From 451531326d18a4b092a15778598529ad77f91043 Mon Sep 17 00:00:00 2001 From: milkmix Date: Fri, 20 Nov 2020 16:29:08 +0100 Subject: [PATCH 1/6] initial work on Defender for Endpoint export module --- misp_modules/modules/export_mod/__init__.py | 2 +- .../export_mod/defender_endpoint_export.py | 99 +++++++++++++++++++ 2 files changed, 100 insertions(+), 1 deletion(-) create mode 100755 misp_modules/modules/export_mod/defender_endpoint_export.py diff --git a/misp_modules/modules/export_mod/__init__.py b/misp_modules/modules/export_mod/__init__.py index 1b0e1d0..79605e2 100644 --- a/misp_modules/modules/export_mod/__init__.py +++ b/misp_modules/modules/export_mod/__init__.py @@ -1,2 +1,2 @@ __all__ = ['cef_export', 'mass_eql_export', 'liteexport', 'goamlexport', 'threat_connect_export', 'pdfexport', - 'threatStream_misp_export', 'osqueryexport', 'nexthinkexport', 'vt_graph'] + 'threatStream_misp_export', 'osqueryexport', 'nexthinkexport', 'vt_graph', 'defender_endpoint'] diff --git a/misp_modules/modules/export_mod/defender_endpoint_export.py b/misp_modules/modules/export_mod/defender_endpoint_export.py new file mode 100755 index 0000000..a1426db --- /dev/null +++ b/misp_modules/modules/export_mod/defender_endpoint_export.py @@ -0,0 +1,99 @@ +""" +Export module for coverting MISP events into Defender for Endpoint KQL queries. +Config['Period'] : allows to define period over witch to look for IOC from now (15m, 1d, 2w, 30d, ...) +""" + +import base64 +import json + +misperrors = {"error": "Error"} + +types_to_use = ['sha1', 'md5', 'domain', 'ip'] + +userConfig = { + +} + +moduleconfig = ["Period"] +inputSource = ['event'] + +outputFileExtension = 'kql' +responseType = 'application/txt' + +moduleinfo = {'version': '1.0', 'author': 'Julien Bachmann, Hacknowledge', + 'description': 'Defender for Endpoint KQL hunting query export module', + 'module-type': ['export']} + +def handle_sha1(value, period): + query = f"""find in (DeviceAlertEvents, DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents) + where SHA1 == {value} or InitiatingProcessSHA1 == {value}""" + return query.replace('\n', ' ') + +def handle_md5(value, period): + query = f"""find in (DeviceAlertEvents, DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents) + where MD5 == {value} or InitiatingProcessMD5 == {value}""" + return query.replace('\n', ' ') + +def handle_domain(value, period): + query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents) + where RemoteUrl contains {value}""" + return query.replace('\n', ' ') + +def handle_ip(value, period): + query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents) + where RemoteIP == {value}""" + return query.replace('\n', ' ') + + +handlers = { + 'sha1': handle_sha1, + 'md5': handle_md5, + 'domain': handle_domain, + 'ip': handle_ip +} + + +def handler(q=False): + if q is False: + return False + r = {'results': []} + request = json.loads(q) + config = request.get("config", {"Period": ""}) + output = '' + + for event in request["data"]: + for attribute in event["Attribute"]: + if attribute['type'] in types_to_use: + output = output + handlers[attribute['type']](attribute['value'], config['Period']) + '\n' + r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')} + return r + + +def introspection(): + modulesetup = {} + try: + responseType + modulesetup['responseType'] = responseType + except NameError: + pass + try: + userConfig + modulesetup['userConfig'] = userConfig + except NameError: + pass + try: + outputFileExtension + modulesetup['outputFileExtension'] = outputFileExtension + except NameError: + pass + try: + inputSource + modulesetup['inputSource'] = inputSource + except NameError: + pass + return modulesetup + + +def version(): + moduleinfo['config'] = moduleconfig + return moduleinfo From 71d2aeaacd9b7b3f2413fb73862a53ce2e61501b Mon Sep 17 00:00:00 2001 From: milkmix Date: Fri, 20 Nov 2020 16:31:48 +0100 Subject: [PATCH 2/6] typo in python src name --- misp_modules/modules/export_mod/__init__.py | 2 +- misp_modules/modules/export_mod/defender_endpoint_export.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/misp_modules/modules/export_mod/__init__.py b/misp_modules/modules/export_mod/__init__.py index 79605e2..5b69d02 100644 --- a/misp_modules/modules/export_mod/__init__.py +++ b/misp_modules/modules/export_mod/__init__.py @@ -1,2 +1,2 @@ __all__ = ['cef_export', 'mass_eql_export', 'liteexport', 'goamlexport', 'threat_connect_export', 'pdfexport', - 'threatStream_misp_export', 'osqueryexport', 'nexthinkexport', 'vt_graph', 'defender_endpoint'] + 'threatStream_misp_export', 'osqueryexport', 'nexthinkexport', 'vt_graph', 'defender_endpoint_export'] diff --git a/misp_modules/modules/export_mod/defender_endpoint_export.py b/misp_modules/modules/export_mod/defender_endpoint_export.py index a1426db..35b6564 100755 --- a/misp_modules/modules/export_mod/defender_endpoint_export.py +++ b/misp_modules/modules/export_mod/defender_endpoint_export.py @@ -1,6 +1,6 @@ """ Export module for coverting MISP events into Defender for Endpoint KQL queries. -Config['Period'] : allows to define period over witch to look for IOC from now (15m, 1d, 2w, 30d, ...) +Config['Period'] : allows to define period over witch to look for IOC from now """ import base64 From 30d9ae6032d833962428b1a4aa3e03e2219a7286 Mon Sep 17 00:00:00 2001 From: milkmix Date: Fri, 20 Nov 2020 18:56:28 +0100 Subject: [PATCH 3/6] added URL support --- .../modules/export_mod/defender_endpoint_export.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/misp_modules/modules/export_mod/defender_endpoint_export.py b/misp_modules/modules/export_mod/defender_endpoint_export.py index 35b6564..a4a0ba8 100755 --- a/misp_modules/modules/export_mod/defender_endpoint_export.py +++ b/misp_modules/modules/export_mod/defender_endpoint_export.py @@ -8,7 +8,7 @@ import json misperrors = {"error": "Error"} -types_to_use = ['sha1', 'md5', 'domain', 'ip'] +types_to_use = ['sha1', 'md5', 'domain', 'ip', 'url'] userConfig = { @@ -44,12 +44,17 @@ def handle_ip(value, period): where RemoteIP == {value}""" return query.replace('\n', ' ') +def handle_url(value, period): + query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents) + where RemoteUrl startswith {value}""" + return query.replace('\n', ' ') handlers = { 'sha1': handle_sha1, 'md5': handle_md5, 'domain': handle_domain, - 'ip': handle_ip + 'ip': handle_ip, + 'url': handle_url } From 47980ef2ebc191d537d89c4bb4671d774028ba19 Mon Sep 17 00:00:00 2001 From: milkmix Date: Sat, 21 Nov 2020 08:52:18 +0100 Subject: [PATCH 4/6] added missing quotes --- .../modules/export_mod/defender_endpoint_export.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/misp_modules/modules/export_mod/defender_endpoint_export.py b/misp_modules/modules/export_mod/defender_endpoint_export.py index a4a0ba8..a70bbb0 100755 --- a/misp_modules/modules/export_mod/defender_endpoint_export.py +++ b/misp_modules/modules/export_mod/defender_endpoint_export.py @@ -26,27 +26,27 @@ moduleinfo = {'version': '1.0', 'author': 'Julien Bachmann, Hacknowledge', def handle_sha1(value, period): query = f"""find in (DeviceAlertEvents, DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents) - where SHA1 == {value} or InitiatingProcessSHA1 == {value}""" + where SHA1 == '{value}' or InitiatingProcessSHA1 == '{value}'""" return query.replace('\n', ' ') def handle_md5(value, period): query = f"""find in (DeviceAlertEvents, DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents) - where MD5 == {value} or InitiatingProcessMD5 == {value}""" + where MD5 == '{value}' or InitiatingProcessMD5 == '{value}'""" return query.replace('\n', ' ') def handle_domain(value, period): query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents) - where RemoteUrl contains {value}""" + where RemoteUrl contains '{value}'""" return query.replace('\n', ' ') def handle_ip(value, period): query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents) - where RemoteIP == {value}""" + where RemoteIP == '{value}'""" return query.replace('\n', ' ') def handle_url(value, period): query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents) - where RemoteUrl startswith {value}""" + where RemoteUrl startswith '{value}'""" return query.replace('\n', ' ') handlers = { From 6b9d30c6cea68a35ebfc366d32def92ef38bc9ae Mon Sep 17 00:00:00 2001 From: milkmix Date: Mon, 23 Nov 2020 15:09:31 +0100 Subject: [PATCH 5/6] added documentation --- documentation/logos/defender_endpoing.png | Bin 0 -> 663462 bytes .../export_mod/defender_endpoint_export.json | 11 +++++++++++ 2 files changed, 11 insertions(+) create mode 100644 documentation/logos/defender_endpoing.png create mode 100644 documentation/website/export_mod/defender_endpoint_export.json diff --git a/documentation/logos/defender_endpoing.png b/documentation/logos/defender_endpoing.png new file mode 100644 index 0000000000000000000000000000000000000000..efc7aced968ec5d429cd20a469d8bd6684f98083 GIT binary patch literal 663462 zcmeEP1$-1o7oWJh8^lO(m*Q^4ic3pzE5+$YDPE*NTci{(ltL*|pcE)A*5XcZNkS4x zAV!S1=bH&E++FT=Z{_ZG@80}=$?nd)dGqE!b8p{{yjk&4&(3z%-qr{qyRKb2^g+lt z1RAAK}_%FHP<#!s2*-?e>v z|EbfbjGgfL7=*rz*w%MkzrIQCE%TzY+jU#M@W*ab`nXy8_i6X-Lf5q+)dQ>?KU^O0 zOSoI_b50#Qn)+PbvD{?Us)gUV^{#2V()x+Ti-4W07VlcV@_NzpIlCr4I-M7PtMsqO ztr8AoZ996~;;g0ZhAs_yH(F@BuU#dlXN#{~y!`w{?KX?7gQp@#%cG+MW|RaOq5SzR zTGR+UYw<5K`trVwB|6(<>)E=#-;_Bdx7+-Q(ZVH0XJ@Ycpqu4FSJdXKRqcL5Z8{k( z+_ovCFWO;>hTj-9G7f!I3k?rl5Pu&n+?Kz2juHC!#{f5@9cz)l%b4XI(D>%)!0iDm zJEB2#k?YuQ7n`CdwNTxz1IKnjhyO-r!yIjnAWK_RxA*d;)sX2NH2i8%(3fb*X5`u_ zb6|_tH4Zr@RL4kdKGNbuaMO;9KDMki&0^rd+Lfw?b@iy>+IWQVh%IeupP#+itNx;f z4$rb~BD7W1}~~VbWvy1{AcHHW_RE1d;15gB_p54ukKv@w@q2G z-~GUgT}Pf6RNXbMxAU}B9kzUzReyKjigrI#yHw>~+347qnnfn9Vj7{tpS3cYv$odW zp`%Q4yM;Oqnt3)h524IcQ_el8YH6}?{Nm@gXO*S5F6q3Z3R*a}>krcq`m{rE?S9vf zw!UJCP=_6hsvmCalYP#!=2>&!b7oJ^*%S|Nyrf<5#q;eP+gXoZ=sSIQwF6(btGevg zVZZ9b>pW=V*YIrb@ypgtwXc1?|3CIEr#cjlu-tyG>gh#RrfsiUx{L^jSZ*|O<)ENd zmL8jz<_DbXV(R>Du>ZB?uDt`ht!>n$UZ0iy{QGzD%WOH_xal{abUL}V`BhZ^>*8gn zJJ0uU-b*^|w7D~SX1y(|-FIxgGyRx%%kLWhl5pqu@eUEITeZJZ z_iUo4MT3i<*R6f|Lc2ddsA;us)Qvv_57_>G+57N-116_d99h5KH-oy=40`0e z+NF-;oaOB=HVJlK(Y}7@i8aPu|NOPzJ?DF!?oI9!lvH!y)`nfYgVtS(7(MZbMbjT^ z`q#L+^u@Lp7hW`Y;qxLO^JD96Bil^-HNS6c)jroh`_Sv9(dr@X4*qhy&mXQ>+gGy_ZXiy;g7_bC!M0!SL(U( z&cJ&&k~$}DOf<=!Wox(0ZSj@m5HOZlBeI z4Zru_zwM(}eSP|l+t+;WH~Yu!ozk!Muk#0&tS}#Zq5Fki?SJjPYj~R^H)Z@rdNxt=JQ*_?kDPv`DEh$4I4KM`n}8Vy?^ig>P+K9se88lcBbR0 z!9|Pg+g|xF^pnue<5q{6ZA<7I-ZyHG^&a;gEt};Ws=a^WZl7OHb(rUuA zynFNRS8mo9^0dK(pvAVLzp{o_8sG zLsFe_gKj(Ce$pWBxXX=d7bk4%yY+tOaUSDN%vhYY{M!}XzP?d=W2@R*eJ)2`J@ewj znK{#jKL6@o&bF;bx1LYk8~I0CKX2YMWZ6DlV#+?gS+du35@@{LJpV!x& z7;|8LulBtbjr%JhsLrT5YX=^DeE9F(v-anWNcU)!+iLpHajoK7G>NVsJ$Ts7CTIV? z`uB}q7p80wf}pa|WnY!uMSB)jF&byGVo}>g9~&3te>FGYzg4Z9MUKfm5}w-j zyB#Omy0u;X^}(-So;w&Y{%Xpag8_L7o5I$HO|W13(fq_mcPvK4kNEb&eB02a-z*)t zto5p?%LjSit+%n!th-O!&xq+z*kMD5=&j@G^=kS@tq&VjZ?(VnXDuR{oNRcq_2t@Q z2j6@+XxpH!pLg?ZTD$t8#*;t)H>Nl>>zmkZu{LpYJT}$2I&|vnU&793FWuw5ueNi| zW*gdcU*7YBA2ZrIR^RLXU6o9iSyfh9&pz*Weq3OkyN&NIf71Sw>XmwCcB$Uus~=L< zo^CWd_)>%2HD8`s61s2A>F##jqqa8N?!M)J{*&srY<8yJ;vd$onbvN9K#z6D$0d)8 zAN#)>2gWQtQhI6fw}02EwBF*{#G`8tm<_IFeZ1XoiT#FDeO%q*$ha{B$NqO~#r38e ze&1f>R_e{8*CW?7`6>P9vQ+2u&d+~1zI$1>fwlYw#h*FwS<@perp=DDj&n1sv21|( zffoO)JYId$!(P9q4%~QX{+W=kdQ4pO>ACA)pZm*b;wzi})-RXNd-e2j>d;<;>I{zg zYeeC)Z9c8sR;)ba8tJjoZNZbOPrrQW^Uaj&|80Ky`!}+`QU4wf$37fW)V1hnUh6|E_9x|U zD4I0%V9!a@Qm>fYGbynMvOoU##Dj-^_gePrv-(kuSDo#zRQ|VgTl%b8c8%@&fB)0v z*r2H$X1_?vvx>>9WY;X>f8WhH@Z92l<^TDO^Q-e&yDgbpI&JN{rRd|4AD`@Xv(?>4 z$E>adWd1WV^GM`Nmx2Eb-10}WVUv<)CbuYEcfZ$_Q$L;Ba_Gb- z6Hlalb>^=*WAl=Hwl@ij%04suwR_p4hufRBj5?F`)s(zTc{wreQS+yVmW16n6+SC8 z?cnKNr-x;?No^b6KI)r?tv@b(`Xv47g3r#*+L3klY3DrirHgNuuFYBP(B5qI=G8Zr z*)4mu{exCbo5r@DUXoP2r~U2Gw?npjl=XThhdjG zA#2yWT|2bx_oWf4RPFgAqp~tg3PBD5W4R}IC`SN5QPL3r6eXaTDv8r-RGqak*B&Mn zG?p#2cv)2=*=KFv>rBy_e)WV=!;fg-@Z;9LUX%15lu-u~*8dXr`ZKDcTl;vTq4gc8 z$MS23pJLI)XZVBrZP0el(OOSY>=~6EO;PyFAgbOYl zT83=qN63*%3KZEMLDfPXFeqB;nzbkdS(sL|9;hB9G$C1>WBAlJp@ON4u{TOi*v zl=UF)+$-j+2!BNyUNMW#r0~kGi_97arJB2iF6zarOpX71MmKUqpB+wQ6tY0(jg((p ziX0a5`^hmDNJF6UoKd7M!=ZJc_3`o>0srZ|r^xma*?K7hgrwh@98gZydP{8i^~~r>-O6tS z{HGC6p3e%x)9?sU#uZz;q7)C2D)tZo>&(bXBcS*=n58k6{FcB1fAo<*DiA=d=E)mt zR2u%NP`4VrY6KKniBoe+${!z150s5odQS%k$#7~^rSg1K4;0$Gr-afND3riH%bu2( z73_l7x~K?5uaH>vKdRC#1Q1IVKN*V8#qs{-w^T2= zH#LBMFow#=;i^$ksNT};=NIopQ~cP?UmU^+2nFVofkzKPCM6C)U&p(Is=7N@M>&s z-4>f-Z!4>;wtI)H3_1mc62x<9WK2pwMl4sY*ePPEth#alC`yn5 zP?UfIOC*(nLgJviC_x550Z^16pd?D?Gh&K1evOBtwrg?f=kRScJy8T zG@YrIx-xOK4vJ#WkR3yyKvMWr*2)S%s%&!A3Mg)iBjeKZN_=GtRtAP_I=NQ>2PMu4 zwsW;H)%cjC;Gih>1jULff}uE)y?c;1>R-!VE}J4avWc4biD?Ctq`AS!!O}#wF6F~* zauEs--*t0Glbbm!#NvV8-(I3WAHDA^k^)7sN08d3<`g5Zx6_6dYD*I#J8(;pt-G9# zzBrz&k?{tNzmhHHKEd;%R8_cLWq)F$8abeiA9*29JNcf+jkEGx8n)mTF@pNr|o;eLCIVgQvOM?YHSTXPrJt(pQlI7DRP!*R=lf9<{gwVZy+uJAwo<6_I z`-K~_j0CvXNKYYhQN4xQ+C?p1QzldEi{ zsEU$!xF&_m8iKhUidY&S!(9at0DMVn|%1{*~ z@v;>s&m@d&=v4Itn{9l4m#SVR>?R`u zFQk;>MD_K?HVvPq-l(YCYNKwJd`;3rf85{OWS0CW^( zs6bo=1fZi-fCM6xAt0IsD$0b@RNRL@#~nNwnS+n0VIP|KS^axyLgn`Cb4ojh!5Fh< zbDm`3^>?;HHdJ9XVRDUv>H&_Rlc)r0OAb zeeF1s=qR`2^QuOr76m^_E~x$>sj$Ym=-f8g2bRiCprl`vM=6^(kfl8rorBKD59*xuI6E#LTpaf^0c_`Vr5d^<9gMwJE=$~wr5Fn6lzqP z4S3^lL$B@Op)w2Ie66ZXy9RorfwkqgmnhO^6_jFE7VLbaNmcArqhQs^jp_to>pg?u=|p5!$i@XW8$4j4Wo5Cu4^_JF9# z9XXn+wB$R=jK7i)`Gtxpgnl1gK^$ePa4HaqI70FRZf0+nUyB%Hy%0_E8s(FE_Gs0` zG{G99ZJ-tUXQc8EDs|TSDig#Ve?`d#*@KH@`0>*S3CMa^h{i z_Ga^mT%^b!B;Qel!dFwBgvi%9MDPJ&p{lJmA4znSwn5g%WNUOGCRg?mRdVFF-=}Mc zjo_~vIRW+HK@#IA1ZTxTH^s3OuHz)VtJ|WzLwr~@rK$r$lrd5K+EEq)a9Cq*iI* zV}UMD@K+07rt?x%G0_)oLh2`}juM?(=pFKX^h?=>5$Y90cq(p|=Gs9BFU3w`zc3sX z%Ip%xCx~3fN2@d;v{DFCdi9_{7xQ>Lv-?aISjBg~Vgt$2(%s8;64F7)D~9fnAv#`) zG7Q3Q*JL{h$t$H!LgbZ{Mj--|fL}qxK#}|A+Mz+2c?nx&RqJ!9&8=>?C@?K#SwH+y3ik*bW zE!mDjgr9pNdG7LaX^Y7{6<&T7j9jechs;%dI;(R+8O4|Gs;ET>t&&cnbtk%XGP6yS zbVs2otN1lU;uWmWbaSAT5`dh|;ERde;T%C#E$T0P)WhFJ3G zMMoiEDzjT^dYGe|lL9JW&9}o4t>tDTKc7m*SSYVbvIR=@RU=yma<4ZXg{qh`?b5um zB|0;v;z~5O9Y)zJhI}DeD>-pgUpfedtKM}Ks$$AI3`tY=N+R*9I*qc4XsR>Y0Z>la&SHw2)@`t)#zXl+{;NoWXPySpZaN8Ce>-dwtg)%Ia>A z9Yq$1+G}I3JxVHQEE}hI?`3EDG;Vfq6~%Z%dN%luqS)9I|4jVe+{CDGb$5^1ifM-Y z3?0RgTc1VUB{h4@qFz8MFapp~1O`-Z**)G-br`&V^tO40s~D&h;jq+OPS8p8wrPc{ z7<3Zhu+&>l&`I>RX@#p8bQ0mP)LTx_N%Xd9g{v5J65+7aTTb$e_Vl)z$}4u{QC6ou zzrH-7JoSC-=}~@7+XUHMeIH|3cLq6_#%CP?tRc|z9|-Oo6?TPjt+F9?7K5-!lCz5K z-)axJZG&7p2+2qIwb=Ch6dxW^$*cFT8@g8u-MU8E229K^2?j_`h)L-{3Tva=nV{<)oq4Gtqs`60rO1AV-NoYg^hab20^_ui9LQih= zrjx9{k~VV6(d2DR?V@V$1yerR^qbhLaEr~cvQZW8Cw$=a-MXG0UsOntV1(#9NnA#e zYjj#+;N#@N>Jcf0Rj$P5HM{X5zahq&m3=Xzr4w4(*FP} zuvSS+B@n+9habs#bfS_}U9-DawLSJhCCh96PG--nOpS9h@=F|tHE`UoDuWo}Mc+y2 zYzlP%9Mi}Ft?T8flyuSQS7_;fsY=siBUSC>qG)#AevQT)Or#!JU&a2Vq_>?UZ*hpq zb5Q1=N=D1iviCyF)LBUH7=0iC{dy;pRY!qN!V0d6#Oi7ie1tk$(7~-D1DTkeVHs#N zk6%2+N}bL^(H^{?iH75jQ&d95RJ=kbsfY=y7{yNVU}^vgc2#}kgfiwU&ZeMwr&5$9 z@ruj&Iux0ikPm5gLGcSo?43k%b2n@{NXU0l=vjIZyB1_YZ8QJPSN4Z^^YP(N{aECb z7OCVq2@||a|4l)Q&IqqH=*m4Fp7YLqLCQk>{DiIEXvHG{?nd~!6Gs$i%cgy13iPSUB0jn>YGS9J>H%S_D; z$f@d-Vu}}iC;6nV{VrL+_TQ7AJhR|1EH2BBx~J13fh#K>Doo`wgsbQ~$>6#Uhh-aL z?n(L4)E|3!$R=~XSEWUEhP~#@Q&~o`UPU2j?RBb9uG){H?<9&fiOrB#{dmESA_?nf zIxRBh5chQ=M370%oaE#gbudBh`S&5-{pBJ=_#nAXq6rLDX_5ZBU+^yO`)=}@j?DAO zhTb*p|B-zbUvC~SXlLR=KJ&*+xA4?(ohz|#@D)-Fv@XG*iCX#pQTsp|+-tyZx$WdHU z4U+k~iTom{mh7TvyqAhsP}cCuCij%lsZ;QXhVu4^;#qBH$5d*h4j(blNJf(=1M5tr z{FuYjFM^bjagO8KL7c3ZVZ}QHZ*mq)%Ndz#qh*2UiW}3|agA(xw_oH3yDB-#AIB+6 z%XF`(MYwhlQclv`5V_)-ZFna4j34Aa=@k>j_AIGRvhgF&X^H?UzU#@+oO}bH4&rE8 z5z?@D`A=WG&xW1V%(p^3^H;19Plj5^F83=`eAg?U-Kvf}vRZ^s2O(u8&y&|8WK+4+ zgXB7ivR`4U!pthyEew1+2zE75p+6{k9SENh=u?46qXlhP!%O zK`AZ5w}TJ?#x;?j@wHzl|Cvr`f?Ukw$yG{0lAT1EHc?dTx2FU$wgWZ(CPW8Oro9S_ zHO$?~0g7bh&vq6@f^-lsTN6~@M}7fyy|pnF$`rfjfC>W3 zL`b%ikUAvK4X&^lq|O@o^{CZ6EKo}&uC1~Pcn;aV1@ZZ8`5EY9JQV!+RiO;T2!*_O6<#M#<3S8>ZlcuEmU$doq*&Wx^vtj#D3M7S1G_BykjA5o!zhtmTaREU&N zgy`L2se`5LoDM~=%*&$H+$Tt=c{XJoMA_?3%C8v;OG#@IsuIc?LRo|5;hACwB_pB~ zA9b(lc90{V`p7MoQkTEj==7qK5K!+-_LnyfaGbJ^@(PcL4rIBOglaSkJZG+M2XVDA zdG=vdyML*?QoicN>xOE8-n(AxIr=zz5cN!5mA!h>@F=b4Qu$?&6uq+RCcHjmq{8$+ zp;Oioadft_u^eT5r4XlAorD068$Ko_r^H_od}SSl(3sDW8*Wj|R{pF^dyoVb9Rw+R z{V8QEkx0FH-B5TZ&Z!b$ZemoyNh@j4h*$Enu_O=a08?8i9|$FLF^1kj2u6CRNl2wg zuwM|7lv`9laLD5Ul()f zUP3`LsU0<#S(@98!(RCD(p0y~X+zt5a{1W7`q~aPCLPG_8wLhr($zBbrlaPx4aw}uN zsDp|7WI8~ z0fAl*ra|)xg8+0AVQ|!IF3?Hzx_O1E9CQ+4aMWuq&`I>Vd4;JQbP{23)N?Lp%G$wq zu%5RuR1Xl)76S0v(H7EB4j`cC2!Jxt^9F|M0Rq}W0F;TgkcM&q0X;_ml!=}RMpK)j54vOkhX5!O@wJJd5{*2N zuzqLQ>(2yb%7K|bKCKm>p;(JUR>&d|1VEWcq@mb|Iq68!w;Qjf&t#KF%e2|pkyK?v za3rN=Tywl!@-JSF7Y_X@#D{4za6JwP5Ll2Kh`1swO6%rvrGzfq)(P2|$O_Pcu5usdvTX(E59 zrck8-A4UW~nJ_}cOrVbUSY|H#DL$%hi}nujVaI{YY`O*US%piFqdSDqP^34aVVs!YgBe_;n# z^hGOYWTeIni?ZtAm91#nF;0V_%Gj}r6GFMj7I-Eq2d%`1Tb+x^la1zm56Xl$gs=jZ zKZMNZG$|`1)Xf~V^0!8vLab5eDz?bnl;5XWuruMKM{W#t?uEeHF**; zi_oLwLbUl>20HRswWR~fgnyH;+K0ivIK$+?<=jy=NNMu3g^e8Q(5}Clf!C#EydyQk zTTPD+_e1T1Y~IBQdE;eohR7dLD0Iq1$TAI;7bp{nwfx#kY3PgNy7^?$1XM-%K(j8} z<0`NwgS)Hn;I1*x!QBdsAwpvafHKh-wA>iy<6qYgm($Ry3+X5=uY?;DJ;=2ITQB5K zSr}5s4t?It88!5^QkJYV&eKkF3-pv0Xn>KROmy7n^G?1(E6%0rSPE$s{~MmdCVz^d zaA{S=D0tQ)0^l4;i(o4&Dwo*#5C8!^Kme499yB6U0T2)a0-#KE+zKw%@GY;6CP>UO z-0>%E;7iJYF%xYet)iUTUKT1+#1kF=RWM?!^!o39fu~|~L{o{>TyC2TMNpLAo?308pS(Is96p7Wm zaFm{>o7pMs>x34^65WVJE0ew@f-(`HMMpGp*ha_ZJG=mmF7&8I|5l~TtBEu&io{}W zIKm$9brzhgU?5v(;J+;xl!*W>5bA0XOULG?8_HL5Qh9dt_o8lfe&wo2bSXG-LrE8Y zz5SXl8FdJ@p|vb&GehD#1VEX*gM#;s>Mf}ZtnDo5e+&%S1xuEqA|aJOHL4OV24fB; z(x(42(yuoy0VJx00LqbCn)MKR$MM9Ja8K4zfk&qhFDH4)Sr$|UTC=!B#FaeZ_ zFgTWTVfyx7cZGf+c6b9v0i|JPrD;W?NhLyRm-99Kg1YWI;%Grw+rxbnEdeC5LI9Kr zE4Y}6`_;1BK}Y4eB$6%}X=@w3CKZXMl?VZFSbckh4@g&uWocO%I{h?PWjaZi*wlGD zEdeC5LI9KrE4Y}6_YU?MK}VI5UyAlKc!uBBPqUvpno=a>2dt^j8AVLD_N5>AwVp>m zHgkKje-%ZZ@XQYZ7=Y!6pVHjdVsmRZ-xPaSY2w?+yu~53-sW3xevYoh3hRNLP99}x zZ3C^)KO^a( zlnB9yxI%EXQN1*ZjMdmNOg+c^FUZZ$(JX}yb4cTc0F0S%!%eMROm9H^b%6Z7c}mMG zcX3r@uEhniv)eeUR3y}xh&DfIC~%(7qE{q@j!BVx+1hy?C=v=$;jdts2#={8$Jq2D z_rPzXXcw4NaWO;prv=L8Q+xh@t?m7lt4vR}GeU z9SdCubu|xrI6bfd9Sx)r1QwPp-~$9`6h7#wnfGKwcB>C}yf{Zk?v2l5h{msAx-j-& zJlYYanS+A2<7uRi>pI94Uxw``OD&GB$`$_hfoa5*kTGc!D>I{%tVN-2%J@T^a0q}h z5e`dQPW$e@?)mY)gg@zs%I>&2LX{NF05fh5GM~C*&%FxrtF)?&44vl?0F=C<35N z1cj5CnK}b0gv+aWRgj$p{UG^AJLAytaPB?{?@tLpA@~$^u_zHzZ*@Lvnr?W8ZpYI* zcJ;vvN}j`l5(25#0w@!$K`mbp)7&wk9^2Rf{m_$sNi0zWWa%l}5dB3U!YjCRJ|;rR zJshu*-@>r8mC!Pcj}V$+^&K{B>*qC*+(XbF0-#K^hjoRL%;r4F!n)x7U_}LrHxcT5 z_N+LYg65r4Zw-Z~tqDrZ7RO;SWWi0r68faS2(?TFrj0$6L{@X3AiOG6l;OcNJXYgs z!6@6p)34C-vuTWU%_>`+JU^~-XGTIG&?o|+Of(8FJLa|4MBjLvT-cB)m$Q{Iil3w2 z&R5&{Pf(#+YKo~;{^^gV2clpXb4Es~xh2SF8U6BLib>|e5EE;2V=eDGph}0UECQfR zWYG}Gy*h)lMAWuH*68mMericwYjqR~PbpH1R%jyP$%xJY2~{2$OjdWjK0YI4?;k^b z2UB_Bs(S=LndrU^luEGnQrg%VeVWM<|y9#pkd^W4+S{1W88M7_@$B5%fmDrUA8CYs%)L<)ky2?0ddCd@|=Gv8Ld2*hCXlRgij0ekWEtSp7@}=7MHIU z?OUSkS97blIa!;q%EYDspw$clpiDG_tJb)V_&s6cuG_E2vn?QG?uBXR{2_HD^P@W30QbGWfiIiGPO^44QI+qaP$9>86;~URXNhyFs6THkCm}qD6#-BtVr?0L1Ct<%!*67?u-Rj`|e z;UO_uV3zPzuoreKulo3K9{eGzxDWtkBCht(nlzssPW*n$^^EC47g)o?;`-ew0ZoMF z3;e{704Njjw~@vr%qb`}4*D)CDuv}#GZD@*|hzJ2tCL(GK5CssBG6JAXq}+NSyO0R1 zHk%47{dofl8ihB6zyJ^c1l}Tm{a{TiTxAB!PM}8s0)T)Z2!M?u2#ml45C8-~nLr-^ z1ONd+5CCN&2#ml45C8-~nLr-^1ONd+5CCN&2#ml45C8-~nLr-^1ONd+5CCN&2#ml4 z5C8-~nLr-^1ONd+5CCN&2#ml45C8-~nLr-^1ONd+5CCN&2#ml45C8-~nLr-^1ONd+ z5CCN&2#ml45C8-~nLr-^1ONd+5HJ;l3owy90U&#+wG6Pi$tDlb z>MsJIO!T*HX=|2|S7N!~bjqR)SJOYkzHMx2i5U`2j8WznEuFtz(%F3p11TiyF#_Nm zNsk*>v1&wt^#1kb9~WYByC|j!`TSw1?f%~ed3|haVNxt4U*IKf1VEXHyL|+a?p$*IlS9FB0v3t1$F04NiQH5eOl6Ece&E3Jr%qiZe1o+3~Z3z1(a~vvnl{ zl&d)eK$&O`Tb*#u%r7x_Ssa-v0&7HN{rlCj+p%}B&j^(SkRV9}K$%Fg*^~=C`e4Gk z9k*V8t~^zAvDr61uiU7fx78ETNd^LOLI9KrC)mW5={z1_ZO3zfwUVP5n(%=m8c@p) z`8b#{RpRI{h@4kzN&nvz19~^1LdQRi#6`bPxb#BAvFXAZcVup>K`V z(GT(O+P*@f8WF7mtkC`;KFHC^L=9?Yk}cQL(d47a%!EoP>UvvVy!p9*OC?DVB@qNb znMkCeWW~G?lhcq)^>S4rOFO%w87*C8SqgfeS5%7Xu8l#@GuSUPspDmN`PL-==7I_Y z%(Q|4C=;!~EKDKOjwOAw?sEE`YM1tYGyE6`1lwL^kTR z^Cf4l?SgEM?CkF~%+ua9gEJGzsBr{9nP?nhb_Lu^$PfAY-_&`BAC_;rA%dYIkk z*W0g$zRWBRQ9ma$Wdk1zbZLS=Goh9#((_7CW8pn@l;JAHI9lL!E zeXSlSC4xw;AOOll0GK0E3M!@Kl(@diE^*DsFLBJsFLg}LE_P4MD)GWf!uxr8k$+@r zA^FbWZD}xxYmWDU$Kp>KJ~K2iX@%%oTpo%_D?+8E2$|r?o*-v))Vz`v^2JlgLWBp2 z`KZy4&k_646!lAYvNCy5&E5PFmOa|f!6eSb#x%vz(m2D>(&XLeQfXP4v9-BzZs!o& z^XhX3N@WOuGEs&Ki@0BIWegZ~FmWG?EE*v-!d&qz2&(R3!J7ZRd#};-W69`MPKnxi z1Ds6J#@=2Ck7uZzM;T#wasg`a<1>WEYIPP`2U;ILGrCeYoe7{P1>^S^1Sun6WoCqK zeD05eUCdckBO$XGHQ5k@u=T_$A4MFKUW~eIk1Ky{iY*rWV??GVM5VC{q3#wa`|D7Y zkEfG6{1l6BzT`Ki!mf0n77_taCPJdAMP41NSff9N`XWS%;#hXe~( zV)Kyo{BTs+(G)$N9>hthSehB5i*Ltx{&Lx;;4n8M9P$RHb^?v_s^NghLNA z(Ud=v(5qY>eg{#4!Ic&PP$snS=svM&B}=rnrw6L-X~{{LLi~2G^6gWUkj?FLhD)K3 zUlk(DdEqG3)eI|@Ku(qlRc@ae_K5tEKvvd%cRmfRxs---G^iA*vf;`O0Z=CF@X|PS zhhS?orMVO8ScTujPjN{Zsq6lPbZiK?{=a0V=yTM{bezMOsJS|WSPdBungPUx0`F#;qsJG+u z5g8{Mc_6VuIz$MI04Nh-@vOkDhPyesg?~Vr4rENE`l=|DBI2h^4Av+ zwEi~88yR7rju51c04Ng;w;$W7TXn_x_IxUubK;e{@Jd zTuBJrfQNPv0A-?Kobf&#BOeH&905=!%5l+I?4{?qh#^xdenDEpvz;D@S7HDs~fOcvm zy;4A#Xt>R=Com0{0PG0@ukk=P1l=M4Jzcl>L+OBk-XH+VL~oiBDgp@T76DKuy2T$# z2L$v60Z=9yZc4If4T9zou(N=!ta+5_OMn)j$A>Xh*3-E%;-qYW&U8@59OB*~V8dgT z@jE7P!wUgeXTl3UgpZUkes^qwGFDQbWe9dLLl36~Dytf89NE05&ERGOYfQ9>x3aRp zGEs&Ki#U5r<4ij8*Vxa9lmiz<(*Etf8g15_tG`)o%Bb&UfimIQ!Y)>(X>=?iQ;X=5 zMV;0*(2BKuCD`r##pijf^FapbBLK>TXB$>>GE1goLC&Y43jxl;oRCLX2G_KIMpj~- zHT3&v)_EXT86!rDj#aEr z(GeYaoJE(6dRDWeP1jZ;7pvsUf24nakGAmD_i{j)2++dV%sxiPX5U?UWkTGo>pFC* z!hTk1!eQ|r;+xBG-l40F$unJJuP^0;G7+F9U2IHgNBE-B=-1VMSe5>pUjPvqSsWea z$4H|{u>Iz1#VD;mxAdo<4cmR2Ud9m(9Dmlj(0W=RY#r9qhGkQ&t|9El9B$)rAabTB zmoVd45=zbyW*6kt7S6OHY`;mn850eyZ~rST14vXG0Z=AtLq$)B4;IcSE-iCZMfD0h zH*vF74Y#eiG0HBaU*M*SH{bZfpZc<9QP0~Fkw3O!!0wlVDH2k44~Fq3qV(uOb$1Kc zQA7t2i!}JmVF4B$>97V4JL%HDzd%3hF}n@@8~Db-N~o4_1(u z9sy7$^!TWqI-!ZQ7_$kAloJx*n zkK}}e2VMw(GT{Z^`^BeI9(w;O(^@#MVFU^YSR-ImR!08~&zd7- zK&D?kA+KkZOG`st&CuPcfwV}O&!JtmLYr5p#DXQEYO&I$A|Z-)T`&4sFH43a1&fze z)&8O$wUCrH5m+V~Xus(#oLAAY4Nsw8Z$k2_GcG_^2H&)9Rn^=4r%gpd>cpf-)?cCD zwt!i{Cl24vp&~yh6BWSliC+1k`vRu?Or1V#GQH)(#Gh~ap--4M|7ly11URbRC`r|K z#$WW#n&1RN_%0(rdh@fAn)~%{7qoqjkf-5%! zK$&pEO|4wk=EkLFCPo=_#LqK|Q3->ylepPc=vWAr_GN1qrMz^hNGds)B1bC|rE*b` z!}rHiw<@oHe(F0=Wg;Z-MPOkWHGc^jg)f#2`7e&E)SQ6?RbLfNOM*2M!rx7_G<*{` zeB_~&#l$}owX#lLY2i3B@(bo~y}b<1OI)l?VpZ{nc;OHLWg;AwN;x&~wR(gTXje-S z6D60yqx7W-{z~}^6*;P5#dZ8sjwYd>ZqT0>AyoOw_zbUakC+Z*{_tn!0h2qE{p%>> z4{^dG0LnyIJe6|$eTa8|r3o^Tfh(hAo|NCN@1@*&P)@CW>~DiA&Ic1kvgsP_XPWv2 zaHQPQmwtRm zY3!tt)oguh%CA%tgCe;-DS)wM0#`6A;9HaY8!$2g0znV}Wg-ZS%uEh^%xs<1Tunc{ zLrO_o5W-v-3yPB?<=4)OL6OvOH%B!*>9+?*rxl{aZ2Hr@h*eU<0}jVw(H(e^f->O+ zpZb|Us=;iX5N@k3q|!3Az)RV_Y%SbDJFNrX@9GnSA|aK(JtdG91Cm&M6|>@fG%cV8 zBO@RX3;|Fkf@IzfL%1Ihn&CwF9F%6|dM&Ce^p6GtqH(Bq7u0yDbQJwBfH#sUzFA|aO6Z-ag0WK{Ox@^z%LXt_ADm%-M; zgn1vaTrPOvivTDSz6i3+Pda(qAo@dg2+I!JnAcA<$7f{rsHW1Zn@Y(n&5RInI4c%K zLIllP#O&Jbo3kmXptwwBy{LpMpZT|??%}FE1VEW+59@a&of=iC$GZobn}8KhX;R-L z9mJlD>@4s%3yTmjBT!U|B<6q2t6cMnO3|Xz^n=p`f^|JTMzDYaNCiXyl!<^~vSD>% zq%Y$#`-H3#wB=C``6Z2!Xpn7Uq&M#=Nb059a@U`9QvygDsn{=6Ym!4p1k z+M$vOBxn=?P$n9MS2gqY!M2yZ>`WO=kI6@pQC0!HuL4p^wi=%alr(!8&fK8rG<_Y0 zm&*^XJ*9 z{JFqGTtTxo#2Xj4GAx%T1s;8zg|5WrGnPH2x$`ozRhy9z2sDNOC=-oAs~+Q%BmEdZ zcL*nS#!rX?6h1RN>PgI>%HPQpT~=e`VrD@J>c5+LsR;4)@O?M;Is7F94tx**Wx@wN z0rIvBwz*u}%i=N8mE@^|JR7MbBW@QDu-JDsJwSsSB>nam!Kh=A^k8NUL{>yfuO zl-}W_&T4B|1%omXL3@Wy3Lw@A?M6T%=5Khc37T$ zKD}$$BkYV;9hMrUY2;^x!qprcCf=bVQ;QhoF*ZV(*C+b7W+Vgxtswx)L~Bqp7c{Vr z!;yADHbUDXtWW?niowdlArr|_6J3xjTU5I1}GEum}wK5d%FcM|vGmoJV ze(4KBQKt}Vby>5f!!8!el@?j^qE7hiaDv(v$?ygaKMt+$ct9P#K%;#G;4?@2n5$i4 zQdY6O&o@uib`Sq}dO-PZV08*O6Pbg$?qJ@TtPU@VW>PaJ^nEw=on8~q@=Ok)Dc+6! ztp2?`p>lib8Lr|(0F;UN+C)yG2Z{N?b$@skDHloeaP(7O)G_3}D@GbpREix9*)I%7 zh3XkKDp?UnORwfuL3l<=C5>W2)$gOwvvl=bjs!WI-NUm%brgBPv$zm|&m3{JM+IqW zdRjg`J<6|Xg#;B5J$Al8Gyh6bkt!c;jOSOgzpjd=Fq~K}pG*E}W=m&Ou%s$0MPf5Q zTx~_-W@GXU6p1|MVtoS3M64~NAQ#^7)}i;Vm!}k>RX$dAHA8o%sy`)64gqudIs%n2 z`yMJU)5*#hC45x{5rw2~NX{-sm6k`TOOA*lNtjb5KOq^$b_> zBLK=o{B0yB;eSy%A9UOncSSCe;o)z5HcnfaBP|%n%aiM`jYbcW3*|_=RkcBX4E2+X zQ|BS{yC_7CKvg${xSEGOnjQ#;XQ>OANa#SBh@>Idh;b)AziPuDpFL)ir;)D(x-j0K zO&0VTPd7LI@maZZrYCq6Et>&WQcz?{A*!_|hE3L*7c(meVK;9IvBE!g{3#Y)c$UYC@w67sOTPWkeIBb! zKr9*rK$(c9DYyw@`qh&xoRgKG`mUkmo5hz~feg7W;Bz|gw-^Ie#pFLf^=aR&s@=a8 zQy@kv2!Jw?N=wnmX*)msReo`qD-DU#Bz(*us_kW|G>vU!K3>=Fi+3Pq7pgfY^uB=X zxG#hJyzI>~-bcZm6cGSrBE?oyBJ&3up8a?8MSdG4NwiU(wk9YVfBG1co?-*mw?h_@pCAKPyXPiW^j$xM*YNQEAxz zc(m^x`O0D+S_fJm#|~G(RT_KfM4JPYiD;XKn_#c9i*3D@Jx##5S&gGmr7h{?ie|Q= zHx{NJOF|p2a{nqhHq5temr&cYRGDzq4+KD&=tnzNs0Ci&aW^WhsCI<}H6u2B9zC|_;?hOk8P$q`e z-b!n`_EOr|8Gj{jR+>m3nT?gm3{WEUAQ?(3C=)|zX*KG(;%v&~IVV%rszI8)XOQ>c z{<6v;^fCLc$Wg@{w1Cap% zQ6kVc=YTahBM@cNfKY${AOHve0)T*FA^@K{hS}~=Yd`=H00aO5KtPlTfMFuaW&xo9 z0YCr{00aO5!$bfK6T@tGs5Kw}2mk_r03aYr1i&y6WwU@#fB+x>2mk_rfMFs4hKXUe zJJcEw00aO5KmZUBB?4fWh_YEgC_n%Z00aO5K)^5&0K>#E+Z}2R2mk_r03ZMeh!O!X zOhnl%AQT_~2mk_r03cwP2!LT?nC%X=1_S^BKmZT`1Vo7d7$%}@77z*$00aO5KmZUh zOa#C%G0b*{S_1-r03ZMe00N>!01OjRHVX&^2mk_r03ZMe7$yQ>m>6ceL#+V;KmZT` z1ONe1A^?VoD4PX@0t5g7KmZT`1Pl`aQ^Tw_)EW=~1SkYja*AzlyvT2OJua{DwYdBy z|3&AvD=H~-q|!Bb&2H#xd9!1%^{E#A))$-jSzULuGRfCqdB7SF00bm}fKgdlnFPcH z5di@}fDZ!C(h5C~J<0BV5BXYLAg>h!bDmJHkRI@$WHN@t)i;Zb6 zABK<@5C8aa%BfP zn?=uP>HPh;CQdswSPrlT1ONdoAOMDm7C?p~00E&9_~ll{fSJc%eV?9J;wv<7J>ZvJ z&)f3On(ppXn)_Ra=|O#<3V?t?ApnMnK{Yp2R>}yRh{$d=`e5R=gskFVDc3{WvU}Q@ zK3(6_V`8rwb|8~&KFw)1?vKRHG3iA$wN|Je7vyAR z@?u$M*V$tlJN>H1)r6`60+L1m3=>H=9|*6H2yD5Q{^`6^DT`BcODc(_ex}&tQGl~K z@~|~Q-gc(tf7TYp2rooM4wlBq7GGsUX=xcs&M8INg{3GL|HWq&qnEFXP<&h?+-EuY`B^+A?#&-eJq?-M?{>gjL{dZozb|)PRPbw ze!4|eK(P=8JBLHNZofv$&!(c-jA9l!d68yUb~K9}|AFJi5e*!6xZ1$f4=*$!Gax{N z02n4T;6M@}zy^UA8AYzx2`$o1sanlGT+4zLsHC-7KEbW`aaOz`zgy>%_ns+)%2E_oq51 zWfyzmv3}1NuZw--UKjb|MG2L$QxN~?w4y)~kFgMy#lh4zZZ;-pQAbxaynzEUCguqQ zRtP*xFG7n>ze0QOW+4fjUz+XbVD=)&#q25BGE~{o^tr#2*|W+{X0aZ&rios5ris?( z##&nr%nE2A1_XE_0EP)q03kbn1c;CIQP{01<|HXYfq%{EIS|`pNF94Lzr8EMFC=;hGDqt`>*HreSL((x8;}D6f+JumI7eUz2yjEd;EfVuhzzJ@ zhrVd#jB0vXazl|tF0#etpNMR<8*g(t_9UB=;lWfKKH?bNe34)NxAn&B3gqs16bK&| zTs{g^OAB?D6@Xy8cZkossQAnxv>7i@`3dh&PR)hEhE(Y^{y;oBG#wjf z!|OXDb5re2S$W%=;i)pW@;^$J`*>7^tW(*4Hxs35&yfmMJX`?*gG4~{+Rz|jg-Qbg z@(2VtnW9hXIh6ltYg#5DvlxAIHU+;}Gel#E$fKhCDH^W@`TWnM@;^cmB+h$Jyxc!z^_AX)Y=#mcWXYchbWRARvAOz%UVi z8-aupLcq_#6m_d=i~7{GLoNKRw7N(&uc#D{Jfxvj7t%zt3q^>gi%Kg(qYfmN{}F!G z+|03|;)?oXjJ0j3kn+jC?4j7mB!9Aj>;l4`^w1e>telC;L09k^ogxnFa%6eJJs@C+ z2!LT?h^-EF=8OPY2U5$!0x#mULT!RjMk z6Ds3lybyQjzIgoih9enKnc2#v+)&Ww)Q@6)$WEz-zE|0$`XJcKbu^-y%Q^jv#!5F4;j+(*y4!@wP;@JuS+2 z!x)i75d>n0{D#+ue1i=UGKv7<4FUv<35OHQ|459hwK1C5)ESM(>vvqVuy#k?b}+%y zP<3#>B7Y+q(&r+hFJvn2DLyQSY;%5|QG{N+E9}sv5-WZ9+$WRbp=_8q% z*@oALtie+=hBP9g6bu%TDR@WCqBAMweKOLCt)75{i84Q;)ifxm`fL8Vab zNv28;Jjg2lqj-ATnV`{)9nt7UPUVIy6%SWH01(hU0$`Zvz70SEo(M?MC@H~C%#LE; zA><49LQF1C1Ry(G1md$w(AQ^D%m1jnWUb1`MvmocRmi9t1V8`~&(dSHP^y3k z6yQ%{3o>3W;&A18Zn@*G{r5BR_EHfGYQUnAwJLK?yej{rU~t6KfBmr2yFqxXa*N7% zmz9>cD^qg76%a5a1i&ycq}JBcx@HxK$1q9CD#ku8vd|yc$Hjk9xd^XUg&<)BGV)8Y zLHWA;PqrFlDu`?g?}^v0v8mL zQBV#bpfLo%Fwq#az*ve1q~(^NOL*Gl^7A}&=~*rc!+s_TbvgC2uxx=8aWr_Dqwqdo z@<)bSlm#7;BZ)G!esE@AH^5D#kwN&!foTLn4deeMtd0YgPV+{*?HwN;?rT0pCD!^DtVAL%W|1F5GHXxCqA^?Vop|-q;>TPdfoXJO= zLLQqK$g#r^00A)}z^6}U7Qp%xF|{Sg!VLlNW5NwL$R!{G_?&lMpLy|_#hj0cb+dsH z6Cs*1)YS|v?d*oy2iqWPv-idxIkB)vKt$=2i0hTj zwQkXAg1n~WXoJnCEu&=h#WXbL5V2bgBZRu~ z>x(gI{C*3Dfil!m>0$nmPibV^2G`I^3yUSV$|k0K+A>P|?|y-{-+V2ms%u3S?9>O<^5kxqTz`?T6*-|0 zKtR(7fMKF(gn_?W2sHAwysj3Z3Zje8b5*1;NBiJau+`nnnF$S;LR&^j`>nC)$m1M? zM7m8NztzN7o^vVD3OrdO(8$;7CeFlpd(PP??uH2w zwrf>e)-oGP25lH6#2Z_KA7ao&o-bD^w@H@}8(!j{i{bYh7}3D~XI=t8W#kqd{o1ZUj_6uw>FHD{Nhp+`h7HdkZjl=?7gaU z?}L}|h+$44cMogMRwl6n>o^?I({2pak{AMDm`JR_^jX{v!Pckv)bH36&I2w88%4<9 ziJylnKC+83uQrU54D7nse?=6Ed(GWbo*1!XD^u$LE97R&-I2-PJo-M7bxdQ2t!!lm zdO$!^2!LUtDP(~!YXtC6_CKsM$z<4fFH7c${q3;&4(v1OX^wxj;6d$WW)bpV8HLjG zc%7G|7cDTXfg`Va9D2yzD8~h7k7?xi6E6WEGaw)!0$`X32qv)Nhd|TH)^|MZOgTF> zIr=yo4`*|K$&G5n@8!U+_TtHXd3+_*T*Et+!e14j;BTW*9vtw3-47e1!FB98cL1^@ zEsBSCwGP2Hr~RGH4ab!oXQUycwh#crL|aHhIcgy=pqAZ!wFp%Z{d9w~7uoV-iu={% zKF_a0BuPaRqojeaX8pQc!!Od>Yo8&!-W38yV8REEyiPm(^$x$S)x#Uu{{jsG2#5&* zqp~v44q|E$Lzm^&i@fShHazF-(@{SdR#vGE1dhVJsCCWTT}lXt`Vc;1~y9gxIyRIMw-Yc6@!GT z`@Ht9$llU~dSre5`DO-6%;tV_-=I47dwm_vQdk!Z82|wdBLIeph5-il+z^=7!f7?P zoNsc?{U@1EcC@;?CnEFz`Wp1fD3O{$Li&`Cy$PD##+7sTB5MN|p5|p!WY22tyn?d; zkP#5jAOc{RXb@ar%^iW6EnU8|G&SO^c^|(jLfd%m&{=@LX!SAZi%}v)gM{i&oBQxv zZ~DXKbdH$|kKobanVWJ6CHOq5h*#gZLAR6w(PyOsRF5mDG zXvXnml*_|c{a0;WQHYCvxr8M{LHDKvNO}%O%2o;K&mY&dN1dv0pD!d1d*+;Y#pkDy z{dGszd3+c^UO+&T2!M5>NpyiXF9hbab6w?RW%7b6lYH#KYs!%%uG!1;?HTODE5DdB zmm4LM15k)Wk5iVqK|=b1gQXGL)Z3F+x0rq`3E?w_IEUd49Cp<3u!!c&05Sps8b$yN z6Ac3l?D-+Eva8z{d^qg7or(V8u^P6PmnB-*LHhGLQZ`CT@uG^szlnSAueyD7&tP9< zLH6Wu4CnDN!oP%Na?FjeH#d~|O=q{+oEbnyKtKx!aQ}s9K{zM^5E#+Wac@Ik%d>ot z7`i{6_mobn0O>k7k*ZNb43g0Y;*r(72z2NX_pMfZ`i_u!XS8ra*atjkmIRLxzsGaV zPcq`gQ;YD4fzk()7YdMB>zkBZa0LX!iU1fUVr?0as{#UnE2AF9W)xMgkia71EFL}h0Drx54SVmsMxX9W z;F?`;@(Jn3USACos&Cd~^qqS#Yx1IQ)5k6u_GOtiRQ1o#PiLwS=-QAtHQ8EfI{^etoV7amn z5B2G-Og@MM1jLE}7$#zE8IVgU0`uFut!x=!{g2W_H6tTZicmj%^emsSx`!tkTF;&j z3rXcQH$~|2G=4r%48A0 z0hr2>N=t#9?-0n!FEOpWBIiH7axx0b1EsO^EH!+iV8$_Dp4C`A1`nCA42EWq5O^kGqvU&@ zM#;J89MpL`XNSk-t>kHE`t-%@;3_Pe49EciQ6K<@i71)@gy4d}FSjxVj5?UOk4s+J zJZpQnqj61~WTRN$Pdk=~)?dkBolndeoUDvd_>4f-TY?SIAR+DeMJs2tw6i;}CcT%C zkFdebi-)lh%Eav!8sKc6$cqtV1_X43fXTvz3w2a96blIOL!hp=<->yF(vnNh^V;#@ z^iM<%o~AHG^}M-n>Fg3>OWb{*RR~qf-4{$O?_ooITGZSVX z{AAzt)MLqL(>48?$5Iz{vWNP@xXOt5oaYm;lOEJ!Q!L_Xn4sBhoaZd=A}sS) zb2CS`u&YuNyi$QK7`j11upx_Zhymwr%YJ3BEVieg=AiC7_^oy&{J_1dEUIuXbp*gL zk$MY){Bj7?UK4ZeQF1|JxkwHVlbSlBZ+UL9C@n2RZMHr~S7Y-zNTA&;^}Q|7r3sb) z-`<(WM^R*P{N=vMeUW594#fjhgdoTnLF5JjIYfaF1qDCg0wmhty6e@eZ_VeEU#hF#BYQp# zVB~-x`4ddL2v<7%5@U520cQkbb@AtCb7{i%wCa0vFW5K86>&pCCz@Ly^*}&v1RzY* zHX`sxHUUxMq;Crk+Bzy+wmpJAp%E=JT>Apr;z6%Gnq5<@`Lf>=*yJGwBLg+KK+FZ`+0n{r(hJrSEg z=Tl3iqB=eIzR!cUKY#m-5CqB1!}3^|3mq9RUz}>oDycQg%9og1adQJ^+)Zll`z{Mz z{Dv7-Q3V84PXNM1^+N;)eU33Z6QN^IGY>|<{Cfa$ZM0v5|Q z1Op(TQUVYrDjgWOC62({eHnkBe<IQ5GGbINN`a;flU|k`aicRbv?5rd&;8;`=fQ5tvm5>mY<=U|IwPcCqsS*YiWTC zs}KGXRuCkHp{-!EBryVJNpx&_q{}CXbS6put}M1$O8f12O{d2-?&l4AjZzS(KLj95 z>d#oBCwC$6Q(9>g7VG46nXXD+QhL@7-&DI}bU5{B?s1n^@BTQiM0aED$uF7ZcYj&N z8&jU}rG>qM2!g~g#5UosbTCFku1@j=C;xQA7dw~h47X)Usjr(u(#6S*TZT4pvdu_# zroh6x^@0F|Nxc|GbfUHd3QH^PTQC3P+;7?Ct!i86PVe=*--9-f3?sWc#Q(Tcef?)U zE)~$T>yw47L(sR&uV3rvOYigywCPB#w=$9LT^#Lb-#86Du93gvhTEJHpC&9CZrgCz zZ%(|@xSQlF&LCh51RzXoVU*Fw+X%#LOI`l?*}O@&Jusud)yaNh)f zOA4_CyZS}AR)_#wNJ{_c79hlWQeOFubwk;LqW#Y3;y0V6ES@jKIT!%}DcTz+T+XnqRJ}sr)xyYA&E45n z=?K~JX{4s!*qu&GkLF0Xvd%1^Y(D#>^km0-+|S4|gvuabr34^MtaRYuwip80MHTKW z-~8EYdF3rcSafnA+B+_S+H2fJn4=%Bmr%D)6DhAmWs%v0^v?1|TCjk52VT@rpohF1 zHyxNVz+y^s`eW^N!W%f!Ube8cnZL7;u2izj z%ELD#(~e8>Be?$Mkd}Q`nuqu#LWT!MR6$^F)f_o~K%K~;hr0EO0LuW_r2UGkCko3d zgG6;~UXK8p(M4XmVtrpWT*#wwTT+QdlEqOA0)g)KOeJdQAwi3Pc$1qh=F^zXsU&I$ z_|}`#6C1T{?B{&F7G1(CAW-iKK$z6~Aw~yHB_J|nEN`1{{oqq5k4K2v`oV2Npl}Mt z4?a!81xfP&G1DZxr7Kxw)OBSdWfqB>yPDYE_q}EPf@c`-37&v}?Gb=5vAr=zk845T z$F!1W9b*%}Wl2ut$9ny%J&lj!ja0r3*&j_&$F9p-8u>*s6_tzn|6P=4bz_HTUfel0 zg2H7cH`4dMh$Xt|8F!6N3y78`+2yk&CtqpQuBpFsid2R(2!Oz!1RzZCO8|j85O{r8 z`n>m#X8(=7B4qmxZ>n8{EB$v&1bMm0kLD%0et|{x>c9FLrE10fH!si$B@S_tsuP~#+KJRb` zyES#EZKJ}-UC=&bsnb8CmfYBH{6~)E(-})Xh&c1q$R7>}5w;Io@`;PMsXNnY#YwR< zB+NcO+enac1_2WYK$w^S3$KEJL_k}rbL<(HwCB5P#Zgk3sPm(tE)+i|oB{+z0+alz zWGQbK9Ll7BvRM>s*>3z$ursZFHjEw&agn+q>|D+uM6(EKW{gCswFv!M?0z7JZPMCVdU4Lz1s#@CVTkB;aOL1GQXMAeY3k=hu>(V>t3qOg(>nBfA&uCOLb(dW_z(AXyv))R_h4~TlEjS+EP;S+ z5`ZwV&2dMs6(Vrpinc?))yeT?x+*^b zn@#fA{alQ+RA5F(YKecYnZ|b5to$xdDiV4Q^l(UE36grW3~{|8)G&;JfDIFXFtOpm zN7t1j5Pzwl`>+iuo0JkL4P5LfZfGd=ZQ-R@C(b4n(}b_C(}h$qpFH^X-jNSCpm(1R zqF^s^LFNnrIDM^{hOvY;DFw>Jb%7u;L>*-yAcg>hi5QNs0s;mJ>||SvM{G>pSX3@9 z|IV!qb-Bll);!x#(LeUddF3?Y>vY=ugK5FW+@0)bCW|vNrK7*l?a;R};P-hYI-0Qk zI&J?+{9;zAJ&ljk|Mo;j^u#9{i3rXhAf5n(iFl^42m-eeIB~V;k-n>wb}F$3MQV(P zX`9yBkLGj_AVdwnZMQn@>t;_&`UKI) zN4#%+WHtAEB`Zr@MDMUEk`jfp7CP8d{*vB7Qzv!sTV*wX;3x>xBLWa6^=L5B73(B0 zZ-2(?EPniKHXER*K;d-w%Gr5O1=9FPAF}65QdNAU8|T#bW4dqucnzeez7mWK(>_yC47p$`ODtQI0JvgMe8C zipnbOU)_^r6LoWxK*2SNq+jx_!qx~J;y!la9k&YG}&Z3p4a;aG1 zMXNWrTz#kQ(!~A9>LH<{!+o4Gt4nbK0wADT0uUyu9U3?W0)`3X73-W|+nK&}jfFq; z=zAjxmC>!e$-}uus1%k}(z0XOwETDuIdr&t$Wr;eD{xc2FLJ$5hd6EwX=pi6>zCQu6mK)_lE zK$uv|NWo7K5JZ5*4!L*Qu8c*N2#0U3%RH6utSJ8lEcn?5b8Vm=2!Mcf5`ZwV&T)g+ zARvrD+?m{wEVjr@OUFvl?*I>Y#?m7%ifQAs%EQIJ?zZ#jJB4cy0D(Fo0AW%m*wH8m zsFOf`iOxCpWX^=8$8uiFEYvkt$V+W=f9ESxJNYh&iS%8kP#Z7{0w7?e1RzYTbl~7N z2v~wZVQHoPsx!GU%Z}wtW-}@p)}}eTeY8(D^Ef!YlkcML%{`A=!f&*pP6BhQ=BU## zc%?o9P$%je6LCE`geW(zeS0JqH00009sH0T56L0SFV73n0T2KI5C8!X00Gqy zfG|c0T8e-fx!V=Gc4RBngaprA^>$_UE>9BK>!3m00cmwUK4;Ysn^4c o&Vc|3fB*=9fOQeDBdV%$IpxxCZODr=x$C`p^zZ&<)R?#a53HPCg#Z8m literal 0 HcmV?d00001 diff --git a/documentation/website/export_mod/defender_endpoint_export.json b/documentation/website/export_mod/defender_endpoint_export.json new file mode 100644 index 0000000..ee45766 --- /dev/null +++ b/documentation/website/export_mod/defender_endpoint_export.json @@ -0,0 +1,11 @@ +{ + "description": "Defender for Endpoint KQL hunting query export module", + "requirements": [], + "features": "This module export an event as Defender for Endpoint KQL queries that can then be used in your own python3 or Powershell tool. If you are using Microsoft Sentinel, you can directly connect your MISP instance to Sentinel and then create queries using the `ThreatIntelligenceIndicator` table to match events against imported IOC.", + "references": [ + "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference" + ], + "input": "MISP Event attributes", + "output": "Defender for Endpoint KQL queries", + "logo": "defender_endpoint.png" +} \ No newline at end of file From 2544218899b347fa055f19b47071bceca937f717 Mon Sep 17 00:00:00 2001 From: milkmix Date: Mon, 23 Nov 2020 16:28:23 +0100 Subject: [PATCH 6/6] fixed error reported by LGTM analysis --- misp_modules/modules/export_mod/defender_endpoint_export.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/misp_modules/modules/export_mod/defender_endpoint_export.py b/misp_modules/modules/export_mod/defender_endpoint_export.py index a70bbb0..eea929c 100755 --- a/misp_modules/modules/export_mod/defender_endpoint_export.py +++ b/misp_modules/modules/export_mod/defender_endpoint_export.py @@ -61,7 +61,6 @@ handlers = { def handler(q=False): if q is False: return False - r = {'results': []} request = json.loads(q) config = request.get("config", {"Period": ""}) output = '' @@ -73,7 +72,6 @@ def handler(q=False): r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')} return r - def introspection(): modulesetup = {} try: