEcMf;uD?IvP<-6(IBtl6EhOLe> zL*=)>Y%BV8;$>EwQEoWO>fr!`dpVKx&f@3e%;j*p#D3=^t;*oIJaP;hQ<-0yIbK1s zCZeRFhLYWrA7J{q4eCkj)6C^AL>T&E={Z07wZorn!#|=kv6Ydt{Ok-}8JI(7Ss}^? zOu*zKcD%8*8Mpais$vWHW|#bKB4CM_O?FBA(1rCP1ik&XP4Oo|vOblDqOuIyU30fa zb@H`gh^AgFG-l88p`_-I7Z$iqN8f47s2xV6FTNCBJ@81mSXD+4`MrnwD`ha`SD_I; zQtK5pJww9?vV{If+fZM(0S5uKyR131jaX9PzQ=pNJqr>V)))(t{gg7XpYZZus1Nwh zD(hdBsstFyw^}rG45T+t#kbl}G)X7uCHxO?;??#uFt;tkl|(9<*s!k>jJ`dUPxdPf zVt2yD@HSUnt*j}ck6APvIuCkx*_q_ZY?9S1Wy7WARN5E8`8 zmy_{(D}@$+qjXm}r1_i93#8DLlr~D<4p}81j%~Ys@^AH<0e)XvuIV@ZkB4~xO%>Cw zvJHeh`~mwf$?ofrOPv0b4xj$^lxbG!?F^PKv~#(~^JEoR8a*itI71U$28fD2>8`Wi zE*fHU(_RyllUf1zGD_Nnce7Ut10kV#cM6{M5Hsvl3r1W&Qd(Oc$-g?sP^Rvu!}aSE zkwE5o+{aiO8fn!bwC#}Rd!#lp7ebQ5TCHk7o7X$mT$zeow9)k?5clv&pR7`|bOrZg zY5F)O6|Nbe(@4@sC@2cqcL|GKRK6i}dUdJ#``E*g28U101?#Pk#w2URjC+RuW|(Y_ zH@f>*w~i|kdNlUfS*)H=3JdB*U zb}fGWz_l%h0f&SbQ<97v12_O?e^=S^8sPpHMRT-+0#&&GaX*m;Li^9Y7P8|34DKI1 zQIknan_x}7(Z3T}=7S#JBhaTGk~XLi0Ouy^lKu|2pu7J_>UB-@bR;h@zZa8aHFZB+ zEk$gk8(G_$m^`PckZG@?&YcCQ2>pHs`*uZq4;lBTUI=$J+jJ&+YOpp)V@v6!GBks! z>lqQffaP5u;I#&sHcPP@z{w*XKZmTO*RdAvx(4)*0;rB0)6*1`>Qp0qXnW)oPq{{* zvk@T!jyvN15=jGPPjWh)N~dMHuc1Ws3yJ)r85eK*Kiit)M@?2l(E&}O<5WfQAc`OG?9LG*FG@;GobIceIydI1 zuv$`W!>8mY_?$=@rhc?LMCq6sc14 z_UMnEC0Dpo}yK0zMtS%}dL`*lM7UePx85|e+) zZ(w(K6g9r>b+=ihmrYOov!7e$$;78tsEzW) zvcn|QDb1~m@BhLl4-3UldrJ?0#AGBP5QXa1E=%5!vFz zKlhNwEpmq6dC!twli%uKEo=UNdq2@mcAWKkZdz9RV{FpBHr{lSV*gpNe<1pi<(j)_ z>{wn2Jrct2+~|!!KY83!g=h&Z_`$i1!6b`bFxhRfFzp%z? zn0xBntlN04JC^)X5*3WSosVlG`GeK$LuALKCoIj57LR@|1*2HmZZg=HAfD|NZnt+R zQs^Vf;LC*`Nzb|FP0#3bt(E5%EGO@p$_p5~mG=`LA6(()XA`=qDDC8kzBK;yra~HS zY$~+39dbnyege~mO?ZBMR6m{C{C3%h(E6kAwx2x=Wsu(1zfEAQVXhTp>2yX_Xli(& zrqX%vbI!v|iy`E}dYk^u-D9altY+Zn&3fixZd&afUjzlrBJD~3DG&a#k^H3yZ?Y!7 zN$^{E7kx@r0Sozy^;L3U0ATuh+^YExLJT9Q=K;5KVfvr%hfvBUn6cTh$-yL^JIkSq z-cgzb3Nlmqq2wPH@5M&fXyzCbgyR!L(!t5%{O&dic8D7ABw|(ib+e#$lT8^Q<+hh2 zBKhglmcE0AUZZ}pE=62a{PFyU!)|K+ zRrtds<`KfgIr@t6^xaMI1LosA+`z5{`g0~-i)Hlj!+ zOQi+PURN)cd#cD@{WR{sJ5RGc)af8mtwvIRKsA0Q6B#C8t;pQF$TApKojjTakYZM; zq{m}~5y7#QI8tPXyJkM>2dk8ySp$_U8ojrCVC~4XkJxY(j^cPhWWgCRma?{OL2I-j zb^VcAr@qv%&^7!M$HsQ5NEN84RP*i@s%^I;jXX_dI2%yYSP%j#rP%Z(b-?&#K|P3V!duLQuz(^TiP7rFpjzPR|Z zat5gpwz-2GxGyMGuHotAa#=~X@6QKq2vatuU?udE^GV44ujon%E`UPMu=>HoG6ndu z<>)77T-d;Lmw<7juNB29<+(aflyA81_g$SFCD~v{*3Coy>l~~q=?7&!g(nH^ z?)R9`wY?1_behRm0m1Leke_u-2&C}s{Bv)|aZUTrg-?lb#doa!vqos~7T&=aD)sQA zw|(i#`y4`ufGo4I<$p>wgxsN2hU%z%J|Fd}8p(Z4{G`^f13a*Uv ztT*^Qt|>8^^K|64;FQVnE7GPd-=2+OtOYB38pNtuWVti)S_S$pk#r2FO<>UU(Nw`Av)0Ap!%cJ zDNO0-2ZU2V`)D#ExXxLOiG$(w_jOn1Bl*_-0822BNpg!UIKR>3D5#}LGr{i~|E;tF zmU7}$amT&=ItCFkW!${zIZs#=O@O^>0lI!aWjFUKt9Qvs&T+NFX5VQ^j>B9Tf|IFU z$o+xToqqVF&AGaUtEo+q3C;)BNgZ@GMbayWpkwX;RDbxYcMo<+1|Y=YVtDhch2|f1 zydK%Z692{BQYVhzgs84N@XX{;ZsY7e16$`B`tLlIA{g=St32EhGKmRVEZJL!Ku`=x47MD!6XeC zMnc|Zn%plI->I)3+N7k+u2(oy%_Gbdy?Cj8B`kZ{59>63pD6zpo=I(HMD`%&PmL#i z58o+$D_W@#z?{J@GK=pxj9$1=Ouy!&B3M8h;bYO&zfYeuGO4&Ae8JJNwpcL$#o3t1 z@5lHqVeqHtLj8&Lg{)v(FeQC;i8=gCYuz_orjGA2jg?X!@7YhyV>ABu5XHREDf3s~ zJvXUA|M%rXU>1rJM96U7Wn7&QYtrgzMDUJuwf~@aw!#?9l_3~F6ggiYbDav zhkM(>{>Smmc>b*03S39=RztPHHJV|?skrIAQF%i@w5~&WpB25f`{tWR7;>sYny?Pm zPLfw5{Ub{`*%36_&Np;Az0I!*qXkxk8V-QJ)$6?huNbR{HnKvS^33~>~S|L2yGc z8PxQwp3aS?s%0EM0=@xr|2DBQZ$#x^w}+ndpJvog8Dl5>{M3Iv%jvG|Dq4Zxv0OVZ zq6es71@bKV6=(n#piEz?-D5)x`RiI_`Tz5OAL2_n+TT{*Mlt}V_yHx|5?Dhrd&j5p z;j}vqE1+dXXp>-i=r_JB_)%*UEBW2_P9C9_(aCe+XPOi7T=(`F_8Ny7XJ`aSi{({7xk+P(%$dPvy4-|a_~>o&DUHlix&Nfa6i9$W zPoKc59*Xp&u3yQY)L60H?zOT=`8MzjrXXrLBJn7r44TGP7kvhA90FL@Y_5G01NJ2n z1NKA`X~kz(Zx6}Xo({#*0zzlV)>KH+`!aQcnNOO27>aATd0$j>P#a6&-SR4BZWq5- zH2Cl(Z$d^`dI9h}m1wkOOf~JMLGlIZ^RQdVRa?G*r4po0L36`CirdK71rD2Te*IEnYtR&$inddXP?mbAQiOt9j)a%YmbNmtPH)9r)XJQMX=;-K{ z2=-lz-g03sej=m>y-l3P*u$77Y7+WHG7q`j39vno9F*NmCyLmAG(quU^{6usTDIY; z;u}l%p8mf??tiC;rcl0luUCdL7*X|5YzWvUJQ7&wrJyYX*9Wo1r(~UvlPfvAeg&}v z?6>zis_uWeBGO2m*HjGsF|L?lyfMP!H7vk#JJXqd70D$iiPTez9*Cu~bG6B~vky4` zqAyl<{X2}s>+}bUlzkG!|Hwuo2g6n(a7Y0#cGLqv`N@&PWcMovsn*$#9U+Q zLx$$r3x2ViH;JvkWfKvTeXBXphVkpHfJ5a(Akyg#E#ks$GtV<>IGIBfH!(+m&2*I4 zpgOAT+I{;Yi`VxTECGGgEK=4{Jdk(S`QjcO#_sXz&W9F#y^|uz=pjy`PCf9(N{y?v zl!GI@x+@rgv%sf!!0oNJCx)PcO@$HpgTpWTvg~)e0Ev(KDqxRNJs{r!M7x8lk23+S z;8Cqy3@_jWt<-prfm2m8nSh}$;d3Uy>fX_%5UyO1@bDa@TW09=aO+hBiFoL8D@!Db z%GrC3z@o`OJD1@a-G>yuw{pLKj5#RF=wAZD=7tYS(sXw7VL(p9ovCbSBbu0ypLv+R zOSY~&eiT5gIt{5s_I%&f-G6#<VXr7<=$*5!nz&n4LkhK;7m?UrOucv)H31O0e zR>m7Ac75zK{%t8Ng&0fV-PP|Uma{=fZx3$~d%&ENXeq;mk#l&_sO92y#efOa;}pw` zO%IN+?>uXNlWlh@brUvlvXe$$^d#VH;lP24FDIaaD?G0CSMaO=`HGI9Q-ldobBEWy z`NUOEc=eG1o;fw;$EUausFiCU713a6A@ufA_i8O6hnqgTLRFW&fa=Np$+Ln>yMD{C=x%I79b={cx+K`UtPy`1ZzG?avL-uaBtogXw?Scu>Zo zNROfa!|o%n%j-;_LX-jgOtKDT5EE>mXFOM8zkc}Zk_L|Gtx9MU+LxOI%te&ItF#i6 z#rJ@p(Xe`(O>9K1`e6guaQUdSs9iDcTikzzEBsyGUNc*J#)k70hX!89V{MYwcsAQS zsgOOf9HDwzo0E1Gj3K(wi(A!m`lAm=O}1;=tN!+C^gz63_7(|Yk#fl%fuBOz%PnAW zNeT(id&#h$Nn3JeNxJTqoTz8HVns&W4~k3lBD}abQrqpkakxT0NESPtHK(m3Moq4# zy%_@z0aqW!XNkB~4NiRZx7Ul+?iKR+5LBEh^XY^hJvyDhdO*UBuAP>mOun3?3era);o6 zT*#P|{2 zvrJK0@pi&$&?#rn%DeaO)W46Q55E&x1XQOpd% zFJoR-EM;g*&+RvDpw{lAD$Z`)L#p%+oIOD0)!htO4figed1@>MT^F+kz?25@v=zX# zF=i%1`;DVs&|;*(cnWhZR~*u6BAau|IU$s4WOt4GyyPRFHEHJ=ZGe3g2X41eV{El< z{$9uBgO#Ay@zvvQBFcdzK9J^pMP3Exc9XG2@}u4uRy&{nIJ>B>()w{f^*bMrjWTG_ zVRaxkYM9-{tFOwJImN#6fs(t7v*K}zhN@?LM!n2`bweiTuT@m^!M35j5>NK-NWup;Eca_9a2WCV4 z$PFNh(N`^%r+vi^aeu*ew6aL$+_?MMV|E>M+ovn3TxNJ(zx7Ii3^D6Gd1L7Sknj3# z*EufXfbtJVTJ$5?p`v$Xr@=l*5&C@b&Sf%5CuRKBDF|KIMbo+jm+Oi1SJ<%UbB;~INUTxcnizH#+HyN?HQO1#xwG_K9sXWa*cJuoD@G5s(l1w`IjQ$zB=ht! z>+accd%i+f0apN4mvC%0(B}FJ9{hF&>t?Ne08CU0*GZd)c9kV7aax5vt0866X-lcVaZEE=N5%H#GA zlhRFe9&sJw9Y+`I1+h}qyGQi|Mi26%UoBrMJw2L_tgK^@hT=NI<_(V`1(vf5O;Sa&VMjiOezi^9 z%yxth4H1QVmdw{mucwN$j(OQ~!ST3@U2pr-!>Y+p6aC*cS*%qo^t-L^AotmtPe&W^ zV#<%m<-`|j2x|l_V$2*m{2TGAuQx|n=Nmzc*aq3R6pc{*%6Zo~{D#lO&snM7c5Q8H zkJMOE{Wwqs-g0O$g?Tgry^jTQ$fNS^Kr|cMmrd-kiBDEl47TISEuM6E=VnpvUB=II z?bVW5M0hKFie+D<;Qj*@|DEmVef<0*8}L_rkXZXsjCwL2xI=Uqmii%I^R#{c(a~43 zuMCIx?)Oacce`%n(Aov7`1eNXBVF}xb{h-UqA1B!RtzUjLz~@3ql-uev)<&Zo0=h} zffE@R?5UJZbzjC?To}|ctYHD!Zvx2;e;((d8mmxoh|d%M4prT%hA0C5P6f7Ge=ZP14#77hTm_^17QXu=~p2fLkanNU3QTk15{T@{Tb#TBw z#c9>WNqnC?nB@a&Md$~N7=6@uc_7ZImZU`~K*_*1#q-#K`&7xxWU-SN5#cW#klO~x zmB}VqzP|*#DboZ$*Ahw@G=*6@c!q)0EDX&^wo?$us)t0%E+}}23)T+q4-7cq+ujrX zMeqZ?n;?mUP7Aw&tmKW{x{cC8y_N0TVZXj%7=2|9 zpOn^0qd$8Oo2!GNt#AYGcBdT1{CJdjmL7tlb%6>+v4zLHsg#>i1W2VvykwR;JkE!X ziN23Ci|1h?y#9G^w3Z}hTOxr-JYV<1ti=j$g-G#)xRz`{-5!5=229Ny4b=h+58Zuhj$bGHVJ!l-}#ng<6N~_bXgb=Z`J6Dpuelm8( z$RH-8x+1ywn_bbJJLqk zaU!w2Rqt?kbAAsI)QH~-DDNJX&ppNr)`KO3o(w`gHzj+I(1KaK@K8Y?WzShhpG%~8 zNYbr#JoBMhzC~UuA?Kj1aW*b+w@iN8yhRH0KZxDmfhtc~LCaUmWSXcwUY!mFPX&^U z8=ZM%LTapCObhFX~92l(hr^~_}zw7H>e#SSqn!XvmeWamhbMf*EgB^#MS8^GI zU5fy@?-CGM#0K~3Aew8b`iQPye|xM^Es0Wu?$?~CUc-2YmkGn3@kTm!R|Wf#_cOc2M5t-A>bIr zBCTMAhjCKoW+Ta^bqKIn<~JEo(6GRpkC}C37NFhe;j5@Y@o_qsj@7HBZ=+-YM0kf3 zcrgi9oR4{w)%?koEH!jZ_5sF5t?;k$l1-z9PAz;e`rH0b^hbP!d+=r&Ud$5#Iy==> znsJK+PcG!d`8V_l8liwF%3h7d6i#KUck_D6vQ$$TXxNZut`6RT5g`Jt(0oLi?z=d5 zF5JIL?_ynA%Mj9$Uf9w?$5l8U?<%`r&LrDMy?M&?eQu`D09j6~rMSpP9IUDr$b1&= zyN}|%ZqYhgxIqaPGkk^1JxUL|vX!C7N#2u_SsaB$ysx`vM`Bzvj_*uN3z&@d<{l*+ zyb9Ir65;{|8OaHFSj~ceil~fm`Q)}_^6TC4Ru>+Q5M$AZ-0VTooUzNNTLx>sQr&I@ z%iPy~N!2rFf_DD09RkJ$e-eNG4nt|aKsso*j!NAIZ6Rv?&AyA-yU*R*TLOs1M8~4)jO0V&WS{Icujs?-+za9AS$YR*?FT^R%V`7 zl1ZqtpZ>fiXRlqzXLltwV;&W=XF~ql-gmZ%2V+cVWh87`7=cyBIg+9XpJ!NAAOn>% zqlC1ztvO`@vZ71|4g)`oo}~|=G=k84p$^L$E$f(nz50+x*KUjJy5Xt z68rZ#q5%;-Zj`va_XFBxM>M-#f_5$KO%ESJg#As%gkbQ4fn{WQl63l;E{qw*r|&2U zF#As`EQB4XS2Km1mvr8Jfk$r#V=>s4vZan4v3-=XQtd(IlCq%b&wRD?q@ipRMr8!_OJv%2ch~}~* z?Doou>=%Yi5pCm~;`{Sgs~06XmxUKkPRjG5|JYprZf#ZjJW*79nsY0{k{sZ64zEeI@#CBT8Wp12&db(WPiXLh z!oKffB&2}7rrsPIH6zCQz1ZcBK7~{BLu!VZK>i^8n-f4(5|Yr(pcq1oYT@%4qxu*= zlrjzh&D_j&ew~1=`Ckkw8Kztrxd4@a-H(%0qjec@qj6WMK^O0LN*cvSI?~g1mbCZI zS58RO7`nbuzcJfsa_H~@KW6Sq7uJM~FDto4)VUv!fJ(AQ=}V|XIpI7AH)pw_Ada%T z_yYu3fhiWyf0GeOV|R$7Pkr{_t}yEStZ*LqVJ#thW^VTsFfo5xs8JS+qA&Bl`pC0> zhvS?`Q_P4|&N0~9co_!R+V~}$gGa)(No469$M2VH0(wB(P=?u0_G4q0zzSOEV~<%$ z7vs1nz-dsSQTkTnm~Lafp(&p^=L7bp>+xu?XV>7UAv(RF?Iw3^QE_kau&9*G#}?M% z_&Slz)?yxu<7Y@eOs?c@T32Rq4YCpx2_6TmuvrnxdBn%v3OBCous*BMdtq?lUZljKr^ zQ@G}rx-^fIm`^(KW1Y9Y(3^)JX9}^aw);J{iCbA*ujR&_6kVO*JrhmI0OSRGRZhhZ zESkGcGn~l{`hw_@qR=!9{pLun80yH`*Z{|&btIOAsbMvWg9``}#83a$leon;%r@N( zjl8Ci!ht_E7`(aZL%`7$1!BbC}om!Li~h@mO+>rKcP;&{4*%%xyY z`)2{09L0e@pW@j01*5i?gL*h?NV3_k#;x8K`fP8K1q;_eXPRMTs|J^FQrZu|~dOtz#4 z3X04FD5zk^0*u!`K7EJGao{gFkwHU}o@_Sn5*ee^QA2+b#V5g^sr23tCdCRyHyN$7 ziHYMs3t@Mobvj-P6m%o#hldeG;<6hZ`i&t*Ntl0WmY8WG4)Gj(A=*ux5BiL1 z`0b@1;P2wQLz5$%1Dzv*d2oVO)G%=hU-rF#2Seb@qTgVI_i=+0q)guqUMJPOSt$QV z@@0^4wF#!ZmP9p_Fn`#VAQAT5Z>Gu2kDf_7i6Z5Pn^cu7j@MPQfzl%&VpcA5hL;qi2E+|Y;wWPkt(U~ z&k$tk@YO6ic)u0w%A-L`bD>ifEh+nr_!xlSjDdLJ`Oi?dnX0gI7{^CbEn1E-*;eE6 zDBvwQk2srpy|{1<)+Iv(J9e+ROP zK}G<<0)u;bMVe97Z>dN;@J!s9c;KSyh?1lmDf1=tU z0kq+W(`<=#z}pv9HmB@?rhFYzEq7dVr;@_ZYKifY-1d{*XCqkLwt2sQ{a6`Y`4ib< zqeA+>FU#;CrNYzJ#c1ruJD$FyQk98hPngq#Y(E+EGog{@D{i^RBNqY!nA#=xDH!;z z@=i;nqSuxTLp%`X8;o|1PPGF7A@WEp#j?2|=BafKDaHdMO{8rdkQ^kjnG5h9m!r2) zET&D|*~LlM*NYj(m8QLA21LVbaqAI*?{g$2k}Gt6ya&RtaPU+B>v9^`gkF7K7K3l% zIS%ZLrWi@kT^H*s^E8%idy7SR=P)X`>C${Sj!t#->LCk{-;^!FR^AZIAM`o=9D+&v z=rwou1s?0+f91hZr`+YikwhxBSMAQ-#U(t{ym}DE21b45-u)80k9o|Apsv;kc`s)8 zPV6!sROk-`cCe4AuZEU?xC>b^lB|$Nj|AfE?6c}sB-vmYUp0Mzh>mhM^84|qJzRGd z(PdkWPbEnhGC12&HK1q=g5GvZnBOZdxiMxp-=U@yz?@9U zHw;~ktO2EA?aCM$AC)r3I3=Or#{0$XYmZ8}Y*2OR`9T@;iHz|-Vh=v~ zX0(xGWEfgl1{pyv;wU2ysJh7;K>TEw=*6^?USX0Bs}Svi#$lPvLR~-Z=Ede9>uLvD zQ|H<>)|%NBbYHOvAVcIX_xyjyFSmu7k*r0WXX@Z1jS7*W`924Ab4UFEw@)UX>QkZI4WT?G+kc3GF`=-XG5uM)T;*}>G8;RtC}ZJ1aJS+ z($Xhp=xW)_pY^D)I}}=^QX#Tjyoeb%*)6SQQ)WijZ-(5q_?yyrBrU)-O2(4|4&+T# z*U>ytvg=l0N3lLKq7=W<9z8yL+>&4?w?!+g#4E z5W-0aI`UL;CqUf>drL6V2jt064g>)6X8D)HJJj?fcyqbe=)U}fl0OiP^EmkDY0H)3w{aE&8z=G1<76697a4a+Mql|sc6qnIqTbiYXi1>L z?;;)4DhPUH9>|2laLiu4K|B_;^N_yO%og(mfrc|BSOwQ>JcuTwf8`#$ zzen)-AZwIsJ-Vesa81q4yAlYx5%0m=lxp0kuSme+!^_H{E8jzAW2e1EQUu=0Wd>g@ z@W=!tQxHJ`$NKOcb~25)i~jt;K#`0P;j_gACB84@GwO! zxKJ!euHwJGx4k+|WMwwLP*rx=Jmin?CvF9ZEW!KAhdh@CV0lumF2o|KXKa{3#xVD7zNd5aZM!^<|+b z&J1sRD6+NclKuSjj~>6*0?`JR(s0bHB?DtEho)$i5ku6Gr;`D_J#v#oB%| zYkCLzh0I%XZ}4FTbu?DO9cw~SZJff%a(g^ky>dE_L6&NKwpYE<5S1tA6!I9__U0yD zk-_8D6J~ZCLbHWeayz0k09Aq{1SodaWX>tqFe-D^EIIy=XO1$dKm1SmOhSsx(b((S zeZ8`>a&(!x;FMqW-lL4@2vgOHUj4EK6K69K1O*-`g&ix?$zp{N7EM^m!`Bra9uiC> z$MMsL9EbIKfWD+fZIT=G4ay^1dAtjQ{Nkm)J(2%-p||bVY&%4iZto*>n3nt4Ch+gT_gRlf77HK5##54voDtt*x5i*AI3XKg!8%y!hzLdYqY6^k!j7W$H16A9bb5`~|4f+srsO}%t$lfW9WcJB!I>d+ z2km_AA)NL<|I(ivQUs>C@LG(vTp<7U1YqsU^pkQ5v9w)>zw0SZrqFqPC8-uSK61L& zyX3khRI%B`l;UnCQisth(rRScAMUr4i9H;o_OW$MD%tnzOXVub(8Qf`Fweq4^cSVj9{E2+K`+!j zcev|sf8!UQLT&{#cTip1ef!Xf< z`9|mRdcUvoW3BOAgQ)k@<}diMz!0R0^3LIIvgZ7L`lI9q4!Pm=m;71EN>Su9nj!M13V>M+C0@&OXWkBYuh-7x=*~>T+Xd3dxOM_CzP;^n&DKX|4N$PG5H%UMIx<43tjMeNk9$SC#JhY zVo?%gjN{}Q^?4t#KKOqQegh|#%OS2De%v(BdE-;)s8)cX?=aI_@p{;qjQrb3mS<$|ygb<* zhVnQ$rD6Vs-WF9GlLF=-L)X)B4fNZlx2rCK!Oa!vhEctQ{O2f1cC z1M=5s{hn{=d)Ss>$?IFX08SG$@Q13qSUf1cqXUcDlj>d~S*7>2LfBQ=Io#ut83$3G z<+r)5L#Nb!TuuX0BCoN&21JF>CP(qL;bNuZlBc+{kBwGYSq(f!BX1yc) ziMDxuG5~%e*ezz26lX=9FI=IYl6?shFm4ba$RL3rHoRrXM{DKNQ5n1t2p6&L{k zMb9=L!6B`mS>u-}?}#59EceFT1QHa}(Dg4AX{w>2FfC-JgZ1~PSso!kAc?C@meo*q zX!Q!5&QGN<1O*p5IdLE&|G1mMmk0*H;ViIMvW8r+>|of_*Teyqlbak5lBh6h|JLcz@7 zFD(bX{TK7$tQ56A^&{UC5Z_BBcRQ~lNoLLg{Of5kB@crqr}^S#Hcup}{2^zJ{R{E- z8e?GTx;^MaenZRgxBn`Iq;Rr+eb^ugn<$#RWcRu{Kx!q59S!M==FlUbKY4}|nSic8 z*ErW)IO*{ATrm+b_3@3Q*Iu)(PBOScE=)gL{<1M(a-dxY9QZ;g=Ln$r#K@lPFGqSz z6MW+UzCtUaVzwD}J$h?bkmhYygvL%Tf0w!r$cy57+6HMMCee>YYU88p57U}$Y&0_?0W8+9WyrA~Ab1Gb+e(uz*4s*8M`x>;EKdf3%q z3k-lB{M@J#LD{78Il3Cg8q=?w8kt?9!>{ngpWEygB>$T~h{C-84L}B4pxM1#tRz#vIxZO?$d9{O@X~H%s?#jXhBioE z8@aqE&OT?Cve&7b@4RA8?iEnm4Y>7Uj~+e5mmqF`b&Z_b-KDTvyzStD1W{iB$aK0QPo^X2#g5lsCYsZXdN~Ga8e8vK(2>AI$@6kdJ!`H)djp%N7sbq(0-I@#2o+%=4U-0XMHw~gc||I93Z zCmKvoy(%*(KE;&!KnAA6`QG$e)IdT&fMurMK^06upp)rW!vlf7Q0lY@8~DR}6b-RM zOxbx=(AhKY7-))|HO{u@5c@-}PAV0>hjJbCtE{Rp6NKU3r_y6)`Qy`Ac$K^bmKt-{ zH~dG093P5Vo}#e7U0Zy^XsCepJ|+;u^>Uw9g-BV-L6@n0tPqX8kgHmrAsZiNPZk6a zaKtbFAz!T_JS<BCEh!RP66f$sy>-s`9TL8m5g0hu)#fUBEt84psssUD-@R7L!= zq?mC3Bj@=EbRpulJhu-VC%VG#6)FO5Q*#*@DukENEp#i`nSQo>Usab7NG`U$llN() z7e@BCVdPnDsNcya^$ner=g`(~PlYJ)R7*xJ?@B5Eg|6$23E3zv^r959RmkJI3;$YC zJ9D$=C2Ge2T#dnSYiO3-#{)bbEEq_WE$Nwy%;VJY~_l5xRmFj;K(HerJ`;&eObjBj{-|-f*C)<*;H)@rP9kzyv z8(tW?`4TDWyIW@mTm>*|+=-25O7;8@E$D~)ZU2k0?+(PWZ~I4NWhG>&bUw!k}Z2=CwuQvX4!j>Y%U|4%lds!x}WE{d+zsre}D9E*XjHo=kYzpXFRa= zuf5SmK#>YsJv-_8!lCLDM^=N>Rl`#aLk)63d8QN*jNmo)O)j-Jr{}=X=19R}iG#Fx z9VmHYL|pfl9&qr&PMfPaPS`9ghI04-o|%arzobN<$bD9JtVOvaB8EapG_5&x+~HgG z*W-~Ai!xCe`LGZNn!LwFgVnqamC>RI1J}fd#2>4D3il|@sd}egiH5DDQEd2k^TdY- z{clW*FWkNw18Is%H`I?(Xrqtkz6&~dL9pCW4`jwc2}AMH_()WxA@^cSK#|_{1x$jw z6+DmMVrZA|H4rH0D#s4Jdy2e z6{9)ZFb^aQ^Dq*YWyJfTvjx6gy{np`>~+QJpRzmRv$~#}^e}{ZoH|oFGoQ`)@2bC+ zKO6>MbcSjkEmr|K*L|ElEM`pLG-Q13$wyh-{J+4)6%MT;P25wKBgPPJO#hXPD&mUQ zXH+7_cmGBf+jAd^@AzQSdT^2oq%ya$^6A7?*1C5|el8l+%4ps(C*8ziI0m}Q**b@h zxW7F&8B^J#30-$pUJ`x`P_%Zy1Fs{X>`Gx5tFz-HVx9G*<{1QEuf3Y*0O#lCBL;ir zMWl}CA2`9vTP8zpTrY;Xi;T4& zWPx8uTXTz?YeZ*}OYD3eO*~<}mHe&L-S=U*ELb&Jh9?h~qDCx}rm4h^(Q*Hy| z$R6NwWM3cPKq;6$~^oH z^p4Js#cp{Za)z^H3_*3(0bFf-OJ9&Yf#36Ztpl7picGs`xZs0T>7X!Qb<|-H9j-O; zaR#GJ2-_Pnd)IfVaMhoL_r(<;$dbEVV7GX8dj;`;@la%|v5yF7Co8#HMCepnR-BMK zxE_}9W&0+XCc5t-ofg`8TwhqgC{mkv?%t*~Mk`(fQwolvsYKIlB0_9z=jphOYNyok88FSt-^O}YwcR@8czgzCnqzw& zg|GZzU29HL)_I!&uZ7Auaz6_-yRLkQ-kZ8{FV79u!V{L!;k#qA6elkB!P(tyX51Fx zZ5JfQ)4a!l{z4(V(iFX4rkU1x#(BDv=cM{z>_Dr1g~x)?*=t-;2gzp7+6UskRaiDr zM0kt2>SP+oskLlLjU13WNW`o0O{jc2x&*I-A2}YeN>uIeMD>|bc5VP{GmRo;pq8J2*?kkm~yK81$NDR?XP~r-dTl_SSBJK6Dk_zRVd*{a%E< ztH4d+Ae%x)`(=K->*mJ=AX*XimqvTh#%ov(%9C%YL&`uauQAZ$z~&^e?5neLUyf50 z1c|kq=3pZ2qkg%A4SAo06l&(2jxJzwNXG6l=^YIawZtIK+!UpO)GyvkNd{~E{cWkB zf@k^wCyEG{rbu;&@7X4EH*SlxRrBa~-R$jJJIou(<$|fMK1KLd2VXXS<|;Mkf26KUW-bQ~v9KP2|c zAte^nHR9E1MuXfVZJKs#tSSW^g3{a=SX8b=+GzEVvgp5E0`lNJv{JN8QGleQS5yu=mNB99n zN&6aRb+3a9SRJM;LKi;tD{O@cFwN2*Di|i6EMbQGI3|1OKhf*mzVc0HXY98EySr;^ zgb|^hr^f6IqNp2r7%XsmC|NZPSfnUS1Ce-{b)7kHH$#u2+T5hBN5S*aq`jC?XJiJC z5@mrFrwLUkmU-mP0DwSHAy__;C1+umd(a_6Tot#fr?+Sv*CVeQJ#(H+7ZG~8x=ZmA zcxB5WuQ(%ez71NtPOdjs_p&Dx_^Mazvx6yeFMGK=*tb|7?QHs4OQ&%9 zh(6!|CTr~y{ptxE+L-GePrW)CMDU4ncKloommDR=e1y2ovWAeCZzM zF-WL@w4XyPFee?XznjWi-28(=m4(H#-BDj86qC?rv4SuDbf8Pgp^ugJ$tW3yw!&hv z%X83iA7$4c~CRC1w^}%kbmJ$6HRF0tFV#-x$0e zQi7XZK@-Nn%0FDpg-1l!NWMsOW_d`qSI)ot71|Op;z(rQT%Il#1=8yapTmU67!AdR z(U?*l^JmZa7wpO_JB5j`%3C~1*R!X}djwBZ>ZXlZD2QrL_Qs4)ezEsf^)L})parT( zrxDsuDzv1v-;LBK@v}!~y1TVgatVK6-f-~jJ`NGXOE;+IN_^G^kSSPtWw0O_q5D$E ztIl1A(h-!Lw!H3kyFU4R5i;2aH%gkST;@3yw-i%he z;S@#~xh^4LZ-%(gzIUo%QZ@p4ns&QXlJ*n+5;2k3^e~vgm2O`T(L_Hs?1IrINhSvi z(C_CWhFeasUf*2DKBlF!=5PA>P!9d0hTWaHgb;V}_$fD6O`BRH_wQ5-KqJ&KI;Ze^DwV$tNgX#WRCvb2-8$3qzZ9qQ3+MkAi*%0pfHbFZuKkv(s}9~3pA`!8?G z-?O`zxY7CNuOjgmJ}?<cOauA|7ECH z!r{oGwD$uF6)Ve+==tz&BBnSiYNy->6lZe%R}&isnDlLfP}yG9^YZ(u&BzjAOW+cE zb_y-O(unR2q84;0(33}HZXrQOv61%=({JR>Wvrr?H+-RfNnB@rc-dW*($Lql_;Vv) zqittCtHjnCVTJ?W+oRNEQT_=$V)Cwl-@LSsto16IXk>v4% znAfeRwmWYwPqvg;Jyk+ovrXjENz8P?|4|i8+L_#CfNG&D)N{EEUk8!eaz7!1(EBE= z0*j(5{Rn9=$N@JDLHmQDYY=AKqy=eS?NsgB+D%2rw-Yj{ZC2W7#ll@?gIIby&qpJ{ z_th>E(nq(+Ik_N}@rZmd%(-_cwC-stZ>VFmZxx0Z8|pu;JF~9ALUyS&=&8cyuA}2BS8tSi z;rK}|pl`jojy^-!Zoy$mvJ@COhvx&oowgob?2cl-tsqa~B(OO7-zR@_KB0F$xs_ky zhBuZZXI&ps$}_)#B-D3W)|x$v`>y!D6e#PA^yv%$?j$*E>GW+{nf z>%U@vjv?4G%WrK0=*rkW&1%0PIr=dzFBEC8^)m5oOsaFlUiGesQ0NMG^Ns()XzcawFkU6*M}`}<%z;cNOj2x;qghw}XN znCoUih{?zP>A-KGA!eEae6&lPUAKY>Rv)dgkW<=n7B6PHfR z{&VI@i^m85e50dPlP#0xCB^r1i=8|rXUM!=hU~1|UIj1-Klj4Y=JCxhCgy9~3LZB>==x58M zEmjlPE_hK=k#v?bsDRT@DpNSGhE-d8ZRa|o7->poC}i&rx>3#j%)E`)cU!c`rV$Uo zDW|HuxvP4%8u~B+cZEzNFqoGqm@ICE(62nuxxm{W2hBgV8tyg8mA19BTX3tbCOmCQ zvW1f^r+J8Gs-#s2_-}mmqG24CVoWHWK{s@#Xvf?c0m|MbVp6Z>Wpg%5)KmJr2D^M} z#dvDniFZoC0zMy&u6#-Bj$@0Agn?6zaYS zZjSm&-3(r(EIGB6c>o+bmo!8gS?rv?J#doRheQ{$RrwKYvpE37fclX2PS)n3qogj? z1zr8!vpS2s*IAZiPNO{5i?o7j2svddX}yaJm`46Gk-p&V8-%@vUD_Ap ze!eD`eK*cW9Ffe}AqwPGFv~=Gsf3NvnJx7n&-^}L+l%v6OiFK_v#R{w@4n$`LqzKJ z2sRc2pzTXpIN1gk05y57FCDuSobOf0>rB@!k6Z!2G>jREhXtAl(K(ILl3B{l;oNtdM`63xU9au} zFkrB2A2_;#hBAmZchf$#XlH!PX>)Vv?J@T3R5kN0;x(u0V<`06$;|a9)L@c`jN~l~ z8~r(hL#*!xU!931_T^t}Q%o5PmR%AF8zi8EiDK)lr?H-p3Pu0~W0IY$KNAWAEq#oZ zh9NMFmn*FlhBRxZj5_z1Cd$g^wKHu{D`~-PeyJzTp0@k|sodQ~==(!04;Wm@D`z0s zmrTV+srt9m!6p9LUYnRc*9DMX;iFeab6MdZ`!_;;@;W4Yh1<5OFpobUE$NLub zO7mCV)$lOv=d77eAea(~o_}SMn3>d)7GIllXfH&m$Ap($@Z^-ymWF}yeZE>32kPNr zv%DBCTzz1NG~vdd=21hdmU$d{S9y6AM8NbQ^--atUgw8Xvy4MGVy6m*ROSm63ATW| zI^K$@Gtpc1cW?@FYX+lWV>^!`z@p#VUhFuj!-r5Z#vk%5hU`wheg4j}3=~<5 z8;+0y=(rxiPoPwaIMHd;HK;N)aa_+n%eg{TM2H)HexgFjB}MkY7GP~qxbP%GcB^L$ zJs|PGMd?P;wu<0g=M~PMzG46_7{bdWAYGzXkGUnZnT^|#BemX>arO7Pl4Mj^yV28i zpQLRQOU9R2CDsBGHl=~Wex~nhNpw{3`8W_suH0DKYD}WyEQ8laugkJtb%SU3*r9D- z-=FYO$U~$O*;Dpn)tKhX&`XO~(xNXDOu1bx{Hqb~eIdDcWovLZq*k(#{8-FSql*i5 znU3_$t7m79EhLFmpZd#DCJ2&tx9RP=bKd&rO`)G$`PwCz9NM2l-{r~LRouMub&FkV z__JhJ?LCRaLh!9B8cI}Saip(1MN64mC<-K$P4DteZ3Uh{+Wow1s-=<=)qLX9Z`qc9 zjW=#T_$9)XM$pZ-&M$t&1)}&es_;)_Z%VflyX`-Xm<@oZzoSvLG&M*pU$eA~4=rEI z+m9v|G*lZO)%;fs*oYmG9rrj?oN~JO~oH|oFFK)bx zAy`_WSqLEMmykR#C(>N2JFEI$hx}6eEmY|2_>CIkczc%_$bwu4Z9~!^WTXP@4iDa_ zl8t@F9+t%>lA88?`+%?o;>I=p6oY_(bh7<4fT{)&#SZh{2C*);6U!w#j+&ch@;?jN zi?(4O<%IfctE5seUXt;#h5VR?>WPm3a>%8Q$xXSc&ZIU4$;io~eH|rOw8?HC)wKiN z`Y@+DeqaNt#{jK$p>t;xPgRs@sMJGT49KE)uP?MKVubgnFxBeIP=BchTU#>igl=%= zrGlL_nTeju(pjEHsOCM*hSWBeN)MBN#}YKmHKI`liW<~RA83>9jFdn~RjR(m!pn!z zPR>r7$?gON3u4!9-IIH2)!-cH2Dcl-Y{V%ig@34czvTv};$%|eWf&~qrai3r?N7TZ ze7TnQM#y}^>t9!4UwO65F@tH=!nkMLd=Ah;)Kjg>hwkBnT+{7-NvD}}xpv5_lYA}* zaS7u6m408tExu%OCnV&)NEiAzJE69O*E})VM+!1SF|YnEAK!Th4#_ea#zDokeiPaR zSl3}A$H?Tp&+w1>V;ruin>${b+tzieochw1oG`gQ@H4l`Yop9#V;|Lo0=fJwxwuY`U8oY zuXK@14}BZANm*PLxJ4&6b$!{CzPW78FaEt9>awcfk)$5}g0SD8BO<7TWb>nZoK=99 z-Iq9-4TNKU$e+(XM{!%letBk|WO%&CF0eJIT1kx+=!RO}XaO=LHFYYbX*eCdc3#kuH6Zo%|FzN~^qQ?0X z-mKV_;0~2h6fIgT7zpGadjiR#3-H_7yd#(Koevliz|El1ZL+NBUnwT`B$-Wb#l~%MJI6?(3?N6n z1T7pAA#RC%%?v@4ZBJR0*!3_%3D5Nhp0y493JDs|&Eh@tgr~-3C+PcMj;&uBk|bPs z?0^+GQ;P|IX`zgks4Q?s#PHat&q_YCRk?fbsT24n_hZ?DHW@44&? zGt6RLj9yqxqV1%x`U18#TLoe}XXp}Q;Hg};~bb7KT zTWh1$0XXG`>UgHLpuMZu1lD~E08nVz%|+M7#gb)YPPzqS-*|RKvM=IoRbh=c_ZqH)v4@bWlh|Ol<2U0;P)sU#2$DrM%kW6s-Jz$EH6NIx(w%j8?pQ5_d%5Jah^Q#xW zK2089`s}F%(;w3lXg{KRbx8RRR=$dhZ5VL6WM({1cNW%9#(2XJLtXvu`&FRrWcM&{ z-r_qeOx7HwiBR z%!VJ;{%aQi2WAGsy~iqYW$Yy-W*Pm5ZafQT+yznKk#y>~?I zPfD^Y)9=zdVO5e`kk=4oTQ~n=>V!4#o}Lbbo|g}AbEm7=5^&3SR7&zXuRpEe(`EUi z$%90kdPB<>2Hv1#oyh0f0rkJ%ug_#cFsy3jiy3z|pv#1L)a1vjgshF_ps<{cTJ+2U z^;y(HK^aLPL1vEi@`te=t6_2Meb2QNNpG2X^gv_jZb(EF{$<6pk31wkf8y$jvit)e z9sJEcmFlXjok-u8=ohahU!anjlOHhnh4lWpCIQDPubAAzqL+<=_}o(7Nz@yDp-5Bn z@gvwX7Pc`+W*@JW$@RINlt93M9+SU4(bbCNhxQ+u-@q2~mCuPTg@hlaN>?fYvq1UQ zo_H|{|I4Yfm$dVBi6!4VENP3u+@cU^wMEDW(1H5p z;>4t{j2HLicII)W{Hk{%mU|-8SXCzs3K)s!mE6A=i^`^~$ z*BcZ>_fN_lW=VPSi<-<;s4XIT{BUu|TH)0~^g-V#a$7OtdXYnxD+aw6w*Yh%169h0 zT!bv=XtbENk~WuJUc?~ZL<_MO5lH@a+2i1v%O(+e6#HozU{yPSGDW~Z8QAo2T2IKx zV-gL?k ztA_s5jWYwnCneU_?Fk}+Kp6Vr2dGp8TC=)ngs$}=I2J3P_3mC>#+_&2RJ6lEl^oW1 zV1js`Q$>jFADk||pm%fQdyV&kOZp?OfrILgf={aD+fZk{Z5j?jUjFmjTK1p1hM_IA z&waKLg*Bpg@xF5WI%1V`?H1o)W!ag+BM2q$$ZBTDfBu^e;omk87uU;Fof>=nmk}8N zMN^i!_^Z63q;_*IZ7ZFeon1mXlGdf%wcNg?Q@a0oT%eA_SkXv zqvZzhLC#%xM*pX8@wu43p%F}$^P40Us+O?K^?4O0ba*{ zy>^ghE?k*P(s@#VN;OGVEhlj38)`Q^$o%b^EbsqMCeXT9sS~rwj5-dC%S4s2n2FDm zrvHC>5krz}U`bl??yM>sAVrmcv{J5<(PF2;^HIH`)lEpd4yb=wBk`;Is()=sSJ5CL zsUpZEH|q55Iw!Q~Brz%xTK*6PNa8tan5o_!?j8vvMH%jfzt)5tqaYH-D&#K=;PCgr zaDhj2QN!WK;x;6*)DC2g&5>8iCxijX`uTFxzB*4Cb5CR{oXxea^U@wLT~ z8#bC~38|GGLKap&)J|V?%FPrub$#RC1yR8EM$Xi>p?%uo<_1RO{yk7?Tm?{?8pn7@ zIUL&D!35|05qGPTO$$^Yx#~S@r#KOJu&^7o*P7}c!YQgxW$s(um1lf*zP~&Drn>5k zRf3%0Z9HBY@)TTQ2wZdGjQuC^kE~l$~ zBO=VS;>zF^9`xT|YL(*}??i6xAY_|(_`EG*W)rx%r^{{BK1Ll}CeybpyTY12QPiUE zd=jwWORT~N)j2J)LGZ8dV<*8fjDtD~s1sHhe8K|K@jT`~isdW8o-0VY9}Q@UrOI$; zVTU~qqGHD=r4#-=!eOR)d(WS!;QXQghwS3zn`g9N^N&|T#n1;JPgr8iB<+QCSrfEq zprJNDMNBi+0I%nGC_4fnEe8&^z@LVe%vdjvhx`9I&yXfEBH&jJC0doY z>TFU1G(Vzu(&P0;Fy!b{HB_W-r3UyW-0Z2;S98}my6_Y+zw?jpFyBt~p(l?K#o2WH zfBo>F#^4pUdhkl2M-TV;#|O6@qb4!hg+mqKf8Ah;I$ReO6u8sO|4H(aHr8pOqfog7 z`Laj@=&tisYq~6g7O~-vqkq7#xse^j8wR(*o+PBRTT`jss#KCzw)n%a!B8LmZ1< zx@abLG`ZCr%0l)<1y5Y>0urJv@PPr<)aTPC2wqYz;kiJ$a_8t!`#d#14_G$@(j-oHK?uq~2c8D4{`f2dtLB|0vpw@MU;?O& z*=O^Ms^K~lcz%INgF~45T)&0!uH|-F<*hsQD}sUl@B%4@{;ZMD=~w1h&`YXJf7+%e zrBsDK6tmqK2oR3KBLk2vTPw#Cu-010sL3Fa)~bq#J?dOHLe^wFfV_@4p7h+c>o=k7 zn6=9?9jkqJZ+?41CZx~Vgb&fz(foyNSC8>qrLdNW1LITcl)sk_e=`s`ud`EaLG4c= z3GwuDnRNu8RY&WYwD-pfqh%8rn6%)qf`!`1_bWQu9#4Pc|0?~!;on*2s(7A9c)8|a zIXAgA^Q3jbP}PgQ&JQQQ(=GkkJ{SFf(%Sfw{Qo>b2q6eo6R7U9TJo@Xn==KIYX9-5wv~y^pN)rSp|oz2 z%wlTN>Vau-oIE$=33Iv=DN(@tv;Yw6KNqp#UNZ`LM+gOC7P=_vVC6DF^khSGj6zsT z41End&k=R^z!k$lE<&SSt_Ks1ZE{h2G^m4nYh&iz6ggkATf92FKdUnW;!nv9O5`3N zQBq%qp|yXSIsVbBfl~Pz!4Kot6@eW2H`xCA#LC*2guh>*{}od79}@XTATQlOY>C3* zNd^j?DytfS)RXT8duwaFt34r=EMG!na`ZaL4cG$)#IhuA4_y2AxnDg%*QT&kC|BJu zk7h6$=7A^?CN}R8UkG`rC9L- zWO4a$@|Tpryt5|spL*2PYmgQMK0nec3hPGJ8e1|EPX3ojH&N^L>iw_U6O=&jEaU|P zFe6dc!UjTO&+m&Bb={op5G=ZYo<4nYlIbv;n@em8V&B28>3~hfMolq&gHn%CG9yxS zA}x#?7o-8deuS^w7t@^oJLcsnhFyNWw>WAQp^)!gMgI&of*s}p6_+<$i+ zLpwDF_>oHWJ$h4)Vo^3yIO$ieR`vBmWwK}o@JeiVzqEKAv7TpOwJvm|W_LI@hlK~y z0h>Nj1JqkbWzO)*rta;JNXPnjb#+o8Di`v=ccEL^9T5B?{eS-)pWe3q`Opj6 zVH&nzXjfV2<^KOX307Z4-Ah(2$389Hvs8*N+}zYes|9uog`2hGnO7l6V%jZ!Zc z1>wcSDam`xWy+R>FD;@XaPVjVD0 z5cl^Vm1|)_U}&?uk8)yY)8!I+q7gIuEc@ z7=JWb<t|1I2&_vEH_Lu?t5YrhPIt1JS!}O^o{Sys7Pgx zBAI)xDSzP~Fjs%G)DrCc)00TdSfC=`JJHQ5jy{M;k2P_y#QEdP z{@enFlmzWor@rcVsCsz!DS0isq7@B~n@`W)Z|d3izUO+PuJ6eMBM0;3k4Z(PWG$P! zUHpLqvj2N^Qeu_AI}Kfx*upX2z(KWw3K#OC=K{vyC12KpPONxffos<(eX<>a>+h;? z=H+J9I7^Htm4V7n{+%JQD4%0YqFRNHbqh%jW zyQ^U?O^_Q*po-#?iEh_NTO(k&SU5oqwahmdN^E(-QdOsx-zw;okncvcX zLdYOjB5jpe&@p%hvi3+~qMjPN%V;%MUYJ&Rfr>$6{xb&iXnQx?2R2l$+X9*n|NF|IItga55Qu?M6;8QHCp(wvugBWbI7-bz|EY673m? z{cB_B9GZ5V$P^G}{g^`boV{q;1`p1zyrmZVLTD54kl=sMmjlQs4ururZQToEVh8RL zb#4vvUsVe!s_RsUvusBQA_7J?f=BNQ?S}5!^?a-`cF6Kl_k7l_w^3~hRn{Y`nTrY5 zdjbO*zinf5Z*33t`y1z8pW^fub)^*Am&VYp^GK>>K#p$#RLFKefE=D$jq{bBiWoAt zXDJIIyg9qv$E$nN6AoU=DS7TL>4S2Lf!5vN>BhiRCPI>RRt`}@h%}WbG!(WVl-W3j1*6&M7H45+%RJPfl zPCP4^)ydXK4jJqO>QSVKqwLGCX}nxIIvN-gJ`Ci9KS4Bsy;Vz~Y02Q-`WOz2(ttPV zZC0P-dv-O7tVH51@oqvztsItlw32RR)@|ML@*iHJIUjSXQqZ#Rn&9dkJi0V2sJ61Z z8M6aJ?|SvTNZDx?v8#9cN6CI|kw|E1?}sQdG9!_DRn7=$ig!m>i1jMGXO3U|G423B zm}cN%84Wl|`xKoaPir4nb;g|>tv?4=g3Avi#M@sRa&G)V2vq9*uFJYawnKpQy8)TD zEYuMQj6(EI_!ouY3cEh`k9a>P z0Lbuzh{qGYsZFh-t*n6p?(0IrEWOgPgaJS}Ci_(fG~tI7Dj{lCW=_ZQ9MMjtr(3Y0 zMQTCUVe_Y!pMD%3MaC2CTDf-w-lZ=85@Ceceh?Dyg$UhNJ5=cq%Z77e=|Xl3RCX&m z1$H{wSHXFxbPVP!gx@7=LW*X^d*~2Q!oLU{0tZFBt0)s-M!7v#G;7>aq-#NH^wZs1 zeu_z_Dok+1nyB~XdHL)W9Pz!CV8#2kLCc|skJKH1N@g5KWZwW|eN4&Bm~qYIDd$O$ zgV2X@v%U#Y6TQtS-$E;w6npfX^tpnH-R;xQEjYVWf?3CPS~rymN(1}RviIwdnoNux ze^fjq*`;6vffYsJ9ZB*0~N2Iu~QXC9$18Qa54aIBpcVyFz`` z2BAP>8-m0-R$Yz8TKO9U<9eE)f#!`G+&Df6yR7VQ+7CwQX5Hgv@@ITx3j3xeiQ54Z zd0p$*X`sP10Cpg+&U6nSwv+@sycpP((A-jupZt`Axlz3@!9pqmwW8qgGG!Q3=_*h6 z4QZ&r=k)HjZU^?HPL;mxqwL3NSEiVt+v=T&AgANqtP)MsK>+QF@Q2*IGeL5{WFt%`h{6^?>v2qHT-#9)etC+Q@+N7uqz z0>1<<^s1o_0?U@dnapMlY*bC%Qw8&TR)lyGPaPx|aT!c*qp_Bq5Wf2M)yKIz#mSIT zoe_I#SBF{aOzTbRQIWuAPS^DYAZmE8CBZR}dOzLWs`x2|&{=tD$o=!}O!gqE*H>T3 zlqRAy%evCFj+wN?F;h^k58yFq8h{Q-yAIqU>V8vNd}IeE$xykSrRBR@2luT>K+AsD z)4eDiO8=hpla#5$Eu1&khjqF%JRjj@k5G^p(Mvuk`L#8JT${`X{9U2F ze(MxpEE&nOOue;&u*4US)kofLz}N@#X2UR02idH7tsma)y_XyN(4=J}&J?$2z$mCI zE71;!`u@!;>@&}P%ul;tNY6ep^L60kQguR7T02_AR7oJfkXm0+_k2z8$m1BpYU;Jq ztD&GYdr!cMJ%#jx_eFUjiYV#-y)tV@&J}+`5?wK<#>*wa(6KR zG>)ZFahi^B03duYIBnmJm}gjPig=86dUgsxpe10Y6B`}5z%&pojBxTO0SumxS9erIZ zeqvvnG<(zTQXr#ch>uGxSe6R8Lk8+buDL6QF)zsSg#LsX!hT z+k56~{MOy80c&lyLoX3UaYdwT-5nE;JobjoN5xET;;E?TDJJxsLBTgZNm9Fl9Y9xF zhu+lgIV+Nr6%jx!6AaB(Bz^fl;piL0OOeq)(O~zN5@NHD z9gpg$5X!A__0H1XQo8*ek-Se&le+HZmQTXUx*uBTEeWBS$DfayEjBQ_)`2N71+kph z^<=}J&pf+7axm`LR$l&qV!U#DsdW}Vg=V~n}EoW>M;kN+q| zV_ZAr?SA3Be0aM4gg6B-Awz=n&! zJ5yey(gG*)x{0r^#HWX6K9d$pdOHQehDPOb`JzVS&pJ~(bbNJBhc^aWxo{Tgv%hMx z(XE~Ch%8PNI3A(wW0W3VlRN?=C?{O7V8(`{OPj zO=_^?iKBuRAG@X1Ou{cSs`^IL@!sY+n{&QB)J6eo`;r6eEn%CZeqH?dyeKW%zhq-A zRZ3%z!3JhPeA-TQ2Lteg0kHLJoS`M&v1a!AjZsQ7mJ2uUlmpK!IZXQbx8$uwlhXh%%z9&3V%I*0skNc^i^&8h}U|DH2E}~J}cUA6-&)-`^ zh+&aNRekVm2_igpzBqQsrR(9-U(Duz^7Ek=V{tg6dfcbnR`mIwc}_n+*atQE1!CQ- z6WuCLCU%A_NJ2nWEU@CNYCTZby|a zQ!P(#mn3&xs-f-z1>#C9dUHDMCN6w+2TxUT3>>}ixFExR?cRiMBB6e6C&urS6P_{aBJdXxRzS7}PN%QzVym4b9v3BtoqSm%hIFR}z zwd1xMwwvsa2A^)Jzkr_t@P+2^PAjqMSYjBmz095U&@$SgyI~n2OVYm|WZk)3`(o9F zSda;2fq1KW|7VN8MVRng0?|^Fp2Ilqvl}AP&p916YLD8{YE55nyjrqT&&7kw(dAs| zyR1!Q>z9m*S`>>jG$y>-vu<(&V_Pda3M={k+b}|+wn|NNwRL!dT;s|$<5y%Yf_I=$ z)f`d3LnLXaPL;;+y=_d1;`V=gM?9@#<#M_A-0YUioFfH?l-TNJrRi`r6aAr-XK?We%@3Kw zT)Io**U)VUOD&~5k~WBbHj;cojV>}*&o4HUz=BzrEZk{Elf=W~y&uAxC)uJldgJ7E zPF*1XPkWYY5){#>lG}zU_<-IOGo|Jnn9dZwEvsl!>Ej`?h-B7SVMZh$;wi zk-YNuXcCSu#yz7DYZ!A~w%eGRTu%B!*l~9tw7*|d)LLDX%H7A#-?76eXW$9$KXYlv zfal#5!QJ!_u5*JaBWTGCCqma%PvU%n+sdeK1uuHGZ?K-sO9f@hu5)GTX(Xc7xKBS; zY7>HiAi4j-bm=@ykR2qt*p(`^94bA!7t5c zWW&WGekK}lY~)knt`Tr@R?%f6H1J>TcreeUy6Y^FKgnQ(sNV0T&VFw#*0>3+@^1(vf-DZkXs~@Mf=_38EC{pt2il;+#4nhfAva z8W-KI+;P)1F;@TXVjO$86PRo=*i9qF&YB+kaH{jJ=v-qJTuwE#KdX2rDn)*qMYk-! zl=pe={Tmb?(nK@ZV2`~6e=brOJ14?u1))p=2Vj(@pZCllVy9I9Q|aXs~E<{meik*gt8>A z*V<{h%q^#*8H)jL#dygp3{p<9PpY>ap`nw#4$PX&h{yY2h5fCMZ1bD&px>?8e8DTJ z8u`nP6Hhi3e zl!;7owbn1*RU4Se9feSKG_hYp*A}_XliBoB)<3q`Udu+GKAUks>hELm4g;>@+4QTV zE7Jorg!^%hN*1OTp*IDnq=J|PIOpTW?!t4T`gMfdn;@GRN^hyfjmL;mEurU4Zu1$~ z`4nSQ3X76KQmtEMk&g>z@GL3!7hgN+5)pJVy2wdkXa`W|X{hXSH?Z&0x^9uP@JiPu zPOQB*Hb@ob|G7)$N&f;HUFtIvx|DBga$kKfx{59x9qH&`bNi!yT-YF*bmDTwv~C24 zS3W8OtF*g~jMnG3zKL{~ZM@Z7I(={YN%S^9+)vES%8N_2YrS-6;(vXdc*)w=WzNl{ z`Bo-Or+3<2hPKLt(IIq?5wDcF@%mSRtnKdfJg1<;g?FUaF0N5~!}^_?a7}hBL&8m5 zqG`HMl)LTP+s9s7YY}__L`LQXA+9P@MYS%=r(4mr8O2{S1D%->G7-Be4-d`lRQ4Zf z2uTI`bYiC}e<{m-(0kkfckPl2()qdynXoi9vDXNWjJxl{3u^a7aNSypgvoYGjLo;> zOZWAppdr|(kc8KLU)2(j9Oo)lpf&ZIHB$#eQy#2cLcaomdi}Qt21Cq^qw)RUWyc)B zO~_qRq5rnbRf*HL;&$x|!M|FZmYw-s2J-i$A4W>6L}NO+n0w-5VpNCZylwL5J8omy zRlsGz;`-p|J6g7%q9aM4#0|!BxG*wh0bydPZT>`Pk*V`!Tt~gRBBXtY#DEUU#UKfY)HoAdPhJMo-*d^+p#M|H9If!Jb zD?Gte_hI4QEMd&-K)w=aX8E3((6qOjS@I?o7?I|OWK9o8x(}Ts3<}ftv$72CTYneq)X63khiKZKS(5 z6}56|r`*+{u^21|M0$oxAz36>+FGPbO=}v5$%8L2dh_XQnZ&)Ni6OTt(;$&svrB{K z6Yua!sR=6&wro0_;G^T+-=b1a32KH2m9f;l-IjNRf$ahk4gN-6)t8gL1@53&DdsTA zIY{`Vl4!^%YK-vOk8M3eM9eyS;!i=tc%$;5yy{a~*RG$Z%>}FoOoms>&g;6Paky(| z-Lpw{Xc7I^F2`;rS6t8D24(w_8cRDJ@9f^2Dynx9ZnIN2WQi!o@79fcb~5-0)J2yV zu&OD|UrYNg=U@UG=P$&^j}Mo^gj$e-SrW$^l>7JZ0rZ1rcQ)eTkDbA{Xc*edM)CEo zUY$i8j?Q_L9lRd8xPSE!ChaXkj0}m4H0BfgN6pj~#)iV8>^l1W{chE~0FzLjD~SHx zBcZTFJL70-B3G5nc`#Zp)=@gesRVAHBH|AAU?H;~rM>{y52hXho^m#=T+-DVom5cq9?m zB&gj90yh_087Q@vA&Xu9GAC~w9I6Rj?NU zj^ep3U3ItU>8;=MS1;svljG%H5Ipl29-Y7gcm54v&@F*G+m?b5XW4u&#c}xg`WVXQ zC%4c<(h*?Vn8QK&W#>yLul)rZ*7l0@CO~NjzXVWF~n?^HVWX4$veuD#nYe9zD0`g~dFoG{diV-DU% zFAWMe?%Gnb^h3Cxz?k{Ro3uL&Au@hCV>wvKAe+q{C25~3`G^rFUjQ&u(0BdoRvrJT zKQkY7HTNjyG%f4Lm6%;-2^i?8QL+B=#>j?dIPHl&Q2ih8tnTslw!;@9C&wXGOrQQ` zm7(kV9mZdcV|xT{18*x7na9JI+VH(vj^sf$f4Wd)5>^iJPyKZ{0g(r#j?CwG7+-n- z?P4!z3%^c-GYphvnp;O|f*n6z9WM#u+g=k%QYiug(SD&9@^&z>`eV<#`0*vQv;Zo;;X~f!BAVi}6pJc%$8B>3V`wi@KA? z!pMMav7w|d5v^{4G4$*r{ydw#^*KVlAu%pEF~q_+QOsa|NEiL!o2wiMJ>sUs$BhzP ziCo}q3oIrs%tvTBN0`H+vTuDTNkiqz5G4^&gbmF1BJO0|liSG0*c#s}`GvR#`Wv?j z#k*s27mzu(?)~gv^AF4;ofngc$aHF+S!i^wv$C<1*k(lCr6}pi=~&+i;$b5U`M}nx z|IzSQ61<1(-*M7B|m(mV?(;RmG^o-6Qr_&`%3*a3@! ztmcdCfC|cMiYHgF+4)qQXcm}Xn~j^jj6m~_5w9|MWx_vY?w<032z4AMMxak($7+QW zlMFWBD}(U#tt4}(OD6Y?|8kr%9t#J);o7v}(YfLjY8L zP@or4cA>*(35J3U~ifNiFVa zHQd7_%FTVO4JVb2jc-0MebDpJ1n`iIrV&TgOEN*fA`t#ru6*RQn@PB_UYH~qKg zwo&lz%%?MhR*rc(>$0K*@HQL?jM4!EQ0)PF+#fPEsA$`+H^m$27YYc!K4v~6pCW;3 z`=RaX;JZ}laZ2Y9u~$>{@H?E*PLIEXY%U!Qa2vtSJ-gPj8piXl?7jzHCctA&<(~bZ zy*bsDk-Yj|+Trdx_0QRbgj&zO$lggUz39N~F`!*EbnBH}G#YV=KQQ*r#JBd7rzu^Q z|GB`-QWs()H!w2x$$q)HD8mstZ#QZ(m}_}D<9&&0QE2~Tbz+159`Jcu1>Ej^j`pzg zn#$Y)+6oO&CE)d|D->aFAgN3^Fc!v_NGzn#`KvQ(J1<4z)^oDww1n^CUEOm5u~crm zo+ST;f63M6IuLl!T)xwh#qJ}r^3$zRy%CMTeLaPUQ)kbc>%tEkVZehBImfQ3_xA_o z+Zn)GzIYJsa+iPU)%4qCYBQ9*fYsQoJ?_1z-PgiPG5j67?C5SHw=bu{I}XVm2m2Jg zfJ`_r3IWo}^I*wgnRU0=slE|+E}@OF`6`=eI&i|s%wzCPjGs@H;zl+~O;{Y|KG0fd z-1ab>+Bz@w;s7?i#N>R=(0_A99_3wB6EDO!kjCJ~Qd_SE|%^~W}1^>ba49MUOW12N2wP*0+|Gdpl|9zl9ELcX-rW zu3xatj1xv0CABsw5lnwjBG`E0>;pRw91V-C83Q~5-mr$%5`)#|$R*in=YziB%V#h! zfh6Wm)Rp;u7H1UcJJo+T4Ly6LDQO>;A3azxT!%ZE<*_$%xC$N^<1T$KT!s%R9k=)Z zxScJ5+#t$TZmVj$5s>dLJQCl_dJg820A)1r4D}Lz{G|H{56d$};<#po_(DLky;Q0$Rc)t%`i{0nw!;b?BLn*?^@}gDQ;N zwbsO*V<2e@*p!&{YwDaqu2ivp!pdguhSNNcC*8uvZOJe7)W%F*2_^H{`!ufmvz%8A zTiVOUWgG2K;^3j;CU&N-Z5b(@zr~|pp3Fo^VC}dN{eve{)ZXjPLdeuVXO`m2!(Q23 z|KyM|Ihp(wKFxg0kjSMLXo2V>O%kNLVFqBo$~b&J>s)^VEzRFH4Q~<=TQvpedf4(1 zN?B!CF)`pR!^GsqZ_w<6*M5elA;Xmq*fy3CKV5evuE_Y);y>Zp7RJY45X`Cg`)?mJ+Ww!{MXPjnT$6??XM>DCSCil;N13bb0 zPMy<^?;}}GoE1uoCUxtZgx1d%+;ZlADs;DWlz=a!Vp1RWomO=MP7IwH;~=S}U;KU+ zzDuXBv-)tOD%`>GVrCAqpN*3efz;T}N}1OD>xgiWiYYRtyt!tMbAk$@)zkj;hE=jF z<8d~Y(hPQwoP0U+t19usLGPlovIvd#<6==H#b*C%-cROVJ=X2qk(%}wr+hKl&(_y+ zLfmbw#SyQe$9OYFA1S)OZ?*Bb%4QgHb3YCJ`q+Pp9UxKed(#7FF3as-EWE}m;+I*v8F5_@s6ejf+SVU5~Y^D=foKy~Iu@~3W%ZUWtxXXJ+yU$fwO zZI`%fX)h+jHjv#a=KJ0dc}4eoS9Z^qG6hGz9U~^jH#R|+hf#!6Z*DZiLdQuze9h;s zinsIJjP@4f>^3Z*pByFX=%i#I|7SQ=hG~5-3vz2S?if|7;^rcXl`d++_C3FP3alAl zdblCEOe5bmxlC_q`vAYI)coA>@#DOmSehT=uYPN#MaUNo3_+fUBjJ#IElyL62?+LN z6A?S|tKB-)r$?*}-#cGT5r|FT&Yyo6Z&d{{@ULaTJoodk4|c@1n4_I9yrWpd)g%7| z563cA?^(7gCUei6qa9#IJCg~kUiSGo^@4hQ#J~VdXY;+VWGi+Yh>eJC^>Y~GJL)|u z^xm4B1i>+E1{62>ji`HCR-3$P-21@uyT0KlDuau``?w?BZny3{F#pBU#ftFK{51M% zY{LTM63>{moxDJNb#qiR&#RV~jW4;P;HWr}sfH*TMuJ~p1S^P}a7f_3?pGJJ@taR> z19zIqNLxy8jR~oYTUA?WXjtx#eEISvW`$6>^T?>=5`meZUm*+qKBE?#!QF)Ay>Gr= zI~`qQBu36GXT`cQq0T-ux}wkS0)=fk2k@1n)%&D@9{rlNmg8sm&S>AV;I6^0N6Ht) zF)+VQEi;pdN%;avN(DzMH)g5Hw`J+4MA5a$9?$I56t=dq3XTTKi~RA^@!iXEq3OL6 z=GB;Dk=c%_z+b)ww zAY_nOCZ72c(O#y;@1a?mH>=~}?eSqq?{VQA)>JQHOLGE3&3zK}6?nQN)K1_ex!t_Z zX{^n3N7&87;COT{_z?=jSw(+JY?vGM_56I3Nzc@t`}{(Iw_K}r0vO*AR*^uYBx;oC zfNGdG=BLKUzF=~{D$+n6GINwG)iilX2ZwfpG9Wu}DMu%zA9esysc~;eRoEfncc(A?4Efe8f%9;(z|U;! z@jmPLNxO=?f{u@S6$s1?9GTH84juQl6P_lgZh!30z^OJpQjle*&UDCD$Jh7Hy-;dT zqVQ48nhBZ6c$z#i8a9Q6sx2b0C)i}Uir_X)*2;Ffo)_^rpFt|JUglK8!-Z7YU^q27 z&D(#bEtg!47mUee?65ztk-KD;=2T^C_u6T7LIC6yWOgS{9>SbSXn0H|ydf~MSPLUS=Az!2}?GA%rqEeE2epTLcn}>l! zRhJ~Cs8;0V{vW7@t(5hHL2!sOcd(n;I~d|jm;a51+o`a!qT*;p`QrRq32js%{jVQe z^`9$oR&TuX1{;L(PEM-gtpWsZHU$3aLZN}xh{0+4Kj!SygCWAlV6(nT@_AkGsFLSR zHTWjTQ<2)fG|7IoSps(5qJ;=qr<$J$5tm^%UcYqCp)HmqM41K~`E#n=B>()zpVywo zL`Q5Dqb0AGnspUp(_{PE$zWLns-vb|Z#5DENijS%o5K>%%iqnWWF>D`9$nIBXSTP0 z<=Df2SM;;c@GB2LTG^dHHJYp$?V$7Uj(bT0^F&c{ZnpfD7K(Ji7IoN+-$ZQDdA5`w zIw=!DQ+RcqOsn{fDXb{DG8uw}HCA_DM{nrmcQ{|0l{le9o8b9#{{kjV$?(c3JMhcR z%`L|CD%;vnF_B(dk&xxFC61#IL{MuXuzq&qbw?X(5j_ zqR(YCi%_#sZr29PvKo(SVdUQx5S4qa@(Il{@W#B3P25AGyokF%qmMiT$pl=pO7&%o zcQHv8V$D*kHOU&!$2Mk1GX|~YncDlh+Iqyi;@8tdX81t?N@(~{)MPwE)X_Yue{iy3 zE&~5;wCG@&p4Th>^hTrxj#ydwV$aLr3rCW9r%_?V6K?|9A?hU88&~6$>E~2DDs-zWv94n-(C{)m8`!b1_nHe0w z^_oYid)z@jU8jVM>#jpwcc3zy7jaJO6}8rNVo<@J^tHpyH+;m$n~c>>9nosko`jZ8 zMNJ*Znw&y=I6VAjtXs~$!d0cbS$e+_nHN5 zlIq0XAR~<5G@jr2$gg)blufQF7l!UwThEy}1=9Sr={fcqkdb+!<;1P*X|9;@U>ni1&usM^C?)#p^%nVVCP5`n{_ ztBQetogfqQkj6~AX;x?Bh$7CcNodLs*=6{UPfVQIGb2s#YNJ&iy+2j1-Mv4YylV8& zs-#PaVom zBV=#5T2JKU!vARD8-Lk-usE!FAE~Cr24dTN>x76n?_myeuzk-0y%}B_`1Er35_XoJ4f3m&ab3m0yvVsF=J6_C zhhqrG|=c}c`pP zd1#HDVx1nJ`5<{V0XX4h9-;2$num-8HCv8+C7MU9x3F1^!}%{Hqt>T$yb-gl4>4C0 zB9hf_mlv;vi>loX0h`y<5J+%QFB_HKlwa4t-gN6!eIHrUe+gD`IP1R_7g<;`j|K-0eFe$hQy9dN|L2&!9gE4#Z6Y_Yt) zKR@M!JIGWwaQvuvuxylh&n$DsDEZ;V-nYWWa>TGW;~vOzU_nbY$1_^^x#C$Jd@q&C z`5N9zdD|!RCo@g@&+7>5jH@7lH{OsGl=ccvf!xxueQu+s)+%Zc9H)m_FU6_9TgTGE zOx`_l38R+J*s&t|>*;m!SsaIsW$_r^rWi7BR68|iZr&6t%f>r>}|8L zxt&deOz_gAF8hRncKRJ53(KnOKt9>@{s6hqE0UNn){h?wjCnqtc(`N2UM*2GW2X|J z){>`=7++Rf5*ZkCe1RJ2vwu#6B+oX`pgla6#;7zUho$8*Lh);u9%PpMo0dL8RcBYt zEP0Bb`kM#v=U6*wU5MPxi|Un30+2s4nhu{)YFzl@;;2ydH_V6axm;DuLPW;f*y~th z>qzb6XIOuwU4>h#MpNi$qD(dL`3q&V`TcI`X6tH=d#+uRJ09%?>1Wk;3|wzTW$K24 z6mKBoZ@HayK0Mmnc{i2kFLQbSpWe?i`>*0S7DRdVKl4UKM(Va5g+oa`w`hz zvA@DT#B1F97f$#L#^A;$z|k1q7tRRMsNy!vHev@YDyV)lV6oN4cFs>4UsRP0sDWx^ z?8~^lGR|%DkPYx7A1pLU)>fW7KBg*sWb0qgdTNYY80>}L(=gLYlvDLczKQR z*2uY->jJeN4r>Pqp-OpBS)F&)#mLxOcYR5}`KMk(1t|PiUSWw>jJt7S_(>7Vd7h>JJp|<)$1YX!6JiH zE^PWz^hYK=S>_L7DMzw{QrMDropD-5>ze>4@vy51DLiP zlgstN9AF`6t$&M9H58)mC;Qc^*-TZVViki_xT<~iO4RtCHP{AatD5;C2wZn3t@5KtKga~B$Nl+o z5Mkxo<@|gcgq*9vtS{xt9FGc|u|)fQ#H5F-L* z#na){myGTDe3z?8U_qn?Z31O}vIyt-mm<&U8tr9Z(0k?}8?*yw*q5DViTpI48|zsW zHxGIt(`$6q$|28)YG-*$xgnYVaTKhP(jjGBC32snWOX8E!gPRW-1L4Z6L=JgZpiQL zETuoPV;bz`VnjSSKVSs0j35)$y?Qog_Pnq-(fn6|ibOdJKbh6%jA=z6X8t_oW?N81 zb?&YRzTp#H<*EWEPYB!;`cOU1q z51C=90yj}!G;nemaj9NpK^maXqr8`dVRjXtTq!1(ea4^0aO6+}NIsV6lq#F-wjO zVH4Fc%5O9uJm3MD^=Hs^OMZU2<*1&qqp(|At!^$ql%mj*(nnJhpf*{~WG=#T4(ks^ z5_PD0y5bEoL(3R3X25E5GkmOCL?b;Hxq$Th#Wh`aKSk|rnbD~|b~m?k+VZQ|Fq{Y$ zhecvvlfM!VB)|vdN>2vU-Jq?0JHq4kw9u>fudv!ex2>+r;XNGek>})MWL>thv6xUM zJ0}pCzFJ85Ph%|c$Gm4kX24%o>YG=dA`*8asz17iN@A;}N}_i-iMM7BNsfV|u@KrF zpDGxGKK_?l0OU%+*ne94u_n*=iW~ZQ&SA?ILz0+)%QVHOVqP9M^Y&p?PEx@9L*bbD z(m@(B6LLv1B4A~(@|+V^Ym`U4piGpzR_+EoHH$_HEnlP|MHUpva!8lf^5`&VB12W4 zPl8{#Q}kNFUudbk8?R+W&be28P(9$!6QxUY0+fJ%^yq{tHMK0l47K(UnCbVBd_eB{ zgKG1xp$U+}()$q1*`a~!67e=R-YZ(H40&@x1v=KA9Gd(@Yb~H$La1UOUR5J(FC_Nl z;j(aw6X)meL`&CVh$Sg}VR9ci#pNX5`?kr^>3lHfiQG+z9rVyRm!{LGHu5asFPL(( z+OD;kDW(rM6+iZM-OM=N?yzL@)2~glDv6$##&Wl?ALI?NJ#^SA?&96s;`QY~^CYm5 z6RBH|z6HGhql>@r8%X7(|4VW)4pwm6&E5;&Ja%%mJRU3>oh6Gjbe?;zRS|gKUpvzQ z7m-y7n5Pp)ewP$WW;bI771Nu$su+39;(gU|$RmOetgk?EstjAYnYplNwgJ-tMWsc* z91#vL6v;2LPsSGRftrv|g4%Z`-xt*FD7L?s;T``{A2j?44UHeA5$2!09G8cHReoB( z)ucbf@08!MKd6N)WQ9XqSCJ~M6l1IvzfhWH&(?SvmAgpphMjPz=tORv*$)a&@z=f> z2zGXRCfc2NP#~g#T~0kk5&j4+Z^r4Q`SRL>=$q5CtVYV4J0rH8i=Yp78_Om;KgB^G ziqN;{gs#{6pzF)&vaadq?|3~O<_a%jbvE$e6I%ZZK}i^T1UFa93d?QZJdBt*x_6GS zbwImoA&Ak*5Zzm8BL2;1#D5p-WU|u{?*1i|h1BKL#B~FTSwzS2 zkS|()skE3cmRhiLP^4zqlMjHZyoVx>)vLK&O`mjZZNO|}@ocJe!`auzJ_OkIq9EYK zNH_C;ZEx)Y5qk*Vu-@EZ_g|4;4<2s?AE(SNH%2ZKm>o+Vi-P-cGuy9XpFGN`s_r59Pt^3d z-)zZ)-+I8xV7AG4nO1XKkQtdvi5l4RehRMnml!M#VZz5J6_>&k7GQ%Pb4T^!g&I&8 ztxvaVck37D>LnM6{Hi#S^JH8C{9@9%aLMn}lSRtA7ZvR8r&b$5$1@3$;#;cdJBeHT z7&Yldu~k-{_{x*y(#j9dO3T2jD+UJ6vryaRxLiX*g`U+n zgZ>a@4472z>J=k&Ww^H7CAqXbx8vf?7OUi1`}c6Y&haAjOTTTqc5fTIDR!47RArZy z`%9xyDFA;*$thWth36Y}r*ZfNfR6S+Sm**2LB88K=(@|L^ z4aGxitGvxs0ltnBQ6{q~O6B4~+-Y>+tk9zQ6f+S8+UlXui)59DC}f)=e`CPC!s{j^ z!kO`?AV-!I{Ej2QfPbNud}>kZ!>RGQpx9?EOYr?3{3>b`y%nqM6-N3%3-O4vsxUHW zFvZn{fo2q^hB&(jO|R)KfxU}SmB&9c`8Z%Bm?|GoSAeaI3c7MQ$2ngc_(5ZBm03qo zVzk-Kg=RK%n#|@8so*sAmN`5wsFi(6s*7Y$*j^s%*uy2(y(Ort!#EWgH)#)Mu#?}I zyR8Sr_SrzAH*G{5*QbT`thbjN@sO^;Jk^K02=o+Xizy|O-J-n>SWPP%oA9f0Y64VW z(&@Jzjn#?|I!;itEVW=mu66B*xnw6{RJ|q(QJryC@Y8YqJWXZci(q~iDq+UQ4CD`m z5+AS)X%cu={wzgzRpfM(^FrC0;rg~e#LrDFzqT-z7N~4s^or>it6Giv=Zk?ZjUS#f z$d;CoCr7u@F<=C&6B9|YC#l16jQ8$Kq=$+!f6r?Si)p@4!KLzuenzwllN zZ5#K6yvMO%BUSY~;#jQ7#NRl?=j6dHbtb)X@Tld+Ka+K@Zle!vdiCF~w+P1`+m+_e z@^DCIIBzo{^?P>(mVr$@*$ID#Wy(7cOvDnOnAE(DjD;zRu4Jo_%U_j5Zf`~3mKQWQl!Wm4n<_fz)M{Jg zi^6yk)tywhcYPi=R*34^mV%X@>cuFC*W2fd`cabB`%9)~C{$=)+lvJXi_jk};uYFi zz+VeAmlIb zp>i2}2*Tmzk)JTzG)oXsDsrQ~Of6giPFAa$pzgRz*k=X*DrF~9I}A|7+Zx3sSvVQl z%1QnN_SJGsFv9?j>SEA2c@vUG_z7s3y@P`(M!+pG+T9JmmEMGgMQa4dWRsm*&YfMQ zsgOV}v|K>=0*zKR|7FALwnU#D%Wh>&{Op-CS#jd5?~0WE-RIOTxzk`FT~(4K#uEsZ zC)~u-1AYPmvyrbddPMf%G@ya?{qEfcq%6|rU~9#H5PpU2m=Gi$`=ITe?wKZGo7o)k zOmtSuUnT@suq~E!IgPAC&`HT)#-|Xy8_fX5LMu_W%gDv>( z5($CE_Ydz4#<95${m7b8DY_9Pj>EwDTxPWY!?5#tZt3pxxojq z@1F@a6o@cYWWa+rgrzF(@Vl3FfgCNlS|w$saxdo$Bm0U=GdN?NH|FrDo*oEZnoaT( z7j?1Z%=^o140kwxHSX@Dm{|_5BCi*0C+`iVvna}FYkL`HFo)3R^Syb+BeYDjCdRND z8bUn@`&Ot=!;{W)XI8_CF*pN1d3bh;NSSNd^fcPO$=vtDdhHx_jm5ur98Amxme7bb zPKCYj1pvnTMga~_L5*Em=(vwFZ{6006&h{RgKah|A(Y4Rie+KR=QZpO!|O+S1YzA@ z&G66gRWZ}xGWu#Dp1#5ra}l3qvH+DiR6Vg4pG^Z?qhrT7Pk_g*pQm2r_?X&A|L4~(pE7knWQ&8`j96}q=>;hb*MP(g)pA!eEDX51x*jj z|4=mEri%kQpfY)y5yDkukaUoqjBk0Pg61Iox}lpg)r#dG40~}P=0L#9`x%s4gm@cv zK@FU~Jv*BAUn;f6+U*BjGBcA!cY*X-2+ZvM=YmHKU@Ny573gN1U|R)`N<|Hu|gY(*zbW_D_+qGU8{PwMrTVDe^1weHUIEp+ZjuaGFA ze+^*9FkH75{?;9T-JZj5XImXQ00NtixI__)5KCa;*tKu&KwrVDG5vOSFLmB*TJh7j zi?Ila$N7qt58TG~_J_@uqip7{&MhFZp-lOkP#I3SWs1`joGgKaRJC_06e-g_*L@4N zALK&R7h%jy9LDAB|GszHz}qUT&W5FWpb;YCZ%EQ4qu>xYzA%#(N~$~5@GgttYs|-x zZi`$Lc3C;^j1R9i-&*2?(CVo+^b*kSVO`Nj^~ViR2qod4eKezKOUAMZ@xqq0Sn{Zw z=*E;{i2=%cmD`d)aO!$#4>^v$bXg^WT@#2%K%dB%Z8M}GbnUTJ|tkhYT zE^Vci9MQwBZuJ~cGF44|ETL&naKa%YM1&f^j8-#FN4h^n1|^gunXYr*XZxt zcBqZOoKZ5ep-i38YP?m!r9%`2QJG~o?tKy#_@l=Q8DAHJ?2O7Hb6JiFG(7TC0P)@6 zpL?=?Q zmWk}r>rf=FS<$JIuWguWt7>sut*!;cMhT7>;dr->(oaKd(1zKFe(-qiBsPt7rG%3= za%CrsKAD-?>KbRcL0QhO=U5>Cl`@9b^H9v8$dc1Lyp^?)+ewjcTI8jg-3lHEraW9W zSPy^M%T2YMjdJU|0S}km$yIeJG}fr0q}wDMw%7o%S! zJRf4n4()pmyFx{ApY~7hu^4vO?n+)#O+Hf#xj8_xw`Ob|t#(P>|%ep>#bJoCa9&PjNWST?A&(o3%FI_$TQ%U%_2+ti zb4T+r58L@F?i0;j(!tL}`cmrnIXjwx{Um})ylFFiv*rM*!@SF_o@WNXL@FxHb9|OKTG9J$Gc3|J9Stpu@VU_YnlhZs+5bcV z9ze$7LVWW`@z;4Gl^bmNchVm-KSUuKD%u+(BsH1poqT^VS_WGZL}ctTHVZZz+|%sv z>e=G61B9a4BgaFsg_fGr4*flUa$!FZKie+6Bu0D1@3-+VXn&T=_!P zB_9%D!^o+S6unQDEDkF%ii0ypB0pnUW!0>I_B;XqfTPwVY2d+EVBO1(%EvVp>~+ol z%EZ!vj)#g>=qee~PH)x7uq`}L?QmMSPZ6a~z+SMkz00QNXEt<@Z!upYm)TK#nd3DI zea;E2#599h8?Z_XuM6+`n#qd@3;85|kvvjg-0z7xOj4ZglI~#N@MrnrRms1kA*;;2vq5v+9iFB7 z4PF^|Susj<7dkLht?b|C9e8jwUz>zci7go8#sg!ClcWmo1^m{RcHytKi zH%<@R-#_h)6rGh_Mtp#0IW8)DxMeC~b}356)I}vZ_#$<_vXVzA`wLA14UOp&fq8E4 zb-REUMv0R+{$|e52}Oi!8o!1_Tg8CD;UvhxINyf47vhGxIuSd_@bga^tc35P=J<>G zWh4mcZis+hcbK1WAnYt`PVOb05lcgrl97!`h#VNr2O^@F1vScV1bKRF(09iL<{H|+ zf~0XWJ(ugHDH>q!=dORwBIY&@n(FFs(T5&ntI z9%HKHV*u2Y8lDdu0j@QwQM{+ph0Loj_}3QLoo#x}T~?4>;Uv)0WQwumhj2!3sRu%V zs7&&YtdIE)f0xMVA=+HV^EgJ9{`5lU?j?P`TkN$Oy23Oms^=vsOj<_u*{fB9w;Txh zE{aU}@FQVc-l5(KhzKuqc)cY)K9XM|AH)kM2$5{Dv=*(RyUUdCe=}Kdd`B8C-`>Nu z%ed+DqNr&%LuKL27hSbRGpUFU84FD+(v^N^SF{^27LZpnF^cOo{i9=PZzi4d2*oFG zg1xD{?I&9&t>L{UrlYvCaSwpurU_)!0n-uPg34I`yU+mIwqO zH5z!})DTs`YY-9ox>ePO7T?S}Pv0j`RQdmepLRJRK09SCToFbZfN4${L0fuLU^zx6 zkY4mgEPU73PnJ|k*3z`AccM(XOn&t9 zMSSeO`7z>_j*8ywReWi!(fbyjGxDr7f)-EaY4Y89ZS88&i60)83JXK$_N9YIP@2+D zSbx9AVtuzWYe}FJ@Ab}^5jOcOu(k(;8j55>nmFhtJ;pT%_Ng)!yndrGL4$1G$r5Em zAX^zVE-5t{vWRU#vuQlNE}l~UNS-O%lq{UBlT9o#k8a0?%!D>&Cu~)k>~kKkB{3 z0aSdrw4LL`A>o3*Gd&7;V?ga2pO6C2ukJ>4>+5KMI|&^I-qr@eK$B8h;DU1=t&(m_ zog*W|H*J90vAQA^5stvji}?XLv2w(r6t{4Kl8BT6n~0Q7~2jkLa&8G+5YN{GONc9`DK zGL!~sfRFg4Qk4uB<=Yw4%MRV$iMM1>RN1})-vQigT@dO}$76{CKXjFZS7NB5>^pK< zk{Ku-JV#6fb(REJ8}=~-`PVNwPSjIg@JL1>!zJFoMu5q*3VSJy3L84QHxyY{rX^v8i|e2pW*>pcE4>3F zss95(tE&-bkClZ{6y`FBcx@_p$sXRx0_Z^n;$6_=@hz7uKCiATmH0nVTlmNh*w_Wx z?(U+m%jf!6Q|+*jxoY{?pH`)#VE($($+7FR1YDW`IG}~Kp$qB33N$XMQ2&RglKHe( zg~R%{80BzFD-R^ue_{g$R8mwu7YYd0(4C6{yLgJE-K*qaX4H4buFDy4-kf+bWIC?0 z(OuN8HYoUb)(F%F8*@w3U<1J~yzdKGdLy!~b_c(eS0W`XVMq%fJ0Ipy{7fz&HkbC_ zb4*wyNEGK}@Y*gU?d76YSv3Yt>VVZF33xjw0|HqQKCrfxSx`xG>{;8}G2{&P4zHrU z;m6iNLl8+mI;RnE3O-wPyN)PrZ7k;Td!DX@l^-J3pc>h$fqz{^aRC{2yAaj4Q)L~Y z(02GQs^`N=y4(NX*sKE7XoPc>C`0dt{I=*3F-VJ*;hX1mM_j=!2$rm>sA$?>MXwdz zZi#DBLLGpGE0#I=PXhV zTQg&SEgNi{^ShP+Weg|5WI_;_B?}pG2}=4_f(}UeR2G!AiMZu9BFx~aHStRCD-mjm zY%rfs&5Y_Uae^e0eU$W_c+(dr)W+Af<;AE}-q*^43L3y{JT=v`F@kO_eZ=1SsHXU~ z3>cJ>t`O^QIm0JxU>n|w{z<#EK=R=Cqvms4;-GF1-_@3QYn`8bAiPFOg!aG@Rzaul z`or6J4k#rKEcljO+_gepIOl8(xF(u#vI0z-cv^LNa{omqdx*oS--bQr@8W<&TVIx3 z(?RY%C6A%4l)#E<12^hliZw-$*3kt;0?zKG%lA;9pKbV$Z|J4QJ7)$tiIevK^pFN8 zHp7tQEZr-+l`djmP)YXH2c;Nk2kw3=IO&y~BBH{MmJ6g7(!|T*Eijh#u~Io-M)XC; zE#!Uo2)QIn_3E}G_zJEYj>CL+cg)?`@bh(x8v=_zu?a$wE1VhfIh#r^CIeF7-emEd z^#CoXUm>{hYVS0pd^_oQS^s(ff18By#RQkN4R2zJS{gOK4hbT6$iiUdJ_3gh+ozKm z&dAF~Mw%rp0svnxFzHz&8hsa4HVjK-eE6MbV42QqY2qTHI4s2Mc&0)z;g8QL^FRBS zV(*l{CciB-&YQj2)%Xk(zH1@8gL%o=t*=3K4$0K){!sw@!!(NLLW$C#mR5q55SA!4 z?-BS>kCb134gXx0(E5-!mNE0ihqZ!7Ong8E@Os;DlDjUy@tXYJBQ5KtLwFmp>f=9n zxzobFl0q}UsFJaZIDlW({iW9(L|mwVz`{g8UtiEvZ7h2Um>Ia)Hx5wR-#t?4sb4@W z)aacEKcJ|HJ>D_*wG|XQhdGX&y)VsJS<@wjo15mNCNE5U^iJKqDXl~$zORAG4~M;ksOvE!|=L{rs&Wq@c~E(5(|8g^I9 zU~Yhp>r(tXNPf={`-Oom^tDGu&YK=Vu#!m@FA-2&b6aWjuI$9y)HoZ? z?KcAqZbmj9f93*K6H@;8D>m{^{Z3O@4iK!@z$keR1rT}V~3Hwhqq)(uA1Jg z<{f#)Zer2qFQ%MNCyiZ(bJi?_L$*E&zaGv5Wwv z)@E_eha*=Oi_Nnm6zB>_D#vww{arvK`CL%j;m!bHkLN{T(N3 zFd^0DuI!K+(yqjCY#u9?4aw%k$=>aeHM{Xp{RcY~@N!?zCH~;4hRy#1Ls6jML?wmV z80Xt?J5H&)ozegenqASMo(JWxu2$6@Ad2O4A-!LflSuxMMG9OBT5#ghm?ST=*yS=p zA&Xoly{BFI^?(h+UnV12pYG1-WS`*;=(G4QEOpX-#L@f78^fmaL5DNI{r*<;&Wp3S zh)LFlo;J-lCQ{Vrl^8*{f_bhaxo%^%F@bn!j_q5sp1Y&`Z{*RE3LS4=o5W0vqs56l zP3l6Q9Gt4JE_OzztGT!-8GQ*qothFtI1Eq1JG5LV;4ph0jg$XVU?d9qWuWBK$;zR1 zHXYa{UzlVx=%`K1CW~ER}r_b z@P_Qzd^H}ZKxm0Q8D+yZ*=CXN`VnB3KUkpuRn{e)ltQ zM9HzQTiB{k0*B?9ka!wF?h}&es?QwKl(cMeq*(|Y$M3!>oD045V#_F4HS#zukz^0G zO#~_*yS2A}PqF--Wl`D0MAPmI)8#Vu=P_|LCNJJ`V(YR!q~gT zPR+KHA)W{=+&Y}Hi-iKurKX@BLxldu6v+qFwi=p#9UaDn-nLmzOF>f^Uogw%g`MPe z=G|K{rR*<*<9`TlwyLC}WS|_=_JYxOgIkpQ1DflKjmie9!2cOjNeMWLf{jsU9t?1}Ed^oM&T-tZlct~j}^x0hoC;6vPg7ARVr9x1f z^LLp|sG9wTk{#o!7qiC_MQtdBfTv;CJd^d=HPoqAQ?KQK z-Ae-dk79?BLB@V^_lA`}aqJa~4>nF(Ge&s}Xe2RmM@o$cFXjc>O~^ACCs)YK#b_^7 z4vP~9RaBIB(GTC0RvvD|yxu@^ArYKt$jV?UeWh`KOmDCqxFa(x1`#3^I#?KNb5CTi z|N5dakXw|7W}lp4>aF8Kh|80YDV&GyWI28-6Gf`M6DbHnOUoF1r}>UZD@l8`?F^Gm z82%N-b6l|+KKXvo%3yDsZLyoST8}eb!**9p z0ZW*>QqIfwWd2)MJpuAqs>D?NlyZM;2SNeq@{6-}n#Xx%*(k=SNM@ik$dR!mGKbLf zZ$U-9uI+^V3Z3Z)l2yIU33!-0(jl7+vHU!Eb_fOY+xQAxa*F0|M972pfDMTgx$vf7 zWL3J6q_NyD;LH~MwpeE5m6`C@#~i^QdB7qifF}+ns=$B^+s%qkmJy5M>}@@stPsyl z&_rKQwftVnEaA?9zhzs(BKdMUvmz54(YhR`|B0rPEKI7>tT1$)Kc(JgJa>$)5@p*3 ztOEYpD9$NMg>0mHEd$byjb<;EfrWUF4-Axu--qeP`t$ohWOfByozfelTaCUsaSq{8 zLBCo}1~mQlf&C2xzcH3n6&QlUx1D?okH@N0atFijM&4&C$2=(|`D4EBxtl^7Yy&*V zZuotG2i1O|-9Li=BC00HKfTaPm_!`TY}YQ9N0pRya7)B`F7_lj$+>sqD7Zz0>s zTv{SXT&ZV%H5Muor9}+cq=A(>dJU4*QQ8kQe$F*Gf$T3Za+%9CYbIHnJ4 z#9Yy9e=Mo4zKK|$l=0%27e&OPNwjB!`znNLgW=K`e!*mHD?sadleAt&YeAjzC0UC# z5{*BHoY1z4v;4Fk>4Xjw9H^BUx=ed1C`vP|lY4v8U{`@J>zx-8>1tW;qwKI!iRC4j zVmD*cx}!wf*5=j@SDv?rDaxh#LtQ-TN(}Lq;``#T?XYv1N>T;mY)(D0<@$YXO0RprlE&V|1P8cd6{>UU}!*TUkQ}w5Smy_qpc+u?;Q&p5iAbA~Kj4a9@ZYhBeB}Q8y^3tltcDR#GSQ0^7w- zOkMd-=H{v^#ozbyta?q)6s)uq*6lWb;*nQEv87&t3g(iI$>j&5?gVlSf`1G?US)UN zNrK$tFDQK+L073`Wz58PJR%5s|LK8oeNO#$awSsfiIQ3tW(*~jZP>W>FGd9GOP1wa zp8T4s@9~^NAHX{HR@ZVF7Z;7kG|KJ2KGUqBcw+rMCIX$rpG(&P!whk={invP)o21W zCgM#^u0E(wqVF!9qg;*7v{X`e95%ZpHv~cXJA{*n=evvQ4l8v6`xlnJY-SweW0hQd zFo3smDO3o;u@21}CHcr*P^uKka*w;Ee5kD?4z?R8C@mAU!#f{#EDm^IJG4bR1xF-{+slYqP7L z^1}&*PIDD*SQ*ps9l;S(QUW1}HO~2WPyS=PZ=IAZ6~Hvb--E>!^6LeQQyk$=Tb%%3 z#aVyaR?T7{Pk^LC+izr+fK2OjyL=InSA!;pKhs-4{_(>x)_UK|88?g>?a6?;KBA&; z6ZJ`XY7OCD5yj(WjEiuht9Q=M+!DI46X6+{cWnvyZkZfi}*7czLy*eNj9xBCv? z+F^V5?KNqtshGWl9*Btri$i*GsMeXcBWCAZvtt4;ke%pep0Ff1cvuCEJNbjt?nOd7 z5h(}mo+im_05u(QMNNs0ZF?&+dCE&3jrM#&b%GWXZK9OC_-yXzBd^SN8%!pOKm#4C z#P+Ue6Dv=vY)3z5U?EnmSD^>do&0pK4zjI=u4Ii_b2474Ea=eY!3kmbIoqciTnTjh zu@-$h*xeWu_}nlPqMBP=qH6p`WOFNKt1?<6_-VpYC6z);4}${N zz*D7910i|pL_23rT|$%Aa~+@3?EGT+vs!wjDOuB+jpGoo@HCfN#;LcI)b^T=NnZ$< z7gBf#1YZ@)h;D3ea)BG%6qFy#m&yM`B(y$G{*Pkukx&Bx1{Oe^Kp zyRd0OFQrT~@2~FTZSw9Yg2n=WlU%ve=fd`c3w*jUeDC>7UbE{N(GFkik~^OrM1;-) z`BJD6io0IdZ%CW%(y7siQH_+yAgE4!`sapMKZqtiRgJ!Xp7!oZqEa+6&TxV^)9)~* zyd(SY2X{wv+2Xd>CaXkWG1#2~>66jn1Y_89;-*Wc*O`ffvEnTxjVaelG505I>-jN$ zZ^c7|51t$S1&93=GXMIwjF_9g=FP^{g~Ty1T3*)K{;T5LsmBUn zwUyM$x3NYfdHkLjucY?hY%BFcGQ2HOWq5mzY*Kmc^U=8?7-Oa@WLlf5@63@F&i9VC zCMP#{di3=p?h3x+^KTMo%BLUqyN|2r>%5)^Jt7eOhX01f^wG0w{mnIZfAqZq>(#?y zSKF^&zVA2L&GpE>)^qvUc#N7cJ+o#SUS<5HYLsB0GdBxQk6cyck6Gy_S@fxxCJI{a zFf=b)ELACziuUBNHh*o%)oLea!SL{I?PV-WQ0ujKZTs?2c^^Y~zp#b8#k~IB<$7kP z`FZVQ?|>gevgV?*GNJ+B8Ykq|PpEmXl^!(?b@CtRSBkWrPDs5xX}m7gh->-s9gZZ<1uHQ4`LW zi#xK}7+(`Ivrinfj7|Y=i%xpdRmF< z4IY`R=3fs(hiV`3i(A+;U>W0!hSdIS_BDR#I|2WC$gUYXe)4Phy-}>F1n+HF9!prt zrKtnvLuF^XMl4!ljr4Vv=YuF2f;`yMPkUnOZ~!aonJ zoI+L`{xw|kuiEh@&C!Xb{5_zp8)Fd za$-2|z0JwXA@TNBwk|nx8*Pj9a_li0!7R$6*)%+>%ZUWAH)NSPI-+ zHEw0)p*d%5)!}R(>PuO2(CDpjL>0-x+0)NyyU1@5kk+z2yZ)J6HM5MZ!F_1^3uQV0eV+HOtxHk8 zos@Bq=58F@7FAM-*-%=9dWHUKzt}p_$rf=N`P6VMc~)JG@^rh39ytp%5pMex#C3c8 zp#5Qq(O+%I|LOiQzAVpZH%f~>;S~P5;t51PpBKR{H(CWV{_lR4bOG8A#-gu^4zl%( zHCb@Esj}UIZ8hy}*t6`cj6o@Lb`pA7pReuG1H+iGqu!|AdM4fM>GUoc%?6W4G(n`e zAQwbRr5wc6@nGqDVesY{g>kGZWr<9$LcYn=ZKYp6&%5W4BQvs;Z(IA%oZYV@elobL zLNHUsyP2^?>`Sr?a}&#f$&Fx*i;jR(!Nxs~_YMPOva1yvcoibH1%P%aiWYe6+^a(47Wfull9u`@cyuUI8)`@5fz!l zO?czQSE8LoWd70RdaIS&56=C25OIuN7mx~|D#+4uylCCUqLRK(c#nUt#Uv*L(|r5MgFy)p6zt;DbIUF z^s#!;va81YQuXG7O7Xf$-`!!eBiÂyEEQ6+A2(pnjgnlB+AYbRb5Kx(roEh3U0 zgg;T0pFL*tUuajsx%fy)%UCNbins;W={?lYAW8goR62%I5+#N0Zrk9|C^#xG!)q~= zw(brkZEC!*N^$+JM6P@Heo3%7FrQ#89U&cUxM3 ztVYNX??IC2%IW-^KEgmrT2CcU1M60aQ^GW0^*fqS7_79Jc`%U*tdkaCYes1^}*_q^IiNc#)(TS-`fvKxNPZP9nkMJE@My_ zwSBU!mB?x^dErqJ9B<<%M=Nb@OhfYXl!(HDwn?f$RX9FJ^Dk)lpQy()i~Nni0IAmE zZ=|x~$s<;a_vgt~PPbijc?<93m77DtQU-i8)1GT?CujB$3i)AXVX;_;r0tkLiI{cJvKKJq@YTV=-$rx|DKijlu6{`6i@5o$-tf`L9C!H6P77jQn14) zb%;N>dC80t;>BnR5VZ*4b5lo(Qvd2lo3y_D?5iMAh-l!K)9})g_te>FMXcL9U0pFh zZDKXE7_5z9Wfv82?zRW)YQJygPdEsoY|Z@-Afqf*d-I}zhkdc+MuG;nT!g2WnUuBWHwGu3q+@*H9sRYDu~!aclcMsML(Nxa9tvj%xGF~XMKmElLyWfx@)s$t$uOPf$L zGOQbaW`qI49q=&5S8ETdw)A|3ra(g_Epl;pTqTlk}-xG=|;1SQk-tjraEU!p%T zKGJ#3b&0}+G?fmKvb$X(Fo8MLOp0xX-Nzo-x^x3j9%1twSu_0eQpwL-b)?0n2E6<& z!~hrh{d&n{?2T+s$Jj{dlM*z-xnUM)YjhsR0UlXvV}a&v|LTc zB&&j}_rIUy>tFQzC?ovzz9(y&V;Uh$dLW4Oz3Oy0-{TPx-P z2EyO&n+Q_O(x?j5^4!zXyv^i@Ev;!_)xsmql!;=V=CZqf=hg-~*=9z}&L3Xvo%5;& zztUu$&I`KCd_)U};i_nJYZg`AA?rjPo=~0xL5s|gXy^mxvnvvV9scP7C$t{pNa1EYjFv=|t^2hY#z?q%6T|B-F9JK5uy8g7)-Fi` zwfk0WC>yKug1*nZqEnqs)m~1pc*fZp92U&u_m!2Gq>m=?L;@G7zv4* z(?F@a9DBZprzy~WCWMCFDRx|)D8TquV6&8RZdIJ@y$d+@YB<=C!%)-8@!J0Ah4g!CloEkzd-~e zDa&e?yPL~w{UX}9>h6uJnc5(``;0z_X72AK58JpjtoEDE%}rH_7{ zcm(1e$Smz1|pd1j9fuXy~Od3i+`SVogM zg>Vp=qw8eS_Z?IAKH?Fkf1puED>BLEiLs=#dQM}7t6yImtUzI;p~(Yz9C~< z3lw83Xufjg1MBRI%NLj#D#k7&DkSDfA@T;SZn;5&;<7i+P;#F97#j3>U%^{zd5us%J z3w55{S0WfgkELyHRHNp!UOj1i^iiPxd2`Z95~Uw{yuN{pnd52v(PHi5_D{M4hyr3v zmpe*CMsyqx^xA^%7+g-;@T_K zkbK3^05mI;NjzW5>0FbDS9Rm&Jh6FDeRL6-_GNRSGvN-wDwX2nh~4zkf8IgysG8GrEe!!3?Ek7!0Kz>FNO=JBY&3k0yWHfRyt_cM-Q&iO;MnAP zKMmUQUr0O2lEPlFs@|{o7;wUa1pZ=X&2%KL`d%(RXCvNT07j3?NLduFlJpgIcfs1= zR6^tt6vbln^0NIshg}!Cgy%#FGi~jlT1R^VrL$}BI)iYM2Z`p$_eZd(bOs6QMdYhB z`CTZkg+*IN+*b|&llu8XO^eq|s75RweaxvIlVHM|YISCU`NKC4Tsp)r=dS>M4^!ZUj^onX<#zpYu(F>lm#=WsB4 z>IMlx^?P=@zFH#KmBBd+@QZ`y=UfW74BjD_XFI+r0;xqhv{Az zdQ${^e;PZ5`XDTH-lPa8k!qNjt&@nJQ4#^`_&~?PE<2S^Bo{7LSe;9y`e7VHFa$52 z*I*0Sh?EXWCDTG#h!Gk|yW%L*MBzR?cke5{J!#n32w4fCQ$YyHTG-%ZZ9s0xW^?sw z>M7k*m{fu(;-=R77iYapVZH$B5!W!!n6Bgb=aJ`tY)#hX!bGB>RS7nwB{kwf30l;X z`IBGX&J~J$yEAI}XV8@2>?E6HItGwpR~zQ4tkRqlGqZ$D}=RE;PzNS9u?tTJJe)e*TweS*7DjQo6! zwN6TzUIiiqLmwp03t`6;_Q%I>3`Xbd*x!f;eKG|tr(-C0+B+ul*L(6LpST4lS!)Ig z5g_Z6p#ggL{LZ^(EIYWL5GpDYdV=n*2`Z7$QNMRlmn*F1StM(_%lx*SR*ePz;yueA z3o_v$GA$}P@fuF;^5}qW)Z`@zH|a(lXcY~-*5h3~TeNuhVmb$N3xJjeazK#%qboVG zwJ#*TJ%=Fc!e^UtLjSzLv9)-IDM>j`H56%&Q~nJ21PEOV*2_LInQ$#5E04hO+Aqpi z{hTzMtH-$f7R*1X23g7V*3njz3UVo}BqHklIYC69{J;NYKHf$r~2^lzr*VxJJ;PVnsFwNpfeG&``C(sN(y>=*pqCIk}sT$-!VK zsV?4!w21A;(ySaTteUhoLM&i`Cxe5geVlws=S|G}k&@|@v^nfwlCl`xi9U5e=7#9M z;VgCp%Yv*Khac4*>b716@s@nxVH=NRu~FeV@N+}65u3k5==(X=B4{;~Y=jDKpT4hT z^rWo#ty|CuBQN*?gA+L6d^g(iY}=3YU@P}zzS@EtLv4YS$y7s10X&xq4Sj0zq4vEI zxMQBE&)U{Wd{cfJu{XI@DYt?We|dAAKZZnRT9$>lb~qegS(34AjL_Ks+m*JaSm8Lk z-o9IoTT}#@xRJVwm=gJWl4aweTRnuG&RUr!i+a8!Pm3t^d+ic+!r(`WC>A{I#13;B zggc9O{v{vxS1({t@6EM`_Bd!fSQ*4?RQ~vtU}QE~AEacENs(_b<#u>MF1P@$843yb z(Qv(kChX_kJy)13=G0ZgVog?DVY2kFA}K``hs+JR9%VwvYFNNa=`KdK?lb4So(*K;EpBhqJLl08Ssi+4HxbhM|Zom3W3 z9i}3Z+r^2o=fOu^#Xz0?B0BhbPkc42dd7}}3&<#>@lbCYy^Bs2&@ zRtDl2O|6s!I_x#=Y-#$YOkSPEccOM$EECxJJcKy(0 z)e4T5`APu@-P}rkg~ao7O_8J#!z!=5#j3XEnu})>N^Q8a_zF+nwv3vL>%Nmc1(v`m z6ey4&pKE0U5mP(qz8!^V7j$RN040wrla&`g1{=FMC!e$(M>G9t(2s_7Ge0Hp9-bT_ zClp>(lxql9M(}5#vjz=FTF9oYy7R%3jtGl|kGJ~?wDV%%BjIHC@wWGBO-cqvpqB@ z*3N}xz#?ztT69b-{jS4@?ZQO>VmzX|g?S@c;X67nf*Q`?q=vjurrZ`yahNO)0BE_w zwp~3Mm+k(psemr&OxJ(oA5MgXw-pjuYKAq^B4iDVE&J6=dBmfA6#z z56Tl*&Wx#cvDU-tK3z1&jH8xyv6r26OJ8j_`KQV_7S1j-Dz? zHE#FAf4+e@n}<=e9OnfQ`kl*skE9mHwuy#sJBLCcKOgPh!GX;~WiU7sn@+|TM>(^e zTz%gOWo1hRKbCC~V3g2>bJ?HwX*IFy^Gg(4zv9N#T!K3-Q2P1NH<;ChX%?`*=3tGM zINFfmw`Mvg)aotdk8(F2O~aK-x+A}DaG|jaB| z%OX2oDybX~ntRw&dJ`GYyQtO{D&7xIdNKvp;I3dOgj~sqtI)8cGk%R-q9COkd#sMT zwH&py2dVO~_%+COmX>{kbpScr8x)RF8#280^qa1f5MauGc6gfsAAIu7`R5A%ngqpP zU})fPFccsI5z|6JYeZ~H8766hxLq%bOILc~0pwom)U0MZ6xVW@7o0fY@MP;2GW@6q z0s#@(x4bAm=}X<#K4M7pk3!Efxsu!~u!Xe*OL;*NuZde zr|ue_UL=0=ekpt12G$5OnP7`*e=I7VkmI5kOR+$$6u}Hv7fkks!FOm>WM0ZwV`$CD z7nZ&NO*FZmDJl}FYy${Y59HSY|pXj`*YJ~H-BOj*(j%1S)E1>?V0w~Fi{nDK&vclo9j<^b zp_ZE+MB0_av1gH?6q`4wp(QD+{KC(#8%bdumcnHV9gIMxE6F_cmCLpLEb~-v>{;9oop)5aBXh{6Z06$RSS$LnUwN^=E$7QJ&OCT{kiBn3HynmoMM8a; zIODOYZv>x&ExUSxId^Xe%_rmker?4F4pS~^OtCOB+O{8<8_4`yik9Su7L^j-AEb4W zcm+SXb2TAIe7RLyQO{p9TN9~1kkcG8=LRzw(20uB2){(+ibeoA6J zMVWJe%>JIr2h}2tag`4hTGBdP^LZ}Bvc`iRSru;T?5}lC$9fY~D}AU4HA|ABNHoL7 zJD`+NY2i?vaLR~>{V6jfTVP4guOBpaqX6x>nos<5d^2oX$$0TZwY=X%i8kG(l|y#a zBxz>&Aq^=HCOaB)7en$gh*1VX*8s`jG3!TRT!qvpVV^W@ad)qLqf>eQD4U%LZ$_ zd|4g*Vf}z=WjTiSok6G}L0D+zip;q}I}tm*89Dni%7}}WgqXd>#}o|luk1r&-uKt* z9ruQAcf1XE)Rk&jCFTaJEUlbdUIpQ-nfZU-*2uHh$Y3$G$+&SyMSw%fLnBBRG>8A& zb4gRv>&fq?Yz0R17#tF9>J`f=+M04*5pfOCB!)>hBs4D^pa8#$3mZM+b3reF%vOrhNuF zi-+EaW+A0VYrOimaN4-kKp{&H9Xe@7u*v)(tUXqOT2|ekAtl-3*+_3o(78Hy0SdWa zDqNQJIl$6ipO{}g8`{CaNeLGV*vk!@#|h-dM{>Xk!(#|+#E=8*T{?F!!kX1tFAB!y zL&VSmscm=}YI$k*5s(sxh!j?`KGF^R*-B;ew}H-k-cIEQZbZ4;<)h6rbH8M2bW zhi*OpeW2Lq>+BnE`>zw1|LTOJh>PG3A6_j&(lTRU2f>!5Zca&tTMK;`vd; z)BWa|Adkca5Ej4SBdjdKsIc+i3N4P`(D)@5-sa!=9*+Ye@j}^kivI9B19Suz1i&@P zl-4@-vh1Y<*dmoG*rJs~Q3prEicri*N*^VPlV}Z+vPG#!pXmnNf*?HMq1Xz7w4;#6 zy=NbM`_B4&Kb}R!U~_+jxD3%}%^@v6A*@2}EE?=&$W3v`>r8aS>v_nIXyPfFh`(PD z)JVaec1S$6nCNX671Mz^Yc*hRt{Me{15rsy4S zFBw*aHG0({pq^a`T*j`_ZdZ5IR*-x`pjr#^TDyYHV)VyB13(C8ClAp%2qB^|+<$Q( zEC^t;-?c_W$x?RKeDa*WHO6o*ws(}??$WZO8&PI<)3LOg@-MG>uB}XE-v!_SF~8?v z|8EghVZ{;nugLOO??PP!LLJJDUG7VYhpqX5ln9s13?vpar4GP2Tg47_#mO)Po^yrB zr8JP{f>+S9mTqrMwz7iK6*({)4N@q9R29Yv^7-VKC3!!= z$rY|{AMa%t_Q?&Z4z=^N@0QR!#A&+D!Gf?(N5vrwjg2x+i8@J*HvXbuYbdF*d=jsbsPs*P0Yd zx$F4e5E=InRu%z2y#Xle%ee?$4N@s6aADh`7#K7RbLUn5dWRMLsGu4T*nf%Y*(Lyzg0RfE}-YWR-QTI7_wlDAOjk0zt0{U)Q9^(LA^ zOzzGZ(brFNPu^ED5!d@CtN1XTYYH=+X};4R|TL6T(l@Lb%+uN)L0xw-n3|=?(9zBynn= z9Htn(BPTR913~7sWM&uu*5By}7FCB-lGkJL`NZ!yEKe+jf!goEj(@ojFopNe!K8bw zDIMFu&u$uD&VMz&NK>f6is3&Tzb%M(>duEwXo+UF8TV~V>L+r6(f1zkw4)J3Y0MK7 zYTb(ByG%%Xtt>-7R^ubHpgvEdTAGesqBDOjN8!k}kaj1XfLlZZ8|nDRI+(i@A<2FeaG-2UgU1*Qw(u59Xaww^A zE#}p}`-v^?Hftc|&B7rEhxCf+RGVC$M%D{;tm3bEz;_S z@A<#AhgKrYN$eprlv{^9(-JvoQ{0UIf`!x+*aCKc32 z4U~v8Q>j`Z4C-Me8X_mY2breAZS`eF7T+Y1MGFgBj7L=Ew;dgrQ^?CTfNWm%-0WV0 zUDrR47&cf1=l`P%5HWQhy35AN0cU?h4SJv~;c^ZK{=y4ei?ybL6;B5?c_tRPB|zP@ zLY!*Z17Y)@k3-kzPiGA@_00@hPr)m2KyF&Z(_4P$@m!*j_g*Q^ux`x!^ZJMFUxr8e zhi_IZ`27ETqu|)sCC4iREU=3c3c+5 zOaO#R?Z|w>MqhK&4Y()Uc!H9VK(2{s{8~2Aur3nJGpIfY40h~z`{PkY_D0#X!^-pM zpCoZiBa1W!<^(-rOEUo`?{C}dYiBfK&t%H&HD2)FdYS)Axn0si10u0Ou!XUOwS}`a zU;=C|k=NYN`NJ>2{EHTw`fs06mV#A>p-OU#6W22k;qe}}cOg{v`XX@)XS4n7-6>~R z_sbzIP)NW6+OkniHMaQ=G;;uxAX*f6TnL!NwX-+kfVO^aDQ zm^42U>Y?-Q>cbU=-1U}v2g>MDIC^q95&aAI9XE|PeGX=8Y7CYH3^vA<*8VK$Uv z<#6-dgX=zqUgv`ubTBFK-{+y&`*CPHvOpmq8l=V`VzNQ&;&Z01Jb3*f}MPwA0mD{6M~|Nf9r^V`eK#bpn z=}iOj-G>eO0>Hcuihsl*z$e~(qUygtqbC`a@9tFr+jrjRj|J4rCA{i1PcW-7C(4=r zCQpSg_}Jo1yO&_&TG&0Ycu9e0Oneql5_MJQEnYS*+> zw5sgnFWCYk%53nu+`Oo9sV`*11GPPyV9z|Y=lW>u+`Z^kP|!PG zvFq`;{C)fY$#Mj3%~!KB^VFm%##0k}3X?GpCb?zjV|l}Xk3PdmD>mm1#djKfqL3G< zS7N{YdfB<||NNkfazr2&KOZTJ=U<<$2s>PU$>{O`-cdzcte{?VS~%Vlm})lUELt#@ z?Xc@{vEmk)`sJ_GoFDt$A?32ebfAkaom&{BtTbrGa858p_5%~hWde==C&|@ETS@a5 z%x+HZ$LRh>>Sc?oeDV3S9Sfi7TH$xZmD*27(`0ugve+OQ$tRQcVu*wHiS_|d!QJih zou_&kdnLp?{mu4|%-YPS=spVF4i6yaB&vH=koyesIN3uf96L3`P&60mSIB#Zv29t< z7tb#r{}G7=Y8}xTTutr#*vZ*E1O*A!>R3%{H*1Y9Y!n?`UOFW9y%6d4v8a8Jc-)P) z*ftdV*fe{)Usyh$P5(H|R-z~>-f8~M7n#EVO?e}nwYEfn)Y@L||4vJ74 zhnS}E(ICG;Fqi9Y9iwf^-rWkdtMdus>M{Hj4^4Qm-mpW{s?*egsJKDY$vei%IN-c` z;vGCjnc*mt+5rvSvT)1Zx`v?YZb=T|f_W*}F4X_taNsQ)eN;A+!k}xUMGJ1X0&3cGEO(nFzUCHPD}XPNf+e^L%IVvm}MiH zSEjE0wp%a3ENVBAC|x&ezDLJEOoEY-^U}ht3*62lSft(^!NQ4~7R|CA-QNH6BMwja zntXl@&182K#@$#LKN_uR(DmSEfMI|-qQXK7WXk*?o>nTUK`pVKeOE9@qe~T5RLUR0 zZQ<|vu3G`;B1K91*Kkilblfm0sC_%?4lSLe;nUmQTm(SM;Oa3t92n**LJ90RW>_2_ zxdW=lQ`QpSJ$9J$m*;m55XumBd_5oxkdBy7}J}-~dp1FT>G&{TEsZ{1K z(~M}-J^Kr4OpI6d9X(qUd`b0jzOR(4ncCIdI-7nR^PV{?4=Q)J(I|B$c_qx9#zwK7 z{hZ@Jr#jEfN*rESg@HV^)4mWI+zQlk)kkGb&{&M8jNLd;=kPs^D&_jRdXg$np#F9K z4Fcz1BmZRA!h&;w(dUV0KV*~PzIr&2R8u=6|ht1!f%hUeDg(HcR; zEq1RT*XoT77LOO6-Mq%1_=3h+`1eb5A9ffR1u!Wtyhk$^*|@uTjPx$qQPK#u&1q2e ze0tRFbG$QqA)y^@kL=s}?#ql#@Qula^Ro&1TyUK?$C+HjcGL7y6t_wZCMn(8p%bxvK!9zi8_MO|IbTV8|Y}%jV(592VCA?_gYJXdPfrCjw*-%_+I4Kq0 zaj{8*)%zst9XK=SK$UGE%a!#vw~*)!Mzi(P6SBns{v7cqcF z)>GE|t}H&wG8De8Ax2@_2r~~IQzodrz1yY}P|LeSL+VQ~F=}O~)r^$U=ELTx@iAt3 zKyzU2;UujgPxpL8ahgoC`op)Vz|+@FjdpaSL|V}~{n9t-rVi@fAF)~AU+9nZGSz2( zEWg8{mcqZnp~FH5)(+o9-peK~Bl-aF@B!w2ilU15c!?{rqHi z{Lg=MsZMFc-A<1*IWOP_bXG3lu|~GkJ`Y+jZICf&~7fe zPud?Da;3!PznCVxIg{G2J$i92g~2EQ?=(rdI=30)(IT7+s${p$-CjcBr|HY0AAf?Xa)Ux_aL2B!3=0Hl(i^S4g?i zR@6AN2gtFpu>Z^ks!l?FFXiHQ0Qe*Vga$w}OIzbOz*OS$L)`9|hL(=F1hR?WQ%s(N z?1D_U;*KAzaW?u+!Q`#El<%na1ZR@me@M4*s%a6PD zb{#PKd z9LlTYY*U#zGFNnew5H(xXxpvG_m0%qJd2V=Gp)CC^TM7c&QX&fYq(kjH5;;>&1d`9q8h7oG@1JnqjQ>fwrHf<@0*!m=O=6a;&z?)@|kE5+vX zRX=L>`=)iTUx80kd@@mSWa`6Do;?-RPJ_9wNpf=XqaDk{sv1Y!)o;F?&u#ojrom^N zszLH#scDL=oGuxr30fQnm<~W-{m)3fzebHlfc@rz$zNG5_s9F3MhKmJF`|{}rQTR4 zG6(_~R5Nkwyh5h;BUXlXS|y-bzYlBy-{Qf)F>O2QitD&X3I{Vo(SBq>ZDCSZ;9o_I zw`EtD7sbqi^VL_f5q;oKPwUTpXe$@(gz`lr9h$0DytoQC+*)@9h7-ZX3{D`6L?JJW z6fcLTSvy^6E-o>0Fs$rjpaeOeW8Yu|vE7yDcIbo&p)jzEgcGo|X&WTg7sGeM`E%O< zW}hztP_Ukpi{PvyX3gq!*}stcCQ{gRDWp72v(GvWiP-4HkogBK@R__lv z*$ww)d(B&`V~`*JsH5hX4>jnM5bZoxT=lF>+~>>Pnsbq{eD23uhYO>g+`R#O4_;BumMN(cUT-Jx>79P^3W3_)qmc zxA+BVD88t!H<+$uMIEk1z&DQY>U26uBn4VWO!bW`DdnngHHPin0QQ?PfO{S>%hfEexrA_DCTcb8wwaOaV(T@1D8HSvDlo3fLxm*}> zq%f204GSF#3IvIN;zr`KPhRh^xVtlTgCw7`tpR?IRuxk_znam^7t=#Od~E@M1n{Al z*LTurs+~yILHC>D0gd}<2v_8L{j{EgNQ*5Vm-e8M#e?fa;*~sC24lvFJJ1K%CGGHeF z20;yh;L1%!U!z0~EKE_v=D|%}7Bc_+tGw39hn1Bot?$=4cA8^HMY7c8VpyxPjAX+j zQt_@!qYpo6Z1(b4(hKxZ0w$0ABn8#ML{2%j)O@>mH6bTOoaM+K$x6toL3GOIGY`*| ztw|7A1(&W(5=l?$Q!7Tw1a>TL0(Ku^Npj&4P-B6LGzjbCJXOZXXm$mM{8dV7YhF+l z?=ZDwV{B1lOB@*9Wi{oS;>Q%*Q@meQfMbF-o&*y(k3iYw3_x53WxF*jZ zHh*h}!onnUqN{-j>=%khV9hecR6;61B60C!G$4X=iiy)IOA6v3$FM`zd=S_Pd59o# zn(K!)Upy|NXlQMDM;eM_W!;5fqq4{cX@53htw;kCgs}v*x0i_d6wYtZV zd>ygjijz!)>e-RZ^ASF-)i`S7T@HY6w>4*Jm=GF(jCN+ZYUD{L6ZpG?c;^R!z#oS6 zCmf|fpywSSvB$nO+3T-KX^gC^`lGfvxlI(guzRT_?^}OZ;;<1C%%K{c-(2pW`c!>F zvwZaQE;ty&56pjiXpmR&vG$kx^tbXh(z(bJS@Z0+H@W~^BE<~Q+KX{pcT^k;Mb;MJsS2)H=ri)jg?QxI{vR<&?e{jeVfo1rd0>wfPYRY0Bw6e4 zJMdROh66u!A4K#a6z`X$f|0OpwB9q}H1oKi*$ms!00$5UvOIk?b zm&xj)M7-_A#D(fAIPenCIq4WcAzfZr~)gmXa00m8kDruxz=WwZZ^MnG6WxT;c_YF_y zKJVvc_dllo_FRuIHdE=POgtvKWSsNTLgR}!foqedW>&m`i<-`u5)UE91(KjApG^v? zo|Oy?hHzW}$nN8sF`2rs@_9E^(8Kv*2IxKHK8fOyLU|Kv_sN3P)2%3pzWs=!urzPb z)u$k}y8idoA}>C29KFf{dgHI4o7N`;mkFM+TqZUsGBj0JnwYc_#pwrt`6~g5@>NWy z)i#ydO(jQWoufsUwKN98TiS^bTDdQ zIz(3^<%sgR^ZZx8s@k-m1i6xCtwHEJiV{%P_u&Wc`A`p?`?J!2w>B!w|FZ*eQ=bU@ z+0@x(&j9xRsp4vOB(0E6bUP(imhCEQ9NH;7Eec@cfb|q!!|2@>o z6)PUYfz87Re;XHvt)Q!?bOxPDj9v)R(I8nRGgzI7EHhHFumfB@P;v%x|53v#;^NhM zUl1Q}`eW#*I9A^5Ho@H?{j(qDO{9H|9zFrEGXsEP?* zJ#?2n4h${;v`QSO4kY}KhJw#`?g~3i(H_Sg@#)%{Ey=(39!PhXX~UAwr!q1osldq( z&_f;8@jsP%bP;eo*tznffuZr`)ZM!ai_?H!aj`=D)#J`LzNdM@Klc_EgOQ`Coh`H7*VnCAml3m_s^f}g zK}XJqW*8EeIvR&}C>vkCdK{5p&miKgXX@HM+3G5-xy2NCczM72===*me;ds1+j`cF zz+6*vcPmNzBR9K=pTO3LGKQAb${XDw*W0nXikheOWs;nKTKVsm)_-<-9m1PyF0Ovo zw`?}FPH}X0mfO|Rb7obxEFZ|Tq2KHYzFL{2eB2!{8f!JHVOJD7GUq;{2S4?d1-Mb*6D|BhTV0qst_TqX%#=Pmr z%ZtZyn35Nnw%2*0SPF01?&4Tj<}5whl z3NVz9NB9-mB6{Nlc`($)kP2nwtr_4$>&2rDOjhTh}2snZqM?}*$Vl;>(Mql zgewty((ve1&IHha+Pa>4F182j;gFnZ+CWNv{%~vP>Q_uHAU+ifTZ(wD4l4f%` zFqXTzsRuvze9r%qs*C;DlfSdXrTx^Ry84#tGd6T;Rw|Y-GR^}2mUHat>Og^G6<4}0 zb`e4ms6lv8q~x;`MTV@YD7;~jGqv3~Zb2L0C|a;S#d z#yE1^@q!>XchyH{-GP`<;xD4crMxgQz`-9-PhK3qJ^g7pUN(031-A5(E9}5tGf?&J z|F*R|jo$#3BWKwxH{&m-TCMuQ`Pw3-`zt$VrNx_WjR0(g+Y*BlnVy@z$u{&sc7&$3 zDohHyII5iMOFhsKPrP+1U|J8Gm6L|H79>V=vx>KV%!B$f{95CIJgl8W$QYOPh11=$?J17%z3p??R!UmP#!hB^k9mOZVGJXq0ds z3=}2Dpk`%ImWp`yB*~xQ99S1#7W99}d&{^eyRLm$LwX^<{aq&pQ!DFFeI?iQsP zVn9hLX^@hTE)j+f=^kq6jsXS%1%@8xJyEagy6gF0&;5RQ-w%I(d|@2+xzD}VUVFu{ z)**+8t#QU1UB^@tkBv&ti?Z2po}=^Tpz9$Fxy5GN0EpC{303)(PH`DX>oM|2(r3gG zxQ0mz>#HBK+bH8GJ>$P#ACp*^-MGWk=8J6@0(`Nj4<&iK!N_`y&q|7fGS*>ciL@LL zK_X*e$cP+M=>u{eu9mp#`=klgwBm6>4U^$KArxSYFt1f&Sl?t# zyFubWnD~Xfj5=AnxMkRxJ=Bb9xhOwOnGpfQfhon{@AQ&&at#jhy|ph?~IDx z6x1Z?q)vMHLqDLhJ_F1nLN}n!wv$da-sSQ~l=AQL^ZF&mDaApxO9;J-)nq&F+7R5W z`!8z*j9cHm!)e8N&L+gI$Ivmd@!H5E_kL((PzZfU5WtQz(|GYl@=b^~w+ad|vaoiY ziF7=3ce9g14_t{6JAsNqYc-ziTyZ8X;9Jh>(1(?HNg9wp)EzB0<~!xNs@=tmm{q-S zN|?xKWn7n)WqU`pE1a9=odggH5TDP4m4VD|X61Xb4oc0f%VGS> zjF3=sMX?avwM!ig`hl!&$mc%RQ`50F)w9})GNC6RIh~BomLJf{iEQy~M_oUn^z$7? zj*B&JNE4k>>;*{>xdd#DXXM44cUp7;U!8Uy!JVgEyyg2NK!S(-Q*E(}}v+x*tFapXjaHL9iwKqrGfjb==wZrGpxX<@KQl+y>g6pdG$QF z+kQkUYdks@ZzhS%qG_ayf75Zp$oP_Kx_V-68L8gFQ?g^?5x8xvG53sU_Ttsh|93>Vj_8c zZPYXK8{IDWS(@+8r^_zY3YP>Ro-5j8q8e!WjuD3=i5MYmjHH7hql3FVBN@JKhbM+$ zX`^G8a~Ve({96;VZiy4}#tlCeTXuj=OY5pzUSB9ktva zR`2nm3SNI+C$J@$A6DA*=+ao4_XOI8S2v#FoVHVv>%%GKFcOw%-)?`*Se$1faW*GiA$O7G)=<_{fNS*PIo(XGdH??`ux9u&;Y4`_CHbq{|hwJW!}v+=6{bS`j56ekgT};`A>kg z%Op_J|JJ_ypUnE-kg5L!mby%R{0pcBFvfrVSm^wp)BV3;M89XB_3ye-{%2P5UoaNlYG;CxRmrn)^WhcjI5o426iaL^Q6hS%M92yLK;0QOUgf8ghSy%tf-_1{>q-@gMR=6w5eVSbO_^FKWA z7Z~#Q?&?#PrJj%VdX4mAOUBORo_LNiJm-3s)%$?F9}46bVAYlD>F?L$ z&YkfSsG*W4d(%$)`?Ao-rwg@C-aDCh3$xjQce<2@K5@yPrzyX8>*4UxSVQ=3*XN`A%E<|?WPna5!2Gy^^yPvD{3qzGvH2bqf$8S;5 zm@!A*WczDB3(S6lVlSoUmyY=jDEz(BG%3aNOaHJVe^g5Tl(JtSzTf!TUm}!a77G(g z{Y%tyB7Zkjxg778lKcaw{cB1t_7$Mu*uR8l>^FJMKfc2+^yqIPid50wef8J&zZd=4 zP3<4m%pcI^UlKL)xd%a``j?z*bp5XFx*YG9;`oh{`z?W@g1U`uihoHeg5pMny=^rj9yQihu(c!UBGAQksrBun zu~=y1BC36%%66RkqQ?pWIlK5qd84QU;7Y_QwNrm!L>(}8TYaTK)w`Cp3N+0jV4)IQ zo7J*|wC%0bwMD*kmfap2FMqC*40#UVvPv0jY-Sn_2U5AEkvlLw+B}FFHfL2vYYC0lr6sk@L<{VtJ*c%G2~FM`eJY3Y?T)P43LfAy{Fm*@hWUJ{Spg&7;D_O9l6hPrd=TE?shmmnrkOnXiD9-YM#$&1-sb3F@ScF(ahZfx-z_tt0#w zpI$uiwus4>6trKse&>wm_YL-bn&pBflKS#As;f|yE9IjBRJO{2D(^^&&o`S!3Qm|H61!wZ=8Lx<7y8xma# zYnm_;CK1eWmbZlzfqkLKLTJ2zw}ehijdReLK-C9YAgX##=KMbG0x*=oaBHdD z7l(rR$!|f0N`s>EX-;zFFf&!VA6==R?WJy6&|a?T*1X@Egi=PfYJE+Z=vsKXtz{@{ z)+vJt`tw0BWSkXNW7&Z4u_9jxaXrJS;&DA=DOSVr-@Tdu`mF+R3b>XRmTICeHFX+4 zRxvS~YJQ{2K>GLkh|p0>k6YkYW%Vn$BuS52AuAf>Pv2oEMP5f*+Yo@G*PZ%BflkLZ zJJ3#mbh!vEzAi0*`0~Rr<*VQA>-}Am;SDxQ@104|__xp<=pIb33 zr7JexwIle?Jx(HljD=UW=F`=_+8l=;tTj$E{1dv*=cYuuEvDF0%jt@{v9I!G6uFuYEE@YU+gW_YgMq>4E2-uNtsiZ^K~MlRn-alSS;9 zciulqB`xJ~1`lq(|9%WuZXJSJ283kVnm!h%V*+2?H^& z2N?%r1yJctjs1}>HG6QodR~7sR?(+Y&{?>e_7>6&byMm0J)cw8-rV+@>C!SN^uiop zVv-*Nym@u>O7mcE9%tL`^B~tN@DMgo6OqE}Ta9H*x=?d?w#6C*rX+)T6emn@5)fS%~8wD=dk%N1yW=eDjH6klal9>5~C> zsqfQW_I#-GLmzZomQPsLAacRbTMIPL0>s4%@k$#?H~5aJ`&`RuWEAx(U21jY zzYL1Gb#z4tK@&p{WC7^oy;y*RnWPFFW7qa+M~|u+1n|lW#%+-uQ5;}6qZ~QU8eafp zU%udgIO2&P{7w2#FvoXv3%jb;J^S!P)zS_(JhVu}hP8L5n{45djqjyIFo|XQdXL5g zLhdcbQ|AaGI_xXCv?avWMuIA#fKI*@Eq%>((=umVEE~X~u)gI@d#Nd5nN)DXI6ZE8 z{(ZVO??Z)q6T-pf%ZaDjv)B)N$~(;iVa&wFCAOO%yT+2OD7M7razI=+QgAe$Y}1sz zl&hVQC(mf(c0#62&F6F??~bi6QEIekMDf+-?_~Fryb&9#vD(qd>+!6n*`L=%EDgec zAc#Q>4s-K4xd%-uX)m4y4;Cuz>e{Len=6$P-h5sr7+Epqsr=S(GIBfh0|z2ol|UuF zws)&fb~|JB^mYCj0z>Hf%+q>^o_6HZxdAuH>@Rhz5gngn(~rMN=uo*f?yr3cSay>YFn8#EL2OWL^9FWF(X)&h3$#!{^&M5+S&=U)9A15; zG&u=CS9XWFy5~s29m2eMo6s9e9^OC^jKgvU%bdb#R#7g&bBZJJ{YVRCHEuU-0Bk4N z9klrd!S)@u01FfX8yJ@j`sw15)8lUJjda^OwXd-s^n02wY4Yg#T#+ zKotVTxekE0dY6RNZ+4v@EEpXo0Azpc&4gpO)Qd||D+Y!j@uX+t4#$#$Y4nlgT?Ec} z6#S-f$ma)jA4>q!Vi9K58n%dz1zQUfjK>ki9Vhgv~2^;&aq zbb4tSLP9qsAjZWl%?sWqz)6+)va{m;f@aZv^$qaI;#hFHhET?^?A)wl!iz?q;1`Yk z{D^BmG)B_qb&>jTv_!MJmDi111%0|g1+-=pMRH@FE2aWD3meiBF>$rWJTNQ6x8QHo z>qU};#;ti_pqjg+Dl#+E;dF*#fN9|-P2I0U-RL%#2`2<8rv+_`OWt3g4Y4k-4NZo~OUgoN$uourhpPMbzpZIX4g z+2Mt=Z#=^J0V~gfrV>lVL&?*mk`g_bGBiK8+Uo6xDX1fKG(EXYC1j0tUepz^i01Sn z^jD+^cc+AvkTq1qd^e+E_UrsDAlSN-Gb3-X&EOLcRL$7jnIjt47hPlZ<{(A?AW)ww zU9+w+5AFypnQ1aqp&ZjgLJf>E`NN+YeAjhAD=4jO)7kJk@B127iq4puwxq_3xm&rY zAB7JXSj~_ZUCg^`+lL&m-W8L`-KpKb<2sGGTflDTmftB*G$xn0fy1*7B-}Q+wu)67 zk6B?rz7g|=gU=3Zy};QkLZ_%v(Ecf(QI%}qD=A6fhzkCI#sG%=u+|n9hpR^+BGM{K zK94M2CpK~}h^NQGKIBfHe|S$ddFTGQvsN^vbueOqz)XkS6`DWmTqa($*3X$4lyV31 zx*}=ub)7_BT~(lb|GxEI!yEgp&b#UA?t!#nXl1-nsF!W7yP_j z&i3tT5m1bvQf>Oh?b%EaW%(0dGJK}*2HYX&a2@ZL`b~K46IP9&t>N@SH2-FH;I3Q; zR6Ak!sy|4~H<;zOFQUQs*M)C~nLrU}Y(AX*Y{{L2Z$MM9O_Ah&lfeol#AYMf4H7SZkgcgIHZzmH z2=c`^^!Jhdlsg(-x9HKSmTp;kI6a}Q#sly8{j|I1I`w@ zmwRvX?bpL+cJrE6AJ%*2c2d(v3c^J9_ez6K?-l4a5mE+mE{H!DcI+w3FxIu3!<=xA z)JN5;L8yn?L~=VN(v{lG4Vy|dwcO_v*w)*X)noZG)}q*TIEUb-w@3R!MjX|)d6ZI~ zxwX5|*iM%6Oc~KHhw2mhZ%~Si8VHpvunPZ^hyzV?L-h;d6~*1QX4H5E10vRVS=|u@ zmQ+xG|MjR@KIiWu?BtZabtqH&6?2}iD=r{am0_~+^+czg+A;~V-AA=zkKIAy| z6Wd}Oe|mQee|mQY)aAzX{y+l>Dq@~&`r8r4RI1AlMdH-VhC*i&2gZ2ZzX}=hr_Jn~ zeVP7_f-`C+b35;NJE9@{Z@AxXU~v}QXT+&}qaYn}Hz&oQJ;^NB-+9Wnz=9|qC-(z@ zAQ4=kRd=AaY#A9n$F11rUnkEIFrLB}Q?LkDFoJ-dNCoh4zRN+u?BzvhDc<*YYgv1x zVpb;Rtj9XcoHCZy7vn#lJmTYO&@jJojoWaOwU2)ysH9leeWvQ($H?2Y4rhY~vRgO> zB>y0LTdV?msuY~(3hG|Ps{XTJ*vtqHT$wO1aiLc6ZQp`spoiDZZ?q+)xXN*>h6wUx zdVPoyC^^FL27v@p_ve)`GMEs@egT=of1dPopHW=md-{i|#h1B?b}bcDZgAvH2{Q1= zUCZSMwoW~wlvMV1Xb%ocksK|0h0_cKIdP~v55bJ}V+EQa+cgs?-_5P@wYP9^ zCDezCOzRY+zi<(f(R5~-I0RiIB7iCckA0Xwbc(H$#S$NAiQgiQXnVC|Z*%SKgz>6p zWZN&%0w;fZSyAGhar+HQu;<4uX@#mkf-KWONs9Ud&G0#!uAuVI`U5%=-^GW`5^5R0 z&yorF)=3giclMaR>Dt^&{gC^h7%;&URtFf{z9dbA^Mg2NxT=(QJXNF|flWFMx8L$o zOuydt>h3}UU-ViZ^9ko-Im(m+)w^dvUt^HCTmEPKCG^kui>m`rC_pM|TKb6cD?dOr zY(Kn};powc_f09WC{vcr)~Ll2;WvCOI{G~s!I?1N>KKkON!%lW*o~_tHmOb2A&kMt z_=xM8p&NT!j>zgypZp&i7)vJC8=DLZy6E=>P;N30WKgnm6gvPF7=ruZ6pm1CY^RR`Z8#3af)RJUvxllbKR1jzlMgtzchfR*6vCK$3vlx(|x% z+KRo#Jlm>Hc3Lv$`^4=DZEgTW*3q`;A6;2azg>;rwut~|w^kwgu>$6sIG;4FL@T+X z6E7rg;H+DA+(O!xYFLXyDfP4?Y+7(Y-w6E^*gu0$Mg22SAHt8!9 z^GaNEGd94auCrIZO&t&!>iMP%cR5{?&n66qnQt zA%<`<437D4qYtN38hsc{V`OMr-OvkYQ6-fVrvx2&P44TVCVf?BzNF`J2=NtVXQA#f^A~T=K+QdY;G~nk{kr6N)*9 zM89kF*eM|q#tKQC5SczK)nPL7d72iAhDbGr)p>@W7lB^ZA4O_Mc%?L0h55Z;8Yyp& z2@`##ZKYJn0N%?XGP&C+ytbs>8Fr7za-@&}GeQ20r|MQGE615(Ghu(HKtO63a-apiy*g`{4eJ-UaK1Yp)hDa^gtzvYc?%*C8m!Er4fFd% zS=taSULC@(?O}i^l2<2X>t}pNo71yp@Di z+^}>{XFe+FskjY$Z0lpH2VDGZn3Up_DGlM;LLnyr7935y^}?%L=pM*8I_2Qfv>x=s2j%HAoBRR2q~;AMzY<%pG@ zkxZF}Tasap>OH?5#KniT)Rh!)>I_lqBINL+PfRw8<+N*l_ELqMoEBM;xSgy?5&9ZL ztx1?~Ba1xcl+|no%lshHo{EX&vd;|K`z@5ztYfsm0yFB2psCZGql1RbGJw;5%OFTQfYK(a>IfmHey)Onmfc zI^LV=vpyAB-m@3#u~-b3fdmQE9akv-447k`5r0iHWEDcEOWwtMtE;k(i_u9WmtG$} zvEa(f9FL)723^f-aN+9Mq#|G@nD6iz(>P;#!gC8r%9kiG@NRIapwKJi$Af`Y4fPw+ zj#>9}7T~NZnCv)A5E}k*iU6ut92@Exhmkr$*n=uAM)z4wE+^cxQ-Gk&Vc~c}X&uAI z`eM+;L|RpY2%fN}dA_Rgm0~7J+#O4?^z9YEZGbq;@PcJ0A#c{%{^gDnG_ERSmoPrw z&7!pZrI0esJjassmB;o`0Jm6>{ldeGla?6E!EB!<&}610+}T#p;ntf6q?MiL^TK67 zDCA-*>im!?!^WUjMuNI;zg+W1>+BcJR;$%9=o|V{Z_X+fvA8xq0UR^N3{cSgm-TtxrYW8RL6*29{5=2b#wmlW|``OPB-$j^F0n7ax=s-Hl z$s0-*!q)9~9h*yo$Y>}Y8x#2#bcP4KJ#E}yB4UdTN(vy_#_M(~tKBYbaZ}OXy4NCX z$|r~$QXU|xO(jg6$QyDzwz*d-ySaLeBBkF=dW?zV@e5HJp7*sMtn9Ih znOSLv0LDzwl{bA2C{80%6iA?u^I^D{!edI=m(i4qq6pOLAJA zn~iC9tXUg<0%1+t#3MrEK-Ez;#3JxbSrEGO+95EA{ng)nvyURRjFtdg8b(#a!I}LSHAee$0F6_M{mggJl=?N>4h7L7{gRwOv_ zs63)ffeI#)h=gtvQ!Ebu7o*vy{&&IP%|AKgsJ(6zw)s$8H_t*Fd z&l$x2p_d`JlQ&h0B74Yk-b@sQLRiJrm*!pm~t-?iw=U9$^;4Ca>u3uVU^~I7P`|of0ss1z{tk=anGZFKIXAia5&#b*RuoZu^wZqEld0`B^YW?J&HJ!pbv0Pyg7pIx`L`cN`qbFS#W2R_ zKb|h6D_wV9ds}#vuWJkcfCWqpNGP}Bz|Mx}Z9^($WqkY{i5|ODN!sF^#!YC4!D=2g z!UTLQoXq195r^LnK7#C`(fHGsxv|#{R<6?>*7eI~hohu!+CqeSyNM3gy_8-Yu|OaI z=85|Xiy2l~`H zhw6OJ4kICT0+HH;Qm2MX`r8f~)Okql^=bTPtfrNSSxqF=XI?ByM~`(?+}oLP1ob>Z zkJ}Zwr>U8KGUR3Zgj3)XSVHm>?M418@ywvRw&(`Qs$SN<6J~-%t$(ZuPDLiAB2GGQ@v28FcbeRT(1V zfo69A!Sb2(`n_TupHhwsRVF#!F^gQCU41X#XU99c8gk*F$jR9+2{xw0 zvBN+>m7#WJp~kur@fzugASokEFm8E=kP>uq2w%7HETtJKt47QZpwr(rjnBlCPH)#g zl=0c?^D1Poy{LFS?^Wov&WYgHw+bbA9{CUV9{xYxd)JN2-)t@edGZJytX6WnBt~VX zTfMD|%xmr5Z*YVZY*_m;iyU`$D20qK0H68I3C?i1>h4&r^-TU&SXuMhwhp!ha^-zR zi2c~bO4R3>j@QkouOELZ3f=4Qw3-n8{4iRd-th~fEMiNRu^4ya z*8|L$gNgi=&y?jYxj}SeyDxVPD}5+Fyb2cuE<;Px3JlBy&tgVBu}rXOTGADj)>CyL zGo|fLu{6|aIcNN>Rb>1q&_^vpqWZ2VIm24}CGBAF0UnADnN7DTTBWBZVE*Yu+NTku zWLQHUzg=Xx!}l)8;RrEr`{cqY>;peeh1HmW+ySGQKM7;KRROJKBNS9_eAnrLnON>% zRKZ1Gzgus-Pj|+{-mPg#+uoN_t(uBh9I!%o^M{n#z10-yL*=csj5{269_s*s&me2! z2*2)|Z__o_LAUbp4Zg=wv8_MIYHCfV^m#_^EN11ZZGc6R^`Nr&PG+5#TyrY7O=ukm zP2hOPdCL@bHl6wizxRl;FDDF*vHSepH0BIl<&!EBl@D^rM}6(_5vdq#LzW`fXV`_l zl3Rp-K~~93L^bYEcZuf?_N$b_w;=8bh}WOSA?bsfR+6GG99%YqA$Hh4jl;h7zSrK} zbxvHHeU$c6Ln4=y(K3)KOCLu-V-;ud+=4zb&`OkF z&}5p>O+N{U>3n(g`KxFG9)#!QV1LY}`sTezMq5u+WVi+Q>*Sg6mWzf7Ex^U)sOsV_ zsFlhSg#@xEz^|Y0Qh^TGy$n=+bkSBsiM$YqsG7luSAuP&IDY0gmISNGi1g^9 zYna;lXdqDVI(l%Uc(CE{5zK7J+ios!@ds8jo?rRtwdpICWu7HXwf8?`-2dwS{C7Ty zLEzE3*d3uu%v5$Aw{h*2wseWk-4=m;^YB3=sag%o2;-22i=@%$;%e+-H6vWIvN~JC* z{4LRey{kk(htPS(p`^C^s(KgEV_#}7J*^bVH3ke$SDTsjCOWX!OADVIbX8E2k8P@x zzEp+E7xa^6)v+cji;XSch4L{Z^O89bnpg0NJ=Yz%gdV~Kj4d99npKZZ5(y^Ym70OH z&D>v#sYAWq^nJ-(93vx@M%;E)o$G5)C6D5jZ0kg3;J+4K$VB$k5IkuR{KIs97WoGN z4#;j__L1BS`FH$SX`PVqKj0N(y8mxRoc&}3`@aeHr>^z0UK)S{bN&K*{={b9ws-^x z;hNw-_iC;x`vrn6wEao_rC{?Pgvp8el7i_s8d1T4+w1U~-^2eB^vJ_Kpu=y>LSH0z z3APpG{dZvKKZ7d$ZJK~49vHd;w}B^*ME@OV6JL3sl;AmTcVRRz)Ay0T=`()noBs$3 zHU3a$-SXt2c7zP@eHZh;1D#@yddp&JU#+lZ28PUG`a3)&MH2izRr&4rT1=ORkcRT_ z@R}|BM#Fybe#KOwm*=_r-?!jb*Ti2t;KchKUQg%2xb$B=L=_7F<=mkvH~p{nAr*hf zk2LCUx1!3p<+AVw^u5OlhOA!5J`^MeTh0aT!W_%$Wl<|Iq5Zx{S_jRyQl~NoE=U4| zPU3~CfiJ2A5#cWR^b!g>epxG6JxcnP7J`l(v1h5Gq$h~RR{oNIC5y%a*iK> zQkb)#MC@JCN=Iiz9L*oy(onRY2;)AFh3=uWttC7Z8qeV~h}rw4KgLlPgzowNZStT# z42YSbJQ3u2|5oeTi>noLJA{&CHLB(*6@+OKDbx*i_!AfJ94C^B_Ge@%;{?81tu|#k zO6>^a4uAClFIQ3`0Hf(y_1sYi=yaD0D9EYREgkO^{DRMX6i{>KzX+m{zPms91pq`d zFpWhT)DL9IcJU+japAVGY0%TTA44m$UF=7^(UoPs_Qbi$LPBe>J~z(p9=uZ&{6WOL z>p=@KG~bKPtM`niub&5KthU`0)%3P0P!j9=RG?CVCki*?tH3@`cv_lJ_F}u_i-8r$ zDBhvh2{onOJm3FWvD7~wwQFPB%SGP9QybX`|5Bo2T~@Qg4>StDv6B*;3q9CzXB95h zSpa}5XA|ItV%5s(6j^b%o%!sG!(|{EPdZI_loZri;%_z)Sf`pSdH?BpkI~@a&YI4` z9$S?|m#VWnV$T0@qtmDrG^~-3Slae22f_0iF0*g%*ZI!B0j}W5I-j4{^iXsL=!gl` zRBkc~&vKYbM_=2o|KLlwJ-j9By4)U`wdW+&sy6GqvIFJ~!p%K-hgE#d9Hs#10tNa1 z00D-*!PpvFYD092?Py+>CdzX0Vz5S{kEX~yh-vioS5xj+}+=4b@`?UuRu=sJSn>+mRQC0!mX0 zI~`{BUArpKP2Zhd-PVitEXvV5D{Q*e@(Lo{W#lx<^jSvBr&qWIXPu57&sU5>8^`M9 zhOCBzsjIiY_Zo|xf})k-xwQ#?_7hw}mDXwYqxv`Jz1<&PI49)@3|ET*#oTa27IbSS zN=#My$|>K@W{v95!muMZ?bpfIFY*QvK;Bq$pPX|rv8?0s1A7kVS~{H4iOeP%_Jt#q zzbtWxlQI!LQ7$`XSEOJIsFG!xgf(_yZgx)Z@XHtI5yB7J^TX`qM8}Yv+dI<`;`~Te zm3#M{WJJ^a_8@k{7G7PUo;z~4`8XbQ?ufq2+pl0$86mMDwxPFSX1tg9rD0pTM(+E0 zFm!qP%4t;y(y0Ui@broLuZq?z7H;jcek|Zy&)=`p-+Is`85BXak{pwD7-fesajleq zqpj+Vog9$D5k`L20YeCgr|<6w4_KMcj;`(t3)SpyEE>MuHby0ryZ_ixVb!$k?_JOY zT8Zp@HR5`)Y_MW!Ae+C{a2>DYsAb*Ici_zHeARRx?w>$b2JLR--jP(sDIj>2W@*v_ z)QXAip4^-n&46-8_Fvfg>tN+Ron<@ldOMrQKq0dx7JYJ_XXdLjx|=ykw*wZv6f*Id z_BpgUKJnjP357yH0j}fua)XjqBDG^5`bg5yddJ3gPz}-Br!W(yLO&DNqhIcE^2Cwy zB87IQ!lWpVW7NnNQjN~H9MD@-!7^F)SQ=UDOu%6$gd?-en#Q`oN-Gu@b5Y{S&2B^P z!_^is4_WQj_*iYqSnSEqI+?Gt3J7`|9q)eU#w264y(NJe+cSas@zV7NOb83Y6}y^r z%sp^t?_@#$(96+u+Op*aAU3a5TG|hq2gRXbV*z%u*ghp)`;Cof7l^8@MhghfW9~B8 zlSl^$sCJgnZ_72`NbUF>NUAi58lS8iDGw&bo7H`*lk#w=21>LYl$xftfbza>KBpcn6gl$Rks+YqRq=qSyV=Gfx z+ev*ZJ8b|j{gnxu0xS+s_*cj&0YxhKunj=kxO*Hq%m#mN@aK&>N1iY;<%SEK?ni8& z$Z|Iq^)%i%vY#auGa4kHbD@46%LKvA z&KJdj@Irc6Oo0Ay4WOi0k$^b7eb6wE5yEVl7|g_?`5ev97NRm@sAL+@VvYp?qgTKK zDUz+M{vGshx@nW*VCa4Q7B?P|FcSIPWX#xnZkgqM_~A-qED;5%ujdk};WK_^2*cHg zoMivc8%SRitaQ#x+)M*Xe&%73ReF8@Mak-I$F|wn0FnJ~=F9%O|VUBCI)* zGIOqNfimf}XT!9Jpq(Q!n#3vJ(+YAUaGw}qF2;);F?cOK8#yl}CowDuEZfc$`YhlA z`!RjEAGbuWunAR~iwov$)(Mku(ng&%rftAxPL>ku(eztzo?(O1kQRzvh9{}D4~X1T zO`zTIeH;nSjpAhepS{c$-=8W>yt#JLA@yY z0OrR6l$tdvU_*V6*Kh871=Al9@kwWG)0)mxuNekf(T9#4y=Xq#Ka!#<|3#OIp!#ufmh;#%o| zAE{evfbp_&mS!gS>-qP~o*t*~Ufu+qy?x|K9PiLi)NfZ6W0q24$a(aZc_Pz6nrMZ- z^RfP!hLuRJq+|0sOfh4%y`3#fl75*2QAl^Wcf9&rH5rRdZv^9^At&wPvN{Wk zl#Qz|;-C4oG^hftOh8oPdX3A6g#Ds@70hO37b4Dj^gF^1(C*t9N@`^{R(+RIqphLD z^NpRed6mhOB7H%?VXRgiDSC1?qpbV-$OItN@!P6=hMC~)K9YU=!(@7+%W66Umix?p zn6a-;tQTo|8j%4h)CQEJ^>>@;=WcVn3vPH7z^&V8qR9~Pt|6SCCH6^$in6$g##%F1 zgSb>QsX&2QQJ#a7;zP=~DjFb2)Z*5N16T6#!+p$S@GyiwJI^krM->1nsChlujIB+| z@7TRv(k_S_PGXgxm!!Zwg`XWnSs)ELLoR=kwYkvgCu0)-`4gDT4pXNg5$QjEM0CZW8Oa1SvbOmmyzn5 zt+1-~<>kcyy_O5-jn+g(P_s&n-TK_r%ew%g2h!bOU!*g8;je4uoZL5Qcb2L;`}zsB z8Rd?Aj3g1b?K{VC^%eZl=bUghneoS~l%Z5+^muC+9F-5qE6Ick1^~VNPJj2wU z+z*eOC8qT)v}zG1T$N;pazob1zn+&`&KJE0ksfu3(Sl~Zu(C0JIa)cT|G}q10vxy= zUqgGCLMcqo9EUDj0#r*xi@d%cJBIcg44l7)H^L-qQe-t2@N@;TZFrAVu7xq4@f!#O z*dYvJ2p`;gO%~@Xh=R7=g@KsRtW&MmNS@myi9IaFQ0dgXG$*Xp_dS^n?8ENW*p{UC z9j7yN9{h9;R|{gxm9r9)W?%z%lDa!q1zF(^u~VW9&HN7NWcVIF!wj|e zyNl}tt&X6So~(Ki`uRbjq597Qwr$7+7tp)LQJFVJCx_4D^)-OSAsuLD_g?U}+?||| zSpcP6J?qxLx_Z^;$spfpyzgLi1>ppVZ&p;MBYjDl_uw7s0B+3Nkh3VAh5nR0qU0M2 zM&CeNX|_r$ctS&1)LS3^ z)S9~A@9@5!#&`bgo;HpD++@u`;q)OTo4v94BXe04rL4S$cw0B&SEoX%YOD{#Pjaz2z%C{_Yh=7|8ZoUKfI55ECTvrJ< zi+P-Jt@AZK%PoXStg>~|OnlvCT9#`sKFQSn_x?F$bWt#|G9IvpOL5b*i2K{^bPs3G zx2Gpc7d19ob_vcrw=|t6j4=#`Y$;~-gk)abn8+T(YhBGxVpZ?r$Ks%mO};EJ(?RE( zv9e)rXgUpK?!LQ4J~3v8nm=Og?3-*N>G8QW1ffQb1%O)U2`2?_Xm+zdGtA-87vwM>$2T5jB@#@Y!3;5Xiat8}I9 zH8zY#B(u#AV|HyJUh&?vN4X44sBVAwe!{l1;NRP!*D=Wqt$Ss50gH|E1t;-P%$sYm z&rZPuZ-HJrq>Yo|DR+3-!p${qW(;RzCruh!eu!1N%DTo?g8(@$;~<%GZZCF7v0gF8 zc|=EIK0-{K$~)zKe*B}w{7u7gBKqJap9T(KfXcrY~LvjuYCK-J0eebO!$<(r% z9t92bN4iB(nbpUs=%2+@`zHGB&QlIY7gJ$3gDtq>J=bau=nlxeRUaPk%k;)POQ}&E z*a!)^9gH+R5Ga$ShPyIas!Aa4aF^XmL}AVd+v$-B9wH_sv45JH_$$<<@^cjTItziC znAP0}L-HA9DRj&a7zS4$G-45rq-OQd+TvKVx{E`v2CsCRhLC!|o4pq`@O(|mj1=ff z%=>z=77Hpg^fMYD;qvwr@E1wvxL#$nqHe&aYw^fHeKFoTU*?Jqti-}q;QQK>>;DVm z5)Tk!V%{VouY=_EM)XF*Su|T?;=5D4Ck@6jV?;7c6hLDe7~t#~zPpX;$W@MXscR?# z6;3F5HVRokSKk2pwBp3-BptLei;j>b8&}xDXHVwCl*fo;rGumH^fWKF2M{5`P{tz^ zXTczV{)k&$PN8!dbRoCoeYh$z@m(nC(lgq(7caUSj*fUzw7@sXIP7GmdN$pR7%F?hgBpsuT ztkUyX!JE{!w?r%v{Xm=P1i9V1Hj2QePt-yWOClUh%yef_^qZHi2)E&qa5=uEfHLn5 zIPz}S$K5`DhQYwPm-l59E+F zoyojckgmn@84tn3Dp7aYhz}_Ec-*oGv!KS5o!a_a8&XLJa$p%s{j!(}Vs_M1IRNTP zm&CpH!sleb_vFAEfNiwgEpWs>N?teelmJUOOjb^%G(=6KLy5NyWjMscmZ=^!t~HrQ zM$_AWgMIe72`KUbzw2MFhC5D@kKjM4Q`gIR$a7D@oHCWko-U&Ub;|+s?Z#!nFeUkc zomjsg(By_B2mNvT)j~_75!+9{^=9tZ8_i)DefsM+cG_y7%U|~H1bgiO^n_5u5*bcWq35j{f=^M6ON9gd&JA!WT+n( z@|ZsQbY>3Fa7*+T%5vtb?EXfHdMd|=OCyJd_Gw3B{?dv3vzeYI?D5^%gcyzHk3~)E!Zh7-MLp}bD%q9Ge;Wij0kS8B+y+fqe(}=z5!bFfWKsf&tJLWW0D%V$_hHzC>wV)A zD*hIqty1Hn$S_uGK8`@~k=paimh%J&Jc)O~4j6^@oe!)Deqh>Xi zH@WL_xmNeM{(h}qxL_!~(|TJbIfWE)^%E;y=-H{kb{-`qYajqdASFlW^KJ)n-gy4= zjjlvIN-Vo;{E5hx3FFF8cMPpsEa$|^VO3p1|5KfyUz=_EYqPaBua19xi(Nl5J}&nw z$F`|_pq~t6dJ5!NRX&h}H3tz(Pj6{_3b>S4*I%mxJj9Re=Mzhxke3TOOplSG0*QZR z=ps@#YX2YdzB8=JY-<~J5CxSHDFObsF&u+v)5jGt$W?;UK=6ckC4z17HLU( z|Fc}rDo3)wr^)%q$QBLvorv^~{0B>p6}YRoAeemc&Gs{7WOtl^A7!5XoBEHAat`?a zy+^)D>No=(w$#&PWJB2<2DGJ+Q&o{bH z*m5{I-Kfl4qp#4kq1sLc=kDFtnJ6Wz())VYx1rc>&JU4mr(d#LYqz=QL_V(}0~ao_ zla!PUI(cihuroQDF3gu`40x0X)8FFeCDJ~A4~pb`gIs3S<>?*z`tD=xL6c2IWDTzb zOpN-hd3nirl;evE=gVX1fcO^rxA^oATMC5h#puJ&)jqIRT%FPnm{d6Wcx=YO^C^J< zqV%_;M*+N%-BHW|qU)CG;pa#%hIQe+<#PCXlmYFe_X3_zP8Kj}r!gQ2oyyR9%h91f zpLG9kVV&f%#<^~7l?=7qceR`4VEqT5RU|!q7fIQhL|Pi~9mn6elGYBq{V}pP;*m>y zY)Y^h{3X=LZWB>vSmU*jh9C{^KS$?tWC7k44}9wO&IdGqKYRbK5gHVIeCmAWU*(|u zS$v{=77+}nnsC{Kg~?4%9x6f@t~Ksn1gMg zYL0zCKxNi$CS|}|U0@R008Y);Ox$(;gyX|`@;ADV#nK*S6xz}|@I&`Ga?W{;BY(Oh zak$=}KQOxwSQM5*So*{r)qiyWfRpp{lhkmYWKlA*!NPqM1DH$8`C=^pT~#t&&41)8>=`=3J=Z-?FAQ4ML;9ZJiK zJa?U(XM@@QgH``DOa^!hJ$wwTys|)k>dbEuN9i{`AP}E<7o)Adam37u=`qLIFi)6pz^#Mb8X6#l6Vfl;7e9&Kzjp6NZ(9Z37Sdqh zv20F493TE#L|YmFK7Djt_dgo&>CMl+-L2*Au=@4+C*q!qNx!yIPmThhG_h_WqLJ~| zZ%3Z|ui+zEz(c={N7Vry_&YLBd1rS&*EjTw^Xqs&XPHd3d(lUm$Fkxh0Q0OZ)TKFs;gdmHuUcqtKfAQo%6&q z&XM8BT}Nbo8m7|{A`NCBqigWm^U7IcZ?Vez!#sY#Ew>ZyWPqUB>WGtVrHE zRzRcaC1KEvw^K~|_bjV7aQ!37do$MgPfna#w9od}W0#}D-mkI!(*KFX59q%x-HobG;D!vd@D@$s=r%fr^m zoOprQB6m3vFz)%W4)CYNx$Y}u=LfMTZEH$qiWL7%dlgDxA~#OHoyKo@D4+H1Z>X)W z+CW3f_sgI0AIcwUR?cS;iS5>_z=5TJA#it>Jt2NO+p+aR{uaxgaw@em7rtZgbCs7D z+taqsk+3nKXt7O4x08MsU2n^5EBoen<4R_OfF5{1=d|qS90Pu*C0X~8O=h4F6!7O2 zY1d0b);c;ndz#cZa{yo4rug1<_RXWdh)EZRwnpe<#)2u{a>dU%BgNKj zM$p9|MQ4(A`%Dn$OF2urEFRplKX=&^MQKRA4 zZzkcZ>cX8CC;_3U*3@61BzRb>j)~!&56`D~^JVCy zQE|`OiHWmpNv>4xB8Wc>;LG@A$>z%=t5(p7r^2RcQGi=NPazr?2Z-KpI|dVOuf*QP z9v_D102MJ0$5HioP(>{ykgBM^3S@68N<(hNgX+Dg$m0ca*!b>dKCGyiW9ql-fq=Q0 z+_!lFXD*=HUP{u=j;qFy7rw||?h7V6#r|(UnT+g9vP>nS;L>K#7-6%ETW4eMJ+Nz7 zKe=O6xiLo>;pYX}JU{o{G}=RG^~|lk19%w=+iTM1cF1i{!MnT8z6F2ne0qT5!KU~8 zLfZ5rP<(2sHIgl1#P^SM4ot=x{4E!8t-fyKciE4wBmj+73ir^l^~F>>BQcWaScePb z$bmZ`-5s0ES3kjovX-iFIQ}M&7I4J&gl?3#?;P9l)t#M=%qdlD9dG_{K`%iLBHgH&R^37Z-F187 z(AvIfPMcvP-hZ&~J1T^0?<$v&q>df4v1Bb>sUPkNIo}Z$(Ca!LXT93EtH?Ie6=b~; z$A7!L0fDgFTs4gJS1|xCK`=KEA#AS-GQGLvzyOI z7qd%HRW+06d7X5HAjvp~kL`*4-v%iW&A1mYh^E8bRb#2+ddf+ zeY@R3(!*fIpr=BThFWIH83BP1b`sTfj_lV@Y41@~h9lwk-Lrd#mzT|(@ndyACX7N1 z=_T>d{d$yCGpGsZ2e^^|Y(vi>WIX=HcHyw1BfFK+cjWsjHa)2gm`UY58eT_TVaU#S zy>)?~-Psa)^CY{>msPG?#=F-Flqm1QVb_r5L46c6kd?N-fZ@#paH|g*@ZD@Aa&b!M)tDU2s`GGgLCV~^RbMsXN zg4($6;>$L5GebBBg!QR@I9%6^se!Oywn;zxrZ>)M39w{e(gVvQ2Ua{*;6tiT_AZm^ z=>1YGDwyugCDLD3-406)z*qmOTmAyd>(PBaR+6G-y}5y=ZW}8Jy9L^+$5vK*nrM*% zRdH(mk1U7GbFw{_P{4T%k$#>UMw_SvyV=O2BMfPl10B|Kr!3LGzely-MmK(9xRS;{ z+20W0A%nb_`}!yf{>NtgC5hJ8kNDZL%vFhhc92ToQNi%$gf3KCQDA4ndjwXtqFoRP z8GNphv^8+b;Y(DBgD3knR#2y&_l(&06hKCH@4?gv@Jj6+zUN+4e@+6Tz3}t$(BHqq z;{V(cUq(l@rcm#I^gDAuwhq2ji!18YN*jp+?PA`pei`-5-AZ=f3kZrWrROvLx>vAj zUq&eWcysf^03H85fWG){zv(1t;H1zz6NL_>IU})|@i&Hlz|H^hk?u8<4)M*>X>--$ z&&#==OqUQ=>e0ipTiFhwX0upmtxSzg42w8U4~`_!$r5C@E;5@)-X||Su@WosBKJAG zsR@~a16L5d4PG?nwRDb+HUucPoy|@D4|jD_$uV&lL12NsyOgPX#2BU3jXZB+=CvA> z=g|gkda&eFcO~LwTUt_mq-TF`Nj;-46Gio2s3EN}+&H}c`MR<^}cyQnxZ$@grt@C$clP8O~obWcmOVG)HQMcln9VF4Orz=s)LbhRW5hilY3*JWH7x~MP z2TQb)&ecx&PAn#R4tJkY41Lhm{rH%pyc(=gEV!l;D*ZwhW-LXt`&!{aVTpV^m3ED2 zNOlW)RJ{EI4;Qsh5dN4b4tT-eSbxUe(D$Ex{4;K=aJ(8iB?BF+Y6^GkG4eOs_*GIWisxDjcKAQrRb90`ObWU+RR&V`Mdp zQ=X`^nUt{^7_S>4GGv)6af@JO|kX@;Ly7MSd z19`6XJJ2fe`(3H+~(`^z)1?f3%4iq>dp(1rU zf^XTkP333&wIq?K#{?9n&Hv`A3=>h6v!`LlA-i<|Tgdt$j`}YQ_e_rpSbO7vOHoH50@L@`!6{- zy$v2cI~*YCeoMlC+sBHER_@NpWzZ_gX>o8ZC5dfN!Qwqs1x6=5dsr=d$_A5V|D>$B zH*EtGS8Ve!407^@W!W^-jnqo}U>E8@`4H>dpx4stBep^rIScEl^(RfLo!v^PSr;^K zVwKCL_{FbeTW$UYG4H@Xl{hT%2<)uOQyNzNX3V*k@U~V)dE3huKk3|K*%vqd?VU|$ z(1hP=MQy@y{RVGGZRgA?hnI0z~)zp9AD z1J{8g>jYtc{muS_b_mNFd@+k-j&-IF7Frf;{O zKK5c6!hU=X#HGPPr#T=D55RBDSdufw#L@7tRIc5z^~;2bK*v6&0)AX_y-f%3Q7XW9;XlJkM1r{q*y163Jc@ebM< zt|!kRhNM6sRU=i|rb>y0ony}Lvp3l+>>&l}aUlns{DxYED{Hj1GL#d6^%}fUQl(+Z>lv&BN<-qo0Qs4WZQqAlKP<5*8 zhfqceWVd9FfNJigqg+HbA4+QY(UpidZHBx$#Xk zblLJfLkpGRK$A=^u;d%qsuWl1a6tqQ8+-mPb!&dgPMBmHt{=m%in3{*g6G zTXeCRVg}qc@3y6+dv1f>_A<&uWIcQ}$hyfljJECf6HceEcF={HvI@qb_=|w*^lmVD zt1VFYD4qbSqUi)Wvz>jcL8AHfyQ2KPhS0ee?vsa9O5{%^I0KCm?=6n#;NUbR`Y6!( zC8L+ehXZ(vJ$$yG@0JTF^l@n%D`?1gZ$?a#vRvZkpuV|n)l0-h_@8FH&(ve7CDl^| z+`3aD6Z>lk6?x&O=mUhfWjhoW=1d+FJeeQrs-D5zl+Uk!4&SkfCkSQkmIg~xgLa0V z+@qQ%=L0pS?YUp_#C&UA`Zmo3!d>AyB35dTvNCCJ_g7Dp=u8LPZ`?rIQyt4Y)ec?a`qeLQIK zO2a|1ohv)7+lQubSso02L*ZL5WZvw3cb%odunSp^emFASmRvKK_>W-uus7hBnsqXCza=V|UUV4HXar4+UNIEA|Im2a zKMACAy+xR0oPQ|SnZ_<-r7!VXWQK;k;b5~5TwZ-YR zG6FA$P`^RLy8QeCI))R-bxJiZM8Af`@(Jwxg))L_QaG39a6uRE2bH@~;1w#@+dCBT zW|!-lDnZy?U25_|^5D2%_$^X^;;oZhCr04N9IKydJbC$(ag?iA<3INd5DRMpm#T#~ zrc6E!PPG=pi=;-kZf1+k?(GbxpYZO>_j%-8AF$OOmFjP*vYJ7+c7D1MXqEL;eJ2_J zJ7?iXdw3u{q3;qHKD3{)*Lk(DQttu)7g!Je_Oi@CHY9^Z?>!I`QN$EiO~5%+5m_u6 z)maa8V6ygCGZfpnRa65nK3W2psy-Ovah|!ywJR)^2)6bi?_-W_<#d>D!uS?U#h@=S znTphW-a`GBb#zV`nyLy+?7zgsdo_(bIj;uvet0EwFochUx~==7tM6M?%#%#0ZMOw+ z8}OX19R{hMg1#ws7rrwDYKA+P1-pXd7dVR~fFMeJ)L1?!$qy63Jle>i_w_!-adrHN zidid_Jcvaf{Iai|eKw?D zuY;TqkqgSuTOja?3I)Z5WCyPAOS{h9f=RfKA}*NEn;YL)Q=D9_x~24Ty`-%~sm5y0 zXY3_jDhFnLyZ9oTZ^Cjs>-LVF`BR&ZREF|%Kvq+x_OIpIHil#u@E_G`L()fU2k5We zn`&p7_N5pW3MPkGpToSmoJP=e;V^oT*1M07DFafo!fi>V&_5_MMDy=hM*{1Pm22n5 z%M8o`!C*N~z#`AUj6p887lRv^{zLPvy!u(tfJM8=Yt=w*`m=Ap8rRsmtP|ALz?yawm5@K23I7V%Z8%1l4M8w>?K`qG>Abs!6jXE^9g0l!lRxY71xu zmUDb`oSa(GWR8MK!@q?HQah?1!6gq;Dmb)(qHGW3=_gXdb(5j*sQP;a^shfq8A$$M zzx|q)L?x1vCLj*^kxC2&w^Iq7O%@Q#?0No#9v_H#0#D#@+@v&Ypdc?CKhXOXJJ6S&tAg&g5`a4` zPW+&A%T&?>QrU`BA`07sxaK)!uhU)WEUlrWU%L<{3!H3_g#Tx{1c-?-q!GXLhT;Aa zF9(1FlB9ZvvsbT{05IUJ-)!jUZnlPmj?FOS7_aU<}PLh(B=EG>5R7N zdTu!kPv8^7Ij#+L>@pjtw?+yU^sV}i| zxRY?TlC}!coUedeOyf$mIkiivddS0kRc-(%<+_Qa;B)SDmfM%p1BM37Uq|z{D0Ucb z&GkdeGtR4mR13%Z`nF6z6@ks$OP;ml*ispy>uU#6i1_YKxOHWjYduyE15=1Blk{Z0 z(O=c|LQtkxuTaY46k6b~l=riaU7mIzchIK9;xFPplgAqt-^j(fSY0kJ_U8B)jl|$A zm%U<{Kytg&AJY_-)A7FDH=$ne&UhlE~GdWdS7ONu##(}{v*U=Q5t9`*)LhO(@$4P&~sSwJD$iW>k zV&%eJvnC7giX*u9v%X)ZlBm~sh+$h=OpGzDssmI_&1U>25NOy2F1EWr-zv06c|$w% z(4SIGBo>I#yr}je$1O92w9j^}4=YaX0nXL6A9rGcM0T6eRRM4Yx*+HrQY7e