diff --git a/x.6-isac-intro/bob-ross.jpg b/x.6-isac-intro/bob-ross.jpg new file mode 100644 index 0000000..e559933 Binary files /dev/null and b/x.6-isac-intro/bob-ross.jpg differ diff --git a/x.6-isac-intro/campaign.png b/x.6-isac-intro/campaign.png new file mode 100644 index 0000000..df5b653 Binary files /dev/null and b/x.6-isac-intro/campaign.png differ diff --git a/x.6-isac-intro/content.tex b/x.6-isac-intro/content.tex new file mode 100644 index 0000000..6482307 --- /dev/null +++ b/x.6-isac-intro/content.tex @@ -0,0 +1,211 @@ +% DO NOT COMPILE THIS FILE DIRECTLY! +% This is included by the other .tex files. + +\begin{frame}[t,plain] +\titlepage +\end{frame} + +\begin{frame} + \frametitle{Plan for this session} + \begin{itemize} + \item Quick introduction of what MISP is + \item How can ISACs use MISP? + \item Working with unique use-cases + \end{itemize} +\end{frame} + +\begin{frame} + \frametitle{MISP and starting from a practical use-case} + \begin{itemize} + \item During a malware analysis workgroup in 2012, we discovered that we worked on the analysis of the same malware. + \item We wanted to share information in an easy and automated way {\bf to avoid duplication of work}. + \item Christophe Vandeplas (then working at the CERT for the Belgian MoD) showed us his work on a platform that later became MISP. + \item A first version of the MISP Platform was used by the MALWG and {\bf the increasing feedback of users} helped us to build an improved platform. + \item MISP is now {\bf a community-driven effort}. + \end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Development based on practical user feedback} +\begin{itemize} +\item There are many different types of users of an information sharing platform like MISP: + \begin{itemize} + \item {\bf Malware reversers} willing to share indicators of analysis with respective colleagues. + \item {\bf Security analysts} searching, validating and using indicators in operational security. + \item {\bf Intelligence analysts} gathering information about specific adversary groups. + \item {\bf Law-enforcement} relying on indicators to support or bootstrap their DFIR cases. + \item {\bf Risk analysis teams} willing to know about the new threats, likelyhood and occurences. + \item {\bf Fraud analysts} willing to share financial indicators to detect financial frauds. + \end{itemize} +\end{itemize} +\end{frame} + +\begin{frame} + \frametitle{So, what is MISP nowadays?} + \begin{itemize} + \item MISP\footnote{\url{https://github.com/MISP/MISP}} is a threat information sharing platform that is free \& open source. + \item MISP has {\bf a host of functionalities} that assist users in creating, collaborating \& sharing threat information. + \item Long list of connectors to support most of the tooling used by security teams (IDS, Siems, host sensors, analysis tools, etc). + \item A rich set of MISP modules\footnote{\url{https://www.github.com/MISP/misp-modules}} to connect to a wide range of services, easily extended by the users. + \item Tools to manage sharing communities and interconnected MISP servers + \end{itemize} +\end{frame} + +\begin{frame} +\frametitle{MISP distributed sharing functionality} +\begin{itemize} +\item MISPs' core functionality is sharing where everyone can be a {\bf consumer and/or a contributor/producer}." +\item Quick benefit without the obligation to contribute. +\item {\bf Low barrier of entry} to get acquainted with the system. +\end{itemize} +\includegraphics[scale=0.9]{misp-distributed.pdf} +\end{frame} + +\begin{frame} +\frametitle{Information quality management} + \begin{itemize} + \item Correlating data + \item Feedback loop from detections via {\bf Sightings} + \item {\bf False positive management} via the warninglist system + \item {\bf Enrichment system} via MISP-modules + \item {\bf Integrations} with a plethora of tools and formats + \item Flexible {\bf API} and support {\bf libraries} such as PyMISP to ease integration + \item {\bf Timelines} and giving information a temporal context + \item Full chain for {\bf indicator life-cycle management} + \end{itemize} +\end{frame} + +\begin{frame} + \frametitle{Correlation features: a tool for analysts} + \includegraphics[scale=0.18]{campaign.png} + \begin{itemize} + \item To {\bf corroborate a finding} (e.g. is this the same campaign?), {\bf reinforce an analysis} (e.g. do other analysts have the same hypothesis?), {\bf confirm a specific aspect} (e.g. are the sinkhole IP addresses used for one campaign?) or just find if this {\bf threat is new or unknown in your community}. + \end{itemize} +\end{frame} + + +\begin{frame} +\frametitle{What sort of sharing scenarios make sense for ISACs?} + \begin{itemize} + \item Exchange of {\bf insights from monitoring} + \item Sharing the outcomes of {\bf incidents} (often technical only) + \item Information on the {\bf attackers, techniques used} + \item {\bf Remediation} information / {\bf prevention} information + \item {\bf Vulnerability} pre-disclosure + \item Supporting {\bf tools / scripts} + \end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Other types of exchanges we've seen (often by sectorial ISACs)} + \begin{itemize} + \item {\bf Financial fraud} information sharing + \item Law enforcement / Border control specific sharing + \item {\bf Disinformation} sharing + \item {\bf Health} related information sharing + \end{itemize} +\end{frame} + +\begin{frame} + \frametitle{An example of an alternate use-case: COVID-19 MISP} + \begin{itemize} + \item COVID-19 MISP is a MISP instance retrofitted for COVID-19 info sharing + \item We are focusing on three areas of sharing: + \begin{itemize} + \item {\bf Medical} information + \item {\bf Cyber threats} related to / abusing COVID-19 + \item {\bf Disinformation} campaigns abusing COVID-19 + \end{itemize} + \item Low barrier of entry, aiming for wide spread + \item Already a {\bf massive community} + \end{itemize} +\end{frame} + +\begin{frame} + \frametitle{COVID-19 MISP dashboard (medical data part)} + \includegraphics[width=1.00\linewidth]{dashboard.png} + We are rapidly building new models for the different COVID-19 related information sources +\end{frame} + +\begin{frame} +\frametitle{Getting started with communities for ISACs} +\begin{itemize} + \item Different models for constituents + \begin{itemize} + \item {\bf Connecting to} a MISP central instance hosted by the ISAC + \item {\bf Hosting} their own instance and connecting to CSIRT's MISP + \item The ISAC member becoming a "{\bf hub}" for a connected (sub-) community + \end{itemize} + \item Additional services potentially offered + \begin{itemize} + \item Access to {\bf shared services / subscriptions} + \item Offering {\bf services} directly through MISP (assisting in incident resolution, etc) + \item {\bf Collaboration} between members + \end{itemize} +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{The arsenal to make it all happen} +\begin{itemize} + \item ISAC specific {\bf common vocabularies} + \item Common tooling / integration options + \begin{itemize} + \item Already existing, self-built or simply reach out to us for support + \end{itemize} + \item Community management tooling + \item {\bf Massive adoption} of MISP means a lot of your members probably already know the tool +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{What do members of a community get out of all of this?} + \begin{itemize} + \item {\bf Herd immunity} through automatable, actionable protection/detection + \item A {\bf collaboration} platform + \item Derived metrics and situational awareness to identify gaps / focus areas + \item Making {\bf canonisation} and {\bf conversion} of their data sources straight forward for their tooling + \item {\bf Near real-time exchange} of automated information + \end{itemize} +\end{frame} + +\begin{frame} +\frametitle{So what's the next step once your sharing community is thriving?} +\begin{itemize} + \item Getting your community to be active takes {\bf time and effort}, but with persistence your chances are great. + \item However, most of these communities end up being in a {\bf sectorial/geographic silo} + \item The next step is to become part of a network of ISACs, {\bf join broader sharing communities} +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Advantages of cross sectorial sharing} +\begin{itemize} + \item {\bf Reuse of TTPs} across sectors + \item Being hit by something that {\bf another sector has faced before} + \item {\bf Hybrid threats} - how seemingly unrelated things may be interesting to correlate + \item Prepare other communities for the capability and {\bf culture of sharing} for when the need arises for them to reach out to CSIRT + \item Generally our field is ahead of several other sectors when it comes to information sharing, might as well {\bf spread the love} +\end{itemize} +\end{frame} + + +\begin{frame} + \frametitle{Conclusion} + \begin{itemize} + \item MISP is just a tool. What matters is your sharing practices. The tool should be as transparent as possible to support you. + \item Enable users to customize MISP to meet their community's use-cases. + \item MISP project combines open source software, open standards, best practices and communities to make information sharing a reality. + \end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Get in touch if you need some help to get started} +\begin{itemize} +\item Getting started with building a new community can be daunting. Feel free to get in touch with us if you have any questions! +\item Contact: info@circl.lu +\item \url{https://www.circl.lu/} +\item \url{https://github.com/MISP} \url{https://gitter.im/MISP/MISP} \url{https://twitter.com/MISPProject} +\end{itemize} +\end{frame} + diff --git a/x.6-isac-intro/dashboard.png b/x.6-isac-intro/dashboard.png new file mode 100644 index 0000000..b575e8f Binary files /dev/null and b/x.6-isac-intro/dashboard.png differ diff --git a/x.6-isac-intro/dictator.jpg b/x.6-isac-intro/dictator.jpg new file mode 100644 index 0000000..8b66bc9 Binary files /dev/null and b/x.6-isac-intro/dictator.jpg differ diff --git a/x.6-isac-intro/images/logo-circl.pdf b/x.6-isac-intro/images/logo-circl.pdf new file mode 120000 index 0000000..2cbaa1a --- /dev/null +++ b/x.6-isac-intro/images/logo-circl.pdf @@ -0,0 +1 @@ +../../logos/logo-circl.pdf \ No newline at end of file diff --git a/x.6-isac-intro/images/misp.png b/x.6-isac-intro/images/misp.png new file mode 100644 index 0000000..0473f07 Binary files /dev/null and b/x.6-isac-intro/images/misp.png differ diff --git a/x.6-isac-intro/images/x-isac-logo.png b/x.6-isac-intro/images/x-isac-logo.png new file mode 100644 index 0000000..21c68bc Binary files /dev/null and b/x.6-isac-intro/images/x-isac-logo.png differ diff --git a/x.6-isac-intro/logo-circl.pdf b/x.6-isac-intro/logo-circl.pdf new file mode 100644 index 0000000..62c9239 Binary files /dev/null and b/x.6-isac-intro/logo-circl.pdf differ diff --git a/x.6-isac-intro/machinetag.pdf b/x.6-isac-intro/machinetag.pdf new file mode 100644 index 0000000..c4bcece Binary files /dev/null and b/x.6-isac-intro/machinetag.pdf differ diff --git a/x.6-isac-intro/misp-distributed.pdf b/x.6-isac-intro/misp-distributed.pdf new file mode 100644 index 0000000..9bacba7 Binary files /dev/null and b/x.6-isac-intro/misp-distributed.pdf differ diff --git a/x.6-isac-intro/misp-expansion.pdf b/x.6-isac-intro/misp-expansion.pdf new file mode 100644 index 0000000..70c90f2 Binary files /dev/null and b/x.6-isac-intro/misp-expansion.pdf differ diff --git a/x.6-isac-intro/misp-overview.pdf b/x.6-isac-intro/misp-overview.pdf new file mode 100644 index 0000000..cb212e3 --- /dev/null +++ b/x.6-isac-intro/misp-overview.pdf @@ -0,0 +1,734 @@ +%PDF-1.4 +%âãÏÓ +1 0 obj + << + /Title () + /Author () + /Subject () + /Keywords () + /Creator (yExport 1.5) + /Producer (org.freehep.graphicsio.pdf.YPDFGraphics2D 1.5) + /CreationDate (D:20161110075922+01'00') + /ModDate (D:20161110075922+01'00') + /Trapped /False + >> +endobj +2 0 obj + << + /Type /Catalog + /Pages 3 0 R + /ViewerPreferences 4 0 R + /OpenAction [5 0 R /Fit] + >> +endobj +4 0 obj + << + /FitWindow true + /CenterWindow false + >> +endobj +5 0 obj + << + /Parent 3 0 R + /Type /Page + /Contents 6 0 R + >> +endobj +6 0 obj + << + /Length 7 0 R + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +GauHqbDmm\DWSOF,(H9VlMVPl#".Z]hs*Xb@rSuda4Fd/'a!g9F_I!N=OfokQ0"uf4q;WQHr:B1907WTdYCHOMrqPMN?[l?iLAgoh(_*\\HSTQ$/hFs"=`Bcb7eT)u;M71\C]`T!_AYq.CS;r,j,qIf)#a6,1A\ +K)T;!m-OJ-T1p76n`>Rm4!nL!]HR385C`U's05#lDuKI;Vc*C"T#d7$B\3:Q'q743Nq)YGkKhg/p0o*9 +oBiYEM>^T3QG7\ZDVi/+h=!SVa8buPh%OXR^5r%:Ys7gu3jc<3ZPh)dO8jVtgA5OYq]A&o?D$W_Ef\PS +ANB?G`5m].$Adr&p6jAkU8IoM)A)kRlutjFKWfekn?mcFcq3SMH7>Jol-S#ZSD+S[>b;a=,<55bo?q": +o0^iC^gPZq0j`$,Xn4X.9Os2FTKe+We%o=p/49T3..CWfDp%D +mBa%kZ[c%G\%8qjq(#iU!A'jkiTH6"+S^S4,j-&EO<`LP)o>[uH?hk77grVd1HG\Dh-UVSI8_A\90]q%"qf<:\n4Zlu<<:B]+DH%SHeZkil2W3B(I-g+ +As]F0/e-)IK..,"Epo]hs84##q1JGDifHkGKklnA\t&9$J\`TR?'Y.;T?Q^'$c%l5[(46NrjhR)49.99 +`ceL7()_#@V'KCeTd/Ipd]G3ajPCa2d]G4LFG?stfu,Y\H1oRA>@F-%rS/@TD:k!XO"=k5pkt"UNK6nb +Q"7YfU7Q?Q+q'H"7)F[?'"cdUlAWK&bQU(V*Yrt^d-9*,(7=-4)n_J)\BH9t76(tWn/qqF6!*B&'0Dnk +!#F5gr4+#O&-PdMj3>qt'2J@W_/'IDJ\a1!5$]b!S_u.pVRFj#.($k?B2E7n*.&I\lJ'ue3NB/hi#Olk +V]5>9^e&m-hCiI8G&A7XmF!l?rRYO.P`pTlLHR;+b7!Xl8+U[jMVItMo$A2QPT!c)+N%2B@%^<9&;R.U +j$'S[`HmTPbtq"Q1'hB2q.iX^np+9b%qol.cLH"#EQm:OXO2HCQRUgs&\Lb&"QsAmF6;[L;F]Pm.9Ecq +N38<2=GgTZ%1)#>=+:I.n'>Kh;8^$hZM\tldY=_jOZm;JUBt,C-4>VlkUl!$R3Y-4S"6R+[N)u0i5.!`%b_UN?C=DmQ<:1BMSdG +B^%/'To[?Af)l8?GA+0(=]>oRJD<5=5?CKR8#HLKqBh#Ma81E7NWm0f'U4#op3J[i!Va<[ZI9q9EGuJ! +?9rkPeZPQ%coKkm'U8;J"f:kJU7gilC5nr_`n%=9`7VtN4,=dXBr;,J:CiS,5u8VU)QXX;#>G"%8d"P7 +M4gNKV^X$rpIcC$>FZ(HY.3/Ea$\EFAoL;LmE3uoLnN9k89.eFcr +43XBq;2;Ee+LIta5q.2F6Mm&hk"h$@gWOq.L`,&u^qK0g%(nou#ZCePg/Nb!*\!k&^Qd3P?+NM:@k#?S +`7iZ.C?g"WQbp3:CfnBZ!R^rs(ge4oS#VZk^_/J1UQG(AILms:2po0RllD2:Ti]jG&64]QrHX+)Ol1s3 +aA%*q0'$2g&q!'VOM;&9,7!9;8&k<;D<#Hmk>k,i+$mu?fdE-NU^i(qg8>NeKm_o-Fs5b?Xf`$,"0Nd- +01[7)Lc`3P7Xme\krJmph)6BLGFNScdre_8Z(2Z2:8b/\$e%7p[6f5+IXJ^3*%aq[+SN=om0,BOVgC^) +f+:-X?=CX_+G's<,B&C2e'8f]]K5G1I9rJqYJlfULAU8C"0/J?q^Wh9EnPk.`>H3/5"Bg!s(,E:^p?62 +DRNlu?LmdT*a=oA2k-pFhkh\J=e@AZOX9X^2oNV30[u37O52;F.j-sM@un8GpkX#rMp+iMD?M7<@\DI: +i?(/nd%]gg+&GCM'np_EJ_f%=?RoV#%BEVpUnLu_JD%UDrHUaEakE3f'f:YEX!uR*#!<1f++rqu]rPg/ +PF7O)>YRS-);Q+#cVPX!iq^k*b3&$"S!T,;@\qRbW9k0NWRPC[LX+[J0\?o8&e0#9"""%Y<-;Vj2XIjS +%T'Tn!#BQCq/\up/`"f\Z&_l-S_e!8:Aolh1LmXtTkY/9BC'c]I<+K$F(hahBPN4[J2@MnFNQ5j$($XW +KU?)u%/],X0IZW"33V%X1d5$B71hA"<>jgjVM,PT;/@Mb0/lEU*V[):k?X>GD''$Cf[GUkbMC2](8dkS +Vb4@YTbM>OA=<%mf?%E5Q!n.&@"(@SN!J,-+R%%La]G>VgH),3YX;/`efMa:+f2JPRr^n$ln(uBD"A[o +^+F$)1Va=O4E:<49Ic$O.@AN>ecRbS-6g@AX9io$b@J$T"gB9lb^c;O%II_pQ(VVG$NNMdGd*6l98J., +@3VZ`fLZO\6V)X^_m'GD@C!"hG)@^(tO:p,,_J>T!ET>iZ[u.;;_=\Z>7=BE +Cm%aabtGn@TkHkO?O/jB,TVL)d%2UkQgjoZ^(?ZjHBX/e/!p;dX!jo2@,PnGKmV35!`[p6s +k-jkU$LNU,'iIhUQc$9OPi9n.lHI=geI=6&2aU$KVdsMY"/7%XMAT@$/J)8*&[h`^Gsg4/)M)3+.5%k$ +f'QoJCN.[ea'%/S!p^ss$CJVl..+_Ml[h$3+A?/Ph$5R:L2-0"YR[E$/$Ob_Q!>GSX^2879;9'LZnLB: +(K^pd/IJRC_7p[d>ncc]YRGW)FV,db.p*-$NUPT@AZmE$"*G:F#JL,keCe=IC>m"R+(L<@a+H"8oQCIMYMe\sS$6Ha6Cc3]b9mUhcY\^+Z/dr1J +m$&\tl8K8Q&=!QpNh''V.iqNGRfh(lDG&TP)Zifu0kgtEGoO_WJkU0?4osXn+Oi&G";^3PBT>>IW[O6Q +MFNBe)(D8%B)"hN<^jj]!Hs"S[\hGWPsa(+ZlaBRDr>LfKU0i\!63Ho!^GrK_RI=/jAPg>>9E[U;A6(l +SF.WRmqY8!L2J=.!.I(KrNZ3Uct^fmo&K.rYEH!&;p&:\0=8#>,.&7<5,(5fr.PK7LsT&F!YrmBUoGX^ +[.:GW5DWUM#DR\WYr%F[&92_sBI_PH,&Y'?<%9\S5d;=p.l1,W#Inb.i\5RW:C7,1,XJk`M[jH>jn+A!b+ +\RiG#<,+?-go?f1UT`VOH1umcRbG9L:f:gQ5BsKQq0/Q\sXeF+K5R(>aWVY1t +5bY12:BF^nBqj8Md4+Ih(RhANaXe^fW_S.(pXi5\;HRV4Q,NgYc;bc!/!;X$2F9pJBDLH%m]0Z-W\IsO +W0=m@+_a/Qd6uF=B-XZ:*Y,H%2"O7TZ!A*.#@R` +7-lg7(=RST622[S_K?bG19_qi=>Def)ottSF +-l]Z)4HPph"s+fY+;ss+<[HL-m)>Yg?G8_\jl7S(#\RNor#M,TLSg!"JRo$G1@V79o>Ird3\H%+qJ>>- +da-uPEGsPK(p7pf?oZKX^p^sfi5b]#1fHQ>Jct`7J=qbI\\Y3KH\;*62:GFRCFdn_q_"1@mU[NsleXuj +:>,HlR\GeT:U!Lb3/?"?pt,juo%Xeo$WH`__(&U]5#E\Jh`andARh4N?J3u/R=7%QCZiq/l/ma#2TjM` +hG1Z9fHT.^'P^+:--CgN,*ol46++]k98]c&FnUFZY&#bI`B%(G>1/YEka*EYU-78M(<\8/l'fa.0QeV+ +fZ?,us4&KGSl#!/TOU7jP@58uT4XlNgfG2pftV?7Mi`,T*!OR*7^k(>P.>ND"I2%C8du8jY+ihZ9ep"8@PZb)j3&LtC%a0?N+TY[ +*oS#&A4HSW]t>B$]1Ig_EbIY]6Eol9rpmm%i>11Q5p"_3?!c4>XIV/FZnok72!f+a1m9gSb'-qnQ"G"Z +8dKI6nJu'_8Z_e=CUmKo!1ASG(An_4Hj)pIbd'D&L>X9p)+3cUlKG*?@*m:d"RXXmPC4Pp3kA=i4LZ_B +Gu7.f\@kl5G[D#uU&Z['(6nl.[-Z?Q#j^RUnJH-1(-H%LRN\[GU/a/I1+NG720o9oVhQ\4%WEf/S3$1] +lAM[!m\!A@Jm2jS94HB(>m@fP4gP]:@ucK_er=WBAKdLpp0\`(4\0]UGc5M&H'<$eERmk8pD'H,J#&$U3oZdVQ_'?jFVAn@oK +_6C!3&QPeOGr&?W9(SYc"'.418:j7m1'4+1'hB+7(&I>_Z +15o6s#\UQNg21ZP$k\V7(LPaa<-TGKHj?B`P>!kc#\Uh464;2"ci`r.'aH:-nj[d*NLGR;<#?+7*1u01 +>IEZMdD\GZMW;=c2^=EAiQmD!^Yh,83n%U+=Gd/,ep*R5ePA:e!n$aQrYc-k4D&#UB\Oi^%f;OFU/&YE +>as7=Y`A#YnT5*KqHC?RR_969pr6^k=FS>k?_Kel6sM1769PV/R]pSA6#8MKpQ6910PeK9'0abD)qY=j +e]%5.O&sk@gcJX8\%oUjG1LKb7C1JJUkgus]V[Tu_b25:23aMa? +A3(%F4:q4D0V\Cg0*kjNYLf%K&[[;pX9b7#f0,trq$b_8#Gc]t,3WpQLD<*^DhXIk[9VNcL55*-6F6l& +7k.($eNHeplL?n53?q5Q.:nnkD!M+*AM4YF4fl^_h,>`->kc>*da^KYh3tP8.25pfH__'q7bq"S`O-@N +Q2B)pV4!RP,%u;^e30Wo-rK_Dcq)\<5D16EL+jBc:Ve3ZX*[Ho=J5(2"6LJD9:=oX/[%BUch=oPmO?&"%CpKRiYT]%esmO:,?H$)oV"JtNPl+?8Q1/5+!oiMLO4XaZ]h.*7TmO8O-ESXPOQAW7D.%d^2 +1!k'h722=[?oA*_HX=&7Woe>E:RR:5Z##Omj@-MuZTZj>HUN,&W-_4J;"k[uFAN)\A_$NDd/T@6DoHQ1 +9^oLZ'"hf>4W\`A-9MGTVcu'bJ47W6VLl\!!]IFFKVosRr57+]*YA(WCd#S;TH"RLW'A=B#]I`qXK>&V +"m,C0!TDc?6LKQ\HK3*Joc/X8EsH[SKI7?`'rim3h')P4668FC1*D6_"dB[N>GX-1gH_5L'aMqD"_-3Y?8h]SeR,V6p_Z'G7fGI*n`7$sMZX,_BlR-mE,FD%l[l#`cqE6%3< +/S+J;:-E^[duiA%)Q,(tneKk9d-/rDF@D8>Q#t!Xe"(g-fr'0_:)A^G4&meL#\D!Z"T*F29ZCQG_')H6 +1!!fr2-c9M"P-+Y=o<2B!q_#C(d#EjIoYd"X/`B;KWh%36*;t=Xnq=NMGAajl>h"\+Y?+NM:5F8,9ecL,m +VRuPM6#roHU0t"1LP*D$ed\CPT[ZXo_[>=mNZr#FE\d]fe>;.u0rL[#nn\-s=og +7EkSV6X>l%qp7a,^O9(;+c[">A>t +?s9.=@,r@Q('fa*G4m2*F;OPt"uCcXmDHqe3EsNFU`SZAgC'h:J._lo['PFX],JLnQ*+j)XH/^ejSIl; +1T'cu&MBD\\FmujUfN(Pl4n)uq1]5BU1KTNgcZ(QQ.r!A]p +Me9YDAbblQY!g=_>V9IO;6!TO3GYgk]fk0oU2KE/94;`dTl"V.mT9gqDeqJH"S34]TQ-G>")j!M>9f^F +n_XJ>TW]3h!`H>?_\,@goT<'cV*0RNE_-O;:FU7u:,1KC'FMW3 +G/TrB?6]0!#_L"+Hpak/,[s)`W(ejR>Z\3f4`)5c$YjK`Z5a54GpPuHd)mtDg&O3=qZ+5Ekkm>5Wb)0W +g2`/G&JlGZMc_L_c[%_Vr1i$0/P +5./paWBKel/7d,bq?#f8i?G%=G&KQo`^5uZ*#.WkQ +%UTQV=1rsk<]F4raYKD"75h=inb2C*BHl%4-NM):aB!jm[E)Fi2@)X$cXgp;-\ItD=9O'KhZ5GL)&38p +3OPt^G9%q30=V!u%s-7Cn/5!.mkCH0h1c7-m(Be\m!X#Y'r5,oaJ^4.aBA<09db6M5]X:V((>JF+os4t +#7Mbj(O7#4]qIT7Ld?gM8A/kM:[lIB8Ynl&Q'_7OW@$C3[>[c!o:(k>6-pTR3r0%hS?T1LBV]BTRl'hF ++@K2'aYI9<;i!t(&?7uQ/)n.SaX*ajU(AaF)Q[5$U*>8TV,j&_q1]Jb+OQ&fCfHfgE9#bD=X#UGU\_d; +,#GiY!YPmkE5dC1$l+'f\:^VX<]%f66r]R$c-\_.C\2?3Cg1MrP>q04)gRat][Qp.n(eQo3&*bKhCc]n +d8GB_d,nIJXG#ct"r-K]!L^i"=r(Z"An8:<>*?!52H$Lt7T-8eh2I:"@Y-+Ck>HhelNlE*kM[U=frb"- +mGUhW7KA@+DD@$R\R4qC^W7](n]VqM]Np/:$?cc;D9`0+"Jl:qCW?W"0V9Gm$K=&V`"5qdM>55P_DSiq +=_$dg_CA3DEDOXsXCW/8)(&`*XH5A&K$0CB+])7ZVj.jKpYKl$bc`,^G23?BN,jYR4PJGW?hC9]?\\@8 +lhE_3s!ud*3hQ[molZqa6.C="l+CI(j/*=lmpmE#fH'.XiR[@hi6lH0$R(MPaVpknLQ.i4n`t=/TPJS# +n/g_\B=54$]pu,p-/*rqj:1(/`,=DnZu4^^1k_^0r/ip+YW3AN\Hg1(0OmF\:t"B3*ZUM?7DI(B;ent0 +FjuM>FIPA7$Dp>#:_l("(JpU;ENi7FN[&i-X-IWIYm&/Wo\_\?JW?^sjo7T!B^nNifKsc0UW(90_(EMb3RMfFF"UW(=a*EA@@U_*YrSDAjOImM$;3Wdd$2BY\;+r5R( +43\>QFE*)L:M1gaEi6N(6>PJM8SA+UNml6pJN-pag^L`D$Z`gD`*JO;=2#j;:1GAa#S2qgJL-&P*`:W< +p`%$RdERJ`U8,ceGZp.^:g23jQeggLGb1cCVZBKH9Zn39Rn\Oq8TWt!g:EHESbTc,N_#Nk;U2O>4T/gP<0-l9in&rA\h0o3FC]s3)E./'+nnAIUZM,;KjP)6l +ag%8=bHYDaQufn,h:hC@pY^[F?!cLW*C2G">GO?H@VnbUYS_d9@oO"4NtP],-$(23`3aI4;a8osOTIch +b/$`PN!+eCkRhgbhYUeDa[3@eT**3,^9Fm"^lEl[,)(2_"o[\.Q\$SUVhHcOcPb%#@Np6h98&q_^T-l>?C[QG;C>DBEL]l3%8q"@u9OZ57LOc>1TgibE#Y;8];;#k-"qE[4ja:k=a +UcXne_0iONPT5QSgFWU1/^c?RE[g?=2>r,#h7QKlA]qsK88!)H`A=#*H:C!1fg*;A4tolJ:\!Uo<>s[Y +"Xa^,X?48c7m7Z-m0PogS)4fD='?\aM!7DnX3D2G5-&8H)t0P+1&J+0S8M`u+.:4_":i?22JCd;],"6tAMA9[-[b;O-7a5#fBQ +%cs%I<+Tc(LZf2RG]+,q:B?+"A[!hbB`Wc:puc&FP-qfN@14kGAtdb+8-_F +N?T7q<*$+g2;(KRX(.P,>m`WO4M=p9nW?T0@6kEbO.a2(2mT?LWj'^%&duZM\-EE!a^\q8>Ms*OSs/uU +j/O=nS+Jf]Zl1TS3PXbg=kaI@DluLl(u&jgQi7B-."3 +(I+q.4c'%u+P`TSo54FH&\I^NN#0D@LjA;@"Jif55,4Ar\:`P"]?kj<1V(rq2\),in&Wi0FtLmu)DK64 +p^IX)*Ut'ie*?[LK=,D>Om4_@kS>3Nmbm)=GAtrVE,b>jGAo8p(EF?>&1s9=[q"Rgi8+eb]9CMb1,t\i +/M_/"^Xs\S_99]qq[U@CJkfi\0Sek$2F_?8"`448kJ +DHR#4klB[;,bB/q'>6oiHK?CTP`G-gOCI>p77aJFcTun6;[?0CY:3oKh2BN)g=H[Al_`WX.CrX^Kt#Zn +0QZk-.FYA#XRLR/.gm +,S=QU0-/h?X4[uW9oBKjh5<]HZ6-;F&%u<6.D6jUY-^CL&FSK!q+T"Oo&Cc"R5]_f+h(YBmP!:\:]b:Q +LIKW]:nC];En^g,@4J8&"`*i'7WYl1]b9DkQp9qER(99`hrmr/_&ZcJ3!G3&#i6-e^`sqH+G,5]#WfKG +2.Pag%OeLH"D%5Q0Mas>>]\W>%c!]TjT>i"Xs*3oo9"sP5]Q'N!*#)jZ^M\="KF3k0G=O7n+Qe3CocSd7niq_/4Q#<+H$i=9`H(@p#;cZBc_i9"p^G<36g +E!J=K24ZeXQlS/]j0[Wh;uTo&FEl_&/j!ms.,AFAa.,UB&IN2Q!kmo.AJ.c/&!m*F,:SrGW"nfSC%*K?^'^1;8'W +*S`cig2HM84A_=E:.RJsd-R$TlD!G*!SPW[4=o^/4]ItCY)'qE:^L@PWH=.LD&h/@LE;DpG!QP +X>E5:AQNsS&O]^S03TrE;hM`WlQYtoA(kOul"Sl4,pBo[-uI/NX)QWGM'&&6(=6eV8\p?0"`*kl96GQ$ +[d47&kfUkd\t6pd`=D8`ZX/_3%>Z^M>`fnM5m0bnICp_.BBN`\HjGpPAJgCL4/C/f4-8lm0YNc8=AAU: +4@SMd6:Nomdm+lF9mX'*M`ge+AK_mR;elb)@>dA$+"X#k(;t'q<1F>-_,::Md3_M8J:KO\nfr'&)cO#g +L"]e2+CuS6KZ&Pu^Y(b,F!F_16PA">'J0`%+)*G/8/`4)8 +Q8:#\`.8V`N#T7`''m5$$t\rZrG#nke^+^9aloSF&eUU6*"33`#Ug12RR`DDH=of"Xt>jHPA:N8!_e>3 +XS8(%asC2H&@\!oRge4A<-R?3&=MM7rF'eJOhX+eG(e"W\YaXA[8+ZrYaT^$QM/JZF4RjjKg_C4/[n0,Cn92;$l`pQA^hiN!VW#Xos*m%gB90n1CM +0_.Ea&17)]@W5I30#bEh6N#$*HGXY73q +_WCPuE2`HmqC>4[rPQU\,DRSBBRU<"o*5/j(Y$#U-1XL.&asFqDgLrN"VIM.Z=#Vs+P5sD%^$mA$)r!V +7Q94O)WVfBX*N.tS+:RQ>DbK'RqWG/;Msb4Q(en2QW'*Bq]0\03?Wu_nkhOST;=GEL7;kdB9'`l>A57i +#1%(]c9YnX43t_TZ<[grS$TGKoT-gmYk++&HENMoV-6)F3sQ>`9LP9(VC6mZK]ufr:3W<2L$?`;nrN%X +l1@&C\LO(,T'jlK,ah["bs&_BA>52Hjb +HOG\Qh4%FAq!OEbTdfD9\VTlYMF`:`&%hS7kOi5,WCRaK6oC +ZG>7.38>pKQnX4E&J2LZAB,D!I.<.10Y1Q/gUe%/JiJB0>%jr[WprO-J*"Kj=2![>SBR0AFtkdU!JiC2Q(%!WUrKZU/Wd2+6BV@jJB +fZ<6T*ju._=4d_1QqCYu[kuo?deb=_0U;9GDta_a\^dK];b4[c'dFiIHc=Me6_Y#K!]#Wgo+e]$0"9[i +CuqZ*.KX&0!(,X5t#!f4JH0U86qY:M>n40*J4,_[IZ_K%O-W8Ag2E=\*m&3!2>#UCi%9Xb@) +/i"J&8^ZW6n+7lZg]l'aL6A@rP*kd0`%N4Z9i +!;[+/$NlQ]VG4uiJuj9,g'&Y6*J"lFI+llpZ1kK(Ge9Nej4N_**li_jpMkBNGb870U#uT!*`,'*G>ATi +.:e5!_J-k>F[X:k%EuKr%X&''-K>BmhYFM^kL_lpcsK$(m<2BjA$^6@c^"=g;S'XBaH,*>publBYM\O+ +s7YJ+J+N?:J,WCGpu=SfV!id+msf_Gs+eAfn%J%DE-TP"5,:M\'P3&$Qp28(r5ToZHq+%c+9*--D2nG +~> +endstream +endobj +7 0 obj + 15148 +endobj +8 0 obj + << + /Length 9 0 R + /Subtype /Image + /SMask 10 0 R + /Width 333 + /Height 333 + /ColorSpace /DeviceRGB + /BitsPerComponent 8 + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gb"0W95Y\=*li7@AJP;Y@B%e9J./aT-+&NFDDnI2(^%=$c]F]K`"^rI06@M+?oG@\,U$`3&R_c8kpBt1 ++o>,tIs"a-^E4/AbXAP8WidH@_1(1s!rr<$zzzzzzzzzzzzzzzzzzzzz!057ARnr5/qL#\20CR?>?2ZF +s=-Dll2$fE?)rGE5&6@+oht[V`UoX1[gKWPc#I'IGf88rQKjT52-,<>Th@X_GP*VT@IO+7sRIejVG",O +chL+n-h>gR?nrrghN3fU6Y<"oT)7M*Im(+E`V]S+/]5CauS<61kWngG=0o;Q.hY:E>5`5s'EM8P%F-)D +IYpgJ?^/lZ.b^20U._\t2d%J*Zh01\b._aL^clcWni]S27(#SU7LiR4^7;7gG?S8ofI_k]f+Hso;QbOqNfAe*3tWNU@pQFSN?5>]mYSAFgf':8ia1A:,hKcb2,3 +bZB)Q]K!(BJQ0l3LHdj![p/^FiW;:i1'(`+K92>Dhg-W0mA_PjIL%VMD(,`[C54oeVQ8dNcW>`D@C])T"J.,:jjE +iI0]YM+4\+ej@;T-Z_skMMN%bG#b5U1gBJthFXli'W4s)t6fIMSD@"0c@H2_)k'q]".dXV +lRMXEo?Mnuff+2U,]j>`(%OXXsO.#X2D`=W$HT1hkQ$0L_hF:+BKQ#=f@Lbn=/p8gN0CYo`ku6(+I!os +rr6F!'l2;s\Ru96*5-47L^8tT_j2;pGP.Yq6^3aEsD.e&MT=nMXf5$j[=6_iU2jNa8q4.2jp9jH@Qp++369#XIM$X1Np%'r@ZKXaF(10n&T_EAkRhl +FNp%'r@ZKXaF(10n&T_EAkRhlFNp%'r@ZKXaF(10n&T_EAkRhlFNp%'r@ZKXaF(10n&T_EAkRhlFNp%' +r@ZKYHIf@lE1h%qoK1sMJf891dKIFbYiU\+MGY6.pTnk_Ao:M%F9%*:-2I[0bT&8CN%nI]%g!.RW&LQW +G_8Vm>hD6qT;JsoolTkg9NohB\BqQ)H8B1pdM+^tp7/oU$]`6%[!/N89"#9IBS?gGA99Bso,\%R% +"OnuR"F*O$B]I(.Wo@6U;n#d)^<+h8JR);#_IJDn%&I!P0ebO).k4%]i:ERg`?>_+Od09H^rjc;&2bIN +h^T%B6e!T#m#P^e[n[EOJNc:ejr\"%^F7J3Jh[T><+7H8uRsZ_!F82RNnD7N9j7E#;J">)%j,J80LcKi +DIB.E1l2'hDZSphX"C%[NC*_s2-nWuX:tM1OMq2+eOoPDUbRl1e.=/F%4Ua82DEW`;P[4$u!)B)/rqMu +J>S;35FI>jfAb,O3Is+3c-L]]%B"@`lnormsX'JZmJI8_C=F5R]`_C`ig0Bl7bUP`#*T:-\qi\,7@u!! +uB?ZOep.S=uI^)VcL%B6PUV9+_n\U[!^/+.lmB&q(WW#=qEL1TE^PE:LTIYYduTHV+9S4MSR(oWQtCO7MfZ^o0uaDKJZ*phhhe'<1OIRbM/:$6X^Db!-ahml7K +\N*-%'W4oTZWT[>O!5/*<>^,"?b?6eI(?b(Gh!s2W!+N[Uq4mJ:=D)Q_JfTZijBnPRmb(B](_jtt3h7l +=Mp'::h[LH_am-unpu?_42*t=IGrD/Rq)k:WQE:)K+tr)$WW'T0a9->idZWdIkIo;_)Tpuli^rU>*%oOE7jNkA$PWHMX +($rdu#/BdmY1jmO5P&5F*eV=V:F.+tIMg!pIbX\,m3_bNmcuPiA@%!91_oV +jK4=:(Y=maF70G9>H"3Mtu/pidAgfZ"Eq +eaDu9[[0c3)k?lBls4"/:@0\d1Qudp%!#KEoR&)VlaF8u*[4N/k-eS$9<\3D)rG$O8X(kmO;^d@=-Ka! +F,'pPWrHA3q$/dL1&QrRQD8qpGG@-j9.*EC^$15EprC]3]@t&[D^UnVOcNSb_jMhu(*!PhG?3XMb@)!U +qb;(H)gf*,!f!lSt^=5P)k'sMalLa,qc3sn85R%HqKODQ`CU:PG/^sVpl/g*Tq:!A_'H3=%3K!W\rC(@ +J4'kD#I<1ak?"@3l0A`nPg+pie>dk5PW&DduKGE*3[0>>3?2Z#B/n82uBl5s;3AL9PBae8`(]A*MXkFg +&2ENE)MALmDnA>c?CX[:I%?Jso[1a6na*Ud&MMlp@f&lC\Q/-`\f/c]ZlJOM]e*5AdO2Tg4mnpJA0)F+ +#>8>%!HB]4KVRMo+a(`bE+'72t\1cAoO!1na0)F+%iIL[)CnID9EdO/%QlH(\_"4>6)a9aC`C7Pq.^]" +Gc+$`b]3;s=\NMi(9TRH/hUT*oVljEIdBBtc:JOZ4h/#8R52Yc\k0p=*%r,>jj.2N^.ofjHX/f"1pR<] +2//@+)0jN0K!h])8]"$s*aMZOI);1C,\a\JD&pJ4R%tNP_CKXp7X*_@b\#T8:$`j\Ua*Up)DI&Yn.GOm +#&D;E@;L=N/SFSXLm>HmOoo<.&jgiuLGAPaG]+L<&Gn>@!"0:FU?`N-eaDC2O9?YR2TuEP&f`U2]-J0" +KrDF`KWRmq)hO5?^bW5J7%e#UtV@>0SV)s2`:VX1m?9oK/beO&CT=TX]7r70-1)VXti1aQ_lAOL,fnZ_ +t1c:MbkM!E&_C:s7-8eX(kIF-uN(p5!+ZJhE^OcV%F09BiNFa(\kCZ;E>kH4faiR-Q*/;+FqY'NurUpe +3Y4u6Q%*:[C+k5GE?i"qNadr-QpW/dfbP&r_@eV;8lJNkUZf)r[ff1tf<$3nSH[JHa#,Pe +691lT(XMT"'Gr`).rMi%>[s5$3@*CX@Nn]XM+/TL-lC=8CkcPmH*>!9K&s%\38'K[0?=tB62t(T50h8" +T+r3Kabj'S'!D6Ijl(q%k*0#]0=9ratX0[8MRJ0*.Q,`Fk`#ObA7-q/3iS,JQkOr=trY++Pb3"oE`#Ob +A6u9&105V9"F8p!a?qT0r35cer>XWD3AhS"_Wj=)\j576bQ&aTdLcHBaMn._'#hE-cO6Z(3M:rj9]ZlY +-UCf4^X>A2;pV'f!]p5(SUCf4^YHr[K]7\kXPtJ4O?;Y0l7`8Q@?Zk#mTmoX`U%V@d@ZEprgpg_/]H^G +BR7kInoe*m;c:UX&%.3cJ:WIbIuQaP?pJJTg$.JklEO@\+`]l +oZXe90.EA%*'r&Z#U7lOmp7^g'DA)@0(S+a?MY1?'mR%#8]2TF;$#S;&5K)IPJoBmO`qWHG>=rRKODJ" +EdGPkO-)U/)5j'XQXm,P9OK48W@g2+)Hj.I7uO\2Zr.lSCYh$0gb8uau/+0es[EGuL-W@g%[U)?;BDc`cF2kp\OXWH;GddRaCj4*<:g[dR0GjiHeZ(LOT)O:\D28 +/AVYbs$`-s30rhX(bN!DbI[GCF?X#@8um^7WjHB8c"D0'X34A_bZ9g5"4S +9"fcA&OkdEK8"s[M6MmR6_Y"F+Sg3hJE[5J.dAl+-VJET`FVqk3dN,G-F@k[rgl_SgeC,Je8B%hX`TXF +J];PookXT?h?0Z/+T?rWn60EMIEV0D#.2UAZT>1603_:T6iM\3q@pV4-gJs_T[k.S+TTRPR]G?86-FBT +-^YMX/U39lNDK5FZK(`A9_I# +Is\->AKJDc*cDi\H^L1u0IA*gfPeZ%aMN.BTcCXo(UTun8fR/hgP`_g5ls$j4%\g(TiS,E]">\ap*(]j +N5BJASSdo(Ak850pk/a<3Q_#_q(!W1U;=-1ZVMhAhg(p'(\Q##/Sb;l6P(o]N*3>Fu'@5B%;,@FlJqVj +&-0nNlIb/.E,*bXCcb^B;+AcU\1KND[h%"NQea$IW`(b%3M7$!9/d3I\enK?Wfzzzzzzzzzzzzzzzzzz +zzzzzzzzzJ11@<1PAht~> +endstream +endobj +9 0 obj + 5448 +endobj +10 0 obj + << + /Length 11 0 R + /Subtype /Image + /Width 333 + /Height 333 + /BitsPerComponent 8 + /ColorSpace /DeviceGray + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gb"/lH[ni@rkR-R1Dn+K#0e8.6V56;%='4[)u$pCMVD.0'I@[=o9LIrMKDR,4:6:'P7"">7!6&iV0%tm +rA;f]`[f:fH-G=8HhLY?^"5;lT/6@!F*p4PfOoWahKuAc3G5P/p=a:*"98E%zzzzzzzzzzzzz!!!"L[D +_g-phKM;X',H"e$lhm1WSal]nj"Q_rINJY+CiQIVtWHbl1X\f?c7TH_](sQQ0'h]8G@NFG"]6 +LgNklbi1ST)\jleJYA"5J.@)4)>0mWMTI-h/R^>]N:#h6*j8lu^Gta5qR%Y-#BZG0hPUol@[Up9Mt@RI +@^m?$eTrW6F_dY-+nF46i!@k]VAk-.uFhSD3_E'p*,Q+O`YBVM0Oo$NZY2!\u>1A6K8[Zk/=5+X#6#5c +06c9FClh(;cA_ie+4O5J'/i'n*E!I+CU[U\=;O]J0;Z;arP.V5C+rmqTi/J0d#?IN5Ng6Er__W<&%8]L +O'ToLosZ%JhZdba8+lhf^X=l:.=]K->;OJs`7>p92^?U_r[JeF%MT7PWKP.q>"F_(oL@XK:7)AY-%LkN +K%)/QD)M=WJu+,DV`eDFPtnrRB2NC,uH&Am],8[oB&2eJ4b^l>Q86j_j>FA9-@H=4'%,1=)o)go61U;T +2\:@O]GrFm9-&#V'B]gY#ar-_\]LA%TjqoGR,/n-Hs<1.*mZiN/s%b%td)"eC;ro8 +;gOjfb]:;Ut3-Wa^0%6VV5aVTShC]iB.aHIF9@Oe^WkW_ftkH[`/E[lmTGfLF=FHe;\"B;!H?GE[)!d) +tp#TR]c0Z4L5Y,H,a.lR5,_mf1%1MiM2W6iIk6s:t<"\.= +E>o[s`-Z.&eTc72Y!jf9jb^a&u\4JID5"&n^Ls00tUISG([#Ba;Lh5pjZ0!+]7=aKuM?Bd"VJ69qE%J4 +p=OR2,iZ/HfTf#fs@aOD,j\dm?>"F'S>o!gGND,`]`ZnWUa:V/dR530VNli%@b! +i8QJW@m#<&eZHb)CN7:\3bl_HA*_-Am#mAq$b)deOJ)dlEna4%\U7%>9]dR4*N:,;)W8bGS;K@>ZJ$#d +r@0112"!okF!mWi/B:7@6c%g2<_$"D*k@pJk_*>H!,c-PIYAX'mN!D=DdY?hX,IS#Xf")Y!UeJal#?u+I7I +6Rp]WFj"[2%s)SXfR7&UIsD.dFTC>C3nLW8"0KMp[9*f]hsY)jRfM@>]m8DpX96HoB.FYObc%TCmTV^A +fE8f#u'uXIc2YZ!ub$'6cOZEW:.=4>,Se*O0A2_7Zfgk:c>lhm%'5H3`9d$VYXNK?D^1%&22YEf +>'>87I?lUF]nP[!0>OrBlMPB",b01]P5Ye&>+l1H1/0ipm:S=+`rU^8u[VW&\?9X1eD+W4q0UF57FGb+ +P8!^q]OC:%(/JVF]sF=Z>V@i[2%t%B&@OI&rpX\@t_dA:'$%bpR'..^MJj%s +>;fcPT!2a^)L4DGb"RaS``6.T[#3N7=A#RGRlcBK6aGf/u<):&A36_J8m`:hK:b@c[)O=b=a8&W2i[ia +/>#e?%Qc%a8PW]o#LEZSM?P/4!fIr\Xg+Y=V4m;'ndT^#US8RE)=!GnSE.1AR_.6"KZt_8lZQ5!;l5HQ +;Pj'_W!mCam[CAfdS/-]#uXk(R'O`'V:9[c4E;t8+6mahmk84pZLJ +Kr@>@otqDQB$KBXLt/Prkr`6:m;2RQo3A]fr;.`p\5?7kg@/iWC']K&uJna'm/=5el&8l7u=gl7eNtDK +msKnt[>%PfEBO4i(+V($"-\QGFphLFn^1.s\[tVA,<8?.>t#Bcn(sUqA_d>tf?aGWVEZ359Jf$WrgOp[66W:$mQWF]b:KtEA)DkKL8t*l[;YIPaLkFn*b0tu:^A\;1RLAH-Q +RsoZQWmEOhCEXrdk'1`)('Irl#qLUM:HKeoK'htGt`S*LGg'%5tH4)dG3)I +W8X5Q+/NZCit:.1bsXgMb78-Y05)$OfL]U9fG'e!mq3f(6*3-#j/[A9pHpIDd[N>R*^[Vcs5hb,%W1TP'k\tN!:H$1EO[&n;@g.6Bp_YrQ^o[Zd2^3iXXY99C +bZp0cV7`G,In^kCel*&7rT7QngRGRJ5T.^Lc)Las7Xo*rF/q&T4j@PBj0o6c+F@Obm\s8pdO/=_/fL`t +]CbGWA#ELEs5$*_1#a5a,@HHV/:uTsDj0./&c6N$%u+_-'-f=]@RS_U2ngG5<8JI9oQW#4Su>]oMrJ9n +N$:KHRTl4/\-4:hAorfu8G+AX*!!q&gKE4_XXZT$M-HR48bZJRQ@DQa(2$N3>=0r)8N+D(RSTIpnRkB:=;` +U33EM;,F>a\ITQ0CB%^.mj"MI+ag*2(AX^6n)k=lZ+=f<%/1PK/oEek.ASKp6OfcI%BlDjoInj3;_[EU +ALn8K#T+#k)?Odp=)(b=iPH%XD:&)lChF\rZo-5T';CLa\\T$1dnn1qRdQ1@MfsP0#tV:,&ta+u5QOJ* +D#V1/jPbAQ_\R4%>U]`r)PPS)h6@aG`>#Wlri1jG4Bp';]d*"[td2%%1H#5"9&g7uT9m;.$>XS:i&lQ$ +*3[6ZU+gIAFtQ[r,,&$,cS-2r#IK9W?Jbiaf%qlN6-=VnESa_CpBP5c.k"i6PX-+HAn4,P'MQ-;>her9 +S-=/h\]pZ%5TKb^du/pR6'3`b6\%O=AQU*J8@#5AJc@!1@Yk#h:$3Onks8d]0peh.[ufR*5Q%k"fUR"r +NXI>VWaC54?S=Fd2WgK=?9.V%YZRHsPS>Ut@#"Ca&*uM&l#4m-i7RH?\*[)cgLn(t#VD4Mh+!!!%O?"L +"-Ch`.5s,i6qTIBu!*.r4n;o2D)P`baW.FCtoQ7AhQ0+b\U$6`iFGNLBkbb8YZ^ELF0q07GYE+X4-tpe +CD`r19%":4QopO,iM\P\]If)+>XjNRHrDd#+jD&WT=&(gZ@@hE;jd:Tjt9qY\&pITpFbaS&@VM8po2u":%>u]b`:"$IrU"ogKCl3nEKQE\`1"g4f +#6A=FAK2FfX?BV9:qCe=-Dn-O5IDO]i#JTDV0u&B2RZkdpY'B8d;LUHZt3ocPrCbW'%qW$T=Q/4]IGo= +ZgH6WLnZ'<4eh,CE3]N=d'eWFAJM?cHNFMIg?$W&fMDEDfT.6'0c_]V\QqY`O6+5"aeNG`pVjIr&I6^V +r#rq4$%?8%L"/[;/F4M_2-2=eo):f-GFfYne;f(V7hIdOQ[eP#Ntg,7>md%"(f1TTHO3(fsK[Z&u4U&= +HPf>Xb82BZ`\QpAS@QB7Q^U,"Kao3$Rt.j7o7/HC9D,`?"*)K>_UB'>C$sTM3>R75BKFQ?e(XljE[5rB +N8pEELm$RF6utj+GN#LZF=N4a"C-2KUXE0\/Zi_dGn,u:psAa;m$m`p8Jg6 +S-WaQP94,;HZOoN`n#Sm(lNY=o=,-@_n`LJ#SMATHS_QX2&WSmLDTPDS,i*ZlpCSTIEbH\%*oFa0M5mh +@NMV?Te&W>0/uTC"2FOa$WGYPG:'koEt`1mkr1_n;GYW;>CQ$Tf#irdfXF5+K9d2#+QbIRboZh\9Umlk +7sRPZo +=6#n)69&eflIsfCPIQ]^)'X%\DC6P*d1ODnY)D1a +7";F?$Brdc[m"h`Mq3Lr/=YUo8i31.aJqj)*Q__(p4jGs:5pn?)U,]@CUoES_fn"2skXj\&JN@se??8X +bD6QA`1>r;n!7CakpCTTt@pLL0($cUfu?KgO6.PY$W0%+`L)-Ka!TPPGVRhT_KG1GX4ocQHRU4>@h<8K +(:WUnUT4**OLaT&W0gP=/^kAWfGicL8jbas@#CK/>@HMg=g'cPMgAAH*uO^N4@/kG6%ldSOHuF?eW)*P +\SdSbuS@=q1DMHZ%-Bf-_p5dE$,W*C\Rna/QC5R9mj4;eV2U$^i[>T*dD*-'<>m>P"?+MSDi4>;V=[B# +Uij?@9k#bAU9iP1IHOSG7081(eCCPL9!YT?<5=*]P9G_foNk>,+Q0OG[C*meDD5\( ++2d3J"Q=+6$4u14/%L^1!?"D>5l)`Ab#tYPb6K6EV\5E&W(E82<_1nm4qt`T7- +T-Fj)`A,9_=!YlA^snq4oiEcgH%39Jf-W.&N-;W^,h>S1mG`?"U`/lc$s]T7np3<>@Q$Fsc7Xf$uOedu +fGj2KRs_r0^eoHJiXfgU!(#;QUlZ5B],["$$>-ZG-_ej)s5>0ASidN^he!liVs3[E#qkJc@i4F6_saZi +>Fns4q#6SM#*)F]FBKRj/`Od\P[62tK^T*Ah+q9YjlnY2A@=7m%;VI2khrWDE#QdKJ]L7VApN\2t&"`; +_XP.C4f.]$4,0F*f8k$h]X+6M%'s9_EX3CM#2k).IRfCU7#r],%A)7)&GqCm(H]-4SdLHLk0^VT(T1_@.na"ESFc1k;p@9d&=hhLrPsjzzzzzzz +zzzzzzzzzz!!(.RrrZ-4)hS~> +endstream +endobj +11 0 obj + 6262 +endobj +12 0 obj + << + /Length 13 0 R + /Subtype /Image + /SMask 14 0 R + /Width 48 + /Height 48 + /ColorSpace /DeviceRGB + /BitsPerComponent 8 + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gb!Sm@;k0K%.0\Bk=Ia@MZK#be[-&hjfb;m5\QTCCfbZ*TrK1Q#S5\b4hJ>^VW69B!-;/rtq9pJ6(:lpt")&QMAFj195Z_i)nn^!r10U&@p/-^-@l"/IsZjK'nrBEQE?4 +s#tKnBs-fe%$-C,hpa6"*9lPiCC`@D?QT,c0*trkQ-Tq0KS5(G@.pmLBN_">:0-9Bqa^$U,(e_X= +kgb]qa5[-lFeG'taWQK`$0q>6?9'ct#BW:.a]*RQSBn?1%=+;.O1(lD4YqDkj&=;'F'QBLPVgtU8N4X^ +'RsAjVC>80U#J-Z/(E^HgUNSO2>T4XbG7qTP*8Ds5)!]254b3Sog@[Gn&3KV]U*J,F=jU@TdAF>OQ_:, +]b+NnRB4LU$?A<6`QWBHm8=pao%r9?cdc#HHeL?S#Xe/L'tHT9H8#m*SU.j4\=_-RI`K/LGfKQKoFi][ +&3>/Tqbc=Xf=#dA.W1#sX&j=-9nulk8ueR?h\H+6a14,d2sb:=o9[A(1h4;P&Jrd=)+h/GR?5I?#VP4. +Wpr_]`$n.J]j6P&R* +endstream +endobj +13 0 obj + 1127 +endobj +14 0 obj + << + /Length 15 0 R + /Subtype /Image + /Width 48 + /Height 48 + /BitsPerComponent 8 + /ColorSpace /DeviceGray + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gatn%>t>Z,'Z][DD/*csj[X'i(2[4mMb.Jg&P=Gq@9?rA.Nq5&U.G,W7Ss[b)/+n@.V5<\fqMrmp44-L ++r4kuq+ulLWGAPMX(uLr^RI@KhJpj#Vbsp +N<5u8N,q,X(]"Zc\RaG^i0I;(?lZStD0b\7d[fncBGFl2*L!Pf\Gq/+K;b.raJ&2Ccq%^T?IS^ZjOua, +PB=MCBi6Ct,+UC+3N;Yi1_ob#_)&'N7i-jhY;?9d^66W;>]Bm&EG`LcqCO29g-M+Ws-n2X)?=C;.>W![ +"bLMh3YYc(Xk-mlms]:\3'=sM0jl9aLX/m7dAZ+>YJN:V>0]2(3NOs+-PNrEH[M5uERGQjTs!\B/5X@` +N^W,>-qTARb0g>C/,3tfRXGh3#*_gO2e06M(:d;'k&o6*Z"'0`b[.kpakOm\T?)suC[4>8e8E,,jT>&X +^4[8A)"eYE5).l5Z[C7G?_Wq63'cZA@^B%jEI5_#6X*q>32aA*'V<9-#t(!2Sbca3dK*aZB%^i7RkOUeNJ +>27jECF]OeD1:(!n@b*Zqulr1DY"u21'=t_]"E.iW"LFe=A`kk]=L\P85*J?0R#aGcVmur>8#7e,FTW2 +@ulA`T6_4Y2^(tq782(PZDF"*QF7ao@OVNQ6&lbCT\BZgT(ki+%Cf$h$1V_]>,i+,S'!CTLT=jVong$MoG,R&HEiB5D:G`4GHpZhTrj-ODLfs([*u,!3LLC=jVFm=?cY4i3A'A)`(B_i.UGP@.5SRJl+B* +2kAr]C`ha;"9s0"\>)7R!`$i-llMHKqe0u*9/n$M4/,&X?g1qC*FlV~> +endstream +endobj +15 0 obj + 947 +endobj +16 0 obj + << + /Length 17 0 R + /Subtype /Image + /SMask 18 0 R + /Width 41 + /Height 48 + /ColorSpace /DeviceRGB + /BitsPerComponent 8 + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gb"0;!=]#/!5bE':MgUI'EA+5!!)p9(D$QI~> +endstream +endobj +17 0 obj + 37 +endobj +18 0 obj + << + /Length 19 0 R + /Subtype /Image + /Width 41 + /Height 48 + /BitsPerComponent 8 + /ColorSpace /DeviceGray + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gar8O(d('VYhP]sFgqAMs'J-H_IB1Ls$(c7/"?T;pg8l^_B=rO#L%i91/@cIs1&;!APrn,EZt%ZeJls,hjJDM;0k^O?DfFmnf!#i#c*r6M]qA8rWiY2D`U3a +W[%pB)A&$S5bR5R!'M(^2-%e,.V/2=8EWBliXNR=8i/Bir?>E-6V%E*(SQ#$FbRSRXg@hn,J`t1'ZP2ImT$DJbLB[fF_8['!QW5_[U.$T!JUj +3NCB/!\+/qs8R3a.:\]G:lXsG<0..7`rm+ZdejFZqXJ_9$=ZgTQHjEQ>k0EYTj)?n5FCq#,I#5lj:(,R +;o`n_8bB\Q:dc-\MuGpN;s8pu+kqPl<^7W(6Fbq1r;Qdr=SDdh$`L'9TE"?[MV.k,0CSrcZGPZ%+.0p& +s(>l8$?KDMmhm;V%F1L&h0]D8g8rSiKIKSSZWJ1kH6tc?bVY':$35jie\;~> +endstream +endobj +19 0 obj + 546 +endobj +20 0 obj + << + /Length 21 0 R + /Subtype /Image + /SMask 22 0 R + /Width 48 + /Height 48 + /ColorSpace /DeviceRGB + /BitsPerComponent 8 + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gb"/g95_U#&;I_u0@HDP;psQH)d\@m@l"Hi7^E@EN'I6-q8]8X@(0[/ +-t9>A4V_N^*aU,?f+B8BO,aF:WQlP(UjtS4bWR0Z4?(KjgYoZ%?f17K=C?bmp3@kQ<*hP@_0HZUlSB`L +IU6h(Y2Id>@Z2U2l/Cc^OsaP"M$0!%q6\?iXs08uD`3tA4Vf]jnq3+GdjTK>BXJuK7"9I\)i]@Q)'0^+-Tl'BFQm^&LD2j+ZVmSH4>?D%\lIu(%n+UT +JE#O\R'Pam6bkM*-!j`VKiZ09#I\&,'%#WQZ)-MIYAHADOceY340X>7Y6++mB\!R)G1GHDDlQtUB],(X +CmD-_:9U\UN?1E<*q6P`iSriY_>4ki?K7Rta0an4hKV391A?)uO*!@=1Aa,qR6%O%Y%7A19)NjjkFRR$ +\2Ag'f3OjoC)pZpXOi\!K3cBD!4PuMkP~> +endstream +endobj +21 0 obj + 682 +endobj +22 0 obj + << + /Length 23 0 R + /Subtype /Image + /Width 48 + /Height 48 + /BitsPerComponent 8 + /ColorSpace /DeviceGray + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gar8O(gOj*""S?+V>f(rXPa=9p&>io?ieIMj&A5DS*6*QW1MC&P(CGGPCZ$AJgg;Cs3EJLs80gZo]Emp +1$T5)c".HtF,#s"pJVr5\/u2?"@uG:GjW*]8a>dEefr4!!cfQs#6k$TGm4IRY(e`>Tr;=@=WG_YI0'mZ +X?s.h,:R:%o\U;1U-2"s?jB^kk]pWY(^U&Uj_T%S(^!h=08bl?jZLT`5f$;mW"9>;JCB/jf^nb^>jD?] +T7@)M_!+-)nVC#f(hc0tHADOh85_*dIP+4Wd/[VJb!IAQ2uIlT,k[V`cB.00?<5M(1BE[X,:L)W&Z&gu +c#*`GC\IuLI3]g8IQ]n[0cB=QG! +_lBSsC*4pVnUtk\LBGuq2$4pg4YLfTR5/,8h#/FVW.KOU3<]bQfnjkb>larDr'd"~> +endstream +endobj +23 0 obj + 471 +endobj +24 0 obj + << + /Length 25 0 R + /Subtype /Image + /SMask 26 0 R + /Width 48 + /Height 48 + /ColorSpace /DeviceRGB + /BitsPerComponent 8 + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gb"0Q#uD=K('j?\$of5aaPh[oQbrk3"8%O,,"/1cTIqX4"`sn_KjeT'PZ=C9_%fcX'biYc-n*)K2BgQs +]"YQ"C5/*N\4!AXZ'!MXr; +6uUUa`S];mlYGk(L"6`lEqoV[!8)&MU[d +8JiD)bEl^<'S_B%9V%WTWuD>;V\[`4)0bHMgU:Pn4:bNrGQdLd^iJYk9g+Na\`U$#'U +PkK7c0JsS0r")r3@Q`W.(`%i57B<%fRC0F:?j:g+NfDL-Ie]-&UZ:(\!dG4EPfiS8i$X'Pi*!Y2_aV5u +mo,gqeTnU0am:o?q%nl63uceTa+OS#]peJm=Fh%r.$\74#a1r +m"gIXd*SM\6[^B('3a1J[=!:%P9c-)J3U90/&9@>nJl+'T6KhlANWBUA3F1ib2FcLG[tQHM\fl0*p2N; +*\oi`4ctj[jjP7^E7;g=&!,mB;<`6KgQIP`d3Zms#.t%_%Ibk5WFe;K\pO.UYF0paTnUZWL?Cbr$Ycj_ +e'aWZ+g8hjAe!dWM0\&';^@^ePt2et%6@:n+b6U'03U=Tf,-8U3P[6\;;GVC%:))'W'"UqM?2<1b+M*3 +=5>l!gR`a_%i`NY3\qFJ;S%.p,g5;qJqJ!Q\=qZT"s]d.!LI*&kP9ge1lmF\^5HOF-RU_%6fNr_-J^Rmc6X-f)Lr33Y7g.?VV-3aFIVoffJM-c +?lP^u>o?9r#^?RC,%.Oq;o'MI!E9'A!Q-u^(FO0H[_1Zu[[A!;"Ym%Ppl:/d>8&C8CMAoA/d#&iC/#'Q +0l"I*g,(=feU)G^oN@G'PKZl).GE%c'U(m5]/5;rGp_/+^BWlH8V2q;[HFF\^s&GKf%p-"WlAa-hmrtmM_+HObZ8J.QH_$V)65g6@WGV+9I8r_WH[Lo +OPedp(NR8mAg2&>SqK_u<_O=JU`keRmBjkgbGsV(SXp)kF4VMZfg;c(k\I-/ +hfrJqCetiHc^oL'%5cfq2RH5d[+Zt=>.F:kgte%C(?=uPa,AC7q'Y!e9g$TP]dGm'?;X5=4[or4Tco3a +jO"m^el>:h`Y6I=DG5gQAh[."?EKe]V!Qd-ZItd;Noc5M1Fo^VT$SC%=cLUf;i["'h)F,W^[:9KN1U/R +O6=[/mtI;Qmoi$K$^k*69KqcF,WM7:a-H-:#d/t,b67/9E+%1BPVj>/gr"V/maLNE7Mjf-4j"(6HJ3(I +[56LuA:LH2p.`'b'lqUUHG>i(-+>[u:9pq\hq-U+HG2j%4S^fK@)$KIp3opOo$q1FkTNC_]SD;c/Tt6MSU&o+Co&&:q'Tl_55d6+jT.RN9-ZS` +eI/8C*iA'1(?Cn,?HIu5o[VB=-Wj.sQ\Wf54C>aUQ4nk0tI#OiZZG1THVu+4Is:1)L*5t>ArUHAY]>JP]!;JjAJW;P+;;fG9\C=&IAu@U9P+NJ3HB]Ep +"BTq(*VN["\+1rj;2=]t&uGu$ST7k8/^bo>S)j^0*'bp&_1USEo +endstream +endobj +25 0 obj + 2723 +endobj +26 0 obj + << + /Length 27 0 R + /Subtype /Image + /Width 48 + /Height 48 + /BitsPerComponent 8 + /ColorSpace /DeviceGray + /Filter [/ASCII85Decode /FlateDecode] + >> +stream +Gar8O(^2_t4C)%;"^02@^$fksk@2B(>lWa^s8OtqEhLKn\,Q:)s)jGX1PYJ;O8hN(BsnS9SB6&\i;['e +W5^NIYPo%9^Qp=S_*kWd_aGRo$8ZbkcouooE$M +P7?GQL64hPpBj+GcaU@XbJWoZ&?puDXT!rIorfleEihc-ZTKJAHJr_"/-5m&hsBV8=6IRO;HP1bf4.\W +n*HPG#>'k`$"O384uW"VV.fC./$FIG*h3"c*^&(T1GGb4`)Q_HOpqXKok]@udF-$q1Xd#%0FL6m+DJ;K +7TTLtCJ00j:?+VuaS6hS#?1TulC;*0;/AON!)*Ij;k^&MVZXUEl<&sb'Ypl5E!E*XPea*a)\)m"_WLII +I69[s.=pF_N1A#k,t1!G$&jr\8r<[0K5i.;!,D5OQ2~> +endstream +endobj +27 0 obj + 611 +endobj +3 0 obj + << + /Parent null + /Type /Pages + /MediaBox [0.0000 0.0000 628.00 773.00] + /Resources 28 0 R + /Kids [5 0 R] + /Count 1 + >> +endobj +29 0 obj + [/PDF /Text /ImageC] +endobj +30 0 obj + << + /Img0 8 0 R + /Img0Mask 10 0 R + /Img1 12 0 R + /Img1Mask 14 0 R + /Img2 16 0 R + /Img2Mask 18 0 R + /Img3 20 0 R + /Img3Mask 22 0 R + /Img4 24 0 R + /Img4Mask 26 0 R + >> +endobj +31 0 obj + << + /S /Transparency + /CS /DeviceRGB + /I true + /K false + >> +endobj +32 0 obj + << + /Alpha1 + << + /ca 1.0000 + /CA 1.0000 + /BM /Normal + /AIS false + >> + >> +endobj +28 0 obj + << + /ProcSet 29 0 R + /XObject 30 0 R + /ExtGState 32 0 R + >> +endobj +xref +0 33 +0000000000 65535 f +0000000015 00000 n +0000000315 00000 n +0000037304 00000 n +0000000445 00000 n +0000000521 00000 n +0000000609 00000 n +0000015867 00000 n +0000015891 00000 n +0000021581 00000 n +0000021604 00000 n +0000028091 00000 n +0000028115 00000 n +0000029484 00000 n +0000029508 00000 n +0000030678 00000 n +0000030701 00000 n +0000030980 00000 n +0000031002 00000 n +0000031771 00000 n +0000031794 00000 n +0000032718 00000 n +0000032741 00000 n +0000033435 00000 n +0000033458 00000 n +0000036423 00000 n +0000036447 00000 n +0000037281 00000 n +0000037998 00000 n +0000037475 00000 n +0000037515 00000 n +0000037753 00000 n +0000037855 00000 n +trailer +<< + /Size 33 + /Root 2 0 R + /Info 1 0 R +>> +startxref +38095 +%%EOF diff --git a/x.6-isac-intro/misp.pdf b/x.6-isac-intro/misp.pdf new file mode 100644 index 0000000..f7a3f9d Binary files /dev/null and b/x.6-isac-intro/misp.pdf differ diff --git a/x.6-isac-intro/misplogo.pdf b/x.6-isac-intro/misplogo.pdf new file mode 100644 index 0000000..60da568 Binary files /dev/null and b/x.6-isac-intro/misplogo.pdf differ diff --git a/x.6-isac-intro/normaltag.png b/x.6-isac-intro/normaltag.png new file mode 100644 index 0000000..781182c Binary files /dev/null and b/x.6-isac-intro/normaltag.png differ diff --git a/x.6-isac-intro/pmf.png b/x.6-isac-intro/pmf.png new file mode 100644 index 0000000..be198a0 Binary files /dev/null and b/x.6-isac-intro/pmf.png differ diff --git a/x.6-isac-intro/screenshots/Sightings1.PNG b/x.6-isac-intro/screenshots/Sightings1.PNG new file mode 100644 index 0000000..5546cf3 Binary files /dev/null and b/x.6-isac-intro/screenshots/Sightings1.PNG differ diff --git a/x.6-isac-intro/screenshots/Sightings2.PNG b/x.6-isac-intro/screenshots/Sightings2.PNG new file mode 100644 index 0000000..cd35990 Binary files /dev/null and b/x.6-isac-intro/screenshots/Sightings2.PNG differ diff --git a/x.6-isac-intro/screenshots/dashboard-live.png b/x.6-isac-intro/screenshots/dashboard-live.png new file mode 100644 index 0000000..9eef8be Binary files /dev/null and b/x.6-isac-intro/screenshots/dashboard-live.png differ diff --git a/x.6-isac-intro/screenshots/dashboard-trendings.png b/x.6-isac-intro/screenshots/dashboard-trendings.png new file mode 100644 index 0000000..e8937e4 Binary files /dev/null and b/x.6-isac-intro/screenshots/dashboard-trendings.png differ diff --git a/x.6-isac-intro/screenshots/enrichment1.PNG b/x.6-isac-intro/screenshots/enrichment1.PNG new file mode 100644 index 0000000..4e7df5d Binary files /dev/null and b/x.6-isac-intro/screenshots/enrichment1.PNG differ diff --git a/x.6-isac-intro/screenshots/enrichment2.PNG b/x.6-isac-intro/screenshots/enrichment2.PNG new file mode 100644 index 0000000..5d1c4c4 Binary files /dev/null and b/x.6-isac-intro/screenshots/enrichment2.PNG differ diff --git a/x.6-isac-intro/screenshots/enrichment3.PNG b/x.6-isac-intro/screenshots/enrichment3.PNG new file mode 100644 index 0000000..e785f2c Binary files /dev/null and b/x.6-isac-intro/screenshots/enrichment3.PNG differ diff --git a/x.6-isac-intro/screenshots/enrichment4.PNG b/x.6-isac-intro/screenshots/enrichment4.PNG new file mode 100644 index 0000000..5f01cd9 Binary files /dev/null and b/x.6-isac-intro/screenshots/enrichment4.PNG differ diff --git a/x.6-isac-intro/screenshots/false-positive.png b/x.6-isac-intro/screenshots/false-positive.png new file mode 100644 index 0000000..7dd3dea Binary files /dev/null and b/x.6-isac-intro/screenshots/false-positive.png differ diff --git a/x.6-isac-intro/screenshots/freetext1.PNG b/x.6-isac-intro/screenshots/freetext1.PNG new file mode 100644 index 0000000..cb17c4c Binary files /dev/null and b/x.6-isac-intro/screenshots/freetext1.PNG differ diff --git a/x.6-isac-intro/screenshots/freetxt2.PNG b/x.6-isac-intro/screenshots/freetxt2.PNG new file mode 100644 index 0000000..4bfb092 Binary files /dev/null and b/x.6-isac-intro/screenshots/freetxt2.PNG differ diff --git a/x.6-isac-intro/screenshots/freetxt3.PNG b/x.6-isac-intro/screenshots/freetxt3.PNG new file mode 100644 index 0000000..6d348ee Binary files /dev/null and b/x.6-isac-intro/screenshots/freetxt3.PNG differ diff --git a/x.6-isac-intro/screenshots/normaltag.png b/x.6-isac-intro/screenshots/normaltag.png new file mode 100644 index 0000000..781182c Binary files /dev/null and b/x.6-isac-intro/screenshots/normaltag.png differ diff --git a/x.6-isac-intro/screenshots/power-responsibility.png b/x.6-isac-intro/screenshots/power-responsibility.png new file mode 100644 index 0000000..697909c Binary files /dev/null and b/x.6-isac-intro/screenshots/power-responsibility.png differ diff --git a/x.6-isac-intro/screenshots/sharing.jpeg b/x.6-isac-intro/screenshots/sharing.jpeg new file mode 100644 index 0000000..3296d43 Binary files /dev/null and b/x.6-isac-intro/screenshots/sharing.jpeg differ diff --git a/x.6-isac-intro/shakyfoundation.jpeg b/x.6-isac-intro/shakyfoundation.jpeg new file mode 100644 index 0000000..efa2d59 Binary files /dev/null and b/x.6-isac-intro/shakyfoundation.jpeg differ diff --git a/x.6-isac-intro/slide.tex b/x.6-isac-intro/slide.tex new file mode 100644 index 0000000..91f3d30 --- /dev/null +++ b/x.6-isac-intro/slide.tex @@ -0,0 +1,26 @@ +\documentclass{beamer} +\usetheme[numbering=progressbar]{focus} +\definecolor{main}{RGB}{47, 161, 219} +\definecolor{textcolor}{RGB}{128, 128, 128} +\definecolor{background}{RGB}{240, 247, 255} + + +\usepackage[utf8]{inputenc} +\usepackage{tikz} +\usepackage{listings} +\usetikzlibrary{positioning} +\usetikzlibrary{shapes,arrows} +%\usepackage[T1]{fontenc} +%\usepackage[scaled]{beramono} + +\author{Team CIRCL \\ \emph{TLP:WHITE}} +\title{MISP for ISACs} +\subtitle{A quick introduction into informationsharing via MISP for ISACs} +\institute{} +\titlegraphic{\includegraphics[scale=0.85]{misp.pdf}} +\date{\input{../includes/location.txt}} + +\begin{document} +\include{content} +\end{document} + diff --git a/x.6-isac-intro/tag-osint.png b/x.6-isac-intro/tag-osint.png new file mode 100644 index 0000000..9675cab Binary files /dev/null and b/x.6-isac-intro/tag-osint.png differ diff --git a/x.6-isac-intro/tags24.png b/x.6-isac-intro/tags24.png new file mode 100644 index 0000000..9b1d331 Binary files /dev/null and b/x.6-isac-intro/tags24.png differ diff --git a/x.6-isac-intro/tagspush.png b/x.6-isac-intro/tagspush.png new file mode 100644 index 0000000..b5f063e Binary files /dev/null and b/x.6-isac-intro/tagspush.png differ diff --git a/x.6-isac-intro/test.txt b/x.6-isac-intro/test.txt new file mode 100644 index 0000000..6b5cc59 --- /dev/null +++ b/x.6-isac-intro/test.txt @@ -0,0 +1,45 @@ + +Model of governance +- Dictatorship instead of democracy +- Gathering ideas, issues, use-cases, code from the community is key, listen to them but reserve the right to veto + - Prevents malevolent community members from blocking the process / imposing tunnel-visioned ideas +- Don't wait for the perfect implementation, start small extend it later +- If the idea doesn't seem suitable for the above, shelf it as soon as possible + +Development process based on failures +- Any idea needs real-world validation +- Be willing to throw away features that "sure seemed like a good idea at the time" +- Failures can often be used to pinpoint better alternatives +- Format follows the implementation (code is law) + +PMF model + +On the flip-side, the dangers of sticking to theoretical format development for too long +- The same mistakes will be made anyway +- Piling mistakes on shaky foundation will be more difficult to undo later + - technical reasons + - sunk cost fallacy + +Designing a standard with sharing in mind (how not to do it) +- Originally the sharing aspects were quite limited (private flag) + - If I want to keep it within my organisation, simply set the flag + - If not set any organisation can see it on the instance +- Utterly simplistic, only worked on communities using a hosted MISP + +Designing a standard with sharing in mind (how to be a minimalist) +- Needed to be extended once communities started self-hosting MISP to be able to control the distance of the data-flow +- Distirbution levels + - Organisation only (private) + - Community + - Connected community + - All + +Designing a standard with sharing in mind (going all out) +- Still not covering all use cases, certain types of users wanting more granularity + - Sharing groups (distribution lists) + - Complex system for persistent and special ad-hoc use-cases +- Next step: Multiple sharing groups/nested sharing groups + + + +